N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-4c5f-9mj4-m247

GHSA-4c5f-9mj4-m247: flagd: Multiple Go Runtime CVEs Impact Security and Availability

Summary

In 2025, several vulnerabilities in the Go Standard Library were disclosed, impacting Go-based applications like flagd (the evaluation engine for OpenFeature). These CVEs primarily focus on Denial of Service (DoS) through resource exhaustion and Race Conditions in database handling.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-4c5f-9mj4-m247

GHSA-4c5f-9mj4-m247:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/open-feature/flagd/core	go	< 0.13.1	0.13.1
github.com/open-feature/flagd/flagd-proxy	go	< 0.8.2	0.8.2
github.com/open-feature/flagd/flagd	go	< 0.13.1	0.13.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The security advisory addresses multiple vulnerabilities within the Go standard library, not in the flagd application code itself. The patch is a dependency update, upgrading the Go version from 1.24.x to 1.25.5 to mitigate these underlying issues. Since the patch does not modify application logic, identifying vulnerable functions requires inference based on which parts of flagd would utilize the vulnerable Go packages.

The analysis focused on files modified for linting purposes within the same pull request, as these changes were necessitated by the Go upgrade. These files point to the gRPC and HTTP sync features of flagd.

gRPC Handlers (syncHandler.FetchAllFlags, syncHandler.GetMetadata): These functions are network entry points for flag synchronization. gRPC is built on HTTP/2, and these handlers are therefore susceptible to the net/http (CVE-2025-58188) and crypto/x509 (CVE-2025-61729) vulnerabilities during request processing and TLS handshakes.
HTTP Client (HTTP.Sync): This function makes outbound requests to fetch flag configurations. It is a potential trigger for the same net/http and crypto/x509 vulnerabilities, but from the client side.

While the advisory mentions other CVEs related to database/sql and archive/zip, the provided patch files did not contain evidence to pinpoint those specific functions. The analysis is therefore focused on the networking-related vulnerabilities for which the patch provides indirect evidence.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.