[GH-ISSUE #193] CVE GO-2025-3563 #50

New issue

Closed

opened 2026-03-03 15:29:53 +03:00 by kerem · 1 comment

kerem commented

2026-03-03 15:29:53 +03:00

Owner

Originally created by @mcbenjemaa on GitHub (May 19, 2025).
Original GitHub issue: https://github.com/luthermonson/go-proxmox/issues/193

Request smuggling due to acceptance of invalid chunked data in net/http
More info: https://pkg.go.dev/vuln/GO-2025-3563
Standard library
Found in: net/http/internal@go1.23.7
Fixed in: net/http/internal@go1.23.8
Example traces found:

proxmox.VirtualMachine.Delete

which eventually calls internal.chunkedReader.Read

Originally created by @mcbenjemaa on GitHub (May 19, 2025). Original GitHub issue: https://github.com/luthermonson/go-proxmox/issues/193 Request smuggling due to acceptance of invalid chunked data in net/http More info: https://pkg.go.dev/vuln/GO-2025-3563 Standard library Found in: net/http/internal@go1.23.7 Fixed in: net/http/internal@go1.23.8 Example traces found: ``` proxmox.VirtualMachine.Delete ``` which eventually calls internal.chunkedReader.Read