CVE-2015-5739: HTTP Request Smuggling in Go stdlib
Summary
GO-2021-0157: The MIME header parser treated spaces and hyphens as equivalent, which can permit HTTP request smuggling. Affects stdlib versions < 1.4.3. Fixed in 1.4.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Go stdlib package is a collection of standard libraries that provide fundamental functionality for Go programs. It includes various modules for networking, text processing, and more. The affected package in this vulnerability is 'net/textproto', which is responsible for parsing MIME headers. MIME headers are used in HTTP requests and responses to specify the content type and other metadata. The vulnerability arises from the incorrect treatment of spaces and hyphens as equivalent in the MIME header parser.
Vulnerability Detail
The MIME header parser in the Go stdlib package incorrectly treats spaces and hyphens as equivalent. This can lead to HTTP request smuggling, where an attacker can manipulate the headers to bypass security measures or perform unauthorized actions. By exploiting this vulnerability, an attacker may be able to inject malicious content, bypass authentication, or perform other malicious activities. The vulnerability was first identified in 2015 and has been assigned multiple CVE identifiers: CVE-2015-5739, CVE-2015-5740, and CVE-2015-5741.
How To Fix
Latest published version: go1.25.5 as of 22 Oct 2026
go get stdlib@vgo1.25.5Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.4.3
This is the first release that contains the fix.
go get stdlib@v1.4.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, developers can mitigate the risk by implementing additional security measures such as input validation and sanitization to prevent header manipulation.
Conclusion
The CVE-2015-5739 vulnerability in the Go stdlib package's MIME header parser can lead to HTTP request smuggling. It is crucial for developers to update the affected package to version 1.4.3 or later to mitigate the risk. Additional security measures, such as input validation, should also be implemented to prevent header manipulation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for stdlib →
FAQ
This vulnerability can allow attackers to manipulate HTTP headers and potentially bypass security measures or perform unauthorized actions.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your Gopkg.lock file and the playground will analyze it for vulnerabilities.
No, the vulnerability was introduced in version 0 of the package and fixed in version 1.4.3. Therefore, versions 1.4.3 and later are not affected.
While specific exploits may not be publicly available, the vulnerability has the potential to be exploited by attackers to perform various malicious activities.
There are alternative packages available for handling HTTP headers in Go, such as 'net/http' and 'net/http/httputil'. Developers can consider using these packages as replacements if they are not affected by the vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for stdlib.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
