CVE-2025-47908 Denial of service via malicious preflight requests in github.com/rs/cors
Attackers can cause denial of service by sending malicious preflight requests with excessive commas in headers, leading to excessive heap allocations in the Go CORS middleware.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-47908?
CVE-2025-47908 is a high-severity denial of service vulnerability in github.com/rs/cors, published on 6 Aug 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Middleware causes a prohibitive amount of heap allocations when processing malicious preflight requests that include a Access-Control-Request-Headers (ACRH) header whose value contains many commas. This behavior can be abused by attackers to produce undue load on the middleware/server as an attempt to cause a denial of service.
Which versions are affected by CVE-2025-47908?
3 open source packages ship an affected version, including github.com/rs/cors.
| Package | Affected | Fixed in |
|---|---|---|
github.com/rs/cors Go | From 1.9.0 | 1.11.0 |
github.com/rs/cors Go | From 1.9.0 | 1.11.0 |
github.com/rs/cors Go | From 1.9.0 | 1.11.0 |
Linux distribution packages (5)
golang-github-prometheus-alertmanager SUSE:Linux Enterprise Module for Package Hub 15 SP6 | All versions | 0.28.1-150100.4.28.2 |
golang-github-prometheus-alertmanager SUSE:Linux Enterprise Module for Package Hub 15 SP7 | All versions | 0.28.1-150100.4.28.2 |
golang-github-prometheus-alertmanager SUSE:Manager Client Tools 15 | All versions | 0.28.1-150100.4.28.2 |
golang-github-prometheus-alertmanager SUSE:Manager Proxy LTS 4.3 | All versions | 0.28.1-150100.4.28.2 |
golang-github-prometheus-alertmanager openSUSE:Leap 15.6 | All versions | 0.28.1-150100.4.28.2 |
How do I fix CVE-2025-47908?
Upgrade github.com/rs/cors to 1.11.0 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-47908 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-47908 exists.
Sources
Also known as CLEANSTART-2026-JT82999, CLEANSTART-2026-LQ54716, GHSA-mh55-gqvf-xfwm, GO-2024-2883, SUSE-SU-2025:4481-1, UBUNTU-CVE-2025-47908.