|
Vulnerabilities
< Back

CVE-2025-47908

Updated on 06 Aug 2025

Severity

7.5 High severity

Details

CVSS score
7.5
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Links
NISTCIRCLRHELUbuntu

Overview

About vulnerability

Middleware causes a prohibitive amount of heap allocations when processing malicious preflight requests that include a Access-Control-Request-Headers (ACRH) header whose value contains many commas. This behavior can be abused by attackers to produce undue load on the middleware/server as an attempt to cause a denial of service.

Details

Affected product:
AlmaLinux 9.2 ESU , Grafana , Loki , TuxCare 9.6 ESU , github.com/grafana/alerting , github.com/grafana/e2e , github.com/grafana/tempo , github.com/openfga/openfga , github.com/prometheus/alertmanager , github.com/prometheus/prometheus , github.com/rs/cors , grafana/alerting , grafana/e2e , grafana/tempo , openfga/openfga , ory/x , prometheus/alertmanager , prometheus/prometheus , rs/cors
Affected packages:
github.com/rs/cors @ 1.10.1 (+28 more)
Middleware causes a prohibitive amount of heap allocations when processing malicious preflight requests that include a Access-Control-Request-Headers (ACRH) header whose value contains many commas. This behavior can be abused by attackers to produce undue load on the middleware/server as an attempt to cause a denial of service.

Fixes