{"id":"CVE-2020-28483","aliases":["GO-2021-0052","GHSA-h395-qcrw-5vmq","SNYK-GOLANG-GITHUBCOMGINGONICGIN-1041736"],"title":"Inconsistent interpretation of HTTP Requests in github.com/gin-gonic/gin","summary":"Inconsistent interpretation of HTTP Requests in github.com/gin-gonic/gin","severity":"none","vendor":"gin-gonic","product":"github.com/gin-gonic/gin","ecosystem":"go","affected":["github.com/gin-gonic/gin < 1.7.7"],"patched":["github.com/gin-gonic/gin 1.7.7"],"published":"2021-04-14","updated":"2026-07-08","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GO-2021-0052","references":[{"url":"https://github.com/gin-gonic/gin/issues/2862"},{"url":"https://github.com/gin-gonic/gin/issues/2473"},{"url":"https://github.com/gin-gonic/gin/issues/2232"},{"url":"https://github.com/gin-gonic/gin/pull/2844"},{"url":"https://github.com/gin-gonic/gin/commit/5929d521715610c9dd14898ebbe1d188d5de8937"},{"url":"https://github.com/gin-gonic/gin/pull/2632"},{"url":"https://github.com/gin-gonic/gin/commit/bfc8ca285eb46dad60e037d57c545cd260636711"},{"url":"https://github.com/gin-gonic/gin/pull/2675"},{"url":"https://github.com/gin-gonic/gin/commit/03e5e05ae089bc989f1ca41841f05504d29e3fd9"},{"url":"https://github.com/gin-gonic/gin/pull/2474"}],"tags":["osv","go"],"epss":0.01316,"epssPercentile":0.69555,"ingestedAt":"2026-07-09T18:56:36.994Z","slug":"CVE-2020-28483","body":"## Overview\n\nDue to improper HTTP header sanitization, a malicious user can spoof their source IP address by setting the X-Forwarded-For header. This may allow a user to bypass IP based restrictions, or obfuscate their true source.\n\n## Affected packages\n\n- `github.com/gin-gonic/gin < 1.7.7`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `github.com/gin-gonic/gin 1.7.7`","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0.3,"exploitation":0,"ransomware":0},"changes":[]}