# stdlib (Go) vulnerabilities

182 known vulnerabilities (8 critical, 55 high, 46 medium, 3 low), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: not known (cve.now hasn't read this package's releases)
- Newest unaffected release: not known without release data
- Registry: https://pkg.go.dev/stdlib

## Advisories (182)

### [CVE-2026-111943](https://cve.now/CVE-2026-111943): Distrust compromised intermediate certificates in crypto/x509

- Severity: Medium 6.8
- Published: Oct 21, 2026
- Affected: fixed in 1.26.10; from 1.27.0-0, fixed in 1.27.3.

### [CVE-2026-97032](https://cve.now/CVE-2026-97032): HTTP/2 server crash due to HPACK encoder race in net/http

- Severity: High 7.5
- Published: Oct 8, 2026
- Affected: fixed in 1.26.9; from 1.27.0-0, fixed in 1.27.2.

### [CVE-2026-94439](https://cve.now/CVE-2026-94439): HTTP/1 server connection desynchronization after 2xx CONNECT response in net/http

- Severity: High 7.5
- Published: Oct 8, 2026
- Affected: fixed in 1.26.9; from 1.27.0-0, fixed in 1.27.2.

### [CVE-2026-78663](https://cve.now/CVE-2026-78663): Double flow control refund on HTTP/2 server streams in net/http

- Severity: Critical 9.1
- Published: Oct 8, 2026
- Affected: fixed in 1.26.9; from 1.27.0-0, fixed in 1.27.2.

### [CVE-2026-78669](https://cve.now/CVE-2026-78669): Excessive CPU consumption from repeated initial window changes in net/http

- Severity: High 7.5
- Published: Oct 8, 2026
- Affected: fixed in 1.26.9; from 1.27.0-0, fixed in 1.27.2.

### [CVE-2026-78660](https://cve.now/CVE-2026-78660): HTTP/2 transport accepts malformed framing-related headers in net/http

- Severity: High 7.5
- Published: Oct 8, 2026
- Affected: fixed in 1.26.9; from 1.27.0-0, fixed in 1.27.2.

### [CVE-2026-78667](https://cve.now/CVE-2026-78667): Lack of limit on size of parsed Range headers in net/http

- Severity: High 7.5
- Published: Oct 8, 2026
- Affected: fixed in 1.26.9; from 1.27.0-0, fixed in 1.27.2.

### [CVE-2026-94440](https://cve.now/CVE-2026-94440): Memory limit bypass when parsing MIME headers in net/textproto, mime/multipart

- Severity: High 7.5
- Published: Oct 8, 2026
- Affected: fixed in 1.26.9; from 1.27.0-0, fixed in 1.27.2.

### [CVE-2026-97031](https://cve.now/CVE-2026-97031): Reject malformed ECH outer extension references in crypto/tls

- Severity: High 7.5
- Published: Oct 8, 2026
- Affected: fixed in 1.26.9; from 1.27.0-0, fixed in 1.27.2.

### [CVE-2026-56866](https://cve.now/CVE-2026-56866): HTTP/1 client connection desynchronization after CONNECT rejection in net/http

- Severity: High 7.5
- Published: Oct 8, 2026
- Affected: fixed in 1.26.9; from 1.27.0-0, fixed in 1.27.2.

### [CVE-2026-56857](https://cve.now/CVE-2026-56857): Root.Mkdir(All) can follow junctions out of the root on Windows in os

- Severity: Critical 9.8
- Published: Oct 8, 2026
- Affected: fixed in 1.26.9; from 1.27.0-0, fixed in 1.27.2.

### [CVE-2026-78659](https://cve.now/CVE-2026-78659): HTTP/2 server memory exhaustion due to Trailer headers in net/http

- Severity: High 7.5
- Published: Oct 8, 2026
- Affected: fixed in 1.26.9; from 1.27.0-0, fixed in 1.27.2.

### [CVE-2026-97030](https://cve.now/CVE-2026-97030): Recognize yield as regexp preceder keyword in html/template

- Severity: Medium 6.1
- Published: Oct 8, 2026
- Affected: fixed in 1.26.9; from 1.27.0-0, fixed in 1.27.2.

### [CVE-2026-94448](https://cve.now/CVE-2026-94448): Reset context tracking on consecutive template expressions in html/template

- Severity: Medium 6.1
- Published: Oct 8, 2026
- Affected: fixed in 1.26.9; from 1.27.0-0, fixed in 1.27.2.

### [CVE-2026-56860](https://cve.now/CVE-2026-56860): Avoid quadratic complexity in resolvePath in net/url

- Severity: Medium 5.9
- Published: Aug 13, 2026
- Affected: fixed in 1.25.13; from 1.26.0-0, fixed in 1.26.6; from 1.27.0-0, fixed in 1.27.0-rc.3.

### [CVE-2026-56858](https://cve.now/CVE-2026-56858): Fix Javascript regexp context tracking in html/template

- Severity: Medium 6.1
- Published: Aug 13, 2026
- Affected: fixed in 1.25.13; from 1.26.0-0, fixed in 1.26.6; from 1.27.0-0, fixed in 1.27.0-rc.3.

### [CVE-2026-56862](https://cve.now/CVE-2026-56862): Limit handshake messages we are willing to accept post-handshake in crypto/tls

- Severity: High 7.5
- Published: Aug 13, 2026
- Affected: fixed in 1.25.13; from 1.26.0-0, fixed in 1.26.6; from 1.27.0-0, fixed in 1.27.0-rc.3.

### [CVE-2026-56853](https://cve.now/CVE-2026-56853): Apply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/http

- Severity: High 7.5
- Published: Aug 13, 2026
- Affected: fixed in 1.25.13; from 1.26.0-0, fixed in 1.26.6; from 1.27.0-0, fixed in 1.27.0-rc.3.

### [CVE-2026-56859](https://cve.now/CVE-2026-56859): Add recursion depth guard during decode in encoding/xml

- Severity: High 7.5
- Published: Aug 13, 2026
- Affected: fixed in 1.25.13; from 1.26.0-0, fixed in 1.26.6; from 1.27.0-0, fixed in 1.27.0-rc.3.

### [CVE-2026-46600](https://cve.now/CVE-2026-46600): Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage

- Severity: High 7.5
- Published: Jul 21, 2026
- Affected: from 1.26.0-0, fixed in 1.26.6; from 1.27.0-0, fixed in 1.27.0-rc.3.

### [CVE-2026-42505](https://cve.now/CVE-2026-42505): Invoking Encrypted Client Hello privacy leak in crypto/tls

- Severity: Medium 5.3
- Published: Jul 8, 2026
- Affected: fixed in 1.25.12; from 1.26.0-0, fixed in 1.26.5; from 1.27.0-0, fixed in 1.27.0-rc.2.

### [CVE-2026-39822](https://cve.now/CVE-2026-39822): Root escape via symlink plus trailing slash in os

- Severity: High 7.8
- Published: Jul 8, 2026
- Affected: fixed in 1.25.12; from 1.26.0-0, fixed in 1.26.5; from 1.27.0-0, fixed in 1.27.0-rc.2.

