RoadRunner is at risk of HTTP Request/Response Smuggling through vulnerable dependency
The advisory, in context
The net/http package dependency used by RoadRunner improperly accepts a bare LF as a line terminator in chunked data chunk-size lines. This can permit request smuggling if a net/http server is used in conjunction with a server that incorrectly accepts a bare LF as part of a chunk-ext.
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
Earlier releases before 2025.1.0
Fixed in 2025.1.0
254 explicitly affected versions
v0.9.0, v1.0.0, v1.0.1, v1.0.2, v1.0.3, v1.0.5, v1.1.0, v1.1.1, v1.2.0, v1.2.1, v1.2.2, v1.2.3, v1.2.4, v1.2.5, v1.2.6, v1.2.7, v1.2.8, v1.3.0, v1.3.1, v1.3.2, v1.3.3, v1.3.4, v1.3.5, v1.3.6, v1.3.7, v1.4.0, v1.4.1, v1.4.2, v1.4.3, v1.4.4, v1.4.5, v1.4.6, v1.4.7, v1.4.8, v1.5.0, v1.5.1, v1.5.2, v1.5.3, v1.6.0, v1.6.1, v1.6.2, v1.6.3, v1.6.4, v1.7.0, v1.7.1, v1.8.0, v1.8.1, v1.8.2, v1.8.3, v1.8.4, v1.9.0, v1.9.1, v1.9.2, v2.0.0, v2.0.0-RC.1, v2.0.0-RC.3, v2.0.0-RC.4, v2.0.0-alpha1, v2.0.0-alpha10, v2.0.0-alpha11, v2.0.0-alpha12, v2.0.0-alpha13, v2.0.0-alpha14, v2.0.0-alpha15, v2.0.0-alpha16, v2.0.0-alpha17, v2.0.0-alpha18, v2.0.0-alpha19, v2.0.0-alpha2, v2.0.0-alpha20, v2.0.0-alpha21, v2.0.0-alpha22, v2.0.0-alpha3, v2.0.0-alpha5, v2.0.0-alpha6, v2.0.0-alpha7, v2.0.0-beta.21, v2.0.0-beta.22, v2.0.0-beta.24, v2.0.0-beta11, v2.0.0-beta12, v2.0.0-beta13, v2.0.0-beta19, v2.0.1, v2.0.2, v2.0.2-beta.1, v2.0.2-beta.2, v2.0.3, v2.0.4, v2.1.0, v2.1.0-beta.1, v2.1.0-beta.2, v2.1.0-beta.3, v2.1.1, v2.10.0, v2.10.0-alpha.1, v2.10.0-rc.1, v2.10.0-rc.2, v2.10.0-rc.3, v2.10.0-rc.4, v2.10.0-rc.5, v2.10.0-rc.6, v2.10.0-rc.7, v2.10.1, v2.10.2, v2.10.3, v2.10.4, v2.10.4-rc.1, v2.10.5, v2.10.6, v2.10.7, v2.11.0, v2.11.0-beta.1, v2.11.0-beta.2, v2.11.0-beta.3, v2.11.0-rc.1, v2.11.1, v2.11.2, v2.11.3, v2.11.3-rc.1, v2.11.4, v2.11.4-beta.1, v2.12.0, v2.12.0-alpha.1, v2.12.0-beta.1, v2.12.0-rc.1, v2.12.1, v2.12.1-rc.1, v2.12.2, v2.12.2-alpha.1, v2.12.2-alpha.2, v2.12.3, v2.2.0, v2.2.1, v2.3.0, v2.3.0-beta.1, v2.3.0-beta.2, v2.3.0-beta.3, v2.3.1, v2.3.1-beta.1, v2.3.1-beta.3, v2.3.1-beta.4, v2.3.1-beta.6, v2.3.1-rc.1, v2.3.2, v2.4.0, v2.4.0-alpha.1, v2.4.0-beta.1, v2.4.0-rc.1, v2.4.1, v2.5.0, v2.5.0-alpha.1, v2.5.0-alpha.2, v2.5.0-beta.1, v2.5.0-beta.2, v2.5.0-beta.3, v2.5.0-beta.4, v2.5.0-rc.1, v2.5.0-rc.2, v2.5.1, v2.5.2, v2.5.3, v2.6.0, v2.6.0-alpha.1, v2.6.0-alpha.2, v2.6.0-alpha.3, v2.6.0-alpha.4, v2.6.0-alpha.5, v2.6.0-beta.1, v2.6.0-rc.1, v2.6.1, v2.6.2, v2.6.3, v2.7.0, v2.7