{"id":"CVE-2020-28483","aliases":["DEBIAN-CVE-2020-28483","EUVD-2021-1332","GHSA-h395-qcrw-5vmq","GO-2021-0052","SNYK-GOLANG-GITHUBCOMGINGONICGIN-1041736","UBUNTU-CVE-2020-28483"],"status":"published","title":"HTTP Response Splitting","description":"This affects all versions of package github.com/gin-gonic/gin. When gin is exposed directly to the internet, a client's IP can be spoofed by setting the X-Forwarded-For header.","severity":{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.01332,"percentile":0.71492,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-113","CWE-444"],"published":"2021-01-20T17:46:29Z","modified":"2026-10-26T12:02:42Z","fixes":[{"ecosystem":"Go","package":"github.com/gin-gonic/gin","fixed_in":["1.7.7"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"golang-github-gin-gonic-gin","fixed_in":["1.8.1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"golang-github-gin-gonic-gin","fixed_in":["1.8.1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"golang-github-gin-gonic-gin","fixed_in":["1.8.1-1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/gin-gonic/gin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.7"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"golang-github-gin-gonic-gin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"golang-github-gin-gonic-gin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"golang-github-gin-gonic-gin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.1-1"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/gin-gonic/gin","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.7.7"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/gin-gonic/gin","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.7.7"}]}]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"golang-github-gin-gonic-gin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2+dfsg1-2","1.2+dfsg1-2ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"golang-github-gin-gonic-gin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.0+dfsg1-3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"golang-github-gin-gonic-gin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6.3-4"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"golang-github-gin-gonic-gin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.8.1-1","1.8.1-2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"golang-github-gin-gonic-gin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.8.1-2","1.8.1-3"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"golang-github-gin-gonic-gin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.8.1-3","1.8.1-4"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"golang-github-gin-gonic-gin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.8.1-3"]}],"products":[{"vendor":"gin-gonic","product":"gin"},{"vendor":"github.com/gin-gonic/gin","product":"github.com/gin-gonic/gin"}],"references":[{"url":"https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGINGONICGIN-1041736","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web","report"]},{"url":"https://github.com/gin-gonic/gin/pull/2474%23issuecomment-729696437","tags":["x_refsource_MISC","x_transferred","Broken Link","fix","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-28483","tags":["advisory"]},{"url":"https://github.com/gin-gonic/gin/pull/2632","tags":["web","fix","report"]},{"url":"https://github.com/gin-gonic/gin/commit/bfc8ca285eb46dad60e037d57c545cd260636711","tags":["web","fix"]},{"url":"https://github.com/gin-gonic/gin/releases/tag/v1.7.0","tags":["web"]},{"url":"https://github.com/gin-gonic/gin/issues/2232","tags":["web","report"]},{"url":"https://github.com/gin-gonic/gin/issues/2473","tags":["web","report"]},{"url":"https://github.com/gin-gonic/gin/issues/2862","tags":["web","report"]},{"url":"https://github.com/gin-gonic/gin/pull/2474#23issuecomment-729696437","tags":["web"]},{"url":"https://github.com/gin-gonic/gin/pull/2675","tags":["web","fix"]},{"url":"https://github.com/gin-gonic/gin/pull/2844","tags":["web","fix","report"]},{"url":"https://github.com/gin-gonic/gin/commit/03e5e05ae089bc989f1ca41841f05504d29e3fd9","tags":["web","fix"]},{"url":"https://github.com/gin-gonic/gin/commit/5929d521715610c9dd14898ebbe1d188d5de8937","tags":["web","fix"]},{"url":"https://github.com/gin-gonic/gin/releases/tag/v1.7.7","tags":["web"]},{"url":"https://pkg.go.dev/vuln/GO-2021-0052","tags":["web"]},{"url":"https://github.com/gin-gonic/gin/pull/2844/files#diff-e6ce689a25eaef174c2dd51fe869fabbe04a6c6afbd416b23eda138c82e761baR1432","tags":["web"]},{"url":"https://github.com/gin-gonic/gin/pull/2474","tags":["web"]},{"url":"https://github.com/advisories/GHSA-h395-qcrw-5vmq"},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-28483","tags":["advisory"]},{"url":"https://github.com/gin-gonic/gin","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2020-28483","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-28483","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2020-28483","title":"HTTP