CVE-2022-1705
MEDIUMCVSS 6.5/10EPSS 1.11%
Last modified
CVE-2022-1705 is a medium-severity vulnerability rated 6.5/10 on the CVSS scale. Acceptance of some invalid Transfer-Encoding headers in the HTTP/1 client in net/http before Go 1.17.12 and Go 1.18.4 allows HTTP request smuggling if combined with an intermediate server that also improperly fails to reject the header as invalid.. EPSS estimates a 1.11% chance of exploitation in the next 30 days.
Description
Acceptance of some invalid Transfer-Encoding headers in the HTTP/1 client in net/http before Go 1.17.12 and Go 1.18.4 allows HTTP request smuggling if combined with an intermediate server that also improperly fails to reject the header as invalid.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Golang | Go | < 1.17.12 |
| Golang | Go | >= 1.18.0, < 1.18.4 |
References
- https://go.dev/cl/409874Patch, Vendor Advisory
- https://go.dev/cl/410714Patch, Vendor Advisory
- https://go.dev/issue/53188Exploit, Issue Tracking, Patch, Vendor Advisory
- https://go.googlesource.com/go/+/e5017a93fcde94f09836200bca55324af037ee5fPatch, Vendor Advisory
- https://groups.google.com/g/golang-announce/c/nqrv9fbR0zERelease Notes, Vendor Advisory
- https://pkg.go.dev/vuln/GO-2022-0525Vendor Advisory
- https://go.dev/cl/409874Patch, Vendor Advisory
- https://go.dev/cl/410714Patch, Vendor Advisory
- https://go.dev/issue/53188Exploit, Issue Tracking, Patch, Vendor Advisory
- https://go.googlesource.com/go/+/e5017a93fcde94f09836200bca55324af037ee5fPatch, Vendor Advisory
- https://groups.google.com/g/golang-announce/c/nqrv9fbR0zERelease Notes, Vendor Advisory
- https://pkg.go.dev/vuln/GO-2022-0525Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2022-1705?
Acceptance of some invalid Transfer-Encoding headers in the HTTP/1 client in net/http before Go 1.17.12 and Go 1.18.4 allows HTTP request smuggling if combined with an intermediate server that also improperly fails to reject the header as invalid.
How severe is CVE-2022-1705?
CVE-2022-1705 has a CVSS score of 6.5/10 (MEDIUM severity). The EPSS model estimates a 1.11% probability of exploitation in the next 30 days.
How do I fix CVE-2022-1705?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2022
- CVE-2022-1699Uncontrolled Resource Consumption in GitHub repository cause…7.5
- CVE-2022-1700Improper Restriction of XML External Entity Reference ('XXE'…9.8
- CVE-2022-1701SonicWall SMA1000 series firmware 12.4.0, 12.4.1-02965 and e…7.5
- CVE-2022-1702SonicWall SMA1000 series firmware 12.4.0, 12.4.1-02965 and e…6.1
- CVE-2022-1703Improper neutralization of special elements in the SonicWall…8.8
- CVE-2022-1704Due to an XML external entity reference, the software parses…9.8
- CVE-2022-1706A vulnerability was found in Ignition where ignition configs…6.5
- CVE-2022-1707The Google Tag Manager for WordPress plugin for WordPress is…6.1
- CVE-2022-1708A vulnerability was found in CRI-O that causes memory or dis…7.5
- CVE-2022-1709The Throws SPAM Away WordPress plugin before 3.3.1 does not …4.3
- CVE-2022-1710The Appointment Hour Booking WordPress plugin before 1.3.56 …4.8
- CVE-2022-1711Server-Side Request Forgery (SSRF) in GitHub repository jgra…7.5
Are you affected by CVE-2022-1705?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST