CVE-2019-14809: Debian Linux

Critical severity, CVSS 9.8. EPSS: 8.4% chance of exploitation in the next 30 days.

net/url in Go before 1.11.13 and 1.12.x before 1.12.8 mishandles malformed hosts in URLs, leading to an authorization bypass in some applications. This is related to a Host field with a suffix appearing in neither Hostname() nor Port(), and is related to a non-numeric port number. For example, an attacker can compose a crafted javascript:// URL that results in a hostname of google.com.

Affected products

• Debian Debian Linux: version 10.0 only
• Golang Go: before 1.11.13 (fixed in 1.11.13); from 1.12.0, before 1.12.8 (fixed in 1.12.8)

Published 2019-08-13. Last modified 2026-06-17.