Read the docs
TI-2023-13786 Aliases CVE-2023-29406GHSA-f8f7-69v5-w4vx

Insufficient sanitization of Host header in net/http

Priority LOW 32CWE-436Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · High · None
Fix status
Partial Red Hat: 19 fixed, 28 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat.

Summary

The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject additional headers or entire requests. With fix, the HTTP/1 client now refuses to send requests containing an invalid Request.Host or Request.URL.Host value.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01453 73rd percentileScored 2026-11-07
Fix Partial net/http (Go standard library): 1.19.11, 1.20.6Red Hat: 30 advisoriesRed Hat: 19 fixed, 28 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Go standard librarynet/httpbefore 1.19.11; 1.20.0-0 to before 1.20.61.19.11, 1.20.6Patch availableCNA
  • net/http VendorGo standard library Affected before 1.19.11; 1.20.0-0 to before 1.20.6 Fixed in 1.19.11, 1.20.6 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*before 1.19.11; 1.20.0 to before 1.20.6VulnerableGo standard library
  • cpe:2.3:a:golang:go:*:*:*:*:*:*:*:* Versions before 1.19.11; 1.20.0 to before 1.20.6 Vulnerable ·Go standard library

Remediation

  • Fix · CNA net/http (Go standard library) Fixed in 1.19.11, 1.20.6

Red Hat 30 advisories

  • RHSA-2024:1570 Released 2024-03-28 · Red Hat rating Important
    ACS 4.4 enhancement and security update
    • RHACS 4.4 for RHEL 8 advanced-cluster-security/rhacs-central-db-rhel8, advanced-cluster-security/rhacs-collector-rhel8, advanced-cluster-security/rhacs-collector-slim-rhel8 +10
  • RHSA-2024:1383 Released 2024-03-19 · Red Hat rating Important
    Red Hat OpenShift Data Foundation 4.15.0 security, enhancement, & bug fix update
    • RHODF 4.15 for RHEL 9 odf4/cephcsi-rhel9, odf4/mcg-core-rhel9, odf4/mcg-operator-bundle +23
  • RHSA-2024:1027 Released 2024-02-28 · Red Hat rating Moderate
    Migration Toolkit for Applications security update
    • MTA 6.2 for RHEL 8 mta/mta-hub-rhel9, mta/mta-operator-bundle, mta/mta-pathfinder-rhel9 +3
Show 27 more Red Hat advisories
  • RHSA-2024:0293 Released 2024-01-23 · Red Hat rating Moderate
    OpenShift Container Platform 4.14.10 packages and security update
    • Red Hat OpenShift Container Platform 4.14 openshift-4.14.0-202401121302.p0.ge36e183.assembly.stream.el8, openshift-4.14.0-202401121302.p0.ge36e183.assembly.stream.el9, openshift-hyperkube-4.14.0-202401121302.p0.ge36e183.assembly.stream.el8 +1
  • RHSA-2023:6840 Released 2023-11-15 · Red Hat rating Important
    OpenShift Container Platform 4.14.2 packages and security update
    • Red Hat OpenShift Container Platform 4.14 cri-o-1.27.1-13.1.rhaos4.14.git956c5f7.el8, cri-o-1.27.1-13.1.rhaos4.14.git956c5f7.el9, openshift-clients-4.14.0-202311031050.p0.g9b1e0d2.assembly.stream.el8 +3
  • RHSA-2023:7202 Released 2023-11-14 · Red Hat rating Moderate
    container-tools:4.0 security and bug fix update
    • Red Hat Enterprise Linux AppStream (v. 8) aardvark-dns-2:1.0.1-38.module+el8.9.0+20325+b2853e6e.aarch64::container-tools:4.0, aardvark-dns-2:1.0.1-38.module+el8.9.0+20325+b2853e6e.ppc64le::container-tools:4.0, aardvark-dns-2:1.0.1-38.module+el8.9.0+20325+b2853e6e.s390x::container-tools:4.0 +47
  • RHSA-2023:6939 Released 2023-11-14 · Red Hat rating Moderate
    container-tools:rhel8 security and bug fix update
    • Red Hat Enterprise Linux AppStream (v. 8) aardvark-dns-2:1.7.0-1.module+el8.9.0+19244+655f84ee.aarch64::container-tools:rhel8, aardvark-dns-2:1.7.0-1.module+el8.9.0+19244+655f84ee.ppc64le::container-tools:rhel8, aardvark-dns-2:1.7.0-1.module+el8.9.0+19244+655f84ee.s390x::container-tools:rhel8 +47
  • RHSA-2023:6938 Released 2023-11-14 · Red Hat rating Moderate
    container-tools:4.0 security and bug fix update
    • Red Hat Enterprise Linux AppStream (v. 8) aardvark-dns-2:1.0.1-38.module+el8.9.0+19098+6e7a5e3f.aarch64::container-tools:4.0, aardvark-dns-2:1.0.1-38.module+el8.9.0+19098+6e7a5e3f.ppc64le::container-tools:4.0, aardvark-dns-2:1.0.1-38.module+el8.9.0+19098+6e7a5e3f.s390x::container-tools:4.0 +47
  • RHSA-2023:6818 Released 2023-11-08 · Red Hat rating Important
    Satellite 6.14 security and bug fix update
    • Red Hat Satellite 6.14 for RHEL 8 foreman-3.7.0.9-1.el8sat, foreman-cli-3.7.0.9-1.el8sat, foreman-debug-3.7.0.9-1.el8sat +33
  • RHSA-2023:6346 Released 2023-11-07 · Red Hat rating Moderate
    toolbox security and bug fix update
    • Red Hat Enterprise Linux AppStream (v. 9) toolbox-0.0.99.4-6.el9_3, toolbox-tests-0.0.99.4-6.el9_3
  • RHSA-2023:6402 Released 2023-11-07 · Red Hat rating Moderate
    containernetworking-plugins security and bug fix update
    • Red Hat Enterprise Linux AppStream (v. 9) containernetworking-plugins-1:1.3.0-4.el9
  • RHSA-2023:6474 Released 2023-11-07 · Red Hat rating Moderate
    podman security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 9) podman-2:4.6.1-5.el9, podman-docker-2:4.6.1-5.el9, podman-gvproxy-2:4.6.1-5.el9 +3
  • RHSA-2023:6473 Released 2023-11-07 · Red Hat rating Moderate
    buildah security update
    • Red Hat Enterprise Linux AppStream (v. 9) buildah-1:1.31.3-1.el9, buildah-tests-1:1.31.3-1.el9
  • RHSA-2023:6363 Released 2023-11-07 · Red Hat rating Moderate
    skopeo security update
    • Red Hat Enterprise Linux AppStream (v. 9) skopeo-2:1.13.3-1.el9, skopeo-tests-2:1.13.3-1.el9
  • RHSA-2023:6298 Released 2023-11-03 · Red Hat rating Important
    Release of OpenShift Serverless Client kn 1.30.2 security update
    • Red Hat OpenShift Serverless 1.0 openshift-serverless-clients-1.9.2-4.el8
  • RHSA-2023:6296 Released 2023-11-02 · Red Hat rating Important
    Release of OpenShift Serverless 1.30.2
    • Red Hat OpenShift Serverless 1.30 openshift-serverless-1-tech-preview/eventing-istio-controller-rhel8, openshift-serverless-1-tech-preview/knative-client-plugin-event-sender-rhel8, openshift-serverless-1-tech-preview/logic-data-index-ephemeral-rhel8 +37
  • RHSA-2023:6161 Released 2023-10-30 · Red Hat rating Important
    Migration Toolkit for Containers (MTC) 1.7.14 security and bug fix update
    • 8Base-RHMTC-1.7 rhmtc/openshift-migration-controller-rhel8, rhmtc/openshift-migration-velero-plugin-for-aws-rhel8, rhmtc/openshift-migration-velero-plugin-for-gcp-rhel8 +3
  • RHSA-2023:5933 Released 2023-10-26 · Red Hat rating Important
    Openshift Secondary Scheduler Operator 1.1.3 security update
    • OSSO 1.1 for RHEL 8 openshift-secondary-scheduler-operator/secondary-scheduler-operator-rhel8
  • RHSA-2023:5947 Released 2023-10-26 · Red Hat rating Important
    Run Once Duration Override Operator for Red Hat OpenShift 1.0.1 security update
    • RODOO 1.0 for RHEL 8 run-once-duration-override-operator/run-once-duration-override-rhel8
  • RHSA-2023:6115 Released 2023-10-25 · Red Hat rating Important
    OpenShift API for Data Protection security update
    • 8Base-OADP-1.1 oadp/oadp-kubevirt-velero-plugin-rhel8, oadp/oadp-rhel8-operator, oadp/oadp-velero-plugin-for-aws-rhel8 +6
  • RHSA-2023:6085 Released 2023-10-24 · Red Hat rating Important
    Red Hat OpenShift distributed tracing security update
    • Red Hat OpenShift distributed tracing 2.9 rhosdt/jaeger-agent-rhel8, rhosdt/jaeger-all-in-one-rhel8, rhosdt/jaeger-collector-rhel8 +15
  • RHSA-2023:6031 Released 2023-10-23 · Red Hat rating Important
    Cryostat security update
    • Cryostat 2 on RHEL 8 cryostat-tech-preview/cryostat-grafana-dashboard-rhel8, cryostat-tech-preview/cryostat-operator-bundle, cryostat-tech-preview/cryostat-reports-rhel8 +3
  • RHSA-2023:5976 Released 2023-10-20 · Red Hat rating Important
    Service Telemetry Framework 1.5.2 security update
    • Service Telemetry Framework 1.5 for RHEL 8 stf/prometheus-webhook-snmp-rhel8, stf/service-telemetry-operator-bundle, stf/service-telemetry-rhel8-operator +4
  • RHSA-2023:5974 Released 2023-10-20 · Red Hat rating Important
    Network Observability security update
    • NETOBSERV 1.4 for RHEL 9 network-observability/network-observability-console-plugin-rhel9, network-observability/network-observability-ebpf-agent-rhel9, network-observability/network-observability-flowlogs-pipeline-rhel9 +1
  • RHSA-2023:5965 Released 2023-10-20 · Red Hat rating Important
    Red Hat OpenStack Platform 16.2.5 (collectd-libpod-stats, etcd) security update
    • Red Hat OpenStack Platform 16.2 etcd-3.3.23-15.el8ost, python-octavia-tests-tempest-1.4.1-2.20230111145026.f7718ef.el8ost, python3-octavia-tests-tempest-1.4.1-2.20230111145026.f7718ef.el8ost +1
  • RHSA-2023:5530 Released 2023-10-20 · Red Hat rating Important
    Logging Subsystem 5.7.7 - Red Hat OpenShift security update
    • RHOL 5.7 for RHEL 8 openshift-logging/cluster-logging-rhel8-operator, openshift-logging/elasticsearch-proxy-rhel8, openshift-logging/elasticsearch-rhel8-operator +7
  • RHSA-2023:5541 Released 2023-10-20 · Red Hat rating Important
    Logging Subsystem 5.6.12 - Red Hat OpenShift security update
    • RHOL 5.6 for RHEL 8 openshift-logging/cluster-logging-rhel8-operator, openshift-logging/elasticsearch-proxy-rhel8, openshift-logging/elasticsearch-rhel8-operator +7
  • RHSA-2023:5935 Released 2023-10-19 · Red Hat rating Important
    Red Hat OpenStack Platform 16.2.5 security update
    • Red Hat OpenStack Platform 16.2 rhosp-rhel8/osp-director-agent, rhosp-rhel8/osp-director-downloader, rhosp-rhel8/osp-director-operator +1
  • RHSA-2023:5738 Released 2023-10-16 · Red Hat rating Important
    go-toolset and golang security and bug fix update
    • Red Hat Enterprise Linux AppStream (v. 9) golang-1.19.13-1.el9_2, golang-bin-1.19.13-1.el9_2, golang-docs-1.19.13-1.el9_2 +4
  • RHSA-2023:5721 Released 2023-10-16 · Red Hat rating Important
    go-toolset:rhel8 security update
    • Red Hat Enterprise Linux AppStream (v. 8) delve-1.9.1-1.module+el8.8.0+16778+5fbb74f5.src::go-toolset:rhel8, delve-1.9.1-1.module+el8.8.0+16778+5fbb74f5.x86_64::go-toolset:rhel8, go-toolset-1.19.13-1.module+el8.8.0+20380+7171fefb.aarch64::go-toolset:rhel8 +18

