CVE-2021-33197

golang: net/http/httputil: ReverseProxy forwards connection headers if first one is empty

Published Aug 2, 2021 CVSS 3.1 · 5.3 Medium EPSS 2.3% KEV · Not listed
Description
In Go before 1.15.13 and 1.16.x before 1.16.5, some configurations of ReverseProxy (from net/http/httputil) result in a situation where an attacker is able to drop arbitrary headers.

Analysis

No analysis available yet

Remediation

No remediation available yet

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2021-19910 In Go before 1.15.13 and 1.16.x before 1.16.5, some configurations of ReverseProxy (from net/http/httputil) result in a situation where an attacker is able to drop arbitrary headers.
History
Type Values Removed Values Added
Metrics epss

{'score': 0.00017}

epss

{'score': 0.00037}

Weaknesses

Sources

Status
PUBLISHED
Assigner
mitre
Published
Updated
Aug 3, 2024, 11:42 PM
Reserved
May 19, 2021, 12:00 AM
Status
Modified
Published
Aug 2, 2021, 7:15 PM
Modified
Jun 17, 2026, 3:54 AM
Severity
Moderate
Public date
May 21, 2021, 12:00 AM