fix(deps): update module github.com/gin-contrib/cors to v1.6.0 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/gin-contrib/cors	v1.4.0 → v1.6.0

GitHub Vulnerability Alerts

CVE-2019-25211

parseWildcardRules in Gin-Gonic CORS middleware before 1.6.0 mishandles a wildcard at the end of an origin string, e.g., https://example.community/* is allowed when the intention is that only https://example.com/* should be allowed, and http://localhost.example.com/* is allowed when the intention is that only http://localhost/* should be allowed.

---

Gin mishandles a wildcard in the origin string in github.com/gin-contrib/cors

CVE-2019-25211 / GHSA-869c-j7wc-8jqv / GO-2024-2955

More information

Details

Gin-Gonic CORS middleware mishandles a wildcard at the end of an origin string. Examples: https://example.community/* is accepted by the origin string https://example.com/* and http://localhost.example.com/* is accepted by the origin string http://localhost/* .

Severity

Unknown

References

• https://github.com/advisories/GHSA-869c-j7wc-8jqv
• https://github.com/gin-contrib/cors/commit/27b723a473efd80d5a498fa9f5933c80204c850d
• https://github.com/gin-contrib/cors/pull/106
• https://github.com/gin-contrib/cors/pull/57
• https://github.com/gin-contrib/cors/compare/v1.5.0...v1.6.0
• https://github.com/gin-contrib/cors/releases/tag/v1.6.0

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

---

Gin mishandles a wildcard at the end of an origin string

CVE-2019-25211 / GHSA-869c-j7wc-8jqv / GO-2024-2955

More information

Details

parseWildcardRules in Gin-Gonic CORS middleware before 1.6.0 mishandles a wildcard at the end of an origin string, e.g., https://example.community/* is allowed when the intention is that only https://example.com/* should be allowed, and http://localhost.example.com/* is allowed when the intention is that only http://localhost/* should be allowed.

Severity

• CVSS Score: 9.3 / 10 (Critical)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2019-25211
• https://github.com/gin-contrib/cors/pull/106
• https://github.com/gin-contrib/cors/pull/57
• https://github.com/gin-contrib/cors/commit/27b723a473efd80d5a498fa9f5933c80204c850d
• https://github.com/gin-contrib/cors/compare/v1.5.0...v1.6.0
• https://github.com/gin-contrib/cors/releases/tag/v1.6.0
• https://github.com/gin-gonic/gin
• https://lists.debian.org/debian-lts-announce/2025/08/msg00024.html

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

gin-contrib/cors (github.com/gin-contrib/cors)

v1.6.0

Compare Source

Changelog

Features

• eac6c48 feat(schema): allow usage of custom schemas (#​139)

Bug fixes

• 27b723a fixe(domain): wildcard parse bug (#​106 and #​57) @​maxshine and @​Hvitgar

Enhancements

• f41df75 chore: update GitHub actions to latest versions
• 2451987 chore: update dependencies to latest versions
• 7d356c2 chore: update dependencies to latest versions
• 5da0aee chore: update third-party dependencies
• 8263fce chore: update version of actions/setup-go in GitHub workflows

Others

• fcbd06f ci: enhance testing matrix and tolerance limits
• f08c1bc ci: refactor CI workflows and improve tests
• 30792dc ci: refactor GitHub Actions workflows
• 0e993b7 ci: update GitHub Actions to Version 3
• 90a7c66 test(cors): enhance CORS wildcard handling tests (#​145)
• 85bf9fb test: improve CORS wildcard handling and testing (#​144)
• d5002f2 test: refactor tests and update CI configurations

v1.5.0

Compare Source

Changelog

Features

• 0eaf9a0 feat: adds support for private network header (#​128)

Enhancements

• c1983b2 chore(CI): add go1.20 version
• 1d5e083 chore(deps): bump github.com/stretchr/testify from 1.8.0 to 1.8.1 (#​112)
• f8b2357 chore(options): Added availability to set 200/204 for OPTIONS request status (#​129)
• f92a222 chore: Add go 1.19 and upgrade lint version to v1.49
• 95df7c6 chore: remove depguard linter and rename example file
• 7ac4445 chore: update GitHub Actions configuration files
• bbf67cd chore: update Go version and setup-go action
• b216599 chore: update goreleaser/goreleaser-action to version v4
• 765e44e chore: update dependencies to latest versions
• bf2c9df chore: update linter configuration and changelog titles
• bbb26b0 chore: update supported versions of Go

Others

• 5914b2f build: update Go version and dependencies

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Never, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.