High severity7.5GHSA Advisory· Published Aug 6, 2025· Updated Apr 15, 2026

CVE-2025-47908

Description

Middleware causes a prohibitive amount of heap allocations when processing malicious preflight requests that include a Access-Control-Request-Headers (ACRH) header whose value contains many commas. This behavior can be abused by attackers to produce undue load on the middleware/server as an attempt to cause a denial of service.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
github.com/rs/corsGo	>= 1.9.0, < 1.11.0	1.11.0

Affected products

157

Rs/CorsGHSA
Range: >= 1.9.0, < 1.11.0
osv-coords156 versions
pkg:apk/chainguard/argo-cd-2.10 pkg:apk/chainguard/argo-cd-2.10-compat pkg:apk/chainguard/argo-cd-2.10-repo-server pkg:apk/chainguard/argo-cd-2.11 pkg:apk/chainguard/argo-cd-2.11-compat pkg:apk/chainguard/argo-cd-2.11-repo-server pkg:apk/chainguard/argo-cd-fips-2.10 pkg:apk/chainguard/argo-cd-fips-2.10-compat pkg:apk/chainguard/argo-cd-fips-2.10-repo-server pkg:apk/chainguard/argo-cd-fips-2.11 pkg:apk/chainguard/argo-cd-fips-2.11-compat pkg:apk/chainguard/argo-cd-fips-2.11-repo-server pkg:apk/chainguard/cortex pkg:apk/chainguard/cortex-fips pkg:apk/chainguard/datadog-agent pkg:apk/chainguard/datadog-agent-core-integrations pkg:apk/chainguard/datadog-agent-core-integrations-fips pkg:apk/chainguard/datadog-agent-fakeintake pkg:apk/chainguard/datadog-agent-fakeintake-fips pkg:apk/chainguard/datadog-agent-fips pkg:apk/chainguard/datadog-agent-jmx pkg:apk/chainguard/datadog-agent-jmx-fips pkg:apk/chainguard/datadog-agent-oci-compat pkg:apk/chainguard/datadog-agent-oci-compat-fips pkg:apk/chainguard/datadog-agent-s6-overlay pkg:apk/chainguard/datadog-agent-s6-overlay-fips pkg:apk/chainguard/datadog-cluster-agent pkg:apk/chainguard/datadog-cluster-agent-fips pkg:apk/chainguard/datadog-cluster-agent-oci-compat pkg:apk/chainguard/datadog-cluster-agent-oci-compat-fips pkg:apk/chainguard/dogstatsd pkg:apk/chainguard/fulcio pkg:apk/chainguard/fulcio-fips pkg:apk/chainguard/go-ipfs-fips pkg:apk/chainguard/grafana-10.4 pkg:apk/chainguard/grafana-10.4-oci-compat pkg:apk/chainguard/grafana-11.0 pkg:apk/chainguard/grafana-11.1 pkg:apk/chainguard/grafana-11.1-oci-compat pkg:apk/chainguard/grafana-fips-10.4 pkg:apk/chainguard/grafana-fips-10.4-oci-compat pkg:apk/chainguard/grafana-fips-11.0 pkg:apk/chainguard/grafana-fips-11.0-oci-compat pkg:apk/chainguard/grafana-fips-11.1 pkg:apk/chainguard/grafana-fips-11.1-oci-compat pkg:apk/chainguard/grafana-mimir pkg:apk/chainguard/grafana-mimir-metaconvert pkg:apk/chainguard/grafana-mimir-mimirtool pkg:apk/chainguard/grafana-mimir-query-tee pkg:apk/chainguard/grafana-oci-compat pkg:apk/chainguard/ipfs pkg:apk/chainguard/mattermost-9 