CVE-2025-22871

Request smuggling due to acceptance of invalid chunked data in net/http

Published Apr 8, 2025 CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Description
The net/http package improperly accepts a bare LF as a line terminator in chunked data chunk-size lines. This can permit request smuggling if a net/http server is used in conjunction with a server that incorrectly accepts a bare LF as part of a chunk-ext.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2025-11855 The net/http package improperly accepts a bare LF as a line terminator in chunked data chunk-size lines. This can permit request smuggling if a net/http server is used in conjunction with a server that incorrectly accepts a bare LF as part of a chunk-ext.
Github GHSA Github GHSA GHSA-g9pc-8g42-g6vq RoadRunner is at risk of HTTP Request/Response Smuggling through vulnerable dependency
History
Type Values Removed Values Added
CPEs cpe:/a:redhat:openshift:4.12::el8
Type Values Removed Values Added
CPEs cpe:/a:redhat:openshift:4.17::el8
cpe:/a:redhat:openshift:4.17::el9
Type Values Removed Values Added
First Time appeared Redhat cryostat
CPEs cpe:/a:redhat:cryostat:4::el9
Vendors & Products Redhat cryostat
Type Values Removed Values Added
CPEs cpe:/a:redhat:ansible_automation_platform:2.5::el8
cpe:/a:redhat:ansible_automation_platform:2.5::el9
Type Values Removed Values Added
First Time appeared Redhat ansible Automation Platform
CPEs cpe:/a:redhat:ansible_automation_platform:2.4::el8
cpe:/a:redhat:ansible_automation_platform:2.4::el9
Vendors & Products Redhat ansible Automation Platform
Type Values Removed Values Added
First Time appeared Redhat openshift
CPEs cpe:/a:redhat:openshift:4.19::el8
cpe:/a:redhat:openshift:4.19::el9
Vendors & Products Redhat openshift
Type Values Removed Values Added
First Time appeared Redhat rhmt
CPEs cpe:/a:redhat:rhel_aus:8.2
cpe:/a:redhat:rhmt:1.8::el8
Vendors & Products Redhat rhmt
Type Values Removed Values Added
CPEs cpe:/a:redhat:rhel_aus:8.4
Type Values Removed Values Added
First Time appeared Redhat openshift Ai
Redhat rhel Aus
CPEs cpe:/a:redhat:openshift_ai:2.21::el9
cpe:/a:redhat:rhel_aus:8.6
cpe:/a:redhat:rhel_e4s:8.6
cpe:/a:redhat:rhel_tus:8.6
Vendors & Products Redhat openshift Ai
Redhat rhel Aus
Type Values Removed Values Added
CPEs cpe:/a:redhat:rhel_e4s:9.0
Type Values Removed Values Added
First Time appeared Redhat acm
Redhat openshift Serverless
Redhat rhel E4s
Redhat rhel Tus
CPEs cpe:/a:redhat:acm:2.13::el9
cpe:/a:redhat:openshift_serverless:1.36::el8
cpe:/a:redhat:rhel_e4s:8.8
cpe:/a:redhat:rhel_e4s:9.2
cpe:/a:redhat:rhel_tus:8.8
Vendors & Products Redhat acm
Redhat openshift Serverless
Redhat rhel E4s
Redhat rhel Tus
Type Values Removed Values Added
First Time appeared Redhat enterprise Linux
Redhat rhel Eus
CPEs cpe:/a:redhat:enterprise_linux:8
cpe:/a:redhat:enterprise_linux:9
cpe:/a:redhat:rhel_eus:9.4
cpe:/o:redhat:enterprise_linux:10.0
Vendors & Products Redhat enterprise Linux
Redhat rhel Eus
Type Values Removed Values Added
First Time appeared Redhat
Redhat service Mesh
CPEs cpe:/a:redhat:service_mesh:3.0::el9
Vendors & Products Redhat
Redhat service Mesh
Type Values Removed Values Added
Metrics cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

cvssV3_1

{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N'}

Type Values Removed Values Added
Weaknesses CWE-444
References
Metrics threat_severity

None

cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N'}

threat_severity

Moderate

Type Values Removed Values Added
Description The net/http package improperly accepts a bare LF as a line terminator in chunked data chunk-size lines. This can permit request smuggling if a net/http server is used in conjunction with a server that incorrectly accepts a bare LF as part of a chunk-ext.
Title Request smuggling due to acceptance of invalid chunked data in net/http
References