stdlib (Go)

Advisories

188

Latest version

—

License

—

OpenSSF Scorecard

—

How to fix

Upgrading to 1.27.3 or later clears every advisory below that has a fix.

Upgrade commands

go get stdlib@v1.27.3 && go mod tidy

Known vulnerabilities

Advisory	Severity	Affected	Fixed in
RUSTSEC-2026-0382 Distrust compromised intermediate certificates in crypto/x509	Medium EPSS 0.40%	`< 1.26.10` `>= 1.27.0-0, < 1.27.3`	`1.26.10` `1.27.3`
GO-2026-6611 Excessive CPU consumption from repeated initial window changes in net/http	High EPSS 0.61%	`>= 1.27.0-0, < 1.27.2`	`1.27.2`
GO-2026-6613 HTTP/1 server connection desynchronization after 2xx CONNECT response in net/http	High EPSS 0.41%	`< 1.26.9` `>= 1.27.0-0, < 1.27.2`	`1.26.9` `1.27.2`
GO-2026-6609 Lack of limit on size of parsed Range headers in net/http	High EPSS 0.48%	`< 1.26.9` `>= 1.27.0-0, < 1.27.2`	`1.26.9` `1.27.2`
GO-2026-6608 Memory limit bypass when parsing MIME headers in net/textproto, mime/multipart	High EPSS 0.51%	`< 1.26.9` `>= 1.27.0-0, < 1.27.2`	`1.26.9` `1.27.2`
GO-2026-6607 Reject malformed ECH outer extension references in crypto/tls	High EPSS 0.52%	`< 1.26.9` `>= 1.27.0-0, < 1.27.2`	`1.26.9` `1.27.2`
GO-2026-6604 Root.Mkdir(All) can follow junctions out of the root on Windows in os	Critical EPSS 0.55%	`< 1.26.9` `>= 1.27.0-0, < 1.27.2`	`1.26.9` `1.27.2`
GO-2026-6600 Recognize yield as regexp preceder keyword in html/template	Medium EPSS 0.29%	`< 1.26.9` `>= 1.27.0-0, < 1.27.2`	`1.26.9` `1.27.2`
GO-2026-6605 HTTP/1 client connection desynchronization after CONNECT rejection in net/http	High EPSS 0.47%	`< 1.26.9` `>= 1.27.0-0, < 1.27.2`	`1.26.9` `1.27.2`
GO-2026-6599 Reset context tracking on consecutive template expressions in html/template	Medium EPSS 0.29%	`< 1.26.9` `>= 1.27.0-0, < 1.27.2`	`1.26.9` `1.27.2`
GO-2026-6617 HTTP/2 server crash due to HPACK encoder race in net/http	High EPSS 0.49%	`>= 1.27.0-0, < 1.27.2`	`1.27.2`
GO-2026-6617 HTTP/2 server crash due to HPACK encoder race in net/http	High EPSS 0.49%	`< 1.26.9`	`1.26.9`
GO-2026-6612 Double flow control refund on HTTP/2 server streams in net/http	Critical EPSS 0.62%	`>= 1.27.0-0, < 1.27.2`	`1.27.2`
GO-2026-6603 HTTP/2 server memory exhaustion due to Trailer headers in net/http	High EPSS 0.63%	`< 1.26.9`	`1.26.9`
GO-2026-6603 HTTP/2 server memory exhaustion due to Trailer headers in net/http	High EPSS 0.63%	`>= 1.27.0-0, < 1.27.2`	`1.27.2`
GO-2026-6610 HTTP/2 transport accepts malformed framing-related headers in net/http	High EPSS 0.43%	`< 1.26.9`	`1.26.9`
GO-2026-6610 HTTP/2 transport accepts malformed framing-related headers in net/http	High EPSS 0.43%	`>= 1.27.0-0, < 1.27.2`	`1.27.2`
GO-2026-6611 Excessive CPU consumption from repeated initial window changes in net/http	High EPSS 0.61%	`< 1.26.9`	`1.26.9`
GO-2026-6612 Double flow control refund on HTTP/2 server streams in net/http	Critical EPSS 0.62%	`< 1.26.9`	`1.26.9`
GO-2026-6091 Fix Javascript regexp context tracking in html/template	Medium EPSS 0.31%	`< 1.25.13` `>= 1.26.0-0, < 1.26.6` `>= 1.27.0-0, < 1.27.0-rc.3`	`1.25.13` `1.26.6` `1.27.0-rc.3`
GO-2026-6089 Apply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/http	High EPSS 0.57%	`< 1.25.13` `>= 1.26.0-0, < 1.26.6` `>= 1.27.0-0, < 1.27.0-rc.3`	`1.25.13` `1.26.6` `1.27.0-rc.3`
