Golang Go vulnerabilities

CVE-2025-47912 [MEDIUM] CVE-2025-47912: The Parse function permits values other than IPv6 addresses to be included in square brackets within The Parse function permits values other than IPv6 addresses to be included in square brackets within the host component of a URL. RFC 3986 permits IPv6 addresses to be included within the host component, enclosed within square brackets. For example: "http://[::1]/". IPv4 addresses and hostnames must not appear within square brackets. Parse did not enforce t

CVE-2026-39819 [MEDIUM] CWE-59 CVE-2026-39819: The "go bug" command writes to two files with predictable names in the system temporary directory (f The "go bug" command writes to two files with predictable names in the system temporary directory (for example, "/tmp"). An attacker with access to the temporary directory can create a symlink in one of these names, causing "go bug" to overwrite the target of the symlink.

CVE-2021-31525 [MEDIUM] CWE-674 CVE-2021-31525: net/http in Go before 1.15.12 and 1.16.x before 1.16.4 allows remote attackers to cause a denial of net/http in Go before 1.15.12 and 1.16.x before 1.16.4 allows remote attackers to cause a denial of service (panic) via a large header to ReadRequest or ReadResponse. Server, Transport, and Client can each be affected in some configurations.

CVE-2017-15042 [MEDIUM] CWE-319 CVE-2017-15042: An unintended cleartext issue exists in Go before 1.8.4 and 1.9.x before 1.9.1. RFC 4954 requires th An unintended cleartext issue exists in Go before 1.8.4 and 1.9.x before 1.9.1. RFC 4954 requires that, during SMTP, the PLAIN auth scheme must only be used on network connections secured with TLS. The original implementation of smtp.PlainAuth in Go 1.0 enforced this requirement, and it was documented to do so. In 2013, upstream issue #5184, this wa

CVE-2026-32289 [MEDIUM] CWE-79 CVE-2026-32289: Context was not properly tracked across template branches for JS template literals, leading to possi Context was not properly tracked across template branches for JS template literals, leading to possibly incorrect escaping of content when branches were used. Additionally template actions within JS template literals did not properly track the brace depth, leading to incorrect escaping being applied. These issues could cause actions within JS templat

CVE-2026-27138 [MEDIUM] CWE-295 CVE-2026-27138: Certificate verification can panic when a certificate in the chain has an empty DNS name and another Certificate verification can panic when a certificate in the chain has an empty DNS name and another certificate in the chain has excluded name constraints. This can crash programs that are either directly verifying X.509 certificate chains, or those that use TLS.

CVE-2023-39326 [MEDIUM] CVE-2023-39326: A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or respo A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network than are in the body. A malicious HTTP client can further exploit this to cause a server to automatically read a large amount of data (up to about 1GiB) when a handler fails to read the entire body of a reques

CVE-2025-61730 [MEDIUM] CVE-2025-61730: During the TLS 1.3 handshake if multiple messages are sent in records that span encryption level bou During the TLS 1.3 handshake if multiple messages are sent in records that span encryption level boundaries (for instance the Client Hello and Encrypted Extensions messages), the subsequent messages may be processed before the encryption level changes. This can cause some minor information disclosure if a network-local attacker can inject messages during th

CVE-2026-27142 [MEDIUM] CWE-79 CVE-2026-27142: Actions which insert URLs into the content attribute of HTML meta tags are not escaped. This can all Actions which insert URLs into the content attribute of HTML meta tags are not escaped. This can allow XSS if the meta tag also has an http-equiv attribute with the value "refresh". A new GODEBUG setting has been added, htmlmetacontenturlescape, which can be used to disable escaping URLs in actions in the meta content attribute which follow "url=" by

CVE-2020-14039 [MEDIUM] CWE-295 CVE-2020-14039: In Go before 1.13.13 and 1.14.x before 1.14.5, Certificate.Verify may lack a check on the VerifyOpti In Go before 1.13.13 and 1.14.x before 1.14.5, Certificate.Verify may lack a check on the VerifyOptions.KeyUsages EKU requirements (if VerifyOptions.Roots equals nil and the installation is on Windows). Thus, X.509 certificate verification is incomplete.

