Skip to contentGo Standard Library vulnerabilities
Newest
- go standard library html/template, golang go +1 moreImproper handling of HTML-like comments in script contexts in html/templateCVE-2023-39318Fix available6.1 Medium
- go standard library crypto/tls, golang go +1 moreLarge RSA keys can cause high CPU usage in crypto/tlsCVE-2023-29409Public exploitFix available5.3 Medium
- go standard library net/http, golang go +1 moreInsufficient sanitization of Host header in net/httpCVE-2023-29406Public exploitFix available6.5 Medium
- go standard library runtime, golang go, fedoraproject fedora +2 moreUnsafe behavior in setuid/setgid binaries in runtimeCVE-2023-29403Fix available7.8 High
- go standard library html/template, golang go +1 moreImproper handling of empty HTML attributes in html/templateCVE-2023-29400Fix available7.3 High
- go standard library html/template, golang go +1 moreImproper handling of JavaScript whitespace in html/templateCVE-2023-24540Fix available9.8 Critical
- go standard library html/template, golang go +1 moreImproper sanitization of CSS values in html/templateCVE-2023-24539Fix available7.3 High
- go standard library html/template, golang go +1 moreBackticks not treated as string delimiters in html/templateCVE-2023-24538Public exploitFix available9.8 Critical
- go standard library go/scanner, golang go +1 moreInfinite loop in parsing in go/scannerCVE-2023-24537Fix available7.5 High
- go standard library mime/multipart, net/textproto, golang go +2 moreExcessive resource consumption in net/http, net/textproto and mime/multipartCVE-2023-24536Fix available7.5 High
- go standard library net/textproto, golang go +1 moreExcessive memory allocation in net/http and net/textprotoCVE-2023-24534Fix available7.5 High
- go standard library crypto/internal/nistec, golang go +1 moreIncorrect calculation on P256 curves in crypto/internal/nistecCVE-2023-24532Fix available5.3 Medium
- go standard library mime/multipart, golang go +1 moreExcessive resource consumption in mime/multipartCVE-2022-41725Fix available7.5 High
- go standard library net/http, golang go, hpack +3 more +5 moreDenial of service via crafted HTTP/2 stream in net/http and golang.org/x/netCVE-2022-41723Fix available7.5 High
- go standard library crypto/tls, golang go +1 morePanic on large handshake records in crypto/tlsCVE-2022-41724Fix available7.5 High
- go standard library path/filepath, golang go +1 morePath traversal on Windows in path/filepathCVE-2022-41722Fix available7.5 High
- go standard library net/http, golang go, http2 +2 more +4 moreExcessive memory growth in net/http and golang.org/x/net/http2CVE-2022-41717Public exploitFix available5.3 Medium
- go standard library net/http, os, golang go +2 moreRestricted file access on Windows in os and net/httpCVE-2022-41720Fix available7.5 High
- go standard library os/exec, syscall, golang go +2 moreUnsanitized NUL in environment variables on Windows in syscall and os/execCVE-2022-41716Fix available7.5 High
- go standard library net/http/httputil, golang go +1 moreIncorrect sanitization of forwarded query parameters in net/http/httputilCVE-2022-2880Fix available7.5 High
- go standard library regexp/syntax, golang go +1 moreMemory exhaustion when compiling regular expressions in regexp/syntaxCVE-2022-41715Fix available7.5 High
- go standard library archive/tar, golang go +1 moreUnbounded memory consumption when reading headers in archive/tarCVE-2022-2879Fix available7.5 High
- go standard library net/url, golang go +1 moreFailure to strip relative path components in net/urlCVE-2022-32190Fix available7.5 High
- go standard library math/big, golang go +1 morePanic when decoding Float and Rat types in math/bigCVE-2022-32189Fix available7.5 High
- go standard library net/http, golang go +1 moreExposure of client IP addresses in net/httpCVE-2022-32148Fix available6.5 Medium
- go standard library encoding/gob, golang go +1 moreStack exhaustion when decoding certain messages in encoding/gobCVE-2022-30635Fix available7.5 High
- go standard library encoding/xml, golang go +1 moreStack exhaustion when unmarshaling certain documents in encoding/xmlCVE-2022-30633Fix available7.5 High
- go standard library path/filepath, golang go +1 moreStack exhaustion on crafted paths in path/filepathCVE-2022-30632Fix available7.5 High
- go standard library compress/gzip, golang go +1 moreStack exhaustion when reading certain archives in compress/gzipCVE-2022-30631Fix available7.5 High
- go standard library io/fs, golang go +1 moreStack exhaustion in Glob on certain paths in io/fsCVE-2022-30630Fix available7.5 High
- go standard library encoding/xml, golang go, fedoraproject fedora +1 more +3 moreStack exhaustion from deeply nested XML documents in encoding/xmlCVE-2022-28131Fix available7.5 High
- go standard library go/parser, golang go +1 moreStack exhaustion due to deeply nested types in go/parserCVE-2022-1962Fix available5.5 Medium
- go standard library net/http, golang go +1 moreImproper sanitization of Transfer-Encoding headers in net/httpCVE-2022-1705Fix available6.5 Medium
- go standard library crypto/rand, golang go, netapp cloud insights telegraf agent +2 moreIndefinite hang with large buffers on Windows in crypto/randCVE-2022-30634Fix available7.5 High
- go standard library crypto/tls, golang go +1 moreSession tickets lack random ticket_age_add in crypto/tlsCVE-2022-30629Fix available3.1 Low
- go standard library os/exec, golang go +1 moreEmpty Cmd.Path can trigger unintended binary in os/exec on WindowsCVE-2022-30580Fix available7.8 High
- go standard library path/filepath, golang go +1 morePath traversal via Clean on Windows in path/filepathCVE-2022-29804Fix available7.5 High
- golang net, golang.org/x/net golang.org/x/net/idna, go standard library net/http +147 more +149 moreInvoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idnaCVE-2026-39821Fix available9.6 Critical