.0-beta.1, v2.7.0-rc.1, v2.7.0-rc.2, v2.7.1, v2.7.2, v2.7.2-rc.1, v2.7.2-rc.2, v2.7.2-rc.3, v2.7.2-rc.4, v2.7.3, v2.7.4, v2.7.5, v2.7.6, v2.7.7, v2.7.8, v2.7.9, v2.8.0, v2.8.0-rc.1, v2.8.0-rc.2, v2.8.1, v2.8.2, v2.8.3, v2.8.4, v2.8.5, v2.8.6, v2.8.7, v2.8.8, v2.9.0, v2.9.0-alpha.1, v2.9.1, v2.9.2, v2.9.3, v2.9.4, v2023.1.0, v2023.1.0-alpha.1, v2023.1.0-alpha.2, v2023.1.0-beta.1, v2023.1.0-rc.1, v2023.1.0-rc.2, v2023.1.1, v2023.1.2, v2023.1.3, v2023.1.4, v2023.1.5, v2023.2.0, v2023.2.0-beta.1, v2023.2.0-beta.2, v2023.2.0-beta.3, v2023.2.1, v2023.2.2, v2023.3.0, v2023.3.0-beta.1, v2023.3.0-beta.2, v2023.3.0-rc.1, v2023.3.1, v2023.3.10, v2023.3.11, v2023.3.12, v2023.3.2, v2023.3.3, v2023.3.4, v2023.3.5, v2023.3.6, v2023.3.7, v2023.3.8, v2023.3.9, v2024.1.0, v2024.1.1, v2024.1.2, v2024.1.3, v2024.1.4, v2024.1.5, v2024.2.0, v2024.2.1, v2024.3.0, v2024.3.1, v2024.3.2, v2024.3.3, v2024.3.4, v2024.3.5
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2025.1.0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"v0.9.0",
"v1.0.0",
"v1.0.1",
"v1.0.2",
"v1.0.3",
"v1.0.5",
"v1.1.0",
"v1.1.1",
"v1.2.0",
"v1.2.1",
"v1.2.2",
"v1.2.3",
"v1.2.4",
"v1.2.5",
"v1.2.6",
"v1.2.7",
"v1.2.8",
"v1.3.0",
"v1.3.1",
"v1.3.2",
"v1.3.3",
"v1.3.4",
"v1.3.5",
"v1.3.6",
"v1.3.7",
"v1.4.0",
"v1.4.1",
"v1.4.2",
"v1.4.3",
"v1.4.4",
"v1.4.5",
"v1.4.6",
"v1.4.7",
"v1.4.8",
"v1.5.0",
"v1.5.1",
"v1.5.2",
"v1.5.3",
"v1.6.0",
"v1.6.1",
"v1.6.2",
"v1.6.3",
"v1.6.4",
"v1.7.0",
"v1.7.1",
"v1.8.0",
"v1.8.1",
"v1.8.2",
"v1.8.3",
"v1.8.4",
"v1.9.0",
"v1.9.1",
"v1.9.2",
"v2.0.0",
"v2.0.0-RC.1",
"v2.0.0-RC.3",
"v2.0.0-RC.4",
"v2.0.0-alpha1",
"v2.0.0-alpha10",
"v2.0.0-alpha11",
"v2.0.0-alpha12",
"v2.0.0-alpha13",
"v2.0.0-alpha14",
"v2.0.0-alpha15",
"v2.0.0-alpha16",
"v2.0.0-alpha17",
"v2.0.0-alpha18",
"v2.0.0-alpha19",
"v2.0.0-alpha2",
"v2.0.0-alpha20",
"v2.0.0-alpha21",
"v2.0.0-alpha22",
"v2.0.0-alpha3",
"v2.0.0-alpha5",
"v2.0.0-alpha6",
"v2.0.0-alpha7",
"v2.0.0-beta.21",
"v2.0.0-beta.22",
"v2.0.0-beta.24",
"v2.0.0-beta11",
"v2.0.0-beta12",
"v2.0.0-beta13",
"v2.0.0-beta19",
"v2.0.1",
"v2.0.2",
"v2.0.2-beta.1",
"v2.0.2-beta.2",
"v2.0.3",
"v2.0.4",
"v2.1.0",
"v2.1.0-beta.1",
"v2.1.0-beta.2",
"v2.1.0-beta.3",
"v2.1.1",
"v2.10.0",
"v2.10.0-alpha.1",
"v2.10.0-rc.1",
"v2.10.0-rc.2",
"v2.10.0-rc.3",
"v2.10.0-rc.4",
"v2.10.0-rc.5",
"v2.10.0-rc.6",
"v2.10.0-rc.7",
"v2.10.1",
"v2.10.2",
"v2.10.3",
"v2.10.4",
"v2.10.4-rc.1",
"v2.10.5",
"v2.10.6",
"v2.10.7",
"v2.11.0",
"v2.11.0-beta.1",
"v2.11.0-beta.2",
"v2.11.0-beta.3",
"v2.11.0-rc.1",
