Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 15

Export CSV
CVE-2022-28131

Stack exhaustion from deeply nested XML documents in encoding/xml

Uncontrolled recursion in Decoder.Skip in encoding/xml before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a deeply nested XML document.

CVSS 3.1 · 7.5 High EPSS 2.6% KEV · Not listed
Vendors
Fedoraproject Golang Netapp and 1 more
Products
Fedora Go Cloud Insights Telegraf and 13 more
CVE-2022-23806

golang: crypto/elliptic: IsOnCurve returns true for invalid field elements

Curve.IsOnCurve in crypto/elliptic in Go before 1.16.14 and 1.17.x before 1.17.7 can incorrectly return true in situations with a big.Int value that is not a valid field element.

CVSS 3.1 · 9.1 Critical EPSS 3.1% KEV · Not listed
Vendors
Debian Golang Netapp and 1 more
Products
Debian Linux Go Beegfs Csi Driver and 11 more
CVE-2022-23773

golang: cmd/go: misinterpretation of branch names can lead to incorrect access control

cmd/go in Go before 1.16.14 and 1.17.x before 1.17.7 can misinterpret branch names that falsely appear to be version tags. This can lead to incorrect access control if an actor is supposed to be able to create branches but not tags.

CVSS 3.1 · 7.5 High EPSS 2.7% KEV · Not listed
Vendors
Golang Netapp Redhat
Products
Go Beegfs Csi Driver Cloud Insights Telegraf Agent and 9 more
CVE-2022-23772

golang: math/big: uncontrolled memory consumption due to an unhandled overflow via Rat.SetString

Rat.SetString in math/big in Go before 1.16.14 and 1.17.x before 1.17.7 has an overflow that can lead to Uncontrolled Memory Consumption.

CVSS 3.1 · 7.5 High EPSS 2.8% KEV · Not listed
Vendors
Debian Golang Netapp and 1 more
Products
Debian Linux Go Beegfs Csi Driver and 10 more
CVE-2021-44716

golang: net/http: limit growth of header canonicalization cache

net/http in Go before 1.16.12 and 1.17.x before 1.17.5 allows uncontrolled memory consumption in the header canonicalization cache via HTTP/2 requests.

CVSS 3.1 · 7.5 High EPSS 4.3% KEV · Not listed
Vendors
Debian Golang Netapp and 1 more
Products
Debian Linux Go Cloud Insights Telegraf and 13 more
CVE-2021-3115

golang: cmd/go: packages using cgo can cause arbitrary code execution at build time

Go before 1.14.14 and 1.15.x before 1.15.7 on Windows is vulnerable to Command Injection and remote code execution when using the "go get" command to fetch modules that make use of cgo (for example, cgo can execute a gcc program from an untrusted download).

CVSS 3.1 · 7.5 High EPSS 6.9% KEV · Not listed
Vendors
Fedoraproject Golang Microsoft and 2 more
Products
Fedora Go Windows and 4 more
CVE-2021-3114

golang: crypto/elliptic: incorrect operations on the P-224 curve

In Go before 1.14.14 and 1.15.x before 1.15.7, crypto/elliptic/p224.go can generate incorrect outputs, related to an underflow of the lowest limb during the final complete reduction in the P-224 field.

CVSS 3.1 · 6.5 Medium EPSS 2.7% KEV · Not listed
Vendors
Debian Fedoraproject Golang and 2 more
Products
Debian Linux Fedora Go and 10 more
CVE-2021-39293

golang: archive/zip: malformed archive may cause panic or memory exhaustion (incomplete fix of CVE-2021-33196)

In archive/zip in Go before 1.16.8 and 1.17.x before 1.17.1, a crafted archive header (falsely designating that many files are present) can cause a NewReader or OpenReader panic. NOTE: this issue exists because of an incomplete fix for CVE-2021-33196.

CVSS 3.1 · 7.5 High EPSS 6.9% KEV · Not listed
Vendors
Golang Netapp Redhat
Products
Go Cloud Insights Telegraf Advanced Cluster Security and 4 more
CVE-2021-34558

golang: crypto/tls: certificate of wrong type is causing TLS client to panic

The crypto/tls package of Go through 1.16.5 does not properly assert that the type of public key in an X.509 certificate matches the expected type when doing a RSA based key exchange, allowing a malicious TLS server to cause a TLS client to panic.

CVSS 3.1 · 6.5 Medium EPSS 7.0% KEV · Not listed
Vendors
Fedoraproject Golang Netapp and 2 more
Products
Fedora Go Cloud Insights Telegraf and 16 more
CVE-2021-33195

golang: net: lookup functions may return invalid host names

Go before 1.15.13 and 1.16.x before 1.16.5 has functions for DNS lookups that do not validate replies from DNS servers, and thus a return value may contain an unsafe injection (e.g., XSS) that does not conform to the RFC1035 format.

CVSS 3.1 · 7.3 High EPSS 3.2% KEV · Not listed
Vendors
Golang Netapp Redhat
Products
Go Cloud Insights Telegraf Agent Advanced Cluster Security and 9 more
CVE-2020-7919

golang: Integer overflow on 32bit architectures via crafted certificate allows for denial of service

Go before 1.12.16 and 1.13.x before 1.13.7 (and the crypto/cryptobyte package before 0.0.0-20200124225646-8b5121be2f68 for Go) allows attacks on clients (resulting in a panic) via a malformed X.509 certificate.

CVSS 3.1 · 7.5 High EPSS 2.6% KEV · Not listed
Vendors
Debian Fedoraproject Golang and 1 more
Products
Debian Linux Fedora Go and 1 more
CVE-2020-28366

Arbitrary code execution in go command with cgo in cmd/go and cmd/cgo

Code injection in the go command with cgo before Go 1.14.12 and Go 1.15.5 allows arbitrary code execution at build time via a malicious unquoted symbol name in a linked object file.

CVSS 3.1 · 7.5 High EPSS 2.3% KEV · Not listed
Vendors
Fedoraproject Golang Netapp and 1 more
Products
Fedora Go Cloud Insights Telegraf Agent and 4 more
CVE-2019-16276

golang: HTTP/1.1 headers with a space before the colon leads to filter bypass or request smuggling

Go before 1.12.10 and 1.13.x before 1.13.1 allow HTTP Request Smuggling.

CVSS 3.1 · 7.5 High EPSS 5.3% KEV · Not listed
Vendors
Debian Fedoraproject Golang and 3 more
Products
Debian Linux Fedora Go and 8 more