k2safe/go-omni
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(ws): release generic WebSocket client and server v0.31.0-preview

Browse Source
This commit is contained in:
k2safe
2026-10-29 19:20:12 +08:00
parent 19ee9746e9
commit 3272974bc1
58 changed files with 7654 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files

839
reports/websocket-vuln-go1.25.json Normal file
View File

@@ -0,0 +1,839 @@
{
"command": "go run golang.org/x/vuln/cmd/govulncheck@v1.1.4 -format=json ./ws/...",
"config": {
"protocol_version": "v1.0.0",
"scanner_name": "govulncheck",
"scanner_version": "v1.1.4",
"db": "https://vuln.go.dev",
"db_last_modified": "2026-10-27T21:16:18Z",
"go_version": "go1.25.0",
"scan_level": "symbol",
"scan_mode": "source"
},
"findings": [
{
"id": "GO-2025-3487",
"module": "golang.org/x/crypto",
"found": "v0.31.0",
"fixed": "v0.35.0",
"symbolReachable": false,
"summary": "Potential denial of service in golang.org/x/crypto"
},
{
"id": "GO-2025-4116",
"module": "golang.org/x/crypto",
"found": "v0.31.0",
"fixed": "v0.43.0",
"symbolReachable": false,
"summary": "Potential denial of service in golang.org/x/crypto/ssh/agent"
},
{
"id": "GO-2025-4134",
"module": "golang.org/x/crypto",
"found": "v0.31.0",
"fixed": "v0.45.0",
"symbolReachable": false,
"summary": "Unbounded memory consumption in golang.org/x/crypto/ssh"
},
{
"id": "GO-2025-4135",
"module": "golang.org/x/crypto",
"found": "v0.31.0",
"fixed": "v0.45.0",
"symbolReachable": false,
"summary": "Malformed constraint may cause denial of service in golang.org/x/crypto/ssh/agent"
},
{
"id": "GO-2026-5005",
"module": "golang.org/x/crypto",
"found": "v0.31.0",
"fixed": "v0.52.0",
"symbolReachable": false,
"summary": "Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent"
},
{
"id": "GO-2026-5006",
"module": "golang.org/x/crypto",
"found": "v0.31.0",
"fixed": "v0.52.0",
"symbolReachable": false,
"summary": "Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent"
},
{
"id": "GO-2026-5013",
"module": "golang.org/x/crypto",
"found": "v0.31.0",
"fixed": "v0.52.0",
"symbolReachable": false,
"summary": "Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh"
},
{
"id": "GO-2026-5014",
"module": "golang.org/x/crypto",
"found": "v0.31.0",
"fixed": "v0.52.0",
"symbolReachable": false,
"summary": "Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh"
},
{
"id": "GO-2026-5015",
"module": "golang.org/x/crypto",
"found": "v0.31.0",
"fixed": "v0.52.0",
"symbolReachable": false,
"summary": "Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh"
},
{
"id": "GO-2026-5016",
"module": "golang.org/x/crypto",
"found": "v0.31.0",
"fixed": "v0.52.0",
"symbolReachable": false,
"summary": "Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh"
},
{
"id": "GO-2026-5017",
"module": "golang.org/x/crypto",
"found": "v0.31.0",
"fixed": "v0.52.0",
"symbolReachable": false,
"summary": "Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh"
},
{
"id": "GO-2026-5018",
"module": "golang.org/x/crypto",
"found": "v0.31.0",
"fixed": "v0.52.0",
"symbolReachable": false,
"summary": "Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh"
},
{
"id": "GO-2026-5019",
"module": "golang.org/x/crypto",
"found": "v0.31.0",
"fixed": "v0.52.0",
"symbolReachable": false,
"summary": "Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh"
},
{
"id": "GO-2026-5020",
"module": "golang.org/x/crypto",
"found": "v0.31.0",
"fixed": "v0.52.0",
"symbolReachable": false,
"summary": "Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh"
},
{
"id": "GO-2026-5021",
"module": "golang.org/x/crypto",
"found": "v0.31.0",
"fixed": "v0.52.0",
"symbolReachable": false,
"summary": "Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts"
},
{
"id": "GO-2026-5023",
"module": "golang.org/x/crypto",
"found": "v0.31.0",
"fixed": "v0.52.0",
"symbolReachable": false,
"summary": "Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh"
},
{
"id": "GO-2026-5033",
"module": "golang.org/x/crypto",
"found": "v0.31.0",
"fixed": "v0.52.0",
"symbolReachable": false,
"summary": "Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent"
},
{
"id": "GO-2026-5932",
"module": "golang.org/x/crypto",
"found": "v0.31.0",
"fixed": null,
"symbolReachable": false,
"summary": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues"
},
{
"id": "GO-2026-6303",
"module": "golang.org/x/crypto",
"found": "v0.31.0",
"fixed": "v0.55.0",
"symbolReachable": false,
"summary": "Source-address critical option not enforced for non-public-key auth callbacks in golang.org/x/crypto/ssh"
},
{
"id": "GO-2026-6354",
"module": "golang.org/x/crypto",
"found": "v0.31.0",
"fixed": "v0.56.0",
"symbolReachable": false,
"summary": "Prevent DoS on deadlocked undecided channel in golang.org/x/crypto/ssh"
},
{
"id": "GO-2026-6355",
"module": "golang.org/x/crypto",
"found": "v0.31.0",
"fixed": "v0.56.0",
"symbolReachable": false,
"summary": "Prevent DoS on deadlocked established channel in golang.org/x/crypto/ssh"
},
{
"id": "GO-2025-3955",
"module": "stdlib",
"found": "v1.25.0",
"fixed": "v1.25.1",
"symbolReachable": false,
"summary": "CrossOriginProtection insecure bypass patterns not limited to exact matches in net/http"
},
{
"id": "GO-2025-4006",
"module": "stdlib",
"found": "v1.25.0",
"fixed": "v1.25.2",
"symbolReachable": false,
"summary": "Excessive CPU consumption in ParseAddress in net/mail"
},
{
"id": "GO-2025-4007",
"module": "stdlib",
"found": "v1.25.0",
"fixed": "v1.25.3",
"symbolReachable": true,
"summary": "Quadratic complexity when checking name constraints in crypto/x509"
},
{
"id": "GO-2025-4008",
"module": "stdlib",
"found": "v1.25.0",
"fixed": "v1.25.2",
"symbolReachable": true,
"summary": "ALPN negotiation error contains attacker controlled information in crypto/tls"
},
{
"id": "GO-2025-4009",
"module": "stdlib",
"found": "v1.25.0",
"fixed": "v1.25.2",
"symbolReachable": false,
"summary": "Quadratic complexity when parsing some invalid inputs in encoding/pem"
},
{
"id": "GO-2025-4010",
"module": "stdlib",
"found": "v1.25.0",
"fixed": "v1.25.2",
"symbolReachable": true,
"summary": "Insufficient validation of bracketed IPv6 hostnames in net/url"
},
{
"id": "GO-2025-4011",
"module": "stdlib",
"found": "v1.25.0",
"fixed": "v1.25.2",
"symbolReachable": true,
"summary": "Parsing DER payload can cause memory exhaustion in encoding/asn1"
},
{
"id": "GO-2025-4012",
"module": "stdlib",
"found": "v1.25.0",
"fixed": "v1.25.2",
"symbolReachable": true,
"summary": "Lack of limit when parsing cookies can cause memory exhaustion in net/http"
},
{
"id": "GO-2025-4013",
"module": "stdlib",
"found": "v1.25.0",
"fixed": "v1.25.2",
"symbolReachable": true,
"summary": "Panic when validating certificates with DSA public keys in crypto/x509"
},
{
"id": "GO-2025-4014",
"module": "stdlib",
"found": "v1.25.0",
"fixed": "v1.25.2",
"symbolReachable": false,
"summary": "Unbounded allocation when parsing GNU sparse map in archive/tar"
},
{
"id": "GO-2025-4015",
"module": "stdlib",
"found": "v1.25.0",
