{"action":"Upgrade github.com/oauth2-proxy/oauth2-proxy/v7 to 7.13.0 or later.","affected":[{"fixed":"7.13.0","introduced":"0"}],"component":"github.com/oauth2-proxy/oauth2-proxy/v7","cve_ids":["CVE-2025-64484"],"ecosystem":"Go","epss":0.00658,"exploited":false,"fixed_versions":["7.13.0"],"ghsa_id":"GHSA-vjrc-mh2v-45x6","id":"tcs_01M5KFPA41AZ0FENCJ0FHQJEV2","modified_at":"2025-11-17T21:48:56Z","published_at":"2025-11-12T21:42:36Z","references":["https://osv.dev/vulnerability/GHSA-vjrc-mh2v-45x6","https://github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-vjrc-mh2v-45x6","https://nvd.nist.gov/vuln/detail/CVE-2025-64484","https://github.com/oauth2-proxy/oauth2-proxy/commit/f3f30fa976fb4bb97d6345ba4735cb6d86e24f95","https://datatracker.ietf.org/doc/html/rfc2616#section-4.2","https://datatracker.ietf.org/doc/html/rfc822#section-3.2","https://github.com/oauth2-proxy/oauth2-proxy","https://github.com/oauth2-proxy/oauth2-proxy/releases/tag/v7.13.0","https://github.security.telekom.com/2020/05/smuggling-http-headers-through-reverse-proxies.html","https://www.uptimia.com/questions/why-are-http-headers-with-underscores-dropped-by-nginx"],"severity":{"label":"high","score":8.5},"sources":[{"source":"osv","source_id":"GHSA-vjrc-mh2v-45x6","url":"https://osv.dev/vulnerability/GHSA-vjrc-mh2v-45x6"}],"summary":"OAuth2-Proxy is vulnerable to header smuggling via underscore leading to potential privilege escalation"}