CVE catalog

CVE-2025-47907

golang-1.19: CVE-2025-47907

Severity: High · CVSS 7CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L
Published: Aug 6, 2025, 10:00:00 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.38% · Oct 25, 2026

Cancelling a query (e.g. by cancelling the context passed to one of the query methods) during a call to the Scan method of the returned Rows can result in unexpected results if other queries are being made in parallel. This can result in a race condition that may overwrite the expected results with those of another query, causing the call to Scan to return either unexpected results from the other query or an error.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	golang-1.19	bookworm	`1.19.8-2`	vulnerable
Suse	azure-storage-azcopy	linux enterprise module for public cloud 15 sp4	`10.32.4-150400.9.11.1`	fixed
Suse	azure-storage-azcopy	linux enterprise module for public cloud 15 sp5	`10.32.4-150400.9.11.1`	fixed
Suse	azure-storage-azcopy	linux enterprise module for public cloud 15 sp6	`10.32.4-150400.9.11.1`	fixed
Suse	azure-storage-azcopy	linux enterprise module for public cloud 15 sp7	`10.32.4-150400.9.11.1`	fixed
Opensuse	clair	tumbleweed	`4.9.0-1.1`	fixed
Opensuse	azure-storage-azcopy	tumbleweed	`10.30.1-1.1`	fixed
Opensuse	nova	tumbleweed	`3.11.8-1.1`	fixed
Opensuse	polaris	tumbleweed	`10.1.1-1.1`	fixed
Opensuse	pluto	tumbleweed	`5.22.5-1.1`	fixed
Suse	govulncheck-vulndb	linux enterprise module for package hub 15 sp6	`0.0.20250814T182633-150000.1.98.1`	fixed
Opensuse	govulncheck-vulndb	leap 15.6	`0.0.20250814T182633-150000.1.98.1`	fixed
Ubuntu	golang-1.13	pro	`1.13.8-1ubuntu2`	vulnerable
Ubuntu	golang-1.13	pro	`1.13.8-1ubuntu2.22.04.1`	vulnerable
Ubuntu	golang-1.13	pro	`1.13.8-1ubuntu2.22.04.1+esm1`	vulnerable
Ubuntu	golang-1.13	pro	`1.13.8-1ubuntu2.22.04.2`	vulnerable
Ubuntu	golang-1.18	pro	`1.18.1-1ubuntu1~18.04.3`	vulnerable
Ubuntu	golang-1.18	pro	`1.18.1-1ubuntu1~18.04.4`	vulnerable
Ubuntu	golang-1.18	pro	`1.18.1-1ubuntu1~18.04.4+esm1`	vulnerable
Ubuntu	golang-1.16	pro	`1.16.2-0ubuntu1~20.04`	vulnerable
Ubuntu	golang-1.16	pro	`1.16.2-0ubuntu1~20.04.1`	vulnerable
Ubuntu	golang-1.16	pro	`1.16.2-0ubuntu1~20.04.1+esm1`	vulnerable
Ubuntu	golang-1.13	20.04	`1.13.1-1ubuntu1`	vulnerable
Ubuntu	golang-1.13	20.04	`1.13.3-1ubuntu1`	vulnerable
Ubuntu	golang-1.13	20.04	`1.13.4-1ubuntu1`	vulnerable
Ubuntu	golang-1.13	20.04	`1.13.5-1ubuntu1`	vulnerable
Ubuntu	golang-1.13	20.04	`1.13.6-1ubuntu1`	vulnerable
Ubuntu	golang-1.13	20.04	`1.13.6-2ubuntu1`	vulnerable
Ubuntu	golang-1.13	20.04	`1.13.7-1ubuntu1`	vulnerable
Ubuntu	golang-1.13	20.04	`1.13.8-1ubuntu1`	vulnerable
Ubuntu	golang-1.13	20.04	`1.13.8-1ubuntu1.1`	vulnerable
Ubuntu	golang-1.13	20.04	`1.13.8-1ubuntu1.2`	vulnerable
Ubuntu	golang-1.14	20.04	`1.14~beta1-1`	vulnerable
Ubuntu	golang-1.14	20.04	`1.14~beta1-2`	vulnerable
Ubuntu	golang-1.14	20.04	`1.14~rc1-1`	vulnerable
Ubuntu	golang-1.14	20.04	`1.14-1`	vulnerable
Ubuntu	golang-1.14	20.04	`1.14.1-1`	vulnerable
Ubuntu	golang-1.14	20.04	`1.14.2-1`	vulnerable
Ubuntu	golang-1.14	20.04	`1.14.2-1ubuntu1`	vulnerable
Ubuntu	golang-1.14	20.04	`1.14.3-2ubuntu2~20.04.1`	vulnerable
Ubuntu	golang-1.14	20.04	`1.14.3-2ubuntu2~20.04.2`	vulnerable
Ubuntu	golang-1.18	20.04	`1.18.1-1ubuntu1~20.04.1`	vulnerable
Ubuntu	golang-1.18	20.04	`1.18.1-1ubuntu1~20.04.2`	vulnerable
Ubuntu	golang-1.18	20.04	`1.18.1-1ubuntu1~20.04.3`	vulnerable
Ubuntu	golang-1.20	20.04	`1.20.3-1ubuntu0.1~20.04`	vulnerable
Ubuntu	golang-1.20	20.04	`1.20.3-1ubuntu0.1~20.04.1`	vulnerable
Ubuntu	golang-1.21	20.04	`1.21.1-1~ubuntu20.04.1`	vulnerable
Ubuntu	golang-1.21	20.04	`1.21.1-1~ubuntu20.04.2`	vulnerable
Ubuntu	golang-1.21	20.04	`1.21.1-1~ubuntu20.04.3`	vulnerable
Ubuntu	golang-1.22	20.04	`1.22.2-2~20.04.1`	vulnerable
Ubuntu	golang-1.22	20.04	`1.22.2-2~20.04.2`	vulnerable
Ubuntu	golang-1.22	20.04	`1.22.2-2~20.04.3`	vulnerable
Ubuntu	golang-1.17	22.04	`1.17-1ubuntu2`	vulnerable
Ubuntu	golang-1.17	22.04	`1.17.3-1ubuntu1`	vulnerable
Ubuntu	golang-1.17	22.04	`1.17.3-1ubuntu2`	vulnerable
Ubuntu	golang-1.17	22.04	`1.17.13-3ubuntu1`	vulnerable
Ubuntu	golang-1.17	22.04	`1.17.13-3ubuntu1.2`	vulnerable
Ubuntu	golang-1.17	22.04	`1.17.13-3ubuntu1.3`	vulnerable
Ubuntu	golang-1.18	22.04	`1.18~beta1-0ubuntu1`	vulnerable
Ubuntu	golang-1.18	22.04	`1.18~beta2-1ubuntu1`	vulnerable
Ubuntu	golang-1.18	22.04	`1.18~beta2-1ubuntu2`	vulnerable
Ubuntu	golang-1.18	22.04	`1.18~rc1-1ubuntu1`	vulnerable
Ubuntu	golang-1.18	22.04	`1.18-1ubuntu1`	vulnerable
Ubuntu	golang-1.18	22.04	`1.18.1-1ubuntu1`	vulnerable
Ubuntu	golang-1.18	22.04	`1.18.1-1ubuntu1.1`	vulnerable
Ubuntu	golang-1.18	22.04	`1.18.1-1ubuntu1.2`	vulnerable
Ubuntu	golang-1.18	22.04	`1.18.1-1ubuntu1.3`	vulnerable
Ubuntu	golang-1.20	22.04	`1.20.3-1ubuntu0.1~22.04`	vulnerable
Ubuntu	golang-1.20	22.04	`1.20.3-1ubuntu0.1~22.04.1`	vulnerable
Ubuntu	golang-1.21	22.04	`1.21.1-1~ubuntu22.04.1`	vulnerable
Ubuntu	golang-1.21	22.04	`1.21.1-1~ubuntu22.04.2`	vulnerable
Ubuntu	golang-1.21	22.04	`1.21.1-1~ubuntu22.04.3`	vulnerable
Ubuntu	golang-1.21	22.04	`1.21.1-1~ubuntu22.04.4`	vulnerable
Ubuntu	golang-1.22	22.04	`1.22.2-2~22.04`	vulnerable
Ubuntu	golang-1.22	22.04	`1.22.2-2~22.04.1`	vulnerable
Ubuntu	golang-1.22	22.04	`1.22.2-2~22.04.2`	vulnerable
Ubuntu	golang-1.22	22.04	`1.22.2-2~22.04.3`	vulnerable
Ubuntu	golang-1.22	22.04	`1.22.2-2~22.04.4`	vulnerable
Ubuntu	golang-1.23	22.04	`1.23.1-1~22.04`	vulnerable
Ubuntu	golang-1.23	22.04	`1.23.1-1~22.04.2`	vulnerable
Ubuntu	golang-1.23	22.04	`1.23.1-1~22.04.3`	vulnerable
Ubuntu	golang-1.24	22.04	`1.24.4-1ubuntu1~22.04.1`	vulnerable
Ubuntu	golang-1.24	22.04	`1.24.4-1ubuntu1~22.04.2`	vulnerable
Ubuntu	golang-1.24	22.04	`1.24.13-2~22.04.1`	vulnerable
Ubuntu	golang-1.24	22.04	`1.24.13-2~22.04.2`	vulnerable
Ubuntu	golang-1.25	22.04	`1.25.14-1~ubuntu0.22.04.1`	vulnerable
Ubuntu	golang-1.21	24.04	`1.21.1-1`	vulnerable
Ubuntu	golang-1.21	24.04	`1.21.3-1`	vulnerable
Ubuntu	golang-1.21	24.04	`1.21.4-1`	vulnerable
Ubuntu	golang-1.21	24.04	`1.21.5-1`	vulnerable
Ubuntu	golang-1.21	24.04	`1.21.6-1`	vulnerable
Ubuntu	golang-1.21	24.04	`1.21.7-1`	vulnerable
Ubuntu	golang-1.21	24.04	`1.21.7-2`	vulnerable
Ubuntu	golang-1.21	24.04	`1.21.8-1`	vulnerable
Ubuntu	golang-1.21	24.04	`1.21.8-1build1`	vulnerable
Ubuntu	golang-1.21	24.04	`1.21.9-1`	vulnerable
Ubuntu	golang-1.21	24.04	`1.21.9-1ubuntu0.1`	vulnerable
Ubuntu	golang-1.22	24.04	`1.22~rc1-2`	vulnerable
Ubuntu	golang-1.22	24.04	`1.22.0-1`	vulnerable
Ubuntu	golang-1.22	24.04	`1.22.0-2`	vulnerable
Ubuntu	golang-1.22	24.04	`1.22.1-1`	vulnerable
Ubuntu	golang-1.22	24.04	`1.22.1-1build1`	vulnerable
Ubuntu	golang-1.22	24.04	`1.22.2-2`	vulnerable
Ubuntu	golang-1.22	24.04	`1.22.2-2ubuntu0.1`	vulnerable
Ubuntu	golang-1.22	24.04	`1.22.2-2ubuntu0.2`	vulnerable
Ubuntu	golang-1.22	24.04	`1.22.2-2ubuntu0.3`	vulnerable
Ubuntu	golang-1.22	24.04	`1.22.2-2ubuntu0.4`	vulnerable
Ubuntu	golang-1.22	24.04	`1.22.2-2ubuntu0.5`	vulnerable
Ubuntu	golang-1.23	24.04	`1.23.1-1~24.04`	vulnerable
Ubuntu	golang-1.23	24.04	`1.23.1-1~24.04.1`	vulnerable
Ubuntu	golang-1.24	24.04	`1.24.4-1ubuntu1~24.04.1`	vulnerable
Ubuntu	golang-1.24	24.04	`1.24.4-1ubuntu1~24.04.2`	vulnerable
Ubuntu	golang-1.24	24.04	`1.24.13-2~24.04.1`	vulnerable
Ubuntu	golang-1.25	24.04	`1.25.14-1~ubuntu0.24.04.1`	vulnerable
Ubuntu	golang-1.23	25.10	`1.23.8-1`	vulnerable
Ubuntu	golang-1.23	25.10	`1.23.10-1`	vulnerable
Ubuntu	golang-1.23	25.10	`1.23.10-1ubuntu0.2`	vulnerable
Ubuntu	golang-1.24	25.10	`1.24.2-1`	vulnerable
Ubuntu	golang-1.24	25.10	`1.24.2-2`	vulnerable
Ubuntu	golang-1.24	25.10	`1.24.4-1`	vulnerable
Ubuntu	golang-1.24	25.10	`1.24.4-1ubuntu1`	vulnerable
Ubuntu	golang-1.23	26.04	`1.23.10-1`	vulnerable

