Browse CVEs

MEDIUM 5.3 CVE-2025-47914 SSH Agent servers do not validate the size of messages when processing new identity requests, which may cause the program to panic if the message is … Crypto 0.45.0+ Fix from $1,6002025-11-19 MEDIUM 5.3 CVE-2025-58181 SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause u… Crypto 0.45.0+ Fix from $1,6002025-11-19 MEDIUM 5.3 CVE-2025-61724 The Reader.ReadResponse function constructs a response string through repeated string concatenation of lines. When the number of lines in a response … Go 1.24.8 / 1.25.2+ Fix from $1,6002025-10-29 HIGH 7.5 CVE-2025-58187 Due to the design of the name constraint checking algorithm, the processing time of some inputs scale non-linearly with respect to the size of the ce… Go 1.24.9 / 1.25.3+ Fix from $1,9502025-10-29 HIGH 7.5 CVE-2025-58188 Validating certificate chains which contain DSA public keys can cause programs to panic, due to a interface cast that assumes they implement the Equa… Go 1.24.8 / 1.25.2+ Fix from $1,9502025-10-29 HIGH 7.5 CVE-2025-61723 The processing time for parsing some invalid inputs scales non-linearly with respect to the size of the input. This affects programs which parse untr… Go 1.24.8 / 1.25.2+ Fix from $1,9502025-10-29 MEDIUM 5.3 CVE-2025-58185 Parsing a maliciously crafted DER payload could allocate large amounts of memory, causing memory exhaustion. Go 1.24.8 / 1.25.2+ Fix from $1,6002025-10-29 MEDIUM 5.3 CVE-2025-58189 When Conn.Handshake fails during ALPN negotiation the error contains attacker controlled information (the ALPN protocols sent by the client) which is… Go 1.24.8 / 1.25.2+ Fix from $1,6002025-10-29 MEDIUM 5.3 CVE-2025-47912 The Parse function permits values other than IPv6 addresses to be included in square brackets within the host component of a URL. RFC 3986 permits IP… Go 1.24.8 / 1.25.2+ Fix from $1,6002025-10-29 MEDIUM 6.5 CVE-2025-47906 If the PATH environment variable contains paths which are executables (rather than just directories), passing certain strings to LookPath ("", ".", a… Go 1.23.12 / 1.24.6+ Fix from $1,6002025-09-18 HIGH 7.0 CVE-2025-47907 Cancelling a query (e.g. by cancelling the context passed to one of the query methods) during a call to the Scan method of the returned Rows can resu… Go 1.23.12 / 1.24.6+ Fix from $1,9502025-08-07 HIGH 8.6 CVE-2025-4674 The go command may execute unexpected commands when operating in untrusted VCS repositories. This occurs when possibly dangerous VCS configuration is… Go 1.23.11 / 1.24.5+ Fix from $1,9502025-07-29 MEDIUM 5.5 CVE-2025-0913 os.OpenFile(path, os.O_CREATE|O_EXCL) behaved differently on Unix and Windows systems when the target path was a dangling symlink. On Unix systems, O… Go 1.23.10 / 1.24.4+ Fix from $1,6002025-06-11 CRITICAL 9.8 CVE-2024-24790 The various Is methods (IsPrivate, IsLoopback, etc) did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which woul… Go 1.21.11 / 1.22.4+ Fix from $2,3002024-06-05 MEDIUM 5.5 CVE-2024-24789 The archive/zip package's handling of certain types of invalid zip files differs from the behavior of most zip implementations. This misalignment cou… Go 1.21.11 / 1.22.4+ Fix from $1,6002024-06-05 HIGH 7.5 CVE-2023-45285 Using go get to fetch a module with the ".git" suffix may unexpectedly fallback to the insecure "git://" protocol if the module is unavailable via th… Go 1.20.12 / 1.21.5+ Fix from $1,9502023-12-06 MEDIUM 5.3 CVE-2023-39326 A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network… Go 1.20.12 / 1.21.5+ Fix from $1,6002023-12-06 HIGH 7.5 CVE-2023-45287 Before Go 1.20, the RSA based TLS key exchanges used the math/big library, which is not constant time. RSA blinding was applied to prevent timing att… Go 1.20.0+ Fix from $1,9502023-12-05 HIGH 7.5 CVE-2023-45283 The filepath package does not recognize paths with a \??\ prefix as special. On Windows, a path beginning with \??\ is a Root Local Device path equiv… Go 1.20.11 / 1.21.4+ Fix from $1,9502023-11-09 MEDIUM 5.3 CVE-2023-45284 On Windows, The IsLocal function does not correctly detect reserved device names in some cases. Reserved names followed by spaces, such as "COM1 ", a… Go 1.20.11 / 1.21.4+ Fix from $1,6002023-11-09 HIGH 7.5 CVE-2023-39325 A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption. While the total… Go 0.17.0 / 1.20.10+ Fix from $1,9502023-10-11 HIGH 8.1 CVE-2023-39323 Line directives ("//line") can be used to bypass the restrictions on "//go:cgo_" directives, allowing blocked linker and compiler flags to be passed … Go 1.20.9 / 1.21.2+ Fix from $1,9502023-10-05 HIGH 7.5 CVE-2023-39321 Processing an incomplete post-handshake message for a QUIC connection can cause a panic. Go 1.21.1+ Fix from $1,9502023-09-08 HIGH 7.5 CVE-2023-39322 QUIC connections do not set an upper bound on the amount of data buffered when reading post-handshake messages, allowing a malicious QUIC connection … Go 1.21.1+ Fix from $1,9502023-09-08 CRITICAL 9.8 CVE-2023-39320 The go.mod toolchain directive, introduced in Go 1.21, can be leveraged to execute scripts and binaries relative to the root of the module when the "… Go 1.21.1+ Fix from $2,3002023-09-08 MEDIUM 6.1 CVE-2023-39318 The html/template package does not properly handle HTML-like "" comment tokens, nor hashbang "#!" comment tokens, in <script> contexts. This may caus… Go 1.20.8 / 1.21.1+ Fix from $1,6002023-09-08 MEDIUM 6.1 CVE-2023-39319 The html/template package does not apply the proper rules for handling occurrences of "<script", "<!--", and "</script" within JS literals in <script… Go 1.20.8 / 1.21.1+ Fix from $1,6002023-09-08 MEDIUM 6.1 CVE-2023-3978 Text nodes not in the HTML namespace are incorrectly literally rendered, causing text which should be escaped to not be. This could lead to an XSS at… Networking 0.13.0+ Fix from $1,6002023-08-02 MEDIUM 6.5 CVE-2023-29407 A maliciously-crafted image can cause excessive CPU consumption in decoding. A tiled image with a height of 0 and a very large width can cause excess… Image 0.10.0+ Fix from $1,6002023-08-02 MEDIUM 6.5 CVE-2023-29408 The TIFF decoder does not place a limit on the size of compressed tile data. A maliciously-crafted image can exploit this to cause a small image (bot… Image 0.10.0+ Fix from $1,6002023-08-02