Go Standard Library
121 CVEs across 38 Go Standard Library products. Browse Go Standard Library vulnerabilities, severities, and proof-of-concept exploits.
Go Standard Library products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-56862 | High | 7.5 | 2026-08-13 | Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not. As a result, a ma… |
CVE-2026-56860 | Medium | 5.9 | 2026-08-13 | Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer rewrites on each step, resulting in qu… |
CVE-2026-56859 | High | 7.5 | 2026-08-13 | Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion. |
CVE-2026-56858 | Medium | 6.1 | 2026-08-13 | Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS. |
CVE-2026-56853 | High | 7.5 | 2026-08-13 | When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. Read… |
CVE-2026-33818 | High | 7.5 | 2026-08-13 | Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures. |
CVE-2026-46600 | High | 7.5 | 2026-07-21 | Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer. |
CVE-2026-42505 | Medium | 5.3 | 2026-07-08 | Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unenc… |
CVE-2026-39822 | High | 7.8 | 2026-07-08 | On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a sym… |
CVE-2026-42507 | Medium | 5.3 | 2026-06-02 | When returning errors, functions in the net/textproto package would include its input as part of the error. This might allow an attacker to inject misleading c… |
CVE-2026-42504 | High | 7.5 | 2026-06-02 | Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU. |
CVE-2026-27145 | Medium | 6.5 | 2026-06-02 | (*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries. This caused strings.Split(ho… |
CVE-2026-39821 | Critical | 9.6 | 2026-05-22 | The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") i… |
CVE-2026-42499 | High | 7.5 | 2026-05-07 | Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322. |
CVE-2026-39836 | High | 7.5 | 2026-05-07 | The Dial and LookupPort functions panic on Windows when provided with an input containing a NUL (0). |
CVE-2026-39826 | Medium | 6.1 | 2026-05-07 | If a trusted template author were to write a <script> tag containing an empty 'type' attribute or a 'type' attribute with an ASCII whitespace, the execution of… |
CVE-2026-39825 | Medium | 5.3 | 2026-05-07 | ReverseProxy can forward queries containing parameters not visible to Rewrite functions. When used with a Rewrite function, or a Director function which parses… |
CVE-2026-39823 | Medium | 6.1 | 2026-05-07 | CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a <meta> tag's <content> attribute. If the URL content were to insert A… |
CVE-2026-39820 | High | 7.5 | 2026-05-07 | Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations. |
CVE-2026-33814 | High | 7.5 | 2026-05-07 | When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a va… |
CVE-2026-33811 | High | 7.5 | 2026-05-07 | When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash. |
CVE-2026-33810 | High | 8.2 | 2026-04-08 | When verifying a certificate chain containing excluded DNS constraints, these constraints are not correctly applied to wildcard DNS SANs which use a different… |
CVE-2026-32289 | Medium | 6.1 | 2026-04-08 | Context was not properly tracked across template branches for JS template literals, leading to possibly incorrect escaping of content when branches were used… |
CVE-2026-32288 | Medium | 5.5 | 2026-04-08 | tar.Reader can allocate an unbounded amount of memory when reading a maliciously-crafted archive containing a large number of sparse regions encoded in the "ol… |
CVE-2026-32283 | High | 7.5 | 2026-04-08 | If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled consu… |
CVE-2026-32282 | Medium | 6.4 | 2026-04-08 | On Linux, if the target of Root.Chmod is replaced with a symlink while the chmod operation is in progress, Chmod can operate on the target of the symlink, even… |
CVE-2026-32281 | High | 7.5 | 2026-04-08 | Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, pos… |
CVE-2026-32280 | High | 7.5 | 2026-04-08 | During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions.In… |
CVE-2026-27142 | Medium | 6.1 | 2026-03-06 | Actions which insert URLs into the content attribute of HTML meta tags are not escaped. This can allow XSS if the meta tag also has an http-equiv attribute wit… |
CVE-2026-27139 | Low | 2.5 | 2026-03-06 | On Unix platforms, when listing the contents of a directory using File.ReadDir or File.Readdir the returned FileInfo could reference a file outside of the Root… |
