Denial of service via malicious preflight requests in github.com/rs/cors
Résumé
Denial of service via malicious preflight requests in github.com/rs/cors
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Middleware causes a prohibitive amount of heap allocations when processing malicious preflight requests that include a Access-Control-Request-Headers (ACRH) header whose value contains many commas. This behavior can be abused by attackers to produce undue load on the middleware/server as an attempt to cause a denial of service.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
État des correctifs par distribution
Paquets corrigés publiés par chaque distribution pour cette CVE
- Ubuntu UBUNTU-CVE-2025-47908 golang-github-rs-cors
Références
- advisory github.com
- advisory nvd.nist.gov
- patch github.com
- report github.com
- web pkg.go.dev
- web pkg.go.dev