GO Standard Library vulnerabilities
135 CVEs and advisories name GO Standard Library as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-33811Crash when handling long CNAME response in net
- CVE-2026-39826Escaper bypass leads to XSS in html/template
- CVE-2026-42499Quadratic string concatenation in consumePhrase in net/mail
- CVE-2026-39825ReverseProxy forwards queries with more than urlmaxqueryparams parameters in net/http/httputil
- CVE-2026-39836Panic in Dial and LookupPort when handling NUL byte on Windows in net
- CVE-2026-33814Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net
- CVE-2026-32280Unexpected work during chain building in crypto/x509
- CVE-2026-32281Inefficient policy validation in crypto/x509
- CVE-2026-32283Unauthenticated TLS 1.3 KeyUpdate record can cause persistent connection retention and DoS in crypto/tls
- CVE-2026-32288Unbounded allocation for old GNU sparse in archive/tar
- CVE-2026-33810Case-sensitive excludedSubtrees name constraints cause Auth Bypass in crypto/x509
- CVE-2026-32289JsBraceDepth Context Tracking Bugs (XSS) in html/template
- CVE-2026-32282TOCTOU permits root escape on Linux via Root.Chmod in os in internal/syscall/unix
- CVE-2026-27142URLs in meta content attribute actions are not escaped in html/template
- CVE-2026-27139FileInfo can escape from a Root in os
- CVE-2026-25679Incorrect parsing of IPv6 host literals in net/url
- CVE-2026-27138Panic in name constraint checking for malformed certificates in crypto/x509
- CVE-2026-27137Incorrect enforcement of email constraints in crypto/x509
- CVE-2025-68121Unexpected session resumption in crypto/tls
- CVE-2025-22873Improper access to parent directory of root in os
- CVE-2025-61728Excessive CPU consumption when building archive index in archive/zip
- CVE-2025-61726Memory exhaustion in query parameter parsing in net/url
- CVE-2025-61730Handshake messages may be processed at the incorrect encryption level in crypto/tls
- CVE-2025-61727Improper application of excluded DNS name constraints when verifying wildcard names in crypto/x509
- CVE-2025-61729Excessive resource consumption when printing error string for host certificate validation in crypto/x509
- CVE-2025-61724Excessive CPU consumption in Reader.ReadResponse in net/textproto
- CVE-2025-58183Unbounded allocation when parsing GNU sparse map in archive/tar
- CVE-2025-58188Panic when validating certificates with DSA public keys in crypto/x509
- CVE-2025-58186Lack of limit when parsing cookies can cause memory exhaustion in net/http
- CVE-2025-58185Parsing DER payload can cause memory exhaustion in encoding/asn1