CVE-2025-22871 — Request smuggling due to acceptance of invalid chunked data in net/http

Affected: Go standard library net/http/internal, Siemens SENTRON 7KT PAC1261 Data Manager

The net/http package improperly accepts a bare LF as a line terminator in chunked data chunk-size lines. This can permit request smuggling if a net/http server is used in conjunction with a server that incorrectly accepts a bare LF as part of a chunk-ext.

GHSA-f6x5-jh6r-wrfv — golang.org/x/crypto/ssh/agent vulnerable to panic if message is malformed due to out of bounds read

Affected: Go: golang.org/x/crypto

SSH Agent servers do not validate the size of messages when processing new identity requests, which may cause the program to panic if the message is malformed due to an out of bounds read.

Most recent entries from all

CVE-2025-22871 — Request smuggling due to acceptance of invalid chunked data in net/http

GHSA-f6x5-jh6r-wrfv — golang.org/x/crypto/ssh/agent vulnerable to panic if message is malformed due to out of bounds read