module: std
package: net/textproto
versions:
- fixed: go1.4.3
description: |
  The MIME header parser treated spaces and hyphens
  as equivalent, which can permit HTTP request smuggling.
published: 2022-01-05T20:00:00Z
cves:
- CVE-2015-5739
credit: Régis Leroy
symbols:
- CanonicalMIMEHeaderKey
- canonicalMIMEHeaderKey
links:
  pr: https://go.dev/cl/11772
  commit: https://go.googlesource.com/go/+/117ddcb83d7f42d6aa72241240af99ded81118e9
  context:
  - https://groups.google.com/g/golang-announce/c/iSIyW4lM4hY/m/ADuQR4DiDwAJ