GS
Vendor
Go standard library
96
CVEs
0
On KEV
22
New 30D
Products
NE9.6
net/http
Go standard library
15 CVEs0 on KEV8 new
NE9.6
net/http/internal/http2
Go standard library
6 CVEs0 on KEV5 new
CR10.0
crypto/tls
Go standard library
8 CVEs0 on KEV1 new
OS9.8
os
Go standard library
4 CVEs0 on KEV1 new
IN9.8
internal/syscall/windows
Go standard library
1 CVEs0 on KEV1 new
HT6.1
html/template
Go standard library
7 CVEs0 on KEV2 new
CR8.2
crypto/x509
Go standard library
11 CVEs0 on KEV1 new
NE7.5
net/http/httputil
Go standard library
3 CVEs0 on KEV1 new
NE7.5
net/textproto
Go standard library
3 CVEs0 on KEV1 new
MI7.5
mime/multipart
Go standard library
1 CVEs0 on KEV1 new
NE7.5
net
Go standard library
4 CVEs0 on KEV0 new
NE7.5
net/url
Go standard library
4 CVEs0 on KEV0 new
AR7.5
archive/tar
Go standard library
3 CVEs0 on KEV0 new
EN7.5
encoding/xml
Go standard library
3 CVEs0 on KEV0 new
NE7.5
net/mail
Go standard library
3 CVEs0 on KEV0 new
EN7.5
encoding/asn1
Go standard library
2 CVEs0 on KEV0 new
EN7.5
encoding/gob
Go standard library
2 CVEs0 on KEV0 new
GO5.5
go/parser
Go standard library
2 CVEs0 on KEV0 new
OS7.8
os/exec
Go standard library
2 CVEs0 on KEV0 new
PA7.5
path/filepath
Go standard library
2 CVEs0 on KEV0 new
AR6.5
archive/zip
Go standard library
1 CVEs0 on KEV0 new
CO7.5
compress/gzip
Go standard library
1 CVEs0 on KEV0 new
EN7.5
encoding/pem
Go standard library
1 CVEs0 on KEV0 new
GO7.5
go/build/constraint
Go standard library
1 CVEs0 on KEV0 new
IN6.4
internal/syscall/unix
Go standard library
1 CVEs0 on KEV0 new
IO7.5
io/fs
Go standard library
1 CVEs0 on KEV0 new
MA7.5
math/big
Go standard library
1 CVEs0 on KEV0 new
MI7.5
mime
Go standard library
1 CVEs0 on KEV0 new
RE7.5
regexp/syntax
Go standard library
1 CVEs0 on KEV0 new
SY7.5
syscall
Go standard library
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-111943 | CR crypto/x509 Go standard library | – | Oct 21 | Distrust compromised intermediate certificates in crypto/x509 |
| CVE-2026-97032 | NE net/http Go standard library | 7.5 | Oct 8 | HTTP/2 server crash due to HPACK encoder race in net/http |
| CVE-2026-94439 | NE net/http Go standard library | 7.5 | Oct 8 | HTTP/1 server connection desynchronization after 2xx CONNECT response in net/http |
| CVE-2026-78663 | NE net/http Go standard library | 9.1 | Oct 8 | Double flow control refund on HTTP/2 server streams in net/http |
| CVE-2026-78669 | NE net/http Go standard library | 7.5 | Oct 8 | Excessive CPU consumption from repeated initial window changes in net/http |
| CVE-2026-78660 | NE net/http Go standard library | 7.5 | Oct 8 | HTTP/2 transport accepts malformed framing-related headers in net/http |
| CVE-2026-78667 | NE net/http Go standard library | 7.5 | Oct 8 | Lack of limit on size of parsed Range headers in net/http |
| CVE-2026-94440 | MI mime/multipart Go standard library | 7.5 | Oct 8 | Memory limit bypass when parsing MIME headers in net/textproto, mime/multipart |
| CVE-2026-97031 | CR crypto/tls Go standard library | 7.5 | Oct 8 | Reject malformed ECH outer extension references in crypto/tls |
| CVE-2026-56866 | NE net/http/httputil Go standard library | 7.5 | Oct 8 | HTTP/1 client connection desynchronization after CONNECT rejection in net/http |
| CVE-2026-56857 | IN internal/syscall/windows Go standard library | 9.8 | Oct 8 | Root.Mkdir(All) can follow junctions out of the root on Windows in os |
