Description
The req package before 3.43.4 for Go may send an unintended request when a malformed URL is provided, because cleanHost in http.go intentionally uses a "garbage in, garbage out" design.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/imroc/req | < 3.43.4 | 3.43.4 | GHSA-cj55-gc7m-wvcq |
| Go | github.com/imroc/req | all versions | — | GO-2024-3098 |
| Go | github.com/imroc/req/v2 | < 3.43.4 | 3.43.4 | GHSA-cj55-gc7m-wvcq |
| Go | github.com/imroc/req/v2 | all versions | — | GO-2024-3098 |
| Go | github.com/imroc/req/v3 | < 3.43.4 | 3.43.4 | GHSA-cj55-gc7m-wvcq |