CVE-2022-26945

HashiCorp go-getter command injection

9.8 CriticalFix available

go-getter up to 1.5.11 and 2.0.2 allowed protocol switching, endless redirect, and configuration bypass via abuse of custom HTTP response header processing. Fixed in 1.6.1 and 2.1.0.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

1.74%Up 0.7 points since May 26, 2022

What each source reports

NVD Score used 9.8

go-getter up to 1.5.11 and 2.0.2 allowed protocol switching, endless redirect, and configuration bypass via abuse of custom HTTP response header processing. Fixed in 1.6.1 and 2.1.0.

Record: CVE-2022-26945
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0: 7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Updated: 2026-11-02

CVE List No score

go-getter up to 1.5.11 and 2.0.2 allowed protocol switching, endless redirect, and configuration bypass via abuse of custom HTTP response header processing. Fixed in 1.6.1 and 2.1.0.

Record: CVE-2022-26945
Updated: 2026-11-02

EUVDEUVD-2022-5681 No score

go-getter up to 1.5.11 and 2.0.2 allowed protocol switching, endless redirect, and configuration bypass via abuse of custom HTTP response header processing. Fixed in 1.6.1 and 2.1.0.

Record: EUVD-2022-5681
Updated: 2026-11-03

GitHub AdvisoriesGHSA-x24g-9w7v-vprh 9.8

HashiCorp go-getter command injection

HashiCorp go-getter before 2.0.2 allows Command Injection.

Record: GHSA-x24g-9w7v-vprh
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-77
Updated: 2026-11-02

OSVDEBIAN-CVE-2022-26945 9.8

go-getter up to 1.5.11 and 2.0.2 allowed protocol switching, endless redirect, and configuration bypass via abuse of custom HTTP response header processing. Fixed in 1.6.1 and 2.1.0.

Record: DEBIAN-CVE-2022-26945
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-05

OSVGHSA-28r2-q6m8-9hpx 8.6

HashiCorp go-getter unsafe downloads could lead to asymmetric resource exhaustion

HashiCorp go-getter through 2.0.2 does not safely perform downloads. Asymmetric resource exhaustion could occur when go-getter processed malicious HTTP responses.

Record: GHSA-28r2-q6m8-9hpx
CVSS 3.1: 8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Updated: 2026-11-02

Show 9 moreShow less

OSVGHSA-cjr4-fv6c-f3mv 8.6

HashiCorp go-getter unsafe downloads could lead to arbitrary host access

HashiCorp go-getter through 2.0.2 does not safely perform downloads. Arbitrary host access was possible via go-getter path traversal, symlink processing, and command injection flaws.

Record: GHSA-cjr4-fv6c-f3mv
CVSS 3.1: 8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Updated: 2026-11-02

OSVGHSA-fcgg-rvwg-jv58 8.6

HashiCorp go-getter unsafe downloads

HashiCorp go-getter through 2.0.2 does not safely perform downloads. Protocol switching, endless redirect, and configuration bypass were possible via abuse of custom HTTP response header processing.

Record: GHSA-fcgg-rvwg-jv58
CVSS 3.1: 8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Updated: 2026-11-02

OSVGHSA-x24g-9w7v-vprh 9.8

HashiCorp go-getter command injection

HashiCorp go-getter before 2.0.2 allows Command Injection.

Record: GHSA-x24g-9w7v-vprh
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-77
Updated: 2026-11-02

OSVUBUNTU-CVE-2022-26945 9.8

go-getter up to 1.5.11 and 2.0.2 allowed protocol switching, endless redirect, and configuration bypass via abuse of custom HTTP response header processing. Fixed in 1.6.1 and 2.1.0.

Record: UBUNTU-CVE-2022-26945
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSV No score

go-getter up to 1.5.11 and 2.0.2 allowed protocol switching, endless redirect, and configuration bypass via abuse of custom HTTP response header processing. Fixed in 1.6.1 and 2.1.0.

Record: CVE-2022-26945
Updated: 2026-11-02

OSVCVE-2022-30321 No score

go-getter up to 1.5.11 and 2.0.2 allowed arbitrary host access via go-getter path traversal, symlink processing, and command injection flaws. Fixed in 1.6.1 and 2.1.0.

