Skip to content
Fencer Intel
high 7.5

CVE-2019-16276 json

Request smuggling due to accepting invalid headers in net/http via net/textproto

published 7y ago modified 4mo ago also GO-2022-0212 , EUVD-2019-7075

cvss
7.5
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
5.3%
EPSS 5.3% chance of exploitation in 30 days, percentile 92%
public exploits
0
none known

Summary

Go before 1.12.10 and 1.13.x before 1.13.1 allow HTTP Request Smuggling.

Patch / fix

  • go stdlib 1.12.10, 1.13.1
  • golang go 1.12.10, 1.13.1
  • openshift openshift 4.2 4.2.4-201911041319.git.0.c7d2111.el7
  • openshift openshift 4.2 4.2.4-201911041319.git.0.c7d2111.el8
  • openshift-clients openshift 4.2 4.2.4-201911010432.git.1.30c33a5.el7
  • openshift-clients openshift 4.2 4.2.4-201911010432.git.1.30c33a5.el8
  • openshift-hyperkube openshift 4.2 4.2.4-201911041319.git.0.c7d2111.el7
  • openshift-hyperkube openshift 4.2 4.2.4-201911041319.git.0.c7d2111.el8
  • openshift-enterprise-autoheal openshift 4.2 4.2.4-201911010432.git.1.0b5cd44.el7
  • atomic-openshift-service-idler openshift 4.2 4.2.4-201911041319.git.1.4131c2f.el7

red hat advisories RHBA-2019:3304RHSA-2020:0329RHSA-2020:0101

  • go1.12 openSUSE Tumbleweed 1.12.17-4.8
  • go1.13 openSUSE Tumbleweed 1.13.15-2.6
  • go1.12 openSUSE Leap 15.1 1.12.12-lp151.2.25.1
  • go1.12 openSUSE Leap 15.0 1.12.12-lp150.11.1

opensuse advisories openSUSE-SU-2024:10805-1openSUSE-SU-2024:10806-1openSUSE-SU-2019:2522-1openSUSE-SU-2019:2521-1

  • go Alpine 3.10 1.12.10-r0
  • go Alpine 3.24, Alpine 3.23, Alpine 3.22 +11 more 1.13.1-r0

alpine advisories ALPINE-CVE-2019-16276

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • go Arch Linux 2:1.13.1-1

arch linux advisories AVG-1050

Is CVE-2019-16276 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2019-16276 updated cvss 6.5

golang: HTTP/1.1 headers with a space before the colon leads to filter bypass or request smuggling

  • Red Hat Ceph Storage 2 golang, golang-bin, golang-src Red Hat Ceph Storage 3 golang, golang-bin, golang-src Red Hat Enterprise Linux 7 cpp, gcc, libgo, gcc-go, golang, libgcc, +20 more
    affected: no fix planned “Will not fix”
  • Red Hat OpenShift Container Platform 3.9 atomic-openshift, atomic-openshift-pod, atomic-openshift-node, atomic-openshift-tests, atomic-openshift-master, atomic-openshift-clients, +8 more Red Hat OpenShift Container Platform 3.10 atomic-openshift, atomic-openshift-pod, atomic-openshift-node, atomic-openshift-tests, atomic-openshift-master, atomic-openshift-clients, +7 more
    affected: no fix planned “Out of support scope”
  • Red Hat OpenShift Container Platform 3.11 apb, cri-o, podman, heapster, cri-tools, prometheus, +57 more Red Hat OpenShift Container Platform 4 apb, cri-o, podman, skopeo, ignition, cri-tools, +32 more
    affected: no fix planned “Will not fix”
  • Red Hat Storage 3 golang, golang-bin, golang-src, golang-misc, golang-tests
    affected: no fix available “Fix deferred”
  • Red Hat Developer Tools for Red Hat Enterprise Linux Server (v. 7) go-toolset-1.12 1.12.12-4.el7, go-toolset-1.12-build 1.12.12-4.el7, go-toolset-1.12-golang 1.12.12-4.el7, go-toolset-1.12-runtime 1.12.12-4.el7, go-toolset-1.12-golang-bin 1.12.12-4.el7, go-toolset-1.12-golang-src 1.12.12-4.el7, +3 more Red Hat Developer Tools for Red Hat Enterprise Linux Workstation (v. 7) go-toolset-1.12 1.12.12-4.el7, go-toolset-1.12-build 1.12.12-4.el7, go-toolset-1.12-golang 1.12.12-4.el7, go-toolset-1.12-runtime 1.12.12-4.el7, go-toolset-1.12-golang-bin 1.12.12-4.el7, go-toolset-1.12-golang-src 1.12.12-4.el7, +3 more
    fixed: vendor fix RHSA-2020:0101
  • Red Hat Enterprise Linux AppStream (v. 8) golang 1.12.12-4.module+el8.1.0+5317+8a49ffbb, go-toolset 1.12.12-2.module+el8.1.0+5317+8a49ffbb, golang-bin 1.12.12-4.module+el8.1.0+5317+8a49ffbb, golang-src 1.12.12-4.module+el8.1.0+5317+8a49ffbb, golang-misc 1.12.12-4.module+el8.1.0+5317+8a49ffbb, golang-race 1.12.12-4.module+el8.1.0+5317+8a49ffbb, +1 more
    fixed: vendor fix RHSA-2020:0329
  • Red Hat OpenShift Container Platform 4.2 openshift4/ose-cli v4.2.4-201911050122, openshift4/ose-node v4.2.4-201911050122, openshift4/ose-tests v4.2.4-201911072324, openshift4/ose-coredns v4.2.4-201911050122, openshift4/ose-hyperkube v4.2.4-201911071146, openshift4/ose-installer v4.2.21-202002240343, +41 more
    fixed: vendor fix RHBA-2019:3304
  • Red Hat OpenShift Container Platform 4.3 openshift4/ose-pod v4.3.0-202001211731, openshift4/ose-etcd v4.3.0-202001211731, openshift4/ose-console v4.3.0-202001211731, openshift4/ose-grafana v4.3.0-202001211731, openshift4/ose-telemeter v4.3.0-202001211731, openshift4/ose-multus-cni v4.3.0-202001211731, +32 more
    fixed: vendor fix RHBA-2020:0062
show 1 more
  • Red Hat OpenShift Container Platform 4.2 faq 0.0.6-4.el7, pivot 0.0.5-2.rhaos4.2.el8, openshift4/ose-pod v4.2.4-201911050122, openshift4/ose-etcd v4.2.4-201911050122, ignition 0.33.0-6.rhaos4.2.gitc65e95c.el8, openshift4/ose-console v4.2.4-201911050122, +66 more Red Hat OpenShift Container Platform 4.3 openshift4/ose-cli v4.3.0-202001211731, openshift4/ose-tests v4.3.0-202001211731, openshift4/ose-coredns v4.3.0-202001211731, openshift4/ose-jenkins v4.3.0-202001211731, openshift4/ose-deployer v4.3.0-202001211731, openshift4/ose-hyperkube v4.3.0-202001211731, +36 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

5.30% chance of exploitation in the next 30 days, higher than 92% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
NVD 2.0 5.0 AV:N/AC:L/Au:N/C:N/I:P/A:N

Affected packages

ecosystem package affected fixed in
go stdlib
<1.12.10
>=1.13.0-0, <1.13.1
1.12.10
1.13.1

Classification

Weakness
  • CWE-444 Inconsistent Interpretation of HTTP Requests

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.