CVE-2019-14809

net/url in Go before 1.11.13 and 1.12.x before 1.12.8 mishandles malformed hosts in URLs, leading to an authorization bypass in some applications. This is related to a Host field with a suffix appearing in neither Hostname() nor Port(), and is related to a non-numeric port number. For example, an attacker can compose a crafted javascript:// URL that results in a hostname of google.com.

• http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00076.html
• http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00002.html
• http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00011.html
• http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00021.html
• http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00038.html
• https://access.redhat.com/errata/RHSA-2019:3433
• https://github.com/golang/go/issues/29098Exploit, Patch, Third Party Advisory
• https://groups.google.com/forum/#%21topic/golang-announce/0uuMm1BwpHE
• https://groups.google.com/forum/#%21topic/golang-announce/65QixT3tcmg
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4BBP27PZGSY6OP6D26E5FW4GZKBFHNU7/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LYO6E3H34C346D2E443GLXK7OK6KIYIQ/
• https://seclists.org/bugtraq/2019/Aug/31Mailing List, Third Party Advisory
• https://www.debian.org/security/2019/dsa-4503Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00076.html
• http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00002.html
• http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00011.html
• http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00021.html
• http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00038.html
• https://access.redhat.com/errata/RHSA-2019:3433
• https://github.com/golang/go/issues/29098Exploit, Patch, Third Party Advisory
• https://groups.google.com/forum/#%21topic/golang-announce/0uuMm1BwpHE
• https://groups.google.com/forum/#%21topic/golang-announce/65QixT3tcmg
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4BBP27PZGSY6OP6D26E5FW4GZKBFHNU7/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LYO6E3H34C346D2E443GLXK7OK6KIYIQ/
• https://seclists.org/bugtraq/2019/Aug/31Mailing List, Third Party Advisory
• https://www.debian.org/security/2019/dsa-4503Third Party Advisory

Published

Aug 13, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-14802HashiCorp Nomad 0.5.0 through 0.9.4 (fixed in 0.9.5) reveals…5.3
• CVE-2019-14804studio/polyglot.php?page=etemplates in UNA 10.0.0-RC1 allows…
• CVE-2019-14805studio/builder_menu.php?page=sets in UNA 10.0.0-RC1 allows X…
• CVE-2019-14806Pallets Werkzeug before 0.15.3, when used with Docker, has i…7.5
• CVE-2019-14807In the MobileFrontend extension 1.31 through 1.33 for MediaW…6.1
• CVE-2019-14808An issue was discovered in the RENPHO application 3.0.0 for …6.8
• CVE-2019-1481An information disclosure vulnerability exists in Windows Me…4.3
• CVE-2019-14810A vulnerability has been found in the implementation of the …5.9
• CVE-2019-14811A flaw was found in, ghostscript versions prior to 9.50, in …7.8
• CVE-2019-14812A flaw was found in all ghostscript versions 9.x before 9.50…7.8
• CVE-2019-14813A flaw was found in ghostscript, versions 9.x before 9.50, i…9.8
• CVE-2019-14814There is heap-based buffer overflow in Linux kernel, all ver…7.8