golang-github-gorilla-csrf

2 results · Feed

• High 7.3
  CVE-2025-47909

  Improper validation of TrustedOrigins allows CSRF attacks in github.com/gorilla/csrf

  Hosts listed in TrustedOrigins implicitly allow requests from the corresponding HTTP origins, allowing network MitMs to perform CSRF attacks. After the CVE-2025-24358 fix, a network attacker that places a form at http://example.com can't get it to submit to h…

  github.com/gorilla/csrf github.com/gorilla/csrf golang-github-gorilla-csrf github.com/gorilla/csrf Debian Ubuntu Go
  Aug 29, 2025
• Medium 5.4
  CVE-2025-24358

  gorilla/csrf CSRF vulnerability due to broken Referer validation

  gorilla/csrf provides Cross Site Request Forgery (CSRF) prevention middleware for Go web applications & services. Prior to 1.7.2, gorilla/csrf does not validate the Origin header against an allowlist. Its executes its validation of the Referer header for cros…

  gorilla csrf github.com/gorilla/csrf golang-github-gorilla-csrf Debian Ubuntu Go
  Apr 15, 2025