CVE-2025-47910

CVE-2025-47910

Medium · published September 23, 2025

CVSS v3.1
5.4
EPSS
0%
Percentile
24.9
In the wild
Unconfirmed
What it is

When using http.CrossOriginProtection, the AddInsecureBypassPattern method can unexpectedly bypass more requests than intended. CrossOriginProtection then skips validation, but forwards the original request path, which may be served by a different handler without the intended security protections.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00330 · 24.9th percentile
Published
2025-09-23T01:15Z
References (4)
https://go.dev/cl/699275 · [email protected]https://go.dev/issue/75054 · [email protected]https://groups.google.com/g/golang-announce/c/PtW9VW21NPs/m/DJhMQ-m5AQAJ · [email protected]https://pkg.go.dev/vuln/GO-2025-3955 · [email protected]
EPSS history
Timeline
  • 22 SEP 21:01Z
    CrossOriginProtection insecure bypass patterns not limited to exact matches in net/http
    cvelistv5