You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The MIME header parser treated spaces and hyphens as equivalent, which can permit HTTP request smuggling.
This was originally done in https://codereview.appspot.com/5690059 (Feb 2012) to deal with bad response headers coming back from webcams, but it presents a potential security problem with HTTP request smuggling for request headers containing "Content Length" instead of "Content-Length".
Part of overall HTTP hardening for request smuggling. See RFC 7230.
The MIME header parser treated spaces and hyphens as equivalent, which can permit HTTP request smuggling.
This was originally done in https://codereview.appspot.com/5690059 (Feb 2012) to deal with bad response headers coming back from webcams, but it presents a potential security problem with HTTP request smuggling for request headers containing "Content Length" instead of "Content-Length".
Part of overall HTTP hardening for request smuggling. See RFC 7230.
This is CVE-2015-5739 and is fixed in Go 1.4.3.
"Content Length" treated as valid header:
https://go-review.googlesource.com/#/c/11772/
Thank you Régis Leroy for reporting.
The text was updated successfully, but these errors were encountered: