Skip to contentGolang Go vulnerabilities
- go standard library net/netip, golang go +1 moreUnexpected behavior from Is methods for IPv4-mapped IPv6 addresses in net/netipCVE-2024-24790Fix available9.8 Critical
- go standard library archive/zip, golang go +1 moreMishandling of corrupt central directory record in archive/zipCVE-2024-24789Fix available5.5 Medium
- go toolchain cmd/go, golang go +1 moreArbitrary code execution during build on Darwin in cmd/goCVE-2024-24787Public exploitFix available6.4 Medium
- go toolchain cmd/go, golang go +1 moreCommand 'go get' may unexpectedly fallback to insecure git in cmd/goCVE-2023-45285Fix available7.5 High
- go standard library net/http/internal, golang go +1 moreDenial of service via chunk extensions in net/httpCVE-2023-39326Fix available5.3 Medium
- go standard library crypto/tls, golang go +1 moreBefore Go 1.20, the RSA based key exchange methods in crypto/tls may exhibit a timing side channelCVE-2023-45287Fix available7.5 High
- go standard library path/filepath, golang go +1 moreIncorrect detection of reserved device names on Windows in path/filepathCVE-2023-45284Fix available5.3 Medium
- go standard library path/filepath, golang go, go standard library internal/safefilepath +2 moreInsecure parsing of Windows paths with a \??\ prefix in path/filepathCVE-2023-45283Fix available7.5 High
- golang go, traefik, red hat openshift ai (rhoai) +2 more +4 moreTraefik - Denial of Service via HTTP/2 Request HandlingCVE-2023-54365Fix available8.7 High
- go standard library net/http, golang go, http2 +4 more +6 moreHTTP/2 rapid reset can cause excessive work in net/httpCVE-2023-39325Public exploitFix available7.5 High
- go toolchain cmd/go, golang go, fedoraproject fedora +2 moreArbitrary code execution during build via line directives in cmd/goCVE-2023-39323Fix available8.1 High
- go standard library crypto/tls, golang go +1 morePanic when processing post-handshake message on QUIC connections in crypto/tlsCVE-2023-39321Fix available7.5 High
- go standard library crypto/tls, crypto tls, golang go +2 moreMemory exhaustion in QUIC connection handling in crypto/tlsCVE-2023-39322Fix available7.5 High
- go standard library html/template, golang go +1 moreImproper handling of special tags within script contexts in html/templateCVE-2023-39319Fix available6.1 Medium
- go toolchain cmd/go, golang go +1 moreArbitrary code execution via go.mod toolchain directive in cmd/goCVE-2023-39320Public exploitFix available9.8 Critical
- go standard library html/template, golang go +1 moreImproper handling of HTML-like comments in script contexts in html/templateCVE-2023-39318Fix available6.1 Medium
- go standard library crypto/tls, golang go +1 moreLarge RSA keys can cause high CPU usage in crypto/tlsCVE-2023-29409Public exploitFix available5.3 Medium
- go standard library net/http, golang go +1 moreInsufficient sanitization of Host header in net/httpCVE-2023-29406Public exploitFix available6.5 Medium
- eclipse jetty, ietf http, http/2 +166 more +168 moreEclipse Jetty XmlParser allows arbitrary DOCTYPE declarationsCVE-2023-44487In KEVPublic exploitFix availableEPSS 100.0%7.5 High
- go toolchain cmd/go, golang go, fedoraproject fedora +2 moreCode injection via go command with cgo in cmd/goCVE-2023-29402Fix available9.8 Critical
- go standard library runtime, golang go, fedoraproject fedora +2 moreUnsafe behavior in setuid/setgid binaries in runtimeCVE-2023-29403Fix available7.8 High
- go toolchain cmd/go, golang go, fedoraproject fedora +1 more +3 moreImproper sanitization of LDFLAGS with embedded spaces in go command with cgo in cmd/goCVE-2023-29405Fix available9.8 Critical
- go toolchain cmd/go, golang go, fedoraproject fedora +2 moreImproper handling of non-optional LDFLAGS in go command with cgo in cmd/goCVE-2023-29404Fix available9.8 Critical
- go standard library html/template, golang go +1 moreImproper handling of empty HTML attributes in html/templateCVE-2023-29400Fix available7.3 High
- go standard library html/template, golang go +1 moreImproper handling of JavaScript whitespace in html/templateCVE-2023-24540Fix available9.8 Critical
- go standard library html/template, golang go +1 moreImproper sanitization of CSS values in html/templateCVE-2023-24539Fix available7.3 High
- go standard library html/template, golang go +1 moreBackticks not treated as string delimiters in html/templateCVE-2023-24538Public exploitFix available9.8 Critical
- go standard library go/scanner, golang go +1 moreInfinite loop in parsing in go/scannerCVE-2023-24537Fix available7.5 High
- go standard library mime/multipart, net/textproto, golang go +2 moreExcessive resource consumption in net/http, net/textproto and mime/multipartCVE-2023-24536Fix available7.5 High
- go standard library net/textproto, golang go +1 moreExcessive memory allocation in net/http and net/textprotoCVE-2023-24534Fix available7.5 High
- go standard library crypto/internal/nistec, golang go +1 moreIncorrect calculation on P256 curves in crypto/internal/nistecCVE-2023-24532Fix available5.3 Medium
- go standard library mime/multipart, golang go +1 moreExcessive resource consumption in mime/multipartCVE-2022-41725Fix available7.5 High
- go standard library net/http, golang go, hpack +3 more +5 moreDenial of service via crafted HTTP/2 stream in net/http and golang.org/x/netCVE-2022-41723Fix available7.5 High
- go standard library crypto/tls, golang go +1 morePanic on large handshake records in crypto/tlsCVE-2022-41724Fix available7.5 High
- go standard library path/filepath, golang go +1 morePath traversal on Windows in path/filepathCVE-2022-41722Fix available7.5 High
- go standard library net/http, golang go, http2 +2 more +4 moreExcessive memory growth in net/http and golang.org/x/net/http2CVE-2022-41717Public exploitFix available5.3 Medium
- go standard library net/http, os, golang go +2 moreRestricted file access on Windows in os and net/httpCVE-2022-41720Fix available7.5 High
- go standard library os/exec, syscall, golang go +2 moreUnsanitized NUL in environment variables on Windows in syscall and os/execCVE-2022-41716Fix available7.5 High
- go standard library net/http/httputil, golang go +1 moreIncorrect sanitization of forwarded query parameters in net/http/httputilCVE-2022-2880Fix available7.5 High
- go standard library regexp/syntax, golang go +1 moreMemory exhaustion when compiling regular expressions in regexp/syntaxCVE-2022-41715Fix available7.5 High
- go standard library archive/tar, golang go +1 moreUnbounded memory consumption when reading headers in archive/tarCVE-2022-2879Fix available7.5 High
- go standard library net/url, golang go +1 moreFailure to strip relative path components in net/urlCVE-2022-32190Fix available7.5 High
- golang go, fedoraproject fedora +1 moregolang.org/x/net/http2 Denial of Service vulnerabilityCVE-2022-27664Fix available7.5 High
- go standard library math/big, golang go +1 morePanic when decoding Float and Rat types in math/bigCVE-2022-32189Fix available7.5 High
- go standard library net/http, golang go +1 moreExposure of client IP addresses in net/httpCVE-2022-32148Fix available6.5 Medium
- go standard library encoding/gob, golang go +1 moreStack exhaustion when decoding certain messages in encoding/gobCVE-2022-30635Fix available7.5 High
- go standard library encoding/xml, golang go +1 moreStack exhaustion when unmarshaling certain documents in encoding/xmlCVE-2022-30633Fix available7.5 High
- go standard library path/filepath, golang go +1 moreStack exhaustion on crafted paths in path/filepathCVE-2022-30632Fix available7.5 High
- go standard library compress/gzip, golang go +1 moreStack exhaustion when reading certain archives in compress/gzipCVE-2022-30631Fix available7.5 High
- go standard library io/fs, golang go +1 moreStack exhaustion in Glob on certain paths in io/fsCVE-2022-30630Fix available7.5 High
- Show moreLoading…