CVE-2021-33197

Name of the Vulnerable Software and Affected Versions Go versions 1.15.12 and earlier Go versions 1.16.x before 1.16.5

Description The issue is related to the ReverseProxy component from net/http/httputil in the Go programming language, which can result in a situation where an attacker can drop arbitrary headers. This can occur when the ReverseProxy is configured in a certain way, allowing an attacker to influence the integrity of data. The vulnerability can be exploited by a remote attacker.

Recommendations For Go versions 1.15.12 and earlier, update to version 1.15.13 or later. For Go versions 1.16.x before 1.16.5, update to version 1.16.5 or later. As a temporary workaround, consider restricting the use of the ReverseProxy component until a patch is available.