CVE-2023-29406: Insufficient sanitization of Host header in net/http
Insufficient sanitization of Host header in net/http
Other sources
The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject additional headers or entire requests. With fix, the HTTP/1 client now refuses to send requests containing an invalid Request.Host or Request.URL.Host value.
— Launchpad
Affected Software
Event History
Frequently Asked Questions
What is CVE-2023-29406?
CVE-2023-29406 is a vulnerability in the HTTP/1 client in Golang, which allows a maliciously crafted Host header to inject additional headers or entire requests.
What is the severity of CVE-2023-29406?
CVE-2023-29406 has a severity value of 6.5, which is considered medium.
How does CVE-2023-29406 affect Golang Go?
CVE-2023-29406 affects Golang Go versions from 1.20.0 up to and including 1.20.6, as well as versions up to and including 1.19.11.
How can I fix CVE-2023-29406?
To fix CVE-2023-29406, update to Golang Go version 1.20.7 or 1.19.12 or later.
What are the references for CVE-2023-29406?
The references for CVE-2023-29406 are: - https://groups.google.com/g/golang-announce/c/2q13H6LEEx0 - https://go.dev/cl/506996 - https://pkg.go.dev/vuln/GO-2023-1878