### [CVE-2026-42507](https://cve.now/CVE-2026-42507): Arbitrary inputs are included in errors without any escaping in net/textproto

- Severity: Medium 5.3
- Published: Jun 2, 2026
- Affected: fixed in 1.25.11; from 1.26.0-0, fixed in 1.26.4.

### [CVE-2026-27145](https://cve.now/CVE-2026-27145): Inefficient candidate hostname parsing in crypto/x509

- Severity: Medium 6.5
- Published: Jun 2, 2026
- Affected: fixed in 1.25.11; from 1.26.0-0, fixed in 1.26.4.

### [CVE-2026-39821](https://cve.now/CVE-2026-39821): Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna

- Severity: Critical 9.6
- Published: May 22, 2026
- Affected: fixed in 1.25.13; from 1.26.0-0, fixed in 1.26.6; from 1.27.0-0, fixed in 1.27.0-rc.3.

### [CVE-2026-39820](https://cve.now/CVE-2026-39820): Quadratic string concatentation in consumeComment in net/mail

- Severity: High 7.5
- Published: May 7, 2026
- Affected: fixed in 1.25.10; from 1.26.0-0, fixed in 1.26.3.

### [CVE-2026-39823](https://cve.now/CVE-2026-39823): Bypass of meta content URL escaping causes XSS in html/template

- Severity: Medium 6.1
- Published: May 7, 2026
- Affected: fixed in 1.25.10; from 1.26.0-0, fixed in 1.26.3.

### [CVE-2026-33811](https://cve.now/CVE-2026-33811): Crash when handling long CNAME response in net

- Severity: High 7.5
- Published: May 7, 2026
- Affected: fixed in 1.25.10; from 1.26.0-0, fixed in 1.26.3.

### [CVE-2026-39826](https://cve.now/CVE-2026-39826): Escaper bypass leads to XSS in html/template

- Severity: Medium 6.1
- Published: May 7, 2026
- Affected: fixed in 1.25.10; from 1.26.0-0, fixed in 1.26.3.

### [CVE-2026-42499](https://cve.now/CVE-2026-42499): Quadratic string concatenation in consumePhrase in net/mail

- Severity: High 7.5
- Published: May 7, 2026
- Affected: fixed in 1.25.10; from 1.26.0-0, fixed in 1.26.3.

### [CVE-2026-39825](https://cve.now/CVE-2026-39825): ReverseProxy forwards queries with more than urlmaxqueryparams parameters in net/http/httputil

- Severity: Medium 5.3
- Published: May 7, 2026
- Affected: fixed in 1.25.10; from 1.26.0-0, fixed in 1.26.3.

### [CVE-2026-39836](https://cve.now/CVE-2026-39836): Panic in Dial and LookupPort when handling NUL byte on Windows in net

- Severity: High 7.5
- Published: May 7, 2026
- Affected: fixed in 1.25.10; from 1.26.0-0, fixed in 1.26.3.

### [CVE-2026-33814](https://cve.now/CVE-2026-33814): Infinite loop in HTTP/2 transport when given bad SETTINGS\_MAX\_FRAME\_SIZE in net/http/internal/http2 in golang.org/x/net

- Severity: High 7.5
- Published: May 7, 2026
- Affected: fixed in 1.25.10; from 1.26.0-0, fixed in 1.26.3.

### [CVE-2026-32280](https://cve.now/CVE-2026-32280): Unexpected work during chain building in crypto/x509

- Severity: High 7.5
- Published: Apr 8, 2026
- Affected: fixed in 1.25.9; from 1.26.0-0, fixed in 1.26.2.

### [CVE-2026-32281](https://cve.now/CVE-2026-32281): Inefficient policy validation in crypto/x509

- Severity: High 7.5
- Published: Apr 8, 2026
- Affected: fixed in 1.25.9; from 1.26.0-0, fixed in 1.26.2.

### [CVE-2026-32283](https://cve.now/CVE-2026-32283): Unauthenticated TLS 1.3 KeyUpdate record can cause persistent connection retention and DoS in crypto/tls

- Severity: High 7.5
- Published: Apr 8, 2026
- Affected: fixed in 1.25.9; from 1.26.0-0, fixed in 1.26.2.

### [CVE-2026-32288](https://cve.now/CVE-2026-32288): Unbounded allocation for old GNU sparse in archive/tar

- Severity: Medium 5.5
- Published: Apr 8, 2026
- Affected: fixed in 1.25.9; from 1.26.0-0, fixed in 1.26.2.

### [CVE-2026-33810](https://cve.now/CVE-2026-33810): Case-sensitive excludedSubtrees name constraints cause Auth Bypass in crypto/x509

- Severity: High 7.5
- Published: Apr 8, 2026
- Affected: from 1.26.0-0, fixed in 1.26.2.

### [CVE-2026-32289](https://cve.now/CVE-2026-32289): JsBraceDepth Context Tracking Bugs (XSS) in html/template

- Severity: Medium 6.1
- Published: Apr 8, 2026
- Affected: fixed in 1.25.9; from 1.26.0-0, fixed in 1.26.2.

### [CVE-2026-32282](https://cve.now/CVE-2026-32282): TOCTOU permits root escape on Linux via Root.Chmod in os in internal/syscall/unix

- Severity: Medium 6.4
- Published: Apr 8, 2026
- Affected: fixed in 1.25.9; from 1.26.0-0, fixed in 1.26.2.

### [CVE-2026-27142](https://cve.now/CVE-2026-27142): URLs in meta content attribute actions are not escaped in html/template

- Severity: Medium 6.1
- Published: Mar 6, 2026
- Affected: fixed in 1.25.8; from 1.26.0-0, fixed in 1.26.1.

### [CVE-2026-27139](https://cve.now/CVE-2026-27139): FileInfo can escape from a Root in os

- Severity: Low 2.5
- Published: Mar 6, 2026
- Affected: fixed in 1.25.8; from 1.26.0-0, fixed in 1.26.1.

### [CVE-2026-25679](https://cve.now/CVE-2026-25679): Incorrect parsing of IPv6 host literals in net/url

- Severity: High 7.5
- Published: Mar 6, 2026
- Affected: fixed in 1.25.8; from 1.26.0-0, fixed in 1.26.1.

### [CVE-2026-27138](https://cve.now/CVE-2026-27138): Panic in name constraint checking for malformed certificates in crypto/x509

- Severity: Medium 5.9
- Published: Mar 6, 2026
- Affected: from 1.26.0-0, fixed in 1.26.1.

### [CVE-2026-27137](https://cve.now/CVE-2026-27137): Incorrect enforcement of email constraints in crypto/x509

- Severity: High 7.5
- Published: Mar 6, 2026
- Affected: from 1.26.0-0, fixed in 1.26.1.

### [CVE-2025-68121](https://cve.now/CVE-2025-68121): Unexpected session resumption in crypto/tls

- Severity: Critical 9.1
- Published: Feb 5, 2026
- Affected: fixed in 1.24.13; from 1.25.0-0, fixed in 1.25.7; from 1.26.0-rc.1, fixed in 1.26.0-rc.3.

