x/vulndb: denial of service in github.com/rs/cors

[jub0bs]

Acknowledgement

• The maintainer(s) of the affected project have already been made aware of this vulnerability.

Description

Middleware cause a prohibitive amount of heap allocations when processing malicious preflight requests that include a Access-Control-Request-Headers (ACRH) header whose value contains many commas. This behavior can be abused by attackers to produce undue load on the middleware/server as an attempt to cause a denial of service.

Affected Modules, Packages, Versions and Symbols

Module: github.com/rs/cors
Package: github.com/rs/cors
Versions:
  - Introduced: 1.9.0
  - Fixed: 1.11.0
Symbols:
  - AllowAll
  - Default
  - Cors
  - New

Fix Commit or Pull Request

rs/cors#171

References

• Some malicious/spoofed preflight requests cause prohibitive load rs/cors#170

[gopherbot]

Change https://go.dev/cl/595963 mentions this issue: data/reports: add GO-2024-2883

[gopherbot]

Change https://go.dev/cl/597156 mentions this issue: data/reports: update 2 reports