CVE-2021-32721: URL Redirection to Untrusted Site ('Open Redirect') in github.com/AndrewBurian/powermux

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-06-29 · updated 2026-06-17
Weakness: CWE-601

Description

PowerMux is a drop-in replacement for Go's http.ServeMux. In PowerMux versions prior to 1.1.1, attackers may be able to craft phishing links and other open redirects by exploiting the trailing slash redirection feature. This may lead to users being redirected to untrusted sites after following an attacker crafted link. The issue is resolved in v1.1.1. There are no existing workarounds.

Affected products

AndrewBurian powermux: before 1.1.1 — fixed in 1.1.1

How to fix

Upgrade to a fixed version: AndrewBurian powermux 1.1.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-32721 or the next vulnerability affects your stack