The net/http library in net/textproto/reader.go in Go before 1.4.3 does not properly parse HTTP header keys, which allows remote attackers to conduct HTTP request smuggling attacks via a space instead of a hyphen, as demonstrated by "Content Length" instead of "Content-Length."
CVSS Details
- CVSS 3.0 Base Score: 9.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade go | Sep 20, 2017 | Aug 14, 2015 |
| Centos_linux | — | Upgrade golang-srcUpgrade golang-testsUpgrade golangUpgrade golang-docsUpgrade golang-binUpgrade golang-misc | Oct 19, 2017 | Aug 24, 2015 |
| Freebsd | — | Upgrade goUpgrade go14 | Dec 10, 2025 | Aug 25, 2015 |
| Redhat_linux | — | Upgrade golang-miscUpgrade golang-srcUpgrade golang-docsUpgrade golang-binUpgrade golang-testsUpgrade golang | Oct 21, 2016 | Aug 24, 2015 |
| Suse | — | Upgrade go-debugsourceUpgrade go-debuginfoUpgrade goUpgrade go-doc | Jul 28, 2016 | Aug 24, 2015 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub