Tagged “go”
CVEs tagged go, newest first.
2111 CVEsRSS
CVE-2026-48119High· 7.1Nezha's authenticated agents can forge service-monitor results for other users' services
Nezha's authenticated agents can forge service-monitor results for other users' services
CVE-2026-44740High· 7.5github.com/go-git/go-billy: Billy: Denial of Service via crafted input due to insufficient validation (CVE-2026-44740)
A flaw was found in Billy, an interface filesystem abstraction for Go. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by providing crafted or malformed input. The issue arises from insufficient validation an…
CVE-2026-10219High· 7.3GoClaw has a Command Injection issue
GoClaw has a Command Injection issue
CVE-2026-10517Medium· 5.8Claircore: Unauthenticated attackers can submit manifests with URIs pointing to internal services or cloud metadata endpoints
Claircore: Unauthenticated attackers can submit manifests with URIs pointing to internal services or cloud metadata endpoints
CVE-2026-42500NonePanic when reading out of bound palette index in golang.org/x/image/bmp
Panic when reading out of bound palette index in golang.org/x/image/bmp
GHSA-w5pp-99ch-qj29Medium· 6.5go-git: Malformed Git object data may cause panics or resource exhaustion
go-git: Malformed Git object data may cause panics or resource exhaustion
CVE-2026-6720HighCalico Inserts Sensitive Information into Log File
Calico Inserts Sensitive Information into Log File
CVE-2026-44973High· 8.1github.com/go-git/go-billy: Go-billy: Arbitrary file access due to path traversal vulnerability (CVE-2026-44973)
A flaw was found in go-billy, an interface filesystem abstraction for Go. Multiple path traversal vulnerabilities exist due to insufficient path sanitization and boundary enforcement. A remote attacker could exploit this by crafting malici…
CVE-2026-47179High· 7.7Arcane Has an Authenticated Arbitrary Host File Read via Docker Compose Include Directives
Arcane Has an Authenticated Arbitrary Host File Read via Docker Compose Include Directives
CVE-2026-45287Lowopentelemetry-go's Schema ParseFile leaks file descriptors on each parse
opentelemetry-go's Schema ParseFile leaks file descriptors on each parse
CVE-2026-9094Critical· 9.8Casdoor: GetTokenExchangeToken bypass through lack of cross-organization JWT signature check
Casdoor: GetTokenExchangeToken bypass through lack of cross-organization JWT signature check
CVE-2026-9804High· 7.7A flaw was found in KubeVirt's virt-exportserver component
A flaw was found in KubeVirt's virt-exportserver component. An attacker with specific namespace-level access can exploit a path traversal vulnerability in the VMExport directory endpoint. By placing a symbolic link (symlink) within an ex…
CVE-2026-44327Critical· 10.0free5GC is an open-source implementation of the 5G core network
free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's NEF mounts the nnef-oam route group without inbound OAuth2/bearer-token authorization. A network attacker who can reach NEF on the SBI can hit the…
CVE-2026-45570Medium· 6.3github.com/go-git/go-git: go-git: Shell command injection in SSH transport (CVE-2026-45570)
A flaw was found in go-git, a library used for Git operations. The component responsible for secure shell (SSH) communication does not correctly handle special characters in repository paths. This oversight allows a remote attacker to mani…
CVE-2026-7374Critical· 9.9A flaw was found in KubeVirt's virt-handler component
A flaw was found in KubeVirt's virt-handler component. This vulnerability allows an authenticated OpenShift user with edit permissions in a single namespace to exploit improper symlink validation when connecting to virtual machine consol…
CVE-2026-25680Medium· 6.5golang.org/x/net/html: golang.org/x/net/html: Denial of Service due to excessive HTML parsing (CVE-2026-25680)
A flaw was found in golang.org/x/net/html. A remote attacker could provide specially crafted HTML, which, when parsed by the affected component, would consume excessive CPU resources. This could lead to a Denial of Service (DoS) condition,…
CVE-2026-42502Medium· 6.1Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html
Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html
CVE-2026-27136NoneInvoking duplicate attributes can cause XSS in golang.org/x/net/html
Invoking duplicate attributes can cause XSS in golang.org/x/net/html
CVE-2026-25681NoneInvoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html
Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html
CVE-2026-39821Critical· 9.6The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label
The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior …
CVE-2026-46598Medium· 5.3golang.org/x/crypto/ssh/agent: golang: golang.org/x/crypto/ssh/agent: Denial of Service via malformed input (CVE-2026-46598)
A flaw was found in golang.org/x/crypto/ssh/agent. An attacker could provide specially crafted inputs that, when processed, lead to the creation of an ed25519.PrivateKey by casting malformed wire bytes. This improper input handling can cau…
CVE-2026-39833Medium· 5.5⚖ disputedgolang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to unenforced key confirmation (CVE-2026-39833)
A flaw was found in golang.org/x/crypto/ssh/agent. The NewKeyring() function, which creates an in-memory keyring, failed to enforce the ConfirmBeforeUse constraint on keys. This allowed keys configured to require user confirmation before u…
CVE-2026-39832Critical· 9.1When adding a key to a remote agent constraint extensions such as [email protected] were not serialized in the request
When adding a key to a remote agent constraint extensions such as [email protected] were not serialized in the request. Destination restrictions were silently stripped when forwarding keys, allowing unrestricted use of…
CVE-2026-46597High· 7.5Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh
Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh
CVE-2026-39828Medium· 6.3⚖ disputedInvoking bypass of certificate restrictions in golang.org/x/crypto/ssh
When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as force-command after a second factor succee…
CVE-2026-39835Medium· 5.3SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate
SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate. CertChecker now returns an error instead of panicking when these…
CVE-2026-39827Medium· 6.5golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via repeated rejected channel openings (CVE-2026-39827)
A flaw was found in golang.org/x/crypto/ssh. An authenticated SSH client can cause a Denial of Service (DoS) by repeatedly opening channels that are rejected by the server. This leads to unbounded memory growth, eventually crashing the ser…
CVE-2026-39830Critical· 9.1A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop
A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop. The blocked goroutine could not be released by calling Close(), resulting in a resource leak per connec…
CVE-2026-39829High· 7.5The RSA and DSA public key parsers did not enforce size limits on key parameters
The RSA and DSA public key parsers did not enforce size limits on key parameters. A crafted public key with an excessively large modulus or DSA parameter could cause several minutes of CPU consumption during signature verification. This …
CVE-2026-39831High· 8.1golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Security key bypass due to missing user presence check (CVE-2026-39831)
A flaw was found in golang.org/x/crypto/ssh. The Verify() method, responsible for FIDO/U2F security key types, did not properly check for user presence. This allowed signatures to be accepted without requiring a physical touch on the hardw…