HTTP Request Smuggling Affecting goliath package, versions >=0.0.0


Severity

Recommended
0.0
medium
0
10

CVSS assessment made by Snyk's Security Team. Learn more

Threat Intelligence

Exploit Maturity
Proof of concept
EPSS
0.09% (41st percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-RUBY-GOLIATH-569136
  • published3 Jun 2020
  • disclosed3 Jun 2020
  • creditSam Sanoop of Snyk Security Team

Introduced: 3 Jun 2020

CVE-2020-7671  (opens in a new tab)
CWE-200  (opens in a new tab)
First added by Snyk

How to fix?

There is no fixed version for goliath.

Overview

goliath is an Async framework for writing API servers.

Affected versions of this package are vulnerable to HTTP Request Smuggling. HTTP pipelining issues and request smuggling attacks might be possible due to incorrect Content-Length and Transfer encoding header parsing.

It is possible to conduct HTTP request smuggling attacks where goliath is used as part of a chain of backend servers due to insufficient Content-Length and Transfer Encoding parsing.

References

CVSS Scores

version 3.1