Approved changes feed: RSS · Atom
cpe:2.3:a:rezmoss:axios4go:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Rezmoss (d8102e9b-79af-549e-bc7b-61a9c6e32c33) |
|---|---|
| Product | Axios4Go (f6741f94-2480-5c6d-89db-2b6c5872a36b) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/rezmoss/axios4go |
purl2cpe | 2026-07-28 16:40:54.946714 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-21697 |
vulnerable | 2026-06-08 07:49:16.701555 |
axios4go's Race Condition in Shared HTTP Client Allows Proxy Configuration Leak
axios4go is a Go HTTP client library. Prior to version 0.6.4, a race condition vulnerability exists in the shared HTTP client configuration. The global `defaultClient` is mutated during request execution without synchronization, directly modifying the shared `http.Client`'s `Transport`, `Timeout`, and `CheckRedirect` properties. Impacted applications include that that use axios4go with concurrent requests (multiple goroutines, `GetAsync`, `PostAsync`, etc.), those where different requests use different proxy configurations, and those that handle sensitive data (authentication credentials, tokens, API keys). Version 0.6.4 fixes this issue.
Published: 2026-01-07T22:29:57.393Z
Updated: 2026-01-08T20:37:17.978Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.