GO-2026-6218 Avoid quadratic complexity in resolvePath in net/url	Medium EPSS 0.55%	`< 1.25.13` `>= 1.26.0-0, < 1.26.6` `>= 1.27.0-0, < 1.27.0-rc.3`	`1.25.13` `1.26.6` `1.27.0-rc.3`
GO-2026-6088 Add recursion depth guard during decode in encoding/xml	High EPSS 0.57%	`< 1.25.13` `>= 1.26.0-0, < 1.26.6` `>= 1.27.0-0, < 1.27.0-rc.3`	`1.25.13` `1.26.6` `1.27.0-rc.3`
GO-2026-6090 Limit handshake messages we are willing to accept post-handshake in crypto/tls	High EPSS 0.57%	`< 1.25.13` `>= 1.26.0-0, < 1.26.6` `>= 1.27.0-0, < 1.27.0-rc.3`	`1.25.13` `1.26.6` `1.27.0-rc.3`
GO-2026-5972 Enforce maximum recursion depth in encoding/asn1	High EPSS 0.57%	`< 1.25.13` `>= 1.26.0-0, < 1.26.6` `>= 1.27.0-0, < 1.27.0-rc.3`	`1.25.13` `1.26.6` `1.27.0-rc.3`
GO-2026-5942 Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage	High EPSS 0.55%	`>= 1.26.0-0, < 1.26.6` `>= 1.27.0-0, < 1.27.0-rc.3`	`1.26.6` `1.27.0-rc.3`
GO-2026-5856 Invoking Encrypted Client Hello privacy leak in crypto/tls	Medium EPSS 0.38%	`< 1.25.12` `>= 1.26.0-0, < 1.26.5` `>= 1.27.0-0, < 1.27.0-rc.2`	`1.25.12` `1.26.5` `1.27.0-rc.2`
GO-2026-4970 Root escape via symlink plus trailing slash in os	High EPSS 0.23%	`< 1.25.12` `>= 1.26.0-0, < 1.26.5` `>= 1.27.0-0, < 1.27.0-rc.2`	`1.25.12` `1.26.5` `1.27.0-rc.2`
GO-2026-5037 Inefficient candidate hostname parsing in crypto/x509	Medium EPSS 0.59%	`< 1.25.11` `>= 1.26.0-0, < 1.26.4`	`1.25.11` `1.26.4`
GO-2026-5038 Quadratic complexity in WordDecoder.DecodeHeader in mime	High EPSS 0.56%	`< 1.25.11` `>= 1.26.0-0, < 1.26.4`	`1.25.11` `1.26.4`
GO-2026-5039 Arbitrary inputs are included in errors without any escaping in net/textproto	Medium EPSS 0.37%	`< 1.25.11` `>= 1.26.0-0, < 1.26.4`	`1.25.11` `1.26.4`
GO-2026-5026 Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna	Critical EPSS 1.83%	`< 1.25.13` `>= 1.26.0-0, < 1.26.6` `>= 1.27.0-0, < 1.27.0-rc.3`	`1.25.13` `1.26.6` `1.27.0-rc.3`
GO-2026-4980 Escaper bypass leads to XSS in html/template	Medium EPSS 0.37%	`< 1.25.10` `>= 1.26.0-0, < 1.26.3`	`1.25.10` `1.26.3`
GO-2026-4971 Panic in Dial and LookupPort when handling NUL byte on Windows in net	High EPSS 0.63%	`< 1.25.10` `>= 1.26.0-0, < 1.26.3`	`1.25.10` `1.26.3`
GO-2026-4918 Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net	High EPSS 0.84%	`< 1.25.10` `>= 1.26.0-0, < 1.26.3`	`1.25.10` `1.26.3`
GO-2026-4976 ReverseProxy forwards queries with more than urlmaxqueryparams parameters in net/http/httputil	Medium EPSS 0.39%	`< 1.25.10` `>= 1.26.0-0, < 1.26.3`	`1.25.10` `1.26.3`
GO-2026-4982 Bypass of meta content URL escaping causes XSS in html/template	Medium EPSS 0.31%	`< 1.25.10` `>= 1.26.0-0, < 1.26.3`	`1.25.10` `1.26.3`
GO-2026-4977 Quadratic string concatenation in consumePhrase in net/mail	High EPSS 0.80%	`< 1.25.10` `>= 1.26.0-0, < 1.26.3`	`1.25.10` `1.26.3`
GO-2026-4986 Quadratic string concatentation in consumeComment in net/mail	High EPSS 0.78%	`< 1.25.10` `>= 1.26.0-0, < 1.26.3`	`1.25.10` `1.26.3`
GO-2026-4981 Crash when handling long CNAME response in net	High EPSS 0.88%	`< 1.25.10` `>= 1.26.0-0, < 1.26.3`	`1.25.10` `1.26.3`
GO-2026-4870 Unauthenticated TLS 1.3 KeyUpdate record can cause persistent connection retention and DoS in crypto/tls	High EPSS 0.62%	`< 1.25.9` `>= 1.26.0-0, < 1.26.2`	`1.25.9` `1.26.2`
GO-2026-4869 Unbounded allocation for old GNU sparse in archive/tar	Medium EPSS 0.29%	`< 1.25.9` `>= 1.26.0-0, < 1.26.2`	`1.25.9` `1.26.2`
GO-2026-4947 Unexpected work during chain building in crypto/x509	High EPSS 0.61%	`< 1.25.9` `>= 1.26.0-0, < 1.26.2`	`1.25.9` `1.26.2`
GO-2026-4865 JsBraceDepth Context Tracking Bugs (XSS) in html/template	Medium EPSS 0.29%	`< 1.25.9` `>= 1.26.0-0, < 1.26.2`	`1.25.9` `1.26.2`
GO-2026-4866 Case-sensitive excludedSubtrees name constraints cause Auth Bypass in crypto/x509	High EPSS 0.34%	`>= 1.26.0-0, < 1.26.2`	`1.26.2`
GO-2026-4864 TOCTOU permits root escape on Linux via Root.Chmod in os in internal/syscall/unix	Medium EPSS 0.29%	`< 1.25.9` `>= 1.26.0-0, < 1.26.2`	`1.25.9` `1.26.2`
GO-2026-4946 Inefficient policy validation in crypto/x509	High EPSS 0.36%	`< 1.25.9` `>= 1.26.0-0, < 1.26.2`	`1.25.9` `1.26.2`
GO-2026-4603 URLs in meta content attribute actions are not escaped in html/template	Medium EPSS 0.34%	`< 1.25.8` `>= 1.26.0-0, < 1.26.1`	`1.25.8` `1.26.1`
GO-2026-4599 Incorrect enforcement of email constraints in crypto/x509	High EPSS 0.63%	`>= 1.26.0-0, < 1.26.1`	`1.26.1`
GO-2026-4600 Panic in name constraint checking for malformed certificates in crypto/x509	Medium EPSS 0.36%	`>= 1.26.0-0, < 1.26.1`	`1.26.1`
GO-2026-4601 Incorrect parsing of IPv6 host literals in net/url	High EPSS 0.77%	`< 1.25.8` `>= 1.26.0-0, < 1.26.1`	`1.25.8` `1.26.1`
GO-2026-4602 FileInfo can escape from a Root in os	Low EPSS 0.21%	`< 1.25.8` `>= 1.26.0-0, < 1.26.1`	`1.25.8` `1.26.1`
GO-2026-4337 Unexpected session resumption in crypto/tls	Critical EPSS 0.92%	`< 1.24.13` `>= 1.25.0-0, < 1.25.7` `>= 1.26.0-rc.1, < 1.26.0-rc.3`	`1.24.13` `1.25.7` `1.26.0-rc.3`
GO-2026-4403 Improper access to parent directory of root in os	Low EPSS 0.23%	`< 1.23.9` `>= 1.24.0-0, < 1.24.3`	`1.23.9` `1.24.3`
GO-2026-4342 Excessive CPU consumption when building archive index in archive/zip	Medium EPSS 0.74%	`< 1.24.12` `>= 1.25.0, < 1.25.6`	`1.24.12` `1.25.6`
GO-2026-4341 Memory exhaustion in query parameter parsing in net/url	High EPSS 2.29%	`< 1.24.12` `>= 1.25.0, < 1.25.6`	`1.24.12` `1.25.6`
GO-2026-4340 Handshake messages may be processed at the incorrect encryption level in crypto/tls	Medium EPSS 0.32%	`< 1.24.12` `>= 1.25.0, < 1.25.6`	`1.24.12` `1.25.6`
GO-2025-4175 Improper application of excluded DNS name constraints when verifying wildcard names in crypto/x509	Medium EPSS 0.28%	`< 1.24.11` `>= 1.25.0, < 1.25.5`	`1.24.11` `1.25.5`
GO-2025-4155 Excessive resource consumption when printing error string for host certificate validation in crypto/x509	High EPSS 0.46%	`< 1.24.11` `>= 1.25.0, < 1.25.5`	`1.24.11` `1.25.5`
GO-2025-4015 Excessive CPU consumption in Reader.ReadResponse in net/textproto	Medium EPSS 0.56%	`< 1.24.8` `>= 1.25.0, < 1.25.2`	`1.24.8` `1.25.2`
GO-2025-4014 Unbounded allocation when parsing GNU sparse map in archive/tar	Medium EPSS 0.44%	`< 1.24.8` `>= 1.25.0, < 1.25.2`	`1.24.8` `1.25.2`
GO-2025-4013 Panic when validating certificates with DSA public keys in crypto/x509	High EPSS 0.38%	`< 1.24.8` `>= 1.25.0, < 1.25.2`	`1.24.8` `1.25.2`
GO-2025-4012 Lack of limit when parsing cookies can cause memory exhaustion in net/http	Medium EPSS 0.56%	`< 1.24.8` `>= 1.25.0, < 1.25.2`	`1.24.8` `1.25.2`
