Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 94

Export CSV
CVE-2021-33197

golang: net/http/httputil: ReverseProxy forwards connection headers if first one is empty

In Go before 1.15.13 and 1.16.x before 1.16.5, some configurations of ReverseProxy (from net/http/httputil) result in a situation where an attacker is able to drop arbitrary headers.

CVSS 3.1 · 5.3 Medium EPSS 2.3% KEV · Not listed
Vendors
Golang Redhat
Products
Go Advanced Cluster Security Container Native Virtualization and 8 more
CVE-2021-33196

golang: archive/zip: malformed archive may cause panic or memory exhaustion

In archive/zip in Go before 1.15.13 and 1.16.x before 1.16.5, a crafted file count (in an archive's header) can cause a NewReader or OpenReader panic.

CVSS 3.1 · 7.5 High EPSS 3.5% KEV · Not listed
Vendors
Debian Golang Redhat
Products
Debian Linux Go Devtools and 5 more
CVE-2021-33195

golang: net: lookup functions may return invalid host names

Go before 1.15.13 and 1.16.x before 1.16.5 has functions for DNS lookups that do not validate replies from DNS servers, and thus a return value may contain an unsafe injection (e.g., XSS) that does not conform to the RFC1035 format.

CVSS 3.1 · 7.3 High EPSS 3.2% KEV · Not listed
Vendors
Golang Netapp Redhat
Products
Go Cloud Insights Telegraf Agent Advanced Cluster Security and 9 more
CVE-2021-31525

golang: net/http: panic in ReadRequest and ReadResponse when reading a very large header

net/http in Go before 1.15.12 and 1.16.x before 1.16.4 allows remote attackers to cause a denial of service (panic) via a large header to ReadRequest or ReadResponse. Server, Transport, and Client can each be affected in some configurations.

CVSS 3.1 · 5.9 Medium EPSS 3.7% KEV · Not listed
Vendors
Fedoraproject Golang Redhat
Products
Fedora Go Advanced Cluster Security and 8 more
CVE-2021-29923

golang: net: incorrect parsing of extraneous zero characters at the beginning of an IP address octet

Go before 1.17 does not properly consider extraneous zero characters at the beginning of an IP address octet, which (in some situations) allows attackers to bypass access control that is based on IP addresses, because of unexpected octal interpretation. This affects net.ParseIP and net.ParseCIDR.

CVSS 3.1 · 7.5 High EPSS 3.7% KEV · Not listed
Vendors
Fedoraproject Golang Oracle and 1 more
Products
Fedora Go Timesten In-memory Database and 10 more
CVE-2021-27918

golang: encoding/xml: infinite loop when using xml.NewTokenDecoder with a custom TokenReader

encoding/xml in Go before 1.15.9 and 1.16.x before 1.16.1 has an infinite loop if a custom TokenReader (for xml.NewTokenDecoder) returns EOF in the middle of an element. This can occur in the Decode, DecodeElement, or Skip method.

CVSS 3.1 · 7.5 High EPSS 2.5% KEV · Not listed
Vendors
Golang Redhat
Products
Go Enterprise Linux Openshift Container Storage and 1 more
CVE-2020-28367

Arbitrary code execution via the go command with cgo in cmd/go

Code injection in the go command with cgo before Go 1.14.12 and Go 1.15.5 allows arbitrary code execution at build time via malicious gcc flags specified via a #cgo directive.

CVSS 3.1 · 7.5 High EPSS 2.4% KEV · Not listed
Vendors
Golang Redhat
Products
Go Devtools Enterprise Linux and 1 more
CVE-2020-28366

Arbitrary code execution in go command with cgo in cmd/go and cmd/cgo

Code injection in the go command with cgo before Go 1.14.12 and Go 1.15.5 allows arbitrary code execution at build time via a malicious unquoted symbol name in a linked object file.

CVSS 3.1 · 7.5 High EPSS 2.3% KEV · Not listed
Vendors
Fedoraproject Golang Netapp and 1 more
Products
Fedora Go Cloud Insights Telegraf Agent and 4 more
CVE-2020-26160

jwt-go: access restriction bypass vulnerability

jwt-go before 4.0.0-preview1 allows attackers to bypass intended access restrictions in situations with []string{} for m["aud"] (which is allowed by the specification). Because the type assertion fails, "" is the value of aud. This is a security problem if the JWT token is presented to a service that lacks its own audience check.

CVSS 3.1 · 7.5 High EPSS 2.2% KEV · Not listed
Vendors
Jwt-go Project Redhat
Products
Jwt-go Container Native Virtualization Cryostat and 3 more
CVE-2020-24553

golang: default Content-Type setting in net/http/cgi and net/http/fcgi could cause XSS

Go before 1.14.8 and 1.15.x before 1.15.1 allows XSS because text/html is the default for CGI/FCGI handlers that lack a Content-Type header.

CVSS 3.1 · 6.1 Medium EPSS 3.6% KEV · Not listed
Vendors
Fedoraproject Golang Opensuse and 2 more
Products
Fedora Go Leap and 3 more
CVE-2020-16845

golang: ReadUvarint and ReadVarint can read an unlimited number of bytes from invalid inputs

Go before 1.13.15 and 14.x before 1.14.7 can have an infinite read loop in ReadUvarint and ReadVarint in encoding/binary via invalid inputs.

CVSS 3.1 · 7.5 High EPSS 4.9% KEV · Not listed
Vendors
Debian Fedoraproject Golang and 2 more
Products
Debian Linux Fedora Go and 10 more
CVE-2020-15586

golang: data race in certain net/http servers including ReverseProxy can lead to DoS

Go before 1.13.13 and 1.14.x before 1.14.5 has a data race in some net/http servers, as demonstrated by the httputil.ReverseProxy Handler, because it reads a request body and writes a response at the same time.

CVSS 3.1 · 5.9 Medium EPSS 2.9% KEV · Not listed
Vendors
Cloudfoundry Debian Fedoraproject and 3 more
Products
Cf-deployment Routing-release Debian Linux and 12 more
CVE-2020-14040

golang.org/x/text: possibility to trigger an infinite loop in encoding/unicode could lead to crash

The x/text package before 0.3.3 for Go has a vulnerability in encoding/unicode that could lead to the UTF-16 decoder entering an infinite loop, causing the program to crash or run out of memory. An attacker could provide a single byte to a UTF16 decoder instantiated with UseBOM or ExpectBOM to trigger an infinite loop if the String function on the Decoder is called, or the Decoder is passed to golang.org/x/text/transform.String.

CVSS 3.1 · 7.5 High EPSS 1.9% KEV · Not listed
Vendors
Fedoraproject Golang Redhat
Products
Fedora Text 3scale Amp and 13 more