CVE-2024-45258

Published: Aug 25, 2024Modified: Jun 17, 2026Deferred

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

The req package before 3.43.4 for Go may send an unintended request when a malformed URL is provided, because cleanHost in http.go intentionally uses a "garbage in, garbage out" design.

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (2)

https://github.com/imroc/req/commit/04e3ece5b380ecad9da3551c449f1b8a9aa76d3d

Source: cve@mitre.org

https://github.com/imroc/req/compare/v3.43.3...v3.43.4

Source: cve@mitre.org

Timeline

No history available yet.