CVE-2021-33197

golang: net/http/httputil: ReverseProxy forwards connection headers if first one is empty

Published Aug 2, 2021 CVSS 3.1 · 5.3 Medium EPSS 2.3% KEV · Not listed
Description
In Go before 1.15.13 and 1.16.x before 1.16.5, some configurations of ReverseProxy (from net/http/httputil) result in a situation where an attacker is able to drop arbitrary headers.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2021-19910 In Go before 1.15.13 and 1.16.x before 1.16.5, some configurations of ReverseProxy (from net/http/httputil) result in a situation where an attacker is able to drop arbitrary headers.
History
Type Values Removed Values Added
Metrics epss

{'score': 0.00017}

epss

{'score': 0.00037}