Request smuggling due to improper header parsing in net/http
HTTP headers were not properly parsed, which allows remote attackers to conduct HTTP request smuggling attacks via a request that contains Content-Length and Transfer-Encoding header fields.
01
describes (3)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2015-5741US | critical9.8 | — | ||
The net/http library in net/http/transfer.go in Go before 1.4.3 does not properly parse HTTP headers, which allows remote attackers to conduct HTTP request smuggling attacks via a… | ||||
| CVE-2015-5740US | critical9.8 | — | ||
The net/http library in net/http/transfer.go in Go before 1.4.3 does not properly parse HTTP headers, which allows remote attackers to conduct HTTP request smuggling attacks via a… | ||||
| CVE-2015-5739US | critical9.8 | — | ||
The net/http library in net/textproto/reader.go in Go before 1.4.3 does not properly parse HTTP header keys, which allows remote attackers to conduct HTTP request smuggling attacks… | ||||
02
references
External citations — patches, advisories, analysis.
- https://go.dev/cl/11772FIX
- https://go.dev/cl/11810FIX
- https://go.dev/cl/12865FIX
- https://go.dev/cl/13148FIX
- https://go.dev/issue/11930REPORT
- https://go.dev/issue/12027REPORT
- https://go.googlesource.com/go/+/117ddcb83d7f42d6aa72241240af99ded81118e9FIX
- https://go.googlesource.com/go/+/26049f6f9171d1190f3bbe05ec304845cfe6399fFIX
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan