CVE-2015-5741 Other in n/a
Remote attackers can conduct HTTP request smuggling attacks by exploiting improper header parsing in the Go net/http library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2015-5741?
CVE-2015-5741 is a critical vulnerability in Golang Go, published on 8 Feb 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The net/http library in net/http/transfer.go in Go before 1.4.3 does not properly parse HTTP headers, which allows remote attackers to conduct HTTP request smuggling attacks via a request that contains Content-Length and Transfer-Encoding header fields.
Weakness: CWE-444
Which versions are affected by CVE-2015-5741?
It affects 3 products.
Products include Golang Go, Redhat Enterprise Linux, Redhat Openstack.
How do I fix CVE-2015-5741?
Upgrade to a fixed version.
Is CVE-2015-5741 being exploited?
There is no known exploitation of CVE-2015-5741 in the wild and no public exploit code.
Other vulnerabilities in Golang Go
- CVE-2020-0601 Microsoft Windows CryptoAPI Spoofing
- CVE-2026-27143 Missing bound checks can lead to memory corruption in safe Go in cmd/compile
- CVE-2024-24790 Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses in net/netip
- CVE-2023-39320 Arbitrary code execution via go.mod toolchain directive in cmd/go
- CVE-2023-24540 Improper handling of JavaScript whitespace in html/template
Sources
Also known as AZL-78996, AZL-98973, GHSA-vfw2-3mm4-xq2j, UBUNTU-CVE-2015-5741.