CVE-2023-29406
MediumSummary
The Go HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject additional headers or entire requests. The fix prevents sending requests with invalid Request.Host or Request.URL.Host values.
Risk Assessment
The risk involves potential request smuggling or header injection attacks, which could compromise communication integrity, enable session hijacking, or bypass security controls.
Recommendation
Immediately update the Go library to a patched version (e.g., 1.20.6 or 1.19.11) and recompile all applications using the HTTP/1 client.
Original NVD description (English source)
The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject additional headers or entire requests. With fix, the HTTP/1 client now refuses to send requests containing an invalid Request.Host or Request.URL.Host value.