Open-source package vulnerability · Go

GHSA-5423-jcjm-2gpv: Traefik affected by Go HTTP Request Smuggling Vulnerability

criticalCVSS 3.1 9.1

Summary net/http: request smuggling through invalid chunked data: The net/http package accepts data in the chunked transfer encoding containing an invalid chunk-size line terminated by a bare LF. When used in conjunction with a server or proxy which incorrectly interprets a bare LF in a chunk extension as part of the extension, this could permit request smuggling.

Published Apr 18, 2025

Affected packages

github.com/traefik/traefik/v2

Ecosystem: Go
Affected: < 2.11.24
Fixed in: 2.11.24
Check: go list -m github.com/traefik/traefik/v2

github.com/traefik/traefik/v3

Ecosystem: Go
Affected: < 3.3.6
Fixed in: 3.3.6
Check: go list -m github.com/traefik/traefik/v3

github.com/traefik/traefik/v3

Ecosystem: Go
Affected: = 3.4.0-rc1
Fixed in: 3.4.0-rc2
Check: go list -m github.com/traefik/traefik/v3

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

Summary

net/http: request smuggling through invalid chunked data: The net/http package accepts data in the chunked transfer encoding containing an invalid chunk-size line terminated by a bare LF. When used in conjunction with a server or proxy which incorrectly interprets a bare LF in a chunk extension as part of the extension, this could permit request smuggling. [CVE-2025-22871] Vendor Affected Components: Go: 1.23.x < 1.23.8

More Details: CVE-2025-22871

Patches

https://github.com/traefik/traefik/releases/tag/v2.11.24
https://github.com/traefik/traefik/releases/tag/v3.3.6
https://github.com/traefik/traefik/releases/tag/v3.4.0-rc2

Credited to varunbondre.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More Go vulnerabilities

All Go entries