CVE-2024-45258: Imroc Req

Critical severity, CVSS 9.8. EPSS: 0.7% chance of exploitation in the next 30 days.

The req package before 3.43.4 for Go may send an unintended request when a malformed URL is provided, because cleanHost in http.go intentionally uses a "garbage in, garbage out" design.

Affected products

• Imroc Req: before 3.43.4 (fixed in 3.43.4)

Published 2024-08-25. Last modified 2026-06-17.