Detections
Analytics

Google: dev-lang/go: security update to 17162.127.5

high Tenable Cloud Security Plugin ID 452867

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Requests forwarded by ReverseProxy include the raw query parameters from the inbound request, including
 unparsable parameters rejected by net/http. This could permit query parameter smuggling when a Go proxy
 forwards a parameter with an unparsable value. After fix, ReverseProxy sanitizes the query parameters in
 the forwarded query when the outbound request's Form field is set after the ReverseProxy. Director
 function returns, indicating that the proxy has parsed the query parameters. Proxies which do not parse
 query parameters continue to forward the original query parameters unchanged. (CVE-2022-2880)

Solution

Update the dev-lang/go library and its related packages to version 17162.127.5 or later.

See Also

https://storage.googleapis.com/cos-oval-vulnerability-feed/cos-101.oval.xml.tar.gz

Plugin Details

Severity: High

ID: 452867

Version: Revision 1.1

Type: Local

Published: 10/1/2026

Updated: 10/1/2026

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.18

Vendor

Vendor Severity: HIGH

CVSS v2

Risk Factor: High

Base Score: 7.8

Temporal Score: 6.1

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:C/A:N

CVSS Score Source: CVE-2022-2880

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.7

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Vulnerability Publication Date: 10/4/2022

Reference Information

CVE: CVE-2022-2880