MEDIUM5.3
GO-2021-0241
Attacker can drop certain headers in net/http/httputil
Quick fix
GO-2021-0241 — stdlib: upgrade to the fixed version with the command below.
go get stdlib@v1.15.13Details
ReverseProxy can be made to forward certain hop-by-hop headers, including Connection. If the target of the ReverseProxy is itself a reverse proxy, this lets an attacker drop arbitrary headers, including those set by the ReverseProxy.Director.
Are you affected?
Enter the version of the package you're using.