CVE-2019-25211

CVE-2019-25211 describes a critical vulnerability in the Gin-Gonic CORS middleware prior to version 1.6.0, where the parseWildcardRules function incorrectly handles wildcard characters at the end of origin strings, leading to unintended access. This flaw allows for broader access than intended, such as permitting "https://example.community/*" when only "https://example.com/*" should be allowed. With a CVSS score of 9.1 (CRITICAL), this vulnerability poses a significant risk due to its network-based attack vector, low attack complexity, and potential for high impact on confidentiality and integrity. Despite its severity, there is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage surrounding this CVE.