Security readout for executives and security teams
Plain-English summary
Some Go HTTP clients accepted malformed Transfer-Encoding headers. In proxy or gateway paths, if another intermediary also mishandled the same invalid header, requests could be interpreted differently, enabling request smuggling. This is a medium-risk parsing inconsistency issue.
Executive priority
Treat as a moderate-priority hygiene fix for Go services, higher where traffic crosses proxies or gateways. It is not listed as actively exploited in the provided sources, but request smuggling can affect confidentiality and integrity when conditions align.
Technical view
CVE-2022-1705 is CWE-444 in Go net/http HTTP/1 client before Go 1.17.12 and 1.18.4. The client accepted certain invalid Transfer-Encoding headers instead of rejecting them. The issue requires an intermediate server with a compatible parsing failure.
Likely exposure
Exposure is limited to software built with vulnerable Go versions that uses net/http as an HTTP/1 client, especially through proxies, reverse proxies, gateways, or other HTTP intermediaries. The sources do not identify a specific application product beyond Go standard library net/http.
Exploitation context
The CVE record describes request smuggling only when combined with an intermediate server that also fails to reject the invalid header. The source bundle does not report active exploitation, and KEV status is false.
Researcher notes
Focus review on HTTP parsing consistency across client and intermediary hops. The vulnerability is in acceptance of invalid Transfer-Encoding headers by the Go HTTP/1 client; the public description requires a second flawed intermediary behavior for request smuggling impact.
Mitigation direction
- Upgrade Go toolchains to 1.17.12, 1.18.4, or later supported releases.
- Rebuild and redeploy Go services after upgrading the toolchain.
- Check Go advisory GO-2022-0525 and Go release guidance for current vendor direction.
- Review HTTP intermediary behavior for strict rejection of invalid Transfer-Encoding headers.
Validation and detection
- Inventory deployed Go binaries and record their build Go versions.
- Identify services using net/http HTTP/1 client paths through proxies or gateways.
- Confirm rebuilt artifacts use a fixed Go version, not only updated source code.
- Review intermediary logs and configurations for malformed Transfer-Encoding handling.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-444: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2022-1705 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N3.92.5Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
6.5MediumVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://go.dev/cl/409874CVE reference
- https://go.googlesource.com/go/+/e5017a93fcde94f09836200bca55324af037ee5fCVE reference
- https://go.dev/issue/53188CVE reference
- https://go.dev/cl/410714CVE reference
- https://groups.google.com/g/golang-announce/c/nqrv9fbR0zECVE reference
- https://pkg.go.dev/vuln/GO-2022-0525CVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.