CVE-2025-22871: Request smuggling due to acceptance of invalid chunked data in net/http
Request smuggling due to acceptance of invalid chunked data in net/http
Other sources
The net/http package improperly accepts a bare LF as a line terminator in chunked data chunk-size lines. This can permit request smuggling if a net/http server is used in conjunction with a server that incorrectly accepts a bare LF as part of a chunk-ext.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-22871?
CVE-2025-22871 is rated as a medium severity vulnerability affecting the net/http package in Google Go.
How does CVE-2025-22871 impact applications?
CVE-2025-22871 can lead to request smuggling vulnerabilities if a net/http server interacts with another server that improperly handles bare LF in chunk-size lines.
How do I fix CVE-2025-22871?
To fix CVE-2025-22871, upgrade to the latest version of Google Go where the vulnerability has been addressed.
What versions of Go are affected by CVE-2025-22871?
CVE-2025-22871 affects all versions of Google Go prior to the patch for this vulnerability.
What should I do if I cannot update my Go application to address CVE-2025-22871?
If you cannot update, implement additional security measures such as using a different server implementation that properly handles request parsing.