Golang vulnerabilities

Products

• Go 172
• Crypto 22
• Net 12
• Http2 6
• Image 6
• Text 4
• Ssh 3
• Tiff 3
• Networking 2

Newest

• golang crypto, golang.org/x/crypto golang.org/x/crypto/ssh +1 more Prevent DoS on deadlocked undecided channel in golang.org/x/crypto/ssh CVE-2026-78662 Fix available 7.5 HighSeptember 2, 2026
• golang crypto, golang.org/x/crypto golang.org/x/crypto/ssh +1 more Prevent DoS on deadlocked established channel in golang.org/x/crypto/ssh CVE-2026-56855 Fix available 7.5 HighSeptember 2, 2026
• go standard library crypto/tls, golang go +1 more Invoking Encrypted Client Hello privacy leak in crypto/tls CVE-2026-42505 Fix available 5.3 MediumJuly 7, 2026
• go standard library os, golang go +1 more Root escape via symlink plus trailing slash in os CVE-2026-39822 Fix available 7.8 HighJuly 7, 2026
• golang tiff, golang.org/x/image golang.org/x/image/tiff +1 more Panic decoding image with out-of-bounds strip offset in x/image/tiff in golang.org/x/image CVE-2026-46604 Fix available 7.5 HighJune 26, 2026
• golang net, golang.org/x/net golang.org/x/net/html +1 more Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html CVE-2026-42506 Fix available 6.1 MediumMay 22, 2026
• golang net, golang.org/x/net golang.org/x/net/html +1 more Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html CVE-2026-42502 Fix available 6.1 MediumMay 22, 2026
• golang net, golang.org/x/net golang.org/x/net/html +1 more Invoking duplicate attributes can cause XSS in golang.org/x/net/html CVE-2026-27136 Fix available 6.1 MediumMay 22, 2026
• golang net, golang.org/x/net golang.org/x/net/html +1 more Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html CVE-2026-25681 Fix available 6.1 MediumMay 22, 2026
• golang net, golang.org/x/net golang.org/x/net/html +1 more Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html CVE-2026-25680 Fix available 6.5 MediumMay 22, 2026
• golang crypto, golang.org/x/crypto golang.org/x/crypto/ssh/agent +1 more Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent CVE-2026-46598 Fix available 5.3 MediumMay 22, 2026
• golang crypto, golang.org/x/crypto golang.org/x/crypto/ssh +1 more Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh CVE-2026-46597 Fix available 7.5 HighMay 22, 2026
• golang crypto, golang.org/x/crypto golang.org/x/crypto/ssh, red hat assisted installer for red hat openshift container platform 2 +54 more +56 more Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh CVE-2026-46595 Public exploitFix available 10.0 CriticalMay 22, 2026
• golang crypto, golang.org/x/crypto golang.org/x/crypto/ssh/knownhosts, red hat assisted installer for red hat openshift container platform 2 +53 more +55 more Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts CVE-2026-42508 Fix available 9.1 CriticalMay 22, 2026
• golang crypto, golang.org/x/crypto golang.org/x/crypto/ssh, red hat assisted installer for red hat openshift container platform 2 +62 more +64 more Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh CVE-2026-39835 Fix available 5.3 MediumMay 22, 2026
• golang crypto, golang.org/x/crypto golang.org/x/crypto/ssh +1 more Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh CVE-2026-39834 Fix available 9.1 CriticalMay 22, 2026
• golang crypto, golang.org/x/crypto golang.org/x/crypto/ssh/agent +1 more Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent CVE-2026-39833 Fix available 9.1 CriticalMay 22, 2026
• golang crypto, golang.org/x/crypto golang.org/x/crypto/ssh/agent, red hat assisted installer for red hat openshift container platform 2 +46 more +48 more Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent CVE-2026-39832 Fix available 9.1 CriticalMay 22, 2026
• golang crypto, golang.org/x/crypto golang.org/x/crypto/ssh +1 more Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh CVE-2026-39831 Fix available 9.1 CriticalMay 22, 2026
• golang crypto, golang.org/x/crypto golang.org/x/crypto/ssh, red hat assisted installer for red hat openshift container platform 2 +68 more +70 more Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh CVE-2026-39830 Fix available 9.1 CriticalMay 22, 2026
• golang crypto, golang.org/x/crypto golang.org/x/crypto/ssh, red hat assisted installer for red hat openshift container platform 2 +74 more +76 more Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh CVE-2026-39829 Fix available 7.5 HighMay 22, 2026
• golang crypto, golang.org/x/crypto golang.org/x/crypto/ssh, red hat assisted installer for red hat openshift container platform 2 +64 more +66 more Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh CVE-2026-39828 Fix available 6.3 MediumMay 22, 2026
• golang crypto, golang.org/x/crypto golang.org/x/crypto/ssh +1 more Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh CVE-2026-39827 Fix available 6.5 MediumMay 22, 2026
• go toolchain cmd/go, golang go +1 more Malicious module proxy can bypass checksum database in cmd/go CVE-2026-42501 Fix available 7.5 HighMay 7, 2026
