Total
174 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-42499 | 1 Golang | 1 Go | 2026-07-10 | N/A | 7.5 HIGH |
| Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322. | |||||
| CVE-2026-39820 | 1 Golang | 1 Go | 2026-07-10 | N/A | 7.5 HIGH |
| Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations. | |||||
| CVE-2026-33814 | 1 Golang | 2 Go, Http2 | 2026-07-10 | N/A | 7.5 HIGH |
| When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0. | |||||
| CVE-2026-33811 | 1 Golang | 1 Go | 2026-07-10 | N/A | 7.5 HIGH |
| When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash. | |||||
| CVE-2026-32280 | 1 Golang | 1 Go | 2026-07-10 | N/A | 7.5 HIGH |
| During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of service. This affects both direct users of crypto/x509 and users of crypto/tls. | |||||
| CVE-2026-25679 | 1 Golang | 1 Go | 2026-07-10 | N/A | 7.5 HIGH |
| url.Parse insufficiently validated the host/authority component and accepted some invalid URLs. | |||||
| CVE-2025-61726 | 1 Golang | 1 Go | 2026-07-10 | N/A | 7.5 HIGH |
| The net/url package does not set a limit on the number of query parameters in a query. While the maximum size of query parameters in URLs is generally limited by the maximum request header size, the net/http.Request.ParseForm method can parse large URL-encoded forms. Parsing a large form containing many unique query parameters can cause excessive memory consumption. | |||||
| CVE-2026-33810 | 1 Golang | 1 Go | 2026-07-09 | N/A | 8.2 HIGH |
| When verifying a certificate chain containing excluded DNS constraints, these constraints are not correctly applied to wildcard DNS SANs which use a different case than the constraint. This only affects validation of otherwise trusted certificate chains, issued by a root CA in the VerifyOptions.Roots CertPool, or in the system certificate pool. | |||||
| CVE-2026-32283 | 1 Golang | 1 Go | 2026-07-09 | N/A | 7.5 HIGH |
| If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled consumption of resources. This can lead to a denial of service. This only affects TLS 1.3. | |||||
| CVE-2026-27140 | 1 Golang | 1 Go | 2026-07-09 | N/A | 8.8 HIGH |
| SWIG file names containing 'cgo' and well-crafted payloads could lead to code smuggling and arbitrary code execution at build time due to trust layer bypass. | |||||
| CVE-2026-27137 | 1 Golang | 1 Go | 2026-07-09 | N/A | 7.5 HIGH |
| When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly applied, and only the last constraint will be considered. | |||||
| CVE-2025-61732 | 1 Golang | 1 Go | 2026-07-09 | N/A | 8.6 HIGH |
| A discrepancy between how Go and C/C++ comments were parsed allowed for code smuggling into the resulting cgo binary. | |||||
| CVE-2025-61731 | 1 Golang | 1 Go | 2026-07-09 | N/A | 7.8 HIGH |
| Building a malicious file with cmd/go can cause can cause a write to an attacker-controlled file with partial control of the file content. The "#cgo pkg-config:" directive in a Go source file provides command-line arguments to provide to the Go pkg-config command. An attacker can provide a "--log-file" argument to this directive, causing pkg-config to write to an attacker-controlled location. | |||||
| CVE-2023-54365 | 3 Golang, Redhat, Traefik | 3 Go, Openshift Ai, Traefik | 2026-07-08 | N/A | 7.5 HIGH |
| Traefik before 2.10.5 and 3.0.0-beta4 is affected by a denial-of-service vulnerability in HTTP/2 request handling inherited from the Go standard library's HTTP/2 implementation (CVE-2023-44487 / CVE-2023-39325, the 'Rapid Reset' technique). A remote attacker can rapidly create and cancel HTTP/2 streams to exhaust server resources and cause service unavailability. | |||||
| CVE-2026-42501 | 1 Golang | 1 Go | 2026-06-17 | N/A | 7.5 HIGH |
