Skip to contentGo Standard Library vulnerabilities
Newest
- go standard library net/httpHTTP/1 server crash due to MaxBytesReader header race in net/httpCVE-2026-97054Fix availableNo score
- go standard library crypto/x509Distrust compromised intermediate certificates in crypto/x509CVE-2026-111943Public exploitFix available6.8 Medium
- go standard library net/http, net/http/internal/http2, golang.org/x/net golang.org/x/net/http2 +2 moreHTTP/2 server crash due to HPACK encoder race in net/httpCVE-2026-97032Fix available7.5 High
- go standard library crypto/tlsReject malformed ECH outer extension references in crypto/tlsCVE-2026-97031Fix available7.5 High
- go standard library html/templateRecognize yield as regexp preceder keyword in html/templateCVE-2026-97030Fix available6.1 Medium
- go standard library html/templateReset context tracking on consecutive template expressions in html/templateCVE-2026-94448Fix available6.1 Medium
- go standard library mime/multipart, net/textproto +1 moreMemory limit bypass when parsing MIME headers in net/textproto, mime/multipartCVE-2026-94440Fix available7.5 High
- go standard library net/httpHTTP/1 server connection desynchronization after 2xx CONNECT response in net/httpCVE-2026-94439Fix available7.5 High
- go standard library net/http, net/http/internal/http2, golang.org/x/net golang.org/x/net/http2 +2 moreExcessive CPU consumption from repeated initial window changes in net/httpCVE-2026-78669Fix available7.5 High
- go standard library net/httpLack of limit on size of parsed Range headers in net/httpCVE-2026-78667Fix available7.5 High
- go standard library net/http, net/http/internal/http2, golang.org/x/net golang.org/x/net/http2 +2 moreDouble flow control refund on HTTP/2 server streams in net/httpCVE-2026-78663Fix available9.1 Critical
- go standard library net/http, net/http/internal/http2, golang.org/x/net golang.org/x/net/http2 +2 moreHTTP/2 transport accepts malformed framing-related headers in net/httpCVE-2026-78660Fix available7.5 High
- go standard library net/http, net/http/internal/http2, golang.org/x/net golang.org/x/net/http2 +2 moreHTTP/2 server memory exhaustion due to Trailer headers in net/httpCVE-2026-78659Fix available7.5 High
- go standard library net/http, net/http/httputil +1 moreHTTP/1 client connection desynchronization after CONNECT rejection in net/httpCVE-2026-56866Fix available7.5 High
- go standard library os, internal/syscall/windows +1 moreRoot.Mkdir(All) can follow junctions out of the root on Windows in osCVE-2026-56857Fix available9.8 Critical
- go standard library crypto/tlsLimit handshake messages we are willing to accept post-handshake in crypto/tlsCVE-2026-56862Fix available7.5 High
- go standard library net/urlAvoid quadratic complexity in resolvePath in net/urlCVE-2026-56860Fix available5.9 Medium
- go standard library encoding/xmlAdd recursion depth guard during decode in encoding/xmlCVE-2026-56859Fix available7.5 High
- go standard library html/templateFix Javascript regexp context tracking in html/templateCVE-2026-56858Fix available6.1 Medium
- go standard library net/httpApply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/httpCVE-2026-56853Fix available7.5 High
- go standard library encoding/asn1Enforce maximum recursion depth in encoding/asn1CVE-2026-33818Fix available7.5 High
- go standard library net, golang.org/x/net golang.org/x/net/dns/dnsmessage +1 moreParsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessageCVE-2026-46600Fix available7.5 High
- go standard library crypto/tls, golang go +1 moreInvoking Encrypted Client Hello privacy leak in crypto/tlsCVE-2026-42505Fix available5.3 Medium
- go standard library os, golang go +1 moreRoot escape via symlink plus trailing slash in osCVE-2026-39822Fix available7.8 High
- go standard library net/textprotoArbitrary inputs are included in errors without any escaping in net/textprotoCVE-2026-42507Fix available5.3 Medium
- go standard library mimeQuadratic complexity in WordDecoder.DecodeHeader in mimeCVE-2026-42504Fix available7.5 High
- go standard library crypto/x509, red hat assisted installer for red hat openshift container platform 2, cert manager support for red hat openshift release 1.19 +128 more +130 moreInefficient candidate hostname parsing in crypto/x509CVE-2026-27145Public exploitFix available6.5 Medium
