Google Go 1.11.5 net-http HTTP Header crlf injection

Summaryinfo

A vulnerability was found in Google Go 1.11.5. It has been classified as critical. This affects an unknown function of the component net-http. This manipulation as part of HTTP Header causes crlf injection. The identification of this vulnerability is CVE-2019-9741. It is possible to initiate the attack remotely. There is no exploit available.

Detailsinfo

A vulnerability classified as critical was found in Google Go 1.11.5 (Programming Language Software). Affected by this vulnerability is an unknown code block of the component net-http. The manipulation as part of a HTTP Header leads to a crlf injection vulnerability. The CWE definition for the vulnerability is CWE-93. The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

An issue was discovered in net/http in Go 1.11.5. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the second argument to http.NewRequest with \r\n followed by an HTTP header or a Redis command.

The bug was discovered 03/12/2019. The weakness was shared 03/13/2019 (Website). The advisory is shared at securityfocus.com. This vulnerability is known as CVE-2019-9741 since 03/13/2019. The attack can be launched remotely. The exploitation doesn't need any form of authentication. It demands that the victim is doing some kind of user interaction. Neither technical details nor an exploit are publicly available. The price for an exploit might be around USD $5k-$25k at the moment (estimation calculated on 05/21/2025).

The vulnerability was handled as a non-public zero-day exploit for at least 1 days. During that time the estimated underground price was around $5k-$25k. The vulnerability scanner Nessus provides a plugin with the ID 236585 (Alibaba Cloud Linux 3 : 0069: go-toolset:rhel8 (ALINUX3-SA-2021:0069)), which helps to determine the existence of the flaw in a target environment. The commercial vulnerability scanner Qualys is able to test this issue with plugin 277754 (Fedora Security Update for golang (FEDORA-2019-d05bc7e3df)).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at Tenable (236585). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Programming Language Software

Vendor

• Google

Name

• Go

Version

• 1.11.5

License

• open-source

Website

• Vendor: https://www.google.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion