PatchTheCVE: gohttp projecthttps://patchthecve.com/CVEs with upgrade or downgrade fix stepsCVE-2019-12198: In GoHttp through 2017-07-25, there is a stack-based buffer over-read via a long User-Agent header.https://patchthecve.com/cve/CVE-2019-12198.htmlhttps://patchthecve.com/cve/CVE-2019-12198.htmlWed, 17 Jun 2026 02:14:13 +0000HIGH 7.5: In GoHttp through 2017-07-25, there is a stack-based buffer over-read via a long User-Agent header.CVE-2019-12160: GoHTTP through 2017-07-25 has a sendHeader use-after-free.https://patchthecve.com/cve/CVE-2019-12160.htmlhttps://patchthecve.com/cve/CVE-2019-12160.htmlWed, 17 Jun 2026 02:14:10 +0000CRITICAL 9.8: GoHTTP through 2017-07-25 has a sendHeader use-after-free.CVE-2019-12159: GoHTTP through 2017-07-25 has a stack-based buffer over-read in the scan function (when called from getRequesthttps://patchthecve.com/cve/CVE-2019-12159.htmlhttps://patchthecve.com/cve/CVE-2019-12159.htmlWed, 17 Jun 2026 02:14:10 +0000HIGH 7.5: GoHTTP through 2017-07-25 has a stack-based buffer over-read in the scan function (when called from getRequestType) via a long URL.CVE-2019-12158: GoHTTP through 2017-07-25 has a GetExtension heap-based buffer overflow via a long extension.https://patchthecve.com/cve/CVE-2019-12158.htmlhttps://patchthecve.com/cve/CVE-2019-12158.htmlWed, 17 Jun 2026 02:14:09 +0000CRITICAL 9.8: GoHTTP through 2017-07-25 has a GetExtension heap-based buffer overflow via a long extension.