https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 20 Oct 2026 13:31:40 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-159829 EUVD-2026-159829 https://cve.radiocsirt.org/vuln/euvd-2026-159829 https://cve.radiocsirt.org/vuln/fkie_cve-2024-45258 <p>The req package before 3.43.4 for Go may send an unintended request when a malformed URL is provided, because cleanHost in http.go intentionally uses a &#34;garbage in, garbage out&#34; design.</p> <p>The req package before 3.43.4 for Go may send an unintended request when a malformed URL is provided, because cleanHost in http.go intentionally uses a &#34;garbage in, garbage out&#34; design.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2024-45258 https://cve.radiocsirt.org/vuln/ghsa-cj55-gc7m-wvcq <p><strong>Affected:</strong> Go: github.com/imroc/req/v3, Go: github.com/imroc/req, Go: github.com/imroc/req/v2</p> <p>The `req` library is a widely used HTTP library in Go. However, it does not handle malformed URLs effectively. As a result, after parsing a malformed URL, the library may send HTTP requests to unexpected destinations, potentially leading to security vulnerabilities or unintended behavior in applications relying on this library for handling HTTP requests.</p> <p>Despite developers potentially utilizing the `net/url` library to parse malformed URLs and implement blocklists to prevent HTTP requests to listed URLs, inconsistencies exist between how the `net/url` and `req` libraries parse URLs. These discrepancies can lead to the failure of defensive strategies, resulting in potential security threats such as Server-Side Request Forgery (SSRF) and Remote Code Execution (RCE).</p> <p><strong>Affected:</strong> Go: github.com/imroc/req/v3, Go: github.com/imroc/req, Go: github.com/imroc/req/v2</p> <p>The `req` library is a widely used HTTP library in Go. However, it does not handle malformed URLs effectively. As a result, after parsing a malformed URL, the library may send HTTP requests to unexpected destinations, potentially leading to security vulnerabilities or unintended behavior in applications relying on this library for handling HTTP requests.</p> <p>Despite developers potentially utilizing the `net/url` library to parse malformed URLs and implement blocklists to prevent HTTP requests to listed URLs, inconsistencies exist between how the `net/url` and `req` libraries parse URLs. These discrepancies can lead to the failure of defensive strategies, resulting in potential security threats such as Server-Side Request Forgery (SSRF) and Remote Code Execution (RCE).</p> https://cve.radiocsirt.org/vuln/ghsa-cj55-gc7m-wvcq