GO-2021-0245 Panic in ReverseProxy in net/http/httputil

ReverseProxy can panic after encountering a problem copying a proxied response body...

GO-2021-0172 Denial of service when parsing large forms in mime/multipart

When parsing large multipart/form-data, an attacker can cause a HTTP server to open a large number of file descriptors. This may be used as a denial-of-service vector...

GO-2022-0643 Denial of service in github.com/elastic/beats

A local attacker can cause a panic if they are able to send arbitrary traffic to a monitored port, due to an out of bounds read...

GO-2022-0629 Directory traversal in sigs.k8s.io/secrets-store-csi-driver

Modifying pod status allows host directory traversal. Kubernetes Secrets Store CSI Driver allows an attacker who can modify a SecretProviderClassPodStatus/Status resource the ability to write content to the host filesystem and sync file contents to Kubernetes Secrets. This includes paths under...

GO-2022-0701 Directory traversal in k8s.io/kubernetes

Crafted object type names can cause directory traversal in Kubernetes. Object names are not validated before being passed to etcd. This allows attackers to write arbitrary files via a crafted object name, hence causing directory traversal vulnerability in Kubernetes, as used in Red Hat OpenShift...

GO-2022-0425 Weak encryption and denial of service in github.com/flynn/noise

The Noise protocol implementation suffers from weakened cryptographic security after encrypting 2^64 messages, and a potential denial of service attack. After 2^64 18.4 quintillion messages are encrypted with the Encrypt function, the nonce counter will wrap around, causing multiple messages to b...

GO-2022-0646 CBC padding oracle issue in AWS S3 Crypto SDK for golang in github.com/aws/aws-sdk-go

A padding oracle vulnerability exists in the AWS S3 Crypto SDK for GoLang versions prior to V2. The SDK allows users to encrypt files with AES-CBC without computing a Message Authentication Code MAC, which then allows an attacker who has write access to the target's S3 bucket and can observe...

GO-2022-0563 Cross-site request forgery in github.com/filebrowser/filebrowser/v2

A Cross-Site Request Forgery vulnerability exists in Filebrowser that allows attackers to create a backdoor user with admin privilege and get access to the filesystem via a malicious HTML webpage that is sent to the victim...

GO-2021-0258 Incorrect authorization in github.com/pomerium/pomerium

Pomerium is an open source identity-aware access proxy. Changes to the OIDC claims of a user after initial login are not reflected in policy evaluation when using allowedidpclaims as part of policy. If using allowedidpclaims and a user's claims are changed, Pomerium can make incorrect authorizati...

GO-2021-0228 Path traversal in github.com/unknwon/cae

The ExtractTo function doesn't securely escape file paths in zip archives which include leading or non-leading "..". This allows an attacker to add or replace files system-wide...

GO-2021-0264 Panic when opening certain archives in archive/zip

Previously, opening a zip with Reader.Open could result in a panic if the zip contained a file whose name was exclusively made up of slash characters or ".." path elements. Open could also panic if passed the empty string directly as an argument. Now, any files in the zip whose name could not be...

GO-2021-0263 Panic on invalid symbol tables in debug/macho

Calling File.ImportedSymbols on a loaded file which contains an invalid dynamic symbol table command can cause a panic, in particular if the encoded number of undefined symbols is larger than the number of symbols in the symbol table...

GO-2021-0226 Cross-site scripting in net/http/cgi and net/http/fcgi

When a Handler does not explicitly set the Content-Type header, the the package would default to “text/html”, which could cause a Cross-Site Scripting vulnerability if an attacker can control any part of the contents of a response. The Content-Type header is now set based on the contents of the...

GO-2021-0225

Certain invalid inputs to ReadUvarint or ReadVarint could cause those functions to read an unlimited number of bytes from the ByteReader argument before returning an error. This could lead to processing more input than expected when the caller is reading directly from a network and depends on...

GO-2021-0237 Open redirect in github.com/AndrewBurian/powermux

Attackers may be able to craft phishing links and other open redirects by exploiting PowerMux's trailing slash redirection feature. This may lead to users being redirected to untrusted sites after following an attacker crafted link...

GO-2021-0178 Cleartext transmission of credentials in net/smtp

SMTP clients using net/smtp can use the PLAIN authentication scheme on network connections not secured with TLS, exposing passwords to man-in-the-middle SMTP servers...

GO-2021-0163 Privilege escalation on Windows via malicious DLL in syscall

Untrusted search path vulnerability on Windows related to LoadLibrary allows local users to gain privileges via a malicious DLL in the current working directory...

GO-2021-0159 Request smuggling due to improper header parsing in net/http

HTTP headers were not properly parsed, which allows remote attackers to conduct HTTP request smuggling attacks via a request that contains Content-Length and Transfer-Encoding header fields...

GO-2021-0157

The MIME header parser treated spaces and hyphens as equivalent, which can permit HTTP request smuggling...

GO-2021-0160 Incorrect calculation affecting RSA computations in math/big

Int.Exp Montgomery mishandled carry propagation and produced an incorrect output, which makes it easier for attackers to obtain private RSA keys via unspecified vectors. This issue can affect RSA computations in crypto/rsa, which is used by crypto/tls. TLS servers on 32-bit systems could plausibl...

GO-2021-0141

A Go HTTP server which reads from the request body while simultaneously writing a response can panic when clients send a "Expect: 100-continue" header...

GO-2021-0140

X509 Certificate verification does not validate KeyUsages EKU requirements on Windows if VerifyOptions.Roots is nil...

GO-2021-0113 Out-of-bounds read in golang.org/x/text/language

Due to improper index calculation, an incorrectly formatted language tag can cause Parse to panic via an out of bounds read. If Parse is used to process untrusted user inputs, this may be used as a vector for a denial of service attack...

GO-2021-0108 CRLF vulnerability in Fiber in github.com/gofiber/fiber

Due to improper input sanitization, a maliciously constructed filename could cause a file download to use an attacker controlled filename, as well as injecting additional headers into an HTTP response...

GO-2021-0112 Improper input validation in go.mongodb.org/mongo-driver

Due to improper input sanitization when marshalling Go objects into BSON, a maliciously constructed Go structure could allow an attacker to inject additional fields into a MongoDB document. Users are affected if they use this package to handle untrusted user input...

GO-2021-0107 Panic or authentication bypass in github.com/ecnepsnai/web

Web Sockets do not execute any AuthenticateMethod methods which may be set, leading to a nil pointer dereference if the returned UserData pointer is assumed to be non-nil, or authentication bypass. This issue only affects WebSockets with an AuthenticateMethod hook. Request handlers that do not...

GO-2021-0111

Due to improper input sanitization when marshalling Go objects into BSON, a maliciously constructed Go structure could allow an attacker to inject additional fields into a MongoDB document. Users are affected if they use this package to handle untrusted user input...

GO-2021-0105 Consensus flaw in github.com/ethereum/go-ethereum

Due to an incorrect state calculation, a specific set of transactions could cause a consensus disagreement, causing users of this package to reject a canonical chain...

GO-2021-0101 Panic due to out-of-bounds read in github.com/apache/thrift

Due to an improper bounds check, parsing maliciously crafted messages can cause panics. If this package is used to parse untrusted input, this may be used as a vector for a denial of service attack...

GO-2021-0103 Denial of service in github.com/holiman/uint256

Due to improper bounds checking, certain mathematical operations can cause a panic via an out of bounds read. If this package is used to process untrusted user inputs, this may be used as a vector for a denial of service attack...

GO-2021-0104 Authorization bypass in github.com/pion/webrtc/v3

Due to improper error handling, DTLS connections were not killed when certificate verification failed, causing users who did not check the connection state to continue to use the connection. This could allow allow an attacker which holds the ICE password, but not a valid certificate, to bypass th...

GO-2021-0106 Path traversal in github.com/whyrusleeping/tar-utils

Due to improper path sanitization, archives containing relative file paths can cause files to be written or overwritten outside of the target directory...

GO-2021-0100 Denial of service via deadlock in github.com/containers/storage

Due to a goroutine deadlock, using github.com/containers/storage/pkg/archive.DecompressStream on a xz archive returns a reader which will hang indefinitely when Close is called. An attacker can use this to cause denial of service if they are able to cause the caller to attempt to decompress an...

GO-2021-0110 Token reuse in github.com/ory/fosite

Uniqueness of JWT IDs jti are not checked, allowing the JWT to be replayed...

GO-2021-0109 Improper handling of token revocation in github.com/ory/fosite

Due to improper error handling, an error with the underlying token storage may cause a user to believe a token has been successfully revoked when it is in fact still valid. An attackers ability to exploit this relies on an ability to trigger errors in the underlying storage...

GO-2021-0102 Panic in decryption in code.cloudfoundry.org/gorouter

Due to improper input validation, a maliciously crafted input can cause a panic, due to incorrect nonce size. If this package is used to decrypt user supplied messages without checking the size of supplied nonces, this may be used as a vector for a denial of service attack...

GO-2022-0762 Cross-site scripting due to incorrect sanitization in github.com/microcosm-cc/bluemonday

An XSS injection was possible because the sanitization of the Cyrillic character i bypass a protection mechanism against user-inputted HTML elements such as the tag...

GO-2022-0706 Information disclosure in go.elastic.co/apm

Sensitive HTTP headers may not be properly sanitized before being sent to the APM server if the program panics...

GO-2022-0755 Cross-site request forgery in github.com/rancher/rancher

Rancher 2 is vulnerable to a Cross-Site Websocket Hijacking attack that allows an exploiter to gain access to clusters managed by Rancher...

GO-2022-0621 Exposure of sensitive information in k8s.io/kube-state-metrics

Exposing annotations as metrics can leak secrets. An experimental feature of kube-state-metrics enables annotations to be exposed as metrics. By default, metrics only expose metadata about secrets. However, a combination of the default kubectl behavior and this new feature can cause the entire...

GO-2020-0008 Insecure generation of random numbers in github.com/miekg/dns

DNS message transaction IDs are generated using math/rand which makes them relatively predictable. This reduces the complexity of response spoofing attacks against DNS clients...

GO-2020-0026 Arbitrary file write via archive extraction in github.com/openshift/source-to-image

Due to improper path sanitization, archives containing relative file paths can cause files to be written or overwritten outside of the target directory...

GO-2020-0012 Panic due to improper verification of cryptographic signatures in golang.org/x/crypto/ssh

An attacker can craft an ssh-ed25519 or [email protected] public key, such that the library will panic when trying to verify a signature with it. If verifying signatures using user supplied public keys, this may be used as a denial of service vector...

GO-2021-0082 Denial of service via malicious message size declaration in github.com/facebook/fbthrift

Thrift Servers preallocate memory for the declared size of messages before checking the actual size of the message. This allows a malicious user to send messages that declare that they are significantly larger than they actually are, allowing them to force the server to allocate significant amoun...

GO-2020-0006 Denial of service via open idle connection in github.com/miekg/dns

An attacker may prevent TCP connections to a Server by opening a connection and leaving it idle, until the connection is closed by the server no other connections will be accepted...

GO-2021-0072 Uncontrolled resource allocation in github.com/docker/distribution

Various storage methods do not impose limits on how much content is accepted from user requests, allowing a malicious user to force the caller to allocate an arbitrary amount of memory...

GO-2020-0019 Integer overflow in github.com/gorilla/websocket

An attacker can craft malicious WebSocket frames that cause an integer overflow in a variable which tracks the number of bytes remaining. This may cause the server or client to get stuck attempting to read frames in a loop, which can be used as a denial of service vector...

GO-2021-0060 Authentication bypass in github.com/russellhaering/gosaml2

Due to the behavior of encoding/xml, a crafted XML document may cause XML Digital Signature validation to be entirely bypassed, causing an unsigned document to appear signed...

GO-2021-0085 Authorization bypass in github.com/opencontainers/runc

AppArmor restrictions may be bypassed due to improper validation of mount targets, allowing a malicious image to mount volumes over e.g. /proc...

GO-2021-0059 Panic due to improper input validation in Get in github.com/tidwall/gjson

Due to improper bounds checking, maliciously crafted JSON objects can cause an out-of-bounds panic. If parsing user input, this may be used as a denial of service vector...