Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process. The following link provides references to all essential vulnerability management information. If something is wrong or missing, please contact a member of PSIRT. https://spaces.redhat.com/display/PRODSEC/Vulnerability+Management+-+Essential+Documents+for+Engineering+Teams
This package is NOT affected by CVE-2025-47910. SUMMARY: ======== CVE-2025-47910 affects Go's net/http package (CrossOriginProtection bypass). The Fedora bpfman package is built entirely from Rust code and does not contain or link against Go's net/http package. The bpfman.spec file clearly shows this is a Rust package: 1. Generated by rust2rpm (Fedora's Rust packaging tool) 2. BuildRequires: cargo-rpm-macros (not golang build tools) 3. Build uses Cargo (Rust's build system): - %cargo_prep, %cargo_build, %cargo_test - Sources include Rust vendor tarball - Binaries installed from ./target/release/ (Rust's output directory) 4. Patches only Rust files (.rs files and Cargo.toml) 5. Packages three Rust-compiled binaries: - bpfman, bpfman-ns, bpfman-rpc NOTE: The upstream repository contains some Go example code in examples/ and clients/ directories, but these are NOT included in the Fedora RPM package. CONCLUSION: =========== Pure Rust package. CVE-2025-47910 does not apply. Closing as NOTABUG.