Skip to contentGolang Go vulnerabilities
- go standard library encoding/xml, golang go, fedoraproject fedora +1 more +3 moreStack exhaustion from deeply nested XML documents in encoding/xmlCVE-2022-28131Fix available7.5 High
- go standard library go/parser, golang go +1 moreStack exhaustion due to deeply nested types in go/parserCVE-2022-1962Fix available5.5 Medium
- go standard library net/http, golang go +1 moreImproper sanitization of Transfer-Encoding headers in net/httpCVE-2022-1705Fix available6.5 Medium
- go standard library crypto/rand, golang go, netapp cloud insights telegraf agent +2 moreIndefinite hang with large buffers on Windows in crypto/randCVE-2022-30634Fix available7.5 High
- go standard library crypto/tls, golang go +1 moreSession tickets lack random ticket_age_add in crypto/tlsCVE-2022-30629Fix available3.1 Low
- go standard library os/exec, golang go +1 moreEmpty Cmd.Path can trigger unintended binary in os/exec on WindowsCVE-2022-30580Fix available7.8 High
- go standard library path/filepath, golang go +1 morePath traversal via Clean on Windows in path/filepathCVE-2022-29804Fix available7.5 High
- golang go, fedoraproject fedora, netapp beegfs csi driver +2 moregolang.org/x/sys/unix has Incorrect privilege reporting in syscallCVE-2022-29526Fix available5.3 Medium
- golang go, fedoraproject extra packages for enterprise linux, fedora +2 moreThe generic P-256 feature in crypto/elliptic in Go before 1.17.9 and 1.18.x before 1.18.1 allows...CVE-2022-28327Fix available7.5 High
- golang goCertificate.Verify in crypto/x509 in Go 1.18.x before 1.18.1 can be caused to panic on macOS when...CVE-2022-27536Fix available7.5 High
- golang go, fedoraproject fedora, netapp kubernetes monitoring operator +2 moreencoding/pem in Go before 1.17.9 and 1.8.x before 1.8.1 has a Decode stack overflow via a large...CVE-2022-24675Public exploitFix available7.5 High
- golang go, debian linux, netapp astra trident +2 moreregexp.Compile in Go before 1.16.15 and 1.17.x before 1.17.8 allows stack exhaustion via a deeply...CVE-2022-24921Fix available7.5 High
- golang go, netapp beegfs csi driver, cloud insights telegraf agent +2 more +4 morecmd/go in Go before 1.16.14 and 1.17.x before 1.17.7 can misinterpret branch names that falsely...CVE-2022-23773Public exploitFix available7.5 High
- golang go, debian linux, netapp beegfs csi driver +3 more +5 moreRat.SetString in math/big in Go before 1.16.14 and 1.17.x before 1.17.7 has an overflow that can...CVE-2022-23772Fix available7.5 High
- golang go, debian linux, netapp beegfs csi driver +3 more +5 moreCurve.IsOnCurve in crypto/elliptic in Go before 1.16.14 and 1.17.x before 1.17.7 can incorrectly...CVE-2022-23806Fix available9.1 Critical
- golang go, debian linux +1 moreGo before 1.16.12 and 1.17.x before 1.17.5 on UNIX allows write operations to an unintended file...CVE-2021-44717Fix available4.8 Medium
- golang go, debian linux, netapp cloud insights telegraf +2 moregolang.org/x/net/http2 allows uncontrolled memory consumptionCVE-2021-44716Fix available7.5 High
- golang go, fedoraproject fedora, oracle timesten in-memory database +2 moreGo before 1.16.10 and 1.17.x before 1.17.3 allows an archive/zip Reader.Open panic via a crafted...CVE-2021-41772Fix available7.5 High
- golang go, debian linux, fedoraproject fedora +2 moreImportedSymbols in debug/macho (for Open or OpenFat) in Go before 1.16.10 and 1.17.x before 1.17...CVE-2021-41771Fix available7.5 High
- golang go, fedoraproject fedora +1 moreGo before 1.16.9 and 1.17.x before 1.17.2 has a Buffer Overflow via large arguments in a function...CVE-2021-38297Public exploitFix availableEPSS 11.0%9.8 Critical
- golang go, netapp cloud insights telegraf +1 moreIn archive/zip in Go before 1.16.8 and 1.17.x before 1.17.1, a crafted archive header (falsely...CVE-2021-39293Fix available7.5 High
- golang go, debian linux, fedoraproject fedora +2 more +4 moreGo before 1.15.15 and 1.16.x before 1.16.7 has a race condition that can lead to a net/http...CVE-2021-36221Fix available5.9 Medium
- golang go, fedoraproject fedora, oracle timesten in-memory database +2 moreGo before 1.17 does not properly consider extraneous zero characters at the beginning of an IP...CVE-2021-29923Fix available7.5 High
- golang go, fedoraproject fedora, netapp cloud insights telegraf +3 more +5 moreThe crypto/tls package of Go through 1.16.5 does not properly assert that the type of public key...CVE-2021-34558Public exploitFix available6.5 Medium
