GoPackage

stdlib

182 known vulnerabilities (8 critical, 55 high, 46 medium, 3 low), with the versions each affects and the releases that fix them.

Latest release: Not known: cve.now hasn't read this package's releases
Newest unaffected release: Not known without release data
Advisories: 182 · 8 critical, 55 high, 46 medium, 3 low

Registry: pkg.go.dev

Advisories 182

CVE-2026-111943Medium 6.8
Distrust compromised intermediate certificates in crypto/x509
Affected: fixed in 1.26.10; from 1.27.0-0, fixed in 1.27.3.
CVE-2026-97032High 7.5
HTTP/2 server crash due to HPACK encoder race in net/http
Affected: fixed in 1.26.9; from 1.27.0-0, fixed in 1.27.2.
CVE-2026-94439High 7.5
HTTP/1 server connection desynchronization after 2xx CONNECT response in net/http
Affected: fixed in 1.26.9; from 1.27.0-0, fixed in 1.27.2.
CVE-2026-78663Critical 9.1
Double flow control refund on HTTP/2 server streams in net/http
Affected: fixed in 1.26.9; from 1.27.0-0, fixed in 1.27.2.
CVE-2026-78669High 7.5
Excessive CPU consumption from repeated initial window changes in net/http
Affected: fixed in 1.26.9; from 1.27.0-0, fixed in 1.27.2.
CVE-2026-78660High 7.5
HTTP/2 transport accepts malformed framing-related headers in net/http
Affected: fixed in 1.26.9; from 1.27.0-0, fixed in 1.27.2.
CVE-2026-78667High 7.5
Lack of limit on size of parsed Range headers in net/http
Affected: fixed in 1.26.9; from 1.27.0-0, fixed in 1.27.2.
CVE-2026-94440High 7.5
Memory limit bypass when parsing MIME headers in net/textproto, mime/multipart
Affected: fixed in 1.26.9; from 1.27.0-0, fixed in 1.27.2.
CVE-2026-97031High 7.5
Reject malformed ECH outer extension references in crypto/tls
Affected: fixed in 1.26.9; from 1.27.0-0, fixed in 1.27.2.
CVE-2026-56866High 7.5
HTTP/1 client connection desynchronization after CONNECT rejection in net/http
Affected: fixed in 1.26.9; from 1.27.0-0, fixed in 1.27.2.
CVE-2026-56857Critical 9.8
Root.Mkdir(All) can follow junctions out of the root on Windows in os
Affected: fixed in 1.26.9; from 1.27.0-0, fixed in 1.27.2.
CVE-2026-78659High 7.5
HTTP/2 server memory exhaustion due to Trailer headers in net/http
Affected: fixed in 1.26.9; from 1.27.0-0, fixed in 1.27.2.
CVE-2026-97030Medium 6.1
Recognize yield as regexp preceder keyword in html/template
Affected: fixed in 1.26.9; from 1.27.0-0, fixed in 1.27.2.
CVE-2026-94448Medium 6.1
Reset context tracking on consecutive template expressions in html/template
Affected: fixed in 1.26.9; from 1.27.0-0, fixed in 1.27.2.
CVE-2026-56860Medium 5.9
Avoid quadratic complexity in resolvePath in net/url
Affected: fixed in 1.25.13; from 1.26.0-0, fixed in 1.26.6; from 1.27.0-0, fixed in 1.27.0-rc.3.

Show all 182 advisoriesShow fewer advisories

CVE-2026-56858Medium 6.1
Fix Javascript regexp context tracking in html/template
Affected: fixed in 1.25.13; from 1.26.0-0, fixed in 1.26.6; from 1.27.0-0, fixed in 1.27.0-rc.3.
CVE-2026-56862High 7.5
Limit handshake messages we are willing to accept post-handshake in crypto/tls
Affected: fixed in 1.25.13; from 1.26.0-0, fixed in 1.26.6; from 1.27.0-0, fixed in 1.27.0-rc.3.
CVE-2026-56853High 7.5
Apply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/http
Affected: fixed in 1.25.13; from 1.26.0-0, fixed in 1.26.6; from 1.27.0-0, fixed in 1.27.0-rc.3.
CVE-2026-56859High 7.5
Add recursion depth guard during decode in encoding/xml
Affected: fixed in 1.25.13; from 1.26.0-0, fixed in 1.26.6; from 1.27.0-0, fixed in 1.27.0-rc.3.
CVE-2026-46600High 7.5
Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage
Affected: from 1.26.0-0, fixed in 1.26.6; from 1.27.0-0, fixed in 1.27.0-rc.3.
CVE-2026-42505Medium 5.3
Invoking Encrypted Client Hello privacy leak in crypto/tls
Affected: fixed in 1.25.12; from 1.26.0-0, fixed in 1.26.5; from 1.27.0-0, fixed in 1.27.0-rc.2.
CVE-2026-39822High 7.8
Root escape via symlink plus trailing slash in os
Affected: fixed in 1.25.12; from 1.26.0-0, fixed in 1.26.5; from 1.27.0-0, fixed in 1.27.0-rc.2.
CVE-2026-42507Medium 5.3
Arbitrary inputs are included in errors without any escaping in net/textproto
Affected: fixed in 1.25.11; from 1.26.0-0, fixed in 1.26.4.
CVE-2026-27145Medium 6.5
Inefficient candidate hostname parsing in crypto/x509
Affected: fixed in 1.25.11; from 1.26.0-0, fixed in 1.26.4.
CVE-2026-39821Critical 9.6
Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna
Affected: fixed in 1.25.13; from 1.26.0-0, fixed in 1.26.6; from 1.27.0-0, fixed in 1.27.0-rc.3.
CVE-2026-39820High 7.5
Quadratic string concatentation in consumeComment in net/mail
Affected: fixed in 1.25.10; from 1.26.0-0, fixed in 1.26.3.
CVE-2026-39823Medium 6.1
Bypass of meta content URL escaping causes XSS in html/template
Affected: fixed in 1.25.10; from 1.26.0-0, fixed in 1.26.3.
CVE-2026-33811High 7.5
Crash when handling long CNAME response in net
Affected: fixed in 1.25.10; from 1.26.0-0, fixed in 1.26.3.
CVE-2026-39826Medium 6.1
Escaper bypass leads to XSS in html/template
Affected: fixed in 1.25.10; from 1.26.0-0, fixed in 1.26.3.
CVE-2026-42499High 7.5
Quadratic string concatenation in consumePhrase in net/mail
Affected: fixed in 1.25.10; from 1.26.0-0, fixed in 1.26.3.
CVE-2026-39825Medium 5.3
ReverseProxy forwards queries with more than urlmaxqueryparams parameters in net/http/httputil
Affected: fixed in 1.25.10; from 1.26.0-0, fixed in 1.26.3.
CVE-2026-39836High 7.5
Panic in Dial and LookupPort when handling NUL byte on Windows in net
Affected: fixed in 1.25.10; from 1.26.0-0, fixed in 1.26.3.
CVE-2026-33814High 7.5
Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net
Affected: fixed in 1.25.10; from 1.26.0-0, fixed in 1.26.3.
CVE-2026-32280High 7.5
Unexpected work during chain building in crypto/x509
Affected: fixed in 1.25.9; from 1.26.0-0, fixed in 1.26.2.
CVE-2026-32281High 7.5
Inefficient policy validation in crypto/x509
Affected: fixed in 1.25.9; from 1.26.0-0, fixed in 1.26.2.
CVE-2026-32283High 7.5
Unauthenticated TLS 1.3 KeyUpdate record can cause persistent connection retention and DoS in crypto/tls
Affected: fixed in 1.25.9; from 1.26.0-0, fixed in 1.26.2.
CVE-2026-32288Medium 5.5
Unbounded allocation for old GNU sparse in archive/tar
Affected: fixed in 1.25.9; from 1.26.0-0, fixed in 1.26.2.
CVE-2026-33810High 7.5
Case-sensitive excludedSubtrees name constraints cause Auth Bypass in crypto/x509
Affected: from 1.26.0-0, fixed in 1.26.2.
CVE-2026-32289Medium 6.1
JsBraceDepth Context Tracking Bugs (XSS) in html/template
Affected: fixed in 1.25.9; from 1.26.0-0, fixed in 1.26.2.
CVE-2026-32282Medium 6.4
TOCTOU permits root escape on Linux via Root.Chmod in os in internal/syscall/unix
Affected: fixed in 1.25.9; from 1.26.0-0, fixed in 1.26.2.
CVE-2026-27142Medium 6.1
URLs in meta content attribute actions are not escaped in html/template
Affected: fixed in 1.25.8; from 1.26.0-0, fixed in 1.26.1.
CVE-2026-27139Low 2.5
FileInfo can escape from a Root in os
Affected: fixed in 1.25.8; from 1.26.0-0, fixed in 1.26.1.
CVE-2026-25679High 7.5
Incorrect parsing of IPv6 host literals in net/url
Affected: fixed in 1.25.8; from 1.26.0-0, fixed in 1.26.1.
CVE-2026-27138Medium 5.9
Panic in name constraint checking for malformed certificates in crypto/x509
Affected: from 1.26.0-0, fixed in 1.26.1.
CVE-2026-27137High 7.5
Incorrect enforcement of email constraints in crypto/x509
Affected: from 1.26.0-0, fixed in 1.26.1.
CVE-2025-68121Critical 9.1
Unexpected session resumption in crypto/tls
Affected: fixed in 1.24.13; from 1.25.0-0, fixed in 1.25.7; from 1.26.0-rc.1, fixed in 1.26.0-rc.3.
