CVE-2019-16276
Go before 1.12.10 and 1.13.x before 1.13.1 allow HTTP Request Smuggling.
7.5 HighFix available
Go before 1.12.10 and 1.13.x before 1.13.1 allow HTTP Request Smuggling.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Exploit likelihood
5.30%Up 2.4 points since Apr 14, 2021
What each source reports
NVD Score used
Go before 1.12.10 and 1.13.x before 1.13.1 allow HTTP Request Smuggling.
- Record
CVE-2019-16276- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:P/A:N - Weakness
- CWE-444
- Updated
- 2026-11-02
CVE List No score
Go before 1.12.10 and 1.13.x before 1.13.1 allow HTTP Request Smuggling.
- Record
CVE-2019-16276- Updated
- 2026-11-02
EUVDEUVD-2019-7075 No score
Go before 1.12.10 and 1.13.x before 1.13.1 allow HTTP Request Smuggling.
- Record
EUVD-2019-7075- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-xv7j-jr8q-mhmm No score
Go before 1.12.10 and 1.13.x before 1.13.1 allow HTTP Request Smuggling.
Go before 1.12.10 and 1.13.x before 1.13.1 allow HTTP Request Smuggling.
- Record
GHSA-xv7j-jr8q-mhmm- Weakness
- CWE-444
- Updated
- 2026-11-02
OSVALPINE-CVE-2019-16276
Go before 1.12.10 and 1.13.x before 1.13.1 allow HTTP Request Smuggling.
- Record
ALPINE-CVE-2019-16276- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-03
OSVBELL-CVE-2019-16276
CVE-2019-16276 does not affect BellSoft software
- Record
BELL-CVE-2019-16276- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
Show 11 moreShow less
OSV
Go before 1.12.10 and 1.13.x before 1.13.1 allow HTTP Request Smuggling.
- Record
CVE-2019-16276- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVRHBA-2019:3304
Red Hat Bug Fix Advisory: OpenShift Container Platform 4.2.4 bug fix update
- Record
RHBA-2019:3304- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVRHSA-2020:0101
Red Hat Security Advisory: go-toolset-1.12-golang security update
- Record
RHSA-2020:0101- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVRHSA-2020:0329
Red Hat Security Advisory: go-toolset:rhel8 security update
- Record
RHSA-2020:0329- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2019-16276
Go before 1.12.10 and 1.13.x before 1.13.1 allow HTTP Request Smuggling.
- Record
UBUNTU-CVE-2019-16276- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVGO-2022-0212 No score
Request smuggling due to accepting invalid headers in net/http via net/textproto
net/http (through net/textproto) used to accept and normalize invalid HTTP/1.1 headers with a space before the colon, in violation of RFC 7230.
If a Go server is used behind an uncommon reverse proxy that accepts and forwards but doesn't normalize such invalid headers, the reverse proxy and the server can interpret the headers differently. This can lead to filter bypasses or request smuggling, the latter if requests from separate clients are multiplexed onto the same upstream connection by the proxy. Such invalid headers are now rejected by Go servers, and passed without normalization to Go client applications.
- Record
GO-2022-0212- Updated
- 2026-11-02
OSVopenSUSE-SU-2019:2521-1 No score
Security update for go1.12
This update for go1.12 fixes the following issues:
Security issues fixed:
- CVE-2019-16276: Fixed the handling of invalid HTTP headers, which had allowed request smuggling (bsc#1152082).
- CVE-2019-17596: Fixed a panic in dsa.Verify caused by invalid public keys (bsc#1154402).
Non-security issue fixed:
- Go was updated to version 1.12.12 (bsc#1141689).
This update was imported from the SUSE:SLE-15:Update update project.
- Record
openSUSE-SU-2019:2521-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2019:2522-1 No score
Security update for go1.12
This update for go1.12 fixes the following issues:
Security issues fixed:
- CVE-2019-16276: Fixed the handling of invalid HTTP headers, which had allowed request smuggling (bsc#1152082).
- CVE-2019-17596: Fixed a panic in dsa.Verify caused by invalid public keys (bsc#1154402).
Non-security issue fixed:
- Go was updated to version 1.12.12 (bsc#1141689).
This update was imported from the SUSE:SLE-15:Update update project.
- Record
openSUSE-SU-2019:2522-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10805-1 No score
go1.12-1.12.17-4.8 on GA media
These are all security issues fixed in the go1.12-1.12.17-4.8 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10805-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10806-1 No score
go1.13-1.13.15-2.6 on GA media
These are all security issues fixed in the go1.13-1.13.15-2.6 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10806-1- Updated
- 2026-11-02
OSVSUSE-SU-2019:2940-1 No score
Security update for go1.12
This update for go1.12 fixes the following issues:
Security issues fixed:
- CVE-2019-16276: Fixed the handling of invalid HTTP headers, which had allowed request smuggling (bsc#1152082).
- CVE-2019-17596: Fixed a panic in dsa.Verify caused by invalid public keys (bsc#1154402).
Non-security issue fixed:
- Go was updated to version 1.12.12 (bsc#1141689).
- Record
SUSE-SU-2019:2940-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
goAlpine:v3.10 |
1.13 up to 1.12.10-r0 | 1.12.10-r0 |
goAlpine:v3.11 |
1.13 up to 1.13.1-r0 | 1.13.1-r0 |
goAlpine:v3.12 |
1.13 up to 1.13.1-r0 | 1.13.1-r0 |
goAlpine:v3.13 |
1.13 up to 1.13.1-r0 | 1.13.1-r0 |
goAlpine:v3.14 |
1.13 up to 1.13.1-r0 | 1.13.1-r0 |
goAlpine:v3.15 |
1.13 up to 1.13.1-r0 | 1.13.1-r0 |
goAlpine:v3.16 |
1.13 up to 1.13.1-r0 | 1.13.1-r0 |
goAlpine:v3.17 |
1.13 up to 1.13.1-r0 | 1.13.1-r0 |
goAlpine:v3.18 |
1.13 up to 1.13.1-r0 | 1.13.1-r0 |
goAlpine:v3.19 |
1.13 up to 1.13.1-r0 | 1.13.1-r0 |
Show 49 moreShow less
| Package | Affected | Fixed |
|---|---|---|
goAlpine:v3.20 |
1.13 up to 1.13.1-r0 | 1.13.1-r0 |
goAlpine:v3.21 |
1.13 up to 1.13.1-r0 | 1.13.1-r0 |
goAlpine:v3.22 |
1.13 up to 1.13.1-r0 | 1.13.1-r0 |
goAlpine:v3.23 |
1.13 up to 1.13.1-r0 | 1.13.1-r0 |
goAlpine:v3.24 |
1.13 up to 1.13.1-r0 | 1.13.1-r0 |
golang-1.7Debian:9 From an advisory covering 7 CVEs |
before 1.7.4-2+deb9u3, plus listed versions 1.7.4-21.7.4-2+deb9u11.7.4-2+deb9u2 |
1.7.4-2+deb9u3 |
golang-1.8Debian:9 From an advisory covering 7 CVEs |
before 1.8.1-1+deb9u3, plus listed versions 1.8.1-11.8.1-1+deb9u11.8.1-1+deb9u2 |
1.8.1-1+deb9u3 |
golang-1.11Debian:10 |
before 1.11.6-1+deb10u2, plus listed versions 1.11.6-11.11.6-1+deb10u1 |
1.11.6-1+deb10u2 |
stdlibGo |
before 1.12.10, 1.13.0-0 up to 1.13.1 | 1.12.101.13.1 |
atomic-enterprise-service-catalogRed Hat:openshift:4.2::el7 |
before 1:4.2.4-201911041319.git.1.1de4bcd.el7 | 1:4.2.4-201911041319.git.1.1de4bcd.el7 |
atomic-enterprise-service-catalog-svcatRed Hat:openshift:4.2::el7 |
before 1:4.2.4-201911041319.git.1.1de4bcd.el7 | 1:4.2.4-201911041319.git.1.1de4bcd.el7 |
atomic-openshift-service-idlerRed Hat:openshift:4.2::el7 |
before 0:4.2.4-201911041319.git.1.4131c2f.el7 | 0:4.2.4-201911041319.git.1.4131c2f.el7 |
openshiftRed Hat:openshift:4.2::el7 |
before 0:4.2.4-201911041319.git.0.c7d2111.el7 | 0:4.2.4-201911041319.git.0.c7d2111.el7 |
openshift-clientsRed Hat:openshift:4.2::el7 |
before 0:4.2.4-201911010432.git.1.30c33a5.el7 | 0:4.2.4-201911010432.git.1.30c33a5.el7 |
openshift-clients-redistributableRed Hat:openshift:4.2::el7 |