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Migration Toolkit for VirtualizationAffectedNo fix yet
Node Maintenance OperatorAffectedNo fix yet
OpenShift Developer Tools and ServicesAffectedNo fix yet
OpenShift PipelinesAffectedNo fix yet
OpenShift Service Mesh 2AffectedNo fix yet
Red Hat 3scale API Management Platform 2AffectedNo fix yet
Red Hat Advanced Cluster Management for Kubernetes 2AffectedNo fix yet
Red Hat Advanced Cluster Security 3AffectedNo fix yet
Red Hat Ansible Automation Platform 2AffectedNo fix yet
Red Hat Application Interconnect 1.0AffectedNo fix yet
Red Hat Ceph Storage 3AffectedNo fix planned: Will not fix
Red Hat Ceph Storage 5AffectedNo fix yet
Red Hat Enterprise Linux 8AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux 9AffectedNo fix planned: Will not fix
Red Hat OpenShift Data Science (RHODS)AffectedNo fix planned: Will not fix
Red Hat OpenShift Dev SpacesAffectedNo fix yet
Red Hat OpenShift GitOpsAffectedNo fix yet
Red Hat OpenShift Virtualization 4AffectedNo fix yet
Red Hat OpenShift distributed tracing 2AffectedNo fix yet
Red Hat OpenShift on AWSAffectedNo fix yet
Red Hat OpenStack Platform 16.2AffectedNo fix planned: Will not fix
Red Hat OpenStack Platform 17.0AffectedNo fix planned: Will not fix
Red Hat OpenStack Platform 17.1AffectedNo fix planned: Will not fix
Red Hat OpenStack Platform 18.0AffectedNo fix yet
Red Hat Storage 3AffectedNo fix planned: Will not fix
Red Hat Web TerminalAffectedNo fix yet: Fix deferred
Red Hat build of Apicurio Registry 2AffectedNo fix yet
Self Node Remediation OperatorAffectedNo fix yet
8Base-OADP-1.1Fixed RHSA-2023:6115
8Base-RHMTC-1.7Fixed RHSA-2023:6161
Cryostat 2 on RHEL 8Fixed RHSA-2023:6031
MTA 6.2 for RHEL 8Fixed RHSA-2024:1027
NETOBSERV 1.4 for RHEL 9Fixed RHSA-2023:5974
OSSO 1.1 for RHEL 8Fixed RHSA-2023:5933
RHACS 4.4 for RHEL 8Fixed RHSA-2024:1570
RHODF 4.15 for RHEL 9Fixed RHSA-2024:1383
RHOL 5.6 for RHEL 8Fixed RHSA-2023:5541
RHOL 5.7 for RHEL 8Fixed RHSA-2023:5530
RODOO 1.0 for RHEL 8Fixed RHSA-2023:5947
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2023:5721, RHSA-2023:6938, RHSA-2023:6939, RHSA-2023:7202
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2023:5738, RHSA-2023:6346, RHSA-2023:6363, RHSA-2023:6402, RHSA-2023:6473, RHSA-2023:6474
Red Hat OpenShift Container Platform 4.14Fixed RHSA-2023:6840, RHSA-2024:0293
Red Hat OpenShift Serverless 1.0Fixed RHSA-2023:6298
Red Hat OpenShift Serverless 1.30Fixed RHSA-2023:6296
Red Hat OpenStack Platform 16.2Fixed RHSA-2023:5935, RHSA-2023:5965
Red Hat Satellite 6.14 for RHEL 8Fixed RHSA-2023:6818
Service Telemetry Framework 1.5 for RHEL 8Fixed RHSA-2023:5976
Not affected: 22 products
  • 8Base-OADP-1.1
  • 8Base-RHMTC-1.7
  • Cryostat 2 on RHEL 8
  • Custom Metric Autoscaler operator for Red Hat Openshift
  • NETOBSERV 1.4 for RHEL 9
  • Node HealthCheck Operator
  • OSSO 1.1 for RHEL 8
  • RHACS 4.4 for RHEL 8
  • RHODF 4.15 for RHEL 9
  • RHOL 5.6 for RHEL 8
  • RHOL 5.7 for RHEL 8
  • RODOO 1.0 for RHEL 8
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat Enterprise Linux AppStream (v. 9)
  • Red Hat OpenShift Container Platform 4
  • Red Hat OpenShift Container Platform 4.14
  • Red Hat OpenStack Platform 16.2
  • Red Hat OpenStack Platform 17.1
  • Red Hat Openshift Data Foundation 4
  • Red Hat Satellite 6.14 for RHEL 8
  • cert-manager Operator for Red Hat OpenShift

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-29406
  2. 2026-10-03 Alias added: GHSA-f8f7-69v5-w4vx

References

Patch 2

Advisory 1

Other 3

  • TI-2020-00578 Improper certificate validation in Microsoft Windows KEVCVSS 3.1HIGH 8.1
  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2018-05208 The "go get" implementation in Go 1.9.4, when the -insecure command-line option is used… CVSS 3.1HIGH 8.8
  • TI-2018-12083 Improper input validation in [UNKNOWN] golang CVSS 3.1HIGH 8.1
  • TI-2024-16306 Mishandling of corrupt central directory record in archive/zip CVSS 3.1MEDIUM 5.5
  • TI-2021-15910 Go before 1.16.9 and 1.17.x before 1.17.2 has a Buffer Overflow via large arguments in a… CVSS 3.1CRITICAL 9.8
See all 170 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences