Every CVE Search/ Get API key

CVE-2016-5386

The net/http package in Go through 1.6 does not attempt to address RFC 3875 section 4.1.18...

8.1 HighFix available

The net/http package in Go through 1.6 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect a CGI application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

5.22%Up 3.2 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 8.1

The net/http package in Go through 1.6 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect a CGI application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue.

Record
CVE-2016-5386
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
6.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:P
Weakness
CWE-284
Updated
2026-11-02
CVE List No score

The net/http package in Go through 1.6 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect a CGI application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue.

Record
CVE-2016-5386
Updated
2026-11-02
EUVDEUVD-2016-6336 No score

The net/http package in Go through 1.6 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect a CGI application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue.

Record
EUVD-2016-6336
Updated
2026-11-03
GitHub AdvisoriesGHSA-9hq4-732f-9vgf 8.1

The net/http package in Go through 1.6 does not attempt to address RFC 3875 section 4.1.18...

The net/http package in Go through 1.6 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect a CGI application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue.

Record
GHSA-9hq4-732f-9vgf
CVSS 3.0
8.1 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-284
Updated
2026-11-02
OSVAZL-78994 8.1

CVE-2016-5386 affecting package golang 1.25.7-1

The net/http package in Go through 1.6 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect a CGI application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue.

Record
AZL-78994
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVAZL-98904 8.1

CVE-2016-5386 affecting package golang 1.27.1-1

The net/http package in Go through 1.6 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect a CGI application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue.

Record
AZL-98904
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 15 moreShow less
OSVBELL-CVE-2016-5386 8.1

CVE-2016-5386 does not affect BellSoft software

Record
BELL-CVE-2016-5386
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSV 8.1

The net/http package in Go through 1.6 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect a CGI application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue.

Record
CVE-2016-5386
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2016:1538 5.3

Red Hat Security Advisory: golang security, bug fix, and enhancement update

Record
RHSA-2016:1538
CVSS 3.0
5.3 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVUBUNTU-CVE-2016-5386 8.1

The net/http package in Go through 1.6 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect a CGI application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue.

Record
UBUNTU-CVE-2016-5386
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVGO-2022-0761 No score

Improper input validation in net/http and net/http/cgi

An input validation flaw in the CGI components allows the HTTP_PROXY environment variable to be set by the incoming Proxy header, which changes where Go by default proxies all outbound HTTP requests.

This environment variable is also used to set the outgoing proxy, enabling an attacker to insert a proxy into outgoing requests of a CGI program.

Read more about "httpoxy" here: https://httpoxy.org.

Record
GO-2022-0761
Updated
2026-11-02
OSVMGASA-2016-0317 No score

Updated golang package fixes security vulnerability

Updated golang packages fix security vulnerability:

Go: sets environmental variable based on user supplied Proxy request header (CVE-2016-5386).

Record
MGASA-2016-0317
Updated
2026-11-02
OSVopenSUSE-SU-2016:2054-1 No score

security update for go

This update addresses a security issue affecting code statically linked with go:

  • CVE-2016-5386: A remote attacker could set the HTTP_PROXY environment variable via Proxy header (bsc#988487)
Record
openSUSE-SU-2016:2054-1
Updated
2026-11-02
OSVopenSUSE-SU-2016:2055-1 No score

security update for go

This update addresses a security issue affecting code statically linked with go:

  • CVE-2016-5386: A remote attacker could set the HTTP_PROXY environment variable via Proxy header (bsc#988487)
Record
openSUSE-SU-2016:2055-1
Updated
2026-11-02
OSVopenSUSE-SU-2016:2536-1 No score

Security update to go1.4

go1.4 was updated to fix the following vulnerabilities:

