CVE-2026-33813

Panic when decoding large WEBP image on 32-bit platforms in golang.org/x/image

Parsing a WEBP image with an invalid, large size panics on 32-bit platforms.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Golang Redhat

Products

Image Hummingbird

CVE-2023-54365

Traefik - Denial of Service via HTTP/2 Request Handling

Traefik before 2.10.5 and 3.0.0-beta4 is affected by a denial-of-service vulnerability in HTTP/2 request handling inherited from the Go standard library's HTTP/2 implementation (CVE-2023-44487 / CVE-2023-39325, the 'Rapid Reset' technique). A remote attacker can rapidly create and cancel HTTP/2 streams to exhaust server resources and cause service unavailability.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Golang Redhat Traefik

Products

Go Openshift Ai Traefik and 1 more

CVE-2026-42507

Arbitrary inputs are included in errors without any escaping in net/textproto

When returning errors, functions in the net/textproto package would include its input as part of the error. This might allow an attacker to inject misleading content to errors that are printed or logged.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Golang

Products

Net

CVE-2023-24540

Improper handling of JavaScript whitespace in html/template

Not all valid JavaScript whitespace characters are considered to be whitespace. Templates containing whitespace characters outside of the character set "\t\n\f\r\u0020\u2028\u2029" in JavaScript contexts that also contain actions may not be properly sanitized during execution.

CVSS 3.1 · 9.8 Critical EPSS 1.6% KEV · Not listed

Vendors

Golang Redhat

Products

Go Acm Advanced Cluster Security and 17 more

CVE-2026-42504

Quadratic complexity in WordDecoder.DecodeHeader in mime

Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Golang

Products

Mime

CVE-2026-39831

Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh

The Verify() method for FIDO/U2F security key types (sk-ecdsa-sha2-nistp256@openssh.com, sk-ssh-ed25519@openssh.com) did not check the User Presence flag. Signatures generated without physical touch were accepted, allowing unattended use of a hardware security key. To restore the previous behavior, return a "no-touch-required" extension in Permissions.Extensions from PublicKeyCallback.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Golang

Products

Crypto Ssh

CVE-2026-46599

Excessive resource consumption in PackBits decompression in golang.org/x/image/tiff

The TIFF decoder does not place a limit on the size of PackBits-compressed data. A maliciously-crafted image can exploit this to cause a small image (both in terms of pixel width/height and encoded size) to make the decoder decode large amounts of compressed data.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Golang

Products

Image

CVE-2026-42500

Panic when reading out of bound palette index in golang.org/x/image/bmp

Decoding a paletted BMP file with an out-of-range palette index results in a panic when accessing pixels in the invalid image.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Golang

Products

Image

CVE-2026-42502

Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Golang

Products

Net

CVE-2026-42506

Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Golang

Products

Net

CVE-2026-27136

Invoking duplicate attributes can cause XSS in golang.org/x/net/html

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Golang

Products

Net

CVE-2026-25680

Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html

Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Golang

Products

Net

CVE-2026-25681

Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Golang

Products

Net

CVE-2026-39834

Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh

When writing data larger than 4GB in a single Write call on an SSH channel, an integer overflow in the internal payload size calculation caused the write loop to spin indefinitely, sending empty packets without making progress. The size comparison now uses int64 to prevent truncation.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Golang

Products

Crypto Ssh

CVE-2026-46597

Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh

An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Golang

Products

Crypto Ssh

CVE-2026-46598

Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent

For certain crafted inputs, a 'ed25519.PrivateKey' was created by casting malformed wire bytes, leading to a panic when used.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Golang

Products

Crypto Ssh

CVE-2026-39824

Invoking integer overflow in NewNTUnicodeString in golang.org/x/sys/windows

NewNTUnicodeString does not check for string length overflow. When provided with a string that overflows the maximum size of a NTUnicodeString (a 16-bit number of bytes), it returns a truncated string rather than an error.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed

Vendors

Golang

Products

Sys

CVE-2026-39827

Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh

An authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users. Rejected channels are now properly removed from the connection's internal state and released for garbage collection.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Golang

Products

Crypto Ssh

CVE-2019-11840

golang.org/x/crypto: Keystream loop in amd64 assembly when overflowing 32-bit counter

An issue was discovered in the supplementary Go cryptography library, golang.org/x/crypto, before v0.0.0-20190320223903-b7391e95e576. A flaw was found in the amd64 implementation of the golang.org/x/crypto/salsa20 and golang.org/x/crypto/salsa20/salsa packages. If more than 256 GiB of keystream is generated, or if the counter otherwise grows greater than 32 bits, the amd64 implementation will first generate incorrect output, and then cycle back to previously generated keystream. Repeated keystream bytes can lead to loss of confidentiality in encryption applications, or to predictability in CSPRNG applications.

CVSS 3.1 · 5.9 Medium EPSS 3.5% KEV · Not listed

Vendors

Debian Golang Redhat

Products

Debian Linux Crypto Openshift

CVE-2026-33812

Excessive memory allocation when decoding malicious SFNT in golang.org/x/image

Parsing a malicious font file can cause excessive memory allocation.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Golang

Products

Image