### [CVE-2025-22873](https://cve.now/CVE-2025-22873): Improper access to parent directory of root in os

- Severity: Low 3.8
- Published: Feb 4, 2026
- Affected: fixed in 1.23.9; from 1.24.0-0, fixed in 1.24.3.

### [CVE-2025-61728](https://cve.now/CVE-2025-61728): Excessive CPU consumption when building archive index in archive/zip

- Severity: Medium 6.5
- Published: Jan 28, 2026
- Affected: fixed in 1.24.12; from 1.25.0, fixed in 1.25.6.

### [CVE-2025-61726](https://cve.now/CVE-2025-61726): Memory exhaustion in query parameter parsing in net/url

- Severity: High 7.5
- Published: Jan 28, 2026
- Affected: fixed in 1.24.12; from 1.25.0, fixed in 1.25.6.

### [CVE-2025-61730](https://cve.now/CVE-2025-61730): Handshake messages may be processed at the incorrect encryption level in crypto/tls

- Severity: Medium 5.3
- Published: Jan 28, 2026
- Affected: fixed in 1.24.12; from 1.25.0, fixed in 1.25.6.

### [CVE-2025-61727](https://cve.now/CVE-2025-61727): Improper application of excluded DNS name constraints when verifying wildcard names in crypto/x509

- Severity: Medium 6.5
- Published: Dec 3, 2025
- Affected: fixed in 1.24.11; from 1.25.0, fixed in 1.25.5.

### [CVE-2025-61729](https://cve.now/CVE-2025-61729): Excessive resource consumption when printing error string for host certificate validation in crypto/x509

- Severity: High 7.5
- Published: Dec 2, 2025
- Affected: fixed in 1.24.11; from 1.25.0, fixed in 1.25.5.

### [CVE-2025-61724](https://cve.now/CVE-2025-61724): Excessive CPU consumption in Reader.ReadResponse in net/textproto

- Severity: Medium 5.3
- Published: Oct 29, 2025
- Affected: fixed in 1.24.8; from 1.25.0, fixed in 1.25.2.

### [CVE-2025-58183](https://cve.now/CVE-2025-58183): Unbounded allocation when parsing GNU sparse map in archive/tar

- Severity: Medium 4.3
- Published: Oct 29, 2025
- Affected: fixed in 1.24.8; from 1.25.0, fixed in 1.25.2.

### [CVE-2025-58188](https://cve.now/CVE-2025-58188): Panic when validating certificates with DSA public keys in crypto/x509

- Severity: High 7.5
- Published: Oct 29, 2025
- Affected: fixed in 1.24.8; from 1.25.0, fixed in 1.25.2.

### [CVE-2025-58186](https://cve.now/CVE-2025-58186): Lack of limit when parsing cookies can cause memory exhaustion in net/http

- Severity: Medium 5.3
- Published: Oct 29, 2025
- Affected: fixed in 1.24.8; from 1.25.0, fixed in 1.25.2.

### [CVE-2025-58185](https://cve.now/CVE-2025-58185): Parsing DER payload can cause memory exhaustion in encoding/asn1

- Severity: Medium 5.3
- Published: Oct 29, 2025
- Affected: fixed in 1.24.8; from 1.25.0, fixed in 1.25.2.

### [CVE-2025-47912](https://cve.now/CVE-2025-47912): Insufficient validation of bracketed IPv6 hostnames in net/url

- Severity: Medium 5.3
- Published: Oct 29, 2025
- Affected: fixed in 1.24.8; from 1.25.0, fixed in 1.25.2.

### [CVE-2025-61723](https://cve.now/CVE-2025-61723): Quadratic complexity when parsing some invalid inputs in encoding/pem

- Severity: High 7.5
- Published: Oct 29, 2025
- Affected: fixed in 1.24.8; from 1.25.0, fixed in 1.25.2.

### [CVE-2025-58189](https://cve.now/CVE-2025-58189): ALPN negotiation error contains attacker controlled information in crypto/tls

- Severity: Medium 5.3
- Published: Oct 29, 2025
- Affected: fixed in 1.24.8; from 1.25.0, fixed in 1.25.2.

### [CVE-2025-58187](https://cve.now/CVE-2025-58187): Quadratic complexity when checking name constraints in crypto/x509

- Severity: High 7.5
- Published: Oct 29, 2025
- Affected: fixed in 1.24.9; from 1.25.0, fixed in 1.25.3.

### [CVE-2025-61725](https://cve.now/CVE-2025-61725): Excessive CPU consumption in ParseAddress in net/mail

- Severity: High 7.5
- Published: Oct 29, 2025
- Affected: fixed in 1.24.8; from 1.25.0, fixed in 1.25.2.

### [CVE-2025-47910](https://cve.now/CVE-2025-47910): CrossOriginProtection insecure bypass patterns not limited to exact matches in net/http

- Severity: Medium 5.4
- Published: Sep 22, 2025
- Affected: from 1.25.0, fixed in 1.25.1.

### [CVE-2025-47906](https://cve.now/CVE-2025-47906): Unexpected paths returned from LookPath in os/exec

- Severity: Medium 6.5
- Published: Sep 18, 2025
- Affected: fixed in 1.23.12; from 1.24.0, fixed in 1.24.6.

### [CVE-2025-47907](https://cve.now/CVE-2025-47907): Incorrect results returned from Rows.Scan in database/sql

- Severity: High 7.0
- Published: Aug 7, 2025
- Affected: fixed in 1.23.12; from 1.24.0, fixed in 1.24.6.

### [CVE-2025-0913](https://cve.now/CVE-2025-0913): Inconsistent handling of O\_CREATE|O\_EXCL on Unix and Windows in os in syscall

- Severity: Medium 5.5
- Published: Jun 11, 2025
- Affected: fixed in 1.23.10; from 1.24.0-0, fixed in 1.24.4.

### [CVE-2025-4673](https://cve.now/CVE-2025-4673): Sensitive headers not cleared on cross-origin redirect in net/http

- Severity: Medium 6.8
- Published: Jun 11, 2025
- Affected: fixed in 1.23.10; from 1.24.0-0, fixed in 1.24.4.

### [CVE-2025-22874](https://cve.now/CVE-2025-22874): Usage of ExtKeyUsageAny disables policy validation in crypto/x509

- Severity: High 7.5
- Published: Jun 11, 2025
- Affected: from 1.24.0-0, fixed in 1.24.4.

### [CVE-2025-22871](https://cve.now/CVE-2025-22871): Request smuggling due to acceptance of invalid chunked data in net/http

- Severity: Critical 9.1
- Published: Apr 8, 2025
- Affected: fixed in 1.23.8; from 1.24.0-0, fixed in 1.24.2.

### [CVE-2025-22870](https://cve.now/CVE-2025-22870): HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net

- Severity: Medium 4.4
- Published: Mar 12, 2025
- Affected: fixed in 1.23.7; from 1.24.0-0, fixed in 1.24.1.

### [CVE-2025-22866](https://cve.now/CVE-2025-22866): Timing sidechannel for P-256 on ppc64le in crypto/internal/nistec

- Severity: Medium 4.0
- Published: Feb 6, 2025
- Affected: fixed in 1.22.12; from 1.23.0-0, fixed in 1.23.6; from 1.24.0-0, fixed in 1.24.0-rc.3.

### [CVE-2025-22865](https://cve.now/CVE-2025-22865): ParsePKCS1PrivateKey panic with partial keys in crypto/x509

- Severity: High 7.5
- Published: Jan 28, 2025
- Affected: from 1.24.0-0, fixed in 1.24.0-rc.2.

### [CVE-2024-45336](https://cve.now/CVE-2024-45336): Sensitive headers incorrectly sent after cross-domain redirect in net/http

- Severity: Medium 6.1
- Published: Jan 28, 2025
- Affected: fixed in 1.22.11; from 1.23.0-0, fixed in 1.23.5; from 1.24.0-0, fixed in 1.24.0-rc.2.

### [CVE-2024-45341](https://cve.now/CVE-2024-45341): Usage of IPv6 zone IDs can bypass URI name constraints in crypto/x509

- Severity: Medium 6.1
- Published: Jan 28, 2025
- Affected: fixed in 1.22.11; from 1.23.0-0, fixed in 1.23.5; from 1.24.0-0, fixed in 1.24.0-rc.2.

### [CVE-2024-34158](https://cve.now/CVE-2024-34158): Stack exhaustion in Parse in go/build/constraint

- Severity: High 7.5
- Published: Sep 6, 2024
- Affected: fixed in 1.22.7; from 1.23.0-0, fixed in 1.23.1.

### [CVE-2024-34156](https://cve.now/CVE-2024-34156): Stack exhaustion in Decoder.Decode in encoding/gob

- Severity: High 7.5
- Published: Sep 6, 2024
- Affected: fixed in 1.22.7; from 1.23.0-0, fixed in 1.23.1.

### [CVE-2024-34155](https://cve.now/CVE-2024-34155): Stack exhaustion in all Parse functions in go/parser

- Severity: Medium 4.3
- Published: Sep 6, 2024
- Affected: fixed in 1.22.7; from 1.23.0-0, fixed in 1.23.1.

### [CVE-2024-24791](https://cve.now/CVE-2024-24791): Denial of service due to improper 100-continue handling in net/http

- Severity: High 7.5
- Published: Jul 2, 2024
- Affected: fixed in 1.21.12; from 1.22.0-0, fixed in 1.22.5.

### [CVE-2024-24789](https://cve.now/CVE-2024-24789): Mishandling of corrupt central directory record in archive/zip

- Severity: Medium 5.3
- Published: Jun 5, 2024
- Affected: fixed in 1.21.11; from 1.22.0-0, fixed in 1.22.4.

### [CVE-2024-24790](https://cve.now/CVE-2024-24790): Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses in net/netip

- Severity: Critical 9.8
- Published: Jun 5, 2024
- Affected: fixed in 1.21.11; from 1.22.0-0, fixed in 1.22.4.

### [CVE-2024-24788](https://cve.now/CVE-2024-24788): Malformed DNS message can cause infinite loop in net

- Severity: Medium 5.9
- Published: May 8, 2024
- Affected: from 1.22.0-0, fixed in 1.22.3.

### [CVE-2023-45288](https://cve.now/CVE-2023-45288): HTTP/2 CONTINUATION flood in net/http

- Severity: High 7.5
- Published: Apr 4, 2024
- Affected: fixed in 1.21.9; from 1.22.0-0, fixed in 1.22.2.

### [CVE-2024-24785](https://cve.now/CVE-2024-24785): Errors returned from JSON marshaling may break template escaping in html/template

- Severity: Medium 5.4
- Published: Mar 5, 2024
- Affected: fixed in 1.21.8; from 1.22.0-0, fixed in 1.22.1.

### [CVE-2024-24784](https://cve.now/CVE-2024-24784): Comments in display names are incorrectly handled in net/mail

- Severity: High 7.5
- Published: Mar 5, 2024
- Affected: fixed in 1.21.8; from 1.22.0-0, fixed in 1.22.1.

### [CVE-2023-45289](https://cve.now/CVE-2023-45289): Incorrect forwarding of sensitive headers and cookies on HTTP redirect in net/http

- Severity: Medium 4.3
- Published: Mar 5, 2024
- Affected: fixed in 1.21.8; from 1.22.0-0, fixed in 1.22.1.

### [CVE-2023-45290](https://cve.now/CVE-2023-45290): Memory exhaustion in multipart form parsing in net/textproto and net/http

- Severity: Medium 6.5
- Published: Mar 5, 2024
- Affected: fixed in 1.21.8; from 1.22.0-0, fixed in 1.22.1.

### [CVE-2024-24783](https://cve.now/CVE-2024-24783): Verify panics on certificates with an unknown public key algorithm in crypto/x509

- Severity: Medium 5.9
- Published: Mar 5, 2024
- Affected: fixed in 1.21.8; from 1.22.0-0, fixed in 1.22.1.

### [CVE-2023-39326](https://cve.now/CVE-2023-39326): Denial of service via chunk extensions in net/http

- Severity: Unrated
- Published: Dec 6, 2023
- Affected: fixed in 1.20.12; from 1.21.0-0, fixed in 1.21.5.

### [CVE-2023-45287](https://cve.now/CVE-2023-45287): Before Go 1.20, the RSA based key exchange methods in crypto/tls may exhibit a timing side channel

- Severity: Unrated
- Published: Dec 5, 2023
- Affected: fixed in 1.20.0.

### [CVE-2023-45284](https://cve.now/CVE-2023-45284): Incorrect detection of reserved device names on Windows in path/filepath

- Severity: Medium 5.3
- Published: Nov 9, 2023
- Affected: fixed in 1.20.11; from 1.21.0-0, fixed in 1.21.4.

### [CVE-2023-45283](https://cve.now/CVE-2023-45283): Insecure parsing of Windows paths with a \\??\\ prefix in path/filepath

- Severity: Unrated
- Published: Nov 9, 2023
- Affected: fixed in 1.20.11; from 1.21.0-0, fixed in 1.21.4; from 1.20.11, fixed in 1.20.12; from 1.21.4, fixed in 1.21.5.

### [CVE-2023-39325](https://cve.now/CVE-2023-39325): HTTP/2 rapid reset can cause excessive work in net/http

- Severity: Unrated
- Published: Oct 11, 2023
- Affected: fixed in 1.20.10; from 1.21.0-0, fixed in 1.21.3.

### [CVE-2023-39322](https://cve.now/CVE-2023-39322): Memory exhaustion in QUIC connection handling in crypto/tls

- Severity: Unrated
- Published: Sep 8, 2023
- Affected: from 1.21.0-0, fixed in 1.21.1.

### [CVE-2023-39321](https://cve.now/CVE-2023-39321): Panic when processing post-handshake message on QUIC connections in crypto/tls

- Severity: Unrated
- Published: Sep 8, 2023
- Affected: from 1.21.0-0, fixed in 1.21.1.

### [CVE-2023-39319](https://cve.now/CVE-2023-39319): Improper handling of special tags within script contexts in html/template

- Severity: Unrated
- Published: Sep 8, 2023
- Affected: fixed in 1.20.8; from 1.21.0-0, fixed in 1.21.1.

### [CVE-2023-39318](https://cve.now/CVE-2023-39318): Improper handling of HTML-like comments in script contexts in html/template

- Severity: Unrated
- Published: Sep 8, 2023
- Affected: fixed in 1.20.8; from 1.21.0-0, fixed in 1.21.1.

### [CVE-2023-29409](https://cve.now/CVE-2023-29409): Large RSA keys can cause high CPU usage in crypto/tls

- Severity: Unrated
- Published: Aug 2, 2023
- Affected: fixed in 1.19.12; from 1.20.0-0, fixed in 1.20.7; from 1.21.0-0, fixed in 1.21.0-rc.4.

### [CVE-2023-29406](https://cve.now/CVE-2023-29406): Insufficient sanitization of Host header in net/http

- Severity: Unrated
- Published: Jul 11, 2023
- Affected: fixed in 1.19.11; from 1.20.0-0, fixed in 1.20.6.

### [CVE-2023-29403](https://cve.now/CVE-2023-29403): Unsafe behavior in setuid/setgid binaries in runtime

- Severity: High 7.8
- Published: Jun 8, 2023
- Affected: fixed in 1.19.10; from 1.20.0-0, fixed in 1.20.5.

### [CVE-2023-24539](https://cve.now/CVE-2023-24539): Improper sanitization of CSS values in html/template

- Severity: High 7.3
- Published: May 11, 2023
- Affected: fixed in 1.19.9; from 1.20.0-0, fixed in 1.20.4.

### [CVE-2023-24540](https://cve.now/CVE-2023-24540): Improper handling of JavaScript whitespace in html/template

- Severity: Critical 9.8
- Published: May 11, 2023
- Affected: fixed in 1.19.9; from 1.20.0-0, fixed in 1.20.4.

### [CVE-2023-29400](https://cve.now/CVE-2023-29400): Improper handling of empty HTML attributes in html/template

- Severity: High 7.3
- Published: May 11, 2023
- Affected: fixed in 1.19.9; from 1.20.0-0, fixed in 1.20.4.

### [CVE-2023-24537](https://cve.now/CVE-2023-24537): Infinite loop in parsing in go/scanner

- Severity: High 7.5
- Published: Apr 6, 2023
- Affected: fixed in 1.19.8; from 1.20.0-0, fixed in 1.20.3.

### [CVE-2023-24538](https://cve.now/CVE-2023-24538): Backticks not treated as string delimiters in html/template

- Severity: Critical 9.8
- Published: Apr 6, 2023
- Affected: fixed in 1.19.8; from 1.20.0-0, fixed in 1.20.3.

### [CVE-2023-24534](https://cve.now/CVE-2023-24534): Excessive memory allocation in net/http and net/textproto

- Severity: High 7.5
- Published: Apr 6, 2023
- Affected: fixed in 1.19.8; from 1.20.0-0, fixed in 1.20.3.

### [CVE-2023-24536](https://cve.now/CVE-2023-24536): Excessive resource consumption in net/http, net/textproto and mime/multipart

- Severity: High 7.5
- Published: Apr 6, 2023
- Affected: fixed in 1.19.8; from 1.20.0-0, fixed in 1.20.3.

### [CVE-2023-24532](https://cve.now/CVE-2023-24532): Incorrect calculation on P256 curves in crypto/internal/nistec

- Severity: Unrated
- Published: Mar 8, 2023
- Affected: fixed in 1.19.7; from 1.20.0-0, fixed in 1.20.2.

### [CVE-2022-41723](https://cve.now/CVE-2022-41723): Denial of service via crafted HTTP/2 stream in net/http and golang.org/x/net

- Severity: High 7.5
- Published: Feb 28, 2023
- Affected: fixed in 1.19.6; from 1.20.0-0, fixed in 1.20.1.

### [CVE-2022-41724](https://cve.now/CVE-2022-41724): Panic on large handshake records in crypto/tls

- Severity: Unrated
- Published: Feb 28, 2023
- Affected: fixed in 1.19.6; from 1.20.0-0, fixed in 1.20.1.

### [CVE-2022-41725](https://cve.now/CVE-2022-41725): Excessive resource consumption in mime/multipart

- Severity: Unrated
- Published: Feb 28, 2023
- Affected: fixed in 1.19.6; from 1.20.0-0, fixed in 1.20.1.

### [CVE-2022-41722](https://cve.now/CVE-2022-41722): Path traversal on Windows in path/filepath

- Severity: Unrated
- Published: Feb 28, 2023
- Affected: fixed in 1.19.6; from 1.20.0-0, fixed in 1.20.1.

### [CVE-2022-41717](https://cve.now/CVE-2022-41717): Excessive memory growth in net/http and golang.org/x/net/http2

- Severity: Unrated
- Published: Dec 8, 2022
- Affected: fixed in 1.18.9; from 1.19.0-0, fixed in 1.19.4.

### [CVE-2022-41720](https://cve.now/CVE-2022-41720): Restricted file access on Windows in os and net/http

- Severity: High 7.5
- Published: Dec 7, 2022
- Affected: fixed in 1.18.9; from 1.19.0-0, fixed in 1.19.4.

### [CVE-2022-41716](https://cve.now/CVE-2022-41716): Unsanitized NUL in environment variables on Windows in syscall and os/exec

- Severity: Medium 6.3
- Published: Nov 2, 2022
- Affected: fixed in 1.18.8; from 1.19.0-0, fixed in 1.19.3.

### [CVE-2022-41715](https://cve.now/CVE-2022-41715): Memory exhaustion when compiling regular expressions in regexp/syntax

- Severity: Unrated
- Published: Oct 14, 2022
- Affected: fixed in 1.18.7; from 1.19.0-0, fixed in 1.19.2.

### [CVE-2022-2880](https://cve.now/CVE-2022-2880): Incorrect sanitization of forwarded query parameters in net/http/httputil

- Severity: Unrated
- Published: Oct 14, 2022
- Affected: fixed in 1.18.7; from 1.19.0-0, fixed in 1.19.2.

### [CVE-2022-2879](https://cve.now/CVE-2022-2879): Unbounded memory consumption when reading headers in archive/tar

- Severity: Unrated
- Published: Oct 14, 2022
- Affected: fixed in 1.18.7; from 1.19.0-0, fixed in 1.19.2.

### [CVE-2022-32190](https://cve.now/CVE-2022-32190): Failure to strip relative path components in net/url

- Severity: Unrated
- Published: Sep 13, 2022
- Affected: from 1.19.0-0, fixed in 1.19.1.

### [CVE-2022-27664](https://cve.now/CVE-2022-27664): In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers can cause a denial of service because an HTTP/2 connection can hang…

- Severity: Unrated
- Published: Sep 6, 2022
- Affected: fixed in 1.18.6; from 1.19.0-0, fixed in 1.19.1.

### [CVE-2022-32148](https://cve.now/CVE-2022-32148): Exposure of client IP addresses in net/http

- Severity: Medium 6.5
- Published: Aug 9, 2022
- Affected: fixed in 1.17.12; from 1.18.0-0, fixed in 1.18.4.

### [CVE-2022-1962](https://cve.now/CVE-2022-1962): Stack exhaustion due to deeply nested types in go/parser

- Severity: Medium 5.5
- Published: Aug 9, 2022
- Affected: fixed in 1.17.12; from 1.18.0-0, fixed in 1.18.4.

### [CVE-2022-30580](https://cve.now/CVE-2022-30580): Empty Cmd.Path can trigger unintended binary in os/exec on Windows

- Severity: High 7.8
- Published: Aug 9, 2022
- Affected: fixed in 1.17.11; from 1.18.0-0, fixed in 1.18.3.

### [CVE-2022-32189](https://cve.now/CVE-2022-32189): Panic when decoding Float and Rat types in math/big

- Severity: Unrated
- Published: Aug 9, 2022
- Affected: fixed in 1.17.13; from 1.18.0-0, fixed in 1.18.5.

### [CVE-2022-30629](https://cve.now/CVE-2022-30629): Session tickets lack random ticket\_age\_add in crypto/tls

- Severity: Low 3.1
- Published: Aug 9, 2022
- Affected: fixed in 1.17.11; from 1.18.0-0, fixed in 1.18.3.

### [CVE-2022-30630](https://cve.now/CVE-2022-30630): Stack exhaustion in Glob on certain paths in io/fs

- Severity: High 7.5
- Published: Aug 9, 2022
- Affected: fixed in 1.17.12; from 1.18.0-0, fixed in 1.18.4.

### [CVE-2022-1705](https://cve.now/CVE-2022-1705): Improper sanitization of Transfer-Encoding headers in net/http

- Severity: Medium 6.5
- Published: Aug 9, 2022
- Affected: fixed in 1.17.12; from 1.18.0-0, fixed in 1.18.4.

### [CVE-2022-30631](https://cve.now/CVE-2022-30631): Stack exhaustion when reading certain archives in compress/gzip

- Severity: High 7.5
- Published: Aug 9, 2022
- Affected: fixed in 1.17.12; from 1.18.0-0, fixed in 1.18.4.

### [CVE-2022-30633](https://cve.now/CVE-2022-30633): Stack exhaustion when unmarshaling certain documents in encoding/xml

- Severity: High 7.5
- Published: Aug 9, 2022
- Affected: fixed in 1.17.12; from 1.18.0-0, fixed in 1.18.4.

### [CVE-2022-30635](https://cve.now/CVE-2022-30635): Stack exhaustion when decoding certain messages in encoding/gob

- Severity: High 7.5
- Published: Aug 9, 2022
- Affected: fixed in 1.17.12; from 1.18.0-0, fixed in 1.18.4.

### [CVE-2022-30632](https://cve.now/CVE-2022-30632): Stack exhaustion on crafted paths in path/filepath

- Severity: Unrated
- Published: Aug 9, 2022
- Affected: fixed in 1.17.12; from 1.18.0-0, fixed in 1.18.4.

### [CVE-2022-29804](https://cve.now/CVE-2022-29804): Path traversal via Clean on Windows in path/filepath

- Severity: Unrated
- Published: Aug 9, 2022
- Affected: fixed in 1.17.11; from 1.18.0-0, fixed in 1.18.3.

### [CVE-2022-28131](https://cve.now/CVE-2022-28131): Stack exhaustion from deeply nested XML documents in encoding/xml

- Severity: Unrated
- Published: Aug 9, 2022
- Affected: fixed in 1.17.12; from 1.18.0-0, fixed in 1.18.4.

### [CVE-2022-30634](https://cve.now/CVE-2022-30634): Indefinite hang with large buffers on Windows in crypto/rand

- Severity: Unrated
- Published: Jul 15, 2022
- Affected: fixed in 1.17.11; from 1.18.0-0, fixed in 1.18.3.

### [CVE-2022-29526](https://cve.now/CVE-2022-29526): Go before 1.17.10 and 1.18.x before 1.18.2 has Incorrect Privilege Assignment.

- Severity: Unrated
- Published: Jun 22, 2022
- Affected: fixed in 1.17.10; from 1.18.0-0, fixed in 1.18.2.

### [CVE-2022-28327](https://cve.now/CVE-2022-28327): The generic P-256 feature in crypto/elliptic in Go before 1.17.9 and 1.18.x before 1.18.1 allows a panic via long scalar input.

- Severity: Unrated
- Published: Apr 20, 2022
- Affected: fixed in 1.17.9; from 1.18.0-0, fixed in 1.18.1.

### [CVE-2022-27536](https://cve.now/CVE-2022-27536): Certificate.Verify in crypto/x509 in Go 1.18.x before 1.18.1 can be caused to panic on macOS when presented with certain malformed…

- Severity: Unrated
- Published: Apr 20, 2022
- Affected: from 1.18.0-0, fixed in 1.18.1.

### [CVE-2022-24675](https://cve.now/CVE-2022-24675): encoding/pem in Go before 1.17.9 and 1.18.x before 1.18.1 has a Decode stack overflow via a large amount of PEM data.

- Severity: Unrated
- Published: Apr 20, 2022
- Affected: fixed in 1.17.9; from 1.18.0-0, fixed in 1.18.1.

### [CVE-2022-24921](https://cve.now/CVE-2022-24921): regexp.Compile in Go before 1.16.15 and 1.17.x before 1.17.8 allows stack exhaustion via a deeply nested expression.

- Severity: Unrated
- Published: Mar 5, 2022
- Affected: fixed in 1.16.15; from 1.17.0-0, fixed in 1.17.8.

### [CVE-2022-23772](https://cve.now/CVE-2022-23772): Rat.SetString in math/big in Go before 1.16.14 and 1.17.x before 1.17.7 has an overflow that can lead to Uncontrolled Memory Consumption.

- Severity: Unrated
- Published: Feb 11, 2022
- Affected: fixed in 1.16.14; from 1.17.0-0, fixed in 1.17.7.

### [CVE-2022-23806](https://cve.now/CVE-2022-23806): Curve.IsOnCurve in crypto/elliptic in Go before 1.16.14 and 1.17.x before 1.17.7 can incorrectly return true in situations with a big.Int…

- Severity: Unrated
- Published: Feb 11, 2022
- Affected: fixed in 1.16.14; from 1.17.0-0, fixed in 1.17.7.

### [CVE-2021-39293](https://cve.now/CVE-2021-39293): In archive/zip in Go before 1.16.8 and 1.17.x before 1.17.1, a crafted archive header (falsely designating that many files are present)…

- Severity: Unrated
- Published: Jan 24, 2022
- Affected: fixed in 1.16.8; from 1.17.0-0, fixed in 1.17.1.

### [CVE-2021-44717](https://cve.now/CVE-2021-44717): Go before 1.16.12 and 1.17.x before 1.17.5 on UNIX allows write operations to an unintended file or unintended network connection as a…

- Severity: Unrated
- Published: Jan 1, 2022
- Affected: fixed in 1.16.12; from 1.17.0-0, fixed in 1.17.5.

### [CVE-2021-44716](https://cve.now/CVE-2021-44716): net/http in Go before 1.16.12 and 1.17.x before 1.17.5 allows uncontrolled memory consumption in the header canonicalization cache via…

- Severity: Unrated
- Published: Jan 1, 2022
- Affected: fixed in 1.16.12; from 1.17.0-0, fixed in 1.17.5.

### [CVE-2021-41772](https://cve.now/CVE-2021-41772): Go before 1.16.10 and 1.17.x before 1.17.3 allows an archive/zip Reader.Open panic via a crafted ZIP archive containing an invalid name or…

- Severity: Unrated
- Published: Nov 8, 2021
- Affected: fixed in 1.16.10; from 1.17.0-0, fixed in 1.17.3.

### [CVE-2021-41771](https://cve.now/CVE-2021-41771): ImportedSymbols in debug/macho (for Open or OpenFat) in Go before 1.16.10 and 1.17.x before 1.17.3 Accesses a Memory Location After the…

- Severity: Unrated
- Published: Nov 8, 2021
- Affected: fixed in 1.16.10; from 1.17.0-0, fixed in 1.17.3.

### [CVE-2021-36221](https://cve.now/CVE-2021-36221): Go before 1.15.15 and 1.16.x before 1.16.7 has a race condition that can lead to a net/http/httputil ReverseProxy panic upon an…

- Severity: Unrated
- Published: Aug 8, 2021
- Affected: fixed in 1.15.15; from 1.16.0-0, fixed in 1.16.7.

### [CVE-2021-33198](https://cve.now/CVE-2021-33198): In Go before 1.15.13 and 1.16.x before 1.16.5, there can be a panic for a large exponent to the math/big.Rat SetString or UnmarshalText…

- Severity: Unrated
- Published: Aug 2, 2021
- Affected: fixed in 1.15.13; from 1.16.0-0, fixed in 1.16.5.

### [CVE-2021-33197](https://cve.now/CVE-2021-33197): In Go before 1.15.13 and 1.16.x before 1.16.5, some configurations of ReverseProxy (from net/http/httputil) result in a situation where an…

- Severity: Unrated
- Published: Aug 2, 2021
- Affected: fixed in 1.15.13; from 1.16.0-0, fixed in 1.16.5.

### [CVE-2021-33195](https://cve.now/CVE-2021-33195): Go before 1.15.13 and 1.16.x before 1.16.5 has functions for DNS lookups that do not validate replies from DNS servers, and thus a return…

- Severity: Unrated
- Published: Aug 2, 2021
- Affected: fixed in 1.15.13; from 1.16.0-0, fixed in 1.16.5.

### [CVE-2021-33196](https://cve.now/CVE-2021-33196): In archive/zip in Go before 1.15.13 and 1.16.x before 1.16.5, a crafted file count (in an archive's header) can cause a NewReader or…

- Severity: Unrated
- Published: Aug 2, 2021
- Affected: fixed in 1.15.13; from 1.16.0-0, fixed in 1.16.5.

### [CVE-2021-34558](https://cve.now/CVE-2021-34558): The crypto/tls package of Go through 1.16.5 does not properly assert that the type of public key in an X.509 certificate matches the…

- Severity: Unrated
- Published: Jul 15, 2021
- Affected: fixed in 1.15.14; from 1.16.0-0, fixed in 1.16.6.

### [CVE-2021-31525](https://cve.now/CVE-2021-31525): net/http in Go before 1.15.12 and 1.16.x before 1.16.4 allows remote attackers to cause a denial of service (panic) via a large header to…

- Severity: Unrated
- Published: May 27, 2021
- Affected: fixed in 1.15.12; from 1.16.0-0, fixed in 1.16.4.

### [CVE-2021-27919](https://cve.now/CVE-2021-27919): archive/zip in Go 1.16.x before 1.16.1 allows attackers to cause a denial of service (panic) upon attempted use of the Reader.Open API for…

- Severity: Unrated
- Published: Mar 11, 2021
- Affected: from 1.16.0-0, fixed in 1.16.1.

### [CVE-2021-27918](https://cve.now/CVE-2021-27918): encoding/xml in Go before 1.15.9 and 1.16.x before 1.16.1 has an infinite loop if a custom TokenReader (for xml.NewTokenDecoder) returns…

- Severity: Unrated
- Published: Mar 10, 2021
- Affected: fixed in 1.15.9; from 1.16.0-0, fixed in 1.16.1.

### [CVE-2021-3114](https://cve.now/CVE-2021-3114): In Go before 1.14.14 and 1.15.x before 1.15.7, crypto/elliptic/p224.go can generate incorrect outputs, related to an underflow of the…

- Severity: Unrated
- Published: Jan 26, 2021
- Affected: fixed in 1.14.14; from 1.15.0-0, fixed in 1.15.7.

### [CVE-2020-28362](https://cve.now/CVE-2020-28362): Go before 1.14.12 and 1.15.x before 1.15.4 allows Denial of Service.

- Severity: Unrated
- Published: Nov 18, 2020
- Affected: from 1.14.0-0, fixed in 1.14.12; from 1.15.0-0, fixed in 1.15.5.

### [CVE-2020-24553](https://cve.now/CVE-2020-24553): Go before 1.14.8 and 1.15.x before 1.15.1 allows XSS because text/html is the default for CGI/FCGI handlers that lack a Content-Type header.

- Severity: Unrated
- Published: Sep 2, 2020
- Affected: fixed in 1.14.8; from 1.15.0-0, fixed in 1.15.1.

### [CVE-2020-16845](https://cve.now/CVE-2020-16845): Go before 1.13.15 and 14.x before 1.14.7 can have an infinite read loop in ReadUvarint and ReadVarint in encoding/binary via invalid inputs.

- Severity: Unrated
- Published: Aug 6, 2020
- Affected: fixed in 1.13.15; from 1.14.0-0, fixed in 1.14.7.

### [CVE-2020-14039](https://cve.now/CVE-2020-14039): In Go before 1.13.13 and 1.14.x before 1.14.5, Certificate.Verify may lack a check on the VerifyOptions.KeyUsages EKU requirements (if…

- Severity: Unrated
- Published: Jul 17, 2020
- Affected: fixed in 1.13.13; from 1.14.0-0, fixed in 1.14.5.

### [CVE-2020-15586](https://cve.now/CVE-2020-15586): Go before 1.13.13 and 1.14.x before 1.14.5 has a data race in some net/http servers, as demonstrated by the httputil.ReverseProxy Handler…

- Severity: Unrated
- Published: Jul 17, 2020
- Affected: fixed in 1.13.13; from 1.14.0-0, fixed in 1.14.5.

