[ Vendor · 15 CVEs ]
Go standard library
CVEs affecting Go standard library published in the last 30 days, plus any Go standard library CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-111943 | 21 Oct 2026 | Not scored yet | Go standard library crypto/x509On most platforms, Go uses the given system root certificates. However, in some narrower cases, the system trust stores may not be updated without… | Fix |
| CVE-2026-97031 | 8 Oct 2026 | CVSS 7.5 | Go standard library crypto/tlsMultiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted packet that could trigger… | |
| CVE-2026-97032 | 8 Oct 2026 | CVSS 7.5 | Go standard library net/httpHTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the… | |
| CVE-2026-94448 | 8 Oct 2026 | CVSS 6.1 | Go standard library html/templateWhen a JavaScript template literal contains consecutive expressions, the context tracking state was not properly reset upon entering a new… | |
| CVE-2026-97030 | 8 Oct 2026 | CVSS 6.1 | Go standard library html/templateA trusted template author may have previously written a valid template wherein the use of the 'yield' keyword would not be correctly escaped. We now… | |
| CVE-2026-78669 | 8 Oct 2026 | CVSS 7.5 | Go standard library net/httpA malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small… | |
| CVE-2026-94439 | 8 Oct 2026 | CVSS 7.5 | Go standard library net/httpWhen an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly… | |
| CVE-2026-94440 | 8 Oct 2026 | CVSS 7.5 | Go standard library net/textprotoParsing a multipart form can bypass memory limits and read an arbitrarily long line into memory when the remaining limit at the start of a part is… | |
| CVE-2026-78659 | 8 Oct 2026 | CVSS 7.5 | Go standard library net/httpWhen "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the… | |
| CVE-2026-78660 | 8 Oct 2026 | CVSS 7.5 | Go standard library net/httpHistorically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2… | |
| CVE-2026-78663 | 8 Oct 2026 | CVSS 9.1 | Go standard library net/httpThe HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any… | |
| CVE-2026-78667 | 8 Oct 2026 | CVSS 7.5 | Go standard library net/httpWhen parsing a Range header containing a large number of small ranges, FileServer(FS), ServeContent, and ServeFile(FS) can consume an excessive… | |
| CVE-2026-56857 | 8 Oct 2026 | CVSS 9.8 | Go standard library osOn Windows, when the target of Root.Mkdir or Root.MkdirAll is a junction pointing to an empty location, the operation can create a directory at the… | |
| CVE-2026-56866 | 8 Oct 2026 | CVSS 7.5 | Go standard library net/httpWhen http.Transport sends an HTTP/1 CONNECT request with a non-empty Request.Body, it writes the body directly to the connection without framing… | |
| CVE-2026-39822 | 8 Jul 2026 | CVSS 7.8 | Go standard library osOn Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a… |