golang-1.26 vulnerabilities (Debian)
64 vulnerabilities.
golang-1.26DebianHTTP/1 server crash due to MaxBytesReader header race in net/httpNo scoregolang-1.26DebianUnexpected code execution via escaped quotes in //go:cgo_ldflag in cmd/go and cmd/compileNo scoregolang-1.26DebianLinker flag injection via cgo_import_dynamic and PE DLL names in cmd/cgo, cmd/compile, and cmd/linkNo scoregolang-1.26DebianHost linker flag injection via //go:cgo_* directives in cmd/compile and cmd/linkNo scoregolang-1.26DebianCgo directive injection via .syso files disguised as Go object files in cmd/go and cmd/linkNo scoregolang-1.26DebianFlag sanitization bypass via "#cgo pkg-config:" directives in cmd/goNo scoregolang-1.26DebianArbitrary code execution via crafted .syso files and cgo linker input files in cmd/goNo scoregolang-1.26DebianLinker script injection via split -Wl, flags and Darwin or symbol linker flags in cgo in cmd/goNo scoregolang-1.26DebianArbitrary code execution during build on darwin via "-l to_library" in cgo in cmd/goNo scoregolang-1.26DebianUnexpected code execution and arbitrary file write via Clang -gen-* and GCC -gnat* flags in cgo in cmd/goNo scoregolang-1.26DebianArbitrary command execution via GCC spec files in cgo linker search directories in cmd/goNo scoregolang-1.26DebianUnexpected code execution via --sysroot, -target, -isysroot, -Wl,-syslibroot, and -x cgo flags in cmd/goNo scoregolang-1.26DebianDistrust compromised intermediate certificates in crypto/x5096.8 Mediumgolang-1.26DebianHTTP/2 server crash due to HPACK encoder race in net/http7.5 Highgolang-1.26DebianReject malformed ECH outer extension references in crypto/tls7.5 Highgolang-1.26DebianRecognize yield as regexp preceder keyword in html/template6.1 Mediumgolang-1.26DebianReset context tracking on consecutive template expressions in html/template6.1 Mediumgolang-1.26DebianChecksum database bypass for golang.org/toolchain in cmd/go7.8 Highgolang-1.26DebianChecksum bypass for golang.org/fips140 in cmd/go7.8 Highgolang-1.26DebianMemory limit bypass when parsing MIME headers in net/textproto, mime/multipart7.5 Highgolang-1.26DebianHTTP/1 server connection desynchronization after 2xx CONNECT response in net/http7.5 Highgolang-1.26DebianExcessive CPU consumption from repeated initial window changes in net/http7.5 Highgolang-1.26DebianLack of limit on size of parsed Range headers in net/http7.5 Highgolang-1.26DebianDouble flow control refund on HTTP/2 server streams in net/http9.1 Criticalgolang-1.26DebianHTTP/2 transport accepts malformed framing-related headers in net/http7.5 Highgolang-1.26DebianHTTP/2 server memory exhaustion due to Trailer headers in net/http7.5 Highgolang-1.26DebianHTTP/1 client connection desynchronization after CONNECT rejection in net/http7.5 Highgolang-1.26DebianFix transparency log tile verification bypass in golang.org/x/mod/sumdb/tlog8.4 Highgolang-1.26DebianIgnore unrelated, unauthenticated hashes in Lookup in golang.org/x/mod/sumdb7.5 Highgolang-1.26DebianLimit handshake messages we are willing to accept post-handshake in crypto/tls7.5 Highgolang-1.26DebianAvoid quadratic complexity in resolvePath in net/url5.9 Mediumgolang-1.26DebianAdd recursion depth guard during decode in encoding/xml7.5 Highgolang-1.26DebianFix Javascript regexp context tracking in html/template6.1 Mediumgolang-1.26DebianApply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/http7.5 Highgolang-1.26DebianEnforce maximum recursion depth in encoding/asn17.5 Highgolang-1.26DebianInvoking Encrypted Client Hello privacy leak in crypto/tls5.3 Mediumgolang-1.26DebianRoot escape via symlink plus trailing slash in os7.8 Highgolang-1.26DebianArbitrary inputs are included in errors without any escaping in net/textproto5.3 Mediumgolang-1.26DebianQuadratic complexity in WordDecoder.DecodeHeader in mime7.5 Highgolang-1.26DebianInefficient candidate hostname parsing in crypto/x5096.5 Mediumgolang-1.26DebianMalicious module proxy can bypass checksum database in cmd/go7.5 Highgolang-1.26DebianQuadratic string concatenation in consumePhrase in net/mail7.5 Highgolang-1.26DebianEscaper bypass leads to XSS in html/template6.1 Mediumgolang-1.26DebianReverseProxy forwards queries with more than urlmaxqueryparams parameters in net/http/httputil5.3 Mediumgolang-1.26DebianBypass of meta content URL escaping causes XSS in html/template6.1 Mediumgolang-1.26DebianQuadratic string concatentation in consumeComment in net/mail7.5 Highgolang-1.26DebianInvoking "go bug" follows symlinks in predictable temporary filenames in cmd/go5.3 Mediumgolang-1.26DebianInvoking "go tool pack" does not sanitize output paths in cmd/go5.9 Mediumgolang-1.26DebianCrash when handling long CNAME response in net7.5 Highgolang-1.26DebianCase-sensitive excludedSubtrees name constraints cause Auth Bypass in crypto/x5098.2 High- Show olderLoading…