REDHAT-BUG-2358493: Medium severity golang/net vulnerability

Published Apr 8, 2025

Updated

The net/http package improperly accepts a bare LF as a line terminator in chunked data chunk-size lines. This can permit request smuggling if a net/http server is used in conjunction with a server that incorrectly accepts a bare LF as part of a chunk-ext.

Affected Software

1 affected component

golang/net

Event History

Apr 8, 2025

Data Sourced

via Red Hat·09:01 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of REDHAT-BUG-2358493?

The severity of REDHAT-BUG-2358493 is critical due to the potential for request smuggling.

How do I fix REDHAT-BUG-2358493?

To fix REDHAT-BUG-2358493, update your version of the net/http package to the latest version that addresses this vulnerability.

What are the potential impacts of REDHAT-BUG-2358493?

The potential impacts of REDHAT-BUG-2358493 include unauthorized access and manipulation of data through request smuggling attacks.

Who is affected by REDHAT-BUG-2358493?

Users of applications that utilize the net/http package in conjunction with improperly configured servers are affected by REDHAT-BUG-2358493.

What is request smuggling in the context of REDHAT-BUG-2358493?

In the context of REDHAT-BUG-2358493, request smuggling refers to the ability to alter the intended processing of requests between two servers due to improper line terminator handling.