Skip to content
OpenAdvisories
High DLA-3395-1 10 CVEs

golang-1.11 - security update

Published Apr 19, 2023 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 1

ReleasePackageFixed in
Debian · 10 golang-1.11 1.11.6-1+deb10u6

Vulnerabilities 10

  • High 7.5
    CVE-2021-44716

    golang.org/x/net/http2 allows uncontrolled memory consumption

    net/http in Go before 1.16.12 and 1.17.x before 1.17.5 allows uncontrolled memory consumption in the header canonicalization cache via HTTP/2 requests.

    golang go stdlib golang-1.8 Debian Ubuntu Azure Linux Alpine Go
  • Unscored —
    CVE-2020-28367

    Arbitrary code execution via the go command with cgo in cmd/go

    Code injection in the go command with cgo before Go 1.14.12 and Go 1.15.5 allows arbitrary code execution at build time via malicious gcc flags specified via a #cgo directive.

    Go toolchain cmd/go go golang-1.8 Debian Ubuntu Alpine Go
  • Unscored —
    CVE-2021-33196

    Panic when reading certain archives in archive/zip

    In archive/zip in Go before 1.15.13 and 1.16.x before 1.16.5, a crafted file count (in an archive's header) can cause a NewReader or OpenReader panic.

    golang go stdlib golang-1.8 Debian Ubuntu Azure Linux Alpine Go
  • Unscored —
    CVE-2021-36221

    Panic in ReverseProxy in net/http/httputil

    Go before 1.15.15 and 1.16.x before 1.16.7 has a race condition that can lead to a net/http/httputil ReverseProxy panic upon an ErrAbortHandler abort.

    go stdlib golang-1.8 golang-1.13 Debian Ubuntu Alpine Go
  • Unscored —
    CVE-2021-38297 Public exploit EPSS 11%

    Buffer overflow in WASM modules in misc/wasm and cmd/link

    Go before 1.16.9 and 1.17.x before 1.17.2 has a Buffer Overflow via large arguments in a function invocation from a WASM module, when GOARCH=wasm GOOS=js is used.

    golang go golang-1.8 golang-1.13 Debian Ubuntu Azure Linux Alpine Go
  • Unscored —
    CVE-2021-39293

    Panic due to crafted inputs in archive/zip

    In archive/zip in Go before 1.16.8 and 1.17.x before 1.17.1, a crafted archive header (falsely designating that many files are present) can cause a NewReader or OpenReader panic. NOTE: this issue exists because of an incomplete fix for CVE-2021-33196.

    go stdlib golang-1.8 golang-1.16 Debian Ubuntu Alpine Go
  • Unscored —
    CVE-2021-41771

    Panic on invalid symbol tables in debug/macho

    ImportedSymbols in debug/macho (for Open or OpenFat) in Go before 1.16.10 and 1.17.x before 1.17.3 Accesses a Memory Location After the End of a Buffer, aka an out-of-bounds slice situation.

    golang go stdlib golang-1.8 Debian Ubuntu Azure Linux Alpine Go
  • Unscored —
    CVE-2021-44717

    Misdirected I/O in syscall

    Go before 1.16.12 and 1.17.x before 1.17.5 on UNIX allows write operations to an unintended file or unintended network connection as a consequence of erroneous closing of file descriptor 0 after file-descriptor exhaustion.

    go stdlib golang-1.8 golang-1.17 Debian Ubuntu Alpine Go
  • Unscored —
    CVE-2022-23806

    Incorrect computation for some invalid field elements in crypto/elliptic

    Curve.IsOnCurve in crypto/elliptic in Go before 1.16.14 and 1.17.x before 1.17.7 can incorrectly return true in situations with a big.Int value that is not a valid field element.

    golang go stdlib lxd Debian Ubuntu Azure Linux Alpine Go
  • Unscored —
    CVE-2022-24921

    Stack exhaustion when compiling deeply nested expressions in regexp

    regexp.Compile in Go before 1.16.15 and 1.17.x before 1.17.8 allows stack exhaustion via a deeply nested expression.

    golang go stdlib golang-1.8 Debian Ubuntu Azure Linux Alpine Go