"fixed": "v1.25.2",
"symbolReachable": false,
"summary": "Excessive CPU consumption in Reader.ReadResponse in net/textproto"
},
{
"id": "GO-2025-4155",
"module": "stdlib",
"found": "v1.25.0",
"fixed": "v1.25.5",
"symbolReachable": true,
"summary": "Excessive resource consumption when printing error string for host certificate validation in crypto/x509"
},
{
"id": "GO-2025-4175",
"module": "stdlib",
"found": "v1.25.0",
"fixed": "v1.25.5",
"symbolReachable": true,
"summary": "Improper application of excluded DNS name constraints when verifying wildcard names in crypto/x509"
},
{
"id": "GO-2026-4337",
"module": "stdlib",
"found": "v1.25.0",
"fixed": "v1.25.7",
"symbolReachable": true,
"summary": "Unexpected session resumption in crypto/tls"
},
{
"id": "GO-2026-4340",
"module": "stdlib",
"found": "v1.25.0",
"fixed": "v1.25.6",
"symbolReachable": true,
"summary": "Handshake messages may be processed at the incorrect encryption level in crypto/tls"
},
{
"id": "GO-2026-4341",
"module": "stdlib",
"found": "v1.25.0",
"fixed": "v1.25.6",
"symbolReachable": false,
"summary": "Memory exhaustion in query parameter parsing in net/url"
},
{
"id": "GO-2026-4342",
"module": "stdlib",
"found": "v1.25.0",
"fixed": "v1.25.6",
"symbolReachable": false,
"summary": "Excessive CPU consumption when building archive index in archive/zip"
},
{
"id": "GO-2026-4601",
"module": "stdlib",
"found": "v1.25.0",
"fixed": "v1.25.8",
"symbolReachable": true,
"summary": "Incorrect parsing of IPv6 host literals in net/url"
},
{
"id": "GO-2026-4602",
"module": "stdlib",
"found": "v1.25.0",
"fixed": "v1.25.8",
"symbolReachable": true,
"summary": "FileInfo can escape from a Root in os"
},
{
"id": "GO-2026-4603",
"module": "stdlib",
"found": "v1.25.0",
"fixed": "v1.25.8",
"symbolReachable": false,
"summary": "URLs in meta content attribute actions are not escaped in html/template"
},
{
"id": "GO-2026-4864",
"module": "stdlib",
"found": "v1.25.0",
"fixed": "v1.25.9",
"symbolReachable": false,
"summary": "TOCTOU permits root escape on Linux via Root.Chmod in os in internal/syscall/unix"
},
{
"id": "GO-2026-4865",
"module": "stdlib",
"found": "v1.25.0",
"fixed": "v1.25.9",
"symbolReachable": false,
"summary": "JsBraceDepth Context Tracking Bugs (XSS) in html/template"
},
{
"id": "GO-2026-4869",
"module": "stdlib",
"found": "v1.25.0",
"fixed": "v1.25.9",
"symbolReachable": false,
"summary": "Unbounded allocation for old GNU sparse in archive/tar"
},
{
"id": "GO-2026-4870",
"module": "stdlib",
"found": "v1.25.0",
"fixed": "v1.25.9",
"symbolReachable": true,
"summary": "Unauthenticated TLS 1.3 KeyUpdate record can cause persistent connection retention and DoS in crypto/tls"
},
{
"id": "GO-2026-4918",
"module": "stdlib",
"found": "v1.25.0",
"fixed": "v1.25.10",
"symbolReachable": false,
"summary": "Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net"
},
{
"id": "GO-2026-4946",
"module": "stdlib",
"found": "v1.25.0",
"fixed": "v1.25.9",
"symbolReachable": true,
"summary": "Inefficient policy validation in crypto/x509"
},
{
"id": "GO-2026-4947",
"module": "stdlib",
"found": "v1.25.0",
"fixed": "v1.25.9",
"symbolReachable": true,
"summary": "Unexpected work during chain building in crypto/x509"
},
{
"id": "GO-2026-4970",
"module": "stdlib",
"found": "v1.25.0",
"fixed": "v1.25.12",
"symbolReachable": false,
"summary": "Root escape via symlink plus trailing slash in os"
},
{
"id": "GO-2026-4971",
"module": "stdlib",
"found": "v1.25.0",
"fixed": "v1.25.10",
