Vulnerability · Published Apr 8, 2025 · Assigned by Go

CVE-2025-22871Request smuggling due to acceptance of invalid chunked data in net/http

Critical 9.1

In plain English

A critical-severity security flaw in net/http/internal from Go standard library. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 58% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.1Critical
Exploit odds (30 days)0.8%top 41.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

The net/http package improperly accepts a bare LF as a line terminator in chunked data chunk-size lines. This can permit request smuggling if a net/http server is used in conjunction with a server that incorrectly accepts a bare LF as part of a chunk-ext.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8aardvark-dns2:1.10.1-2.module_el8.10.0+4016+efd18bf8ALSA-2025:9142
AlmaLinux:8aardvark-dns2:1.10.1-2.module_el8.10.0+3901+4b80ecd7ALSA-2025:9142
AlmaLinux:8aardvark-dns2:1.10.1-2.module_el8.10.0+3909+6e1c1eb7ALSA-2025:9142
AlmaLinux:10buildah2:1.39.4-2.el10_0ALSA-2025:9148
AlmaLinux:8buildah2:1.33.12-2.module_el8.10.0+4016+efd18bf8ALSA-2025:9142
AlmaLinux:9buildah2:1.39.4-2.el9_6ALSA-2025:9147
AlmaLinux:10buildah-tests2:1.39.4-2.el10_0ALSA-2025:9148
AlmaLinux:8buildah-tests2:1.33.12-2.module_el8.10.0+4016+efd18bf8ALSA-2025:9142
AlmaLinux:9buildah-tests2:1.39.4-2.el9_6ALSA-2025:9147
AlmaLinux:8cockpit-podman84.1-1.module_el8.10.0+4016+efd18bf8ALSA-2025:9142
AlmaLinux:8conmon3:2.1.10-1.module_el8.10.0+3970+8445edf6ALSA-2025:9142
AlmaLinux:8container-selinux2:2.229.0-2.module_el8.10.0+3909+6e1c1eb7ALSA-2025:9142
AlmaLinux:8containernetworking-plugins1:1.4.0-6.module_el8.10.0+4016+efd18bf8ALSA-2025:9142
AlmaLinux:9containernetworking-plugins1:1.6.2-2.el9_6ALSA-2025:9143
AlmaLinux:8containers-common2:1-82.module_el8.10.0+3901+4b80ecd7ALSA-2025:9142
AlmaLinux:8containers-common2:1-82.module_el8.10.0+3876+e55593a8ALSA-2025:9142
AlmaLinux:8containers-common2:1-82.module_el8.10.0+3970+8445edf6ALSA-2025:9142
AlmaLinux:8crit3.18-5.module_el8.10.0+3858+6ad51f9fALSA-2025:9142
AlmaLinux:8crit3.18-5.module_el8.10.0+3845+87b84552ALSA-2025:9142
AlmaLinux:8crit3.18-5.module_el8.10.0+3901+4b80ecd7ALSA-2025:9142
AlmaLinux:8criu3.18-5.module_el8.10.0+3970+8445edf6ALSA-2025:9142
AlmaLinux:8criu3.18-5.module_el8.10.0+3876+e55593a8ALSA-2025:9142
AlmaLinux:8criu3.18-5.module_el8.10.0+3926+f12484f5ALSA-2025:9142
AlmaLinux:8criu3.18-5.module_el8.10.0+3909+6e1c1eb7ALSA-2025:9142
