CVE-2019-14809
net/url in Go before 1.11.13 and 1.12.x before 1.12.8 mishandles malformed hosts in URLs, leading...
net/url in Go before 1.11.13 and 1.12.x before 1.12.8 mishandles malformed hosts in URLs, leading to an authorization bypass in some applications. This is related to a Host field with a suffix appearing in neither Hostname() nor Port(), and is related to a non-numeric port number. For example, an attacker can compose a crafted javascript:// URL that results in a hostname of google.com.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
net/url in Go before 1.11.13 and 1.12.x before 1.12.8 mishandles malformed hosts in URLs, leading to an authorization bypass in some applications. This is related to a Host field with a suffix appearing in neither Hostname() nor Port(), and is related to a non-numeric port number. For example, an attacker can compose a crafted javascript:// URL that results in a hostname of google.com.
- Record
CVE-2019-14809- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Updated
- 2026-11-02
CVE List No score
net/url in Go before 1.11.13 and 1.12.x before 1.12.8 mishandles malformed hosts in URLs, leading to an authorization bypass in some applications. This is related to a Host field with a suffix appearing in neither Hostname() nor Port(), and is related to a non-numeric port number. For example, an attacker can compose a crafted javascript:// URL that results in a hostname of google.com.
- Record
CVE-2019-14809- Updated
- 2026-11-02
EUVDEUVD-2019-5938 No score
net/url in Go before 1.11.13 and 1.12.x before 1.12.8 mishandles malformed hosts in URLs, leading to an authorization bypass in some applications. This is related to a Host field with a suffix appearing in neither Hostname() nor Port(), and is related to a non-numeric port number. For example, an attacker can compose a crafted javascript:// URL that results in a hostname of google.com.
- Record
EUVD-2019-5938- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-2xf8-4fv6-m993 No score
net/url in Go before 1.11.13 and 1.12.x before 1.12.8 mishandles malformed hosts in URLs, leading...
net/url in Go before 1.11.13 and 1.12.x before 1.12.8 mishandles malformed hosts in URLs, leading to an authorization bypass in some applications. This is related to a Host field with a suffix appearing in neither Hostname() nor Port(), and is related to a non-numeric port number. For example, an attacker can compose a crafted javascript:// URL that results in a hostname of google.com.
- Record
GHSA-2xf8-4fv6-m993- Updated
- 2026-11-02
OSVALPINE-CVE-2019-14809
net/url in Go before 1.11.13 and 1.12.x before 1.12.8 mishandles malformed hosts in URLs, leading to an authorization bypass in some applications. This is related to a Host field with a suffix appearing in neither Hostname() nor Port(), and is related to a non-numeric port number. For example, an attacker can compose a crafted javascript:// URL that results in a hostname of google.com.
- Record
ALPINE-CVE-2019-14809- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-03
OSVAZL-78948
CVE-2019-14809 affecting package golang 1.25.7-1
net/url in Go before 1.11.13 and 1.12.x before 1.12.8 mishandles malformed hosts in URLs, leading to an authorization bypass in some applications. This is related to a Host field with a suffix appearing in neither Hostname() nor Port(), and is related to a non-numeric port number. For example, an attacker can compose a crafted javascript:// URL that results in a hostname of google.com.
- Record
AZL-78948- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 17 moreShow less
OSVAZL-98907
CVE-2019-14809 affecting package golang 1.27.1-1
net/url in Go before 1.11.13 and 1.12.x before 1.12.8 mishandles malformed hosts in URLs, leading to an authorization bypass in some applications. This is related to a Host field with a suffix appearing in neither Hostname() nor Port(), and is related to a non-numeric port number. For example, an attacker can compose a crafted javascript:// URL that results in a hostname of google.com.
- Record
AZL-98907- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVBELL-CVE-2019-14809
CVE-2019-14809 does not affect BellSoft software
- Record
BELL-CVE-2019-14809- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSV
net/url in Go before 1.11.13 and 1.12.x before 1.12.8 mishandles malformed hosts in URLs, leading to an authorization bypass in some applications. This is related to a Host field with a suffix appearing in neither Hostname() nor Port(), and is related to a non-numeric port number. For example, an attacker can compose a crafted javascript:// URL that results in a hostname of google.com.
