CVE-2025-47907
published 2025-08-07CVE-2025-47907: Cancelling a query (e.g. by cancelling the context passed to one of the query methods) during a call to the Scan method of the returned Rows can result in…
PriorityP337high7CVSS 3.1
AVNACHPRNUINSUCHILAL
EPSS
0.33%
24.9th percentile
Cancelling a query (e.g. by cancelling the context passed to one of the query methods) during a call to the Scan method of the returned Rows can result in unexpected results if other queries are being made in parallel. This can result in a race condition that may overwrite the expected results with those of another query, causing the call to Scan to return either unexpected results from the other query or an error.
Affected
15 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | golang-1.15 | < golang-1.24 1.24.7-1 (forky) | golang-1.24 1.24.7-1 (forky) |
| debian | golang-1.19 | < golang-1.24 1.24.7-1 (forky) | golang-1.24 1.24.7-1 (forky) |
| debian | golang-1.24 | < golang-1.24 1.24.7-1 (forky) | golang-1.24 1.24.7-1 (forky) |
| github.com | open-feature_flagd_core | >= 0 < 0.13.1 | 0.13.1 |
| github.com | open-feature_flagd_flagd | >= 0 < 0.13.1 | 0.13.1 |
| github.com | open-feature_flagd_flagd-proxy | >= 0 < 0.8.2 | 0.8.2 |
| go_standard_library | database_sql | < 1.23.12 | 1.23.12 |
| go_standard_library | database_sql | >= 1.24.0 < 1.24.6 | 1.24.6 |
| golang | go | < 1.23.12 | 1.23.12 |
| golang | go | >= 1.24.0 < 1.24.6 | 1.24.6 |
| msrc | azl3_golang_1.23.11-1_on_azure_linux_3.0 | — | — |
| msrc | azl3_golang_1.24.5-1_on_azure_linux_3.0 | — | — |
| msrc | cbl2_golang_1.18.8-8_on_cbl_mariner_2.0 | — | — |
| msrc | cbl2_golang_1.22.7-4_on_cbl_mariner_2.0 | — | — |
| msrc | cbl2_golang_1.22.7-5_on_cbl_mariner_2.0 | — | — |
CVSS provenance
nvdv3.17.0HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L
ghsa7.0HIGH
osv7.0HIGH
vendor_debian7.0HIGH
vendor_msrc7.0HIGH
vendor_redhat7.0HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Microsoft
Incorrect results returned from Rows.Scan in database/sql
vendor_msrc·2025-08-12·CVSS 7.0
CVE-2025-47907 [HIGH] Incorrect results returned from Rows.Scan in database/sql
Incorrect results returned from Rows.Scan in database/sql
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
Go: Go
Customer Action Required: Yes
Remediation: CBL-Mariner Releases
Reference: https://learn.mic
Red Hat
database/sql: Postgres Scan Race Condition
vendor_redhat·2025-08-07·CVSS 7.0
CVE-2025-47907 [HIGH] CWE-362 database/sql: Postgres Scan Race Condition
database/sql: Postgres Scan Race Condition
Cancelling a query (e.g. by cancelling the context passed to one of the query methods) during a call to the Scan method of the returned Rows can result in unexpected results if other queries are being made in parallel. This can result in a race condition that may overwrite the expected results with those of another query, causing the call to Scan to return either unexpected results from the other query or an error.
A flaw was found in database/sql. Concurrent queries can produce unexpected results when a query is cancelled during a Scan method call on returned Rows, creating a race condition. This vulnerability allows an attacker who can initiate and cancel queries to trigger this condition, possibly leading to inconsistent data being returned t
Debian
CVE-2025-47907: golang-1.15 - Cancelling a query (e.g. by cancelling the context passed to one of the query me...
vendor_debian·2025·CVSS 7.0
CVE-2025-47907 [HIGH] CVE-2025-47907: golang-1.15 - Cancelling a query (e.g. by cancelling the context passed to one of the query me...
Cancelling a query (e.g. by cancelling the context passed to one of the query methods) during a call to the Scan method of the returned Rows can result in unexpected results if other queries are being made in parallel. This can result in a race condition that may overwrite the expected results with those of another query, causing the call to Scan to return either unexpected results from the other query or an error.
