Description
The net/http package improperly accepts a bare LF as a line terminator in chunked data chunk-size lines. This can permit request smuggling if a net/http server is used in conjunction with a server that incorrectly accepts a bare LF as part of a chunk-ext.
Published: 2025-04-08
Score: 9.1 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2025-11855 The net/http package improperly accepts a bare LF as a line terminator in chunked data chunk-size lines. This can permit request smuggling if a net/http server is used in conjunction with a server that incorrectly accepts a bare LF as part of a chunk-ext.
Github GHSA Github GHSA GHSA-g9pc-8g42-g6vq RoadRunner is at risk of HTTP Request/Response Smuggling through vulnerable dependency
History

Tue, 12 May 2026 13:30:00 +0000

Type Values Removed Values Added
References

Thu, 10 Jul 2025 16:00:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:openshift:4.12::el8

Wed, 09 Jul 2025 16:15:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:openshift:4.17::el8
cpe:/a:redhat:openshift:4.17::el9

Fri, 04 Jul 2025 02:30:00 +0000

Type Values Removed Values Added
First Time appeared Redhat cryostat
CPEs cpe:/a:redhat:cryostat:4::el9
Vendors & Products Redhat cryostat

Tue, 01 Jul 2025 14:45:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:ansible_automation_platform:2.5::el8
cpe:/a:redhat:ansible_automation_platform:2.5::el9

Tue, 01 Jul 2025 02:30:00 +0000

Type Values Removed Values Added
First Time appeared Redhat ansible Automation Platform
CPEs cpe:/a:redhat:ansible_automation_platform:2.4::el8
cpe:/a:redhat:ansible_automation_platform:2.4::el9
Vendors & Products Redhat ansible Automation Platform

Wed, 25 Jun 2025 02:45:00 +0000

Type Values Removed Values Added
First Time appeared Redhat openshift
CPEs cpe:/a:redhat:openshift:4.19::el8
cpe:/a:redhat:openshift:4.19::el9
Vendors & Products Redhat openshift

Mon, 23 Jun 2025 14:45:00 +0000

Type Values Removed Values Added
First Time appeared Redhat rhmt
CPEs cpe:/a:redhat:rhel_aus:8.2
cpe:/a:redhat:rhmt:1.8::el8
Vendors & Products Redhat rhmt

Tue, 17 Jun 2025 16:30:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:rhel_aus:8.4

Mon, 16 Jun 2025 18:45:00 +0000

Type Values Removed Values Added
First Time appeared Redhat openshift Ai
Redhat rhel Aus
CPEs cpe:/a:redhat:openshift_ai:2.21::el9
cpe:/a:redhat:rhel_aus:8.6
cpe:/a:redhat:rhel_e4s:8.6
cpe:/a:redhat:rhel_tus:8.6
Vendors & Products Redhat openshift Ai
Redhat rhel Aus

Thu, 12 Jun 2025 19:00:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:rhel_e4s:9.0

Tue, 10 Jun 2025 06:45:00 +0000

Type Values Removed Values Added
First Time appeared Redhat acm
Redhat openshift Serverless
Redhat rhel E4s
Redhat rhel Tus
CPEs cpe:/a:redhat:acm:2.13::el9
cpe:/a:redhat:openshift_serverless:1.36::el8
cpe:/a:redhat:rhel_e4s:8.8
cpe:/a:redhat:rhel_e4s:9.2
cpe:/a:redhat:rhel_tus:8.8
Vendors & Products Redhat acm
Redhat openshift Serverless
Redhat rhel E4s
Redhat rhel Tus

Fri, 06 Jun 2025 22:00:00 +0000

Type Values Removed Values Added
First Time appeared Redhat enterprise Linux
Redhat rhel Eus
CPEs cpe:/a:redhat:enterprise_linux:8
cpe:/a:redhat:enterprise_linux:9
cpe:/a:redhat:rhel_eus:9.4
cpe:/o:redhat:enterprise_linux:10.0
Vendors & Products Redhat enterprise Linux
Redhat rhel Eus

Sat, 31 May 2025 00:15:00 +0000

Type Values Removed Values Added
First Time appeared Redhat
Redhat service Mesh
CPEs cpe:/a:redhat:service_mesh:3.0::el9
Vendors & Products Redhat
Redhat service Mesh

Fri, 18 Apr 2025 15:15:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N'}

 ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

cvssV3_1

{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N'}

Wed, 09 Apr 2025 15:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-444
References
Metrics threat_severity

None

 cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N'}

threat_severity

Moderate

Tue, 08 Apr 2025 21:45:00 +0000

Type Values Removed Values Added
References

Tue, 08 Apr 2025 20:15:00 +0000

Type Values Removed Values Added
Description The net/http package improperly accepts a bare LF as a line terminator in chunked data chunk-size lines. This can permit request smuggling if a net/http server is used in conjunction with a server that incorrectly accepts a bare LF as part of a chunk-ext.
Title Request smuggling due to acceptance of invalid chunked data in net/http
References

Subscriptions

Redhat Acm Ansible Automation Platform Cryostat Enterprise Linux Openshift Openshift Ai Openshift Serverless Rhel Aus Rhel E4s Rhel Eus Rhel Tus Rhmt Service Mesh
cve-icon MITRE

Status: PUBLISHED

Assigner: Go

Published:

Updated: 2026-05-12T12:04:11.015Z

Reserved: 2025-01-08T19:11:42.834Z

Link: CVE-2025-22871

cve-icon Vulnrichment

Updated: 2025-04-08T21:03:21.913Z

cve-icon NVD

Status : Deferred

Published: 2025-04-08T20:15:20.183

Modified: 2026-05-12T13:16:39.897

Link: CVE-2025-22871

cve-icon Redhat

Severity : Moderate

Publid Date: 2025-04-08T20:04:34Z

Links: CVE-2025-22871 - Bugzilla

cve-icon OpenCVE Enrichment

No data.

Weaknesses