Skip to contentGolang Go vulnerabilities
- golang go, debian linux, fedoraproject fedora +6 more +8 moreGo before 1.12.10 and 1.13.x before 1.13.1 allow HTTP Request Smuggling.CVE-2019-16276Fix available7.5 High
- golang go, debian linux +1 morenet/url in Go before 1.11.13 and 1.12.x before 1.12.8 mishandles malformed hosts in URLs, leading...CVE-2019-14809Fix available9.8 Critical
- golang goGo through 1.12.5 on Windows mishandles process creation with a nil environment in conjunction...CVE-2019-118889.8 Critical
- golang go, debian linux, fedoraproject fedora +2 more +4 moreAn issue was discovered in net/http in Go 1.11.5. CRLF injection is possible if the attacker...CVE-2019-9741Fix available6.1 Medium
- golang goGo through 1.12 on Windows misuses certain LoadLibrary functionality, leading to DLL injection.CVE-2019-9634Fix available7.8 High
- golang go, debian linux, opensuse leap +2 moreGo before 1.10.8 and 1.11.x before 1.11.5 mishandles P-521 and P-384 elliptic curves, which...CVE-2019-6486Fix available8.2 High
- golang go, [unknown] golang, opensuse leap +2 moreThe crypto/x509 package of Go before 1.10.6 and 1.11.x before 1.11.3 does not limit the amount of...CVE-2018-16875Public exploitFix available5.9 Medium
- [unknown] golang, golang go, debian linux +3 more +5 moreIn Go before 1.10.6 and 1.11.x before 1.11.3, the "go get" command is vulnerable to directory...CVE-2018-16874Fix available6.8 Medium
- [unknown] golang, golang go, debian linux +3 more +5 moreIn Go before 1.10.6 and 1.11.x before 1.11.3, the "go get" command is vulnerable to remote code...CVE-2018-16873Fix availableEPSS 66.3%7.5 High
- golang go, debian linux +1 moreThe "go get" implementation in Go 1.9.4, when the -insecure command-line option is used, does not...CVE-2018-7187Fix availableEPSS 63.0%8.8 High
- golang go, debian linux, redhat enterprise linux server +3 more +5 moreGo before 1.8.7, Go 1.9.x before 1.9.4, and Go 1.10 pre-releases before Go 1.10rc2 allow "go get"...CVE-2018-6574Public exploitFix available7.8 High
- golang go, fedoraproject fedora, redhat enterprise linux server +3 more +5 moreThe net/http library in net/http/transfer.go in Go before 1.4.3 does not properly parse HTTP...CVE-2015-57409.8 Critical
- golang go, fedoraproject fedora, redhat enterprise linux server +3 more +5 moreThe net/http library in net/textproto/reader.go in Go before 1.4.3 does not properly parse HTTP...CVE-2015-57399.8 Critical
- golang goAn unintended cleartext issue exists in Go before 1.8.4 and 1.9.x before 1.9.1. RFC 4954 requires...CVE-2017-15042Fix available5.9 Medium
- golang go, debian linux, redhat developer tools +4 more +6 moreGo before 1.8.4 and 1.9.x before 1.9.1 allows "go get" remote command execution. Using custom...CVE-2017-15041Fix available9.8 Critical
- golang goThe net/http package's Request.ParseMultipartForm method starts writing to temporary files once...CVE-2017-1000098Fix available7.5 High
- golang goOn Darwin, user's trust preferences for root certificates were not honored. If the user had a...CVE-2017-1000097Fix available7.5 High
- golang go, fedoraproject fedora, novell suse package hub for suse linux enterprise +1 more +3 moreA bug in the standard library ScalarMult implementation of curve P-256 for amd64 architectures in...CVE-2017-8932Fix available5.9 Medium
- golang go, fedoraproject fedora, oracle linux +3 more +5 moreThe net/http package in Go through 1.6 does not attempt to address RFC 3875 section 4.1.18...CVE-2016-5386Fix available8.1 High
- golang go, fedoraproject fedora, opensuse leap +2 moreThe Verify function in crypto/dsa/dsa.go in Go before 1.5.4 and 1.6.x before 1.6.1 does not...CVE-2016-3959Public exploitFix available7.5 High
- golang goUntrusted search path vulnerability in Go before 1.5.4 and 1.6.x before 1.6.1 on Windows allows...CVE-2016-3958Fix available7.8 High
- golang go, opensuse leap +1 moreThe Int.Exp Montgomery code in the math/big library in Go 1.5.x before 1.5.3 mishandles carry...CVE-2015-8618Fix available7.5 High
- golang gocrpyto/tls in Go 1.1 before 1.3.2, when SessionTicketsDisabled is enabled, allows man-in-the...CVE-2014-7189Fix available4.3 Medium