CRITICAL 9.1 Microsoft

CVE-2025-22871

Request smuggling due to acceptance of invalid chunked data in net/http

Microsoft Security Update 2025-Apr: Request smuggling due to acceptance of invalid chunked data in net/http

Affected Products

cbl2 golang 1.22.7-3 on CBL Mariner 2.0
cbl2 gcc 11.2.0-8 on CBL Mariner 2.0
cbl2 python-tensorboard 2.11.0-3 on CBL Mariner 2.0
azl3 golang 1.24.3-1 on Azure Linux 3.0
cbl2 msft-golang 1.24.1-2 on CBL Mariner 2.0
cbl2 golang 1.18.8-7 on CBL Mariner 2.0
cbl2 tensorflow 2.11.1-2 on CBL Mariner 2.0
azl3 tensorflow 2.16.1-9 on Azure Linux 3.0

References

Published: 2025-04-08 · Source: Microsoft · Feed updated: 2026-08-10

This critical severity vulnerability with a CVSS score of 9.1 was published on 2025-04-08 via Microsoft. Affected: cbl2 golang 1.22.7-3 on CBL Mariner 2.0, cbl2 gcc 11.2.0-8 on CBL Mariner 2.0, cbl2 python-tensorboard 2.11.0-3 on CBL Mariner 2.0 and 5 more.

Risk Timeline

CVE Disclosed2025-04-08 · 489 days ago

Remediation Resources

Official Advisory

msrc.microsoft.com/update-guide/vulnerability/CVE-2025-22871

NVD / MITRE

nvd.nist.gov/vuln/detail/CVE-2025-22871

Related Vulnerabilities

CVE	Title	Severity	CVSS
CVE-2024-36048	QAbstractOAuth in Qt Network Authorization in Qt before 5.15.17, 6.x before 6.2.	CRITICAL	9.8
CVE-2025-30215	NATS-Server Fails to Authorize Certain Jetstream Admin APIs	CRITICAL	9.6
CVE-2026-43870	Apache Thrift: Node.js web_server.js multi-vulnerability	CRITICAL	9.4
CVE-2024-30896 PoC	InfluxDB OSS 2.x through 2.7.11 stores the administrative operator token under t	CRITICAL	9.1
CVE-2026-23918 PoC	Apache HTTP Server: http2: double free and possible RCE on early reset	HIGH	8.8
CVE-2026-24072	Apache HTTP Server: mod_rewrite elevation of privileges via ap_expr	HIGH	8.8

vulnfeed aggregates 7759 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.