VulertSecurity VulertSecurity

Vulnerability Database · Go · Package report

github.com/hashicorp/go-retryablehttp: vulnerability history, versions and safety

github.com/hashicorp/go-retryablehttp is a package in the Go ecosystem. Vulert records 2 vulnerabilities for it across 120 releases, first recorded in Jun 2024. Each vulnerability names the versions it affects, the fixed version to move to, and a workaround where no fix has been published.

i
2 vulnerabilities recorded M1 U1
i
0 with no fix published

Every vulnerability has a patched version to move to.

i
0 in the last 12 months

Nothing new recorded in the last year.

See the disclosure history →
i
0 malicious-package vulnerabilities

No published version shipped hostile code.

See all github.com/hashicorp/go-retryablehttp vulnerabilities

Vulert verdict on github.com/hashicorp/go-retryablehttp v0.7.8 i

Updated on 23 Oct 2026

Action needed: v0.7.8 has 2 known vulnerabilities, but every one of them has a fix. Upgrade to the version listed below and you are clear.

Package health score 79/100
  • Security Minor issues
  • Maintenance Maintaining
  • Popularity Key ecosystem project
  • Community Quiet

What to do: Upgrade to the version that resolves each vulnerability below. Fix it, then keep watch: this version is affected today, and the next one may be too — Vulert alerts you when a new vulnerability lands. Monitor it with Vulert →

  • Current release v0.7.8 — affected i
  • Vulnerabilities on record 2 over 1 year · 0 in the last year i
  • Latest disclosure 25 Jun 2024 i
  • Highest CVSS 6.0 i
  • With no published fix 0 i
  • Stars 2,352 i
  • OpenSSF scorecard 4/10 i
  • Last release 16 months ago i
  • Licence MPL-2.0 i

Version list, release dates, licence and dependants published by the Go module proxy, refreshed 22 Oct 2026. Licence information is not legal advice.

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.

01 Versions

Which versions are affected

Every version Vulert tracks for github.com/hashicorp/go-retryablehttp, newest first, with the vulnerabilities recorded against each one. A version showing none has no vulnerability in the Vulert database — open it for the full picture on that release.