CVE-2025-22873Low 3.8
Improper access to parent directory of root in os
Affected: fixed in 1.23.9; from 1.24.0-0, fixed in 1.24.3.
CVE-2025-61728Medium 6.5
Excessive CPU consumption when building archive index in archive/zip
Affected: fixed in 1.24.12; from 1.25.0, fixed in 1.25.6.
CVE-2025-61726High 7.5
Memory exhaustion in query parameter parsing in net/url
Affected: fixed in 1.24.12; from 1.25.0, fixed in 1.25.6.
CVE-2025-61730Medium 5.3
Handshake messages may be processed at the incorrect encryption level in crypto/tls
Affected: fixed in 1.24.12; from 1.25.0, fixed in 1.25.6.
CVE-2025-61727Medium 6.5
Improper application of excluded DNS name constraints when verifying wildcard names in crypto/x509
Affected: fixed in 1.24.11; from 1.25.0, fixed in 1.25.5.
CVE-2025-61729High 7.5
Excessive resource consumption when printing error string for host certificate validation in crypto/x509
Affected: fixed in 1.24.11; from 1.25.0, fixed in 1.25.5.
CVE-2025-61724Medium 5.3
Excessive CPU consumption in Reader.ReadResponse in net/textproto
Affected: fixed in 1.24.8; from 1.25.0, fixed in 1.25.2.
CVE-2025-58183Medium 4.3
Unbounded allocation when parsing GNU sparse map in archive/tar
Affected: fixed in 1.24.8; from 1.25.0, fixed in 1.25.2.
CVE-2025-58188High 7.5
Panic when validating certificates with DSA public keys in crypto/x509
Affected: fixed in 1.24.8; from 1.25.0, fixed in 1.25.2.
CVE-2025-58186Medium 5.3
Lack of limit when parsing cookies can cause memory exhaustion in net/http
Affected: fixed in 1.24.8; from 1.25.0, fixed in 1.25.2.
CVE-2025-58185Medium 5.3
Parsing DER payload can cause memory exhaustion in encoding/asn1
Affected: fixed in 1.24.8; from 1.25.0, fixed in 1.25.2.
CVE-2025-47912Medium 5.3
Insufficient validation of bracketed IPv6 hostnames in net/url
Affected: fixed in 1.24.8; from 1.25.0, fixed in 1.25.2.
CVE-2025-61723High 7.5
Quadratic complexity when parsing some invalid inputs in encoding/pem
Affected: fixed in 1.24.8; from 1.25.0, fixed in 1.25.2.
CVE-2025-58189Medium 5.3
ALPN negotiation error contains attacker controlled information in crypto/tls
Affected: fixed in 1.24.8; from 1.25.0, fixed in 1.25.2.
CVE-2025-58187High 7.5
Quadratic complexity when checking name constraints in crypto/x509
Affected: fixed in 1.24.9; from 1.25.0, fixed in 1.25.3.
CVE-2025-61725High 7.5
Excessive CPU consumption in ParseAddress in net/mail
Affected: fixed in 1.24.8; from 1.25.0, fixed in 1.25.2.
CVE-2025-47910Medium 5.4
CrossOriginProtection insecure bypass patterns not limited to exact matches in net/http
Affected: from 1.25.0, fixed in 1.25.1.
CVE-2025-47906Medium 6.5
Unexpected paths returned from LookPath in os/exec
Affected: fixed in 1.23.12; from 1.24.0, fixed in 1.24.6.
CVE-2025-47907High 7.0
Incorrect results returned from Rows.Scan in database/sql
Affected: fixed in 1.23.12; from 1.24.0, fixed in 1.24.6.
CVE-2025-0913Medium 5.5
Inconsistent handling of O_CREATE|O_EXCL on Unix and Windows in os in syscall
Affected: fixed in 1.23.10; from 1.24.0-0, fixed in 1.24.4.
CVE-2025-4673Medium 6.8
Sensitive headers not cleared on cross-origin redirect in net/http
Affected: fixed in 1.23.10; from 1.24.0-0, fixed in 1.24.4.
CVE-2025-22874High 7.5
Usage of ExtKeyUsageAny disables policy validation in crypto/x509
Affected: from 1.24.0-0, fixed in 1.24.4.
CVE-2025-22871Critical 9.1
Request smuggling due to acceptance of invalid chunked data in net/http
Affected: fixed in 1.23.8; from 1.24.0-0, fixed in 1.24.2.
CVE-2025-22870Medium 4.4
HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net
Affected: fixed in 1.23.7; from 1.24.0-0, fixed in 1.24.1.
CVE-2025-22866Medium 4.0
Timing sidechannel for P-256 on ppc64le in crypto/internal/nistec
Affected: fixed in 1.22.12; from 1.23.0-0, fixed in 1.23.6; from 1.24.0-0, fixed in 1.24.0-rc.3.
