Skip to content
Heist/ feed
Back to feed
Medium

Security advisory

Type: advisorySources: OSVCVE: CVE-2023-26125

Versions of the package github.com/gin-gonic/gin before 1.9.0 are vulnerable to Improper Input Validation by allowing an attacker to use a specially crafted request via the X-Forwarded-Prefix header, potentially leading to cache poisoning. **Note:** Although this issue does not pose a significant threat on its own it can serve as an input vector for other more impactful vulnerabilities. However, successful exploitation may depend on the server configuration and whether the header is used in the application logic.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2023-26125
Confirmed fixed CVEs
Not specified
Updated in this feed
7 Nov 2026, 19:28 UTC · Revision 1

Source evidence

CVE-2023-26125

core-osv · Original source

Published 4 May 2023, 05:00 UTC

Versions of the package github.com/gin-gonic/gin before 1.9.0 are vulnerable to Improper Input Validation by allowing an attacker to use a specially crafted request via the X-Forwarded-Prefix header, potentially leading to cache poisoning. **Note:** Although this issue does not pose a significant threat on its own it can serve as an input vector for other more impactful vulnerabilities. However, successful exploitation may depend on the server configuration and whether the header is used in the application logic.

osv:CVE-2023-26125
Complete source record
{
  "id": "aca5bf903a383b668db6bf0cca17712819b7c41442c9ca0b7a5b478ade7159da",
  "url": "https://osv.dev/vulnerability/CVE-2023-26125",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "CVE-2023-26125",
    "summary": "Versions of the package github.com/gin-gonic/gin before 1.9.0 are vulnerable to Improper Input Validation by allowing an attacker to use a specially crafted request via the X-Forwarded-Prefix header, potentially leading to cache poisoning. **Note:** Although this issue does not pose a significant threat on its own it can serve as an input vector for other more impactful vulnerabilities. However, successful exploitation may depend on the server configuration and whether the header is used in the application logic.",
    "evidence": "osv:CVE-2023-26125",
    "products": [],
    "severity": "medium",
    "structured": {
      "id": "CVE-2023-26125",
      "aliases": [
        "CVE-2023-26125",
        "GHSA-3vp4-m3rf-835h"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/gin-gonic/gin",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "ea03e10384502e1baf6f560a2b0ea32c342ede5b"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "1.9.0"
                      }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StandardRange"
                  },
                  {
                    "range": [
                      {
                        "fixed": "ea03e10384502e1baf6f560a2b0ea32c342ede5b"
                      }
                    ],
                    "source": "REFERENCES_TAG",
                    "original_tag": "v1.9.0"
                  },
                  {
                    "cpe": "cpe:2.3:a:gin-gonic:gin:*:*:*:*:*:*:*:*",
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "1.9.0"
                      }
                    ],
                    "source": "CPE_RANGE"
                  }
                ]
              }
            }
          ],
          "versions": [
            "v1.8.1",
            "v1.8.0",
            "v1.7.1",
            "v1.7.0",
            "v1.6.2",
            "v1.6.1",
            "v1.6.0",
            "v1.5.0",
            "v1.4.0",
            "v1.3.0",
            "v1.2",
            "v1.1.4",
            "v1.1.3",
            "v1.1.2",
            "v1.1.1",
            "v1.1",
            "v1.0-rc.2",
            "v1.0",
            "v1.0rc1",
            "v0.6",
            "v0.5",
            "v0.4",
            "v0.3",
            "v0.2b",
            "v0.1"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-26125.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:51.799087742Z",
      "provider": "osv",
      "references": [
        "https://github.com/gin-gonic/gin/releases/tag/v1.9.0",
        "https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGINGONICGIN-3324285",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/26xxx/CVE-2023-26125.json",
        "https://nvd.nist.gov/vuln/detail/CVE-2023-26125",
        "https://github.com/gin-gonic/gin/pull/3500",
        "https://github.com/gin-gonic/gin/pull/3503",
        "https://github.com/t0rchwo0d/gin/commit/fd9f98e70fb4107ee68c783482d231d35e60507b"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-20"
        ],
        "cna_assigner": "snyk",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/26xxx/CVE-2023-26125.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2023-26125",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 520220,
  "published_at": "2023-05-04T05:00:01.441+00:00"
}