i
Version Released Vulert vulnerabilities Licence Fix published Details
v0.7.9-0.20260414052622-fd004584a467 14 Apr 2026 M1 U1 MPL-2.0 Yes Details →
v0.7.9-0.20250818113541-867c4f597d13 18 Aug 2025 M1 U1 MPL-2.0 Yes Details →
v0.7.9-0.20250817221500-393b7aa9bc4b 17 Aug 2025 M1 U1 MPL-2.0 Yes Details →
v0.7.9-0.20250729104535-73a996c63903 29 Jul 2025 M1 U1 MPL-2.0 Yes Details →
v0.7.9-0.20250714123710-4e0b7035fda1 14 Jul 2025 M1 U1 MPL-2.0 Yes Details →
v0.7.9-0.20250707144045-11a110fd7226 07 Jul 2025 M1 U1 MPL-2.0 Yes Details →
v0.7.9-0.20250701181634-278e841b12c2 01 Jul 2025 M1 U1 MPL-2.0 Yes Details →
v0.7.8 18 Jun 2025 M1 U1 MPL-2.0 Yes Details →
v0.7.8-0.20250610113327-b0cac1ef80e9 10 Jun 2025 M1 U1 MPL-2.0 Yes Details →
v0.7.8-0.20250610062321-66c110b37fbd 10 Jun 2025 M1 U1 MPL-2.0 Yes Details →
v0.7.8-0.20250604113215-5d06fe54f973 04 Jun 2025 M1 U1 MPL-2.0 Yes Details →
v0.7.8-0.20250601085952-eeac125589f6 01 Jun 2025 M1 U1 MPL-2.0 Yes Details →
v0.0.0-20250408030537-390c1d807b1d 08 Apr 2025 M1 U1 MPL-2.0 Yes Details →
v0.7.8-0.20250408030537-390c1d807b1d 08 Apr 2025 M1 U1 MPL-2.0 Yes Details →
v0.7.8-0.20250403120222-a881d6ca9dda 03 Apr 2025 M1 U1 MPL-2.0 Yes Details →
v0.7.8-0.20250403094415-9c1b40b160e2 03 Apr 2025 M1 U1 MPL-2.0 Yes Details →
v0.7.8-0.20250325063326-a75949c2221a 25 Mar 2025 M1 U1 MPL-2.0 Yes Details →
v0.7.8-0.20250304103039-4016dddbbffd 04 Mar 2025 M1 U1 MPL-2.0 Yes Details →
v0.7.8-0.20250225070934-cf4213f3797a 25 Feb 2025 M1 U1 MPL-2.0 Yes Details →
v0.7.8-0.20250220110736-57872b08d2c5 20 Feb 2025 M1 U1 MPL-2.0 Yes Details →
v0.7.8-0.20241119170810-9dfd949154e5 19 Nov 2024 M1 U1 MPL-2.0 Yes Details →
v0.7.8-0.20241119112125-9237bc1df962 19 Nov 2024 M1 U1 MPL-2.0 Yes Details →
v0.7.8-0.20241007224037-9e9e5c8e6c47 07 Oct 2024 M1 U1 MPL-2.0 Yes Details →
v0.0.0-20240617132440-40b0cad1633f 17 Jun 2024 M1 U1 MPL-2.0 Yes Details →
v0.7.8-0.20240617132440-40b0cad1633f 17 Jun 2024 M1 U1 MPL-2.0 Yes Details →
v0.7.8-0.20240612224904-9d239f46cf24 12 Jun 2024 M1 U1 MPL-2.0 Yes Details →
v0.7.7 30 May 2024 M1 U1 MPL-2.0 Yes Details →
v0.7.7-0.20240530001300-1542b31176d3 30 May 2024 M1 U1 MPL-2.0 Yes Details →
v0.7.7-0.20240530000855-a99f07beb3c5 30 May 2024 M1 U1 MPL-2.0 Yes Details →
v0.7.7-0.20240517145315-86e852df43aa 17 May 2024 M1 U1 MPL-2.0 Yes Details →
v0.7.7-0.20240516225153-47fe99e6460c 16 May 2024 M1 U1 MPL-2.0 Yes Details →
v0.7.7-0.20240513145228-490fc06be093 13 May 2024 M1 U1 MPL-2.0 Yes Details →
v0.7.6 09 May 2024 M1 U1 MPL-2.0 Yes Details →
v0.7.6-0.20240509170516-d969eaa9c978 09 May 2024 M1 U1 MPL-2.0 Yes Details →
v0.7.6-0.20240509141150-838a5028df86 09 May 2024 M1 U1 MPL-2.0 Yes Details →
v0.7.6-0.20240509135830-003233786801 09 May 2024 M1 U1 MPL-2.0 Yes Details →
v0.7.6-0.20240426070404-edadfe12db0d 26 Apr 2024 M1 U1 MPL-2.0 Yes Details →
v0.0.0-20231201220521-a1a8ab82eb17 01 Dec 2023 M1 U1 MPL-2.0 Yes Details →
v0.7.6-0.20231201220521-a1a8ab82eb17 01 Dec 2023 M1 U1 MPL-2.0 Yes Details →
v0.7.6-0.20231201220413-a004c57d62e1 01 Dec 2023 M1 U1 MPL-2.0 Yes Details →
v0.0.0-20231108214153-4165cf889720 08 Nov 2023 M1 U1 MPL-2.0 Yes Details →
v0.7.5 08 Nov 2023 M1 U1 MPL-2.0 Yes Details →
v0.7.5-0.20231108162351-6c37e0241664 08 Nov 2023 M1 U1 MPL-2.0 Yes Details →
v0.7.5-0.20231108160701-309c58e33f3c 08 Nov 2023 M1 U1 MPL-2.0 Yes Details →
v0.7.5-0.20231106162232-9bb2062addb0 06 Nov 2023 M1 U1 MPL-2.0 Yes Details →
v0.0.0-20230606183423-571a88bc9c3b 06 Jun 2023 M1 U1 MPL-2.0 Yes Details →
v0.7.4 06 Jun 2023 M1 U1 MPL-2.0 Yes Details →
v0.7.4-0.20230606183423-571a88bc9c3b 06 Jun 2023 M1 U1 MPL-2.0 Yes Details →
v0.7.3 06 Jun 2023 M1 U1 MPL-2.0 Yes Details →
v0.7.3-0.20230519085312-3899851f2b38 19 May 2023 M1 U1 MPL-2.0 Yes Details →
v0.7.3-0.20230515152519-ee107da66013 15 May 2023 M1 U1 MPL-2.0 Yes Details →
v0.7.3-0.20230505121517-7bf089a067d5 05 May 2023 M1 U1 MPL-2.0 Yes Details →
v0.0.0-20230405161942-2bcd5fe0ec97 05 Apr 2023 M1 U1 MPL-2.0 Yes Details →
v0.7.3-0.20230405161942-2bcd5fe0ec97 05 Apr 2023 M1 U1 MPL-2.0 Yes Details →
v0.7.3-0.20230404182759-5322c00dcb1b 04 Apr 2023 M1 U1 MPL-2.0 Yes Details →
v0.7.3-0.20230403220410-82ed15fd9d30 03 Apr 2023 M1 U1 MPL-2.0 Yes Details →
v0.7.3-0.20230403220258-d77790c0d1dd 03 Apr 2023 M1 U1 MPL-2.0 Yes Details →
v0.7.3-0.20230403214002-3a6ed802f35d 03 Apr 2023 M1 U1 MPL-2.0 Yes Details →
v0.7.3-0.20230403212845-0c83c6c736a7 03 Apr 2023 M1 U1 MPL-2.0 Yes Details →
v0.7.3-0.20230403212814-e8eb669553c6 03 Apr 2023 M1 U1 MPL-2.0 Yes Details →
v0.7.3-0.20230403145038-eadc8800296a 03 Apr 2023 M1 U1 MPL-2.0 Yes Details →
v0.7.1-0.20230117204623-7f638666931a 17 Jan 2023 M1 U1 MPL-2.0 Yes Details →
v0.7.3-0.20230117204623-7f638666931a 17 Jan 2023 M1 U1 MPL-2.0 Yes Details →
v0.7.3-0.20230104160807-b94a2575994c 04 Jan 2023 M1 U1 MPL-2.0 Yes Details →
v0.7.2 03 Jan 2023 M1 U1 MPL-2.0 Yes Details →
v0.0.0-20220511161854-493aa4cf372e 11 May 2022 M1 U1 MPL-2.0 Yes Details →
v0.7.2-0.20220511161854-493aa4cf372e 11 May 2022 M1 U1 MPL-2.0 Yes Details →
v0.7.2-0.20220510172936-b0b736350062 10 May 2022 M1 U1 MPL-2.0 Yes Details →
v0.7.2-0.20220426002045-fb2a4c537881 26 Apr 2022 M1 U1 MPL-2.0 Yes Details →
v0.7.1 13 Apr 2022 M1 U1 MPL-2.0 Yes Details →
v0.7.1-0.20220413225950-98169fe9787b 13 Apr 2022 M1 U1 MPL-2.0 Yes Details →
v0.7.1-0.20220413214744-5bd1a6f34ca4 13 Apr 2022 M1 U1 MPL-2.0 Yes Details →
v0.7.1-0.20220413033123-c9eb34c54dc8 13 Apr 2022 M1 U1 MPL-2.0 Yes Details →
v0.7.1-0.20220411211153-5081362c3d96 11 Apr 2022 M1 U1 MPL-2.0 Yes Details →
v0.7.1-0.20220315235341-28e8f812c9e7 15 Mar 2022 M1 U1 MPL-2.0 Yes Details →
v0.7.1-0.20220210122859-676f2f06de02 10 Feb 2022 M1 U1 MPL-2.0 Yes Details →
v0.7.1-0.20211018174820-ff6d014e72d9 18 Oct 2021 M1 U1 MPL-2.0 Yes Details →
v0.7.1-0.20211015012939-dbd03671c353 15 Oct 2021 M1 U1 MPL-2.0 Yes Details →
v0.7.1-0.20211015011509-23b650d2b36d 15 Oct 2021 M1 U1 MPL-2.0 Yes Details →
v0.7.1-0.20211015011509-2467a3e7e156 15 Oct 2021 M1 U1 MPL-2.0 Yes Details →
v0.7.1-0.20211014165327-789d44111902 14 Oct 2021 M1 U1 MPL-2.0 Yes Details →
v0.7.1-0.20211014164907-2ca445675ca3 14 Oct 2021 M1 U1 MPL-2.0 Yes Details →
v0.7.1-0.20210813155352-012f144018e1 13 Aug 2021 M1 U1 MPL-2.0 Yes Details →
v0.7.1-0.20210813155352-f2396f056078 13 Aug 2021 M1 U1 MPL-2.0 Yes Details →
v0.7.1-0.20210809174605-e16f95849105 09 Aug 2021 M1 U1 MPL-2.0 Yes Details →
v0.0.0-20210427181442-02c1586c8f14 27 Apr 2021 M1 U1 MPL-2.0 Yes Details →
v0.7.0 27 Apr 2021 M1 U1 MPL-2.0 Yes Details →
v0.6.9-0.20210424005505-207df31d0280 24 Apr 2021 M1 U1 MPL-2.0 Yes Details →
v0.0.0-20201104135513-991b9d0a42d1 04 Nov 2020 M1 U1 MPL-2.0 Yes Details →
v0.6.8 04 Nov 2020 M1 U1 MPL-2.0 Yes Details →
v0.6.8-0.20200824211813-6861976bd321 24 Aug 2020 M1 U1 MPL-2.0 Yes Details →
v0.6.7 07 Aug 2020 M1 U1 MPL-2.0 Yes Details →
v0.6.7-0.20200807182356-37b3e74def02 07 Aug 2020 M1 U1 MPL-2.0 Yes Details →
v0.6.7-0.20200721161721-0321369f5ae5 21 Jul 2020 M1 U1 MPL-2.0 Yes Details →
v0.6.7-0.20200622160738-1831df73d7ee 22 Jun 2020 M1 U1 MPL-2.0 Yes Details →
v0.6.7-0.20200615182455-cf855b1d14d5 15 Jun 2020 M1 U1 MPL-2.0 Yes Details →
v0.6.7-0.20200615182049-171d0c90ea3f 15 Jun 2020 M1 U1 MPL-2.0 Yes Details →
v0.6.7-0.20200609142618-7cf40fa96c37 09 Jun 2020 M1 U1 MPL-2.0 Yes Details →
v0.6.7-0.20200428012955-4af2e4b19703 28 Apr 2020 M1 U1 MPL-2.0 Yes Details →
v0.6.7-0.20200415203738-fa421e5443e2 15 Apr 2020 M1 U1 MPL-2.0 Yes Details →
v0.6.7-0.20200415194935-8aac9d500fdd 15 Apr 2020 M1 U1 — Yes Details →
v0.0.0-20200413233632-dd1fc3518973 13 Apr 2020 M1 U1 — Yes Details →
v0.6.6 13 Apr 2020 M1 U1 — Yes Details →
v0.6.6-0.20200413230512-160aaddf31fa 13 Apr 2020 M1 U1 — Yes Details →
v0.0.0-20200413185606-3d21811b5df9 13 Apr 2020 M1 U1 — Yes Details →
v0.6.6-0.20200413185606-3d21811b5df9 13 Apr 2020 M1 U1 — Yes Details →
v0.6.5-0.20200407051154-3de733c49af2 07 Apr 2020 M1 U1 — Yes Details →
v0.6.5-0.20200407050445-03e3428c1832 07 Apr 2020 M1 U1 — Yes Details →
v0.6.5-0.20200406210805-641a70c18436 06 Apr 2020 M1 U1 — Yes Details →
v0.6.5-0.20200406210309-a4acb653a1ea 06 Apr 2020 M1 U1 — Yes Details →
v0.6.5-0.20200404163521-908440013806 04 Apr 2020 M1 U1 — Yes Details →
v0.6.5-0.20200404103821-03415ec1b08c 04 Apr 2020 M1 U1 — Yes Details →
v0.0.0-20200401163704-27fc49b35882 01 Apr 2020 M1 U1 — Yes Details →
v0.6.5 01 Apr 2020 M1 U1 — Yes Details →
v0.0.0-20200331141659-0a3762566857 31 Mar 2020 M1 U1 — Yes Details →
v0.6.5-0.20200331141659-0a3762566857 31 Mar 2020 M1 U1 — Yes Details →
v0.6.5-0.20200218145722-a69a5dbc65e4 18 Feb 2020 M1 U1 — Yes Details →
v0.6.5-0.20200218144824-35fb70aa4ff2 18 Feb 2020 M1 U1 — Yes Details →
v0.0.0-20191125180011-eaff869a704e 25 Nov 2019 M1 U1 — Yes Details →
v0.6.4 25 Nov 2019 M1 U1 — Yes Details →

