# cve.now: GO Standard Library

The newest entries naming GO Standard Library as an affected vendor (up to 200), of 135 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-97054](https://cve.now/CVE-2026-97054.md): HTTP/1 server crash due to MaxBytesReader header race in net/http (no CVSS)
- [CVE-2026-111943](https://cve.now/CVE-2026-111943.md): Distrust compromised intermediate certificates in crypto/x509 (CVSS 6.8)
- [CVE-2026-97032](https://cve.now/CVE-2026-97032.md): HTTP/2 server crash due to HPACK encoder race in net/http (CVSS 7.5)
- [CVE-2026-94439](https://cve.now/CVE-2026-94439.md): HTTP/1 server connection desynchronization after 2xx CONNECT response in net/http (CVSS 7.5)
- [CVE-2026-78663](https://cve.now/CVE-2026-78663.md): Double flow control refund on HTTP/2 server streams in net/http (CVSS 9.1)
- [CVE-2026-78669](https://cve.now/CVE-2026-78669.md): Excessive CPU consumption from repeated initial window changes in net/http (CVSS 7.5)
- [CVE-2026-78660](https://cve.now/CVE-2026-78660.md): HTTP/2 transport accepts malformed framing-related headers in net/http (CVSS 7.5)
- [CVE-2026-78667](https://cve.now/CVE-2026-78667.md): Lack of limit on size of parsed Range headers in net/http (CVSS 7.5)
- [CVE-2026-94440](https://cve.now/CVE-2026-94440.md): Memory limit bypass when parsing MIME headers in net/textproto, mime/multipart (CVSS 7.5)
- [CVE-2026-97031](https://cve.now/CVE-2026-97031.md): Reject malformed ECH outer extension references in crypto/tls (CVSS 7.5)
- [CVE-2026-56866](https://cve.now/CVE-2026-56866.md): HTTP/1 client connection desynchronization after CONNECT rejection in net/http (CVSS 7.5)
- [CVE-2026-56857](https://cve.now/CVE-2026-56857.md): Root.Mkdir(All) can follow junctions out of the root on Windows in os (CVSS 9.8)
- [CVE-2026-78659](https://cve.now/CVE-2026-78659.md): HTTP/2 server memory exhaustion due to Trailer headers in net/http (CVSS 7.5)
- [CVE-2026-97030](https://cve.now/CVE-2026-97030.md): Recognize yield as regexp preceder keyword in html/template (CVSS 6.1)
- [CVE-2026-94448](https://cve.now/CVE-2026-94448.md): Reset context tracking on consecutive template expressions in html/template (CVSS 6.1)
- [CVE-2026-56860](https://cve.now/CVE-2026-56860.md): Avoid quadratic complexity in resolvePath in net/url (CVSS 5.9)
- [CVE-2026-56858](https://cve.now/CVE-2026-56858.md): Fix Javascript regexp context tracking in html/template (CVSS 6.1)
- [CVE-2026-56862](https://cve.now/CVE-2026-56862.md): Limit handshake messages we are willing to accept post-handshake in crypto/tls (CVSS 7.5)
- [CVE-2026-56853](https://cve.now/CVE-2026-56853.md): Apply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/http (CVSS 7.5)
- [CVE-2026-56859](https://cve.now/CVE-2026-56859.md): Add recursion depth guard during decode in encoding/xml (CVSS 7.5)
- [CVE-2026-33818](https://cve.now/CVE-2026-33818.md): Enforce maximum recursion depth in encoding/asn1 (CVSS 7.5)
- [CVE-2026-46600](https://cve.now/CVE-2026-46600.md): Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage (CVSS 7.5)
- [CVE-2026-42505](https://cve.now/CVE-2026-42505.md): Invoking Encrypted Client Hello privacy leak in crypto/tls (CVSS 5.3)
- [CVE-2026-39822](https://cve.now/CVE-2026-39822.md): Root escape via symlink plus trailing slash in os (CVSS 7.8)
- [CVE-2026-42507](https://cve.now/CVE-2026-42507.md): Arbitrary inputs are included in errors without any escaping in net/textproto (CVSS 5.3)
- [CVE-2026-42504](https://cve.now/CVE-2026-42504.md): Quadratic complexity in WordDecoder.DecodeHeader in mime (CVSS 7.5)
