2375 matches found
Google Go 安全漏洞
Google Go is a static strongly typed, compiled, concatenated, and garbage-collected programming language from Google USA. A security vulnerability exists in Google Go, which stems from the vulnerability of filepath.Walk and filepath.WalkDir to a TOCTOU competition condition attack...
net/http: Request smuggling due to acceptance of invalid chunked data in net/http
A flaw was found in the net/http golang package. The net/http package incorrectly accepts messages that end with a line feed LF instead of the proper line ending. When used with another server that also misinterprets this, it can lead to request smuggling—where an attacker tricks the system to se...
net/http: Request smuggling due to acceptance of invalid chunked data in net/http
A flaw was found in the net/http golang package. The net/http package incorrectly accepts messages that end with a line feed LF instead of the proper line ending. When used with another server that also misinterprets this, it can lead to request smuggling—where an attacker tricks the system to se...
ROS-20250801-01
A vulnerability in a set of add-on tools and libraries for the Go language designed to integrate with the OpenTelemetry, OpenTelemetry-Go Contrib is related to unconstrained and unregulated resource allocation when adding net.peer.sock.addr and net.peer.sock.port tags. regulation when adding...
net/http: Request smuggling due to acceptance of invalid chunked data in net/http
A flaw was found in the net/http golang package. The net/http package incorrectly accepts messages that end with a line feed LF instead of the proper line ending. When used with another server that also misinterprets this, it can lead to request smuggling—where an attacker tricks the system to se...
go-toolset:rhel8 security update
An update is available for module.go-toolset, golang, module.delve, go-toolset, module.golang, delve. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Go Toolset...
Exploit for OS Command Injection in Docker
This repository is an offensive tool for container exploitation. The primary capability of this tool is to perform a container breakout via exposed Docker daemons docker.sock, CVE-2019-5736, and privileged container breakout via enabled CAPS and SYSCALLS. It also extracts data from Linux Kernel...
net/http: Request smuggling due to acceptance of invalid chunked data in net/http
A flaw was found in the net/http golang package. The net/http package incorrectly accepts messages that end with a line feed LF instead of the proper line ending. When used with another server that also misinterprets this, it can lead to request smuggling—where an attacker tricks the system to se...
The vulnerability of the implementation package for the JWE, JWS, and JWT go-jose standards in the Go programming language lies in its uncontrolled resource consumption, allowing attackers to cause service failures.
The vulnerability of the implementation package for the JWE, JWS, and JWT go-jose standards in the Go programming language is related to an uncontrolled resource consumption. Exploiting this vulnerability could allow a malicious actor to cause service failures...
The vulnerability of the Golang programming language, related to insufficient protection of sensitive data, allows attackers to gain access to potentially confidential information.
The vulnerability of the Golang programming language is related to the insufficient protection of sensitive data. Exploiting this vulnerability can allow an attacker, operating remotely, to gain access to potentially confidential information...
The vulnerability of the parse.ParseUnverified() function in the golang-jwt library for handling web tokens allows attackers to disclose sensitive information that should be protected.
The vulnerability of the parse.ParseUnverified function in the golang-jwt library for handling web tokens in the Go programming language is related to uncontrolled resource consumption. Exploiting this vulnerability allows an attacker to disclose protected information...
The vulnerability of the Golang programming language, related to improper validation of input data, allows attackers to execute arbitrary code.
The vulnerability of the Golang programming language is related to incorrect validation of input data. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
OESA-2025-1749 golang security update
. Security Fixes: Proxy-Authorization and Proxy-Authenticate headers persisted on cross-origin redirects potentially leaking sensitive information.CVE-2025-4673...
Sensitive headers not cleared on cross-origin redirect in net/http
...
net/http: Request smuggling due to acceptance of invalid chunked data in net/http
A flaw was found in the net/http golang package. The net/http package incorrectly accepts messages that end with a line feed LF instead of the proper line ending. When used with another server that also misinterprets this, it can lead to request smuggling—where an attacker tricks the system to se...
crypto/x509: Usage of ExtKeyUsageAny disables policy validation in crypto/x509
A flaw was found in Go's crypto/x509 package. This vulnerability allows improper certificate validation, bypassing policy constraints via using ExtKeyUsageAny in VerifyOptions.KeyUsages...
net/http: Request smuggling due to acceptance of invalid chunked data in net/http
A flaw was found in the net/http golang package. The net/http package incorrectly accepts messages that end with a line feed LF instead of the proper line ending. When used with another server that also misinterprets this, it can lead to request smuggling—where an attacker tricks the system to se...
OPENSUSE-SU-2025:15224-1 go1.24-1.24.4-1.1 on GA media
These are all security issues fixed in the go1.24-1.24.4-1.1 package on the GA media of openSUSE Tumbleweed...
The vulnerabilities of the Go programming language’s packages net/http, x/net/proxy, and x/net/http/httpproxy allow attackers to compromise the confidentiality and accessibility of protected information.
The vulnerability of the net/http, x/net/proxy, and x/net/http/httpproxy libraries in the Go programming language is related to incorrect matching of hosts with proxy server templates. Exploiting this vulnerability can allow an attacker to compromise the confidentiality and accessibility of...
GHSA-H34R-JXQM-QGPR juju/utils leaks private key in certs
Summary Certs generated by v4 contain their private key. Details Background Recently, I encountered an API in Go that’s easy to misuse: sha512.Sum384 and sha512.New384.Sum look very similar and behave very differently. https://go.dev/play/p/kDCqqoYk84k demonstrates this. I want to discuss extendi...