Every CVE whose affected-product data names Golang Go, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.
CVEs (168)
CVE-2025-68121 — CVSS 10.0 (critical): During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake…
CVE-2026-27143 — CVSS 9.8 (critical): Arithmetic over induction variables in loops were not correctly checked for underflow or overflow. As a result, the compiler would allow…
CVE-2024-24790 — CVSS 9.8 (critical): The various Is methods (IsPrivate, IsLoopback, etc) did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses…
CVE-2020-29511 — CVSS 9.8 (critical): The encoding/xml package in Go (all versions) does not correctly preserve the semantics of element namespace prefixes during tokenization…
CVE-2023-39320 — CVSS 9.8 (critical): The go.mod toolchain directive, introduced in Go 1.21, can be leveraged to execute scripts and binaries relative to the root of the module…
CVE-2023-29405 — CVSS 9.8 (critical): The go command may execute arbitrary code at build time when using cgo. This may occur when running "go get" on a malicious module, or when…
CVE-2023-29404 — CVSS 9.8 (critical): The go command may execute arbitrary code at build time when using cgo. This may occur when running "go get" on a malicious module, or when…
CVE-2023-29402 — CVSS 9.8 (critical): The go command may generate unexpected code at build time when using cgo. This may result in unexpected behavior when running a go program…
CVE-2021-38297 — CVSS 9.8 (critical): Go before 1.16.9 and 1.17.x before 1.17.2 has a Buffer Overflow via large arguments in a function invocation from a WASM module, when…
CVE-2019-11888 — CVSS 9.8 (critical): Go through 1.12.5 on Windows mishandles process creation with a nil environment in conjunction with a non-nil token, which allows attackers…
CVE-2019-14809 — CVSS 9.8 (critical): net/url in Go before 1.11.13 and 1.12.x before 1.12.8 mishandles malformed hosts in URLs, leading to an authorization bypass in some…
CVE-2012-2666 — CVSS 9.8 (critical): golang/go in 1.0.2 fixes all.bash on shared machines. dotest() in src/pkg/debug/gosym/pclntab_test.go creates a temporary file with…
CVE-2023-24540 — CVSS 9.8 (critical): Not all valid JavaScript whitespace characters are considered to be whitespace. Templates containing whitespace characters outside of the…
CVE-2023-24538 — CVSS 9.8 (critical): Templates do not properly consider backticks (`) as Javascript string delimiters, and do not escape them as expected. Backticks are used…
CVE-2015-5739 — CVSS 9.8 (critical): The net/http library in net/textproto/reader.go in Go before 1.4.3 does not properly parse HTTP header keys, which allows remote attackers…
CVE-2015-5740 — CVSS 9.8 (critical): The net/http library in net/http/transfer.go in Go before 1.4.3 does not properly parse HTTP headers, which allows remote attackers to…
CVE-2015-5741 — CVSS 9.8 (critical): The net/http library in net/http/transfer.go in Go before 1.4.3 does not properly parse HTTP headers, which allows remote attackers to…
CVE-2017-15041 — CVSS 9.8 (critical): Go before 1.8.4 and 1.9.x before 1.9.1 allows "go get" remote command execution. Using custom domains, it is possible to arrange things so…
CVE-2020-29509 — CVSS 9.8 (critical): The encoding/xml package in Go (all versions) does not correctly preserve the semantics of attribute namespace prefixes during tokenization…
CVE-2020-29510 — CVSS 9.8 (critical): The encoding/xml package in Go versions 1.15 and earlier does not correctly preserve the semantics of directives during tokenization…
CVE-2022-23806 — CVSS 9.1 (critical): Curve.IsOnCurve in crypto/elliptic in Go before 1.16.14 and 1.17.x before 1.17.7 can incorrectly return true in situations with a big.Int…
CVE-2026-27140 — CVSS 8.8 (high): SWIG file names containing 'cgo' and well-crafted payloads could lead to code smuggling and arbitrary code execution at build time due to…
CVE-2018-7187 — CVSS 8.8 (high): The "go get" implementation in Go 1.9.4, when the -insecure command-line option is used, does not validate the import path (get/vcs.go only…
CVE-2025-4674 — CVSS 8.6 (high): The go command may execute unexpected commands when operating in untrusted VCS repositories. This occurs when possibly dangerous VCS…
CVE-2025-61732 — CVSS 8.6 (high): A discrepancy between how Go and C/C++ comments were parsed allowed for code smuggling into the resulting cgo binary.
CVE-2026-33810 — CVSS 8.2 (high): When verifying a certificate chain containing excluded DNS constraints, these constraints are not correctly applied to wildcard DNS SANs…
CVE-2019-6486 — CVSS 8.2 (high): Go before 1.10.8 and 1.11.x before 1.11.5 mishandles P-521 and P-384 elliptic curves, which allows attackers to cause a denial of service…
CVE-2018-16873 — CVSS 8.1 (high): In Go before 1.10.6 and 1.11.x before 1.11.3, the "go get" command is vulnerable to remote code execution when executed with the -u flag…
CVE-2023-39323 — CVSS 8.1 (high): Line directives ("//line") can be used to bypass the restrictions on "//go:cgo_" directives, allowing blocked linker and compiler flags to…
CVE-2018-16874 — CVSS 8.1 (high): In Go before 1.10.6 and 1.11.x before 1.11.3, the "go get" command is vulnerable to directory traversal when executed with the import path…
CVE-2016-5386 — CVSS 8.1 (high): The net/http package in Go through 1.6 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not…
CVE-2016-3958 — CVSS 7.8 (high): Untrusted search path vulnerability in Go before 1.5.4 and 1.6.x before 1.6.1 on Windows allows local users to gain privileges via a Trojan…
CVE-2019-9634 — CVSS 7.8 (high): Go through 1.12 on Windows misuses certain LoadLibrary functionality, leading to DLL injection.
CVE-2025-61731 — CVSS 7.8 (high): Building a malicious file with cmd/go can cause can cause a write to an attacker-controlled file with partial control of the file content…
CVE-2022-30580 — CVSS 7.8 (high): Code injection in Cmd.Start in os/exec before Go 1.17.11 and Go 1.18.3 allows execution of any binaries in the working directory named…
CVE-2023-29403 — CVSS 7.8 (high): On Unix platforms, the Go runtime does not behave differently when a binary is run with the setuid/setgid bits. This can be dangerous in…
CVE-2018-6574 — CVSS 7.8 (high): Go before 1.8.7, Go 1.9.x before 1.9.4, and Go 1.10 pre-releases before Go 1.10rc2 allow "go get" remote command execution during source…
CVE-2026-42501 — CVSS 7.5 (high): A malicious module proxy can exploit a flaw in the go command's validation of module checksums to bypass checksum database validation. This…
CVE-2015-8618 — CVSS 7.5 (high): The Int.Exp Montgomery code in the math/big library in Go 1.5.x before 1.5.3 mishandles carry propagation and produces incorrect output…
CVE-2016-3959 — CVSS 7.5 (high): The Verify function in crypto/dsa/dsa.go in Go before 1.5.4 and 1.6.x before 1.6.1 does not properly check parameters passed to the big…
CVE-2017-1000097 — CVSS 7.5 (high): On Darwin, user's trust preferences for root certificates were not honored. If the user had a root certificate loaded in their Keychain…
CVE-2017-1000098 — CVSS 7.5 (high): The net/http package's Request.ParseMultipartForm method starts writing to temporary files once the request body size surpasses the given…
CVE-2019-17596 — CVSS 7.5 (high): Go before 1.12.11 and 1.3.x before 1.13.2 can panic upon an attempt to process network traffic containing an invalid DSA public key. There…
CVE-2020-16845 — CVSS 7.5 (high): Go before 1.13.15 and 14.x before 1.14.7 can have an infinite read loop in ReadUvarint and ReadVarint in encoding/binary via invalid inputs.
CVE-2020-28366 — CVSS 7.5 (high): Code injection in the go command with cgo before Go 1.14.12 and Go 1.15.5 allows arbitrary code execution at build time via a malicious…
CVE-2020-28367 — CVSS 7.5 (high): Code injection in the go command with cgo before Go 1.14.12 and Go 1.15.5 allows arbitrary code execution at build time via malicious gcc…
CVE-2020-28851 — CVSS 7.5 (high): In x/text in Go 1.15.4, an "index out of range" panic occurs in language.ParseAcceptLanguage while parsing the -u- extension…
CVE-2020-7919 — CVSS 7.5 (high): Go before 1.12.16 and 1.13.x before 1.13.7 (and the crypto/cryptobyte package before 0.0.0-20200124225646-8b5121be2f68 for Go) allows…
CVE-2021-27918 — CVSS 7.5 (high): encoding/xml in Go before 1.15.9 and 1.16.x before 1.16.1 has an infinite loop if a custom TokenReader (for xml.NewTokenDecoder) returns…
CVE-2021-29923 — CVSS 7.5 (high): Go before 1.17 does not properly consider extraneous zero characters at the beginning of an IP address octet, which (in some situations)…
CVE-2021-3115 — CVSS 7.5 (high): Go before 1.14.14 and 1.15.x before 1.15.7 on Windows is vulnerable to Command Injection and remote code execution when using the "go get"…
CVE-2021-33194 — CVSS 7.5 (high): golang.org/x/net before v0.0.0-20210520170846-37e1c6afe023 allows attackers to cause a denial of service (infinite loop) via crafted…
CVE-2021-33196 — CVSS 7.5 (high): In archive/zip in Go before 1.15.13 and 1.16.x before 1.16.5, a crafted file count (in an archive's header) can cause a NewReader or…
CVE-2021-33198 — CVSS 7.5 (high): In Go before 1.15.13 and 1.16.x before 1.16.5, there can be a panic for a large exponent to the math/big.Rat SetString or UnmarshalText…
CVE-2021-39293 — CVSS 7.5 (high): In archive/zip in Go before 1.16.8 and 1.17.x before 1.17.1, a crafted archive header (falsely designating that many files are present) can…
CVE-2021-41771 — CVSS 7.5 (high): ImportedSymbols in debug/macho (for Open or OpenFat) in Go before 1.16.10 and 1.17.x before 1.17.3 Accesses a Memory Location After the End…
CVE-2021-41772 — CVSS 7.5 (high): Go before 1.16.10 and 1.17.x before 1.17.3 allows an archive/zip Reader.Open panic via a crafted ZIP archive containing an invalid name or…
CVE-2021-44716 — CVSS 7.5 (high): net/http in Go before 1.16.12 and 1.17.x before 1.17.5 allows uncontrolled memory consumption in the header canonicalization cache via…
CVE-2022-23772 — CVSS 7.5 (high): Rat.SetString in math/big in Go before 1.16.14 and 1.17.x before 1.17.7 has an overflow that can lead to Uncontrolled Memory Consumption.
CVE-2022-23773 — CVSS 7.5 (high): cmd/go in Go before 1.16.14 and 1.17.x before 1.17.7 can misinterpret branch names that falsely appear to be version tags. This can lead to…
CVE-2022-24675 — CVSS 7.5 (high): encoding/pem in Go before 1.17.9 and 1.18.x before 1.18.1 has a Decode stack overflow via a large amount of PEM data.
CVE-2022-24921 — CVSS 7.5 (high): regexp.Compile in Go before 1.16.15 and 1.17.x before 1.17.8 allows stack exhaustion via a deeply nested expression.
CVE-2022-27536 — CVSS 7.5 (high): Certificate.Verify in crypto/x509 in Go 1.18.x before 1.18.1 can be caused to panic on macOS when presented with certain malformed…
CVE-2022-27664 — CVSS 7.5 (high): In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers can cause a denial of service because an HTTP/2 connection can hang…
CVE-2022-28131 — CVSS 7.5 (high): Uncontrolled recursion in Decoder.Skip in encoding/xml before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack…
CVE-2022-28327 — CVSS 7.5 (high): The generic P-256 feature in crypto/elliptic in Go before 1.17.9 and 1.18.x before 1.18.1 allows a panic via long scalar input.