### [CVE-2020-7919](https://cve.now/CVE-2020-7919): Go before 1.12.16 and 1.13.x before 1.13.7 (and the crypto/cryptobyte package before 0.0.0-20200124225646-8b5121be2f68 for Go) allows…

- Severity: Unrated
- Published: Mar 16, 2020
- Affected: fixed in 1.12.16; from 1.13.0-0, fixed in 1.13.7.

### [CVE-2015-5741](https://cve.now/CVE-2015-5741): The net/http library in net/http/transfer.go in Go before 1.4.3 does not properly parse HTTP headers, which allows remote attackers to…

- Severity: Unrated
- Published: Feb 8, 2020
- Affected: fixed in 1.4.3.

### [CVE-2020-0601](https://cve.now/CVE-2020-0601): A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) certificates.An attac

- Severity: High 8.1 · KEV
- Published: Jan 14, 2020
- Affected: fixed in 1.12.16; from 1.13.0-0, fixed in 1.13.7.

### [CVE-2019-17596](https://cve.now/CVE-2019-17596): Go before 1.12.11 and 1.3.x before 1.13.2 can panic upon an attempt to process network traffic containing an invalid DSA public key.

- Severity: Unrated
- Published: Oct 24, 2019
- Affected: fixed in 1.12.11; from 1.13.0-0, fixed in 1.13.2.

### [CVE-2019-16276](https://cve.now/CVE-2019-16276): Go before 1.12.10 and 1.13.x before 1.13.1 allow HTTP Request Smuggling.

- Severity: Unrated
- Published: Sep 30, 2019
- Affected: fixed in 1.12.10; from 1.13.0-0, fixed in 1.13.1.

### [CVE-2019-14809](https://cve.now/CVE-2019-14809): net/url in Go before 1.11.13 and 1.12.x before 1.12.8 mishandles malformed hosts in URLs, leading to an authorization bypass in some…

- Severity: Unrated
- Published: Aug 13, 2019
- Affected: fixed in 1.11.13; from 1.12.0-0, fixed in 1.12.8.

### [CVE-2019-9512](https://cve.now/CVE-2019-9512): Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service

- Severity: High 7.5
- Published: Aug 13, 2019
- Affected: fixed in 1.11.13; from 1.12.0-0, fixed in 1.12.8.

### [CVE-2019-9514](https://cve.now/CVE-2019-9514): Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service

- Severity: High 7.5
- Published: Aug 13, 2019
- Affected: fixed in 1.11.13; from 1.12.0-0, fixed in 1.12.8.

### [CVE-2019-9634](https://cve.now/CVE-2019-9634): Go through 1.12 on Windows misuses certain LoadLibrary functionality, leading to DLL injection.

- Severity: Unrated
- Published: Mar 8, 2019
- Affected: fixed in 1.11.10; from 1.12.0-0, fixed in 1.12.2.

### [CVE-2019-6486](https://cve.now/CVE-2019-6486): Go before 1.10.8 and 1.11.x before 1.11.5 mishandles P-521 and P-384 elliptic curves, which allows attackers to cause a denial of service…

- Severity: Unrated
- Published: Jan 24, 2019
- Affected: fixed in 1.10.8; from 1.11.0-0, fixed in 1.11.5.

### [CVE-2018-16875](https://cve.now/CVE-2018-16875): The crypto/x509 package of Go before 1.10.6 and 1.11.x before 1.11.3 does not limit the amount of work performed for each chain…

- Severity: Medium 5.9
- Published: Dec 14, 2018
- Affected: fixed in 1.10.6; from 1.11.0-0, fixed in 1.11.3.

### [CVE-2015-5740](https://cve.now/CVE-2015-5740): The net/http library in net/http/transfer.go in Go before 1.4.3 does not properly parse HTTP headers, which allows remote attackers to…

- Severity: Unrated
- Published: Oct 18, 2017
- Affected: fixed in 1.4.3.

### [CVE-2015-5739](https://cve.now/CVE-2015-5739): The net/http library in net/textproto/reader.go in Go before 1.4.3 does not properly parse HTTP header keys, which allows remote attackers…

- Severity: Unrated
- Published: Oct 18, 2017
- Affected: fixed in 1.4.3.

### [CVE-2017-15042](https://cve.now/CVE-2017-15042): An unintended cleartext issue exists in Go before 1.8.4 and 1.9.x before 1.9.1.

- Severity: Unrated
- Published: Oct 5, 2017
- Affected: from 1.1.0-0, fixed in 1.8.4; from 1.9.0-0, fixed in 1.9.1.

### [CVE-2017-1000098](https://cve.now/CVE-2017-1000098): The net/http package's Request.ParseMultipartForm method starts writing to temporary files once the request body size surpasses the given…

- Severity: Unrated
- Published: Oct 4, 2017
- Affected: fixed in 1.6.4; from 1.7.0-0, fixed in 1.7.4.

### [CVE-2017-1000097](https://cve.now/CVE-2017-1000097): On Darwin, user's trust preferences for root certificates were not honored.

- Severity: Unrated
- Published: Oct 4, 2017
- Affected: fixed in 1.6.4; from 1.7.0-0, fixed in 1.7.4.

### [CVE-2017-8932](https://cve.now/CVE-2017-8932): A bug in the standard library ScalarMult implementation of curve P-256 for amd64 architectures in Go before 1.7.6 and 1.8.x before 1.8.2…

- Severity: Unrated
- Published: Jul 6, 2017
- Affected: from 1.6.0-0, fixed in 1.7.6; from 1.8.0-0, fixed in 1.8.2.

### [CVE-2016-5386](https://cve.now/CVE-2016-5386): The net/http package in Go through 1.6 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not…

- Severity: Unrated
- Published: Jul 19, 2016
- Affected: fixed in 1.6.3.

### [CVE-2016-3959](https://cve.now/CVE-2016-3959): The Verify function in crypto/dsa/dsa.go in Go before 1.5.4 and 1.6.x before 1.6.1 does not properly check parameters passed to the big…

- Severity: Unrated
- Published: May 23, 2016
- Affected: fixed in 1.5.4; from 1.6.0-0, fixed in 1.6.1.

### [CVE-2016-3958](https://cve.now/CVE-2016-3958): Untrusted search path vulnerability in Go before 1.5.4 and 1.6.x before 1.6.1 on Windows allows local users to gain privileges via a…

- Severity: Unrated
- Published: May 23, 2016
- Affected: fixed in 1.5.4; from 1.6.0-0, fixed in 1.6.1.

### [CVE-2015-8618](https://cve.now/CVE-2015-8618): The Int.Exp Montgomery code in the math/big library in Go 1.5.x before 1.5.3 mishandles carry propagation and produces incorrect output…

- Severity: Unrated
- Published: Jan 27, 2016
- Affected: from 1.5.0-0, fixed in 1.5.3.

### [CVE-2014-7189](https://cve.now/CVE-2014-7189): crpyto/tls in Go 1.1 before 1.3.2, when SessionTicketsDisabled is enabled, allows man-in-the-middle attackers to spoof clients via…

- Severity: Unrated
- Published: Oct 7, 2014
- Affected: from 1.1.0-0, fixed in 1.3.2.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/go/stdlib
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.