CVE-2025-22871

Packagist/spiral/roadrunner CVE-2025-22871: critical 9.1

RoadRunner is at risk of HTTP Request/Response Smuggling through vulnerable dependency

Action: Upgrade spiral/roadrunner to 2025.1.0 or later.

composer require spiral/roadrunner:2025.1.0

Affected

Fixed versions

Sources

• osv: GHSA-g9pc-8g42-g6vq
• https://nvd.nist.gov/vuln/detail/CVE-2025-22871
• https://github.com/roadrunner-server/roadrunner/issues/2166
• https://github.com/roadrunner-server/roadrunner/commit/f269279ee87d0b88127741cad1042389af7605fa
• https://cert-portal.siemens.com/productcert/html/ssa-783943.html
• https://github.com/roadrunner-server/roadrunner
• https://github.com/roadrunner-server/roadrunner/releases/tag/v2025.1.0
• https://go.dev/cl/652998
• https://go.dev/issue/71988
• https://groups.google.com/g/golang-announce/c/Y2uBTVKjBQk
• https://pkg.go.dev/vuln/GO-2025-3563
• http://www.openwall.com/lists/oss-security/2025/04/04/4

CVE-2025-22871 · published 2025-04-08T21:31:40Z · modified 2026-09-10T03:50:23.911296198Z · JSON

Go/stdlib CVE-2025-22871: unknown

Request smuggling due to acceptance of invalid chunked data in net/http

Action: Upgrade stdlib to 1.23.8 or later.

Upgrade Go to 1.23.8.

Upgrade Go to 1.24.2.

Affected

Fixed versions

Sources

• osv: GO-2025-3563
• https://go.dev/cl/652998
• https://go.dev/issue/71988
• https://groups.google.com/g/golang-announce/c/Y2uBTVKjBQk

CVE-2025-22871 · published 2025-04-08T19:46:23Z · modified 2026-02-17T16:13:52.395126Z · JSON