Go standard library

46 results · Clear filters · Feed

• Medium 5.3
  CVE-2023-45284

  Incorrect detection of reserved device names on Windows in path/filepath

  On Windows, The IsLocal function does not correctly detect reserved device names in some cases. Reserved names followed by spaces, such as "COM1 ", and reserved names "COM" and "LPT" followed by superscript 1, 2, or 3, are incorrectly reported as local. With …

  Go standard library path/filepath golang stdlib Debian Ubuntu Azure Linux Go
  Nov 9, 2023
• Medium 5.3
  CVE-2022-41717 Public exploit

  Excessive memory growth in net/http and golang.org/x/net/http2

  An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server connections contain a cache of HTTP header keys sent by the client. While the total number of entries in this cache is capped, an attacker sending very large…

  Go standard library golang.org/x/net net/http golang.org/x/net/http2 Debian Ubuntu Azure Linux Alpine Wolfi Go
  Dec 8, 2022
• Medium 6.3
  CVE-2022-41716

  Unsanitized NUL in environment variables on Windows in syscall and os/exec

  Due to unsanitized NUL values, attackers may be able to maliciously set environment variables on Windows. In syscall.StartProcess and os/exec.Cmd, invalid environment variable values containing NUL values are not properly checked for. A malicious environment …

  Go standard library os/exec syscall katib-suggestion-hyperopt Debian Ubuntu Azure Linux Wolfi Go
  Nov 2, 2022
• Medium 6.5
  CVE-2022-32148

  Exposure of client IP addresses in net/http

  Improper exposure of client IP addresses in net/http before Go 1.17.12 and Go 1.18.4 can be triggered by calling httputil.ReverseProxy.ServeHTTP with a Request.Header map containing a nil value for the X-Forwarded-For header, which causes ReverseProxy to set …

  Go standard library net/http golang go Debian Ubuntu Azure Linux Alpine Go
  Aug 9, 2022
• Medium 5.5
  CVE-2022-1962

  Stack exhaustion due to deeply nested types in go/parser

  Uncontrolled recursion in the Parse functions in go/parser before Go 1.17.12 and Go 1.18.4 allow an attacker to cause a panic due to stack exhaustion via deeply nested types or declarations.

  Go standard library go/parser golang go Debian Ubuntu Azure Linux Alpine Go
  Aug 9, 2022
• Medium 6.5
  CVE-2022-1705

  Improper sanitization of Transfer-Encoding headers in net/http

  Acceptance of some invalid Transfer-Encoding headers in the HTTP/1 client in net/http before Go 1.17.12 and Go 1.18.4 allows HTTP request smuggling if combined with an intermediate server that also improperly fails to reject the header as invalid.

  Go standard library net/http golang go Debian Ubuntu Azure Linux Alpine Go
  Aug 9, 2022