golang-1.24 vulnerabilities (Debian)
93 vulnerabilities.
golang-1.24DebianHTTP/1 server crash due to MaxBytesReader header race in net/httpNo scoregolang-1.24DebianUnexpected code execution via escaped quotes in //go:cgo_ldflag in cmd/go and cmd/compileNo scoregolang-1.24DebianLinker flag injection via cgo_import_dynamic and PE DLL names in cmd/cgo, cmd/compile, and cmd/linkNo scoregolang-1.24DebianHost linker flag injection via //go:cgo_* directives in cmd/compile and cmd/linkNo scoregolang-1.24DebianCgo directive injection via .syso files disguised as Go object files in cmd/go and cmd/linkNo scoregolang-1.24DebianFlag sanitization bypass via "#cgo pkg-config:" directives in cmd/goNo scoregolang-1.24DebianArbitrary code execution via crafted .syso files and cgo linker input files in cmd/goNo scoregolang-1.24DebianLinker script injection via split -Wl, flags and Darwin or symbol linker flags in cgo in cmd/goNo scoregolang-1.24DebianArbitrary code execution during build on darwin via "-l to_library" in cgo in cmd/goNo scoregolang-1.24DebianUnexpected code execution and arbitrary file write via Clang -gen-* and GCC -gnat* flags in cgo in cmd/goNo scoregolang-1.24DebianArbitrary command execution via GCC spec files in cgo linker search directories in cmd/goNo scoregolang-1.24DebianUnexpected code execution via --sysroot, -target, -isysroot, -Wl,-syslibroot, and -x cgo flags in cmd/goNo scoregolang-1.24DebianDistrust compromised intermediate certificates in crypto/x5096.8 Mediumgolang-1.24DebianHTTP/2 server crash due to HPACK encoder race in net/http7.5 Highgolang-1.24DebianReject malformed ECH outer extension references in crypto/tls7.5 Highgolang-1.24DebianRecognize yield as regexp preceder keyword in html/template6.1 Mediumgolang-1.24DebianReset context tracking on consecutive template expressions in html/template6.1 Mediumgolang-1.24DebianChecksum database bypass for golang.org/toolchain in cmd/go7.8 Highgolang-1.24DebianChecksum bypass for golang.org/fips140 in cmd/go7.8 Highgolang-1.24DebianMemory limit bypass when parsing MIME headers in net/textproto, mime/multipart7.5 Highgolang-1.24DebianHTTP/1 server connection desynchronization after 2xx CONNECT response in net/http7.5 Highgolang-1.24DebianExcessive CPU consumption from repeated initial window changes in net/http7.5 Highgolang-1.24DebianLack of limit on size of parsed Range headers in net/http7.5 Highgolang-1.24DebianDouble flow control refund on HTTP/2 server streams in net/http9.1 Criticalgolang-1.24DebianHTTP/2 transport accepts malformed framing-related headers in net/http7.5 Highgolang-1.24DebianHTTP/2 server memory exhaustion due to Trailer headers in net/http7.5 Highgolang-1.24DebianHTTP/1 client connection desynchronization after CONNECT rejection in net/http7.5 Highgolang-1.24DebianFix transparency log tile verification bypass in golang.org/x/mod/sumdb/tlog8.4 Highgolang-1.24DebianIgnore unrelated, unauthenticated hashes in Lookup in golang.org/x/mod/sumdb7.5 Highgolang-1.24DebianLimit handshake messages we are willing to accept post-handshake in crypto/tls7.5 Highgolang-1.24DebianAvoid quadratic complexity in resolvePath in net/url5.9 Mediumgolang-1.24DebianAdd recursion depth guard during decode in encoding/xml7.5 Highgolang-1.24DebianFix Javascript regexp context tracking in html/template6.1 Mediumgolang-1.24DebianApply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/http7.5 Highgolang-1.24DebianEnforce maximum recursion depth in encoding/asn17.5 Highgolang-1.24DebianInvoking Encrypted Client Hello privacy leak in crypto/tls5.3 Mediumgolang-1.24DebianRoot escape via symlink plus trailing slash in os7.8 Highgolang-1.24DebianArbitrary inputs are included in errors without any escaping in net/textproto5.3 Mediumgolang-1.24DebianQuadratic complexity in WordDecoder.DecodeHeader in mime7.5 Highgolang-1.24DebianInefficient candidate hostname parsing in crypto/x5096.5 Mediumgolang-1.24DebianMalicious module proxy can bypass checksum database in cmd/go7.5 Highgolang-1.24DebianQuadratic string concatenation in consumePhrase in net/mail7.5 Highgolang-1.24DebianEscaper bypass leads to XSS in html/template6.1 Mediumgolang-1.24DebianReverseProxy forwards queries with more than urlmaxqueryparams parameters in net/http/httputil5.3 Mediumgolang-1.24DebianBypass of meta content URL escaping causes XSS in html/template6.1 Mediumgolang-1.24DebianQuadratic string concatentation in consumeComment in net/mail7.5 Highgolang-1.24DebianInvoking "go bug" follows symlinks in predictable temporary filenames in cmd/go5.3 Mediumgolang-1.24DebianInvoking "go tool pack" does not sanitize output paths in cmd/go5.9 Mediumgolang-1.24DebianCrash when handling long CNAME response in net7.5 Highgolang-1.24DebianJsBraceDepth Context Tracking Bugs (XSS) in html/template6.1 Medium- Show olderLoading…