N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-vh9x-phq6-fx54

GHSA-vh9x-phq6-fx54: Duplicate Advisory: Denial of service via malicious preflight requests in github.com/rs/cors

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-mh55-gqvf-xfwm. This link is maintained to preserve external references.

Original Description

Middleware causes a prohibitive amount of heap allocations when processing malicious preflight requests that include a Access-Control-Request-Headers (ACRH) header whose value contains many commas. This behavior can be abused by attackers to produce undue load on the middleware/server as an attempt to cause a denial of service.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-vh9x-phq6-fx54

GHSA-vh9x-phq6-fx54:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/rs/cors	go	>= 1.9.0, < 1.11.0	1.11.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a denial of service in the rs/cors library, caused by excessive memory allocation when handling preflight requests. The root cause lies in the splitHeaderValues function in utils.go. This function would split the Access-Control-Request-Headers header value by commas. An attacker could craft a request with a header containing thousands of commas, forcing splitHeaderValues to allocate a massive slice of strings, leading to resource exhaustion.

The vulnerable workflow was orchestrated by the handlePreflight function in cors.go. This function would read the header and pass it to splitHeaderValues, and then the resulting slice would be processed by areHeadersAllowed. All three functions are key to triggering the vulnerability.

The patch addresses the issue by completely removing the splitHeaderValues and areHeadersAllowed functions. It introduces a new data structure, SortedSet, and a method, Subsumes, which validates the header by iterating over the raw string in controlled chunks. This avoids the large memory allocation, effectively mitigating the DoS risk. The handlePreflight function was updated to use this new, secure mechanism. Therefore, a runtime profile during exploitation would prominently feature splitHeaderValues as the source of the memory allocation, called from handlePreflight.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.