Golang Go vulnerabilities

CVE-2025-61729 [HIGH] CWE-295 CVE-2025-61729: Within HostnameError.Error(), when constructing an error string, there is no limit to the number of Within HostnameError.Error(), when constructing an error string, there is no limit to the number of hosts that will be printed out. Furthermore, the error string is constructed by repeated string concatenation, leading to quadratic runtime. Therefore, a certificate provided by a malicious actor can result in excessive resource consumption.

CVE-2026-32281 [HIGH] CWE-295 CVE-2026-32281: Validating certificate chains which use policies is unexpectedly inefficient when certificates in th Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service. This only affects validation of otherwise trusted certificate chains, issued by a root CA in the VerifyOptions.Roots CertPool, or in the system certificate pool.

CVE-2021-34558 [MEDIUM] CWE-295 CVE-2021-34558: The crypto/tls package of Go through 1.16.5 does not properly assert that the type of public key in The crypto/tls package of Go through 1.16.5 does not properly assert that the type of public key in an X.509 certificate matches the expected type when doing a RSA based key exchange, allowing a malicious TLS server to cause a TLS client to panic.

CVE-2016-3959 [HIGH] CWE-20 CVE-2016-3959: The Verify function in crypto/dsa/dsa.go in Go before 1.5.4 and 1.6.x before 1.6.1 does not properly The Verify function in crypto/dsa/dsa.go in Go before 1.5.4 and 1.6.x before 1.6.1 does not properly check parameters passed to the big integer library, which might allow remote attackers to cause a denial of service (infinite loop) via a crafted public key to a program that uses HTTPS client certificates or SSH server libraries.

CVE-2022-2879 [HIGH] CWE-770 CVE-2022-2879: Reader.Read does not set a limit on the maximum size of file headers. A maliciously crafted archive Reader.Read does not set a limit on the maximum size of file headers. A maliciously crafted archive could cause Read to allocate unbounded amounts of memory, potentially causing resource exhaustion or panics. After fix, Reader.Read limits the maximum size of header blocks to 1 MiB.

CVE-2023-39322 [HIGH] CWE-770 CVE-2023-39322: QUIC connections do not set an upper bound on the amount of data buffered when reading post-handshak QUIC connections do not set an upper bound on the amount of data buffered when reading post-handshake messages, allowing a malicious QUIC connection to cause unbounded memory growth. With fix, connections now consistently reject messages larger than 65KiB in size.

CVE-2022-41716 [HIGH] CVE-2022-41716: Due to unsanitized NUL values, attackers may be able to maliciously set environment variables on Win Due to unsanitized NUL values, attackers may be able to maliciously set environment variables on Windows. In syscall.StartProcess and os/exec.Cmd, invalid environment variable values containing NUL values are not properly checked for. A malicious environment variable value can exploit this behavior to set a value for a different environment variable. For exam

CVE-2022-27664 [HIGH] CVE-2022-27664: In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers can cause a denial of service be In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers can cause a denial of service because an HTTP/2 connection can hang during closing if shutdown were preempted by a fatal error.

CVE-2022-32189 [HIGH] CVE-2022-32189: A too-short encoded message can cause a panic in Float.GobDecode and Rat GobDecode in math/big in Go A too-short encoded message can cause a panic in Float.GobDecode and Rat GobDecode in math/big in Go before 1.17.13 and 1.18.5, potentially allowing a denial of service.

CVE-2022-41715 [HIGH] CVE-2022-41715: Programs which compile regular expressions from untrusted sources may be vulnerable to memory exhaus Programs which compile regular expressions from untrusted sources may be vulnerable to memory exhaustion or denial of service. The parsed regexp representation is linear in the size of the input, but in some cases the constant factor can be as high as 40,000, making relatively small regexps consume much larger amounts of memory. After fix, each regexp being p

CVE-2023-24537 [HIGH] CWE-190 CVE-2023-24537: Calling any of the Parse functions on Go source code which contains //line directives with very larg Calling any of the Parse functions on Go source code which contains //line directives with very large line numbers can cause an infinite loop due to integer overflow.

CVE-2023-39321 [HIGH] CWE-400 CVE-2023-39321: Processing an incomplete post-handshake message for a QUIC connection can cause a panic. Processing an incomplete post-handshake message for a QUIC connection can cause a panic.

CVE-2023-29403 [HIGH] CWE-668 CVE-2023-29403: On Unix platforms, the Go runtime does not behave differently when a binary is run with the setuid/s On Unix platforms, the Go runtime does not behave differently when a binary is run with the setuid/setgid bits. This can be dangerous in certain cases, such as when dumping memory state, or assuming the status of standard i/o file descriptors. If a setuid/setgid binary is executed with standard I/O file descriptors closed, opening any files can result

CVE-2022-41724 [HIGH] CWE-400 CVE-2022-41724: Large handshake records may cause panics in crypto/tls. Both clients and servers may send large TLS Large handshake records may cause panics in crypto/tls. Both clients and servers may send large TLS handshake records which cause servers and clients, respectively, to panic when attempting to construct responses. This affects all TLS 1.3 clients, TLS 1.2 clients which explicitly enable session resumption (by setting Config.ClientSessionCache to a non-

CVE-2025-47907 [HIGH] CWE-362 CVE-2025-47907: Cancelling a query (e.g. by cancelling the context passed to one of the query methods) during a call Cancelling a query (e.g. by cancelling the context passed to one of the query methods) during a call to the Scan method of the returned Rows can result in unexpected results if other queries are being made in parallel. This can result in a race condition that may overwrite the expected results with those of another query, causing the call to Scan to r

CVE-2020-28851 [HIGH] CWE-129 CVE-2020-28851: In x/text in Go 1.15.4, an "index out of range" panic occurs in language.ParseAcceptLanguage while p In x/text in Go 1.15.4, an "index out of range" panic occurs in language.ParseAcceptLanguage while parsing the -u- extension. (x/text/language is supposed to be able to parse an HTTP Accept-Language header.)

CVE-2017-1000097 [HIGH] CWE-295 CVE-2017-1000097: On Darwin, user's trust preferences for root certificates were not honored. If the user had a root c On Darwin, user's trust preferences for root certificates were not honored. If the user had a root certificate loaded in their Keychain that was explicitly not trusted, a Go program would still verify a connection using that root certificate.

CVE-2021-3114 [MEDIUM] CWE-682 CVE-2021-3114: In Go before 1.14.14 and 1.15.x before 1.15.7, crypto/elliptic/p224.go can generate incorrect output In Go before 1.14.14 and 1.15.x before 1.15.7, crypto/elliptic/p224.go can generate incorrect outputs, related to an underflow of the lowest limb during the final complete reduction in the P-224 field.

CVE-2022-1705 [MEDIUM] CWE-444 CVE-2022-1705: Acceptance of some invalid Transfer-Encoding headers in the HTTP/1 client in net/http before Go 1.17 Acceptance of some invalid Transfer-Encoding headers in the HTTP/1 client in net/http before Go 1.17.12 and Go 1.18.4 allows HTTP request smuggling if combined with an intermediate server that also improperly fails to reject the header as invalid.

CVE-2022-32148 [MEDIUM] CVE-2022-32148: Improper exposure of client IP addresses in net/http before Go 1.17.12 and Go 1.18.4 can be triggere Improper exposure of client IP addresses in net/http before Go 1.17.12 and Go 1.18.4 can be triggered by calling httputil.ReverseProxy.ServeHTTP with a Request.Header map containing a nil value for the X-Forwarded-For header, which causes ReverseProxy to set the client IP as the value of the X-Forwarded-For header.