Security
Headlines
HeadlinesLatestCVEs

Headline

GHSA-mh55-gqvf-xfwm: Denial of service via malicious preflight requests in github.com/rs/cors

Middleware causes a prohibitive amount of heap allocations when processing malicious preflight requests that include a Access-Control-Request-Headers (ACRH) header whose value contains many commas. This behavior can be abused by attackers to produce undue load on the middleware/server as an attempt to cause a denial of service.

ghsa
#dos#git
  1. GitHub Advisory Database
  2. GitHub Reviewed
  3. GHSA-mh55-gqvf-xfwm

Denial of service via malicious preflight requests in github.com/rs/cors

Moderate severity GitHub Reviewed Published Jul 5, 2024 to the GitHub Advisory Database • Updated Jul 5, 2024

Package

gomod github.com/rs/cors (Go)

Affected versions

>= 1.9.0, < 1.11.0

Middleware causes a prohibitive amount of heap allocations when processing malicious preflight requests that include a Access-Control-Request-Headers (ACRH) header whose value contains many commas. This behavior can be abused by attackers to produce undue load on the middleware/server as an attempt to cause a denial of service.

References

  • rs/cors#170
  • rs/cors#171
  • rs/cors@4c32059

Published to the GitHub Advisory Database

Jul 5, 2024

ghsa: Latest News

GHSA-6jrf-rcjf-245r: changedetection.io path traversal using file URI scheme without supplying hostname