CVE-2022-2879 — CVSS 7.5 (high): Reader.Read does not set a limit on the maximum size of file headers. A maliciously crafted archive could cause Read to allocate unbounded…
CVE-2022-2880 — CVSS 7.5 (high): Requests forwarded by ReverseProxy include the raw query parameters from the inbound request, including unparsable parameters rejected by…
CVE-2022-29804 — CVSS 7.5 (high): Incorrect conversion of certain invalid paths to valid, absolute paths in Clean in path/filepath before Go 1.17.11 and Go 1.18.3 on Windows…
CVE-2022-30630 — CVSS 7.5 (high): Uncontrolled recursion in Glob in io/fs before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a…
CVE-2022-30631 — CVSS 7.5 (high): Uncontrolled recursion in Reader.Read in compress/gzip before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack…
CVE-2022-30632 — CVSS 7.5 (high): Uncontrolled recursion in Glob in path/filepath before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion…
CVE-2022-30633 — CVSS 7.5 (high): Uncontrolled recursion in Unmarshal in encoding/xml before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack…
CVE-2022-30634 — CVSS 7.5 (high): Infinite loop in Read in crypto/rand before Go 1.17.11 and Go 1.18.3 on Windows allows attacker to cause an indefinite hang by passing a…
CVE-2022-30635 — CVSS 7.5 (high): Uncontrolled recursion in Decoder.Decode in encoding/gob before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack…
CVE-2022-32189 — CVSS 7.5 (high): A too-short encoded message can cause a panic in Float.GobDecode and Rat GobDecode in math/big in Go before 1.17.13 and 1.18.5, potentially…
CVE-2022-32190 — CVSS 7.5 (high): JoinPath and URL.JoinPath do not remove ../ path elements appended to a relative path. For example, JoinPath("https://go.dev", "../go")…
CVE-2022-41715 — CVSS 7.5 (high): Programs which compile regular expressions from untrusted sources may be vulnerable to memory exhaustion or denial of service. The parsed…
CVE-2022-41716 — CVSS 7.5 (high): Due to unsanitized NUL values, attackers may be able to maliciously set environment variables on Windows. In syscall.StartProcess and…
CVE-2022-41720 — CVSS 7.5 (high): On Windows, restricted files can be accessed via os.DirFS and http.Dir. The os.DirFS function and http.Dir type provide access to a tree of…
CVE-2022-41722 — CVSS 7.5 (high): A path traversal vulnerability exists in filepath.Clean on Windows. On Windows, the filepath.Clean function could transform an invalid path…
CVE-2022-41723 — CVSS 7.5 (high): A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of service…
CVE-2022-41724 — CVSS 7.5 (high): Large handshake records may cause panics in crypto/tls. Both clients and servers may send large TLS handshake records which cause servers…
CVE-2022-41725 — CVSS 7.5 (high): A denial of service is possible from excessive resource consumption in net/http and mime/multipart. Multipart form parsing with…
CVE-2023-24534 — CVSS 7.5 (high): HTTP and MIME header parsing can allocate large amounts of memory, even when parsing small inputs, potentially leading to a denial of…
CVE-2023-24536 — CVSS 7.5 (high): Multipart form parsing can consume large amounts of CPU and memory when processing form inputs containing very large numbers of parts. This…
CVE-2023-24537 — CVSS 7.5 (high): Calling any of the Parse functions on Go source code which contains //line directives with very large line numbers can cause an infinite…
CVE-2023-39322 — CVSS 7.5 (high): QUIC connections do not set an upper bound on the amount of data buffered when reading post-handshake messages, allowing a malicious QUIC…
CVE-2023-39325 — CVSS 7.5 (high): A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption. While…
CVE-2023-45283 — CVSS 7.5 (high): The filepath package does not recognize paths with a \??\ prefix as special. On Windows, a path beginning with \??\ is a Root Local Device…
