Tagged “go”
CVEs tagged go, newest first.
2108 CVEsRSS
CVE-2026-32283High· 7.5If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled consumption of resources
If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled consumption of resources. This can lead to a denial of service. This only affects T…
CVE-2026-32280High· 7.5During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of service
During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of service. This affects both direct u…
CVE-2026-33810High· 8.2When verifying a certificate chain containing excluded DNS constraints, these constraints are not correctly applied to wildcard DNS SANs which use a different case than the constraint
When verifying a certificate chain containing excluded DNS constraints, these constraints are not correctly applied to wildcard DNS SANs which use a different case than the constraint. This only affects validation of otherwise trusted ce…
CVE-2026-32281Medium· 5.9Inefficient policy validation in crypto/x509
Inefficient policy validation in crypto/x509
CVE-2026-33816High· 8.3github.com/jackc/pgx/v5: github.com/jackc/pgx: Memory-safety vulnerability (CVE-2026-33816)
A flaw was found in github.com/jackc/pgx, a PostgreSQL driver for Go. This memory-safety vulnerability could allow an attacker to cause various impacts, such as denial of service (DoS) or potentially arbitrary code execution, by exploiting…
CVE-2026-33815High· 8.3github.com/jackc/pgx/v5: github.com/jackc/pgx: Memory-safety vulnerability (CVE-2026-33815)
A flaw was found in github.com/jackc/pgx. This memory-safety vulnerability could potentially lead to unexpected behavior or system instability.
CVE-2026-33540High· 7.5Distribution affected by pull-through cache credential exfiltration via www-authenticate bearer realm
Distribution affected by pull-through cache credential exfiltration via www-authenticate bearer realm
CVE-2026-34972Medium· 4.2github.com/openfga/openfga: OpenFGA: Improper policy enforcement via specific BatchCheck calls (CVE-2026-34972)
A flaw was found in OpenFGA, a high-performance authorization engine. Under specific conditions, a user making BatchCheck calls with multiple checks for the same object, relation, and user combination can trigger improper policy enforcemen…
CVE-2026-35480Medium· 6.2go-ipld-prime: DAG-CBOR decoder unbounded memory allocation from CBOR headers
go-ipld-prime: DAG-CBOR decoder unbounded memory allocation from CBOR headers
CVE-2026-34986High· 7.5Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards
Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.4 and …
CVE-2026-35166MediumHugo: Certain markdown links are not properly escaped
Hugo: Certain markdown links are not properly escaped
CVE-2026-34976Critical· 10.0PoCDgraph: Pre-Auth Database Overwrite + SSRF + File Read via restoreTenant Missing Authorization
Dgraph: Pre-Auth Database Overwrite + SSRF + File Read via restoreTenant Missing Authorization
CVE-2026-34742High· 8.0github.com/modelcontextprotocol/go-sdk: Model Context Protocol (MCP) Go SDK: DNS rebinding vulnerability allows unauthorized access (CVE-20…
A flaw was found in the Model Context Protocol (MCP) Go SDK. When an HTTP-based MCP server is run on localhost without authentication, a malicious website can exploit a DNS rebinding vulnerability. This allows the attacker to bypass same-o…
CVE-2026-4370Critical· 10.0Juju has Improper TLS Client/Server authentication and certificate verification on Database Cluster
Juju has Improper TLS Client/Server authentication and certificate verification on Database Cluster
CVE-2026-33634CriticalCISA KEV0dayPoCTrivy ecosystem supply chain was briefly compromised in github.com/aquasecurity/trivy
Trivy ecosystem supply chain was briefly compromised in github.com/aquasecurity/trivy
CVE-2026-34783High· 8.1Ferret: Path Traversal in IO::FS::WRITE allows arbitrary file write when scraping malicious websites
Ferret: Path Traversal in IO::FS::WRITE allows arbitrary file write when scraping malicious websites
CVE-2026-5199LowTemporal Server: attacker-controlled namespace could signal, delete, and reset workflows or activities in a victim namespace on the same …
Temporal Server: attacker-controlled namespace could signal, delete, and reset workflows or activities in a victim namespace on the same cluster
CVE-2026-34040High· 8.4PoCMoby: Moby: Authorization bypass vulnerability (CVE-2026-34040)
A flaw was found in Moby, an open-source container framework. This security vulnerability allows attackers to bypass authorization plugins (AuthZ), which are mechanisms designed to control access and permissions within the container enviro…
CVE-2026-33762Low· 2.8go-git is an extensible git implementation library written in pure Go
go-git is an extensible git implementation library written in pure Go. Prior to version 5.17.1, go-git’s index decoder for format version 4 fails to validate the path name prefix length before applying it to the previously decoded path n…
CVE-2026-33030High· 8.8nginx-UI has Unencrypted Storage of DNS API Tokens and ACME Private Keys
nginx-UI has Unencrypted Storage of DNS API Tokens and ACME Private Keys
CVE-2026-27018HighGotenberg has Chromium deny-list bypass via case-insensitive URL scheme (bypass of GHSA-rh2x-ccvw-q7r3)
Gotenberg has Chromium deny-list bypass via case-insensitive URL scheme (bypass of GHSA-rh2x-ccvw-q7r3)
CVE-2026-32287High· 7.5XPath: Boolean expression infinite loop leads to denial of service via CPU exhaustion
XPath: Boolean expression infinite loop leads to denial of service via CPU exhaustion
GHSA-46wh-3698-f2cxHighTraefik: Deny Rule Bypass via Unauthenticated Malicious gRPC Requests in gRPC-Go Dependency (CVE-2026-33186)
Traefik: Deny Rule Bypass via Unauthenticated Malicious gRPC Requests in gRPC-Go Dependency (CVE-2026-33186)
CVE-2026-33433High· 8.8Traefik Vulnerable to BasicAuth/DigestAuth Identity Spoofing via Non-Canonical headerField
Traefik Vulnerable to BasicAuth/DigestAuth Identity Spoofing via Non-Canonical headerField
CVE-2026-32695MediumTraefik has Knative Ingress Rule Injection that Allows Host Restriction Bypass
Traefik has Knative Ingress Rule Injection that Allows Host Restriction Bypass
CVE-2026-33748Medium· 6.5github.com/moby/buildkit: BuildKit: Unauthorized file access via Git URL fragment subdir components (CVE-2026-33748)
A flaw was found in BuildKit. Insufficient validation of Git URL fragment subdirectory components may allow a remote attacker to access files outside the checked-out Git repository root. This access is limited to files on the same mounted …
CVE-2026-33747High· 8.2BuildKit: github.com/moby/buildkit: BuildKit: Arbitrary file write and code execution via untrusted frontend (CVE-2026-33747)
A flaw was found in BuildKit, a toolkit for converting source code to build artifacts. An untrusted BuildKit frontend can be leveraged to craft a malicious API message, allowing files to be written outside of the designated BuildKit state …
CVE-2026-34204High· 7.1MinIO is Vulnerable to SSE Metadata Injection via Replication Headers
MinIO is Vulnerable to SSE Metadata Injection via Replication Headers
CVE-2026-27877Medium· 6.5Grafana public dashboards disclose all direct mode datasources
Grafana public dashboards disclose all direct mode datasources
CVE-2026-28377High· 7.5Grafana Tempo has Inadequate Encryption Strength
Grafana Tempo has Inadequate Encryption Strength