AIKIDO-2024-10537
github.com/valyala/fasthttp is vulnerable to HTTP Request/Response Smuggling
55
Medium Risk
This Affects:
github.com/valyala/fasthttpTL;DR
Affected versions of this package are vulnerable to request smuggling due to improper handling of chunked HTTP requests. Specifically, fasthttp allows newline characters (\n) between the chunk size and the CRLF within the chunk extension. This behavior can lead to request smuggling vulnerabilities when used with certain reverse proxies, potentially enabling attackers to bypass security controls or inject malicious requests. The issue has been mitigated in newer versions by disallowing newlines in the chunk extension.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
github.com/valyala/fasthttp is vulnerable to HTTP Request/Response Smuggling in versions 0.1.0 - 1.57.0.
How to fix this
Upgrade the github.com/valyala/fasthttp library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant