Go
by Golang
Source repositories
CVEs (220)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2026-42504 | Hig | 0.42 | 7.5 | 0.01 | Jun 2, 2026 | Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU. | ||
| CVE-2026-46599 | Hig | 0.42 | 7.5 | 0.00 | May 29, 2026 | The TIFF decoder does not place a limit on the size of PackBits-compressed data. A maliciously-crafted image can exploit this to cause a small image (both in terms of pixel width/height and encoded size) to make the decoder decode large amounts of compressed data. | ||
| CVE-2026-46597 | Hig | 0.42 | 7.5 | 0.00 | May 22, 2026 | An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs. | ||
| CVE-2026-39829 | Hig | 0.42 | 7.5 | 0.00 | May 22, 2026 | The RSA and DSA public key parsers did not enforce size limits on key parameters. A crafted public key with an excessively large modulus or DSA parameter could cause several minutes of CPU consumption during signature verification. This could be triggered by unauthenticated… | ||
| CVE-2026-42501 | Hig | 0.42 | 7.5 | 0.00 | May 7, 2026 | A malicious module proxy can exploit a flaw in the go command's validation of module checksums to bypass checksum database validation. This vulnerability affects any user using an untrusted module proxy (GOMODPROXY) or checksum database (GOSUMDB). A malicious module proxy can… | ||
| CVE-2026-42499 | Hig | 0.42 | 7.5 | 0.01 | May 7, 2026 | Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322. | ||
| CVE-2026-39836 | Hig | 0.42 | 7.5 | 0.01 | May 7, 2026 | The Dial and LookupPort functions panic on Windows when provided with an input containing a NUL (0). | ||
| CVE-2026-39820 | Hig | 0.42 | 7.5 | 0.01 | May 7, 2026 | Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations. | ||
| CVE-2026-33814 | Hig | 0.42 | 7.5 | 0.01 | May 7, 2026 | When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0. | ||
| CVE-2026-33811 | Hig | 0.42 | 7.5 | 0.01 | May 7, 2026 | When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash. | ||
| CVE-2026-32283 | Hig | 0.42 | 7.5 | 0.01 | Apr 8, 2026 | If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled consumption of resources. This can lead to a denial of service. This only affects TLS 1.3. | ||
| CVE-2026-32281 | Hig | 0.42 | 7.5 | 0.00 | Apr 8, 2026 | Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service. This only affects validation of otherwise trusted certificate chains, issued by a root… | ||
| CVE-2026-32280 | Hig | 0.42 | 7.5 | 0.01 | Apr 8, 2026 | During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of service. This affects both direct users of crypto/x509 and users of… | ||
| CVE-2026-27137 | Hig | 0.42 | 7.5 | 0.01 | Mar 6, 2026 | When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly applied, and only the last constraint will be considered. | ||
| CVE-2026-25679 | Hig | 0.42 | 7.5 | 0.01 | Mar 6, 2026 | url.Parse insufficiently validated the host/authority component and accepted some invalid URLs. | ||
| CVE-2025-61726 | Hig | 0.42 | 7.5 | 0.02 | Jan 28, 2026 | The net/url package does not set a limit on the number of query parameters in a query. While the maximum size of query parameters in URLs is generally limited by the maximum request header size, the net/http.Request.ParseForm method can parse large URL-encoded forms. Parsing a… | ||
| CVE-2025-61727 | Med | 0.42 | 6.5 | 0.00 | Dec 3, 2025 | An excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate. For example a constraint that excludes the subdomain test.example.com does not prevent a leaf certificate from claiming the SAN *.example.com. | ||
| CVE-2025-61725 | Hig | 0.42 | 7.5 | 0.01 | Oct 29, 2025 | The ParseAddress function constructs domain-literal address components through repeated string concatenation. When parsing large domain-literal components, this can cause excessive CPU consumption. | ||
| CVE-2025-61723 | Hig | 0.42 | 7.5 | 0.01 | Oct 29, 2025 | The processing time for parsing some invalid inputs scales non-linearly with respect to the size of the input. This affects programs which parse untrusted PEM inputs. | ||
| CVE-2025-58188 | Hig | 0.42 | 7.5 | 0.00 | Oct 29, 2025 | Validating certificate chains which contain DSA public keys can cause programs to panic, due to a interface cast that assumes they implement the Equal method. This affects programs which validate arbitrary certificate chains. |
- risk 0.42cvss 7.5epss 0.01
Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU.
- risk 0.42cvss 7.5epss 0.00
The TIFF decoder does not place a limit on the size of PackBits-compressed data. A maliciously-crafted image can exploit this to cause a small image (both in terms of pixel width/height and encoded size) to make the decoder decode large amounts of compressed data.
- risk 0.42cvss 7.5epss 0.00
An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs.
- risk 0.42cvss 7.5epss 0.00
The RSA and DSA public key parsers did not enforce size limits on key parameters. A crafted public key with an excessively large modulus or DSA parameter could cause several minutes of CPU consumption during signature verification. This could be triggered by unauthenticated…
- risk 0.42cvss 7.5epss 0.00
A malicious module proxy can exploit a flaw in the go command's validation of module checksums to bypass checksum database validation. This vulnerability affects any user using an untrusted module proxy (GOMODPROXY) or checksum database (GOSUMDB). A malicious module proxy can…
- risk 0.42cvss 7.5epss 0.01
Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322.
- risk 0.42cvss 7.5epss 0.01
The Dial and LookupPort functions panic on Windows when provided with an input containing a NUL (0).
- risk 0.42cvss 7.5epss 0.01
Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations.
- risk 0.42cvss 7.5epss 0.01
When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.
- risk 0.42cvss 7.5epss 0.01
When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash.
- risk 0.42cvss 7.5epss 0.01
If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled consumption of resources. This can lead to a denial of service. This only affects TLS 1.3.
- risk 0.42cvss 7.5epss 0.00
Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service. This only affects validation of otherwise trusted certificate chains, issued by a root…
- risk 0.42cvss 7.5epss 0.01
During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of service. This affects both direct users of crypto/x509 and users of…
- risk 0.42cvss 7.5epss 0.01
When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly applied, and only the last constraint will be considered.
- risk 0.42cvss 7.5epss 0.01
url.Parse insufficiently validated the host/authority component and accepted some invalid URLs.
- risk 0.42cvss 7.5epss 0.02
The net/url package does not set a limit on the number of query parameters in a query. While the maximum size of query parameters in URLs is generally limited by the maximum request header size, the net/http.Request.ParseForm method can parse large URL-encoded forms. Parsing a…
- risk 0.42cvss 6.5epss 0.00
An excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate. For example a constraint that excludes the subdomain test.example.com does not prevent a leaf certificate from claiming the SAN *.example.com.
- risk 0.42cvss 7.5epss 0.01
The ParseAddress function constructs domain-literal address components through repeated string concatenation. When parsing large domain-literal components, this can cause excessive CPU consumption.
- risk 0.42cvss 7.5epss 0.01
The processing time for parsing some invalid inputs scales non-linearly with respect to the size of the input. This affects programs which parse untrusted PEM inputs.
- risk 0.42cvss 7.5epss 0.00
Validating certificate chains which contain DSA public keys can cause programs to panic, due to a interface cast that assumes they implement the Equal method. This affects programs which validate arbitrary certificate chains.
Page 6 of 11