  • CVE-2016-5386: Remote attacker could have set the application's HTTP_PROXY environment variable via Proxy headers (boo#988487)
Record
openSUSE-SU-2016:2536-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:10802-1 No score

go-1.17-1.1 on GA media

These are all security issues fixed in the go-1.17-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10802-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:10803-1 No score

go1.10-1.10.8-8.2 on GA media

These are all security issues fixed in the go1.10-1.10.8-8.2 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10803-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:10804-1 No score

go1.11-1.11.13-10.5 on GA media

These are all security issues fixed in the go1.11-1.11.13-10.5 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10804-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:10805-1 No score

go1.12-1.12.17-4.8 on GA media

These are all security issues fixed in the go1.12-1.12.17-4.8 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10805-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:10811-1 No score

go1.4-1.4.3-12.2 on GA media

These are all security issues fixed in the go1.4-1.4.3-12.2 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10811-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:10812-1 No score

go1.9-1.9.7-11.2 on GA media

These are all security issues fixed in the go1.9-1.9.7-11.2 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10812-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
golang
Azure Linux:3
 through 1.25.7-1 None known
golang
Azure Linux:3
 1.27.0 to 1.27.1-1 None known
stdlib
Go
 before 1.6.3
1.6.3
golang
Mageia:5
 before 1.6.3-1.mga5
1.6.3-1.mga5
golang
Red Hat:enterprise_linux:7::server
From an advisory covering 5 CVEs
 before 0:1.6.3-1.el7_2.1
0:1.6.3-1.el7_2.1
golang-bin
Red Hat:enterprise_linux:7::server
From an advisory covering 5 CVEs
 before 0:1.6.3-1.el7_2.1
0:1.6.3-1.el7_2.1
golang-docs
Red Hat:enterprise_linux:7::server
From an advisory covering 5 CVEs
 before 0:1.6.3-1.el7_2.1
0:1.6.3-1.el7_2.1
golang-misc
Red Hat:enterprise_linux:7::server
From an advisory covering 5 CVEs
 before 0:1.6.3-1.el7_2.1
0:1.6.3-1.el7_2.1
golang-src
Red Hat:enterprise_linux:7::server
From an advisory covering 5 CVEs
 before 0:1.6.3-1.el7_2.1
0:1.6.3-1.el7_2.1
golang-tests
Red Hat:enterprise_linux:7::server
From an advisory covering 5 CVEs
 before 0:1.6.3-1.el7_2.1
0:1.6.3-1.el7_2.1
Show 9 moreShow less
Affected packages
PackageAffectedFixed
golang-1.6
Ubuntu:16.04:LTS
 All versions, plus listed versions
1.6-0ubuntu11.6-0ubuntu21.6-0ubuntu31.6-0ubuntu41.6-0ubuntu5
Show 5 moreShow less
1.6.1-0ubuntu11.6.2-0ubuntu5~16.041.6.2-0ubuntu5~16.04.21.6.2-0ubuntu5~16.04.31.6.2-0ubuntu5~16.04.4
 None known
go
SUSE:Package Hub 12
 before 1.6.1-6.1
1.6.1-6.1
go1.4
SUSE:Package Hub 12
 before 1.4.3-6.1
1.4.3-6.1
go
openSUSE:Tumbleweed
From an advisory covering 10 CVEs
 before 1.17-1.1
1.17-1.1
go1.10
openSUSE:Tumbleweed
From an advisory covering 12 CVEs
 before 1.10.8-8.2
1.10.8-8.2
go1.11
openSUSE:Tumbleweed
From an advisory covering 15 CVEs
 before 1.11.13-10.5
1.11.13-10.5
go1.12
openSUSE:Tumbleweed
From an advisory covering 18 CVEs
 before 1.12.17-4.8
1.12.17-4.8
go1.4
openSUSE:Tumbleweed
From an advisory covering 4 CVEs
 before 1.4.3-12.2
1.4.3-12.2
go1.9
openSUSE:Tumbleweed
From an advisory covering 9 CVEs
 before 1.9.7-11.2
1.9.7-11.2

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2016-5386 is a high vulnerability (CVSS 8.1) in Golang Go, published July 18, 2016. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 5.22%, the 92nd percentile. Fixed in stdlib 1.6.3.

References

Show 56 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open