The net/http library in net/http/transfer.go in Go before 1.4.3 does not properly parse HTTP headers, which allows remote attackers to conduct HTTP request smuggling attacks via a request that contains Content-Length and Transfer-Encoding header fields.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade go | Sep 20, 2017 | Aug 14, 2015 |
| Centos_linux | — | Upgrade golang-docsUpgrade golang-binUpgrade golang-testsUpgrade golangUpgrade golang-miscUpgrade golang-src | Oct 19, 2017 | Aug 24, 2015 |
| Freebsd | — | Upgrade goUpgrade go14 | Dec 10, 2025 | Aug 25, 2015 |
| Redhat_linux | — | Upgrade golang-docsUpgrade golangUpgrade golang-srcUpgrade golang-miscUpgrade golang-testsUpgrade golang-bin | Oct 21, 2016 | Aug 24, 2015 |
| Suse | — | Upgrade go-docUpgrade go-debuginfoUpgrade go-debugsourceUpgrade go | Jul 28, 2016 | Aug 24, 2015 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub