CVE catalog

CVE-2025-24358

golang-github-gorilla-csrf: CVE-2025-24358

[CVE catalog]

Severity
Medium · CVSS 6.5CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Published
Source
[NVD] · [CVE record]
EPSS
0.37% · Oct 25, 2026

gorilla/csrf provides Cross Site Request Forgery (CSRF) prevention middleware for Go web applications & services. Prior to 1.7.2, gorilla/csrf does not validate the Origin header against an allowlist. Its executes its validation of the Referer header for cross-origin requests only when it believes the request is being served over TLS. It determines this by inspecting the r.URL.Scheme value. However, this value is never populated for "server" requests per the Go spec, and so this check does not run in practice. This vulnerability allows an attacker who has gained XSS on a subdomain or top level domain to perform authenticated form submissions against gorilla/csrf protected targets that share the same top level domain. This vulnerability is fixed in 1.7.2.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiangolang-github-gorilla-csrfsid1.7.2+ds1-3fixed
Debiangolang-github-gorilla-csrfforky1.7.2+ds1-3fixed
Debiangolang-github-gorilla-csrftrixie1.7.2+ds1-2fixed
Debiangolang-github-gorilla-csrfbookworm1.7.1-1vulnerable
Opensusegovulncheck-vulndbtumbleweed0.0.20250422T181640-1.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiangolang-github-gorilla-csrfsourcesid1.7.2+ds1-2not yet assignedNot reported[1103584]
Debiangolang-github-gorilla-csrfsourceforky1.7.2+ds1-2not yet assignedNot reported[1103584]
Debiangolang-github-gorilla-csrfsourcetrixie1.7.2+ds1-2not yet assignedNot reported[1103584]
Debiangolang-github-gorilla-csrfsourcebookworm(unfixed)not yet assignedNot reported[1103584]
Opensusegovulncheck-vulndbrpmtumbleweed0.0.20250422T181640-1.1Not reportedOPENSUSE-SU-2025:15017-1Not reported

[Debian bug #1103584]

Notes

[bookworm] golang-github-gorilla-csrf: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [golang-github-gorilla-csrf-dev]Affected

    Source package: [golang-github-gorilla-csrf]

    Details (4)

    • 1.7.1-1 · all · bookworm

      Affected

      dsa · golang-github-gorilla-csrf · debian · bookworm; dsa · golang-github-gorilla-csrf · debian · 12

    • 1.7.1-1 · all · bookworm

      Affected

      dsa · golang-github-gorilla-csrf · debian · bookworm; dsa · golang-github-gorilla-csrf · debian · 12

    • 1.7.2-1~bpo12+1 · all · bookworm-backports

      Affected

      dsa · golang-github-gorilla-csrf · debian · bookworm; dsa · golang-github-gorilla-csrf · debian · 12

    • 1.7.2-1~bpo12+1 · all · bookworm-backports

      Affected

      dsa · golang-github-gorilla-csrf · debian · bookworm; dsa · golang-github-gorilla-csrf · debian · 12

[Debian 13 (Trixie)]

  • [golang-github-gorilla-csrf-dev]Fixed

    Source package: [golang-github-gorilla-csrf]

    Details (2)

    • 1.7.2+ds1-2 · all · trixie

      Fixed · Fixed: 1.7.2+ds1-2

      dsa · golang-github-gorilla-csrf · debian · 13

    • 1.7.2+ds1-2 · all · trixie

      Fixed · Fixed: 1.7.2+ds1-2

      dsa · golang-github-gorilla-csrf · debian · 13

[openSUSE Tumbleweed]

  • [govulncheck-vulndb]Fixed

    Source package: [govulncheck-vulndb]

    Details (1)

    • 0.0.20260828T144745-1.1 · noarch · tumbleweed

      Fixed · Fixed: 0.0.20250422T181640-1.1

      dsa · govulncheck-vulndb · opensuse · tumbleweed

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]