Critical severity9.8OSV Advisory· Published Aug 25, 2024· Updated Apr 15, 2026

CVE-2024-45258

Description

The req package before 3.43.4 for Go may send an unintended request when a malformed URL is provided, because cleanHost in http.go intentionally uses a "garbage in, garbage out" design.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
github.com/imroc/req/v3Go	< 3.43.4	3.43.4
github.com/imroc/reqGo	< 3.43.4	3.43.4
github.com/imroc/req/v2Go	< 3.43.4	3.43.4

Affected products

Imroc/ReqOSV
Range: v0.1.0, v0.1.1, v0.1.3, …
ghsa-coords3 versions
pkg:golang/github.com/imroc/req pkg:golang/github.com/imroc/req/v2 pkg:golang/github.com/imroc/req/v3
< 3.43.4+ 2 more
- (no CPE)range: < 3.43.4
- (no CPE)range: < 3.43.4
- (no CPE)range: < 3.43.4

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-cj55-gc7m-wvcqghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2024-45258ghsaADVISORY
github.com/imroc/req/commit/04e3ece5b380ecad9da3551c449f1b8a9aa76d3dnvdWEB
github.com/imroc/req/compare/v3.43.3...v3.43.4nvdWEB
pkg.go.dev/vuln/GO-2024-3098ghsaWEB

News mentions

No linked articles in our index yet.

cvss	0.637
epss	0.001
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000