{"id":"GHSA-vhxv-fg4m-p2w8","aliases":["GO-2024-2813"],"url":"https://o3.security/vulnerability/GHSA-vhxv-fg4m-p2w8","summary":"Some CORS middleware allow untrusted origins","details":"### Impact\n\nSome CORS middleware (more specifically those created by specifying two or more origin patterns whose hosts share a proper suffix) incorrectly allow some untrusted origins, thereby opening the door to cross-origin attacks from the untrusted origins in question.\n\nFor example, specifying origin patterns `https://foo.com` and `https://bar.com` (in that order) would yield a middleware that would incorrectly allow untrusted origin `https://barfoo.com`.\n\n### Patches\n\nPatched in v0.1.3.\n\n### Workarounds\n\nNone.","published":"2024-05-03T17:34:17Z","modified":"2026-02-04T02:40:18.244436Z","cvss":{"score":9.3,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Go","name":"github.com/jub0bs/cors","fixedVersion":"0.1.3"}],"fix":{"url":"https://github.com/jub0bs/cors/commit/5bc0648a32db2d600179a50866f648f4d7090363","label":"jub0bs/cors@5bc0648"},"references":[{"type":"WEB","url":"https://github.com/jub0bs/cors/security/advisories/GHSA-vhxv-fg4m-p2w8"},{"type":"WEB","url":"https://github.com/jub0bs/cors/commit/5bc0648a32db2d600179a50866f648f4d7090363"},{"type":"WEB","url":"https://github.com/jub0bs/cors/commit/63900fa1776237095fa0ed47ff85791e21f3a7d7"},{"type":"PACKAGE","url":"https://github.com/jub0bs/cors"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-02-04T02:40:18.244436Z"}}