Moderate Vulnerability in Go Packages: Request Smuggling Due to Invalid Chunked Data
Summary
ALSA-2025:8476: Moderate: golang security update. Affects go-toolset versions < 1.23.9-1.el9_6. Fixed in 1.23.9-1.el9_6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Go programming language, provided by the golang packages, is widely used for building efficient and reliable software. It includes a compiler and various tools that facilitate the development process. However, a recent security issue has been identified in the net/http package, which can lead to request smuggling vulnerabilities. This flaw arises from the acceptance of invalid chunked data, potentially allowing attackers to manipulate HTTP requests.
Vulnerability Detail
The vulnerability, identified as CVE-2025-22871, originates from the net/http package's handling of chunked transfer encoding. When invalid chunked data is accepted, it can lead to request smuggling attacks, where an attacker can send malicious requests that may bypass security controls. This could result in unauthorized access to sensitive data or the execution of unintended commands on the server, posing a significant risk to applications relying on this package.
How To Fix
Minimum fixed version
1.23.9-1.el9_6
This is the first release that contains the fix.
sudo dnf update go-toolsetTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you may consider implementing additional validation on incoming HTTP requests to filter out potentially malicious chunked data. However, this is not a substitute for applying the necessary updates.
Conclusion
In summary, the identified vulnerability in the Go packages poses a moderate risk due to its potential for request smuggling attacks. It is crucial to update the affected packages to the patched version to mitigate this risk. Additionally, utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for go-toolset →
FAQ
CVE-2025-22871 is a vulnerability in the Go programming language's net/http package that allows for request smuggling due to the acceptance of invalid chunked data.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The vulnerability can lead to unauthorized access to sensitive data and the execution of unintended commands, posing significant risks to applications.
If immediate updates are not possible, consider implementing additional validation on incoming HTTP requests as a temporary workaround.
For more details, refer to the CVE page associated with CVE-2025-22871, which provides comprehensive information about the vulnerability and its implications.
Related vulnerabilities
Recent vulnerabilities recorded for go-toolset.
