GO-2025-3849

See a problem?
Please try reporting it to the source first.

Source

https://pkg.go.dev/vuln/GO-2025-3849

Import Source

https://vuln.go.dev/ID/GO-2025-3849.json

JSON Data

https://api.osv.dev/v1/vulns/GO-2025-3849

Aliases

Published

2025-08-07T15:07:27Z

Modified

2025-08-11T06:27:06.746398Z

Summary

Incorrect results returned from Rows.Scan in database/sql

Details

Cancelling a query (e.g. by cancelling the context passed to one of the query methods) during a call to the Scan method of the returned Rows can result in unexpected results if other queries are being made in parallel. This can result in a race condition that may overwrite the expected results with those of another query, causing the call to Scan to return either unexpected results from the other query or an error.

Database specific

{
    "review_status": "REVIEWED",
    "url": "https://pkg.go.dev/vuln/GO-2025-3849"
}

References

Credits

- Spike Curtis from Coder

Affected packages

Go / stdlib

Package

Name: stdlib; View open source insights on deps.dev
Purl: pkg:golang/stdlib

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.23.12

Introduced

1.24.0

Fixed

1.24.6

Ecosystem specific

{
    "imports": [
        {
            "path": "database/sql",
            "symbols": [
                "Row.Scan",
                "Rows.Scan"
            ]
        }
    ]
}