CVE-2025-22871: Go stdlib net/http Request Smuggling Vulnerability
Summary
CVE-2025-22871: Request smuggling due to acceptance of invalid chunked data in net/http. Affects stdlib across 2 version ranges.
< 1.23.8
>= 1.24.0-0, < 1.24.2
Fixed in 1.23.8 or 1.24.2, depending on the release line you run. How to fix ↓
Also tracked for
- golang · Bitnami
- spiral/roadrunner · Packagist
- golang-1.15 · Debian:11
The same CVE-2025-22871 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Go standard library's net/http package is a fundamental component for building web servers and clients in Go. It provides essential functionalities for handling HTTP requests and responses, including support for chunked transfer encoding. However, due to its design, it can be vulnerable to specific attack vectors, such as request smuggling, when improperly handling chunked data.
Vulnerability Detail
The vulnerability arises from the net/http package's improper acceptance of a bare LF (Line Feed) as a line terminator in chunked data chunk-size lines. This flaw can lead to request smuggling attacks, where an attacker could manipulate requests to bypass security controls or confuse the server into processing malicious requests. The issue is particularly concerning when the net/http server interacts with another server that incorrectly accepts bare LF as part of chunked transfer encoding, potentially allowing unauthorized access or data manipulation.
How To Fix
Latest published version: go1.25.5 as of 22 Oct 2026
go get stdlib@vgo1.25.5Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.23.81.23.8go get stdlib@v1.23.8 -
>= 1.24.0-0, < 1.24.21.24.2go get stdlib@v1.24.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, ensure that your application does not accept chunked transfer encoding from untrusted sources. Additionally, consider implementing additional validation checks on incoming requests to mitigate the risk of request smuggling.
Conclusion
The CVE-2025-22871 vulnerability in the Go standard library's net/http package poses a significant risk of request smuggling attacks. Users are urged to update to the latest patched versions to secure their applications. Additionally, implementing workarounds can help mitigate risks until an upgrade is feasible.
See every vulnerability recorded for stdlib →
FAQ
Request smuggling is an attack technique that allows an attacker to send multiple HTTP requests in a single connection, potentially leading to unauthorized actions or data exposure.
You can check if your application is affected by this vulnerability using the Vulert playground at Vulert Scanner, which allows you to monitor and alert for open-source vulnerabilities in real-time.
If exploited, this vulnerability could allow attackers to bypass security measures, manipulate requests, or gain unauthorized access to sensitive data.
Yes, upgrading to Go version 1.23.8 or later, or 1.24.2 or later for pre-release versions, will mitigate this vulnerability.
If immediate upgrading is not possible, implement strict validation on incoming requests and avoid accepting chunked transfer encoding from untrusted sources as a temporary measure.
References
Related vulnerabilities
Recent vulnerabilities recorded for stdlib.
