CVE-2022-2583 Race condition in github.com/ntbosscher/gobase

Low 3.7 Published 27 Dec 2022 Updated 11 Apr 2025

A race condition in the Go authentication library can lead to incorrect HTTP request routing, potentially allowing unauthorized access.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2022-2583?

CVE-2022-2583 is a low-severity vulnerability in github.com/ntbosscher/gobase/auth/httpauth, published on 27 Dec 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A race condition can cause incorrect HTTP request routing.

Weakness: CWE-362

Which versions are affected by CVE-2022-2583?

5 open source packages ship an affected version, including github.com/ntbosscher/gobase. It affects 1 product.

Package	Affected	Fixed in
`github.com/ntbosscher/gobase` Go	All versions	`0.7.2`
`github.com/ntbosscher/gobase` Go	All versions	`0.7.2`
`github.com/ntbosscher/gobase` Go	All versions	`0.7.2`
`github.com/ntbosscher/gobase` Go	All versions	`0.7.2`
`github.com/ntbosscher/gobase` Go	All versions	`0.7.2`

Products include Gobase Project Gobase.

How do I fix CVE-2022-2583?

Upgrade github.com/ntbosscher/gobase to 0.7.2 or later.

Is CVE-2022-2583 being exploited?

There is no known exploitation of CVE-2022-2583 in the wild and no public exploit code.

Sources

Also known as GHSA-4348-x292-h437, GHSA-h2x7-2ff6-v32p, GO-2022-0400.