840 lines
25 KiB
JSON
840 lines
25 KiB
JSON
{
|
|
"command": "go run golang.org/x/vuln/cmd/govulncheck@v1.1.4 -format=json ./ws/...",
|
|
"config": {
|
|
"protocol_version": "v1.0.0",
|
|
"scanner_name": "govulncheck",
|
|
"scanner_version": "v1.1.4",
|
|
"db": "https://vuln.go.dev",
|
|
"db_last_modified": "2026-10-27T21:16:18Z",
|
|
"go_version": "go1.25.0",
|
|
"scan_level": "symbol",
|
|
"scan_mode": "source"
|
|
},
|
|
"findings": [
|
|
{
|
|
"id": "GO-2025-3487",
|
|
"module": "golang.org/x/crypto",
|
|
"found": "v0.31.0",
|
|
"fixed": "v0.35.0",
|
|
"symbolReachable": false,
|
|
"summary": "Potential denial of service in golang.org/x/crypto"
|
|
},
|
|
{
|
|
"id": "GO-2025-4116",
|
|
"module": "golang.org/x/crypto",
|
|
"found": "v0.31.0",
|
|
"fixed": "v0.43.0",
|
|
"symbolReachable": false,
|
|
"summary": "Potential denial of service in golang.org/x/crypto/ssh/agent"
|
|
},
|
|
{
|
|
"id": "GO-2025-4134",
|
|
"module": "golang.org/x/crypto",
|
|
"found": "v0.31.0",
|
|
"fixed": "v0.45.0",
|
|
"symbolReachable": false,
|
|
"summary": "Unbounded memory consumption in golang.org/x/crypto/ssh"
|
|
},
|
|
{
|
|
"id": "GO-2025-4135",
|
|
"module": "golang.org/x/crypto",
|
|
"found": "v0.31.0",
|
|
"fixed": "v0.45.0",
|
|
"symbolReachable": false,
|
|
"summary": "Malformed constraint may cause denial of service in golang.org/x/crypto/ssh/agent"
|
|
},
|
|
{
|
|
"id": "GO-2026-5005",
|
|
"module": "golang.org/x/crypto",
|
|
"found": "v0.31.0",
|
|
"fixed": "v0.52.0",
|
|
"symbolReachable": false,
|
|
"summary": "Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent"
|
|
},
|
|
{
|
|
"id": "GO-2026-5006",
|
|
"module": "golang.org/x/crypto",
|
|
"found": "v0.31.0",
|
|
"fixed": "v0.52.0",
|
|
"symbolReachable": false,
|
|
"summary": "Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent"
|
|
},
|
|
{
|
|
"id": "GO-2026-5013",
|
|
"module": "golang.org/x/crypto",
|
|
"found": "v0.31.0",
|
|
"fixed": "v0.52.0",
|
|
"symbolReachable": false,
|
|
"summary": "Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh"
|
|
},
|
|
{
|
|
"id": "GO-2026-5014",
|
|
"module": "golang.org/x/crypto",
|
|
"found": "v0.31.0",
|
|
"fixed": "v0.52.0",
|
|
"symbolReachable": false,
|
|
"summary": "Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh"
|
|
},
|
|
{
|
|
"id": "GO-2026-5015",
|
|
"module": "golang.org/x/crypto",
|
|
"found": "v0.31.0",
|
|
"fixed": "v0.52.0",
|
|
"symbolReachable": false,
|
|
"summary": "Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh"
|
|
},
|
|
{
|
|
"id": "GO-2026-5016",
|
|
"module": "golang.org/x/crypto",
|
|
"found": "v0.31.0",
|
|
"fixed": "v0.52.0",
|
|
"symbolReachable": false,
|
|
"summary": "Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh"
|
|
},
|
|
{
|
|
"id": "GO-2026-5017",
|
|
"module": "golang.org/x/crypto",
|
|
"found": "v0.31.0",
|
|
"fixed": "v0.52.0",
|
|
"symbolReachable": false,
|
|
"summary": "Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh"
|
|
},
|
|
{
|
|
