CVE-2023-45286 HTTP request body disclosure in github.com/go-resty/resty/v2

What is CVE-2023-45286?

CVE-2023-45286 is a medium-severity vulnerability in github.com/go-resty/resty/v2, published on 28 Nov 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A race condition in go-resty can result in HTTP request body disclosure across requests. This condition can be triggered by calling sync.Pool.Put with the same *bytes.Buffer more than once, when request retries are enabled and a retry occurs. The call to sync.Pool.Get will then return a bytes.Buffer that hasn't had bytes.Buffer.Reset called on it. This dirty buffer will contain the HTTP request body from an unrelated request, and go-resty will append the current HTTP request body to it, sending two bodies in one request. The sync.Pool in question is defined at package level scope, so a completely unrelated server could receive the request body.

Weakness: CWE-362

Which versions are affected by CVE-2023-45286?

3 open source packages ship an affected version, including github.com/go-resty/resty/v2. It affects 1 product.

Products include Resty Project Resty.

How do I fix CVE-2023-45286?

Upgrade github.com/go-resty/resty/v2 to 2.11.0 or later.

Is CVE-2023-45286 being exploited?

There is no known exploitation of CVE-2023-45286 in the wild and no public exploit code.

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as AZL-32050, DEBIAN-CVE-2023-45286, GHSA-xwh9-gc39-5298, GO-2023-2328, UBUNTU-CVE-2023-45286.