CVE-2022-2880

{
  "id": "CVE-2022-2880",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security@golang.org",
      "affectedData": [
        {
          "vendor": "Go standard library",
          "product": "net/http/httputil",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "1.18.7",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "1.19.0-0",
              "lessThan": "1.19.2",
              "versionType": "semver"
            }
          ],
          "packageName": "net/http/httputil",
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "programRoutines": [
            {
              "name": "ReverseProxy.ServeHTTP"
            }
          ]
        }
      ]
    }
  ],
  "published": "2022-10-14T15:15:18.090",
  "references": [
    {
      "url": "https://go.dev/cl/432976",
      "tags": [
        "Patch"
      ],
      "source": "security@golang.org"
    },
    {
      "url": "https://go.dev/issue/54663",
      "tags": [
        "Exploit",
        "Issue Tracking",
        "Third Party Advisory"
      ],
      "source": "security@golang.org"
    },
    {
      "url": "https://groups.google.com/g/golang-announce/c/xtuG5faxtaU",
      "tags": [
        "Mailing List",
        "Release Notes"
      ],
      "source": "security@golang.org"
    },
    {
      "url": "https://pkg.go.dev/vuln/GO-2022-1038",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security@golang.org"
    },
    {
      "url": "https://security.gentoo.org/glsa/202311-09",
      "source": "security@golang.org"
    },
    {
      "url": "https://go.dev/cl/432976",
      "tags": [
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://go.dev/issue/54663",
      "tags": [
        "Exploit",
        "Issue Tracking",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://groups.google.com/g/golang-announce/c/xtuG5faxtaU",
      "tags": [
        "Mailing List",
        "Release Notes"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://pkg.go.dev/vuln/GO-2022-1038",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://security.gentoo.org/glsa/202311-09",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-444"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Requests forwarded by ReverseProxy include the raw query parameters from the inbound request, including unparsable parameters rejected by net/http. This could permit query parameter smuggling when a Go proxy forwards a parameter with an unparsable value. After fix, ReverseProxy sanitizes the query parameters in the forwarded query when the outbound request's Form field is set after the ReverseProxy. Director function returns, indicating that the proxy has parsed the query parameters. Proxies which do not parse query parameters continue to forward the original query parameters unchanged."
    },
    {
      "lang": "es",
      "value": "Las peticiones reenviadas por ReverseProxy incluyen los parámetros de consulta sin procesar de la petición entrante, incluyendo parámetros no analizables rechazados por net/http. Esto podría permitir el contrabando de parámetros de consulta cuando un proxy Go reenvía un parámetro con un valor no analizable. Después de la corrección, ReverseProxy sanea los parámetros de consulta en la consulta reenviada cuando el campo Form de la petición saliente es establecido después de que la función ReverseProxy. La función Director regresa, indicando que el proxy ha analizado los parámetros de la consulta. Los proxies que no analizan los parámetros de consulta continúan reenviando los parámetros de consulta originales sin cambios"
    }
  ],
  "lastModified": "2026-06-17T04:42:45.547",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9CB667C1-EC12-4400-B4F0-6D3B7DDAAD99",
              "versionEndExcluding": "1.18.7"
            },
            {
              "criteria": "cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7614AA04-CA34-4ED8-B580-005EA84BD5B4",
              "versionEndExcluding": "1.19.2",
              "versionStartIncluding": "1.19.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@golang.org"
}