- Record
CVE-2019-14809- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHEA-2019:4179
Red Hat Enhancement Advisory: new packages: go-toolset-1.12
- Record
RHEA-2019:4179- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVRHSA-2019:3433
Red Hat Security Advisory: go-toolset:rhel8 security, bug fix, and enhancement update
- Record
RHSA-2019:3433- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2019-14809
net/url in Go before 1.11.13 and 1.12.x before 1.12.8 mishandles malformed hosts in URLs, leading to an authorization bypass in some applications. This is related to a Host field with a suffix appearing in neither Hostname() nor Port(), and is related to a non-numeric port number. For example, an attacker can compose a crafted javascript:// URL that results in a hostname of google.com.
- Record
UBUNTU-CVE-2019-14809- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGO-2022-0211 No score
Incorrect parsing validation in net/url
The url.Parse function accepts URLs with malformed hosts, such that the Host field can have arbitrary suffixes that appear in neither Hostname() nor Port(), allowing authorization bypasses in certain applications.
- Record
GO-2022-0211- Updated
- 2026-11-02
OSVMGASA-2019-0251 No score
Updated golang packages fix security vulnerabilities
Updated golang packages fix security vulnerabilities:
Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service. The attacker sends continual pings to an HTTP/2 peer, causing the peer to build an internal queue of responses. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both (CVE-2019-9512)
Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service. The attacker opens a number of streams and sends an invalid request over each stream that should solicit a stream of RST_STREAM frames from the peer. Depending on how the peer queues the RST_STREAM frames, this can consume excess memory, CPU, or both (CVE-2019-9514).
net/url in Go before 1.11.13 and 1.12.x before 1.12.8 mishandles malformed hosts in URLs, leading to an authorization bypass in some applications. This is related to a Host field with a suffix appearing in neither Hostname() nor Port(), and is related to a non-numeric port number. (CVE-2019-14809)
- Record
MGASA-2019-0251- Updated
- 2026-11-02
OSVopenSUSE-SU-2019:2000-1 No score
Security update for go1.12
This update for go1.12 fixes the following issues:
Security issues fixed:
- CVE-2019-9512: Fixed HTTP/2 flood using PING frames that results in unbounded memory growth. (bsc#1146111)
- CVE-2019-9514: Fixed HTTP/2 implementation is vulnerable to a reset flood, potentially leading to a denial of service. (bsc#1146115)
- CVE-2019-14809: Fixed authorization bypass due to malformed hosts in URLs. (bsc#1146123)
- Record
openSUSE-SU-2019:2000-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2019:2056-1 No score
Security update for go1.12
This update for go1.12 fixes the following issues:
Security issues fixed:
- CVE-2019-9512: Fixed HTTP/2 flood using PING frames that results in unbounded memory growth (bsc#1146111).
- CVE-2019-9514: Fixed HTTP/2 implementation that is vulnerable to a reset flood, potentially leading to a denial of service (bsc#1146115).
- CVE-2019-14809: Fixed malformed hosts in URLs that leads to authorization bypass (bsc#1146123).
Bugfixes:
- Update to go version 1.12.9 (bsc#1141689).
- Adding Web Assembly stuff from misc/wasm (bsc#1139210).
This update was imported from the SUSE:SLE-15:Update update project.
- Record
openSUSE-SU-2019:2056-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2019:2072-1 No score
Security update for go1.11
This update for go1.11 fixes the following issues:
Security issues fixed:
- CVE-2019-9512: Fixed HTTP/2 flood using PING frames that results in unbounded memory growth (bsc#1146111).
- CVE-2019-9514: Fixed HTTP/2 implementation that is vulnerable to a reset flood, potentially leading to a denial of service (bsc#1146115).
- CVE-2019-14809: Fixed malformed hosts in URLs that leads to authorization bypass (bsc#1146123).
Bugfixes:
- Update to go version 1.11.13 (bsc#1141688).
This update was imported from the SUSE:SLE-15:Update update project.
- Record
openSUSE-SU-2019:2072-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2019:2085-1 No score
Security update for go1.12
This update for go1.12 fixes the following issues:
Security issues fixed:
- CVE-2019-9512: Fixed HTTP/2 flood using PING frames that results in unbounded memory growth (bsc#1146111).
- CVE-2019-9514: Fixed HTTP/2 implementation that is vulnerable to a reset flood, potentially leading to a denial of service (bsc#1146115).
