github.com/gorilla/csrf

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

High 7.3

CVE-2025-47909

Improper validation of TrustedOrigins allows CSRF attacks in github.com/gorilla/csrf

Hosts listed in TrustedOrigins implicitly allow requests from the corresponding HTTP origins, allowing network MitMs to perform CSRF attacks. After the CVE-2025-24358 fix, a network attacker that places a form at http://example.com can't get it to submit to h…

github.com/gorilla/csrf github.com/gorilla/csrf golang-github-gorilla-csrf github.com/gorilla/csrf Debian Ubuntu Go

Aug 29, 2025
Medium 5.4

CVE-2025-24358

gorilla/csrf CSRF vulnerability due to broken Referer validation

gorilla/csrf provides Cross Site Request Forgery (CSRF) prevention middleware for Go web applications & services. Prior to 1.7.2, gorilla/csrf does not validate the Origin header against an allowlist. Its executes its validation of the Referer header for cros…

gorilla csrf github.com/gorilla/csrf golang-github-gorilla-csrf Debian Ubuntu Go

Apr 15, 2025