• go standard library net/mail, golang go, red hat assisted installer for red hat openshift container platform 2 +108 more +110 more Quadratic string concatenation in consumePhrase in net/mail CVE-2026-42499 Fix available 7.5 HighMay 7, 2026
• go standard library net, golang go +1 more Panic in Dial and LookupPort when handling NUL byte on Windows in net CVE-2026-39836 Fix available 7.5 HighMay 7, 2026
• go standard library html/template, golang go +1 more Escaper bypass leads to XSS in html/template CVE-2026-39826 Fix available 6.1 MediumMay 7, 2026
• go standard library net/http/httputil, golang go +1 more ReverseProxy forwards queries with more than urlmaxqueryparams parameters in net/http/httputil CVE-2026-39825 Fix available 5.3 MediumMay 7, 2026
• go standard library html/template, golang go +1 more Bypass of meta content URL escaping causes XSS in html/template CVE-2026-39823 Fix available 6.1 MediumMay 7, 2026
• go standard library net/mail, golang go, red hat assisted installer for red hat openshift container platform 2 +107 more +109 more Quadratic string concatentation in consumeComment in net/mail CVE-2026-39820 Fix available 7.5 HighMay 7, 2026
• go toolchain cmd/go, golang go +1 more Invoking "go bug" follows symlinks in predictable temporary filenames in cmd/go CVE-2026-39819 Fix available 5.3 MediumMay 7, 2026
• go toolchain cmd/go, golang go +1 more Invoking "go tool pack" does not sanitize output paths in cmd/go CVE-2026-39817 Fix available 5.9 MediumMay 7, 2026
• go standard library net/http, golang go, http2 +106 more +108 more Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net CVE-2026-33814 Fix available 7.5 HighMay 7, 2026
• go standard library net, golang go, red hat assisted installer for red hat openshift container platform 2 +145 more +147 more Crash when handling long CNAME response in net CVE-2026-33811 Fix available 7.5 HighMay 7, 2026
• golang gopls, golang.org/x/tools golang.org/x/tools/gopls +1 more Accidental binding to INADDR_ANY might lead to RCE in golang.org/x/tools/gopls CVE-2026-42503 Fix available 8.8 HighMay 6, 2026
• golang image, golang.org/x/image golang.org/x/image/font/sfnt +1 more Excessive memory allocation when decoding malicious SFNT in golang.org/x/image CVE-2026-33812 Fix available 6.1 MediumApril 21, 2026
• golang image, golang.org/x/image golang.org/x/image/webp +1 more Panic when decoding large WEBP image on 32-bit platforms in golang.org/x/image CVE-2026-33813 Fix available 7.5 HighApril 21, 2026
• go standard library crypto/x509, golang go, red hat assisted installer for red hat openshift container platform 2 +103 more +105 more Case-sensitive excludedSubtrees name constraints cause Auth Bypass in crypto/x509 CVE-2026-33810 Fix available 8.2 HighApril 7, 2026
• go standard library html/template, golang go +1 more JsBraceDepth Context Tracking Bugs (XSS) in html/template CVE-2026-32289 Fix available 6.1 MediumApril 7, 2026
• go standard library archive/tar, golang go +1 more Unbounded allocation for old GNU sparse in archive/tar CVE-2026-32288 Fix available 5.5 MediumApril 7, 2026
• go standard library crypto/tls, golang go, red hat assisted installer for red hat openshift container platform 2 +117 more +119 more Unauthenticated TLS 1.3 KeyUpdate record can cause persistent connection retention and DoS in crypto/tls CVE-2026-32283 Fix available 7.5 HighApril 7, 2026
• go standard library internal/syscall/unix, golang go +1 more TOCTOU permits root escape on Linux via Root.Chmod in os in internal/syscall/unix CVE-2026-32282 Fix available 6.4 MediumApril 7, 2026
• go standard library crypto/x509, golang go +1 more Inefficient policy validation in crypto/x509 CVE-2026-32281 Fix available 7.5 HighApril 7, 2026
• go standard library crypto/x509, golang go, red hat assisted installer for red hat openshift container platform 2 +140 more +142 more Unexpected work during chain building in crypto/x509 CVE-2026-32280 Fix available 7.5 HighApril 7, 2026
• go toolchain cmd/compile, golang go +1 more Miscompilation allows memory corruption via CONVNOP-wrapped array copy in cmd/compile CVE-2026-27144 Fix available 7.1 HighApril 7, 2026
• go toolchain cmd/compile, golang go +1 more Missing bound checks can lead to memory corruption in safe Go in cmd/compile CVE-2026-27143 Fix available 9.8 CriticalApril 7, 2026
• go toolchain cmd/go, golang go, red hat openshift service mesh 2 +24 more +26 more Code execution vulnerability in SWIG code generation in cmd/go CVE-2026-27140 Fix available 8.8 HighApril 7, 2026
• golang tiff, golang.org/x/image golang.org/x/image/tiff +1 more OOM from malicious IFD offset in golang.org/x/image/tiff CVE-2026-33809 Fix available 5.3 MediumMarch 25, 2026
• go standard library html/template, golang go +1 more URLs in meta content attribute actions are not escaped in html/template CVE-2026-27142 Fix available 6.1 MediumMarch 6, 2026
• go standard library os, golang go +1 more FileInfo can escape from a Root in os CVE-2026-27139 Fix available 2.5 LowMarch 6, 2026
• Show olderLoading…