"v2.11.1",
"v2.11.2",
"v2.11.3",
"v2.11.3-rc.1",
"v2.11.4",
"v2.11.4-beta.1",
"v2.12.0",
"v2.12.0-alpha.1",
"v2.12.0-beta.1",
"v2.12.0-rc.1",
"v2.12.1",
"v2.12.1-rc.1",
"v2.12.2",
"v2.12.2-alpha.1",
"v2.12.2-alpha.2",
"v2.12.3",
"v2.2.0",
"v2.2.1",
"v2.3.0",
"v2.3.0-beta.1",
"v2.3.0-beta.2",
"v2.3.0-beta.3",
"v2.3.1",
"v2.3.1-beta.1",
"v2.3.1-beta.3",
"v2.3.1-beta.4",
"v2.3.1-beta.6",
"v2.3.1-rc.1",
"v2.3.2",
"v2.4.0",
"v2.4.0-alpha.1",
"v2.4.0-beta.1",
"v2.4.0-rc.1",
"v2.4.1",
"v2.5.0",
"v2.5.0-alpha.1",
"v2.5.0-alpha.2",
"v2.5.0-beta.1",
"v2.5.0-beta.2",
"v2.5.0-beta.3",
"v2.5.0-beta.4",
"v2.5.0-rc.1",
"v2.5.0-rc.2",
"v2.5.1",
"v2.5.2",
"v2.5.3",
"v2.6.0",
"v2.6.0-alpha.1",
"v2.6.0-alpha.2",
"v2.6.0-alpha.3",
"v2.6.0-alpha.4",
"v2.6.0-alpha.5",
"v2.6.0-beta.1",
"v2.6.0-rc.1",
"v2.6.1",
"v2.6.2",
"v2.6.3",
"v2.7.0",
"v2.7.0-beta.1",
"v2.7.0-rc.1",
"v2.7.0-rc.2",
"v2.7.1",
"v2.7.2",
"v2.7.2-rc.1",
"v2.7.2-rc.2",
"v2.7.2-rc.3",
"v2.7.2-rc.4",
"v2.7.3",
"v2.7.4",
"v2.7.5",
"v2.7.6",
"v2.7.7",
"v2.7.8",
"v2.7.9",
"v2.8.0",
"v2.8.0-rc.1",
"v2.8.0-rc.2",
"v2.8.1",
"v2.8.2",
"v2.8.3",
"v2.8.4",
"v2.8.5",
"v2.8.6",
"v2.8.7",
"v2.8.8",
"v2.9.0",
"v2.9.0-alpha.1",
"v2.9.1",
"v2.9.2",
"v2.9.3",
"v2.9.4",
"v2023.1.0",
"v2023.1.0-alpha.1",
"v2023.1.0-alpha.2",
"v2023.1.0-beta.1",
"v2023.1.0-rc.1",
"v2023.1.0-rc.2",
"v2023.1.1",
"v2023.1.2",
"v2023.1.3",
"v2023.1.4",
"v2023.1.5",
"v2023.2.0",
"v2023.2.0-beta.1",
"v2023.2.0-beta.2",
"v2023.2.0-beta.3",
"v2023.2.1",
"v2023.2.2",
"v2023.3.0",
"v2023.3.0-beta.1",
"v2023.3.0-beta.2",
"v2023.3.0-rc.1",
"v2023.3.1",
"v2023.3.10",
"v2023.3.11",
"v2023.3.12",
"v2023.3.2",
"v2023.3.3",
"v2023.3.4",
"v2023.3.5",
"v2023.3.6",
"v2023.3.7",
"v2023.3.8",
"v2023.3.9",
"v2024.1.0",
"v2024.1.1",
"v2024.1.2",
"v2024.1.3",
"v2024.1.4",
"v2024.1.5",
"v2024.2.0",
"v2024.2.1",
"v2024.3.0",
"v2024.3.1",
"v2024.3.2",
"v2024.3.3",
"v2024.3.4",
"v2024.3.5"
]
}References
- https://nvd.nist.gov/vuln/detail/CVE-2025-22871
- https://github.com/roadrunner-server/roadrunner/issues/2166
- https://github.com/roadrunner-server/roadrunner/commit/f269279ee87d0b88127741cad1042389af7605fa
- https://cert-portal.siemens.com/productcert/html/ssa-783943.html
- https://github.com/roadrunner-server/roadrunner
- https://github.com/roadrunner-server/roadrunner/releases/tag/v2025.1.0
- https://go.dev/cl/652998
- https://go.dev/issue/71988
- https://groups.google.com/g/golang-announce/c/Y2uBTVKjBQk
- https://pkg.go.dev/vuln/GO-2025-3563
- http://www.openwall.com/lists/oss-security/2025/04/04/4