Response Splitting","description":"This affects all versions of package github.com/gin-gonic/gin. When gin is exposed directly to the internet, a client's IP can be spoofed by setting the X-Forwarded-For header.","status":"published","published":"2021-01-20T17:46:29.476Z","modified":"2024-09-16T17:28:31.192Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N","level":"high","assessor":"cna"}],"updated_at":"2026-11-02T14:35:57.017407Z"}],"euvd":[{"id":"EUVD-2021-1332","description":"This affects all versions of package github.com/gin-gonic/gin. When gin is exposed directly to the internet, a client's IP can be spoofed by setting the X-Forwarded-For header.","status":"published","published":"2021-01-20T17:46:29Z","modified":"2024-09-16T17:28:31Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N","level":"high"}],"updated_at":"2026-11-03T00:55:41.925187Z"}],"ghsa":[{"id":"GHSA-h395-qcrw-5vmq","title":"Inconsistent Interpretation of HTTP Requests in github.com/gin-gonic/gin","description":"When gin is exposed directly to the internet, a client's IP can be spoofed by setting the X-Forwarded-For header. This affects all versions of package github.com/gin-gonic/gin under 1.7.7. ","status":"published","published":"2021-06-23T17:53:21Z","modified":"2024-05-20T19:29:08Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N","level":"high"}],"cwes":["CWE-113","CWE-444"],"updated_at":"2026-11-02T14:37:50.750599Z"}],"nvd":[{"id":"CVE-2020-28483","description":"This affects all versions of package github.com/gin-gonic/gin. When gin is exposed directly to the internet, a client's IP can be spoofed by setting the X-Forwarded-For header.","status":"published","published":"2021-01-20T18:15:12.517Z","modified":"2026-06-17T03:10:31.587Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N","level":"high","assessor":"secondary"},{"version":"2.0","score":5.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-444"],"updated_at":"2026-11-02T14:06:30.596418Z"}],"osv":[{"id":"CVE-2020-28483","description":"This affects all versions of package github.com/gin-gonic/gin. When gin is exposed directly to the internet, a client's IP can be spoofed by setting the X-Forwarded-For header.","status":"published","published":"2021-01-20T18:15:12.517Z","modified":"2026-10-24T10:30:38.353912405Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:16.248747Z"},{"id":"DEBIAN-CVE-2020-28483","description":"This affects all versions of package github.com/gin-gonic/gin. When gin is exposed directly to the internet, a client's IP can be spoofed by setting the X-Forwarded-For header.","status":"published","published":"2021-01-20T18:15:12.517Z","modified":"2026-10-26T12:02:42.840345136Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:34.019707Z"},{"id":"GHSA-h395-qcrw-5vmq","title":"Inconsistent Interpretation of HTTP Requests in github.com/gin-gonic/gin","description":"When gin is exposed directly to the internet, a client's IP can be spoofed by setting the X-Forwarded-For header. This affects all versions of package github.com/gin-gonic/gin under 1.7.7. ","status":"published","published":"2021-06-23T17:53:21Z","modified":"2026-09-10T03:49:05.801847827Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N","level":"high"}],"cwes":["CWE-113","CWE-444"],"updated_at":"2026-11-02T15:46:48.546324Z"},{"id":"UBUNTU-CVE-2020-28483","description":"This affects all versions of package github.com/gin-gonic/gin. When gin is exposed directly to the internet, a client's IP can be spoofed by setting the X-Forwarded-For header.","status":"published","published":"2021-01-20T18:15:00Z","modified":"2026-10-17T12:55:52.95009764Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N","level":"high"}],"updated_at":"2026-11-02T15:54:24.541803Z"},{"id":"GO-2021-0052","title":"Inconsistent interpretation of HTTP Requests in github.com/gin-gonic/gin","description":"Due to improper HTTP header sanitization, a malicious user can spoof their source IP address by setting the X-Forwarded-For header. This may allow a user to bypass IP based restrictions, or obfuscate their true source.","status":"published","published":"2021-04-14T20:04:52Z","modified":"2026-07-08T05:56:36.895132392Z","updated_at":"2026-11-02T15:47:00.604718Z"}]}}