CVE-2025-22871Request smuggling due to acceptance of invalid chunked data in net/http
- 9.1CriticalCVSS base score
- 0.84%Exploitation in 30 daysEPSS · top 42% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
The net/http package improperly accepts a bare LF as a line terminator in chunked data chunk-size lines. This can permit request smuggling if a net/http server is used in conjunction with a server that incorrectly accepts a bare LF as part of a chunk-ext.
Timeline
ID reserved
By Go
- 3 months later
· 3 months later
Published
- 13 months later
· 13 months later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| CISA-ADPADP (enrichment) | 3.1 | Critical9.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N |
| NVDNVD · Deferred | 3.1 | Critical9.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N |
- EPSS (exploitation in 30 days)
- 0.84% · top 42% of all CVEs (15 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: yes · Technical impact: total
The list uses the assigner's score when there is one, then CISA's, then NVD's: Critical 9.1.
Affected products
Go standard library · net/http/internal
- affected < 1.23.8
- affected 1.24.0-0 – < 1.24.2
Affected packages
From reviewed advisories of the GitHub Advisory Database.
- Packagistspiral/roadrunnerGHSA-g9pc-8g42-g6vq (opens in a new tab)
References
References6
- https://go.dev/cl/652998 (opens in a new tab)
- https://go.dev/issue/71988 (opens in a new tab)
- https://groups.google.com/g/golang-announce/c/Y2uBTVKjBQk (opens in a new tab)
- https://pkg.go.dev/vuln/GO-2025-3563 (opens in a new tab)
- http://www.openwall.com/lists/oss-security/2025/04/04/4 (opens in a new tab)
- https://cert-portal.siemens.com/productcert/html/ssa-783943.html (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2025-11855 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisory GHSA-g9pc-8g42-g6vq (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2025-22871)Record last updated .