{
  "command": "go run golang.org/x/vuln/cmd/govulncheck@v1.1.4 -format=json ./ws/...",
  "config": {
    "protocol_version": "v1.0.0",
    "scanner_name": "govulncheck",
    "scanner_version": "v1.1.4",
    "db": "https://vuln.go.dev",
    "db_last_modified": "2026-10-27T21:16:18Z",
    "go_version": "go1.25.0",
    "scan_level": "symbol",
    "scan_mode": "source"
  },
  "findings": [
    {
      "id": "GO-2025-3487",
      "module": "golang.org/x/crypto",
      "found": "v0.31.0",
      "fixed": "v0.35.0",
      "symbolReachable": false,
      "summary": "Potential denial of service in golang.org/x/crypto"
    },
    {
      "id": "GO-2025-4116",
      "module": "golang.org/x/crypto",
      "found": "v0.31.0",
      "fixed": "v0.43.0",
      "symbolReachable": false,
      "summary": "Potential denial of service in golang.org/x/crypto/ssh/agent"
    },
    {
      "id": "GO-2025-4134",
      "module": "golang.org/x/crypto",
      "found": "v0.31.0",
      "fixed": "v0.45.0",
      "symbolReachable": false,
      "summary": "Unbounded memory consumption in golang.org/x/crypto/ssh"
    },
    {
      "id": "GO-2025-4135",
      "module": "golang.org/x/crypto",
      "found": "v0.31.0",
      "fixed": "v0.45.0",
      "symbolReachable": false,
      "summary": "Malformed constraint may cause denial of service in golang.org/x/crypto/ssh/agent"
    },
    {
      "id": "GO-2026-5005",
      "module": "golang.org/x/crypto",
      "found": "v0.31.0",
      "fixed": "v0.52.0",
      "symbolReachable": false,
      "summary": "Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent"
    },
    {
      "id": "GO-2026-5006",
      "module": "golang.org/x/crypto",
      "found": "v0.31.0",
      "fixed": "v0.52.0",
      "symbolReachable": false,
      "summary": "Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent"
    },
    {
      "id": "GO-2026-5013",
      "module": "golang.org/x/crypto",
      "found": "v0.31.0",
      "fixed": "v0.52.0",
      "symbolReachable": false,
      "summary": "Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh"
    },
    {
      "id": "GO-2026-5014",
      "module": "golang.org/x/crypto",
      "found": "v0.31.0",
      "fixed": "v0.52.0",
      "symbolReachable": false,
      "summary": "Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh"
    },
    {
      "id": "GO-2026-5015",
      "module": "golang.org/x/crypto",
      "found": "v0.31.0",
      "fixed": "v0.52.0",
      "symbolReachable": false,
      "summary": "Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh"
    },
    {
      "id": "GO-2026-5016",
      "module": "golang.org/x/crypto",
      "found": "v0.31.0",
      "fixed": "v0.52.0",
      "symbolReachable": false,
      "summary": "Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh"
    },
    {
      "id": "GO-2026-5017",
      "module": "golang.org/x/crypto",
      "found": "v0.31.0",
      "fixed": "v0.52.0",
      "symbolReachable": false,
      "summary": "Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh"
    },
    {
      "id": "GO-2026-5018",
      "module": "golang.org/x/crypto",
      "found": "v0.31.0",
      "fixed": "v0.52.0",
      "symbolReachable": false,
      "summary": "Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh"
    },
    {
      "id": "GO-2026-5019",
      "module": "golang.org/x/crypto",
      "found": "v0.31.0",
      "fixed": "v0.52.0",
      "symbolReachable": false,
      "summary": "Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh"
    },
    {
      "id": "GO-2026-5020",
      "module": "golang.org/x/crypto",
      "found": "v0.31.0",
      "fixed": "v0.52.0",
      "symbolReachable": false,
      "summary": "Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh"
    },
    {
      "id": "GO-2026-5021",
      "module": "golang.org/x/crypto",
      "found": "v0.31.0",
      "fixed": "v0.52.0",
      "symbolReachable": false,
      "summary": "Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts"
    },
    {
      "id": "GO-2026-5023",
      "module": "golang.org/x/crypto",
      "found": "v0.31.0",
      "fixed": "v0.52.0",
      "symbolReachable": false,
      "summary": "Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh"
    },
    {
      "id": "GO-2026-5033",
      "module": "golang.org/x/crypto",
      "found": "v0.31.0",
      "fixed": "v0.52.0",
      "symbolReachable": false,
      "summary": "Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent"
    },
    {
      "id": "GO-2026-5932",
      "module": "golang.org/x/crypto",
      "found": "v0.31.0",
      "fixed": null,
      "symbolReachable": false,
      "summary": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues"
    },
    {
      "id": "GO-2026-6303",
      "module": "golang.org/x/crypto",
      "found": "v0.31.0",
      "fixed": "v0.55.0",
      "symbolReachable": false,
      "summary": "Source-address critical option not enforced for non-public-key auth callbacks in golang.org/x/crypto/ssh"
    },
    {
      "id": "GO-2026-6354",
      "module": "golang.org/x/crypto",
      "found": "v0.31.0",
      "fixed": "v0.56.0",
      "symbolReachable": false,
      "summary": "Prevent DoS on deadlocked undecided channel in golang.org/x/crypto/ssh"
    },
    {
      "id": "GO-2026-6355",
      "module": "golang.org/x/crypto",
      "found": "v0.31.0",
      "fixed": "v0.56.0",
      "symbolReachable": false,
      "summary": "Prevent DoS on deadlocked established channel in golang.org/x/crypto/ssh"
    },
    {
      "id": "GO-2025-3955",
      "module": "stdlib",
      "found": "v1.25.0",
      "fixed": "v1.25.1",
      "symbolReachable": false,
      "summary": "CrossOriginProtection insecure bypass patterns not limited to exact matches in net/http"
    },
    {
      "id": "GO-2025-4006",
      "module": "stdlib",
      "found": "v1.25.0",
      "fixed": "v1.25.2",
      "symbolReachable": false,
      "summary": "Excessive CPU consumption in ParseAddress in net/mail"
    },
    {
      "id": "GO-2025-4007",
      "module": "stdlib",
      "found": "v1.25.0",
      "fixed": "v1.25.3",
      "symbolReachable": true,
      "summary": "Quadratic complexity when checking name constraints in crypto/x509"
    },
    {
      "id": "GO-2025-4008",
      "module": "stdlib",
      "found": "v1.25.0",
      "fixed": "v1.25.2",
      "symbolReachable": true,
      "summary": "ALPN negotiation error contains attacker controlled information in crypto/tls"
    },
    {
      "id": "GO-2025-4009",
      "module": "stdlib",
      "found": "v1.25.0",
      "fixed": "v1.25.2",
      "symbolReachable": false,
      "summary": "Quadratic complexity when parsing some invalid inputs in encoding/pem"
    },
    {
      "id": "GO-2025-4010",
      "module": "stdlib",
      "found": "v1.25.0",
      "fixed": "v1.25.2",
      "symbolReachable": true,
      "summary": "Insufficient validation of bracketed IPv6 hostnames in net/url"
    },
    {
      "id": "GO-2025-4011",
      "module": "stdlib",
      "found": "v1.25.0",
      "fixed": "v1.25.2",
      "symbolReachable": true,
      "summary": "Parsing DER payload can cause memory exhaustion in encoding/asn1"
    },
    {
      "id": "GO-2025-4012",
      "module": "stdlib",
      "found": "v1.25.0",
      "fixed": "v1.25.2",
      "symbolReachable": true,
      "summary": "Lack of limit when parsing cookies can cause memory exhaustion in net/http"
    },
    {
      "id": "GO-2025-4013",
      "module": "stdlib",
      "found": "v1.25.0",
      "fixed": "v1.25.2",
      "symbolReachable": true,
      "summary": "Panic when validating certificates with DSA public keys in crypto/x509"
    },
    {
      "id": "GO-2025-4014",
      "module": "stdlib",
      "found": "v1.25.0",
      "fixed": "v1.25.2",
      "symbolReachable": false,
      "summary": "Unbounded allocation when parsing GNU sparse map in archive/tar"
    },
    {
      "id": "GO-2025-4015",
      "module": "stdlib",
      "found": "v1.25.0",
      "fixed": "v1.25.2",
      "symbolReachable": false,
      "summary": "Excessive CPU consumption in Reader.ReadResponse in net/textproto"
    },
    {
      "id": "GO-2025-4155",
      "module": "stdlib",
      "found": "v1.25.0",
      "fixed": "v1.25.5",
      "symbolReachable": true,
      "summary": "Excessive resource consumption when printing error string for host certificate validation in crypto/x509"