- [CVE-2026-27145](https://cve.now/CVE-2026-27145.md): Inefficient candidate hostname parsing in crypto/x509 (CVSS 6.5)
- [CVE-2026-39821](https://cve.now/CVE-2026-39821.md): Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna (CVSS 9.6)
- [CVE-2026-39820](https://cve.now/CVE-2026-39820.md): Quadratic string concatentation in consumeComment in net/mail (CVSS 7.5)
- [CVE-2026-39823](https://cve.now/CVE-2026-39823.md): Bypass of meta content URL escaping causes XSS in html/template (CVSS 6.1)
- [CVE-2026-33811](https://cve.now/CVE-2026-33811.md): Crash when handling long CNAME response in net (CVSS 7.5)
- [CVE-2026-39826](https://cve.now/CVE-2026-39826.md): Escaper bypass leads to XSS in html/template (CVSS 6.1)
- [CVE-2026-42499](https://cve.now/CVE-2026-42499.md): Quadratic string concatenation in consumePhrase in net/mail (CVSS 7.5)
- [CVE-2026-39825](https://cve.now/CVE-2026-39825.md): ReverseProxy forwards queries with more than urlmaxqueryparams parameters in net/http/httputil (CVSS 5.3)
- [CVE-2026-39836](https://cve.now/CVE-2026-39836.md): Panic in Dial and LookupPort when handling NUL byte on Windows in net (CVSS 7.5)
- [CVE-2026-33814](https://cve.now/CVE-2026-33814.md): Infinite loop in HTTP/2 transport when given bad SETTINGS\_MAX\_FRAME\_SIZE in net/http/internal/http2 in golang.org/x/net (CVSS 7.5)
- [CVE-2026-32280](https://cve.now/CVE-2026-32280.md): Unexpected work during chain building in crypto/x509 (CVSS 7.5)
- [CVE-2026-32281](https://cve.now/CVE-2026-32281.md): Inefficient policy validation in crypto/x509 (CVSS 7.5)
- [CVE-2026-32283](https://cve.now/CVE-2026-32283.md): Unauthenticated TLS 1.3 KeyUpdate record can cause persistent connection retention and DoS in crypto/tls (CVSS 7.5)
- [CVE-2026-32288](https://cve.now/CVE-2026-32288.md): Unbounded allocation for old GNU sparse in archive/tar (CVSS 5.5)
- [CVE-2026-33810](https://cve.now/CVE-2026-33810.md): Case-sensitive excludedSubtrees name constraints cause Auth Bypass in crypto/x509 (CVSS 7.5)
- [CVE-2026-32289](https://cve.now/CVE-2026-32289.md): JsBraceDepth Context Tracking Bugs (XSS) in html/template (CVSS 6.1)
- [CVE-2026-32282](https://cve.now/CVE-2026-32282.md): TOCTOU permits root escape on Linux via Root.Chmod in os in internal/syscall/unix (CVSS 6.4)
- [CVE-2026-27142](https://cve.now/CVE-2026-27142.md): URLs in meta content attribute actions are not escaped in html/template (CVSS 6.1)
- [CVE-2026-27139](https://cve.now/CVE-2026-27139.md): FileInfo can escape from a Root in os (CVSS 2.5)
- [CVE-2026-25679](https://cve.now/CVE-2026-25679.md): Incorrect parsing of IPv6 host literals in net/url (CVSS 7.5)
- [CVE-2026-27138](https://cve.now/CVE-2026-27138.md): Panic in name constraint checking for malformed certificates in crypto/x509 (CVSS 5.9)
- [CVE-2026-27137](https://cve.now/CVE-2026-27137.md): Incorrect enforcement of email constraints in crypto/x509 (CVSS 7.5)
- [CVE-2025-68121](https://cve.now/CVE-2025-68121.md): Unexpected session resumption in crypto/tls (CVSS 9.1)
- [CVE-2025-22873](https://cve.now/CVE-2025-22873.md): Improper access to parent directory of root in os (CVSS 3.8)
- [CVE-2025-61728](https://cve.now/CVE-2025-61728.md): Excessive CPU consumption when building archive index in archive/zip (CVSS 6.5)
- [CVE-2025-61726](https://cve.now/CVE-2025-61726.md): Memory exhaustion in query parameter parsing in net/url (CVSS 7.5)
- [CVE-2025-61730](https://cve.now/CVE-2025-61730.md): Handshake messages may be processed at the incorrect encryption level in crypto/tls (CVSS 5.3)
- [CVE-2025-61727](https://cve.now/CVE-2025-61727.md): Improper application of excluded DNS name constraints when verifying wildcard names in crypto/x509 (CVSS 6.5)
