high 7.0

CVE-2025-47907 json

Incorrect results returned from Rows.Scan in database/sql

published 2025-08-07 15 mo ago modified 2026-09-08 2 mo ago also BIT-golang-2025-47907 , EUVD-2025-23921 , GO-2025-3849

cvss: 7.0; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.4%; EPSS 0.4% chance of exploitation in 30 days, percentile 38%
public exploits: 0; none known

Cancelling a query (e.g. by cancelling the context passed to one of the query methods) during a call to the Scan method of the returned Rows can result in unexpected results if other queries are being made in parallel. This can result in a race condition that may overwrite the expected results with those of another query, causing the call to Scan to return either unexpected results from the other query or an error.

Patch / fix

fixed in 3 distros 6 links 1

bitnami golang 1.23.12, 1.24.6
go stdlib 1.23.12, 1.24.6
Go standard library database/sql 1.23.12, 1.24.6

red hat suse opensuse almalinux alpine azure linux

podman RHEL 10.1 7:5.6.0-5.el10_1
podman-tests RHEL 10.1 7:5.6.0-5.el10_1
podman-docker RHEL 10.1 7:5.6.0-5.el10_1
podman-remote RHEL 10.1 7:5.6.0-5.el10_1
podman RHEL 9 6:5.6.0-6.el9_7
podman-tests RHEL 9 6:5.6.0-6.el9_7
podman-docker RHEL 9 6:5.6.0-6.el9_7
podman-remote RHEL 9 6:5.6.0-6.el9_7

red hat advisories RHSA-2026:1084 RHSA-2025:21384 RHSA-2025:21385 RHSA-2025:21383 RHSA-2025:21382 RHSA-2025:21337

azure-storage-azcopy SLE Module for Public Cloud 15 SP7, SLE Module for Public Cloud 15 SP6, SLE Module for Public Cloud 15 SP5 +1 more 10.32.4-150400.9.11.1
go1.25-openssl SLES for SAP 15 SP6, SLES 15 SP6-LTSS, SLE Module for Development Tools 15 SP7 +1 more 1.25.6-150600.13.9.1
go1.25-openssl SLES for SAP 15 SP5, SLES for SAP 15 SP4, SLES 15 SP5-LTSS +5 more 1.25.6-150000.1.9.1
go1.25-openssl SLE Module for Development Tools 15 SP7, SLE Module for Development Tools 15 SP6, openSUSE Leap 15.6 1.25.0-150600.13.3.1
go1.23-openssl SLE Module for Development Tools 15 SP7, SLE Module for Development Tools 15 SP6, openSUSE Leap 15.6 1.23.12-150600.13.9.1
go1.24-openssl SLE Module for Development Tools 15 SP7, SLE Module for Development Tools 15 SP6, openSUSE Leap 15.6 1.24.6-150600.13.9.1
go1.25-openssl SLES for SAP 15 SP5, SLES for SAP 15 SP4, SLES for SAP 15 SP3 +9 more 1.25.0-150000.1.3.1
go1.25 SLES for SAP 15 SP5, SLES for SAP 15 SP4, SLES for SAP 15 SP3 +12 more 1.25.0-150000.1.5.1

suse advisories SUSE-SU-2026:2466-1 SUSE-SU-2026:0298-1 SUSE-SU-2026:0297-1 SUSE-SU-2025:03161-1 SUSE-SU-2025:03159-1 SUSE-SU-2025:03158-1

clair openSUSE Tumbleweed 4.9.0-1.1
azure-storage-azcopy openSUSE Tumbleweed 10.30.1-1.1
nova openSUSE Tumbleweed 3.11.8-1.1
pluto openSUSE Tumbleweed 5.22.5-1.1
polaris openSUSE Tumbleweed 10.1.1-1.1
go1.23 openSUSE Tumbleweed 1.23.12-1.1
go1.24 openSUSE Tumbleweed 1.24.6-1.1
govulncheck-vulndb openSUSE Tumbleweed 0.0.20250807T150727-1.1

opensuse advisories openSUSE-SU-2025:15823-1 openSUSE-SU-2025:15594-1 openSUSE-SU-2025:15464-1 openSUSE-SU-2025:15465-1 openSUSE-SU-2025:15466-1 openSUSE-SU-2025:15422-1

podman AlmaLinux 9 6:5.6.0-6.el9_7
podman-tests AlmaLinux 9 6:5.6.0-6.el9_7
podman-docker AlmaLinux 9 6:5.6.0-6.el9_7
podman-remote AlmaLinux 9 6:5.6.0-6.el9_7
podman-plugins AlmaLinux 9 6:5.6.0-6.el9_7
podman AlmaLinux 10 7:5.6.0-5.el10_1
podman-tests AlmaLinux 10 7:5.6.0-5.el10_1
podman-docker AlmaLinux 10 7:5.6.0-5.el10_1

