CVE Catalog
CVE-2015-5739
CriticalSummary
The net/http library in Go before version 1.4.3 does not properly parse HTTP header keys, allowing remote attackers to conduct HTTP request smuggling attacks via a space instead of a hyphen.
Risk Assessment
Attackers can exploit this vulnerability to manipulate HTTP requests, potentially leading to unauthorized access to data or execution of unwanted operations on the server.
Recommendation
It is recommended to update the Go library to version 1.4.3 or newer to protect against this type of attack.
Original NVD description (English source)
The net/http library in net/textproto/reader.go in Go before 1.4.3 does not properly parse HTTP header keys, which allows remote attackers to conduct HTTP request smuggling attacks via a space instead of a hyphen, as demonstrated by "Content Length" instead of "Content-Length."