A race condition in go-resty can result in HTTP request body disclosure across requests. This condition can be triggered by calling sync.Pool.Put with the same *bytes.Buffer more than once, when request retries are enabled and a retry occurs. The call to sync.Pool.Get will then return a bytes.Buffer that hasn't had bytes.Buffer.Reset called on it. This dirty buffer will contain the HTTP request body from an unrelated request, and go-resty will append the current HTTP request body to it, sending two bodies in one request. The sync.Pool in question is defined at package level scope, so a completely unrelated server could receive the request body.

Affected: Go: github.com/go-resty/resty/v2

A race condition in go-resty can result in HTTP request body disclosure across requests.

This condition can be triggered by calling sync.Pool.Put with the same *bytes.Buffer more than once, when request retries are enabled and a retry occurs. The call to sync.Pool.Get will then return a bytes.Buffer that hasn't had bytes.Buffer.Reset called on it. This dirty buffer will contain the HTTP request body from an unrelated request, and go-resty will append the current HTTP request body to it, sending two bodies in one request.

The sync.Pool in question is defined at package level scope, so a completely unrelated server could receive the request body.

rclone-1.65.1-1.1 on GA media

follow-redirects: Improper Input Validation due to the improper handling of URLs by the url.parse() css-tools: Improper Input Validation causes Denial of Service via Regular Expression golang: net/http/internal: Denial of Service (DoS) via Resource Consumption via HTTP requests go-resty: HTTP request body disclosure in github.com/go-resty/resty/v2 golang: crypto/tls: Timing Side Channel attack in RSA based TLS key exchanges. golang: net/http, x/net/http2: unlimited number of CONTINUATION frames causes DoS axios: exposure of confidential data stored in cookies css-tools: regular expression denial of service (ReDoS) when parsing CSS golang-protobuf: encoding/protojson, internal/encoding/json: infinite loop in protojson.Unmarshal when unmarshaling certain forms of invalid JSON follow-redirects: Possible credential leak webpack-dev-middleware: lack of URL validation may lead to file leak

Affected: Ubuntu:22.04:LTS: golang-github-go-resty-resty, Ubuntu:24.04:LTS: golang-github-go-resty-resty, Ubuntu:25.10: golang-github-go-resty-resty, Ubuntu:26.04:LTS: golang-github-go-resty-resty

A race condition in go-resty can result in HTTP request body disclosure across requests. This condition can be triggered by calling sync.Pool.Put with the same *bytes.Buffer more than once, when request retries are enabled and a retry occurs. The call to sync.Pool.Get will then return a bytes.Buffer that hasn't had bytes.Buffer.Reset called on it. This dirty buffer will contain the HTTP request body from an unrelated request, and go-resty will append the current HTTP request body to it, sending two bodies in one request. The sync.Pool in question is defined at package level scope, so a completely unrelated server could receive the request body.

Ein Angreifer kann mehrere Schwachstellen in Red Hat OpenShift ausnutzen, um Dateien zu manipulieren, einen Denial-of-Service-Zustand zu verursachen, beliebigen Code auszuführen, vertrauliche Informationen offenzulegen, seine Privilegien zu erweitern oder um weitere nicht spezifizierte Angriffe auszuführen.