Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2023-29406

Insufficient sanitization of Host header in net/http

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Go

Description

The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject additional headers or entire requests. With fix, the HTTP/1 client now refuses to send requests containing an invalid Request.Host or Request.URL.Host value.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Go standard library net/http

Default version status: unaffected

  • 0 to < 1.19.11affected
  • 1.20.0-0 to < 1.20.6affected

References