Golang Go vulnerabilities

CVE-2024-24789 [MEDIUM] CVE-2024-24789: The archive/zip package's handling of certain types of invalid zip files differs from the behavior o The archive/zip package's handling of certain types of invalid zip files differs from the behavior of most zip implementations. This misalignment could be exploited to create an zip file with contents that vary depending on the implementation reading the file. The archive/zip package now rejects files containing these errors.

CVE-2022-1962 [MEDIUM] CWE-674 CVE-2022-1962: Uncontrolled recursion in the Parse functions in go/parser before Go 1.17.12 and Go 1.18.4 allow an Uncontrolled recursion in the Parse functions in go/parser before Go 1.17.12 and Go 1.18.4 allow an attacker to cause a panic due to stack exhaustion via deeply nested types or declarations.

CVE-2021-27919 [MEDIUM] CVE-2021-27919: archive/zip in Go 1.16.x before 1.16.1 allows attackers to cause a denial of service (panic) upon at archive/zip in Go 1.16.x before 1.16.1 allows attackers to cause a denial of service (panic) upon attempted use of the Reader.Open API for a ZIP archive in which ../ occurs at the beginning of any filename.

CVE-2026-32288 [MEDIUM] CWE-770 CVE-2026-32288: tar.Reader can allocate an unbounded amount of memory when reading a maliciously-crafted archive con tar.Reader can allocate an unbounded amount of memory when reading a maliciously-crafted archive containing a large number of sparse regions encoded in the "old GNU sparse map" format.

CVE-2014-7189 [MEDIUM] CWE-264 CVE-2014-7189: crpyto/tls in Go 1.1 before 1.3.2, when SessionTicketsDisabled is enabled, allows man-in-the-middle crpyto/tls in Go 1.1 before 1.3.2, when SessionTicketsDisabled is enabled, allows man-in-the-middle attackers to spoof clients via unspecified vectors.

CVE-2025-22873 [LOW] CWE-23 CVE-2025-22873: It was possible to improperly access the parent directory of an os.Root by opening a filename ending It was possible to improperly access the parent directory of an os.Root by opening a filename ending in "../". For example, Root.Open("../") would open the parent directory of the Root. This escape only permits opening the parent directory itself, not ancestors of the parent or files contained within the parent.

CVE-2026-27139 [LOW] CWE-22 CVE-2026-27139: On Unix platforms, when listing the contents of a directory using File.ReadDir or File.Readdir the r On Unix platforms, when listing the contents of a directory using File.ReadDir or File.Readdir the returned FileInfo could reference a file outside of the Root in which the File was opened. The impact of this escape is limited to reading metadata provided by lstat from arbitrary locations on the filesystem without permitting reading or writing files out

CVE-2022-30629 [LOW] CWE-330 CVE-2022-30629: Non-random values for ticket_age_add in session tickets in crypto/tls before Go 1.17.11 and Go 1.18. Non-random values for ticket_age_add in session tickets in crypto/tls before Go 1.17.11 and Go 1.18.3 allow an attacker that can observe TLS handshakes to correlate successive connections by comparing ticket ages during session resumption.