CVE-2019-16276: High severity Golang Go vulnerability
As announced by Go upstream on 2019-09-25: net/http (through net/textproto) used to accept and normalize invalid HTTP/1.1 headers with a space before the colon, in violation of RFC 7230. If a Go server is used behind an uncommon reverse proxy that accepts and forwards but doesn't normalize such invalid headers, the reverse proxy and the server can interpret the headers differently. This can lead to filter bypasses or request smuggling, the latter if requests from separate clients are multiplexed onto the same upstream connection by the proxy. Such invalid headers are now rejected by Go servers, and passed without normalization to Go client applications
Reference: https://github.com/golang/go/issues/34540
Other sources
Go before 1.12.10 and 1.13.x before 1.13.1 allow HTTP Request Smuggling.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/Goto a version that resolves this vulnerability.Fixed in 1.13.1 - Upgrade
Upgrade
redhat/Goto a version that resolves this vulnerability.Fixed in 1.12.10 - Upgrade
Upgrade
alpine/goto a version that resolves this vulnerability.Fixed in 1.12.10-r0 - Upgrade
Upgrade
alpine/goto a version that resolves this vulnerability.Fixed in 1.13.1-r0
Event History
Frequently Asked Questions
What is CVE-2019-16276?
CVE-2019-16276 is a vulnerability in Go before 1.12.10 and 1.13.x before 1.13.1 that allows HTTP Request Smuggling.
What is the severity of CVE-2019-16276?
The severity of CVE-2019-16276 is high with a CVSS score of 7.5.
Which software versions are affected by CVE-2019-16276?
Go versions before 1.12.10 and 1.13.x before 1.13.1 are affected by CVE-2019-16276.
How can I fix CVE-2019-16276?
To fix CVE-2019-16276, update to Go version 1.12.10 or 1.13.1.
Where can I find more information about CVE-2019-16276?
You can find more information about CVE-2019-16276 at the following references: [Link 1](https://github.com/golang/go/issues/34540), [Link 2](https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1755971), [Link 3](https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1755970).