github.com/go-resty/resty/v2
Simple HTTP, REST, and SSE client library for Go
View on Github
Activity
- Latest release
- 6mo ago
- Total releases
- 36
- Cadence
- ~22 days
- Last 12 months
- 3
Reach
- Stars
- 11.8k
Details
- First release
- Jul 16, 2019
| Version | Released | |
|---|---|---|
v2.17.2
patch
|
v2.17.2
patch
Dependencies (2)
|
|
v2.17.1
patch
|
v2.17.1
patch
Dependencies (2)
|
|
v2.17.0
minor
|
v2.17.0
minor
Dependencies (2)
|
|
v2.16.5
patch
|
v2.16.5
patch
Dependencies (2)
|
|
v2.16.4
patch
|
v2.16.4
patch
Dependencies (2)
|
|
v2.16.3
patch
|
v2.16.3
patch
Dependencies (2)
|
|
v2.16.2
patch
|
v2.16.2
patch
Dependencies (2)
|
|
v2.16.1
patch
|
v2.16.1
patch
Dependencies (2)
|
|
v2.16.0
minor
|
v2.16.0
minor
Dependencies (2)
|
|
v2.15.3
patch
|
v2.15.3
patch
Dependencies (2)
|
|
v2.15.2
patch
|
v2.15.2
patch
Dependencies (2)
|
|
v2.15.1
patch
|
v2.15.1
patch
Dependencies (2)
|
|
v2.15.0
minor
|
v2.15.0
minor
Dependencies (2)
|
|
v2.14.0
minor
|
v2.14.0
minor
Dependencies (2)
|
|
v2.13.1
patch
|
v2.13.1
patch
Dependencies (2)
|
|
v2.13.0
minor
|
v2.13.0
minor
Dependencies (2)
|
|
v2.12.0
minor
|
v2.12.0
minor
Dependencies (2)
|
|
v2.11.0
minor
|
v2.11.0
minor
Dependencies (2)
|
|
v2.10.0
minor
1 CVE
CVE-2023-45286
GHSA-xwh9-gc39-5298
GO-2023-2328
Nov 28, 2023
github.com/go-resty/resty/v2 HTTP request body disclosure
5.9
/ 10
Medium
Network
High
None
None
Unchanged
High
None
None
A race condition in go-resty can result in HTTP request body disclosure across requests. This condition can be triggered by calling sync.Pool.Put with the same *bytes.Buffer more than once, when request retries are enabled and a retry occurs. The call to sync.Pool.Get will then return a bytes.Buffer that hasn't had bytes.Buffer.Reset called on it. This dirty buffer will contain the HTTP request body from an unrelated request, and go-resty will append the current HTTP request body to it, sending two bodies in one request. The sync.Pool in question is defined at package level scope, so a completely unrelated server could receive the request body. Fixed in
2.11.0
References Updated Sep 10, 2026 · Source: OSV.dev |
v2.10.0
minor
Dependencies (2)
|
|
v2.10.0-rc.3
pre
|
v2.10.0-rc.3
pre
Dependencies (2)
|
|
v2.10.0-rc.2
pre
|
v2.10.0-rc.2
pre
Dependencies (2)
|
|
v2.10.0-rc.1
pre
|
v2.10.0-rc.1
pre
Dependencies (2)
|
|
v2.9.1
patch
|
v2.9.1
patch
Dependencies (2)
|
|
v2.9.0
minor
|
v2.9.0
minor
Dependencies (2)
|
|
v2.8.0
minor
|
v2.8.0
minor
Dependencies (1)
|
|
v2.7.0
minor
|
v2.7.0
minor
Dependencies (1)
|
|
v2.6.0
minor
|
v2.6.0
minor
Dependencies (1)
|
|
v2.5.0
minor
|
v2.5.0
minor
Dependencies (1)
|
|
v2.4.0
minor
|
v2.4.0
minor
Dependencies (1)
|
|
v2.3.0
minor
|
v2.3.0
minor
Dependencies (1)
|
|
v2.3.0-rc.2
pre
|
v2.3.0-rc.2
pre
Dependencies (1)
|
|
v2.3.0-rc.1
pre
|
v2.3.0-rc.1
pre
Dependencies (1)
|
|
v2.2.0
minor
|
v2.2.0
minor
Dependencies (1)
|
|
v2.1.0
minor
|
v2.1.0
minor
Dependencies (1)
|
|
v2.0.0
initial
|
v2.0.0
initial
Dependencies (1)
|
|
v2.0.0-rc.4
pre
|
v2.0.0-rc.4
pre
Dependencies (1)
|