CVE-2023-45286
CVSS 3.1 Score 5.9 of 10 (medium)
Details
Summary
CVE-2023-45286 is a race condition vulnerability affecting go-resty, an HTTP client library for Go. The issue arises when sync.Pool is used to manage bytes.Buffer instances, and request retries are enabled. When a retry occurs, a previously used bytes.Buffer may be reused, resulting in the current HTTP request body being appended to the buffer that contains data from an unrelated request. This leads to the unintended sending of two HTTP request bodies in a single request. The vulnerability exists at package level scope, potentially impacting unrelated servers.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Advisories, Assessments, and Mitigations
Prioritize, Pinpoint, and Act to Prevent Vulnerability Exploits with Recorded Future
- Gain complete coverage of your cyber, third party, and physical attack surface
- Proactively mitigate threats before they turn into costly attacks
- Make fast, effective, data-driven decisions