CVE-2022-1996 — Authorization Bypass Through User-Controlled Key in Go-restful

CWE-639 — Authorization Bypass Through User-Controlled KeyCWE-1341 — Multiple Releases of Same Resource or HandleCWE-825 — Expired Pointer DereferenceCWE-20 — Improper Input ValidationCWE-430 — Deployment of Wrong HandlerCWE-362 — Race ConditionCWE-476 — NULL Pointer DereferenceCWE-416 — Use After FreeCWE-787 — Out-of-bounds WriteCWE-544 — Missing Standardized Error Handling MechanismCWE-826 — Premature Release of Resource During Expected LifetimeCWE-823 — Use of Out-of-range Pointer Offset35 documents7 sources
Severity
9.1CRITICALNVD
EPSS
1.0%
top 23.43%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
14
Emicklei Go-restfulGithub.com Emicklei Go-restfulGithub.com Emicklei Go-restful V3+11 more
Timeline
PublishedJun 8
Latest updateDec 24

Description

Authorization Bypass Through User-Controlled Key in GitHub repository emicklei/go-restful prior to v3.8.0.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NExploitability: 3.9 | Impact: 5.2

Affected Packages13 packages

▶debiandebian/golang-github-emicklei-go-restful< golang-github-emicklei-go-restful 3.10.2-1 (bookworm)
▶CVEListV5emicklei/emicklei_go-restfulunspecified — v3.8.0

Also affects: Fedora 35, 36

Patches

Patch: github.com ↗Patch: huntr.dev ↗Patch: github.com ↗

🔴Vulnerability Details

5
OSV
wifi: mt76: do not run mt76u_status_worker if the device is not running↗2025-12-24
▶
OSV
Authorization bypass in github.com/emicklei/go-restful, go-restful/v2 and go-restful/v3↗2022-08-15
▶
OSV
Authorization Bypass Through User-Controlled Key in go-restful↗2022-06-09
▶
GHSA
Authorization Bypass Through User-Controlled Key in go-restful↗2022-06-09
▶
OSV
CVE-2022-1996: Authorization Bypass Through User-Controlled Key in GitHub repository emicklei/go-restful prior to v3↗2022-06-08
▶

📋Vendor Advisories

11
Red Hat
kernel: wifi: ar5523: Fix use-after-free on ar5523_cmd() timed out↗2025-12-24
▶
Red Hat
kernel: dm thin: Use last transaction's pmd->root when commit failed↗2025-10-07
▶
Red Hat
kernel: wifi: ath9k: verify the expected usb_endpoints are present↗2025-09-15
▶
Red Hat
kernel: media: mceusb: Use new usb_control_msg_*() routines↗2025-06-18
▶
Red Hat
kernel: net, neigh: Fix null-ptr-deref in neigh_table_clear()↗2025-05-01
▶

🕵️Threat Intelligence

1
Wiz
CVE-2022-50885 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