- [CVE-2025-61729](https://cve.now/CVE-2025-61729.md): Excessive resource consumption when printing error string for host certificate validation in crypto/x509 (CVSS 7.5)
- [CVE-2025-61724](https://cve.now/CVE-2025-61724.md): Excessive CPU consumption in Reader.ReadResponse in net/textproto (CVSS 5.3)
- [CVE-2025-58183](https://cve.now/CVE-2025-58183.md): Unbounded allocation when parsing GNU sparse map in archive/tar (CVSS 4.3)
- [CVE-2025-58188](https://cve.now/CVE-2025-58188.md): Panic when validating certificates with DSA public keys in crypto/x509 (CVSS 7.5)
- [CVE-2025-58186](https://cve.now/CVE-2025-58186.md): Lack of limit when parsing cookies can cause memory exhaustion in net/http (CVSS 5.3)
- [CVE-2025-58185](https://cve.now/CVE-2025-58185.md): Parsing DER payload can cause memory exhaustion in encoding/asn1 (CVSS 5.3)
- [CVE-2025-47912](https://cve.now/CVE-2025-47912.md): Insufficient validation of bracketed IPv6 hostnames in net/url (CVSS 5.3)
- [CVE-2025-61723](https://cve.now/CVE-2025-61723.md): Quadratic complexity when parsing some invalid inputs in encoding/pem (CVSS 7.5)
- [CVE-2025-58189](https://cve.now/CVE-2025-58189.md): ALPN negotiation error contains attacker controlled information in crypto/tls (CVSS 5.3)
- [CVE-2025-58187](https://cve.now/CVE-2025-58187.md): Quadratic complexity when checking name constraints in crypto/x509 (CVSS 7.5)
- [CVE-2025-61725](https://cve.now/CVE-2025-61725.md): Excessive CPU consumption in ParseAddress in net/mail (CVSS 7.5)
- [CVE-2025-47910](https://cve.now/CVE-2025-47910.md): CrossOriginProtection insecure bypass patterns not limited to exact matches in net/http (CVSS 5.4)
- [CVE-2025-47906](https://cve.now/CVE-2025-47906.md): Unexpected paths returned from LookPath in os/exec (CVSS 6.5)
- [CVE-2025-47907](https://cve.now/CVE-2025-47907.md): Incorrect results returned from Rows.Scan in database/sql (CVSS 7.0)
- [CVE-2024-8244](https://cve.now/CVE-2024-8244.md): Walk/WalkDir in path/filepath susceptible to symlink race (CVSS 3.7)
- [CVE-2025-0913](https://cve.now/CVE-2025-0913.md): Inconsistent handling of O\_CREATE|O\_EXCL on Unix and Windows in os in syscall (CVSS 5.5)
- [CVE-2025-4673](https://cve.now/CVE-2025-4673.md): Sensitive headers not cleared on cross-origin redirect in net/http (CVSS 6.8)
- [CVE-2025-22874](https://cve.now/CVE-2025-22874.md): Usage of ExtKeyUsageAny disables policy validation in crypto/x509 (CVSS 7.5)
- [CVE-2025-22871](https://cve.now/CVE-2025-22871.md): Request smuggling due to acceptance of invalid chunked data in net/http (CVSS 9.1)
- [CVE-2025-22870](https://cve.now/CVE-2025-22870.md): HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net (CVSS 4.4)
- [CVE-2025-22866](https://cve.now/CVE-2025-22866.md): Timing sidechannel for P-256 on ppc64le in crypto/internal/nistec (CVSS 4.0)
- [CVE-2025-22865](https://cve.now/CVE-2025-22865.md): ParsePKCS1PrivateKey panic with partial keys in crypto/x509 (CVSS 7.5)
- [CVE-2024-45336](https://cve.now/CVE-2024-45336.md): Sensitive headers incorrectly sent after cross-domain redirect in net/http (CVSS 6.1)
- [CVE-2024-45341](https://cve.now/CVE-2024-45341.md): Usage of IPv6 zone IDs can bypass URI name constraints in crypto/x509 (CVSS 6.1)
- [CVE-2024-34158](https://cve.now/CVE-2024-34158.md): Stack exhaustion in Parse in go/build/constraint (CVSS 7.5)
- [CVE-2024-34156](https://cve.now/CVE-2024-34156.md): Stack exhaustion in Decoder.Decode in encoding/gob (CVSS 7.5)
- [CVE-2024-34155](https://cve.now/CVE-2024-34155.md): Stack exhaustion in all Parse functions in go/parser (CVSS 4.3)