GO-2025-4011 Parsing DER payload can cause memory exhaustion in encoding/asn1	Medium EPSS 0.56%	`< 1.24.8` `>= 1.25.0, < 1.25.2`	`1.24.8` `1.25.2`
GO-2025-4010 Insufficient validation of bracketed IPv6 hostnames in net/url	Medium EPSS 0.47%	`< 1.24.8` `>= 1.25.0, < 1.25.2`	`1.24.8` `1.25.2`
GO-2025-4009 Quadratic complexity when parsing some invalid inputs in encoding/pem	High EPSS 0.66%	`< 1.24.8` `>= 1.25.0, < 1.25.2`	`1.24.8` `1.25.2`
GO-2025-4008 ALPN negotiation error contains attacker controlled information in crypto/tls	Medium EPSS 0.47%	`< 1.24.8` `>= 1.25.0, < 1.25.2`	`1.24.8` `1.25.2`
GO-2025-4007 Quadratic complexity when checking name constraints in crypto/x509	High EPSS 0.41%	`< 1.24.9` `>= 1.25.0, < 1.25.3`	`1.24.9` `1.25.3`
GO-2025-4006 Excessive CPU consumption in ParseAddress in net/mail	High EPSS 0.65%	`< 1.24.8` `>= 1.25.0, < 1.25.2`	`1.24.8` `1.25.2`
GO-2025-3955 CrossOriginProtection insecure bypass patterns not limited to exact matches in net/http	Medium EPSS 0.35%	`>= 1.25.0, < 1.25.1`	`1.25.1`
GO-2025-3956 Unexpected paths returned from LookPath in os/exec	Medium EPSS 0.55%	`< 1.23.12` `>= 1.24.0, < 1.24.6`	`1.23.12` `1.24.6`
GO-2025-3849 Incorrect results returned from Rows.Scan in database/sql	High EPSS 0.41%	`< 1.23.12` `>= 1.24.0, < 1.24.6`	`1.23.12` `1.24.6`
GO-2025-3750 Inconsistent handling of O_CREATE\|O_EXCL on Unix and Windows in os in syscall	Medium EPSS 0.33%	`< 1.23.10` `>= 1.24.0-0, < 1.24.4`	`1.23.10` `1.24.4`
GO-2025-3751 Sensitive headers not cleared on cross-origin redirect in net/http	Medium EPSS 0.67%	`< 1.23.10` `>= 1.24.0-0, < 1.24.4`	`1.23.10` `1.24.4`
GO-2025-3749 Usage of ExtKeyUsageAny disables policy validation in crypto/x509	High EPSS 0.37%	`>= 1.24.0-0, < 1.24.4`	`1.24.4`
GO-2025-3563 RoadRunner is at risk of HTTP Request/Response Smuggling through vulnerable dependency	Critical EPSS 0.83%	`< 1.23.8` `>= 1.24.0-0, < 1.24.2`	`1.23.8` `1.24.2`
GHSA-qxp5-gwg8-xv66 HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net	Medium EPSS 0.43%	`< 1.23.7` `>= 1.24.0-0, < 1.24.1`	`1.23.7` `1.24.1`
GO-2025-3447 Timing sidechannel for P-256 on ppc64le in crypto/internal/nistec	Medium EPSS 0.29%	`< 1.22.12` `>= 1.23.0-0, < 1.23.6` `>= 1.24.0-0, < 1.24.0-rc.3`	`1.22.12` `1.23.6` `1.24.0-rc.3`
GO-2025-3420 Sensitive headers incorrectly sent after cross-domain redirect in net/http	Medium EPSS 0.73%	`< 1.22.11` `>= 1.23.0-0, < 1.23.5` `>= 1.24.0-0, < 1.24.0-rc.2`	`1.22.11` `1.23.5` `1.24.0-rc.2`
GO-2025-3421 ParsePKCS1PrivateKey panic with partial keys in crypto/x509	High EPSS 0.61%	`>= 1.24.0-0, < 1.24.0-rc.2`	`1.24.0-rc.2`
GO-2025-3373 Usage of IPv6 zone IDs can bypass URI name constraints in crypto/x509	Medium EPSS 0.57%	`< 1.22.11` `>= 1.23.0-0, < 1.23.5` `>= 1.24.0-0, < 1.24.0-rc.2`	`1.22.11` `1.23.5` `1.24.0-rc.2`
GO-2024-3105 Stack exhaustion in all Parse functions in go/parser	Medium EPSS 0.84%	`< 1.22.7` `>= 1.23.0-0, < 1.23.1`	`1.22.7` `1.23.1`
GO-2024-3107 Stack exhaustion in Parse in go/build/constraint	High EPSS 1.05%	`< 1.22.7` `>= 1.23.0-0, < 1.23.1`	`1.22.7` `1.23.1`
GO-2024-3106 Stack exhaustion in Decoder.Decode in encoding/gob	High EPSS 1.92%	`< 1.22.7` `>= 1.23.0-0, < 1.23.1`	`1.22.7` `1.23.1`
GO-2024-2963 Denial of service due to improper 100-continue handling in net/http	High EPSS 1.41%	`< 1.21.12` `>= 1.22.0-0, < 1.22.5`	`1.21.12` `1.22.5`
