When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when doing this.

https://groups.google.com/g/golang-announce/c/Y2uBTVKjBQk/m/cs6qIK5BAAJ announces the release of Go versions 1.24.2 and 1.23.8, including a security fix for: net/http: request smuggling through invalid chunked data

The net/http package accepted data in the chunked transfer encoding containing an invalid chunk-size line terminated by a bare LF. When used in conjunction with a server or proxy which incorrectly interprets a bare LF in a chunk extension as part of the extension, this could permit request smuggling.

The net/http package now rejects chunk-size lines containing a bare LF.

Thanks to Jeppe Bonde Weikop for reporting this issue.

This is CVE-2025-22871 and Go issue https://go.dev/issue/71988. -- -Alan Coopersmith- alan.coopersmith () oracle com Oracle Solaris Engineering - https://blogs.oracle.com/solaris

Security Fix(es): golang: net/http, x/net/http2: rapid stream resets can cause excessive work (CVE-2023-39325) HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) (CVE-2023-44487)For more details about the security issue(s), including the impact, a CVSSscore, acknowledgments, and other related information, refer to the CVE page(s)listed in the References section.