Golang Go vulnerabilities

• go standard library crypto/tls, golang go +1 more Invoking Encrypted Client Hello privacy leak in crypto/tls CVE-2026-42505 Fix available 5.3 MediumJuly 7, 2026
• go standard library os, golang go +1 more Root escape via symlink plus trailing slash in os CVE-2026-39822 Fix available 7.8 HighJuly 7, 2026
• go toolchain cmd/go, golang go +1 more Malicious module proxy can bypass checksum database in cmd/go CVE-2026-42501 Fix available 7.5 HighMay 7, 2026
• go standard library net/mail, golang go, red hat assisted installer for red hat openshift container platform 2 +108 more +110 more Quadratic string concatenation in consumePhrase in net/mail CVE-2026-42499 Fix available 7.5 HighMay 7, 2026
• go standard library net, golang go +1 more Panic in Dial and LookupPort when handling NUL byte on Windows in net CVE-2026-39836 Fix available 7.5 HighMay 7, 2026
• go standard library html/template, golang go +1 more Escaper bypass leads to XSS in html/template CVE-2026-39826 Fix available 6.1 MediumMay 7, 2026
• go standard library net/http/httputil, golang go +1 more ReverseProxy forwards queries with more than urlmaxqueryparams parameters in net/http/httputil CVE-2026-39825 Fix available 5.3 MediumMay 7, 2026
• go standard library html/template, golang go +1 more Bypass of meta content URL escaping causes XSS in html/template CVE-2026-39823 Fix available 6.1 MediumMay 7, 2026
• go standard library net/mail, golang go, red hat assisted installer for red hat openshift container platform 2 +107 more +109 more Quadratic string concatentation in consumeComment in net/mail CVE-2026-39820 Fix available 7.5 HighMay 7, 2026
• go toolchain cmd/go, golang go +1 more Invoking "go bug" follows symlinks in predictable temporary filenames in cmd/go CVE-2026-39819 Fix available 5.3 MediumMay 7, 2026
• go toolchain cmd/go, golang go +1 more Invoking "go tool pack" does not sanitize output paths in cmd/go CVE-2026-39817 Fix available 5.9 MediumMay 7, 2026
• go standard library net/http, golang go, http2 +106 more +108 more Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net CVE-2026-33814 Fix available 7.5 HighMay 7, 2026
• go standard library net, golang go, red hat assisted installer for red hat openshift container platform 2 +145 more +147 more Crash when handling long CNAME response in net CVE-2026-33811 Fix available 7.5 HighMay 7, 2026
• golang gopls, golang.org/x/tools golang.org/x/tools/gopls +1 more Accidental binding to INADDR_ANY might lead to RCE in golang.org/x/tools/gopls CVE-2026-42503 Fix available 8.8 HighMay 6, 2026
• go standard library crypto/x509, golang go, red hat assisted installer for red hat openshift container platform 2 +103 more +105 more Case-sensitive excludedSubtrees name constraints cause Auth Bypass in crypto/x509 CVE-2026-33810 Fix available 8.2 HighApril 7, 2026
• go standard library html/template, golang go +1 more JsBraceDepth Context Tracking Bugs (XSS) in html/template CVE-2026-32289 Fix available 6.1 MediumApril 7, 2026
• go standard library archive/tar, golang go +1 more Unbounded allocation for old GNU sparse in archive/tar CVE-2026-32288 Fix available 5.5 MediumApril 7, 2026
• go standard library crypto/tls, golang go, red hat assisted installer for red hat openshift container platform 2 +117 more +119 more Unauthenticated TLS 1.3 KeyUpdate record can cause persistent connection retention and DoS in crypto/tls CVE-2026-32283 Fix available 7.5 HighApril 7, 2026
• go standard library internal/syscall/unix, golang go +1 more TOCTOU permits root escape on Linux via Root.Chmod in os in internal/syscall/unix CVE-2026-32282 Fix available 6.4 MediumApril 7, 2026
• go standard library crypto/x509, golang go +1 more Inefficient policy validation in crypto/x509 CVE-2026-32281 Fix available 7.5 HighApril 7, 2026
• go standard library crypto/x509, golang go, red hat assisted installer for red hat openshift container platform 2 +140 more +142 more Unexpected work during chain building in crypto/x509 CVE-2026-32280 Fix available 7.5 HighApril 7, 2026
• go toolchain cmd/compile, golang go +1 more Miscompilation allows memory corruption via CONVNOP-wrapped array copy in cmd/compile CVE-2026-27144 Fix available 7.1 HighApril 7, 2026
• go toolchain cmd/compile, golang go +1 more Missing bound checks can lead to memory corruption in safe Go in cmd/compile CVE-2026-27143 Fix available 9.8 CriticalApril 7, 2026
• go toolchain cmd/go, golang go, red hat openshift service mesh 2 +24 more +26 more Code execution vulnerability in SWIG code generation in cmd/go CVE-2026-27140 Fix available 8.8 HighApril 7, 2026
