GO-2025-3984 Rancher CLI SAML authentication is vulnerable to phishing attacks in github.com/rancher/rancher

Rancher CLI SAML authentication is vulnerable to phishing attacks in github.com/rancher/rancher. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerabili...

Symlink Attack

Overview std/syscall is a Go standard library package std/syscall Affected versions of this package are vulnerable to Symlink Attack. Go Vulnerability Report:os.OpenFilepath, os.OCREATE|OEXCL behaved differently on Unix and Windows systems when the target path was a dangling symlink. On Unix...

HTTP Request Smuggling

Overview std/net/http/internal is a Go standard library package std/net/http/internal Affected versions of this package are vulnerable to HTTP Request Smuggling. Go Vulnerability Report:The net/http package improperly accepts a bare LF as a line terminator in chunked data chunk-size lines. This c...

Improper Neutralization

Overview std/net/mail is a Go standard library package std/net/mail Affected versions of this package are vulnerable to Improper Neutralization. Go Vulnerability Report: The ParseAddressList function incorrectly handles comments text within parentheses within display names. Since this is a...

Allocation of Resources Without Limits or Throttling

Overview std/net/textproto is a Go standard library package std/net/textproto Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling. Go Vulnerability Report: When parsing a multipart form either explicitly with Request.ParseMultipartForm or...

Uncontrolled Search Path Element

Overview std/syscall is a Go standard library package std/syscall Affected versions of this package are vulnerable to Uncontrolled Search Path Element. Go Vulnerability Report: via the LoadLibrary process. An attacker can execute arbitrary code by placing a malicious DLL in a location where it wi...

Uncaught Exception

Overview std/archive/zip is a Go standard library package std/archive/zip Affected versions of this package are vulnerable to Uncaught Exception. Go Vulnerability Report: via the NewReader or OpenReader functions when processing an archive that specifies an unusually large number of files. An...

Race Condition

Overview std/net/http is a Go standard library package std/net/http Affected versions of this package are vulnerable to Race Condition. Go Vulnerability Report: HTTP servers where the Handler concurrently reads the request body and writes a response can encounter a data race and crash. The...

Infinite loop

Overview std/encoding/xml is a Go standard library package std/encoding/xml Affected versions of this package are vulnerable to Infinite loop. Go Vulnerability Report: The Decode, DecodeElement, and Skip methods of an xml.Decoder provided by xml.NewTokenDecoder may enter an infinite loop when...