Microsoft Windows CryptoAPI Spoofing Vulnerability

HTTP/2 Rapid Reset Attack Vulnerability

During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed…

Missing bound checks can lead to memory corruption in safe Go in cmd/compile

The various Is methods (IsPrivate, IsLoopback, etc) did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would return true in their…

The go.mod toolchain directive, introduced in Go 1.21, can be leveraged to execute scripts and binaries relative to the root of the module when the "go" command was executed…

The go command may execute arbitrary code at build time when using cgo

The go command may execute arbitrary code at build time when using cgo

The go command may generate unexpected code at build time when using cgo

Not all valid JavaScript whitespace characters are considered to be whitespace

Templates do not properly consider backticks (`) as Javascript string delimiters, and do not escape them as expected

Go before 1.16.9 and 1.17.x before 1.17.2 has a Buffer Overflow via large arguments in a function invocation from a WASM module, when GOARCH=wasm GOOS=js is used

golang/go in 1.0.2 fixes all.bash on shared machines

The net/http library in net/http/transfer.go in Go before 1.4.3 does not properly parse HTTP headers, which allows remote attackers to conduct HTTP request smuggling attacks via a…

net/url in Go before 1.11.13 and 1.12.x before 1.12.8 mishandles malformed hosts in URLs, leading to an authorization bypass in some applications

Go through 1.12.5 on Windows mishandles process creation with a nil environment in conjunction with a non-nil token, which allows attackers to obtain sensitive information or gain…

The net/http library in net/http/transfer.go in Go before 1.4.3 does not properly parse HTTP headers, which allows remote attackers to conduct HTTP request smuggling attacks via a…

The net/http library in net/textproto/reader.go in Go before 1.4.3 does not properly parse HTTP header keys, which allows remote attackers to conduct HTTP request smuggling…

Go before 1.8.4 and 1.9.x before 1.9.1 allows "go get" remote command execution

Curve.IsOnCurve in crypto/elliptic in Go before 1.16.14 and 1.17.x before 1.17.7 can incorrectly return true in situations with a big.Int value that is not a valid field element

Code execution vulnerability in SWIG code generation in cmd/go

The "go get" implementation in Go 1.9.4, when the -insecure command-line option is used, does not validate the import path (get/vcs.go only checks for "://" anywhere in the…

A discrepancy between how Go and C/C++ comments were parsed allowed for code smuggling into the resulting cgo binary

The go command may execute unexpected commands when operating in untrusted VCS repositories

Case-sensitive excludedSubtrees name constraints cause Auth Bypass in crypto/x509

Go before 1.10.8 and 1.11.x before 1.11.5 mishandles P-521 and P-384 elliptic curves, which allows attackers to cause a denial of service (CPU consumption) or possibly conduct…

Line directives ("//line") can be used to bypass the restrictions on "//go:cgo_" directives, allowing blocked linker and compiler flags to be passed during compilation

In Go before 1.10.6 and 1.11.x before 1.11.3, the "go get" command is vulnerable to directory traversal when executed with the import path of a malicious Go package which contains…

In Go before 1.10.6 and 1.11.x before 1.11.3, the "go get" command is vulnerable to remote code execution when executed with the -u flag and the import path of a malicious Go…

The net/http package in Go through 1.6 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of…

Root escape via symlink plus trailing slash in os

Building a malicious file with cmd/go can cause can cause a write to an attacker-controlled file with partial control of the file content

On Unix platforms, the Go runtime does not behave differently when a binary is run with the setuid/setgid bits

Empty Cmd.Path can trigger unintended binary in os/exec on Windows

Go through 1.12 on Windows misuses certain LoadLibrary functionality, leading to DLL injection

Go before 1.8.7, Go 1.9.x before 1.9.4, and Go 1.10 pre-releases before Go 1.10rc2 allow "go get" remote command execution during source code build, by leveraging the gcc or clang…

Untrusted search path vulnerability in Go before 1.5.4 and 1.6.x before 1.6.1 on Windows allows local users to gain privileges via a Trojan horse DLL in the current working…

Traefik - Denial of Service via HTTP/2 Request Handling

Quadratic string concatentation in consumeComment in net/mail

Malicious module proxy can bypass checksum database in cmd/go

Crash when handling long CNAME response in net

Quadratic string concatenation in consumePhrase in net/mail

Panic in Dial and LookupPort when handling NUL byte on Windows in net

Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net

Unexpected work during chain building in crypto/x509

Inefficient policy validation in crypto/x509

Unauthenticated TLS 1.3 KeyUpdate record can cause persistent connection retention and DoS in crypto/tls

When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions,…

url.Parse insufficiently validated the host/authority component and accepted some invalid URLs

The net/url package does not set a limit on the number of query parameters in a query