CVE-2025-47910
UnscoredAdvisory
Published 22 Sept 2025In the index since 5 Sept 2026
- Severity
- Unscored
- worst across findings
- CVSS
- —
- base score, highest
- EPSS
- 0.003
- 26th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 59
- of 17,781 indexed, latest versions
- Container images
- 55
- deployed by those charts
- Fix available
- 1 of 1
- affected package
CrossOriginProtection insecure bypass patterns not limited to exact matches in net/http
Carried by container images the latest versions of 59 of 17,781 indexed charts deploy, on 55 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| stdlibgolang | go1.25.0 | 1.25.1 | 55 |
- OSV records
- GO-2025-3955
- Also known as
- BIT-golang-2025-47910
Charts affected
59 by stars
| Chart | Latest | Affected images | Radar Score |
|---|---|---|---|
| rybbitrybbit-helm | 1.3.0 | 1 of 7See more | 5,819 |
| ctlogsigstoreVerified publisher | 0.2.68 | 3 of 4See more | 2,728 |
| trilliansigstoreVerified publisher | 0.3.17 | 1 of 5See more | 2,808 |
| tufsigstoreVerified publisher | 0.1.32 | 1 of 1See more | 761 |
| spire-ha-agentspiffeVerified publisher | 0.3.2 | 1 of 2See more | 361 |
| volcanovolcano-sh | 1.15.2 | 3 of 3See more | 1,533 |
| aih-scannerwallarmVerified publisher | 2.7.11 | 1 of 2See more | 3,911 |
| giteawenerme | 12.7.0 | 1 of 4See more | 8,811 |
| wexa-studiowexa-studio | 1.2.0 | 2 of 15See more | 14,983 |
Container images carrying it
55 by charts deploying them
A fixed version is listed for 1 of the 1 affected package.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| ghcr.io/ | ae8eb69c7b70 | stdlib | 1.25.1 | 1 |
| ghcr.io/ | 307cf2d05afe | stdlib | 1.25.1 | 1 |
| quay.io/ | a4d2667f2b6e | stdlib | 1.25.1 | 1 |
| quay.io/ | 7652b1285f50 | stdlib | 1.25.1 | 1 |
| registry.gitlab.com/ | 4369f3ba1d9a | stdlib | 1.25.1 | 1 |