CVE-2019-16276
published 2019-09-30CVE-2019-16276: Go before 1.12.10 and 1.13.x before 1.13.1 allow HTTP Request Smuggling.
PriorityP346high7.5CVSS 3.1
AVNACLPRNUINSUCNIHAN
EPSS
5.30%
91.7th percentile
Go before 1.12.10 and 1.13.x before 1.13.1 allow HTTP Request Smuggling.
Affected
16 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| golang | go | < 1.12.10 | 1.12.10 |
| golang | go | >= 1.13 < 1.13.1 | 1.13.1 |
| msrc | azl3_python-tensorboard_2.11.0-3_on_azure_linux_3.0 | — | — |
| msrc | azl3_python-tensorboard_2.16.2-2_on_azure_linux_3.0 | — | — |
| msrc | azure_linux_3.0_arm | — | — |
| msrc | azure_linux_3.0_x64 | — | — |
| opensuse | leap | — | — |
| opensuse | leap | — | — |
| redhat | developer_tools | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux_eus | — | — |
| redhat | openshift_container_platform | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:P/A:N
osv7.5HIGH
vendor_msrc7.5HIGH
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-xv7j-jr8q-mhmm: Go before 1
ghsa_unreviewed·2022-05-24
CVE-2019-16276 [HIGH] CWE-444 GHSA-xv7j-jr8q-mhmm: Go before 1
Go before 1.12.10 and 1.13.x before 1.13.1 allow HTTP Request Smuggling.
OSV
Request smuggling due to accepting invalid headers in net/http via net/textproto
osv·2022-05-23
CVE-2019-16276 Request smuggling due to accepting invalid headers in net/http via net/textproto
Request smuggling due to accepting invalid headers in net/http via net/textproto
net/http (through net/textproto) used to accept and normalize invalid HTTP/1.1 headers with a space before the colon, in violation of RFC 7230.
If a Go server is used behind an uncommon reverse proxy that accepts and forwards but doesn't normalize such invalid headers, the reverse proxy and the server can interpret the headers differently. This can lead to filter bypasses or request smuggling, the latter if requests from separate clients are multiplexed onto the same upstream connection by the proxy. Such invalid headers are now rejected by Go servers, and passed without normalization to Go client applications.
OSV
CVE-2019-16276: Go before 1
osv·2019-09-30·CVSS 7.5
CVE-2019-16276 [HIGH] CVE-2019-16276: Go before 1
Go before 1.12.10 and 1.13.x before 1.13.1 allow HTTP Request Smuggling.
Red Hat
golang: HTTP/1.1 headers with a space before the colon leads to filter bypass or request smuggling
vendor_redhat·2019-09-25·CVSS 7.5
CVE-2019-16276 [HIGH] CWE-444 golang: HTTP/1.1 headers with a space before the colon leads to filter bypass or request smuggling
golang: HTTP/1.1 headers with a space before the colon leads to filter bypass or request smuggling
Go before 1.12.10 and 1.13.x before 1.13.1 allow HTTP Request Smuggling.
It was discovered that net/http (through net/textproto) in golang does not correctly interpret HTTP requests where an HTTP header contains spaces before the colon. This could be abused by an attacker to smuggle HTTP requests when a proxy or a firewall is placed behind a server implemented in Go or to filter bypasses depending on the specific network configuration.
Statement: * This issue affects the versions of golang as shipped with Red Hat Enterprise Linux 7, however it was deprecated in Red Hat Enterprise Linux 7.6 and it does not receive updates anymore. Developers are encouraged to use the Go Toolset instead, whi
Microsoft
Go before 1.12.10 and 1.13.x before 1.13.1 allow HTTP Request Smuggling.
vendor_msrc·2019-09-10·CVSS 7.5
CVE-2019-16276 [HIGH] CWE-444 Go before 1.12.10 and 1.13.x before 1.13.1 allow HTTP Request Smuggling.
Go before 1.12.10 and 1.13.x before 1.13.1 allow HTTP Request Smuggling.
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
mitre: mitre
Customer Action Required: Yes
Remediation: CBL-Mariner Releases
Referen
No detection rules found.
No public exploits indexed.
