CVE-2022-32148

CVE-2022-32148 is a medium-severity vulnerability in Go's net/http package (before versions 1.17.12 and 1.18.4) that allows for the improper exposure or spoofing of client IP addresses. This occurs when `httputil.ReverseProxy.ServeHTTP` is called with a nil `X-Forwarded-For` header, causing the proxy to incorrectly set the client's IP. With a CVSS score of 6.5 (Medium), this network-exploitable vulnerability has low attack complexity and requires no privileges or user interaction, potentially impacting the confidentiality and integrity of client IP information. There is currently no evidence of active exploitation, nor are there any public exploit codes available in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage for this CVE are minimal, indicating low public awareness and attention.