Golang Go vulnerabilities

CVE-2026-25679 [HIGH] CWE-425 CVE-2026-25679: url.Parse insufficiently validated the host/authority component and accepted some invalid URLs. url.Parse insufficiently validated the host/authority component and accepted some invalid URLs.

CVE-2025-61723 [HIGH] CWE-770 CVE-2025-61723: The processing time for parsing some invalid inputs scales non-linearly with respect to the size of The processing time for parsing some invalid inputs scales non-linearly with respect to the size of the input. This affects programs which parse untrusted PEM inputs.

CVE-2025-58187 [HIGH] CWE-407 CVE-2025-58187: Due to the design of the name constraint checking algorithm, the processing time of some inputs scal Due to the design of the name constraint checking algorithm, the processing time of some inputs scale non-linearly with respect to the size of the certificate. This affects programs which validate arbitrary certificate chains.

CVE-2020-16845 [HIGH] CWE-835 CVE-2020-16845: Go before 1.13.15 and 14.x before 1.14.7 can have an infinite read loop in ReadUvarint and ReadVarin Go before 1.13.15 and 14.x before 1.14.7 can have an infinite read loop in ReadUvarint and ReadVarint in encoding/binary via invalid inputs.

CVE-2021-41771 [HIGH] CWE-119 CVE-2021-41771: ImportedSymbols in debug/macho (for Open or OpenFat) in Go before 1.16.10 and 1.17.x before 1.17.3 A ImportedSymbols in debug/macho (for Open or OpenFat) in Go before 1.16.10 and 1.17.x before 1.17.3 Accesses a Memory Location After the End of a Buffer, aka an out-of-bounds slice situation.

CVE-2019-9634 [HIGH] CWE-427 CVE-2019-9634: Go through 1.12 on Windows misuses certain LoadLibrary functionality, leading to DLL injection. Go through 1.12 on Windows misuses certain LoadLibrary functionality, leading to DLL injection.

CVE-2021-44716 [HIGH] CWE-400 CVE-2021-44716: net/http in Go before 1.16.12 and 1.17.x before 1.17.5 allows uncontrolled memory consumption in the net/http in Go before 1.16.12 and 1.17.x before 1.17.5 allows uncontrolled memory consumption in the header canonicalization cache via HTTP/2 requests.

CVE-2020-28362 [HIGH] CWE-295 CVE-2020-28362: Go before 1.14.12 and 1.15.x before 1.15.4 allows Denial of Service. Go before 1.14.12 and 1.15.x before 1.15.4 allows Denial of Service.

CVE-2021-33198 [HIGH] CVE-2021-33198: In Go before 1.15.13 and 1.16.x before 1.16.5, there can be a panic for a large exponent to the math In Go before 1.15.13 and 1.16.x before 1.16.5, there can be a panic for a large exponent to the math/big.Rat SetString or UnmarshalText method.

CVE-2017-1000098 [HIGH] CWE-769 CVE-2017-1000098: The net/http package's Request.ParseMultipartForm method starts writing to temporary files once the The net/http package's Request.ParseMultipartForm method starts writing to temporary files once the request body size surpasses the given "maxMemory" limit. It was possible for an attacker to generate a multipart request crafted such that the server ran out of file descriptors.

CVE-2022-30634 [HIGH] CWE-835 CVE-2022-30634: Infinite loop in Read in crypto/rand before Go 1.17.11 and Go 1.18.3 on Windows allows attacker to c Infinite loop in Read in crypto/rand before Go 1.17.11 and Go 1.18.3 on Windows allows attacker to cause an indefinite hang by passing a buffer larger than 1 << 32 - 1 bytes.

CVE-2022-30633 [HIGH] CWE-674 CVE-2022-30633: Uncontrolled recursion in Unmarshal in encoding/xml before Go 1.17.12 and Go 1.18.4 allows an attack Uncontrolled recursion in Unmarshal in encoding/xml before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via unmarshalling an XML document into a Go struct which has a nested field that uses the 'any' field tag.

CVE-2023-45287 [HIGH] CWE-203 CVE-2023-45287: Before Go 1.20, the RSA based TLS key exchanges used the math/big library, which is not constant tim Before Go 1.20, the RSA based TLS key exchanges used the math/big library, which is not constant time. RSA blinding was applied to prevent timing attacks, but analysis shows this may not have been fully effective. In particular it appears as if the removal of PKCS#1 padding may leak timing information, which in turn could be used to recover session ke

CVE-2026-33814 [HIGH] CWE-835 CVE-2026-33814: When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATIO When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.

CVE-2026-42499 [HIGH] CWE-1046 CVE-2026-42499: Pathological inputs could cause DoS through consumePhrase when parsing an email address according to Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322.

CVE-2023-24539 [HIGH] CWE-74 CVE-2023-24539: Angle brackets (<>) are not considered dangerous characters when inserted into CSS contexts. Templat Angle brackets (<>) are not considered dangerous characters when inserted into CSS contexts. Templates containing multiple actions separated by a '/' character can result in unexpectedly closing the CSS context and allowing for injection of unexpected HTML, if executed with untrusted input.

CVE-2023-29400 [HIGH] CWE-74 CVE-2023-29400: Templates containing actions in unquoted HTML attributes (e.g. "attr=") executed with empty inp Templates containing actions in unquoted HTML attributes (e.g. "attr={{.}}") executed with empty input can result in output with unexpected results when parsed due to HTML normalization rules. This may allow injection of arbitrary attributes into tags.

CVE-2025-58188 [HIGH] CWE-295 CVE-2025-58188: Validating certificate chains which contain DSA public keys can cause programs to panic, due to a in Validating certificate chains which contain DSA public keys can cause programs to panic, due to a interface cast that assumes they implement the Equal method. This affects programs which validate arbitrary certificate chains.

CVE-2021-33196 [HIGH] CWE-20 CVE-2021-33196: In archive/zip in Go before 1.15.13 and 1.16.x before 1.16.5, a crafted file count (in an archive's In archive/zip in Go before 1.15.13 and 1.16.x before 1.16.5, a crafted file count (in an archive's header) can cause a NewReader or OpenReader panic.

CVE-2021-41772 [HIGH] CWE-20 CVE-2021-41772: Go before 1.16.10 and 1.17.x before 1.17.3 allows an archive/zip Reader.Open panic via a crafted ZIP Go before 1.16.10 and 1.17.x before 1.17.3 allows an archive/zip Reader.Open panic via a crafted ZIP archive containing an invalid name or an empty filename field.