Google Go up to 1.23.11/1.24.5 database-sql race condition

Summaryinfo

A vulnerability labeled as problematic has been found in Google Go up to 1.23.11/1.24.5. This affects an unknown function of the component database-sql. The manipulation results in race condition. This vulnerability is known as CVE-2025-47907. It is possible to launch the attack remotely. No exploit is available. The affected component should be upgraded.

Detailsinfo

A vulnerability classified as problematic has been found in Google Go up to 1.23.11/1.24.5. Affected is an unknown part of the component database-sql. The manipulation with an unknown input leads to a race condition vulnerability. CWE is classifying the issue as CWE-362. The product contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently. This is going to have an impact on integrity. CVE summarizes:

Cancelling a query (e.g. by cancelling the context passed to one of the query methods) during a call to the Scan method of the returned Rows can result in unexpected results if other queries are being made in parallel. This can result in a race condition that may overwrite the expected results with those of another query, causing the call to Scan to return either unexpected results from the other query or an error.

This vulnerability is traded as CVE-2025-47907 since 05/14/2025. The exploitability is told to be difficult. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. There are neither technical details nor an exploit publicly available.

The vulnerability scanner Nessus provides a plugin with the ID 250284 (Golang 1.23 < 1.23.12 / 1.24 < 1.24.6 Multiple Vulnerabilities), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 1.23.12 or 1.24.6 eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (250284) and CERT Bund (WID-SEC-2025-1740). Once again VulDB remains the best source for vulnerability data.

Affected

• Amazon Linux 2
• Red Hat Enterprise Linux
• Fedora Linux
• SUSE Linux
• Oracle Linux
• SUSE openSUSE
• RESF Rocky Linux
• IBM App Connect Enterprise
• IBM MQ
• Golang Go
• Splunk Splunk Enterprise
• Dell NetWorker
• Red Hat OpenShift

Productinfo

Type

• Programming Language Software

Vendor

• Google

Name

• Go

Version

• 1.23.0
• 1.23.1
• 1.23.2
• 1.23.3
• 1.23.4
• 1.23.5
• 1.23.6
• 1.23.7
• 1.23.8
• 1.23.9
• 1.23.10
• 1.23.11
• 1.24.0
• 1.24.1
• 1.24.2
• 1.24.3
• 1.24.4
• 1.24.5

License

• open-source

Website

• Vendor: https://www.google.com/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion