Cross-Site Request Forgery Vulnerability in Go Applications by TrustedOrigins

CVE-2025-47909

What is CVE-2025-47909?

The vulnerability in Go applications arises from the improper handling of TrustedOrigins, which permits network attackers to exploit Cross-Site Request Forgery (CSRF) attacks. When a host is included in the TrustedOrigins list, it fails to properly validate the request origins, allowing both HTTP and HTTPS requests. This flaw can be manipulated by attackers who can host forms on malicious domains, leading to unauthorized actions being executed on behalf of users. To mitigate this risk, developers should transition to using net/http.CrossOriginProtection, or utilize backported alternatives available for older versions.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References