    },
    {
      "id": "GO-2025-4175",
      "module": "stdlib",
      "found": "v1.25.0",
      "fixed": "v1.25.5",
      "symbolReachable": true,
      "summary": "Improper application of excluded DNS name constraints when verifying wildcard names in crypto/x509"
    },
    {
      "id": "GO-2026-4337",
      "module": "stdlib",
      "found": "v1.25.0",
      "fixed": "v1.25.7",
      "symbolReachable": true,
      "summary": "Unexpected session resumption in crypto/tls"
    },
    {
      "id": "GO-2026-4340",
      "module": "stdlib",
      "found": "v1.25.0",
      "fixed": "v1.25.6",
      "symbolReachable": true,
      "summary": "Handshake messages may be processed at the incorrect encryption level in crypto/tls"
    },
    {
      "id": "GO-2026-4341",
      "module": "stdlib",
      "found": "v1.25.0",
      "fixed": "v1.25.6",
      "symbolReachable": false,
      "summary": "Memory exhaustion in query parameter parsing in net/url"
    },
    {
      "id": "GO-2026-4342",
      "module": "stdlib",
      "found": "v1.25.0",
      "fixed": "v1.25.6",
      "symbolReachable": false,
      "summary": "Excessive CPU consumption when building archive index in archive/zip"
    },
    {
      "id": "GO-2026-4601",
      "module": "stdlib",
      "found": "v1.25.0",
      "fixed": "v1.25.8",
      "symbolReachable": true,
      "summary": "Incorrect parsing of IPv6 host literals in net/url"
    },
    {
      "id": "GO-2026-4602",
      "module": "stdlib",
      "found": "v1.25.0",
      "fixed": "v1.25.8",
      "symbolReachable": true,
      "summary": "FileInfo can escape from a Root in os"
    },
    {
      "id": "GO-2026-4603",
      "module": "stdlib",
      "found": "v1.25.0",
      "fixed": "v1.25.8",
      "symbolReachable": false,
      "summary": "URLs in meta content attribute actions are not escaped in html/template"
    },
    {
      "id": "GO-2026-4864",
      "module": "stdlib",
      "found": "v1.25.0",
      "fixed": "v1.25.9",
      "symbolReachable": false,
      "summary": "TOCTOU permits root escape on Linux via Root.Chmod in os in internal/syscall/unix"
    },
    {
      "id": "GO-2026-4865",
      "module": "stdlib",
      "found": "v1.25.0",
      "fixed": "v1.25.9",
      "symbolReachable": false,
      "summary": "JsBraceDepth Context Tracking Bugs (XSS) in html/template"
    },
    {
      "id": "GO-2026-4869",
      "module": "stdlib",
      "found": "v1.25.0",
      "fixed": "v1.25.9",
      "symbolReachable": false,
      "summary": "Unbounded allocation for old GNU sparse in archive/tar"
    },
    {
      "id": "GO-2026-4870",
      "module": "stdlib",
      "found": "v1.25.0",
      "fixed": "v1.25.9",
      "symbolReachable": true,
      "summary": "Unauthenticated TLS 1.3 KeyUpdate record can cause persistent connection retention and DoS in crypto/tls"
    },
    {
      "id": "GO-2026-4918",
      "module": "stdlib",
      "found": "v1.25.0",
      "fixed": "v1.25.10",
      "symbolReachable": false,
      "summary": "Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net"
    },
    {
      "id": "GO-2026-4946",
      "module": "stdlib",
      "found": "v1.25.0",
      "fixed": "v1.25.9",
      "symbolReachable": true,
      "summary": "Inefficient policy validation in crypto/x509"
    },
    {
      "id": "GO-2026-4947",
      "module": "stdlib",
      "found": "v1.25.0",
      "fixed": "v1.25.9",
      "symbolReachable": true,
      "summary": "Unexpected work during chain building in crypto/x509"
    },
    {
      "id": "GO-2026-4970",
      "module": "stdlib",
      "found": "v1.25.0",
      "fixed": "v1.25.12",
      "symbolReachable": false,
      "summary": "Root escape via symlink plus trailing slash in os"
    },
    {
      "id": "GO-2026-4971",
      "module": "stdlib",
      "found": "v1.25.0",
      "fixed": "v1.25.10",
      "symbolReachable": true,
      "summary": "Panic in Dial and LookupPort when handling NUL byte on Windows in net"
    },
    {
      "id": "GO-2026-4976",
      "module": "stdlib",
      "found": "v1.25.0",
      "fixed": "v1.25.10",
      "symbolReachable": false,
      "summary": "ReverseProxy forwards queries with more than urlmaxqueryparams parameters in net/http/httputil"
    },
    {
      "id": "GO-2026-4977",
      "module": "stdlib",
      "found": "v1.25.0",
      "fixed": "v1.25.10",
      "symbolReachable": false,
      "summary": "Quadratic string concatenation in consumePhrase in net/mail"
    },
    {
      "id": "GO-2026-4980",
      "module": "stdlib",
      "found": "v1.25.0",
      "fixed": "v1.25.10",
      "symbolReachable": false,
      "summary": "Escaper bypass leads to XSS in html/template"
    },
    {
      "id": "GO-2026-4981",
      "module": "stdlib",
      "found": "v1.25.0",
      "fixed": "v1.25.10",
      "symbolReachable": false,
      "summary": "Crash when handling long CNAME response in net"
    },
    {
      "id": "GO-2026-4982",
      "module": "stdlib",
      "found": "v1.25.0",
      "fixed": "v1.25.10",
      "symbolReachable": false,
      "summary": "Bypass of meta content URL escaping causes XSS in html/template"
    },
    {
      "id": "GO-2026-4986",
      "module": "stdlib",
      "found": "v1.25.0",
      "fixed": "v1.25.10",
      "symbolReachable": false,
      "summary": "Quadratic string concatentation in consumeComment in net/mail"
    },
    {
      "id": "GO-2026-5026",
      "module": "stdlib",
      "found": "v1.25.0",
      "fixed": "v1.25.13",
      "symbolReachable": false,
      "summary": "Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna"
    },
    {
      "id": "GO-2026-5037",
      "module": "stdlib",
      "found": "v1.25.0",
      "fixed": "v1.25.11",
      "symbolReachable": true,
      "summary": "Inefficient candidate hostname parsing in crypto/x509"
    },
    {
      "id": "GO-2026-5038",
      "module": "stdlib",
      "found": "v1.25.0",
      "fixed": "v1.25.11",
      "symbolReachable": false,
      "summary": "Quadratic complexity in WordDecoder.DecodeHeader in mime"
    },
    {
      "id": "GO-2026-5039",
      "module": "stdlib",
      "found": "v1.25.0",
      "fixed": "v1.25.11",
      "symbolReachable": true,
      "summary": "Arbitrary inputs are included in errors without any escaping in net/textproto"
    },
    {
      "id": "GO-2026-5856",
      "module": "stdlib",
      "found": "v1.25.0",
      "fixed": "v1.25.12",
      "symbolReachable": true,
      "summary": "Invoking Encrypted Client Hello privacy leak in crypto/tls"
    },
    {
      "id": "GO-2026-5972",
      "module": "stdlib",
      "found": "v1.25.0",
      "fixed": "v1.25.13",
      "symbolReachable": true,
      "summary": "Enforce maximum recursion depth in encoding/asn1"
    },
    {
      "id": "GO-2026-6088",
      "module": "stdlib",
      "found": "v1.25.0",
      "fixed": "v1.25.13",
      "symbolReachable": false,
      "summary": "Add recursion depth guard during decode in encoding/xml"
    },
    {
      "id": "GO-2026-6089",
      "module": "stdlib",
      "found": "v1.25.0",
      "fixed": "v1.25.13",
      "symbolReachable": false,
      "summary": "Apply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/http"
    },
    {
      "id": "GO-2026-6090",
      "module": "stdlib",
      "found": "v1.25.0",
      "fixed": "v1.25.13",
      "symbolReachable": true,
      "summary": "Limit handshake messages we are willing to accept post-handshake in crypto/tls"
    },
    {
      "id": "GO-2026-6091",
      "module": "stdlib",
      "found": "v1.25.0",
      "fixed": "v1.25.13",
      "symbolReachable": false,
      "summary": "Fix Javascript regexp context tracking in html/template"
    },
    {
      "id": "GO-2026-6218",
      "module": "stdlib",
      "found": "v1.25.0",
      "fixed": "v1.25.13",
      "symbolReachable": false,
      "summary": "Avoid quadratic complexity in resolvePath in net/url"
    },
    {
      "id": "GO-2026-6599",
      "module": "stdlib",
      "found": "v1.25.0",
      "fixed": "v1.26.9",
      "symbolReachable": false,
      "summary": "Reset context tracking on consecutive template expressions in html/template"
    },
    {
      "id": "GO-2026-6600",
      "module": "stdlib",
      "found": "v1.25.0",
      "fixed": "v1.26.9",
      "symbolReachable": false,
