Go/github.com/oauth2-proxy/oauth2-proxy CVE-2025-64484: high 8.5, EPSS 0.66%
OAuth2-Proxy is vulnerable to header smuggling via underscore leading to potential privilege escalation in github.com/oauth2-proxy/oauth2-proxy
Action: No fix published. Pin and monitor.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | - | - |
Fixed versions
No fixed version in the source.
Sources
- osv: GO-2025-4113
- nvd: CVE-2025-64484
- https://github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-vjrc-mh2v-45x6
- https://github.com/oauth2-proxy/oauth2-proxy/commit/f3f30fa976fb4bb97d6345ba4735cb6d86e24f95
- https://datatracker.ietf.org/doc/html/rfc2616#section-4.2
- https://datatracker.ietf.org/doc/html/rfc822#section-3.2
- https://github.com/oauth2-proxy/oauth2-proxy/releases/tag/v7.13.0
- https://github.security.telekom.com/2020/05/smuggling-http-headers-through-reverse-proxies.html
- https://www.uptimia.com/questions/why-are-http-headers-with-underscores-dropped-by-nginx
CVE-2025-64484 · published · modified · JSON