Skip to content
Fencer Vulns
medium 6.5

CVE-2023-29406 json

Insufficient sanitization of Host header in net/http

published 2023-07-11 3 y ago modified 2026-09-08 2 mo ago also BIT-golang-2023-29406 , EUVD-2023-32977 , GO-2023-1878

cvss
6.5
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
1.5%
EPSS 1.5% chance of exploitation in 30 days, percentile 73%
public exploits
0
none known

Summary

The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject additional headers or entire requests. With fix, the HTTP/1 client now refuses to send requests containing an invalid Request.Host or Request.URL.Host value.

Patch / fix

  • bitnami golang 1.19.11, 1.20.6
  • go stdlib 1.19.11, 1.20.6
  • Go standard library net/http 1.19.11, 1.20.6
  • golang-1.17 Ubuntu 22.04 LTS 1.17.13-3ubuntu1.2
  • golang-1.18 Ubuntu 20.04 LTS 1.18.1-1ubuntu1~20.04.3
  • golang-1.18 Ubuntu 22.04 LTS 1.18.1-1ubuntu1.2
  • golang-1.18 Ubuntu Pro 16.04 LTS 1.18.1-1ubuntu1~16.04.6+esm1
  • golang-1.18 Ubuntu Pro 18.04 LTS 1.18.1-1ubuntu1~18.04.4+esm1

ubuntu advisories UBUNTU-CVE-2023-29406

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • git-lfs RHEL 9 3.4.1-1.el9
  • git-lfs RHEL 8 3.4.1-1.el8
  • delve RHEL 8 1.9.1-1.module+el8.8.0+16778+5fbb74f5
  • golang RHEL 8 1.19.13-1.module+el8.8.0+20373+d9cd605c
  • go-toolset RHEL 8 1.19.13-1.module+el8.8.0+20380+7171fefb
  • golang-bin RHEL 8 1.19.13-1.module+el8.8.0+20373+d9cd605c
  • golang-src RHEL 8 1.19.13-1.module+el8.8.0+20373+d9cd605c
  • golang-misc RHEL 8 1.19.13-1.module+el8.8.0+20373+d9cd605c

red hat advisories RHBA-2024:2274RHBA-2024:3053RHSA-2023:5721RHSA-2023:7202RHSA-2023:6938RHSA-2023:6939

  • etcd openSUSE Leap 15.6, openSUSE Leap 15.5 3.5.12-150000.7.6.1
  • go1.19-openssl SLE Module for Development Tools 15 SP5, SLE Module for Development Tools 15 SP4, openSUSE Leap 15.5 +1 more 1.19.13.1-150000.1.8.1
  • go1.20-openssl SLE Module for Development Tools 15 SP5, SLE Module for Development Tools 15 SP4, openSUSE Leap 15.5 +1 more 1.20.6.1-150000.1.8.1
  • go1.20 SLE Real Time 15 SP3, SLE Module for Development Tools 15 SP5, SLE Module for Development Tools 15 SP4 +2 more 1.20.6-150000.1.17.1
  • go1.19 SLE Real Time 15 SP3, SLE Module for Development Tools 15 SP5, SLE Module for Development Tools 15 SP4 +2 more 1.19.11-150000.1.37.1

suse advisories SUSE-SU-2024:3656-1SUSE-SU-2023:3841-1SUSE-SU-2023:3002-1SUSE-SU-2023:2846-1SUSE-SU-2023:2845-1

  • go1.19 openSUSE Tumbleweed 1.19.11-1.1
  • go1.20 openSUSE Tumbleweed 1.20.6-1.1

opensuse advisories openSUSE-SU-2024:13046-1openSUSE-SU-2024:13074-1

  • crit AlmaLinux 8 3.15-3.module_el8.6.0+3137+d33c3efb
  • crit AlmaLinux 8 3.15-3.module_el8.6.0+2877+8e437bf5
  • criu AlmaLinux 8 3.15-3.module_el8.6.0+2877+8e437bf5
  • criu AlmaLinux 8 3.15-3.module_el8.6.0+3137+d33c3efb
  • crun AlmaLinux 8 1.8.3-1.module_el8.9.0+3627+db8ec155
  • runc AlmaLinux 8 1:1.1.5-2.module_el8.9.0+3627+db8ec155
  • udica AlmaLinux 8 0.2.6-4.module_el8.9.0+3627+db8ec155
  • conmon AlmaLinux 8 2:2.1.4-2.module_el8.9.0+3627+db8ec155

almalinux advisories ALSA-2023:6938ALSA-2023:6939ALSA-2023:7202ALSA-2023:6346ALSA-2023:6363ALSA-2023:6402

