MEDIUM6.5
GO-2022-0525
Improper sanitization of Transfer-Encoding headers in net/http
Quick fix
GO-2022-0525 — stdlib: upgrade to the fixed version with the command below.
go get stdlib@v1.17.12Details
The HTTP/1 client accepted some invalid Transfer-Encoding headers as indicating a "chunked" encoding. This could potentially allow for request smuggling, but only if combined with an intermediate server that also improperly failed to reject the header as invalid.
Are you affected?
Enter the version of the package you're using.