Vulnerabilities in Go standard library
135 resultsCVE-2024-34155MEDIUMStack exhaustion in all Parse functions in go/parserEPSS 0.8%CVE-2026-25679HIGHIncorrect parsing of IPv6 host literals in net/urlEPSS 0.8%CVE-2023-24532—Incorrect calculation on P256 curves in crypto/internal/nistecEPSS 0.8%CVE-2026-42499HIGHQuadratic string concatenation in consumePhrase in net/mailEPSS 0.8%CVE-2024-24785MEDIUMErrors returned from JSON marshaling may break template escaping in html/templateEPSS 0.8%CVE-2026-39820HIGHQuadratic string concatentation in consumeComment in net/mailEPSS 0.8%CVE-2025-61728MEDIUMExcessive CPU consumption when building archive index in archive/zipEPSS 0.7%CVE-2026-97031HIGHReject malformed ECH outer extension references in crypto/tlsEPSS 0.7%CVE-2024-45336MEDIUMSensitive headers incorrectly sent after cross-domain redirect in net/httpEPSS 0.7%CVE-2026-94440HIGHMemory limit bypass when parsing MIME headers in net/textproto, mime/multipartEPSS 0.7%CVE-2022-30580HIGHEmpty Cmd.Path can trigger unintended binary in os/exec on WindowsEPSS 0.7%CVE-2026-97032HIGHHTTP/2 server crash due to HPACK encoder race in net/httpEPSS 0.7%CVE-2025-4673MEDIUMSensitive headers not cleared on cross-origin redirect in net/httpEPSS 0.7%CVE-2024-24783MEDIUMVerify panics on certificates with an unknown public key algorithm in crypto/x509EPSS 0.7%CVE-2026-78667HIGHLack of limit on size of parsed Range headers in net/httpEPSS 0.7%CVE-2025-61723HIGHQuadratic complexity when parsing some invalid inputs in encoding/pemEPSS 0.7%CVE-2026-27137HIGHIncorrect enforcement of email constraints in crypto/x509EPSS 0.7%CVE-2025-61725HIGHExcessive CPU consumption in ParseAddress in net/mailEPSS 0.6%CVE-2026-39836HIGHPanic in Dial and LookupPort when handling NUL byte on Windows in netEPSS 0.6%CVE-2026-32283HIGHUnauthenticated TLS 1.3 KeyUpdate record can cause persistent connection retention and DoS in crypto/tlsEPSS 0.6%