Go/stdlib

Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net

Modified: 10/16/2026

Inefficient policy validation in crypto/x509

Modified: 10/3/2026

Unexpected work during chain building in crypto/x509

Modified: 10/3/2026

Root escape via symlink plus trailing slash in os

Modified: 9/16/2026

Panic in Dial and LookupPort when handling NUL byte on Windows in net

Modified: 8/26/2026

ReverseProxy forwards queries with more than urlmaxqueryparams parameters in net/http/httputil

Modified: 8/31/2026

Quadratic string concatenation in consumePhrase in net/mail

Modified: 10/7/2026

Escaper bypass leads to XSS in html/template

Modified: 8/31/2026

Crash when handling long CNAME response in net

Modified: 9/29/2026

Bypass of meta content URL escaping causes XSS in html/template

Modified: 8/31/2026

Quadratic string concatentation in consumeComment in net/mail

Modified: 10/7/2026

Panic when opening archives in archive/zip

Modified: 5/20/2024

Panic during division of very large numbers in math/big

Modified: 5/20/2024

Unbounded read from invalid inputs in encoding/binary

Modified: 5/20/2024

Man-in-the-middle attack with SessionTicketsDisabled in crypto/tls

Modified: 6/3/2024

Request smuggling due to improper header parsing in net/http

Modified: 5/20/2024

Incorrect calculation affecting RSA computations in math/big

Modified: 5/20/2024

Privilege escalation on Windows via malicious DLL in syscall

Modified: 5/20/2024

Denial of service when parsing large forms in mime/multipart

Modified: 5/20/2024

Cleartext transmission of credentials in net/smtp

Modified: 5/20/2024

Certificate verification error on Windows in crypto/x509

Modified: 5/20/2024

Data race and crash in net/http

Modified: 5/20/2024

Cross-site scripting in net/http/cgi and net/http/fcgi

Modified: 5/20/2024

Infinite loop when decoding inputs in encoding/xml

Modified: 5/20/2024

Incorrect operations on the P-224 curve in crypto/elliptic

Modified: 5/20/2024

Improper sanitization when resolving values from DNS in net

Modified: 5/20/2024

Panic when reading certain archives in archive/zip

Modified: 5/20/2024

Attacker can drop certain headers in net/http/httputil

Modified: 5/20/2024

Panic on inputs with large exponents in math/big

Modified: 5/20/2024

Panic on certain certificates in crypto/tls

Modified: 5/20/2024

Panic in ReverseProxy in net/http/httputil

Modified: 5/20/2024

Panic on invalid symbol tables in debug/macho

Modified: 5/20/2024

Panic when opening certain archives in archive/zip

Modified: 5/20/2024

Uncontrolled memory consumption in math/big

Modified: 5/20/2024

Incorrect computation for some invalid field elements in crypto/elliptic

Modified: 5/20/2024

Stack exhaustion when compiling deeply nested expressions in regexp

Modified: 5/20/2024

Denial of service due to unchecked parameters in crypto/dsa

Modified: 5/20/2024

Mishandled trust preferences for root certificates on Darwin in crypto/x509

Modified: 6/3/2024

Incorrect computation for P-256 curves in crypto/elliptic

Modified: 5/20/2024

Denial of service in chain verification in crypto/x509

Modified: 5/20/2024

Incorrect parsing validation in net/url

Modified: 5/20/2024

Request smuggling due to accepting invalid headers in net/http via net/textproto

Modified: 5/20/2024

Panic on invalid DSA public keys in crypto/dsa

Modified: 5/20/2024

Denial of service affecting P-521 and P-384 curves in crypto/elliptic

Modified: 5/20/2024

DLL injection on Windows in runtime and syscall

Modified: 5/20/2024

Panic in certificate parsing in crypto/x509 and golang.org/x/crypto/cryptobyte

Modified: 2/4/2026

Panic due to large headers in net/http and golang.org/x/net/http/httpguts

Modified: 2/4/2026

Panic due to crafted inputs in archive/zip

Modified: 5/20/2024

Unbounded memory growth in net/http and golang.org/x/net/http2

Modified: 5/20/2024

Misdirected I/O in syscall

Modified: 5/20/2024

Stack overflow from a large amount of PEM data in encoding/pem

Modified: 5/20/2024

Panic during certificate parsing on Darwin in crypto/x509

Modified: 5/20/2024

Panic due to large inputs affecting P-256 curves in crypto/elliptic

Modified: 5/20/2024

Indefinite hang with large buffers on Windows in crypto/rand

Modified: 5/20/2024

Incorrect privilege reporting in syscall and golang.org/x/sys/unix

Modified: 2/4/2026

Stack exhaustion due to deeply nested types in go/parser

Modified: 5/20/2024

Exposure of client IP addresses in net/http

Modified: 5/20/2024

Stack exhaustion from deeply nested XML documents in encoding/xml

Modified: 5/20/2024

Stack exhaustion on crafted paths in path/filepath

Modified: 5/20/2024

Stack exhaustion when unmarshaling certain documents in encoding/xml

Modified: 5/20/2024

Stack exhaustion when reading certain archives in compress/gzip

Modified: 5/20/2024

Improper sanitization of Transfer-Encoding headers in net/http

Modified: 5/20/2024

Stack exhaustion when decoding certain messages in encoding/gob

Modified: 5/20/2024

Stack exhaustion in Glob on certain paths in io/fs

Modified: 5/20/2024

Session tickets lack random ticket_age_add in crypto/tls

Modified: 5/20/2024

Empty Cmd.Path can trigger unintended binary in os/exec on Windows

Modified: 5/20/2024

Path traversal via Clean on Windows in path/filepath

Modified: 5/20/2024

Certificate validation bypass on Windows in crypto/x509

Modified: 5/20/2024

Reset flood in net/http and golang.org/x/net/http

Modified: 2/4/2026

Panic when decoding Float and Rat types in math/big

Modified: 5/20/2024

Improper input validation in net/http and net/http/cgi

Modified: 5/20/2024

Denial of service in net/http and golang.org/x/net/http2

Modified: 2/4/2026

Failure to strip relative path components in net/url

Modified: 7/15/2026

Unbounded memory consumption when reading headers in archive/tar

Modified: 7/15/2026

Incorrect sanitization of forwarded query parameters in net/http/httputil

Modified: 7/15/2026

Memory exhaustion when compiling regular expressions in regexp/syntax

Modified: 7/15/2026

Unsanitized NUL in environment variables on Windows in syscall and os/exec

Modified: 2/4/2026

Restricted file access on Windows in os and net/http

Modified: 2/4/2026

Excessive memory growth in net/http and golang.org/x/net/http2

Modified: 2/4/2026

Path traversal on Windows in path/filepath

Modified: 2/4/2026

Excessive resource consumption in mime/multipart

Modified: 2/4/2026

Panic on large handshake records in crypto/tls

Modified: 2/4/2026

Denial of service via crafted HTTP/2 stream in net/http and golang.org/x/net

Modified: 2/4/2026

Incorrect calculation on P256 curves in crypto/internal/nistec

Modified: 2/4/2026

Infinite loop in parsing in go/scanner

Modified: 2/4/2026

Backticks not treated as string delimiters in html/template

Modified: 2/4/2026

Excessive memory allocation in net/http and net/textproto

Modified: 2/4/2026

Excessive resource consumption in net/http, net/textproto and mime/multipart

Modified: 2/4/2026

Improper sanitization of CSS values in html/template

Modified: 2/4/2026

Improper handling of JavaScript whitespace in html/template

Modified: 2/4/2026

Improper handling of empty HTML attributes in html/template

Modified: 2/4/2026

Unsafe behavior in setuid/setgid binaries in runtime

Modified: 2/4/2026

Insufficient sanitization of Host header in net/http

Modified: 2/4/2026

Large RSA keys can cause high CPU usage in crypto/tls

Modified: 2/4/2026

Improper handling of HTML-like comments in script contexts in html/template

Modified: 2/4/2026

Improper handling of special tags within script contexts in html/template

Modified: 2/4/2026

Panic when processing post-handshake message on QUIC connections in crypto/tls

Modified: 2/4/2026

Memory exhaustion in QUIC connection handling in crypto/tls

Modified: 2/4/2026

HTTP/2 rapid reset can cause excessive work in net/http