The newest 120 of 182 versions Vulert tracks. Severity counts are the vulnerabilities recorded against that exact release.

02 Disclosure history

How often vulnerabilities are recorded

  • 2024 2

Counted by the year Vulert recorded each vulnerability — the same date the table below shows as disclosed. 0 of the 2 were recorded in the last 12 months.

03 Vulnerabilities

Recorded vulnerabilities for github.com/hashicorp/go-retryablehttp

The 2 most severe of 2 vulnerabilities recorded for this package

Search all 2 in the database →
Vulnerability Severity Fixed version ↓ Disclosed ↓
CVE-2024-6104: go-retryablehttp can leak basic auth credentials to log files 6.0 medium 0.7.7 24 Jun 2024
Sensitive Information Leak in github.com/hashicorp/go-retryablehttp N/A unrated 0.7.7 25 Jun 2024

Vulnerability wrong, a fix missing, or a package we should cover? Report it and we will fix the record. Report Vulnerability Provide Feedback

Updated: 23/Oct/2026 · Vulnerabilities in our DB: 524315

Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

About github.com/hashicorp/go-retryablehttp

Is github.com/hashicorp/go-retryablehttp safe to use?

Vulert records 2 vulnerabilities for github.com/hashicorp/go-retryablehttp in Go: 0 critical, 0 high, 1 medium and 0 low, plus 1 not yet rated. Every one of them has a published fix, so the practical answer is to run a supported release and keep it patched.

What is github.com/hashicorp/go-retryablehttp's Vulert package health score?

Vulert scores github.com/hashicorp/go-retryablehttp 79/100, which reads as in good shape. The score weighs the vulnerability record (40), maintenance and release cadence (25), adoption from dependents and stars (20) and community signals such as the OpenSSF scorecard and forks (15).

Is the latest version of github.com/hashicorp/go-retryablehttp affected?

Yes. v0.7.8, the version you would install today, has 2 known vulnerabilities, and every one of them has a published fix. Upgrade to the version listed for each.

Which version of github.com/hashicorp/go-retryablehttp should I use?

v0.7.8 is the version Vulert recommends for the affected releases. The version table above lists every release with the vulnerabilities recorded against it, so you can confirm the range you actually run.

How many vulnerabilities does github.com/hashicorp/go-retryablehttp have?

2 vulnerabilities are recorded for github.com/hashicorp/go-retryablehttp in the Go ecosystem: 0 critical, 0 high, 1 medium and 0 low, plus 1 not yet rated. The ledger on this page lists the same counts next to the date of the most recent disclosure.

How often are new github.com/hashicorp/go-retryablehttp vulnerabilities disclosed?

0 vulnerabilities were recorded for github.com/hashicorp/go-retryablehttp in the last 12 months, and the oldest entry in this database dates to 24 Jun 2024. Recency matters more than a lifetime total: it shows how actively new issues are being disclosed for the package you are considering.

Which versions of github.com/hashicorp/go-retryablehttp are affected?

Each vulnerability on this page lists the affected version range and the fixed version to move to. Open the vulnerability for the version you actually run — fixes are specific to a release line, not to the package as a whole.

How do I monitor github.com/hashicorp/go-retryablehttp for upcoming vulnerabilities?

Upload the manifest or SBOM for your application at vulert.com/scanner and Vulert keeps checking the github.com/hashicorp/go-retryablehttp version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.