Data race and crash in net/http

中危 5.9CVE-2020-15586 · BIT-golang-2020-15586 · GO-2021-0224 · Published 17/07/2020 · updated 17/06/2026

要点

CVE-2020-15586 是影响 stdlib, cf-deployment (cloudfoundry), routing-release (cloudfoundry) 的中危 (CVSS 5.9)漏洞。
未来 30 天内被利用的概率（EPSS）：2.9%，高于 86.9% 的漏洞。
修复：升级到 1.14.5, 1.13.13, 13.7.0, 0.203.0 或更高版本。

Package	Affected versions	Patched versions
stdlib Go	`≥ 1.14.0-0, < 1.14.5< 1.13.13`	`1.14.51.13.13`
cf-deployment cloudfoundry	`< 13.7.0`	`13.7.0`
routing-release cloudfoundry	`< 0.203.0`	`0.203.0`
go golang	`≥ 1.14.0, < 1.14.5< 1.13.13`	`1.14.51.13.13`

Description

HTTP servers where the Handler concurrently reads the request body and writes a response can encounter a data race and crash. The httputil.ReverseProxy Handler is affected.

NVD description

Go before 1.13.13 and 1.14.x before 1.14.5 has a data race in some net/http servers, as demonstrated by the httputil.ReverseProxy Handler, because it reads a request body and writes a response at the same time.

References

go.dev/cl/242598 · FIX
go.googlesource.com/go/+/fa98f46741f818913a8c11b877520a548715131f · FIX
go.dev/issue/34902 · REPORT
groups.google.com/g/golang-announce/c/XZNfaiwgt2w · WEB
lists.opensuse.org/opensuse-security-announce/2020-07/msg00077.html · Mailing List
lists.opensuse.org/opensuse-security-announce/2020-07/msg00082.html · Mailing List
lists.opensuse.org/opensuse-security-announce/2020-09/msg00029.html · Mailing List
lists.opensuse.org/opensuse-security-announce/2020-09/msg00030.html · Mailing List
groups.google.com/forum
groups.google.com/forum
lists.debian.org/debian-lts-announce/2020/11/msg00037.html · Mailing List

stdlib 的其他漏洞

查看全部 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

stdlib

≥ 1.14.0-0, < 1.14.5< 1.13.13

1.14.51.13.13

cf-deployment

cloudfoundry

< 13.7.0

13.7.0

routing-release

cloudfoundry

< 0.203.0

0.203.0

golang

≥ 1.14.0, < 1.14.5< 1.13.13