id: GO-2024-2883
modules:
    - module: github.com/rs/cors
      versions:
        - introduced: 1.9.0
        - fixed: 1.11.0
      vulnerable_at: 1.10.1
      packages:
        - package: github.com/rs/cors
          symbols:
            - Cors.handlePreflight
            - Cors.areHeadersAllowed
            - New
            - splitHeaderValues
          derived_symbols:
            - AllowAll
            - Cors.HandlerFunc
            - Cors.ServeHTTP
            - Default
summary: Denial of service via malicious preflight requests in github.com/rs/cors
description: |-
    Middleware causes a prohibitive amount of heap allocations when processing
    malicious preflight requests that include a Access-Control-Request-Headers
    (ACRH) header whose value contains many commas. This behavior can be abused by
    attackers to produce undue load on the middleware/server as an attempt to cause
    a denial of service.
ghsas:
    - GHSA-mh55-gqvf-xfwm
credits:
    - '@jub0bs'
references:
    - fix: https://github.com/rs/cors/pull/171
    - report: https://github.com/rs/cors/issues/170
source:
    id: go-security-team
    created: 2024-07-02T11:27:50.335482-04:00
review_status: REVIEWED