golang: net/http: insufficient sanitization of Host header

🗓️ 08 Nov 2023 14:26:58Reported by RedHatType

redhat

redhat🔗 access.redhat.com👁 4 Views

Golang net library vulnerability allows Host header injection, enabling cross site scripting and session hijacking.

Reporter	Title	Published	Views	Family All 369
ibm	Security Bulletin: IBM Cloud Pak for Data Scheduling was built with a vulnerable golang compiler. ( CVE-2023-29406, CVE-2023-29409 )	6 Dec 202315:44	–	ibm
ibm	Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to multiple Base OS issues	1 Dec 202316:06	–	ibm
ibm	Security Bulletin: Vulnerabilities in Node.js, Golang Go, HTTP/2, NGINX, OpenSSH, Linux kernel might affect IBM Spectrum Protect Plus	4 Feb 202518:15	–	ibm
ibm	Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to multiple Operator package issues	30 Nov 202318:45	–	ibm
ibm	Security Bulletin: Operations Dashboard is vulnerable to header injection due to Golang Go	2 Oct 202316:06	–	ibm
ibm	Security Bulletin: Multiple vulnerabilities in Golang Go affect Cloud Pak System	2 Jan 202411:59	–	ibm
ibm	Security Bulletin: Multiple security vulnerabilities are addressed with IBM Business Automation Manager Open Editions 9.0.1	16 Nov 202315:21	–	ibm
ibm	Security Bulletin: Vulnerabilities in Golang, openSSH and openJDK might affect IBM Spectrum Copy Data Management	15 Sep 202313:26	–	ibm
ibm	Security Bulletin: IBM Storage Protect Server is susceptible to numerous vulnerabilities due to Golang Go (CVE-2023-29402, CVE-2023-29403, CVE-2023-29404, CVE-2023-29405, CVE-2023-29406, CVE-2023-29400, CVE-2023-24540, CVE-2023-24539, X-Force 250518)	25 Sep 202317:11	–	ibm
ibm	Security Bulletin: IBM Observability with Instana for Self-Hosted Standard Edition is affected by Multiple Security Vulnerabilities	17 Oct 202408:51	–	ibm

OS	OS Version	Architecture	Package	Package Version	Filename
Red Hat Enterprise Linux	8	x86_64	yggdrasil-worker-forwarder	0.0.3-1.el8sat	yggdrasil-worker-forwarder-0.0.3-1.el8sat.x86_64.rpm

Source	Link
access	www.access.redhat.com/security/cve/CVE-2023-29406
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
groups	www.groups.google.com/g/golang-announce/c/2q13H6LEEx0
nvd	www.nvd.nist.gov/vuln/detail/CVE-2023-29406
cve	www.cve.org/CVERecord

16 Jul 2026 08:19Current

6.9Medium risk

Vulners AI Score6.9

CVSS 3.16.5

EPSS0.01453

SSVC

golang host header header injection cross site scripting session hijacking cache poisoning net library