GO Standard Library vulnerabilities
136 CVEs and advisories name GO Standard Library as an affected vendor, newest first. Follow it as a feed.
- CVE-2025-47912Insufficient validation of bracketed IPv6 hostnames in net/url
- CVE-2025-61723Quadratic complexity when parsing some invalid inputs in encoding/pem
- CVE-2025-58189ALPN negotiation error contains attacker controlled information in crypto/tls
- CVE-2025-58187Quadratic complexity when checking name constraints in crypto/x509
- CVE-2025-61725Excessive CPU consumption in ParseAddress in net/mail
- CVE-2025-47910CrossOriginProtection insecure bypass patterns not limited to exact matches in net/http
- CVE-2025-47906Unexpected paths returned from LookPath in os/exec
- CVE-2025-47907Incorrect results returned from Rows.Scan in database/sql
- CVE-2024-8244Walk/WalkDir in path/filepath susceptible to symlink race
- CVE-2025-0913Inconsistent handling of O_CREATE|O_EXCL on Unix and Windows in os in syscall
- CVE-2025-4673Sensitive headers not cleared on cross-origin redirect in net/http
- CVE-2025-22874Usage of ExtKeyUsageAny disables policy validation in crypto/x509
- CVE-2025-22871Request smuggling due to acceptance of invalid chunked data in net/http
- CVE-2025-22870HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net
- CVE-2025-22866Timing sidechannel for P-256 on ppc64le in crypto/internal/nistec
- CVE-2025-22865ParsePKCS1PrivateKey panic with partial keys in crypto/x509
- CVE-2024-45336Sensitive headers incorrectly sent after cross-domain redirect in net/http
- CVE-2024-45341Usage of IPv6 zone IDs can bypass URI name constraints in crypto/x509
- CVE-2024-34158Stack exhaustion in Parse in go/build/constraint
- CVE-2024-34156Stack exhaustion in Decoder.Decode in encoding/gob
- CVE-2024-34155Stack exhaustion in all Parse functions in go/parser
- CVE-2024-24791Denial of service due to improper 100-continue handling in net/http
- CVE-2024-24789Mishandling of corrupt central directory record in archive/zip
- CVE-2024-24790Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses in net/netip
- CVE-2024-24788Malformed DNS message can cause infinite loop in net
- CVE-2023-45288HTTP/2 CONTINUATION flood in net/http
- CVE-2024-24785Errors returned from JSON marshaling may break template escaping in html/template
- CVE-2024-24784Comments in display names are incorrectly handled in net/mail
- CVE-2023-45289Incorrect forwarding of sensitive headers and cookies on HTTP redirect in net/http
- CVE-2023-45290Memory exhaustion in multipart form parsing in net/textproto and net/http