CVE-2025-47908: 
Grafana vulnerability analysis and mitigation

CVE-2025-47908 is a vulnerability discovered in the rs/cors middleware that affects versions from v1.9.0 before v1.11.0. The vulnerability was disclosed on August 6, 2025, and involves excessive heap memory allocation when processing preflight requests containing Access-Control-Request-Headers (ACRH) headers with numerous comma values (Go Project).

The vulnerability occurs when the middleware processes the Access-Control-Request-Headers (ACRH) header of preflight requests in a suboptimal way. Specifically, processing a preflight request with a maliciously long ACRH header causes excessive heap allocations, taking up to 127ms of execution time and 116 MiB of heap allocations for a single 1-MiB malicious preflight request. The vulnerability has been assigned a CVSS v3.1 score of 7.5 (High) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (NVD).

The vulnerability can be exploited to cause denial of service by producing undue load on the middleware/server. Since CORS middleware occurs before authentication, attackers don't need to be authenticated to exploit this vulnerability. Local tests demonstrated that concurrent sending of a modest number of malicious preflight requests was sufficient to make a Docker container with limited memory run out of memory and crash (Github Issue).

The vulnerability can be exploited by sending malicious preflight requests that include an Access-Control-Request-Headers (ACRH) header containing many commas. While most Web Application Firewalls (WAFs) would likely drop these malicious preflight requests, servers not behind a WAF remain vulnerable. No public exploits were observed at the time of the initial report (Github Issue).

A fix has been implemented in version v1.11.0 of the rs/cors middleware. The solution involves taking advantage of the Fetch standard's guarantees about preflight requests, including case-insensitive header names, lowercase ACRH values, and lexicographically sorted unique values. The fix implements a sorted-set data structure for storing allowed headers, significantly reducing memory allocation and processing time (Github PR).