Authorization Bypass Through User-Controlled Key in go-restful

CRITICAL 9.1CVE-2022-1996 · GHSA-r48q-9g5r-8q2h · GO-2022-0619 · Published 08/06/2022 · updated 17/06/2026

In short

CVE-2022-1996 is a CRITICAL (CVSS 9.1) vulnerability affecting github.com/emicklei/go-restful, github.com/emicklei/go-restful/v2, github.com/emicklei/go-restful/v3.
Chance of exploitation in the next 30 days (EPSS): 3.1%, higher than 87.9% of all vulnerabilities.
Fix: update to 2.16.0, 2.16.0+incompatible, 3.8.0 or later.

Package	Affected versions	Patched versions
github.com/emicklei/go-restful Go	`< 2.16.0< 2.16.0+incompatible`	`2.16.02.16.0+incompatible`
github.com/emicklei/go-restful/v2 Go	`≥ 2.7.1≤ 2.7.1`	No fix yet
github.com/emicklei/go-restful/v3 Go	`≥ 3.0.0, < 3.8.0`	`3.8.0`
go-restful go-restful_project	`≥ 3.0.0, < 3.8.0< 2.16.0`	`3.8.02.16.0`

Authorization Bypass Through User-Controlled Key in GitHub repository emicklei/go-restful prior to v3.8.0.

NVD description

Authorization Bypass Through User-Controlled Key in GitHub repository emicklei/go-restful prior to v3.8.0.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.