AlmaLinux:8criu-devel3.18-5.module_el8.10.0+4016+efd18bf8ALSA-2025:9142
AlmaLinux:8criu-devel3.18-5.module_el8.10.0+3876+e55593a8ALSA-2025:9142
AlmaLinux:8criu-devel3.18-5.module_el8.10.0+3858+6ad51f9fALSA-2025:9142
AlmaLinux:8criu-libs3.18-5.module_el8.10.0+4016+efd18bf8ALSA-2025:9142
AlmaLinux:8criu-libs3.18-5.module_el8.10.0+3970+8445edf6ALSA-2025:9142
AlmaLinux:8criu-libs3.18-5.module_el8.10.0+3926+f12484f5ALSA-2025:9142
AlmaLinux:8criu-libs3.18-5.module_el8.10.0+3909+6e1c1eb7ALSA-2025:9142
AlmaLinux:8crun1.14.3-2.module_el8.10.0+3845+87b84552ALSA-2025:9142
AlmaLinux:8crun1.14.3-2.module_el8.10.0+3909+6e1c1eb7ALSA-2025:9142
AlmaLinux:8crun1.14.3-2.module_el8.10.0+3926+f12484f5ALSA-2025:9142
AlmaLinux:10delve1.24.1-2.el10_0ALSA-2025:9317
AlmaLinux:8delve1.24.1-1.module_el8.10.0+3977+66935a26ALSA-2025:8478
AlmaLinux:8fuse-overlayfs1.13-1.module_el8.10.0+3909+6e1c1eb7ALSA-2025:9142
AlmaLinux:8fuse-overlayfs1.13-1.module_el8.10.0+3792+03eaed9cALSA-2025:9142
AlmaLinux:8fuse-overlayfs1.13-1.module_el8.10.0+3970+8445edf6ALSA-2025:9142
AlmaLinux:10git-lfs3.6.1-2.el10_0ALSA-2025:9063
AlmaLinux:8git-lfs3.4.1-5.el8_10ALSA-2025:9060
AlmaLinux:9git-lfs3.6.1-2.el9_6ALSA-2025:9106
AlmaLinux:8go-toolset1.23.9-1.module_el8.10.0+4000+1ad1b2ccALSA-2025:8478
AlmaLinux:9go-toolset1.23.9-1.el9_6ALSA-2025:8476
AlmaLinux:8golang1.23.9-1.module_el8.10.0+4000+1ad1b2ccALSA-2025:8478
AlmaLinux:9golang1.23.9-1.el9_6ALSA-2025:8476
AlmaLinux:8golang-bin1.23.9-1.module_el8.10.0+4000+1ad1b2ccALSA-2025:8478
AlmaLinux:9golang-bin1.23.9-1.el9_6ALSA-2025:8476
AlmaLinux:10golang-docs1.23.9-1.el10_0.alma.1ALSA-2025:8477
AlmaLinux:8golang-docs1.23.9-1.module_el8.10.0+4000+1ad1b2ccALSA-2025:8478
AlmaLinux:9golang-docs1.23.9-1.el9_6ALSA-2025:8476
AlmaLinux:10golang-misc1.23.9-1.el10_0.alma.1ALSA-2025:8477
AlmaLinux:8golang-misc1.23.9-1.module_el8.10.0+4000+1ad1b2ccALSA-2025:8478
AlmaLinux:9golang-misc1.23.9-1.el9_6ALSA-2025:8476
AlmaLinux:9golang-race1.23.9-1.el9_6ALSA-2025:8476
AlmaLinux:10golang-src1.23.9-1.el10_0.alma.1ALSA-2025:8477
AlmaLinux:8golang-src1.23.9-1.module_el8.10.0+4000+1ad1b2ccALSA-2025:8478
AlmaLinux:9golang-src1.23.9-1.el9_6ALSA-2025:8476
AlmaLinux:10golang-tests1.23.9-1.el10_0.alma.1ALSA-2025:8477
AlmaLinux:8golang-tests1.23.9-1.module_el8.10.0+4000+1ad1b2ccALSA-2025:8478
AlmaLinux:9golang-tests1.23.9-1.el9_6ALSA-2025:8476
AlmaLinux:10grafana10.2.6-18.el10_0ALSA-2025:8666
AlmaLinux:8grafana9.2.10-25.el8_10ALSA-2025:8667
