HTTP Request Smuggling Affecting goliath package, versions >=0.0.0
Threat Intelligence
Exploit Maturity
Proof of concept
EPSS
0.09% (40th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-RUBY-GOLIATH-569136
- published 3 Jun 2020
- disclosed 3 Jun 2020
- credit Sam Sanoop of Snyk Security Team
Introduced: 3 Jun 2020
CVE-2020-7671 Open this link in a new tabHow to fix?
There is no fixed version for goliath.
Overview
goliath is an Async framework for writing API servers.
Affected versions of this package are vulnerable to HTTP Request Smuggling. HTTP pipelining issues and request smuggling attacks might be possible due to incorrect Content-Length and Transfer encoding header parsing.
It is possible to conduct HTTP request smuggling attacks where goliath is used as part of a chain of backend servers due to insufficient Content-Length and Transfer Encoding parsing.
References
CVSS Scores
version 3.1