Go/github.com/swaggo/http-swagger CVE-2022-24863, CVE-2024-25712: high 7.5, EPSS 2.44%

Denial of Service in http-swagger

Action: Upgrade github.com/swaggo/http-swagger to 1.2.6 or later.

go get github.com/swaggo/http-swagger@v1.2.6

Affected

Fixed versions

Sources

• osv: GHSA-xg75-q3q5-cqmv
• https://github.com/swaggo/http-swagger/security/advisories/GHSA-xg75-q3q5-cqmv
• https://nvd.nist.gov/vuln/detail/CVE-2022-24863
• https://github.com/swaggo/http-swagger/pull/62
• https://github.com/swaggo/http-swagger/commit/b7d83e8fba85a7a51aa7e45e8244b4173f15049e
• https://cosmosofcyberspace.github.io/improper_http_method_leads_to_xss/poc.html
• https://github.com/swaggo/http-swagger
• https://github.com/swaggo/http-swagger/releases/tag/v1.2.6

CVE-2022-24863, CVE-2024-25712 · published 2022-04-22T20:55:52Z · modified 2024-03-04T18:35:26Z · JSON