CVE-2025-47907: Go stdlib database/sql Rows.Scan Race Condition Vulnerability
Summary
CVE-2025-47907: Incorrect results returned from Rows.Scan in database/sql. Affects stdlib across 2 version ranges.
< 1.23.12
>= 1.24.0, < 1.24.6
Fixed in 1.23.12 or 1.24.6, depending on the release line you run. How to fix ↓
Also tracked for
- golang · Bitnami
- golang-1.15 · Debian:11
The same CVE-2025-47907 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Go standard library's database/sql package provides a generic interface for interacting with SQL databases. It allows developers to execute queries, retrieve results, and manage database connections efficiently. The package is widely used in Go applications for its simplicity and effectiveness in handling SQL operations. However, it is susceptible to a race condition vulnerability that can lead to unexpected results when multiple queries are executed in parallel.
Vulnerability Detail
The vulnerability arises when a query is cancelled during the execution of the Scan method on the returned Rows. If multiple queries are being processed simultaneously, cancelling one query can inadvertently overwrite the results of another query. This race condition can lead to either unexpected results being returned from the Scan method or an error, compromising the integrity of the data retrieved from the database.
How To Fix
Latest published version: go1.25.5 as of 22 Oct 2026
go get stdlib@vgo1.25.5Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.23.121.23.12go get stdlib@v1.23.12 -
>= 1.24.0, < 1.24.61.24.6go get stdlib@v1.24.6
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, ensure that queries are not cancelled while the Scan method is being executed. This can be achieved by managing the context carefully and avoiding concurrent executions of queries that may interfere with each other.
Conclusion
The CVE-2025-47907 vulnerability in the Go standard library's database/sql package poses a significant risk due to race conditions during query execution. It is crucial for developers to update their Go installations to the latest patched versions to mitigate this risk and ensure data integrity.
See every vulnerability recorded for stdlib →
FAQ
The impact includes the potential for incorrect data being returned from database queries, which can lead to application errors and data integrity issues.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The affected versions are from 0 up to 1.23.12 and from 1.24.0 up to 1.24.6.
Yes, updating to the patched versions of the Go standard library will resolve this vulnerability.
If immediate updates are not possible, implement careful context management to avoid cancelling queries while scanning results.
References
Related vulnerabilities
Recent vulnerabilities recorded for stdlib.