- golang gogolang/go in 1.0.2 fixes all.bash on shared machines. dotest() in src/pkg/debug/gosym...CVE-2012-26669.8 Critical
- golang goGo before 1.15.12 and 1.16.x before 1.16.5 attempts to allocate excessive memory (issue 2 of 2).CVE-2021-33198Fix available7.5 High
- golang goGo before 1.15.12 and 1.16.x before 1.16.5 acts as an Unintended Proxy or Intermediary.CVE-2021-33197Fix available5.3 Medium
- golang go, debian linux +1 moreGo before 1.15.12 and 1.16.x before 1.16.5 attempts to allocate excessive memory (issue 1 of 2).CVE-2021-33196Fix available7.5 High
- golang go, netapp cloud insights telegraf agent +1 moreGo before 1.15.12 and 1.16.x before 1.16.5 allows injection.CVE-2021-33195Fix available7.3 High
- golang go, fedoraproject fedora +1 moregolang.org/x/net/http/httpguts vulnerable to Uncontrolled RecursionCVE-2021-31525Fix available5.9 Medium
- golang go, fedoraproject fedora +1 moregolang.org/x/net/html Infinite Loop vulnerabilityCVE-2021-33194Fix available7.5 High
- golang go, fedoraproject fedora +1 morearchive/zip in Go 1.16.x before 1.16.1 allows attackers to cause a denial of service (panic) upon...CVE-2021-27919Fix available5.5 Medium
- golang goencoding/xml in Go before 1.15.9 and 1.16.x before 1.16.1 has an infinite loop if a custom...CVE-2021-27918Fix available7.5 High
- golang go, debian linux, fedoraproject fedora +2 more +4 moreIn Go before 1.14.14 and 1.15.x before 1.15.7, crypto/elliptic/p224.go can generate incorrect...CVE-2021-3114Fix available6.5 Medium
- golang go, fedoraproject fedora, netapp cloud insights telegraf agent +1 more +3 moreGo before 1.14.14 and 1.15.x before 1.15.7 on Windows is vulnerable to Command Injection and...CVE-2021-3115Fix available7.5 High
- golang goIn x/text in Go 1.15.4, an "index out of range" panic occurs in language.ParseAcceptLanguage...CVE-2020-28851Fix available7.5 High
- ecies go, netapp trident +1 moreAuthentication Bypass in github.com/russellhaering/gosaml2CVE-2020-29509Fix available9.8 Critical
- ecies go, netapp trident +1 moreThe encoding/xml package in Go (all versions) does not correctly preserve the semantics of...CVE-2020-29511Fix available9.8 Critical
- ecies go, netapp trident +1 moreThe encoding/xml package in Go versions 1.15 and earlier does not correctly preserve the...CVE-2020-29510Fix available9.8 Critical
- golang go, fedoraproject fedora, netapp cloud insights telegraf agent +1 more +3 moreGo before 1.14.12 and 1.15.x before 1.15.4 allows Denial of Service.CVE-2020-28362Fix available7.5 High
- go toolchain cmd/go, golang go +1 moreArbitrary code execution via the go command with cgo in cmd/goCVE-2020-28367Fix available7.5 High
- go toolchain cmd/cgo, cmd/go, golang go +3 more +5 moreArbitrary code execution in go command with cgo in cmd/go and cmd/cgoCVE-2020-28366Fix available7.5 High
- golang go, fedoraproject fedora, opensuse leap +1 more +3 moreGo before 1.14.8 and 1.15.x before 1.15.1 allows XSS because text/html is the default for CGI...CVE-2020-24553Fix available6.1 Medium
- golang go, debian linux, fedoraproject fedora +1 more +3 moreWithdrawn Advisory: Infinite loop in xzCVE-2020-16845Fix available7.5 High
- golang go, opensuse leap +1 moreIn Go before 1.13.13 and 1.14.x before 1.14.5, Certificate.Verify may lack a check on the...CVE-2020-14039Fix available5.3 Medium
- golang go, cloudfoundry cf-deployment, routing-release +3 more +5 moreGo before 1.13.13 and 1.14.x before 1.14.5 has a data race in some net/http servers, as...CVE-2020-15586Fix available5.9 Medium
- golang go, debian linux, fedoraproject fedora +1 more +3 moreHelm uses crypto package vulnerable to panic from malformed X.509 certificateCVE-2020-7919Fix available7.5 High
- golang go, redhat enterprise linux, openstack +2 moreThe net/http library in net/http/transfer.go in Go before 1.4.3 does not properly parse HTTP...CVE-2015-57419.8 Critical
- microsoft windows, golang go, microsoft windows 10 version 1903 for 32-bit systems +20 more +22 moreA spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic...CVE-2020-0601In KEVPublic exploitFix availableEPSS 89.1%8.1 High
- golang go, arista cloudvision portal, eos +8 more +10 moreGo before 1.12.11 and 1.3.x before 1.13.2 can panic upon an attempt to process network traffic...CVE-2019-17596Public exploitFix available7.5 High
- Show moreLoading…