critical
CVE-2025-22871
RoadRunner request smuggling via bare-LF chunk-size line (bundled Go net/http)
- Severity
- critical
- Affected product
- RoadRunner
- Affected versions
- RoadRunner < 2025.1.0
- Fixed in
- RoadRunner 2025.1.0
- Detection basis
- Component version range
- Shipped rule
- RoadRunner: RoadRunner request smuggling via bare-LF chunk-size line (bundled Go net/http)
- Added to NewScan
- 2026-09-02
- Detected by
- NewScan — free, self-hosted
How NewScan reports it
COMPONENT VERSION RANGE
NewScan fingerprints RoadRunner from its response and reports this CVE when the detected version falls inside the affected range below.
References
Scan for this yourself — local, in-band scanning is free.
Get NewScan (FREE) →Review the measured benchmark, then use the verified remediation process.