CVE-2025-22871
Vulnerability Summary
Timeline
Description
The net/http package improperly accepts a bare LF as a line terminator in chunked data chunk-size lines. This can permit request smuggling if a net/http server is used in conjunction with a server that incorrectly accepts a bare LF as part of a chunk-ext.
CVSS Metrics
- v3.1•CRITICAL•Score: 9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- v3.1•MEDIUM•Score: 5.4CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
EPSS Trends
Current EPSS score: 0.81%• Percentile: 55%
Affected Systems
- chainguard•aactl
< 0.4.12-r30
- chainguard•actions-runner-controller
< 0.11.0-r1
- chainguard•actions-runner-controller-compat
< 0.11.0-r1
- chainguard•actions-runner-controller-fips
< 0.11.0-r1
- chainguard•actions-runner-controller-fips-compat
< 0.11.0-r1
- chainguard•addon-resizer
< 1.8.23-r4
- chainguard•addon-resizer-compat
< 1.8.23-r4
- chainguard•addon-resizer-fips
< 1.8.23-r4
- chainguard•addon-resizer-fips-compat
< 1.8.23-r4
- chainguard•age
< 1.2.1-r4
- chainguard•age-fips
< 1.2.1-r4
- chainguard•agentbeat
< 8.17.4-r1
- chainguard•agentbeat-fips
< 8.17.4-r1
- chainguard•amass
< 4.2.0-r22
- chainguard•amazon-cloudwatch-agent-operator
< 2.2.0-r3
- chainguard•amazon-cloudwatch-agent-operator-compat
< 2.2.0-r3
- chainguard•amazon-cloudwatch-agent-operator-fips
< 2.2.0-r3
- chainguard•amazon-cloudwatch-agent-operator-fips-compat
< 2.2.0-r3
- chainguard•amazon-k8s-cni
< 1.19.3-r3
- chainguard•amazon-k8s-cni-compat
< 1.19.3-r3
- chainguard•amazon-k8s-cni-fips
< 1.19.3-r4
- chainguard•amazon-k8s-cni-init
< 1.19.3-r3
- chainguard•amazon-k8s-cni-init-compat
< 1.19.3-r3
- chainguard•amazon-k8s-cni-init-fips
< 1.19.3-r4
- chainguard•amazon-k8s-cni-init-fips-compat
< 1.19.3-r4
- chainguard•ansible-operator
< 1.37.2-r2
- chainguard•ansible-operator-compat
< 1.37.2-r2
- chainguard•apache-beam-python-3.11-sdk
< 2.64.0-r1
- chainguard•argo-cd-2.11
all
- chainguard•argo-cd-2.13
< 2.13.6-r2
- chainguard•argo-cd-2.13-compat
< 2.13.6-r2
- chainguard•argo-cd-2.13-repo-server
< 2.13.6-r2
- chainguard•argo-events-fips
< 1.9.6-r0
- chainguard•argo-workflows
< 3.6.5-r4
- chainguard•argo-workflows-fips
< 3.6.5-r4
- chainguard•authservice
< 1.0.4-r6
- chainguard•authservice-compat
< 1.0.4-r6
- chainguard•authservice-fips
< 1.0.4-r6
- chainguard•authservice-fips-compat
< 1.0.4-r6
- chainguard•aws-application-networking-k8s
< 1.1.0-r6
- chainguard•aws-application-networking-k8s-compat
< 1.1.0-r6
- chainguard•aws-application-networking-k8s-fips
< 1.1.0-r1
- chainguard•aws-application-networking-k8s-fips-compat
< 1.1.0-r1
- chainguard•aws-ebs-csi-driver
< 1.41.0-r1
- chainguard•aws-flb-cloudwatch
< 1.9.4-r16
- chainguard•aws-flb-cloudwatch-compat
< 1.9.4-r16
- chainguard•aws-flb-cloudwatch-compat-fips
< 1.9.4-r10
- chainguard•aws-flb-cloudwatch-fips
< 1.9.4-r10
- chainguard•aws-flb-firehose
< 1.7.2-r16
- chainguard•aws-flb-firehose-compat
< 1.7.2-r16
Showing first 50 affected entries in server-rendered view.
