Go/github.com/gorilla/csrf CVE-2025-24358: medium 5.4, EPSS 0.37%
gorilla/csrf CSRF vulnerability due to broken Referer validation
Action: Upgrade github.com/gorilla/csrf to 1.7.3 or later.
go get github.com/gorilla/csrf@v1.7.3Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.7.3 | - |
Fixed versions
| 1.7.3 |
Sources
- osv: GHSA-rq77-p4h8-4crw
- nvd: CVE-2025-24358
- https://github.com/gorilla/csrf/security/advisories/GHSA-rq77-p4h8-4crw
- https://github.com/gorilla/csrf/commit/9dd6af1f6d30fc79fb0d972394deebdabad6b5eb
- https://github.com/gorilla/csrf
- https://lists.debian.org/debian-lts-announce/2025/05/msg00002.html
- https://pkg.go.dev/vuln/GO-2025-3607
CVE-2025-24358 · published · modified · JSON