CVE-2015-5741
published 2020-02-08CVE-2015-5741: The net/http library in net/http/transfer.go in Go before 1.4.3 does not properly parse HTTP headers, which allows remote attackers to conduct HTTP request…
PriorityP349critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
2.70%
84.3th percentile
The net/http library in net/http/transfer.go in Go before 1.4.3 does not properly parse HTTP headers, which allows remote attackers to conduct HTTP request smuggling attacks via a request that contains Content-Length and Transfer-Encoding header fields.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| golang | go | < 1.4.3 | 1.4.3 |
| redhat | enterprise_linux | — | — |
| redhat | openstack | — | — |
| redhat | openstack | — | — |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
osv9.8CRITICAL
vendor_redhat9.8CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-vfw2-3mm4-xq2j: The net/http library in net/http/transfer
ghsa_unreviewed·2022-05-24
CVE-2015-5741 [CRITICAL] CWE-444 GHSA-vfw2-3mm4-xq2j: The net/http library in net/http/transfer
The net/http library in net/http/transfer.go in Go before 1.4.3 does not properly parse HTTP headers, which allows remote attackers to conduct HTTP request smuggling attacks via a request that contains Content-Length and Transfer-Encoding header fields.
OSV
Request smuggling due to improper header parsing in net/http
osv·2022-01-05
CVE-2015-5739 Request smuggling due to improper header parsing in net/http
Request smuggling due to improper header parsing in net/http
HTTP headers were not properly parsed, which allows remote attackers to conduct HTTP request smuggling attacks via a request that contains Content-Length and Transfer-Encoding header fields.
OSV
CVE-2015-5741: The net/http library in net/http/transfer
osv·2020-02-08·CVSS 9.8
CVE-2015-5741 [CRITICAL] CVE-2015-5741: The net/http library in net/http/transfer
The net/http library in net/http/transfer.go in Go before 1.4.3 does not properly parse HTTP headers, which allows remote attackers to conduct HTTP request smuggling attacks via a request that contains Content-Length and Transfer-Encoding header fields.
Red Hat
golang: HTTP request smuggling in net/http library
vendor_redhat·2015-07-29·CVSS 9.8
CVE-2015-5741 [CRITICAL] CWE-444 golang: HTTP request smuggling in net/http library
golang: HTTP request smuggling in net/http library
The net/http library in net/http/transfer.go in Go before 1.4.3 does not properly parse HTTP headers, which allows remote attackers to conduct HTTP request smuggling attacks via a request that contains Content-Length and Transfer-Encoding header fields.
HTTP-request vulnerabilities have been found in the Golang net/http and net/textproto libraries. Request headers with double Content-Length fields do not generate a 400 error (the second field is ignored), and invalid fields are parsed as valid (for example, "Content Length:" with a space in the middle is accepted). A non-authenticated attacker could exploit these flaws to bypass security controls, perform web-cache poisoning, or alter the request/response map (denial of service).
Packag
No detection rules found.
No public exploits indexed.
http://lists.fedoraproject.org/pipermail/package-announce/2015-October/167997.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2015-October/168029.htmlhttp://seclists.org/oss-sec/2015/q3/237http://seclists.org/oss-sec/2015/q3/292http://seclists.org/oss-sec/2015/q3/294https://bugzilla.redhat.com/show_bug.cgi?id=1250352https://github.com/golang/go/commit/300d9a21583e7cf0149a778a0611e76ff7c6680fhttp://lists.fedoraproject.org/pipermail/package-announce/2015-October/167997.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2015-October/168029.htmlhttp://seclists.org/oss-sec/2015/q3/237http://seclists.org/oss-sec/2015/q3/292http://seclists.org/oss-sec/2015/q3/294https://bugzilla.redhat.com/show_bug.cgi?id=1250352https://github.com/golang/go/commit/300d9a21583e7cf0149a778a0611e76ff7c6680f
2020-02-08
Published