402 matches found
golang: net/url: Memory exhaustion in query parameter parsing in net/url
A flaw was found in the net/url package in the Go standard library. The package does not enforce a limit on the number of unique query parameters it parses. A Go application using the net/http.Request.ParseForm method will try to process all parameters provided in the request. A specially crafted...
CVE-2026-27896
The CVE-2026-27896 concerns the Go MCP SDK, affected in versions prior to 1.3.1, where Go’s json.Unmarshal (case-insensitive field matching) could accept non-standard JSON-RPC/MCP field casing. This violates JSON-RPC 2.0’s exact field names and could allow messages to bypass intermediary inspecti...
crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate
A flaw was found in golang. A remote attacker could exploit this vulnerability by providing a specially crafted certificate during the error string construction process within the HostnameError.Error function. This flaw, caused by unbounded string concatenation, leads to excessive resource...
ROS-20260209-73-0033
A vulnerability in the JWE, JWS, JWT go-jose standards suite implementation package for the Go programming language is related to incorrect processing of highly compressed input data. Exploitation of the vulnerability could allow an attacker acting remotely to cause a denial of service...
Google Go Denial of Service Vulnerability (CNVD-2026-10647)
Google Go is a static strongly typed, compiled, concatenated, and garbage-collected programming language from Google. A denial of service vulnerability exists in Google Go, which stems from the use of a hyperlinear filename indexing algorithm, and can be exploited by an attacker to cause a denial...
CLEANSTART-2026-ZO91195 go-redis is the official Redis client library for the Go programming language
Multiple security vulnerabilities affect the harbor-registry-fips package. go-redis is the official Redis client library for the Go programming language. See references for individual vulnerability details...
ROS-20260129-73-0064
A vulnerability in the HostnameError.Error function of the crypto/x509 package of the Go programming language is related to incorrect resource sweep or release. Exploitation of the vulnerability could allow an attacker acting remotely to cause a denial of service...
Google Go 安全漏洞
Google Go is a static strongly typed, compiled, concatenated, and garbage-collected programming language from Google. Google Go suffers from an information disclosure vulnerability that stems from an issue with the order in which messages across cryptographic level boundaries are processed during...
ALSA-2026:0922 Important: golang security update
The golang packages provide the Go programming language compiler. Security Fixes: crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate CVE-2025-61729 For more details about the security issues, including the impact, a CVSS score, acknowledgments, an...
golang: archive/tar: Unbounded allocation when parsing GNU sparse map
A flaw was found in the archive/tar package in the Go standard library. tar.Reader does not set a maximum size on the number of sparse region data blocks in GNU tar pax 1.0 sparse files. A specially crafted tar archive with a pax header indicating a big number of sparse regions can cause a Go...
container-tools:rhel8 security, bug fix, and enhancement update
An update is available for module.criu, module.libslirp, libslirp, criu. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The container-tools module contains tool...
ROS-20251124-04
Go programming language vulnerability is related to unrestricted resource allocation. Exploitation The vulnerability could allow an attacker acting remotely to cause a denial of service...
The vulnerability of the crypto/tls component in the Go programming language, which allows a perpetrator to disclose protected information
The vulnerability of the crypto/tls component in the Go programming language is related to errors in processing input data. Exploiting this vulnerability can allow a malicious actor to disclose sensitive information...
The vulnerability of the Go programming language’s encoding/ASN1 component, which allows a hacker to trigger a service failure.
The vulnerability of the Go programming language’s encoding/ASN1 component is related to the lack of memory release after the effective lifespan of the component. Exploiting this vulnerability can allow a remote attacker to cause a service failure...
The vulnerability of the Equal() function in the crypto-x509 component of the Go programming language allows a perpetrator to trigger a service failure.
The vulnerability of the Equal function in the crypto-x509 component of the Go programming language is related to improper cleaning or release of resources. Exploiting this vulnerability can allow an attacker, operating remotely, to cause service failures...
RHEL 10 : golang (RHSA-2025:21779)
The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:21779 advisory. The golang packages provide the Go programming language compiler. Security Fixes: golang: archive/tar: Unbounded allocation when parsing GNU sparse...
The vulnerability of the crypto-x509 component in the Go programming language, which allows a perpetrator to trigger a service failure
The vulnerability of the crypto-x509 component in the Go programming language is related to an uncontrolled resource consumption. Exploiting this vulnerability could allow a malicious actor to cause service failures remotely...
SUSE SLED15 / SLES15 / openSUSE 15 Security Update : go1.24 (SUSE-SU-2025:3682-1)
The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:3682-1 advisory. go1.24.9 released 2025-10-13 includes fixes to the crypto/x509 package. bsc1236217 crypto/x509:...
ROS-20251008-07
Vulnerabilities The Go programming language vulnerability is related to synchronization errors when using a of a shared resource. Exploitation of the vulnerability could allow an attacker acting remotely to cause a denial of denial of service...