| CVE-2026-78659 | NE net/http/internal/http2 Go standard library | 7.5 | Oct 8 | HTTP/2 server memory exhaustion due to Trailer headers in net/http |
| CVE-2026-97030 | HT html/template Go standard library | 6.1 | Oct 8 | Recognize yield as regexp preceder keyword in html/template |
| CVE-2026-94448 | HT html/template Go standard library | 6.1 | Oct 8 | Reset context tracking on consecutive template expressions in html/template |
| CVE-2026-56860 | NE net/url Go standard library | 5.9 | Aug 13 | Avoid quadratic complexity in resolvePath in net/url |
| CVE-2026-56858 | HT html/template Go standard library | 6.1 | Aug 13 | Fix Javascript regexp context tracking in html/template |
| CVE-2026-56862 | CR crypto/tls Go standard library | 7.5 | Aug 13 | Limit handshake messages we are willing to accept post-handshake in crypto/tls |
| CVE-2026-56853 | NE net/http Go standard library | 7.5 | Aug 13 | Apply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/http |
| CVE-2026-56859 | EN encoding/xml Go standard library | 7.5 | Aug 13 | Add recursion depth guard during decode in encoding/xml |
| CVE-2026-33818 | EN encoding/asn1 Go standard library | 7.5 | Aug 13 | Enforce maximum recursion depth in encoding/asn1 |
| CVE-2026-46600 | NE net Go standard library | 7.5 | Jul 21 | Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage |
| CVE-2026-42505 | CR crypto/tls Go standard library | 5.3 | Jul 8 | Invoking Encrypted Client Hello privacy leak in crypto/tls |
| CVE-2026-39822 | OS os Go standard library | 7.8 | Jul 8 | Root escape via symlink plus trailing slash in os |
| CVE-2026-42507 | NE net/textproto Go standard library | 5.3 | Jun 2 | Arbitrary inputs are included in errors without any escaping in net/textproto |
| CVE-2026-42504 | MI mime Go standard library | 7.5 | Jun 2 | Quadratic complexity in WordDecoder.DecodeHeader in mime |
| CVE-2026-27145 | CR crypto/x509 Go standard library | 6.5 | Jun 2 | Inefficient candidate hostname parsing in crypto/x509 |
| CVE-2026-39821 | NE net/http Go standard library | 9.6 | May 22 | Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna |
| CVE-2026-39820 | NE net/mail Go standard library | 7.5 | May 7 | Quadratic string concatentation in consumeComment in net/mail |
| CVE-2026-39823 | HT html/template Go standard library | 6.1 | May 7 | Bypass of meta content URL escaping causes XSS in html/template |
| CVE-2026-33811 | NE net Go standard library | 7.5 | May 7 | Crash when handling long CNAME response in net |
| CVE-2026-39826 | HT html/template Go standard library | 6.1 | May 7 | Escaper bypass leads to XSS in html/template |
| CVE-2026-42499 | NE net/mail Go standard library | 7.5 | May 7 | Quadratic string concatenation in consumePhrase in net/mail |
| CVE-2026-39825 | NE net/http/httputil Go standard library | 5.3 | May 7 | ReverseProxy forwards queries with more than urlmaxqueryparams parameters in net/http/httputil |
| CVE-2026-39836 | NE net Go standard library | 7.5 | May 7 | Panic in Dial and LookupPort when handling NUL byte on Windows in net |
| CVE-2026-33814 | NE net/http Go standard library | 7.5 | May 7 | Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net |
| CVE-2026-32280 | CR crypto/x509 Go standard library | 7.5 | Apr 8 | Unexpected work during chain building in crypto/x509 |
| CVE-2026-32281 | CR crypto/x509 Go standard library | 7.5 | Apr 8 | Inefficient policy validation in crypto/x509 |
| CVE-2026-32283 | CR crypto/tls Go standard library | 7.5 | Apr 8 | Unauthenticated TLS 1.3 KeyUpdate record can cause persistent connection retention and DoS in crypto/tls |
| CVE-2026-32288 | AR archive/tar Go standard library | 5.5 | Apr 8 | Unbounded allocation for old GNU sparse in archive/tar |
| CVE-2026-33810 | CR crypto/x509 Go standard library | 8.2 | Apr 8 | Case-sensitive excludedSubtrees name constraints cause Auth Bypass in crypto/x509 |
| CVE-2026-32289 | HT html/template Go standard library | 6.1 | Apr 8 | JsBraceDepth Context Tracking Bugs (XSS) in html/template |
| CVE-2026-32282 | IN internal/syscall/unix Go standard library | 6.4 | Apr 8 | TOCTOU permits root escape on Linux via Root.Chmod in os in internal/syscall/unix |
| CVE-2026-27142 | HT html/template Go standard library | 6.1 | Mar 6 | URLs in meta content attribute actions are not escaped in html/template |
| CVE-2026-27139 | OS os Go standard library | 2.5 | Mar 6 | FileInfo can escape from a Root in os |
| CVE-2026-25679 | NE net/url Go standard library | 7.5 | Mar 6 | Incorrect parsing of IPv6 host literals in net/url |
| CVE-2026-27138 | CR crypto/x509 Go standard library | 5.9 | Mar 6 | Panic in name constraint checking for malformed certificates in crypto/x509 |
| CVE-2026-27137 | CR crypto/x509 Go standard library | 7.5 | Mar 6 | Incorrect enforcement of email constraints in crypto/x509 |
| CVE-2025-68121 | CR crypto/tls Go standard library | 10.0 | Feb 5 | Unexpected session resumption in crypto/tls |
| CVE-2025-22873 | OS os Go standard library | 3.8 | Feb 4 | Improper access to parent directory of root in os |
| CVE-2025-61728 | AR archive/zip Go standard library | 6.5 | Jan 28 | Excessive CPU consumption when building archive index in archive/zip |
| CVE-2025-61726 | NE net/url Go standard library | 7.5 | Jan 28 | Memory exhaustion in query parameter parsing in net/url |
| CVE-2025-61730 | CR crypto/tls Go standard library | 5.3 | Jan 28 | Handshake messages may be processed at the incorrect encryption level in crypto/tls |
| CVE-2025-61727 | CR crypto/x509 Go standard library | 6.5 | Dec 3 | Improper application of excluded DNS name constraints when verifying wildcard names in crypto/x509 |
| CVE-2025-61729 | CR crypto/x509 Go standard library | 7.5 | Dec 2 | Excessive resource consumption when printing error string for host certificate validation in crypto/x509 |
| CVE-2025-61724 | NE net/textproto Go standard library | 5.3 | Oct 29 | Excessive CPU consumption in Reader.ReadResponse in net/textproto |
| CVE-2025-58183 | AR archive/tar Go standard library | 4.3 | Oct 29 | Unbounded allocation when parsing GNU sparse map in archive/tar |
| CVE-2025-58188 | CR crypto/x509 Go standard library | 7.5 | Oct 29 | Panic when validating certificates with DSA public keys in crypto/x509 |
| CVE-2025-58186 | NE net/http Go standard library | 5.3 | Oct 29 | Lack of limit when parsing cookies can cause memory exhaustion in net/http |
| CVE-2025-58185 | EN encoding/asn1 Go standard library | 5.3 | Oct 29 | Parsing DER payload can cause memory exhaustion in encoding/asn1 |
| CVE-2025-47912 | NE net/url Go standard library | 5.3 | Oct 29 | Insufficient validation of bracketed IPv6 hostnames in net/url |