| A malicious module proxy can exploit a flaw in the go command's validation of module checksums to bypass checksum database validation. This vulnerability affects any user using an untrusted module proxy (GOMODPROXY) or checksum database (GOSUMDB). A malicious module proxy can serve altered versions of the Go toolchain. When selecting a different version of the Go toolchain than the currently installed toolchain (due to the GOTOOLCHAIN environment variable, or a go.work or go.mod with a toolchain line), the go command will download and execute a toolchain provided by the module proxy. A malicious module proxy can bypass checksum database validation for this downloaded toolchain. Since this vulnerability affects the security of toolchain downloads, setting GOTOOLCHAIN to a fixed version is not sufficient. You must upgrade your base Go toolchain. The go tool always validates the hash of a toolchain before executing it, so fixed versions will refuse to execute any cached, altered versions of the toolchain. The go tool trusts go.sum files to contain accurate hashes of the current module's dependencies. A malicious proxy exploiting this vulnerability to serve an altered module will have caused an incorrect hash to be recorded in the go.sum. Users who have configured a non-trusted GOPROXY can determine if they have been affected by running "rm go.sum ; go mod tidy ; go mod verify", which will revalidate all dependencies of the current module. The specific flaw in more detail: The go command consults the checksum database to validate downloaded modules, when a module is not listed in the go.sum file. It verifies that the module hash reported by the checksum database matches the hash of the downloaded module. If, however, the checksum database returns a successful response that contains no entry for the module, the go command incorrectly permitted validation to succeed. A module proxy may mirror or proxy the checksum database, in which case the go command will not connect to the checksum database directly. Checksums reported by the checksum database are cryptographically signed, so a malicious proxy cannot alter the reported checksum for a module. However, a proxy which returns an empty checksum response, or a checksum response for an unrelated module, could cause the go command to proceed as if a downloaded module has been validated. | |||||
| CVE-2026-39836 | 1 Golang | 1 Go | 2026-06-17 | N/A | 7.5 HIGH |
| The Dial and LookupPort functions panic on Windows when provided with an input containing a NUL (0). | |||||
| CVE-2026-39826 | 1 Golang | 1 Go | 2026-06-17 | N/A | 6.1 MEDIUM |
| If a trusted template author were to write a <script> tag containing an empty 'type' attribute or a 'type' attribute with an ASCII whitespace, the execution of the template would incorrectly escape any data passed into the <script> block. | |||||
| CVE-2026-39825 | 1 Golang | 1 Go | 2026-06-17 | N/A | 5.3 MEDIUM |
| ReverseProxy can forward queries containing parameters not visible to Rewrite functions. When used with a Rewrite function, or a Director function which parses query parameters, ReverseProxy sanitizes the forwarded request to remove query parameters which are not parsed by url.ParseQuery. ReverseProxy does not take ParseQuery's limit on the total number of query parameters (controlled by GODEBUG=urlmaxqueryparams=N) into account. This can permit ReverseProxy to forward a request containing a query parameter that is not visible to the Rewrite function. For example, the query "a1=x&a2=x&...&a10000=x&hidden=y" can forward the parameter "hidden=y" while hiding it from the proxy's Rewrite function. | |||||
| CVE-2026-39823 | 1 Golang | 1 Go | 2026-06-17 | N/A | 6.1 MEDIUM |
| CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a <meta> tag's <content> attribute. If the URL content were to insert ASCII whitespaces around the '=' rune inside of the <content> attribute, the escaper would fail to similarly escape it, leading to XSS. | |||||
| CVE-2026-39819 | 1 Golang | 1 Go | 2026-06-17 | N/A | 5.3 MEDIUM |
| The "go bug" command writes to two files with predictable names in the system temporary directory (for example, "/tmp"). An attacker with access to the temporary directory can create a symlink in one of these names, causing "go bug" to overwrite the target of the symlink. | |||||