CVE-2025-22871 json
Request smuggling due to acceptance of invalid chunked data in net/http
published 2025-04-08 19 mo ago modified 2026-10-16 24 d ago also BIT-golang-2025-22871 , EUVD-2025-11855 , GHSA-g9pc-8g42-g6vq , GO-2025-3563
- cvss
- 9.1
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.8%
- EPSS 0.8% chance of exploitation in 30 days, percentile 58%
- public exploits
- 0
- none known
Summary
The net/http package improperly accepts a bare LF as a line terminator in chunked data chunk-size lines. This can permit request smuggling if a net/http server is used in conjunction with a server that incorrectly accepts a bare LF as part of a chunk-ext.
Patch / fix
- packagist spiral/roadrunner 2025.1.0
- bitnami golang 1.23.8, 1.24.2
- go stdlib 1.23.8, 1.24.2
- Go standard library net/http/internal 1.23.8, 1.24.2
- Siemens SENTRON 7KT PAC1261 Data Manager V2.1.0
- golang-1.24 Debian 13 1.24.2-1
debian advisories DEBIAN-CVE-2025-22871
- runc openshift 4.14 4:1.2.5-2.rhaos4.17.el8
- runc openshift 4.14 4:1.2.5-2.rhaos4.17.el9
- cri-o openshift 4.14 1.27.8-16.rhaos4.14.gite1422c1.el8
- cri-o openshift 4.14 1.27.8-16.rhaos4.14.gite1422c1.el9
- skopeo openshift 4.14 2:1.11.3-5.rhaos4.14.el8
- skopeo openshift 4.14 2:1.11.3-5.rhaos4.14.el9
- cri-tools openshift 4.14 1.27.0-7.el8
- cri-tools openshift 4.14 1.27.0-7.el9
red hat advisories RHSA-2025:21328RHSA-2025:15291RHBA-2025:14817RHSA-2025:12850RHSA-2025:12831RHSA-2025:11682
- go1.24 SLES 16.0, SLES for SAP applications 16.0 1.24.13-160000.3.1
- go1.25 SLES 16.0, SLES for SAP applications 16.0 1.25.12-160000.2.1
- go1.26 SLES 16.0, SLES for SAP applications 16.0 1.26.5-160000.2.1
- go1.24-openssl SLES 16.0, SLES for SAP applications 16.0 1.24.13-160000.3.1
- go1.25-openssl SLES 16.0, SLES for SAP applications 16.0 1.25.12-160000.2.1
- go1.26-openssl SLES 16.0, SLES for SAP applications 16.0 1.26.5-160000.2.1
- go1.23-openssl SLE Module for Development Tools 15 SP7, SLE Module for Development Tools 15 SP6, openSUSE Leap 15.6 1.23.12-150600.13.9.1
- go1.23-openssl SLES for SAP 15 SP5, SLES for SAP 15 SP4, SLES for SAP 15 SP3 +9 more 1.23.9-150000.1.9.1
suse advisories SUSE-SU-2026:22950-1SUSE-SU-2026:22958-1SUSE-SU-2025:03159-1SUSE-SU-2025:01731-1SUSE-SU-2025:1153-1SUSE-SU-2025:1141-1
- go1.21 openSUSE Leap 16.0 1.21.13-160000.3.1
- go1.22 openSUSE Leap 16.0 1.22.12-160000.4.1
- go1.23 openSUSE Leap 16.0 1.23.12-160000.3.1
- go1.24 openSUSE Leap 16.0 1.24.13-160000.3.1
- go1.25 openSUSE Leap 16.0 1.25.12-160000.2.1
- go1.26 openSUSE Leap 16.0 1.26.5-160000.2.1
- go1.22-openssl openSUSE Leap 16.0 1.22.12-160000.4.1
- go1.23-openssl openSUSE Leap 16.0 1.23.12-160000.3.1
opensuse advisories openSUSE-SU-2026:21447-1openSUSE-SU-2025:15352-1openSUSE-SU-2025:15305-1openSUSE-SU-2025:15029-1openSUSE-SU-2025:14978-1openSUSE-SU-2025:14962-1
- opentelemetry-collector AlmaLinux 9 0.127.0-1.el9_6
- opentelemetry-collector AlmaLinux 10 0.127.0-1.el10_0
- osbuild-composer AlmaLinux 8 101-4.el8_10.alma.1
- osbuild-composer-core AlmaLinux 8 101-4.el8_10.alma.1
- osbuild-composer-worker AlmaLinux 8 101-4.el8_10.alma.1
- weldr-client AlmaLinux 8 35.12-3.el8_10
- osbuild-composer AlmaLinux 10 134.1-2.el10_0.alma.1
- osbuild-composer-core AlmaLinux 10 134.1-2.el10_0.alma.1
