Vulnetix
Try Vulnetix Request Demo
CVE-2019-25211 PUBLISHED

parseWildcardRules in Gin-Gonic CORS middleware before 1.6.0 mishandles a wildcard at the end of an origin string, e.g., https://example.community/* is allowed when the intention is that only https://example.com/* should be allowed, and http://localhost.example.com/* is allowed when the intention is that only http://localhost/* should be allowed.

EPSS 0.39% · 59.7th percentile

Risk Scores

EPSS Score
0.39%
59.7th percentile

Affected Products

VendorProductVersions
Ubuntu:22.04:LTSgolang-github-gin-contrib-cors0, 1.3.1-1
Ubuntu:24.04:LTSgolang-github-gin-contrib-cors0, 1.4.0-1
Ubuntu:25.10golang-github-gin-contrib-cors1.4.0-1, 0
Ubuntu:20.04:LTSgolang-github-gin-contrib-cors0, 1.3.0-2

Timeline

References

Open in Interactive Console →