CVE-2025-47908: Denial of service via malicious preflight requests in github.com/rs/cors

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-08-06 · updated 2026-06-17

Description

Middleware causes a prohibitive amount of heap allocations when processing malicious preflight requests that include a Access-Control-Request-Headers (ACRH) header whose value contains many commas. This behavior can be abused by attackers to produce undue load on the middleware/server as an attempt to cause a denial of service.

Affected products

github.com/rs/cors: from 1.9.0 before 1.11.0 — fixed in 1.11.0

How to fix

Upgrade to a fixed version: github.com/rs/cors 1.11.0. Check the vendor advisory for mitigations.

References

https://github.com/rs/cors/issues/170
https://github.com/rs/cors/pull/171
https://pkg.go.dev/vuln/GO-2024-2883

Get alerted when CVE-2025-47908 or the next vulnerability affects your stack