gorilla github.com/gorilla/csrf vulnerabilities

Latest gorilla github.com/gorilla/csrf CVEs

Newest publication first

1. CVE-2025-47909 Improper validation of TrustedOrigins allows CSRF attacks in github.com/gorilla/csrf

   Published 2025-08-29

   High·CVSS 7.3 EPSS 0.17%

   Hosts listed in TrustedOrigins implicitly allow requests from the corresponding HTTP origins, allowing network MitMs to perform CSRF attacks. After the CVE-2025-24358 fix, a network attacker that places a form at http://example.com can't get it to submit to https://example.com be...

2. CVE-2025-24358 gorilla/csrf CSRF vulnerability due to broken Referer validation

   Published 2025-04-15

   Medium·CVSS 5.4 EPSS 0.38%

   gorilla/csrf provides Cross Site Request Forgery (CSRF) prevention middleware for Go web applications & services. Prior to 1.7.2, gorilla/csrf does not validate the Origin header against an allowlist. Its executes its validation of the Referer header for cross-origin requests onl...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.