CVE-2026-27138 | Medium | 5.9 | 2026-03-06 | Certificate verification can panic when a certificate in the chain has an empty DNS name and another certificate in the chain has excluded name constraints. Th… |
CVE-2026-27137 | High | 7.5 | 2026-03-06 | When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different d… |
CVE-2026-25679 | High | 7.5 | 2026-03-06 | url.Parse insufficiently validated the host/authority component and accepted some invalid URLs. |
CVE-2025-68121 | Critical | 10.0 | 2026-02-05 | During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed han… |
CVE-2025-22873 | Low | 3.8 | 2026-02-04 | It was possible to improperly access the parent directory of an os.Root by opening a filename ending in "../". For example, Root.Open("../") would open the par… |
CVE-2025-61730 | Medium | 5.3 | 2026-01-28 | During the TLS 1.3 handshake if multiple messages are sent in records that span encryption level boundaries (for instance the Client Hello and Encrypted Extens… |
CVE-2025-61728 | Medium | 6.5 | 2026-01-28 | archive/zip uses a super-linear file name indexing algorithm that is invoked the first time a file in an archive is opened. This can lead to a denial of servic… |
CVE-2025-61726 | High | 7.5 | 2026-01-28 | The net/url package does not set a limit on the number of query parameters in a query. While the maximum size of query parameters in URLs is generally limited… |
CVE-2025-61727 | Medium | 6.5 | 2025-12-03 | An excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate. For example a constraint that exc… |
CVE-2025-61729 | High | 7.5 | 2025-12-02 | Within HostnameError.Error(), when constructing an error string, there is no limit to the number of hosts that will be printed out. Furthermore, the error stri… |
CVE-2025-61725 | High | 7.5 | 2025-10-29 | The ParseAddress function constructs domain-literal address components through repeated string concatenation. When parsing large domain-literal components, thi… |
CVE-2025-61724 | Medium | 5.3 | 2025-10-29 | The Reader.ReadResponse function constructs a response string through repeated string concatenation of lines. When the number of lines in a response is large… |
CVE-2025-61723 | High | 7.5 | 2025-10-29 | The processing time for parsing some invalid inputs scales non-linearly with respect to the size of the input. This affects programs which parse untrusted PEM… |
CVE-2025-58189 | Medium | 5.3 | 2025-10-29 | When Conn.Handshake fails during ALPN negotiation the error contains attacker controlled information (the ALPN protocols sent by the client) which is not escap… |
CVE-2025-58188 | High | 7.5 | 2025-10-29 | Validating certificate chains which contain DSA public keys can cause programs to panic, due to a interface cast that assumes they implement the Equal method… |
CVE-2025-58187 | High | 7.5 | 2025-10-29 | Due to the design of the name constraint checking algorithm, the processing time of some inputs scale non-linearly with respect to the size of the certificate… |
CVE-2025-58186 | Medium | 5.3 | 2025-10-29 | Despite HTTP headers having a default limit of 1MB, the number of cookies that can be parsed does not have a limit. By sending a lot of very small cookies such… |
CVE-2025-58185 | Medium | 5.3 | 2025-10-29 | Parsing a maliciously crafted DER payload could allocate large amounts of memory, causing memory exhaustion. |
CVE-2025-58183 | Medium | 4.3 | 2025-10-29 | tar.Reader does not set a maximum size on the number of sparse region data blocks in GNU tar pax 1.0 sparse files. A maliciously-crafted archive containing a l… |
CVE-2025-47912 | Medium | 5.3 | 2025-10-29 | The Parse function permits values other than IPv6 addresses to be included in square brackets within the host component of a URL. RFC 3986 permits IPv6 address… |
CVE-2025-47910 | Medium | 5.4 | 2025-09-22 | When using http.CrossOriginProtection, the AddInsecureBypassPattern method can unexpectedly bypass more requests than intended. CrossOriginProtection then skip… |
CVE-2025-47906 | Medium | 6.5 | 2025-09-18 | If the PATH environment variable contains paths which are executables (rather than just directories), passing certain strings to LookPath ("", ".", and "..")… |
CVE-2025-47907 | High | 7.0 | 2025-08-07 | Cancelling a query (e.g. by cancelling the context passed to one of the query methods) during a call to the Scan method of the returned Rows can result in unex… |
CVE-2024-8244 | Low | 3.7 | 2025-08-06 | The filepath.Walk and filepath.WalkDir functions are documented as not following symbolic links, but both functions are susceptible to a TOCTOU (time of check/… |
CVE-2025-0913 | Medium | 5.5 | 2025-06-11 | os.OpenFile(path, os.O_CREATE|O_EXCL) behaved differently on Unix and Windows systems when the target path was a dangling symlink. On Unix systems, OpenFile wi… |
CVE-2025-4673 | Medium | 6.8 | 2025-06-11 | Proxy-Authorization and Proxy-Authenticate headers persisted on cross-origin redirects potentially leaking sensitive information. |
CVE-2025-22874 | High | 7.5 | 2025-06-11 | Calling Verify with a VerifyOptions.KeyUsages that contains ExtKeyUsageAny unintentionally disabledpolicy validation. This only affected certificate chains whi… |
CVE-2025-22871 | Critical | 9.1 | 2025-04-08 | The net/http package improperly accepts a bare LF as a line terminator in chunked data chunk-size lines. This can permit request smuggling if a net/http server… |
CVE-2025-22870 | Medium | 4.4 | 2025-03-12 | Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component. For example, when the NO_PROXY environment variable is s… |
CVE-2025-22866 | Medium | 4.0 | 2025-02-06 | Due to the usage of a variable time instruction in the assembly implementation of an internal function, a small number of bits of secret scalars are leaked on… |
CVE-2025-22865 | High | 7.5 | 2025-01-28 | Using ParsePKCS1PrivateKey to parse a RSA key that is missing the CRT values would panic when verifying that the key is well formed. |
CVE-2024-45341 | Medium | 6.1 | 2025-01-28 | A certificate with a URI which has a IPv6 address with a zone ID may incorrectly satisfy a URI name constraint that applies to the certificate chain. Certifica… |
CVE-2024-45336 | Medium | 6.1 | 2025-01-28 | The HTTP client drops sensitive headers after following a cross-domain redirect. For example, a request to a.com/ containing an Authorization header which is r… |
CVE-2024-34158 | High | 7.5 | 2024-09-06 | Calling Parse on a "// +build" build tag line with deeply nested expressions can cause a panic due to stack exhaustion. |
CVE-2024-34156 | High | 7.5 | 2024-09-06 | Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion. This is a follow-up to CVE-2022-30635. |
CVE-2024-34155 | Medium | 4.3 | 2024-09-06 | Calling any of the Parse functions on Go source code which contains deeply nested literals can cause a panic due to stack exhaustion. |
CVE-2024-24791 | High | 7.5 | 2024-07-02 | The net/http HTTP/1.1 client mishandled the case where a server responds to a request with an "Expect: 100-continue" header with a non-informational (200 or hi… |
CVE-2024-24790 | Critical | 9.8 | 2024-06-05 | The various Is methods (IsPrivate, IsLoopback, etc) did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would return t… |
CVE-2024-24789 | Medium | 5.5 | 2024-06-05 | The archive/zip package's handling of certain types of invalid zip files differs from the behavior of most zip implementations. This misalignment could be expl… |
CVE-2024-24788 | Medium | 5.9 | 2024-05-08 | A malformed DNS message in response to a query can cause the Lookup functions to get stuck in an infinite loop. |
CVE-2023-45288 | High | 7.5 | 2024-04-04 | An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK stat… |
CVE-2024-24785 | Medium | 5.4 | 2024-03-05 | If errors returned from MarshalJSON methods contain user controlled data, they may be used to break the contextual auto-escaping behavior of the html/template… |
CVE-2024-24784 | High | 7.5 | 2024-03-05 | The ParseAddressList function incorrectly handles comments (text within parentheses) within display names. Since this is a misalignment with conforming address… |
CVE-2024-24783 | Medium | 5.9 | 2024-03-05 | Verifying a certificate chain which contains a certificate with an unknown public key algorithm will cause Certificate.Verify to panic. This affects all crypto… |
CVE-2023-45290 | Medium | 6.5 | 2024-03-05 | When parsing a multipart form (either explicitly with Request.ParseMultipartForm or implicitly with Request.FormValue, Request.PostFormValue, or Request.FormFi… |
CVE-2023-45289 | Medium | 4.3 | 2024-03-05 | When following an HTTP redirect to a domain which is not a subdomain match or exact match of the initial domain, an http.Client does not forward sensitive head… |
CVE-2023-39326 | Medium | 5.3 | 2023-12-06 | A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network than are… |
