Analysis and contextual insights are available on OpenCVE Cloud.
No vendor fix or workaround currently provided.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
| Source | ID | Title |
|---|---|---|
EUVD |
EUVD-2025-30469 | When using http.CrossOriginProtection, the AddInsecureBypassPattern method can unexpectedly bypass more requests than intended. CrossOriginProtection then skips validation, but forwards the original request path, which may be served by a different handler without the intended security protections. |
Fri, 26 Sep 2025 12:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Weaknesses | CWE-440 | |
| References |
| |
| Metrics |
threat_severity
|
threat_severity
|
Wed, 24 Sep 2025 14:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
cvssV3_1
|
Tue, 23 Sep 2025 16:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Go Standard Library
Go Standard Library net\/http Golang Golang http2 Golang net |
|
| Vendors & Products |
Go Standard Library
Go Standard Library net\/http Golang Golang http2 Golang net |
Mon, 22 Sep 2025 21:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | When using http.CrossOriginProtection, the AddInsecureBypassPattern method can unexpectedly bypass more requests than intended. CrossOriginProtection then skips validation, but forwards the original request path, which may be served by a different handler without the intended security protections. | |
| Title | CrossOriginProtection insecure bypass patterns not limited to exact matches in net/http | |
| References |
|
Status: PUBLISHED
Assigner: Go
Published:
Updated: 2025-09-24T13:29:45.405Z
Reserved: 2025-05-13T23:31:29.597Z
Link: CVE-2025-47910
Updated: 2025-09-24T13:29:28.022Z
Status : Deferred
Published: 2025-09-22T21:15:59.627
Modified: 2026-04-15T00:35:42.020
Link: CVE-2025-47910
OpenCVE Enrichment
Updated: 2025-09-23T16:03:40Z
EUVD