{"id":"CVE-2019-14809","aliases":["ALPINE-CVE-2019-14809","AZL-78948","AZL-98907","BELL-CVE-2019-14809","DSA-4503-1","EUVD-2019-5938","GHSA-2xf8-4fv6-m993","GO-2022-0211","MGASA-2019-0251","RHEA-2019:4179","RHSA-2019:3433","SUSE-SU-2019:2213-1","SUSE-SU-2019:2214-1","UBUNTU-CVE-2019-14809","openSUSE-SU-2019:2000-1","openSUSE-SU-2019:2056-1","openSUSE-SU-2019:2072-1","openSUSE-SU-2019:2085-1","openSUSE-SU-2019:2130-1","openSUSE-SU-2024:10804-1","openSUSE-SU-2024:10805-1"],"status":"published","title":"net/url in Go before 1.11.13 and 1.12.x before 1.12.8 mishandles malformed hosts in URLs, leading...","description":"net/url in Go before 1.11.13 and 1.12.x before 1.12.8 mishandles malformed hosts in URLs, leading to an authorization bypass in some applications. This is related to a Host field with a suffix appearing in neither Hostname() nor Port(), and is related to a non-numeric port number. For example, an attacker can compose a crafted javascript:// URL that results in a hostname of google.com.","severity":{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.08359,"percentile":0.95001,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2019-08-13T20:54:24Z","modified":"2026-11-03T06:32:29Z","fixes":[{"ecosystem":"Alpine:v3.10","package":"go","fixed_in":["1.12.8-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"go","fixed_in":["1.12.8-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"go","fixed_in":["1.12.8-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"go","fixed_in":["1.12.8-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"go","fixed_in":["1.12.8-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"go","fixed_in":["1.12.8-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"go","fixed_in":["1.12.8-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"go","fixed_in":["1.12.8-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"go","fixed_in":["1.12.8-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"go","fixed_in":["1.12.8-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"go","fixed_in":["1.12.8-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"go","fixed_in":["1.12.8-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"go","fixed_in":["1.12.8-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"go","fixed_in":["1.12.8-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"go","fixed_in":["1.12.8-r0"],"sources":["osv"]},{"ecosystem":"Go","package":"stdlib","fixed_in":["1.11.13","1.12.8"],"sources":["osv"]},{"ecosystem":"Red Hat:devtools:2019","package":"go-toolset-1.12","fixed_in":["0:1.12.8-2.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:devtools:2019","package":"go-toolset-1.12-build","fixed_in":["0:1.12.8-2.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:devtools:2019","package":"go-toolset-1.12-golang","fixed_in":["0:1.12.8-2.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:devtools:2019","package":"go-toolset-1.12-golang-bin","fixed_in":["0:1.12.8-2.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:devtools:2019","package":"go-toolset-1.12-golang-docs","fixed_in":["0:1.12.8-2.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:devtools:2019","package":"go-toolset-1.12-golang-misc","fixed_in":["0:1.12.8-2.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:devtools:2019","package":"go-toolset-1.12-golang-race","fixed_in":["0:1.12.8-2.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:devtools:2019","package":"go-toolset-1.12-golang-src","fixed_in":["0:1.12.8-2.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:devtools:2019","package":"go-toolset-1.12-golang-tests","fixed_in":["0:1.12.8-2.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:devtools:2019","package":"go-toolset-1.12-runtime","fixed_in":["0:1.12.8-2.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"go-toolset","fixed_in":["0:1.12.8-1.module+el8.1.0+4089+be929cf8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"golang","fixed_in":["0:1.12.8-2.module+el8.1.0+4089+be929cf8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"golang-bin","fixed_in":["0:1.12.8-2.module+el8.1.0+4089+be929cf8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"golang-docs","fixed_in":["0:1.12.8-2.module+el8.1.0+4089+be929cf8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"golang-misc","fixed_in":["0:1.12.8-2.module+el8.1.0+4089+be929cf8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"golang-race","fixed_in":["0:1.12.8-2.module+el8.1.0+4089+be929cf8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"golang-src","fixed_in":["0:1.12.8-2.module+el8.1.0+4089+be929cf8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"golang-tests","fixed_in":["0:1.12.8-2.module+el8.1.0+4089+be929cf8"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.10","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.12.0"},{"fixed":"1.12.8-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.12.0"},{"fixed":"1.12.8-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.12.0"},{"fixed":"1.12.8-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.12.0"},{"fixed":"1.12.8-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.12.0"},{"fixed":"1.12.8-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.12.0"},{"fixed":"1.12.8-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