| Package | Affected versions | Patched versions |
|---|---|---|
| stdlib | ≥ 1.18.0-0, < 1.18.4< 1.17.12 | 1.18.41.17.12 |
| go | ≥ 1.18.0, < 1.18.4< 1.17.12 | 1.18.41.17.12 |
Client IP adresses may be unintentionally exposed via X-Forwarded-For headers.
When httputil.ReverseProxy.ServeHTTP is called with a Request.Header map containing a nil value for the X-Forwarded-For header, ReverseProxy sets the client IP as the value of the X-Forwarded-For header, contrary to its documentation.
In the more usual case where a Director function sets the X-Forwarded-For header value to nil, ReverseProxy leaves the header unmodified as expected.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free