| Bug | bullseye | Description |
|---|
| CVE-2023-39325 | vulnerable (no DSA) | A malicious HTTP/2 client which rapidly creates requests and immediate ... |
| CVE-2023-39323 | vulnerable (no DSA) | Line directives ("//line") can be used to bypass the restrictions on " ... |
| CVE-2023-39319 | vulnerable (no DSA) | The html/template package does not apply the proper rules for handling ... |
| CVE-2023-39318 | vulnerable (no DSA) | The html/template package does not properly handle HTML-like "" commen ... |
| CVE-2023-29409 | vulnerable (no DSA) | Extremely large RSA keys in certificate chains can cause a client/serv ... |
| CVE-2023-29406 | vulnerable (no DSA) | The HTTP/1 client does not fully validate the contents of the Host hea ... |
| CVE-2023-29405 | vulnerable (no DSA) | The go command may execute arbitrary code at build time when using cgo ... |
| CVE-2023-29404 | vulnerable (no DSA) | The go command may execute arbitrary code at build time when using cgo ... |
| CVE-2023-29403 | vulnerable (no DSA) | On Unix platforms, the Go runtime does not behave differently when a b ... |
| CVE-2023-29402 | vulnerable (no DSA) | The go command may generate unexpected code at build time when using c ... |
| CVE-2023-29400 | vulnerable (no DSA) | Templates containing actions in unquoted HTML attributes (e.g. "attr={ ... |
| CVE-2023-24540 | vulnerable (no DSA) | Not all valid JavaScript whitespace characters are considered to be wh ... |
| CVE-2023-24539 | vulnerable (no DSA) | Angle brackets (<>) are not considered dangerous characters when inser ... |
| CVE-2023-24538 | vulnerable (no DSA) | Templates do not properly consider backticks (`) as Javascript string ... |
| CVE-2023-24537 | vulnerable (no DSA) | Calling any of the Parse functions on Go source code which contains // ... |
| CVE-2023-24536 | vulnerable (no DSA) | Multipart form parsing can consume large amounts of CPU and memory whe ... |
| CVE-2023-24534 | vulnerable (no DSA) | HTTP and MIME header parsing can allocate large amounts of memory, eve ... |
| CVE-2023-24532 | vulnerable (no DSA) | The ScalarMult and ScalarBaseMult methods of the P256 Curve may return ... |
| CVE-2022-41725 | vulnerable (no DSA) | A denial of service is possible from excessive resource consumption in ... |
| CVE-2022-41724 | vulnerable (no DSA) | Large handshake records may cause panics in crypto/tls. Both clients a ... |
| CVE-2022-41723 | vulnerable (no DSA) | A maliciously crafted HTTP/2 stream could cause excessive CPU consumpt ... |
| CVE-2022-41717 | vulnerable (no DSA) | An attacker can cause excessive memory growth in a Go server accepting ... |
| CVE-2022-41715 | vulnerable (no DSA) | Programs which compile regular expressions from untrusted sources may ... |
| CVE-2022-32189 | vulnerable (no DSA) | A too-short encoded message can cause a panic in Float.GobDecode and R ... |
| CVE-2022-32148 | vulnerable (no DSA) | Improper exposure of client IP addresses in net/http before Go 1.17.12 ... |
| CVE-2022-30635 | vulnerable (no DSA) | Uncontrolled recursion in Decoder.Decode in encoding/gob before Go 1.1 ... |
| CVE-2022-30633 | vulnerable (no DSA) | Uncontrolled recursion in Unmarshal in encoding/xml before Go 1.17.12 ... |
| CVE-2022-30632 | vulnerable (no DSA) | Uncontrolled recursion in Glob in path/filepath before Go 1.17.12 and ... |
| CVE-2022-30631 | vulnerable (no DSA) | Uncontrolled recursion in Reader.Read in compress/gzip before Go 1.17. ... |
| CVE-2022-30629 | vulnerable (no DSA) | Non-random values for ticket_age_add in session tickets in crypto/tls ... |
| CVE-2022-29526 | vulnerable (no DSA) | Go before 1.17.10 and 1.18.x before 1.18.2 has Incorrect Privilege Ass ... |
| CVE-2022-28131 | vulnerable (no DSA) | Uncontrolled recursion in Decoder.Skip in encoding/xml before Go 1.17. ... |
| CVE-2022-27664 | vulnerable (no DSA) | In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers ca ... |
| CVE-2022-2880 | vulnerable (no DSA) | Requests forwarded by ReverseProxy include the raw query parameters fr ... |
| CVE-2022-2879 | vulnerable (no DSA) | Reader.Read does not set a limit on the maximum size of file headers. ... |
| CVE-2022-1962 | vulnerable (no DSA) | Uncontrolled recursion in the Parse functions in go/parser before Go 1 ... |