Record: CVE-2022-30321
Updated: 2026-11-02

OSVCVE-2022-30322 No score

go-getter up to 1.5.11 and 2.0.2 allowed asymmetric resource exhaustion when go-getter processed malicious HTTP responses. Fixed in 1.6.1 and 2.1.0.

Record: CVE-2022-30322
Updated: 2026-11-02

OSVCVE-2022-30323 No score

go-getter up to 1.5.11 and 2.0.2 panicked when processing password-protected ZIP files. Fixed in 1.6.1 and 2.1.0.

Record: CVE-2022-30323
Updated: 2026-11-02

OSVGO-2022-0586 No score

Resource exhaustion in github.com/hashicorp/go-getter and related modules

Malicious HTTP responses can cause a number of misbehaviors, including overwriting local files, resource exhaustion, and panics.

Protocol switching, endless redirect, and configuration bypass are possible through abuse of custom HTTP response header processing.
Arbitrary host access is possible through go-getter path traversal, symlink processing, and command injection flaws.
Asymmetric resource exhaustion can occur when go-getter processes malicious HTTP responses.
A panic can be triggered when go-getter processed password-protected ZIP files.

Record: GO-2022-0586
Updated: 2026-11-02

Affected products

hashicorp go-getter

Affected packages

Affected packages
Package	Affected	Fixed
`github.com/hashicorp/go-getter` Go	before 1.6.1	1.6.1
`github.com/hashicorp/go-getter` Go	2.0.0 up to 2.1.0	2.1.0
`github.com/hashicorp/go-getter/v2` Go	before 2.1.0	2.1.0
`github.com/hashicorp/go-getter/s3/v2` Go	before 2.1.0	2.1.0
`github.com/hashicorp/go-getter/gcs/v2` Go	before 2.1.0	2.1.0
`golang-github-hashicorp-go-getter` Debian:12	All versions, plus listed versions 1.4.1-11.8.9-1	None known
`golang-github-hashicorp-go-getter` Debian:14	before 1.8.9-1, plus listed versions 0.0~git20160316.0.575ec4e-11.4.0-11.4.1-1	1.8.9-1
`github.com/hashicorp/go-getter` Go From an advisory covering 4 CVEs	before 1.6.1	1.6.1
`github.com/hashicorp/go-getter` Go From an advisory covering 4 CVEs	2.0.0 up to 2.1.0	2.1.0
`github.com/hashicorp/go-getter/v2` Go From an advisory covering 4 CVEs	before 2.1.0	2.1.0

Show 10 moreShow less

Affected packages
Package	Affected	Fixed
`github.com/hashicorp/go-getter/s3/v2` Go From an advisory covering 4 CVEs	before 2.1.0	2.1.0
`github.com/hashicorp/go-getter/gcs/v2` Go From an advisory covering 4 CVEs	before 2.1.0	2.1.0
`golang-github-hashicorp-go-getter` Ubuntu:18.04:LTS	All versions, plus listed versions 0.0~git20160316.0.575ec4e-1	None known
`golang-github-hashicorp-go-getter` Ubuntu:20.04:LTS	All versions, plus listed versions 0.0~git20160316.0.575ec4e-11.4.0-11.4.1-1	None known
`golang-github-jesseduffield-go-getter` Ubuntu:20.04:LTS	All versions, plus listed versions 0.0~git20180822.906e156-3	None known
`golang-github-hashicorp-go-getter` Ubuntu:22.04:LTS	All versions, plus listed versions 1.4.1-1	None known
`golang-github-jesseduffield-go-getter` Ubuntu:22.04:LTS	All versions, plus listed versions 0.0~git20180822.906e156-4	None known
`golang-github-hashicorp-go-getter` Ubuntu:24.04:LTS	All versions, plus listed versions 1.4.1-1	None known
`golang-github-jesseduffield-go-getter` Ubuntu:24.04:LTS	All versions, plus listed versions 0.0~git20180822.906e156-5	None known
`golang-github-hashicorp-go-getter` Ubuntu:25.10	All versions, plus listed versions 1.4.1-1	None known

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected
Nov 5, 2026	affected, facts	OSV
Nov 3, 2026	affected	OSV
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-26945 is a critical vulnerability (CVSS 9.8) in Hashicorp Go-getter, published May 25, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.74%, the 77th percentile. Fixed in github.com/hashicorp/go-getter 1.6.1.

References

Show 16 moreShow less