CVE-2025-22865High 7.5
ParsePKCS1PrivateKey panic with partial keys in crypto/x509
Affected: from 1.24.0-0, fixed in 1.24.0-rc.2.
CVE-2024-45336Medium 6.1
Sensitive headers incorrectly sent after cross-domain redirect in net/http
Affected: fixed in 1.22.11; from 1.23.0-0, fixed in 1.23.5; from 1.24.0-0, fixed in 1.24.0-rc.2.
CVE-2024-45341Medium 6.1
Usage of IPv6 zone IDs can bypass URI name constraints in crypto/x509
Affected: fixed in 1.22.11; from 1.23.0-0, fixed in 1.23.5; from 1.24.0-0, fixed in 1.24.0-rc.2.
CVE-2024-34158High 7.5
Stack exhaustion in Parse in go/build/constraint
Affected: fixed in 1.22.7; from 1.23.0-0, fixed in 1.23.1.
CVE-2024-34156High 7.5
Stack exhaustion in Decoder.Decode in encoding/gob
Affected: fixed in 1.22.7; from 1.23.0-0, fixed in 1.23.1.
CVE-2024-34155Medium 4.3
Stack exhaustion in all Parse functions in go/parser
Affected: fixed in 1.22.7; from 1.23.0-0, fixed in 1.23.1.
CVE-2024-24791High 7.5
Denial of service due to improper 100-continue handling in net/http
Affected: fixed in 1.21.12; from 1.22.0-0, fixed in 1.22.5.
CVE-2024-24789Medium 5.3
Mishandling of corrupt central directory record in archive/zip
Affected: fixed in 1.21.11; from 1.22.0-0, fixed in 1.22.4.
CVE-2024-24790Critical 9.8
Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses in net/netip
Affected: fixed in 1.21.11; from 1.22.0-0, fixed in 1.22.4.
CVE-2024-24788Medium 5.9
Malformed DNS message can cause infinite loop in net
Affected: from 1.22.0-0, fixed in 1.22.3.
CVE-2023-45288High 7.5
HTTP/2 CONTINUATION flood in net/http
Affected: fixed in 1.21.9; from 1.22.0-0, fixed in 1.22.2.
CVE-2024-24785Medium 5.4
Errors returned from JSON marshaling may break template escaping in html/template
Affected: fixed in 1.21.8; from 1.22.0-0, fixed in 1.22.1.
CVE-2024-24784High 7.5
Comments in display names are incorrectly handled in net/mail
Affected: fixed in 1.21.8; from 1.22.0-0, fixed in 1.22.1.
CVE-2023-45289Medium 4.3
Incorrect forwarding of sensitive headers and cookies on HTTP redirect in net/http
Affected: fixed in 1.21.8; from 1.22.0-0, fixed in 1.22.1.
CVE-2023-45290Medium 6.5
Memory exhaustion in multipart form parsing in net/textproto and net/http
Affected: fixed in 1.21.8; from 1.22.0-0, fixed in 1.22.1.
CVE-2024-24783Medium 5.9
Verify panics on certificates with an unknown public key algorithm in crypto/x509
Affected: fixed in 1.21.8; from 1.22.0-0, fixed in 1.22.1.
CVE-2023-39326Unrated
Denial of service via chunk extensions in net/http
Affected: fixed in 1.20.12; from 1.21.0-0, fixed in 1.21.5.
CVE-2023-45287Unrated
Before Go 1.20, the RSA based key exchange methods in crypto/tls may exhibit a timing side channel
Affected: fixed in 1.20.0.
CVE-2023-45284Medium 5.3
Incorrect detection of reserved device names on Windows in path/filepath
Affected: fixed in 1.20.11; from 1.21.0-0, fixed in 1.21.4.
CVE-2023-45283Unrated
Insecure parsing of Windows paths with a \??\ prefix in path/filepath
Affected: fixed in 1.20.11; from 1.21.0-0, fixed in 1.21.4; from 1.20.11, fixed in 1.20.12; from 1.21.4, fixed in 1.21.5.
CVE-2023-39325Unrated
HTTP/2 rapid reset can cause excessive work in net/http
Affected: fixed in 1.20.10; from 1.21.0-0, fixed in 1.21.3.
CVE-2023-39322Unrated
Memory exhaustion in QUIC connection handling in crypto/tls
Affected: from 1.21.0-0, fixed in 1.21.1.
CVE-2023-39321Unrated
Panic when processing post-handshake message on QUIC connections in crypto/tls
Affected: from 1.21.0-0, fixed in 1.21.1.
CVE-2023-39319Unrated
Improper handling of special tags within script contexts in html/template
Affected: fixed in 1.20.8; from 1.21.0-0, fixed in 1.21.1.
