When using http.CrossOriginProtection, the AddInsecureBypassPattern method can unexpectedly bypass more requests than intended. CrossOriginProtection then skips validation, but forwards the original request path, which may be served by a different handler without the intended security protections.
History

Fri, 26 Sep 2025 12:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-440
References
Metrics threat_severity

None

threat_severity

Moderate


Wed, 24 Sep 2025 14:15:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}


Tue, 23 Sep 2025 16:15:00 +0000

Type Values Removed Values Added
First Time appeared Go Standard Library
Go Standard Library net\/http
Golang
Golang http2
Golang net
Vendors & Products Go Standard Library
Go Standard Library net\/http
Golang
Golang http2
Golang net

Mon, 22 Sep 2025 21:15:00 +0000

Type Values Removed Values Added
Description When using http.CrossOriginProtection, the AddInsecureBypassPattern method can unexpectedly bypass more requests than intended. CrossOriginProtection then skips validation, but forwards the original request path, which may be served by a different handler without the intended security protections.
Title CrossOriginProtection insecure bypass patterns not limited to exact matches in net/http
References

cve-icon MITRE

Status: PUBLISHED

Assigner: Go

Published: 2025-09-22T21:01:55.440Z

Updated: 2025-09-24T13:29:45.405Z

Reserved: 2025-05-13T23:31:29.597Z

Link: CVE-2025-47910

cve-icon Vulnrichment

Updated: 2025-09-24T13:29:28.022Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2025-09-22T21:15:59.627

Modified: 2025-09-24T14:15:49.437

Link: CVE-2025-47910

cve-icon Redhat

Severity : Moderate

Publid Date: 2025-09-22T21:01:55Z

Links: CVE-2025-47910 - Bugzilla