pkg:apk/chainguard/mattermost-9-compat pkg:apk/chainguard/prometheus-alertmanager pkg:apk/chainguard/prometheus-alertmanager-bitnami-compat pkg:apk/chainguard/prometheus-alertmanager-fips pkg:apk/chainguard/prometheus-alertmanager-fips-iamguarded-compat pkg:apk/chainguard/prometheus-alertmanager-iamguarded-compat pkg:apk/chainguard/rekor pkg:apk/chainguard/rekor-backfill-index pkg:apk/chainguard/rekor-backfill-redis pkg:apk/chainguard/rekor-cli pkg:apk/chainguard/rekor-fips pkg:apk/chainguard/rekor-fips-backfill-index pkg:apk/chainguard/rekor-fips-backfill-redis pkg:apk/chainguard/rekor-fips-cli pkg:apk/chainguard/rekor-fips-server pkg:apk/chainguard/rekor-server pkg:apk/chainguard/tempo-2.3 pkg:apk/chainguard/tempo-2.3-cli pkg:apk/chainguard/tempo-2.3-query pkg:apk/chainguard/tempo-2.3-vulture pkg:apk/chainguard/tempo-fips pkg:apk/chainguard/tempo-fips-cli pkg:apk/chainguard/tempo-fips-query pkg:apk/chainguard/tempo-fips-vulture pkg:apk/chainguard/timestamp-authority pkg:apk/chainguard/timestamp-authority-cli pkg:apk/chainguard/timestamp-authority-fips pkg:apk/chainguard/timestamp-authority-fips-cli pkg:apk/chainguard/timestamp-authority-fips-server pkg:apk/chainguard/timestamp-authority-server pkg:apk/wolfi/argo-cd-2.10 pkg:apk/wolfi/argo-cd-2.10-compat pkg:apk/wolfi/argo-cd-2.10-repo-server pkg:apk/wolfi/argo-cd-2.11 pkg:apk/wolfi/argo-cd-2.11-compat pkg:apk/wolfi/argo-cd-2.11-repo-server pkg:apk/wolfi/cortex pkg:apk/wolfi/datadog-agent pkg:apk/wolfi/datadog-agent-core-integrations pkg:apk/wolfi/datadog-agent-fakeintake pkg:apk/wolfi/datadog-agent-jmx pkg:apk/wolfi/datadog-agent-oci-compat pkg:apk/wolfi/datadog-agent-s6-overlay pkg:apk/wolfi/datadog-cluster-agent pkg:apk/wolfi/datadog-cluster-agent-oci-compat pkg:apk/wolfi/dogstatsd pkg:apk/wolfi/fulcio pkg:apk/wolfi/grafana-10.4 pkg:apk/wolfi/grafana-11.0 pkg:apk/wolfi/grafana-11.1 pkg:apk/wolfi/grafana-mimir pkg:apk/wolfi/grafana-mimir-metaconvert pkg:apk/wolfi/grafana-mimir-mimirtool pkg:apk/wolfi/grafana-mimir-query-tee pkg:apk/wolfi/grafana-oci-compat pkg:apk/wolfi/ipfs pkg:apk/wolfi/mattermost-9 pkg:apk/wolfi/mattermost-9-compat pkg:apk/wolfi/prometheus-alertmanager pkg:apk/wolfi/prometheus-alertmanager-bitnami-compat pkg:apk/wolfi/prometheus-alertmanager-iamguarded-compat pkg:apk/wolfi/rekor pkg:apk/wolfi/rekor-backfill-index pkg:apk/wolfi/rekor-backfill-redis pkg:apk/wolfi/rekor-cli pkg:apk/wolfi/rekor-server pkg:apk/wolfi/timestamp-authority pkg:apk/wolfi/timestamp-authority-cli pkg:apk/wolfi/timestamp-authority-server pkg:golang/github.com/rs/cors pkg:rpm/opensuse/golang-github-prometheus-alertmanager&distro=openSUSE%20Leap%2015.6 pkg:rpm/opensuse/govulncheck-vulndb&distro=openSUSE%20Tumbleweed