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	golang-1.19	source	bookworm	`(unfixed)`	not yet assigned	Not reported	Not reported
Suse	azure-storage-azcopy	rpm	linux enterprise module for public cloud 15 sp4	`10.32.4-150400.9.11.1`	Not reported	SUSE-SU-2026:2466-1	Not reported
Suse	azure-storage-azcopy	rpm	linux enterprise module for public cloud 15 sp5	`10.32.4-150400.9.11.1`	Not reported	SUSE-SU-2026:2466-1	Not reported
Suse	azure-storage-azcopy	rpm	linux enterprise module for public cloud 15 sp6	`10.32.4-150400.9.11.1`	Not reported	SUSE-SU-2026:2466-1	Not reported
Suse	azure-storage-azcopy	rpm	linux enterprise module for public cloud 15 sp7	`10.32.4-150400.9.11.1`	Not reported	SUSE-SU-2026:2466-1	Not reported
Opensuse	clair	rpm	tumbleweed	`4.9.0-1.1`	Not reported	OPENSUSE-SU-2025:15823-1	Not reported
Opensuse	azure-storage-azcopy	rpm	tumbleweed	`10.30.1-1.1`	Not reported	OPENSUSE-SU-2025:15594-1	Not reported
Opensuse	nova	rpm	tumbleweed	`3.11.8-1.1`	Not reported	OPENSUSE-SU-2025:15464-1	Not reported
Opensuse	polaris	rpm	tumbleweed	`10.1.1-1.1`	Not reported	OPENSUSE-SU-2025:15466-1	Not reported
Opensuse	pluto	rpm	tumbleweed	`5.22.5-1.1`	Not reported	OPENSUSE-SU-2025:15465-1	Not reported
Suse	govulncheck-vulndb	rpm	linux enterprise module for package hub 15 sp6	`0.0.20250814T182633-150000.1.98.1`	Not reported	SUSE-SU-2025:02912-1	Not reported
Opensuse	govulncheck-vulndb	rpm	leap 15.6	`0.0.20250814T182633-150000.1.98.1`	Not reported	SUSE-SU-2025:02912-1	Not reported