CVE-2023-29409 [MEDIUM] CWE-400 CVE-2023-29409: Extremely large RSA keys in certificate chains can cause a client/server to expend significant CPU t Extremely large RSA keys in certificate chains can cause a client/server to expend significant CPU time verifying signatures. With fix, the size of RSA keys transmitted during handshakes is restricted to <= 8192 bits. Based on a survey of publicly trusted RSA keys, there are currently only three certificates in circulation with keys larger than this

CVE-2021-44717 [MEDIUM] CWE-404 CVE-2021-44717: Go before 1.16.12 and 1.17.x before 1.17.5 on UNIX allows write operations to an unintended file or Go before 1.16.12 and 1.17.x before 1.17.5 on UNIX allows write operations to an unintended file or unintended network connection as a consequence of erroneous closing of file descriptor 0 after file-descriptor exhaustion.

CVE-2025-61724 [MEDIUM] CWE-770 CVE-2025-61724: The Reader.ReadResponse function constructs a response string through repeated string concatenation The Reader.ReadResponse function constructs a response string through repeated string concatenation of lines. When the number of lines in a response is large, this can cause excessive CPU consumption.

CVE-2026-39823 [MEDIUM] CVE-2026-39823: CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a <meta> tag CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a tag's attribute. If the URL content were to insert ASCII whitespaces around the '=' rune inside of the attribute, the escaper would fail to similarly escape it, leading to XSS.

CVE-2025-58189 [MEDIUM] CWE-532 CVE-2025-58189: When Conn.Handshake fails during ALPN negotiation the error contains attacker controlled information When Conn.Handshake fails during ALPN negotiation the error contains attacker controlled information (the ALPN protocols sent by the client) which is not escaped.

CVE-2023-24532 [MEDIUM] CWE-682 CVE-2023-24532: The ScalarMult and ScalarBaseMult methods of the P256 Curve may return an incorrect result if called The ScalarMult and ScalarBaseMult methods of the P256 Curve may return an incorrect result if called with some specific unreduced scalars (a scalar larger than the order of the curve). This does not impact usages of crypto/ecdsa or crypto/ecdh.

CVE-2023-39318 [MEDIUM] CWE-79 CVE-2023-39318: The html/template package does not properly handle HTML-like "" comment tokens, nor hashbang "#!" co The html/template package does not properly handle HTML-like "" comment tokens, nor hashbang "#!" comment tokens, in contexts. This may cause the template parser to improperly interpret the contents of contexts, causing actions to be improperly escaped. This may be leveraged to perform an XSS attack.

CVE-2023-39319 [MEDIUM] CWE-79 CVE-2023-39319: The html/template package does not apply the proper rules for handling occurrences of "<script", "<! The html/template package does not apply the proper rules for handling occurrences of " contexts. This may cause the template parser to improperly consider script contexts to be terminated early, causing actions to be improperly escaped. This could be leveraged to perform an XSS attack.

CVE-2023-45284 [MEDIUM] CVE-2023-45284: On Windows, The IsLocal function does not correctly detect reserved device names in some cases. Rese On Windows, The IsLocal function does not correctly detect reserved device names in some cases. Reserved names followed by spaces, such as "COM1 ", and reserved names "COM" and "LPT" followed by superscript 1, 2, or 3, are incorrectly reported as local. With fix, IsLocal now correctly reports these names as non-local.

CVE-2025-0913 [MEDIUM] CWE-59 CVE-2025-0913: os.OpenFile(path, os.O_CREATE|O_EXCL) behaved differently on Unix and Windows systems when the targe os.OpenFile(path, os.O_CREATE|O_EXCL) behaved differently on Unix and Windows systems when the target path was a dangling symlink. On Unix systems, OpenFile with O_CREATE and O_EXCL flags never follows symlinks. On Windows, when the target path was a symlink to a nonexistent location, OpenFile would create a file in that location. OpenFile now always r