{"id":"GHSA-vhxv-fg4m-p2w8","aliases":["GO-2024-2813"],"status":"published","title":"Some CORS middleware allow untrusted origins","description":"### Impact\n\nSome CORS middleware (more specifically those created by specifying two or more origin patterns whose hosts share a proper suffix) incorrectly allow some untrusted origins, thereby opening the door to cross-origin attacks from the untrusted origins in question.\n\nFor example, specifying origin patterns `https://foo.com` and `https://bar.com` (in that order) would yield a middleware that would incorrectly allow untrusted origin `https://barfoo.com`.\n\n### Patches\n\nPatched in v0.1.3.\n\n### Workarounds\n\nNone.","severity":{"version":"3.1","score":9.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","level":"critical","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2024-05-03T17:34:17Z","modified":"2026-02-04T03:40:21Z","fixes":[{"ecosystem":"Go","package":"github.com/jub0bs/cors","fixed_in":["0.1.3"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/jub0bs/cors","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.3"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/jub0bs/cors","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.1.3"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/jub0bs/cors","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.1.3"}]}]}],"references":[{"url":"https://github.com/jub0bs/cors/security/advisories/GHSA-vhxv-fg4m-p2w8","tags":["web","advisory"]},{"url":"https://github.com/jub0bs/cors/commit/5bc0648a32db2d600179a50866f648f4d7090363","tags":["web"]},{"url":"https://github.com/jub0bs/cors/commit/63900fa1776237095fa0ed47ff85791e21f3a7d7","tags":["web","fix"]},{"url":"https://github.com/advisories/GHSA-vhxv-fg4m-p2w8"},{"url":"https://github.com/jub0bs/cors","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-vhxv-fg4m-p2w8","title":"Some CORS middleware allow untrusted origins","description":"### Impact\n\nSome CORS middleware (more specifically those created by specifying two or more origin patterns whose hosts share a proper suffix) incorrectly allow some untrusted origins, thereby opening the door to cross-origin attacks from the untrusted origins in question.\n\nFor example, specifying origin patterns `https://foo.com` and `https://bar.com` (in that order) would yield a middleware that would incorrectly allow untrusted origin `https://barfoo.com`.\n\n### Patches\n\nPatched in v0.1.3.\n\n### Workarounds\n\nNone.","status":"published","published":"2024-05-03T17:34:17Z","modified":"2024-05-21T15:38:56Z","cvss":[{"version":"3.1","score":9.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T14:37:51.549437Z"}],"osv":[{"id":"GHSA-vhxv-fg4m-p2w8","title":"Some CORS middleware allow untrusted origins","description":"### Impact\n\nSome CORS middleware (more specifically those created by specifying two or more origin patterns whose hosts share a proper suffix) incorrectly allow some untrusted origins, thereby opening the door to cross-origin attacks from the untrusted origins in question.\n\nFor example, specifying origin patterns `https://foo.com` and `https://bar.com` (in that order) would yield a middleware that would incorrectly allow untrusted origin `https://barfoo.com`.\n\n### Patches\n\nPatched in v0.1.3.\n\n### Workarounds\n\nNone.","status":"published","published":"2024-05-03T17:34:17Z","modified":"2026-02-04T02:40:18.244436Z","cvss":[{"version":"3.1","score":9.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T15:46:57.348035Z"},{"id":"GO-2024-2813","title":"Some CORS middleware allow untrusted origins in github.com/jub0bs/cors","description":"Some CORS middleware (more specifically those created by specifying two or more origin patterns whose hosts share a proper suffix) incorrectly allow some untrusted origins, thereby opening the door to cross-origin attacks from the untrusted origins in question.\n\nFor example, specifying origin patterns \"https://foo.com\" and \"https://bar.com\" (in that order) would yield a middleware that would incorrectly allow untrusted origin \"https://barfoo.com\".","status":"published","published":"2024-05-21T15:08:01Z","modified":"2026-02-04T03:40:21.076648Z","updated_at":"2026-11-02T15:47:01.453823Z"}]}}