CVEDB API

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2026-21697

axios4go is a Go HTTP client library. Prior to version 0.6.4, a race condition vulnerability exists in the shared HTTP client configuration. The global `defaultClient` is mutated during request execution without synchronization, directly modifying the shared `http.Client`'s `Transport`, `Timeout`, and `CheckRedirect` properties. Impacted applications include that that use axios4go with concurrent requests (multiple goroutines, `GetAsync`, `PostAsync`, etc.), those where different requests use different proxy configurations, and those that handle sensitive data (authentication credentials, tokens, API keys). Version 0.6.4 fixes this issue.

Exploit prediction scoring system (EPSS) score

EPSS Score 0.002

EPSS Ranking 37.8%

CVSS Severity

CVSS v3 Score 8.1

References

Products affected by CVE-2026-21697

Rezmoss » Axios4go » Version: 0.1.0

cpe:2.3:a:rezmoss:axios4go:0.1.0
Rezmoss » Axios4go » Version: 0.2.0

cpe:2.3:a:rezmoss:axios4go:0.2.0
Rezmoss » Axios4go » Version: 0.2.1

cpe:2.3:a:rezmoss:axios4go:0.2.1
Rezmoss » Axios4go » Version: 0.3.0

cpe:2.3:a:rezmoss:axios4go:0.3.0
Rezmoss » Axios4go » Version: 0.4.0

cpe:2.3:a:rezmoss:axios4go:0.4.0
Rezmoss » Axios4go » Version: 0.5.0

cpe:2.3:a:rezmoss:axios4go:0.5.0
Rezmoss » Axios4go » Version: 0.6.0

cpe:2.3:a:rezmoss:axios4go:0.6.0
Rezmoss » Axios4go » Version: 0.6.1

cpe:2.3:a:rezmoss:axios4go:0.6.1
Rezmoss » Axios4go » Version: 0.6.2

cpe:2.3:a:rezmoss:axios4go:0.6.2
Rezmoss » Axios4go » Version: 0.6.3

cpe:2.3:a:rezmoss:axios4go:0.6.3

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2026-21697

Products

Pricing

Contact Us