GO-2024-2887 Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses in net/netip	Critical EPSS 1.95%	`< 1.21.11` `>= 1.22.0-0, < 1.22.4`	`1.21.11` `1.22.4`
GO-2024-2888 Mishandling of corrupt central directory record in archive/zip	Medium EPSS 0.44%	`< 1.21.11` `>= 1.22.0-0, < 1.22.4`	`1.21.11` `1.22.4`
GO-2024-2824 Malformed DNS message can cause infinite loop in net	Medium EPSS 0.99%	`>= 1.22.0-0, < 1.22.3`	`1.22.3`
GHSA-4v7x-pqxf-cx7m net/http, x/net/http2: close connections when receiving too many headers	High EPSS 91.97%	`< 1.21.9` `>= 1.22.0-0, < 1.22.2`	`1.21.9` `1.22.2`
GO-2024-2610 Errors returned from JSON marshaling may break template escaping in html/template	Medium EPSS 0.80%	`< 1.21.8` `>= 1.22.0-0, < 1.22.1`	`1.21.8` `1.22.1`
GO-2024-2609 Comments in display names are incorrectly handled in net/mail	High EPSS 1.05%	`< 1.21.8` `>= 1.22.0-0, < 1.22.1`	`1.21.8` `1.22.1`
GO-2024-2600 Incorrect forwarding of sensitive headers and cookies on HTTP redirect in net/http	Medium EPSS 1.08%	`< 1.21.8` `>= 1.22.0-0, < 1.22.1`	`1.21.8` `1.22.1`
GO-2024-2599 Memory exhaustion in multipart form parsing in net/textproto and net/http	Medium EPSS 1.17%	`< 1.21.8` `>= 1.22.0-0, < 1.22.1`	`1.21.8` `1.22.1`
GO-2024-2598 Verify panics on certificates with an unknown public key algorithm in crypto/x509	Medium EPSS 0.67%	`< 1.21.8` `>= 1.22.0-0, < 1.22.1`	`1.21.8` `1.22.1`
GO-2023-2382 Denial of service via chunk extensions in net/http	Medium EPSS 1.21%	`< 1.20.12` `>= 1.21.0-0, < 1.21.5`	`1.20.12` `1.21.5`
GO-2023-2375 Before Go 1.20, the RSA based key exchange methods in crypto/tls may exhibit a timing side channel	High EPSS 1.25%	`< 1.20.0`	`1.20.0`
GO-2023-2186 Incorrect detection of reserved device names on Windows in path/filepath	Medium EPSS 0.90%	`< 1.20.11` `>= 1.21.0-0, < 1.21.4`	`1.20.11` `1.21.4`
GO-2023-2185 Insecure parsing of Windows paths with a \??\ prefix in path/filepath	High EPSS 2.76%	`< 1.20.11` `>= 1.21.0-0, < 1.21.4`	`1.20.11` `1.21.4`
GO-2023-2185 Insecure parsing of Windows paths with a \??\ prefix in path/filepath	High EPSS 2.76%	`>= 1.20.11, < 1.20.12` `>= 1.21.4, < 1.21.5`	`1.20.12` `1.21.5`
GHSA-4374-p667-p6c8 HTTP/2 rapid reset can cause excessive work in net/http Known exploited	High EPSS 100.00%	`< 1.20.10` `>= 1.21.0-0, < 1.21.3`	`1.20.10` `1.21.3`
GO-2023-2044 Panic when processing post-handshake message on QUIC connections in crypto/tls	High EPSS 1.34%	`>= 1.21.0-0, < 1.21.1`	`1.21.1`
GO-2023-2045 Memory exhaustion in QUIC connection handling in crypto/tls	High EPSS 1.34%	`>= 1.21.0-0, < 1.21.1`	`1.21.1`
GO-2023-2043 Improper handling of special tags within script contexts in html/template	Medium EPSS 0.91%	`< 1.20.8` `>= 1.21.0-0, < 1.21.1`	`1.20.8` `1.21.1`
GO-2023-2041 Improper handling of HTML-like comments in script contexts in html/template	Medium EPSS 0.93%	`< 1.20.8` `>= 1.21.0-0, < 1.21.1`	`1.20.8` `1.21.1`
GO-2023-1987 Large RSA keys can cause high CPU usage in crypto/tls	Medium EPSS 1.60%	`< 1.19.12` `>= 1.20.0-0, < 1.20.7` `>= 1.21.0-0, < 1.21.0-rc.4`	`1.19.12` `1.20.7` `1.21.0-rc.4`
GO-2023-1878 Insufficient sanitization of Host header in net/http	Medium EPSS 1.45%	`< 1.19.11` `>= 1.20.0-0, < 1.20.6`	`1.19.11` `1.20.6`
