Skip to contentGo Standard Library vulnerabilities
Newest
- go standard library archive/zip, golang go +1 moreExcessive CPU consumption when building archive index in archive/zipCVE-2025-61728Fix available6.5 Medium
- go standard library net/url, golang go, red hat assisted installer for red hat openshift container platform 2 +160 more +162 moreMemory exhaustion in query parameter parsing in net/urlCVE-2025-61726Fix available7.5 High
- go standard library crypto/x509, golang go +1 moreImproper application of excluded DNS name constraints when verifying wildcard names in crypto/x509CVE-2025-61727Fix available6.5 Medium
- go standard library crypto/x509, golang go +1 moreExcessive resource consumption when printing error string for host certificate validation in crypto/x509CVE-2025-61729Fix available7.5 High
- go standard library net/mailExcessive CPU consumption in ParseAddress in net/mailCVE-2025-61725Fix available7.5 High
- go standard library net/textproto, golang go +1 moreExcessive CPU consumption in Reader.ReadResponse in net/textprotoCVE-2025-61724Fix available5.3 Medium
- go standard library encoding/pem, golang go +1 moreQuadratic complexity when parsing some invalid inputs in encoding/pemCVE-2025-61723Fix available7.5 High
- go standard library crypto/tls, golang go +1 moreALPN negotiation error contains attacker controlled information in crypto/tlsCVE-2025-58189Fix available5.3 Medium
- go standard library crypto/x509, golang go +1 morePanic when validating certificates with DSA public keys in crypto/x509CVE-2025-58188Fix available7.5 High
- go standard library crypto/x509, golang go +1 moreQuadratic complexity when checking name constraints in crypto/x509CVE-2025-58187Fix available7.5 High
- go standard library net/httpLack of limit when parsing cookies can cause memory exhaustion in net/httpCVE-2025-58186Fix available5.3 Medium
- go standard library encoding/asn1, golang go +1 moreParsing DER payload can cause memory exhaustion in encoding/asn1CVE-2025-58185Fix available5.3 Medium
- go standard library archive/tarUnbounded allocation when parsing GNU sparse map in archive/tarCVE-2025-58183Fix available4.3 Medium
- go standard library net/url, golang go +1 moreInsufficient validation of bracketed IPv6 hostnames in net/urlCVE-2025-47912Fix available5.3 Medium
- go standard library net/httpCrossOriginProtection insecure bypass patterns not limited to exact matches in net/httpCVE-2025-47910Fix available5.4 Medium
- go standard library database/sql, golang go +1 moreIncorrect results returned from Rows.Scan in database/sqlCVE-2025-47907Fix available7.0 High
- go standard library os/exec, golang go +1 moreUnexpected paths returned from LookPath in os/execCVE-2025-47906Fix available6.5 Medium
- go standard library path/filepathWalk/WalkDir in path/filepath susceptible to symlink raceCVE-2024-82443.7 Low
- go standard library osIGEL OS Secure Terminal and Secure Shadow Remote Code ExecutionCVE-2025-34082Public exploit9.3 Critical
- go standard library net/httpSensitive headers not cleared on cross-origin redirect in net/httpCVE-2025-4673Fix available6.8 Medium
- go standard library crypto/x509Usage of ExtKeyUsageAny disables policy validation in crypto/x509CVE-2025-22874Fix available7.5 High
- go standard library os, syscall, golang go +2 moreInconsistent handling of O_CREATE|O_EXCL on Unix and Windows in os in syscallCVE-2025-0913Fix available5.5 Medium
- go standard library os, golang go +1 moreImproper access to parent directory of root in osCVE-2025-22873Fix available3.8 Low
- go standard library net/http/internal, siemens sentron 7kt pac1261 data manager +1 moreRequest smuggling due to acceptance of invalid chunked data in net/httpCVE-2025-22871Fix available9.1 Critical
- go standard library net/http, golang.org/x/net golang.org/x/net/http/httpproxy, golang.org/x/net/proxy +2 moreHTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/netCVE-2025-22870Public exploitFix available4.4 Medium
- go standard library crypto/internal/nistecTiming sidechannel for P-256 on ppc64le in crypto/internal/nistecCVE-2025-22866Fix available4.0 Medium
- go standard library crypto/x509ParsePKCS1PrivateKey panic with partial keys in crypto/x509CVE-2025-22865Fix available7.5 High
- go standard library crypto/x509Usage of IPv6 zone IDs can bypass URI name constraints in crypto/x509CVE-2024-45341Fix available6.1 Medium
- go standard library net/httpSensitive headers incorrectly sent after cross-domain redirect in net/httpCVE-2024-45336Fix available6.1 Medium
- go standard library go/build/constraint, go build constraint standard library +1 moreStack exhaustion in Parse in go/build/constraintCVE-2024-34158Fix available7.5 High
- go standard library encoding/gob, encoding\/gob +1 moreStack exhaustion in Decoder.Decode in encoding/gobCVE-2024-34156Fix available7.5 High
- go standard library go/parserStack exhaustion in all Parse functions in go/parserCVE-2024-34155Fix available4.3 Medium
- go standard library net/http, net\/http +1 moreDenial of service due to improper 100-continue handling in net/httpCVE-2024-24791Fix available7.5 High
- go standard library net/netip, golang go +1 moreUnexpected behavior from Is methods for IPv4-mapped IPv6 addresses in net/netipCVE-2024-24790Fix available9.8 Critical
- go standard library archive/zip, golang go +1 moreMishandling of corrupt central directory record in archive/zipCVE-2024-24789Fix available5.5 Medium
- go standard library netMalformed DNS message can cause infinite loop in netCVE-2024-24788Fix available5.9 Medium
- go standard library net/http, net\/http, golang http2 +1 more +3 moreHTTP/2 CONTINUATION flood in net/httpCVE-2023-45288Public exploitFix availableEPSS 89.5%7.5 High
- go standard library html/templateErrors returned from JSON marshaling may break template escaping in html/templateCVE-2024-24785Fix available5.4 Medium
- go standard library net/mail, net\/mail +1 moreComments in display names are incorrectly handled in net/mailCVE-2024-24784Fix available7.5 High
- go standard library net/http, net/http/cookiejar +1 moreIncorrect forwarding of sensitive headers and cookies on HTTP redirect in net/httpCVE-2023-45289Fix available4.3 Medium
- go standard library net/textprotoMemory exhaustion in multipart form parsing in net/textproto and net/httpCVE-2023-45290Fix available6.5 Medium
- go standard library crypto/x509Verify panics on certificates with an unknown public key algorithm in crypto/x509CVE-2024-24783Fix available5.9 Medium
- go standard library net/http/internal, golang go +1 moreDenial of service via chunk extensions in net/httpCVE-2023-39326Fix available5.3 Medium
- go standard library crypto/tls, golang go +1 moreBefore Go 1.20, the RSA based key exchange methods in crypto/tls may exhibit a timing side channelCVE-2023-45287Fix available7.5 High
- go standard library path/filepath, golang go +1 moreIncorrect detection of reserved device names on Windows in path/filepathCVE-2023-45284Fix available5.3 Medium
- go standard library path/filepath, golang go, go standard library internal/safefilepath +2 moreInsecure parsing of Windows paths with a \??\ prefix in path/filepathCVE-2023-45283Fix available7.5 High
- go standard library net/http, golang go, http2 +4 more +6 moreHTTP/2 rapid reset can cause excessive work in net/httpCVE-2023-39325Public exploitFix available7.5 High
- go standard library crypto/tls, golang go +1 morePanic when processing post-handshake message on QUIC connections in crypto/tlsCVE-2023-39321Fix available7.5 High
- go standard library crypto/tls, crypto tls, golang go +2 moreMemory exhaustion in QUIC connection handling in crypto/tlsCVE-2023-39322Fix available7.5 High
- go standard library html/template, golang go +1 moreImproper handling of special tags within script contexts in html/templateCVE-2023-39319Fix available6.1 Medium
- Show moreLoading…