Skip to contentGolang vulnerabilities
Newest
- golang goGo through 1.12 on Windows misuses certain LoadLibrary functionality, leading to DLL injection.CVE-2019-9634Fix available7.8 High
- golang go, debian linux, opensuse leap +2 moreGo before 1.10.8 and 1.11.x before 1.11.5 mishandles P-521 and P-384 elliptic curves, which...CVE-2019-6486Fix available8.2 High
- golang go, [unknown] golang, opensuse leap +2 moreThe crypto/x509 package of Go before 1.10.6 and 1.11.x before 1.11.3 does not limit the amount of...CVE-2018-16875Public exploitFix available5.9 Medium
- [unknown] golang, golang go, debian linux +3 more +5 moreIn Go before 1.10.6 and 1.11.x before 1.11.3, the "go get" command is vulnerable to directory...CVE-2018-16874Fix available6.8 Medium
- [unknown] golang, golang go, debian linux +3 more +5 moreIn Go before 1.10.6 and 1.11.x before 1.11.3, the "go get" command is vulnerable to remote code...CVE-2018-16873Fix availableEPSS 66.3%7.5 High
- golang net, fedoraproject fedora +1 moregolang.org/x/net/html Improper Validation of Array Index vulnerabilityCVE-2018-17848Fix available7.5 High
- golang net, fedoraproject fedora +1 moregolang.org/x/net/html has Improper Restriction of Operations within the Bounds of a Memory BufferCVE-2018-17847Fix available7.5 High
- golang net, fedoraproject fedora +1 morex/net/html Vulnerable to DoS During HTML ParsingCVE-2018-17846Fix available7.5 High
- golang net, fedoraproject fedora +1 moregolang.org/x/net/html has Improper Restriction of Operations within the Bounds of a Memory BufferCVE-2018-17143Fix available7.5 High
- golang net, fedoraproject fedora +1 moregolang.org/x/net/html NULL Pointer Dereference vulnerabilityCVE-2018-17142Fix available7.5 High
- golang net, fedoraproject fedora +1 moregolang.org/x/net/html NULL Pointer Dereference vulnerabilityCVE-2018-17075Fix available7.5 High
- archiver project archiverArbitrary File Write via Archive Extraction in mholt/archiverCVE-2018-1002207Fix available5.5 Medium
- golang go, debian linux +1 moreThe "go get" implementation in Go 1.9.4, when the -insecure command-line option is used, does not...CVE-2018-7187Fix availableEPSS 63.0%8.8 High
- golang go, debian linux, redhat enterprise linux server +3 more +5 moreGo before 1.8.7, Go 1.9.x before 1.9.4, and Go 1.10 pre-releases before Go 1.10rc2 allow "go get"...CVE-2018-6574Public exploitFix available7.8 High
- golang go, fedoraproject fedora, redhat enterprise linux server +3 more +5 moreThe net/http library in net/http/transfer.go in Go before 1.4.3 does not properly parse HTTP...CVE-2015-57409.8 Critical
- golang go, fedoraproject fedora, redhat enterprise linux server +3 more +5 moreThe net/http library in net/textproto/reader.go in Go before 1.4.3 does not properly parse HTTP...CVE-2015-57399.8 Critical
- golang goAn unintended cleartext issue exists in Go before 1.8.4 and 1.9.x before 1.9.1. RFC 4954 requires...CVE-2017-15042Fix available5.9 Medium
- golang go, debian linux, redhat developer tools +4 more +6 moreGo before 1.8.4 and 1.9.x before 1.9.1 allows "go get" remote command execution. Using custom...CVE-2017-15041Fix available9.8 Critical
- golang goThe net/http package's Request.ParseMultipartForm method starts writing to temporary files once...CVE-2017-1000098Fix available7.5 High
- golang goOn Darwin, user's trust preferences for root certificates were not honored. If the user had a...CVE-2017-1000097Fix available7.5 High
- golang go, fedoraproject fedora, novell suse package hub for suse linux enterprise +1 more +3 moreA bug in the standard library ScalarMult implementation of curve P-256 for amd64 architectures in...CVE-2017-8932Fix available5.9 Medium
- go ssh library, golang crypto +1 moregolang.org/x/crypto/ssh Man-in-the-Middle attackCVE-2017-3204Fix available8.1 High
- golang net, golang.org/x/net golang.org/x/net/idna, go standard library net/http +147 more +149 moreInvoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idnaCVE-2026-39821Fix available9.6 Critical
- golang go, fedoraproject fedora, oracle linux +3 more +5 moreThe net/http package in Go through 1.6 does not attempt to address RFC 3875 section 4.1.18...CVE-2016-5386Fix available8.1 High
- golang go, fedoraproject fedora, opensuse leap +2 moreThe Verify function in crypto/dsa/dsa.go in Go before 1.5.4 and 1.6.x before 1.6.1 does not...CVE-2016-3959Public exploitFix available7.5 High
- golang goUntrusted search path vulnerability in Go before 1.5.4 and 1.6.x before 1.6.1 on Windows allows...CVE-2016-3958Fix available7.8 High
- golang go, opensuse leap +1 moreThe Int.Exp Montgomery code in the math/big library in Go 1.5.x before 1.5.3 mishandles carry...CVE-2015-8618Fix available7.5 High
- golang gocrpyto/tls in Go 1.1 before 1.3.2, when SessionTicketsDisabled is enabled, allows man-in-the...CVE-2014-7189Fix available4.3 Medium