GO-2023-1840 Unsafe behavior in setuid/setgid binaries in runtime	High EPSS 0.43%	`< 1.19.10` `>= 1.20.0-0, < 1.20.5`	`1.19.10` `1.20.5`
GO-2023-1753 Improper handling of empty HTML attributes in html/template	High EPSS 1.04%	`< 1.19.9` `>= 1.20.0-0, < 1.20.4`	`1.19.9` `1.20.4`
GO-2023-1752 Improper handling of JavaScript whitespace in html/template	Critical EPSS 1.56%	`< 1.19.9` `>= 1.20.0-0, < 1.20.4`	`1.19.9` `1.20.4`
GO-2023-1751 Improper sanitization of CSS values in html/template	High EPSS 1.04%	`< 1.19.9` `>= 1.20.0-0, < 1.20.4`	`1.19.9` `1.20.4`
GO-2023-1703 Backticks not treated as string delimiters in html/template	Critical EPSS 2.28%	`< 1.19.8` `>= 1.20.0-0, < 1.20.3`	`1.19.8` `1.20.3`
GO-2023-1702 Infinite loop in parsing in go/scanner	High EPSS 1.41%	`< 1.19.8` `>= 1.20.0-0, < 1.20.3`	`1.19.8` `1.20.3`
GO-2023-1705 Excessive resource consumption in net/http, net/textproto and mime/multipart	High EPSS 1.48%	`< 1.19.8` `>= 1.20.0-0, < 1.20.3`	`1.19.8` `1.20.3`
GO-2023-1704 Excessive memory allocation in net/http and net/textproto	High EPSS 1.89%	`< 1.19.8` `>= 1.20.0-0, < 1.20.3`	`1.19.8` `1.20.3`
GO-2023-1621 Incorrect calculation on P256 curves in crypto/internal/nistec	Medium EPSS 0.82%	`< 1.19.7` `>= 1.20.0-0, < 1.20.2`	`1.19.7` `1.20.2`
GO-2023-1569 Excessive resource consumption in mime/multipart	High EPSS 1.24%	`< 1.19.6` `>= 1.20.0-0, < 1.20.1`	`1.19.6` `1.20.1`
GHSA-vvpx-j8f3-3w6h golang.org/x/net vulnerable to Uncontrolled Resource Consumption	High EPSS 4.56%	`< 1.19.6` `>= 1.20.0-0, < 1.20.1`	`1.19.6` `1.20.1`
GO-2023-1570 Panic on large handshake records in crypto/tls	High EPSS 1.11%	`< 1.19.6` `>= 1.20.0-0, < 1.20.1`	`1.19.6` `1.20.1`
GO-2023-1568 Path traversal on Windows in path/filepath	High EPSS 1.68%	`< 1.19.6` `>= 1.20.0-0, < 1.20.1`	`1.19.6` `1.20.1`
GHSA-xrjj-mj9h-534m golang.org/x/net/http2 vulnerable to possible excessive memory growth	Medium EPSS 6.08%	`< 1.18.9` `>= 1.19.0-0, < 1.19.4`	`1.18.9` `1.19.4`
GO-2022-1143 Restricted file access on Windows in os and net/http	High EPSS 1.28%	`< 1.18.9` `>= 1.19.0-0, < 1.19.4`	`1.18.9` `1.19.4`
GO-2022-1095 Unsanitized NUL in environment variables on Windows in syscall and os/exec	High EPSS 1.03%	`< 1.18.8` `>= 1.19.0-0, < 1.19.3`	`1.18.8` `1.19.3`
GO-2022-1038 Incorrect sanitization of forwarded query parameters in net/http/httputil	High EPSS 1.41%	`< 1.18.7` `>= 1.19.0-0, < 1.19.2`	`1.18.7` `1.19.2`
GO-2022-1039 Memory exhaustion when compiling regular expressions in regexp/syntax	High EPSS 1.73%	`< 1.18.7` `>= 1.19.0-0, < 1.19.2`	`1.18.7` `1.19.2`
GO-2022-1037 Unbounded memory consumption when reading headers in archive/tar	High EPSS 2.01%	`< 1.18.7` `>= 1.19.0-0, < 1.19.2`	`1.18.7` `1.19.2`
GO-2022-0988 Failure to strip relative path components in net/url	High EPSS 2.15%	`>= 1.19.0-0, < 1.19.1`	`1.19.1`
GHSA-69cg-p879-7622 golang.org/x/net/http2 Denial of Service vulnerability	High EPSS 3.49%	`< 1.18.6` `>= 1.19.0-0, < 1.19.1`	`1.18.6` `1.19.1`
GO-2022-0761 Improper input validation in net/http and net/http/cgi	Not rated yet EPSS 5.22%	`< 1.6.3`	`1.6.3`
GO-2022-0537 Panic when decoding Float and Rat types in math/big	High EPSS 2.78%	`< 1.17.13` `>= 1.18.0-0, < 1.18.5`	`1.17.13` `1.18.5`
GO-2022-0533 Path traversal via Clean on Windows in path/filepath	High EPSS 2.39%	`< 1.17.11` `>= 1.18.0-0, < 1.18.3`	`1.17.11` `1.18.3`
