In Go before 1.15.13 and 1.16.x before 1.16.5, some configurations of ReverseProxy (from net/http/httputil) result in a situation where an attacker is able to drop arbitrary headers.

CPENameOperatorVersion
goeqweekly.2012-01-27
goeqweekly.2012-03-13
goeqweekly.2009-12-22
goeqweekly.2012-01-20
goeqgo1.10beta2
goeqgo1.12beta2
goeqgo1.15beta1
goeqweekly.2010-07-01
goeqweekly.2011-03-07.1
goeqgo1.11beta2

Name	Operator	Version
go	eq	weekly.2012-01-27
go	eq	weekly.2012-03-13
go	eq	weekly.2009-12-22
go	eq	weekly.2012-01-20
go	eq	go1.10beta2
go	eq	go1.12beta2
go	eq	go1.15beta1
go	eq	weekly.2010-07-01
go	eq	weekly.2011-03-07.1
go	eq	go1.11beta2