AlmaLinux:9grafana10.2.6-14.el9_6ALSA-2025:8682
AlmaLinux:10grafana-pcp5.2.2-3.el10_0ALSA-2025:8915
AlmaLinux:8grafana-pcp5.1.1-10.el8_10ALSA-2025:8918
AlmaLinux:9grafana-pcp5.1.1-11.el9_6ALSA-2025:8916
AlmaLinux:10grafana-selinux10.2.6-18.el10_0ALSA-2025:8666
AlmaLinux:8grafana-selinux9.2.10-25.el8_10ALSA-2025:8667
AlmaLinux:9grafana-selinux10.2.6-14.el9_6ALSA-2025:8682
AlmaLinux:10gvisor-tap-vsock6:0.8.5-2.el10_0ALSA-2025:9151
AlmaLinux:9gvisor-tap-vsock6:0.8.5-2.el9_6ALSA-2025:9150
AlmaLinux:10gvisor-tap-vsock-gvforwarder6:0.8.5-2.el10_0ALSA-2025:9151
AlmaLinux:9gvisor-tap-vsock-gvforwarder6:0.8.5-2.el9_6ALSA-2025:9150
AlmaLinux:10ipp-usb0.9.27-3.el10_0ALSA-2025:9156
AlmaLinux:8libslirp4.4.0-2.module_el8.10.0+3876+e55593a8ALSA-2025:9142
AlmaLinux:8libslirp4.4.0-2.module_el8.10.0+3858+6ad51f9fALSA-2025:9142
AlmaLinux:8libslirp4.4.0-2.module_el8.10.0+4016+efd18bf8ALSA-2025:9142
AlmaLinux:8libslirp4.4.0-2.module_el8.10.0+3845+87b84552ALSA-2025:9142
AlmaLinux:8libslirp-devel4.4.0-2.module_el8.10.0+3909+6e1c1eb7ALSA-2025:9142
AlmaLinux:8libslirp-devel4.4.0-2.module_el8.10.0+3901+4b80ecd7ALSA-2025:9142
AlmaLinux:8libslirp-devel4.4.0-2.module_el8.10.0+3970+8445edf6ALSA-2025:9142
AlmaLinux:8netavark2:1.10.3-1.module_el8.10.0+3970+8445edf6ALSA-2025:9142
AlmaLinux:8netavark2:1.10.3-1.module_el8.10.0+3926+f12484f5ALSA-2025:9142
AlmaLinux:8netavark2:1.10.3-1.module_el8.10.0+4016+efd18bf8ALSA-2025:9142
AlmaLinux:8oci-seccomp-bpf-hook1.2.10-1.module_el8.10.0+3876+e55593a8ALSA-2025:9142
AlmaLinux:8oci-seccomp-bpf-hook1.2.10-1.module_el8.10.0+3792+03eaed9cALSA-2025:9142
AlmaLinux:8oci-seccomp-bpf-hook1.2.10-1.module_el8.10.0+3909+6e1c1eb7ALSA-2025:9142
AlmaLinux:10opentelemetry-collector0.127.0-1.el10_0ALSA-2025:12850
AlmaLinux:9opentelemetry-collector0.127.0-1.el9_6ALSA-2025:12831
AlmaLinux:10osbuild-composer134.1-2.el10_0.alma.1ALSA-2025:9623
AlmaLinux:8osbuild-composer101-4.el8_10.alma.1ALSA-2025:9844
AlmaLinux:9osbuild-composer132.2-2.el9_6.alma.1ALSA-2025:9634
AlmaLinux:10osbuild-composer-core134.1-2.el10_0.alma.1ALSA-2025:9623
AlmaLinux:8osbuild-composer-core101-4.el8_10.alma.1ALSA-2025:9844
AlmaLinux:9osbuild-composer-core132.2-2.el9_6.alma.1ALSA-2025:9634
AlmaLinux:10osbuild-composer-worker134.1-2.el10_0.alma.1ALSA-2025:9623
AlmaLinux:8osbuild-composer-worker101-4.el8_10.alma.1ALSA-2025:9844
AlmaLinux:9osbuild-composer-worker132.2-2.el9_6.alma.1ALSA-2025:9634
AlmaLinux:8podman4:4.9.4-20.module_el8.10.0+4016+efd18bf8ALSA-2025:9142
AlmaLinux:8podman4:4.9.4-20.module_el8.10.0+3970+8445edf6ALSA-2025:9142
AlmaLinux:9podman5:5.4.0-10.el9_6ALSA-2025:9144
AlmaLinux:8podman-catatonit4:4.9.4-20.module_el8.10.0+3970+8445edf6ALSA-2025:9142
AlmaLinux:8podman-catatonit4:4.9.4-20.module_el8.10.0+4016+efd18bf8ALSA-2025:9142
AlmaLinux:10podman-docker6:5.4.0-10.el10_0ALSA-2025:9146
AlmaLinux:8podman-docker4:4.9.4-20.module_el8.10.0+3970+8445edf6ALSA-2025:9142
AlmaLinux:9podman-docker5:5.4.0-10.el9_6ALSA-2025:9144
AlmaLinux:8podman-gvproxy4:4.9.4-20.module_el8.10.0+3970+8445edf6ALSA-2025:9142
AlmaLinux:8podman-gvproxy4:4.9.4-20.module_el8.10.0+4016+efd18bf8ALSA-2025:9142
AlmaLinux:8podman-plugins4:4.9.4-20.module_el8.10.0+3970+8445edf6ALSA-2025:9142
AlmaLinux:9podman-plugins5:5.4.0-10.el9_6ALSA-2025:9144
AlmaLinux:8podman-remote4:4.9.4-20.module_el8.10.0+3970+8445edf6ALSA-2025:9142
AlmaLinux:8podman-remote4:4.9.4-20.module_el8.10.0+4016+efd18bf8ALSA-2025:9142
AlmaLinux:9podman-remote5:5.4.0-10.el9_6ALSA-2025:9144
AlmaLinux:8podman-tests4:4.9.4-20.module_el8.10.0+3970+8445edf6ALSA-2025:9142
AlmaLinux:8podman-tests4:4.9.4-20.module_el8.10.0+4016+efd18bf8ALSA-2025:9142
AlmaLinux:9podman-tests5:5.4.0-10.el9_6ALSA-2025:9144
AlmaLinux:8python3-criu3.18-5.module_el8.10.0+3926+f12484f5ALSA-2025:9142
AlmaLinux:8python3-criu3.18-5.module_el8.10.0+3970+8445edf6ALSA-2025:9142
AlmaLinux:8python3-criu3.18-5.module_el8.10.0+3876+e55593a8ALSA-2025:9142
AlmaLinux:8python3-podman4.9.0-3.module_el8.10.0+4016+efd18bf8ALSA-2025:9142
AlmaLinux:8runc1:1.1.12-6.module_el8.10.0+3959+b8dc5e6aALSA-2025:9142
AlmaLinux:8runc1:1.1.12-6.module_el8.10.0+3970+8445edf6ALSA-2025:9142
AlmaLinux:10skopeo2:1.18.1-2.el10_0ALSA-2025:9149
AlmaLinux:8skopeo2:1.14.5-4.module_el8.10.0+4016+efd18bf8ALSA-2025:9142
AlmaLinux:9skopeo2:1.18.1-2.el9_6ALSA-2025:9145
AlmaLinux:10skopeo-tests2:1.18.1-2.el10_0ALSA-2025:9149
AlmaLinux:8skopeo-tests2:1.14.5-4.module_el8.10.0+4016+efd18bf8ALSA-2025:9142
AlmaLinux:9skopeo-tests2:1.18.1-2.el9_6ALSA-2025:9145
AlmaLinux:8slirp4netns1.2.3-1.module_el8.10.0+3926+f12484f5ALSA-2025:9142
AlmaLinux:8slirp4netns1.2.3-1.module_el8.10.0+3876+e55593a8ALSA-2025:9142
AlmaLinux:8slirp4netns1.2.3-1.module_el8.10.0+3901+4b80ecd7ALSA-2025:9142
AlmaLinux:8slirp4netns1.2.3-1.module_el8.10.0+3845+87b84552ALSA-2025:9142
AlmaLinux:8toolbox0.0.99.5-2.module_el8.10.0+3858+6ad51f9fALSA-2025:9142
AlmaLinux:8toolbox0.0.99.5-2.module_el8.10.0+3901+4b80ecd7ALSA-2025:9142
