1. Home
  2. Security Advisories
  3. Go
  4. GO-2022-0525

[GO-2022-0525] Improper sanitization of Transfer-Encoding headers in net/http

Severity Medium
Affected Packages 2
Fixed Packages 2
CVEs 1
Info Packages Vulnerabilities

The HTTP/1 client accepted some invalid Transfer-Encoding headers as indicating
a "chunked" encoding. This could potentially allow for request smuggling, but
only if combined with an intermediate server that also improperly failed to
reject the header as invalid.

Package Affected Version
pkg:golang/net/http >= 1.18.3, < 1.17.12
pkg:golang/net/http >= 1.18.3, < 1.18.4
Package Fixed Version
pkg:golang/net/http = 1.17.12
pkg:golang/net/http = 1.18.4
ID
GO-2022-0525
Severity
medium
Severity from
CVE-2022-1705
URL
https://pkg.go.dev/vuln/GO-2022-0525
Published
2022-08-12T17:19:52
(2 years ago)
Modified
2024-07-17T19:54:18
(2 months ago)
Other Advisories
Type Package URL Namespace Name / Product Version Distribution / Platform Arch Patch / Fix
Fixed pkg:golang/net/http net http = 1.17.12
Affected pkg:golang/net/http net http >= 1.18.3 < 1.17.12
Fixed pkg:golang/net/http net http = 1.18.4
Affected pkg:golang/net/http net http >= 1.18.3 < 1.18.4
# CVE Description CVSS EPSS EPSS Trend (30 days) Affected Products Weaknesses Security Advisories Exploits PoC Pubblication Date Modification Date
# CVE Description CVSS EPSS EPSS Trend (30 days) Affected Products Weaknesses Security Advisories PoC Pubblication Date Modification Date