CVE-2025-22871: Request smuggling due to acceptance of invalid chunked data in net/http

Deferred

AliasesSUSE-SU-2025:1141-1SUSE-SU-2025:1153-1SUSE-SU-2026:22950-1+3102 more

Published 08-04-2025Last modified 12-05-2026

Vulnerability summary

CVE-2025-22871 is a critical (CVSS 9.1) vulnerability in go standard library net/http/internal. EPSS estimates a 0.84% chance of exploitation in the next 30 days, higher than 57.9% of scored vulnerabilities.

Priority

Prioritisesevere

Severe, CVSS 9.1 (CVE.org); no exploitation reported by the 5 checked sources; EPSS 1% (FIRST, 03-11-2026)

Source freshness unavailable

How is this decided?

CVSS score

9.1/10

010

Critical · v3.1 (CVE.org)

EPSS score

0.84%

0%100%

Low · +0.03 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 10 · Related 339

MGASA-2025-0175 OPENSUSE-SU-2025:15305-1 RHSA-2025:10295 RHSA-2025:21328 RHSA-2025:8665 RHSA-2025:8680+94 more

Showing 100 of 340.

Timeline

08-04-2025
PublishedVulnerability first disclosed.
12-05-2026
Last modifiedVulnerability information updated.

Description

The net/http package improperly accepts a bare LF as a line terminator in chunked data chunk-size lines. This can permit request smuggling if a net/http server is used in conjunction with a server that incorrectly accepts a bare LF as part of a chunk-ext.

CVSS metrics

8 scores · 8 sources · 1 version

v3.19.1

EPSS trend

Probability

0.84%

Chance of exploitation in the next 30 days

Percentile

58%

Versus all other CVEs

30-day change

Increase +0.03 pp

From 0.81% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard199 products

aactl< 0.4.12-r30
actions-runner-controller< 0.11.0-r1
actions-runner-controller-compat< 0.11.0-r1
actions-runner-controller-fips< 0.11.0-r1
actions-runner-controller-fips-compat< 0.11.0-r1

