CVE-2025-47908

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Middleware causes a prohibitive amount of heap allocations when processing malicious preflight requests that include a Access-Control-Request-Headers (ACRH) header whose value contains many commas. This behavior can be abused by attackers to produce undue load on the middleware/server as an attempt to cause a denial of service.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected software

Vendor	Product	Versions
github.com/rs/cors	github.com/rs/cors	>= 1.9.0, < 1.11.0

References

Timeline

Published: Aug 6, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-479097.3Hosts listed in TrustedOrigins implicitly allow requests from the corresponding HTTP origins, allowing network MitMs to perform CSRF attacks CVE-2025-47919.8A vulnerability has been found in FreeFloat FTP Server 1.0 and classified as critical. This vulnerability affects unknown code of the compon CVE-2025-479105.4When using http.CrossOriginProtection, the AddInsecureBypassPattern method can unexpectedly bypass more requests than intended. CrossOriginP CVE-2025-479115.3The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when processing certain inputs, which can lead to denial o CVE-2025-479125.3The Parse function permits values other than IPv6 addresses to be included in square brackets within the host component of a URL. RFC 3986 p CVE-2025-479137.5SSH clients receiving SSH_AGENT_SUCCESS when expecting a typed response will panic and cause early termination of the client process.CVE-2025-479145.3SSH Agent servers do not validate the size of messages when processing new identity requests, which may cause the program to panic if the me CVE-2025-479169.8Invision Community 5.0.0 before 5.0.7 allows remote code execution via crafted template strings to themeeditor.php. The issue lies within th CVE-2025-479179.8Mbed TLS before 3.6.4 allows a use-after-free in certain situations of applications that are developed in accordance with the documentation.CVE-2025-47929.8A vulnerability was found in FreeFloat FTP Server 1.0 and classified as critical. This issue affects some unknown processing of the componen CVE-2025-479289.1Spotipy is a Python library for the Spotify Web API. As of commit 4f5759dbfb4506c7b6280572a4db1aabc1ac778d, using `pull_request_target` on `CVE-2025-479292.1DumbDrop, a file upload application that provides an interface for dragging and dropping files, has a DOM cross-site scripting vulnerability