| CVE-2022-1705 | vulnerable (no DSA) | Acceptance of some invalid Transfer-Encoding headers in the HTTP/1 cli ... |
| CVE-2021-29923 | vulnerable (no DSA) | Go before 1.17 does not properly consider extraneous zero characters a ... |
| Bug | bullseye | Description |
|---|
| CVE-2023-45284 | vulnerable | On Windows, The IsLocal function does not correctly detect reserved de ... |
| CVE-2023-45283 | vulnerable | The filepath package does not recognize paths with a \??\ prefix as sp ... |
| CVE-2022-41722 | vulnerable | A path traversal vulnerability exists in filepath.Clean on Windows. On ... |
| CVE-2022-41720 | vulnerable | On Windows, restricted files can be accessed via os.DirFS and http.Dir ... |
| CVE-2022-41716 | vulnerable | Due to unsanitized NUL values, attackers may be able to maliciously se ... |
| CVE-2020-29511 | vulnerable | The encoding/xml package in Go (all versions) does not correctly prese ... |
| CVE-2020-29510 | vulnerable | The encoding/xml package in Go versions 1.15 and earlier does not corr ... |
| CVE-2020-29509 | vulnerable | The encoding/xml package in Go (all versions) does not correctly prese ... |
| Bug | Description |
|---|
| CVE-2022-32190 | JoinPath and URL.JoinPath do not remove ../ path elements appended to ... |
| CVE-2022-30634 | Infinite loop in Read in crypto/rand before Go 1.17.11 and Go 1.18.3 o ... |
| CVE-2022-30630 | Uncontrolled recursion in Glob in io/fs before Go 1.17.12 and Go 1.18. ... |
| CVE-2022-30580 | Code injection in Cmd.Start in os/exec before Go 1.17.11 and Go 1.18.3 ... |
| CVE-2022-29804 | Incorrect conversion of certain invalid paths to valid, absolute paths ... |
| CVE-2022-24921 | regexp.Compile in Go before 1.16.15 and 1.17.x before 1.17.8 allows st ... |
| CVE-2022-23806 | Curve.IsOnCurve in crypto/elliptic in Go before 1.16.14 and 1.17.x bef ... |
| CVE-2022-23773 | cmd/go in Go before 1.16.14 and 1.17.x before 1.17.7 can misinterpret ... |
| CVE-2022-23772 | Rat.SetString in math/big in Go before 1.16.14 and 1.17.x before 1.17. ... |
| CVE-2021-44717 | Go before 1.16.12 and 1.17.x before 1.17.5 on UNIX allows write operat ... |
| CVE-2021-44716 | net/http in Go before 1.16.12 and 1.17.x before 1.17.5 allows uncontro ... |
| CVE-2021-41772 | Go before 1.16.10 and 1.17.x before 1.17.3 allows an archive/zip Reade ... |
| CVE-2021-41771 | ImportedSymbols in debug/macho (for Open or OpenFat) in Go before 1.16 ... |
| CVE-2021-39293 | In archive/zip in Go before 1.16.8 and 1.17.x before 1.17.1, a crafted ... |
| CVE-2021-38297 | Go before 1.16.9 and 1.17.x before 1.17.2 has a Buffer Overflow via la ... |
| CVE-2021-36221 | Go before 1.15.15 and 1.16.x before 1.16.7 has a race condition that c ... |
| CVE-2021-34558 | The crypto/tls package of Go through 1.16.5 does not properly assert t ... |
| CVE-2021-33198 | In Go before 1.15.13 and 1.16.x before 1.16.5, there can be a panic fo ... |
| CVE-2021-33197 | In Go before 1.15.13 and 1.16.x before 1.16.5, some configurations of ... |
| CVE-2021-33196 | In archive/zip in Go before 1.15.13 and 1.16.x before 1.16.5, a crafte ... |
| CVE-2021-33195 | Go before 1.15.13 and 1.16.x before 1.16.5 has functions for DNS looku ... |
| CVE-2021-31525 | net/http in Go before 1.15.12 and 1.16.x before 1.16.4 allows remote a ... |
| CVE-2021-27919 | archive/zip in Go 1.16.x before 1.16.1 allows attackers to cause a den ... |
| CVE-2021-27918 | encoding/xml in Go before 1.15.9 and 1.16.x before 1.16.1 has an infin ... |
| CVE-2021-3115 | Go before 1.14.14 and 1.15.x before 1.15.7 on Windows is vulnerable to ... |
| CVE-2021-3114 | In Go before 1.14.14 and 1.15.x before 1.15.7, crypto/elliptic/p224.go ... |
| CVE-2020-28367 | Code injection in the go command with cgo before Go 1.14.12 and Go 1.1 ... |
| CVE-2020-28366 | Code injection in the go command with cgo before Go 1.14.12 and Go 1.1 ... |
| CVE-2020-28362 | Go before 1.14.12 and 1.15.x before 1.15.4 allows Denial of Service. |
| CVE-2020-24553 | Go before 1.14.8 and 1.15.x before 1.15.1 allows XSS because text/html ... |
| CVE-2020-16845 | Go before 1.13.15 and 14.x before 1.14.7 can have an infinite read loo ... |
| CVE-2020-15586 | Go before 1.13.13 and 1.14.x before 1.14.5 has a data race in some net ... |
| CVE-2020-14039 | In Go before 1.13.13 and 1.14.x before 1.14.5, Certificate.Verify may ... |