Scope: local
bullseye: open
GHSA
flagd: Multiple Go Runtime CVEs Impact Security and Availability
ghsa·2026-01-05·CVSS 7.0
CVE-2025-47907 [HIGH] CWE-20 flagd: Multiple Go Runtime CVEs Impact Security and Availability
flagd: Multiple Go Runtime CVEs Impact Security and Availability
### Summary
In 2025, several vulnerabilities in the Go Standard Library were disclosed, impacting Go-based applications like flagd (the evaluation engine for OpenFeature). These CVEs primarily focus on Denial of Service (DoS) through resource exhaustion and Race Conditions in database handling.
| CVE ID | Impacted Package | Severity | Description & Impact on flagd |
| -- | -- | -- | -- |
| CVE-2025-47907 | database/sql | 7.0 (High) | Race Condition: Canceling a query during a Scan call can return data from the wrong query. Critical if flagd uses SQL-based sync providers (e.g., Postgres), potentially leading to incorrect flag configurations. |
| CVE-2025-61725 | net/mail | 7.5 (High) | DoS: Inefficient complexity in ParseAdd
OSV
flagd: Multiple Go Runtime CVEs Impact Security and Availability
osv·2026-01-05·CVSS 7.0
CVE-2025-47907 [HIGH] flagd: Multiple Go Runtime CVEs Impact Security and Availability
flagd: Multiple Go Runtime CVEs Impact Security and Availability
### Summary
In 2025, several vulnerabilities in the Go Standard Library were disclosed, impacting Go-based applications like flagd (the evaluation engine for OpenFeature). These CVEs primarily focus on Denial of Service (DoS) through resource exhaustion and Race Conditions in database handling.
| CVE ID | Impacted Package | Severity | Description & Impact on flagd |
| -- | -- | -- | -- |
| CVE-2025-47907 | database/sql | 7.0 (High) | Race Condition: Canceling a query during a Scan call can return data from the wrong query. Critical if flagd uses SQL-based sync providers (e.g., Postgres), potentially leading to incorrect flag configurations. |
| CVE-2025-61725 | net/mail | 7.5 (High) | DoS: Inefficient complexity in ParseAdd
OSV
Incorrect results returned from Rows.Scan in database/sql
osv·2025-08-07
CVE-2025-47907 Incorrect results returned from Rows.Scan in database/sql
Incorrect results returned from Rows.Scan in database/sql
Cancelling a query (e.g. by cancelling the context passed to one of the query methods) during a call to the Scan method of the returned Rows can result in unexpected results if other queries are being made in parallel. This can result in a race condition that may overwrite the expected results with those of another query, causing the call to Scan to return either unexpected results from the other query or an error.
OSV
CVE-2025-47907: Cancelling a query (e
osv·2025-08-07·CVSS 7.0
CVE-2025-47907 [HIGH] CVE-2025-47907: Cancelling a query (e
Cancelling a query (e.g. by cancelling the context passed to one of the query methods) during a call to the Scan method of the returned Rows can result in unexpected results if other queries are being made in parallel. This can result in a race condition that may overwrite the expected results with those of another query, causing the call to Scan to return either unexpected results from the other query or an error.
GHSA
GHSA-j5pm-7495-qmr3: Cancelling a query (e
ghsa_unreviewed·2025-08-07
CVE-2025-47907 [HIGH] GHSA-j5pm-7495-qmr3: Cancelling a query (e
Cancelling a query (e.g. by cancelling the context passed to one of the query methods) during a call to the Scan method of the returned Rows can result in unexpected results if other queries are being made in parallel. This can result in a race condition that may overwrite the expected results with those of another query, causing the call to Scan to return either unexpected results from the other query or an error.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2025-47907 database/sql: Postgres Scan Race Condition
bugzilla·2025-08-07·CVSS 7.0
CVE-2025-47907 [HIGH] CVE-2025-47907 database/sql: Postgres Scan Race Condition
CVE-2025-47907 database/sql: Postgres Scan Race Condition
Cancelling a query (e.g. by cancelling the context passed to one of the query methods) during a call to the Scan method of the returned Rows can result in unexpected results if other queries are being made in parallel. This can result in a race condition that may overwrite the expected results with those of another query, causing the call to Scan to return either unexpected results from the other query or an error.
Discussion:
As noted in this issue in Go and its follow on links: https://github.com/golang/go/issues/74831
This appears to be addressed in Go v1.23.12, v1.24.7, and v1.25.0 and higher.
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 9.4 Extended Update Support
Via RHSA-2025:1
Wiz
GHSA-4c5f-9mj4-m247 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 7.0
CVE-2025-47907 [HIGH] GHSA-4c5f-9mj4-m247 Impact, Exploitability, and Mitigation Steps | Wiz
## GHSA-4c5f-9mj4-m247 :
vulnerability analysis and mitigation
## Summary
In 2025, several vulnerabilities in the Go Standard Library were disclosed, impacting Go-based applications like flagd (the evaluation engine for OpenFeature). These CVEs primarily focus on Denial of Service (DoS) through resource exhaustion and Race Conditions in database handling.
CVE-2025-47907
database/sql
7.0 (High)
Race Condition: Canceling a query during a Scan call can return data from the wrong query. Critical if flagd uses SQL-based sync providers (e.g., Postgres), potentially leading to incorrect flag configurations.
CVE-2025-61725
net/mail
7.5 (High)
DoS: Inefficient complexity in ParseAddress. Attackers can provide crafted email strings with large domain literals to exhaust CPU if flagd parse
2025-08-07
Published