Cancelling a query (e.g. by cancelling the context passed to one of the query methods) during a call to the Scan method of the returned Rows can result in unexpected results if other queries are being made in parallel. This can result in a race condition that may overwrite the expected results with those of another query, causing the call to Scan to return either unexpected results from the other query or an error.

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact Low

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00019.

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

Vendors Products
Golang
  • Database Sql

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

Vendors Products
Golang
  • Database Sql
Advisories
Source ID Title
EUVD EUVD EUVD-2025-23921 Cancelling a query (e.g. by cancelling the context passed to one of the query methods) during a call to the Scan method of the returned Rows can result in unexpected results if other queries are being made in parallel. This can result in a race condition that may overwrite the expected results with those of another query, causing the call to Scan to return either unexpected results from the other query or an error.
Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
http://www.openwall.com/lists/oss-security/2025/08/06/1 cve-icon
https://go.dev/cl/693735 cve-icon cve-icon cve-icon
https://go.dev/issue/74831 cve-icon cve-icon cve-icon
https://groups.google.com/g/golang-announce/c/x5MKroML2yM cve-icon cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2025-47907 cve-icon
https://pkg.go.dev/vuln/GO-2025-3849 cve-icon cve-icon cve-icon
https://www.cve.org/CVERecord?id=CVE-2025-47907 cve-icon
History

Tue, 04 Nov 2025 22:30:00 +0000

Type Values Removed Values Added
References

Thu, 14 Aug 2025 12:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Important

Thu, 07 Aug 2025 22:15:00 +0000

Type Values Removed Values Added
First Time appeared Golang
Golang database Sql
Vendors & Products Golang
Golang database Sql

Thu, 07 Aug 2025 16:15:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 7, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 07 Aug 2025 15:45:00 +0000

Type Values Removed Values Added
Description Cancelling a query (e.g. by cancelling the context passed to one of the query methods) during a call to the Scan method of the returned Rows can result in unexpected results if other queries are being made in parallel. This can result in a race condition that may overwrite the expected results with those of another query, causing the call to Scan to return either unexpected results from the other query or an error.
Title Incorrect results returned from Rows.Scan in database/sql
References
cve-icon MITRE

Status: PUBLISHED

Assigner: Go

Published:

Updated: 2025-11-04T21:10:56.083Z

Reserved: 2025-05-13T23:31:29.597Z

Link: CVE-2025-47907

cve-icon Vulnrichment

Updated: 2025-11-04T21:10:56.083Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2025-08-07T16:15:30.357

Modified: 2025-11-04T22:16:16.347

Link: CVE-2025-47907

cve-icon Redhat

Severity : Important

Publid Date: 2025-08-07T15:25:30Z

Links: CVE-2025-47907 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2025-08-07T22:01:46Z