CVE-2022-1705

Improper sanitization of Transfer-Encoding headers in net/http

Medium · published August 9, 2022

CVSS v3.1
6.5
EPSS
1%
Percentile
73.1
In the wild
Unconfirmed
What it is

Acceptance of some invalid Transfer-Encoding headers in the HTTP/1 client in net/http before Go 1.17.12 and Go 1.18.4 allows HTTP request smuggling if combined with an intermediate server that also improperly fails to reject the header as invalid.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.01447 · 73.1th percentile
Published
2022-08-09T20:16Z
EPSS history
Timeline
  • 09 AUG 20:16Z
    Improper sanitization of Transfer-Encoding headers in net/http
    cvelistv5