CVE-2025-22871
CVE-2025-22871 · Request smuggling due to acceptance of invalid chunked data in net/http
This page contains facts from public vulnerability sources. Check the original advisory before updating.
This page shows selected source facts. See the linked advisories for the complete description and affected versions.
The net/http package improperly accepts a bare LF as a line terminator in chunked data chunk-size lines. This can permit request smuggling if a net/http server is used in conjunction with a server that incorrectly accepts a bare LF as part of a chunk-ext.
CVSS 9.1 · Critical · EPSS 0.8% · Fix available
- Published
- Updated
Affected products and versions
net/http/internal
- Versions
- ≥ 0, < 1.23.8: Affected (semver)
- ≥ 1.24.0-0, < 1.24.2: Affected (semver)
Update to 1.23.8; Update to 1.24.2
golang-1.19 Debian:12
- Versions
- 1.19.10-1
- 1.19.10-2
- 1.19.11-1
- 1.19.12-1
- 1.19.12-2
- 1.19.12-2~bpo11+1
- 1.19.12-2~bpo12+1
- 1.19.13-1
- 1.19.13-1~bpo11+1
- 1.19.13-1~bpo12+1
- 1.19.8-2
- 1.19.9-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.24 Debian:13
- Affected ranges
- ECOSYSTEM: < 1.24.2-1
Update to 1.24.2-1
spiral/roadrunner Packagist
- Versions
- v0.9.0
- v1.0.0
- v1.0.1
- v1.0.2
- v1.0.3
- v1.0.5
- v1.1.0
- v1.1.1
- v1.2.0
- v1.2.1
- v1.2.2
- v1.2.3
- v1.2.4
- v1.2.5
- v1.2.6
- v1.2.7
- v1.2.8
- v1.3.0
- v1.3.1
- v1.3.2
- v1.3.3
- v1.3.4
- v1.3.5
- v1.3.6
- v1.3.7
- v1.4.0
- v1.4.1
- v1.4.2
- v1.4.3
- v1.4.4
- v1.4.5
- v1.4.6
- v1.4.7
- v1.4.8
- v1.5.0
- v1.5.1
- v1.5.2
- v1.5.3
- v1.6.0
- v1.6.1
- v1.6.2
- v1.6.3
- v1.6.4
- v1.7.0
- v1.7.1
- v1.8.0
- v1.8.1
- v1.8.2
- v1.8.3
- v1.8.4
- v1.9.0
- v1.9.1
- v1.9.2
- v2.0.0
- v2.0.0-RC.1
- v2.0.0-RC.3
- v2.0.0-RC.4
- v2.0.0-alpha1
- v2.0.0-alpha10
- v2.0.0-alpha11
- v2.0.0-alpha12
- v2.0.0-alpha13
- v2.0.0-alpha14
- v2.0.0-alpha15
- v2.0.0-alpha16
- v2.0.0-alpha17
- v2.0.0-alpha18
- v2.0.0-alpha19
- v2.0.0-alpha2
- v2.0.0-alpha20
- v2.0.0-alpha21
- v2.0.0-alpha22
- v2.0.0-alpha3
- v2.0.0-alpha5
- v2.0.0-alpha6
- v2.0.0-alpha7
- v2.0.0-beta.21
- v2.0.0-beta.22
- v2.0.0-beta.24
- v2.0.0-beta11
- v2.0.0-beta12
- v2.0.0-beta13
- v2.0.0-beta19
- v2.0.1
- v2.0.2
- v2.0.2-beta.1
- v2.0.2-beta.2
- v2.0.3
- v2.0.4
- v2.1.0
- v2.1.0-beta.1
- v2.1.0-beta.2
- v2.1.0-beta.3
- v2.1.1
- v2.10.0
- v2.10.0-alpha.1
- v2.10.0-rc.1
- v2.10.0-rc.2
- v2.10.0-rc.3
- v2.10.0-rc.4
- v2.10.0-rc.5
- v2.10.0-rc.6
- v2.10.0-rc.7
- v2.10.1
- v2.10.2
- v2.10.3
- v2.10.4
- v2.10.4-rc.1
- v2.10.5
- v2.10.6
- v2.10.7
- v2.11.0
- v2.11.0-beta.1
- v2.11.0-beta.2
- v2.11.0-beta.3
- v2.11.0-rc.1
- v2.11.1
- v2.11.2
- v2.11.3
- v2.11.3-rc.1
- v2.11.4
- v2.11.4-beta.1
- v2.12.0
- v2.12.0-alpha.1
- v2.12.0-beta.1
- v2.12.0-rc.1
- v2.12.1
- v2.12.1-rc.1
- v2.12.2
- v2.12.2-alpha.1
- v2.12.2-alpha.2
- v2.12.3
