Go

Latest CVEs · RSS

• CVE-2026-97032 2026-10-08
  HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder f
• CVE-2026-94439 2026-10-08
  When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to r
• CVE-2026-78663 2026-10-08
  The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread p
• CVE-2026-78669 2026-10-08
  A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS fr
• CVE-2026-78660 2026-10-08
  Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. Howeve
• CVE-2026-78667 2026-10-08
  When parsing a Range header containing a large number of small ranges, FileServer(FS), ServeContent, and ServeFile(FS) can consume an excessive amount of CPU.
• CVE-2026-94440 2026-10-08
  Parsing a multipart form can bypass memory limits and read an arbitrarily long line into memory when the remaining limit at the start of a part is less than 400
• CVE-2026-97031 2026-10-08
  Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted packet that could trigger memory exhaus
• CVE-2026-56866 2026-10-08
  When http.Transport sends an HTTP/1 CONNECT request with a non-empty Request.Body, it writes the body directly to the connection without framing after the reque
• CVE-2026-56857 2026-10-08
  On Windows, when the target of Root.Mkdir or Root.MkdirAll is a junction pointing to an empty location, the operation can create a directory at the junction tar
• CVE-2026-78659 2026-10-08
  When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler.
• CVE-2026-94447 2026-10-08
  Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/toolchain go.sum entry and operates a malicious GOMODPROXY the use
• CVE-2026-94444 2026-10-08
  Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/fips140 and operates a malicious GOMODPROXY the user chooses to co
• CVE-2026-97030 2026-10-08
  A trusted template author may have previously written a valid template wherein the use of the 'yield' keyword would not be correctly escaped. We now ensure that
• CVE-2026-94448 2026-10-08
  When a JavaScript template literal contains consecutive expressions, the context tracking state was not properly reset upon entering a new expression. We now en
• CVE-2026-56851 2026-10-07
  The Nickname profile can panic with an out-of-bounds slice error when transforming crafted input into a short destination buffer.
• CVE-2026-94445 2026-09-25
  A malicious txtar could escape the intended execution context and force arbitrary writes to the playground host's trusted filesystem. Disjointly, one of the
• CVE-2026-56855 2026-09-02
  Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC
• CVE-2026-78662 2026-09-02
  Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, de
• CVE-2026-56854 2026-08-28
  The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCa
• CVE-2026-46603 2026-08-14
  VP8L decoding in golang.org/x/image/vp8l can allocate an excessive amount of memory when processing a crafted VP8L image containing many unused Huffman tree gro
• CVE-2026-56860 2026-08-13
  Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer rewrites on each step, resulting in qua
• CVE-2026-56864 2026-08-13
  A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and
• CVE-2026-56865 2026-08-13
  A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-c
• CVE-2026-56858 2026-08-13
  Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS.