id: GO-2022-0212
modules:
    - module: std
      versions:
        - fixed: 1.12.10
        - introduced: 1.13.0-0
        - fixed: 1.13.1
      vulnerable_at: 1.13.0
      packages:
        - package: net/textproto
          symbols:
            - Reader.ReadMimeHeader
          skip_fix: 'TODO: revisit this reason (fix appears to not work with Go <1.18)'
summary: Request smuggling due to accepting invalid headers in net/http via net/textproto
description: |-
    net/http (through net/textproto) used to accept and normalize invalid HTTP/1.1
    headers with a space before the colon, in violation of RFC 7230.

    If a Go server is used behind an uncommon reverse proxy that accepts and
    forwards but doesn't normalize such invalid headers, the reverse proxy and the
    server can interpret the headers differently. This can lead to filter bypasses
    or request smuggling, the latter if requests from separate clients are
    multiplexed onto the same upstream connection by the proxy. Such invalid headers
    are now rejected by Go servers, and passed without normalization to Go client
    applications.
published: 2022-05-23T22:46:20Z
cves:
    - CVE-2019-16276
credits:
    - Andrew Stucki (99designs.com)
    - Adam Scarr (99designs.com)
    - Jan Masarik (masarik.sh)
references:
    - fix: https://go.dev/cl/197503
    - fix: https://go.googlesource.com/go/+/41b1f88efab9d263408448bf139659119002ea50
    - report: https://go.dev/issue/34540
    - web: https://groups.google.com/g/golang-announce/c/cszieYyuL9Q/m/g4Z7pKaqAgAJ
review_status: REVIEWED