AlmaLinux:8toolbox0.0.99.5-2.module_el8.10.0+3845+87b84552ALSA-2025:9142
AlmaLinux:8toolbox0.0.99.5-2.module_el8.10.0+3876+e55593a8ALSA-2025:9142
AlmaLinux:8toolbox-tests0.0.99.5-2.module_el8.10.0+3909+6e1c1eb7ALSA-2025:9142
AlmaLinux:8toolbox-tests0.0.99.5-2.module_el8.10.0+3858+6ad51f9fALSA-2025:9142
AlmaLinux:8toolbox-tests0.0.99.5-2.module_el8.10.0+3970+8445edf6ALSA-2025:9142
AlmaLinux:8udica0.2.6-21.module_el8.10.0+3926+f12484f5ALSA-2025:9142
AlmaLinux:8weldr-client35.12-3.el8_10ALSA-2025:9845
AlmaLinux:9weldr-client35.12-4.el9_6ALSA-2025:9635
Alpine:v3.21go1.23.8-r0ALPINE-CVE-2025-22871
Alpine:v3.22go1.24.2-r0ALPINE-CVE-2025-22871
Alpine:v3.23go1.24.2-r0ALPINE-CVE-2025-22871
Alpine:v3.24go1.24.2-r0ALPINE-CVE-2025-22871
Debian:12golang-1.19no fix listedDEBIAN-CVE-2025-22871
Debian:13golang-1.241.24.2-1DEBIAN-CVE-2025-22871
Gostdlib1.23.8, 1.24.2GO-2025-3563
Packagistspiral/roadrunner2025.1.0GHSA-g9pc-8g42-g6vq
Rocky Linux:8aardvark-dns2:1.10.1-2.module+el8.10.0+1896+b18fa106RLSA-2025:9142
Rocky Linux:8aardvark-dns2:1.10.1-2.module+el8.10.0+1874+ce489889RLSA-2025:9142
Rocky Linux:8aardvark-dns2:1.10.1-2.module+el8.10.0+1880+8e896d1bRLSA-2025:9142
Rocky Linux:8aardvark-dns2:1.10.1-2.module+el8.10.0+1948+4b5cd4a9RLSA-2025:9142
Rocky Linux:8aardvark-dns2:1.10.1-2.module+el8.10.0+2001+6a33db9fRLSA-2025:9142
Rocky Linux:10buildah2:1.39.4-2.el10_0RLSA-2025:9148
Rocky Linux:8buildah2:1.33.12-2.module+el8.10.0+2001+6a33db9fRLSA-2025:9142
Rocky Linux:9buildah2:1.39.4-2.el9_6RLSA-2025:9147
Rocky Linux:8cockpit-podman0:84.1-1.module+el8.10.0+1880+8e896d1bRLSA-2025:9142
Rocky Linux:8cockpit-podman0:84.1-1.module+el8.10.0+1896+b18fa106RLSA-2025:9142
Rocky Linux:8cockpit-podman0:84.1-1.module+el8.10.0+1948+4b5cd4a9RLSA-2025:9142
Rocky Linux:8cockpit-podman0:84.1-1.module+el8.10.0+2001+6a33db9fRLSA-2025:9142
Rocky Linux:8cockpit-podman0:84.1-1.module+el8.10.0+1843+6892ab28RLSA-2025:9142
Rocky Linux:8cockpit-podman0:84.1-1.module+el8.10.0+1872+2e18eb19RLSA-2025:9142
Rocky Linux:8cockpit-podman0:84.1-1.module+el8.10.0+1874+ce489889RLSA-2025:9142
Rocky Linux:8cockpit-podman0:84.1-1.module+el8.10.0+1815+5fe7415eRLSA-2025:9142
Rocky Linux:8cockpit-podman0:84.1-1.module+el8.10.0+1825+623b0c20RLSA-2025:9142
Rocky Linux:8conmon3:2.1.10-1.module+el8.10.0+1948+4b5cd4a9RLSA-2025:9142
Rocky Linux:8conmon3:2.1.10-1.module+el8.10.0+2001+6a33db9fRLSA-2025:9142
Rocky Linux:8conmon3:2.1.10-1.module+el8.10.0+1815+5fe7415eRLSA-2025:9142
