CVE-2019-25211: Gin-Contrib Cors

Critical severity, CVSS 9.1. EPSS: 0.4% chance of exploitation in the next 30 days.

parseWildcardRules in Gin-Gonic CORS middleware before 1.6.0 mishandles a wildcard at the end of an origin string, e.g., https://example.community/* is allowed when the intention is that only https://example.com/* should be allowed, and http://localhost.example.com/* is allowed when the intention is that only http://localhost/* should be allowed.

Affected products

• Gin-Contrib Cors: before 1.6.0 (fixed in 1.6.0)

Published 2024-06-29. Last modified 2026-06-17.