The net/http library in net/textproto/reader.go in Go before 1.4.3 does not properly parse HTTP header keys, which allows remote attackers to conduct HTTP request smuggling attacks via a space instead of a hyphen, as demonstrated by "Content Length" instead of "Content-Length."
CVSS Details
- CVSS 3.0 Base Score: 9.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade go | Sep 20, 2017 | Aug 14, 2015 |
| Centos_linux | — | Upgrade golang-srcUpgrade golang-docsUpgrade golang-binUpgrade golangUpgrade golang-miscUpgrade golang-tests | Oct 19, 2017 | Aug 24, 2015 |
| Freebsd | — | Upgrade goUpgrade go14 | Dec 10, 2025 | Aug 25, 2015 |
| Redhat_linux | — | Upgrade golang-miscUpgrade golang-srcUpgrade golang-testsUpgrade golang-binUpgrade golang-docsUpgrade golang | Oct 21, 2016 | Aug 24, 2015 |
| Suse | — | Upgrade goUpgrade go-debuginfoUpgrade go-debugsourceUpgrade go-doc | Jul 28, 2016 | Aug 24, 2015 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub