CVE-2025-47910

Description

When using http.CrossOriginProtection, the AddInsecureBypassPattern method can unexpectedly bypass more requests than intended. CrossOriginProtection then skips validation, but forwards the original request path, which may be served by a different handler without the intended security protections.

CVSS Metrics

• v3.1•MEDIUM•Score: 5.4CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

EPSS Trends

Current EPSS score: 0.33%• Percentile: 26%

Affected Systems

• chainguard•aactl

  < 0.4.12-r36

• chainguard•amazon-cloudwatch-agent-operator

  < 3.2.0-r0

• chainguard•amazon-cloudwatch-agent-operator-compat

  < 3.2.0-r0

• chainguard•apm-server-8.17

  < 8.17.10-r1

• chainguard•apm-server-8.17-compat

  < 8.17.10-r1

• chainguard•argo-events

  < 1.9.7-r4

• chainguard•aws-application-networking-k8s

  < 1.1.4-r2

• chainguard•aws-application-networking-k8s-compat

  < 1.1.4-r2

• chainguard•aws-eks-pod-identity-agent

  < 0.1.33-r1

• chainguard•aws-eks-pod-identity-agent-compat

  < 0.1.33-r1

• chainguard•aws-otel-collector

  < 0.45.0-r1

• chainguard•aws-otel-collector-compat

  < 0.45.0-r1

• chainguard•aws-otel-collector-healthcheck

  < 0.45.0-r1

• chainguard•aws-privateca-issuer

  < 1.7.0-r1

• chainguard•aws-privateca-issuer-compat

  < 1.7.0-r1

• chainguard•azure-service-operator

  < 2.15.0-r1

• chainguard•azure-service-operator-compat

  < 2.15.0-r1

• chainguard•azuredisk-csi-1.31

  < 1.31.11-r5

• chainguard•azuredisk-csi-1.31-compat

  < 1.31.11-r5

• chainguard•blob-csi-1.25

  < 1.25.9-r7

• chainguard•blob-csi-1.25-compat

  < 1.25.9-r7

• chainguard•blob-csi-1.26

  < 1.26.7-r3

• chainguard•blob-csi-1.26-compat

  < 1.26.7-r3

• chainguard•bom

  < 0.6.0-r25

• chainguard•buildctl

  < 0.24.0-r1

• chainguard•buildkitd

  < 0.24.0-r1

• chainguard•caddy

  < 2.10.2-r1

• chainguard•caddy-man

  < 2.10.2-r1

• chainguard•caddy-src

  < 2.10.2-r1

• chainguard•cerbos

  < 0.46.0-r3

• chainguard•cerbos-compat

  < 0.46.0-r3

• chainguard•cerbosctl

  < 0.46.0-r3

• chainguard•cerbosctl-compat

  < 0.46.0-r3

• chainguard•cert-manager-1.18

  < 1.18.2-r4

• chainguard•cert-manager-acmesolver-1.18

  < 1.18.2-r4

• chainguard•cert-manager-acmesolver-1.18-iamguarded-compat

  < 1.18.2-r4

• chainguard•cert-manager-cainjector-1.18

  < 1.18.2-r4

• chainguard•cert-manager-cainjector-1.18-iamguarded-compat

  < 1.18.2-r4

• chainguard•cert-manager-cmctl

  < 0

• chainguard•cert-manager-controller-1.18

  < 1.18.2-r4

• chainguard•cert-manager-controller-1.18-iamguarded-compat

  < 1.18.2-r4

• chainguard•cert-manager-startupapicheck-1.18

  < 1.18.2-r4

• chainguard•cert-manager-webhook-1.18

  < 1.18.2-r4

• chainguard•cert-manager-webhook-1.18-iamguarded-compat

  < 1.18.2-r4

• chainguard•cg

  < 0_git20250819-r2

• chainguard•chart-testing

  < 3.13.0-r8

• chainguard•chartmuseum

  < 0.16.3-r7

• chainguard•cilium-cli

  < 0.18.7-r1

• chainguard•cis-operator-1.2

  < 1.2.7-r4

• chainguard•cis-operator-1.3

  < 1.3.8-r4

Showing first 50 affected entries in server-rendered view.

References (5)

• https://go.dev/cl/699275
• https://go.dev/issue/75054
• https://groups.google.com/g/golang-announce/c/PtW9VW21NPs/m/DJhMQ-m5AQAJ
• https://pkg.go.dev/vuln/GO-2025-3955
• https://security-tracker.debian.org/tracker/CVE-2025-47910