Security controls bypass or absence In golang-1.25
Description
When using http.CrossOriginProtection, the AddInsecureBypassPattern method can unexpectedly bypass more requests than intended. CrossOriginProtection then skips validation, but forwards the original request path, which may be served by a different handler without the intended security protections.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Package | Affected version | Patched versions |
|---|---|---|---|
 debian 14 | 1.25.1-1 | ||
 go | 1.25.1 | ||
 rpm rhel10 | - | - | |
rpm rhel9 | - | - | |
rpm rhel9 | - | - | |
rpm rhel10 | - | - | |
rpm rhel8 | - | - | |
rpm rhel10 | - | - | |
rpm rhel8 | - | - | |
rpm rhel9 | - | - |
1-10 of 57
10
Aliases
1. 2. 3. 4. 5. 6. 7.
References
1. 2. 3.