Skip to content
OpenAdvisories
High · 7.5 CVE-2025-47908 EUVD-2025-23882GHSA-mh55-gqvf-xfwmGO-2024-2883

Denial of service via malicious preflight requests in github.com/rs/cors

Published Aug 6, 2025 · Updated Aug 7, 2025 · Assigned by Go

Vendor: github.com/rs/cors Product: github.com/rs/cors Package: cortex Package: fulcio Package: github.com/rs/cors Package: golang-github-rs-cors Package: grafana-mimir Package: prometheus-alertmanager Package: prometheus-alertmanager-iamguarded-compat Package: rekor Package: rekor-backfill-index Package: rekor-cli Package: rekor-server Package: timestamp-authority Package: timestamp-authority-cli Package: timestamp-authority-server Ecosystem: Go Ecosystem: Ubuntu Ecosystem: Wolfi

Description

Middleware causes a prohibitive amount of heap allocations when processing malicious preflight requests that include a Access-Control-Request-Headers (ACRH) header whose value contains many commas. This behavior can be abused by attackers to produce undue load on the middleware/server as an attempt to cause a denial of service.

Affected products

VendorProductAffectedFixed
github.com/rs/cors github.com/rs/cors 1.9.0 – < 1.11.0 1.11.0

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.10 golang-github-rs-cors No fix yet —
Ubuntu 26.04 LTS golang-github-rs-cors No fix yet —
Ubuntu 25.10 golang-github-rs-cors No fix yet —
Ubuntu 24.04 LTS golang-github-rs-cors No fix yet —
Ubuntu 22.04 LTS golang-github-rs-cors No fix yet —
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu 20.04 LTS golang-github-rs-cors No fix yet —

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP7 golang-github-prometheus-alertmanager 0.28.1-150100.4.28.2 SUSE-SU-2025:4481-1
SLES 15 SP6 golang-github-prometheus-alertmanager 0.28.1-150100.4.28.2 SUSE-SU-2025:4481-1
Show 6 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SUSE Multi Linux Manager Tools SLE-Micro-5 dracut-saltboot 1.0.0-150002.3.3.1 SUSE-SU-2025:3819-1
SUSE Multi Linux Manager Tools SLE-Micro-5 uyuni-tools 5.1.20-150002.3.3.3 SUSE-SU-2025:3819-1
SUSE Multi Linux Manager Tools SLE-15 dracut-saltboot 1.0.0-150002.3.3.1 SUSE-SU-2025:3819-1
SUSE Multi Linux Manager Tools SLE-15 golang-github-prometheus-alertmanager 0.28.1-150002.4.3.3 SUSE-SU-2025:3819-1
SUSE Multi Linux Manager Tools SLE-15 grafana 11.5.7-150002.4.3.3 SUSE-SU-2025:3819-1
SUSE Multi Linux Manager Tools SLE-15 mgr-push 5.1.4-150002.3.3.3 SUSE-SU-2025:3819-1
SUSE Multi Linux Manager Tools SLE-15 python-defusedxml 0.7.1-150002.1.3.2 SUSE-SU-2025:3819-1
SUSE Multi Linux Manager Tools SLE-15 rhnlib 5.1.3-150002.3.3.2 SUSE-SU-2025:3819-1
SUSE Multi Linux Manager Tools SLE-15 spacecmd 5.1.11-150002.3.3.2 SUSE-SU-2025:3819-1
SUSE Multi Linux Manager Tools SLE-15 spacewalk-client-tools 5.1.7-150002.3.3.3 SUSE-SU-2025:3819-1
SUSE Multi Linux Manager Tools SLE-15 supportutils-plugin-susemanager-client 5.1.4-150002.3.3.2 SUSE-SU-2025:3819-1
SUSE Multi Linux Manager Tools SLE-15 uyuni-tools 5.1.20-150002.3.3.3 SUSE-SU-2025:3819-1
SUSE Multi Linux Manager Tools SLE-12 Multi-Linux-ManagerTools-SLE-release 12-120002.1.3.2 SUSE-SU-2025:3817-1
SUSE Multi Linux Manager Tools SLE-12 golang-github-prometheus-alertmanager 0.28.1-120002.4.3.2 SUSE-SU-2025:3817-1
SUSE Multi Linux Manager Tools SLE-12 grafana 11.5.7-120002.4.3.2 SUSE-SU-2025:3817-1
SUSE Multi Linux Manager Tools SLE-12 mgr-push 5.1.4-120002.3.3.3 SUSE-SU-2025:3817-1
SUSE Multi Linux Manager Tools SLE-12 python-defusedxml 0.6.0-120002.1.3.1 SUSE-SU-2025:3817-1
SUSE Multi Linux Manager Tools SLE-12 rhnlib 5.1.3-120002.3.3.1 SUSE-SU-2025:3817-1
SUSE Multi Linux Manager Tools SLE-12 spacecmd 5.1.11-120002.3.3.2 SUSE-SU-2025:3817-1
SUSE Multi Linux Manager Tools SLE-12 spacewalk-client-tools 5.1.7-120002.3.3.2 SUSE-SU-2025:3817-1
SUSE Multi Linux Manager Tools SLE-12 supportutils-plugin-susemanager-client 5.1.4-120002.3.3.1 SUSE-SU-2025:3817-1
SUSE Manager Proxy LTS 4.3 golang-github-prometheus-alertmanager 0.28.1-150100.4.28.2 SUSE-SU-2025:4481-1
SUSE Manager Client Tools 15 golang-github-prometheus-alertmanager 0.28.1-150100.4.28.2 SUSE-SU-2025:4481-1
SUSE Manager Client Tools 12 golang-github-prometheus-alertmanager 0.28.1-1.34.1 SUSE-SU-2025:4457-1
SUSE Manager Client Tools 12 grafana 11.5.10-1.87.1 SUSE-SU-2025:4457-1
SUSE Manager Client Tools 12 mgr-push 5.0.3-1.30.3 SUSE-SU-2025:4457-1
SUSE Manager Client Tools 12 rhnlib 5.0.6-21.55.1 SUSE-SU-2025:4457-1
SUSE Manager Client Tools 12 spacecmd 5.0.14-38.162.1 SUSE-SU-2025:4457-1
SUSE Manager Client Tools 12 supportutils-plugin-susemanager-client 5.0.5-6.36.1 SUSE-SU-2025:4457-1
SUSE Manager Client Tools 12 uyuni-tools 0.1.37-1.27.1 SUSE-SU-2025:4457-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed govulncheck-vulndb 0.0.20250807T150727-1.1 openSUSE-SU-2025:15424-1
openSUSE Leap 16.0 golang-github-prometheus-alertmanager 0.28.1-bp160.1.1 openSUSE-SU-2026:21136-1
openSUSE Leap 15.6 golang-github-prometheus-alertmanager 0.28.1-150100.4.28.2 SUSE-SU-2025:4481-1

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling cortex 1.17.1-r4 —
Wolfi rolling fulcio 1.4.5-r7 —
Wolfi rolling grafana-mimir 2.13.0-r1 —
Wolfi rolling prometheus-alertmanager +1 0.27.0-r8 —
Wolfi rolling rekor +3 1.3.6-r8 —
Wolfi rolling timestamp-authority +2 1.2.2-r12 —

Affected packages

EcosystemPackageAffectedFixedRecord
Go github.com/rs/cors >= 1.9.0, < 1.11.0 1.11.0 GHSA-mh55-gqvf-xfwm

Advisories 6

References