Skip to content
OpenAdvisories
High · 7.5 CVE-2023-24623 EUVD-2023-0556GHSA-v9mp-j8g7-2q6mGO-2023-1526

Paranoidhttp Server-Side Request Forgery vulnerability

Published Jan 30, 2023 · Updated Mar 28, 2025 · Assigned by mitre

Package: github.com/hakobe/paranoidhttp Ecosystem: Go

Description

Paranoidhttp before 0.3.0 allows SSRF because [::] is equivalent to the 127.0.0.1 address, but does not match the filter for private addresses.

Affected packages

EcosystemPackageAffectedFixedRecord
Go github.com/hakobe/paranoidhttp < 0.3.0 0.3.0 GHSA-v9mp-j8g7-2q6m

References