CVE-2023-29406 Insufficient sanitization of Host header in net/http

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Multiple CVEs Affecting net/http Identified in 2023 and 2024 Two vulnerabilities in the net/http package have been reported. CVE-2024-45336, published on January 28, 2025, involves sensitive headers being incorrectly sent after cross-domain redirects. CVE-2023-29406, published on July 11, 2023, relates to insufficient sanitization of the Host header, with a public proof of concept released on November 12, 2023. 3 sources 41