{"id":"GO-2021-0052","summary":"Inconsistent interpretation of HTTP Requests in github.com/gin-gonic/gin","details":"Due to improper HTTP header sanitization, a malicious user can spoof their source IP address by setting the X-Forwarded-For header. This may allow a user to bypass IP based restrictions, or obfuscate their true source.","aliases":["CVE-2020-28483","GHSA-h395-qcrw-5vmq","SNYK-GOLANG-GITHUBCOMGINGONICGIN-1041736"],"modified":"2026-05-07T04:56:47.934609746Z","published":"2021-04-14T20:04:52Z","database_specific":{"url":"https://pkg.go.dev/vuln/GO-2021-0052","review_status":"REVIEWED"},"references":[{"type":"REPORT","url":"https://github.com/gin-gonic/gin/issues/2862"},{"type":"REPORT","url":"https://github.com/gin-gonic/gin/issues/2473"},{"type":"REPORT","url":"https://github.com/gin-gonic/gin/issues/2232"},{"type":"FIX","url":"https://github.com/gin-gonic/gin/pull/2844"},{"type":"FIX","url":"https://github.com/gin-gonic/gin/commit/5929d521715610c9dd14898ebbe1d188d5de8937"},{"type":"FIX","url":"https://github.com/gin-gonic/gin/pull/2632"},{"type":"FIX","url":"https://github.com/gin-gonic/gin/commit/bfc8ca285eb46dad60e037d57c545cd260636711"},{"type":"FIX","url":"https://github.com/gin-gonic/gin/pull/2675"},{"type":"FIX","url":"https://github.com/gin-gonic/gin/commit/03e5e05ae089bc989f1ca41841f05504d29e3fd9"},{"type":"WEB","url":"https://github.com/gin-gonic/gin/pull/2474"}],"affected":[{"package":{"name":"github.com/gin-gonic/gin","ecosystem":"Go","purl":"pkg:golang/github.com/gin-gonic/gin"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.7.7"}]}],"ecosystem_specific":{"imports":[{"path":"github.com/gin-gonic/gin","symbols":["Context.ClientIP","Context.Next","Context.RemoteIP","Engine.HandleContext","Engine.Run","Engine.RunFd","Engine.RunListener","Engine.RunTLS","Engine.RunUnix","Engine.ServeHTTP"]}]},"database_specific":{"source":"https://vuln.go.dev/ID/GO-2021-0052.json"}}],"schema_version":"1.7.5","credits":[{"name":"@sorenisanerd"}]}