When using http.CrossOriginProtection, the AddInsecureBypassPattern method can unexpectedly bypass more requests than intended. CrossOriginProtection then skips validation, but forwards the original request path, which may be served by a different handler without the intended security protections.

vendor_unpatched cve-2025-47910: Unpatched CVEs for Debian Linux, Ubuntu Linux (cve-2025-47910)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-dd17908bcd advisory.

    Automatic update for containernetworking-plugins-1.8.0-2.fc44.

    ##### **Changelog**

    ```
    * Fri Sep 26 2025 Bradley G Smith <bradley.g.smith@gmail.com> - 1.8.0-2
    - Resolve CVE-2025-47910
    - Resolves: rhbz#2398656, rhbz#2398402
    - Rebuild with go 1.25.1 (fc44, fc43) or 1.24.7 (fc42, fc41)

    ```

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2025:03200-1 advisory.

    Update to go1.25.1, released 2025-09-03 (bsc#1244485).

    Security issues fixed:

    - CVE-2025-47910: net/http: `CrossOriginProtection` insecure bypass patterns not limited to exact matches     (bsc#1249141).

    Other issues fixed:

    - go#74822 cmd/go: 'get toolchain@latest' should ignore release candidates.
    - go#74999 net: WriteMsgUDPAddrPort should accept IPv4-mapped IPv6 destination addresses on IPv4 UDP     sockets.
    - go#75008 os/exec: TestLookPath fails on plan9 after CL 685755.
    - go#75021 testing/synctest: bubble not terminating.
    - go#75083 os: File.Seek doesn't set the correct offset with Windows overlapped handles.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Golang running on the remote host is 1.24.x prior to 1.24.7, 1.25.x prior to 1.25.1. It is, therefore, affected by a vulnerability as referenced in 75054 advisory.

  - When passing patterns to CrossOriginProtection.AddInsecureBypassPattern, requests that would have     redirected to those patterns (e.g. without a trailingslash) were also exempted, which might be unexpected.     (CVE-2025-47910)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
265993	Fedora 44 : containernetworking-plugins (2025-dd17908bcd)	Nessus	Fedora Local Security Checks	medium
264676	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : go1.25 (SUSE-SU-2025:03200-1)	Nessus	SuSE Local Security Checks	medium
261503	Golang 1.24.x < 1.24.7 / 1.25.x < 1.25.1 Insecure Bypass (75054)	Nessus	Misc.	medium

Detections

Analytics

CVE-2025-47910

medium

Tenable Plugins

Coming Soon

medium

medium

medium