CVE-2015-5739: Request smuggling due to improper header parsing in net/http
Summary
CVE-2015-5739: Request smuggling due to improper header parsing in net/http. Affects stdlib versions < 1.4.3. Fixed in 1.4.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The stdlib package in Go provides a set of standard libraries for the Go programming language. The net/http package is part of the stdlib and is used for building HTTP servers and clients. It includes functions and types for handling HTTP requests and responses. The vulnerability identified as CVE-2015-5739 affects the net/http package in Go. This package is widely used for developing web applications and services in the Go ecosystem.
Vulnerability Detail
The vulnerability in the net/http package arises from improper parsing of HTTP headers. This allows remote attackers to conduct HTTP request smuggling attacks by sending a request that contains Content-Length and Transfer-Encoding header fields. By exploiting this vulnerability, an attacker can manipulate the HTTP request headers to bypass security measures or perform unauthorized actions. The impact of this vulnerability can range from information disclosure to remote code execution, depending on the specific application and its configuration.
How To Fix
Latest published version: go1.25.5 as of 22 Oct 2026
go get stdlib@vgo1.25.5Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.4.3
This is the first release that contains the fix.
go get stdlib@v1.4.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the fix by updating the net/http package to a secure version.
Conclusion
The vulnerability identified as CVE-2015-5739 in the net/http package of the Go stdlib allows remote attackers to conduct HTTP request smuggling attacks. It is crucial for developers to update their Go installations to a version equal to or higher than 1.4.3 to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for stdlib →
FAQ
The impact of this vulnerability can vary depending on the specific application and its configuration. It can range from information disclosure to remote code execution.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your Gopkg.lock file and the playground will analyze it for any open-source vulnerabilities, including this one.
No, there is no known workaround for this vulnerability. It is recommended to update the net/http package to a secure version.
The vulnerability was introduced in version 0 of the net/http package and was fixed in version 1.4.3. Therefore, any version prior to 1.4.3 is affected.
To update the net/http package, you can use the 'go get' command with the package import path. For example, 'go get net/http' will update the package to the latest version.
References
Related vulnerabilities
Recent vulnerabilities recorded for stdlib.
