{"id":"GHSA-x477-fq37-q5wr","aliases":["GO-2023-1524"],"status":"published","title":"Initial debug-host handler implementation could leak information and facilitate denial of service","description":"### Impact\nversion 1.5.0 and 1.6.0 when using the new `debug-host` feature could expose unnecessary information about the host\n\n### Patches\nUse 1.6.1 or newer\n\n### Workarounds\nDowngrade to 1.4.0 or set `debug-host` to empty\n\n### References\nhttps://github.com/fortio/proxy/pull/38\n\nQ\u0026A https://github.com/fortio/proxy/discussions","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200"],"published":"2023-01-27T00:55:27Z","modified":"2026-03-03T04:53:15Z","fixes":[{"ecosystem":"Go","package":"fortio.org/proxy","fixed_in":["1.6.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"fortio.org/proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.5.0"},{"fixed":"1.6.1"}]}]},{"source":"osv","ecosystem":"Go","package":"fortio.org/proxy","ranges":[{"type":"SEMVER","events":[{"introduced":"1.5.0"},{"fixed":"1.6.1"}]}]},{"source":"osv","ecosystem":"Go","package":"fortio.org/proxy","ranges":[{"type":"SEMVER","events":[{"introduced":"1.5.0"},{"fixed":"1.6.1"}]}]}],"references":[{"url":"https://github.com/fortio/proxy/security/advisories/GHSA-x477-fq37-q5wr","tags":["web","advisory"]},{"url":"https://github.com/fortio/proxy/pull/38","tags":["web"]},{"url":"https://github.com/advisories/GHSA-x477-fq37-q5wr"},{"url":"https://github.com/fortio/proxy","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-x477-fq37-q5wr","title":"Initial debug-host handler implementation could leak information and facilitate denial of service","description":"### Impact\nversion 1.5.0 and 1.6.0 when using the new `debug-host` feature could expose unnecessary information about the host\n\n### Patches\nUse 1.6.1 or newer\n\n### Workarounds\nDowngrade to 1.4.0 or set `debug-host` to empty\n\n### References\nhttps://github.com/fortio/proxy/pull/38\n\nQ\u0026A https://github.com/fortio/proxy/discussions","status":"published","published":"2023-01-27T00:55:27Z","modified":"2023-01-27T00:55:28Z","cwes":["CWE-200"],"updated_at":"2026-11-02T14:36:14.825433Z"}],"osv":[{"id":"GHSA-x477-fq37-q5wr","title":"Initial debug-host handler implementation could leak information and facilitate denial of service","description":"### Impact\nversion 1.5.0 and 1.6.0 when using the new `debug-host` feature could expose unnecessary information about the host\n\n### Patches\nUse 1.6.1 or newer\n\n### Workarounds\nDowngrade to 1.4.0 or set `debug-host` to empty\n\n### References\nhttps://github.com/fortio/proxy/pull/38\n\nQ\u0026A https://github.com/fortio/proxy/discussions","status":"published","published":"2023-01-27T00:55:27Z","modified":"2024-08-20T20:59:07.170624Z","cwes":["CWE-200"],"updated_at":"2026-11-02T15:46:59.484835Z"},{"id":"GO-2023-1524","title":"Initial debug-host handler implementation could leak information and facilitate denial of service in fortio.org/proxy","description":"Initial debug-host handler implementation could leak information and facilitate denial of service in fortio.org/proxy","status":"published","published":"2024-08-20T20:26:01Z","modified":"2026-03-03T04:53:15.70038Z","updated_at":"2026-11-02T15:47:01.185262Z"}]}}