HOMEVULNERABILITIESCVE-2015-5739
CRITICAL

CVE-2015-5739

CWE-444Published: October 18, 2017· Updated: Jun 17, 2026

9.8
CVSS v3.1

Official Description

The net/http library in net/textproto/reader.go in Go before 1.4.3 does not properly parse HTTP header keys, which allows remote attackers to conduct HTTP request smuggling attacks via a space instead of a hyphen, as demonstrated by "Content Length" instead of "Content-Length."

NVD Source

Technical Analysis

CVE-2015-5739 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 9.8.

CVSS v3.1 Vector Breakdown

Exploitability
Attack VectorNetwork
Attack ComplexityLow
Privileges Req.None
User InteractionNone
ScopeUnchanged
Impact
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected Vendors & Products

Fedora1 product(s)
fedora
Go1 product(s)
go
Red Hat4 product(s)
enterprise linux serverenterprise linux server ausenterprise linux server eusenterprise linux server tus
Source: NVD CPE · 16 total CPE entries

Exploit & PoC Resources

NO KNOWN EXPLOITNo public exploit confirmed at this time
Exploit-DB
Offensive Security exploit database
GitHub PoC Search
Community PoC repositories
Rapid7 / Metasploit
Metasploit module search
PacketStorm
Security advisories & exploits
NVD Detail
Official NIST entry
MITRE CVE
CVE Program entry
External links open in a new tab. Always verify in a controlled environment before use.

Official Patches & Advisories

PATCHhttps://bugzilla.redhat.com/show_bug.cgi?id=1250352
PATCHhttps://github.com/golang/go/commit/117ddcb83d7f42d6aa72241240af99ded81118e9
PATCHhttps://bugzilla.redhat.com/show_bug.cgi?id=1250352
PATCHhttps://github.com/golang/go/commit/117ddcb83d7f42d6aa72241240af99ded81118e9
ADVISORYhttp://lists.fedoraproject.org/pipermail/package-announce/2015-October/167997.html
ADVISORYhttp://lists.fedoraproject.org/pipermail/package-announce/2015-October/168029.html
ADVISORYhttp://rhn.redhat.com/errata/RHSA-2016-1538.html
ADVISORYhttp://seclists.org/oss-sec/2015/q3/237
ADVISORYhttp://seclists.org/oss-sec/2015/q3/292
ADVISORYhttp://seclists.org/oss-sec/2015/q3/294
ADVISORYhttp://www.securityfocus.com/bid/76281
ADVISORYhttp://lists.fedoraproject.org/pipermail/package-announce/2015-October/167997.html
ADVISORYhttp://lists.fedoraproject.org/pipermail/package-announce/2015-October/168029.html
ADVISORYhttp://rhn.redhat.com/errata/RHSA-2016-1538.html
ADVISORYhttp://seclists.org/oss-sec/2015/q3/237
ADVISORYhttp://seclists.org/oss-sec/2015/q3/292
ADVISORYhttp://seclists.org/oss-sec/2015/q3/294
ADVISORYhttp://www.securityfocus.com/bid/76281

All References (18)

→
http://lists.fedoraproject.org/pipermail/package-announce/2015-October/167997.htmlThird Party Advisory
→
http://lists.fedoraproject.org/pipermail/package-announce/2015-October/168029.htmlThird Party Advisory
→
http://rhn.redhat.com/errata/RHSA-2016-1538.htmlThird Party Advisory
→
http://seclists.org/oss-sec/2015/q3/237Mailing List · Third Party Advisory
→
http://seclists.org/oss-sec/2015/q3/292Mailing List · Third Party Advisory
→
http://seclists.org/oss-sec/2015/q3/294Mailing List · Third Party Advisory
→
http://www.securityfocus.com/bid/76281Third Party Advisory · VDB Entry
→
https://bugzilla.redhat.com/show_bug.cgi?id=1250352Issue Tracking · Patch · Third Party Advisory
→
https://github.com/golang/go/commit/117ddcb83d7f42d6aa72241240af99ded81118e9Issue Tracking · Patch · Third Party Advisory
→
http://lists.fedoraproject.org/pipermail/package-announce/2015-October/167997.htmlThird Party Advisory
→
http://lists.fedoraproject.org/pipermail/package-announce/2015-October/168029.htmlThird Party Advisory
→
http://rhn.redhat.com/errata/RHSA-2016-1538.htmlThird Party Advisory
→
http://seclists.org/oss-sec/2015/q3/237Mailing List · Third Party Advisory
→
http://seclists.org/oss-sec/2015/q3/292Mailing List · Third Party Advisory
→
http://seclists.org/oss-sec/2015/q3/294Mailing List · Third Party Advisory

Quick Facts

CVE IDCVE-2015-5739
CVSS Score9.8 / 10
SeverityCRITICAL
WeaknessCWE-444
CISA KEVNo
Affected3 vendor(s)
PublishedOct 18, 2017

Related CVEs (CWE-444)

CVE-2025-1867
10.0
CVE-2018-3907
10.0
CVE-2025-55315
9.9
CVE-2026-9170
9.8
CVE-2024-22081
9.8
CVE-2021-30180
9.8

Recommended Actions

  • →Apply vendor patches immediately
  • →Monitor CVE-2015-5739 in threat intel feeds
  • →Review IDS/IPS signatures for exploitation attempts
Data sourced from NVD (NIST), CISA KEV, and EPSS (FIRST). Analysis generated by CTIWATCH.COM. CVE data is provided under the NVD usage policy.
← All Vulnerabilities·Search for CVE-2015-5739·NVD