GO Standard Library vulnerabilities
135 CVEs and advisories name GO Standard Library as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-97054HTTP/1 server crash due to MaxBytesReader header race in net/http
- CVE-2026-111943Distrust compromised intermediate certificates in crypto/x509
- CVE-2026-97032HTTP/2 server crash due to HPACK encoder race in net/http
- CVE-2026-94439HTTP/1 server connection desynchronization after 2xx CONNECT response in net/http
- CVE-2026-78663Double flow control refund on HTTP/2 server streams in net/http
- CVE-2026-78669Excessive CPU consumption from repeated initial window changes in net/http
- CVE-2026-78660HTTP/2 transport accepts malformed framing-related headers in net/http
- CVE-2026-78667Lack of limit on size of parsed Range headers in net/http
- CVE-2026-94440Memory limit bypass when parsing MIME headers in net/textproto, mime/multipart
- CVE-2026-97031Reject malformed ECH outer extension references in crypto/tls
- CVE-2026-56866HTTP/1 client connection desynchronization after CONNECT rejection in net/http
- CVE-2026-56857Root.Mkdir(All) can follow junctions out of the root on Windows in os
- CVE-2026-78659HTTP/2 server memory exhaustion due to Trailer headers in net/http
- CVE-2026-97030Recognize yield as regexp preceder keyword in html/template
- CVE-2026-94448Reset context tracking on consecutive template expressions in html/template
- CVE-2026-56860Avoid quadratic complexity in resolvePath in net/url
- CVE-2026-56858Fix Javascript regexp context tracking in html/template
- CVE-2026-56862Limit handshake messages we are willing to accept post-handshake in crypto/tls
- CVE-2026-56853Apply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/http
- CVE-2026-56859Add recursion depth guard during decode in encoding/xml
- CVE-2026-33818Enforce maximum recursion depth in encoding/asn1
- CVE-2026-46600Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage
- CVE-2026-42505Invoking Encrypted Client Hello privacy leak in crypto/tls
- CVE-2026-39822Root escape via symlink plus trailing slash in os
- CVE-2026-42507Arbitrary inputs are included in errors without any escaping in net/textproto
- CVE-2026-42504Quadratic complexity in WordDecoder.DecodeHeader in mime
- CVE-2026-27145Inefficient candidate hostname parsing in crypto/x509
- CVE-2026-39821Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna
- CVE-2026-39820Quadratic string concatentation in consumeComment in net/mail
- CVE-2026-39823Bypass of meta content URL escaping causes XSS in html/template