CVE-2023-45285 — CVSS 7.5 (high): Using go get to fetch a module with the ".git" suffix may unexpectedly fallback to the insecure "git://" protocol if the module is…
CVE-2023-45287 — CVSS 7.5 (high): Before Go 1.20, the RSA based TLS key exchanges used the math/big library, which is not constant time. RSA blinding was applied to prevent…
CVE-2025-58187 — CVSS 7.5 (high): Due to the design of the name constraint checking algorithm, the processing time of some inputs scale non-linearly with respect to the size…
CVE-2025-58188 — CVSS 7.5 (high): Validating certificate chains which contain DSA public keys can cause programs to panic, due to a interface cast that assumes they…
CVE-2025-61723 — CVSS 7.5 (high): The processing time for parsing some invalid inputs scales non-linearly with respect to the size of the input. This affects programs which…
CVE-2025-61726 — CVSS 7.5 (high): The net/url package does not set a limit on the number of query parameters in a query. While the maximum size of query parameters in URLs…
CVE-2025-61729 — CVSS 7.5 (high): Within HostnameError.Error(), when constructing an error string, there is no limit to the number of hosts that will be printed out…
CVE-2026-25679 — CVSS 7.5 (high): url.Parse insufficiently validated the host/authority component and accepted some invalid URLs.
CVE-2026-27137 — CVSS 7.5 (high): When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local…
CVE-2026-32280 — CVSS 7.5 (high): During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed…
CVE-2026-32281 — CVSS 7.5 (high): Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of…
CVE-2026-32283 — CVSS 7.5 (high): If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock…
CVE-2026-33811 — CVSS 7.5 (high): When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash.
CVE-2026-33814 — CVSS 7.5 (high): When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a…
CVE-2026-39820 — CVSS 7.5 (high): Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory…
CVE-2026-39836 — CVSS 7.5 (high): The Dial and LookupPort functions panic on Windows when provided with an input containing a NUL (0).
CVE-2026-42499 — CVSS 7.5 (high): Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322.
CVE-2023-29400 — CVSS 7.3 (high): Templates containing actions in unquoted HTML attributes (e.g. "attr={{.}}") executed with empty input can result in output with unexpected…
CVE-2021-33195 — CVSS 7.3 (high): Go before 1.15.13 and 1.16.x before 1.16.5 has functions for DNS lookups that do not validate replies from DNS servers, and thus a return…
CVE-2023-24539 — CVSS 7.3 (high): Angle brackets (<>) are not considered dangerous characters when inserted into CSS contexts. Templates containing multiple actions…
CVE-2026-27144 — CVSS 7.1 (high): The compiler is meant to unwrap pointers which are the operands of a memory move; a no-op interface conversion prevented the compiler from…
CVE-2025-47907 — CVSS 7.0 (high): Cancelling a query (e.g. by cancelling the context passed to one of the query methods) during a call to the Scan method of the returned…
CVE-2025-68119 — CVSS 7.0 (high): Downloading and building modules with malicious version strings can cause local code execution. On systems with Mercurial (hg) installed…
CVE-2025-47906 — CVSS 6.5 (medium): If the PATH environment variable contains paths which are executables (rather than just directories), passing certain strings to LookPath…
CVE-2025-61728 — CVSS 6.5 (medium): archive/zip uses a super-linear file name indexing algorithm that is invoked the first time a file in an archive is opened. This can lead…
CVE-2021-34558 — CVSS 6.5 (medium): The crypto/tls package of Go through 1.16.5 does not properly assert that the type of public key in an X.509 certificate matches the…
CVE-2022-1705 — CVSS 6.5 (medium): Acceptance of some invalid Transfer-Encoding headers in the HTTP/1 client in net/http before Go 1.17.12 and Go 1.18.4 allows HTTP request…
