Skip to content

Denial of service via malicious preflight requests in github.com/rs/cors

Moderate severity GitHub Reviewed Published Jul 5, 2024 to the GitHub Advisory Database • Updated Jul 5, 2024

Package

gomod github.com/rs/cors (Go)

Affected versions

>= 1.9.0, < 1.11.0

Patched versions

1.11.0

Description

Middleware causes a prohibitive amount of heap allocations when processing malicious preflight requests that include a Access-Control-Request-Headers (ACRH) header whose value contains many commas. This behavior can be abused by attackers to produce undue load on the middleware/server as an attempt to cause a denial of service.

References

Published to the GitHub Advisory Database Jul 5, 2024
Reviewed Jul 5, 2024
Last updated Jul 5, 2024

Severity

Moderate

Weaknesses

CVE ID

No known CVE

GHSA ID

GHSA-mh55-gqvf-xfwm

Source code

Loading Checking history
See something to contribute? Suggest improvements for this vulnerability.