CVE-2019-9741

2019-03-1308:29:00

Google

osv.dev

6.8 Medium

AI Score

Confidence

Low

0.005 Low

EPSS

Percentile

76.0%

JSON

An issue was discovered in net/http in Go 1.11.5. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the second argument to http.NewRequest with \r\n followed by an HTTP header or a Redis command.

CPENameOperatorVersion
goeqgo1.10rc1
goeqweekly.2011-07-07
goeqweekly.2010-11-10
goeqweekly.2011-09-01
goeqweekly.2010-07-29
goeqgo1.7rc4
goeqgo1.7beta1
goeqweekly.2010-10-20
goeqweekly.2010-11-23
goeqweekly.2011-10-18

Name	Operator	Version
go	eq	go1.10rc1
go	eq	weekly.2011-07-07
go	eq	weekly.2010-11-10
go	eq	weekly.2011-09-01
go	eq	weekly.2010-07-29
go	eq	go1.7rc4
go	eq	go1.7beta1
go	eq	weekly.2010-10-20
go	eq	weekly.2010-11-23
go	eq	weekly.2011-10-18