Code injection in the go command with cgo before Go 1.14.12 and Go 1.15.5 allows arbitrary code execution at build time via malicious gcc flags specified via a #cgo directive

Code injection in the go command with cgo before Go 1.14.12 and Go 1.15.5 allows arbitrary code execution at build time via a malicious unquoted symbol name in a linked object…

Go before 1.14.12 and 1.15.x before 1.15.4 allows Denial of Service

Go before 1.13.15 and 14.x before 1.14.7 can have an infinite read loop in ReadUvarint and ReadVarint in encoding/binary via invalid inputs

Go before 1.12.16 and 1.13.x before 1.13.7 (and the crypto/cryptobyte package before 0.0.0-20200124225646-8b5121be2f68 for Go) allows attacks on clients (resulting in a panic) via…

Go before 1.12.11 and 1.3.x before 1.13.2 can panic upon an attempt to process network traffic containing an invalid DSA public key

Go before 1.12.10 and 1.13.x before 1.13.1 allow HTTP Request Smuggling

The crypto/x509 package of Go before 1.10.6 and 1.11.x before 1.11.3 does not limit the amount of work performed for each chain verification, which might allow attackers to craft…

The net/http package's Request.ParseMultipartForm method starts writing to temporary files once the request body size surpasses the given "maxMemory" limit

On Darwin, user's trust preferences for root certificates were not honored

The Verify function in crypto/dsa/dsa.go in Go before 1.5.4 and 1.6.x before 1.6.1 does not properly check parameters passed to the big integer library, which might allow remote…

The Int.Exp Montgomery code in the math/big library in Go 1.5.x before 1.5.3 mishandles carry propagation and produces incorrect output, which makes it easier for attackers to…

Templates containing actions in unquoted HTML attributes (e.g

Angle brackets (<>) are not considered dangerous characters when inserted into CSS contexts

Go before 1.15.13 and 1.16.x before 1.16.5 has functions for DNS lookups that do not validate replies from DNS servers, and thus a return value may contain an unsafe injection…

Miscompilation allows memory corruption via CONVNOP-wrapped array copy in cmd/compile

Downloading and building modules with malicious version strings can cause local code execution

Cancelling a query (e.g

archive/zip uses a super-linear file name indexing algorithm that is invoked the first time a file in an archive is opened

An excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate

If the PATH environment variable contains paths which are executables (rather than just directories), passing certain strings to LookPath ("", ".", and ".."), can result in the…

The HTTP/1 client does not fully validate the contents of the Host header

Exposure of client IP addresses in net/http

Improper sanitization of Transfer-Encoding headers in net/http

The crypto/tls package of Go through 1.16.5 does not properly assert that the type of public key in an X.509 certificate matches the expected type when doing a RSA based key…

In Go before 1.14.14 and 1.15.x before 1.15.7, crypto/elliptic/p224.go can generate incorrect outputs, related to an underflow of the lowest limb during the final complete…

TOCTOU permits root escape on Linux via Root.Chmod in os in internal/syscall/unix

Bypass of meta content URL escaping causes XSS in html/template

Escaper bypass leads to XSS in html/template

JsBraceDepth Context Tracking Bugs (XSS) in html/template

URLs in meta content attribute actions are not escaped in html/template

The html/template package does not apply the proper rules for handling occurrences of "<script", "<!--", and "</script" within JS literals in <script> contexts

The html/template package does not properly handle HTML-like "" comment tokens, nor hashbang "#!" comment tokens, in <script> contexts

Go before 1.14.8 and 1.15.x before 1.15.1 allows XSS because text/html is the default for CGI/FCGI handlers that lack a Content-Type header

An issue was discovered in net/http in Go 1.11.5

Invoking "go tool pack" does not sanitize output paths in cmd/go

Panic in name constraint checking for malformed certificates in crypto/x509

Go before 1.15.15 and 1.16.x before 1.16.7 has a race condition that can lead to a net/http/httputil ReverseProxy panic upon an ErrAbortHandler abort

net/http in Go before 1.15.12 and 1.16.x before 1.16.4 allows remote attackers to cause a denial of service (panic) via a large header to ReadRequest or ReadResponse

Go before 1.13.13 and 1.14.x before 1.14.5 has a data race in some net/http servers, as demonstrated by the httputil.ReverseProxy Handler, because it reads a request body and…

An unintended cleartext issue exists in Go before 1.8.4 and 1.9.x before 1.9.1

A bug in the standard library ScalarMult implementation of curve P-256 for amd64 architectures in Go before 1.7.6 and 1.8.x before 1.8.2 causes incorrect results to be generated…

The encoding/xml package in Go (all versions) does not correctly preserve the semantics of element namespace prefixes during tokenization round-trips, which allows an attacker to…

The encoding/xml package in Go versions 1.15 and earlier does not correctly preserve the semantics of directives during tokenization round-trips, which allows an attacker to craft…

The encoding/xml package in Go (all versions) does not correctly preserve the semantics of attribute namespace prefixes during tokenization round-trips, which allows an attacker…

Unbounded allocation for old GNU sparse in archive/tar

os.OpenFile(path, os.O_CREATE|O_EXCL) behaved differently on Unix and Windows systems when the target path was a dangling symlink

The archive/zip package's handling of certain types of invalid zip files differs from the behavior of most zip implementations

Stack exhaustion due to deeply nested types in go/parser

archive/zip in Go 1.16.x before 1.16.1 allows attackers to cause a denial of service (panic) upon attempted use of the Reader.Open API for a ZIP archive in which ../ occurs at the…