Unrated severityNVD Advisory· Published Jul 11, 2023· Updated Feb 13, 2025

Insufficient sanitization of Host header in net/http

CVE-2023-29406

Description

The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject additional headers or entire requests. With fix, the HTTP/1 client now refuses to send requests containing an invalid Request.Host or Request.URL.Host value.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

osv-coords73 versions
pkg:apk/chainguard/falco pkg:apk/chainguard/falco-dev pkg:apk/chainguard/falco-src pkg:apk/chainguard/go-1.19 pkg:apk/chainguard/go-1.19-doc pkg:apk/chainguard/go-1.20 pkg:apk/chainguard/go-1.20-doc pkg:apk/chainguard/kind pkg:apk/wolfi/falco pkg:apk/wolfi/falco-dev pkg:apk/wolfi/falco-src pkg:apk/wolfi/go-1.19 pkg:apk/wolfi/go-1.19-doc pkg:apk/wolfi/go-1.20 pkg:apk/wolfi/go-1.20-doc pkg:apk/wolfi/kind pkg:bitnami/golang pkg:rpm/almalinux/aardvark-dns pkg:rpm/almalinux/buildah pkg:rpm/almalinux/buildah-tests pkg:rpm/almalinux/cockpit-podman pkg:rpm/almalinux/conmon pkg:rpm/almalinux/containernetworking-plugins pkg:rpm/almalinux/containers-common pkg:rpm/almalinux/container-selinux pkg:rpm/almalinux/crit pkg:rpm/almalinux/criu pkg:rpm/almalinux/criu-devel pkg:rpm/almalinux/criu-libs pkg:rpm/almalinux/crun pkg:rpm/almalinux/fuse-overlayfs pkg:rpm/almalinux/libslirp pkg:rpm/almalinux/libslirp-devel pkg:rpm/almalinux/netavark pkg:rpm/almalinux/oci-seccomp-bpf-hook pkg:rpm/almalinux/podman pkg:rpm/almalinux/podman-catatonit pkg:rpm/almalinux/podman-docker pkg:rpm/almalinux/podman-gvproxy pkg:rpm/almalinux/podman-plugins pkg:rpm/almalinux/podman-remote pkg:rpm/almalinux/podman-tests pkg:rpm/almalinux/python3-criu pkg:rpm/almalinux/python3-podman pkg:rpm/almalinux/runc pkg:rpm/almalinux/skopeo pkg:rpm/almalinux/skopeo-tests pkg:rpm/almalinux/slirp4netns pkg:rpm/almalinux/toolbox pkg:rpm/almalinux/toolbox-tests pkg:rpm/almalinux/udica pkg:rpm/opensuse/etcd&distro=openSUSE%20Leap%2015.5 pkg:rpm/opensuse/etcd&distro=openSUSE%20Leap%2015.6 pkg:rpm/opensuse/go1.19&distro=openSUSE%20Leap%2015.4 pkg:rpm/opensuse/go1.19&distro=openSUSE%20Leap%2015.5 pkg:rpm/opensuse/go1.19&distro=openSUSE%20Tumbleweed pkg:rpm/opensuse/go1.19-openssl&distro=openSUSE%20Leap%2015.4 pkg:rpm/opensuse/go1.19-openssl&distro=openSUSE%20Leap%2015.5 pkg:rpm/opensuse/go1.20&distro=openSUSE%20Leap%2015.4 pkg:rpm/opensuse/go1.20&distro=openSUSE%20Leap%2015.5 pkg:rpm/opensuse/go1.20&distro=openSUSE%20Tumbleweed pkg:rpm/opensuse/go1.20-openssl&distro=openSUSE%20Leap%2015.4 pkg:rpm/opensuse/go1.20-openssl&distro=openSUSE%20Leap%2015.5 pkg:rpm/suse/go1.19&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Development%20Tools%2015%20SP4 pkg:rpm/suse/go1.19&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Development%20Tools%2015%20SP5 pkg:rpm/suse/go1.19&distro=SUSE%20Linux%20Enterprise%20Real%20Time%2015%20SP3 pkg:rpm/suse/go1.19-openssl&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Development%20Tools%2015%20SP4 pkg:rpm/suse/go1.19-openssl&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Development%20Tools%2015%20SP5 pkg:rpm/suse/go1.20&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Development%20Tools%2015%20SP4 pkg:rpm/suse/go1.20&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Development%20Tools%2015%20SP5 pkg:rpm/suse/go1.20&distro=SUSE%20Linux%20Enterprise%20Real%20Time%2015%20SP3 pkg:rpm/suse/go1.20-openssl&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Development%20Tools%2015%20SP4 pkg:rpm/suse/go1.20-openssl&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Development%20Tools%2015%20SP5
