BlackTreeCVE Intelligencegithub.com/rs/cors · github.com/rs/cors
High technical severity with public exploit material referenced by a structured source; prioritise exposed affected systems while verifying vendor guidance.
Debian, ubuntu findings are scoped to the named distribution, release and source package. An absent finding does not mean a package is unaffected.
A published vendor fix does not prove that a matching update is enabled and installable on a particular asset. Confirm the local package candidate before scheduling remediation.
| Distribution release | Source package | Vendor state | Fixed version | Evidence |
|---|---|---|---|---|
| Debian trixietrixie · source | golang-github-rs-cors | Not affectedDebian marks this release not affected (fixed-version marker 0). | Not published in this feed | Debian Security Tracker ↗Source updated 6 Oct 2026 |
| Debian bookwormbookworm · source | golang-github-rs-cors | Not affectedDebian marks this release not affected (fixed-version marker 0). | Not published in this feed | Debian Security Tracker ↗Source updated 6 Oct 2026 |
| Debian forkyforky · source | golang-github-rs-cors | Not affectedDebian marks this release not affected (fixed-version marker 0). | Not published in this feed | Debian Security Tracker ↗Source updated 6 Oct 2026 |
| Debian sidsid · source | golang-github-rs-cors | Not affectedDebian marks this release not affected (fixed-version marker 0). | Not published in this feed | Debian Security Tracker ↗Source updated 6 Oct 2026 |
| Ubuntu 24.04 LTSnoble · standard archive | golang-github-rs-cors | Under evaluationCanonical reports that the package might be affected and still needs evaluation or fixing. | Not published in this feed | Canonical Ubuntu Security ↗Source updated 5 Oct 2026 |
These OSV and GitHub advisory ranges apply only to the named package and ecosystem. A listed fixed version is not a universal product patch or proof that an update is installed.
| Ecosystem and package | Affected range | First fixed version | Evidence |
|---|---|---|---|
| Gogithub.com/rs/cors | SEMVER: introduced 1.9.0; fixed 1.11.0 | 1.11.0 | OSV record ↗aggregator derived · 10 Sep 2026 |
| gogithub.com/rs/cors | >= 1.9.0, < 1.11.0 | 1.11.0 | GitHub advisory ↗github reviewed aggregator · 6 Aug 2025 |
High technical severity with public exploit material referenced by a structured source; prioritise exposed affected systems while verifying vendor guidance.
Fix not verifiedMiddleware causes a prohibitive amount of heap allocations when processing malicious preflight requests that include a Access-Control-Request-Headers (ACRH) header whose value contains many commas. This behavior can be abused by attackers to produce undue load on the middleware/server as an attempt to cause a denial of service.
Middleware causes a prohibitive amount of heap allocations when processing malicious preflight requests that include a Access-Control-Request-Headers (ACRH) header whose value contains many commas. This behavior can be abused by attackers to produce undue load on the middleware/server as an attempt to cause a denial of service.
The product manages a group of objects or resources and performs a separate memory allocation for each object, but it does not properly limit the total amount of memory that is consumed by all of the combined objects.
An attacker operating through a network path may attempt exploitation without authentication or user interaction. If successful, the issue may disrupt the affected service.
Middleware causes a prohibitive amount of heap allocations when processing malicious preflight requests that include a Access-Control-Request-Headers (ACRH) header whose value contains many commas. This behavior can be abused by attackers to produce undue load on the middleware/server as an attempt to cause a denial of service.
The product manages a group of objects or resources and performs a separate memory allocation for each object, but it does not properly limit the total amount of memory that is consumed by all of the combined objects.
An attacker operating through a network path may attempt exploitation without authentication or user interaction. If successful, the issue may disrupt the affected service.
CVSS severity, EPSS forecast probability, public exploit material and CISA-confirmed exploitation are separate signals.
No CISA KEV match was present at the last successful refresh. This means no confirmation from that source, not proof of no exploitation.
CISA Vulnrichment records proof-of-concept exploitation in its SSVC data. BlackTree has not independently executed or validated exploit material.
CWE-1325: Improperly Controlled Sequential Memory Allocation. The product manages a group of objects or resources and performs a separate memory allocation for each object, but it does not properly limit the total amount of memory that is consumed by all of the combined objects.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HCommon Vulnerability Scoring System 3.1: the compact vector below is decoded into plain language.
Operational remediation based on structured source evidence.
Published 6 Aug 2025 · Last source change 7 Aug 2025, 13:47 UTC · CWE-1325 · Improperly Controlled Sequential Memory Allocation
Core structured fields are present and their contributing authorities are shown above.
No material field changes have been recorded since change tracking began. Routine source refreshes and cosmetic edits are intentionally excluded.