GCVE - cpe:2.3:a:go_standard_library:net/http:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:go_standard_library:net/http:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Go Standard Library (`50bc78d3-15d0-59a4-bc22-a964570e0614`)
Product	Net/Http (`946477f3-4e91-5cd0-a6d0-4366b8769286`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2026-33814`	vulnerable	2026-06-08 07:59:11.260457	Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0. Published: 2026-05-07T19:41:17.631Z Updated: 2026-07-27T12:05:30.478Z Open on db.gcve.eu Reference links https://go.dev/cl/761581 https://go.dev/cl/761640 https://go.dev/issue/78476 https://groups.google.com/g/golang-announce/c/qcCIEXso47M https://pkg.go.dev/vuln/GO-2026-4918	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-58186`	vulnerable	2026-06-08 07:35:17.422307	Lack of limit when parsing cookies can cause memory exhaustion in net/http Despite HTTP headers having a default limit of 1MB, the number of cookies that can be parsed does not have a limit. By sending a lot of very small cookies such as "a=;", an attacker can make an HTTP server allocate a large amount of structs, causing large memory consumption. Published: 2025-10-29T22:10:13.912Z Updated: 2025-11-04T21:13:35.468Z Open on db.gcve.eu Reference links https://go.dev/issue/75672 https://go.dev/cl/709855 https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI https://pkg.go.dev/vuln/GO-2025-4012	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-4673`	vulnerable	2026-06-08 07:29:17.079745	Sensitive headers not cleared on cross-origin redirect in net/http Proxy-Authorization and Proxy-Authenticate headers persisted on cross-origin redirects potentially leaking sensitive information. Published: 2025-06-11T16:42:53.054Z Updated: 2025-06-11T17:59:48.033Z Open on db.gcve.eu Reference links https://go.dev/cl/679257 https://go.dev/issue/73816 https://groups.google.com/g/golang-announce/c/ufZ8WpEsA3A https://pkg.go.dev/vuln/GO-2025-3751	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-47910`	vulnerable	2026-06-08 07:27:15.062960	CrossOriginProtection insecure bypass patterns not limited to exact matches in net/http When using http.CrossOriginProtection, the AddInsecureBypassPattern method can unexpectedly bypass more requests than intended. CrossOriginProtection then skips validation, but forwards the original request path, which may be served by a different handler without the intended security protections. Published: 2025-09-22T21:01:55.440Z Updated: 2025-09-24T13:29:45.405Z Open on db.gcve.eu Reference links https://go.dev/cl/699275 https://go.dev/issue/75054 https://groups.google.com/g/golang-announce/c/PtW9VW21NPs/m/DJhMQ-m5AQAJ https://pkg.go.dev/vuln/GO-2025-3955	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-22870`	vulnerable	2026-06-08 07:10:54.935692	HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component. For example, when the NO_PROXY environment variable is set to "*.example.com", a request to "[::1%25.example.com]:80` will incorrectly match and not be proxied. Published: 2025-03-12T18:27:59.376Z Updated: 2026-04-16T22:39:33.619Z Open on db.gcve.eu Reference links https://go.dev/cl/654697 https://go.dev/issue/71984 https://groups.google.com/g/golang-announce/c/4t3lzH3I0eI/m/b42ImqrBAQAJ https://pkg.go.dev/vuln/GO-2025-3503	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-45336`	vulnerable	2026-06-08 06:48:05.933285	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-24791`	vulnerable	2026-06-08 06:29:41.770956	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-45289`	vulnerable	2026-06-08 06:12:42.458869	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-45288`	vulnerable	2026-06-08 06:12:42.457420	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-39325`	vulnerable	2026-06-08 06:09:37.042287	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-29406`	vulnerable	2026-06-08 06:02:40.124088	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2022-41723`	vulnerable	2026-06-08 05:48:30.862095	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2022-41720`	vulnerable	2026-06-08 05:48:30.853378	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2022-41717`	vulnerable	2026-06-08 05:48:30.847707	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2022-32148`	vulnerable	2026-06-08 05:44:42.603394	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2022-1705`	vulnerable	2026-06-08 05:39:13.766349	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.