NetSight
IP …
critical9.8

CVE-2015-5740

The net/http library in net/http/transfer.go in Go before 1.4.3 does not properly parse HTTP headers, which allows remote attackers to conduct HTTP request smu…

Impact

The net/http library in net/http/transfer.go in Go before 1.4.3 does not properly parse HTTP headers, which allows remote attackers to conduct HTTP request smuggling attacks via a request with two Content-length headers.

Affected products

VendorProductAffected versions
GolangGo
through 1.4.2
FedoraprojectFedora
Versions 21, 22
RedhatEnterprise Linux Server
Version 7.0
RedhatEnterprise Linux Server Aus
Versions 7.2, 7.3, 7.4, 7.6
RedhatEnterprise Linux Server Eus
Versions 7.2, 7.3, 7.4, 7.5, 7.6
RedhatEnterprise Linux Server Tus
Versions 7.2, 7.3, 7.6

Weakness classification

CWE-444

References