stdlib vulnerabilities (Go)
185 vulnerabilities.
stdlibGoGo before 1.15.12 and 1.16.x before 1.16.5 attempts to allocate excessive memory (issue 1 of 2).7.5 HighstdlibGoGo before 1.15.12 and 1.16.x before 1.16.5 allows injection.7.3 HighstdlibGogolang.org/x/net/http/httpguts vulnerable to Uncontrolled Recursion5.9 MediumstdlibGoarchive/zip in Go 1.16.x before 1.16.1 allows attackers to cause a denial of service (panic) upon...5.5 MediumstdlibGoencoding/xml in Go before 1.15.9 and 1.16.x before 1.16.1 has an infinite loop if a custom...7.5 HighstdlibGoIn Go before 1.14.14 and 1.15.x before 1.15.7, crypto/elliptic/p224.go can generate incorrect...6.5 MediumstdlibGoGo before 1.14.12 and 1.15.x before 1.15.4 allows Denial of Service.7.5 HighstdlibGoGo before 1.14.8 and 1.15.x before 1.15.1 allows XSS because text/html is the default for CGI...6.1 MediumstdlibGoWithdrawn Advisory: Infinite loop in xz7.5 HighstdlibGoIn Go before 1.13.13 and 1.14.x before 1.14.5, Certificate.Verify may lack a check on the...5.3 MediumstdlibGoGo before 1.13.13 and 1.14.x before 1.14.5 has a data race in some net/http servers, as...5.9 MediumstdlibGoHelm uses crypto package vulnerable to panic from malformed X.509 certificate7.5 HighstdlibGoThe net/http library in net/http/transfer.go in Go before 1.4.3 does not properly parse HTTP...9.8 CriticalstdlibGoA spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic...8.1 HighstdlibGoGo before 1.12.11 and 1.3.x before 1.13.2 can panic upon an attempt to process network traffic...7.5 HighstdlibGoGo before 1.12.10 and 1.13.x before 1.13.1 allow HTTP Request Smuggling.7.5 HighstdlibGonet/url in Go before 1.11.13 and 1.12.x before 1.12.8 mishandles malformed hosts in URLs, leading...9.8 CriticalstdlibGoSome HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service7.5 HighstdlibGoSome HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service7.5 HighstdlibGoGo through 1.12 on Windows misuses certain LoadLibrary functionality, leading to DLL injection.7.8 HighstdlibGoGo before 1.10.8 and 1.11.x before 1.11.5 mishandles P-521 and P-384 elliptic curves, which...8.2 HighstdlibGoThe crypto/x509 package of Go before 1.10.6 and 1.11.x before 1.11.3 does not limit the amount of...5.9 MediumstdlibGoThe net/http library in net/http/transfer.go in Go before 1.4.3 does not properly parse HTTP...9.8 CriticalstdlibGoThe net/http library in net/textproto/reader.go in Go before 1.4.3 does not properly parse HTTP...9.8 CriticalstdlibGoAn unintended cleartext issue exists in Go before 1.8.4 and 1.9.x before 1.9.1. RFC 4954 requires...5.9 MediumstdlibGoThe net/http package's Request.ParseMultipartForm method starts writing to temporary files once...7.5 HighstdlibGoOn Darwin, user's trust preferences for root certificates were not honored. If the user had a...7.5 HighstdlibGoA bug in the standard library ScalarMult implementation of curve P-256 for amd64 architectures in...5.9 MediumstdlibGoInvoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna9.6 CriticalstdlibGoThe net/http package in Go through 1.6 does not attempt to address RFC 3875 section 4.1.18...8.1 HighstdlibGoThe Verify function in crypto/dsa/dsa.go in Go before 1.5.4 and 1.6.x before 1.6.1 does not...7.5 HighstdlibGoUntrusted search path vulnerability in Go before 1.5.4 and 1.6.x before 1.6.1 on Windows allows...7.8 HighstdlibGoThe Int.Exp Montgomery code in the math/big library in Go 1.5.x before 1.5.3 mishandles carry...7.5 HighstdlibGocrpyto/tls in Go 1.1 before 1.3.2, when SessionTicketsDisabled is enabled, allows man-in-the...4.3 Medium