Skip to contentGo Standard Library Net vulnerabilities
- go standard library net/httpHTTP/1 server crash due to MaxBytesReader header race in net/httpCVE-2026-97054Fix availableNo score
- go standard library net/http, net/http/internal/http2, golang.org/x/net golang.org/x/net/http2 +2 moreHTTP/2 server crash due to HPACK encoder race in net/httpCVE-2026-97032Fix available7.5 High
- go standard library mime/multipart, net/textproto +1 moreMemory limit bypass when parsing MIME headers in net/textproto, mime/multipartCVE-2026-94440Fix available7.5 High
- go standard library net/httpHTTP/1 server connection desynchronization after 2xx CONNECT response in net/httpCVE-2026-94439Fix available7.5 High
- go standard library net/http, net/http/internal/http2, golang.org/x/net golang.org/x/net/http2 +2 moreExcessive CPU consumption from repeated initial window changes in net/httpCVE-2026-78669Fix available7.5 High
- go standard library net/httpLack of limit on size of parsed Range headers in net/httpCVE-2026-78667Fix available7.5 High
- go standard library net/http, net/http/internal/http2, golang.org/x/net golang.org/x/net/http2 +2 moreDouble flow control refund on HTTP/2 server streams in net/httpCVE-2026-78663Fix available9.1 Critical
- go standard library net/http, net/http/internal/http2, golang.org/x/net golang.org/x/net/http2 +2 moreHTTP/2 transport accepts malformed framing-related headers in net/httpCVE-2026-78660Fix available7.5 High
- go standard library net/http, net/http/internal/http2, golang.org/x/net golang.org/x/net/http2 +2 moreHTTP/2 server memory exhaustion due to Trailer headers in net/httpCVE-2026-78659Fix available7.5 High
- go standard library net/http, net/http/httputil +1 moreHTTP/1 client connection desynchronization after CONNECT rejection in net/httpCVE-2026-56866Fix available7.5 High
- go standard library net/urlAvoid quadratic complexity in resolvePath in net/urlCVE-2026-56860Fix available5.9 Medium
- go standard library net/httpApply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/httpCVE-2026-56853Fix available7.5 High
- go standard library net, golang.org/x/net golang.org/x/net/dns/dnsmessage +1 moreParsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessageCVE-2026-46600Fix available7.5 High
- go standard library net/textprotoArbitrary inputs are included in errors without any escaping in net/textprotoCVE-2026-42507Fix available5.3 Medium
- go standard library net/mail, golang go, red hat assisted installer for red hat openshift container platform 2 +108 more +110 moreQuadratic string concatenation in consumePhrase in net/mailCVE-2026-42499Fix available7.5 High
- go standard library net, golang go +1 morePanic in Dial and LookupPort when handling NUL byte on Windows in netCVE-2026-39836Fix available7.5 High
- go standard library net/http/httputil, golang go +1 moreReverseProxy forwards queries with more than urlmaxqueryparams parameters in net/http/httputilCVE-2026-39825Fix available5.3 Medium
- go standard library net/mail, golang go, red hat assisted installer for red hat openshift container platform 2 +107 more +109 moreQuadratic string concatentation in consumeComment in net/mailCVE-2026-39820Fix available7.5 High
- go standard library net/http, golang go, http2 +106 more +108 moreInfinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/netCVE-2026-33814Fix available7.5 High
- go standard library net, golang go, red hat assisted installer for red hat openshift container platform 2 +145 more +147 moreCrash when handling long CNAME response in netCVE-2026-33811Fix available7.5 High
- go standard library net/url, golang go, red hat assisted installer for red hat openshift container platform 2 +143 more +145 moreIncorrect parsing of IPv6 host literals in net/urlCVE-2026-25679Fix available7.5 High
- go standard library net/url, golang go, red hat assisted installer for red hat openshift container platform 2 +160 more +162 moreMemory exhaustion in query parameter parsing in net/urlCVE-2025-61726Fix available7.5 High
- go standard library net/mailExcessive CPU consumption in ParseAddress in net/mailCVE-2025-61725Fix available7.5 High