Modified: 9/28/2026

Insecure parsing of Windows paths with a \??\ prefix in path/filepath

Modified: 2/4/2026

Incorrect detection of reserved device names on Windows in path/filepath

Modified: 2/4/2026

Before Go 1.20, the RSA based key exchange methods in crypto/tls may exhibit a timing side channel

Modified: 2/4/2026

Denial of service via chunk extensions in net/http

Modified: 2/4/2026

Verify panics on certificates with an unknown public key algorithm in crypto/x509

Modified: 2/4/2026

Memory exhaustion in multipart form parsing in net/textproto and net/http

Modified: 2/4/2026

Incorrect forwarding of sensitive headers and cookies on HTTP redirect in net/http

Modified: 2/4/2026

Comments in display names are incorrectly handled in net/mail

Modified: 2/4/2026

Errors returned from JSON marshaling may break template escaping in html/template

Modified: 2/4/2026

HTTP/2 CONTINUATION flood in net/http

Modified: 2/4/2026

Malformed DNS message can cause infinite loop in net

Modified: 2/4/2026

Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses in net/netip

Modified: 3/23/2026

Mishandling of corrupt central directory record in archive/zip

Modified: 3/23/2026

Denial of service due to improper 100-continue handling in net/http

Modified: 2/4/2026

Stack exhaustion in all Parse functions in go/parser

Modified: 2/24/2026

Stack exhaustion in Decoder.Decode in encoding/gob

Modified: 2/24/2026

Stack exhaustion in Parse in go/build/constraint

Modified: 8/5/2026

Usage of IPv6 zone IDs can bypass URI name constraints in crypto/x509

Modified: 2/17/2026

Sensitive headers incorrectly sent after cross-domain redirect in net/http

Modified: 2/17/2026

ParsePKCS1PrivateKey panic with partial keys in crypto/x509

Modified: 1/30/2025

Timing sidechannel for P-256 on ppc64le in crypto/internal/nistec

Modified: 9/29/2026

HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net

Modified: 4/16/2026

Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna

Modified: 10/16/2026

Request smuggling due to acceptance of invalid chunked data in net/http

Modified: 2/17/2026

Usage of ExtKeyUsageAny disables policy validation in crypto/x509

Modified: 8/27/2026

Inconsistent handling of O_CREATE|O_EXCL on Unix and Windows in os in syscall

Modified: 2/4/2026

Sensitive headers not cleared on cross-origin redirect in net/http

Modified: 10/14/2026

Inefficient candidate hostname parsing in crypto/x509

Modified: 10/2/2026

Incorrect results returned from Rows.Scan in database/sql

Modified: 5/30/2026

Quadratic complexity in WordDecoder.DecodeHeader in mime

Modified: 10/20/2026

Arbitrary inputs are included in errors without any escaping in net/textproto

Modified: 10/3/2026

CrossOriginProtection insecure bypass patterns not limited to exact matches in net/http

Modified: 5/15/2026

Unexpected paths returned from LookPath in os/exec

Modified: 10/14/2026

Excessive CPU consumption in ParseAddress in net/mail

Modified: 5/15/2026

Quadratic complexity when checking name constraints in crypto/x509

Modified: 5/15/2026

ALPN negotiation error contains attacker controlled information in crypto/tls

Modified: 5/15/2026

Quadratic complexity when parsing some invalid inputs in encoding/pem

Modified: 5/15/2026

Insufficient validation of bracketed IPv6 hostnames in net/url

Modified: 5/15/2026

Parsing DER payload can cause memory exhaustion in encoding/asn1

Modified: 5/15/2026

Lack of limit when parsing cookies can cause memory exhaustion in net/http

Modified: 5/15/2026

Panic when validating certificates with DSA public keys in crypto/x509

Modified: 8/8/2026

Unbounded allocation when parsing GNU sparse map in archive/tar

Modified: 10/2/2026

Excessive CPU consumption in Reader.ReadResponse in net/textproto

Modified: 5/15/2026

Excessive resource consumption when printing error string for host certificate validation in crypto/x509

