Skip to content
Fencer Intel
critical 9.8

CVE-2019-14809 json

Incorrect parsing validation in net/url

published 7y ago modified 4mo ago also GO-2022-0211 , EUVD-2019-5938

cvss
9.8
version 3.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
8.4%
EPSS 8.4% chance of exploitation in 30 days, percentile 95%
public exploits
0
none known

Summary

net/url in Go before 1.11.13 and 1.12.x before 1.12.8 mishandles malformed hosts in URLs, leading to an authorization bypass in some applications. This is related to a Host field with a suffix appearing in neither Hostname() nor Port(), and is related to a non-numeric port number. For example, an attacker can compose a crafted javascript:// URL that results in a hostname of google.com.

Patch / fix

  • go stdlib 1.11.13, 1.12.8
  • golang go 1.11.13, 1.12.8
  • golang RHEL 8 1.12.8-2.module+el8.1.0+4089+be929cf8
  • go-toolset RHEL 8 1.12.8-1.module+el8.1.0+4089+be929cf8
  • golang-bin RHEL 8 1.12.8-2.module+el8.1.0+4089+be929cf8
  • golang-src RHEL 8 1.12.8-2.module+el8.1.0+4089+be929cf8
  • golang-misc RHEL 8 1.12.8-2.module+el8.1.0+4089+be929cf8
  • golang-race RHEL 8 1.12.8-2.module+el8.1.0+4089+be929cf8
  • golang-tests RHEL 8 1.12.8-2.module+el8.1.0+4089+be929cf8
  • go-toolset-1.12 devtools 2019 1.12.8-2.el7

red hat advisories RHSA-2019:3433RHEA-2019:4179

  • go1.11 openSUSE Tumbleweed 1.11.13-10.5
  • go1.12 openSUSE Tumbleweed 1.12.17-4.8
  • go1.12 openSUSE Leap 15.1 1.12.9-lp151.2.21.1
  • go1.12 openSUSE Leap 15.1 1.12.9-lp151.2.17.1
  • go1.11 openSUSE Leap 15.1, openSUSE Leap 15.0 1.11.13-lp151.2.9.1
  • go1.12 openSUSE Leap 15.1, openSUSE Leap 15.0 1.12.9-lp151.2.13.1
  • go1.12 openSUSE Leap 15.1 1.12.9-lp151.2.9.1

opensuse advisories openSUSE-SU-2024:10804-1openSUSE-SU-2024:10805-1openSUSE-SU-2019:2130-1openSUSE-SU-2019:2085-1openSUSE-SU-2019:2072-1openSUSE-SU-2019:2056-1

  • go Alpine 3.24, Alpine 3.23, Alpine 3.22 +12 more 1.12.8-r0

alpine advisories ALPINE-CVE-2019-14809

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • go Arch Linux 2:1.12.8-1

arch linux advisories AVG-1021

Is CVE-2019-14809 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2019-14809 updated cvss 7.5

golang: malformed hosts in URLs leads to authorization bypass

  • Red Hat Ceph Storage 2 golang, golang-bin, golang-src Red Hat Ceph Storage 3 golang, golang-bin, golang-src Red Hat Enterprise Linux 7 golang, golang-bin, golang-src, golang-misc, golang-tests Red Hat OpenStack Platform 9 (Mitaka) Operational Tools golang, golang-bin, golang-src
    affected: workaround, no fix planned “This flaw has no mitigation for any affected golang package versions.”
  • Red Hat Storage 3 golang, golang-bin, golang-src, golang-misc, golang-tests
    affected: workaround, no fix available “This flaw has no mitigation for any affected golang package versions.”
  • Red Hat Developer Tools for Red Hat Enterprise Linux Server (v. 7) go-toolset-1.12 1.12.8-2.el7, go-toolset-1.12-build 1.12.8-2.el7, go-toolset-1.12-golang 1.12.8-2.el7, go-toolset-1.12-runtime 1.12.8-2.el7, go-toolset-1.12-golang-bin 1.12.8-2.el7, go-toolset-1.12-golang-src 1.12.8-2.el7, +3 more Red Hat Developer Tools for Red Hat Enterprise Linux Workstation (v. 7) go-toolset-1.12 1.12.8-2.el7, go-toolset-1.12-build 1.12.8-2.el7, go-toolset-1.12-golang 1.12.8-2.el7, go-toolset-1.12-runtime 1.12.8-2.el7, go-toolset-1.12-golang-bin 1.12.8-2.el7, go-toolset-1.12-golang-src 1.12.8-2.el7, +3 more
    fixed: vendor fix “This flaw has no mitigation for any affected golang package versions.” RHEA-2019:4179
  • Red Hat Enterprise Linux AppStream (v. 8) golang 1.12.8-2.module+el8.1.0+4089+be929cf8, go-toolset 1.12.8-1.module+el8.1.0+4089+be929cf8, golang-bin 1.12.8-2.module+el8.1.0+4089+be929cf8, golang-src 1.12.8-2.module+el8.1.0+4089+be929cf8, golang-misc 1.12.8-2.module+el8.1.0+4089+be929cf8, golang-race 1.12.8-2.module+el8.1.0+4089+be929cf8, +1 more
    fixed: vendor fix “This flaw has no mitigation for any affected golang package versions.” RHSA-2019:3433

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

8.36% chance of exploitation in the next 30 days, higher than 95% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

  • github.com https://github.com/golang/go/issues/29098 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 3.0 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected packages

ecosystem package affected fixed in
go stdlib
<1.11.13
>=1.12.0-0, <1.12.8
1.11.13
1.12.8

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.