{"id":"GHSA-vhxv-fg4m-p2w8","summary":"Some CORS middleware allow untrusted origins","details":"### Impact\n\nSome CORS middleware (more specifically those created by specifying two or more origin patterns whose hosts share a proper suffix) incorrectly allow some untrusted origins, thereby opening the door to cross-origin attacks from the untrusted origins in question.\n\nFor example, specifying origin patterns `https://foo.com` and `https://bar.com` (in that order) would yield a middleware that would incorrectly allow untrusted origin `https://barfoo.com`.\n\n### Patches\n\nPatched in v0.1.3.\n\n### Workarounds\n\nNone.","aliases":["GO-2024-2813"],"modified":"2026-02-04T02:40:18.244436Z","published":"2024-05-03T17:34:17Z","related":["GO-2024-2812"],"database_specific":{"cwe_ids":[],"severity":"CRITICAL","github_reviewed":true,"github_reviewed_at":"2024-05-03T17:34:17Z","nvd_published_at":null},"references":[{"type":"WEB","url":"https://github.com/jub0bs/cors/security/advisories/GHSA-vhxv-fg4m-p2w8"},{"type":"WEB","url":"https://github.com/jub0bs/cors/commit/5bc0648a32db2d600179a50866f648f4d7090363"},{"type":"WEB","url":"https://github.com/jub0bs/cors/commit/63900fa1776237095fa0ed47ff85791e21f3a7d7"},{"type":"PACKAGE","url":"https://github.com/jub0bs/cors"}],"affected":[{"package":{"name":"github.com/jub0bs/cors","ecosystem":"Go","purl":"pkg:golang/github.com/jub0bs/cors"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.1.3"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/05/GHSA-vhxv-fg4m-p2w8/GHSA-vhxv-fg4m-p2w8.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N"}]}