CrossOriginProtection insecure bypass patterns not limited to exact matches in net/http
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Go standard library | net/http | unaffected |
|
No data.
No data.
| Vendor | Product | Versions |
|---|---|---|
| Go Standard Library | Net\/http | — |
| Golang | Http2 | — |
| Golang | Net | — |
| Source | ID | Title |
|---|---|---|
EUVD |
EUVD-2025-30469 | When using http.CrossOriginProtection, the AddInsecureBypassPattern method can unexpectedly bypass more requests than intended. CrossOriginProtection then skips validation, but forwards the original request path, which may be served by a different handler without the intended security protections. |
No CVSS v4.0
No CVSS v3.0
No CVSS v2
This CVE is not in the KEV list.
Exploit prediction score: < 1% (0.346% probability within 30 days)
| Type | Values Removed | Values Added |
|---|---|---|
| Weaknesses | CWE-440 | |
| References |
| |
| Metrics |
threat_severity
|
threat_severity
|
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
cvssV3_1
|
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Go Standard Library
Go Standard Library net\/http Golang Golang http2 Golang net |
|
| Vendors & Products |
Go Standard Library
Go Standard Library net\/http Golang Golang http2 Golang net |
| Type | Values Removed | Values Added |
|---|---|---|
| Description | When using http.CrossOriginProtection, the AddInsecureBypassPattern method can unexpectedly bypass more requests than intended. CrossOriginProtection then skips validation, but forwards the original request path, which may be served by a different handler without the intended security protections. | |
| Title | CrossOriginProtection insecure bypass patterns not limited to exact matches in net/http | |
| References |
|
View source · Bugzilla · JSON
OpenCVE enrichment
Updated: Sep 23, 2025, 4:03 PM
EUVD