CVE-2025-22871
Request smuggling due to acceptance of invalid chunked data in net/http
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
Request smuggling due to acceptance of invalid chunked data in net/http
The net/http package improperly accepts a bare LF as a line terminator in chunked data chunk-size lines. This can permit request smuggling if a net/http server is used in conjunction with a server that incorrectly accepts a bare LF as part of a chunk-ext.
Reserved 2025-01-08 | Published 2025-04-08 | Updated 2025-04-18 | Assigner GoCWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')
Jeppe Bonde Weikop
groups.google.com/g/golang-announce/c/Y2uBTVKjBQk
Support options