almalinux advisories ALSA-2025:12831ALSA-2025:12850ALSA-2025:9844ALSA-2025:9845ALSA-2025:9623ALSA-2025:9634
- osbuild-composer Rocky Linux 8 101-4.el8_10.rocky.0.6
- opentelemetry-collector Rocky Linux 9 0.127.0-1.el9_6
- golang Rocky Linux 9 1.23.9-1.el9_6
- grafana Rocky Linux 9 10.2.6-14.el9_6
- grafana-pcp Rocky Linux 9 5.1.1-11.el9_6
- git-lfs Rocky Linux 9 3.6.1-2.el9_6
- containernetworking-plugins Rocky Linux 9 1:1.6.2-2.el9_6
- podman Rocky Linux 9 5:5.4.0-10.el9_6
rocky linux advisories RLSA-2025:9844RLSA-2025:12831RLSA-2025:8476RLSA-2025:8682RLSA-2025:8916RLSA-2025:9106
- go Alpine 3.21 1.23.8-r0
- go Alpine 3.24, Alpine 3.23, Alpine 3.22 1.24.2-r0
alpine advisories ALPINE-CVE-2025-22871
Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- msft-golang CBL-Mariner 2.0 1.24.1-2
- golang CBL-Mariner 2.0 1.18.8-7
- golang CBL-Mariner 2.0 1.22.7-3
azure linux advisories AZL-59652AZL-59656AZL-59666
Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2025-22871 updated cvss 5.4
net/http: Request smuggling due to acceptance of invalid chunked data in net/http
-
Red Hat Custom Metric Autoscaler operator for Red Hat Openshift custom-metrics-autoscaler/custom-metrics-autoscaler-rhel8 Red Hat OpenShift Developer Tools and Services odo, helm Red Hat OpenShift Pipelines openshift-pipelines-clientaffected: workaround, no fix available
-
Red Hat OpenShift Service Mesh 2 openshift-golang-builder-container Red Hat Advanced Cluster Management for Kubernetes 2 flightctl, flightctl-agent, flightctl-selinuxaffected: workaround, no fix planned “Will not fix”
-
Red Hat Certification for Red Hat Enterprise Linux 8 redhat-certification-preflight Red Hat Certification Program for Red Hat Enterprise Linux 9 redhat-certification-preflight Red Hat Edge Manager preview flightctl, flightctl-api-rhel9affected: workaround, no fix available
-
Red Hat Enterprise Linux 7 skopeo, host-metering, rhc-worker-script, host-metering-selinuxaffected: workaround, no fix planned “Out of support scope”
-
Red Hat Enterprise Linux 9 butane, ignition, ignition-edge, ignition-grub, ignition-validate Red Hat Enterprise Linux 10 butane, ignitionaffected: workaround, no fix planned “Will not fix”
-
Red Hat OpenShift Container Platform 4 butane, ignition, microshift, microshift-olm, openshift-kuryr, microshift-sriov, +26 moreaffected: workaround, no fix available, no fix planned “Out of support scope”
-
Red Hat OpenShift on AWS rosa Red Hat OpenShift Virtualization 4 kubevirt, openshift-golang-builder-container Red Hat Satellite 6 yggdrasil-worker-forwarderaffected: workaround, no fix available
-
Red Hat Cryostat 4 on RHEL 9 cryostat/cryostat-rhel9 4.0.1-3, cryostat/cryostat-db-rhel9 4.0.1-5, cryostat/jfr-datasource-rhel9 4.0.1-3, cryostat/cryostat-reports-rhel9 4.0.1-3, cryostat/cryostat-storage-rhel9 4.0.1-5, cryostat/cryostat-rhel9-operator 4.0.1-5, +5 morefixed: vendor fix RHSA-2025:10323
show 21 moreshow fewer
-
Red Hat Custom Metric Autoscaler operator for Red Hat Openshift 2.17 custom-metrics-autoscaler 2.17.2-1755715459, custom-metrics-autoscaler 2.17.2-1755715476, custom-metrics-autoscaler 2.17.2-1755715722, custom-metrics-autoscaler 2.17.2-1755716621fixed: vendor fix RHSA-2025:16124
-
Red Hat Logging Subsystem for Red Hat OpenShift 6.2 openshift-loggingfixed: vendor fix RHSA-2025:13241
-
