CVE-2024-41110: Go Http Content Length Gate Without Chunked Check
An *http.Request body read/forward is gated only on `ContentLength > 0`, without also accepting chunked Transfer-Encoding. RFC 7230 specifies that Content-Length is ignored when Transfer-Encoding: chunked is set, and Go's net/http reports `r.ContentLength == -1` for chunked requests. A client can therefore smuggle a body past this gate by sending a chunked r
Gogreprules fetch cve-2024-41110-go-http-content-length-gate-without-chunked-check --engine opengrepDescription
An *http.Request body read/forward is gated only on `ContentLength > 0`, without also accepting chunked Transfer-Encoding. RFC 7230 specifies that Content-Length is ignored when Transfer-Encoding: chunked is set, and Go's net/http reports `r.ContentLength == -1` for chunked requests. A client can therefore smuggle a body past this gate by sending a chunked r
Community feedback
0 rule-level signals from signed-in users.
- Useful reports
- 0
- Context false positives
- 0
- Metadata suggestions
- 0
Contextual precision
Aggregated from approved scan feedback. False-positive reports describe observed scan contexts, not a global rule verdict.
- Findings observed
- 0
- Projects
- 0
- Reporters
- 0
Precision details are collecting more signed-in reports before verdict counts or ratios are emphasized.
No approved finding verdicts yet.
No scan diagnostics reported yet.