CVE-2022-1962

Stack exhaustion due to deeply nested types in go/parser

Uncontrolled recursion in the Parse functions in go/parser before Go 1.17.12 and Go 1.18.4 allow an attacker to cause a panic due to stack exhaustion via deeply nested types or declarations.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Golang Redhat

Products

Go Acm Application Interconnect and 13 more

CVE-2022-30635

Stack exhaustion when decoding certain messages in encoding/gob

Uncontrolled recursion in Decoder.Decode in encoding/gob before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a message which contains deeply nested structures.

CVSS 3.1 · 7.5 High EPSS 1.9% KEV · Not listed

Vendors

Golang Redhat

Products

Go Acm Ceph Storage and 12 more

CVE-2022-30630

Stack exhaustion in Glob on certain paths in io/fs

Uncontrolled recursion in Glob in io/fs before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a path which contains a large number of path separators.

CVSS 3.1 · 7.5 High EPSS 2.2% KEV · Not listed

Vendors

Golang Redhat

Products

Go Acm Application Interconnect and 14 more

CVE-2022-30580

Empty Cmd.Path can trigger unintended binary in os/exec on Windows

Code injection in Cmd.Start in os/exec before Go 1.17.11 and Go 1.18.3 allows execution of any binaries in the working directory named either "..com" or "..exe" by calling Cmd.Run, Cmd.Start, Cmd.Output, or Cmd.CombinedOutput when Cmd.Path is unset.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Golang

Products

Go

CVE-2022-1705

Improper sanitization of Transfer-Encoding headers in net/http

Acceptance of some invalid Transfer-Encoding headers in the HTTP/1 client in net/http before Go 1.17.12 and Go 1.18.4 allows HTTP request smuggling if combined with an intermediate server that also improperly fails to reject the header as invalid.

CVSS 3.1 · 6.5 Medium EPSS 1.5% KEV · Not listed

Vendors

Golang Redhat

Products

Go Acm Application Interconnect and 19 more

CVE-2025-66630

Fiber insecurely fallsback in utils.UUIDv4() / utils.UUID() — predictable / zero‑UUID on crypto/rand failure

Fiber is an Express inspired web framework written in Go. Before 2.52.11, on Go versions prior to 1.24, the underlying crypto/rand implementation can return an error if secure randomness cannot be obtained. Because no error is returned by the Fiber v2 UUID functions, application code may unknowingly rely on predictable, repeated, or low-entropy identifiers in security-critical pathways. This is especially impactful because many Fiber v2 middleware components (session middleware, CSRF, rate limiting, request-ID generation, etc.) default to using utils.UUIDv4(). This vulnerability is fixed in 2.52.11.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed

Vendors

Gofiber Golang

Products

Fiber Go

CVE-2025-68119

Unexpected code execution when invoking toolchain in cmd/go

Downloading and building modules with malicious version strings can cause local code execution. On systems with Mercurial (hg) installed, downloading modules from non-standard sources (e.g., custom domains) can cause unexpected code execution due to how external VCS commands are constructed. This issue can also be triggered by providing a malicious version string to the toolchain. On systems with Git installed, downloading and building modules with malicious version strings can allow an attacker to write to arbitrary files on the filesystem. This can only be triggered by explicitly providing the malicious version strings to the toolchain and does not affect usage of @latest or bare module paths.

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed

Vendors

Golang Gotoolchain

Products

Go Cmd/go

CVE-2025-61731

Arbitrary file write using cgo pkg-config directive in cmd/go

Building a malicious file with cmd/go can cause can cause a write to an attacker-controlled file with partial control of the file content. The "#cgo pkg-config:" directive in a Go source file provides command-line arguments to provide to the Go pkg-config command. An attacker can provide a "--log-file" argument to this directive, causing pkg-config to write to an attacker-controlled location.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Golang Gotoolchain

Products

Go Cmd/go

CVE-2025-61732

Potential code smuggling via doc comments in cmd/cgo

A discrepancy between how Go and C/C++ comments were parsed allowed for code smuggling into the resulting cgo binary.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Golang Gotoolchain

Products

Go Cmd/go

CVE-2025-22873

Improper access to parent directory of root in os

It was possible to improperly access the parent directory of an os.Root by opening a filename ending in "../". For example, Root.Open("../") would open the parent directory of the Root. This escape only permits opening the parent directory itself, not ancestors of the parent or files contained within the parent.

