Vulnerability · Published Nov 28, 2023 · Assigned by Go
CVE-2023-45286HTTP request body disclosure in github.com/go-resty/resty/v2
Medium 5.9
In plain English
A medium-severity security flaw in github.com/go-resty/resty/v2 from github.com/go-resty/resty/v2. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 54% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
A race condition in go-resty can result in HTTP request body disclosure across requests. This condition can be triggered by calling sync.Pool.Put with the same *bytes.Buffer more than once, when request retries are enabled and a retry occurs. The call to sync.Pool.Get will then return a bytes.Buffer that hasn't had bytes.Buffer.Reset called on it. This dirty buffer will contain the HTTP request body from an unrelated request, and go-resty will append the current HTTP request body to it, sending two bodies in one request. The sync.Pool in question is defined at package level scope, so a completely unrelated server could receive the request body.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | golang-github-go-resty-resty | no fix listed | DEBIAN-CVE-2023-45286 |
| Debian:13 | golang-github-go-resty-resty | 2.10.0-2 | DEBIAN-CVE-2023-45286 |
| Debian:14 | golang-github-go-resty-resty | 2.10.0-2 | DEBIAN-CVE-2023-45286 |
| Go | github.com/go-resty/resty/v2 | 2.11.0 | GHSA-xwh9-gc39-5298 |
| Go | github.com/go-resty/resty/v2 | 2.11.0 | GO-2023-2328 |
| Ubuntu:22.04:LTS | golang-github-go-resty-resty | no fix listed | UBUNTU-CVE-2023-45286 |
| Ubuntu:24.04:LTS | golang-github-go-resty-resty | no fix listed | UBUNTU-CVE-2023-45286 |
| Ubuntu:25.10 | golang-github-go-resty-resty | no fix listed | UBUNTU-CVE-2023-45286 |
| Ubuntu:26.04:LTS | golang-github-go-resty-resty | no fix listed | UBUNTU-CVE-2023-45286 |
| Ubuntu:26.10 | golang-github-go-resty-resty | no fix listed | UBUNTU-CVE-2023-45286 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| github.com/go-resty/resty/v2 | github.com/go-resty/resty/v2 | 2.10.0 – before 2.11.0 |