CVE-2019-25211

Critical

Advisory

Published 29 Jun 2024In the index since 6 Sept 2026

Severity: Critical; worst across findings
CVSS: 9.1; base score, highest
EPSS: 0.004; 36th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 32; of 17,781 indexed, latest versions
Container images: 34; deployed by those charts
Fix available: 2 of 2; affected packages

Gin mishandles a wildcard at the end of an origin string

Carried by container images the latest versions of 32 of 17,781 indexed charts deploy, on 34 images.

Affected package	Affected versions	Fixed in	Images
github.com/gin-contrib/corsgolang	v0.0.0-20190301062745-f9e10995c85a, v1.3.0, v1.3.1, v1.4.0	1.6.0	31
github.com/gin-gonic/gingolang	v1.4.0, v1.4.1-0.20190910091637-9aa870f108a1, v1.5.0	1.6.0	5

OSV records: GHSA-869c-j7wc-8jqv
Also known as: GO-2024-2955

Charts affected

32 by stars

Chart

Latest

Affected images

Radar Score

kubebadgeskubebadges

0.1.3

1 of 2 See more

kubebadges kubebadges 0.1.3

1 of the 2 container images this version deploys carry CVE-2019-25211.

Container image	Digest	Package	Fixed in
neosu/kubebadges :v0.0.5	256530d8e5c6	github.com/gin-contrib/cors@v1.4.0	1.6.0

Open the chart page →

1,798

wharf-helmwharf-helm

3.2.6

4 of 5 See more

wharf-helm wharf-helm 3.2.6

4 of the 5 container images this version deploys carry CVE-2019-25211.

Container image	Digest	Package	Fixed in
quay.io/iver-wharf/wharf-api :v5.2.0	b736b345437d	github.com/gin-contrib/cors@v1.3.1	1.6.0
quay.io/iver-wharf/wharf-provider-azuredevops :v3.0.1	2fe7e4dcffdf	github.com/gin-contrib/cors@v1.3.1	1.6.0
quay.io/iver-wharf/wharf-provider-github :v3.0.1	77a22cb45c2a	github.com/gin-contrib/cors@v1.3.1	1.6.0
quay.io/iver-wharf/wharf-provider-gitlab :v2.0.1	d7079e0890da	github.com/gin-contrib/cors@v1.3.1	1.6.0

Open the chart page →

10,032

prometheus-cachethqoxyno-zeta

1.1.1

1 of 1 See more

prometheus-cachethq oxyno-zeta 1.1.1

1 of the 1 container images this version deploys carry CVE-2019-25211.

Container image	Digest	Package	Fixed in
oxynozeta/prometheus-cachethq :1.1.1	31f11669d597	github.com/gin-gonic/gin@v1.4.0	1.6.0

Open the chart page →

1,713

wharf-ainowharf-helm

0.1.5

5 of 7 See more

wharf-aino wharf-helm 0.1.5

5 of the 7 container images this version deploys carry CVE-2019-25211.

Container image	Digest	Package	Fixed in
quay.io/iver-wharf/wharf-api :v5.2.0	b736b345437d	github.com/gin-contrib/cors@v1.3.1	1.6.0
quay.io/iver-wharf/wharf-cmd :v0.8.2	e98d13459cdc	github.com/gin-contrib/cors@v1.3.1	1.6.0
quay.io/iver-wharf/wharf-provider-azuredevops :v3.0.1	2fe7e4dcffdf	github.com/gin-contrib/cors@v1.3.1	1.6.0
quay.io/iver-wharf/wharf-provider-github :v3.0.1	77a22cb45c2a	github.com/gin-contrib/cors@v1.3.1	1.6.0
quay.io/iver-wharf/wharf-provider-gitlab :v2.0.1	d7079e0890da	github.com/gin-contrib/cors@v1.3.1	1.6.0

Open the chart page →

13,459

wharf-cmdwharf-helm

0.3.3

1 of 1 See more

wharf-cmd wharf-helm 0.3.3

1 of the 1 container images this version deploys carry CVE-2019-25211.

