Vulnerabilities in Go standard library
135 resultsCVE-2026-32280HIGHUnexpected work during chain building in crypto/x509EPSS 0.6%CVE-2026-56866HIGHHTTP/1 client connection desynchronization after CONNECT rejection in net/httpEPSS 0.6%CVE-2025-22865HIGHParsePKCS1PrivateKey panic with partial keys in crypto/x509EPSS 0.6%CVE-2026-27145MEDIUMInefficient candidate hostname parsing in crypto/x509EPSS 0.6%CVE-2026-56853HIGHApply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/httpEPSS 0.6%CVE-2026-33818HIGHEnforce maximum recursion depth in encoding/asn1EPSS 0.6%CVE-2026-56859HIGHAdd recursion depth guard during decode in encoding/xmlEPSS 0.6%CVE-2026-56862HIGHLimit handshake messages we are willing to accept post-handshake in crypto/tlsEPSS 0.6%CVE-2025-58186MEDIUMLack of limit when parsing cookies can cause memory exhaustion in net/httpEPSS 0.6%CVE-2026-42504HIGHQuadratic complexity in WordDecoder.DecodeHeader in mimeEPSS 0.6%CVE-2025-61724MEDIUMExcessive CPU consumption in Reader.ReadResponse in net/textprotoEPSS 0.6%CVE-2024-45341MEDIUMUsage of IPv6 zone IDs can bypass URI name constraints in crypto/x509EPSS 0.6%CVE-2025-58185MEDIUMParsing DER payload can cause memory exhaustion in encoding/asn1EPSS 0.6%CVE-2026-56857CRITICALRoot.Mkdir(All) can follow junctions out of the root on Windows in osEPSS 0.6%CVE-2025-47906MEDIUMUnexpected paths returned from LookPath in os/execEPSS 0.5%CVE-2026-56860MEDIUMAvoid quadratic complexity in resolvePath in net/urlEPSS 0.5%CVE-2026-46600HIGHParsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessageEPSS 0.5%CVE-2026-78660HIGHHTTP/2 transport accepts malformed framing-related headers in net/httpEPSS 0.5%CVE-2026-94439HIGHHTTP/1 server connection desynchronization after 2xx CONNECT response in net/httpEPSS 0.5%CVE-2025-61729HIGHExcessive resource consumption when printing error string for host certificate validation in crypto/x509EPSS 0.5%