• go standard library html/template, golang go +1 more URLs in meta content attribute actions are not escaped in html/template CVE-2026-27142 Fix available 6.1 MediumMarch 6, 2026
• go standard library os, golang go +1 more FileInfo can escape from a Root in os CVE-2026-27139 Fix available 2.5 LowMarch 6, 2026
• go standard library net/url, golang go, red hat assisted installer for red hat openshift container platform 2 +143 more +145 more Incorrect parsing of IPv6 host literals in net/url CVE-2026-25679 Fix available 7.5 HighMarch 6, 2026
• go standard library crypto/x509, golang go +1 more Panic in name constraint checking for malformed certificates in crypto/x509 CVE-2026-27138 Fix available 5.9 MediumMarch 6, 2026
• go standard library crypto/x509, golang go, red hat assisted installer for red hat openshift container platform 2 +99 more +101 more Incorrect enforcement of email constraints in crypto/x509 CVE-2026-27137 Fix available 7.5 HighMarch 6, 2026
• go toolchain cmd/cgo, golang go, red hat enterprise linux 10 +31 more +33 more Potential code smuggling via doc comments in cmd/cgo CVE-2025-61732 Fix available 8.6 HighFebruary 5, 2026
• go standard library crypto/tls, golang go +1 more Unexpected session resumption in crypto/tls CVE-2025-68121 Fix available 10.0 CriticalJanuary 16, 2026
• go toolchain cmd/go, golang go, red hat enterprise linux 10 +30 more +32 more Arbitrary file write using cgo pkg-config directive in cmd/go CVE-2025-61731 Fix available 7.8 HighJanuary 16, 2026
• go toolchain cmd/go, golang go +1 more Unexpected code execution when invoking toolchain in cmd/go CVE-2025-68119 Fix available 7.0 HighJanuary 16, 2026
• go standard library crypto/tls, golang go +1 more Handshake messages may be processed at the incorrect encryption level in crypto/tls CVE-2025-61730 Fix available 5.3 MediumJanuary 16, 2026
• go standard library archive/zip, golang go +1 more Excessive CPU consumption when building archive index in archive/zip CVE-2025-61728 Fix available 6.5 MediumJanuary 16, 2026
• go standard library net/url, golang go, red hat assisted installer for red hat openshift container platform 2 +160 more +162 more Memory exhaustion in query parameter parsing in net/url CVE-2025-61726 Fix available 7.5 HighJanuary 16, 2026
• go standard library crypto/x509, golang go +1 more Improper application of excluded DNS name constraints when verifying wildcard names in crypto/x509 CVE-2025-61727 Fix available 6.5 MediumDecember 2, 2025
• go standard library crypto/x509, golang go +1 more Excessive resource consumption when printing error string for host certificate validation in crypto/x509 CVE-2025-61729 Fix available 7.5 HighDecember 2, 2025
• go standard library net/textproto, golang go +1 more Excessive CPU consumption in Reader.ReadResponse in net/textproto CVE-2025-61724 Fix available 5.3 MediumOctober 8, 2025
• go standard library encoding/pem, golang go +1 more Quadratic complexity when parsing some invalid inputs in encoding/pem CVE-2025-61723 Fix available 7.5 HighOctober 8, 2025
• go standard library crypto/tls, golang go +1 more ALPN negotiation error contains attacker controlled information in crypto/tls CVE-2025-58189 Fix available 5.3 MediumOctober 8, 2025
• go standard library crypto/x509, golang go +1 more Panic when validating certificates with DSA public keys in crypto/x509 CVE-2025-58188 Fix available 7.5 HighOctober 8, 2025
• go standard library crypto/x509, golang go +1 more Quadratic complexity when checking name constraints in crypto/x509 CVE-2025-58187 Fix available 7.5 HighOctober 8, 2025
• go standard library encoding/asn1, golang go +1 more Parsing DER payload can cause memory exhaustion in encoding/asn1 CVE-2025-58185 Fix available 5.3 MediumOctober 8, 2025
• go standard library net/url, golang go +1 more Insufficient validation of bracketed IPv6 hostnames in net/url CVE-2025-47912 Fix available 5.3 MediumOctober 8, 2025
• go standard library database/sql, golang go +1 more Incorrect results returned from Rows.Scan in database/sql CVE-2025-47907 Fix available 7.0 HighAugust 7, 2025
• go standard library os/exec, golang go +1 more Unexpected paths returned from LookPath in os/exec CVE-2025-47906 Fix available 6.5 MediumAugust 7, 2025
• go toolchain cmd/go, golang go +1 more Unexpected command execution in untrusted VCS repositories in cmd/go CVE-2025-4674 Fix available 8.6 HighJuly 9, 2025
• go standard library os, syscall, golang go +2 more Inconsistent handling of O_CREATE|O_EXCL on Unix and Windows in os in syscall CVE-2025-0913 Fix available 5.5 MediumJune 9, 2025
• go standard library os, golang go +1 more Improper access to parent directory of root in os CVE-2025-22873 Fix available 3.8 LowMay 7, 2025
• Show olderLoading…