- go standard library net/textproto, golang go +1 moreExcessive CPU consumption in Reader.ReadResponse in net/textprotoCVE-2025-61724Fix available5.3 Medium
- go standard library net/httpLack of limit when parsing cookies can cause memory exhaustion in net/httpCVE-2025-58186Fix available5.3 Medium
- go standard library net/url, golang go +1 moreInsufficient validation of bracketed IPv6 hostnames in net/urlCVE-2025-47912Fix available5.3 Medium
- go standard library net/httpCrossOriginProtection insecure bypass patterns not limited to exact matches in net/httpCVE-2025-47910Fix available5.4 Medium
- go standard library net/httpSensitive headers not cleared on cross-origin redirect in net/httpCVE-2025-4673Fix available6.8 Medium
- go standard library net/http/internal, siemens sentron 7kt pac1261 data manager +1 moreRequest smuggling due to acceptance of invalid chunked data in net/httpCVE-2025-22871Fix available9.1 Critical
- go standard library net/http, golang.org/x/net golang.org/x/net/http/httpproxy, golang.org/x/net/proxy +2 moreHTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/netCVE-2025-22870Public exploitFix available4.4 Medium
- go standard library net/httpSensitive headers incorrectly sent after cross-domain redirect in net/httpCVE-2024-45336Fix available6.1 Medium
- go standard library net/http, net\/http +1 moreDenial of service due to improper 100-continue handling in net/httpCVE-2024-24791Fix available7.5 High
- go standard library net/netip, golang go +1 moreUnexpected behavior from Is methods for IPv4-mapped IPv6 addresses in net/netipCVE-2024-24790Fix available9.8 Critical
- go standard library netMalformed DNS message can cause infinite loop in netCVE-2024-24788Fix available5.9 Medium
- go standard library net/http, net\/http, golang http2 +1 more +3 moreHTTP/2 CONTINUATION flood in net/httpCVE-2023-45288Public exploitFix availableEPSS 89.5%7.5 High
- go standard library net/mail, net\/mail +1 moreComments in display names are incorrectly handled in net/mailCVE-2024-24784Fix available7.5 High
- go standard library net/http, net/http/cookiejar +1 moreIncorrect forwarding of sensitive headers and cookies on HTTP redirect in net/httpCVE-2023-45289Fix available4.3 Medium
- go standard library net/textprotoMemory exhaustion in multipart form parsing in net/textproto and net/httpCVE-2023-45290Fix available6.5 Medium
- go standard library net/http/internal, golang go +1 moreDenial of service via chunk extensions in net/httpCVE-2023-39326Fix available5.3 Medium
- go standard library net/http, golang go, http2 +4 more +6 moreHTTP/2 rapid reset can cause excessive work in net/httpCVE-2023-39325Public exploitFix available7.5 High
- go standard library net/http, golang go +1 moreInsufficient sanitization of Host header in net/httpCVE-2023-29406Public exploitFix available6.5 Medium
- go standard library mime/multipart, net/textproto, golang go +2 moreExcessive resource consumption in net/http, net/textproto and mime/multipartCVE-2023-24536Fix available7.5 High
- go standard library net/textproto, golang go +1 moreExcessive memory allocation in net/http and net/textprotoCVE-2023-24534Fix available7.5 High
- go standard library net/http, golang go, hpack +3 more +5 moreDenial of service via crafted HTTP/2 stream in net/http and golang.org/x/netCVE-2022-41723Fix available7.5 High
- go standard library net/http, golang go, http2 +2 more +4 moreExcessive memory growth in net/http and golang.org/x/net/http2CVE-2022-41717Public exploitFix available5.3 Medium
- go standard library net/http, os, golang go +2 moreRestricted file access on Windows in os and net/httpCVE-2022-41720Fix available7.5 High
- go standard library net/http/httputil, golang go +1 moreIncorrect sanitization of forwarded query parameters in net/http/httputilCVE-2022-2880Fix available7.5 High
- go standard library net/url, golang go +1 moreFailure to strip relative path components in net/urlCVE-2022-32190Fix available7.5 High
- go standard library net/http, golang go +1 moreExposure of client IP addresses in net/httpCVE-2022-32148Fix available6.5 Medium
- go standard library net/http, golang go +1 moreImproper sanitization of Transfer-Encoding headers in net/httpCVE-2022-1705Fix available6.5 Medium
- Show olderLoading…