Modified: 8/14/2026

Improper application of excluded DNS name constraints when verifying wildcard names in crypto/x509

Modified: 5/15/2026

Unexpected session resumption in crypto/tls

Modified: 9/29/2026

Handshake messages may be processed at the incorrect encryption level in crypto/tls

Modified: 8/7/2026

Memory exhaustion in query parameter parsing in net/url

Modified: 10/3/2026

Excessive CPU consumption when building archive index in archive/zip

Modified: 8/8/2026

Improper access to parent directory of root in os

Modified: 5/15/2026

Incorrect enforcement of email constraints in crypto/x509

Modified: 10/7/2026

Panic in name constraint checking for malformed certificates in crypto/x509

Modified: 5/15/2026

Incorrect parsing of IPv6 host literals in net/url

Modified: 10/16/2026

FileInfo can escape from a Root in os

Modified: 5/15/2026

URLs in meta content attribute actions are not escaped in html/template

Modified: 5/15/2026

TOCTOU permits root escape on Linux via Root.Chmod in os in internal/syscall/unix

Modified: 9/29/2026

JsBraceDepth Context Tracking Bugs (XSS) in html/template

Modified: 10/7/2026

Case-sensitive excludedSubtrees name constraints cause Auth Bypass in crypto/x509

Modified: 10/14/2026

Unbounded allocation for old GNU sparse in archive/tar

Modified: 10/7/2026

Unauthenticated TLS 1.3 KeyUpdate record can cause persistent connection retention and DoS in crypto/tls

Modified: 10/3/2026

Invoking Encrypted Client Hello privacy leak in crypto/tls

Modified: 10/3/2026

Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage

Modified: 8/17/2026

Enforce maximum recursion depth in encoding/asn1

Modified: 10/20/2026

Add recursion depth guard during decode in encoding/xml

Modified: 10/20/2026

Apply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/http

Modified: 10/7/2026

Limit handshake messages we are willing to accept post-handshake in crypto/tls

Modified: 10/20/2026

Fix Javascript regexp context tracking in html/template

Modified: 10/20/2026

Avoid quadratic complexity in resolvePath in net/url

Modified: 10/20/2026

Reset context tracking on consecutive template expressions in html/template

Modified: 10/16/2026

Recognize yield as regexp preceder keyword in html/template

Modified: 10/16/2026

HTTP/2 server memory exhaustion due to Trailer headers in net/http

Modified: 10/16/2026

Root.Mkdir(All) can follow junctions out of the root on Windows in os

Modified: 10/16/2026

HTTP/1 client connection desynchronization after CONNECT rejection in net/http

Modified: 10/16/2026

Reject malformed ECH outer extension references in crypto/tls

Modified: 10/16/2026

Memory limit bypass when parsing MIME headers in net/textproto, mime/multipart

Modified: 10/16/2026

Lack of limit on size of parsed Range headers in net/http

Modified: 10/16/2026

HTTP/2 transport accepts malformed framing-related headers in net/http

Modified: 10/16/2026

Excessive CPU consumption from repeated initial window changes in net/http

Modified: 10/16/2026

Double flow control refund on HTTP/2 server streams in net/http

Modified: 10/16/2026

HTTP/1 server connection desynchronization after 2xx CONNECT response in net/http

Modified: 10/16/2026

HTTP/2 server crash due to HPACK encoder race in net/http

Modified: 10/16/2026

Distrust compromised intermediate certificates in crypto/x509

Modified: 10/21/2026