5.9 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
6.9 Medium
AI Score
Confidence
Low
0.001 Low
EPSS
Percentile
36.8%
A race condition in go-resty can result in HTTP request body disclosure across requests. This condition can be triggered by calling sync.Pool.Put with the same *bytes.Buffer more than once, when request retries are enabled and a retry occurs. The call to sync.Pool.Get will then return a bytes.Buffer that hasn’t had bytes.Buffer.Reset called on it. This dirty buffer will contain the HTTP request body from an unrelated request, and go-resty will append the current HTTP request body to it, sending two bodies in one request. The sync.Pool in question is defined at package level scope, so a completely unrelated server could receive the request body.
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
Debian | 12 | all | golang-github-go-resty-resty | <= 2.6.0-1 | golang-github-go-resty-resty_2.6.0-1_all.deb |
Debian | 11 | all | golang-github-go-resty-resty | <= 2.4.0-1 | golang-github-go-resty-resty_2.4.0-1_all.deb |
Debian | 999 | all | golang-github-go-resty-resty | <= 2.10.0-1 | golang-github-go-resty-resty_2.10.0-1_all.deb |
Debian | 13 | all | golang-github-go-resty-resty | <= 2.10.0-1 | golang-github-go-resty-resty_2.10.0-1_all.deb |
5.9 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
6.9 Medium
AI Score
Confidence
Low
0.001 Low
EPSS
Percentile
36.8%