addon-resizer< 1.8.23-r4
addon-resizer-compat< 1.8.23-r4
addon-resizer-fips< 1.8.23-r4
addon-resizer-fips-compat< 1.8.23-r4
age< 1.2.1-r4
age-fips< 1.2.1-r4
agentbeat< 8.17.4-r1
agentbeat-fips< 8.17.4-r1
amass< 4.2.0-r22
amazon-cloudwatch-agent-operator< 2.2.0-r3
amazon-cloudwatch-agent-operator-compat< 2.2.0-r3
amazon-cloudwatch-agent-operator-fips< 2.2.0-r3
amazon-cloudwatch-agent-operator-fips-compat< 2.2.0-r3
amazon-k8s-cni< 1.19.3-r3
amazon-k8s-cni-compat< 1.19.3-r3
amazon-k8s-cni-fips< 1.19.3-r4
amazon-k8s-cni-init< 1.19.3-r3
amazon-k8s-cni-init-compat< 1.19.3-r3
amazon-k8s-cni-init-fips< 1.19.3-r4
amazon-k8s-cni-init-fips-compat< 1.19.3-r4
ansible-operator< 1.37.2-r2
ansible-operator-compat< 1.37.2-r2
apache-beam-python-3.11-sdk< 2.64.0-r1
argo-cd-2.11All versions (No fix recorded)
argo-cd-2.13< 2.13.6-r2
argo-cd-2.13-compat< 2.13.6-r2
argo-cd-2.13-repo-server< 2.13.6-r2
argo-events-fips< 1.9.6-r0
argo-workflows< 3.6.5-r4
argo-workflows-fips< 3.6.5-r4
authservice< 1.0.4-r6
authservice-compat< 1.0.4-r6
authservice-fips< 1.0.4-r6
authservice-fips-compat< 1.0.4-r6
aws-application-networking-k8s< 1.1.0-r6
aws-application-networking-k8s-compat< 1.1.0-r6
aws-application-networking-k8s-fips< 1.1.0-r1
aws-application-networking-k8s-fips-compat< 1.1.0-r1
aws-ebs-csi-driver< 1.41.0-r1
aws-flb-cloudwatch< 1.9.4-r16
aws-flb-cloudwatch-compat< 1.9.4-r16
aws-flb-cloudwatch-compat-fips< 1.9.4-r10
aws-flb-cloudwatch-fips< 1.9.4-r10
aws-flb-firehose< 1.7.2-r16
aws-flb-firehose-compat< 1.7.2-r16
aws-flb-firehose-compat-fips< 1.7.2-r10
aws-flb-firehose-fips< 1.7.2-r10
aws-flb-kinesis< 1.10.2-r17
aws-flb-kinesis-compat< 1.10.2-r17
aws-flb-kinesis-compat-fips< 1.10.2-r11
aws-flb-kinesis-fips< 1.10.2-r11
aws-network-policy-agent< 1.2.0-r2
aws-network-policy-agent-compat< 1.2.0-r2
aws-network-policy-agent-compat-fips< 1.2.0-r0
aws-network-policy-agent-fips< 1.2.0-r0
aws-privateca-issuer< 1.4.1-r3
aws-privateca-issuer-compat< 1.4.1-r3
aws-privateca-issuer-compat-fips< 1.4.1-r3
aws-privateca-issuer-fips< 1.4.1-r3
aws-signer-notation-plugin< 1.0.350-r3
aws-signer-notation-plugin-fips< 1.0.350-r3
azcopy< 10.28.1-r1
azcopy-fips< 10.28.1-r1
azure-aad-pod-identity-mic< 1.8.17-r22
azure-aad-pod-identity-nmi< 1.8.17-r22
azure-service-operator< 2.12.0-r2
azure-service-operator-compat< 2.12.0-r2
azure-service-operator-fips< 2.12.0-r1
bank-vaults< 1.20.4-r29
bank-vaults-fips< 1.20.4-r26
bank-vaults-template< 1.20.4-r29
bank-vaults-template-fips< 1.20.4-r26
bazelisk< 1.26.0-r0
bazelisk-default< 1.26.0-r0
bom< 0.6.0-r19
buildah< 1.39.4-r1
buildctl< 0.20.2-r1
buildctl-fips< 0.20.2-r1
buildkitd< 0.20.2-r1
buildkitd-fips< 0.20.2-r1
caddy< 2.9.1-r8
caddy-fips< 2.9.1-r9
caddy-man< 2.9.1-r9
caddy-src< 2.9.1-r8
cadvisor< 0.52.1-r4
cadvisor-compat< 0.52.1-r4
cadvisor-fips< 0.52.1-r3
capslock< 0.2.7-r3
cargobump< 0.1.0-r3
cass-operator< 1.23.2-r1
cass-operator-compat< 1.23.2-r1
cass-operator-compat-fips< 1.23.2-r1
cass-operator-config< 1.23.2-r1
cass-operator-fips< 1.23.2-r1
cass-operator-fips-no-pvc-delete< 1.23.2-r1
cass-operator-fips-no-pvc-delete-compat< 1.23.2-r1
cert-exporter< 2.14.0-r10
cert-exporter-fips< 2.14.0-r10
cert-manager-cmctl< 2.1.1-r10
cert-manager-cmctl-fips< 2.1.1-r10
cert-manager-fips-1.17< 1.17.1-r6
cert-manager-istio-csr< 0.14.0-r7
cert-manager-istio-csr-compat< 0.14.0-r7
cert-manager-webhook-pdns< 2.5.2-r5
cert-manager-webhook-pdns-fips< 2.5.2-r5
cfssl< 1.6.5-r18
cfssl-bundle< 1.6.5-r18
cfssl-bundle-fips< 1.6.5-r10
cfssl-certinfo< 1.6.5-r18
cfssl-certinfo-fips< 1.6.5-r10
cfssl-fips< 1.6.5-r10
cfssl-json< 1.6.5-r18
cfssl-json-fips< 1.6.5-r10
cfssl-mkbundle< 1.6.5-r18