- v2.2.0
- v2.2.1
- v2.3.0
- v2.3.0-beta.1
- v2.3.0-beta.2
- v2.3.0-beta.3
- v2.3.1
- v2.3.1-beta.1
- v2.3.1-beta.3
- v2.3.1-beta.4
- v2.3.1-beta.6
- v2.3.1-rc.1
- v2.3.2
- v2.4.0
- v2.4.0-alpha.1
- v2.4.0-beta.1
- v2.4.0-rc.1
- v2.4.1
- v2.5.0
- v2.5.0-alpha.1
- v2.5.0-alpha.2
- v2.5.0-beta.1
- v2.5.0-beta.2
- v2.5.0-beta.3
- v2.5.0-beta.4
- v2.5.0-rc.1
- v2.5.0-rc.2
- v2.5.1
- v2.5.2
- v2.5.3
- v2.6.0
- v2.6.0-alpha.1
- v2.6.0-alpha.2
- v2.6.0-alpha.3
- v2.6.0-alpha.4
- v2.6.0-alpha.5
- v2.6.0-beta.1
- v2.6.0-rc.1
- v2.6.1
- v2.6.2
- v2.6.3
- v2.7.0
- v2.7.0-beta.1
- v2.7.0-rc.1
- v2.7.0-rc.2
- v2.7.1
- v2.7.2
- v2.7.2-rc.1
- v2.7.2-rc.2
- v2.7.2-rc.3
- v2.7.2-rc.4
- v2.7.3
- v2.7.4
- v2.7.5
- v2.7.6
- v2.7.7
- v2.7.8
- v2.7.9
- v2.8.0
- v2.8.0-rc.1
- v2.8.0-rc.2
- v2.8.1
- v2.8.2
- v2.8.3
- v2.8.4
- v2.8.5
- v2.8.6
- v2.8.7
- v2.8.8
- v2.9.0
- v2.9.0-alpha.1
- v2.9.1
- v2.9.2
- v2.9.3
- v2.9.4
- v2023.1.0
- v2023.1.0-alpha.1
- v2023.1.0-alpha.2
- v2023.1.0-beta.1
- v2023.1.0-rc.1
- v2023.1.0-rc.2
- v2023.1.1
- v2023.1.2
- v2023.1.3
- v2023.1.4
- v2023.1.5
- v2023.2.0
- v2023.2.0-beta.1
- v2023.2.0-beta.2
- v2023.2.0-beta.3
- v2023.2.1
- v2023.2.2
- v2023.3.0
- v2023.3.0-beta.1
- v2023.3.0-beta.2
- v2023.3.0-rc.1
- v2023.3.1
- v2023.3.10
- v2023.3.11
- v2023.3.12
- v2023.3.2
- v2023.3.3
- v2023.3.4
- v2023.3.5
- v2023.3.6
- v2023.3.7
- v2023.3.8
- v2023.3.9
- v2024.1.0
- v2024.1.1
- v2024.1.2
- v2024.1.3
- v2024.1.4
- v2024.1.5
- v2024.2.0
- v2024.2.1
- v2024.3.0
- v2024.3.1
- v2024.3.2
- v2024.3.3
- v2024.3.4
- v2024.3.5
- Affected ranges
- ECOSYSTEM: < 2025.1.0
Update to 2025.1.0
golang-1.10 Ubuntu:14.04:LTS
- Versions
- 1.10.4-2ubuntu1~14.04.1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.10 Ubuntu:16.04:LTS
- Versions
- 1.10.4-2ubuntu1~16.04.1
- 1.10.4-2ubuntu1~16.04.2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.6 Ubuntu:16.04:LTS
- Versions
- 1.6-0ubuntu1
- 1.6-0ubuntu2
- 1.6-0ubuntu3
- 1.6-0ubuntu4
- 1.6-0ubuntu5
- 1.6.1-0ubuntu1
- 1.6.2-0ubuntu5~16.04
- 1.6.2-0ubuntu5~16.04.2
- 1.6.2-0ubuntu5~16.04.3
- 1.6.2-0ubuntu5~16.04.4
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.13 Ubuntu:Pro:16.04:LTS
- Versions
- 1.13.8-1ubuntu1~16.04.2
- 1.13.8-1ubuntu1~16.04.3
- 1.13.8-1ubuntu1~16.04.3+esm2
- 1.13.8-1ubuntu1~16.04.3+esm3
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.18 Ubuntu:Pro:16.04:LTS
- Versions
- 1.18.1-1ubuntu1~16.04.6
- 1.18.1-1ubuntu1~16.04.6+esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.10 Ubuntu:18.04:LTS
- Versions
- 1.10~rc1-1
- 1.10~rc1-1ubuntu1
- 1.10~rc1-2ubuntu1
- 1.10~rc2-1ubuntu1
- 1.10-1ubuntu1
- 1.10.1-1ubuntu2
- 1.10.4-2ubuntu1~18.04.1
- 1.10.4-2ubuntu1~18.04.2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.13 Ubuntu:Pro:18.04:LTS
- Versions
- 1.13.8-1ubuntu1~18.04.2
- 1.13.8-1ubuntu1~18.04.3
