Golang

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2021-33195 2Golang Netapp 2Cloud Insights Telegraf Agent Go Jun 17, 2026 Aug 2, 2021 N/A· v4 7.3 HIGH· v3 7.5 HIGH· v2 Go before 1.15.13 and 1.16.x before 1.16.5 has functions for DNS lookups that do not validate replies from DNS servers, and thus a return value may contain an unsafe injection (e.g., XSS) that does not conform to the RFC...Show more Go before 1.15.13 and 1.16.x before 1.16.5 has functions for DNS lookups that do not validate replies from DNS servers, and thus a return value may contain an unsafe injection (e.g., XSS) that does not conform to the RFC1035 format.Show less
CVE-2021-34558 4Fedoraproject GolangNetapp+1 more 6Cloud Insights Telegraf FedoraGo+3 more Jun 17, 2026 Jul 15, 2021 N/A· v4 6.5 MEDIUM· v3 2.6 LOW· v2 The crypto/tls package of Go through 1.16.5 does not properly assert that the type of public key in an X.509 certificate matches the expected type when doing a RSA based key exchange, allowing a malicious TLS server to c...Show more The crypto/tls package of Go through 1.16.5 does not properly assert that the type of public key in an X.509 certificate matches the expected type when doing a RSA based key exchange, allowing a malicious TLS server to cause a TLS client to panic.Show less
CVE-2012-2666 1Golang 1Go Nov 21, 2024 Jul 9, 2021 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 golang/go in 1.0.2 fixes all.bash on shared machines. dotest() in src/pkg/debug/gosym/pclntab_test.go creates a temporary file with predicable name and executes it as shell script.
CVE-2021-31525 2Fedoraproject Golang 2Fedora Go Jun 17, 2026 May 27, 2021 N/A· v4 5.9 MEDIUM· v3 2.6 LOW· v2 net/http in Go before 1.15.12 and 1.16.x before 1.16.4 allows remote attackers to cause a denial of service (panic) via a large header to ReadRequest or ReadResponse. Server, Transport, and Client can each be affected in...Show more net/http in Go before 1.15.12 and 1.16.x before 1.16.4 allows remote attackers to cause a denial of service (panic) via a large header to ReadRequest or ReadResponse. Server, Transport, and Client can each be affected in some configurations.Show less
CVE-2021-33194 2Fedoraproject Golang 2Fedora Go Jun 17, 2026 May 26, 2021 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 golang.org/x/net before v0.0.0-20210520170846-37e1c6afe023 allows attackers to cause a denial of service (infinite loop) via crafted ParseFragment input.
CVE-2021-27919 2Fedoraproject Golang 2Fedora Go Jun 17, 2026 Mar 11, 2021 N/A· v4 5.5 MEDIUM· v3 4.3 MEDIUM· v2 archive/zip in Go 1.16.x before 1.16.1 allows attackers to cause a denial of service (panic) upon attempted use of the Reader.Open API for a ZIP archive in which ../ occurs at the beginning of any filename.
CVE-2021-27918 1Golang 1Go Jun 17, 2026 Mar 11, 2021 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 encoding/xml in Go before 1.15.9 and 1.16.x before 1.16.1 has an infinite loop if a custom TokenReader (for xml.NewTokenDecoder) returns EOF in the middle of an element. This can occur in the Decode, DecodeElement, or Sk...Show more encoding/xml in Go before 1.15.9 and 1.16.x before 1.16.1 has an infinite loop if a custom TokenReader (for xml.NewTokenDecoder) returns EOF in the middle of an element. This can occur in the Decode, DecodeElement, or Skip method.Show less
CVE-2021-3115 3Fedoraproject GolangNetapp 4Cloud Insights Telegraf Agent FedoraGo+1 more Jun 17, 2026 Jan 26, 2021 N/A· v4 7.5 HIGH· v3 5.1 MEDIUM· v2 Go before 1.14.14 and 1.15.x before 1.15.7 on Windows is vulnerable to Command Injection and remote code execution when using the "go get" command to fetch modules that make use of cgo (for example, cgo can execute a gcc...Show more Go before 1.14.14 and 1.15.x before 1.15.7 on Windows is vulnerable to Command Injection and remote code execution when using the "go get" command to fetch modules that make use of cgo (for example, cgo can execute a gcc program from an untrusted download).Show less
CVE-2021-3114 4Debian FedoraprojectGolang+1 more 5Cloud Insights Telegraf Agent Debian LinuxFedora+2 more Jun 17, 2026 Jan 26, 2021 N/A· v4 6.5 MEDIUM· v3 6.4 MEDIUM· v2 In Go before 1.14.14 and 1.15.x before 1.15.7, crypto/elliptic/p224.go can generate incorrect outputs, related to an underflow of the lowest limb during the final complete reduction in the P-224 field.
CVE-2021-3121 2Golang Hashicorp 2Consul Protobuf Jun 17, 2026 Jan 11, 2021 N/A· v4 8.6 HIGH· v3 7.5 HIGH· v2 An issue was discovered in GoGo Protobuf before 1.3.2. plugin/unmarshal/unmarshal.go lacks certain index validation, aka the "skippy peanut butter" issue.
CVE-2020-28852 1Golang 1Text Jun 17, 2026 Jan 2, 2021 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 In x/text in Go before v0.3.5, a "slice bounds out of range" panic occurs in language.ParseAcceptLanguage while processing a BCP 47 tag. (x/text/language is supposed to be able to parse an HTTP Accept-Language header.)
CVE-2020-28851 1Golang 1Go Jun 17, 2026 Jan 2, 2021 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 In x/text in Go 1.15.4, an "index out of range" panic occurs in language.ParseAcceptLanguage while parsing the -u- extension. (x/text/language is supposed to be able to parse an HTTP Accept-Language header.)
CVE-2020-29652 1Golang 1Ssh Jun 17, 2026 Dec 17, 2020 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 A nil pointer dereference in the golang.org/x/crypto/ssh component through v0.0.0-20201203163018-be400aefbc4c for Go allows remote attackers to cause a denial of service against SSH servers.
CVE-2020-29511 2Golang Netapp 2Go Trident Jun 17, 2026 Dec 14, 2020 N/A· v4 5.6 MEDIUM· v3 6.8 MEDIUM· v2 The encoding/xml package in Go (all versions) does not correctly preserve the semantics of element namespace prefixes during tokenization round-trips, which allows an attacker to craft inputs that behave in conflicting w...Show more The encoding/xml package in Go (all versions) does not correctly preserve the semantics of element namespace prefixes during tokenization round-trips, which allows an attacker to craft inputs that behave in conflicting ways during different stages of processing in affected downstream applications.Show less
CVE-2020-29510 2Golang Netapp 2Go Trident Jun 17, 2026 Dec 14, 2020 N/A· v4 5.6 MEDIUM· v3 6.8 MEDIUM· v2 The encoding/xml package in Go versions 1.15 and earlier does not correctly preserve the semantics of directives during tokenization round-trips, which allows an attacker to craft inputs that behave in conflicting ways d...Show more The encoding/xml package in Go versions 1.15 and earlier does not correctly preserve the semantics of directives during tokenization round-trips, which allows an attacker to craft inputs that behave in conflicting ways during different stages of processing in affected downstream applications.Show less
CVE-2020-29509 2Golang Netapp 2Go Trident Jun 17, 2026 Dec 14, 2020 N/A· v4 5.6 MEDIUM· v3 6.8 MEDIUM· v2 The encoding/xml package in Go (all versions) does not correctly preserve the semantics of attribute namespace prefixes during tokenization round-trips, which allows an attacker to craft inputs that behave in conflicting...Show more The encoding/xml package in Go (all versions) does not correctly preserve the semantics of attribute namespace prefixes during tokenization round-trips, which allows an attacker to craft inputs that behave in conflicting ways during different stages of processing in affected downstream applications.Show less
CVE-2020-28367 1Golang 1Go Jun 17, 2026 Nov 18, 2020 N/A· v4 7.5 HIGH· v3 5.1 MEDIUM· v2 Code injection in the go command with cgo before Go 1.14.12 and Go 1.15.5 allows arbitrary code execution at build time via malicious gcc flags specified via a #cgo directive.
CVE-2020-28366 3Fedoraproject GolangNetapp 4Cloud Insights Telegraf Agent FedoraGo+1 more Jun 17, 2026 Nov 18, 2020 N/A· v4 7.5 HIGH· v3 5.1 MEDIUM· v2 Code injection in the go command with cgo before Go 1.14.12 and Go 1.15.5 allows arbitrary code execution at build time via a malicious unquoted symbol name in a linked object file.
CVE-2020-28362 3Fedoraproject GolangNetapp 4Cloud Insights Telegraf Agent FedoraGo+1 more Jun 17, 2026 Nov 18, 2020 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 Go before 1.14.12 and 1.15.x before 1.15.4 allows Denial of Service.
CVE-2020-24553 4Fedoraproject GolangOpensuse+1 more 4Communications Cloud Native Core Policy FedoraGo+1 more Jun 17, 2026 Sep 2, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Go before 1.14.8 and 1.15.x before 1.15.1 allows XSS because text/html is the default for CGI/FCGI handlers that lack a Content-Type header.

Previous 1...8910 11 12 Next