GO-2022-0531 Session tickets lack random ticket_age_add in crypto/tls	Low EPSS 1.21%	`< 1.17.11` `>= 1.18.0-0, < 1.18.3`	`1.17.11` `1.18.3`
GO-2022-0520 Exposure of client IP addresses in net/http	Medium EPSS 1.52%	`< 1.17.12` `>= 1.18.0-0, < 1.18.4`	`1.17.12` `1.18.4`
GO-2022-0532 Empty Cmd.Path can trigger unintended binary in os/exec on Windows	High EPSS 0.70%	`< 1.17.11` `>= 1.18.0-0, < 1.18.3`	`1.17.11` `1.18.3`
GO-2022-0525 Improper sanitization of Transfer-Encoding headers in net/http	Medium EPSS 1.53%	`< 1.17.12` `>= 1.18.0-0, < 1.18.4`	`1.17.12` `1.18.4`
GO-2022-0527 Stack exhaustion in Glob on certain paths in io/fs	High EPSS 2.19%	`< 1.17.12` `>= 1.18.0-0, < 1.18.4`	`1.17.12` `1.18.4`
GO-2022-0526 Stack exhaustion when decoding certain messages in encoding/gob	High EPSS 1.92%	`< 1.17.12` `>= 1.18.0-0, < 1.18.4`	`1.17.12` `1.18.4`
GO-2022-0524 Stack exhaustion when reading certain archives in compress/gzip	High EPSS 2.19%	`< 1.17.12` `>= 1.18.0-0, < 1.18.4`	`1.17.12` `1.18.4`
GO-2022-0523 Stack exhaustion when unmarshaling certain documents in encoding/xml	High EPSS 2.21%	`< 1.17.12` `>= 1.18.0-0, < 1.18.4`	`1.17.12` `1.18.4`
GO-2022-0522 Stack exhaustion on crafted paths in path/filepath	High EPSS 2.19%	`< 1.17.12` `>= 1.18.0-0, < 1.18.4`	`1.17.12` `1.18.4`
GO-2022-0521 Stack exhaustion from deeply nested XML documents in encoding/xml	High EPSS 2.56%	`< 1.17.12` `>= 1.18.0-0, < 1.18.4`	`1.17.12` `1.18.4`
GO-2022-0515 Stack exhaustion due to deeply nested types in go/parser	Medium EPSS 0.92%	`< 1.17.12` `>= 1.18.0-0, < 1.18.4`	`1.17.12` `1.18.4`
GO-2022-0191 Denial of service in chain verification in crypto/x509	Not rated yet EPSS 6.48%	`< 1.10.6` `>= 1.11.0-0, < 1.11.3`	`1.10.6` `1.11.3`
GO-2022-0211 Incorrect parsing validation in net/url	Not rated yet EPSS 8.36%	`< 1.11.13` `>= 1.12.0-0, < 1.12.8`	`1.11.13` `1.12.8`
GO-2022-0187 Incorrect computation for P-256 curves in crypto/elliptic	Not rated yet EPSS 2.23%	`>= 1.6.0-0, < 1.7.6` `>= 1.8.0-0, < 1.8.2`	`1.7.6` `1.8.2`
GHSA-p782-xgp4-8hr8 golang.org/x/sys/unix has Incorrect privilege reporting in syscall	Medium EPSS 2.95%	`< 1.17.10` `>= 1.18.0-0, < 1.18.2`	`1.17.10` `1.18.2`
GO-2022-0477 Indefinite hang with large buffers on Windows in crypto/rand	High EPSS 2.28%	`< 1.17.11` `>= 1.18.0-0, < 1.18.3`	`1.17.11` `1.18.3`
GO-2021-0154 Man-in-the-middle attack with SessionTicketsDisabled in crypto/tls	Not rated yet EPSS 1.38%	`>= 1.1.0-0, < 1.3.2`	`1.3.2`
GO-2022-0220 DLL injection on Windows in runtime and syscall	Not rated yet EPSS 3.11%	`< 1.11.10` `>= 1.12.0-0, < 1.12.2`	`1.11.10` `1.12.2`
GO-2022-0166 Denial of service due to unchecked parameters in crypto/dsa	Not rated yet EPSS 4.36%	`< 1.5.4` `>= 1.6.0-0, < 1.6.1`	`1.5.4` `1.6.1`
GO-2022-0171 Mishandled trust preferences for root certificates on Darwin in crypto/x509	Not rated yet EPSS 1.44%	`< 1.6.4` `>= 1.7.0-0, < 1.7.4`	`1.6.4` `1.7.4`
GO-2022-0213 Panic on invalid DSA public keys in crypto/dsa	Not rated yet EPSS 4.69%	`< 1.12.11` `>= 1.13.0-0, < 1.13.2`	`1.12.11` `1.13.2`
GHSA-39qc-96h7-956f golang.org/x/net/http vulnerable to a reset flood	High EPSS 83.43%	`< 1.11.13` `>= 1.12.0-0, < 1.12.8`	`1.11.13` `1.12.8`