CVE-2021-3114 — CVSS 6.5 (medium): In Go before 1.14.14 and 1.15.x before 1.15.7, crypto/elliptic/p224.go can generate incorrect outputs, related to an underflow of the…
CVE-2022-32148 — CVSS 6.5 (medium): Improper exposure of client IP addresses in net/http before Go 1.17.12 and Go 1.18.4 can be triggered by calling httputil.ReverseProxy.Serve…
CVE-2025-61727 — CVSS 6.5 (medium): An excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate. For example a…
CVE-2023-29406 — CVSS 6.5 (medium): The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject additional headers…
CVE-2026-32282 — CVSS 6.4 (medium): On Linux, if the target of Root.Chmod is replaced with a symlink while the chmod operation is in progress, Chmod can operate on the target…
CVE-2026-32289 — CVSS 6.1 (medium): Context was not properly tracked across template branches for JS template literals, leading to possibly incorrect escaping of content when…
CVE-2019-9741 — CVSS 6.1 (medium): An issue was discovered in net/http in Go 1.11.5. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by…
CVE-2023-39319 — CVSS 6.1 (medium): The html/template package does not apply the proper rules for handling occurrences of "<script", "<!--", and "</script" within JS literals…
CVE-2020-24553 — CVSS 6.1 (medium): Go before 1.14.8 and 1.15.x before 1.15.1 allows XSS because text/html is the default for CGI/FCGI handlers that lack a Content-Type header.
CVE-2023-39318 — CVSS 6.1 (medium): The html/template package does not properly handle HTML-like "" comment tokens, nor hashbang "#!" comment tokens, in <script> contexts…
CVE-2026-27142 — CVSS 6.1 (medium): Actions which insert URLs into the content attribute of HTML meta tags are not escaped. This can allow XSS if the meta tag also has an…
CVE-2026-39823 — CVSS 6.1 (medium): CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a <meta> tag's <content> attribute. If the URL…
CVE-2026-39826 — CVSS 6.1 (medium): If a trusted template author were to write a <script> tag containing an empty 'type' attribute or a 'type' attribute with an ASCII…
CVE-2026-27138 — CVSS 5.9 (medium): Certificate verification can panic when a certificate in the chain has an empty DNS name and another certificate in the chain has excluded…
CVE-2026-39817 — CVSS 5.9 (medium): The "go tool pack" subcommand (usually used only by the compiler as an internal tool with known-good inputs) does not sanitize output…
CVE-2021-31525 — CVSS 5.9 (medium): net/http in Go before 1.15.12 and 1.16.x before 1.16.4 allows remote attackers to cause a denial of service (panic) via a large header to…
CVE-2017-8932 — CVSS 5.9 (medium): A bug in the standard library ScalarMult implementation of curve P-256 for amd64 architectures in Go before 1.7.6 and 1.8.x before 1.8.2…
CVE-2018-16875 — CVSS 5.9 (medium): The crypto/x509 package of Go before 1.10.6 and 1.11.x before 1.11.3 does not limit the amount of work performed for each chain…
CVE-2021-36221 — CVSS 5.9 (medium): Go before 1.15.15 and 1.16.x before 1.16.7 has a race condition that can lead to a net/http/httputil ReverseProxy panic upon an…
CVE-2017-15042 — CVSS 5.9 (medium): An unintended cleartext issue exists in Go before 1.8.4 and 1.9.x before 1.9.1. RFC 4954 requires that, during SMTP, the PLAIN auth scheme…
CVE-2020-15586 — CVSS 5.9 (medium): Go before 1.13.13 and 1.14.x before 1.14.5 has a data race in some net/http servers, as demonstrated by the httputil.ReverseProxy Handler…
CVE-2024-24789 — CVSS 5.5 (medium): The archive/zip package's handling of certain types of invalid zip files differs from the behavior of most zip implementations. This…
CVE-2021-27919 — CVSS 5.5 (medium): archive/zip in Go 1.16.x before 1.16.1 allows attackers to cause a denial of service (panic) upon attempted use of the Reader.Open API for…
