Github.Com/Go Resty/Resty/V2

Submit a proposal Propose CVE/GCVE/GHSA reference

Approved changes feed: RSS · Atom

cpe:2.3:a:github.com/go-resty/resty/v2:github.com/go-resty/resty/v2:*:*:*:*:*:*:*:*

part: a version: * update: *

VendorGithub.Com/Go Resty/Resty/V2 (a6b5ee24-97c7-597d-8e1e-4bc76924604d)
ProductGithub.Com/Go Resty/Resty/V2 (39532b6f-e4ba-5a12-9bf9-ad881871dd27)
Edition*
Language*
Software edition*
Target software*
Target hardware*
Other*

Notes

Imported from gcve-enriched-dumps CVE data

PURL mappings

PURLSourceLast updated
No PURL mappings for this CPE yet.

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2023-45286 vulnerable 2026-06-08 06:12:42.449668 HTTP request body disclosure in github.com/go-resty/resty/v2
A race condition in go-resty can result in HTTP request body disclosure across requests. This condition can be triggered by calling sync.Pool.Put with the same *bytes.Buffer more than once, when request retries are enabled and a retry occurs. The call to sync.Pool.Get will then return a bytes.Buffer that hasn't had bytes.Buffer.Reset called on it. This dirty buffer will contain the HTTP request body from an unrelated request, and go-resty will append the current HTTP request body to it, sending two bodies in one request. The sync.Pool in question is defined at package level scope, so a completely unrelated server could receive the request body.
Published: 2023-11-28T16:31:21.078Z
Updated: 2024-08-28T20:01:23.626Z
Reference links
Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

Inspect record JSON

Open JSON directly

Open this panel to browse, search, copy or download the JSON record.