"id": "GO-2026-5018",
|
|
"module": "golang.org/x/crypto",
|
|
"found": "v0.31.0",
|
|
"fixed": "v0.52.0",
|
|
"symbolReachable": false,
|
|
"summary": "Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh"
|
|
},
|
|
{
|
|
"id": "GO-2026-5019",
|
|
"module": "golang.org/x/crypto",
|
|
"found": "v0.31.0",
|
|
"fixed": "v0.52.0",
|
|
"symbolReachable": false,
|
|
"summary": "Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh"
|
|
},
|
|
{
|
|
"id": "GO-2026-5020",
|
|
"module": "golang.org/x/crypto",
|
|
"found": "v0.31.0",
|
|
"fixed": "v0.52.0",
|
|
"symbolReachable": false,
|
|
"summary": "Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh"
|
|
},
|
|
{
|
|
"id": "GO-2026-5021",
|
|
"module": "golang.org/x/crypto",
|
|
"found": "v0.31.0",
|
|
"fixed": "v0.52.0",
|
|
"symbolReachable": false,
|
|
"summary": "Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts"
|
|
},
|
|
{
|
|
"id": "GO-2026-5023",
|
|
"module": "golang.org/x/crypto",
|
|
"found": "v0.31.0",
|
|
"fixed": "v0.52.0",
|
|
"symbolReachable": false,
|
|
"summary": "Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh"
|
|
},
|
|
{
|
|
"id": "GO-2026-5033",
|
|
"module": "golang.org/x/crypto",
|
|
"found": "v0.31.0",
|
|
"fixed": "v0.52.0",
|
|
"symbolReachable": false,
|
|
"summary": "Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent"
|
|
},
|
|
{
|
|
"id": "GO-2026-5932",
|
|
"module": "golang.org/x/crypto",
|
|
"found": "v0.31.0",
|
|
"fixed": null,
|
|
"symbolReachable": false,
|
|
"summary": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues"
|
|
},
|
|
{
|
|
"id": "GO-2026-6303",
|
|
"module": "golang.org/x/crypto",
|
|
"found": "v0.31.0",
|
|
"fixed": "v0.55.0",
|
|
"symbolReachable": false,
|
|
"summary": "Source-address critical option not enforced for non-public-key auth callbacks in golang.org/x/crypto/ssh"
|
|
},
|
|
{
|
|
"id": "GO-2026-6354",
|
|
"module": "golang.org/x/crypto",
|
|
"found": "v0.31.0",
|
|
"fixed": "v0.56.0",
|
|
"symbolReachable": false,
|
|
"summary": "Prevent DoS on deadlocked undecided channel in golang.org/x/crypto/ssh"
|
|
},
|
|
{
|
|
"id": "GO-2026-6355",
|
|
"module": "golang.org/x/crypto",
|
|
"found": "v0.31.0",
|
|
"fixed": "v0.56.0",
|
|
"symbolReachable": false,
|
|
"summary": "Prevent DoS on deadlocked established channel in golang.org/x/crypto/ssh"
|
|
},
|
|
{
|
|
"id": "GO-2025-3955",
|
|
"module": "stdlib",
|
|
"found": "v1.25.0",
|
|
"fixed": "v1.25.1",
|
|
"symbolReachable": false,
|
|
"summary": "CrossOriginProtection insecure bypass patterns not limited to exact matches in net/http"
|
|
},
|
|
{
|
|
"id": "GO-2025-4006",
|
|
"module": "stdlib",
|
|
"found": "v1.25.0",
|
|
"fixed": "v1.25.2",
|
|
"symbolReachable": false,
|
|
"summary": "Excessive CPU consumption in ParseAddress in net/mail"
|
|
},
|
|
{
|
|
"id": "GO-2025-4007",
|
|
"module": "stdlib",
|
|
"found": "v1.25.0",
|
|
"fixed": "v1.25.3",
|
|
"symbolReachable": true,
|
|
"summary": "Quadratic complexity when checking name constraints in crypto/x509"