CVE-2023-39318Unrated
Improper handling of HTML-like comments in script contexts in html/template
Affected: fixed in 1.20.8; from 1.21.0-0, fixed in 1.21.1.
CVE-2023-29409Unrated
Large RSA keys can cause high CPU usage in crypto/tls
Affected: fixed in 1.19.12; from 1.20.0-0, fixed in 1.20.7; from 1.21.0-0, fixed in 1.21.0-rc.4.
CVE-2023-29406Unrated
Insufficient sanitization of Host header in net/http
Affected: fixed in 1.19.11; from 1.20.0-0, fixed in 1.20.6.
CVE-2023-29403High 7.8
Unsafe behavior in setuid/setgid binaries in runtime
Affected: fixed in 1.19.10; from 1.20.0-0, fixed in 1.20.5.
CVE-2023-24539High 7.3
Improper sanitization of CSS values in html/template
Affected: fixed in 1.19.9; from 1.20.0-0, fixed in 1.20.4.
CVE-2023-24540Critical 9.8
Improper handling of JavaScript whitespace in html/template
Affected: fixed in 1.19.9; from 1.20.0-0, fixed in 1.20.4.
CVE-2023-29400High 7.3
Improper handling of empty HTML attributes in html/template
Affected: fixed in 1.19.9; from 1.20.0-0, fixed in 1.20.4.
CVE-2023-24537High 7.5
Infinite loop in parsing in go/scanner
Affected: fixed in 1.19.8; from 1.20.0-0, fixed in 1.20.3.
CVE-2023-24538Critical 9.8
Backticks not treated as string delimiters in html/template
Affected: fixed in 1.19.8; from 1.20.0-0, fixed in 1.20.3.
CVE-2023-24534High 7.5
Excessive memory allocation in net/http and net/textproto
Affected: fixed in 1.19.8; from 1.20.0-0, fixed in 1.20.3.
CVE-2023-24536High 7.5
Excessive resource consumption in net/http, net/textproto and mime/multipart
Affected: fixed in 1.19.8; from 1.20.0-0, fixed in 1.20.3.
CVE-2023-24532Unrated
Incorrect calculation on P256 curves in crypto/internal/nistec
Affected: fixed in 1.19.7; from 1.20.0-0, fixed in 1.20.2.
CVE-2022-41723High 7.5
Denial of service via crafted HTTP/2 stream in net/http and golang.org/x/net
Affected: fixed in 1.19.6; from 1.20.0-0, fixed in 1.20.1.
CVE-2022-41724Unrated
Panic on large handshake records in crypto/tls
Affected: fixed in 1.19.6; from 1.20.0-0, fixed in 1.20.1.
CVE-2022-41725Unrated
Excessive resource consumption in mime/multipart
Affected: fixed in 1.19.6; from 1.20.0-0, fixed in 1.20.1.
CVE-2022-41722Unrated
Path traversal on Windows in path/filepath
Affected: fixed in 1.19.6; from 1.20.0-0, fixed in 1.20.1.
CVE-2022-41717Unrated
Excessive memory growth in net/http and golang.org/x/net/http2
Affected: fixed in 1.18.9; from 1.19.0-0, fixed in 1.19.4.
CVE-2022-41720High 7.5
Restricted file access on Windows in os and net/http
Affected: fixed in 1.18.9; from 1.19.0-0, fixed in 1.19.4.
CVE-2022-41716Medium 6.3
Unsanitized NUL in environment variables on Windows in syscall and os/exec
Affected: fixed in 1.18.8; from 1.19.0-0, fixed in 1.19.3.
CVE-2022-41715Unrated
Memory exhaustion when compiling regular expressions in regexp/syntax
Affected: fixed in 1.18.7; from 1.19.0-0, fixed in 1.19.2.
CVE-2022-2880Unrated
Incorrect sanitization of forwarded query parameters in net/http/httputil
Affected: fixed in 1.18.7; from 1.19.0-0, fixed in 1.19.2.
CVE-2022-2879Unrated
Unbounded memory consumption when reading headers in archive/tar
Affected: fixed in 1.18.7; from 1.19.0-0, fixed in 1.19.2.
CVE-2022-32190Unrated
Failure to strip relative path components in net/url
Affected: from 1.19.0-0, fixed in 1.19.1.
CVE-2022-27664Unrated
In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers can cause a denial of service because an HTTP/2 connection can hang…
Affected: fixed in 1.18.6; from 1.19.0-0, fixed in 1.19.1.
CVE-2022-32148Medium 6.5
Exposure of client IP addresses in net/http
Affected: fixed in 1.17.12; from 1.18.0-0, fixed in 1.18.4.
CVE-2022-1962Medium 5.5
Stack exhaustion due to deeply nested types in go/parser
Affected: fixed in 1.17.12; from 1.18.0-0, fixed in 1.18.4.
