{"id":"CVE-2025-47910","sourceIdentifier":"security@golang.org","published":"2025-09-22T21:15:59.627","lastModified":"2026-10-11T20:10:00.200","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"When using http.CrossOriginProtection, the AddInsecureBypassPattern method can unexpectedly bypass more requests than intended. CrossOriginProtection then skips validation, but forwards the original request path, which may be served by a different handler without the intended security protections."},{"lang":"es","value":"Al usar http.CrossOriginProtection, el método AddInsecureBypassPattern puede omitir inesperadamente más solicitudes de las previstas. CrossOriginProtection entonces omite la validación, pero reenvía la ruta de solicitud original, que puede ser atendida por un gestor diferente sin las protecciones de seguridad previstas."}],"affected":[{"source":"security@golang.org","affectedData":[{"vendor":"Go standard library","product":"net/http","defaultStatus":"unaffected","collectionURL":"https://pkg.go.dev","packageName":"net/http","programRoutines":[{"name":"CrossOriginProtection.AddInsecureBypassPattern"}],"versions":[{"version":"1.25.0","lessThan":"1.25.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-09-24T13:29:38.364534Z","id":"CVE-2025-47910","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"references":[{"url":"https://go.dev/cl/699275","source":"security@golang.org"},{"url":"https://go.dev/issue/75054","source":"security@golang.org"},{"url":"https://groups.google.com/g/golang-announce/c/PtW9VW21NPs/m/DJhMQ-m5AQAJ","source":"security@golang.org"},{"url":"https://pkg.go.dev/vuln/GO-2025-3955","source":"security@golang.org"}]}