Rocky Linux:8conmon3:2.1.10-1.module+el8.10.0+1843+6892ab28RLSA-2025:9142
Rocky Linux:8conmon3:2.1.10-1.module+el8.10.0+1872+2e18eb19RLSA-2025:9142
Rocky Linux:8conmon3:2.1.10-1.module+el8.10.0+1880+8e896d1bRLSA-2025:9142
Rocky Linux:8conmon3:2.1.10-1.module+el8.10.0+1874+ce489889RLSA-2025:9142
Rocky Linux:8conmon3:2.1.10-1.module+el8.10.0+1896+b18fa106RLSA-2025:9142
Rocky Linux:8container-selinux2:2.229.0-2.module+el8.10.0+1843+6892ab28RLSA-2025:9142
Rocky Linux:8container-selinux2:2.229.0-2.module+el8.10.0+2001+6a33db9fRLSA-2025:9142
Rocky Linux:8container-selinux2:2.229.0-2.module+el8.10.0+1948+4b5cd4a9RLSA-2025:9142
Rocky Linux:8container-selinux2:2.229.0-2.module+el8.10.0+1896+b18fa106RLSA-2025:9142
Rocky Linux:8container-selinux2:2.229.0-2.module+el8.10.0+1880+8e896d1bRLSA-2025:9142
Rocky Linux:8container-selinux2:2.229.0-2.module+el8.10.0+1874+ce489889RLSA-2025:9142
Rocky Linux:8container-selinux2:2.229.0-2.module+el8.10.0+1815+5fe7415eRLSA-2025:9142
Rocky Linux:8container-selinux2:2.229.0-2.module+el8.10.0+1825+623b0c20RLSA-2025:9142
Rocky Linux:8container-selinux2:2.229.0-2.module+el8.10.0+1872+2e18eb19RLSA-2025:9142
Rocky Linux:8containernetworking-plugins1:1.4.0-6.module+el8.10.0+2001+6a33db9fRLSA-2025:9142
Rocky Linux:9containernetworking-plugins1:1.6.2-2.el9_6RLSA-2025:9143
Rocky Linux:8containers-common2:1-82.module+el8.10.0+1880+8e896d1bRLSA-2025:9142
Rocky Linux:8containers-common2:1-82.module+el8.10.0+1896+b18fa106RLSA-2025:9142
Rocky Linux:8containers-common2:1-82.module+el8.10.0+1948+4b5cd4a9RLSA-2025:9142
Rocky Linux:8containers-common2:1-82.module+el8.10.0+2001+6a33db9fRLSA-2025:9142
Rocky Linux:8containers-common2:1-82.module+el8.10.0+1872+2e18eb19RLSA-2025:9142
Rocky Linux:8containers-common2:1-82.module+el8.10.0+1843+6892ab28RLSA-2025:9142
Rocky Linux:8containers-common2:1-82.module+el8.10.0+1874+ce489889RLSA-2025:9142
Rocky Linux:8criu0:3.18-5.module+el8.10.0+1880+8e896d1bRLSA-2025:9142
Rocky Linux:8criu0:3.18-5.module+el8.10.0+1872+2e18eb19RLSA-2025:9142
Rocky Linux:8criu0:3.18-5.module+el8.10.0+1874+ce489889RLSA-2025:9142
Rocky Linux:8criu0:3.18-5.module+el8.10.0+1896+b18fa106RLSA-2025:9142
Rocky Linux:8criu0:3.18-5.module+el8.10.0+1815+5fe7415eRLSA-2025:9142
Rocky Linux:8criu0:3.18-5.module+el8.10.0+1948+4b5cd4a9RLSA-2025:9142

Affected products (as reported)

VendorProductVersions
Go standard library net/http/internal 0 – before 1.23.81.24.0-0 – before 1.24.2

References