almalinux advisories ALSA-2025:20909 ALSA-2025:20983 ALSA-2025:13941

go Alpine 3.24, Alpine 3.23, Alpine 3.22 1.24.6-r0

alpine advisories ALPINE-CVE-2025-47907

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

golang CBL-Mariner 2.0 1.18.8-9
golang CBL-Mariner 2.0 1.22.7-5
golang Azure Linux 3.0 1.23.12-1
golang Azure Linux 3.0 1.24.6-1

azure linux advisories AZL-66135 AZL-66138 AZL-66150 AZL-66153

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

go.dev/cl/693735 patch

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2025-47907 updated 2026-11-05 cvss 7.0

database/sql: Postgres Scan Race Condition

Red Hat Assisted Installer for Red Hat OpenShift Container Platform 2 rhai/assisted-installer-rhel9, rhai/assisted-installer-agent-rhel9, rhai/assisted-installer-controller-rhel9 Red Hat cert-manager Operator for Red Hat OpenShift cert-manager/cert-manager-operator-rhel9, cert-manager/cert-manager-istio-csr-rhel9
affected: workaround, no fix available
Red Hat Confidential Compute Attestation build-of-trustee/trustee-rhel9-operator, openshift-sandboxed-containers/osc-rhel9-operator, openshift-sandboxed-containers/osc-podvm-payload-rhel9, openshift-sandboxed-containers/osc-cloud-api-adaptor-rhel9, openshift-sandboxed-containers/osc-cloud-api-adaptor-webhook-rhel9, confidential-compute-attestation-tech-preview/trustee-rhel9-operator
affected: workaround, no fix available, no fix planned “Will not fix”
Red Hat Deployment Validation Operator dvo/deployment-validation-rhel8-operator Red Hat external secrets operator for Red Hat OpenShift - Tech Preview external-secrets-operator/external-secrets-rhel9
affected: workaround, no fix available
Red Hat Kube Descheduler Operator kube-descheduler-operator/descheduler-rhel9
affected: workaround, no fix planned “Will not fix”
Red Hat Logging Subsystem for Red Hat OpenShift openshift-logging/logging-loki-rhel9 Red Hat Migration Toolkit for Applications 7 mta/mta-hub-rhel9 Red Hat Migration Toolkit for Virtualization migration-toolkit-virtualization/mtv-api-rhel9
affected: workaround, no fix available
Red Hat mirror registry for Red Hat OpenShift openshift/mirror-registry-rhel8
affected: workaround, no fix planned “Will not fix”
Red Hat Multicluster Engine for Kubernetes multicluster-engine/assisted-installer-rhel9, multicluster-engine/image-based-install-rhel9, multicluster-engine/mce-capi-webhook-config-rhel9, multicluster-engine/assisted-installer-agent-rhel9, multicluster-engine/hypershift-addon-rhel9-operator, multicluster-engine/assisted-installer-controller-rhel9, +1 more
affected: workaround, no fix available
Red Hat NBDE Tang Server nbde-tang-server/nbde-tang-server-rhel9-operator
affected: workaround, no fix planned “Will not fix”

