Loading story…
A vulnerability in Go's net/http package, tracked as CVE-2025-22871, can let malformed HTTP messages ending with a lone line feed be accepted instead of the required line ending, creating conditions for HTTP request smuggling when traffic is passed to another server that interprets the request differently. The issue affects server-side handling and has drawn differing severity assessments, with cve.org listing a CVSS 9.1 score while Red Hat rates impact on its products as Moderate with a CVSS v3 5.4 score.
Red Hat said exposure varies by product and noted that Red Hat Satellite is considered Low severity because it uses the affected Go component only as an HTTP client rather than as a server. The company reported that no acceptable mitigation is currently available under its product security criteria and published fixes for multiple affected packages, including Cryostat 4 on RHEL 9 components through advisory RHSA-2025:10323.
See affected versions and whether adversaries are exploiting it.
7 events from the most recent confirmed update back to the earliest known activity.
Red Hat issued RHSA-2025:11749 with updated Red Hat Ceph Storage 8.1 container images that fix CVE-2025-22871, the Go net/http request-smuggling flaw. The Important advisory also addressed six other vulnerabilities in bundled components.
Red Hat issued RHSA-2025:10781, an Important advisory providing OpenShift Container Platform 4.16.44 container-image updates for RHEL 9. The release fixes CVE-2025-22868 and the Go net/http request-smuggling flaw CVE-2025-22871, as well as CVE-2025-32462 in sudo.
Red Hat said fixes for CVE-2025-22871 were issued for Cryostat 4 on RHEL 9 components in RHSA-2025:10323, including multiple Cryostat-related packages.
Red Hat published its CVE entry for CVE-2025-22871, describing a Go net/http flaw that can enable HTTP request smuggling due to incorrect acceptance of LF-terminated messages.
Red Hat tracked CVE-2025-22871 as Bugzilla bug 2358493, reported on 2025-04-08, describing a Go net/http request smuggling flaw caused by acceptance of bare-LF-terminated chunk-size lines. The bug record also noted the upstream fixed versions as Go 1.24.2 and Go 1.23.8 and referenced the corresponding Go commits.
Red Hat tracked CVE-2025-22868 as Bugzilla bug 2348366, reported as a high-severity issue in golang.org/x/oauth2/jws. The flaw allows malformed tokens to trigger unexpected memory consumption during parsing, creating a denial-of-service risk.
Red Hat updated its CVE-2025-22871 entry, reflecting later changes to the advisory record.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
6 references tracked. Mallory keeps watching after this page renders.
cve.org
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourcebugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The Go Project disclosed **CVE-2025-61726**, a denial-of-service flaw in the standard library's `net/url` handling that can be triggered through `net/http.Request.ParseForm`. The bug stems from the lack of a limit on query parameter counts, allowing attackers to submit URL-encoded forms with many unique parameters and drive excessive memory consumption. The issue affects Go releases before **1.24.12** and **1.25.x before 1.25.6**, and is tracked in Go issue `#77101` and Go advisory **GO-2026-4341**. Red Hat subsequently shipped **Important** security updates for multiple products bundling vulnerable Go components, most notably **grafana-pcp** across RHEL 8, RHEL 9, and RHEL 10 channels, as well as **golang-github-openprinting-ipp-usb** on RHEL 10. Several advisories bundled fixes for related Go flaws, including **CVE-2025-61729** in `crypto/x509` and **CVE-2025-68121` in `crypto/tls`, with updated packages released for `x86_64`, `aarch64`, `ppc64le`, and `s390x` architectures across standard, SAP, AUS, EUS, and Extended Life Cycle offerings.
Aug 20, 2026
New research and vendor advisories have highlighted a broader class of **HTTP desynchronization and request smuggling** risks driven by parser inconsistencies in headers and chunked encoding. A PortSwigger paper on **CRLF-powered desync attacks** warned that header injection can do far more than trigger open redirects or XSS, enabling attackers to "behead" HTTP streams and create severe front-end/back-end parsing mismatches. Related research on ambiguous chunk line terminators and chunk-extension parsing has shown how subtle differences in HTTP/1.1 handling can be turned into cache poisoning, security-control bypass, unauthorized access, and denial-of-service conditions. Red Hat documented multiple affected implementations under **CWE-444**. **`CVE-2026-33870`** in Netty was rated Important and stems from incorrect parsing of quoted strings in HTTP/1.1 chunked transfer-encoding extension values, with no acceptable mitigation listed beyond product fixes. **`CVE-2024-52304`** in aiohttp affects deployments using the pure Python parser, where newline handling in chunk extensions can let attackers bypass proxies or firewalls. **`CVE-2026-1525`** in Undici allows duplicate `Content-Length` headers through case-variant names, creating malformed requests that can trigger request smuggling or DoS. Supporting tooling such as **smugchunks** has emerged to detect chunk-parsing discrepancies in black-box testing, underscoring that these desync issues are practical and span multiple widely used HTTP stacks.
Aug 20, 2026
**CVE-2026-73812** (also tracked as **GHSA-7j6m-4ffg-hg46**) is a high-severity HTTP request-smuggling flaw in Erlang/OTP's `inets` `httpd` component. Although the server rejects duplicate `Content-Length` headers, it accepts requests that include both `Transfer-Encoding` and `Content-Length`, a combination RFC 9112 identifies as a likely smuggling attempt. An attacker can exploit this behavior when a `Content-Length`-preferring frontend proxy forwards requests to an `inets` backend that prioritizes chunked `Transfer-Encoding`, creating CL.TE request desynchronization. Erlang/OTP fixed the issue in OTP **27.3.4.17**, **28.5.0.6**, and **29.0.6**, corresponding to `inets` versions **9.3.2.7**, **9.6.2.3**, and **9.7.2**; the impact on OTP versions earlier than 17.0 is unknown.
Sep 2, 2026