CVE-2026-21697

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-21697

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-21697.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-21697

Aliases

GHSA-cmj9-27wj-7x47

Published

2026-01-07T22:29:57.393Z

Modified

2026-03-13T07:57:11.655731Z

Severity

8.2 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

axios4go's Race Condition in Shared HTTP Client Allows Proxy Configuration Leak

Details

axios4go is a Go HTTP client library. Prior to version 0.6.4, a race condition vulnerability exists in the shared HTTP client configuration. The global defaultClient is mutated during request execution without synchronization, directly modifying the shared http.Client's Transport, Timeout, and CheckRedirect properties. Impacted applications include that that use axios4go with concurrent requests (multiple goroutines, GetAsync, PostAsync, etc.), those where different requests use different proxy configurations, and those that handle sensitive data (authentication credentials, tokens, API keys). Version 0.6.4 fixes this issue.

Database specific

{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-362"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/21xxx/CVE-2026-21697.json"
}

References

Affected packages

Git / github.com/rezmoss/axios4go

Affected ranges

Type: GIT
Repo: https://github.com/rezmoss/axios4go
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

bc21ffb4e5fa9a743c7dbfac4c72764f97921444

Affected versions

v0.*

v0.1.0

v0.2.0

v0.2.1

v0.3.0

v0.4.0

v0.5.0

v0.6.0

v0.6.1

v0.6.2

v0.6.3

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-21697.json"