Security [High] CVE-2025-47907 #114
Description
Vulnerability Details
- ID: CVE-2025-47907
- Severity: High
- Affected Provider Version: ['v1.0.4']
- Package: stdlib
- Package Version: go1.23.10
- Type: go-module
- Description: Cancelling a query (e.g. by cancelling the context passed to one of the query methods) during a call to the Scan method of the returned Rows can result in unexpected results if other queries are being made in parallel. This can result in a race condition that may overwrite the expected results with those of another query, causing the call to Scan to return either unexpected results from the other query or an error.
- Fix State: fixed
- Fix Versions: 1.23.12, 1.24.6
- Artifact Paths: /usr/local/bin/provider
- More Info: https://go.dev/cl/693735, https://go.dev/issue/74831, https://groups.google.com/g/golang-announce/c/x5MKroML2yM, https://pkg.go.dev/vuln/GO-2025-3849
This vulnerability was detected during the periodic CVE scan.