  • criu Rocky Linux 8 3.15-3.module+el8.9.0+1445+07728297
  • crun Rocky Linux 8 1.8.3-1.module+el8.9.0+1445+07728297
  • runc Rocky Linux 8 1:1.1.5-2.module+el8.9.0+1445+07728297
  • udica Rocky Linux 8 0.2.6-4.module+el8.9.0+1445+07728297
  • conmon Rocky Linux 8 2:2.1.4-2.module+el8.9.0+1445+07728297
  • podman Rocky Linux 8 2:4.0.2-24.module+el8.9.0+1445+07728297
  • buildah Rocky Linux 8 1:1.24.6-7.module+el8.9.0+1445+07728297
  • libslirp Rocky Linux 8 4.4.0-1.module+el8.9.0+1445+07728297

rocky linux advisories RLSA-2023:6938RLSA-2023:6939RLSA-2023:7202

  • go Alpine 3.18 1.20.7-r0
  • go Alpine 3.24, Alpine 3.23, Alpine 3.22 +3 more 1.20.6-r0

alpine advisories ALPINE-CVE-2023-29406

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • golang CBL-Mariner 2.0, Azure Linux 3.0 1.20.7-1
  • msft-golang CBL-Mariner 2.0 1.20.7-1
  • golang CBL-Mariner 2.0 1.21.6-1

azure linux advisories AZL-27410AZL-28831AZL-37418AZL-37420AZL-52711

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2023-29406 updated cvss 6.5

golang: net/http: insufficient sanitization of Host header

  • Red Hat Migration Toolkit for Virtualization migration-toolkit-virtualization/mtv-rhv-populator-rhel8 Red Hat Node Maintenance Operator workload-availability/node-maintenance-rhel8-operator Red Hat OpenShift Developer Tools and Services helm, ocp-tools-4/jenkins-rhel8 Red Hat OpenShift Pipelines openshift-pipelines-client Red Hat OpenShift Service Mesh 2 openshift-golang-builder-container Red Hat 3scale API Management Platform 2 3scale-amp26/3scale-operator
    +5 more products
    Red Hat Advanced Cluster Management for Kubernetes 2 rhacm2/prometheus-rhel9 Red Hat Advanced Cluster Security 3 advanced-cluster-security/rhacs-main-rhel8 Red Hat Ansible Automation Platform 2 receptor Red Hat Application Interconnect 1.0 skupper-cli Red Hat build of Apicurio Registry 2 openshift-service-mesh/istio-rhel9-operator
    affected: no fix available
  • Red Hat Ceph Storage 3 golang, golang-bin, golang-src
    affected: no fix planned “Will not fix”
  • Red Hat Ceph Storage 5 rhceph/rhceph-5-dashboard-rhel8
    affected: no fix available
  • Red Hat Enterprise Linux 8 osbuild-composer, osbuild-composer-core, osbuild-composer-worker, osbuild-composer-dnf-json Red Hat Enterprise Linux 9 butane, ignition, ignition-edge, ignition-grub, osbuild-composer, ignition-validate, +3 more Red Hat OpenShift Data Science (RHODS) rhods/odh-mm-rest-proxy-rhel8
    affected: no fix planned “Will not fix”
  • Red Hat OpenShift Dev Spaces devspaces/udi-rhel8 Red Hat OpenShift distributed tracing 2 rhosdt/jaeger-agent-rhel8 Red Hat OpenShift GitOps openshift-gitops-kam Red Hat OpenShift on AWS rosa Red Hat OpenShift Virtualization 4 kubevirt, openshift-golang-builder-container
    affected: no fix available
  • Red Hat OpenStack Platform 16.2 collectd-libpod-stats
    affected: no fix planned “Will not fix”
  • Red Hat OpenStack Platform 17.0 collectd-libpod-stats, golang-github-infrawatch-apputils
    affected: no fix planned “Out of support scope”
  • Red Hat OpenStack Platform 17.1 collectd-libpod-stats
    affected: no fix planned “Will not fix”
show 16 more
  • Red Hat OpenStack Platform 18.0 collectd-libpod-stats, rhoso-operators/rabbitmq-cluster-rhel9-operator
    affected: no fix available, no fix planned “Will not fix”
  • Red Hat Storage 3 golang, golang-bin, golang-src, golang-misc, golang-tests, go-toolset-7-golang
    affected: no fix planned “Will not fix”
  • Red Hat Web Terminal web-terminal/web-terminal-rhel9-operator
    affected: no fix available “Fix deferred”
  • Red Hat Self Node Remediation Operator workload-availability/self-node-remediation-rhel8-operator
    affected: no fix available
  • Red Hat Cryostat 2 on RHEL 8 cryostat-tech-preview/cryostat-rhel8-operator 2.3.1-11
    fixed: vendor fix RHSA-2023:6031
  • Red Hat MTA 6.2 for RHEL 8 mta/mta-ui-rhel9 6.2.2-2, mta/mta-hub-rhel9 6.2.2-2, mta/mta-rhel8-operator 6.2.2-3, mta/mta-operator-bundle 6.2.2-5, mta/mta-pathfinder-rhel9 6.2.2-2, mta/mta-windup-addon-rhel9 6.2.2-3
    fixed: vendor fix RHSA-2024:1027
  • Red Hat NETOBSERV 1.4 for RHEL 9 network-observability/network-observability-rhel9-operator v1.4.0-51
    fixed: vendor fix RHSA-2023:5974
  • Red Hat OpenShift API for Data Protection 1.1 oadp/oadp-velero-rhel8 1.1.7-6
    fixed: vendor fix RHSA-2023:6115
  • Red Hat OSSO 1.1 for RHEL 8 openshift-secondary-scheduler-operator/secondary-scheduler-operator-rhel8 v1.1-37
    fixed: vendor fix RHSA-2023:5933
  • Red Hat Enterprise Linux AppStream (v. 8) git-lfs 3.4.1-1.el8, crit 3.15-3.module+el8.9.0+19243+df4d9ff2, crit 3.15-3.module+el8.9.0+20325+b2853e6e, crit 3.18-4.module+el8.9.0+19090+d2921118, criu 3.15-3.module+el8.9.0+19243+df4d9ff2, criu 3.15-3.module+el8.9.0+20325+b2853e6e, +102 more
    fixed: vendor fix RHBA-2024:3053
  • Red Hat Enterprise Linux AppStream (v. 9) podman 4.6.1-5.el9, git-lfs 3.4.1-1.el9, skopeo 1.13.3-1.el9, buildah 1.31.3-1.el9, golang 1.19.13-1.el9_2, podman-tests 4.6.1-5.el9, +14 more
    fixed: vendor fix RHSA-2023:5738
  • Red Hat Migration Toolkit 1.7 rhmtc/openshift-velero-plugin-rhel8 v1.7.14-3
    fixed: vendor fix RHSA-2023:6161
  • Red Hat OpenShift Container Platform 4.14 openshift 4.14.0-202401121302.p0.ge36e183.assembly.stream.el8, openshift 4.14.0-202401121302.p0.ge36e183.assembly.stream.el9, openshift-clients 4.14.0-202311031050.p0.g9b1e0d2.assembly.stream.el8, openshift-clients 4.14.0-202311031050.p0.g9b1e0d2.assembly.stream.el9, openshift-hyperkube 4.14.0-202401121302.p0.ge36e183.assembly.stream.el8, openshift-hyperkube 4.14.0-202401121302.p0.ge36e183.assembly.stream.el9, +2 more
    fixed: vendor fix RHSA-2024:0293
  • Red Hat OpenShift Serverless 1.0 openshift-serverless-clients 1.9.2-4.el8
    fixed: vendor fix RHSA-2023:6298
  • Red Hat OpenShift Serverless 1.30 openshift-serverless-1/client-kn-rhel8 1.9.2-4, openshift-serverless-1/func-utils-rhel8 1.30.2-2, openshift-serverless-1/serving-queue-rhel8 1.9.0-4, openshift-serverless-1/eventing-mtping-rhel8 1.9.0-4, openshift-serverless-1/kourier-control-rhel8 1.9.0-5, openshift-serverless-1/serving-webhook-rhel8 1.9.0-4, +34 more
    fixed: vendor fix RHSA-2023:6296
  • Red Hat OpenStack Platform 16.2 etcd 3.3.23-15.el8ost, rhosp-rhel8/osp-director-agent 1.3.0-10, rhosp-rhel8/osp-director-operator 1.3.0-9, rhosp-rhel8/osp-director-downloader 1.3.0-11, rhosp-rhel8/osp-director-operator-bundle 1.3.0-19
    fixed: vendor fix RHSA-2023:5965

