CVE-2015-5741

CRITICAL

Go <1.4.3 - Server-Side Request Forgery

Title source: manual
STIX 2.1

Description

The net/http library in net/http/transfer.go in Go before 1.4.3 does not properly parse HTTP headers, which allows remote attackers to conduct HTTP request smuggling attacks via a request that contains Content-Length and Transfer-Encoding header fields.

References (7)

Core 7
Core References
Mailing List, Third Party Advisory x_refsource_misc
http://seclists.org/oss-sec/2015/q3/237
Mailing List, Third Party Advisory x_refsource_misc
http://seclists.org/oss-sec/2015/q3/292
Mailing List, Third Party Advisory x_refsource_misc
http://seclists.org/oss-sec/2015/q3/294
Issue Tracking, Patch, Third Party Advisory x_refsource_misc
https://bugzilla.redhat.com/show_bug.cgi?id=1250352
Mailing List, Patch, Third Party Advisory x_refsource_misc
http://lists.fedoraproject.org/pipermail/package-announce/2015-October/168029.html
Mailing List, Patch, Third Party Advisory x_refsource_misc
http://lists.fedoraproject.org/pipermail/package-announce/2015-October/167997.html

Scores

CVSS v3 9.8
EPSS 0.0273
EPSS Percentile 84.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-444
Status published
Products (4)
golang/go < 1.4.3
redhat/enterprise_linux 7.0
redhat/openstack 7.0
redhat/openstack 8
Published Feb 08, 2020
Tracked Since Feb 18, 2026