Skip to content
OpenAdvisories

Package · Go

stdlib

182 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

8 results · Clear filters · Feed

  • Critical 9.1
    CVE-2026-78663

    Double flow control refund on HTTP/2 server streams in net/http

    The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client…

    Go standard library golang.org/x/net net/http golang.org/x/net/http2 Debian Ubuntu Alpine Go
  • Critical 9.8
    CVE-2026-56857

    Root.Mkdir(All) can follow junctions out of the root on Windows in os

    On Windows, when the target of Root.Mkdir or Root.MkdirAll is a junction pointing to an empty location, the operation can create a directory at the junction target even when that target is located outside the root. This only applies to operations where the la…

    Go standard library os internal/syscall/windows go Windows Ubuntu Alpine Go
  • Critical 9.6
    CVE-2026-39821

    Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna

    The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege …

    Go standard library golang.org/x/net net/http net/http/internal/http2 Debian Ubuntu Alpine Go
  • Critical 9.1
    CVE-2025-68121

    Unexpected session resumption in crypto/tls

    During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed handshake may succeed when it should have failed. This may happen when a user ca…

    Go standard library crypto/tls go stdlib Debian Ubuntu Alpine Go
  • Critical 9.1
    CVE-2025-22871

    Request smuggling due to acceptance of invalid chunked data in net/http

    The net/http package improperly accepts a bare LF as a line terminator in chunked data chunk-size lines. This can permit request smuggling if a net/http server is used in conjunction with a server that incorrectly accepts a bare LF as part of a chunk-ext.

    Go standard library net/http/internal go stdlib Debian Ubuntu Alpine Packagist Go
  • Critical 9.8
    CVE-2024-24790

    Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses in net/netip

    The various Is methods (IsPrivate, IsLoopback, etc) did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would return true in their traditional IPv4 forms.

    Go standard library net/netip go stdlib Debian Ubuntu Alpine Go
  • Critical 9.8
    CVE-2023-24540

    Improper handling of JavaScript whitespace in html/template

    Not all valid JavaScript whitespace characters are considered to be whitespace. Templates containing whitespace characters outside of the character set "\t\n\f\r\u0020\u2028\u2029" in JavaScript contexts that also contain actions may not be properly sanitized…

    Go standard library html/template go stdlib Debian Alpine Go
  • Critical 9.8
    CVE-2023-24538 Public exploit

    Backticks not treated as string delimiters in html/template

    Templates do not properly consider backticks (`) as Javascript string delimiters, and do not escape them as expected. Backticks are used, since ES6, for JS template literals. If a template contains a Go template action within a Javascript template literal, th…

    Go standard library html/template go stdlib Debian Ubuntu Alpine Go