CVE Catalog
CVE-2015-5740
CriticalSummary
The net/http library in Go before version 1.4.3 does not properly parse HTTP headers, allowing remote attackers to conduct HTTP request smuggling attacks via a request with two Content-length headers.
Risk Assessment
Attackers may exploit this vulnerability to manipulate HTTP traffic, potentially leading to unauthorized access to data or the introduction of malicious code.
Recommendation
It is recommended to update the Go library to version 1.4.3 or later to protect against these attacks.
Original NVD description (English source)
The net/http library in net/http/transfer.go in Go before 1.4.3 does not properly parse HTTP headers, which allows remote attackers to conduct HTTP request smuggling attacks via a request with two Content-length headers.