CVE-2025-64484
3 advisories.
Go/github.com/oauth2-proxy/oauth2-proxy/v7 CVE-2025-64484: high 8.5
OAuth2-Proxy is vulnerable to header smuggling via underscore leading to potential privilege escalation
Action: Upgrade github.com/oauth2-proxy/oauth2-proxy/v7 to 7.13.0 or later.
go get github.com/oauth2-proxy/oauth2-proxy/v7@v7.13.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 7.13.0 | - |
Fixed versions
| 7.13.0 |
Sources
- osv: GHSA-vjrc-mh2v-45x6
- https://github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-vjrc-mh2v-45x6
- https://nvd.nist.gov/vuln/detail/CVE-2025-64484
- https://github.com/oauth2-proxy/oauth2-proxy/commit/f3f30fa976fb4bb97d6345ba4735cb6d86e24f95
- https://datatracker.ietf.org/doc/html/rfc2616#section-4.2
- https://datatracker.ietf.org/doc/html/rfc822#section-3.2
- https://github.com/oauth2-proxy/oauth2-proxy
- https://github.com/oauth2-proxy/oauth2-proxy/releases/tag/v7.13.0
- https://github.security.telekom.com/2020/05/smuggling-http-headers-through-reverse-proxies.html
- https://www.uptimia.com/questions/why-are-http-headers-with-underscores-dropped-by-nginx
CVE-2025-64484 · published · modified · JSON
Go/github.com/oauth2-proxy/oauth2-proxy CVE-2025-64484: unknown
OAuth2-Proxy is vulnerable to header smuggling via underscore leading to potential privilege escalation in github.com/oauth2-proxy/oauth2-proxy
Action: No fix published. Pin and monitor.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | - | - |
Fixed versions
No fixed version in the source.
Sources
- osv: GO-2025-4113
- https://github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-vjrc-mh2v-45x6
- https://nvd.nist.gov/vuln/detail/CVE-2025-64484
- https://github.com/oauth2-proxy/oauth2-proxy/commit/f3f30fa976fb4bb97d6345ba4735cb6d86e24f95
- https://datatracker.ietf.org/doc/html/rfc2616#section-4.2
- https://datatracker.ietf.org/doc/html/rfc822#section-3.2
- https://github.com/oauth2-proxy/oauth2-proxy/releases/tag/v7.13.0
- https://github.security.telekom.com/2020/05/smuggling-http-headers-through-reverse-proxies.html
- https://www.uptimia.com/questions/why-are-http-headers-with-underscores-dropped-by-nginx
CVE-2025-64484 · published · modified · JSON
Go/github.com/oauth2-proxy/oauth2-proxy/v7 CVE-2025-64484: unknown
OAuth2-Proxy is vulnerable to header smuggling via underscore leading to potential privilege escalation in github.com/oauth2-proxy/oauth2-proxy
Action: Upgrade github.com/oauth2-proxy/oauth2-proxy/v7 to 7.13.0 or later.
go get github.com/oauth2-proxy/oauth2-proxy/v7@v7.13.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 7.13.0 | - |
Fixed versions
| 7.13.0 |
Sources
- osv: GO-2025-4113#Go/github.com/oauth2-proxy/oauth2-proxy/v7
- https://github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-vjrc-mh2v-45x6
- https://nvd.nist.gov/vuln/detail/CVE-2025-64484
- https://github.com/oauth2-proxy/oauth2-proxy/commit/f3f30fa976fb4bb97d6345ba4735cb6d86e24f95
- https://datatracker.ietf.org/doc/html/rfc2616#section-4.2
- https://datatracker.ietf.org/doc/html/rfc822#section-3.2
- https://github.com/oauth2-proxy/oauth2-proxy/releases/tag/v7.13.0
- https://github.security.telekom.com/2020/05/smuggling-http-headers-through-reverse-proxies.html
- https://www.uptimia.com/questions/why-are-http-headers-with-underscores-dropped-by-nginx
CVE-2025-64484 · published · modified · JSON