CVE-2025-22871

Published Apr 8, 2025

Last updated 6 months ago

CVSS critical 9.1
Golang

Overview

Description
The net/http package improperly accepts a bare LF as a line terminator in chunked data chunk-size lines. This can permit request smuggling if a net/http server is used in conjunction with a server that incorrectly accepts a bare LF as part of a chunk-ext.
Source
security@golang.org
NVD status
Deferred

Risk scores

CVSS 3.1

Type
Secondary
Base score
9.1
Impact score
5.2
Exploitability score
3.9
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Severity
CRITICAL

Social media

Hype score
Not currently trending

  1. 🚨New #JabraDirect Version has been published - Addresses several vulnerabilities: CVE-2025-22871, CVE-2024-24790, CVE-2023-24531, CVE-2023-29827 https://t.co/FkTFszhXoi https://t.co/EqIYH67uN5

    @andresbohren

    27 May 2026

    124 Impressions

    1 Retweet

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  2. ⚠️Múltiples vulnerabilidades en RedHat Linux ❗CVE-2025-49796 ❗CVE-2025-49794 ❗CVE-2025-22871 ➡️Más info: https://t.co/zcO9bsmYd2 https://t.co/urrvBrzzwY

    @CERTpy

    12 Aug 2025

    88 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  3. ⚠ CVE-2025-22870 & CVE-2025-22871: Golang vulnerabilities in Mageia Linux allow HTTP request smuggling & IPv6 proxy bypass. 🔐 Patch now (golang-1.23.8-1.mga9) or risk exploitation. Details: https://t.co/0btEeFH2vH #Golang #ZeroD

    @Cezar_H_Linux

    3 Jun 2025

    54 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  4. syftでSBOM作ってgrypeで脆弱性を出力してるのだけど、脆弱性があるファイルを出力できないのかな。 go-moduleに含まれるstdlibでCVE-2025-22871のCriticalが検出されたのはわかったけど、何を更新すれば良いのか。 curlでダウンロードしたコマンドを片っ端から更新してくしかないのかな。。。

    @jay34986

    21 Apr 2025

    45 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  5. 🔴 Traefik, HTTP Request Smuggling, #CVE-2025-22871 (Critical) https://t.co/B621YFEwAq

    @dailycve

    19 Apr 2025

    5 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  6. 🚨 Lambda Watchdog detected a new UNKNOWN severity CVE 🚨 CVE-2025-22871 was detected in the latest AWS Lambda image scan affecting the stdlib package in 25 images. Check the full report 👉 https://t.co/6EUGaPyRZk #AWS #Lambda #CVE #CloudSecurity #Serverless

    @LambdaWatchdog

    9 Apr 2025

    6 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  7. CVE-2025-22871 The net/http package improperly accepts a bare LF as a line terminator in chunked data chunk-size lines. This can permit request smuggling if a net/http server is use… https://t.co/CrlIiBnrcD

    @CVEnew

    9 Apr 2025

    41 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  8. New post from https://t.co/uXvPWJy6tj (CVE-2025-22871 | Google Go 1.23/1.24 net-http request smuggling) has been published on https://t.co/SFZDdM8H8V

    @WolfgangSesin

    2 Apr 2025

    12 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  9. 🎊 Go 1.24.2 and 1.23.8 are released! 🔐 Security: Includes a security fix for net/http (CVE-2025-22871). 📣 Announcement: https://t.co/ZvslQsqZmB 📦 Download: https://t.co/SO9mNulAfF #golang https://t.co/gZrxjFKfEB

    @golang

    1 Apr 2025

    22073 Impressions

    131 Retweets

    521 Likes

    26 Bookmarks

    5 Replies

    7 Quotes

Related CVEs

  1. During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed handshake may succeed when it should have failed. This may happen when a user calls Config.Clone and mutates the returned Config, or uses Config.GetConfigForClient. This can cause a client to resume a session with a server that it would not have resumed with during the initial handshake, or cause a server to resume a session with a client that it would not have resumed with during the initial handshake.•CVE-2025-68121
  2. It was possible to improperly access the parent directory of an os.Root by opening a filename ending in "../". For example, Root.Open("../") would open the parent directory of the Root. This escape only permits opening the parent directory itself, not ancestors of the parent or files contained within the parent.•CVE-2025-22873
  3. Downloading and building modules with malicious version strings can cause local code execution. On systems with Mercurial (hg) installed, downloading modules from non-standard sources (e.g., custom domains) can cause unexpected code execution due to how external VCS commands are constructed. This issue can also be triggered by providing a malicious version string to the toolchain. On systems with Git installed, downloading and building modules with malicious version strings can allow an attacker to write to arbitrary files on the filesystem. This can only be triggered by explicitly providing the malicious version strings to the toolchain and does not affect usage of @latest or bare module paths.•CVE-2025-68119
  4. Building a malicious file with cmd/go can cause can cause a write to an attacker-controlled file with partial control of the file content. The "#cgo pkg-config:" directive in a Go source file provides command-line arguments to provide to the Go pkg-config command. An attacker can provide a "--log-file" argument to this directive, causing pkg-config to write to an attacker-controlled location.•CVE-2025-61731
  5. archive/zip uses a super-linear file name indexing algorithm that is invoked the first time a file in an archive is opened. This can lead to a denial of service when consuming a maliciously constructed ZIP archive.•CVE-2025-61728

References

Sources include official advisories and independent security research.