pkg:rpm/suse/dracut-saltboot&distro=SUSE%20Multi%20Linux%20Manager%20Tools%20SLE-15 pkg:rpm/suse/dracut-saltboot&distro=SUSE%20Multi%20Linux%20Manager%20Tools%20SLE-Micro-5 pkg:rpm/suse/golang-github-prometheus-alertmanager&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Package%20Hub%2015%20SP6 pkg:rpm/suse/golang-github-prometheus-alertmanager&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Package%20Hub%2015%20SP7 pkg:rpm/suse/golang-github-prometheus-alertmanager&distro=SUSE%20Manager%20Client%20Tools%2012 pkg:rpm/suse/golang-github-prometheus-alertmanager&distro=SUSE%20Manager%20Client%20Tools%2015 pkg:rpm/suse/golang-github-prometheus-alertmanager&distro=SUSE%20Manager%20Proxy%20LTS%204.3 pkg:rpm/suse/golang-github-prometheus-alertmanager&distro=SUSE%20Multi%20Linux%20Manager%20Tools%20SLE-12 pkg:rpm/suse/golang-github-prometheus-alertmanager&distro=SUSE%20Multi%20Linux%20Manager%20Tools%20SLE-15 pkg:rpm/suse/grafana&distro=SUSE%20Manager%20Client%20Tools%2012 pkg:rpm/suse/grafana&distro=SUSE%20Multi%20Linux%20Manager%20Tools%20SLE-12 pkg:rpm/suse/grafana&distro=SUSE%20Multi%20Linux%20Manager%20Tools%20SLE-15 pkg:rpm/suse/mgr-push&distro=SUSE%20Manager%20Client%20Tools%2012 pkg:rpm/suse/mgr-push&distro=SUSE%20Multi%20Linux%20Manager%20Tools%20SLE-12 pkg:rpm/suse/mgr-push&distro=SUSE%20Multi%20Linux%20Manager%20Tools%20SLE-15 pkg:rpm/suse/Multi-Linux-ManagerTools-SLE-release&distro=SUSE%20Multi%20Linux%20Manager%20Tools%20SLE-12 pkg:rpm/suse/python-defusedxml&distro=SUSE%20Multi%20Linux%20Manager%20Tools%20SLE-12 pkg:rpm/suse/python-defusedxml&distro=SUSE%20Multi%20Linux%20Manager%20Tools%20SLE-15 pkg:rpm/suse/rhnlib&distro=SUSE%20Manager%20Client%20Tools%2012 pkg:rpm/suse/rhnlib&distro=SUSE%20Multi%20Linux%20Manager%20Tools%20SLE-12 pkg:rpm/suse/rhnlib&distro=SUSE%20Multi%20Linux%20Manager%20Tools%20SLE-15 pkg:rpm/suse/spacecmd&distro=SUSE%20Manager%20Client%20Tools%2012 pkg:rpm/suse/spacecmd&distro=SUSE%20Multi%20Linux%20Manager%20Tools%20SLE-12 pkg:rpm/suse/spacecmd&distro=SUSE%20Multi%20Linux%20Manager%20Tools%20SLE-15 pkg:rpm/suse/spacewalk-client-tools&distro=SUSE%20Multi%20Linux%20Manager%20Tools%20SLE-12 pkg:rpm/suse/spacewalk-client-tools&distro=SUSE%20Multi%20Linux%20Manager%20Tools%20SLE-15 pkg:rpm/suse/supportutils-plugin-susemanager-client&distro=SUSE%20Manager%20Client%20Tools%2012 pkg:rpm/suse/supportutils-plugin-susemanager-client&distro=SUSE%20Multi%20Linux%20Manager%20Tools%20SLE-12 pkg:rpm/suse/supportutils-plugin-susemanager-client&distro=SUSE%20Multi%20Linux%20Manager%20Tools%20SLE-15 pkg:rpm/suse/uyuni-tools&distro=SUSE%20Manager%20Client%20Tools%2012 pkg:rpm/suse/uyuni-tools&distro=SUSE%20Multi%20Linux%20Manager%20Tools%20SLE-15 pkg:rpm/suse/uyuni-tools&distro=SUSE%20Multi%20Linux%20Manager%20Tools%20SLE-Micro-5