.12.0"},{"fixed":"1.12.8-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.12.0"},{"fixed":"1.12.8-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.12.0"},{"fixed":"1.12.8-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.12.0"},{"fixed":"1.12.8-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.12.0"},{"fixed":"1.12.8-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.12.0"},{"fixed":"1.12.8-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.12.0"},{"fixed":"1.12.8-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.12.0"},{"fixed":"1.12.8-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.12.0"},{"fixed":"1.12.8-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.25.7-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.27.0"},{"last_affected":"1.27.1-1"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"golang-1.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.6-1+deb10u1"}]}],"versions":["1.11.6-1"],"bundled":3},{"source":"osv","ecosystem":"Go","package":"stdlib","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.11.13"},{"introduced":"1.12.0-0"},{"fixed":"1.12.8"}]}]},{"source":"osv","ecosystem":"Mageia:6","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.13-1.mga6"}]}],"bundled":3},{"source":"osv","ecosystem":"Mageia:7","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.8-1.mga7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:devtools:2019","package":"go-toolset-1.12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.8-2.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:devtools:2019","package":"go-toolset-1.12-build","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.8-2.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:devtools:2019","package":"go-toolset-1.12-golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.8-2.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:devtools:2019","package":"go-toolset-1.12-golang-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.8-2.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:devtools:2019","package":"go-toolset-1.12-golang-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.8-2.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:devtools:2019","package":"go-toolset-1.12-golang-misc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.8-2.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:devtools:2019","package":"go-toolset-1.12-golang-race","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.8-2.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:devtools:2019","package":"go-toolset-1.12-golang-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.8-2.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:devtools:2019","package":"go-toolset-1.12-golang-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.8-2.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:devtools:2019","package":"go-toolset-1.12-runtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.8-2.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"go-toolset","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.8-1.module+el8.1.0+4089+be929cf8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.8-2.module+el8.1.0+4089+be929cf8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"golang-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.8-2.module+el8.1.0+4089+be929cf8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"golang-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.8-2.module+el8.1.0+4089+be929cf8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"golang-misc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.8-2.module+el8.1.0+4089+be929cf8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"golang-race","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.8-2.module+el8.1.0+4089+be929cf8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"golang-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.8-2.module+el8.1.0+4089+be929cf8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"golang-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.8-2.module+el8.1.0+4089+be929cf8"}]}]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"golang-1.10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.10.4-2ubuntu1~14.04.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"golang-1.10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.10.4-2ubuntu1~16.04.1","1.10.4-2ubuntu1~16.04.2"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"golang-1.6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6-0ubuntu1","1.6-0ubuntu2","1.6-0ubuntu3","1.6-0ubuntu4","1.6-0ubuntu5","1.6.1-0ubuntu1","1.6.2-0ubuntu5~16.04","1.6.2-0ubuntu5~16.04.2","1.6.2-0ubuntu5~16.04.3","1.6.2-0ubuntu5~16.04.4"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"golang-1.10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.10~rc1-1","1.10~rc1-1ubuntu1","1.10~rc1-2ubuntu1","1.10~rc2-1ubuntu1","1.10-1ubuntu1","1.10.1-1ubuntu2","1.10.4-2ubuntu1~18.04.1","1.10.4-2ubuntu1~18.04.2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"golang-1.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.8.3-2ubuntu1","1.8.3-2ubuntu1.18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"golang-1.9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.9.1-2ubuntu1","1.9.2-1ubuntu1","1.9.2-3ubuntu1","1.9.3-1ubuntu1","1.9.4-1ubuntu1"]},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"go1.12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.9-lp151.2.9.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.0","package":"go1.12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.9-lp151.2.13.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"go1.12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.9-lp151.2.13.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.0","package":"go1.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.13-lp151.2.9.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"go1.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.13-lp151.2.9.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"go1.12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.9-lp151.2.17.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"go1.12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.9-lp151.2.21.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"go1.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.13-10.5"}]}],"bundled":15},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"go1.12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.17-4.8"}]}],"bundled":18}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"golang","product":"go"}],"references":[{"url":"https://groups.google.com/forum/#%21topic/golang-announce/0uuMm1BwpHE","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://groups.google.com/forum/#%21topic/golang-announce/65QixT3tcmg","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://github.com/golang/go/issues/29098","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Patch","Third Party Advisory","fix","article","report"]},{"url":"https://seclists.org/bugtraq/2019/Aug/31","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://www.debian.org/security/2019/dsa-4503","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00076.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00002.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00011.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LYO6E3H34C346D2E443GLXK7OK6KIYIQ/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4BBP27PZGSY6OP6D26E5FW4GZKBFHNU7/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00021.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00038.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"https://access.redhat.com/errata/RHSA-2019:3433","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-14809","tags":["web","advisory"]},{"url":"https://groups.google.com/forum/#!topic/golang-announce/0uuMm1BwpHE","tags":["report"]},{"url":"https://groups.google.com/forum/#!topic/golang-announce/65QixT3tcmg","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4BBP27PZGSY6OP6D26E5FW4GZKBFHNU7/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LYO6E3H34C346D2E443GLXK7OK6KIYIQ/"},{"url":"https://github.com/advisories/GHSA-2xf8-4fv6-m993"},{"url":"https://security.alpinelinux.org/vuln/CVE-2019-14809","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2019-14809","tags":["advisory"]},{"url":"https://go.dev/cl/189258","tags":["fix"]},{"url":"https://go.googlesource.com/go/+/61bb56ad63992a3199acc55b2537c8355ef887b6","tags":["fix"]},{"url":"https://go.dev/issue/29098","tags":["report"]},{"url":"https://groups.google.com/g/golang-announce/c/65QixT3tcmg","tags":["web"]},{"url":"https://advisories.mageia.org/MGASA-2019-0251.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=25372","tags":["report"]},{"url":"https://access.redhat.com/errata/RHEA-2019:4179","tags":["advisory"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_developer_tools/1/html/using_go_1.12.12_toolset/","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1709604","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1734784","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1741234","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhea-2019_4179.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-14809","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1743129","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-14809","tags":["advisory","report"]},{"url":"https://github.com/golang/go/commit/61bb56ad63992a3199acc55b2537c8355ef887b6","tags":["article"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.1_release_notes/","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1700109","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1709603","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_3433.json","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20192213-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1141688","tags":["report"]},{"url":"https://bugzilla.suse.com/1146111","tags":["report"]},{"url":"https://bugzilla.suse.com/1146115","tags":["report"]},{"url":"https://bugzilla.suse.com/1146123","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14809","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9512","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9514","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20192214-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1139210","tags":["report"]},{"url":"https://bugzilla.suse.com/1141689","