Notes

[bookworm] golang-1.19: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[golang-1.19]Affected
Details (2)
- 1.19.8-2 · all · bookworm
  Affected
  dsa · golang-1.19 · debian · bookworm; dsa · golang-1.19 · debian · 12
- 1.19.8-2 · all · bookworm
  Affected
  dsa · golang-1.19 · debian · bookworm; dsa · golang-1.19 · debian · 12
[golang-1.19-doc]Affected
Source package: [golang-1.19]
Details (2)
- 1.19.8-2 · all · bookworm
  Affected
  dsa · golang-1.19 · debian · bookworm; dsa · golang-1.19 · debian · 12
- 1.19.8-2 · all · bookworm
  Affected
  dsa · golang-1.19 · debian · bookworm; dsa · golang-1.19 · debian · 12
[golang-1.19-go]Affected
Source package: [golang-1.19]
Details (2)
- 1.19.8-2 · amd64 · bookworm
  Affected
  dsa · golang-1.19 · debian · bookworm; dsa · golang-1.19 · debian · 12
- 1.19.8-2 · arm64 · bookworm
  Affected
  dsa · golang-1.19 · debian · bookworm; dsa · golang-1.19 · debian · 12
[golang-1.19-src]Affected
Source package: [golang-1.19]
Details (2)
- 1.19.8-2 · all · bookworm
  Affected
  dsa · golang-1.19 · debian · bookworm; dsa · golang-1.19 · debian · 12
- 1.19.8-2 · all · bookworm
  Affected
  dsa · golang-1.19 · debian · bookworm; dsa · golang-1.19 · debian · 12

[Debian 13 (Trixie)]

