CVE-2023-29406: Insufficient sanitization of Host header in net/http
Summary
CVE-2023-29406: Insufficient sanitization of Host header in net/http. Affects stdlib across 2 version ranges.
< 1.19.11
>= 1.20.0-0, < 1.20.6
Fixed in 1.19.11 or 1.20.6, depending on the release line you run. How to fix ↓
Also tracked for
- golang · Bitnami
- golang-1.15 · Debian:11
The same CVE-2023-29406 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The stdlib package in Go is a collection of standard libraries that provide essential functionality for Go programs. The net/http package within stdlib is responsible for handling HTTP requests and responses. It includes a client implementation for making HTTP requests. This vulnerability affects the HTTP/1 client in net/http.
Vulnerability Detail
The HTTP/1 client in net/http does not properly validate the contents of the Host header. This allows an attacker to craft a malicious Host header that can inject additional headers or even entire requests. This can lead to various security issues, such as request smuggling or injection attacks. The vulnerability can be exploited by sending a specially crafted HTTP request to a vulnerable application that uses the affected net/http package.
How To Fix
Latest published version: go1.25.5 as of 22 Oct 2026
go get stdlib@vgo1.25.5Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.19.111.19.11go get stdlib@v1.19.11 -
>= 1.20.0-0, < 1.20.61.20.6go get stdlib@v1.20.6
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to update the affected package to a fixed version as soon as possible.
Conclusion
The HTTP/1 client in the net/http package of the Go stdlib is vulnerable to an insufficient sanitization of the Host header. This can allow an attacker to inject additional headers or entire requests. To mitigate this vulnerability, it is recommended to update the affected package to a fixed version. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for stdlib →
FAQ
This vulnerability allows an attacker to inject additional headers or entire requests, potentially leading to request smuggling or injection attacks.
Versions 0.0.0 to 1.19.10 and versions 1.20.0-0 to 1.20.5 of the Go stdlib package are affected.
There are no known public exploits for this vulnerability at the time of this report.
Yes, updating the affected package to version 1.19.11 or later, or version 1.20.6 or later, will fix this vulnerability.
You can find more information about this vulnerability in the Go vulnerability database at https://pkg.go.dev/vuln/GO-2023-1878.
References
Related vulnerabilities
Recent vulnerabilities recorded for stdlib.