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-14809","tags":["report"]},{"url":"https://github.com/golang/go/commit/c1d9ca70995dc232a2145e3214f94e03409f6fcc","tags":["report"]},{"url":"https://github.com/golang/go/commit/3226f2d492963d361af9dfc6714ef141ba606713","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/XQV7XTKIELHQ3WYN6US2FNRX7SHXE46J/#XQV7XTKIELHQ3WYN6US2FNRX7SHXE46J","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/LE2FKAGHX7TQTQPVJRI4PFRX7OYCDOCT/#LE2FKAGHX7TQTQPVJRI4PFRX7OYCDOCT","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/BI24YEOJ5PH7KNJKSQBX7VWR2MF4QCUT/#BI24YEOJ5PH7KNJKSQBX7VWR2MF4QCUT","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/CFMNCQ6JJUWWGAM7EXLET5I2K3DIJU5W/#CFMNCQ6JJUWWGAM7EXLET5I2K3DIJU5W","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/STTKQXKGK7AYG47JA3WXKGWSW6TYWICU/#STTKQXKGK7AYG47JA3WXKGWSW6TYWICU","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2014-7189","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8618","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3959","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5386","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-15041","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-15042","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-8932","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16873","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16874","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16875","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-6574","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-6486","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11888","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-16276","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-17596","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2019-14809","description":"net/url in Go before 1.11.13 and 1.12.x before 1.12.8 mishandles malformed hosts in URLs, leading to an authorization bypass in some applications. This is related to a Host field with a suffix appearing in neither Hostname() nor Port(), and is related to a non-numeric port number. For example, an attacker can compose a crafted javascript:// URL that results in a hostname of google.com.","status":"published","published":"2019-08-13T20:54:24Z","modified":"2024-08-05T00:26:39.12Z","updated_at":"2026-11-02T14:20:18.085548Z"}],"euvd":[{"id":"EUVD-2019-5938","description":"net/url in Go before 1.11.13 and 1.12.x before 1.12.8 mishandles malformed hosts in URLs, leading to an authorization bypass in some applications. This is related to a Host field with a suffix appearing in neither Hostname() nor Port(), and is related to a non-numeric port number. For example, an attacker can compose a crafted javascript:// URL that results in a hostname of google.com.","status":"published","published":"2019-08-13T20:54:24Z","modified":"2024-08-05T00:26:39Z","updated_at":"2026-11-03T02:40:38.166988Z"}],"ghsa":[{"id":"GHSA-2xf8-4fv6-m993","title":"net/url in Go before 1.11.13 and 1.12.x before 1.12.8 mishandles malformed hosts in URLs, leading...","description":"net/url in Go before 1.11.13 and 1.12.x before 1.12.8 mishandles malformed hosts in URLs, leading to an authorization bypass in some applications. This is related to a Host field with a suffix appearing in neither Hostname() nor Port(), and is related to a non-numeric port number. For example, an attacker can compose a crafted javascript:// URL that results in a hostname of google.com.","status":"published","published":"2022-05-24T16:53:16Z","modified":"2023-01-28T05:06:21Z","updated_at":"2026-11-02T14:44:25.86191Z"}],"nvd":[{"id":"CVE-2019-14809","description":"net/url in Go before 1.11.13 and 1.12.x before 1.12.8 mishandles malformed hosts in URLs, leading to an authorization bypass in some applications. This is related to a Host field with a suffix appearing in neither Hostname() nor Port(), and is related to a non-numeric port number. For example, an attacker can compose a crafted javascript:// URL that results in a hostname of google.com.","status":"published","published":"2019-08-13T21:15:11.427Z","modified":"2026-06-17T02:19:03.737Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"updated_at":"2026-11-02T14:05:22.878504Z"}],"osv":[{"id":"ALPINE-CVE-2019-14809","description":"net/url in Go before 1.11.13 and 1.12.x before 1.12.8 mishandles malformed hosts in URLs, leading to an authorization bypass in some applications. This is related to a Host field with a suffix appearing in neither Hostname() nor Port(), and is related to a non-numeric port number. For example, an attacker can compose a crafted javascript:// URL that results in a hostname of google.com.","status":"published","published":"2019-08-13T21:15:11.427Z","modified":"2026-11-03T06:32:29.221026685Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-03T07:17:41.158523Z"},{"id":"AZL-78948","title":"CVE-2019-14809 affecting package golang 1.25.7-1","description":"net/url in Go before 1.11.13 and 1.12.x before 1.12.8 mishandles malformed hosts in URLs, leading to an authorization bypass in some applications. This is related to a Host field with a suffix appearing in neither Hostname() nor Port(), and is related to a