title: Improper sanitization of Transfer-Encoding headers in net/http
description: Acceptance of some invalid Transfer-Encoding headers in the HTTP/1 client in net/http before Go 1.17.12 and Go 1.18.4 allows HTTP request smuggling if combined with an intermediate server that also improperly fails to reject the header as invalid.
problem types: CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')
affected:
{
vendor: Go standard library
product: net/http
collectionURL: https://pkg.go.dev
packageName: net/http
versions:
version: 0, lessThan: 1.17.12, status: affected, versionType: semver
version: 1.18.0-0, lessThan: 1.18.4, status: affected, versionType: semver
programRoutines:
name: transferReader.parseTransferEncoding
defaultStatus: unaffected
}