{"id":"EUVD-2025-30469","revision":"919980d6e7654ca181f34b9ef4f88c38","records":[{"revision":"919980d6e7654ca181f34b9ef4f88c38","observedAt":"2026-11-09T03:05:38.705+00:00","statement":{"source":"euvd","id":"EUVD-2025-30469","aliases":["CVE-2025-47910","GHSA-8pjc-487g-w6p2"],"title":"When using http.CrossOriginProtection, the AddInsecureBypassPattern method can unexpectedly bypass more requests than intended. CrossOriginProtection then skips validation, but forwards the original request path, which may be served by a di…","description":"When using http.CrossOriginProtection, the AddInsecureBypassPattern method can unexpectedly bypass more requests than intended. CrossOriginProtection then skips validation, but forwards the original request path, which may be served by a different handler without the intended security protections.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","score":5.4,"severity":null}],"references":["https://go.dev/cl/699275","https://go.dev/issue/75054","https://groups.google.com/g/golang-announce/c/PtW9VW21NPs/m/DJhMQ-m5AQAJ","https://pkg.go.dev/vuln/GO-2025-3955"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-30469","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Sep 22, 2025, 9:01:55 PM","dateUpdated":"Sep 24, 2025, 1:29:45 PM"},"relatedAdvisories":[{"id":"SUSE-SU-2025:03525-1","title":"Security update for go1.25-openssl","vulnerabilityIds":["CVE-2025-47910"]},{"id":"openSUSE-SU-2025:15574-1","title":"govulncheck-vulndb-0.0.20250922T204835-1.1 on GA media","vulnerabilityIds":["CVE-2025-47910"]},{"id":"RHSA-2026:7385","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","vulnerabilityIds":["CVE-2025-22873","CVE-2025-47910","CVE-2025-47911","CVE-2025-47912","CVE-2025-47914","CVE-2025-58181","CVE-2025-58183","CVE-2025-58185","CVE-2025-58186","CVE-2025-58187","CVE-2025-58188","CVE-2025-58189","CVE-2025-58190","CVE-2025-61723","CVE-2025-61724","CVE-2025-61725","CVE-2025-61726","CVE-2025-61727","CVE-2025-61728","CVE-2025-61729","CVE-2025-61730","CVE-2025-61731","CVE-2025-61732","CVE-2025-68119","CVE-2025-68121","CVE-2026-25679","CVE-2026-27139","CVE-2026-27141","CVE-2026-27143","CVE-2026-27144","CVE-2026-32281","CVE-2026-32282","CVE-2026-32283","CVE-2026-32288","CVE-2026-32289","CVE-2026-33809","CVE-2026-33813","CVE-2026-42503"]},{"id":"SUSE-SU-2026:0297-1","title":"Security update for go1.25-openssl","vulnerabilityIds":["CVE-2025-4674","CVE-2025-47906","CVE-2025-47907","CVE-2025-47910","CVE-2025-47912","CVE-2025-58183","CVE-2025-58185","CVE-2025-58186","CVE-2025-58187","CVE-2025-58188","CVE-2025-58189","CVE-2025-61723","CVE-2025-61724","CVE-2025-61725","CVE-2025-61726","CVE-2025-61727","CVE-2025-61728","CVE-2025-61729","CVE-2025-61730","CVE-2025-61731","CVE-2025-68119","CVE-2025-68121"]},{"id":"WID-SEC-W-2025-1963","title":"Golang Go: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen","vulnerabilityIds":["CVE-2025-47910"]},{"id":"RHSA-2026:7291","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","vulnerabilityIds":["CVE-2025-22873","CVE-2025-47910","CVE-2025-47911","CVE-2025-47912","CVE-2025-47914","CVE-2025-58181","CVE-2025-58183","CVE-2025-58185","CVE-2025-58186","CVE-2025-58187","CVE-2025-58188","CVE-2025-58189","CVE-2025-58190","CVE-2025-61723","CVE-2025-61724","CVE-2025-61725","CVE-2025-61726","CVE-2025-61727","CVE-2025-61728","CVE-2025-61729","CVE-2025-61730","CVE-2025-61731","CVE-2025-61732","CVE-2025-68119","CVE-2025-68121","CVE-2026-25679","CVE-2026-27137","CVE-2026-27138","CVE-2026-27139","CVE-2026-27141","CVE-2026-27142","CVE-2026-27143","CVE-2026-27144","CVE-2026-32281","CVE-2026-32282","CVE-2026-32283","CVE-2026-32288","CVE-2026-32289","CVE-2026-33809","CVE-2026-33810"]},{"id":"SUSE-SU-2025:03200-1","title":"Security update for go1.25","vulnerabilityIds":["CVE-2025-47910"]},{"id":"SUSE-SU-2025:21192-1","title":"Security update for go1.25","vulnerabilityIds":["CVE-2025-47910","CVE-2025-47912","CVE-2025-58183","CVE-2025-58185","CVE-2025-58186","CVE-2025-58187","CVE-2025-58188","CVE-2025-58189","CVE-2025-61723","CVE-2025-61724","CVE-2025-61725","CVE-2025-61727","CVE-2025-61729"]},{"id":"SUSE-SU-2025:03524-1","title":"Security update for go1.25-openssl","vulnerabilityIds":["CVE-2025-47910"]},{"id":"openSUSE-SU-2025:20157-1","title":"Security update for go1.25","vulnerabilityIds":["CVE-2025-47910","CVE-2025-47912","CVE-2025-58183","CVE-2025-58185","CVE-2025-58186","CVE-2025-58187","CVE-2025-58188","CVE-2025-58189","CVE-2025-61723","CVE-2025-61724","CVE-2025-61725","CVE-2025-61727","CVE-2025-61729"]},{"id":"SUSE-SU-2026:0298-1","title":"Security update for go1.25-openssl","vulnerabilityIds":["CVE-2025-4674","CVE-2025-47906","CVE-2025-47907","CVE-2025-47910","CVE-2025-47912","CVE-2025-58183","CVE-2025-58185","CVE-2025-58186","CVE-2025-58187","CVE-2025-58188","CVE-2025-58189","CVE-2025-61723","CVE-2025-61724","CVE-2025-61725","CVE-2025-61726","CVE-2025-61727","CVE-2025-61728","CVE-2025-61729","CVE-2025-61730","CVE-2025-61731","CVE-2025-68119","CVE-2025-68121"]},{"id":"openSUSE-SU-2025:15525-1","title":"go1.25-1.25.1-1.1 on GA media","vulnerabilityIds":["CVE-2025-47910"]}],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2025-30469","identifiers":["EUVD-2025-30469","CVE-2025-47910","GHSA-8pjc-487g-w6p2"]},"retained":false,"historicalAffected":[]}],"coverage":[]}