Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
A request smuggling attack is possible when using 'MaxBytesHandler'. When using 'MaxBytesHandler', the body of an HTTP request is not fully consumed. When the server attempts to read HTTP2 frames from the connection, it will instead be reading the body of the HTTP request, which could be attacker-manipulated to represent arbitrary HTTP2 requests. This issue affects the packages golang.org/x/net and github.com/golang/net versions 0.0.0-20220524220425-1d687d428aca through v0.1.0.
CWE-444 - HTTP Request Smuggling
Entities such as web servers, web caching proxies, and application firewalls could parse HTTP requests differently. When there are two or more such entities in the path of an HTTP request, an attacker can send a specially crafted HTTP request that is seen as two different sets of requests by the attacked devices, allowing the attacker to smuggle a request into one device without the other device being aware of it. Such a vulnerability can prove devastating, for it enables further attacks on the application, like web cache poisoning, session hijacking, cross-site scripting, security bypassing, and sensitive information exposure.