cfssl-mkbundle-fips< 1.6.5-r10
cfssl-multirootca< 1.6.5-r18
cfssl-multirootca-fips< 1.6.5-r10
cfssl-newkey< 1.6.5-r18
cfssl-newkey-fips< 1.6.5-r10
cfssl-scan< 1.6.5-r18
cfssl-scan-fips< 1.6.5-r10
chainctl< 0.2.72-r0
chartmuseum< 0.16.2-r17
chartmuseum-fips< 0.16.2-r15
checksec< 3.0.2-r1
cilium-1.15< 1.15.15-r1
cilium-1.15-clustermesh-apiserver< 1.15.15-r1
cilium-1.15-container-init< 1.15.15-r1
cilium-1.15-container-init-compat< 1.15.15-r1
cilium-1.15-hubble-relay< 1.15.15-r1
cilium-1.15-iptables< 1.15.15-r1
cilium-1.15-operator-aws< 1.15.15-r1
cilium-1.15-operator-generic< 1.15.15-r1
cilium-1.16< 1.16.8-r1
cilium-1.16-clustermesh-apiserver< 1.16.8-r1
cilium-1.16-container-init< 1.16.8-r1
cilium-1.16-container-init-compat< 1.16.8-r1
cilium-1.16-hubble-relay< 1.16.8-r1
cilium-1.16-iptables< 1.16.8-r1
cilium-1.16-operator-aws< 1.16.8-r1
cilium-1.16-operator-generic< 1.16.8-r1
cilium-1.17< 1.17.2-r1
cilium-1.17-clustermesh-apiserver< 1.17.2-r1
cilium-1.17-container-init< 1.17.2-r1
cilium-1.17-container-init-compat< 1.17.2-r1
cilium-1.17-hubble-relay< 1.17.2-r1
cilium-1.17-iptables< 1.17.2-r1
cilium-1.17-operator-aws< 1.17.2-r1
cilium-1.17-operator-generic< 1.17.2-r1
cilium-envoy-1.16< 1.16.8-r1
cilium-envoy-1.17< 1.17.2-r1
cilium-envoy-fips-1.15< 1.15.15-r1
cilium-envoy-fips-1.16< 1.16.8-r1
cilium-envoy-fips-1.17< 1.17.2-r1
cilium-fips-1.15< 1.15.15-r2
cilium-fips-1.15-clustermesh-apiserver< 1.15.15-r2
cilium-fips-1.15-container-init< 1.15.15-r2
cilium-fips-1.15-container-init-compat< 1.15.15-r2
cilium-fips-1.15-host-utils< 1.15.15-r2
cilium-fips-1.15-hubble-relay< 1.15.15-r2
cilium-fips-1.15-operator-aws< 1.15.15-r2
cilium-fips-1.15-operator-azure< 1.15.15-r2
cilium-fips-1.15-operator-generic< 1.15.15-r2
cilium-fips-1.16< 1.16.8-r2
cilium-fips-1.16-clustermesh-apiserver< 1.16.8-r2
cilium-fips-1.16-container-init< 1.16.8-r2
cilium-fips-1.16-container-init-compat< 1.16.8-r2
cilium-fips-1.16-host-utils< 1.16.8-r2
cilium-fips-1.16-hubble-relay< 1.16.8-r2
cilium-fips-1.16-operator-aws< 1.16.8-r2
cilium-fips-1.16-operator-azure< 1.16.8-r2
cilium-fips-1.16-operator-generic< 1.16.8-r2
cilium-fips-1.17< 1.17.2-r2
cilium-fips-1.17-clustermesh-apiserver< 1.17.2-r2
cilium-fips-1.17-container-init< 1.17.2-r2
cilium-fips-1.17-container-init-compat< 1.17.2-r2
cilium-fips-1.17-host-utils< 1.17.2-r2
cilium-fips-1.17-hubble-relay< 1.17.2-r2
cilium-fips-1.17-operator-aws< 1.17.2-r2
cilium-fips-1.17-operator-azure< 1.17.2-r2
cilium-fips-1.17-operator-generic< 1.17.2-r2
clickhouse-operator-fips< 0.24.5-r1
clickhouse-operator-fips-compat< 0.24.5-r1
clickhouse-operator-fips-metrics-exporter< 0.24.5-r1
clickhouse-operator-fips-metrics-exporter-compat< 0.24.5-r1
cloud-sql-proxy-fips< 2.15.2-r1
cloud-sql-proxy-fips-compat< 2.15.2-r1
cloudnative-pg< 1.25.1-r32
cloudnative-pg-fips< 1.25.1-r33
cloudnative-pg-fips-plugins< 1.25.1-r33
cloudnative-pg-plugins< 1.25.1-r32
cluster-autoscaler-1.31< 1.31.2-r3
cluster-autoscaler-1.31-compat< 1.31.2-r3
cluster-autoscaler-1.32< 1.32.1-r2

Show all 199

Alpine1 product

go< 1.23.8-r0 | < 1.24.2-r0

2 vendors · 200 products · Showing 200 of 2382

References

227 links

go.dev/cl/652998ARTICLEWEBFIX
go.dev/issue/71988ARTICLEWEBREPORT
groups.google.com/g/golang-announce/c/Y2uBTVKjBQkARTICLEWEB
pkg.go.dev/vuln/GO-2025-3563AdvisoryWEB
www.openwall.com/lists/oss-security/2025/04/04/4WEB
cert-portal.siemens.com/productcert/html/ssa-783943.htmlWEB
www.suse.com/support/update/announcement/2025/suse-su-20251141-1/Advisory
bugzilla.suse.com/1229122REPORT
bugzilla.suse.com/1240550REPORT
www.suse.com/security/cve/CVE-2025-22871WEB

Show all 100 references

Showing 100 of 227.