CVE-2024-24787-PoC

CVE-2024-24787-PoC En Darwin, compilar un módulo de Go que contenga CGO puede desencadenar la ejecución de código arbitrario al usar la versión de ld de Apple, debido al uso de la bandera -ltolibrary en una directiva 'cgo LDFLAGS'. Este no es mi error, solo hice un PoC para el mismo. Referencia...

CLEANSTART-2026-AC13048 When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash

CVE-2026-33811 affects multiple packages. When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash. See references for individual vulnerability details...

Go-Get-RCE-CVE-2018-6574-POC

CVE-2018-6574 POC ENLACE https://nvd.nist.gov/vuln/detail/CVE-2018-6574 http://blog.nsfocus.net/cve-2018-6574/ EJECUCIÓN go get github.com/neargle/CVE-2018-6574-POC DETALLE El payload está en: https://github.com/neargle/CVE-2018-6574-POC/blob/master/calc.cL10 Ahora, con las funciones de CGO, se...

CLEANSTART-2026-TG48757 When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash

Security vulnerability affects the temporal-server package. When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash...

Astra Linux - Vulnerability in Golang-1.19

The go command may generate unexpected code during build time when using cgo. This can lead to unexpected behavior when running a go program that uses cgo. This issue may occur when running a trusted module that contains directories with newline characters in their names. Modules retrieved using...

CVE-2018-6574

CVE-2018-6574 Pasos para reproducir: 1. Crea un archivo .c que contenga el comando malicioso revshell: include include static void malicious attributeconstructor; void malicious system""; 2. Compílalo usando GCC. Debes compilarlo en la misma arquitectura y sistema operativo que el objetivo por...

CVE-2018-6574

CVE-2018-6574 Exploit para ejecución remota de comandos en el comando go get de Golang. Introducción Cuando ejecutas go get con un paquete, Go está diseñado para compilar e instalar el paquete sin ejecutar ningún código de él. La intención es que puedas obtener, compilar e incluso instalar paquet...

CVE-2018-6574

CVE-2018-6574 POC POC de exploit para CVE-2018-6574 Compilar 1. Crea un archivo de exploit con lo siguiente: include include static void malicious attributeconstructor; void malicious system"COMMAND"; 2. Compílalo: gcc -shared -o exploit.so -fPIC exploit.c 3. Finalmente, necesitas el código Go qu...

CLEANSTART-2026-CA40991 mongo-go-driver repository contains CGo bindings for GSSAPI (Kerberos) authentication on Linux and macOS

CVE-2026-2303 affects multiple packages. The mongo-go-driver repository contains CGo bindings for GSSAPI Kerberos authentication on Linux and macOS. See references for individual vulnerability details...

CLEANSTART-2026-KR88876 When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash

Security vulnerability affects the cri-tools package. When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash...

CLEANSTART-2026-DN56555 When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash

CVE-2026-33811 affects multiple packages. When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash. See references for individual vulnerability details...

AlmaLinux 9.2 [TuxCare] Security Update: go-toolset / golang / golang-bin / golang-docs / golang-misc / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1780946485)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1780946485 advisory. - SWIG file names containing 'cgo' and well-crafted payloads could lead to code smuggling and arbitrary code execution at build time...

Rocky Linux 9.6 [TuxCare] Security Update: git-lfs (ALMALINUX9.6:CLSA-2026:1784541123)

The Rocky Linux 9.6 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1784541123 advisory. - When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash...

Rocky Linux 10.1 [CIQ] Security Update: go-toolset / golang / golang-bin / golang-docs / golang-misc / etc Multiple Vulnerabilities (crlsa-2026_2706)

The Rocky Linux 10.1 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20262706 advisory. golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip CVE-2025-61728 golang: net/url: Memory exhaustion in query...

AlmaLinux 9.2 [TuxCare] Security Update: go-toolset / golang / golang-bin / golang-docs / golang-misc / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1772039226)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1772039226 advisory. - The net/url package does not set a limit on the number of query parameters in a query. While the maximum size of query parameters ...

AlmaLinux 9.6 [TuxCare] Security Update: git-lfs (ALMALINUX9.6:CLSA-2026:1784541123)

The AlmaLinux 9.6 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1784541123 advisory. - When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash...

Rocky Linux 9 [CIQ] Security Update: go-toolset / golang / golang-bin / golang-docs / golang-misc / etc Multiple Vulnerabilities (crlsa-2023_3923)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20233923 advisory. golang: cmd/go: go command may generate unexpected code at build time when using cgo CVE-2023-29402 golang: cmd/go: go command may execute arbitrary code a...

CLEANSTART-2026-WJ46547 When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash

Security vulnerability affects the crane package. When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash...

CLEANSTART-2026-RQ24666 discrepancy between how Go and C/C++ comments were parsed allowed for code smuggling into the resulting cgo binary

CVE-2025-61732 affects multiple packages. A discrepancy between how Go and C/C++ comments were parsed allowed for code smuggling into the resulting cgo binary. See references for individual vulnerability details...

AlmaLinux 9.2 [TuxCare] Security Update: oci-seccomp-bpf-hook (ALMALINUX9.2:CLSA-2026:1784707996)

The AlmaLinux 9.2 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1784707996 advisory. - When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash...