modules:
  - module: std
    versions:
      - fixed: 1.12.10
      - introduced: 1.13.0
        fixed: 1.13.1
    vulnerable_at: 1.13.0
    packages:
      - package: net/textproto
        symbols:
          - Reader.ReadMimeHeader
        skip_fix: 'TODO: revisit this reason (fix appears to not work with Go <1.18)'
description: |
    net/http (through net/textproto) used to accept and normalize invalid
    HTTP/1.1 headers with a space before the colon, in violation of RFC 7230.

    If a Go server is used behind an uncommon reverse proxy that accepts and
    forwards but doesn't normalize such invalid headers, the reverse proxy and
    the server can interpret the headers differently. This can lead to filter
    bypasses or request smuggling, the latter if requests from separate clients
    are multiplexed onto the same upstream connection by the proxy. Such
    invalid headers are now rejected by Go servers, and passed without
    normalization to Go client applications.
published: 2022-05-23T22:46:20Z
cves:
  - CVE-2019-16276
credit: Andrew Stucki, Adam Scarr (99designs.com), and Jan Masarik (masarik.sh)
references:
  - fix: https://go.dev/cl/197503
  - fix: https://go.googlesource.com/go/+/41b1f88efab9d263408448bf139659119002ea50
  - report: https://go.dev/issue/34540
  - web: https://groups.google.com/g/golang-announce/c/cszieYyuL9Q/m/g4Z7pKaqAgAJ