Go

CVEs (220)

• CVE-2022-2879HigOct 14, 2022
  Golang

  Go
  risk 0.49cvss 7.5epss 0.02

  Reader.Read does not set a limit on the maximum size of file headers. A maliciously crafted archive could cause Read to allocate unbounded amounts of memory, potentially causing resource exhaustion or panics. After fix, Reader.Read limits the maximum size of header blocks to 1…

• CVE-2022-30635HigAug 10, 2022
  Golang

  Go
  risk 0.49cvss 7.5epss 0.02

  Uncontrolled recursion in Decoder.Decode in encoding/gob before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a message which contains deeply nested structures.

• CVE-2022-30633HigAug 10, 2022
  Golang

  Go
  risk 0.49cvss 7.5epss 0.02

  Uncontrolled recursion in Unmarshal in encoding/xml before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via unmarshalling an XML document into a Go struct which has a nested field that uses the 'any' field tag.

• CVE-2022-30632HigAug 10, 2022
  Go

  filepath
  risk 0.49cvss 7.5epss 0.02

  Uncontrolled recursion in Glob in path/filepath before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a path containing a large number of path separators.

• CVE-2022-30631HigAug 10, 2022
  Go

  compress/gzip
  risk 0.49cvss 7.5epss 0.02

  Uncontrolled recursion in Reader.Read in compress/gzip before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via an archive containing a large number of concatenated 0-length compressed files.

• CVE-2022-30630HigAug 10, 2022
  Golang

  Go
  risk 0.49cvss 7.5epss 0.02

  Uncontrolled recursion in Glob in io/fs before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a path which contains a large number of path separators.

• CVE-2022-29804HigAug 10, 2022
  Golang

  Go
  risk 0.49cvss 7.5epss 0.02

  Incorrect conversion of certain invalid paths to valid, absolute paths in Clean in path/filepath before Go 1.17.11 and Go 1.18.3 on Windows allows potential directory traversal attack.

• CVE-2022-28131HigAug 10, 2022
  Golang

  Go
  risk 0.49cvss 7.5epss 0.02

  Uncontrolled recursion in Decoder.Skip in encoding/xml before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a deeply nested XML document.

• CVE-2022-30634HigJul 15, 2022
  Golang

  Go
  risk 0.49cvss 7.5epss 0.02

  Infinite loop in Read in crypto/rand before Go 1.17.11 and Go 1.18.3 on Windows allows attacker to cause an indefinite hang by passing a buffer larger than 1 << 32 - 1 bytes.

• CVE-2022-28327HigApr 20, 2022
  Golang

  Go
  risk 0.49cvss 7.5epss 0.04

  The generic P-256 feature in crypto/elliptic in Go before 1.17.9 and 1.18.x before 1.18.1 allows a panic via long scalar input.

• CVE-2022-27536HigApr 20, 2022
  Golang

  Go
  risk 0.49cvss 7.5epss 0.01

  Certificate.Verify in crypto/x509 in Go 1.18.x before 1.18.1 can be caused to panic on macOS when presented with certain malformed certificates. This allows a remote TLS server to cause a TLS client to panic.

• CVE-2022-24675HigApr 20, 2022
  Go

  encoding/pem
  risk 0.49cvss 7.5epss 0.10

  encoding/pem in Go before 1.17.9 and 1.18.x before 1.18.1 has a Decode stack overflow via a large amount of PEM data.

• CVE-2022-24921HigMar 5, 2022
  Golang

  Go
  risk 0.49cvss 7.5epss 0.03

  regexp.Compile in Go before 1.16.15 and 1.17.x before 1.17.8 allows stack exhaustion via a deeply nested expression.

• CVE-2022-23773HigFeb 11, 2022
  Golang

  Go
  risk 0.49cvss 7.5epss 0.03

  cmd/go in Go before 1.16.14 and 1.17.x before 1.17.7 can misinterpret branch names that falsely appear to be version tags. This can lead to incorrect access control if an actor is supposed to be able to create branches but not tags.

• CVE-2022-23772HigFeb 11, 2022
  Golang

  Go
  risk 0.49cvss 7.5epss 0.03

  Rat.SetString in math/big in Go before 1.16.14 and 1.17.x before 1.17.7 has an overflow that can lead to Uncontrolled Memory Consumption.

• CVE-2021-39293HigJan 24, 2022
  Golang

  Go
  risk 0.49cvss 7.5epss 0.07

  In archive/zip in Go before 1.16.8 and 1.17.x before 1.17.1, a crafted archive header (falsely designating that many files are present) can cause a NewReader or OpenReader panic. NOTE: this issue exists because of an incomplete fix for CVE-2021-33196.

• CVE-2021-41772HigNov 8, 2021
  Golang

  Go
  risk 0.49cvss 7.5epss 0.03

  Go before 1.16.10 and 1.17.x before 1.17.3 allows an archive/zip Reader.Open panic via a crafted ZIP archive containing an invalid name or an empty filename field.

• CVE-2021-41771HigNov 8, 2021
  Golang

  Go
  risk 0.49cvss 7.5epss 0.04

  ImportedSymbols in debug/macho (for Open or OpenFat) in Go before 1.16.10 and 1.17.x before 1.17.3 Accesses a Memory Location After the End of a Buffer, aka an out-of-bounds slice situation.

• CVE-2021-29923HigAug 7, 2021
  Golang

  Go
  risk 0.49cvss 7.5epss 0.04

  Go before 1.17 does not properly consider extraneous zero characters at the beginning of an IP address octet, which (in some situations) allows attackers to bypass access control that is based on IP addresses, because of unexpected octal interpretation. This affects net.ParseIP…

• CVE-2021-33198HigAug 2, 2021
  Go

  math/big
  risk 0.49cvss 7.5epss 0.03

  In Go before 1.15.13 and 1.16.x before 1.16.5, there can be a panic for a large exponent to the math/big.Rat SetString or UnmarshalText method.