Description
The net/http package in Go through 1.6 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect a CGI application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | golang-1.6 | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | golang +5 | 1.6.3-1.el7_2.1 | RHSA-2016:1538 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE Package Hub 12 | go | 1.6.1-6.1 | openSUSE-SU-2016:2055-1, openSUSE-SU-2016:2054-1 |
| SUSE Package Hub 12 | go1.4 | 1.4.3-6.1 | openSUSE-SU-2016:2536-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | go | 1.17-1.1 | openSUSE-SU-2024:10802-1 |
| openSUSE Tumbleweed | go1.10 | 1.10.8-8.2 | openSUSE-SU-2024:10803-1 |
| openSUSE Tumbleweed | go1.11 | 1.11.13-10.5 | openSUSE-SU-2024:10804-1 |
| openSUSE Tumbleweed | go1.12 | 1.12.17-4.8 | openSUSE-SU-2024:10805-1 |
| openSUSE Tumbleweed | go1.4 | 1.4.3-12.2 | openSUSE-SU-2024:10811-1 |
| openSUSE Tumbleweed | go1.9 | 1.9.7-11.2 | openSUSE-SU-2024:10812-1 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | golang | No fix yet | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 7 | golang +5 | 1.6.3-1.el7_2.1 | ELSA-2016-1538 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | stdlib | < 1.6.3 | 1.6.3 | GO-2022-0761 |
Advisories 12
- RHSA-2016:1538 Red Hat Security Advisory: golang security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · May 13, 2026
- openSUSE-SU-2024:10811-1 go1.4-1.4.3-12.2 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10803-1 go1.10-1.10.8-8.2 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10812-1 go1.9-1.9.7-11.2 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2016:2536-1 Security update to go1.4 SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2016:2055-1 security update for go SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10804-1 go1.11-1.11.13-10.5 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2016:2054-1 security update for go SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10805-1 go1.12-1.12.17-4.8 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2025-2522 Mehrere Webserver: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen BSI CERT-Bund (WID) · Nov 10, 2025
- openSUSE-SU-2024:10802-1 go-1.17-1.1 on GA media SUSE / openSUSE Security Updates · May 7, 2025
- ELSA-2016-1538 Moderate: golang security, bug fix, and enhancement update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Aug 2, 2016
References
- VU#797896 third-party-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1353798
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html
- FEDORA-2016-340e361b90 vendor-advisory
- FEDORA-2016-ea5e284d34 vendor-advisory
- RHSA-2016:1538 vendor-advisory
- https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03770en_us
- https://httpoxy.org/
- http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html