| Bug | bookworm | Description |
|---|
| CVE-2025-22871 | vulnerable (no DSA) | The net/http package improperly accepts a bare LF as a line terminator ... |
| CVE-2025-22870 | vulnerable (no DSA) | Matching of hosts against proxy patterns can improperly treat an IPv6 ... |
| CVE-2025-22866 | vulnerable (no DSA) | Due to the usage of a variable time instruction in the assembly implem ... |
| CVE-2025-4674 | vulnerable (no DSA) | |
| CVE-2025-4673 | vulnerable (no DSA) | Proxy-Authorization and Proxy-Authenticate headers persisted on cross- ... |
| CVE-2024-45341 | vulnerable (no DSA) | A certificate with a URI which has a IPv6 address with a zone ID may i ... |
| CVE-2024-45336 | vulnerable (no DSA) | The HTTP client drops sensitive headers after following a cross-domain ... |
| CVE-2024-34158 | vulnerable (no DSA) | Calling Parse on a "// +build" build tag line with deeply nested expre ... |
| CVE-2024-34156 | vulnerable (no DSA) | Calling Decoder.Decode on a message which contains deeply nested struc ... |
| CVE-2024-34155 | vulnerable (no DSA) | Calling any of the Parse functions on Go source code which contains de ... |
| CVE-2024-24791 | vulnerable (no DSA) | The net/http HTTP/1.1 client mishandled the case where a server respon ... |
| CVE-2024-24790 | vulnerable (no DSA) | The various Is methods (IsPrivate, IsLoopback, etc) did not work as ex ... |
| CVE-2024-24789 | vulnerable (no DSA) | The archive/zip package's handling of certain types of invalid zip fil ... |
| CVE-2024-24785 | vulnerable (no DSA) | If errors returned from MarshalJSON methods contain user controlled da ... |
| CVE-2024-24784 | vulnerable (no DSA) | The ParseAddressList function incorrectly handles comments (text withi ... |
| CVE-2024-24783 | vulnerable (no DSA) | Verifying a certificate chain which contains a certificate with an unk ... |
| CVE-2023-45290 | vulnerable (no DSA) | When parsing a multipart form (either explicitly with Request.ParseMul ... |
| CVE-2023-45289 | vulnerable (no DSA) | When following an HTTP redirect to a domain which is not a subdomain m ... |
| CVE-2023-45288 | vulnerable (no DSA) | An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of ... |
| CVE-2023-45287 | vulnerable (no DSA) | Before Go 1.20, the RSA based TLS key exchanges used the math/big libr ... |
| CVE-2023-45285 | vulnerable (no DSA) | Using go get to fetch a module with the ".git" suffix may unexpectedly ... |
| CVE-2023-39326 | vulnerable (no DSA) | A malicious HTTP sender can use chunk extensions to cause a receiver r ... |
| CVE-2023-39325 | vulnerable (no DSA) | A malicious HTTP/2 client which rapidly creates requests and immediate ... |
| CVE-2023-39323 | vulnerable (no DSA) | Line directives ("//line") can be used to bypass the restrictions on " ... |
| CVE-2023-39319 | vulnerable (no DSA) | The html/template package does not apply the proper rules for handling ... |
| CVE-2023-39318 | vulnerable (no DSA) | The html/template package does not properly handle HTML-like "" commen ... |
| CVE-2023-29409 | vulnerable (no DSA) | Extremely large RSA keys in certificate chains can cause a client/serv ... |
| CVE-2023-29406 | vulnerable (no DSA) | The HTTP/1 client does not fully validate the contents of the Host hea ... |
| CVE-2023-29405 | vulnerable (no DSA) | The go command may execute arbitrary code at build time when using cgo ... |
| CVE-2023-29404 | vulnerable (no DSA) | The go command may execute arbitrary code at build time when using cgo ... |
| CVE-2023-29403 | vulnerable (no DSA) | On Unix platforms, the Go runtime does not behave differently when a b ... |
| CVE-2023-29402 | vulnerable (no DSA) | The go command may generate unexpected code at build time when using c ... |
| CVE-2023-29400 | vulnerable (no DSA) | Templates containing actions in unquoted HTML attributes (e.g. "attr={ ... |
| CVE-2023-24540 | vulnerable (no DSA) | Not all valid JavaScript whitespace characters are considered to be wh ... |
| CVE-2023-24539 | vulnerable (no DSA) | Angle brackets (<>) are not considered dangerous characters when inser ... |
| CVE-2023-24531 | vulnerable (no DSA) | Command go env is documented as outputting a shell script containing t ... |
| Bug | Description |
|---|
| CVE-2025-22874 | Calling Verify with a VerifyOptions.KeyUsages that contains ExtKeyUsag ... |
| CVE-2025-22873 | |
| CVE-2025-22865 | Using ParsePKCS1PrivateKey to parse a RSA key that is missing the CRT ... |
| CVE-2025-0913 | os.OpenFile(path, os.O_CREATE|O_EXCL) behaved differently on Unix and ... |
| CVE-2024-24788 | A malformed DNS message in response to a query can cause the Lookup fu ... |
| CVE-2024-24787 | On Darwin, building a Go module which contains CGO can trigger arbitra ... |
| CVE-2023-24538 | Templates do not properly consider backticks (`) as Javascript string ... |
| CVE-2023-24537 | Calling any of the Parse functions on Go source code which contains // ... |
| CVE-2023-24536 | Multipart form parsing can consume large amounts of CPU and memory whe ... |
| CVE-2023-24534 | HTTP and MIME header parsing can allocate large amounts of memory, eve ... |
| CVE-2023-24532 | The ScalarMult and ScalarBaseMult methods of the P256 Curve may return ... |
| CVE-2022-41725 | A denial of service is possible from excessive resource consumption in ... |
| CVE-2022-41724 | Large handshake records may cause panics in crypto/tls. Both clients a ... |
| CVE-2022-41723 | A maliciously crafted HTTP/2 stream could cause excessive CPU consumpt ... |
| CVE-2022-41722 | A path traversal vulnerability exists in filepath.Clean on Windows. On ... |
| CVE-2022-41720 | On Windows, restricted files can be accessed via os.DirFS and http.Dir ... |
| CVE-2022-41717 | An attacker can cause excessive memory growth in a Go server accepting ... |
| CVE-2022-41716 | Due to unsanitized NUL values, attackers may be able to maliciously se ... |
| CVE-2022-41715 | Programs which compile regular expressions from untrusted sources may ... |
| CVE-2022-32190 | JoinPath and URL.JoinPath do not remove ../ path elements appended to ... |
| CVE-2022-32189 | A too-short encoded message can cause a panic in Float.GobDecode and R ... |
| CVE-2022-32148 | Improper exposure of client IP addresses in net/http before Go 1.17.12 ... |
| CVE-2022-30635 | Uncontrolled recursion in Decoder.Decode in encoding/gob before Go 1.1 ... |
| CVE-2022-30633 | Uncontrolled recursion in Unmarshal in encoding/xml before Go 1.17.12 ... |
| CVE-2022-30632 | Uncontrolled recursion in Glob in path/filepath before Go 1.17.12 and ... |
| CVE-2022-30631 | Uncontrolled recursion in Reader.Read in compress/gzip before Go 1.17. ... |
| CVE-2022-30630 | Uncontrolled recursion in Glob in io/fs before Go 1.17.12 and Go 1.18. ... |
| CVE-2022-27664 | In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers ca ... |
| CVE-2022-2880 | Requests forwarded by ReverseProxy include the raw query parameters fr ... |
| CVE-2022-2879 | Reader.Read does not set a limit on the maximum size of file headers. ... |
| CVE-2022-1962 | Uncontrolled recursion in the Parse functions in go/parser before Go 1 ... |
| CVE-2022-1705 | Acceptance of some invalid Transfer-Encoding headers in the HTTP/1 cli ... |