An unauthenticated remote attacker can trigger a denial of service condition in the rs/cors Go middleware by sending crafted HTTP preflight requests that exhaust server heap memory.

This vulnerability, classified as CWE-1325, involves improper control of sequential memory allocation within the middleware. An unauthenticated attacker can exploit this by submitting an Access-Control-Request-Headers (ACRH) header with an excessive number of commas, forcing the application to perform prohibitive heap allocations.

The successful exploitation of this vulnerability results in a denial of service, which can render the affected service unavailable to legitimate users. With a CVSS score of 7.5, this high severity flaw poses a significant risk to application stability and uptime, potentially disrupting critical business operations that rely on the affected middleware for cross-origin resource sharing.

Immediate Action: Update the rs/cors package to version 1.11.0 or later to include the necessary memory allocation constraints.

Proactive Monitoring: Monitor server resource utilization, specifically heap memory usage and request processing latency, to detect potential spikes associated with malicious preflight requests.

Compensating Controls: Implement a Web Application Firewall (WAF) or ingress controller rule to inspect and limit the complexity or length of the Access-Control-Request-Headers (ACRH) header in incoming HTTP requests.

Public Exploit Available: No (exploit_available: unknown)

Given the ease with which this vulnerability can be exploited to cause a denial of service, all organizations utilizing the rs/cors middleware must prioritize the update to version 1.11.0. Failure to patch may expose infrastructure to service disruption from automated scanning tools or malicious actors seeking to degrade system availability.