Request smuggling via conflicting message-length headers

HTTP request smuggling in Go net/http before 1.4.3 allows remote attackers to desynchronize request processing via conflicting headers. The request parser in net/http/transfer.go accepted both Transfer-Encoding and Content-Length, discarded Content-Length, and continued with chunked framing instead of rejecting the ambiguous request. An unauthenticated attacker must reach a Go HTTP server through an intermediary that parses the message differently; the resulting desynchronization lets injected bytes be processed as another request.