      "summary": "Recognize yield as regexp preceder keyword in html/template"
    },
    {
      "id": "GO-2026-6603",
      "module": "stdlib",
      "found": "v1.25.0",
      "fixed": "v1.26.9",
      "symbolReachable": true,
      "summary": "HTTP/2 server memory exhaustion due to Trailer headers in net/http"
    },
    {
      "id": "GO-2026-6604",
      "module": "stdlib",
      "found": "v1.25.0",
      "fixed": "v1.26.9",
      "symbolReachable": false,
      "summary": "Root.Mkdir(All) can follow junctions out of the root on Windows in os"
    },
    {
      "id": "GO-2026-6605",
      "module": "stdlib",
      "found": "v1.25.0",
      "fixed": "v1.26.9",
      "symbolReachable": false,
      "summary": "HTTP/1 client connection desynchronization after CONNECT rejection in net/http"
    },
    {
      "id": "GO-2026-6607",
      "module": "stdlib",
      "found": "v1.25.0",
      "fixed": "v1.26.9",
      "symbolReachable": true,
      "summary": "Reject malformed ECH outer extension references in crypto/tls"
    },
    {
      "id": "GO-2026-6608",
      "module": "stdlib",
      "found": "v1.25.0",
      "fixed": "v1.26.9",
      "symbolReachable": true,
      "summary": "Memory limit bypass when parsing MIME headers in net/textproto, mime/multipart"
    },
    {
      "id": "GO-2026-6609",
      "module": "stdlib",
      "found": "v1.25.0",
      "fixed": "v1.26.9",
      "symbolReachable": false,
      "summary": "Lack of limit on size of parsed Range headers in net/http"
    },
    {
      "id": "GO-2026-6610",
      "module": "stdlib",
      "found": "v1.25.0",
      "fixed": "v1.26.9",
      "symbolReachable": false,
      "summary": "HTTP/2 transport accepts malformed framing-related headers in net/http"
    },
    {
      "id": "GO-2026-6611",
      "module": "stdlib",
      "found": "v1.25.0",
      "fixed": "v1.26.9",
      "symbolReachable": true,
      "summary": "Excessive CPU consumption from repeated initial window changes in net/http"
    },
    {
      "id": "GO-2026-6612",
      "module": "stdlib",
      "found": "v1.25.0",
      "fixed": "v1.26.9",
      "symbolReachable": true,
      "summary": "Double flow control refund on HTTP/2 server streams in net/http"
    },
    {
      "id": "GO-2026-6613",
      "module": "stdlib",
      "found": "v1.25.0",
      "fixed": "v1.26.9",
      "symbolReachable": true,
      "summary": "HTTP/1 server connection desynchronization after 2xx CONNECT response in net/http"
    },
    {
      "id": "GO-2026-6617",
      "module": "stdlib",
      "found": "v1.25.0",
      "fixed": "v1.26.9",
      "symbolReachable": true,
      "summary": "HTTP/2 server crash due to HPACK encoder race in net/http"
    },
    {
      "id": "GO-2026-6809",
      "module": "stdlib",
      "found": "v1.25.0",
      "fixed": "v1.26.10",
      "symbolReachable": true,
      "summary": "Distrust compromised intermediate certificates in crypto/x509"
    },
    {
      "id": "GO-2025-3503",
      "module": "golang.org/x/net",
      "found": "v0.33.0",
      "fixed": "v0.36.0",
      "symbolReachable": false,
      "summary": "HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net"
    },
    {
      "id": "GO-2025-3595",
      "module": "golang.org/x/net",
      "found": "v0.33.0",
      "fixed": "v0.38.0",
      "symbolReachable": false,
      "summary": "Incorrect Neutralization of Input During Web Page Generation in x/net in golang.org/x/net"
    },
    {
      "id": "GO-2026-4440",
      "module": "golang.org/x/net",
      "found": "v0.33.0",
      "fixed": "v0.45.0",
      "symbolReachable": false,
      "summary": "Quadratic parsing complexity in golang.org/x/net/html"
    },
    {
      "id": "GO-2026-4441",
      "module": "golang.org/x/net",
      "found": "v0.33.0",
      "fixed": "v0.45.0",
      "symbolReachable": false,
      "summary": "Infinite parsing loop in golang.org/x/net"
    },
    {
      "id": "GO-2026-4918",
      "module": "golang.org/x/net",
      "found": "v0.33.0",
      "fixed": "v0.53.0",
      "symbolReachable": false,
      "summary": "Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net"
    },
    {
      "id": "GO-2026-5025",
      "module": "golang.org/x/net",
      "found": "v0.33.0",
      "fixed": "v0.55.0",
      "symbolReachable": false,
      "summary": "Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html"
    },
    {
      "id": "GO-2026-5026",
      "module": "golang.org/x/net",
      "found": "v0.33.0",
      "fixed": "v0.55.0",
      "symbolReachable": false,
      "summary": "Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna"
    },
    {
      "id": "GO-2026-5027",
      "module": "golang.org/x/net",
      "found": "v0.33.0",
      "fixed": "v0.55.0",
      "symbolReachable": false,
      "summary": "Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html"
    },
    {
      "id": "GO-2026-5028",
      "module": "golang.org/x/net",
      "found": "v0.33.0",
      "fixed": "v0.55.0",
      "symbolReachable": false,
      "summary": "Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html"
    },
    {
      "id": "GO-2026-5029",
      "module": "golang.org/x/net",
      "found": "v0.33.0",
      "fixed": "v0.55.0",
      "symbolReachable": false,
      "summary": "Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html"
    },
    {
      "id": "GO-2026-5030",
      "module": "golang.org/x/net",
      "found": "v0.33.0",
      "fixed": "v0.55.0",
      "symbolReachable": false,
      "summary": "Invoking duplicate attributes can cause XSS in golang.org/x/net/html"
    },
    {
      "id": "GO-2026-5942",
      "module": "golang.org/x/net",
      "found": "v0.33.0",
      "fixed": "v0.56.0",
      "symbolReachable": false,
      "summary": "Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage"
    },
    {
      "id": "GO-2026-6603",
      "module": "golang.org/x/net",
      "found": "v0.33.0",
      "fixed": "v0.60.0",
      "symbolReachable": true,
      "summary": "HTTP/2 server memory exhaustion due to Trailer headers in net/http"
    },
    {
      "id": "GO-2026-6610",
      "module": "golang.org/x/net",
      "found": "v0.33.0",
      "fixed": "v0.60.0",
      "symbolReachable": false,
      "summary": "HTTP/2 transport accepts malformed framing-related headers in net/http"
    },
    {
      "id": "GO-2026-6611",
      "module": "golang.org/x/net",
      "found": "v0.33.0",
      "fixed": "v0.60.0",
      "symbolReachable": true,
      "summary": "Excessive CPU consumption from repeated initial window changes in net/http"
    },
    {
      "id": "GO-2026-6612",
      "module": "golang.org/x/net",
      "found": "v0.33.0",
      "fixed": "v0.60.0",
      "symbolReachable": true,
      "summary": "Double flow control refund on HTTP/2 server streams in net/http"
    },
    {
      "id": "GO-2026-6617",
      "module": "golang.org/x/net",
      "found": "v0.33.0",
      "fixed": "v0.60.0",
      "symbolReachable": true,
      "summary": "HTTP/2 server crash due to HPACK encoder race in net/http"
    },
    {
      "id": "GO-2026-6860",
      "module": "golang.org/x/net",
      "found": "v0.33.0",
      "fixed": "v0.62.0",
      "symbolReachable": false,
      "summary": "Avoid quadratic complexity when coalescing text nodes in html in golang.org/x/net"
    },
    {
      "id": "GO-2026-6866",
      "module": "golang.org/x/net",
      "found": "v0.33.0",
      "fixed": "v0.62.0",
      "symbolReachable": false,
      "summary": "Check all ancestor namespace transitions when rendering raw text in html in golang.org/x/net"
    },
    {
      "id": "GO-2026-5024",
      "module": "golang.org/x/sys",
      "found": "v0.28.0",
      "fixed": "v0.44.0",
      "symbolReachable": false,
      "summary": "Invoking integer overflow in NewNTUnicodeString in golang.org/x/sys/windows"
    },
    {
      "id": "GO-2026-5970",
      "module": "golang.org/x/text",
      "found": "v0.21.0",
      "fixed": "v0.39.0",
      "symbolReachable": false,
      "summary": "Infinite loop on invalid input in golang.org/x/text"
    },
    {
      "id": "GO-2026-6629",
      "module": "golang.org/x/text",
      "found": "v0.21.0",
      "fixed": "v0.41.0",
      "symbolReachable": false,
      "summary": "Panic parsing crafted input in x/text/secure/precis in golang.org/x/text"
    }
  ]
}