CVSS 3.1 · 3.8 Low EPSS < 1% KEV · Not listed

Vendors

Go Standard Library Golang

Products

Os Go

CVE-2025-58185

Parsing DER payload can cause memory exhaustion in encoding/asn1

Parsing a maliciously crafted DER payload could allocate large amounts of memory, causing memory exhaustion.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Golang

Products

Encoding Go

CVE-2025-61728

Excessive CPU consumption when building archive index in archive/zip

archive/zip uses a super-linear file name indexing algorithm that is invoked the first time a file in an archive is opened. This can lead to a denial of service when consuming a maliciously constructed ZIP archive.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Go Standard Library Golang

Products

Archive/zip Go

CVE-2025-61730

Handshake messages may be processed at the incorrect encryption level in crypto/tls

During the TLS 1.3 handshake if multiple messages are sent in records that span encryption level boundaries (for instance the Client Hello and Encrypted Extensions messages), the subsequent messages may be processed before the encryption level changes. This can cause some minor information disclosure if a network-local attacker can inject messages during the handshake.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Go Standard Library Golang

Products

Crypto Tls Go

CVE-2025-4674

Unexpected command execution in untrusted VCS repositories in cmd/go

The go command may execute unexpected commands when operating in untrusted VCS repositories. This occurs when possibly dangerous VCS configuration is present in repositories. This can happen when a repository was fetched via one VCS (e.g. Git), but contains metadata for another VCS (e.g. Mercurial). Modules which are retrieved using the go command line, i.e. via "go get", are not affected.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Golang Gotoolchain

Products

Go Cmd/go

CVE-2025-47907

Incorrect results returned from Rows.Scan in database/sql

Cancelling a query (e.g. by cancelling the context passed to one of the query methods) during a call to the Scan method of the returned Rows can result in unexpected results if other queries are being made in parallel. This can result in a race condition that may overwrite the expected results with those of another query, causing the call to Scan to return either unexpected results from the other query or an error.

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed

Vendors

Golang

Products

Database Sql Go

CVE-2025-58187

Quadratic complexity when checking name constraints in crypto/x509

Due to the design of the name constraint checking algorithm, the processing time of some inputs scale non-linearly with respect to the size of the certificate. This affects programs which validate arbitrary certificate chains.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Golang

Products

Crypto Go

CVE-2025-58188

Panic when validating certificates with DSA public keys in crypto/x509

Validating certificate chains which contain DSA public keys can cause programs to panic, due to a interface cast that assumes they implement the Equal method. This affects programs which validate arbitrary certificate chains.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Golang

Products

Crypto Go

CVE-2025-58189

ALPN negotiation error contains attacker controlled information in crypto/tls

When Conn.Handshake fails during ALPN negotiation the error contains attacker controlled information (the ALPN protocols sent by the client) which is not escaped.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Golang

Products

Crypto Go

CVE-2025-61723

Quadratic complexity when parsing some invalid inputs in encoding/pem

The processing time for parsing some invalid inputs scales non-linearly with respect to the size of the input. This affects programs which parse untrusted PEM inputs.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Golang

Products

Encoding Go

CVE-2025-61724

Excessive CPU consumption in Reader.ReadResponse in net/textproto

The Reader.ReadResponse function constructs a response string through repeated string concatenation of lines. When the number of lines in a response is large, this can cause excessive CPU consumption.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Golang

Products

Go Net