Improper input validation in github.com/gin-gonic/gin
Priority HIGH 71CWE-20Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- Low · Low · Low
- Fix status
- Partial Red Hat: 4 fixed, 10 without a fix
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-77.
Summary
Versions of the package github.com/gin-gonic/gin before 1.9.0 are vulnerable to Improper Input Validation by allowing an attacker to use a specially crafted request via the X-Forwarded-Prefix header, potentially leading to cache poisoning. **Note:** Although this issue does not pose a significant threat on its own it can serve as an input vector for other more impactful vulnerabilities. However, successful exploitation may depend on the server configuration and whether the header is used in the application logic.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00905 60th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial github.com/gin-gonic/gin: 1.9.0github.com/gin-gonic/gin (Go): 1.9.0Red Hat: 4 advisoriesRed Hat: 4 fixed, 10 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | github.com/gin-gonic/gin | before 1.9.0 | 1.9.0 | Patch available | CNA |
| — | github.com/gin-gonic/gin (Go) | before 1.9.0 | 1.9.0 | Patch available | GHSA-3vp4-m3rf-835h |
- github.com/gin-gonic/gin Vendor— Affected before 1.9.0 Fixed in 1.9.0 Patch available CNA
- github.com/gin-gonic/gin (Go) Vendor— Affected before 1.9.0 Fixed in 1.9.0 Patch available GHSA-3vp4-m3rf-835h
Remediation
- Fix · CNA github.com/gin-gonic/gin Fixed in 1.9.0
- Fix · GHSA-3vp4-m3rf-835h github.com/gin-gonic/gin (Go) Fixed in 1.9.0 Advisory →
Red Hat 4 advisories
- RHSA-2024:10813 Released 2024-12-12 · Red Hat rating ImportantOpenShift Container Platform 4.13.54 bug fix and security update
- Red Hat OpenShift Container Platform 4.13 openshift4/ose-agent-installer-csr-approver-rhel8, openshift4/ose-cluster-samples-operator, openshift4/ose-console +1
- RHSA-2024:8688 Released 2024-11-06 · Red Hat rating ImportantOpenShift Container Platform 4.13.53 bug fix and security update
- Red Hat OpenShift Container Platform 4.13 openshift4/cloud-network-config-controller-rhel8, openshift4/egress-router-cni-rhel8, openshift4/kubevirt-csi-driver-rhel8 +47
- RHSA-2023:4627 Released 2023-08-14 · Red Hat rating ImportantMigration Toolkit for Applications security and bug fix update
- MTA 6.2 for RHEL 8 mta/mta-hub-rhel9, mta/mta-operator-bundle, mta/mta-ui-rhel9 +1
Show 1 more Red Hat advisories
- RHSA-2023:4293 Released 2023-07-27 · Red Hat rating ModerateMigration Toolkit for Containers (MTC) 1.7.11 security and bug fix update
- 8Base-RHMTC-1.7 rhmtc/openshift-migration-controller-rhel8, rhmtc/openshift-migration-velero-plugin-for-aws-rhel8, rhmtc/openshift-migration-velero-plugin-for-gcp-rhel8 +3
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Migration Toolkit for Applications 6 | Affected | No fix yet |
| Migration Toolkit for Virtualization | Affected | No fix yet |
| OpenShift Serverless | Affected | No fix yet |
| Red Hat Advanced Cluster Management for Kubernetes 2 | Affected | No fix yet |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet |
| Red Hat OpenShift Data Science (RHODS) | Affected | No fix yet |
| Red Hat OpenShift Dev Spaces | Affected | No fix yet |
| Red Hat OpenShift GitOps | Affected | No fix yet |
| Red Hat Openshift Sandboxed Containers | Affected | No fix planned: Out of support scope |
| Red Hat Quay 3 | Affected | No fix planned: Will not fix |
| 8Base-MTV-2.5 | Fixed | — |
| 8Base-RHMTC-1.7 | Fixed | RHSA-2023:4293 |
| MTA 6.2 for RHEL 8 | Fixed | RHSA-2023:4627 |
| Red Hat OpenShift Container Platform 4.13 | Fixed | RHSA-2024:10813, RHSA-2024:8688 |
Not affected: 12 products
- 8Base-MTV-2.5
- 8Base-RHMTC-1.7
- Custom Metric Autoscaler operator for Red Hat Openshift
- Logging Subsystem for Red Hat OpenShift
- MTA 6.2 for RHEL 8
- Red Hat Advanced Cluster Management for Kubernetes 2
- Red Hat Advanced Cluster Security 3
- Red Hat Advanced Cluster Security 4
- Red Hat OpenShift Container Platform 4
- Red Hat OpenShift Container Platform 4.13
- Red Hat OpenShift Container Platform Assisted Installer 1
- Red Hat Web Terminal
Timeline
- 2026-10-02 Threatist record created from CVE-2023-26125
- 2026-10-03 Alias added: GHSA-3vp4-m3rf-835h
References
Patch 2
More Gin-gonic Gin vulnerabilities
- TI-2020-18795 Arbitrary log line injection in github.com/gin-gonic/gin CVSS 3.1HIGH 7.5
- TI-2023-13781 Improper handling of filenames in Content-Disposition HTTP header in github.com/gin-gonic/gin CVSS 3.1MEDIUM 4.3
- TI-2020-17293 HTTP response splitting in github.com/gin-gonic/gin CVSS 3.1HIGH 7.1
Sources
- CVE-2023-26125 · CVE Program
- CVE-2023-26125 · NVD
- FIRST EPSS
- GHSA-3vp4-m3rf-835h · GitHub Advisory Database · CC BY 4.0
- CVE-2023-26125 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences