CVE-2025-47907: Go stdlib database/sql Rows.Scan Race Condition Vulnerability
Summary
CVE-2025-47907: Incorrect results returned from Rows.Scan in database/sql. Affects stdlib across 2 version ranges.
< 1.23.12
>= 1.24.0, < 1.24.6
Fixed in 1.23.12 or 1.24.6, depending on the release line you run. How to fix ↓
Also tracked for
- golang · Bitnami
- golang-1.15 · Debian:11
The same CVE-2025-47907 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Go standard library's database/sql package provides a generic interface for interacting with SQL databases. It allows developers to execute queries and retrieve results in a structured manner. The Rows.Scan method is used to read data from a query result into variables. However, this package is susceptible to race conditions when queries are cancelled during the scanning process, leading to unexpected results.
Vulnerability Detail
The vulnerability arises when a query is cancelled while the Rows.Scan method is being executed. If multiple queries are running in parallel, this can lead to a race condition where the results of one query may overwrite the expected results of another. This can cause the Scan method to return incorrect data or even trigger an error, compromising the integrity of the application's data handling.
How To Fix
Latest published version: go1.25.5 as of 22 Oct 2026
go get stdlib@vgo1.25.5Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.23.121.23.12go get stdlib@v1.23.12 -
>= 1.24.0, < 1.24.61.24.6go get stdlib@v1.24.6
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, avoid cancelling queries while the Rows.Scan method is in progress. Ensure that all queries are completed before attempting to cancel any ongoing operations. Additionally, consider implementing synchronization mechanisms to manage concurrent queries more effectively.
Conclusion
CVE-2025-47907 presents a significant risk to applications using the Go standard library's database/sql package. By understanding the nature of this vulnerability and applying the recommended fixes or workarounds, developers can safeguard their applications against potential data integrity issues.
See every vulnerability recorded for stdlib →
FAQ
CVE-2025-47907 is a vulnerability in the Go standard library's database/sql package that can lead to race conditions when cancelling queries during the Rows.Scan method.
This vulnerability can cause your application to return incorrect results or errors when executing SQL queries, potentially leading to data integrity issues.
The vulnerability affects versions prior to 1.23.12 and 1.24.0, specifically those before 1.24.6.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without needing to sign up.
If an immediate update is not possible, implement workarounds such as avoiding query cancellations during scanning and using synchronization to manage concurrent queries.
References
Related vulnerabilities
Recent vulnerabilities recorded for stdlib.