CVE-2023-45287 | High | 7.5 | 2023-12-05 | Before Go 1.20, the RSA based TLS key exchanges used the math/big library, which is not constant time. RSA blinding was applied to prevent timing attacks, but… |
CVE-2023-45284 | Medium | 5.3 | 2023-11-09 | On Windows, The IsLocal function does not correctly detect reserved device names in some cases. Reserved names followed by spaces, such as "COM1 ", and reserve… |
CVE-2023-45283 | High | 7.5 | 2023-11-09 | The filepath package does not recognize paths with a \??\ prefix as special. On Windows, a path beginning with \??\ is a Root Local Device path equivalent to a… |
CVE-2023-39325 | High | 7.5 | 2023-10-11 | A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption. While the total number of… |
CVE-2023-39322 | High | 7.5 | 2023-09-08 | QUIC connections do not set an upper bound on the amount of data buffered when reading post-handshake messages, allowing a malicious QUIC connection to cause u… |
CVE-2023-39321 | High | 7.5 | 2023-09-08 | Processing an incomplete post-handshake message for a QUIC connection can cause a panic. |
CVE-2023-39319 | Medium | 6.1 | 2023-09-08 | The html/template package does not apply the proper rules for handling occurrences of "<script", "<!--", and "</script" within JS literals in <script> contexts… |
CVE-2023-39318 | Medium | 6.1 | 2023-09-08 | The html/template package does not properly handle HTML-like "" comment tokens, nor hashbang "#!" comment tokens, in <script> contexts. This may cause the temp… |
CVE-2023-29409 | Medium | 5.3 | 2023-08-02 | Extremely large RSA keys in certificate chains can cause a client/server to expend significant CPU time verifying signatures. With fix, the size of RSA keys tr… |
CVE-2023-29406 | Medium | 6.5 | 2023-07-11 | The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject additional headers or entire requests… |
CVE-2023-29403 | High | 7.8 | 2023-06-08 | On Unix platforms, the Go runtime does not behave differently when a binary is run with the setuid/setgid bits. This can be dangerous in certain cases, such as… |
CVE-2023-29400 | High | 7.3 | 2023-05-11 | Templates containing actions in unquoted HTML attributes (e.g. "attr={{.}}") executed with empty input can result in output with unexpected results when parsed… |
CVE-2023-24540 | Critical | 9.8 | 2023-05-11 | Not all valid JavaScript whitespace characters are considered to be whitespace. Templates containing whitespace characters outside of the character set "\t\n\f… |
CVE-2023-24539 | High | 7.3 | 2023-05-11 | Angle brackets (<>) are not considered dangerous characters when inserted into CSS contexts. Templates containing multiple actions separated by a '/' character… |
CVE-2023-24538 | Critical | 9.8 | 2023-04-06 | Templates do not properly consider backticks (`) as Javascript string delimiters, and do not escape them as expected. Backticks are used, since ES6, for JS tem… |
CVE-2023-24537 | High | 7.5 | 2023-04-06 | Calling any of the Parse functions on Go source code which contains //line directives with very large line numbers can cause an infinite loop due to integer ov… |
CVE-2023-24536 | High | 7.5 | 2023-04-06 | Multipart form parsing can consume large amounts of CPU and memory when processing form inputs containing very large numbers of parts. This stems from several… |
CVE-2023-24534 | High | 7.5 | 2023-04-06 | HTTP and MIME header parsing can allocate large amounts of memory, even when parsing small inputs, potentially leading to a denial of service. Certain unusual… |
CVE-2023-24532 | Medium | 5.3 | 2023-03-08 | The ScalarMult and ScalarBaseMult methods of the P256 Curve may return an incorrect result if called with some specific unreduced scalars (a scalar larger than… |
CVE-2022-41725 | High | 7.5 | 2023-02-28 | A denial of service is possible from excessive resource consumption in net/http and mime/multipart. Multipart form parsing with mime/multipart.Reader.ReadForm… |
CVE-2022-41724 | High | 7.5 | 2023-02-28 | Large handshake records may cause panics in crypto/tls. Both clients and servers may send large TLS handshake records which cause servers and clients, respecti… |
CVE-2022-41723 | High | 7.5 | 2023-02-28 | A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of service from a small number of… |
CVE-2022-41722 | High | 7.5 | 2023-02-28 | A path traversal vulnerability exists in filepath.Clean on Windows. On Windows, the filepath.Clean function could transform an invalid path such as "a/../c:/b"… |