CVE-2020-15586: net/http Go package vulnerable to 'Expect: 100-continue' header panic
Summary
CVE-2020-15586: Data race and crash in net/http. Affects stdlib across 2 version ranges.
< 1.13.13
>= 1.14.0-0, < 1.14.5
Fixed in 1.13.13 or 1.14.5, depending on the release line you run. How to fix ↓
Also tracked for
- golang · Bitnami
- golang-1.15 · Debian:11
The same CVE-2020-15586 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The net/http package in Go provides a set of functions and types for building HTTP servers and clients. It is a fundamental package used in many Go applications for handling HTTP requests and responses. However, a vulnerability has been discovered in the package that can lead to a panic when clients send an 'Expect: 100-continue' header while the server is simultaneously reading from the request body and writing a response.
Vulnerability Detail
The vulnerability arises due to a panic condition triggered by the 'Expect: 100-continue' header. When this header is received, the server attempts to read from the request body while also writing a response. This concurrent operation can cause the server to panic, resulting in a crash or unexpected behavior. The impact of this vulnerability can vary depending on the application using the net/http package. In some cases, it may lead to denial of service or data corruption.
How To Fix
Latest published version: go1.25.5 as of 22 Oct 2026
go get stdlib@vgo1.25.5Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.13.131.13.13go get stdlib@v1.13.13 -
>= 1.14.0-0, < 1.14.51.14.5go get stdlib@v1.14.5
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If updating the Go version is not immediately feasible, a workaround can be implemented by disabling the 'Expect: 100-continue' header in the client requests. This can be achieved by removing or modifying the code responsible for adding the 'Expect' header in the client implementation. However, this workaround may not be suitable for all scenarios and should be carefully evaluated.
Conclusion
The net/http package in Go is vulnerable to a panic condition triggered by the 'Expect: 100-continue' header. This vulnerability can lead to crashes or unexpected behavior, potentially causing denial of service or data corruption. It is recommended to update to the fixed versions of Go or apply the provided workaround. For further assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for stdlib →
FAQ
The impact can vary depending on the application, but it can lead to denial of service or data corruption.
Versions 1.13.0 to 1.13.12 and 1.14.0 to 1.14.4 are affected.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability.
Yes, updating to Go version 1.13.13 or later (for Go 1.13.x) or 1.14.5 or later (for Go 1.14.x) will fix the vulnerability.
A workaround is to disable the 'Expect: 100-continue' header in client requests, but it may not be suitable for all scenarios.
References
Related vulnerabilities
Recent vulnerabilities recorded for stdlib.
