Browse CVEs

MEDIUM 5.3 CVE-2023-29409 Extremely large RSA keys in certificate chains can cause a client/server to expend significant CPU time verifying signatures. With fix, the size of R… Go 1.19.12 / 1.20.7+ Fix from $1,6002023-08-02 MEDIUM 6.5 CVE-2023-29406 The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject additional headers or entire … Go 1.19.11 / 1.20.6+ Fix from $1,6002023-07-11 CRITICAL 9.8 CVE-2023-29404 The go command may execute arbitrary code at build time when using cgo. This may occur when running "go get" on a malicious module, or when running a… Go 1.19.10 / 1.20.5+ Fix from $2,3002023-06-08 CRITICAL 9.8 CVE-2023-29405 The go command may execute arbitrary code at build time when using cgo. This may occur when running "go get" on a malicious module, or when running a… Go 1.19.10 / 1.20.5+ Fix from $2,3002023-06-08 CRITICAL 9.8 CVE-2023-29402 The go command may generate unexpected code at build time when using cgo. This may result in unexpected behavior when running a go program which uses… Go 1.19.10 / 1.20.5+ Fix from $2,3002023-06-08 HIGH 7.8 CVE-2023-29403 On Unix platforms, the Go runtime does not behave differently when a binary is run with the setuid/setgid bits. This can be dangerous in certain case… Go 1.19.10 / 1.20.5+ Fix from $1,9502023-06-08 CRITICAL 9.8 CVE-2023-24540 Not all valid JavaScript whitespace characters are considered to be whitespace. Templates containing whitespace characters outside of the character s… Go 1.19.9 / 1.20.4+ Fix from $2,3002023-05-11 HIGH 7.3 CVE-2023-24539 Angle brackets (<>) are not considered dangerous characters when inserted into CSS contexts. Templates containing multiple actions separated by a '/'… Go 1.19.9 / 1.20.4+ Fix from $1,9502023-05-11 HIGH 7.3 CVE-2023-29400 Templates containing actions in unquoted HTML attributes (e.g. "attr={{.}}") executed with empty input can result in output with unexpected results w… Go 1.19.9 / 1.20.4+ Fix from $1,9502023-05-11 CRITICAL 9.8 CVE-2023-24538 Templates do not properly consider backticks (`) as Javascript string delimiters, and do not escape them as expected. Backticks are used, since ES6, … Go 1.19.8 / 1.20.3+ Fix from $2,3002023-04-06 HIGH 7.5 CVE-2023-24534 HTTP and MIME header parsing can allocate large amounts of memory, even when parsing small inputs, potentially leading to a denial of service. Certai… Go 1.19.8 / 1.20.3+ Fix from $1,9502023-04-06 HIGH 7.5 CVE-2023-24536 Multipart form parsing can consume large amounts of CPU and memory when processing form inputs containing very large numbers of parts. This stems fro… Go 1.19.8 / 1.20.3+ Fix from $1,9502023-04-06 HIGH 7.5 CVE-2023-24537 Calling any of the Parse functions on Go source code which contains //line directives with very large line numbers can cause an infinite loop due to … Go 1.19.8 / 1.20.3+ Fix from $1,9502023-04-06 MEDIUM 5.3 CVE-2023-24532 The ScalarMult and ScalarBaseMult methods of the P256 Curve may return an incorrect result if called with some specific unreduced scalars (a scalar l… Go 1.19.7 / 1.20.2+ Fix from $1,6002023-03-08 HIGH 7.5 CVE-2022-41724 Large handshake records may cause panics in crypto/tls. Both clients and servers may send large TLS handshake records which cause servers and clients… Go 1.19.6+ Fix from $1,9502023-02-28 HIGH 7.5 CVE-2022-41725 A denial of service is possible from excessive resource consumption in net/http and mime/multipart. Multipart form parsing with mime/multipart.Reader… Go 1.19.6+ Fix from $1,9502023-02-28 MEDIUM 5.5 CVE-2022-41727 An attacker can craft a malformed TIFF image which will consume a significant amount of memory when passed to DecodeConfig. This could lead to a deni… Image 0.5.0+ Fix from $1,6002023-02-28 HIGH 7.5 CVE-2022-41722 A path traversal vulnerability exists in filepath.Clean on Windows. On Windows, the filepath.Clean function could transform an invalid path such as "… Go 1.19.6+ Fix from $1,9502023-02-28 HIGH 7.5 CVE-2022-41723 A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of service from a small … Go 0.7.0 / 1.19.6+ Fix from $1,9502023-02-28 HIGH 7.5 CVE-2022-41721 A request smuggling attack is possible when using MaxBytesHandler. When using MaxBytesHandler, the body of an HTTP request is not fully consumed. Whe… H2c 2022-11-04+ Fix from $1,9502023-01-13 HIGH 7.5 CVE-2021-38561 golang.org/x/text/language in golang.org/x/text before 0.3.7 can panic with an out-of-bounds read during BCP 47 language tag parsing. Index calculati… Text 0.3.7+ Fix from $1,9502022-12-26 MEDIUM 5.3 CVE-2022-41717EPSS 6% An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server connections contain a cache of HTTP header keys… Go 0.4.0 / 1.18.9+ Fix from $1,6002022-12-08 HIGH 7.5 CVE-2022-41720 On Windows, restricted files can be accessed via os.DirFS and http.Dir. The os.DirFS function and http.Dir type provide access to a tree of files roo… Go 1.18.9 / 1.19.4+ Fix from $1,9502022-12-07 HIGH 7.5 CVE-2022-41716 Due to unsanitized NUL values, attackers may be able to maliciously set environment variables on Windows. In syscall.StartProcess and os/exec.Cmd, in… Go 1.18.8 / 1.19.3+ Fix from $1,9502022-11-02 HIGH 7.5 CVE-2022-41715 Programs which compile regular expressions from untrusted sources may be vulnerable to memory exhaustion or denial of service. The parsed regexp repr… Go 1.18.7 / 1.19.2+ Fix from $1,9502022-10-14 HIGH 7.5 CVE-2022-32149 An attacker may cause a denial of service by crafting an Accept-Language header which ParseAcceptLanguage will take significant time to parse. Text 0.3.8+ Fix from $1,9502022-10-14 HIGH 7.5 CVE-2022-2880 Requests forwarded by ReverseProxy include the raw query parameters from the inbound request, including unparsable parameters rejected by net/http. T… Go 1.18.7 / 1.19.2+ Fix from $1,9502022-10-14 HIGH 7.5 CVE-2022-2879 Reader.Read does not set a limit on the maximum size of file headers. A maliciously crafted archive could cause Read to allocate unbounded amounts of… Go 1.18.7 / 1.19.2+ Fix from $1,9502022-10-14 HIGH 7.5 CVE-2022-32190 JoinPath and URL.JoinPath do not remove ../ path elements appended to a relative path. For example, JoinPath("https://go.dev", "../go") returns the U… Go Patch available Fix from $1,9502022-09-13 HIGH 7.5 CVE-2022-27664 In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers can cause a denial of service because an HTTP/2 connection can hang during closin… Go 1.18.6+ Fix from $1,9502022-09-06