2256 matches found
CVE-2026-35392 goshs has an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs PUT Upload
goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.3, PUT upload in httpserver/updown.go has no path sanitization. This vulnerability is fixed in 2.0.0-beta.3...
UBUNTU-CVE-2026-34986
Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption JWE, JSON Web Signature JWS, and JSON Web Token JWT standards. Prior to 4.1.4 and 3.0.5, decrypting a JSON Web Encryption JWE object will panic if t...
Exploit for Deserialization of Untrusted Data in Facebook React
👻 CVE-2025-55182 Go exploit Interactive RCE exploitation to...
Go JOSE 安全漏洞
Go JOSE is an implementation of the JOSE standard in Go, open sourced under the Go JOSE project. Versions prior to Go JOSE 4.1.4 and 3.0.5 contained security vulnerabilities. These vulnerabilities occurred when decrypting JSON Web Encryption objects. If the alg field indicated the key wrapping...
The vulnerability of the Delete() function in the Go programming language, which allows a hacker to trigger a service failure
The vulnerability of the Delete function in the Go programming language is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to cause service failures...
goshs 路径遍历漏洞
Goshs is a simple HTTP server developed by Patrick Hener using Go language. Versions of Goshs prior to 2.0.0-beta.3 contained a path traversal vulnerability. This vulnerability stemmed from the lack of path cleaning during PUT uploads, which could lead to path traversal attacks...
goshs 路径遍历漏洞
Goshs is a simple HTTP server developed by Patrick Hener using Go language. Versions of Goshs prior to 2.0.0-beta.3 contained a path traversal vulnerability. This vulnerability stemmed from the lack of cleaning up POST multipart upload directories, which could lead to path traversal attacks...
RHSA-2026:0923 Red Hat Security Advisory: golang security update
Bulletin has no description...
The vulnerability of the HTTP/2 implementation in the Go programming language allows attackers to bypass existing security mechanisms.
The vulnerability of the HTTP/2 implementation in the Go programming language is related to deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor to bypass existing security mechanisms remotely...
goshs 安全漏洞
Goshs is a simple HTTP server developed by Patrick Hener using Go language. Versions of Goshs from 1.1.0 to 2.0.0-beta.2 contained security vulnerabilities. These vulnerabilities stemmed from the use of shared tokens, which could bypass the limited file download restrictions, allowing access to a...
net/url: Incorrect parsing of IPv6 host literals in net/url
The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid...
CLSA-2026-1775040432 golang: Fix of CVE-2025-61731
CVE-2025-61731: fix pkg-config --log-file argument injection via cgo pkg-config directive...
A laughing RAT: CrystalX combines spyware, stealer, and prankware features
Introduction In March 2026, we discovered an active campaign promoting previously unknown malware in private Telegram chats. The Trojan was offered as a MaaS malware‑as‑a‑service with three subscription tiers. It caught our attention because of its extensive arsenal of capabilities. On the panel...
ROS-20260401-73-0042
Vulnerability in golang-x-net related to null pointer dereferencing. Exploitation of the vulnerability could allow an attacker to cause a denial of service...
golang: net/url: Memory exhaustion in query parameter parsing in net/url
A flaw was found in the net/url package in the Go standard library. The package does not enforce a limit on the number of unique query parameters it parses. A Go application using the net/http.Request.ParseForm method will try to process all parameters provided in the request. A specially crafted...
The vulnerability of the Go programming language, related to errors in the certificate validation process, allows a perpetrator to cause service failures.
The vulnerability of the Go programming language is related to errors in the certificate validation process. Exploiting this vulnerability allows a malicious actor, operating remotely, to cause service failures...
The vulnerability of the File.ReadDir() and File.Readdir() functions in the Go programming language allows a perpetrator to gain unauthorized access to protected information.
The vulnerability of the File.ReadDir and File.Readdir functions in the Go programming language is related to improper restrictions on the path to a limited directory. Exploiting this vulnerability allows an attacker to gain unauthorized access to protected information...
The vulnerability of the url.Parse() function in the host/authority component of the Go programming language allows a hacker to execute arbitrary code.
The vulnerability of the url.Parse function in the host/authority component of the Go programming language is related to improper syntax validation of input. Exploiting this vulnerability allows an attacker to execute arbitrary code remotely...
ROS-20260327-73-0007
A vulnerability in the Golang programming language is related to errors in the certificate authentication procedure. Exploitation of the vulnerability may allow an attacker to affect confidentiality, integrity and availability of protected information...