Medium severity · published Sep 22, 2025
CVE-2025-47910
CrossOriginProtection insecure bypass patterns not limited to exact matches in net/http
5.4
CVSS
0.3%
EPSS
No
On KEV
Description
When using http.CrossOriginProtection, the AddInsecureBypassPattern method can unexpectedly bypass more requests than intended. CrossOriginProtection then skips validation, but forwards the original request path, which may be served by a different handler without the intended security protections.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 26% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NE
net/http · Go standard library
1.25.0 before 1.25.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-47910
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-47910
go.dev
https://go.dev/cl/699275
go.dev
https://go.dev/issue/75054
groups.google.com
https://groups.google.com/g/golang-announce/c/PtW9VW21NPs/m/DJhMQ-m5AQAJ
pkg.go.dev
https://pkg.go.dev/vuln/GO-2025-3955
More from net/http
9.6
CVE-2026-39821
Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna
9.1
CVE-2026-78663
Double flow control refund on HTTP/2 server streams in net/http
7.5
CVE-2026-97032
HTTP/2 server crash due to HPACK encoder race in net/http
7.5
CVE-2026-94439
HTTP/1 server connection desynchronization after 2xx CONNECT response in net/http
7.5
CVE-2026-78669
Excessive CPU consumption from repeated initial window changes in net/http