Red Hat multicluster engine for Kubernetes 2.7 multicluster-enginefixed: vendor fix RHSA-2025:22683
-
Red Hat Multicluster Global Hub 1.4.9 multicluster-globalhub 1.4.2-1753321485fixed: vendor fix RHSA-2025:12891
-
Red Hat OpenShift API for Data Protection 1.4 oadp/oadp-velero-rhel9 1.4.5-20fixed: vendor fix RHSA-2025:11396
-
Red Hat Advanced Cluster Management for Kubernetes 2.13 for RHEL 9 rhacm2/subctl-rhel9 v0.20.1-2, rhacm2/nettest-rhel9 v0.20.1-4, rhacm2/lighthouse-agent-rhel9 v0.20.1-1, rhacm2/lighthouse-coredns-rhel9 v0.20.1-1, rhacm2/submariner-gateway-rhel9 v0.20.1-1, rhacm2/submariner-rhel9-operator v0.20.1-2, +3 morefixed: vendor fix RHSA-2025:8691
-
Red Hat Ansible Automation Platform 2.4 for RHEL 8 receptor 1.5.7-1.el8ap Red Hat Ansible Automation Platform 2.4 for RHEL 9 receptor 1.5.7-1.el9apfixed: vendor fix RHSA-2025:9975
-
Red Hat Ansible Automation Platform 2.5 for RHEL 8 receptor 1.5.7-2.el8ap, receptorctl 1.5.7-2.el8ap, automation-gateway-proxy 2.5.10-2.el8ap, automation-gateway-proxy-server 2.5.10-2.el8ap Red Hat Ansible Automation Platform 2.5 for RHEL 9 receptor 1.5.7-2.el9ap, receptorctl 1.5.7-2.el9ap, automation-gateway-proxy-openssl30 2.6.6-2.el9ap, automation-gateway-proxy-openssl32 2.6.6-2.el9ap, automation-gateway-proxy-openssl30-server 2.6.6-2.el9ap, automation-gateway-proxy-openssl32-server 2.6.6-2.el9apfixed: vendor fix RHSA-2025:9986
-
Red Hat Ceph Storage 7.1 Tools rhceph/rhceph-7-rhel9 7-533, rhceph/grafana-rhel9 11.6.2-9, rhceph/grafana-rhel10 11.6.2-9, rhceph/keepalived-rhel9 2.2.8-76, rhceph/snmp-notifier-rhel9 1.2.1-126, rhceph/rhceph-haproxy-rhel9 2.4.22-78, +1 morefixed: vendor fix RHSA-2025:13671
-
Red Hat Ceph Storage 8.1 Tools rhceph/grafana-rhel9 11.6.2-4fixed: vendor fix RHSA-2025:11749
-
Red Hat Enterprise Linux AppStream (v. 8) git-lfs 3.4.1-5.el8_10, grafana 9.2.10-25.el8_10, grafana-pcp 5.1.1-10.el8_10, weldr-client 35.12-3.el8_10, osbuild-composer 101-4.el8_10, grafana-selinux 9.2.10-25.el8_10, +42 morefixed: vendor fix RHSA-2025:9142
-
Red Hat Enterprise Linux AppStream (v. 9) git-lfs 3.6.1-2.el9_6, golang 1.23.9-1.el9_6, podman 5.4.0-10.el9_6, skopeo 1.18.1-2.el9_6, buildah 1.39.4-2.el9_6, grafana 10.2.6-14.el9_6, +22 morefixed: vendor fix RHSA-2025:9147
-
Red Hat Enterprise Linux AppStream (v. 10) delve 1.24.1-2.el10_0, git-lfs 3.6.1-2.el10_0, golang 1.23.9-1.el10_0, podman 5.4.0-10.el10_0, skopeo 1.18.1-2.el10_0, buildah 1.39.4-2.el10_0, +20 morefixed: vendor fix RHSA-2025:9148
-
Red Hat Enterprise Linux AppStream AUS (v. 8.2) grafana 6.3.6-8.el8_2, grafana-loki 6.3.6-8.el8_2, grafana-mssql 6.3.6-8.el8_2, grafana-mysql 6.3.6-8.el8_2, grafana-graphite 6.3.6-8.el8_2, grafana-influxdb 6.3.6-8.el8_2, +15 morefixed: vendor fix RHSA-2025:9319
-
Red Hat Enterprise Linux AppStream AUS (v.8.4) grafana 7.3.6-10.el8_4, git-lfs 2.13.3-3.el8_4.2, grafana-pcp 3.0.2-2.el8_4, osbuild-composer 28.7-3.el8_4, osbuild-composer-core 28.7-3.el8_4, osbuild-composer-worker 28.7-3.el8_4, +8 morefixed: vendor fix RHSA-2025:9172
-
Red Hat Enterprise Linux AppStream AUS (v.8.6) grafana 7.5.11-7.el8_6, git-lfs 2.13.3-3.el8_6.4, grafana-pcp 3.2.0-2.el8_6, weldr-client 35.5-2.el8_6, osbuild-composer 46.3-3.el8_6, osbuild-composer-core 46.3-3.el8_6, +43 more Red Hat Enterprise Linux AppStream E4S (v.8.6) grafana 7.5.11-7.el8_6, git-lfs 2.13.3-3.el8_6.4, grafana-pcp 3.2.0-2.el8_6, weldr-client 35.5-2.el8_6, osbuild-composer 46.3-3.el8_6, osbuild-composer-core 46.3-3.el8_6, +43 morefixed: vendor fix RHSA-2025:9312
