CVE-2023-45286

Summary

CVE-2023-45286 is a race condition vulnerability affecting go-resty, an HTTP client library for Go. The issue arises when sync.Pool is used to manage bytes.Buffer instances, and request retries are enabled. When a retry occurs, a previously used bytes.Buffer may be reused, resulting in the current HTTP request body being appended to the buffer that contains data from an unrelated request. This leads to the unintended sending of two HTTP request bodies in a single request. The vulnerability exists at package level scope, potentially impacting unrelated servers.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.