Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: Go standard library net/http 1.17.12, 1.18.4 Clear all filters
TI-2022-13881 CVE-2022-32148 · GHSA-f839-v4x8-wvr3

Exposure of client IP addresses in net/http

Priority LOW 38

Improper exposure of client IP addresses in net/http before Go 1.17.12 and Go 1.18.4 can be triggered by calling httputil.ReverseProxy.ServeHTTP with a Request.Header map containing a nil value for the X-Forwarded-For he…

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.01517 Published 2022-08-09 Partial fix · 1.17.12, 1.18.4
TI-2022-01571 CVE-2022-1705 · GHSA-5hv8-7f46-fxf6

Improper sanitization of Transfer-Encoding headers in net/http

Priority LOW 32

Acceptance of some invalid Transfer-Encoding headers in the HTTP/1 client in net/http before Go 1.17.12 and Go 1.18.4 allows HTTP request smuggling if combined with an intermediate server that also improperly fails to re…

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.01531 Published 2022-08-09 Partial fix · 1.17.12, 1.18.4 CWE-444