CVE-2025-47907: 
Docker vulnerability analysis and mitigation

CVE-2025-47907 is a vulnerability in the Go programming language's database/sql package, discovered and disclosed on August 7, 2025. The vulnerability affects multiple versions of Go, specifically versions before 1.23.12 and from 1.24.0 before 1.24.6. This security issue was reported by Spike Curtis from Coder (Go Project).

The vulnerability occurs when cancelling a query during a call to the Scan method of the returned Rows while other queries are being executed in parallel. This creates a race condition that can overwrite the expected results with those of another query. The issue has been assigned a CVSS 3.1 Base Score of 7.0 (HIGH) with the vector string CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L (NVD).

The vulnerability can cause the Scan method to return either unexpected results from another query or generate an error. This issue affects most database/sql drivers and could lead to data inconsistency or incorrect query results in applications using parallel database operations (Go Project).

The issue has been fixed in Go versions 1.23.12 and 1.24.6. Users are advised to upgrade to these patched versions to mitigate the vulnerability (Go Project).