< 2.10.13-r2+ 155 more
- (no CPE)range: < 2.10.13-r2
- (no CPE)range: < 2.10.13-r2
- (no CPE)range: < 2.10.13-r2
- (no CPE)range: < 2.11.4-r2
- (no CPE)range: < 2.11.4-r2
- (no CPE)range: < 2.11.4-r2
- (no CPE)range: < 2.10.13-r2
- (no CPE)range: < 2.10.13-r2
- (no CPE)range: < 2.10.13-r2
- (no CPE)range: < 2.11.4-r2
- (no CPE)range: < 2.11.4-r2
- (no CPE)range: < 2.11.4-r2
- (no CPE)range: < 1.17.1-r4
- (no CPE)range: < 1.17.1-r6
- (no CPE)range: < 7.54.1-r3
- (no CPE)range: < 7.54.1-r3
- (no CPE)range: < 7.64.1-r0
- (no CPE)range: < 7.54.1-r3
- (no CPE)range: < 7.64.1-r0
- (no CPE)range: < 7.64.1-r0
- (no CPE)range: < 7.54.1-r3
- (no CPE)range: < 7.64.1-r0
- (no CPE)range: < 7.54.1-r3
- (no CPE)range: < 7.64.1-r0
- (no CPE)range: < 7.54.1-r3
- (no CPE)range: < 7.64.1-r0
- (no CPE)range: < 7.64.1-r0
- (no CPE)range: < 7.64.1-r0
- (no CPE)range: < 7.64.1-r0
- (no CPE)range: < 7.64.1-r0
- (no CPE)range: < 7.54.1-r3
- (no CPE)range: < 1.4.5-r7
- (no CPE)range: < 1.4.5-r8
- (no CPE)range: < 0.29.0-r2
- (no CPE)range: < 10.4.5-r2
- (no CPE)range: < 10.4.5-r2
- (no CPE)range: < 11.0.1-r3
- (no CPE)range: < 11.1.0-r3
- (no CPE)range: < 11.1.0-r3
- (no CPE)range: < 10.4.5-r2
- (no CPE)range: < 10.4.5-r2
- (no CPE)range: < 11.0.1-r2
- (no CPE)range: < 11.0.1-r2
- (no CPE)range: < 11.1.0-r3
- (no CPE)range: < 11.1.0-r3
- (no CPE)range: < 2.13.0-r1
- (no CPE)range: < 2.13.0-r1
- (no CPE)range: < 2.13.0-r1
- (no CPE)range: < 2.13.0-r1
- (no CPE)range: < 11.0.1-r3
- (no CPE)range: < 0.29.0-r2
- (no CPE)range: < 9.9.1-r2
- (no CPE)range: < 9.9.1-r2
- (no CPE)range: < 0.27.0-r8
- (no CPE)range: < 0.27.0-r8
- (no CPE)range: < 0.27.0-r10
- (no CPE)range: < 0.27.0-r10
- (no CPE)range: < 0.27.0-r8
- (no CPE)range: < 1.3.6-r8
- (no CPE)range: < 1.3.6-r8
- (no CPE)range: < 1.3.6-r8
- (no CPE)range: < 1.3.6-r8
- (no CPE)range: < 1.3.6-r9
- (no CPE)range: < 1.3.6-r9
- (no CPE)range: < 1.3.6-r9
- (no CPE)range: < 1.3.6-r9
- (no CPE)range: < 1.3.6-r9
- (no CPE)range: < 1.3.6-r8
- (no CPE)range: < 2.3.1-r6
- (no CPE)range: < 2.3.1-r6
- (no CPE)range: < 2.3.1-r6
- (no CPE)range: < 2.3.1-r6
- (no CPE)range: < 2.5.0-r6
- (no CPE)range: < 2.5.0-r6
- (no CPE)range: < 2.5.0-r6
- (no CPE)range: < 2.5.0-r6
- (no CPE)range: < 1.2.2-r12
- (no CPE)range: < 1.2.2-r12
- (no CPE)range: < 1.2.2-r12
- (no CPE)range: < 1.2.2-r12
- (no CPE)range: < 1.2.2-r12
- (no CPE)range: < 1.2.2-r12
- (no CPE)range: < 2.10.13-r2
- (no CPE)range: < 2.10.13-r2
- (no CPE)range: < 2.10.13-r2
- (no CPE)range: < 2.11.4-r2
- (no CPE)range: < 2.11.4-r2
- (no CPE)range: < 2.11.4-r2
