CVE-2025-47907

HighCVSS 7.0/10Last modified Jun 17, 2026

Description

Cancelling a query (e.g. by cancelling the context passed to one of the query methods) during a call to the Scan method of the returned Rows can result in unexpected results if other queries are being made in parallel. This can result in a race condition that may overwrite the expected results with those of another query, causing the call to Scan to return either unexpected results from the other query or an error.

Metrics

CVSS 3.1 7.0/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L

Weakness enumeration

CWE-362

Affected software

No affected versions have been published.

Timeline

Published: Aug 7, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-479087.5Middleware causes a prohibitive amount of heap allocations when processing malicious preflight requests that include a Access-Control-Reques CVE-2025-479097.3Hosts listed in TrustedOrigins implicitly allow requests from the corresponding HTTP origins, allowing network MitMs to perform CSRF attacks CVE-2025-47919.8A vulnerability has been found in FreeFloat FTP Server 1.0 and classified as critical. This vulnerability affects unknown code of the compon CVE-2025-479105.4When using http.CrossOriginProtection, the AddInsecureBypassPattern method can unexpectedly bypass more requests than intended. CrossOriginP CVE-2025-479115.3The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when processing certain inputs, which can lead to denial o CVE-2025-479125.3The Parse function permits values other than IPv6 addresses to be included in square brackets within the host component of a URL. RFC 3986 p CVE-2025-479137.5SSH clients receiving SSH_AGENT_SUCCESS when expecting a typed response will panic and cause early termination of the client process.CVE-2025-479145.3SSH Agent servers do not validate the size of messages when processing new identity requests, which may cause the program to panic if the me CVE-2025-479169.8Invision Community 5.0.0 before 5.0.7 allows remote code execution via crafted template strings to themeeditor.php. The issue lies within th CVE-2025-479179.8Mbed TLS before 3.6.4 allows a use-after-free in certain situations of applications that are developed in accordance with the documentation.CVE-2025-47929.8A vulnerability was found in FreeFloat FTP Server 1.0 and classified as critical. This issue affects some unknown processing of the componen CVE-2025-479289.1Spotipy is a Python library for the Spotify Web API. As of commit 4f5759dbfb4506c7b6280572a4db1aabc1ac778d, using `pull_request_target` on `