Vendors / HashiCorp Records 247 All Threatist records
Exploited (KEV) 0 None in CISA KEV
CVSS critical 24
CVSS high 120
Exploited now HashiCorp records in CISA KEV No HashiCorp vulnerabilities are listed in CISA KEV.
Components Products in the NVD configurations · select one to filter the records Priority MEDIUM 46
go-getter up to 1.5.11 and 2.0.2 allowed protocol switching, endless redirect, and configuration bypass via abuse of custom HTTP response header processing.
CVSS 3.1 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01743 · Published 2022-05-25 · Partial fix · 1.6.1, 2.1.0 CWE-77
Priority MEDIUM 45
HashiCorp’s go-getter library is vulnerable to argument injection when executing Git to discover remote branches.
CVSS 3.1 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01329 · Published 2024-04-17 · Fixed in 1.7.3, 1.7.4 CWE-88
Priority MEDIUM 43
go-getter up to 1.5.11 and 2.0.2 allowed arbitrary host access via go-getter path traversal, symlink processing, and command injection flaws.
CVSS 3.1 HIGH 8.6· Network · No auth · No interaction · EPSS 0.03114 · Published 2022-05-25 · Partial fix · 1.6.1, 2.1.0 CWE-22
Priority MEDIUM 42
HashiCorp’s go-getter library can be coerced into executing Git update on an existing maliciously modified Git Configuration, potentially leading to arbitrary code execution.
CVSS 3.1 HIGH 8.8· Network · No auth · User interaction · EPSS 0.00981 · Published 2024-06-25 · Partial fix · 1.7.4, 1.7.5 CWE-77
Priority MEDIUM 40
HashiCorp's go-getter library subdirectory download feature is vulnerable to symlink attacks leading to unauthorized read access beyond the designated directory boundaries.
CVSS 3.1 HIGH 7.5· Network · No auth · No interaction · EPSS 0.00602 · Published 2025-08-15 · Partial fix · 1.7.8, 1.7.9 CWE-59
Priority MEDIUM 40
go-getter up to 1.5.11 and 2.0.2 panicked when processing password-protected ZIP files.
CVSS 3.1 HIGH 8.6· Network · No auth · No interaction · EPSS 0.01462 · Published 2022-05-25 · Partial fix · 1.6.1, 2.1.0
Priority MEDIUM 40
go-getter up to 1.5.11 and 2.0.2 allowed asymmetric resource exhaustion when go-getter processed malicious HTTP responses.
CVSS 3.1 HIGH 8.6· Network · No auth · No interaction · EPSS 0.01462 · Published 2022-05-25 · Partial fix · 1.6.1, 2.1.0
Priority LOW 29
HashiCorp go-getter up to 1.6.2 and 2.1.1 is vulnerable to decompression bombs.
CVSS 3.1 MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.00454 · Published 2023-02-16 · Partial fix · 1.7.0, 2.2.0 CWE-409
Priority LOW 25
The Hashicorp go-getter library before 1.5.11 does not redact an SSH key from a URL query parameter.
CVSS 3.1 MEDIUM 5.5· Local · Low privileges · No interaction · EPSS 0.0041 · Published 2022-04-27 · Partial fix · 1.5.11 CWE-532
Open these records in search → All records by CVSS severity
24 120 98 5 0
THREATIST.IORead the docs