< 0.37.1-r0+ 72 more
- (no CPE)range: < 0.37.1-r0
- (no CPE)range: < 0.37.1-r0
- (no CPE)range: < 0.37.1-r0
- (no CPE)range: < 1.19.11-r0
- (no CPE)range: < 1.19.11-r0
- (no CPE)range: < 1.20.6-r0
- (no CPE)range: < 1.20.6-r0
- (no CPE)range: < 0.21.0-r0
- (no CPE)range: < 0.37.1-r0
- (no CPE)range: < 0.37.1-r0
- (no CPE)range: < 0.37.1-r0
- (no CPE)range: < 1.19.11-r0
- (no CPE)range: < 1.19.11-r0
- (no CPE)range: < 1.20.6-r0
- (no CPE)range: < 1.20.6-r0
- (no CPE)range: < 0.21.0-r0
- (no CPE)range: < 1.19.11
- (no CPE)range: < 2:1.0.1-38.module_el8.9.0+3627+db8ec155
- (no CPE)range: < 1:1.31.3-1.el9
- (no CPE)range: < 1:1.31.3-1.el9
- (no CPE)range: < 46-1.module_el8.7.0+3344+5bcd850f
- (no CPE)range: < 2:2.1.4-2.module_el8.9.0+3627+db8ec155
- (no CPE)range: < 1:1.3.0-4.el9
- (no CPE)range: < 2:1-38.module_el8.9.0+3627+db8ec155
- (no CPE)range: < 2:2.205.0-3.module_el8.9.0+3627+db8ec155
- (no CPE)range: < 3.15-3.module_el8.6.0+3137+d33c3efb
- (no CPE)range: < 3.15-3.module_el8.6.0+2877+8e437bf5
- (no CPE)range: < 3.15-3.module_el8.6.0+2877+8e437bf5
- (no CPE)range: < 3.15-3.module_el8.6.0+2877+8e437bf5
- (no CPE)range: < 1.8.3-1.module_el8.9.0+3627+db8ec155
- (no CPE)range: < 1.9-2.module_el8.9.0+3627+db8ec155
- (no CPE)range: < 4.4.0-1.module_el8.6.0+2877+8e437bf5
- (no CPE)range: < 4.4.0-1.module_el8.6.0+3137+d33c3efb
- (no CPE)range: < 2:1.0.1-38.module_el8.9.0+3627+db8ec155
- (no CPE)range: < 1.2.5-2.module_el8.8.0+3468+16b86c82
- (no CPE)range: < 2:4.6.1-5.el9
- (no CPE)range: < 2:4.0.2-24.module_el8.9.0+3627+db8ec155
- (no CPE)range: < 2:4.6.1-5.el9
- (no CPE)range: < 2:4.6.1-5.el9
- (no CPE)range: < 2:4.6.1-5.el9
- (no CPE)range: < 2:4.6.1-5.el9
- (no CPE)range: < 2:4.6.1-5.el9
- (no CPE)range: < 3.15-3.module_el8.6.0+3137+d33c3efb
- (no CPE)range: < 4.0.0-2.module_el8.9.0+3627+db8ec155
- (no CPE)range: < 1:1.1.5-2.module_el8.9.0+3627+db8ec155
- (no CPE)range: < 2:1.13.3-1.el9
- (no CPE)range: < 2:1.13.3-1.el9
- (no CPE)range: < 1.1.8-3.module_el8.9.0+3627+db8ec155
- (no CPE)range: < 0.0.99.4-6.el9_3
- (no CPE)range: < 0.0.99.4-6.el9_3
- (no CPE)range: < 0.2.6-4.module_el8.9.0+3627+db8ec155
- (no CPE)range: < 3.5.12-150000.7.6.1
- (no CPE)range: < 3.5.12-150000.7.6.1
- (no CPE)range: < 1.19.11-150000.1.37.1
- (no CPE)range: < 1.19.11-150000.1.37.1
- (no CPE)range: < 1.19.11-1.1
- (no CPE)range: < 1.19.13.1-150000.1.8.1
- (no CPE)range: < 1.19.13.1-150000.1.8.1
- (no CPE)range: < 1.20.6-150000.1.17.1
- (no CPE)range: < 1.20.6-150000.1.17.1
- (no CPE)range: < 1.20.6-1.1
- (no CPE)range: < 1.20.6.1-150000.1.8.1
- (no CPE)range: < 1.20.6.1-150000.1.8.1
- (no CPE)range: < 1.19.11-150000.1.37.1
- (no CPE)range: < 1.19.11-150000.1.37.1
- (no CPE)range: < 1.19.11-150000.1.37.1
- (no CPE)range: < 1.19.13.1-150000.1.8.1
- (no CPE)range: < 1.19.13.1-150000.1.8.1
- (no CPE)range: < 1.20.6-150000.1.17.1
- (no CPE)range: < 1.20.6-150000.1.17.1
- (no CPE)range: < 1.20.6-150000.1.17.1
- (no CPE)range: < 1.20.6.1-150000.1.8.1
- (no CPE)range: < 1.20.6.1-150000.1.8.1
Go standard library/net/httpv5
Range: 0

Patches

Vulnerability mechanics

References

go.dev/cl/506996mitre
go.dev/issue/60374mitre
groups.google.com/g/golang-announce/c/2q13H6LEEx0mitre
pkg.go.dev/vuln/GO-2023-1878mitre
security.gentoo.org/glsa/202311-09mitre
security.netapp.com/advisory/ntap-20230814-0002/mitre

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000