CVE-2022-30580High 7.8
Empty Cmd.Path can trigger unintended binary in os/exec on Windows
Affected: fixed in 1.17.11; from 1.18.0-0, fixed in 1.18.3.
CVE-2022-32189Unrated
Panic when decoding Float and Rat types in math/big
Affected: fixed in 1.17.13; from 1.18.0-0, fixed in 1.18.5.
CVE-2022-30629Low 3.1
Session tickets lack random ticket_age_add in crypto/tls
Affected: fixed in 1.17.11; from 1.18.0-0, fixed in 1.18.3.
CVE-2022-30630High 7.5
Stack exhaustion in Glob on certain paths in io/fs
Affected: fixed in 1.17.12; from 1.18.0-0, fixed in 1.18.4.
CVE-2022-1705Medium 6.5
Improper sanitization of Transfer-Encoding headers in net/http
Affected: fixed in 1.17.12; from 1.18.0-0, fixed in 1.18.4.
CVE-2022-30631High 7.5
Stack exhaustion when reading certain archives in compress/gzip
Affected: fixed in 1.17.12; from 1.18.0-0, fixed in 1.18.4.
CVE-2022-30633High 7.5
Stack exhaustion when unmarshaling certain documents in encoding/xml
Affected: fixed in 1.17.12; from 1.18.0-0, fixed in 1.18.4.
CVE-2022-30635High 7.5
Stack exhaustion when decoding certain messages in encoding/gob
Affected: fixed in 1.17.12; from 1.18.0-0, fixed in 1.18.4.
CVE-2022-30632Unrated
Stack exhaustion on crafted paths in path/filepath
Affected: fixed in 1.17.12; from 1.18.0-0, fixed in 1.18.4.
CVE-2022-29804Unrated
Path traversal via Clean on Windows in path/filepath
Affected: fixed in 1.17.11; from 1.18.0-0, fixed in 1.18.3.
CVE-2022-28131Unrated
Stack exhaustion from deeply nested XML documents in encoding/xml
Affected: fixed in 1.17.12; from 1.18.0-0, fixed in 1.18.4.
CVE-2022-30634Unrated
Indefinite hang with large buffers on Windows in crypto/rand
Affected: fixed in 1.17.11; from 1.18.0-0, fixed in 1.18.3.
CVE-2022-29526Unrated
Go before 1.17.10 and 1.18.x before 1.18.2 has Incorrect Privilege Assignment.
Affected: fixed in 1.17.10; from 1.18.0-0, fixed in 1.18.2.
CVE-2022-28327Unrated
The generic P-256 feature in crypto/elliptic in Go before 1.17.9 and 1.18.x before 1.18.1 allows a panic via long scalar input.
Affected: fixed in 1.17.9; from 1.18.0-0, fixed in 1.18.1.
CVE-2022-27536Unrated
Certificate.Verify in crypto/x509 in Go 1.18.x before 1.18.1 can be caused to panic on macOS when presented with certain malformed…
Affected: from 1.18.0-0, fixed in 1.18.1.
CVE-2022-24675Unrated
encoding/pem in Go before 1.17.9 and 1.18.x before 1.18.1 has a Decode stack overflow via a large amount of PEM data.
Affected: fixed in 1.17.9; from 1.18.0-0, fixed in 1.18.1.
CVE-2022-24921Unrated
regexp.Compile in Go before 1.16.15 and 1.17.x before 1.17.8 allows stack exhaustion via a deeply nested expression.
Affected: fixed in 1.16.15; from 1.17.0-0, fixed in 1.17.8.
CVE-2022-23772Unrated
Rat.SetString in math/big in Go before 1.16.14 and 1.17.x before 1.17.7 has an overflow that can lead to Uncontrolled Memory Consumption.
Affected: fixed in 1.16.14; from 1.17.0-0, fixed in 1.17.7.
CVE-2022-23806Unrated
Curve.IsOnCurve in crypto/elliptic in Go before 1.16.14 and 1.17.x before 1.17.7 can incorrectly return true in situations with a big.Int…
Affected: fixed in 1.16.14; from 1.17.0-0, fixed in 1.17.7.
CVE-2021-39293Unrated
In archive/zip in Go before 1.16.8 and 1.17.x before 1.17.1, a crafted archive header (falsely designating that many files are present)…
Affected: fixed in 1.16.8; from 1.17.0-0, fixed in 1.17.1.
CVE-2021-44717Unrated
Go before 1.16.12 and 1.17.x before 1.17.5 on UNIX allows write operations to an unintended file or unintended network connection as a…
Affected: fixed in 1.16.12; from 1.17.0-0, fixed in 1.17.5.
CVE-2021-44716Unrated
net/http in Go before 1.16.12 and 1.17.x before 1.17.5 allows uncontrolled memory consumption in the header canonicalization cache via…
Affected: fixed in 1.16.12; from 1.17.0-0, fixed in 1.17.5.
