Skip to content
Fencer Vulns
medium 6.1

CVE-2019-9741 json

An issue was discovered in net/http in Go 1.11.5.

published 2019-03-13 7 y ago modified 2026-06-17 4 mo ago also EUVD-2019-19104

cvss
6.1
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
2.2%
EPSS 2.2% chance of exploitation in 30 days, percentile 82%
public exploits
0
none known

Summary

An issue was discovered in net/http in Go 1.11.5. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the second argument to http.NewRequest with \r\n followed by an HTTP header or a Redis command.

Patch / fix

  • golang RHEL 8 1.11.5-2.module+el8.0.0+3175+261ae921
  • go-toolset RHEL 8 1.11.5-2.module+el8.0.0+3175+261ae921
  • golang-bin RHEL 8 1.11.5-2.module+el8.0.0+3175+261ae921
  • golang-src RHEL 8 1.11.5-2.module+el8.0.0+3175+261ae921
  • golang-misc RHEL 8 1.11.5-2.module+el8.0.0+3175+261ae921
  • golang-race RHEL 8 1.11.5-2.module+el8.0.0+3175+261ae921
  • golang-tests RHEL 8 1.11.5-2.module+el8.0.0+3175+261ae921
  • go-toolset-1.11-golang devtools 2019 1.11.5-3.el7

red hat advisories RHSA-2019:1519RHSA-2019:1300

  • python-tensorboard Azure Linux 3.0 2.16.2-1

azure linux advisories AZL-38599

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2019-9741 updated cvss 5.3

golang: CRLF injection in net/http

  • Red Hat Ceph Storage 2 golang, golang-bin, golang-src Red Hat Ceph Storage 3 golang, golang-bin, golang-src Red Hat Enterprise Linux 7 golang, golang-bin, golang-src, golang-misc, golang-tests Red Hat OpenStack Platform 8 (Liberty) Operational Tools golang, golang-src, golang-pkg-linux-amd64, golang-pkg-bin-linux-amd64 Red Hat OpenStack Platform 9 (Mitaka) Operational Tools golang, golang-bin, golang-src Red Hat Storage 3 golang, golang-bin, golang-src, golang-misc, golang-tests
    affected: no fix planned “Will not fix”
  • Red Hat Developer Tools for Red Hat Enterprise Linux Server (v. 7) go-toolset-1.11 1.11.5-2.el7, go-toolset-1.11-build 1.11.5-2.el7, go-toolset-1.11-golang 1.11.5-3.el7, go-toolset-1.11-runtime 1.11.5-2.el7, go-toolset-1.11-scldevel 1.11.5-2.el7, go-toolset-1.11-golang-bin 1.11.5-3.el7, +4 more Red Hat Developer Tools for Red Hat Enterprise Linux Workstation (v. 7) go-toolset-1.11 1.11.5-2.el7, go-toolset-1.11-build 1.11.5-2.el7, go-toolset-1.11-golang 1.11.5-3.el7, go-toolset-1.11-runtime 1.11.5-2.el7, go-toolset-1.11-scldevel 1.11.5-2.el7, go-toolset-1.11-golang-bin 1.11.5-3.el7, +4 more
    fixed: vendor fix RHSA-2019:1300
  • Red Hat Enterprise Linux AppStream (v. 8) golang 1.11.5-2.module+el8.0.0+3175+261ae921, go-toolset 1.11.5-2.module+el8.0.0+3175+261ae921, golang-bin 1.11.5-2.module+el8.0.0+3175+261ae921, golang-src 1.11.5-2.module+el8.0.0+3175+261ae921, golang-misc 1.11.5-2.module+el8.0.0+3175+261ae921, golang-race 1.11.5-2.module+el8.0.0+3175+261ae921, +1 more
    fixed: vendor fix RHSA-2019:1519

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

2.20% chance of exploitation in the next 30 days, higher than 82% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/golang/go/issues/30794 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 3.1 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
NVD 2.0 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N

Classification

Weakness
  • CWE-93 Improper Neutralization of CRLF Sequences

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.