GO-2025-3849

See a problem?
Please try reporting it to the source first.
Source
https://pkg.go.dev/vuln/GO-2025-3849
Import Source
https://vuln.go.dev/ID/GO-2025-3849.json
JSON Data
https://api.osv.dev/v1/vulns/GO-2025-3849
Aliases
Downstream
Related
Published
2025-08-07T15:07:27Z
Modified
2026-05-30T10:29:20Z
Summary
Incorrect results returned from Rows.Scan in database/sql
Details

Cancelling a query (e.g. by cancelling the context passed to one of the query methods) during a call to the Scan method of the returned Rows can result in unexpected results if other queries are being made in parallel. This can result in a race condition that may overwrite the expected results with those of another query, causing the call to Scan to return either unexpected results from the other query or an error.

Database specific 
{
    "review_status": "REVIEWED",
    "url": "https://pkg.go.dev/vuln/GO-2025-3849"
}
References
Credits
    • Spike Curtis from Coder

Affected packages

Go / stdlib

Package

Name
stdlib
View open source insights on deps.dev
Purl
pkg:golang/stdlib

Affected ranges

Type
SEMVER
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.23.12
Introduced
1.24.0
Fixed
1.24.6

Ecosystem specific 

{
    "imports": [
        {
            "path": "database/sql",
            "symbols": [
                "Row.Scan",
                "Rows.Scan"
            ]
        }
    ]
}

Database specific

source 
"https://vuln.go.dev/ID/GO-2025-3849.json"