Moderate Security Vulnerability in Go Toolset: Request Smuggling in net/http
Summary
ALSA-2025:8478: Moderate: go-toolset:rhel8 security update. Affects delve versions < 1.24.1-1.module_el8.10.0+3977+66935a26. Fixed in 1.24.1-1.module_el8.10.0+3977+66935a26. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Go Toolset is a collection of tools and libraries for the Go programming language, also known as Golang. It is widely used for building scalable and efficient software applications. The toolset includes various components such as delve for debugging, and golang for the core language functionalities. This vulnerability specifically affects the net/http package, which is responsible for handling HTTP requests and responses, making it a critical component for web applications built using Go.
Vulnerability Detail
The vulnerability arises from a flaw in the net/http package that allows for request smuggling due to the acceptance of invalid chunked data. This can lead to various security issues, including the potential for unauthorized access or manipulation of HTTP requests. The vulnerability is identified as CVE-2025-22871, which highlights the importance of addressing this issue promptly to maintain the integrity and security of applications utilizing the Go Toolset.
How To Fix
Minimum fixed version
1.24.1-1.module_el8.10.0+3977+66935a26
This is the first release that contains the fix.
sudo dnf update delveTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, it is advisable to implement strict validation of incoming HTTP requests and avoid processing chunked transfer encoding until the patch is applied. This can help mitigate the risk of request smuggling until the update is completed.
Conclusion
The Go Toolset has a moderate security vulnerability that affects the net/http package, allowing for request smuggling due to invalid chunked data. It is crucial to update the affected packages to their patched versions to mitigate the risk. Additionally, implementing temporary workarounds can help protect applications until updates are applied.
See every vulnerability recorded for delve →
FAQ
CVE-2025-22871 is the identifier for the vulnerability affecting the net/http package in the Go Toolset, which allows for request smuggling due to invalid chunked data.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By uploading your manifest file like package-lock.json, you can check for vulnerabilities without needing to install any software.
The vulnerability can lead to unauthorized access, data manipulation, and other security breaches in applications that rely on the affected net/http package.
Yes, patches are available for the affected packages. It is recommended to update to the latest versions as specified in the 'how to fix' section.
If immediate updates are not possible, implement strict validation of HTTP requests and avoid processing chunked transfer encoding as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for delve.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
