Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 31

Export CSV
CVE-2023-24532

Incorrect calculation on P256 curves in crypto/internal/nistec

The ScalarMult and ScalarBaseMult methods of the P256 Curve may return an incorrect result if called with some specific unreduced scalars (a scalar larger than the order of the curve). This does not impact usages of crypto/ecdsa or crypto/ecdh.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Golang Redhat
Products
Go Enterprise Linux Migration Toolkit Applications and 7 more
CVE-2022-30632

Stack exhaustion on crafted paths in path/filepath

Uncontrolled recursion in Glob in path/filepath before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a path containing a large number of path separators.

CVSS 3.1 · 7.5 High EPSS 2.2% KEV · Not listed
Vendors
Golang Redhat
Products
Go Acm Application Interconnect and 15 more
CVE-2022-29526

golang: syscall: faccessat checks wrong group

Go before 1.17.10 and 1.18.x before 1.18.2 has Incorrect Privilege Assignment. When called with a non-zero flags parameter, the Faccessat function could incorrectly report that a file is accessible.

CVSS 3.1 · 5.3 Medium EPSS 3.0% KEV · Not listed
Vendors
Fedoraproject Golang Linux and 2 more
Products
Fedora Go Linux Kernel and 12 more
CVE-2022-27664

golang: net/http: handle server errors after sending GOAWAY

In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers can cause a denial of service because an HTTP/2 connection can hang during closing if shutdown were preempted by a fatal error.

CVSS 3.1 · 7.5 High EPSS 3.5% KEV · Not listed
Vendors
Fedoraproject Golang Redhat
Products
Fedora Go Acm and 16 more
CVE-2022-23806

golang: crypto/elliptic: IsOnCurve returns true for invalid field elements

Curve.IsOnCurve in crypto/elliptic in Go before 1.16.14 and 1.17.x before 1.17.7 can incorrectly return true in situations with a big.Int value that is not a valid field element.

CVSS 3.1 · 9.1 Critical EPSS 3.1% KEV · Not listed
Vendors
Debian Golang Netapp and 1 more
Products
Debian Linux Go Beegfs Csi Driver and 11 more
CVE-2022-23773

golang: cmd/go: misinterpretation of branch names can lead to incorrect access control

cmd/go in Go before 1.16.14 and 1.17.x before 1.17.7 can misinterpret branch names that falsely appear to be version tags. This can lead to incorrect access control if an actor is supposed to be able to create branches but not tags.

CVSS 3.1 · 7.5 High EPSS 2.7% KEV · Not listed
Vendors
Golang Netapp Redhat
Products
Go Beegfs Csi Driver Cloud Insights Telegraf Agent and 9 more
CVE-2022-23772

golang: math/big: uncontrolled memory consumption due to an unhandled overflow via Rat.SetString

Rat.SetString in math/big in Go before 1.16.14 and 1.17.x before 1.17.7 has an overflow that can lead to Uncontrolled Memory Consumption.

CVSS 3.1 · 7.5 High EPSS 2.8% KEV · Not listed
Vendors
Debian Golang Netapp and 1 more
Products
Debian Linux Go Beegfs Csi Driver and 10 more
CVE-2021-44716

golang: net/http: limit growth of header canonicalization cache

net/http in Go before 1.16.12 and 1.17.x before 1.17.5 allows uncontrolled memory consumption in the header canonicalization cache via HTTP/2 requests.

CVSS 3.1 · 7.5 High EPSS 4.3% KEV · Not listed
Vendors
Debian Golang Netapp and 1 more
Products
Debian Linux Go Cloud Insights Telegraf and 13 more
CVE-2021-34558

golang: crypto/tls: certificate of wrong type is causing TLS client to panic

The crypto/tls package of Go through 1.16.5 does not properly assert that the type of public key in an X.509 certificate matches the expected type when doing a RSA based key exchange, allowing a malicious TLS server to cause a TLS client to panic.

CVSS 3.1 · 6.5 Medium EPSS 7.0% KEV · Not listed
Vendors
Fedoraproject Golang Netapp and 2 more
Products
Fedora Go Cloud Insights Telegraf and 16 more