- CVE-2019-14809: Fixed malformed hosts in URLs that leads to authorization bypass (bsc#1146123).
Bugfixes:
- Update to go version 1.12.9 (bsc#1141689).
- Adding Web Assembly stuff from misc/wasm (bsc#1139210).
This update was imported from the SUSE:SLE-15:Update update project.
- Record
openSUSE-SU-2019:2085-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2019:2130-1 No score
Security update for go1.12
This update for go1.12 fixes the following issues:
Security issues fixed:
- CVE-2019-9512: Fixed HTTP/2 flood using PING frames that results in unbounded memory growth (bsc#1146111).
- CVE-2019-9514: Fixed HTTP/2 implementation that is vulnerable to a reset flood, potentially leading to a denial of service (bsc#1146115).
- CVE-2019-14809: Fixed malformed hosts in URLs that leads to authorization bypass (bsc#1146123).
Bugfixes:
- Update to go version 1.12.9 (bsc#1141689).
- Adding Web Assembly stuff from misc/wasm (bsc#1139210).
This update was imported from the SUSE:SLE-15:Update update project.
- Record
openSUSE-SU-2019:2130-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10804-1 No score
go1.11-1.11.13-10.5 on GA media
These are all security issues fixed in the go1.11-1.11.13-10.5 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10804-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10805-1 No score
go1.12-1.12.17-4.8 on GA media
These are all security issues fixed in the go1.12-1.12.17-4.8 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10805-1- Updated
- 2026-11-02
OSVSUSE-SU-2019:2213-1 No score
Security update for go1.11
This update for go1.11 fixes the following issues:
Security issues fixed:
- CVE-2019-9512: Fixed HTTP/2 flood using PING frames that results in unbounded memory growth (bsc#1146111).
- CVE-2019-9514: Fixed HTTP/2 implementation that is vulnerable to a reset flood, potentially leading to a denial of service (bsc#1146115).
- CVE-2019-14809: Fixed malformed hosts in URLs that leads to authorization bypass (bsc#1146123).
Bugfixes:
- Update to go version 1.11.13 (bsc#1141688).
- Record
SUSE-SU-2019:2213-1- Updated
- 2026-11-02
OSVSUSE-SU-2019:2214-1 No score
Security update for go1.12
This update for go1.12 fixes the following issues:
Security issues fixed:
- CVE-2019-9512: Fixed HTTP/2 flood using PING frames that results in unbounded memory growth (bsc#1146111).
- CVE-2019-9514: Fixed HTTP/2 implementation that is vulnerable to a reset flood, potentially leading to a denial of service (bsc#1146115).
- CVE-2019-14809: Fixed malformed hosts in URLs that leads to authorization bypass (bsc#1146123).
Bugfixes:
- Update to go version 1.12.9 (bsc#1141689).
- Adding Web Assembly stuff from misc/wasm (bsc#1139210).
- Record
SUSE-SU-2019:2214-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
goAlpine:v3.10 |
1.12.0 up to 1.12.8-r0 | 1.12.8-r0 |
goAlpine:v3.11 |
1.12.0 up to 1.12.8-r0 | 1.12.8-r0 |
goAlpine:v3.12 |
1.12.0 up to 1.12.8-r0 | 1.12.8-r0 |
goAlpine:v3.13 |
1.12.0 up to 1.12.8-r0 | 1.12.8-r0 |
goAlpine:v3.14 |
1.12.0 up to 1.12.8-r0 | 1.12.8-r0 |
goAlpine:v3.15 |
1.12.0 up to 1.12.8-r0 | 1.12.8-r0 |
goAlpine:v3.16 |
1.12.0 up to 1.12.8-r0 | 1.12.8-r0 |
goAlpine:v3.17 |
1.12.0 up to 1.12.8-r0 | 1.12.8-r0 |
goAlpine:v3.18 |
1.12.0 up to 1.12.8-r0 | 1.12.8-r0 |
goAlpine:v3.19 |
1.12.0 up to 1.12.8-r0 | 1.12.8-r0 |
Show 44 moreShow less
| Package | Affected | Fixed |
|---|---|---|
goAlpine:v3.20 |
1.12.0 up to 1.12.8-r0 | 1.12.8-r0 |
goAlpine:v3.21 |
1.12.0 up to 1.12.8-r0 | 1.12.8-r0 |
goAlpine:v3.22 |
1.12.0 up to 1.12.8-r0 | 1.12.8-r0 |
goAlpine:v3.23 |
1.12.0 up to 1.12.8-r0 | 1.12.8-r0 |
goAlpine:v3.24 |
1.12.0 up to 1.12.8-r0 | 1.12.8-r0 |
golangAzure Linux:3 |
through 1.25.7-1 | None known |
golangAzure Linux:3 |
1.27.0 to 1.27.1-1 | None known |
golang-1.11Debian:10 |
before 1.11.6-1+deb10u1, plus listed versions 1.11.6-1 |
1.11.6-1+deb10u1 |
stdlibGo |
before 1.11.13, 1.12.0-0 up to 1.12.8 | 1.11.131.12.8 |
golangMageia:6 |
before 1.11.13-1.mga6 | 1.11.13-1.mga6 |
golangMageia:7 |
before 1.12.8-1.mga7 | 1.12.8-1.mga7 |
go-toolset-1.12Red Hat:devtools:2019 |
before 0:1.12.8-2.el7 | 0:1.12.8-2.el7 |
go-toolset-1.12-buildRed Hat:devtools:2019 |
before 0:1.12.8-2.el7 | 0:1.12.8-2.el7 |
go-toolset-1.12-golangRed Hat:devtools:2019 |
before 0:1.12.8-2.el7 | 0:1.12.8-2.el7 |
go-toolset-1.12-golang-binRed Hat:devtools:2019 |
before 0:1.12.8-2.el7 | 0:1.12.8-2.el7 |
go-toolset-1.12-golang-docsRed Hat:devtools:2019 |
before 0:1.12.8-2.el7 | 0:1.12.8-2.el7 |
go-toolset-1.12-golang-miscRed Hat:devtools:2019 |
before 0:1.12.8-2.el7 | 0:1.12.8-2.el7 |
go-toolset-1.12-golang-raceRed Hat:devtools:2019 |
before 0:1.12.8-2.el7 | 0:1.12.8-2.el7 |
go-toolset-1.12-golang-srcRed Hat:devtools:2019 |
before 0:1.12.8-2.el7 | 0:1.12.8-2.el7 |
go-toolset-1.12-golang-testsRed Hat:devtools:2019 |
before 0:1.12.8-2.el7 | 0:1.12.8-2.el7 |
go-toolset-1.12-runtimeRed Hat:devtools:2019 |
before 0:1.12.8-2.el7 | 0:1.12.8-2.el7 |
go-toolsetRed Hat:enterprise_linux:8::appstream |
before 0:1.12.8-1.module+el8.1.0+4089+be929cf8 | 0:1.12.8-1.module+el8.1.0+4089+be929cf8 |
golangRed Hat:enterprise_linux:8::appstream |
before 0:1.12.8-2.module+el8.1.0+4089+be929cf8 | 0:1.12.8-2.module+el8.1.0+4089+be929cf8 |
golang-binRed Hat:enterprise_linux:8::appstream |
before 0:1.12.8-2.module+el8.1.0+4089+be929cf8 | 0:1.12.8-2.module+el8.1.0+4089+be929cf8 |
golang-docsRed Hat:enterprise_linux:8::appstream |
before 0:1.12.8-2.module+el8.1.0+4089+be929cf8 | 0:1.12.8-2.module+el8.1.0+4089+be929cf8 |
golang-miscRed Hat:enterprise_linux:8::appstream |
before 0:1.12.8-2.module+el8.1.0+4089+be929cf8 | 0:1.12.8-2.module+el8.1.0+4089+be929cf8 |
golang-raceRed Hat:enterprise_linux:8::appstream |
before 0:1.12.8-2.module+el8.1.0+4089+be929cf8 | 0:1.12.8-2.module+el8.1.0+4089+be929cf8 |
golang-srcRed Hat:enterprise_linux:8::appstream |
before 0:1.12.8-2.module+el8.1.0+4089+be929cf8 | 0:1.12.8-2.module+el8.1.0+4089+be929cf8 |
golang-testsRed Hat:enterprise_linux:8::appstream |
before 0:1.12.8-2.module+el8.1.0+4089+be929cf8 | 0:1.12.8-2.module+el8.1.0+4089+be929cf8 |
golang-1.10Ubuntu:14.04:LTS |
All versions, plus listed versions 1.10.4-2ubuntu1~14.04.1 |
None known |
golang-1.10Ubuntu:16.04:LTS |
All versions, plus listed versions 1.10.4-2ubuntu1~16.04.11.10.4-2ubuntu1~16.04.2 |
None known |
golang-1.6Ubuntu:16.04:LTS |
All versions, plus listed versions 1.6-0ubuntu11.6-0ubuntu21.6-0ubuntu31.6-0ubuntu41.6-0ubuntu5 Show 5 moreShow less1.6.1-0ubuntu11.6.2-0ubuntu5~16.041.6.2-0ubuntu5~16.04.21.6.2-0ubuntu5~16.04.31.6.2-0ubuntu5~16.04.4 |
None known |
golang-1.10Ubuntu:18.04:LTS |
All versions, plus listed versions 1.10~rc1-11.10~rc1-1ubuntu11.10~rc1-2ubuntu11.10~rc2-1ubuntu11.10-1ubuntu11.10.1-1ubuntu21.10.4-2ubuntu1~18.04.11.10.4-2ubuntu1~18.04.2 |
None known |
golang-1.8Ubuntu:18.04:LTS |
All versions, plus listed versions 1.8.3-2ubuntu11.8.3-2ubuntu1.18.04.1 |
None known |
golang-1.9Ubuntu:18.04:LTS |
All versions, plus listed versions 1.9.1-2ubuntu11.9.2-1ubuntu11.9.2-3ubuntu11.9.3-1ubuntu11.9.4-1ubuntu1 |
None known |
go1.12openSUSE:Leap 15.1 |
before 1.12.9-lp151.2.9.1 | 1.12.9-lp151.2.9.1 |
go1.12openSUSE:Leap 15.0 |
before 1.12.9-lp151.2.13.1 | 1.12.9-lp151.2.13.1 |
go1.12openSUSE:Leap 15.1 |
before 1.12.9-lp151.2.13.1 | 1.12.9-lp151.2.13.1 |
go1.11openSUSE:Leap 15.0 |
before 1.11.13-lp151.2.9.1 | 1.11.13-lp151.2.9.1 |
go1.11openSUSE:Leap 15.1 |
before 1.11.13-lp151.2.9.1 | 1.11.13-lp151.2.9.1 |
go1.12openSUSE:Leap 15.1 |
before 1.12.9-lp151.2.17.1 | 1.12.9-lp151.2.17.1 |
go1.12openSUSE:Leap 15.1 |
before 1.12.9-lp151.2.21.1 | 1.12.9-lp151.2.21.1 |
go1.11openSUSE:Tumbleweed |
before 1.11.13-10.5 | 1.11.13-10.5 |
go1.12openSUSE:Tumbleweed |
before 1.12.17-4.8 | 1.12.17-4.8 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, references | OSV | |
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-14809 is a critical vulnerability (CVSS 9.8) in Golang Go, published August 13, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 8.36%, the 94th percentile. Fixed in go 1.12.8-r0.
References
groups.google.com/forum
github.com/golang/go/issues/29098
seclists.org/bugtraq/2019/Aug/31
debian.org/security/2019/dsa-4503
lists.opensuse.org/opensuse-security-announce/2019-08/msg00076.html
Show 67 moreShow less
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LYO6E3H34C346D2E443GLXK7OK6KIYIQ
access.redhat.com/errata/RHSA-2019:3433
nvd.nist.gov/vuln/detail/CVE-2019-14809
security.alpinelinux.org/vuln/CVE-2019-14809
docs.bell-sw.com/security/cves/CVE-2019-14809
go.dev/cl/189258
go.googlesource.com/go/+/61bb56ad63992a3199acc55b2537c8355ef887b6
advisories.mageia.org/MGASA-2019-0251.html
bugs.mageia.org/show_bug.cgi?id=25372
bugzilla.redhat.com/show_bug.cgi?id=1709604
security.access.redhat.com/data/csaf/v2/advisories/2019/rhea-2019_4179.json
cve.org/CVERecord?id=CVE-2019-14809
suse.com/support/update/announcement/2019/suse-su-20192213-1
bugzilla.suse.com/1141688
ubuntu.com/security/CVE-2019-14809