CVE-2022-2583

LowCVSS 3.7/10Last modified Jun 17, 2026

Description

A race condition can cause incorrect HTTP request routing.

Metrics

CVSS 3.1 3.7/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-362

Affected software

Vendor	Product	Versions
github.com/ntbosscher/gobase	github.com/ntbosscher/gobase/auth/httpauth	< 0.7.2

References

https://github.com/ntbosscher/gobase/commit/a8d40bce9c429d324122d18c446924dab809e812Patch, Third Party Advisory
https://pkg.go.dev/vuln/GO-2022-0400Patch, Third Party Advisory
https://github.com/ntbosscher/gobase/commit/a8d40bce9c429d324122d18c446924dab809e812Patch, Third Party Advisory
https://pkg.go.dev/vuln/GO-2022-0400Patch, Third Party Advisory

Timeline

Published: Dec 27, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-258303.3Information Exposure vulnerability in Galaxy Watch3 Plugin prior to version 2.2.09.22012751 allows attacker to access password information o CVE-2022-258314.6Improper access control vulnerability in S Secure prior to SMR Apr-2022 Release 1 allows physical attackers to access secured data in certai CVE-2022-258326.8Improper authentication vulnerability in S Secure prior to SMR Apr-2022 Release 1 allows physical attackers to use locked Myfiles app withou CVE-2022-258333.3Improper authentication in ImsService prior to SMR Apr-2022 Release 1 allows attackers to get IMSI without READ_PRIVILEGED_PHONE_STATE permi CVE-2022-258347.8In Percona XtraBackup (PXB) through 2.2.24 and 3.x through 8.0.27-19, a crafted filename on the local file system could trigger unexpected c CVE-2022-258367.5Bluetooth® Low Energy Pairing in Bluetooth Core Specification v4.0 through v5.3 may permit an unauthenticated MITM to acquire credentials wi CVE-2022-258377.5Bluetooth® Pairing in Bluetooth Core Specification v1.0B through v5.3 may permit an unauthenticated MITM to acquire credentials with two pai CVE-2022-258388.1Laravel Fortify before 1.11.1 allows reuse within a short time window, thus calling into question the "OT" part of the "TOTP" concept.CVE-2022-258395.3The package url-js before 2.1.0 are vulnerable to Improper Input Validation due to improper parsing, which makes it is possible for the host CVE-2022-25847.5The dag-pb codec can panic when decoding invalid blocks.CVE-2022-258417.8Uncontrolled search path elements in the Intel(R) Datacenter Group Event Android application, all versions, may allow an authenticated user CVE-2022-258429.8All versions of package com.alibaba.oneagent:one-java-agent-plugin are vulnerable to Arbitrary File Write via Archive Extraction (Zip Slip)