CVE-2025-47910: Go Standard Library Net/http

Medium severity, CVSS 5.4. EPSS: 0.3% chance of exploitation in the next 30 days.

When using http.CrossOriginProtection, the AddInsecureBypassPattern method can unexpectedly bypass more requests than intended. CrossOriginProtection then skips validation, but forwards the original request path, which may be served by a different handler without the intended security protections.

Affected products

• Go Standard Library Net/http: from 1.25.0, before 1.25.1 (fixed in 1.25.1)

Published 2025-09-22. Last modified 2026-06-17.