{"action":"Upgrade github.com/oauth2-proxy/oauth2-proxy/v7 to 7.13.0 or later.","affected":[{"fixed":"7.13.0","introduced":"0"}],"component":"github.com/oauth2-proxy/oauth2-proxy/v7","cve_ids":["CVE-2025-64484"],"ecosystem":"Go","epss":0.00658,"exploited":false,"fixed_versions":["7.13.0"],"ghsa_id":"GHSA-vjrc-mh2v-45x6","id":"tcs_01M5KGBHV0QEEKSW8ATB7HYKE2","modified_at":"2026-03-03T04:57:36.731541Z","published_at":"2025-11-17T19:11:23Z","references":["https://osv.dev/vulnerability/GO-2025-4113","https://github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-vjrc-mh2v-45x6","https://nvd.nist.gov/vuln/detail/CVE-2025-64484","https://github.com/oauth2-proxy/oauth2-proxy/commit/f3f30fa976fb4bb97d6345ba4735cb6d86e24f95","https://datatracker.ietf.org/doc/html/rfc2616#section-4.2","https://datatracker.ietf.org/doc/html/rfc822#section-3.2","https://github.com/oauth2-proxy/oauth2-proxy/releases/tag/v7.13.0","https://github.security.telekom.com/2020/05/smuggling-http-headers-through-reverse-proxies.html","https://www.uptimia.com/questions/why-are-http-headers-with-underscores-dropped-by-nginx"],"severity":{"label":"high","score":8.5},"sources":[{"source":"osv","source_id":"GO-2025-4113#Go/github.com/oauth2-proxy/oauth2-proxy/v7","url":"https://osv.dev/vulnerability/GO-2025-4113"},{"source":"nvd","source_id":"CVE-2025-64484","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-64484"}],"summary":"OAuth2-Proxy is vulnerable to header smuggling via underscore leading to potential privilege escalation in github.com/oauth2-proxy/oauth2-proxy"}