Linux 13140
Google 12525
Microsoft 12378
Apple 6692
Oracle 6649
Adobe 6383
Ibm 6266
Cisco 5746
Debian 3919
Apache 2864
Mozilla 2857
Redhat 2581
Go
MEDIUM 5.3
ReverseProxy can forward queries containing parameters not visible to Rewrite functions. When used with a Rewrite function, or a Director function wh…
Go
HIGH 7.5
When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash.
Go
HIGH 7.5
When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE…
Go
MEDIUM 5.9
The "go tool pack" subcommand (usually used only by the compiler as an internal tool with known-good inputs) does not sanitize output filenames. Extr…
Image
HIGH 7.5
Parsing a WEBP image with an invalid, large size panics on 32-bit platforms.
Image
MEDIUM 6.1
Parsing a malicious font file can cause excessive memory allocation.
Go
CRITICAL 9.8
Arithmetic over induction variables in loops were not correctly checked for underflow or overflow. As a result, the compiler would allow for invalid …
Go
HIGH 8.2
When verifying a certificate chain containing excluded DNS constraints, these constraints are not correctly applied to wildcard DNS SANs which use a …
Go
HIGH 7.5
During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in Verify…
Go
HIGH 7.5
If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontro…
Go
HIGH 7.5
Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy map…
Go
HIGH 7.1
The compiler is meant to unwrap pointers which are the operands of a memory move; a no-op interface conversion prevented the compiler from making the…
Go
MEDIUM 6.4
On Linux, if the target of Root.Chmod is replaced with a symlink while the chmod operation is in progress, Chmod can operate on the target of the sym…
Go
MEDIUM 6.1
Context was not properly tracked across template branches for JS template literals, leading to possibly incorrect escaping of content when branches w…
Go
MEDIUM 5.5
tar.Reader can allocate an unbounded amount of memory when reading a maliciously-crafted archive containing a large number of sparse regions encoded …
Go
HIGH 8.8
SWIG file names containing 'cgo' and well-crafted payloads could lead to code smuggling and arbitrary code execution at build time due to trust layer…
Tiff
MEDIUM 5.3
A maliciously crafted TIFF file can cause image decoding to attempt to allocate up 4GiB of memory, causing either excessive resource consumption or a…
Go
MEDIUM 6.1
Actions which insert URLs into the content attribute of HTML meta tags are not escaped. This can allow XSS if the meta tag also has an http-equiv att…
Go
HIGH 7.5
url.Parse insufficiently validated the host/authority component and accepted some invalid URLs.
Go
HIGH 7.5
When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but d…
Go
MEDIUM 5.9
Certificate verification can panic when a certificate in the chain has an empty DNS name and another certificate in the chain has excluded name const…
Go
CRITICAL 10.0
During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the r…
Go
HIGH 8.6
A discrepancy between how Go and C/C++ comments were parsed allowed for code smuggling into the resulting cgo binary.
Go
HIGH 7.0
Downloading and building modules with malicious version strings can cause local code execution. On systems with Mercurial (hg) installed, downloading…
Go
HIGH 7.8
Building a malicious file with cmd/go can cause can cause a write to an attacker-controlled file with partial control of the file content. The "#cgo …
Go
HIGH 7.5
The net/url package does not set a limit on the number of query parameters in a query. While the maximum size of query parameters in URLs is generall…
Go
MEDIUM 6.5
archive/zip uses a super-linear file name indexing algorithm that is invoked the first time a file in an archive is opened. This can lead to a denial…
Go
MEDIUM 5.3
During the TLS 1.3 handshake if multiple messages are sent in records that span encryption level boundaries (for instance the Client Hello and Encryp…
Go
MEDIUM 6.5
An excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate. For example a constrain…
Go
HIGH 7.5
Within HostnameError.Error(), when constructing an error string, there is no limit to the number of hosts that will be printed out. Furthermore, the …