Bug 2387083 (CVE-2025-47907)

Summary: CVE-2025-47907 database/sql: Postgres Scan Race Condition
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: aaguirre, aazores, abarbaro, abrianik, adistefa, akostadi, akoudelk, alcohan, amasferr, amctagga, anjoseph, anpicker, aoconnor, bbrownin, bdettelb, bkabrda, bniver, bparees, brainfor, catoconn, cbartlet, ckandaga, cmah, crizzo, ddahlem, dhanak, dmayorov, doconnor, drosa, dsimansk, dward, dymurray, eaguilar, ebaron, eglynn, fdeutsch, flucifre, ggrzybek, gmeno, gparvin, gryan, gzaronik, haoli, hasun, hkataria, ibolton, jaharrin, jajackso, jbalunas, jburrell, jcammara, jcantril, jchui, jeder, jfula, jhe, jjoyce, jkoehler, jlledo, jmatthew, jmitchel, jmontleo, jneedle, jolong, jowilson, jprabhak, jschluet, jwendell, kegrant, kingland, koliveir, kshier, ktsao, kverlaen, lball, lbragsta, lchilton, ldai, lfitzger, lgamliel, lhh, lphiri, lsharar, lsvaty, lucarval, mabashia, manissin, matzew, mbenjamin, mburns, mgarciac, mhackett, mkudlej, mmakovy, mnovotny, mwringe, nboldt, ngough, njean, nyancey, oblaut, ometelka, oramraz, owatkins, pahickey, parichar, pbraun, pgaikwad, pgrist, pjindal, psrna, ptisnovs, pvasanth, rcardoso, rcernich, rfreiman, rhaigner, rjohnson, rojacob, sakbas, sausingh, sdawley, sfeifer, shvarugh, simaishi, slucidi, smcdonal, smullick, sostapov, sseago, stcannon, stirabos, syedriko, tasato, teagle, tfister, thason, thavo, tjochec, tsweeney, vereddy, veshanka, wenshen, whayutin, wtam, xdharmai, xiyuan, yguenane
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in database/sql. Concurrent queries can produce unexpected results when a query is cancelled during a Scan method call on returned Rows, creating a race condition. This vulnerability allows an attacker who can initiate and cancel queries to trigger this condition, possibly leading to inconsistent data being returned to the application.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2397303, 2397304, 2397305, 2397301, 2397302    
Bug Blocks:    

Description OSIDB Bzimport 2025-08-07 16:01:33 UTC 
Cancelling a query (e.g. by cancelling the context passed to one of the query methods) during a call to the Scan method of the returned Rows can result in unexpected results if other queries are being made in parallel. This can result in a race condition that may overwrite the expected results with those of another query, causing the call to Scan to return either unexpected results from the other query or an error.
Comment 4 Tom Sweeney 2025-09-22 18:05:52 UTC 
As noted in this issue in Go and its follow on links: https://github.com/golang/go/issues/74831

This appears to be addressed in Go v1.23.12, v1.24.7, and v1.25.0 and higher.