golang (AlmaLinux:9) — known CVEs & security advisories

Known CVE vulnerabilities and GitHub Security Advisories affecting the AlmaLinux:9 package golang, with affected version ranges, CVSS severity, EPSS exploit prediction, and CISA KEV status.

CVEs (48)

• CVE-2025-68121 — CVSS 10.0 (critical): During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake…
• CVE-2023-29404 — CVSS 9.8 (critical): The go command may execute arbitrary code at build time when using cgo. This may occur when running "go get" on a malicious module, or when…
• CVE-2023-29405 — CVSS 9.8 (critical): The go command may execute arbitrary code at build time when using cgo. This may occur when running "go get" on a malicious module, or when…
• CVE-2024-24790 — CVSS 9.8 (critical): The various Is methods (IsPrivate, IsLoopback, etc) did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses…
• CVE-2023-24540 — CVSS 9.8 (critical): Not all valid JavaScript whitespace characters are considered to be whitespace. Templates containing whitespace characters outside of the…
• CVE-2023-29402 — CVSS 9.8 (critical): The go command may generate unexpected code at build time when using cgo. This may result in unexpected behavior when running a go program…
• CVE-2025-22871 — CVSS 9.1 (critical): The net/http package improperly accepts a bare LF as a line terminator in chunked data chunk-size lines. This can permit request smuggling…
• CVE-2025-61732 — CVSS 8.6 (high): A discrepancy between how Go and C/C++ comments were parsed allowed for code smuggling into the resulting cgo binary.
• CVE-2025-4674 — CVSS 8.6 (high): The go command may execute unexpected commands when operating in untrusted VCS repositories. This occurs when possibly dangerous VCS…
• CVE-2025-61731 — CVSS 7.8 (high): Building a malicious file with cmd/go can cause can cause a write to an attacker-controlled file with partial control of the file content…
• CVE-2023-29403 — CVSS 7.8 (high): On Unix platforms, the Go runtime does not behave differently when a binary is run with the setuid/setgid bits. This can be dangerous in…
• CVE-2023-45285 — CVSS 7.5 (high): Using go get to fetch a module with the ".git" suffix may unexpectedly fallback to the insecure "git://" protocol if the module is…
• CVE-2023-45288 — CVSS 7.5 (high): An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames…
• CVE-2022-30631 — CVSS 7.5 (high): Uncontrolled recursion in Reader.Read in compress/gzip before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack…
• CVE-2022-28131 — CVSS 7.5 (high): Uncontrolled recursion in Decoder.Skip in encoding/xml before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack…
• CVE-2022-2879 — CVSS 7.5 (high): Reader.Read does not set a limit on the maximum size of file headers. A maliciously crafted archive could cause Read to allocate unbounded…
• CVE-2022-2880 — CVSS 7.5 (high): Requests forwarded by ReverseProxy include the raw query parameters from the inbound request, including unparsable parameters rejected by…
• CVE-2022-30630 — CVSS 7.5 (high): Uncontrolled recursion in Glob in io/fs before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a…
• CVE-2022-30632 — CVSS 7.5 (high): Uncontrolled recursion in Glob in path/filepath before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion…
• CVE-2022-30633 — CVSS 7.5 (high): Uncontrolled recursion in Unmarshal in encoding/xml before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack…
• CVE-2022-30635 — CVSS 7.5 (high): Uncontrolled recursion in Decoder.Decode in encoding/gob before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack…
• CVE-2022-41715 — CVSS 7.5 (high): Programs which compile regular expressions from untrusted sources may be vulnerable to memory exhaustion or denial of service. The parsed…
• CVE-2023-39325 — CVSS 7.5 (high): A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption. While…
• CVE-2023-44487 — CVSS 7.5 (high) — actively exploited: The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly…
• CVE-2024-1394 — CVSS 7.5 (high): A memory leak flaw was found in Golang in the RSA encrypting/decrypting code, which might lead to a resource exhaustion vulnerability using…
• CVE-2024-24784 — CVSS 7.5 (high): The ParseAddressList function incorrectly handles comments (text within parentheses) within display names. Since this is a misalignment…
• CVE-2024-24791 — CVSS 7.5 (high): The net/http HTTP/1.1 client mishandled the case where a server responds to a request with an "Expect: 100-continue" header with a…
• CVE-2024-34156 — CVSS 7.5 (high): Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion. This is a follow-up…
• CVE-2024-34158 — CVSS 7.5 (high): Calling Parse on a "// +build" build tag line with deeply nested expressions can cause a panic due to stack exhaustion.
• CVE-2025-61726 — CVSS 7.5 (high): The net/url package does not set a limit on the number of query parameters in a query. While the maximum size of query parameters in URLs…
• CVE-2025-61729 — CVSS 7.5 (high): Within HostnameError.Error(), when constructing an error string, there is no limit to the number of hosts that will be printed out…
• CVE-2026-25679 — CVSS 7.5 (high): url.Parse insufficiently validated the host/authority component and accepted some invalid URLs.
• CVE-2026-27137 — CVSS 7.5 (high): When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local…
• CVE-2025-4673 — CVSS 6.8 (medium): Proxy-Authorization and Proxy-Authenticate headers persisted on cross-origin redirects potentially leaking sensitive information.
• CVE-2025-61728 — CVSS 6.5 (medium): archive/zip uses a super-linear file name indexing algorithm that is invoked the first time a file in an archive is opened. This can lead…
• CVE-2024-9355 — CVSS 6.5 (medium): A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length…
• CVE-2023-45290 — CVSS 6.5 (medium): When parsing a multipart form (either explicitly with Request.ParseMultipartForm or implicitly with Request.FormValue…
• CVE-2022-32148 — CVSS 6.5 (medium): Improper exposure of client IP addresses in net/http before Go 1.17.12 and Go 1.18.4 can be triggered by calling httputil.ReverseProxy.Serve…
• CVE-2022-1705 — CVSS 6.5 (medium): Acceptance of some invalid Transfer-Encoding headers in the HTTP/1 client in net/http before Go 1.17.12 and Go 1.18.4 allows HTTP request…
• CVE-2024-24783 — CVSS 5.9 (medium): Verifying a certificate chain which contains a certificate with an unknown public key algorithm will cause Certificate.Verify to panic…
• CVE-2024-24789 — CVSS 5.5 (medium): The archive/zip package's handling of certain types of invalid zip files differs from the behavior of most zip implementations. This…
• CVE-2022-1962 — CVSS 5.5 (medium): Uncontrolled recursion in the Parse functions in go/parser before Go 1.17.12 and Go 1.18.4 allow an attacker to cause a panic due to stack…
• CVE-2024-24785 — CVSS 5.4 (medium): If errors returned from MarshalJSON methods contain user controlled data, they may be used to break the contextual auto-escaping behavior…
• CVE-2023-39326 — CVSS 5.3 (medium): A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from…
• CVE-2023-29409 — CVSS 5.3 (medium): Extremely large RSA keys in certificate chains can cause a client/server to expend significant CPU time verifying signatures. With fix, the…
• CVE-2024-34155 — CVSS 4.3 (medium): Calling any of the Parse functions on Go source code which contains deeply nested literals can cause a panic due to stack exhaustion.
• CVE-2025-58183 — CVSS 4.3 (medium): tar.Reader does not set a maximum size on the number of sparse region data blocks in GNU tar pax 1.0 sparse files. A maliciously-crafted…
• CVE-2023-45289 — CVSS 4.3 (medium): When following an HTTP redirect to a domain which is not a subdomain match or exact match of the initial domain, an http.Client does not…