9.1
Critique
CVE-2025-22871 The net/http package improperly accepts a bare LF as a line terminator in chunked data chunk-size lines
Description
The net/http package improperly accepts a bare LF as a line terminator in chunked data chunk-size lines. This can permit request smuggling if a net/http server is used in conjunction with a server that incorrectly accepts a bare LF as part of a chunk-ext.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| net/http/internal 1.24 | 1.24.0-0 → < 1.24.2 | 1.24.2 |
| net/http/internal 1.23 | premières → < 1.23.8 | 1.23.8 |
| SENTRON 7KT PAC1261 Data Manager 2.1 | premières → < 2.1.0 | 2.1.0 |
Références
- go.dev go.dev
- go.dev go.dev
- groups.google.com groups.google.com
- pkg.go.dev pkg.go.dev
Chronologie
- Publiée
- Dernière modification