Aller au contenu
en Se connecter
6.5 Moyenne

CVE-2022-32148 Improper exposure of client IP addresses in net/http before Go 1.17.12 and Go 1.18.4 can be triggered by calling…

Description

Improper exposure of client IP addresses in net/http before Go 1.17.12 and Go 1.18.4 can be triggered by calling httputil.ReverseProxy.ServeHTTP with a Request.Header map containing a nil value for the X-Forwarded-For header, which causes ReverseProxy to set the client IP as the value of the X-Forwarded-For header.

Produits et versions touchés

Produit Versions touchées Corrigé en
net/http 1.18 1.18.0-0 → < 1.18.4 1.18.4
net/http 1.17 premières → < 1.17.12 1.17.12

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de net/http

Les 26 CVE de net/http →
CVE-2026-97032 HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently 7.5 Élevée CVE-2026-78663 The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream… 9.1 Critique CVE-2026-78669 A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams… 7.5 Élevée CVE-2026-78667 When parsing a Range header containing a large number of small ranges, FileServer(FS), ServeContent, and ServeFile(FS)… 7.5 Élevée
Suivre cette CVE