Homepage
About Snyk

HTTP Request Smuggling Affecting goliath package, versions >=0.0.0

0.0
medium

Snyk CVSS

    Attack Complexity High
    Confidentiality High

    Threat Intelligence

    Exploit Maturity Proof of concept
    EPSS 0.09% (38th percentile)
Expand this section
NVD
7.5 high

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-RUBY-GOLIATH-569136
  • published 3 Jun 2020
  • disclosed 3 Jun 2020
  • credit Sam Sanoop of Snyk Security Team
Report a new vulnerability Found a mistake?

Introduced: 3 Jun 2020

CVE-2020-7671 Open this link in a new tab
CWE-200 Open this link in a new tab
First added by Snyk

How to fix?

There is no fixed version for goliath.

Overview

goliath is an Async framework for writing API servers.

Affected versions of this package are vulnerable to HTTP Request Smuggling. HTTP pipelining issues and request smuggling attacks might be possible due to incorrect Content-Length and Transfer encoding header parsing.

It is possible to conduct HTTP request smuggling attacks where goliath is used as part of a chain of backend servers due to insufficient Content-Length and Transfer Encoding parsing.

References