Skip to content
fr Sign in
9.1 Critical

CVE-2025-22871 The net/http package improperly accepts a bare LF as a line terminator in chunked data chunk-size lines

Description

The net/http package improperly accepts a bare LF as a line terminator in chunked data chunk-size lines. This can permit request smuggling if a net/http server is used in conjunction with a server that incorrectly accepts a bare LF as part of a chunk-ext.

Affected products and versions

Product Affected versions Fixed in
net/http/internal 1.24 1.24.0-0 → < 1.24.2 1.24.2
net/http/internal 1.23 earliest → < 1.23.8 1.23.8
SENTRON 7KT PAC1261 Data Manager 2.1 earliest → < 2.1.0 2.1.0

References

Timeline

  1. Published
  2. Last modified

Other CVEs of net/http/internal

The 2 CVEs of net/http/internal →
CVE-2023-39326 A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read… Not rated
Track this CVE