References (213)
- https://go.dev/cl/652998
- https://go.dev/issue/71988
- https://groups.google.com/g/golang-announce/c/Y2uBTVKjBQk
- https://pkg.go.dev/vuln/GO-2025-3563
- http://www.openwall.com/lists/oss-security/2025/04/04/4
- https://cert-portal.siemens.com/productcert/html/ssa-783943.html
- https://www.suse.com/support/update/announcement/2026/suse-su-202622950-1/
- https://bugzilla.suse.com/1245878
- https://bugzilla.suse.com/1264390
- https://bugzilla.suse.com/1264391
- https://bugzilla.suse.com/1264392
- https://bugzilla.suse.com/1264393
- https://bugzilla.suse.com/1264394
- https://bugzilla.suse.com/1264395
- https://www.suse.com/security/cve/CVE-2025-22871
- https://www.suse.com/support/update/announcement/2026/suse-su-202622958-1/
- https://access.redhat.com/errata/RHBA-2025:14817
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhba-2025_14817.json
- https://access.redhat.com/security/cve/CVE-2025-22871
- https://bugzilla.redhat.com/show_bug.cgi?id=2358493
- https://www.cve.org/CVERecord?id=CVE-2025-22871
- https://nvd.nist.gov/vuln/detail/CVE-2025-22871
- https://access.redhat.com/errata/RHSA-2025:10271
- https://access.redhat.com/security/updates/classification/#moderate
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_10271.json
- https://access.redhat.com/errata/RHSA-2025:10291
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_10291.json
- https://access.redhat.com/errata/RHSA-2025:10768
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_10768.json
- https://access.redhat.com/errata/RHSA-2025:10782
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_10782.json
- https://access.redhat.com/errata/RHSA-2025:11352
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_11352.json
- https://access.redhat.com/errata/RHSA-2025:11678
- https://issues.redhat.com/browse/OCPBUGS-58323
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_11678.json
- https://access.redhat.com/errata/RHSA-2025:11682
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_11682.json
- https://access.redhat.com/errata/RHSA-2025:12831
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_12831.json
- https://access.redhat.com/errata/RHSA-2025:12850
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_12850.json
- https://access.redhat.com/errata/RHSA-2025:15291
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_15291.json
- https://access.redhat.com/errata/RHSA-2025:8476
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_8476.json
- https://access.redhat.com/errata/RHSA-2025:8477
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_8477.json
- https://access.redhat.com/errata/RHSA-2025:8478
- https://issues.redhat.com/browse/RHEL-94636
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_8478.json
- https://access.redhat.com/errata/RHSA-2025:8539
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_8539.json
- https://access.redhat.com/errata/RHSA-2025:8601
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_8601.json
- https://access.redhat.com/errata/RHSA-2025:8632
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_8632.json
- https://access.redhat.com/errata/RHSA-2025:8633
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_8633.json
- https://access.redhat.com/errata/RHSA-2025:8634
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_8634.json
- https://access.redhat.com/errata/RHSA-2025:8666
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_8666.json
- https://access.redhat.com/errata/RHSA-2025:8667
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_8667.json
- https://access.redhat.com/errata/RHSA-2025:8682
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_8682.json
- https://access.redhat.com/errata/RHSA-2025:8689
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_8689.json
- https://access.redhat.com/errata/RHSA-2025:8737
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_8737.json
- https://access.redhat.com/errata/RHSA-2025:8915
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_8915.json
- https://access.redhat.com/errata/RHSA-2025:8916
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_8916.json
- https://access.redhat.com/errata/RHSA-2025:8918
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_8918.json
- https://access.redhat.com/errata/RHSA-2025:8974
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_8974.json
- https://access.redhat.com/errata/RHSA-2025:8975
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_8975.json
- https://access.redhat.com/errata/RHSA-2025:8982
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_8982.json
- https://access.redhat.com/errata/RHSA-2025:8983
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_8983.json
- https://access.redhat.com/errata/RHSA-2025:8984
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_8984.json
- https://access.redhat.com/errata/RHSA-2025:9017
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_9017.json
- https://access.redhat.com/errata/RHSA-2025:9018
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_9018.json
- https://access.redhat.com/errata/RHSA-2025:9019
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_9019.json
- https://access.redhat.com/errata/RHSA-2025:9020
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_9020.json
- https://access.redhat.com/errata/RHSA-2025:9025
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_9025.json
- https://access.redhat.com/errata/RHSA-2025:9043
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_9043.json
- https://access.redhat.com/errata/RHSA-2025:9059
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_9059.json
- https://access.redhat.com/errata/RHSA-2025:9060
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_9060.json
- https://access.redhat.com/errata/RHSA-2025:9061
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_9061.json
- https://access.redhat.com/errata/RHSA-2025:9062
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_9062.json
- https://access.redhat.com/errata/RHSA-2025:9063
