The net/http library in net/http/transfer.go in Go before 1.4.3 does not properly parse HTTP headers, which allows remote attackers to conduct HTTP request smuggling attacks via a request that contains Content-Length and Transfer-Encoding header fields.
| Software | From | Fixed in |
|---|---|---|
| redhat / enterprise_linux | 7.0 | 7.0.x |
| redhat / openstack | 7.0 | 7.0.x |
| redhat / openstack | 8 | 8.x |
| golang / go | - | 1.4.3 |