github.com/gin-gonic/gin
Go5 known CVEs affecting this package
Aggregated from OSV, GitHub Security Advisories, NVD, and vendor advisories. Each CVE links to its full detail page with vendor advisories, patches, fixed versions, and remediation guidance.
CVEs affecting github.com/gin-gonic/ginpage 1 of 1
- CVE-2019-25211CRITICALCVSS 9.1EG 9.1fixed in 1.6.02024-06-29
parseWildcardRules in Gin-Gonic CORS middleware before 1.6.0 mishandles a wildcard at the end of an origin string, e.g., https://example.community/* is allowed when the intention is that only https://example.com/* should be allowed, and ht…
- CVE-2020-28483HIGHCVSS 7.1EG 7.1fixed in 1.7.72021-01-20
This affects all versions of package github.com/gin-gonic/gin. When gin is exposed directly to the internet, a client's IP can be spoofed by setting the X-Forwarded-For header.
- CVE-2020-36567HIGHCVSS 7.5EG 7.5fixed in 1.6.02022-12-27
Unsanitized input in the default logger in github.com/gin-gonic/gin before v1.6.0 allows remote attackers to inject arbitrary log lines.
- CVE-2023-26125MEDIUMCVSS 5.6EG 5.6fixed in 1.9.02023-05-04
Versions of the package github.com/gin-gonic/gin before 1.9.0 are vulnerable to Improper Input Validation by allowing an attacker to use a specially crafted request via the X-Forwarded-Prefix header, potentially leading to cache poisoning.…
- CVE-2023-29401MEDIUMCVSS 4.3EG 4.3fixed in 1.9.12023-06-08
The filename parameter of the Context.FileAttachment function is not properly sanitized. A maliciously crafted filename can cause the Content-Disposition header to be sent with an unexpected filename value or otherwise modify the Content-D…
Check whether github.com/gin-gonic/gin is used in your infrastructure
EchelonGraph scans your cloud and SBOMs to map every package to your actual deployments. See blast radius for github.com/gin-gonic/gin CVEs against the assets you own.
Book a Demo →