{"id":"GO-2024-2813","summary":"Some CORS middleware allow untrusted origins in github.com/jub0bs/cors","details":"Some CORS middleware (more specifically those created by specifying two or more origin patterns whose hosts share a proper suffix) incorrectly allow some untrusted origins, thereby opening the door to cross-origin attacks from the untrusted origins in question.\n\nFor example, specifying origin patterns \"https://foo.com\" and \"https://bar.com\" (in that order) would yield a middleware that would incorrectly allow untrusted origin \"https://barfoo.com\".","aliases":["GHSA-vhxv-fg4m-p2w8"],"modified":"2026-02-04T03:40:21.076648Z","published":"2024-05-21T15:08:01Z","related":["GHSA-v84h-653v-4pq9"],"database_specific":{"review_status":"REVIEWED","url":"https://pkg.go.dev/vuln/GO-2024-2813"},"references":[{"type":"ADVISORY","url":"https://github.com/jub0bs/cors/security/advisories/GHSA-vhxv-fg4m-p2w8"},{"type":"FIX","url":"https://github.com/jub0bs/cors/commit/63900fa1776237095fa0ed47ff85791e21f3a7d7"}],"affected":[{"package":{"name":"github.com/jub0bs/cors","ecosystem":"Go","purl":"pkg:golang/github.com/jub0bs/cors"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.1.3"}]}],"ecosystem_specific":{"imports":[{"path":"github.com/jub0bs/cors/internal/origins/radix","symbols":["Tree.Contains","Tree.Insert"]}]},"database_specific":{"source":"https://vuln.go.dev/ID/GO-2024-2813.json"}}],"schema_version":"1.7.3"}