arXiv
XI Commandments of Kubernetes Security: A Systematization of Knowledge Related to Kubernetes Security Practices
arxiv_fulltext·2020-06-27
XI Commandments of Kubernetes Security: A Systematization of Knowledge Related to Kubernetes Security Practices
11 Commandments of Kubernetes Security: A Systematization of Knowledge Related to Kubernetes Security Practices
Md. Shazibul Islam Shamim
Dept. of Computer Science
Tennessee Technological University
Cookeville, TN, USA
[email protected]
Farzana Ahamed Bhuiyan
Dept. of Computer Science
Tennessee Technological University
Cookeville, TN, USA
[email protected]
Akond Rahman
Dept. of Computer Science
Tennessee Tech. University
Cookeville, TN, USA
[email protected]
## Abstract
Kubernetes is an open-source software for automating management of computerized services. Organizations, such as IBM, Capital One and Adidas use Kubernetes to deploy and manage their containers, and have reported benefits related to deployment frequency. Despite reported benefits, Kub
HackerOne
HTTP Request Smuggling Vulnerability Analysis - cURL Security Report
hackerone·2025-07-13
[MEDIUM] HTTP Request Smuggling Vulnerability Analysis - cURL Security Report
HTTP Request Smuggling Vulnerability Analysis - cURL Security Report
# HTTP Request Smuggling Vulnerability Report - cURL
## Summary:
cURL does not explicitly reject HTTP requests that contain both Transfer-Encoding and Content-Length headers, which can lead to HTTP request smuggling vulnerabilities (CWE-444) when the request passes through intermediary systems (proxies, load balancers, firewalls) that interpret these conflicting headers differently than the destination server. This inconsistent interpretation allows attackers to potentially smuggle malicious requests past security controls or cause cache poisoning attacks.
The vulnerability stems from the `http_req_set_reader()` function in `http.c` which processes Transfer-Encoding headers without validating for the presence of confli
Bugzilla
CVE-2019-16276 golang: HTTP/1.1 headers with a space before the colon leads to filter bypass or request smuggling
bugzilla·2019-09-26·CVSS 7.5
CVE-2019-16276 [HIGH] CVE-2019-16276 golang: HTTP/1.1 headers with a space before the colon leads to filter bypass or request smuggling
CVE-2019-16276 golang: HTTP/1.1 headers with a space before the colon leads to filter bypass or request smuggling
As announced by Go upstream on 2019-09-25: net/http (through net/textproto) used to accept and normalize invalid HTTP/1.1 headers with a space before the colon, in violation of RFC 7230. If a Go server is used behind an uncommon reverse proxy that accepts and forwards but doesn't normalize such invalid headers, the reverse proxy and the server can interpret the headers differently. This can lead to filter bypasses or request smuggling, the latter if requests from separate clients are multiplexed onto the same upstream connection by the proxy. Such invalid headers are now rejected by Go servers, and passed without normalization to Go client applications
Reference:
https://gith
Bugzilla
CVE-2019-16276 golang: HTTP/1.1 headers with a space before the colon leads to filter bypass or request smuggling [fedora-all]
bugzilla·2019-09-26·CVSS 7.5
CVE-2019-16276 [HIGH] CVE-2019-16276 golang: HTTP/1.1 headers with a space before the colon leads to filter bypass or request smuggling [fedora-all]
CVE-2019-16276 golang: HTTP/1.1 headers with a space before the colon leads to filter bypass or request smuggling [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOT
Bugzilla
CVE-2019-16276 golang: HTTP/1.1 headers with a space before the colon leads to filter bypass or request smuggling [epel-all]
bugzilla·2019-09-26·CVSS 7.5
CVE-2019-16276 [HIGH] CVE-2019-16276 golang: HTTP/1.1 headers with a space before the colon leads to filter bypass or request smuggling [epel-all]
CVE-2019-16276 golang: HTTP/1.1 headers with a space before the colon leads to filter bypass or request smuggling [epel-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of epel-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: t
http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00043.htmlhttp://lists.opensuse.org/opensuse-security-announce/2019-11/msg00044.htmlhttps://access.redhat.com/errata/RHSA-2020:0101https://access.redhat.com/errata/RHSA-2020:0329https://access.redhat.com/errata/RHSA-2020:0652https://github.com/golang/go/issues/34540https://groups.google.com/forum/#%21msg/golang-announce/cszieYyuL9Q/g4Z7pKaqAgAJhttps://lists.debian.org/debian-lts-announce/2021/03/msg00014.htmlhttps://lists.debian.org/debian-lts-announce/2021/03/msg00015.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LULL72EUUKIY4NWDZVJVN2LIB4MXHS5P/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/O7GMJ3VXF5RXK2C7CL66KJ6XOOTOL5BJ/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Q5MD2F7ATWSTB45ZJIPJHBAAHVRGRAKG/https://security.netapp.com/advisory/ntap-20191122-0004/http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00043.htmlhttp://lists.opensuse.org/opensuse-security-announce/2019-11/msg00044.htmlhttps://access.redhat.com/errata/RHSA-2020:0101https://access.redhat.com/errata/RHSA-2020:0329https://access.redhat.com/errata/RHSA-2020:0652https://github.com/golang/go/issues/34540https://groups.google.com/forum/#%21msg/golang-announce/cszieYyuL9Q/g4Z7pKaqAgAJhttps://lists.debian.org/debian-lts-announce/2021/03/msg00014.htmlhttps://lists.debian.org/debian-lts-announce/2021/03/msg00015.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LULL72EUUKIY4NWDZVJVN2LIB4MXHS5P/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/O7GMJ3VXF5RXK2C7CL66KJ6XOOTOL5BJ/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Q5MD2F7ATWSTB45ZJIPJHBAAHVRGRAKG/https://security.netapp.com/advisory/ntap-20191122-0004/
2019-09-30
Published