CVE-2025-47910

CrossOriginProtection insecure bypass patterns not limited to exact matches in net/http

Published Sep 22, 2025 CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Description
When using http.CrossOriginProtection, the AddInsecureBypassPattern method can unexpectedly bypass more requests than intended. CrossOriginProtection then skips validation, but forwards the original request path, which may be served by a different handler without the intended security protections.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2025-30469 When using http.CrossOriginProtection, the AddInsecureBypassPattern method can unexpectedly bypass more requests than intended. CrossOriginProtection then skips validation, but forwards the original request path, which may be served by a different handler without the intended security protections.
History
Type Values Removed Values Added
Metrics cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Type Values Removed Values Added
First Time appeared Go Standard Library
Go Standard Library net\/http
Golang
Golang http2
Golang net
Vendors & Products Go Standard Library
Go Standard Library net\/http
Golang
Golang http2
Golang net
Type Values Removed Values Added
Description When using http.CrossOriginProtection, the AddInsecureBypassPattern method can unexpectedly bypass more requests than intended. CrossOriginProtection then skips validation, but forwards the original request path, which may be served by a different handler without the intended security protections.
Title CrossOriginProtection insecure bypass patterns not limited to exact matches in net/http
References
Weaknesses

Sources

Status
PUBLISHED
Assigner
Go
Published
Updated
Sep 24, 2025, 1:29 PM
Reserved
May 13, 2025, 11:31 PM
Status
Deferred
Published
Sep 22, 2025, 9:15 PM
Modified
Oct 11, 2026, 8:10 PM
Severity
Moderate
Public date
Sep 22, 2025, 9:01 PM