Threats tagged 'ghsa-jj45-xvq5-rhh9'

A vulnerability (CVE-2026-6993) exists in go-kratos kratos versions up to 2.9.2 affecting the NewServer function in transport/http/server.go. This flaw involves the http.DefaultServeMux fallback handler and results in a confused deputy issue, allowing unintended intermediary behavior. The vulnerability can be exploited remotely without authentication. Public exploit code is available. A patch identified by commit 0284a5bcf92b5a7ee015300ce3051baf7ae4718d addresses the issue.