- go standard library mime, sensiolabs symfony +1 moreSymfony: Email Header Injection via Non-Token Characters in Mime Parameter NamesCVE-2026-45070Fix available6.3 Medium
- go standard library net/mail, golang go, red hat assisted installer for red hat openshift container platform 2 +108 more +110 moreQuadratic string concatenation in consumePhrase in net/mailCVE-2026-42499Fix available7.5 High
- go standard library net, golang go +1 morePanic in Dial and LookupPort when handling NUL byte on Windows in netCVE-2026-39836Fix available7.5 High
- go standard library html/template, golang go +1 moreEscaper bypass leads to XSS in html/templateCVE-2026-39826Fix available6.1 Medium
- go standard library net/http/httputil, golang go +1 moreReverseProxy forwards queries with more than urlmaxqueryparams parameters in net/http/httputilCVE-2026-39825Fix available5.3 Medium
- go standard library html/template, golang go +1 moreBypass of meta content URL escaping causes XSS in html/templateCVE-2026-39823Fix available6.1 Medium
- go standard library net/mail, golang go, red hat assisted installer for red hat openshift container platform 2 +107 more +109 moreQuadratic string concatentation in consumeComment in net/mailCVE-2026-39820Fix available7.5 High
- go standard library net/http, golang go, http2 +106 more +108 moreInfinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/netCVE-2026-33814Fix available7.5 High
- go standard library net, golang go, red hat assisted installer for red hat openshift container platform 2 +145 more +147 moreCrash when handling long CNAME response in netCVE-2026-33811Fix available7.5 High
- go standard library crypto/x509, golang go, red hat assisted installer for red hat openshift container platform 2 +103 more +105 moreCase-sensitive excludedSubtrees name constraints cause Auth Bypass in crypto/x509CVE-2026-33810Fix available8.2 High
- go standard library html/template, golang go +1 moreJsBraceDepth Context Tracking Bugs (XSS) in html/templateCVE-2026-32289Fix available6.1 Medium
- go standard library archive/tar, golang go +1 moreUnbounded allocation for old GNU sparse in archive/tarCVE-2026-32288Fix available5.5 Medium
- go standard library crypto/tls, golang go, red hat assisted installer for red hat openshift container platform 2 +117 more +119 moreUnauthenticated TLS 1.3 KeyUpdate record can cause persistent connection retention and DoS in crypto/tlsCVE-2026-32283Fix available7.5 High
- go standard library internal/syscall/unix, golang go +1 moreTOCTOU permits root escape on Linux via Root.Chmod in os in internal/syscall/unixCVE-2026-32282Fix available6.4 Medium
- go standard library crypto/x509, golang go +1 moreInefficient policy validation in crypto/x509CVE-2026-32281Fix available7.5 High
- go standard library crypto/x509, golang go, red hat assisted installer for red hat openshift container platform 2 +140 more +142 moreUnexpected work during chain building in crypto/x509CVE-2026-32280Fix available7.5 High
- go standard library html/template, golang go +1 moreURLs in meta content attribute actions are not escaped in html/templateCVE-2026-27142Fix available6.1 Medium
- go standard library os, golang go +1 moreFileInfo can escape from a Root in osCVE-2026-27139Fix available2.5 Low
- go standard library net/url, golang go, red hat assisted installer for red hat openshift container platform 2 +143 more +145 moreIncorrect parsing of IPv6 host literals in net/urlCVE-2026-25679Fix available7.5 High
- go standard library crypto/x509, golang go +1 morePanic in name constraint checking for malformed certificates in crypto/x509CVE-2026-27138Fix available5.9 Medium
- go standard library crypto/x509, golang go, red hat assisted installer for red hat openshift container platform 2 +99 more +101 moreIncorrect enforcement of email constraints in crypto/x509CVE-2026-27137Fix available7.5 High
- go standard library crypto/tls, golang go +1 moreUnexpected session resumption in crypto/tlsCVE-2025-68121Fix available10.0 Critical
- go standard library crypto/tls, golang go +1 moreHandshake messages may be processed at the incorrect encryption level in crypto/tlsCVE-2025-61730Fix available5.3 Medium
- Show olderLoading…