Skip to content
Fencer Vulns
medium 5.9

CVE-2023-45286 json

HTTP request body disclosure in github.com/go-resty/resty/v2

published 2023-11-27 2 y ago modified 2026-09-10 1 mo ago also GHSA-xwh9-gc39-5298 , GO-2023-2328 , EUVD-2023-3068

cvss
5.9
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.7%
EPSS 0.7% chance of exploitation in 30 days, percentile 54%
public exploits
0
none known

Summary

A race condition in go-resty can result in HTTP request body disclosure across requests. This condition can be triggered by calling sync.Pool.Put with the same *bytes.Buffer more than once, when request retries are enabled and a retry occurs. The call to sync.Pool.Get will then return a bytes.Buffer that hasn't had bytes.Buffer.Reset called on it. This dirty buffer will contain the HTTP request body from an unrelated request, and go-resty will append the current HTTP request body to it, sending two bodies in one request. The sync.Pool in question is defined at package level scope, so a completely unrelated server could receive the request body.

Patch / fix

  • go github.com/go-resty/resty/v2 2.11.0
  • github.com/go-resty/resty/v2 github.com/go-resty/resty/v2 2.11.0
  • golang-github-go-resty-resty Debian 14, Debian 13 2.10.0-2

debian advisories DEBIAN-CVE-2023-45286

  • rclone openSUSE Tumbleweed 1.65.1-1.1

opensuse advisories openSUSE-SU-2024:13569-1

  • packer CBL-Mariner 2.0 1.8.7-1

azure linux advisories AZL-32050

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2023-45286 updated cvss 4.7

go-resty: HTTP request body disclosure in github.com/go-resty/resty/v2

  • Red Hat Migration Toolkit for Applications 6 mta/mta-hub-rhel8, mta/mta-windup-addon-rhel8
    affected: no fix planned “Will not fix”
  • Red Hat OpenShift distributed tracing 2 rhosdt/tempo-gateway-rhel8, rhosdt/opentelemetry-rhel8-operator
    affected: no fix available
  • Red Hat MTA 7.0 for RHEL 9 mta/mta-hub-rhel9 7.0.3-10, mta/mta-analyzer-addon-rhel9 7.0.3-13
    fixed: vendor fix RHSA-2024:3316
  • Red Hat OpenShift distributed tracing 3.2 rhosdt/tempo-rhel8 2.4.2-3, rhosdt/tempo-query-rhel8 0.10.0-8, rhosdt/jaeger-agent-rhel8 1.57.0-5, rhosdt/jaeger-query-rhel8 1.57.0-5, rhosdt/tempo-gateway-rhel8 1.0.0-8, rhosdt/tempo-rhel8-operator 0.10.0-6, +13 more
    fixed: vendor fix RHSA-2024:3621
  • Red Hat MTA 7.0 for RHEL 8 mta/mta-rhel8-operator 7.0.3-7 Red Hat MTA 7.0 for RHEL 9 mta/mta-ui-rhel9 7.0.3-13, mta/mta-cli-rhel9 7.0.3-16, mta/mta-operator-bundle 7.0.3-25, mta/mta-windup-shim-rhel9 7.0.3-12, mta/mta-analyzer-lsp-rhel9 7.0.3-13 Red Hat Ceph Storage 5 rhceph/rhceph-5-dashboard-rhel8 Red Hat OpenShift Container Platform 4 openshift4/ose-prometheus, openshift4/ose-prom-label-proxy Red Hat OpenShift Dev Spaces devspaces/traefik-rhel8
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
2 y ago

Exploit prediction

0.72% chance of exploitation in the next 30 days, higher than 54% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/go-resty/resty/issues/739 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 3.1 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
GitHub 3.1 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected packages

ecosystem package affected fixed in
go github.com/go-resty/resty/v2
>=2.10.0, <2.11.0
2.11.0

Affected products

  • github.com/go-resty/resty/v2 github.com/go-resty/resty/v2

Classification

Weakness
  • CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization
  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.