17892 matches found
html/template: golang: html/template: Cross-Site Scripting (XSS) via improper context and brace depth tracking in JS template literals
A flaw was found in the html/template package. This vulnerability arises from improper tracking of context and brace depth within JavaScript JS template literals. A remote attacker could exploit these issues to cause content to be incorrectly or improperly escaped, leading to Cross-Site Scripting...
crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application
A flaw was found in the crypto/x509 package within Go golang. When verifying a certificate chain, excluded DNS Domain Name System constraints are not correctly applied to wildcard DNS Subject Alternative Names SANs if the case of the SAN differs from the constraint. This oversight could allow an...
crypto/x509: Quadratic complexity when checking name constraints in crypto/x509
A potential denial of service flaw has been discovered in golang's crypto/x509 module. Due to the design of the name constraint checking algorithm, the processing time of some inputs scales non-linearly with respect to the size of the certificate. This affects programs which validate arbitrary...
cmd/go: cmd/go: Local code execution and arbitrary file write via malicious module version strings
A flaw was found in Golang's cmd/go module. This vulnerability allows a local attacker to achieve local code execution by downloading and building modules with specially crafted malicious version strings. On systems with Mercurial hg installed, this can occur when downloading modules from...
html/template: URLs in meta content attribute actions are not escaped in html/template
An input escaping flaw has been discovered in the golang html/template module. Actions which insert URLs into the content attribute of HTML meta tags are not escaped. This can allow XSS if the meta tag also has an http-equiv attribute with the value "refresh". A new GODEBUG setting has been added...
crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation
A flaw was found in Go's crypto/x509 package. A remote attacker could exploit this by presenting a specially crafted certificate chain containing a large number of policy mappings. This inefficient validation process consumes excessive resources, which can lead to a denial of service DoS for...
net/url: Incorrect parsing of IPv6 host literals in net/url
The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid...
CLEANSTART-2026-ZI02697 gRPC-Go is the Go language implementation of gRPC
Multiple security vulnerabilities affect the tempo package. gRPC-Go is the Go language implementation of gRPC. See references for individual vulnerability details...
CLEANSTART-2026-BA09462 OpenTelemetry-Go is the Go implementation of OpenTelemetry
Multiple security vulnerabilities affect the cass-operator-fips package. OpenTelemetry-Go is the Go implementation of OpenTelemetry. See references for individual vulnerability details...
CLEANSTART-2026-MO53190 gRPC-Go is the Go language implementation of gRPC
Multiple security vulnerabilities affect the istio-fips package. gRPC-Go is the Go language implementation of gRPC. See references for individual vulnerability details...
CLEANSTART-2026-BY59711 gRPC-Go is the Go language implementation of gRPC
Multiple security vulnerabilities affect the cert-manager-webhook-pdns-fips package. gRPC-Go is the Go language implementation of gRPC. See references for individual vulnerability details...
CLEANSTART-2026-UZ17701 gRPC-Go is the Go language implementation of gRPC
Multiple security vulnerabilities affect the terragrunt-fips package. gRPC-Go is the Go language implementation of gRPC. See references for individual vulnerability details...
CLEANSTART-2026-TN07413 Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web To...
Multiple security vulnerabilities affect the terragrunt-fips package. Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption JWE, JSON Web Signature JWS, and JSON Web Token JWT standards. See references...
CLEANSTART-2026-IW23933 gRPC-Go is the Go language implementation of gRPC
Multiple security vulnerabilities affect the istio-fips package. gRPC-Go is the Go language implementation of gRPC. See references for individual vulnerability details...
CLEANSTART-2026-KU98579 gRPC-Go is the Go language implementation of gRPC
Multiple security vulnerabilities affect the istio package. gRPC-Go is the Go language implementation of gRPC. See references for individual vulnerability details...
OPENSUSE-SU-2026:10514-1 go1.25-1.25.9-1.1 on GA media
These are all security issues fixed in the go1.25-1.25.9-1.1 package on the GA media of openSUSE Tumbleweed...
Linux Distros Unpatched Vulnerability : CVE-2026-29181
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - OpenTelemetry-Go is the Go implementation of OpenTelemetry. From 1.36.0 to 1.40.0, multi-value baggage: header extraction parses each header field-value...
HashiCorp go-getter 安全漏洞
HashiCorp go-getter is a Go golang library from the American company HashiCorp, used to download files or directories using URLs as the main input format from various sources. HashiCorp go-getter versions prior to v1.8.5 contained a security vulnerability that allowed arbitrary files to be read...
Oracle Linux 8 : go-toolset:ol8 (ELSA-2026-6949)
The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-6949 advisory. delve 1.25.2-1.0.1 - Disable DWARF compression which has issues Alex Burmashev 1.25.2-1 - Update to Delve 1.25.2 Sync from CentOS Stream 9 - Related:...
Linux Distros Unpatched Vulnerability : CVE-2026-39882
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to 1.43.0, the otlp HTTP exporters traces/metrics/logs read the full HTTP response body into a...