What’s Vulnerable › Vulnerabilities

CVE-2019-16276

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 5.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2019-09-30 · updated 2026-06-17
• Weakness: CWE-444

Description

Go before 1.12.10 and 1.13.x before 1.13.1 allow HTTP Request Smuggling.

Affected products

• Debian Linux: 9.0
• Fedoraproject Fedora: 29, 30, 31
• Go: before 1.12.10; from 1.13 before 1.13.1 — fixed in 1.12.10, 1.13.1
• NetApp Cloud Insights Telegraf Agent: all versions
• openSUSE Leap: 15.0, 15.1
• RedHat Developer Tools: 1.0
• Red Hat Enterprise Linux: 8.0
• RedHat Enterprise Linux Eus: 8.1
• Red Hat OpenShift Container Platform 4.18: 4.2

How to fix

Upgrade to a fixed version: Go 1.12.10, 1.13.1. Check the vendor advisory for mitigations.

References

• http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00043.html
• http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00044.html
• https://access.redhat.com/errata/RHSA-2020:0101
• https://access.redhat.com/errata/RHSA-2020:0329
• https://access.redhat.com/errata/RHSA-2020:0652
• https://github.com/golang/go/issues/34540
• https://groups.google.com/forum/#%21msg/golang-announce/cszieYyuL9Q/g4Z7pKaqAgAJ
• https://lists.debian.org/debian-lts-announce/2021/03/msg00014.html
• https://lists.debian.org/debian-lts-announce/2021/03/msg00015.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LULL72EUUKIY4NWDZVJVN2LIB4MXHS5P/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/O7GMJ3VXF5RXK2C7CL66KJ6XOOTOL5BJ/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Q5MD2F7ATWSTB45ZJIPJHBAAHVRGRAKG/

Get alerted when CVE-2019-16276 or the next vulnerability affects your stack