Container image	Digest	Package	Fixed in
quay.io/iver-wharf/wharf-cmd :v0.8.2	e98d13459cdc	github.com/gin-contrib/cors@v1.3.1	1.6.0

Open the chart page →

3,427

mx-nodebicarus-labs

0.1.0

1 of 1 See more

mx-node bicarus-labs 0.1.0

1 of the 1 container images this version deploys carry CVE-2019-25211.

Container image	Digest	Package	Fixed in
bicarus/elrond-rosetta :v1.3.50.0	b1dab0721e1c	github.com/gin-contrib/cors@v0.0.0-20190301062745-f9e10995c85a	1.6.0

Open the chart page →

7,956

mx-notifierbicarus-labs

1.1.9

1 of 1 See more

mx-notifier bicarus-labs 1.1.9

1 of the 1 container images this version deploys carry CVE-2019-25211.

Container image	Digest	Package	Fixed in
bicarus/mx-notifier :1.1.8	bed688d16762	github.com/gin-contrib/cors@v1.4.0	1.6.0

Open the chart page →

3,722

clechaosnative

0.2.7

2 of 6 See more

cle chaosnative 0.2.7

2 of the 6 container images this version deploys carry CVE-2019-25211.

Container image	Digest	Package	Fixed in
chaosnative/cle-auth-server :2.7.0	72ee352bc333	github.com/gin-contrib/cors@v1.3.1	1.6.0
chaosnative/cle-license-module :2.7.0	62cf6adc355e	github.com/gin-contrib/cors@v1.3.1	1.6.0

Open the chart page →

16,389

zincdevtron

0.1.2

1 of 1 See more

zinc devtron 0.1.2

1 of the 1 container images this version deploys carry CVE-2019-25211.

Container image	Digest	Package	Fixed in
public.ecr.aws/zinclabs/zinc :latest	fefa9ee7256a	github.com/gin-contrib/cors@v1.4.0	1.6.0

Open the chart page →

1,507

zincdevtron-labs

0.1.2

1 of 1 See more

zinc devtron-labs 0.1.2

1 of the 1 container images this version deploys carry CVE-2019-25211.

Container image	Digest	Package	Fixed in
public.ecr.aws/zinclabs/zinc :latest	fefa9ee7256a	github.com/gin-contrib/cors@v1.4.0	1.6.0

Open the chart page →

1,507

vipienferama

0.2.8

1 of 1 See more

vipien ferama 0.2.8

1 of the 1 container images this version deploys carry CVE-2019-25211.

Container image	Digest	Package	Fixed in
ghcr.io/ferama/vipien :v0.5.3	923a3f704b21	github.com/gin-contrib/cors@v1.3.1	1.6.0

Open the chart page →

7,481

vcverifierfiware

4.12.25

1 of 1 See more

vcverifier fiware 4.12.25

1 of the 1 container images this version deploys carry CVE-2019-25211.

Container image	Digest	Package	Fixed in
quay.io/fiware/vcverifier :6.21.1	5f9aa6a9c385	github.com/gin-contrib/cors@v1.4.0	1.6.0

Open the chart page →

558

ledgerformance

1.2.0

1 of 1 See more

ledger formance 1.2.0

1 of the 1 container images this version deploys carry CVE-2019-25211.

Container image	Digest	Package	Fixed in
ghcr.io/formancehq/ledger :v1.9.2	03c1ddbda33b	github.com/gin-contrib/cors@v1.4.0	1.6.0

Open the chart page →

4,602

gotifygeek-cookbook

1.2.2

1 of 1 See more

gotify geek-cookbook 1.2.2

1 of the 1 container images this version deploys carry CVE-2019-25211.

Container image	Digest	Package	Fixed in
gotify/server :2.1.4	09c79bc1e403	github.com/gin-contrib/cors@v1.3.1	1.6.0

Open the chart page →

3,131

torrservergeek-cookbook

1.2.2

1 of 1 See more

torrserver geek-cookbook 1.2.2

1 of the 1 container images this version deploys carry CVE-2019-25211.

Container image	Digest	Package	Fixed in
smailkoz/torrserver :1.0.111	7b52d15de8f0	github.com/gin-contrib/cors@v1.3.1	1.6.0

Open the chart page →

3,165

loki-proxygroundcover

0.1.1

1 of 1 See more

loki-proxy groundcover 0.1.1

1 of the 1 container images this version deploys carry CVE-2019-25211.

Container image	Digest	Package	Fixed in
public.ecr.aws/groundcovercom/loki-proxy :0.1.1	783d550ad813	github.com/gin-gonic/gin@v1.5.0	1.6.0

Open the chart page →

2,175

tdenginehuangchengwu-helm-chart

3.0.2

1 of 1 See more

tdengine huangchengwu-helm-chart 3.0.2

1 of the 1 container images this version deploys carry CVE-2019-25211.

Container image	Digest	Package	Fixed in
tdengine/tdengine :3.0.2.2	4140a4021ddb	github.com/gin-contrib/cors@v1.3.1	1.6.0

Open the chart page →

3,747

vcverifieri4trust

1.0.23

1 of 1 See more

vcverifier i4trust 1.0.23

1 of the 1 container images this version deploys carry CVE-2019-25211.

Container image	Digest	Package	Fixed in
quay.io/fiware/vcverifier :2.0.1	cd36290dc849	github.com/gin-contrib/cors@v1.4.0	1.6.0

Open the chart page →

1,784

komiserkomiser-eks

3.1.10

1 of 1 See more

komiser komiser-eks 3.1.10

1 of the 1 container images this version deploys carry CVE-2019-25211.

Container image	Digest	Package	Fixed in
tailwarden/komiser :3.1.10	3f68c8ae7993	github.com/gin-contrib/cors@v1.4.0	1.6.0

Open the chart page →

1,265

kubetrankubeblocks

0.1.0

1 of 1 See more

kubetran kubeblocks 0.1.0

1 of the 1 container images this version deploys carry CVE-2019-25211.

Container image	Digest	Package	Fixed in
apecloud/kubetran-platform :latest	32bd92c7f7fa	github.com/gin-contrib/cors@v1.4.0	1.6.0

Open the chart page →

1,207

cranekubesphere-stable

0.5.2

1 of 3 See more

crane kubesphere-stable 0.5.2

1 of the 3 container images this version deploys carry CVE-2019-25211.

Container image	Digest	Package	Fixed in
gocrane/craned :v0.5.1	a1400909118c	github.com/gin-contrib/cors@v1.3.1	1.6.0

Open the chart page →

8,883

weather-app-chartlocal-weatherapp

0.1.0

1 of 4 See more

weather-app-chart local-weatherapp 0.1.0

1 of the 4 container images this version deploys carry CVE-2019-25211.

Container image	Digest	Package	Fixed in
youssef11gaber10/deployment-auth-go :latest	6597b26959d2	github.com/gin-contrib/cors@v1.4.0	1.6.0

Open the chart page →

5,905

karmamesosphere

1.3.0

1 of 1 See more

karma mesosphere 1.3.0

1 of the 1 container images this version deploys carry CVE-2019-25211.

Container image	Digest	Package	Fixed in
lmierzwa/karma :v0.50	3751e5eed656	github.com/gin-contrib/cors@v1.3.0 github.com/gin-gonic/gin@v1.4.1-0.20190910091637-9aa870f108a1	1.6.0 1.6.0

Open the chart page →

2,111

karmamesosphere-stable

2.0.3

1 of 1 See more

karma mesosphere-stable 2.0.3

1 of the 1 container images this version deploys carry CVE-2019-25211.

Container image	Digest	Package	Fixed in
lmierzwa/karma :v0.70	d417abe7ddb5	github.com/gin-contrib/cors@v1.3.1	1.6.0

Open the chart page →

1,966

kommandermesosphere-stable

0.39.2

1 of 29 See more

kommander mesosphere-stable 0.39.2

1 of the 29 container images this version deploys carry CVE-2019-25211.

Container image	Digest	Package	Fixed in
mesosphere/karma :v0.55-d2iq-proxy	4693bb4e0814	github.com/gin-contrib/cors@v1.3.0 github.com/gin-gonic/gin@v1.5.0	1.6.0 1.6.0

Open the chart page →

68,284

mindavphntom

0.1.6

1 of 2 See more

mindav phntom 0.1.6

1 of the 2 container images this version deploys carry CVE-2019-25211.

Container image	Digest	Package	Fixed in
phntom/mindav :0.1.7-kix3	5695f546abbb	github.com/gin-gonic/gin@v1.4.0	1.6.0

Open the chart page →

4,158

zincromholdings

0.1.2

1 of 1 See more

zinc romholdings 0.1.2

1 of the 1 container images this version deploys carry CVE-2019-25211.

