CVE-2019-16276: Request smuggling due to accepting invalid headers in net/http
Summary
CVE-2019-16276: Request smuggling due to accepting invalid headers in net/http via net/textproto. Affects stdlib across 2 version ranges.
< 1.12.10
>= 1.13.0-0, < 1.13.1
Fixed in 1.12.10 or 1.13.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The net/http package in the Go standard library is a powerful tool for building HTTP servers and clients. It provides functionality for handling HTTP requests and responses, parsing headers, and managing connections. However, prior to version 1.13.1, the package had a vulnerability that allowed it to accept and normalize invalid HTTP/1.1 headers with a space before the colon, which is a violation of RFC 7230. This vulnerability could be exploited when a Go server is used behind a reverse proxy that accepts and forwards such invalid headers without normalizing them. In such cases, the reverse proxy and the server may interpret the headers differently, leading to potential filter bypasses or request smuggling if requests from separate clients are multiplexed onto the same upstream connection by the proxy.
Vulnerability Detail
The vulnerability arises from the net/http package's acceptance and normalization of invalid headers with a space before the colon. This behavior is in violation of the HTTP/1.1 specification and can result in inconsistencies between the reverse proxy and the Go server. Attackers can potentially exploit these inconsistencies to bypass filters or perform request smuggling attacks. The vulnerability has been addressed in versions 1.12.10 and 1.13.1 of the Go standard library, where such invalid headers are now rejected by Go servers and passed without normalization to Go client applications.
How To Fix
Latest published version: go1.25.5 as of 22 Oct 2026
go get stdlib@vgo1.25.5Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.12.101.12.10go get stdlib@v1.12.10 -
>= 1.13.0-0, < 1.13.11.13.1go get stdlib@v1.13.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, as a general best practice, it is recommended to always use the latest version of the affected package and keep all software dependencies up to date.
Conclusion
The vulnerability in the net/http package of the Go standard library, which allowed the acceptance of invalid headers with a space before the colon, has been addressed in versions 1.12.10 and 1.13.1. It is crucial to update the affected package to the fixed version and ensure that any reverse proxies used in conjunction with Go servers handle headers correctly. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for stdlib →
FAQ
The vulnerability can potentially lead to filter bypasses or request smuggling attacks if a Go server is used behind a reverse proxy that accepts and forwards invalid headers without normalizing them.
Versions prior to 1.12.10 and 1.13.1 of the Go standard library are affected by this vulnerability.
There are no known public exploits for this vulnerability at the time of writing.
Yes, this vulnerability can be exploited remotely if a Go server is exposed to the internet and is behind a reverse proxy that accepts and forwards invalid headers without normalizing them.
Yes, the vulnerability has been fixed in versions 1.12.10 and 1.13.1 of the Go standard library. It is recommended to update to these versions or any subsequent version that includes the fix.
References
Related vulnerabilities
Recent vulnerabilities recorded for stdlib.
