Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh

Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna

Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh

Glib: off-by-one error in glib/gkeyfile.c via "g_key_file_get_locale_string_list"

Glib: buffer over-read in glib/giochannel.c via "g_io_channel_read_line_backend"

Glib: buffer over-read in g_regex_replace() via glib/gregex.c:string_append() and g_utf8_next_char()

Glib: buffer over-read in glib/gvariant-serialiser.c via gvs_tuple_is_normal()

Glib: path traversal in glib/gio/gdbusauthmechanismsha1.c via keyring_lookup_entry and mechanism_client_data_receive

Glib: out-of-bounds read in glib/gdatetime.c:g_date_time_get_ymd via invalid gdatetime

Quadratic string concatentation in consumeComment in net/mail

Quadratic string concatenation in consumePhrase in net/mail

OpenTelemetry-Go multi-value `baggage` header extraction causes excessive allocations (remote dos amplification)

attr < 2.6.0 Symlink Traversal Privilege Escalation via getfattr/setfattr

OpenTelemetry-Go has an incomplete fix for CVE-2026-24051: BSD kenv command not using absolute path enables PATH hijacking

Inefficient candidate hostname parsing in crypto/x509

Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh

Gdbusserver: glib2: gdbusserver pre-authentication dos via unbounded sasl line buffering