Container image	Digest	Package	Fixed in
public.ecr.aws/zinclabs/zinc :latest	fefa9ee7256a	github.com/gin-contrib/cors@v1.4.0	1.6.0

Open the chart page →

1,507

agentssynapse

0.1.30

2 of 9 See more

agents synapse 0.1.30

2 of the 9 container images this version deploys carry CVE-2019-25211.

Container image	Digest	Package	Fixed in
ghcr.io/synapsecns/sanguine/agents :6e3887fc2a05aff0d159453cedbfbe5024b910bf	81a9ebc899a4	github.com/gin-contrib/cors@v1.4.0	1.6.0
ghcr.io/synapsecns/sanguine/scribe :6e3887fc2a05aff0d159453cedbfbe5024b910bf	5e0a3dfa9f96	github.com/gin-contrib/cors@v1.4.0	1.6.0

Open the chart page →

7,244

cctpsynapse

0.3.0

1 of 4 See more

cctp synapse 0.3.0

1 of the 4 container images this version deploys carry CVE-2019-25211.

Container image	Digest	Package	Fixed in
ghcr.io/synapsecns/sanguine/cctp-relayer :b5a1dd5288f1a18eb05994e130d626fed45a56fc	2f1408c94168	github.com/gin-contrib/cors@v1.4.0	1.6.0

Open the chart page →

1,815

promexportersynapse

0.1.1

1 of 1 See more

promexporter synapse 0.1.1

1 of the 1 container images this version deploys carry CVE-2019-25211.

Container image	Digest	Package	Fixed in
ghcr.io/synapsecns/sanguine/promexporter :4a9aad096c2bd1160e56e5472ddac77fa0cde2e9	416c1c5aeb86	github.com/gin-contrib/cors@v1.4.0	1.6.0

Open the chart page →

1,704

sinnersynapse

0.1.0

1 of 6 See more

sinner synapse 0.1.0

1 of the 6 container images this version deploys carry CVE-2019-25211.

Container image	Digest	Package	Fixed in
ghcr.io/synapsecns/sanguine/sinner :latest	3e98a98f6074	github.com/gin-contrib/cors@v1.4.0	1.6.0

Open the chart page →

1,955

todolist-charttodolist-chart

0.1.7

1 of 10 See more

todolist-chart todolist-chart 0.1.7

1 of the 10 container images this version deploys carry CVE-2019-25211.

Container image	Digest	Package	Fixed in
erenozcan17/go_backend :v4.2	50b4f23422b6	github.com/gin-contrib/cors@v1.4.0	1.6.0

Open the chart page →

6,973

Container images carrying it

34 by charts deploying them

A fixed version is listed for 2 of the 2 affected packages.

Container image	Digest	Package	Fixed in	Used by
public.ecr.aws/zinclabs/zinc :latest	fefa9ee7256a	github.com/gin-contrib/cors@v1.4.0	1.6.0	3
quay.io/iver-wharf/wharf-api :v5.2.0	b736b345437d	github.com/gin-contrib/cors@v1.3.1	1.6.0	2
quay.io/iver-wharf/wharf-cmd :v0.8.2	e98d13459cdc	github.com/gin-contrib/cors@v1.3.1	1.6.0	2
quay.io/iver-wharf/wharf-provider-azuredevops :v3.0.1	2fe7e4dcffdf	github.com/gin-contrib/cors@v1.3.1	1.6.0	2
quay.io/iver-wharf/wharf-provider-github :v3.0.1	77a22cb45c2a	github.com/gin-contrib/cors@v1.3.1	1.6.0	2
quay.io/iver-wharf/wharf-provider-gitlab :v2.0.1	d7079e0890da	github.com/gin-contrib/cors@v1.3.1	1.6.0	2
apecloud/kubetran-platform :latest	32bd92c7f7fa	github.com/gin-contrib/cors@v1.4.0	1.6.0	1
bicarus/elrond-rosetta :v1.3.50.0	b1dab0721e1c	github.com/gin-contrib/cors@v0.0.0-20190301062745-f9e10995c85a	1.6.0	1
bicarus/mx-notifier :1.1.8	bed688d16762	github.com/gin-contrib/cors@v1.4.0	1.6.0	1
chaosnative/cle-auth-server :2.7.0	72ee352bc333	github.com/gin-contrib/cors@v1.3.1	1.6.0	1
chaosnative/cle-license-module :2.7.0	62cf6adc355e	github.com/gin-contrib/cors@v1.3.1	1.6.0	1
erenozcan17/go_backend :v4.2	50b4f23422b6	github.com/gin-contrib/cors@v1.4.0	1.6.0	1
gocrane/craned :v0.5.1	a1400909118c	github.com/gin-contrib/cors@v1.3.1	1.6.0	1
gotify/server :2.1.4	09c79bc1e403	github.com/gin-contrib/cors@v1.3.1	1.6.0	1
lmierzwa/karma :v0.50	3751e5eed656	github.com/gin-contrib/cors@v1.3.0 github.com/gin-gonic/gin@v1.4.1-0.20190910091637-9aa870f108a1	1.6.0 1.6.0	1
lmierzwa/karma :v0.70	d417abe7ddb5	github.com/gin-contrib/cors@v1.3.1	1.6.0	1
mesosphere/karma :v0.55-d2iq-proxy	4693bb4e0814	github.com/gin-contrib/cors@v1.3.0 github.com/gin-gonic/gin@v1.5.0	1.6.0 1.6.0	1
neosu/kubebadges :v0.0.5	256530d8e5c6	github.com/gin-contrib/cors@v1.4.0	1.6.0	1
oxynozeta/prometheus-cachethq :1.1.1	31f11669d597	github.com/gin-gonic/gin@v1.4.0	1.6.0	1
phntom/mindav :0.1.7-kix3	5695f546abbb	github.com/gin-gonic/gin@v1.4.0	1.6.0	1
smailkoz/torrserver :1.0.111	7b52d15de8f0	github.com/gin-contrib/cors@v1.3.1	1.6.0	1
tailwarden/komiser :3.1.10	3f68c8ae7993	github.com/gin-contrib/cors@v1.4.0	1.6.0	1
tdengine/tdengine :3.0.2.2	4140a4021ddb	github.com/gin-contrib/cors@v1.3.1	1.6.0	1
youssef11gaber10/deployment-auth-go :latest	6597b26959d2	github.com/gin-contrib/cors@v1.4.0	1.6.0	1
ghcr.io/ferama/vipien :v0.5.3	923a3f704b21	github.com/gin-contrib/cors@v1.3.1	1.6.0	1
ghcr.io/formancehq/ledger :v1.9.2	03c1ddbda33b	github.com/gin-contrib/cors@v1.4.0	1.6.0	1
ghcr.io/synapsecns/sanguine/agents :6e3887fc2a05aff0d159453cedbfbe5024b910bf	81a9ebc899a4	github.com/gin-contrib/cors@v1.4.0	1.6.0	1
ghcr.io/synapsecns/sanguine/cctp-relayer :b5a1dd5288f1a18eb05994e130d626fed45a56fc	2f1408c94168	github.com/gin-contrib/cors@v1.4.0	1.6.0	1
ghcr.io/synapsecns/sanguine/promexporter :4a9aad096c2bd1160e56e5472ddac77fa0cde2e9	416c1c5aeb86	github.com/gin-contrib/cors@v1.4.0	1.6.0	1
ghcr.io/synapsecns/sanguine/scribe :6e3887fc2a05aff0d159453cedbfbe5024b910bf	5e0a3dfa9f96	github.com/gin-contrib/cors@v1.4.0	1.6.0	1
ghcr.io/synapsecns/sanguine/sinner :latest	3e98a98f6074	github.com/gin-contrib/cors@v1.4.0	1.6.0	1
public.ecr.aws/groundcovercom/loki-proxy :0.1.1	783d550ad813	github.com/gin-gonic/gin@v1.5.0	1.6.0	1
quay.io/fiware/vcverifier :6.21.1	5f9aa6a9c385	github.com/gin-contrib/cors@v1.4.0	1.6.0	1
quay.io/fiware/vcverifier :2.0.1	cd36290dc849	github.com/gin-contrib/cors@v1.4.0	1.6.0	1