"symbolReachable": true,
"summary": "Panic in Dial and LookupPort when handling NUL byte on Windows in net"
},
{
"id": "GO-2026-4976",
"module": "stdlib",
"found": "v1.25.0",
"fixed": "v1.25.10",
"symbolReachable": false,
"summary": "ReverseProxy forwards queries with more than urlmaxqueryparams parameters in net/http/httputil"
},
{
"id": "GO-2026-4977",
"module": "stdlib",
"found": "v1.25.0",
"fixed": "v1.25.10",
"symbolReachable": false,
"summary": "Quadratic string concatenation in consumePhrase in net/mail"
},
{
"id": "GO-2026-4980",
"module": "stdlib",
"found": "v1.25.0",
"fixed": "v1.25.10",
"symbolReachable": false,
"summary": "Escaper bypass leads to XSS in html/template"
},
{
"id": "GO-2026-4981",
"module": "stdlib",
"found": "v1.25.0",
"fixed": "v1.25.10",
"symbolReachable": false,
"summary": "Crash when handling long CNAME response in net"
},
{
"id": "GO-2026-4982",
"module": "stdlib",
"found": "v1.25.0",
"fixed": "v1.25.10",
"symbolReachable": false,
"summary": "Bypass of meta content URL escaping causes XSS in html/template"
},
{
"id": "GO-2026-4986",
"module": "stdlib",
"found": "v1.25.0",
"fixed": "v1.25.10",
"symbolReachable": false,
"summary": "Quadratic string concatentation in consumeComment in net/mail"
},
{
"id": "GO-2026-5026",
"module": "stdlib",
"found": "v1.25.0",
"fixed": "v1.25.13",
"symbolReachable": false,
"summary": "Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna"
},
{
"id": "GO-2026-5037",
"module": "stdlib",
"found": "v1.25.0",
"fixed": "v1.25.11",
"symbolReachable": true,
"summary": "Inefficient candidate hostname parsing in crypto/x509"
},
{
"id": "GO-2026-5038",
"module": "stdlib",
"found": "v1.25.0",
"fixed": "v1.25.11",
"symbolReachable": false,
"summary": "Quadratic complexity in WordDecoder.DecodeHeader in mime"
},
{
"id": "GO-2026-5039",
"module": "stdlib",
"found": "v1.25.0",
"fixed": "v1.25.11",
"symbolReachable": true,
"summary": "Arbitrary inputs are included in errors without any escaping in net/textproto"
},
{
"id": "GO-2026-5856",
"module": "stdlib",
"found": "v1.25.0",
"fixed": "v1.25.12",
"symbolReachable": true,
"summary": "Invoking Encrypted Client Hello privacy leak in crypto/tls"
},
{
"id": "GO-2026-5972",
"module": "stdlib",
"found": "v1.25.0",
"fixed": "v1.25.13",
"symbolReachable": true,
"summary": "Enforce maximum recursion depth in encoding/asn1"
},
{
"id": "GO-2026-6088",
"module": "stdlib",
"found": "v1.25.0",
"fixed": "v1.25.13",
"symbolReachable": false,
"summary": "Add recursion depth guard during decode in encoding/xml"
},
{
"id": "GO-2026-6089",
"module": "stdlib",
"found": "v1.25.0",
"fixed": "v1.25.13",
"symbolReachable": false,
"summary": "Apply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/http"
},
{
"id": "GO-2026-6090",
"module": "stdlib",
"found": "v1.25.0",
"fixed": "v1.25.13",
"symbolReachable": true,
"summary": "Limit handshake messages we are willing to accept post-handshake in crypto/tls"
},
{
"id": "GO-2026-6091",
"module": "stdlib",
"found": "v1.25.0",
"fixed": "v1.25.13",
"symbolReachable": false,
"summary": "Fix Javascript regexp context tracking in html/template"
},
{
"id": "GO-2026-6218",
"module": "stdlib",
"found": "v1.25.0",
"fixed": "v1.25.13",
"symbolReachable": false,
"summary": "Avoid quadratic complexity in resolvePath in net/url"
},
{
"id": "GO-2026-6599",
"module": "stdlib",
"found": "v1.25.0",
"fixed": "v1.26.9",
"symbolReachable": false,
"summary": "Reset context tracking on consecutive template expressions in html/template"
},
{
"id": "GO-2026-6600",
"module": "stdlib",
"found": "v1.25.0",
"fixed": "v1.26.9",
"symbolReachable": false,
"summary": "Recognize yield as regexp preceder keyword in html/template"
},
{
"id": "GO-2026-6603",
"module": "stdlib",
"found": "v1.25.0",
"fixed": "v1.26.9",
"symbolReachable": true,
"summary": "HTTP/2 server memory exhaustion due to Trailer headers in net/http"
},
{
"id": "GO-2026-6604",
"module": "stdlib",
"found": "v1.25.0",
"fixed": "v1.26.9",
"symbolReachable": false,
"summary": "Root.Mkdir(All) can follow junctions out of the root on Windows in os"
},
{
"id": "GO-2026-6605",
"module": "stdlib",
"found": "v1.25.0",
"fixed": "v1.26.9",
"symbolReachable": false,
"summary": "HTTP/1 client connection desynchronization after CONNECT rejection in net/http"
},
{
"id": "GO-2026-6607",
"module": "stdlib",
"found": "v1.25.0",
"fixed": "v1.26.9",
"symbolReachable": true,
"summary": "Reject malformed ECH outer extension references in crypto/tls"
},
{
"id": "GO-2026-6608",
"module": "stdlib",
"found": "v1.25.0",
"fixed": "v1.26.9",
"symbolReachable": true,
"summary": "Memory limit bypass when parsing MIME headers in net/textproto, mime/multipart"
},
{
"id": "GO-2026-6609",
"module": "stdlib",
"found": "v1.25.0",
"fixed": "v1.26.9",
"symbolReachable": false,
"summary": "Lack of limit on size of parsed Range headers in net/http"
},
{
"id": "GO-2026-6610",
"module": "stdlib",
"found": "v1.25.0",
"fixed": "v1.26.9",
"symbolReachable": false,
"summary": "HTTP/2 transport accepts malformed framing-related headers in net/http"
},
{
"id": "GO-2026-6611",
"module": "stdlib",
"found": "v1.25.0",
"fixed": "v1.26.9",
"symbolReachable": true,
"summary": "Excessive CPU consumption from repeated initial window changes in net/http"
},
{
"id": "GO-2026-6612",
"module": "stdlib",
"found": "v1.25.0",
"fixed": "v1.26.9",
"symbolReachable": true,
"summary": "Double flow control refund on HTTP/2 server streams in net/http"
},
{
"id": "GO-2026-6613",
"module": "stdlib",
"found": "v1.25.0",
"fixed": "v1.26.9",
"symbolReachable": true,
"summary": "HTTP/1 server connection desynchronization after 2xx CONNECT response in net/http"
},
{
"id": "GO-2026-6617",
"module": "stdlib",
"found": "v1.25.0",
"fixed": "v1.26.9",
"symbolReachable": true,
"summary": "HTTP/2 server crash due to HPACK encoder race in net/http"
},
{
"id": "GO-2026-6809",
"module": "stdlib",
"found": "v1.25.0",
"fixed": "v1.26.10",
"symbolReachable": true,
"summary": "Distrust compromised intermediate certificates in crypto/x509"
},
{
"id": "GO-2025-3503",
"module": "golang.org/x/net",
"found": "v0.33.0",
"fixed": "v0.36.0",
"symbolReachable": false,
"summary": "HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net"
},
{
"id": "GO-2025-3595",
"module": "golang.org/x/net",
"found": "v0.33.0",
"fixed": "v0.38.0",
"symbolReachable": false,
"summary": "Incorrect Neutralization of Input During Web Page Generation in x/net in golang.org/x/net"
},
{
"id": "GO-2026-4440",
"module": "golang.org/x/net",
"found": "v0.33.0",
"fixed": "v0.45.0",
"symbolReachable": false,
"summary": "Quadratic parsing complexity in golang.org/x/net/html"
},
{
"id": "GO-2026-4441",
"module": "golang.org/x/net",
"found": "v0.33.0",
"fixed": "v0.45.0",
"symbolReachable": false,
"summary": "Infinite parsing loop in golang.org/x/net"
},
{
"id": "GO-2026-4918",
"module": "golang.org/x/net",
"found": "v0.33.0",
"fixed": "v0.53.0",
"symbolReachable": false,
"summary": "Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net"
},
{
"id": "GO-2026-5025",
"module": "golang.org/x/net",
"found": "v0.33.0",
"fixed": "v0.55.0",
"symbolReachable": false,
"summary": "Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html"
},
{
"id": "GO-2026-5026",
"module": "golang.org/x/net",
"found": "v0.33.0",
"fixed": "v0.55.0",
"symbolReachable": false,
"summary": "Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna"
},
{
"id": "GO-2026-5027",
"module": "golang.org/x/net",
"found": "v0.33.0",
"fixed": "v0.55.0",
"symbolReachable": false,
"summary": "Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html"
},
{
"id": "GO-2026-5028",
"module": "golang.org/x/net",
"found": "v0.33.0",
"fixed": "v0.55.0",
"symbolReachable": false,
"summary": "Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html"
},
{
"id": "GO-2026-5029",
"module": "golang.org/x/net",
"found": "v0.33.0",
"fixed": "v0.55.0",
"symbolReachable": false,
"summary": "Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html"
},
{
"id": "GO-2026-5030",
"module": "golang.org/x/net",
"found": "v0.33.0",
"fixed": "v0.55.0",
"symbolReachable": false,
"summary": "Invoking duplicate attributes can cause XSS in golang.org/x/net/html"
},
{
"id": "GO-2026-5942",
"module": "golang.org/x/net",
"found": "v0.33.0",
"fixed": "v0.56.0",
"symbolReachable": false,
"summary": "Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage"
},
{
"id": "GO-2026-6603",
"module": "golang.org/x/net",
"found": "v0.33.0",
"fixed": "v0.60.0",
"symbolReachable": true,
"summary": "HTTP/2 server memory exhaustion due to Trailer headers in net/http"
},
{
"id": "GO-2026-6610",
"module": "golang.org/x/net",
"found": "v0.33.0",
"fixed": "v0.60.0",
"symbolReachable": false,
"summary": "HTTP/2 transport accepts malformed framing-related headers in net/http"
},
{
"id": "GO-2026-6611",
"module": "golang.org/x/net",
"found": "v0.33.0",
"fixed": "v0.60.0",
"symbolReachable": true,
"summary": "Excessive CPU consumption from repeated initial window changes in net/http"
},
{
"id": "GO-2026-6612",
"module": "golang.org/x/net",
"found": "v0.33.0",
"fixed": "v0.60.0",
"symbolReachable": true,
"summary": "Double flow control refund on HTTP/2 server streams in net/http"
},
{
"id": "GO-2026-6617",
"module": "golang.org/x/net",
"found": "v0.33.0",
"fixed": "v0.60.0",
"symbolReachable": true,
"summary": "HTTP/2 server crash due to HPACK encoder race in net/http"
},
{
"id": "GO-2026-6860",
"module": "golang.org/x/net",
"found": "v0.33.0",
"fixed": "v0.62.0",
"symbolReachable": false,
"summary": "Avoid quadratic complexity when coalescing text nodes in html in golang.org/x/net"
},
{
"id": "GO-2026-6866",
"module": "golang.org/x/net",
"found": "v0.33.0",
"fixed": "v0.62.0",
"symbolReachable": false,
"summary": "Check all ancestor namespace transitions when rendering raw text in html in golang.org/x/net"
},
{
"id": "GO-2026-5024",
"module": "golang.org/x/sys",
"found": "v0.28.0",
"fixed": "v0.44.0",
"symbolReachable": false,
"summary": "Invoking integer overflow in NewNTUnicodeString in golang.org/x/sys/windows"
},
{
"id": "GO-2026-5970",
"module": "golang.org/x/text",
"found": "v0.21.0",
"fixed": "v0.39.0",
"symbolReachable": false,
"summary": "Infinite loop on invalid input in golang.org/x/text"
},
{
"id": "GO-2026-6629",
"module": "golang.org/x/text",
"found": "v0.21.0",
"fixed": "v0.41.0",
"symbolReachable": false,
"summary": "Panic parsing crafted input in x/text/secure/precis in golang.org/x/text"
}
]
}