- [CVE-2024-24791](https://cve.now/CVE-2024-24791.md): Denial of service due to improper 100-continue handling in net/http (CVSS 7.5)
- [CVE-2024-24789](https://cve.now/CVE-2024-24789.md): Mishandling of corrupt central directory record in archive/zip (CVSS 5.3)
- [CVE-2024-24790](https://cve.now/CVE-2024-24790.md): Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses in net/netip (CVSS 9.8)
- [CVE-2024-24788](https://cve.now/CVE-2024-24788.md): Malformed DNS message can cause infinite loop in net (CVSS 5.9)
- [CVE-2023-45288](https://cve.now/CVE-2023-45288.md): HTTP/2 CONTINUATION flood in net/http (CVSS 7.5)
- [CVE-2024-24785](https://cve.now/CVE-2024-24785.md): Errors returned from JSON marshaling may break template escaping in html/template (CVSS 5.4)
- [CVE-2024-24784](https://cve.now/CVE-2024-24784.md): Comments in display names are incorrectly handled in net/mail (CVSS 7.5)
- [CVE-2023-45289](https://cve.now/CVE-2023-45289.md): Incorrect forwarding of sensitive headers and cookies on HTTP redirect in net/http (CVSS 4.3)
- [CVE-2023-45290](https://cve.now/CVE-2023-45290.md): Memory exhaustion in multipart form parsing in net/textproto and net/http (CVSS 6.5)
- [CVE-2024-24783](https://cve.now/CVE-2024-24783.md): Verify panics on certificates with an unknown public key algorithm in crypto/x509 (CVSS 5.9)
- [CVE-2023-39326](https://cve.now/CVE-2023-39326.md): Denial of service via chunk extensions in net/http (no CVSS)
- [CVE-2023-45287](https://cve.now/CVE-2023-45287.md): Before Go 1.20, the RSA based key exchange methods in crypto/tls may exhibit a timing side channel (no CVSS)
- [CVE-2023-45284](https://cve.now/CVE-2023-45284.md): Incorrect detection of reserved device names on Windows in path/filepath (CVSS 5.3)
- [CVE-2023-45283](https://cve.now/CVE-2023-45283.md): Insecure parsing of Windows paths with a \\??\\ prefix in path/filepath (no CVSS)
- [CVE-2023-39325](https://cve.now/CVE-2023-39325.md): HTTP/2 rapid reset can cause excessive work in net/http (no CVSS)
- [CVE-2023-39322](https://cve.now/CVE-2023-39322.md): Memory exhaustion in QUIC connection handling in crypto/tls (no CVSS)
- [CVE-2023-39321](https://cve.now/CVE-2023-39321.md): Panic when processing post-handshake message on QUIC connections in crypto/tls (no CVSS)
- [CVE-2023-39319](https://cve.now/CVE-2023-39319.md): Improper handling of special tags within script contexts in html/template (no CVSS)
- [CVE-2023-39318](https://cve.now/CVE-2023-39318.md): Improper handling of HTML-like comments in script contexts in html/template (no CVSS)
- [CVE-2023-29409](https://cve.now/CVE-2023-29409.md): Large RSA keys can cause high CPU usage in crypto/tls (no CVSS)
- [CVE-2023-29406](https://cve.now/CVE-2023-29406.md): Insufficient sanitization of Host header in net/http (no CVSS)
- [CVE-2023-29403](https://cve.now/CVE-2023-29403.md): Unsafe behavior in setuid/setgid binaries in runtime (CVSS 7.8)
- [CVE-2023-24539](https://cve.now/CVE-2023-24539.md): Improper sanitization of CSS values in html/template (CVSS 7.3)
- [CVE-2023-24540](https://cve.now/CVE-2023-24540.md): Improper handling of JavaScript whitespace in html/template (CVSS 9.8)
- [CVE-2023-29400](https://cve.now/CVE-2023-29400.md): Improper handling of empty HTML attributes in html/template (CVSS 7.3)
- [CVE-2023-24537](https://cve.now/CVE-2023-24537.md): Infinite loop in parsing in go/scanner (CVSS 7.5)
- [CVE-2023-24538](https://cve.now/CVE-2023-24538.md): Backticks not treated as string delimiters in html/template (CVSS 9.8)
