CVE-2025-47907: Incorrect results returned from Rows.Scan in database/sql
Cancelling a query (e.g. by cancelling the context passed to one of the query methods) during a call to the Scan method of the returned Rows can result in unexpected results if other queries are being made in parallel. This can result in a race condition that may overwrite the expected results with those of another query, causing the call to Scan to return either unexpected results from the other query or an error.
Other sources
Incorrect results returned from Rows.Scan in database/sql
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.24.6 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.23.12
Event History
Frequently Asked Questions
What is the severity of CVE-2025-47907?
CVE-2025-47907 is classified as a moderate severity vulnerability due to the potential for race conditions affecting query results.
What software versions are affected by CVE-2025-47907?
CVE-2025-47907 affects Google Go versions prior to 1.24.6 and 1.23.12.
How can I fix CVE-2025-47907?
To fix CVE-2025-47907, upgrade to Google Go version 1.24.6 or higher, or 1.23.12 or higher.
What is the main issue described in CVE-2025-47907?
The main issue in CVE-2025-47907 involves a race condition resulting from cancelling a query during its execution, leading to unexpected behavior.
Are multiple queries impacted simultaneously by CVE-2025-47907?
Yes, CVE-2025-47907 can lead to unexpected results when multiple queries are executed in parallel while one is cancelled.