CVE-2023-29406

Katalog CVE

CVSS 6.5 · Medium EPSS 1,5%

Kerentanan Interpretation Conflict pada golang go. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject additional headers or entire requests. With fix, the HTTP/1 client now refuses to send requests containing an invalid Request.Host or Request.URL.Host value.

Rincian

Terbit di NVD

11 Juli 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-436: Interpretation Conflict

EPSS (30 hari)

1,5% peluang dieksploitasi; lebih tinggi dari 72,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://pkg.go.dev/vuln/GO-2023-1878 advisory vendor
• https://go.dev/cl/506996 patch
• https://go.dev/issue/60374 issue tracking · patch
• https://groups.google.com/g/golang-announce/c/2q13H6LEEx0 mailing list
• https://security.gentoo.org/glsa/202311-09
• https://security.netapp.com/advisory/ntap-20230814-0002/