{"action":"Upgrade stdlib to 1.23.8 or later.","affected":[{"fixed":"1.23.8","introduced":"0"},{"fixed":"1.24.2","introduced":"1.24.0-0"}],"component":"stdlib","cve_ids":["CVE-2025-22871"],"ecosystem":"Go","epss":0.00826,"exploited":false,"fixed_versions":["1.23.8","1.24.2"],"ghsa_id":"GHSA-g9pc-8g42-g6vq","id":"tcs_01M5KG7SJB6DR59D3DH86V58E2","modified_at":"2026-02-17T16:13:52.395126Z","published_at":"2025-04-08T19:46:23Z","references":["https://osv.dev/vulnerability/GO-2025-3563","https://go.dev/cl/652998","https://go.dev/issue/71988","https://groups.google.com/g/golang-announce/c/Y2uBTVKjBQk"],"severity":{"label":"critical","score":9.1},"sources":[{"source":"osv","source_id":"GO-2025-3563","url":"https://osv.dev/vulnerability/GO-2025-3563"},{"source":"nvd","source_id":"CVE-2025-22871","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-22871"}],"summary":"Request smuggling due to acceptance of invalid chunked data in net/http"}