CVE-2022-32148: go standard library net/http
Vulnerability summary
CVE-2022-32148 is a medium (CVSS 6.5) vulnerability in go standard library net/http. EPSS estimates a 1.43% chance of exploitation in the next 30 days, higher than 72.7% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 26 · Related 7Timeline
- 09-08-2022PublishedVulnerability first disclosed.
- 06-03-2026Last modifiedVulnerability information updated.
Description
Improper exposure of client IP addresses in net/http before Go 1.17.12 and Go 1.18.4 can be triggered by calling httputil.ReverseProxy.ServeHTTP with a Request.Header map containing a nil value for the X-Forwarded-For header, which causes ReverseProxy to set the client IP as the value of the X-Forwarded-For header.
CVSS metrics
4 scores · 4 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
- OSV · DebianEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
- NVDNIST6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
EPSS trend
Probability
1.43%
Chance of exploitation in the next 30 days
Percentile
73%
Versus all other CVEs
30-day change
+0.08 pp
From 1.35% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (go.dev)
Maturity: unknown
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Ubuntu3 products
- golang-1.13< 1.13.8-1ubuntu1~16.04.3+esm3 | < 1.13.8-1ubuntu1~18.04.4+esm1 | < 1.13.8-1ubuntu1.2 | < 1.13.8-1ubuntu2.22.04.2
- golang-1.16< 1.16.2-0ubuntu1~18.04.2+esm1 | < 1.16.2-0ubuntu1~20.04.1
- golang-1.18< 1.18.1-1ubuntu1~18.04.4 | < 1.18.1-1ubuntu1~20.04.2 | < 1.18.1-1ubuntu1.1
Debian1 product
- golang-1.19< 1.19~rc1-1
Go1 product
- stdlib≥ 1.18.0-0, < 1.18.4
Go standard library1 product
- net/http< 1.17.12 | ≥ 1.18.0-0, < 1.18.4
Golang1 product
- go< 1.17.12 | ≥ 1.18.0, < 1.18.4
5 vendors · 7 products
References
12 links- pkg.go.dev/vuln/GO-2022-0520Vendor Advisory