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_9063.json
- https://access.redhat.com/errata/RHSA-2025:9064
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_9064.json
- https://access.redhat.com/errata/RHSA-2025:9065
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_9065.json
- https://access.redhat.com/errata/RHSA-2025:9067
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_9067.json
- https://access.redhat.com/errata/RHSA-2025:9069
- https://issues.redhat.com/browse/RHEL-79868
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_9069.json
- https://access.redhat.com/errata/RHSA-2025:9070
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_9070.json
- https://access.redhat.com/errata/RHSA-2025:9078
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_9078.json
- https://access.redhat.com/errata/RHSA-2025:9106
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_9106.json
- https://access.redhat.com/errata/RHSA-2025:9142
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_9142.json
- https://access.redhat.com/errata/RHSA-2025:9143
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_9143.json
- https://access.redhat.com/errata/RHSA-2025:9144
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_9144.json
- https://access.redhat.com/errata/RHSA-2025:9145
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_9145.json
- https://access.redhat.com/errata/RHSA-2025:9146
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_9146.json
- https://access.redhat.com/errata/RHSA-2025:9147
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_9147.json
- https://access.redhat.com/errata/RHSA-2025:9148
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_9148.json
- https://access.redhat.com/errata/RHSA-2025:9149
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_9149.json
- https://access.redhat.com/errata/RHSA-2025:9150
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_9150.json
- https://access.redhat.com/errata/RHSA-2025:9151
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_9151.json
- https://access.redhat.com/errata/RHSA-2025:9156
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_9156.json
- https://access.redhat.com/errata/RHSA-2025:9172
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_9172.json
- https://access.redhat.com/errata/RHSA-2025:9177
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_9177.json
- https://access.redhat.com/errata/RHSA-2025:9199
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_9199.json
- https://access.redhat.com/errata/RHSA-2025:9200
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_9200.json
- https://access.redhat.com/errata/RHSA-2025:9205
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_9205.json
- https://access.redhat.com/errata/RHSA-2025:9206
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_9206.json
- https://access.redhat.com/errata/RHSA-2025:9207
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_9207.json
- https://access.redhat.com/errata/RHSA-2025:9279
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_9279.json
- https://access.redhat.com/errata/RHSA-2025:9311
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_9311.json
- https://access.redhat.com/errata/RHSA-2025:9312
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_9312.json
- https://access.redhat.com/errata/RHSA-2025:9313
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_9313.json
- https://access.redhat.com/errata/RHSA-2025:9317
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_9317.json
- https://access.redhat.com/errata/RHSA-2025:9319
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_9319.json
- https://access.redhat.com/errata/RHSA-2025:9623
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_9623.json
- https://access.redhat.com/errata/RHSA-2025:9634
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_9634.json
- https://access.redhat.com/errata/RHSA-2025:9635
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_9635.json
- https://access.redhat.com/errata/RHSA-2025:9637
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_9637.json
- https://access.redhat.com/errata/RHSA-2025:9638
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_9638.json
- https://access.redhat.com/errata/RHSA-2025:9639
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_9639.json
- https://access.redhat.com/errata/RHSA-2025:9640
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_9640.json
- https://access.redhat.com/errata/RHSA-2025:9641
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_9641.json
- https://access.redhat.com/errata/RHSA-2025:9642
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_9642.json
- https://access.redhat.com/errata/RHSA-2025:9711
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_9711.json
- https://access.redhat.com/errata/RHSA-2025:9712
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_9712.json
- https://access.redhat.com/errata/RHSA-2025:9713
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_9713.json
- https://access.redhat.com/errata/RHSA-2025:9714
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_9714.json
- https://access.redhat.com/errata/RHSA-2025:9715
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_9715.json
- https://access.redhat.com/errata/RHSA-2025:9756
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_9756.json
- https://access.redhat.com/errata/RHSA-2025:9844
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_9844.json
- https://access.redhat.com/errata/RHSA-2025:9845
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_9845.json
- https://access.redhat.com/errata/RHSA-2025:9975
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_9975.json
- https://security-tracker.debian.org/tracker/CVE-2025-22871
- https://github.com/roadrunner-server/roadrunner/issues/2166
- https://github.com/roadrunner-server/roadrunner/commit/f269279ee87d0b88127741cad1042389af7605fa
- https://github.com/roadrunner-server/roadrunner
- https://github.com/roadrunner-server/roadrunner/releases/tag/v2025.1.0