HTTP Request Smuggling Affecting std/net/textproto package, versions <1.12.10>=1.13.0-0 <1.13.1
Threat Intelligence
The probability is the direct output of the EPSS model, and conveys an overall sense of the threat of exploitation in the wild. The percentile measures the EPSS probability relative to all known EPSS scores. Note: This data is updated daily, relying on the latest available EPSS model version. Check out the EPSS documentation for more details.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-GOLANG-STDNETTEXTPROTO-14552570
- published6 Jan 2026
- disclosed23 May 2022
- creditAndrew Stucki, Adam Scarr, Jan Masarik
Introduced: 23 May 2022
CVE-2019-16276 (opens in a new tab)How to fix?
Upgrade std/net/textproto to version 1.12.10, 1.13.1 or higher.
Overview
std/net/textproto is a Go standard library package std/net/textproto
Affected versions of this package are vulnerable to HTTP Request Smuggling.
Go Vulnerability Report:
net/http (through net/textproto) used to accept and normalize invalid HTTP/1.1 headers with a space before the colon, in violation of RFC 7230. If a Go server is used behind an uncommon reverse proxy that accepts and forwards but doesn't normalize such invalid headers, the reverse proxy and the server can interpret the headers differently. This can lead to filter bypasses or request smuggling, the latter if requests from separate clients are multiplexed onto the same upstream connection by the proxy. Such invalid headers are now rejected by Go servers, and passed without normalization to Go client applications.