CVE-2023-26125

🗓️ 04 May 2023 05:00:01Reported by snykType

cve🔗 web.nvd.nist.gov👁 345 Views🌐 WEB

Versions of github.com/gin-gonic/gin prior to 1.9.0 are vulnerable to Improper Input Validation via X-Forwarded-Prefix header, leading to cache poisoning. Note: Can serve as input vector for other vulnerabilities

Reporter	Title	Published	Views	Family All 27
IBM Security Bulletins	Security Bulletin: Astronomer with IBM is vulnerable to several vulnerabilities (CVE-2023-26125, CVE-2023-28155, CVE-2024-29018)	11 Aug 202513:34	–	ibm
Circl	CVE-2023-26125	4 May 202312:42	–	circl
CNNVD	Gin-Gonic Gin: Input validation error vulnerability	4 May 202300:00	–	cnnvd
Cvelist	CVE-2023-26125	4 May 202305:00	–	cvelist
Debian CVE	CVE-2023-26125	4 May 202305:00	–	debiancve
EUVD	EUVD-2023-1460	3 Oct 202520:07	–	euvd
Github Security Blog	Improper input validation in github.com/gin-gonic/gin	4 May 202306:30	–	github
Mend	CVE-2023-26125	4 May 202305:00	–	mend
NVD	CVE-2023-26125	4 May 202305:15	–	nvd
osv_debian	DEBIAN-CVE-2023-26125	4 May 202305:15	–	osv_debian

NVD

Vulners

Node

gin-gonic ginRange<1.9.0

[
  {
    "product": "github.com/gin-gonic/gin",
    "versions": [
      {
        "version": "0",
        "lessThan": "1.9.0",
        "status": "affected",
        "versionType": "semver"
      }
    ],
    "vendor": "n/a"
  }
]

Source	Link
github	www.github.com/t0rchwo0d/gin/commit/fd9f98e70fb4107ee68c783482d231d35e60507b
security	www.security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGINGONICGIN-3324285
github	www.github.com/gin-gonic/gin/releases/tag/v1.9.0
github	www.github.com/gin-gonic/gin/pull/3500
github	www.github.com/gin-gonic/gin/pull/3503

Parameter	Position	Path	Description	CWE
X-Forwarded-Prefix	header	/	Improper input validation of the X-Forwarded-Prefix header in gin-gonic/gin versions before 1.9.0 can lead to cache poisoning.	CWE-20, CWE-77

17 Jun 2026 05:42Current

7High risk

Vulners AI Score7

CVSS 3.15.6 - 7.3

EPSS0.00905

SSVC