CVE-2025-47907

7.0 HIGH
Published: August 07, 2025 Modified: January 29, 2026
View on NVD

Description

Cancelling a query (e.g. by cancelling the context passed to one of the query methods) during a call to the Scan method of the returned Rows can result in unexpected results if other queries are being made in parallel. This can result in a race condition that may overwrite the expected results with those of another query, causing the call to Scan to return either unexpected results from the other query or an error.

AI Explanation

Get an AI-powered plain-language explanation of this vulnerability and remediation steps.

Login to generate AI explanation

CVSS v3.x Details

0.0 Low Medium High Critical 10.0
Vector String
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L

References to Advisories, Solutions, and Tools

Patch Vendor Advisory Exploit Third Party Advisory
https://go.dev/cl/693735
Source: security@golang.org
Patch
https://go.dev/issue/74831
Source: security@golang.org
Issue Tracking Third Party Advisory
https://groups.google.com/g/golang-announce/c/x5MKroML2yM
Source: security@golang.org
Mailing List Release Notes
https://pkg.go.dev/vuln/GO-2025-3849
Source: security@golang.org
Vendor Advisory
http://www.openwall.com/lists/oss-security/2025/08/06/1
Source: af854a3a-2127-422b-91ae-364da2661108
Mailing List Release Notes

5 reference(s) from NVD

Quick Stats

CVSS v3 Score
7.0 / 10.0
EPSS (Exploit Probability)
0.0%
1th percentile
Exploitation Status
Not in CISA KEV

Weaknesses (CWE)

Affected Vendors

golang