Description
Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a reverse proxy. If the HTTP/1 client also does not behave strictly enough, this can result in response smuggling.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Go standard library net/http
Default version status: unaffected
0 to < 1.26.9affected
Go standard library net/http/internal/http2
Default version status: unaffected
1.27.0-0 to < 1.27.2affected
golang.org/x/net golang.org/x/net/http2
Default version status: unaffected
0 to < 0.60.0affected