CVE-2021-41772Unrated
Go before 1.16.10 and 1.17.x before 1.17.3 allows an archive/zip Reader.Open panic via a crafted ZIP archive containing an invalid name or…
Affected: fixed in 1.16.10; from 1.17.0-0, fixed in 1.17.3.
CVE-2021-41771Unrated
ImportedSymbols in debug/macho (for Open or OpenFat) in Go before 1.16.10 and 1.17.x before 1.17.3 Accesses a Memory Location After the…
Affected: fixed in 1.16.10; from 1.17.0-0, fixed in 1.17.3.
CVE-2021-36221Unrated
Go before 1.15.15 and 1.16.x before 1.16.7 has a race condition that can lead to a net/http/httputil ReverseProxy panic upon an…
Affected: fixed in 1.15.15; from 1.16.0-0, fixed in 1.16.7.
CVE-2021-33198Unrated
In Go before 1.15.13 and 1.16.x before 1.16.5, there can be a panic for a large exponent to the math/big.Rat SetString or UnmarshalText…
Affected: fixed in 1.15.13; from 1.16.0-0, fixed in 1.16.5.
CVE-2021-33197Unrated
In Go before 1.15.13 and 1.16.x before 1.16.5, some configurations of ReverseProxy (from net/http/httputil) result in a situation where an…
Affected: fixed in 1.15.13; from 1.16.0-0, fixed in 1.16.5.
CVE-2021-33195Unrated
Go before 1.15.13 and 1.16.x before 1.16.5 has functions for DNS lookups that do not validate replies from DNS servers, and thus a return…
Affected: fixed in 1.15.13; from 1.16.0-0, fixed in 1.16.5.
CVE-2021-33196Unrated
In archive/zip in Go before 1.15.13 and 1.16.x before 1.16.5, a crafted file count (in an archive's header) can cause a NewReader or…
Affected: fixed in 1.15.13; from 1.16.0-0, fixed in 1.16.5.
CVE-2021-34558Unrated
The crypto/tls package of Go through 1.16.5 does not properly assert that the type of public key in an X.509 certificate matches the…
Affected: fixed in 1.15.14; from 1.16.0-0, fixed in 1.16.6.
CVE-2021-31525Unrated
net/http in Go before 1.15.12 and 1.16.x before 1.16.4 allows remote attackers to cause a denial of service (panic) via a large header to…
Affected: fixed in 1.15.12; from 1.16.0-0, fixed in 1.16.4.
CVE-2021-27919Unrated
archive/zip in Go 1.16.x before 1.16.1 allows attackers to cause a denial of service (panic) upon attempted use of the Reader.Open API for…
Affected: from 1.16.0-0, fixed in 1.16.1.
CVE-2021-27918Unrated
encoding/xml in Go before 1.15.9 and 1.16.x before 1.16.1 has an infinite loop if a custom TokenReader (for xml.NewTokenDecoder) returns…
Affected: fixed in 1.15.9; from 1.16.0-0, fixed in 1.16.1.
CVE-2021-3114Unrated
In Go before 1.14.14 and 1.15.x before 1.15.7, crypto/elliptic/p224.go can generate incorrect outputs, related to an underflow of the…
Affected: fixed in 1.14.14; from 1.15.0-0, fixed in 1.15.7.
CVE-2020-28362Unrated
Go before 1.14.12 and 1.15.x before 1.15.4 allows Denial of Service.
Affected: from 1.14.0-0, fixed in 1.14.12; from 1.15.0-0, fixed in 1.15.5.
CVE-2020-24553Unrated
Go before 1.14.8 and 1.15.x before 1.15.1 allows XSS because text/html is the default for CGI/FCGI handlers that lack a Content-Type header.
Affected: fixed in 1.14.8; from 1.15.0-0, fixed in 1.15.1.
CVE-2020-16845Unrated
Go before 1.13.15 and 14.x before 1.14.7 can have an infinite read loop in ReadUvarint and ReadVarint in encoding/binary via invalid inputs.
Affected: fixed in 1.13.15; from 1.14.0-0, fixed in 1.14.7.
CVE-2020-14039Unrated
In Go before 1.13.13 and 1.14.x before 1.14.5, Certificate.Verify may lack a check on the VerifyOptions.KeyUsages EKU requirements (if…
Affected: fixed in 1.13.13; from 1.14.0-0, fixed in 1.14.5.
CVE-2020-15586Unrated
Go before 1.13.13 and 1.14.x before 1.14.5 has a data race in some net/http servers, as demonstrated by the httputil.ReverseProxy Handler…
Affected: fixed in 1.13.13; from 1.14.0-0, fixed in 1.14.5.
CVE-2020-7919Unrated
Go before 1.12.16 and 1.13.x before 1.13.7 (and the crypto/cryptobyte package before 0.0.0-20200124225646-8b5121be2f68 for Go) allows…
Affected: fixed in 1.12.16; from 1.13.0-0, fixed in 1.13.7.
