CVE-2025-47908
Denial of service via malicious preflight requests in github.com/rs/cors
Summary
Denial of service via malicious preflight requests in github.com/rs/cors
Original description
The description as published by the source.
Middleware causes a prohibitive amount of heap allocations when processing malicious preflight requests that include a Access-Control-Request-Headers (ACRH) header whose value contains many commas. This behavior can be abused by attackers to produce undue load on the middleware/server as an attempt to cause a denial of service.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Ubuntu UBUNTU-CVE-2025-47908 golang-github-rs-cors
References
- advisory github.com
- advisory nvd.nist.gov
- patch github.com
- report github.com
- web pkg.go.dev
- web pkg.go.dev