-
Red Hat Enterprise Linux AppStream E4S (v.8.8) grafana 7.5.15-7.el8_8, git-lfs 3.2.0-2.el8_8.4, grafana-pcp 3.2.0-4.el8_8, weldr-client 35.9-3.el8_8, osbuild-composer 75-4.el8_8, osbuild-composer-core 75-4.el8_8, +43 morefixed: vendor fix RHSA-2025:9025
-
Red Hat Enterprise Linux AppStream E4S (v.9.0) golang 1.17.13-6.el9_0, podman 4.2.0-6.el9_0.4, grafana 7.5.11-11.el9_0, buildah 1.26.9-1.el9_0.1, git-lfs 2.13.3-5.el9_0.4, skopeo 1.8.0-4.1.el9_0.1, +20 morefixed: vendor fix RHSA-2025:9062
-
Red Hat Enterprise Linux AppStream E4S (v.9.2) grafana 9.0.9-8.el9_2, git-lfs 3.2.0-2.el9_2.3, golang 1.19.13-16.el9_2, podman 4.4.1-22.el9_2.2, buildah 1.29.5-1.el9_2.1, grafana-pcp 5.1.1-3.el9_2, +19 morefixed: vendor fix RHSA-2025:9017
-
Red Hat Enterprise Linux AppStream EUS (v.9.4) golang 1.21.13-9.el9_4, git-lfs 3.4.1-4.el9_4.2, grafana 9.2.10-23.el9_4, podman 4.9.4-18.el9_4.1, skopeo 1.14.5-2.el9_4.1, buildah 1.33.12-2.el9_4.1, +20 morefixed: vendor fix RHSA-2025:8632
-
Red Hat Enterprise Linux AppStream TUS (v.8.6) grafana 7.5.11-7.el8_6, git-lfs 2.13.3-3.el8_6.4, grafana-pcp 3.2.0-2.el8_6, weldr-client 35.5-2.el8_6, osbuild-composer 46.3-3.el8_6, osbuild-composer-core 46.3-3.el8_6, +43 morefixed: vendor fix RHSA-2025:9312
16 more fixed, 37 more not affected in the full advisory
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
cisa ICSA-26-134-14 updated cvss 9.1
Siemens SENTRON 7KT PAC1261 Data Manager
-
Siemens SENTRON 7KT PAC1261 Data Manager < 2.1.0affected: fixed in V2.1.0, mitigation support.industry.siemens.com
Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- total
- Assessed
- 18 mo ago
Exploit prediction
0.84% chance of exploitation in the next 30 days, higher than 58% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 9.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N |
| GitHub | 3.1 | 9.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N |
| CNA | 3.1 | 9.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N |
| OSV | 3.1 | 9.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | spiral/roadrunner | <2025.1.0 |
2025.1.0 |
| bitnami | golang | <1.23.8 >=1.24.0-0, <1.24.2 |
1.23.8 1.24.2 |
| go | stdlib | <1.23.8 >=1.24.0-0, <1.24.2 |
1.23.8 1.24.2 |
Affected products
- Go standard library net/http/internal
- Siemens SENTRON 7KT PAC1261 Data Manager
Classification
References
-
go.dev
/cl/652998
web, patch
-
github.com
/roadrunner-server/roadrunner/commit/f269279ee87d0b88127741cad1042389af7605fa
web
-
go.dev
/issue/71988
web, report
-
groups.google.com
/g/golang-announce/c/Y2uBTVKjBQk
web
-
pkg.go.dev
/vuln/GO-2025-3563
web
-
openwall.com
/lists/oss-security/2025/04/04/4
web
-
cert-portal.siemens.com
/productcert/html/ssa-783943.html
web
-
nvd.nist.gov
/vuln/detail/CVE-2025-22871
advisory, web
-
github.com
/roadrunner-server/roadrunner/issues/2166
web
-
github.com
/roadrunner-server/roadrunner
package
-
github.com
/roadrunner-server/roadrunner/releases/tag/v2025.1.0
web
Sources
- CVE List CVE-2025-22871
- GitHub Advisory GHSA-g9pc-8g42-g6vq
- NVD CVE-2025-22871
- OSV BIT-golang-2025-22871
- OSV GO-2025-3563
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.