- 1.13.8-1ubuntu1~18.04.4
- 1.13.8-1ubuntu1~18.04.4+esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.16 Ubuntu:Pro:18.04:LTS
- Versions
- 1.16.2-0ubuntu1~18.04.2
- 1.16.2-0ubuntu1~18.04.2+esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.18 Ubuntu:Pro:18.04:LTS
- Versions
- 1.18.1-1ubuntu1~18.04.3
- 1.18.1-1ubuntu1~18.04.4
- 1.18.1-1ubuntu1~18.04.4+esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.8 Ubuntu:18.04:LTS
- Versions
- 1.8.3-2ubuntu1
- 1.8.3-2ubuntu1.18.04.1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.9 Ubuntu:18.04:LTS
- Versions
- 1.9.1-2ubuntu1
- 1.9.2-1ubuntu1
- 1.9.2-3ubuntu1
- 1.9.3-1ubuntu1
- 1.9.4-1ubuntu1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.13 Ubuntu:20.04:LTS
- Versions
- 1.13.1-1ubuntu1
- 1.13.3-1ubuntu1
- 1.13.4-1ubuntu1
- 1.13.5-1ubuntu1
- 1.13.6-1ubuntu1
- 1.13.6-2ubuntu1
- 1.13.7-1ubuntu1
- 1.13.8-1ubuntu1
- 1.13.8-1ubuntu1.1
- 1.13.8-1ubuntu1.2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.14 Ubuntu:20.04:LTS
- Versions
- 1.14~beta1-1
- 1.14~beta1-2
- 1.14~rc1-1
- 1.14-1
- 1.14.1-1
- 1.14.2-1
- 1.14.2-1ubuntu1
- 1.14.3-2ubuntu2~20.04.1
- 1.14.3-2ubuntu2~20.04.2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.16 Ubuntu:Pro:20.04:LTS
- Versions
- 1.16.2-0ubuntu1~20.04
- 1.16.2-0ubuntu1~20.04.1
- 1.16.2-0ubuntu1~20.04.1+esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.18 Ubuntu:20.04:LTS
- Versions
- 1.18.1-1ubuntu1~20.04.1
- 1.18.1-1ubuntu1~20.04.2
- 1.18.1-1ubuntu1~20.04.3
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.20 Ubuntu:20.04:LTS
- Versions
- 1.20.3-1ubuntu0.1~20.04
- 1.20.3-1ubuntu0.1~20.04.1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.21 Ubuntu:20.04:LTS
- Versions
- 1.21.1-1~ubuntu20.04.1
- 1.21.1-1~ubuntu20.04.2
- 1.21.1-1~ubuntu20.04.3
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.22 Ubuntu:20.04:LTS
- Versions
- 1.22.2-2~20.04.1
- 1.22.2-2~20.04.2
- 1.22.2-2~20.04.3
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.17 Ubuntu:22.04:LTS
- Versions
- 1.17-1ubuntu2
- 1.17.3-1ubuntu1
- 1.17.3-1ubuntu2
- 1.17.13-3ubuntu1
- 1.17.13-3ubuntu1.2
- 1.17.13-3ubuntu1.3
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.18 Ubuntu:22.04:LTS
- Versions
- 1.18~beta1-0ubuntu1
- 1.18~beta2-1ubuntu1
- 1.18~beta2-1ubuntu2
- 1.18~rc1-1ubuntu1
- 1.18-1ubuntu1
- 1.18.1-1ubuntu1
- 1.18.1-1ubuntu1.1
- 1.18.1-1ubuntu1.2
- 1.18.1-1ubuntu1.3
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
Original sources
- https://go.dev/cl/652998
- https://go.dev/issue/71988
- https://groups.google.com/g/golang-announce/c/Y2uBTVKjBQk
- https://pkg.go.dev/vuln/GO-2025-3563
- http://www.openwall.com/lists/oss-security/2025/04/04/4
- https://cert-portal.siemens.com/productcert/html/ssa-783943.html
- https://nvd.nist.gov/vuln/detail/CVE-2025-22871