Golang Go vulnerabilities

CVE-2021-34558 [MEDIUM] CWE-295 CVE-2021-34558: The crypto/tls package of Go through 1.16.5 does not properly assert that the type of public key in The crypto/tls package of Go through 1.16.5 does not properly assert that the type of public key in an X.509 certificate matches the expected type when doing a RSA based key exchange, allowing a malicious TLS server to cause a TLS client to panic.

CVE-2016-3959 [HIGH] CWE-20 CVE-2016-3959: The Verify function in crypto/dsa/dsa.go in Go before 1.5.4 and 1.6.x before 1.6.1 does not properly The Verify function in crypto/dsa/dsa.go in Go before 1.5.4 and 1.6.x before 1.6.1 does not properly check parameters passed to the big integer library, which might allow remote attackers to cause a denial of service (infinite loop) via a crafted public key to a program that uses HTTPS client certificates or SSH server libraries.

CVE-2022-2879 [HIGH] CWE-770 CVE-2022-2879: Reader.Read does not set a limit on the maximum size of file headers. A maliciously crafted archive Reader.Read does not set a limit on the maximum size of file headers. A maliciously crafted archive could cause Read to allocate unbounded amounts of memory, potentially causing resource exhaustion or panics. After fix, Reader.Read limits the maximum size of header blocks to 1 MiB.

CVE-2023-29403 [HIGH] CWE-668 CVE-2023-29403: On Unix platforms, the Go runtime does not behave differently when a binary is run with the setuid/s On Unix platforms, the Go runtime does not behave differently when a binary is run with the setuid/setgid bits. This can be dangerous in certain cases, such as when dumping memory state, or assuming the status of standard i/o file descriptors. If a setuid/setgid binary is executed with standard I/O file descriptors closed, opening any files can result

CVE-2022-41716 [HIGH] CVE-2022-41716: Due to unsanitized NUL values, attackers may be able to maliciously set environment variables on Win Due to unsanitized NUL values, attackers may be able to maliciously set environment variables on Windows. In syscall.StartProcess and os/exec.Cmd, invalid environment variable values containing NUL values are not properly checked for. A malicious environment variable value can exploit this behavior to set a value for a different environment variable. For exam

CVE-2025-47907 [HIGH] CWE-362 CVE-2025-47907: Cancelling a query (e.g. by cancelling the context passed to one of the query methods) during a call Cancelling a query (e.g. by cancelling the context passed to one of the query methods) during a call to the Scan method of the returned Rows can result in unexpected results if other queries are being made in parallel. This can result in a race condition that may overwrite the expected results with those of another query, causing the call to Scan to r

CVE-2020-28851 [HIGH] CWE-129 CVE-2020-28851: In x/text in Go 1.15.4, an "index out of range" panic occurs in language.ParseAcceptLanguage while p In x/text in Go 1.15.4, an "index out of range" panic occurs in language.ParseAcceptLanguage while parsing the -u- extension. (x/text/language is supposed to be able to parse an HTTP Accept-Language header.)

CVE-2022-32189 [HIGH] CVE-2022-32189: A too-short encoded message can cause a panic in Float.GobDecode and Rat GobDecode in math/big in Go A too-short encoded message can cause a panic in Float.GobDecode and Rat GobDecode in math/big in Go before 1.17.13 and 1.18.5, potentially allowing a denial of service.

CVE-2023-24537 [HIGH] CWE-190 CVE-2023-24537: Calling any of the Parse functions on Go source code which contains //line directives with very larg Calling any of the Parse functions on Go source code which contains //line directives with very large line numbers can cause an infinite loop due to integer overflow.

CVE-2022-41715 [HIGH] CVE-2022-41715: Programs which compile regular expressions from untrusted sources may be vulnerable to memory exhaus Programs which compile regular expressions from untrusted sources may be vulnerable to memory exhaustion or denial of service. The parsed regexp representation is linear in the size of the input, but in some cases the constant factor can be as high as 40,000, making relatively small regexps consume much larger amounts of memory. After fix, each regexp being p

CVE-2023-39322 [HIGH] CWE-770 CVE-2023-39322: QUIC connections do not set an upper bound on the amount of data buffered when reading post-handshak QUIC connections do not set an upper bound on the amount of data buffered when reading post-handshake messages, allowing a malicious QUIC connection to cause unbounded memory growth. With fix, connections now consistently reject messages larger than 65KiB in size.

CVE-2022-41724 [HIGH] CWE-400 CVE-2022-41724: Large handshake records may cause panics in crypto/tls. Both clients and servers may send large TLS Large handshake records may cause panics in crypto/tls. Both clients and servers may send large TLS handshake records which cause servers and clients, respectively, to panic when attempting to construct responses. This affects all TLS 1.3 clients, TLS 1.2 clients which explicitly enable session resumption (by setting Config.ClientSessionCache to a non-

CVE-2022-27664 [HIGH] CVE-2022-27664: In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers can cause a denial of service be In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers can cause a denial of service because an HTTP/2 connection can hang during closing if shutdown were preempted by a fatal error.

CVE-2017-1000097 [HIGH] CWE-295 CVE-2017-1000097: On Darwin, user's trust preferences for root certificates were not honored. If the user had a root c On Darwin, user's trust preferences for root certificates were not honored. If the user had a root certificate loaded in their Keychain that was explicitly not trusted, a Go program would still verify a connection using that root certificate.

CVE-2023-39321 [HIGH] CWE-400 CVE-2023-39321: Processing an incomplete post-handshake message for a QUIC connection can cause a panic. Processing an incomplete post-handshake message for a QUIC connection can cause a panic.

CVE-2021-3114 [MEDIUM] CWE-682 CVE-2021-3114: In Go before 1.14.14 and 1.15.x before 1.15.7, crypto/elliptic/p224.go can generate incorrect output In Go before 1.14.14 and 1.15.x before 1.15.7, crypto/elliptic/p224.go can generate incorrect outputs, related to an underflow of the lowest limb during the final complete reduction in the P-224 field.

CVE-2020-29510 [MEDIUM] CWE-115 CVE-2020-29510: The encoding/xml package in Go versions 1.15 and earlier does not correctly preserve the semantics o The encoding/xml package in Go versions 1.15 and earlier does not correctly preserve the semantics of directives during tokenization round-trips, which allows an attacker to craft inputs that behave in conflicting ways during different stages of processing in affected downstream applications.

CVE-2016-3958 [HIGH] CWE-264 CVE-2016-3958: Untrusted search path vulnerability in Go before 1.5.4 and 1.6.x before 1.6.1 on Windows allows loca Untrusted search path vulnerability in Go before 1.5.4 and 1.6.x before 1.6.1 on Windows allows local users to gain privileges via a Trojan horse DLL in the current working directory, related to use of the LoadLibrary function.

CVE-2022-41717 [MEDIUM] CWE-770 CVE-2022-41717: An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 serve An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server connections contain a cache of HTTP header keys sent by the client. While the total number of entries in this cache is capped, an attacker sending very large keys can cause the server to allocate approximately 64 MiB per open connection.

CVE-2023-29406 [MEDIUM] CWE-436 CVE-2023-29406: The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Hos The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject additional headers or entire requests. With fix, the HTTP/1 client now refuses to send requests containing an invalid Request.Host or Request.URL.Host value.