CVE-2025-47910: 
Go vulnerability analysis and mitigation

CVE-2025-47910 is a security vulnerability discovered in Go's http.CrossOriginProtection functionality, specifically affecting versions from Go 1.25.0 before Go 1.25.1. The vulnerability was disclosed on September 22, 2025, and involves the AddInsecureBypassPattern method unexpectedly bypassing more requests than intended (Go Project, Go Project).

The vulnerability occurs when using http.CrossOriginProtection's AddInsecureBypassPattern method. The issue stems from the internal ServeMux implementation used for checking bypass patterns. When a pattern like '/hello/' is specified, requests to '/hello' are also bypassed due to ServeMux's internal redirection behavior. While CrossOriginProtection skips validation based on this match, it forwards the original request path, allowing requests to be served without the intended security protections (Go Project).

The vulnerability allows more HTTP requests to bypass Cross-Origin protection than intended. This could potentially lead to unauthorized cross-origin requests being processed without proper security validation, undermining the intended protection mechanisms. The CVSS v3.1 score for this vulnerability is 5.4 (Medium), with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N (Go Project).

The vulnerability can be triggered when configuring CrossOriginProtection with specific bypass patterns. For example, if a bypass pattern is set for '/hello/', requests to '/hello' will also be incorrectly bypassed, potentially allowing unauthorized cross-origin access to endpoints that should be protected (Go Project).

The vulnerability has been fixed in Go version 1.25.1. Users are strongly advised to upgrade to this version or later to address the security issue. The fix was released on September 3, 2025, as part of a security update (Go Project).