Go Standard Library
Page 2 of 2 — Go Standard Library CVEs from a corpus of 121, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-41717 | Medium | 5.3 | 2022-12-08 | An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server connections contain a cache of HTTP header keys sent by t… |
CVE-2022-41720 | High | 7.5 | 2022-12-07 | On Windows, restricted files can be accessed via os.DirFS and http.Dir. The os.DirFS function and http.Dir type provide access to a tree of files rooted at a g… |
CVE-2022-41716 | High | 7.5 | 2022-11-02 | Due to unsanitized NUL values, attackers may be able to maliciously set environment variables on Windows. In syscall.StartProcess and os/exec.Cmd, invalid envi… |
CVE-2022-41715 | High | 7.5 | 2022-10-14 | Programs which compile regular expressions from untrusted sources may be vulnerable to memory exhaustion or denial of service. The parsed regexp representation… |
CVE-2022-2880 | High | 7.5 | 2022-10-14 | Requests forwarded by ReverseProxy include the raw query parameters from the inbound request, including unparsable parameters rejected by net/http. This could… |
CVE-2022-2879 | High | 7.5 | 2022-10-14 | Reader.Read does not set a limit on the maximum size of file headers. A maliciously crafted archive could cause Read to allocate unbounded amounts of memory, p… |
CVE-2022-32190 | High | 7.5 | 2022-09-13 | JoinPath and URL.JoinPath do not remove ../ path elements appended to a relative path. For example, JoinPath("https://go.dev", "../go") returns the URL "https… |
CVE-2022-32189 | High | 7.5 | 2022-08-10 | A too-short encoded message can cause a panic in Float.GobDecode and Rat GobDecode in math/big in Go before 1.17.13 and 1.18.5, potentially allowing a denial o… |
CVE-2022-32148 | Medium | 6.5 | 2022-08-10 | Improper exposure of client IP addresses in net/http before Go 1.17.12 and Go 1.18.4 can be triggered by calling httputil.ReverseProxy.ServeHTTP with a Request… |
CVE-2022-30635 | High | 7.5 | 2022-08-10 | Uncontrolled recursion in Decoder.Decode in encoding/gob before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a mess… |
CVE-2022-30633 | High | 7.5 | 2022-08-10 | Uncontrolled recursion in Unmarshal in encoding/xml before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via unmarshalli… |
CVE-2022-30632 | High | 7.5 | 2022-08-10 | Uncontrolled recursion in Glob in path/filepath before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a path containi… |
CVE-2022-30631 | High | 7.5 | 2022-08-10 | Uncontrolled recursion in Reader.Read in compress/gzip before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via an archi… |
CVE-2022-30630 | High | 7.5 | 2022-08-10 | Uncontrolled recursion in Glob in io/fs before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a path which contains a… |
CVE-2022-30629 | Low | 3.1 | 2022-08-10 | Non-random values for ticket_age_add in session tickets in crypto/tls before Go 1.17.11 and Go 1.18.3 allow an attacker that can observe TLS handshakes to corr… |
CVE-2022-30580 | High | 7.8 | 2022-08-10 | Code injection in Cmd.Start in os/exec before Go 1.17.11 and Go 1.18.3 allows execution of any binaries in the working directory named either "..com" or "..exe… |
CVE-2022-29804 | High | 7.5 | 2022-08-10 | Incorrect conversion of certain invalid paths to valid, absolute paths in Clean in path/filepath before Go 1.17.11 and Go 1.18.3 on Windows allows potential di… |
CVE-2022-28131 | High | 7.5 | 2022-08-10 | Uncontrolled recursion in Decoder.Skip in encoding/xml before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a deeply… |
CVE-2022-1962 | Medium | 5.5 | 2022-08-10 | Uncontrolled recursion in the Parse functions in go/parser before Go 1.17.12 and Go 1.18.4 allow an attacker to cause a panic due to stack exhaustion via deepl… |
CVE-2022-1705 | Medium | 6.5 | 2022-08-10 | Acceptance of some invalid Transfer-Encoding headers in the HTTP/1 client in net/http before Go 1.17.12 and Go 1.18.4 allows HTTP request smuggling if combined… |
CVE-2022-30634 | High | 7.5 | 2022-07-15 | Infinite loop in Read in crypto/rand before Go 1.17.11 and Go 1.18.3 on Windows allows attacker to cause an indefinite hang by passing a buffer larger than 1 <… |