github.com/rs/cors (go) has 2 known vulnerabilities, the worst rated MODERATE. Upgrade to 1.11.0 or later to clear all of them. No malicious-package signal is recorded.
Tracked for PyPI packages. HuggingFace models declare Python dependencies, so go packages are not covered.
CVSS v3.1 base score out of 10; GitHub rates it MODERATE
chance of exploitation in 30 days, 53rd percentile of all CVEs
CyberXYZ composite out of 10
fig. 01 — GHSA-mh55-gqvf-xfwm, the advisory selected below
Middleware causes a prohibitive amount of heap allocations when processing malicious preflight requests that include a Access-Control-Request-Headers (ACRH)…
Full advisory text at GitHub advisory or NVD.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CyberXYZ does not call a package safe in absolute terms. It records 2 known vulnerabilities for github.com/rs/cors (go), the worst rated MODERATE, and no malicious-package signal. Whether it is acceptable depends on the version you run.
Yes. CyberXYZ records 2 known vulnerabilities for github.com/rs/cors (go), the worst rated MODERATE. They are GHSA-mh55-gqvf-xfwm, GHSA-927h-x4qj-r242.
1.11.0 or later clears every advisory recorded for github.com/rs/cors (go). Check the release you pick before installing it.
Search github.com/rs/cors in CyberXYZ Check at https://cyberxyz.io/check?q=github.com%2Frs%2Fcors. The xyz Scanner checks a project's dependencies, and CyberXYZ Proxy checks each package as it is installed.
Checked 2026-11-15 at 08:08 UTC. The most recent advisory here was published 2024-07-05. Updated continuously from NVD, GHSA, OSV and CNA feeds.