CVE-2025-47907
📋 TL;DR
This vulnerability in Go's database/sql package allows race conditions when cancelling queries during parallel database operations. It can cause Scan() methods to return incorrect data from other queries or errors. Affects applications using Go's database/sql package with concurrent query execution and cancellation.
💻 Affected Systems
- Go programming language database/sql package
📦 What is this software?
Go by Golang
Go by Golang
⚠️ Risk & Real-World Impact
Worst Case
Data corruption or leakage where sensitive query results are returned to wrong users, potentially exposing confidential information or causing application logic errors.
Likely Case
Intermittent data inconsistencies or application errors when multiple concurrent database queries are executed with context cancellation.
If Mitigated
Minor application errors or degraded performance when race conditions occur, but no data exposure due to application-level validation.
🎯 Exploit Status
Exploitation requires specific timing conditions with concurrent database operations and context cancellation. Not trivial to exploit reliably.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Go 1.24.1 or Go 1.23.10
Vendor Advisory: https://go.dev/issue/74831
Restart Required: Yes
Instructions:
1. Update Go installation to version 1.24.1 or 1.23.10. 2. Recompile all affected applications with the updated Go version. 3. Redeploy patched applications. 4. Restart services using the patched applications.
🔧 Temporary Workarounds
Avoid concurrent query cancellation
allModify application code to avoid cancelling database contexts while Scan() operations are in progress, especially when running parallel queries.
Implement query serialization
allUse mutexes or other synchronization mechanisms to prevent concurrent database operations that could trigger the race condition.
🧯 If You Can't Patch
- Implement application-level data validation to detect and handle unexpected query results
- Add monitoring for database query errors and implement circuit breakers for failing queries
🔍 How to Verify
Check if Vulnerable:
Check Go version with 'go version'. If version is below 1.24.1 (for Go 1.24) or below 1.23.10 (for Go 1.23), the system is vulnerable.Check Version:
go versionVerify Fix Applied:
After updating, verify with 'go version' that version is 1.24.1 or 1.23.10 or higher. Test application with concurrent database queries and context cancellation.📡 Detection & Monitoring
Log Indicators:
- Unexpected database query results
- Scan() method errors
- Context cancellation errors during database operations
- Data inconsistency reports
Network Indicators:
- Increased database error responses
- Unusual query patterns with timing anomalies
SIEM Query:
source="application_logs" AND ("unexpected query result" OR "scan error" OR "context canceled" AND "database")