Skip to content
OpenAdvisories

Package · Go

stdlib

182 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

49 results · Clear filters · Feed

  • Medium 5.3
    CVE-2023-45284

    Incorrect detection of reserved device names on Windows in path/filepath

    On Windows, The IsLocal function does not correctly detect reserved device names in some cases. Reserved names followed by spaces, such as "COM1 ", and reserved names "COM" and "LPT" followed by superscript 1, 2, or 3, are incorrectly reported as local. With …

    Go standard library path/filepath stdlib golang-1.8 Debian Ubuntu Go
  • Medium 5.3
    CVE-2022-41717 Public exploit

    Excessive memory growth in net/http and golang.org/x/net/http2

    An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server connections contain a cache of HTTP header keys sent by the client. While the total number of entries in this cache is capped, an attacker sending very large…

    Go standard library golang.org/x/net net/http golang.org/x/net/http2 Debian Ubuntu Alpine Go
  • Medium 6.3
    CVE-2022-41716

    Unsanitized NUL in environment variables on Windows in syscall and os/exec

    Due to unsanitized NUL values, attackers may be able to maliciously set environment variables on Windows. In syscall.StartProcess and os/exec.Cmd, invalid environment variable values containing NUL values are not properly checked for. A malicious environment …

    Go standard library os/exec syscall stdlib Debian Ubuntu Go
  • Medium 6.5
    CVE-2022-32148

    Exposure of client IP addresses in net/http

    Improper exposure of client IP addresses in net/http before Go 1.17.12 and Go 1.18.4 can be triggered by calling httputil.ReverseProxy.ServeHTTP with a Request.Header map containing a nil value for the X-Forwarded-For header, which causes ReverseProxy to set …

    Go standard library net/http go stdlib Debian Ubuntu Alpine Go
  • Medium 5.5
    CVE-2022-1962

    Stack exhaustion due to deeply nested types in go/parser

    Uncontrolled recursion in the Parse functions in go/parser before Go 1.17.12 and Go 1.18.4 allow an attacker to cause a panic due to stack exhaustion via deeply nested types or declarations.

    Go standard library go/parser go stdlib Debian Ubuntu Alpine Go
  • Medium 6.5
    CVE-2022-1705

    Improper sanitization of Transfer-Encoding headers in net/http

    Acceptance of some invalid Transfer-Encoding headers in the HTTP/1 client in net/http before Go 1.17.12 and Go 1.18.4 allows HTTP request smuggling if combined with an intermediate server that also improperly fails to reject the header as invalid.

    Go standard library net/http go stdlib Debian Ubuntu Alpine Go
  • Medium 5.3
    CVE-2022-29526

    golang.org/x/sys/unix has Incorrect privilege reporting in syscall

    Go before 1.17.10 and 1.18.x before 1.18.2 has Incorrect Privilege Assignment. When called with a non-zero flags parameter, the Faccessat function could incorrectly report that a file is accessible.

    stdlib golang-1.8 golang-1.10 golang-1.16 Debian Ubuntu Alpine Go
  • Medium 5.9
    CVE-2021-31525

    golang.org/x/net/http/httpguts vulnerable to Uncontrolled Recursion

    net/http in Go before 1.15.12 and 1.16.x before 1.16.4 allows remote attackers to cause a denial of service (panic) via a large header to ReadRequest or ReadResponse. Server, Transport, and Client can each be affected in some configurations.

    go stdlib golang-1.16 golang.org/x/net Debian Ubuntu Alpine Go
  • Medium 5.9
    CVE-2018-16875 Public exploit

    Denial of service in chain verification in crypto/x509

    The crypto/x509 package of Go before 1.10.6 and 1.11.x before 1.11.3 does not limit the amount of work performed for each chain verification, which might allow attackers to craft pathological inputs leading to a CPU denial of service. Go TLS servers accepting…

    [UNKNOWN] golang stdlib golang-1.8 Ubuntu Go