net/url in Go before 1.11.13 and 1.12.x before 1.12.8 mishandles malformed hosts in URLs, leading to an authorization bypass in some applications. This is related to a Host field with a suffix appearing in neither Hostname() nor Port(), and is related to a non-numeric port number. For example, an attacker can compose a crafted javascript:// URL that results in a hostname of google.com.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade go | Nov 8, 2019 | Aug 13, 2019 |
| Amazon Linux Ami 2 | — | Upgrade golang-docsUpgrade golang-binUpgrade golang-testsUpgrade golangUpgrade golang-srcUpgrade golang-misc | Apr 27, 2020 | Aug 13, 2019 |
| Amazon_linux | — | Upgrade golang | Oct 4, 2019 | Aug 13, 2019 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Aug 13, 2019 |
| Centos_linux | — | Upgrade golang-binUpgrade go-toolsetUpgrade golang-docsUpgrade golang-srcUpgrade golangUpgrade golang-testsUpgrade golang-raceUpgrade golang-misc | Nov 6, 2019 | Aug 13, 2019 |
| Debian | — | Upgrade golang-1.11 | Oct 23, 2019 | Aug 13, 2019 |
| Huawei Euleros 2_0_sp3 | — | Upgrade golang-srcUpgrade golang-binUpgrade golang | Apr 30, 2021 | Aug 13, 2019 |
| Huawei Euleros 2_0_sp5 | — | Upgrade golang-srcUpgrade golangUpgrade golang-bin | Sep 12, 2019 | Aug 13, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade golang-srcUpgrade golangUpgrade golang-bin | Sep 30, 2019 | Aug 13, 2019 |
| Oracle Solaris | — | Upgrade developer/gcc-9 to version 9.2.0-11.4.21.0.1.69.0 on Solaris 11.4Upgrade developer/gcc to version 9.2.0-11.4.21.0.1.69.0 on Solaris 11.4Upgrade developer/gcc/gcc-go to version 9.2.0-11.4.21.0.1.69.0 on Solaris 11.4Upgrade system/library/gcc/gcc-go-runtime to version 9.2.0-11.4.21.0.1.69.0 on Solaris 11.4Upgrade system/library/gcc/gcc-gobjc-runtime-9 to version 9.2.0-11.4.21.0.1.69.0 on Solaris 11.4Upgrade system/library/gcc/gcc-c-runtime to version 9.2.0-11.4.21.0.1.69.0 on Solaris 11.4Upgrade system/library/gcc/gcc-go-runtime-9 to version 9.2.0-11.4.21.0.1.69.0 on Solaris 11.4Upgrade developer/gcc/gcc-go-9 to version 9.2.0-11.4.21.0.1.69.0 on Solaris 11.4Upgrade system/library/gcc/gcc-runtime-9 to version 9.2.0-11.4.21.0.1.69.0 on Solaris 11.4Upgrade developer/gcc/gcc-common-9 to version 9.2.0-11.4.21.0.1.69.0 on Solaris 11.4Upgrade developer/gcc/gcc-c-9 to version 9.2.0-11.4.21.0.1.69.0 on Solaris 11.4Upgrade system/library/gcc/gcc-gfortran-runtime-9 to version 9.2.0-11.4.21.0.1.69.0 on Solaris 11.4Upgrade developer/gcc/gcc-gobjc-9 to version 9.2.0-11.4.21.0.1.69.0 on Solaris 11.4Upgrade system/library/gcc/gcc-runtime to version 9.2.0-11.4.21.0.1.69.0 on Solaris 11.4Upgrade system/library/gcc/gcc-gfortran-runtime to version 9.2.0-11.4.21.0.1.69.0 on Solaris 11.4Upgrade developer/gcc/gcc-gobjc to version 9.2.0-11.4.21.0.1.69.0 on Solaris 11.4Upgrade system/library/gcc/gcc-c-runtime-9 to version 9.2.0-11.4.21.0.1.69.0 on Solaris 11.4Upgrade developer/gcc/gcc-gfortran-9 to version 9.2.0-11.4.21.0.1.69.0 on Solaris 11.4Upgrade developer/gcc/gcc-c++ to version 9.2.0-11.4.21.0.1.69.0 on Solaris 11.4Upgrade developer/gcc/gcc-gfortran to version 9.2.0-11.4.21.0.1.69.0 on Solaris 11.4Upgrade system/library/gcc/gcc-gobjc-runtime to version 9.2.0-11.4.21.0.1.69.0 on Solaris 11.4 | Jan 19, 2021 | Aug 13, 2019 |
| Oracle_linux | — | Upgrade golang-miscUpgrade golang-srcUpgrade golang-raceUpgrade golangUpgrade golang-binUpgrade go-toolsetUpgrade golang-docsUpgrade golang-tests | Jul 22, 2024 | Aug 13, 2019 |
| Redhat_linux | — | Upgrade go-toolsetUpgrade golang-srcUpgrade golang-testsUpgrade golang-docsUpgrade golang-binNo solution existsUpgrade golangUpgrade golang-miscUpgrade golang-race | Nov 6, 2019 | Aug 13, 2019 |
| Suse | — | Upgrade go1.11Upgrade go1.12-docUpgrade go1.11-raceUpgrade go1.11-docUpgrade go1.12Upgrade go1.12-race | Aug 27, 2019 | Aug 13, 2019 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Aug 13, 2019 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Aug 13, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub