Vulnerabilidades em Go standard library
121 resultadosAnálise Vexday
Com 111 CVEs catalogadas e nenhuma confirmada em exploração ativa segundo o CISA KEV, a Go standard library apresenta taxa de exploração abaixo da média geral do catálogo, o que não elimina riscos relevantes. O score EPSS de 0,9197 associado a CVE-2023-45288 indica alta probabilidade estimada de exploração para essa vulnerabilidade específica, exigindo atenção prioritária. O tipo de falha mais frequente é CWE-94 (injeção de código), e a existência de 2 CVEs com prova de conceito pública amplia a superfície de risco para equipes que ainda não aplicaram as correções correspondentes. As 18 vulnerabilidades surgidas nos últimos 90 dias reforçam a necessidade de monitoramento contínuo, dado o ritmo recente de descobertas.
CVE-2026-42504HIGHQuadratic complexity in WordDecoder.DecodeHeader in mimeEPSS 0.6%CVE-2025-47906MEDIUMUnexpected paths returned from LookPath in os/execEPSS 0.5%CVE-2026-46600HIGHParsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessageEPSS 0.5%CVE-2025-58186MEDIUMLack of limit when parsing cookies can cause memory exhaustion in net/httpEPSS 0.5%CVE-2025-61724MEDIUMExcessive CPU consumption in Reader.ReadResponse in net/textprotoEPSS 0.5%CVE-2025-58185MEDIUMParsing DER payload can cause memory exhaustion in encoding/asn1EPSS 0.5%CVE-2026-56860MEDIUMAvoid quadratic complexity in resolvePath in net/urlEPSS 0.5%CVE-2024-45341MEDIUMUsage of IPv6 zone IDs can bypass URI name constraints in crypto/x509EPSS 0.5%CVE-2025-61729HIGHExcessive resource consumption when printing error string for host certificate validation in crypto/x509EPSS 0.5%CVE-2024-24789MEDIUMMishandling of corrupt central directory record in archive/zipEPSS 0.4%CVE-2025-47912MEDIUMInsufficient validation of bracketed IPv6 hostnames in net/urlEPSS 0.4%CVE-2025-58189MEDIUMALPN negotiation error contains attacker controlled information in crypto/tlsEPSS 0.4%CVE-2023-29403HIGHUnsafe behavior in setuid/setgid binaries in runtimeEPSS 0.4%CVE-2025-58183MEDIUMUnbounded allocation when parsing GNU sparse map in archive/tarEPSS 0.4%CVE-2025-22870MEDIUMHTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/netEPSS 0.4%CVE-2026-39825MEDIUMReverseProxy forwards queries with more than urlmaxqueryparams parameters in net/http/httputilEPSS 0.4%CVE-2026-42505MEDIUMInvoking Encrypted Client Hello privacy leak in crypto/tlsEPSS 0.4%CVE-2025-58187HIGHQuadratic complexity when checking name constraints in crypto/x509EPSS 0.4%CVE-2025-22874HIGHUsage of ExtKeyUsageAny disables policy validation in crypto/x509EPSS 0.4%CVE-2026-39826MEDIUMEscaper bypass leads to XSS in html/templateEPSS 0.4%