Logo
›
›vulnerability›CVE-2023-29406
Name
CVE-2023-29406
Source
NVD ( link)Debian ( link)
Description
The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject additional headers or entire requests. With fix, the HTTP/1 client now refuses to send requests containing an invalid Request.Host or Request.URL.Host value.
CWEs
CWE-436
Published Date
Updated Date
Workaround
-
Advisories
https://go.dev/cl/506996Patch
https://go.dev/issue/60374Issue Tracking
https://groups.google.com/g/golang-announce/c/2q13H6LEEx0Mailing List
https://pkg.go.dev/vuln/GO-2023-1878Vendor Advisory
https://go.dev/cl/506996Patch
https://go.dev/issue/60374Issue Tracking
https://groups.google.com/g/golang-announce/c/2q13H6LEEx0Mailing List
https://pkg.go.dev/vuln/GO-2023-1878Vendor Advisory

Analysis#

Affected Component
Analysis
go
Exploitable
go-binary-native
Exploitable

Vulnerability Ratings#

6.5
CVSSv31
NaN
other

Others affected components#

Name
Project
Project Version
Version
Status
golang-bootstrap
openwrt
master
1.24.13-r1
Not Affected
golang1.26
openwrt
master
1.26.4-r1
Not Affected
golang-bootstrap
openwrt
openwrt-25.12
1.24.13-r1
Not Affected
golang1.26
openwrt
openwrt-25.12
1.26.4-r1
Not Affected
go
yocto
master
1.26.4
Not Affected
go-binary-native
yocto
master
1.26.4
Not Affected
go
yocto
scarthgap
1.22.12
Not Affected
go-binary-native
yocto
scarthgap
1.22.12
Not Affected