Read the docs
TI-2023-24276 Aliases CVE-2023-45286GHSA-xwh9-gc39-5298

HTTP request body disclosure in github.com/go-resty/resty/v2

Priority LOW 28CWE-362Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Partial Red Hat: 2 fixed, 2 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-200.

Summary

A race condition in go-resty can result in HTTP request body disclosure across requests. This condition can be triggered by calling sync.Pool.Put with the same *bytes.Buffer more than once, when request retries are enabled and a retry occurs. The call to sync.Pool.Get will then return a bytes.Buffer that hasn't had bytes.Buffer.Reset called on it. This dirty buffer will contain the HTTP request body from an unrelated request, and go-resty will append the current HTTP request body to it, sending two bodies in one request. The sync.Pool in question is defined at package level scope, so a completely unrelated server could receive the request body.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00722 54th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial github.com/go-resty/resty/v2 (github.com/go-resty/resty/v2): 2.11.0github.com/go-resty/resty/v2 (Go): 2.11.0Red Hat: 2 advisoriesRed Hat: 2 fixed, 2 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
github.com/go-resty/resty/v2github.com/go-resty/resty/v22.10.0 to before 2.11.02.11.0Patch availableCNA
—github.com/go-resty/resty/v2 (Go)2.10.0 to before 2.11.02.11.0Patch availableGHSA-xwh9-gc39-5298
  • github.com/go-resty/resty/v2 Vendorgithub.com/go-resty/resty/v2 Affected 2.10.0 to before 2.11.0 Fixed in 2.11.0 Patch available CNA
  • github.com/go-resty/resty/v2 (Go) Vendor— Affected 2.10.0 to before 2.11.0 Fixed in 2.11.0 Patch available GHSA-xwh9-gc39-5298

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:resty_project:resty:*:*:*:*:*:go:*:*up to 2.10.0VulnerableResty Project
  • cpe:2.3:a:resty_project:resty:*:*:*:*:*:go:*:* Versions up to 2.10.0 Vulnerable ·Resty Project

Remediation

  • Fix · CNA github.com/go-resty/resty/v2 (github.com/go-resty/resty/v2) Fixed in 2.11.0
  • Fix · GHSA-xwh9-gc39-5298 github.com/go-resty/resty/v2 (Go) Fixed in 2.11.0 Advisory →

Red Hat 2 advisories

  • RHSA-2024:3621 Released 2024-06-05 · Red Hat rating Important
    Red Hat OpenShift distributed tracing 3.2.0 operator/operand containers update
    • Red Hat OpenShift distributed tracing 3.2 rhosdt/jaeger-agent-rhel8, rhosdt/jaeger-all-in-one-rhel8, rhosdt/jaeger-collector-rhel8 +16
  • RHSA-2024:3316 Released 2024-05-23 · Red Hat rating Important
    Migration Toolkit for Applications security and bug fix update
    • MTA 7.0 for RHEL 9 mta/mta-analyzer-addon-rhel9, mta/mta-analyzer-lsp-rhel9, mta/mta-cli-rhel9 +3

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Migration Toolkit for Applications 6AffectedNo fix planned: Will not fix
Red Hat OpenShift distributed tracing 2AffectedNo fix yet
MTA 7.0 for RHEL 9Fixed RHSA-2024:3316
Red Hat OpenShift distributed tracing 3.2Fixed RHSA-2024:3621
Not affected: 5 products
  • MTA 7.0 for RHEL 8
  • MTA 7.0 for RHEL 9
  • Red Hat Ceph Storage 5
  • Red Hat OpenShift Container Platform 4
  • Red Hat OpenShift Dev Spaces

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-45286
  2. 2026-10-03 Alias added: GHSA-xwh9-gc39-5298

References

Exploit 1

Patch 1

Advisory 2

Other 4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences