The net/http package in Go through 1.6 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect a CGI application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue.

...

Unsanitized NUL in environment variables on Windows in syscall and os/exec

...

An unintended cleartext issue exists in Go before 1.8.4 and 1.9.x before 1.9.1. RFC 4954 requires that, during SMTP, the PLAIN auth scheme must only be used on network connections secured with TLS. The original implementation of smtp.PlainAuth in Go 1.0 enforced this requirement, and it was documented to do so. In 2013, upstream issue #5184, this was changed so that the server may decide whether PLAIN is acceptable. The result is that if you set up a man-in-the-middle SMTP server that doesn't advertise STARTTLS and does advertise that PLAIN auth is OK, the smtp.PlainAuth implementation sends the username and password.

...

On Darwin, user's trust preferences for root certificates were not honored. If the user had a root certificate loaded in their Keychain that was explicitly not trusted, a Go program would still verify a connection using that root certificate.

...

Go before 1.10.8 and 1.11.x before 1.11.5 mishandles P-521 and P-384 elliptic curves, which allows attackers to cause a denial of service (CPU consumption) or possibly conduct ECDH private key recovery attacks.

...

Linux Distros Unpatched Vulnerability : CVE-2016-5386

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The net/http package in Go through 1.6 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications...

Linux Distros Unpatched Vulnerability : CVE-2018-6574

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Go before 1.8.7, Go 1.9.x before 1.9.4, and Go 1.10 pre-releases before Go 1.10rc2 allow go get remote command execution during source code build, by leveraging...

Linux Distros Unpatched Vulnerability : CVE-2017-8932

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A bug in the standard library ScalarMult implementation of curve P-256 for amd64 architectures in Go before 1.7.6 and 1.8.x before 1.8.2 causes incorrect result...

Linux Distros Unpatched Vulnerability : CVE-2015-5741

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The net/http library in net/http/transfer.go in Go before 1.4.3 does not properly parse HTTP headers, which allows remote attackers to conduct HTTP request...

ROS-20250903-02

The vulnerability in the go-git library is related to input validation errors when processing directory traversal sequences. Exploitation of the vulnerability could allow an attacker acting remotely to perform directory traversal attacks...

Linux Distros Unpatched Vulnerability : CVE-2015-5739

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The net/http library in net/textproto/reader.go in Go before 1.4.3 does not properly parse HTTP header keys, which allows remote attackers to conduct HTTP reque...

Linux Distros Unpatched Vulnerability : CVE-2015-5740

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The net/http library in net/http/transfer.go in Go before 1.4.3 does not properly parse HTTP headers, which allows remote attackers to conduct HTTP request...

Linux Distros Unpatched Vulnerability : CVE-2017-15041

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Go before 1.8.4 and 1.9.x before 1.9.1 allows go get remote command execution. Using custom domains, it is possible to arrange things so that example.com/pkg1...

Linux Distros Unpatched Vulnerability : CVE-2017-15042

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An unintended cleartext issue exists in Go before 1.8.4 and 1.9.x before 1.9.1. RFC 4954 requires that, during SMTP, the PLAIN auth scheme must only be used on...

SUSE-SU-2025:03046-1 Security update for govulncheck-vulndb

This update for govulncheck-vulndb fixes the following issues: Update to version 0.0.20250829T154226 2025-08-29T15:42:26Z jscPED-11136. Go CVE Numbering Authority IDs added or updated with aliases: GO-2025-3884 GO-2025-3892 GO-2025-3893 GO-2025-3894 GO-2025-3895 GO-2025-3896 GO-2025-3897...

MGASA-2025-0221 Updated golang packages fix vulnerabilities

LookPath may return unexpected paths, CVE-2025-47906. incorrect results returned from Rows.Scan, CVE-2025-47907. These packages fix the issues for the compiler only; applications using the functions still need to be rebuilt...

Malicious code in monolith-twirp-merge-queue-go-mergequeueservice (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 3e907c6e8d9b369e32e165c27d2a66931e8ecbb4b256a932542731234e6cf8da The OpenSSF Package Analysis project identified 'monolith-twirp-merge-queue-go-mergequeueservice' @ 1.0.2 rubygems as malicious. It is considere...

MAL-2025-46932 Malicious code in monolith-twirp-merge-queue-go-mergequeueservice (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 3e907c6e8d9b369e32e165c27d2a66931e8ecbb4b256a932542731234e6cf8da The OpenSSF Package Analysis project identified 'monolith-twirp-merge-queue-go-mergequeueservice' @ 1.0.2 rubygems as malicious. It is considere...

CVE-2025-47909

Hosts listed in TrustedOrigins implicitly allow requests from the corresponding HTTP origins, allowing network MitMs to perform CSRF attacks. After the CVE-2025-24358 fix, a network attacker that places a form at http://example.com can't get it to submit to https://example.com because the Origin...

Linux Distros Unpatched Vulnerability : CVE-2025-8959

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - HashiCorp's go-getter library subdirectory download feature is vulnerable to symlink attacks leading to unauthorized read access beyond the designated directory...