Описание
The net/http package improperly accepts a bare LF as a line terminator in chunked data chunk-size lines. This can permit request smuggling if a net/http server is used in conjunction with a server that incorrectly accepts a bare LF as part of a chunk-ext.
| Релиз | Статус | Примечание |
|---|---|---|
| devel | not-affected | 1.23.8-1 |
| esm-infra/focal | DNE | |
| focal | DNE | |
| jammy | needs-triage | |
| noble | needs-triage | |
| oracular | needs-triage | |
| plucky | not-affected | 1.23.8-1 |
| upstream | released | 1.23.8-1 |
Показывать по
| Релиз | Статус | Примечание |
|---|---|---|
| devel | not-affected | 1.24.2-1 |
| esm-infra/focal | DNE | |
| focal | DNE | |
| jammy | DNE | |
| noble | DNE | |
| oracular | DNE | |
| plucky | not-affected | 1.24.2-1 |
| upstream | released | 1.24.2-1 |
Показывать по
EPSS
9.1 Critical
CVSS3
Связанные уязвимости
The net/http package improperly accepts a bare LF as a line terminator in chunked data chunk-size lines. This can permit request smuggling if a net/http server is used in conjunction with a server that incorrectly accepts a bare LF as part of a chunk-ext.
The net/http package improperly accepts a bare LF as a line terminator in chunked data chunk-size lines. This can permit request smuggling if a net/http server is used in conjunction with a server that incorrectly accepts a bare LF as part of a chunk-ext.
The net/http package improperly accepts a bare LF as a line terminator ...
EPSS
9.1 Critical
CVSS3