CVE-2015-5741Unrated
The net/http library in net/http/transfer.go in Go before 1.4.3 does not properly parse HTTP headers, which allows remote attackers to…
Affected: fixed in 1.4.3.
CVE-2020-0601High 8.1 · KEV
A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) certificates.An attac
Affected: fixed in 1.12.16; from 1.13.0-0, fixed in 1.13.7.
CVE-2019-17596Unrated
Go before 1.12.11 and 1.3.x before 1.13.2 can panic upon an attempt to process network traffic containing an invalid DSA public key.
Affected: fixed in 1.12.11; from 1.13.0-0, fixed in 1.13.2.
CVE-2019-16276Unrated
Go before 1.12.10 and 1.13.x before 1.13.1 allow HTTP Request Smuggling.
Affected: fixed in 1.12.10; from 1.13.0-0, fixed in 1.13.1.
CVE-2019-14809Unrated
net/url in Go before 1.11.13 and 1.12.x before 1.12.8 mishandles malformed hosts in URLs, leading to an authorization bypass in some…
Affected: fixed in 1.11.13; from 1.12.0-0, fixed in 1.12.8.
CVE-2019-9512High 7.5
Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service
Affected: fixed in 1.11.13; from 1.12.0-0, fixed in 1.12.8.
CVE-2019-9514High 7.5
Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service
Affected: fixed in 1.11.13; from 1.12.0-0, fixed in 1.12.8.
CVE-2019-9634Unrated
Go through 1.12 on Windows misuses certain LoadLibrary functionality, leading to DLL injection.
Affected: fixed in 1.11.10; from 1.12.0-0, fixed in 1.12.2.
CVE-2019-6486Unrated
Go before 1.10.8 and 1.11.x before 1.11.5 mishandles P-521 and P-384 elliptic curves, which allows attackers to cause a denial of service…
Affected: fixed in 1.10.8; from 1.11.0-0, fixed in 1.11.5.
CVE-2018-16875Medium 5.9
The crypto/x509 package of Go before 1.10.6 and 1.11.x before 1.11.3 does not limit the amount of work performed for each chain…
Affected: fixed in 1.10.6; from 1.11.0-0, fixed in 1.11.3.
CVE-2015-5740Unrated
The net/http library in net/http/transfer.go in Go before 1.4.3 does not properly parse HTTP headers, which allows remote attackers to…
Affected: fixed in 1.4.3.
CVE-2015-5739Unrated
The net/http library in net/textproto/reader.go in Go before 1.4.3 does not properly parse HTTP header keys, which allows remote attackers…
Affected: fixed in 1.4.3.
CVE-2017-15042Unrated
An unintended cleartext issue exists in Go before 1.8.4 and 1.9.x before 1.9.1.
Affected: from 1.1.0-0, fixed in 1.8.4; from 1.9.0-0, fixed in 1.9.1.
CVE-2017-1000098Unrated
The net/http package's Request.ParseMultipartForm method starts writing to temporary files once the request body size surpasses the given…
Affected: fixed in 1.6.4; from 1.7.0-0, fixed in 1.7.4.
CVE-2017-1000097Unrated
On Darwin, user's trust preferences for root certificates were not honored.
Affected: fixed in 1.6.4; from 1.7.0-0, fixed in 1.7.4.
CVE-2017-8932Unrated
A bug in the standard library ScalarMult implementation of curve P-256 for amd64 architectures in Go before 1.7.6 and 1.8.x before 1.8.2…
Affected: from 1.6.0-0, fixed in 1.7.6; from 1.8.0-0, fixed in 1.8.2.
CVE-2016-5386Unrated
The net/http package in Go through 1.6 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not…
Affected: fixed in 1.6.3.
CVE-2016-3959Unrated
The Verify function in crypto/dsa/dsa.go in Go before 1.5.4 and 1.6.x before 1.6.1 does not properly check parameters passed to the big…
Affected: fixed in 1.5.4; from 1.6.0-0, fixed in 1.6.1.
CVE-2016-3958Unrated
Untrusted search path vulnerability in Go before 1.5.4 and 1.6.x before 1.6.1 on Windows allows local users to gain privileges via a…
Affected: fixed in 1.5.4; from 1.6.0-0, fixed in 1.6.1.
CVE-2015-8618Unrated
The Int.Exp Montgomery code in the math/big library in Go 1.5.x before 1.5.3 mishandles carry propagation and produces incorrect output…
Affected: from 1.5.0-0, fixed in 1.5.3.
CVE-2014-7189Unrated
crpyto/tls in Go 1.1 before 1.3.2, when SessionTicketsDisabled is enabled, allows man-in-the-middle attackers to spoof clients via…
Affected: from 1.1.0-0, fixed in 1.3.2.