[golang-1.24]Affected
Details (2)
- 1.24.4-1 · all · trixie
  Affected
  dsa · golang-1.24 · debian · 13
- 1.24.4-1 · all · trixie
  Affected
  dsa · golang-1.24 · debian · 13
[golang-1.24-doc]Affected
Source package: [golang-1.24]
Details (2)
- 1.24.4-1 · all · trixie
  Affected
  dsa · golang-1.24 · debian · 13
- 1.24.4-1 · all · trixie
  Affected
  dsa · golang-1.24 · debian · 13
[golang-1.24-go]Affected
Source package: [golang-1.24]
Details (2)
- 1.24.4-1 · amd64 · trixie
  Affected
  dsa · golang-1.24 · debian · 13
- 1.24.4-1 · arm64 · trixie
  Affected
  dsa · golang-1.24 · debian · 13
[golang-1.24-src]Affected
Source package: [golang-1.24]
Details (2)
- 1.24.4-1 · all · trixie
  Affected
  dsa · golang-1.24 · debian · 13
- 1.24.4-1 · all · trixie
  Affected
  dsa · golang-1.24 · debian · 13

[openSUSE Tumbleweed]

[clairctl]Unknown
Source package: [clair]
Details (1)
- 4.9.0-1.4 · x86_64 · tumbleweed
  Unknown · Fixed: 4.9.0-1.1
  Version impact unknown
  dsa · clair · opensuse · tumbleweed
[nova-bash-completion]Unknown
Source package: [nova]
Details (1)
- 3.12.0-1.4 · noarch · tumbleweed
  Unknown · Fixed: 3.11.8-1.1
  Version impact unknown
  dsa · nova · opensuse · tumbleweed
[nova-fish-completion]Unknown
Source package: [nova]
Details (1)
- 3.12.0-1.4 · noarch · tumbleweed
  Unknown · Fixed: 3.11.8-1.1
  Version impact unknown
  dsa · nova · opensuse · tumbleweed
[nova-zsh-completion]Unknown
Source package: [nova]
Details (1)
- 3.12.0-1.4 · noarch · tumbleweed
  Unknown · Fixed: 3.11.8-1.1
  Version impact unknown
  dsa · nova · opensuse · tumbleweed
[pluto-bash-completion]Unknown
Source package: [pluto]
Details (1)
- 5.24.3-1.1 · noarch · tumbleweed
  Unknown · Fixed: 5.22.5-1.1
  Version impact unknown
  dsa · pluto · opensuse · tumbleweed
[pluto-fish-completion]Unknown
Source package: [pluto]
Details (1)
- 5.24.3-1.1 · noarch · tumbleweed
  Unknown · Fixed: 5.22.5-1.1
  Version impact unknown
  dsa · pluto · opensuse · tumbleweed
[pluto-zsh-completion]Unknown
Source package: [pluto]
Details (1)
- 5.24.3-1.1 · noarch · tumbleweed
  Unknown · Fixed: 5.22.5-1.1
  Version impact unknown
  dsa · pluto · opensuse · tumbleweed
[polaris-bash-completion]Unknown
Source package: [polaris]
Details (1)
- 10.2.2-1.1 · noarch · tumbleweed
  Unknown · Fixed: 10.1.1-1.1
  Version impact unknown
  dsa · polaris · opensuse · tumbleweed
[polaris-fish-completion]Unknown
Source package: [polaris]
Details (1)
- 10.2.2-1.1 · noarch · tumbleweed
  Unknown · Fixed: 10.1.1-1.1
  Version impact unknown
  dsa · polaris · opensuse · tumbleweed
[polaris-zsh-completion]Unknown
Source package: [polaris]
Details (1)
- 10.2.2-1.1 · noarch · tumbleweed
  Unknown · Fixed: 10.1.1-1.1
  Version impact unknown
  dsa · polaris · opensuse · tumbleweed
[azure-storage-azcopy]Fixed
Source package: [azure-storage-azcopy]
Details (1)
- 10.32.7-1.1 · x86_64 · tumbleweed
  Fixed · Fixed: 10.30.1-1.1
  dsa · azure-storage-azcopy · opensuse · tumbleweed
[clair]Fixed
Source package: [clair]
Details (1)
- 4.9.0-1.4 · x86_64 · tumbleweed
  Fixed · Fixed: 4.9.0-1.1
  dsa · clair · opensuse · tumbleweed

Next results

Observed: Oct 27, 2026, 12:31:56 PM UTC

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]