- (no CPE)range: < 1.17.1-r4
- (no CPE)range: < 7.54.1-r3
- (no CPE)range: < 7.54.1-r3
- (no CPE)range: < 7.54.1-r3
- (no CPE)range: < 7.54.1-r3
- (no CPE)range: < 7.54.1-r3
- (no CPE)range: < 7.54.1-r3
- (no CPE)range: < 7.64.1-r0
- (no CPE)range: < 7.64.1-r0
- (no CPE)range: < 7.54.1-r3
- (no CPE)range: < 1.4.5-r7
- (no CPE)range: < 10.4.5-r2
- (no CPE)range: < 11.0.1-r3
- (no CPE)range: < 11.1.0-r3
- (no CPE)range: < 2.13.0-r1
- (no CPE)range: < 2.13.0-r1
- (no CPE)range: < 2.13.0-r1
- (no CPE)range: < 2.13.0-r1
- (no CPE)range: < 11.0.1-r3
- (no CPE)range: < 0.29.0-r2
- (no CPE)range: < 9.9.1-r2
- (no CPE)range: < 9.9.1-r2
- (no CPE)range: < 0.27.0-r8
- (no CPE)range: < 0.27.0-r8
- (no CPE)range: < 0.27.0-r8
- (no CPE)range: < 1.3.6-r8
- (no CPE)range: < 1.3.6-r8
- (no CPE)range: < 1.3.6-r8
- (no CPE)range: < 1.3.6-r8
- (no CPE)range: < 1.3.6-r8
- (no CPE)range: < 1.2.2-r12
- (no CPE)range: < 1.2.2-r12
- (no CPE)range: < 1.2.2-r12
- (no CPE)range: >= 1.9.0, < 1.11.0
- (no CPE)range: < 0.28.1-150100.4.28.2
- (no CPE)range: < 0.0.20250807T150727-1.1
- (no CPE)range: < 1.0.0-150002.3.3.1
- (no CPE)range: < 1.0.0-150002.3.3.1
- (no CPE)range: < 0.28.1-150100.4.28.2
- (no CPE)range: < 0.28.1-150100.4.28.2
- (no CPE)range: < 0.28.1-1.34.1
- (no CPE)range: < 0.28.1-150100.4.28.2
- (no CPE)range: < 0.28.1-150100.4.28.2
- (no CPE)range: < 0.28.1-120002.4.3.2
- (no CPE)range: < 0.28.1-150002.4.3.3
- (no CPE)range: < 11.5.10-1.87.1
- (no CPE)range: < 11.5.7-120002.4.3.2
- (no CPE)range: < 11.5.7-150002.4.3.3
- (no CPE)range: < 5.0.3-1.30.3
- (no CPE)range: < 5.1.4-120002.3.3.3
- (no CPE)range: < 5.1.4-150002.3.3.3
- (no CPE)range: < 12-120002.1.3.2
- (no CPE)range: < 0.6.0-120002.1.3.1
- (no CPE)range: < 0.7.1-150002.1.3.2
- (no CPE)range: < 5.0.6-21.55.1
- (no CPE)range: < 5.1.3-120002.3.3.1
- (no CPE)range: < 5.1.3-150002.3.3.2
- (no CPE)range: < 5.0.14-38.162.1
- (no CPE)range: < 5.1.11-120002.3.3.2
- (no CPE)range: < 5.1.11-150002.3.3.2
- (no CPE)range: < 5.1.7-120002.3.3.2
- (no CPE)range: < 5.1.7-150002.3.3.3
- (no CPE)range: < 5.0.5-6.36.1
- (no CPE)range: < 5.1.4-120002.3.3.1
- (no CPE)range: < 5.1.4-150002.3.3.2
- (no CPE)range: < 0.1.37-1.27.1
- (no CPE)range: < 5.1.20-150002.3.3.3
- (no CPE)range: < 5.1.20-150002.3.3.3

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-mh55-gqvf-xfwmghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2025-47908ghsaADVISORY
github.com/rs/cors/commit/4c32059b2756926619f6bf70281b91be7b5dddb2ghsaWEB
github.com/rs/cors/issues/170nvdWEB
github.com/rs/cors/pull/171nvdWEB
pkg.go.dev/vuln/GO-2024-2883nvdWEB

News mentions

No linked articles in our index yet.

cvss	0.488
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000