Skip to content
OpenAdvisories

Package · Go

stdlib

181 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

15 results · Clear filters · Feed

  • Medium 6.8
    CVE-2026-111943 Public exploit

    Distrust compromised intermediate certificates in crypto/x509

    On most platforms, Go uses the given system root certificates. However, in some narrower cases, the system trust stores may not be updated without further action. To defend against the narrower set of cases that may remain affected, a denylist was added in cr…

    Go standard library crypto/x509 go stdlib Debian Ubuntu Alpine Go crates.io
  • Medium 6.5
    CVE-2026-27145 Public exploit

    Inefficient candidate hostname parsing in crypto/x509

    (*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries. This caused strings.Split(host, ".") to execute repeatedly on the same input hostname. With a large DNS SAN list, verification c…

    Go standard library crypto/x509 stdlib golang-1.19 Debian Ubuntu Go
  • Medium 4.4
    CVE-2025-22870 Public exploit

    HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net

    Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component. For example, when the NO_PROXY environment variable is set to "*.example.com", a request to "[::1%25.example.com]:80` will incorrectly match and not be prox…

    Go standard library golang.org/x/net net/http golang.org/x/net/proxy Debian Ubuntu Alpine Go
  • High 7.5
    CVE-2023-45288 Public exploit EPSS 89%

    HTTP/2 CONTINUATION flood in net/http

    An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a reques…

    Go standard library golang.org/x/net net/http golang.org/x/net/http2 Debian Ubuntu Alpine Go
  • High 7.5
    CVE-2023-39325 Public exploit

    HTTP/2 rapid reset can cause excessive work in net/http

    A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption. While the total number of requests is bounded by the http2.Server.MaxConcurrentStreams setting, resetting an in-progress requ…

    Go standard library golang.org/x/net net/http golang.org/x/net/http2 Debian Ubuntu Alpine Go
  • Unscored —
    CVE-2023-29409 Public exploit

    Large RSA keys can cause high CPU usage in crypto/tls

    Extremely large RSA keys in certificate chains can cause a client/server to expend significant CPU time verifying signatures. With fix, the size of RSA keys transmitted during handshakes is restricted to <= 8192 bits. Based on a survey of publicly trusted RSA…

    Go standard library crypto/tls go stdlib Debian Ubuntu Alpine Go
  • Unscored —
    CVE-2023-29406 Public exploit

    Insufficient sanitization of Host header in net/http

    The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject additional headers or entire requests. With fix, the HTTP/1 client now refuses to send requests containing an invalid Request.Host or Reque…

    Go standard library net/http go stdlib Debian Ubuntu Alpine Go
  • Critical 9.8
    CVE-2023-24538 Public exploit

    Backticks not treated as string delimiters in html/template

    Templates do not properly consider backticks (`) as Javascript string delimiters, and do not escape them as expected. Backticks are used, since ES6, for JS template literals. If a template contains a Go template action within a Javascript template literal, th…

    Go standard library html/template go stdlib Debian Ubuntu Alpine Go
  • Medium 5.3
    CVE-2022-41717 Public exploit

    Excessive memory growth in net/http and golang.org/x/net/http2

    An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server connections contain a cache of HTTP header keys sent by the client. While the total number of entries in this cache is capped, an attacker sending very large…

    Go standard library golang.org/x/net net/http golang.org/x/net/http2 Debian Ubuntu Alpine Go
  • Unscored —
    CVE-2022-24675 Public exploit

    Stack overflow from a large amount of PEM data in encoding/pem

    encoding/pem in Go before 1.17.9 and 1.18.x before 1.18.1 has a Decode stack overflow via a large amount of PEM data.

    go stdlib golang-1.18 golang-1.17 Ubuntu Alpine Go
  • Unscored —
    CVE-2021-34558 Public exploit

    Panic on certain certificates in crypto/tls

    The crypto/tls package of Go through 1.16.5 does not properly assert that the type of public key in an X.509 certificate matches the expected type when doing a RSA based key exchange, allowing a malicious TLS server to cause a TLS client to panic.

    go stdlib golang-1.8 golang-1.13 Debian Ubuntu Alpine Go
  • High 8.1
    CVE-2020-0601 Exploited Public exploit EPSS 89%

    Certificate validation bypass on Windows in crypto/x509

    A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) certificates.An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious executable, making …

    Microsoft Windows 10 Version 1903 for x64-based Systems Windows Server, version 1903 (Server Core installation) Windows 10 Version 1903 for ARM64-based Systems Windows Alpine Go
    KEV Nov 3, 2021
  • Unscored —
    CVE-2019-17596 Public exploit

    Panic on invalid DSA public keys in crypto/dsa

    Go before 1.12.11 and 1.3.x before 1.13.2 can panic upon an attempt to process network traffic containing an invalid DSA public key. There are several attack scenarios, such as traffic from a client to a server that verifies client certificates.

    go stdlib golang-1.8 golang-1.13 Ubuntu Alpine Go
  • Medium 5.9
    CVE-2018-16875 Public exploit

    Denial of service in chain verification in crypto/x509

    The crypto/x509 package of Go before 1.10.6 and 1.11.x before 1.11.3 does not limit the amount of work performed for each chain verification, which might allow attackers to craft pathological inputs leading to a CPU denial of service. Go TLS servers accepting…

    [UNKNOWN] golang stdlib golang-1.8 Ubuntu Go
  • Unscored —
    CVE-2016-3959 Public exploit

    Denial of service due to unchecked parameters in crypto/dsa

    The Verify function in crypto/dsa/dsa.go in Go before 1.5.4 and 1.6.x before 1.6.1 does not properly check parameters passed to the big integer library, which might allow remote attackers to cause a denial of service (infinite loop) via a crafted public key t…

    stdlib Go