Skip to content
CVE PROGRAM SOURCE RECORD6.5 Medium

CVE-2022-32148

Exposure of client IP addresses in net/http

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Go

Description

Improper exposure of client IP addresses in net/http before Go 1.17.12 and Go 1.18.4 can be triggered by calling httputil.ReverseProxy.ServeHTTP with a Request.Header map containing a nil value for the X-Forwarded-For header, which causes ReverseProxy to set the client IP as the value of the X-Forwarded-For header.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Go standard library net/http

Default version status: unaffected

  • 0 to < 1.17.12affected
  • 1.18.0-0 to < 1.18.4affected

References