non-numeric port number. For example, an attacker can compose a crafted javascript:// URL that results in a hostname of google.com.","status":"published","published":"2019-08-13T21:15:11Z","modified":"2026-04-21T04:34:32.561883Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:28:10.017343Z"},{"id":"AZL-98907","title":"CVE-2019-14809 affecting package golang 1.27.1-1","description":"net/url in Go before 1.11.13 and 1.12.x before 1.12.8 mishandles malformed hosts in URLs, leading to an authorization bypass in some applications. This is related to a Host field with a suffix appearing in neither Hostname() nor Port(), and is related to a non-numeric port number. For example, an attacker can compose a crafted javascript:// URL that results in a hostname of google.com.","status":"published","published":"2019-08-13T21:15:11Z","modified":"2026-09-16T06:39:01Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:28:12.596039Z"},{"id":"BELL-CVE-2019-14809","title":"CVE-2019-14809 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:15:11.610109Z","modified":"2026-01-26T09:47:20.664541Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:28:15.340685Z"},{"id":"CVE-2019-14809","description":"net/url in Go before 1.11.13 and 1.12.x before 1.12.8 mishandles malformed hosts in URLs, leading to an authorization bypass in some applications. This is related to a Host field with a suffix appearing in neither Hostname() nor Port(), and is related to a non-numeric port number. For example, an attacker can compose a crafted javascript:// URL that results in a hostname of google.com.","status":"published","published":"2019-08-13T21:15:11.427Z","modified":"2026-10-20T10:52:22.348704382Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:11.029493Z"},{"id":"RHEA-2019:4179","title":"Red Hat Enhancement Advisory: new packages: go-toolset-1.12","status":"published","published":"2024-09-13T16:11:59Z","modified":"2026-06-29T10:23:27Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:58.636919Z"},{"id":"RHSA-2019:3433","title":"Red Hat Security Advisory: go-toolset:rhel8 security, bug fix, and enhancement update","status":"published","published":"2024-09-13T16:14:08Z","modified":"2026-06-29T10:27:19Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:06.0195Z"},{"id":"UBUNTU-CVE-2019-14809","description":"net/url in Go before 1.11.13 and 1.12.x before 1.12.8 mishandles malformed hosts in URLs, leading to an authorization bypass in some applications. This is related to a Host field with a suffix appearing in neither Hostname() nor Port(), and is related to a non-numeric port number. For example, an attacker can compose a crafted javascript:// URL that results in a hostname of google.com.","status":"published","published":"2019-08-13T21:15:00Z","modified":"2025-10-24T04:47:45Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:19.6877Z"},{"id":"DSA-4503-1","title":"golang-1.11 - security update","status":"published","published":"2019-08-18T00:00:00Z","modified":"2026-03-09T02:09:43.131701Z","updated_at":"2026-11-02T15:46:16.862196Z"},{"id":"GO-2022-0211","title":"Incorrect parsing validation in net/url","description":"The url.Parse function accepts URLs with malformed hosts, such that the Host field can have arbitrary suffixes that appear in neither Hostname() nor Port(), allowing authorization bypasses in certain applications.","status":"published","published":"2022-07-01T20:15:30Z","modified":"2024-05-20T16:03:47Z","updated_at":"2026-11-02T15:47:00.604718Z"},{"id":"MGASA-2019-0251","title":"Updated golang packages fix security vulnerabilities","description":"Updated golang packages fix security vulnerabilities:\n\nSome HTTP/2 implementations are vulnerable to ping floods, potentially\nleading to a denial of service. The attacker sends continual pings to an\nHTTP/2 peer, causing the peer to build an internal queue of responses.\nDepending on how efficiently this data is queued, this can consume excess\nCPU, memory, or both (CVE-2019-9512)\n\nSome HTTP/2 implementations are vulnerable to a reset flood, potentially\nleading to a denial of service. The attacker opens a number of streams and\nsends an invalid request over each stream that should solicit a stream of\nRST_STREAM frames from the peer. Depending on how the peer queues the\nRST_STREAM frames, this can consume excess memory, CPU, or both\n(CVE-2019-9514).\n\nnet/url in Go before 1.11.13 and 1.12.x before 1.12.8 mishandles malformed\nhosts in URLs, leading to an authorization bypass in some applications.\nThis is related to a Host field with a suffix appearing in neither\nHostname() nor Port(), and is related to a non-numeric port number.\n(CVE-2019-14809)\n","status":"published","published":"2019-09-06T21:09:08Z","modified":"2026-04-16T04:40:39.059708327Z","updated_at":"2026-11-02T15:49:40.793816Z"},{"id":"openSUSE-SU-2019:2000-1","title":"Security update for go1.12","description":"This update for go1.12 fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2019-9512: Fixed HTTP/2 flood using PING frames that results in unbounded memory growth. (bsc#1146111)\n- CVE-2019-9514: Fixed HTTP/2 implementation is vulnerable to a reset flood, potentially leading to a denial of service. (bsc#1146115)\n- CVE-2019-14809: Fixed authorization bypass due to malformed hosts in URLs. (bsc#1146123)\n","status":"published","published":"2019-08-24T12:18:42Z","modified":"2026-02-04T04:32:46.47104Z","updated_at":"2026-11-02T16:58:30.784344Z"},{"id":"openSUSE-SU-2019:2056-1","title":"Security update for go1.12","description":"This update for go1.12 fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2019-9512: Fixed HTTP/2 flood using PING frames that results in unbounded memory growth (bsc#1146111).\n- CVE-2019-9514: Fixed HTTP/2 implementation that is vulnerable to a reset flood, potentially leading to a denial of service (bsc#1146115).\n- CVE-2019-14809: Fixed malformed hosts in URLs that leads to authorization bypass (bsc#1146123).\n\nBugfixes:\n\n- Update to go version 1.12.9 (bsc#1141689).\n- Adding Web Assembly stuff from misc/wasm (bsc#1139210).\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2019-09-02T12:21:15Z","modified":"2026-02-04T03:38:08.473369Z","updated_at":"2026-11-02T16:58:30.784344Z"},{"id":"openSUSE-SU-2019:2072-1","title":"Security update for go1.11","description":"This update for go1.11 fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2019-9512: Fixed HTTP/2 flood using PING frames that results in unbounded memory growth (bsc#1146111).\n- CVE-2019-9514: Fixed HTTP/2 implementation that is vulnerable to a reset flood, potentially leading to a denial of service (bsc#1146115).\n- CVE-2019-14809: Fixed malformed hosts in URLs that leads to authorization bypass (bsc#1146123).\n\nBugfixes:\n\n- Update to go version 1.11.13 (bsc#1141688).\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2019-09-05T08:24:15Z","modified":"2026-02-04T02:51:46.943426Z","updated_at":"2026-11-02T16:58:30.784344Z"},{"id":"openSUSE-SU-2019:2085-1","title":"Security update for go1.12","description":"This update for go1.12 fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2019-9512: Fixed HTTP/2 flood using PING frames that results in unbounded memory growth (bsc#1146111).\n- CVE-2019-9514: Fixed HTTP/2 implementation that is vulnerable to a reset flood, potentially leading to a denial of service (bsc#1146115).\n- CVE-2019-14809: Fixed malformed hosts in URLs that leads to authorization bypass (bsc#1146123).\n\nBugfixes:\n\n- Update to go version 1.12.9 (bsc#1141689).\n- Adding Web Assembly stuff from misc/wasm (bsc#1139210).\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2019-09-07T14:22:30Z","modified":"2026-02-04T04:16:51.887099Z","updated_at":"2026-11-02T16:58:30.784344Z"},{"id":"openSUSE-SU-2019:2130-1","title":"Security update for go1.12","description":"This update for go1.12 fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2019-9512: Fixed HTTP/2 flood using PING frames that results in unbounded memory growth (bsc#1146111).\n- CVE-2019-9514: Fixed HTTP/2 implementation that is vulnerable to a reset flood, potentially leading to a denial of service (bsc#1146115).\n- CVE-2019-14809: Fixed malformed hosts in URLs that leads to authorization bypass (bsc#1146123).\n\nBugfixes:\n\n- Update to go version 1.12.9 (bsc#1141689).\n- Adding Web Assembly stuff from misc/wasm (bsc#1139210).\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2019-09-14T12:16:57Z","modified":"2026-02-04T03:11:27.978441Z","updated_at":"2026-11-02T16:58:30.784344Z"},{"id":"openSUSE-SU-2024:10804-1","title":"go1.11-1.11.13-10.5 on GA media","description":"These are all security issues fixed in the go1.11-1.11.13-10.5 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:13:47.136272Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"openSUSE-SU-2024:10805-1","title":"go1.12-1.12.17-4.8 on GA media","description":"These are all security issues fixed in the go1.12-1.12.17-4.8 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:28:31.331263Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"SUSE-SU-2019:2213-1","title":"Security update for go1.11","description":"This update for go1.11 fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2019-9512: Fixed HTTP/2 flood using PING frames that results in unbounded memory growth (bsc#1146111).\n- CVE-2019-9514: Fixed HTTP/2 implementation that is vulnerable to a reset flood, potentially leading to a denial of service (bsc#1146115).\n- CVE-2019-14809: Fixed malformed hosts in URLs that leads to authorization bypass (bsc#1146123).\n\nBugfixes:\n\n- Update to go version 1.11.13 (bsc#1141688).\n","status":"published","published":"2019-08-23T12:47:18Z","modified":"2026-02-04T04:29:23.039433Z","updated_at":"2026-11-02T15:53:46.44301Z"},{"id":"SUSE-SU-2019:2214-1","title":"Security update for go1.12","description":"This update for go1.12 fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2019-9512: Fixed HTTP/2 flood using PING frames that results in unbounded memory growth (bsc#1146111).\n- CVE-2019-9514: Fixed HTTP/2 implementation that is vulnerable to a reset flood, potentially leading to a denial of service (bsc#1146115).\n- CVE-2019-14809: Fixed malformed hosts in URLs that leads to authorization bypass (bsc#1146123).\n\nBugfixes:\n\n- Update to go version 1.12.9 (bsc#1141689).\n- Adding Web Assembly stuff from misc/wasm (bsc#1139210).\n","status":"published","published":"2019-08-23T12:47:33Z","modified":"2026-02-04T03:36:57.039624Z","updated_at":"2026-11-02T15:53:46.44301Z"}]}}