https://seclists.org/oss-sec/2025/q2/15: CVE-2025-22871 : Go net/http: quest smuggling through invalid chunked data
Published Apr 4, 2025
·Updated
Affected Software
1 affected component
go net/http<=1.24.1, <=1.23.7
Frequently Asked Questions
1
What is the severity of CVE-2025-22871?
CVE-2025-22871 has been classified with a high severity due to its potential for request smuggling attacks.
2
How do I fix CVE-2025-22871?
To fix CVE-2025-22871, upgrade to Go version 1.24.2 or 1.23.8 which contain the security patch.
3
What vulnerabilities does CVE-2025-22871 address?
CVE-2025-22871 addresses the issue of request smuggling through invalid chunked data in the Go net/http package.
4
What versions of Go are affected by CVE-2025-22871?
CVE-2025-22871 affects versions of Go prior to 1.24.2 and 1.23.8.
5
Is there any workaround for CVE-2025-22871?
There are no recommended workarounds; the best action is to update to the patched versions of Go.