Middleware causes a prohibitive amount of heap allocations when processing malicious preflight requests that include a Access-Control-Request-Headers (ACRH) header whose value contains many commas. This behavior can be abused by attackers to produce undue load on the middleware/server as an attempt to cause a denial of service.

The remote SUSE Linux SLES15 / openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2025:4481-1 advisory.

    - Update to version 0.28.1 (jsc#PED-13285):
      * Improved performance of inhibition rules when using Equal         labels.
      * Improve the documentation on escaping in UTF-8 matchers.
      * Update alertmanager_config_hash metric help to document the         hash is not cryptographically strong.
      * Fix panic in amtool when using --verbose.
      * Fix templating of channel field for Rocket.Chat.
      * Fix rocketchat_configs written as rocket_configs in docs.
      * Fix usage for --enable-feature flag.
      * Trim whitespace from OpsGenie API Key.
      * Fix Jira project template not rendered when searching for         existing issues.
      * Fix subtle bug in JSON/YAML encoding of inhibition rules that         would cause Equal labels to be omitted.
      * Fix header for slack_configs in docs.
      * Fix weight and wrap of Microsoft Teams notifications.
    - Upgrade to version 0.28.0:
      * CVE-2025-47908: Bump github.com/rs/cors (bsc#1247748).
      * Templating errors in the SNS integration now return an error.
      * Adopt log/slog, drop go-kit/log.
      * Add a new Microsoft Teams integration based on Flows.
      * Add a new Rocket.Chat integration.
      * Add a new Jira integration.
      * Add support for GOMEMLIMIT, enable it via the feature flag
        --enable-feature=auto-gomemlimit.
      * Add support for GOMAXPROCS, enable it via the feature flag
        --enable-feature=auto-gomaxprocs.
      * Add support for limits of silences including the maximum number         of active and pending silences, and the maximum size per         silence (in bytes). You can use the flags
        --silences.max-silences and --silences.max-silence-size-bytes         to set them accordingly.
      * Muted alerts now show whether they are suppressed or not in         both the /api/v2/alerts endpoint and the Alertmanager UI.
    - Upgrade to version 0.27.0:
      * API: Removal of all api/v1/ endpoints. These endpoints         now log and return a deprecation message and respond with a         status code of 410.
      * UTF-8 Support: Introduction of support for any UTF-8         character as part of label names and matchers.
      * Discord Integration: Enforce max length in message.
      * Metrics: Introduced the experimental feature flag
        --enable-feature=receiver-name-in-metrics to include the         receiver name.
      * Metrics: Introduced a new gauge named         alertmanager_inhibition_rules that counts the number of         configured inhibition rules.
      * Metrics: Introduced a new counter named         alertmanager_alerts_supressed_total that tracks muted alerts,         it contains a reason label to indicate the source of the mute.
      * Discord Integration: Introduced support for webhook_url_file.
      * Microsoft Teams Integration: Introduced support for         webhook_url_file.
      * Microsoft Teams Integration: Add support for summary.
      * Metrics: Notification metrics now support two new values for         the label reason, contextCanceled and contextDeadlineExceeded.
      * Email Integration: Contents of auth_password_file are now         trimmed of prefixed and suffixed whitespace.
      * amtool: Fixes the error scheme required for webhook url when         using amtool with --alertmanager.url.
      * Mixin: Fix AlertmanagerFailedToSendAlerts,         AlertmanagerClusterFailedToSendAlerts, and         AlertmanagerClusterFailedToSendAlerts to make sure they ignore         the reason label.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Middleware causes a prohibitive amount of heap allocations when processing malicious preflight requests     that include a Access-Control-Request-Headers (ACRH) header whose value contains many commas. This     behavior can be abused by attackers to produce undue load on the middleware/server as an attempt to cause     a denial of service. (CVE-2025-47908)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Middleware causes a prohibitive amount of heap allocations when processing malicious preflight requests
    that include a Access-Control-Request-Headers (ACRH) header whose value contains many commas. This
    behavior can be abused by attackers to produce undue load on the middleware/server as an attempt to cause
    a denial of service. (CVE-2025-47908)

ID	Name	Product	Family	Severity
279374	SUSE SLES15 / openSUSE 15 Security Update : golang-github-prometheus-alertmanager (SUSE-SU-2025:4481-1)	Nessus	SuSE Local Security Checks	high
253558	Linux Distros Unpatched Vulnerability : CVE-2025-47908	Nessus	Misc.	high
416968	SCA: security update for github.com/rs/cors (GHSA-mh55-gqvf-xfwm)	Tenable Cloud Security	SCA Checks	high
416968	SCA: security update for github.com/rs/cors (GHSA-mh55-gqvf-xfwm)	Tenable Self-Hosted Container Security	SCA Checks	high

Detections

Analytics

CVE-2025-47908

high

Tenable Plugins

high

high

high

high