7 more fixed, 22 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

cisa ICSA-24-046-11 updated cvss 6.5

Siemens SCALANCE XCM-/XRM-300

  • Siemens SCALANCE XCH328 (6GK5328-4TS01-2EC2) <V2.4 Siemens SCALANCE XCM324 (6GK5324-8TS01-2AC2) <V2.4 Siemens SCALANCE XCM328 (6GK5328-4TS01-2AC2) <V2.4 Siemens SCALANCE XCM332 (6GK5332-0GA01-2AC2) <V2.4 Siemens SCALANCE XRH334 (24 V DC, 8xFO, CC) (6GK5334-2TS01-2ER3) <V2.4 Siemens SCALANCE XRM334 (2x230 V AC, 8xFO) (6GK5334-2TS01-4AR3) <V2.4
    +5 more products
    Siemens SCALANCE XRM334 (2x230 V AC, 12xFO) (6GK5334-3TS01-4AR3) <V2.4 Siemens SCALANCE XRM334 (24 V DC, 8xFO) (6GK5334-2TS01-2AR3) <V2.4 Siemens SCALANCE XRM334 (24 V DC, 12xFO) (6GK5334-3TS01-2AR3) <V2.4 Siemens SCALANCE XRM334 (230 V AC, 8xFO) (6GK5334-2TS01-3AR3) <V2.4 Siemens SCALANCE XRM334 (230 V AC, 12xFO) (6GK5334-3TS01-3AR3) <V2.4
    affected: fixed in V2.4 support.industry.siemens.com

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
2 y ago

Exploit prediction

1.45% chance of exploitation in the next 30 days, higher than 73% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
OSV 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Affected packages

ecosystem package affected fixed in
bitnami golang
<1.19.11
>=1.20.0, <1.20.6
1.19.11
1.20.6
go stdlib
<1.19.11
>=1.20.0-0, <1.20.6
1.19.11
1.20.6

Affected products

  • Go standard library net/http

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.