Vulnerability Database

298,930

Total vulnerabilities in the database

CVE-2022-26945

go-getter up to 1.5.11 and 2.0.2 allowed protocol switching, endless redirect, and configuration bypass via abuse of custom HTTP response header processing. Fixed in 1.6.1 and 2.1.0.

Published: May 25, 2022
Updated: Aug 9, 2023
CVE: CVE-2022-26945
GHSA: GHSA-x24g-9w7v-vprh
Severity: Critical
Exploit:

CVSS v3:

Severity: Critical
Score: 9.8
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2:

Severity: High
Score: 7.5
AV:N/AC:L/Au:N/C:P/I:P/A:P

CWEs:

CWE-77

OWASP TOP 10:

A1 - Injection

Affected Software
References

Software	From	Fixed in
hashicorp / go-getter	2.0.2	2.0.2.x
hashicorp / go-getter	-	1.5.11.x
github.com/hashicorp/go-getter	-	1.6.1
github.com/hashicorp/go-getter	2.0.0	2.1.0
github.com/hashicorp/go-getter/v2	-	2.1.0
github.com/hashicorp/go-getter/s3/v2	-	2.1.0
github.com/hashicorp/go-getter/gcs/v2	-	2.1.0

Deep Security Visibility Without the Complexity

SynScan provides clear, real-time security insights so you can monitor your attack surface, spot risks early, and act fast—without extra complexity.

No setup fees
5-min deployment
Cancel anytime