Total 213 security vulnerabilities recorded for golang software and firmware.
Certificate verification can panic when a certificate in the chain has an empty DNS name and another certificate in the chain has excluded name constr...
When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but di...
url.Parse insufficiently validated the host/authority component and accepted some invalid URLs....
During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the re...
A discrepancy between how Go and C/C++ comments were parsed allowed for code smuggling into the resulting cgo binary....
It was possible to improperly access the parent directory of an os.Root by opening a filename ending in "../". For example, Root.Open("../") would ope...
Downloading and building modules with malicious version strings can cause local code execution. On systems with Mercurial (hg) installed, downloading ...
Building a malicious file with cmd/go can cause can cause a write to an attacker-controlled file with partial control of the file content. The "#cgo p...
During the TLS 1.3 handshake if multiple messages are sent in records that span encryption level boundaries (for instance the Client Hello and Encrypt...
archive/zip uses a super-linear file name indexing algorithm that is invoked the first time a file in an archive is opened. This can lead to a denial ...
The net/url package does not set a limit on the number of query parameters in a query. While the maximum size of query parameters in URLs is generally...
An excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate. For example a constraint...
Within HostnameError.Error(), when constructing an error string, there is no limit to the number of hosts that will be printed out. Furthermore, the e...
SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause un...
SSH Agent servers do not validate the size of messages when processing new identity requests, which may cause the program to panic if the message is m...
The Reader.ReadResponse function constructs a response string through repeated string concatenation of lines. When the number of lines in a response i...
The processing time for parsing some invalid inputs scales non-linearly with respect to the size of the input. This affects programs which parse untru...
When Conn.Handshake fails during ALPN negotiation the error contains attacker controlled information (the ALPN protocols sent by the client) which is ...
Validating certificate chains which contain DSA public keys can cause programs to panic, due to a interface cast that assumes they implement the Equal...
Due to the design of the name constraint checking algorithm, the processing time of some inputs scale non-linearly with respect to the size of the cer...
Parsing a maliciously crafted DER payload could allocate large amounts of memory, causing memory exhaustion....
The Parse function permits values other than IPv6 addresses to be included in square brackets within the host component of a URL. RFC 3986 permits IPv...
If the PATH environment variable contains paths which are executables (rather than just directories), passing certain strings to LookPath ("", ".", an...
Cancelling a query (e.g. by cancelling the context passed to one of the query methods) during a call to the Scan method of the returned Rows can resul...