Introduction
Silent data corruption is one of the hardest production problems for an engineering team to diagnose and fix. In high-concurrency Go applications, a subtle race condition in the database/sql package can silently overwrite or mix query results. The application then behaves unpredictably, and data integrity suffers. CVE-2025-47907 is a concrete case of this risk, in a core component of the Go ecosystem that thousands of organizations use worldwide.
Go, developed by Google, is a foundational language for cloud infrastructure, backend services, and distributed systems. Its database/sql package is the de facto standard for database access in Go, and nearly all major Go database drivers use it. So CVE-2025-47907 has a broad, significant impact on any team that relies on Go for concurrent database workloads.
Technical Information
CVE-2025-47907 is a race condition in the database/sql package of Go's standard library. It occurs when a query is cancelled through its context (for example, on a timeout or an explicit cancel) during a call to the Scan method on a Rows object, while other queries run in parallel.
When that happens, the cleanup that context cancellation triggers can interfere with the scan in progress. Because database/sql and most drivers share connection resources and manage internal buffers, a cancelled query can cause result buffers to be released or reassigned too early. The Scan call may then return data from another concurrent query, or an error, instead of the results of the original query.
The flaw is not specific to one database driver. It affects most drivers that implement the database/sql interface, including those for MySQL and PostgreSQL. The root cause is missing synchronization between the cleanup that runs on context cancellation and the logic that scans results. The race is most likely to show up in applications that:
- Perform many concurrent queries
- Use context cancellation for timeouts or user interrupts
- Share database connections across goroutines
No public code snippet shows the vulnerable section, but the Go issue tracker and related advisories describe the race window and its impact in detail.
Affected Systems and Versions
CVE-2025-47907 affects Go's database/sql package in all versions before 1.24.6 and 1.23.12. Any Go application that uses the standard database/sql package for concurrent queries with context cancellation is potentially vulnerable. Most drivers built on the standard package are affected, including MySQL and PostgreSQL drivers.
- Affected: Go 1.24.5 and earlier, Go 1.23.11 and earlier
- Fixed: Go 1.24.6 and Go 1.23.12
Vendor Security History
Go has fixed race conditions and resource-management issues in its standard library before, including in the database/sql package. Spike Curtis from Coder reported CVE-2025-47907, and the Go team fixed it with coordinated releases and public advisories. The team is known for prompt patches and clear advisories, and the project has a strong record of security response.
References
- NVD entry for CVE-2025-47907
- Go security advisory and patch
- Go issue tracker
- Golang announce mailing list
- Go vulnerability database entry
- OSS Security mailing list discussion
- GitHub Engineering blog on Go MySQL driver bugs
- Doyensec blog on database race conditions
- Dev.to article on race conditions in Go
- Checkmarx blog on race conditions in Go
