---
id: CVE-2020-28483
aliases:
  - GO-2021-0052
  - GHSA-h395-qcrw-5vmq
  - SNYK-GOLANG-GITHUBCOMGINGONICGIN-1041736
title: Inconsistent interpretation of HTTP Requests in github.com/gin-gonic/gin
summary: Inconsistent interpretation of HTTP Requests in github.com/gin-gonic/gin
severity: none
vendor: gin-gonic
product: github.com/gin-gonic/gin
ecosystem: go
affected:
  - github.com/gin-gonic/gin < 1.7.7
patched:
  - github.com/gin-gonic/gin 1.7.7
published: '2021-04-14'
updated: '2026-07-08'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GO-2021-0052'
references:
  - url: 'https://github.com/gin-gonic/gin/issues/2862'
  - url: 'https://github.com/gin-gonic/gin/issues/2473'
  - url: 'https://github.com/gin-gonic/gin/issues/2232'
  - url: 'https://github.com/gin-gonic/gin/pull/2844'
  - url: >-
      https://github.com/gin-gonic/gin/commit/5929d521715610c9dd14898ebbe1d188d5de8937
  - url: 'https://github.com/gin-gonic/gin/pull/2632'
  - url: >-
      https://github.com/gin-gonic/gin/commit/bfc8ca285eb46dad60e037d57c545cd260636711
  - url: 'https://github.com/gin-gonic/gin/pull/2675'
  - url: >-
      https://github.com/gin-gonic/gin/commit/03e5e05ae089bc989f1ca41841f05504d29e3fd9
  - url: 'https://github.com/gin-gonic/gin/pull/2474'
tags:
  - osv
  - go
epss: 0.01316
epssPercentile: 0.69575
ingestedAt: '2026-07-09T18:56:36.994Z'
---

## Overview

Due to improper HTTP header sanitization, a malicious user can spoof their source IP address by setting the X-Forwarded-For header. This may allow a user to bypass IP based restrictions, or obfuscate their true source.

## Affected packages

- `github.com/gin-gonic/gin < 1.7.7`

## Remediation

Upgrade to a patched release:

- `github.com/gin-gonic/gin 1.7.7`