- [CVE-2023-24534](https://cve.now/CVE-2023-24534.md): Excessive memory allocation in net/http and net/textproto (CVSS 7.5)
- [CVE-2023-24536](https://cve.now/CVE-2023-24536.md): Excessive resource consumption in net/http, net/textproto and mime/multipart (CVSS 7.5)
- [CVE-2023-24532](https://cve.now/CVE-2023-24532.md): Incorrect calculation on P256 curves in crypto/internal/nistec (no CVSS)
- [CVE-2022-41723](https://cve.now/CVE-2022-41723.md): Denial of service via crafted HTTP/2 stream in net/http and golang.org/x/net (CVSS 7.5)
- [CVE-2022-41724](https://cve.now/CVE-2022-41724.md): Panic on large handshake records in crypto/tls (no CVSS)
- [CVE-2022-41725](https://cve.now/CVE-2022-41725.md): Excessive resource consumption in mime/multipart (no CVSS)
- [CVE-2022-41722](https://cve.now/CVE-2022-41722.md): Path traversal on Windows in path/filepath (no CVSS)
- [CVE-2022-41717](https://cve.now/CVE-2022-41717.md): Excessive memory growth in net/http and golang.org/x/net/http2 (no CVSS)
- [CVE-2022-41720](https://cve.now/CVE-2022-41720.md): Restricted file access on Windows in os and net/http (CVSS 7.5)
- [CVE-2022-41716](https://cve.now/CVE-2022-41716.md): Unsanitized NUL in environment variables on Windows in syscall and os/exec (CVSS 6.3)
- [CVE-2022-41715](https://cve.now/CVE-2022-41715.md): Memory exhaustion when compiling regular expressions in regexp/syntax (no CVSS)
- [CVE-2022-2880](https://cve.now/CVE-2022-2880.md): Incorrect sanitization of forwarded query parameters in net/http/httputil (no CVSS)
- [CVE-2022-2879](https://cve.now/CVE-2022-2879.md): Unbounded memory consumption when reading headers in archive/tar (no CVSS)
- [CVE-2022-32190](https://cve.now/CVE-2022-32190.md): Failure to strip relative path components in net/url (no CVSS)
- [CVE-2022-32148](https://cve.now/CVE-2022-32148.md): Exposure of client IP addresses in net/http (CVSS 6.5)
- [CVE-2022-1962](https://cve.now/CVE-2022-1962.md): Stack exhaustion due to deeply nested types in go/parser (CVSS 5.5)
- [CVE-2022-30580](https://cve.now/CVE-2022-30580.md): Empty Cmd.Path can trigger unintended binary in os/exec on Windows (CVSS 7.8)
- [CVE-2022-32189](https://cve.now/CVE-2022-32189.md): Panic when decoding Float and Rat types in math/big (no CVSS)
- [CVE-2022-30629](https://cve.now/CVE-2022-30629.md): Session tickets lack random ticket\_age\_add in crypto/tls (CVSS 3.1)
- [CVE-2022-30630](https://cve.now/CVE-2022-30630.md): Stack exhaustion in Glob on certain paths in io/fs (CVSS 7.5)
- [CVE-2022-1705](https://cve.now/CVE-2022-1705.md): Improper sanitization of Transfer-Encoding headers in net/http (CVSS 6.5)
- [CVE-2022-30631](https://cve.now/CVE-2022-30631.md): Stack exhaustion when reading certain archives in compress/gzip (CVSS 7.5)
- [CVE-2022-30633](https://cve.now/CVE-2022-30633.md): Stack exhaustion when unmarshaling certain documents in encoding/xml (CVSS 7.5)
- [CVE-2022-30635](https://cve.now/CVE-2022-30635.md): Stack exhaustion when decoding certain messages in encoding/gob (CVSS 7.5)
- [CVE-2022-30632](https://cve.now/CVE-2022-30632.md): Stack exhaustion on crafted paths in path/filepath (no CVSS)
- [CVE-2022-29804](https://cve.now/CVE-2022-29804.md): Path traversal via Clean on Windows in path/filepath (no CVSS)
- [CVE-2022-28131](https://cve.now/CVE-2022-28131.md): Stack exhaustion from deeply nested XML documents in encoding/xml (no CVSS)
- [CVE-2022-30634](https://cve.now/CVE-2022-30634.md): Indefinite hang with large buffers on Windows in crypto/rand (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/go-standard-library
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.