When using http.CrossOriginProtection, the AddInsecureBypassPattern method can unexpectedly bypass more requests than intended. CrossOriginProtection then skips validation, but forwards the original request path, which may be served by a different handler without the intended security protections.
Metrics
Affected Vendors & Products
References
History
Fri, 26 Sep 2025 12:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Weaknesses | CWE-440 | |
| References |
| |
| Metrics |
threat_severity
|
threat_severity
|
Wed, 24 Sep 2025 14:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
cvssV3_1
|
Tue, 23 Sep 2025 16:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Go Standard Library
Go Standard Library net\/http Golang Golang http2 Golang net |
|
| Vendors & Products |
Go Standard Library
Go Standard Library net\/http Golang Golang http2 Golang net |
Mon, 22 Sep 2025 21:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | When using http.CrossOriginProtection, the AddInsecureBypassPattern method can unexpectedly bypass more requests than intended. CrossOriginProtection then skips validation, but forwards the original request path, which may be served by a different handler without the intended security protections. | |
| Title | CrossOriginProtection insecure bypass patterns not limited to exact matches in net/http | |
| References |
|
Status: PUBLISHED
Assigner: Go
Published: 2025-09-22T21:01:55.440Z
Updated: 2025-09-24T13:29:45.405Z
Reserved: 2025-05-13T23:31:29.597Z
Link: CVE-2025-47910
Updated: 2025-09-24T13:29:28.022Z
Status : Awaiting Analysis
Published: 2025-09-22T21:15:59.627
Modified: 2025-09-24T14:15:49.437
Link: CVE-2025-47910