CVE-2023-29406

2023-07-1120:15:10

Google

osv.dev

cve-2023-29406

host header injection

http/1 client

security fix

software

7 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

28.6%

JSON

The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject additional headers or entire requests. With fix, the HTTP/1 client now refuses to send requests containing an invalid Request.Host or Request.URL.Host value.

CPENameOperatorVersion
goeqweekly.2010-01-05
goeqweekly.2010-08-11
goeqweekly.2011-09-01
goeqweekly.2011-06-09
goeqweekly.2010-11-10
goeqweekly.2011-07-07
goeqgo1.19.7
goeqgo1.19.8
goeqweekly.2011-08-10
goeqgo1.9.2

Name	Operator	Version
go	eq	weekly.2010-01-05
go	eq	weekly.2010-08-11
go	eq	weekly.2011-09-01
go	eq	weekly.2011-06-09
go	eq	weekly.2010-11-10
go	eq	weekly.2011-07-07
go	eq	go1.19.7
go	eq	go1.19.8
go	eq	weekly.2011-08-10
go	eq	go1.9.2