CVE-2023-29406
Assigner: Go
Published: 2023-07-11T19:23:58.511Z
State: PUBLISHED
title: Insufficient sanitization of Host header in net/http
descriptions: value: The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject additional headers or entire requests. With fix, the HTTP/1 client now refuses to send requests containing an invalid Request.Host or Request.URL.Host value.
affected: vendor: Go standard library
product: net/http
collectionURL: https://pkg.go.dev
packageName: net/http
versions: version: 0
lessThan: 1.19.11
status: affected
versionType: semver
version: 1.20.0-0
lessThan: 1.20.6
status: affected
versionType: semver
programRoutines: Request.write
Client.CloseIdleConnections
Client.Do
Client.Get
Client.Head
Client.Post
Client.PostForm
Get
Head
Post
PostForm
Request.Write
Request.WriteProxy
Transport.CancelRequest
Transport.CloseIdleConnections
Transport.RoundTrip
defaultStatus: unaffected
problemTypes: descriptions: description: CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')
credits: value: Bartek Nowotarski