Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') Affecting github.com/almeidapaulopt/tsdproxy/internal/consts package, versions <3.0.0-alpha.3
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-GOLANG-GITHUBCOMALMEIDAPAULOPTTSDPROXYINTERNALCONSTS-17972544
- published14 Jul 2026
- disclosed14 Jul 2026
- creditUnknown
Introduced: 14 Jul 2026
CVE NOT AVAILABLE CWE-74 (opens in a new tab)How to fix?
Upgrade github.com/almeidapaulopt/tsdproxy/internal/consts to version 3.0.0-alpha.3 or higher.
Overview
Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') in the handling of HTTP headers, specifically X-Forwarded-For and X-Real-IP. An attacker can impersonate arbitrary client IP addresses to backend services by injecting crafted headers, potentially bypassing IP-based access controls, rate limiting, audit logging, and geo-blocking enforced by the backend. This is only exploitable if the backend service relies on the first element of X-Forwarded-For or the value of X-Real-IP for authentication or authorization decisions.