Lucene search

K
osvGoogleOSV:GO-2022-0525
HistoryJul 25, 2022 - 5:34 p.m.

Improper sanitization of Transfer-Encoding headers in net/http

2022-07-2517:34:18
Google
osv.dev
13

7.1 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

54.1%

The HTTP/1 client accepted some invalid Transfer-Encoding headers as indicating a “chunked” encoding. This could potentially allow for request smuggling, but only if combined with an intermediate server that also improperly failed to reject the header as invalid.

CPENameOperatorVersion
stdlibge1.18.0-0
stdliblt1.17.12
stdliblt1.18.4