CVE-2025-47907

Description

Cancelling a query (e.g. by cancelling the context passed to one of the query methods) during a call to the Scan method of the returned Rows can result in unexpected results if other queries are being made in parallel. This can result in a race condition that may overwrite the expected results with those of another query, causing the call to Scan to return either unexpected results from the other query or an error.

PUBLISHED Reserved 2025-05-13 | Published 2025-08-07 | Updated 2025-11-04 | Assigner Go

Problem types

CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Product status

Credits

Spike Curtis from Coder

References

www.openwall.com/lists/oss-security/2025/08/06/1

go.dev/cl/693735

go.dev/issue/74831

groups.google.com/g/golang-announce/c/x5MKroML2yM

pkg.go.dev/vuln/GO-2025-3849

cve.org (CVE-2025-47907)

nvd.nist.gov (CVE-2025-47907)

Download JSON