{"id":"CVE-2017-20146","aliases":["DEBIAN-CVE-2017-20146","EUVD-2022-7663","GHSA-jcr6-mmjj-pchw","GO-2020-0020","UBUNTU-CVE-2017-20146"],"status":"published","title":"Improper access control in github.com/gorilla/handlers","description":"Usage of the CORS handler may apply improper CORS headers, allowing the requester to explicitly control the value of the Access-Control-Allow-Origin header, which bypasses the expected behavior of the Same Origin Policy.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.00765,"percentile":0.55699,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-346"],"published":"2021-04-14T20:04:52Z","modified":"2026-10-20T10:47:48Z","fixes":[{"ecosystem":"Go","package":"github.com/gorilla/handlers","fixed_in":["1.3.0"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"golang-github-gorilla-handlers","fixed_in":["1.3.0-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"golang-github-gorilla-handlers","fixed_in":["1.3.0-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"golang-github-gorilla-handlers","fixed_in":["1.3.0-1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/gorilla/handlers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"golang-github-gorilla-handlers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.0-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"golang-github-gorilla-handlers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.0-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"golang-github-gorilla-handlers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.0-1"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/gorilla/handlers","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.3.0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/gorilla/handlers","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.3.0"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"golang-github-gorilla-handlers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.0~git20150820.0.40694b4-1","0.0~git20160115.0.8f27580-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"golang-github-gorilla-handlers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1-3"]}],"products":[{"vendor":"github.com/gorilla/handlers","product":"github.com/gorilla/handlers"},{"vendor":"gorillatoolkit","product":"handlers"}],"references":[{"url":"https://github.com/gorilla/handlers/pull/116","tags":["x_transferred","Patch","Third Party Advisory","fix","web","report"]},{"url":"https://github.com/gorilla/handlers/commit/90663712d74cb411cbef281bc1e08c19d1a76145","tags":["x_transferred","Patch","Third Party Advisory","fix","web","report"]},{"url":"https://pkg.go.dev/vuln/GO-2020-0020","tags":["x_transferred","Third Party Advisory","advisory","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-20146","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-jcr6-mmjj-pchw"},{"url":"https://security-tracker.debian.org/tracker/CVE-2017-20146","tags":["advisory"]},{"url":"https://github.com/gorilla/handlers","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2017-20146","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-20146","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2017-20146","title":"Improper access control in github.com/gorilla/handlers","description":"Usage of the CORS handler may apply improper CORS headers, allowing the requester to explicitly control the value of the Access-Control-Allow-Origin header, which bypasses the expected behavior of the Same Origin Policy.","status":"published","published":"2022-12-27T21:13:00.461Z","modified":"2025-04-11T23:02:21.962Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"updated_at":"2026-11-02T14:33:11.59359Z"}],"euvd":[{"id":"EUVD-2022-7663","description":"Usage of the CORS handler may apply improper CORS headers, allowing the requester to explicitly control the value of the Access-Control-Allow-Origin header, which bypasses the expected behavior of the Same Origin Policy.","status":"published","published":"2022-12-27T21:13:00Z","modified":"2025-04-11T23:02:21Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T20:52:34.493984Z"}],"ghsa":[{"id":"GHSA-jcr6-mmjj-pchw","title":"gorilla/handlers may allow requester to bypass expected behavior of the Same Origin Policy","description":"Usage of the CORS handler may apply improper CORS headers, allowing the requester to explicitly control the value of the Access-Control-Allow-Origin header, which bypasses the expected behavior of the Same Origin Policy.","status":"published","published":"2022-12-28T00:30:23Z","modified":"2023-02-03T05:01:32Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-346"],"updated_at":"2026-11-02T14:36:41.247728Z"}],"nvd":[{"id":"CVE-2017-20146","description":"Usage of the CORS handler may apply improper CORS headers, allowing the requester to explicitly control the value of the Access-Control-Allow-Origin header, which bypasses the expected behavior of the Same Origin Policy.","status":"published","published":"2022-12-27T22:15:11.07Z","modified":"2026-06-17T01:15:16.18Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-346"],"updated_at":"2026-11-02T14:04:21.492973Z"}],"osv":[{"id":"CVE-2017-20146","description":"Usage of the CORS handler may apply improper CORS headers, allowing the requester to explicitly control the value of the Access-Control-Allow-Origin header, which bypasses the expected behavior of the Same Origin Policy.","status":"published","published":"2022-12-27T22:15:11.07Z","modified":"2026-10-20T10:47:48.980011295Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:05.486486Z"},{"id":"DEBIAN-CVE-2017-20146","description":"Usage of the CORS handler may apply improper CORS headers, allowing the requester to explicitly control the value of the Access-Control-Allow-Origin header, which bypasses the expected behavior of the Same Origin Policy.","status":"published","published":"2022-12-27T22:15:11.07Z","modified":"2026-09-01T20:03:47.748417713Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:29.100767Z"},{"id":"GHSA-jcr6-mmjj-pchw","title":"gorilla/handlers may allow requester to bypass expected behavior of the Same Origin Policy","description":"Usage of the CORS handler may apply improper CORS headers, allowing the requester to explicitly control the value of the Access-Control-Allow-Origin header, which bypasses the expected behavior of the Same Origin Policy.","status":"published","published":"2022-12-28T00:30:23Z","modified":"2023-11-08T03:59:17.264487Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-346"],"updated_at":"2026-11-02T15:46:50.336262Z"},{"id":"UBUNTU-CVE-2017-20146","description":"Usage of the CORS handler may apply improper CORS headers, allowing the requester to explicitly control the value of the Access-Control-Allow-Origin header, which bypasses the expected behavior of the Same Origin Policy.","status":"published","published":"2022-12-27T22:15:00Z","modified":"2025-10-24T04:46:41Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:14.977781Z"},{"id":"GO-2020-0020","title":"Improper access control in github.com/gorilla/handlers","description":"Usage of the CORS handler may apply improper CORS headers, allowing the requester to explicitly control the value of the Access-Control-Allow-Origin header, which bypasses the expected behavior of the Same Origin Policy.","status":"published","published":"2021-04-14T20:04:52Z","modified":"2024-05-20T16:03:47Z","updated_at":"2026-11-02T15:47:00.604718Z"}]}}