CVE-2025-0913 — CVSS 5.5 (medium): os.OpenFile(path, os.O_CREATE|O_EXCL) behaved differently on Unix and Windows systems when the target path was a dangling symlink. On Unix…
CVE-2022-1962 — CVSS 5.5 (medium): Uncontrolled recursion in the Parse functions in go/parser before Go 1.17.12 and Go 1.18.4 allow an attacker to cause a panic due to stack…
CVE-2026-32288 — CVSS 5.5 (medium): tar.Reader can allocate an unbounded amount of memory when reading a maliciously-crafted archive containing a large number of sparse…
CVE-2023-39326 — CVSS 5.3 (medium): A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from…
CVE-2020-14039 — CVSS 5.3 (medium): In Go before 1.13.13 and 1.14.x before 1.14.5, Certificate.Verify may lack a check on the VerifyOptions.KeyUsages EKU requirements (if…
CVE-2022-41717 — CVSS 5.3 (medium): An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server connections contain a cache of HTTP…
CVE-2023-29409 — CVSS 5.3 (medium): Extremely large RSA keys in certificate chains can cause a client/server to expend significant CPU time verifying signatures. With fix, the…
CVE-2025-47912 — CVSS 5.3 (medium): The Parse function permits values other than IPv6 addresses to be included in square brackets within the host component of a URL. RFC 3986…
CVE-2023-45284 — CVSS 5.3 (medium): On Windows, The IsLocal function does not correctly detect reserved device names in some cases. Reserved names followed by spaces, such as…
CVE-2026-39819 — CVSS 5.3 (medium): The "go bug" command writes to two files with predictable names in the system temporary directory (for example, "/tmp"). An attacker with…
CVE-2023-24532 — CVSS 5.3 (medium): The ScalarMult and ScalarBaseMult methods of the P256 Curve may return an incorrect result if called with some specific unreduced scalars…
CVE-2025-61730 — CVSS 5.3 (medium): During the TLS 1.3 handshake if multiple messages are sent in records that span encryption level boundaries (for instance the Client Hello…
CVE-2026-39825 — CVSS 5.3 (medium): ReverseProxy can forward queries containing parameters not visible to Rewrite functions. When used with a Rewrite function, or a Director…
CVE-2025-61724 — CVSS 5.3 (medium): The Reader.ReadResponse function constructs a response string through repeated string concatenation of lines. When the number of lines in a…
CVE-2025-58189 — CVSS 5.3 (medium): When Conn.Handshake fails during ALPN negotiation the error contains attacker controlled information (the ALPN protocols sent by the…
CVE-2021-33197 — CVSS 5.3 (medium): In Go before 1.15.13 and 1.16.x before 1.16.5, some configurations of ReverseProxy (from net/http/httputil) result in a situation where an…
CVE-2025-58185 — CVSS 5.3 (medium): Parsing a maliciously crafted DER payload could allocate large amounts of memory, causing memory exhaustion.
CVE-2022-29526 — CVSS 5.3 (medium): Go before 1.17.10 and 1.18.x before 1.18.2 has Incorrect Privilege Assignment. When called with a non-zero flags parameter, the Faccessat…
CVE-2021-44717 — CVSS 4.8 (medium): Go before 1.16.12 and 1.17.x before 1.17.5 on UNIX allows write operations to an unintended file or unintended network connection as a…
CVE-2014-7189 — CVSS 4.3 (medium): crpyto/tls in Go 1.1 before 1.3.2, when SessionTicketsDisabled is enabled, allows man-in-the-middle attackers to spoof clients via…
CVE-2025-22873 — CVSS 3.8 (low): It was possible to improperly access the parent directory of an os.Root by opening a filename ending in "../". For example…
CVE-2022-30629 — CVSS 3.1 (low): Non-random values for ticket_age_add in session tickets in crypto/tls before Go 1.17.11 and Go 1.18.3 allow an attacker that can observe…
CVE-2026-27139 — CVSS 2.5 (low): On Unix platforms, when listing the contents of a directory using File.ReadDir or File.Readdir the returned FileInfo could reference a file…