before 0:4.2.4-201911010432.git.1.30c33a5.el7 | 0:4.2.4-201911010432.git.1.30c33a5.el7 |
openshift-enterprise-autohealRed Hat:openshift:4.2::el7 |
before 0:4.2.4-201911010432.git.1.0b5cd44.el7 | 0:4.2.4-201911010432.git.1.0b5cd44.el7 |
openshift-hyperkubeRed Hat:openshift:4.2::el7 |
before 0:4.2.4-201911041319.git.0.c7d2111.el7 | 0:4.2.4-201911041319.git.0.c7d2111.el7 |
openshiftRed Hat:openshift:4.2::el8 |
before 0:4.2.4-201911041319.git.0.c7d2111.el8 | 0:4.2.4-201911041319.git.0.c7d2111.el8 |
openshift-clientsRed Hat:openshift:4.2::el8 |
before 0:4.2.4-201911010432.git.1.30c33a5.el8 | 0:4.2.4-201911010432.git.1.30c33a5.el8 |
openshift-clients-redistributableRed Hat:openshift:4.2::el8 |
before 0:4.2.4-201911010432.git.1.30c33a5.el8 | 0:4.2.4-201911010432.git.1.30c33a5.el8 |
openshift-hyperkubeRed Hat:openshift:4.2::el8 |
before 0:4.2.4-201911041319.git.0.c7d2111.el8 | 0:4.2.4-201911041319.git.0.c7d2111.el8 |
go-toolset-1.12Red Hat:devtools:2019 From an advisory covering 2 CVEs |
before 0:1.12.12-4.el7 | 0:1.12.12-4.el7 |
go-toolset-1.12-buildRed Hat:devtools:2019 From an advisory covering 2 CVEs |
before 0:1.12.12-4.el7 | 0:1.12.12-4.el7 |
go-toolset-1.12-golangRed Hat:devtools:2019 From an advisory covering 2 CVEs |
before 0:1.12.12-4.el7 | 0:1.12.12-4.el7 |
go-toolset-1.12-golang-binRed Hat:devtools:2019 From an advisory covering 2 CVEs |
before 0:1.12.12-4.el7 | 0:1.12.12-4.el7 |
go-toolset-1.12-golang-docsRed Hat:devtools:2019 From an advisory covering 2 CVEs |
before 0:1.12.12-4.el7 | 0:1.12.12-4.el7 |
go-toolset-1.12-golang-miscRed Hat:devtools:2019 From an advisory covering 2 CVEs |
before 0:1.12.12-4.el7 | 0:1.12.12-4.el7 |
go-toolset-1.12-golang-raceRed Hat:devtools:2019 From an advisory covering 2 CVEs |
before 0:1.12.12-4.el7 | 0:1.12.12-4.el7 |
go-toolset-1.12-golang-srcRed Hat:devtools:2019 From an advisory covering 2 CVEs |
before 0:1.12.12-4.el7 | 0:1.12.12-4.el7 |
go-toolset-1.12-golang-testsRed Hat:devtools:2019 From an advisory covering 2 CVEs |
before 0:1.12.12-4.el7 | 0:1.12.12-4.el7 |
go-toolset-1.12-runtimeRed Hat:devtools:2019 From an advisory covering 2 CVEs |
before 0:1.12.12-4.el7 | 0:1.12.12-4.el7 |
go-toolsetRed Hat:enterprise_linux:8::appstream From an advisory covering 2 CVEs |
before 0:1.12.12-2.module+el8.1.0+5317+8a49ffbb | 0:1.12.12-2.module+el8.1.0+5317+8a49ffbb |
golangRed Hat:enterprise_linux:8::appstream From an advisory covering 2 CVEs |
before 0:1.12.12-4.module+el8.1.0+5317+8a49ffbb | 0:1.12.12-4.module+el8.1.0+5317+8a49ffbb |
golang-binRed Hat:enterprise_linux:8::appstream From an advisory covering 2 CVEs |
before 0:1.12.12-4.module+el8.1.0+5317+8a49ffbb | 0:1.12.12-4.module+el8.1.0+5317+8a49ffbb |
golang-docsRed Hat:enterprise_linux:8::appstream From an advisory covering 2 CVEs |
before 0:1.12.12-4.module+el8.1.0+5317+8a49ffbb | 0:1.12.12-4.module+el8.1.0+5317+8a49ffbb |
golang-miscRed Hat:enterprise_linux:8::appstream From an advisory covering 2 CVEs |
before 0:1.12.12-4.module+el8.1.0+5317+8a49ffbb | 0:1.12.12-4.module+el8.1.0+5317+8a49ffbb |
golang-raceRed Hat:enterprise_linux:8::appstream From an advisory covering 2 CVEs |
before 0:1.12.12-4.module+el8.1.0+5317+8a49ffbb | 0:1.12.12-4.module+el8.1.0+5317+8a49ffbb |
golang-srcRed Hat:enterprise_linux:8::appstream From an advisory covering 2 CVEs |
before 0:1.12.12-4.module+el8.1.0+5317+8a49ffbb | 0:1.12.12-4.module+el8.1.0+5317+8a49ffbb |
golang-testsRed Hat:enterprise_linux:8::appstream From an advisory covering 2 CVEs |
before 0:1.12.12-4.module+el8.1.0+5317+8a49ffbb | 0:1.12.12-4.module+el8.1.0+5317+8a49ffbb |
golang-1.10Ubuntu:14.04:LTS |
All versions, plus listed versions 1.10.4-2ubuntu1~14.04.1 |
None known |
golang-1.10Ubuntu:16.04:LTS |
All versions, plus listed versions 1.10.4-2ubuntu1~16.04.11.10.4-2ubuntu1~16.04.2 |
None known |
golang-1.6Ubuntu:16.04:LTS |
All versions, plus listed versions 1.6-0ubuntu11.6-0ubuntu21.6-0ubuntu31.6-0ubuntu41.6-0ubuntu5 Show 5 moreShow less1.6.1-0ubuntu11.6.2-0ubuntu5~16.041.6.2-0ubuntu5~16.04.21.6.2-0ubuntu5~16.04.31.6.2-0ubuntu5~16.04.4 |
None known |
golang-1.10Ubuntu:18.04:LTS |
All versions, plus listed versions 1.10~rc1-11.10~rc1-1ubuntu11.10~rc1-2ubuntu11.10~rc2-1ubuntu11.10-1ubuntu11.10.1-1ubuntu21.10.4-2ubuntu1~18.04.11.10.4-2ubuntu1~18.04.2 |
None known |
golang-1.8Ubuntu:18.04:LTS |
All versions, plus listed versions 1.8.3-2ubuntu11.8.3-2ubuntu1.18.04.1 |
None known |
golang-1.9Ubuntu:18.04:LTS |
All versions, plus listed versions 1.9.1-2ubuntu11.9.2-1ubuntu11.9.2-3ubuntu11.9.3-1ubuntu11.9.4-1ubuntu1 |
None known |
go1.12openSUSE:Leap 15.0 From an advisory covering 2 CVEs |
before 1.12.12-lp150.11.1 | 1.12.12-lp150.11.1 |
go1.12openSUSE:Leap 15.1 From an advisory covering 2 CVEs |
before 1.12.12-lp151.2.25.1 | 1.12.12-lp151.2.25.1 |
go1.12openSUSE:Tumbleweed From an advisory covering 18 CVEs |
before 1.12.17-4.8 | 1.12.17-4.8 |
go1.13openSUSE:Tumbleweed From an advisory covering 5 CVEs |
before 1.13.15-2.6 | 1.13.15-2.6 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected, aliases, references | OSV | |
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-16276 is a high vulnerability (CVSS 7.5) in Golang Go, published September 27, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 5.30%, the 92nd percentile. Fixed in go 1.12.10-r0.
References
github.com/golang/go/issues/34540
groups.google.com/forum
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LULL72EUUKIY4NWDZVJVN2LIB4MXHS5P
lists.opensuse.org/opensuse-security-announce/2019-11/msg00043.html
Show 62 moreShow less
security.netapp.com/advisory/ntap-20191122-0004
access.redhat.com/errata/RHSA-2020:0101
lists.debian.org/debian-lts-announce/2021/03/msg00014.html
nvd.nist.gov/vuln/detail/CVE-2019-16276
security.alpinelinux.org/vuln/CVE-2019-16276
docs.bell-sw.com/security/cves/CVE-2019-16276
go.dev/cl/197503
go.googlesource.com/go/+/41b1f88efab9d263408448bf139659119002ea50
bugzilla.redhat.com/show_bug.cgi?id=1765304
security.access.redhat.com/data/csaf/v2/advisories/2019/rhba-2019_3304.json
cve.org/CVERecord?id=CVE-2019-16276
suse.com/support/update/announcement/2019/suse-su-20192940-1
bugzilla.suse.com/1141689
ubuntu.com/security/CVE-2019-16276