CVE-2024-41270

9.1 criticalEPSS 0.3%

Critical (9.1) in appleboy gorush. EPSS 0.3% chance of exploitation in the next 30 days. Fixed in github.com/appleboy/gorush 1.18.5.

An issue discovered in the RunHTTPServer function in Gorush v1.18.4 allows attackers to intercept and manipulate data due to use of deprecated TLS version.

Severity

CVSS 3.1

9.1 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 23% of CVEs (scores of 2026-10-31)
CWE: CWE-327
Published: 2024-08-06
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

appleboy:gorush

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-p3pf-mff8-3h47	Go	github.com/appleboy/gorush	<1.18.5	1.18.5
GO-2024-3058	Go	github.com/appleboy/gorush	<1.18.5	1.18.5

References

https://gist.github.com/nyxfqq/cfae38fada582a0f576d154be1aeb1fc

Check your stack JSON