|
|
},
|
|
{
|
|
"id": "GO-2025-4008",
|
|
"module": "stdlib",
|
|
"found": "v1.25.0",
|
|
"fixed": "v1.25.2",
|
|
"symbolReachable": true,
|
|
"summary": "ALPN negotiation error contains attacker controlled information in crypto/tls"
|
|
},
|
|
{
|
|
"id": "GO-2025-4009",
|
|
"module": "stdlib",
|
|
"found": "v1.25.0",
|
|
"fixed": "v1.25.2",
|
|
"symbolReachable": false,
|
|
"summary": "Quadratic complexity when parsing some invalid inputs in encoding/pem"
|
|
},
|
|
{
|
|
"id": "GO-2025-4010",
|
|
"module": "stdlib",
|
|
"found": "v1.25.0",
|
|
"fixed": "v1.25.2",
|
|
"symbolReachable": true,
|
|
"summary": "Insufficient validation of bracketed IPv6 hostnames in net/url"
|
|
},
|
|
{
|
|
"id": "GO-2025-4011",
|
|
"module": "stdlib",
|
|
"found": "v1.25.0",
|
|
"fixed": "v1.25.2",
|
|
"symbolReachable": true,
|
|
"summary": "Parsing DER payload can cause memory exhaustion in encoding/asn1"
|
|
},
|
|
{
|
|
"id": "GO-2025-4012",
|
|
"module": "stdlib",
|
|
"found": "v1.25.0",
|
|
"fixed": "v1.25.2",
|
|
"symbolReachable": true,
|
|
"summary": "Lack of limit when parsing cookies can cause memory exhaustion in net/http"
|
|
},
|
|
{
|
|
"id": "GO-2025-4013",
|
|
"module": "stdlib",
|
|
"found": "v1.25.0",
|
|
"fixed": "v1.25.2",
|
|
"symbolReachable": true,
|
|
"summary": "Panic when validating certificates with DSA public keys in crypto/x509"
|
|
},
|
|
{
|
|
"id": "GO-2025-4014",
|
|
"module": "stdlib",
|
|
"found": "v1.25.0",
|
|
"fixed": "v1.25.2",
|
|
"symbolReachable": false,
|
|
"summary": "Unbounded allocation when parsing GNU sparse map in archive/tar"
|
|
},
|
|
{
|
|
"id": "GO-2025-4015",
|
|
"module": "stdlib",
|
|
"found": "v1.25.0",
|
|
"fixed": "v1.25.2",
|
|
"symbolReachable": false,
|
|
"summary": "Excessive CPU consumption in Reader.ReadResponse in net/textproto"
|
|
},
|
|
{
|
|
"id": "GO-2025-4155",
|
|
"module": "stdlib",
|
|
"found": "v1.25.0",
|
|
"fixed": "v1.25.5",
|
|
"symbolReachable": true,
|
|
"summary": "Excessive resource consumption when printing error string for host certificate validation in crypto/x509"
|
|
},
|
|
{
|
|
"id": "GO-2025-4175",
|
|
"module": "stdlib",
|
|
"found": "v1.25.0",
|
|
"fixed": "v1.25.5",
|
|
"symbolReachable": true,
|
|
"summary": "Improper application of excluded DNS name constraints when verifying wildcard names in crypto/x509"
|
|
},
|
|
{
|
|
"id": "GO-2026-4337",
|
|
"module": "stdlib",
|
|
"found": "v1.25.0",
|
|
"fixed": "v1.25.7",
|
|
"symbolReachable": true,
|
|
"summary": "Unexpected session resumption in crypto/tls"
|
|
},
|
|
{
|
|
"id": "GO-2026-4340",
|
|
"module": "stdlib",
|
|
"found": "v1.25.0",
|
|
"fixed": "v1.25.6",
|
|
"symbolReachable": true,
|
|
"summary": "Handshake messages may be processed at the incorrect encryption level in crypto/tls"
|
|
},
|
|
{
|
|
"id": "GO-2026-4341",
|
|
"module": "stdlib",
|
|
"found": "v1.25.0",
|
|
"fixed": "v1.25.6",
|
|
"symbolReachable": false,
|
|
"summary": "Memory exhaustion in query parameter parsing in net/url"
|
|
},
|
|
{
|
|
"id": "GO-2026-4342",
|
|
"module": "stdlib",
|
|
"found": "v1.25.0",
|
|
"fixed": "v1.25.6",
|
|
"symbolReachable": false,
|
|
"summary": "Excessive CPU consumption when building archive index in archive/zip"
|
|
},
|
|
{
|
|
"id": "GO-2026-4601",
|
|
"module": "stdlib",
|
|
"found": "v1.25.0",
|
|
"fixed": "v1.25.8",
|
|
"symbolReachable": true,
|
|
"summary": "Incorrect parsing of IPv6 host literals in net/url"
|
|
},
|
|
{
|
|
"id": "GO-2026-4602",
|
|
"module": "stdlib",
|
|
"found": "v1.25.0",
|
|
"fixed": "v1.25.8",
|
|
"symbolReachable": true,
|
|
"summary": "FileInfo can escape from a Root in os"
|
|
},
|
|
{
|
|
"id": "GO-2026-4603",
|
|
"module": "stdlib",
|
|
"found": "v1.25.0",
|
|
"fixed": "v1.25.8",
|
|
"symbolReachable": false,
|
|
"summary": "URLs in meta content attribute actions are not escaped in html/template"
|
|
},
|
|
{
|
|
"id": "GO-2026-4864",
|
|
"module": "stdlib",
|
|
"found": "v1.25.0",
|
|
"fixed": "v1.25.9",
|
|
"symbolReachable": false,
|
|
"summary": "TOCTOU permits root escape on Linux via Root.Chmod in os in internal/syscall/unix"
|
|
},
|
|
{
|
|
"id": "GO-2026-4865",
|
|
"module": "stdlib",
|
|
"found": "v1.25.0",
|
|
"fixed": "v1.25.9",
|
|
"symbolReachable": false,
|
|
"summary": "JsBraceDepth Context Tracking Bugs (XSS) in html/template"
|
|
},
|
|
{
|
|
"id": "GO-2026-4869",
|
|
"module": "stdlib",
|
|
"found": "v1.25.0",
|
|
"fixed": "v1.25.9",
|
|
"symbolReachable": false,
|
|
"summary": "Unbounded allocation for old GNU sparse in archive/tar"
|
|
},
|
|
{
|
|
"id": "GO-2026-4870",
|
|
"module": "stdlib",
|
|
"found": "v1.25.0",
|
|
"fixed": "v1.25.9",
|
|
"symbolReachable": true,
|
|
"summary": "Unauthenticated TLS 1.3 KeyUpdate record can cause persistent connection retention and DoS in crypto/tls"
|
|
},
|
|
{
|
|
"id": "GO-2026-4918",
|
|
"module": "stdlib",
|
|
"found": "v1.25.0",
|
|
"fixed": "v1.25.10",
|
|
"symbolReachable": false,
|
|
"summary": "Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net"
|
|
},
|
|
{
|
|
"id": "GO-2026-4946",
|
|
"module": "stdlib",
|
|
"found": "v1.25.0",
|
|
"fixed": "v1.25.9",
|
|
"symbolReachable": true,
|
|
"summary": "Inefficient policy validation in crypto/x509"
|
|
},
|
|
{
|
|
"id": "GO-2026-4947",
|
|
"module": "stdlib",
|
|
"found": "v1.25.0",
|
|
"fixed": "v1.25.9",
|
|
"symbolReachable": true,
|
|
"summary": "Unexpected work during chain building in crypto/x509"
|
|
},
|
|
{
|
|
"id": "GO-2026-4970",
|
|
"module": "stdlib",
|
|
"found": "v1.25.0",
|
|
"fixed": "v1.25.12",
|
|
"symbolReachable": false,
|
|
"summary": "Root escape via symlink plus trailing slash in os"
|
|
},
|
|
{
|
|
"id": "GO-2026-4971",
|
|
"module": "stdlib",
|
|
"found": "v1.25.0",
|
|
"fixed": "v1.25.10",
|
|
"symbolReachable": true,
|
|
"summary": "Panic in Dial and LookupPort when handling NUL byte on Windows in net"
|
|
},
|
|
{
|
|
"id": "GO-2026-4976",
|
|
"module": "stdlib",
|
|
"found": "v1.25.0",
|
|
"fixed": "v1.25.10",
|
|
"symbolReachable": false,
|
|
"summary": "ReverseProxy forwards queries with more than urlmaxqueryparams parameters in net/http/httputil"
|
|
},
|
|
{
|
|
"id": "GO-2026-4977",
|
|
"module": "stdlib",
|
|
"found": "v1.25.0",
|
|
"fixed": "v1.25.10",
|
|
"symbolReachable": false,
|
|
"summary": "Quadratic string concatenation in consumePhrase in net/mail"
|
|
},
|
|
{
|
|
"id": "GO-2026-4980",
|
|
"module": "stdlib",
|
|
"found": "v1.25.0",
|
|
"fixed": "v1.25.10",
|
|
"symbolReachable": false,
|
|
"summary": "Escaper bypass leads to XSS in html/template"
|
|
},
|
|
{
|
|
"id": "GO-2026-4981",
|
|
"module": "stdlib",
|
|
"found": "v1.25.0",
|
|
"fixed": "v1.25.10",
|
|
"symbolReachable": false,
|
|
"summary": "Crash when handling long CNAME response in net"
|
|
},
|
|
{
|
|
"id": "GO-2026-4982",
|
|
"module": "stdlib",
|
|
"found": "v1.25.0",
|
|
"fixed": "v1.25.10",
|
|
"symbolReachable": false,
|
|
"summary": "Bypass of meta content URL escaping causes XSS in html/template"
|
|
},
|
|
{
|
|
"id": "GO-2026-4986",
|
|
"module": "stdlib",
|
|
"found": "v1.25.0",
|
|
"fixed": "v1.25.10",
|
|
"symbolReachable": false,
|
|
"summary": "Quadratic string concatentation in consumeComment in net/mail"
|
|
},
|
|
{
|
|
"id": "GO-2026-5026",
|
|
"module": "stdlib",
|
|
"found": "v1.25.0",
|
|
"fixed": "v1.25.13",
|
|
"symbolReachable": false,
|
|
"summary": "Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna"
|
|
},
|
|
{
|
|
"id": "GO-2026-5037",
|
|
"module": "stdlib",
|
|
"found": "v1.25.0",
|
|
"fixed": "v1.25.11",
|
|
"symbolReachable": true,
|
|
"summary": "Inefficient candidate hostname parsing in crypto/x509"
|
|
},
|
|
{
|
|
"id": "GO-2026-5038",
|
|
"module": "stdlib",
|
|
"found": "v1.25.0",
|
|
"fixed": "v1.25.11",
|
|
"symbolReachable": false,
|
|
"summary": "Quadratic complexity in WordDecoder.DecodeHeader in mime"
|
|
},
|
|
{
|
|
"id": "GO-2026-5039",
|
|
"module": "stdlib",
|
|
"found": "v1.25.0",
|
|
"fixed": "v1.25.11",
|
|
"symbolReachable": true,
|
|
"summary": "Arbitrary inputs are included in errors without any escaping in net/textproto"
|
|
},
|
|
{
|
|
"id": "GO-2026-5856",
|
|
"module": "stdlib",
|
|
"found": "v1.25.0",
|
|
"fixed": "v1.25.12",
|
|
"symbolReachable": true,
|
|
"summary": "Invoking Encrypted Client Hello privacy leak in crypto/tls"
|
|
},
|
|
{
|
|
"id": "GO-2026-5972",
|
|
"module": "stdlib",
|
|
"found": "v1.25.0",
|
|
"fixed": "v1.25.13",
|
|
"symbolReachable": true,
|
|
"summary": "Enforce maximum recursion depth in encoding/asn1"
|
|
},
|
|
{
|
|
"id": "GO-2026-6088",
|
|
"module": "stdlib",
|
|
"found": "v1.25.0",
|
|
"fixed": "v1.25.13",
|
|
"symbolReachable": false,
|
|
"summary": "Add recursion depth guard during decode in encoding/xml"
|
|
},
|
|
{
|
|
"id": "GO-2026-6089",
|
|
"module": "stdlib",
|
|
"found": "v1.25.0",
|
|
"fixed": "v1.25.13",
|
|
"symbolReachable": false,
|
|
"summary": "Apply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/http"
|
|
},
|
|
{
|
|
"id": "GO-2026-6090",
|
|
"module": "stdlib",
|
|
"found": "v1.25.0",
|
|
"fixed": "v1.25.13",
|
|
"symbolReachable": true,
|
|
"summary": "Limit handshake messages we are willing to accept post-handshake in crypto/tls"
|
|
},
|
|
{
|
|
"id": "GO-2026-6091",
|
|
"module": "stdlib",
|
|
"found": "v1.25.0",
|
|
"fixed": "v1.25.13",
|
|
"symbolReachable": false,
|
|
"summary": "Fix Javascript regexp context tracking in html/template"
|
|
},
|
|
{
|
|
"id": "GO-2026-6218",
|
|
"module": "stdlib",
|
|
"found": "v1.25.0",
|
|
"fixed": "v1.25.13",
|
|
"symbolReachable": false,
|
|
"summary": "Avoid quadratic complexity in resolvePath in net/url"
|
|
},
|
|
{
|
|
"id": "GO-2026-6599",
|
|
"module": "stdlib",
|
|
"found": "v1.25.0",
|
|
"fixed": "v1.26.9",
|
|
"symbolReachable": false,
|
|
"summary": "Reset context tracking on consecutive template expressions in html/template"
|
|
},
|
|
{
|
|
"id": "GO-2026-6600",
|
|
"module": "stdlib",
|
|
"found": "v1.25.0",
|
|
"fixed": "v1.26.9",
|
|
"symbolReachable": false,
|
|
"summary": "Recognize yield as regexp preceder keyword in html/template"
|
|
},
|
|
{
|
|
"id": "GO-2026-6603",
|
|
"module": "stdlib",
|
|
"found": "v1.25.0",
|
|
"fixed": "v1.26.9",
|
|
"symbolReachable": true,
|
|
"summary": "HTTP/2 server memory exhaustion due to Trailer headers in net/http"
|
|
},
|
|
{
|
|
"id": "GO-2026-6604",
|
|
"module": "stdlib",
|
|
"found": "v1.25.0",
|
|
"fixed": "v1.26.9",
|
|
"symbolReachable": false,
|
|
"summary": "Root.Mkdir(All) can follow junctions out of the root on Windows in os"
|
|
},
|
|
{
|
|
"id": "GO-2026-6605",
|
|
"module": "stdlib",
|
|
"found": "v1.25.0",
|
|
"fixed": "v1.26.9",
|
|
"symbolReachable": false,
|
|
"summary": "HTTP/1 client connection desynchronization after CONNECT rejection in net/http"
|
|
},
|
|
{
|
|
"id": "GO-2026-6607",
|
|
"module": "stdlib",
|
|
"found": "v1.25.0",
|
|
"fixed": "v1.26.9",
|
|
"symbolReachable": true,
|
|
"summary": "Reject malformed ECH outer extension references in crypto/tls"
|
|
},
|
|
{
|
|
"id": "GO-2026-6608",
|
|
"module": "stdlib",
|
|
"found": "v1.25.0",
|
|
"fixed": "v1.26.9",
|
|
"symbolReachable": true,
|
|
"summary": "Memory limit bypass when parsing MIME headers in net/textproto, mime/multipart"
|
|
},
|
|
{
|
|
"id": "GO-2026-6609",
|
|
"module": "stdlib",
|
|
"found": "v1.25.0",
|
|
"fixed": "v1.26.9",
|
|
"symbolReachable": false,
|
|
"summary": "Lack of limit on size of parsed Range headers in net/http"
|
|
},
|
|
{
|
|
"id": "GO-2026-6610",
|
|
"module": "stdlib",
|
|
"found": "v1.25.0",
|
|
"fixed": "v1.26.9",
|
|
"symbolReachable": false,
|
|
"summary": "HTTP/2 transport accepts malformed framing-related headers in net/http"
|
|
},
|
|
{
|
|
"id": "GO-2026-6611",
|
|
"module": "stdlib",
|
|
"found": "v1.25.0",
|
|
"fixed": "v1.26.9",
|
|
"symbolReachable": true,
|
|
"summary": "Excessive CPU consumption from repeated initial window changes in net/http"
|
|
},
|
|
{
|
|
"id": "GO-2026-6612",
|
|
"module": "stdlib",
|
|
