CVE-2022-1705: Improper sanitization of Transfer-Encoding headers in net/http
Summary
CVE-2022-1705: Improper sanitization of Transfer-Encoding headers in net/http. Affects stdlib across 2 version ranges.
< 1.17.12
>= 1.18.0-0, < 1.18.4
Fixed in 1.17.12 or 1.18.4, depending on the release line you run. How to fix ↓
Also tracked for
- golang · Bitnami
- golang-1.15 · Debian:11
The same CVE-2022-1705 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The stdlib package in the Go ecosystem provides a set of standard libraries for the Go programming language. The net/http package is a part of the stdlib package and is used for building HTTP servers and clients. It includes functionality for handling HTTP requests and responses. This vulnerability affects the net/http package in versions prior to 1.17.12 and 1.18.4. The package is vulnerable to improper sanitization of Transfer-Encoding headers, which could potentially allow for request smuggling. However, this vulnerability can only be exploited if combined with an intermediate server that also fails to reject the invalid header.
Vulnerability Detail
The net/http package in Go's stdlib accepts some invalid Transfer-Encoding headers as indicating a "chunked" encoding. This can lead to request smuggling if an intermediate server also fails to reject the invalid header. Request smuggling is a technique where an attacker can manipulate the interaction between two components (e.g., a client and a server) to bypass security controls or perform unauthorized actions. In this case, an attacker could potentially smuggle requests to the server by exploiting the improper handling of Transfer-Encoding headers.
How To Fix
Latest published version: go1.25.5 as of 22 Oct 2026
go get stdlib@vgo1.25.5Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.17.121.17.12go get stdlib@v1.17.12 -
>= 1.18.0-0, < 1.18.41.18.4go get stdlib@v1.18.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, as a general best practice, it is recommended to follow secure coding practices and implement proper input validation and sanitization to mitigate the risk of request smuggling attacks.
Conclusion
The net/http package in Go's stdlib is vulnerable to improper sanitization of Transfer-Encoding headers, which could potentially lead to request smuggling. It is crucial to update to the latest version of the package (1.17.12 or 1.18.4) to mitigate this vulnerability. Additionally, following secure coding practices and implementing proper input validation can help reduce the risk of request smuggling attacks. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for stdlib →
FAQ
This vulnerability could potentially allow an attacker to smuggle requests to the server, bypassing security controls and performing unauthorized actions.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation.
No, only versions prior to 1.17.12 and 1.18.4 are affected. It is recommended to update to the latest version to ensure the vulnerability is patched.
There is no known public exploit for this vulnerability at the time of writing. However, it is important to apply the recommended fixes to mitigate the risk.
You can find more information about this vulnerability in the Go vulnerability database at https://pkg.go.dev/vuln/GO-2022-0525.
References
Related vulnerabilities
Recent vulnerabilities recorded for stdlib.
