rs cors up to 1.10.x Access-Control-Request-Headers improperly controlled sequential memory allocation

Summaryinfo

A vulnerability classified as problematic has been found in rs cors up to 1.10.x. Affected is an unknown function. This manipulation of the argument Access-Control-Request-Headers causes improperly controlled sequential memory allocation. This vulnerability is tracked as CVE-2025-47908. The attack is possible to be carried out remotely. No exploit exists. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability classified as problematic was found in rs cors up to 1.10.x. Affected by this vulnerability is some unknown processing. The manipulation of the argument Access-Control-Request-Headers with an unknown input leads to a improperly controlled sequential memory allocation vulnerability. The CWE definition for the vulnerability is CWE-1325. The product manages a group of objects or resources and performs a separate memory allocation for each object, but it does not properly limit the total amount of memory that is consumed by all of the combined objects. As an impact it is known to affect availability. The summary by CVE is:

Middleware causes a prohibitive amount of heap allocations when processing malicious preflight requests that include a Access-Control-Request-Headers (ACRH) header whose value contains many commas. This behavior can be abused by attackers to produce undue load on the middleware/server as an attempt to cause a denial of service.

It is possible to read the advisory at github.com. This vulnerability is known as CVE-2025-47908 since 05/14/2025. The exploitation appears to be easy. The attack can be launched remotely. Technical details of the vulnerability are known, but there is no available exploit.

The vulnerability scanner Nessus provides a plugin with the ID 253558 (Linux Distros Unpatched Vulnerability : CVE-2025-47908), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 1.11.0 eliminates this vulnerability. Applying a patch is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at Tenable (253558). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• rs

Name

• cors

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.5
• 1.6
• 1.7
• 1.8
• 1.9
• 1.10

Website

• Product: https://github.com/rs/cors/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion