CVE-2025-47910: CrossOriginProtection insecure bypass patterns not limited to exact matches in net/http
When using http.CrossOriginProtection, the AddInsecureBypassPattern method can unexpectedly bypass more requests than intended. CrossOriginProtection then skips validation, but forwards the original request path, which may be served by a different handler without the intended security protections.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-47910?
CVE-2025-47910 has a medium severity rating of 5.4 according to CVSS 3.1.
How do I fix CVE-2025-47910?
To mitigate CVE-2025-47910, ensure that your usage of http.CrossOriginProtection and AddInsecureBypassPattern is restricted to exact matches only.
What are the risks associated with CVE-2025-47910?
The risks include the potential for unauthorized request handling due to ineffective validation, leading to possible security vulnerabilities.
What software is affected by CVE-2025-47910?
CVE-2025-47910 affects IBM Concert Software when using the http.CrossOriginProtection feature.
When was CVE-2025-47910 published?
CVE-2025-47910 was published on September 22, 2025.