"found": "v1.25.0",
|
|
"fixed": "v1.26.9",
|
|
"symbolReachable": true,
|
|
"summary": "Double flow control refund on HTTP/2 server streams in net/http"
|
|
},
|
|
{
|
|
"id": "GO-2026-6613",
|
|
"module": "stdlib",
|
|
"found": "v1.25.0",
|
|
"fixed": "v1.26.9",
|
|
"symbolReachable": true,
|
|
"summary": "HTTP/1 server connection desynchronization after 2xx CONNECT response in net/http"
|
|
},
|
|
{
|
|
"id": "GO-2026-6617",
|
|
"module": "stdlib",
|
|
"found": "v1.25.0",
|
|
"fixed": "v1.26.9",
|
|
"symbolReachable": true,
|
|
"summary": "HTTP/2 server crash due to HPACK encoder race in net/http"
|
|
},
|
|
{
|
|
"id": "GO-2026-6809",
|
|
"module": "stdlib",
|
|
"found": "v1.25.0",
|
|
"fixed": "v1.26.10",
|
|
"symbolReachable": true,
|
|
"summary": "Distrust compromised intermediate certificates in crypto/x509"
|
|
},
|
|
{
|
|
"id": "GO-2025-3503",
|
|
"module": "golang.org/x/net",
|
|
"found": "v0.33.0",
|
|
"fixed": "v0.36.0",
|
|
"symbolReachable": false,
|
|
"summary": "HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net"
|
|
},
|
|
{
|
|
"id": "GO-2025-3595",
|
|
"module": "golang.org/x/net",
|
|
"found": "v0.33.0",
|
|
"fixed": "v0.38.0",
|
|
"symbolReachable": false,
|
|
"summary": "Incorrect Neutralization of Input During Web Page Generation in x/net in golang.org/x/net"
|
|
},
|
|
{
|
|
"id": "GO-2026-4440",
|
|
"module": "golang.org/x/net",
|
|
"found": "v0.33.0",
|
|
"fixed": "v0.45.0",
|
|
"symbolReachable": false,
|
|
"summary": "Quadratic parsing complexity in golang.org/x/net/html"
|
|
},
|
|
{
|
|
"id": "GO-2026-4441",
|
|
"module": "golang.org/x/net",
|
|
"found": "v0.33.0",
|
|
"fixed": "v0.45.0",
|
|
"symbolReachable": false,
|
|
"summary": "Infinite parsing loop in golang.org/x/net"
|
|
},
|
|
{
|
|
"id": "GO-2026-4918",
|
|
"module": "golang.org/x/net",
|
|
"found": "v0.33.0",
|
|
"fixed": "v0.53.0",
|
|
"symbolReachable": false,
|
|
"summary": "Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net"
|
|
},
|
|
{
|
|
"id": "GO-2026-5025",
|
|
"module": "golang.org/x/net",
|
|
"found": "v0.33.0",
|
|
"fixed": "v0.55.0",
|
|
"symbolReachable": false,
|
|
"summary": "Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html"
|
|
},
|
|
{
|
|
"id": "GO-2026-5026",
|
|
"module": "golang.org/x/net",
|
|
"found": "v0.33.0",
|
|
"fixed": "v0.55.0",
|
|
"symbolReachable": false,
|
|
"summary": "Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna"
|
|
},
|
|
{
|
|
"id": "GO-2026-5027",
|
|
"module": "golang.org/x/net",
|
|
"found": "v0.33.0",
|
|
"fixed": "v0.55.0",
|
|
"symbolReachable": false,
|
|
"summary": "Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html"
|
|
},
|
|
{
|
|
"id": "GO-2026-5028",
|
|
"module": "golang.org/x/net",
|
|
"found": "v0.33.0",
|
|
"fixed": "v0.55.0",
|
|
"symbolReachable": false,
|
|
"summary": "Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html"
|
|
},
|
|
{
|
|
"id": "GO-2026-5029",
|
|
"module": "golang.org/x/net",
|
|
"found": "v0.33.0",
|
|
"fixed": "v0.55.0",
|
|
"symbolReachable": false,
|
|
"summary": "Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html"
|
|
},
|
|
{
|
|
"id": "GO-2026-5030",
|
|
"module": "golang.org/x/net",
|
|
"found": "v0.33.0",
|
|
"fixed": "v0.55.0",
|
|
"symbolReachable": false,
|
|
"summary": "Invoking duplicate attributes can cause XSS in golang.org/x/net/html"
|
|
},
|
|
{
|
|
"id": "GO-2026-5942",
|
|
"module": "golang.org/x/net",
|
|
"found": "v0.33.0",
|
|
"fixed": "v0.56.0",
|
|
"symbolReachable": false,
|
|
"summary": "Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage"
|
|
},
|
|
{
|
|
"id": "GO-2026-6603",
|
|
"module": "golang.org/x/net",
|
|
"found": "v0.33.0",
|
|
"fixed": "v0.60.0",
|
|
"symbolReachable": true,
|
|
"summary": "HTTP/2 server memory exhaustion due to Trailer headers in net/http"
|
|
},
|
|
{
|
|
"id": "GO-2026-6610",
|
|
"module": "golang.org/x/net",
|
|
"found": "v0.33.0",
|
|
"fixed": "v0.60.0",
|
|
"symbolReachable": false,
|
|
"summary": "HTTP/2 transport accepts malformed framing-related headers in net/http"
|
|
},
|
|
{
|
|
"id": "GO-2026-6611",
|
|
"module": "golang.org/x/net",
|
|
"found": "v0.33.0",
|
|
"fixed": "v0.60.0",
|
|
"symbolReachable": true,
|
|
"summary": "Excessive CPU consumption from repeated initial window changes in net/http"
|
|
},
|
|
{
|
|
"id": "GO-2026-6612",
|
|
"module": "golang.org/x/net",
|
|
"found": "v0.33.0",
|
|
"fixed": "v0.60.0",
|
|
"symbolReachable": true,
|
|
"summary": "Double flow control refund on HTTP/2 server streams in net/http"
|
|
},
|
|
{
|
|
"id": "GO-2026-6617",
|
|
"module": "golang.org/x/net",
|
|
"found": "v0.33.0",
|
|
"fixed": "v0.60.0",
|
|
"symbolReachable": true,
|
|
"summary": "HTTP/2 server crash due to HPACK encoder race in net/http"
|
|
},
|
|
{
|
|
"id": "GO-2026-6860",
|
|
"module": "golang.org/x/net",
|
|
"found": "v0.33.0",
|
|
"fixed": "v0.62.0",
|
|
"symbolReachable": false,
|
|
"summary": "Avoid quadratic complexity when coalescing text nodes in html in golang.org/x/net"
|
|
},
|
|
{
|
|
"id": "GO-2026-6866",
|
|
"module": "golang.org/x/net",
|
|
"found": "v0.33.0",
|
|
"fixed": "v0.62.0",
|
|
"symbolReachable": false,
|
|
"summary": "Check all ancestor namespace transitions when rendering raw text in html in golang.org/x/net"
|
|
},
|
|
{
|
|
"id": "GO-2026-5024",
|
|
"module": "golang.org/x/sys",
|
|
"found": "v0.28.0",
|
|
"fixed": "v0.44.0",
|
|
"symbolReachable": false,
|
|
"summary": "Invoking integer overflow in NewNTUnicodeString in golang.org/x/sys/windows"
|
|
},
|
|
{
|
|
"id": "GO-2026-5970",
|
|
"module": "golang.org/x/text",
|
|
"found": "v0.21.0",
|
|
"fixed": "v0.39.0",
|
|
"symbolReachable": false,
|
|
"summary": "Infinite loop on invalid input in golang.org/x/text"
|
|
},
|
|
{
|
|
"id": "GO-2026-6629",
|
|
"module": "golang.org/x/text",
|
|
"found": "v0.21.0",
|
|
"fixed": "v0.41.0",
|
|
"symbolReachable": false,
|
|
"summary": "Panic parsing crafted input in x/text/secure/precis in golang.org/x/text"
|
|
}
|
|
]
|
|
}
|