The net/http package improperly accepts a bare LF as a line terminator in chunked data chunk-size lines. This can permit request smuggling if a net/http server is used in conjunction with a server that incorrectly accepts a bare LF as part of a chunk-ext.

Published: 2025-04-08

CVSS: 9.1

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Download Exploit for CVE-2025-22871 here:

Use Tor Browser to access .onion links.

Check our team here:

https://tatramed.sk/exploit-111-cve-2016-1585/

https://tatramed.sk/exploit-790-cve-2018-3646/

https://tatramed.sk/exploit-658-cve-2023-45857/

https://tatramed.sk/exploit-797-cve-2014-1812/