chore(deps): update module github.com/rs/cors to v1.11.0 [security] (release-1.13)

[phisco-renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/rs/cors	v1.9.0 → v1.11.0

---

Denial of service via malicious preflight requests in github.com/rs/cors

CVE-2025-47908 / GHSA-mh55-gqvf-xfwm

More information

Details

Middleware causes a prohibitive amount of heap allocations when processing malicious preflight requests that include a Access-Control-Request-Headers (ACRH) header whose value contains many commas. This behavior can be abused by attackers to produce undue load on the middleware/server as an attempt to cause a denial of service.

Severity

Medium

References

• https://github.com/rs/cors/issues/170
• https://github.com/rs/cors/pull/171
• https://github.com/rs/cors/commit/4c32059b2756926619f6bf70281b91be7b5dddb2
• https://nvd.nist.gov/vuln/detail/CVE-2025-47908
• https://pkg.go.dev/vuln/GO-2024-2883
• https://github.com/advisories/GHSA-mh55-gqvf-xfwm

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Denial of service via malicious preflight requests in github.com/rs/cors

CVE-2025-47908 / GHSA-mh55-gqvf-xfwm / GO-2024-2883

More information

Details

Middleware causes a prohibitive amount of heap allocations when processing malicious preflight requests that include a Access-Control-Request-Headers (ACRH) header whose value contains many commas. This behavior can be abused by attackers to produce undue load on the middleware/server as an attempt to cause a denial of service.

Severity

Moderate

References

• https://nvd.nist.gov/vuln/detail/CVE-2025-47908
• https://github.com/rs/cors/issues/170
• https://github.com/rs/cors/pull/171
• https://github.com/rs/cors/commit/4c32059b2756926619f6bf70281b91be7b5dddb2
• https://github.com/rs/cors
• https://pkg.go.dev/vuln/GO-2024-2883

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Denial of service via malicious preflight requests in github.com/rs/cors

CVE-2025-47908 / GHSA-mh55-gqvf-xfwm / GO-2024-2883

More information

Details

Middleware causes a prohibitive amount of heap allocations when processing malicious preflight requests that include a Access-Control-Request-Headers (ACRH) header whose value contains many commas. This behavior can be abused by attackers to produce undue load on the middleware/server as an attempt to cause a denial of service.

Severity

Unknown

References

• https://github.com/rs/cors/pull/171
• https://github.com/rs/cors/issues/170

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

---

Release Notes

rs/cors (github.com/rs/cors)

v1.11.0

Compare Source

v1.10.1

Compare Source

v1.10.0

Compare Source

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • ""
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.

[phisco-renovate]

⚠️ Artifact update problem

Renovate failed to update artifacts related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: go.mod

Command failed: install-tool golang $(grep -oP ^toolchain go\K.+ go.mod)

File name: go.mod

Command failed: make generate
go: downloading github.com/rs/cors v1.11.0
# golang.org/x/tools/internal/tokeninternal
/home/ubuntu/go/pkg/mod/golang.org/x/tools@v0.11.0/internal/tokeninternal/tokeninternal.go:78:9: invalid array length -delta * delta (constant -256 of type int64)
apis/generate.go:45: running "go": exit status 1
make[1]: *** [build/makelib/golang.mk:240: go.generate] Error 1
make: *** [build/makelib/common.mk:434: generate] Error 2