show 22 more

Red Hat Network Observability Operator network-observability/network-observability-cli-rhel9, network-observability/network-observability-rhel9-operator, network-observability/network-observability-ebpf-agent-rhel9, network-observability/network-observability-flowlogs-pipeline-rhel9
affected: workaround, no fix available
Red Hat Node Maintenance Operator workload-availability/node-maintenance-rhel8-operator, container-native-virtualization/node-maintenance-operator
affected: workaround, no fix available, no fix planned “Will not fix”
Red Hat OpenShift Lightspeed openshift-lightspeed/lightspeed-rhel9-operator, openshift-lightspeed/lightspeed-operator-bundle, openshift-lightspeed-tech-preview/lightspeed-operator-bundle
affected: workaround, no fix available
Red Hat OpenShift Pipelines openshift-pipelines-client
affected: workaround, no fix planned “Will not fix”
Red Hat OpenShift Run Once Duration Override Operator run-once-duration-override-operator/run-once-duration-override-rhel9
affected: workaround, no fix available
Red Hat OpenShift Secondary Scheduler Operator openshift-secondary-scheduler-operator/secondary-scheduler-rhel9-operator
affected: workaround, no fix planned “Will not fix”
Red Hat OpenShift Service Mesh 2 openshift-golang-builder-container
affected: workaround, no fix available
Red Hat Power monitoring for Red Hat OpenShift openshift-power-monitoring/kepler-rhel9, openshift-power-monitoring/power-monitoring-rhel9-operator
affected: workaround, no fix planned “Will not fix”
Red Hat Advanced Cluster Management for Kubernetes 2 flightctl, flightctl-agent, flightctl-selinux, rhacm2/submariner-addon-rhel9, rhacm2/volsync-operator-bundle
affected: workaround, no fix available, no fix planned “Will not fix”
Red Hat Ceph Storage 5 rhel9/grafana, rhceph/grafana-rhel9
affected: workaround, no fix available
Red Hat Ceph Storage 6 rhel9/grafana, rhceph/grafana-rhel9
affected: workaround, no fix planned “Will not fix”
Red Hat Ceph Storage 8 rhel9/grafana Red Hat Certification for Red Hat Enterprise Linux 8 redhat-certification-preflight
affected: workaround, no fix available
Red Hat Certification Program for Red Hat Enterprise Linux 9 redhat-certification-preflight
affected: workaround, no fix available “Fix deferred”
Red Hat Connectivity Link 1 rhcl-1/authorino-rhel9, 3scale-tech-preview/authorino-rhel9
affected: workaround, no fix available, no fix planned “Will not fix”
Red Hat Developer Hub 1 rhdh-orchestrator-dev-preview-beta/controller-rhel9-operator
affected: workaround, no fix planned “Will not fix”
Red Hat Edge Manager preview flightctl, rhem/flightctl-ui-rhel9, rhem/flightctl-api-rhel9, rhem/flightctl-ui-ocp-rhel9, rhem/flightctl-worker-rhel9, rhem/flightctl-periodic-rhel9, +1 more Red Hat Enterprise Linux 8 delve, golang, podman, go-toolset, golang-bin, golang-src, +10 more
affected: workaround, no fix available
Red Hat Enterprise Linux 9 rhel9/bootc-image-builder, rhel9-eus/rhel-9.6-bootc-image-builder Red Hat Enterprise Linux 10 rhel10/bootc-image-builder, rhel10-eus/rhel-10.0-bootc-image-builder Red Hat Enterprise Linux AI (RHEL AI) golang
affected: workaround, no fix planned “Will not fix”
Red Hat OpenShift AI (RHOAI) rhoai/odh-rhel9-operator, rhods/odh-rhel8-operator, rhoai/odh-model-controller-rhel8, rhoai/odh-model-controller-rhel9, rhoai/odh-ml-pipelines-driver-rhel8, rhoai/odh-ml-pipelines-launcher-rhel8, +6 more
affected: workaround, no fix available, no fix planned “Will not fix”
Red Hat OpenShift Cluster Manager CLI ocm-cli-clients/ocm-cli-rhel9 Red Hat OpenShift Dev Spaces devspaces/traefik-rhel9, devspaces/dashboard-rhel9, devspaces/configbump-rhel9, devspaces/imagepuller-rhel9, devspaces/devspaces-rhel9-operator, devspaces-tech-preview/jetbrains-ide-rhel9 Red Hat OpenShift Dev Workspaces Operator devworkspace/devworkspace-rhel9-operator, devworkspace/devworkspace-project-clone-rhel9
affected: workaround, no fix available
Red Hat OpenShift distributed tracing 3 rhosdt/tempo-rhel8, rhosdt/tempo-query-rhel8, rhosdt/jaeger-agent-rhel8, rhosdt/tempo-gateway-rhel8, rhosdt/tempo-rhel8-operator, rhosdt/jaeger-ingester-rhel8, +8 more
affected: workaround, no fix available, no fix planned “Will not fix”
Red Hat OpenShift on AWS rosa
affected: workaround, no fix available
Red Hat Openshift Sandboxed Containers openshift-sandboxed-containers/osc-monitor-rhel9
affected: workaround, no fix planned “Will not fix”

7 more affected, 46 more fixed, 57 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 15 mo ago (2025-08-07)

Exploit prediction

0.44% chance of exploitation in the next 30 days, higher than 38% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CISA ADP	3.1	7.0	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L
CNA	3.1	7.0	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L
OSV	3.1	7.0	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L

Affected packages

ecosystem	package	affected	fixed in
bitnami	golang	<1.23.12 >=1.24.0, <1.24.6	1.23.12 1.24.6
go	stdlib	<1.23.12 >=1.24.0, <1.24.6	1.23.12 1.24.6

Affected products

Go standard library database/sql

Classification

Weakness

CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization

References

go.dev /cl/693735
patch
pkg.go.dev /vuln/GO-2025-3849
vendor-advisory, advisory
go.dev /issue/74831
issue-tracking, third-party-advisory, advisory, report
groups.google.com /g/golang-announce/c/x5MKroML2yM
mailing-list, release-notes, discussion, web
openwall.com /lists/oss-security/2025/08/06/1
mailing-list, release-notes, discussion
nvd.nist.gov /vuln/detail/CVE-2025-47907
web

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.

Summary