{"id":"CVE-2015-5740","aliases":["EUVD-2015-5686","GHSA-8vhq-594p-r648","GO-2021-0159","RHSA-2016:1538","UBUNTU-CVE-2015-5740"],"status":"published","title":"The net/http library in net/http/transfer.go in Go before 1.4.3 does not properly parse HTTP...","description":"The net/http library in net/http/transfer.go in Go before 1.4.3 does not properly parse HTTP headers, which allows remote attackers to conduct HTTP request smuggling attacks via a request with two Content-length headers.","severity":{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.03657,"percentile":0.89695,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-444"],"published":"2017-10-18T20:00:00Z","modified":"2026-06-17T00:29:41Z","affected":[{"source":"osv","ecosystem":"Go","package":"stdlib","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.4.3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.3-1.el7_2.1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"golang-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.3-1.el7_2.1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"golang-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.3-1.el7_2.1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"golang-misc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.3-1.el7_2.1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"golang-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.3-1.el7_2.1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"golang-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.3-1.el7_2.1"}]}],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"gccgo-4.9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.9-20140213-0ubuntu1","4.9-20140213-0ubuntu2","4.9-20140217-0ubuntu1","4.9-20140222-0ubuntu1","4.9-20140303-0ubuntu2","4.9-20140303-0ubuntu3","4.9-20140321-0ubuntu1","4.9-20140330-0ubuntu1","4.9-20140406-0ubuntu1","4.9.1-0ubuntu1","4.9.3-0ubuntu4"]}],"products":[{"vendor":"fedoraproject","product":"fedora"},{"vendor":"golang","product":"go"},{"vendor":"redhat","product":"enterprise_linux_server"},{"vendor":"redhat","product":"enterprise_linux_server_aus"},{"vendor":"redhat","product":"enterprise_linux_server_eus"},{"vendor":"redhat","product":"enterprise_linux_server_tus"}],"references":[{"url":"http://seclists.org/oss-sec/2015/q3/292","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-October/167997.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","Third Party Advisory"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-October/168029.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","Third Party Advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2016-1538.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1250352","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Patch","Third Party Advisory","report"]},{"url":"http://seclists.org/oss-sec/2015/q3/294","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory"]},{"url":"http://seclists.org/oss-sec/2015/q3/237","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory"]},{"url":"https://github.com/golang/go/commit/300d9a21583e7cf0149a778a0611e76ff7c6680f","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Patch","Third Party Advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-5740","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-8vhq-594p-r648"},{"url":"https://go.dev/cl/13148","tags":["fix"]},{"url":"https://go.googlesource.com/go/+/26049f6f9171d1190f3bbe05ec304845cfe6399f","tags":["fix"]},{"url":"https://go.dev/cl/11772","tags":["fix"]},{"url":"https://go.dev/cl/11810","tags":["fix"]},{"url":"https://go.dev/cl/12865","tags":["fix"]},{"url":"https://go.googlesource.com/go/+/117ddcb83d7f42d6aa72241240af99ded81118e9","tags":["fix"]},{"url":"https://go.googlesource.com/go/+/300d9a21583e7cf0149a778a0611e76ff7c6680f","tags":["fix"]},{"url":"https://go.googlesource.com/go/+/c2db5f4ccc61ba7df96a747e268a277b802cbb87","tags":["fix"]},{"url":"https://go.dev/issue/12027","tags":["report"]},{"url":"https://go.dev/issue/11930","tags":["report"]},{"url":"https://groups.google.com/g/golang-announce/c/iSIyW4lM4hY/m/ADuQR4DiDwAJ","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2016:1538","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1346331","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1353798","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_1538.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-5739","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-5739","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-5739","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-5740","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-5740","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-5741","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-5741","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-5741","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-3959","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1324343","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-3959","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-3959","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-5386","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-5386","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-5386","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2015-5740","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2015-5740","description":"The net/http library in net/http/transfer.go in Go before 1.4.3 does not properly parse HTTP headers, which allows remote attackers to conduct HTTP request smuggling attacks via a request with two Content-length headers.","status":"published","published":"2017-10-18T20:00:00Z","modified":"2024-08-06T06:59:04.387Z","updated_at":"2026-11-02T14:35:40.217028Z"}],"euvd":[{"id":"EUVD-2015-5686","description":"The net/http library in net/http/transfer.go in Go before 1.4.3 does not properly parse HTTP headers, which allows remote attackers to conduct HTTP request smuggling attacks via a request with two Content-length headers.","status":"published","published":"2017-10-18T20:00:00Z","modified":"2024-08-06T06:59:04Z","updated_at":"2026-11-03T02:21:58.760301Z"}],"ghsa":[{"id":"GHSA-8vhq-594p-r648","title":"The net/http library in net/http/transfer.go in Go before 1.4.3 does not properly parse HTTP...","description":"The net/http library in net/http/transfer.go in Go before 1.4.3 does not properly parse HTTP headers, which allows remote attackers to conduct HTTP request smuggling attacks via a request with two Content-length headers.","status":"published","published":"2022-05-14T01:04:30Z","modified":"2023-02-02T05:03:01Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-444"],"updated_at":"2026-11-02T14:51:33.40906Z"}],"nvd":[{"id":"CVE-2015-5740","description":"The net/http library in net/http/transfer.go in Go before 1.4.3 does not properly parse HTTP headers, which allows remote attackers to conduct HTTP request smuggling attacks via a request with two Content-length headers.","status":"published","published":"2017-10-18T20:29:00.353Z","modified":"2026-06-17T00:29:41.447Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-444"],"updated_at":"2026-11-02T14:03:19.244941Z"}],"osv":[{"id":"RHSA-2016:1538","title":"Red Hat Security Advisory: golang security, bug fix, and enhancement update","status":"published","published":"2024-09-15T23:33:06Z","modified":"2026-05-13T10:35:06.173042Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:03.734507Z"},{"id":"UBUNTU-CVE-2015-5740","description":"The net/http library in net/http/transfer.go in Go before 1.4.3 does not properly parse HTTP headers, which allows remote attackers to conduct HTTP request smuggling attacks via a request with two Content-length headers.","status":"published","published":"2017-10-18T20:29:00Z","modified":"2025-10-24T04:45:26Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:10.385269Z"},{"id":"GO-2021-0159","title":"Request smuggling due to improper header parsing in net/http","description":"HTTP headers were not properly parsed, which allows remote attackers to conduct HTTP request smuggling attacks via a request that contains Content-Length and Transfer-Encoding header fields.","status":"published","published":"2022-01-05T21:39:14Z","modified":"2024-05-20T16:03:47Z","updated_at":"2026-11-02T15:47:00.604718Z"}]}}