GO-2022-0217 Denial of service affecting P-521 and P-384 curves in crypto/elliptic	Not rated yet EPSS 4.50%	`< 1.10.8` `>= 1.11.0-0, < 1.11.5`	`1.10.8` `1.11.5`
GO-2022-0212 Request smuggling due to accepting invalid headers in net/http via net/textproto	Not rated yet EPSS 5.30%	`< 1.12.10` `>= 1.13.0-0, < 1.13.1`	`1.12.10` `1.13.1`
GO-2022-0273 Panic due to crafted inputs in archive/zip	Not rated yet EPSS 6.93%	`< 1.16.8` `>= 1.17.0-0, < 1.17.1`	`1.16.8` `1.17.1`
GO-2022-0289 Misdirected I/O in syscall	Not rated yet EPSS 2.00%	`< 1.16.12` `>= 1.17.0-0, < 1.17.5`	`1.16.12` `1.17.5`
GO-2022-0435 Panic due to large inputs affecting P-256 curves in crypto/elliptic	High EPSS 4.16%	`< 1.17.9` `>= 1.18.0-0, < 1.18.1`	`1.17.9` `1.18.1`
GO-2022-0434 Panic during certificate parsing on Darwin in crypto/x509	High EPSS 1.47%	`>= 1.18.0-0, < 1.18.1`	`1.18.1`
GO-2022-0433 Stack overflow from a large amount of PEM data in encoding/pem	High EPSS 9.95%	`< 1.17.9` `>= 1.18.0-0, < 1.18.1`	`1.17.9` `1.18.1`
GO-2021-0347 Stack exhaustion when compiling deeply nested expressions in regexp	High EPSS 3.23%	`< 1.16.15` `>= 1.17.0-0, < 1.17.8`	`1.16.15` `1.17.8`
GO-2021-0223 Certificate verification error on Windows in crypto/x509	Not rated yet EPSS 1.76%	`< 1.13.13` `>= 1.14.0-0, < 1.14.5`	`1.13.13` `1.14.5`
GO-2021-0224 Data race and crash in net/http	Not rated yet EPSS 2.88%	`< 1.13.13` `>= 1.14.0-0, < 1.14.5`	`1.13.13` `1.14.5`
GO-2021-0234 Infinite loop when decoding inputs in encoding/xml	Not rated yet EPSS 2.47%	`< 1.15.9` `>= 1.16.0-0, < 1.16.1`	`1.15.9` `1.16.1`
GO-2021-0235 Incorrect operations on the P-224 curve in crypto/elliptic	Not rated yet EPSS 2.70%	`< 1.14.14` `>= 1.15.0-0, < 1.15.7`	`1.14.14` `1.15.7`
GO-2021-0239 Improper sanitization when resolving values from DNS in net	Not rated yet EPSS 3.20%	`< 1.15.13` `>= 1.16.0-0, < 1.16.5`	`1.15.13` `1.16.5`
GO-2021-0240 Panic when reading certain archives in archive/zip	Not rated yet EPSS 3.46%	`< 1.15.13` `>= 1.16.0-0, < 1.16.5`	`1.15.13` `1.16.5`
GO-2021-0241 Attacker can drop certain headers in net/http/httputil	Not rated yet EPSS 2.26%	`< 1.15.13` `>= 1.16.0-0, < 1.16.5`	`1.15.13` `1.16.5`
GO-2021-0242 Panic on inputs with large exponents in math/big	Not rated yet EPSS 3.37%	`< 1.15.13` `>= 1.16.0-0, < 1.16.5`	`1.15.13` `1.16.5`
GO-2021-0243 Panic on certain certificates in crypto/tls	Not rated yet EPSS 6.98%	`< 1.15.14` `>= 1.16.0-0, < 1.16.6`	`1.15.14` `1.16.6`
GO-2021-0245 Panic in ReverseProxy in net/http/httputil	Not rated yet EPSS 3.11%	`< 1.15.15` `>= 1.16.0-0, < 1.16.7`	`1.15.15` `1.16.7`
GO-2021-0172 Denial of service when parsing large forms in mime/multipart	Not rated yet EPSS 2.08%	`< 1.6.4` `>= 1.7.0-0, < 1.7.4`	`1.6.4` `1.7.4`
GO-2021-0319 Incorrect computation for some invalid field elements in crypto/elliptic	Critical EPSS 3.07%	`< 1.16.14` `>= 1.17.0-0, < 1.17.7`	`1.16.14` `1.17.7`
GO-2021-0317 Uncontrolled memory consumption in math/big	High EPSS 2.81%	`< 1.16.14` `>= 1.17.0-0, < 1.17.7`	`1.16.14` `1.17.7`
GO-2021-0264 Panic when opening certain archives in archive/zip	Not rated yet EPSS 3.25%	`< 1.16.10` `>= 1.17.0-0, < 1.17.3`	`1.16.10` `1.17.3`
GO-2021-0263 Panic on invalid symbol tables in debug/macho	Not rated yet EPSS 4.70%	`< 1.16.10` `>= 1.17.0-0, < 1.17.3`	`1.16.10` `1.17.3`
GO-2021-0226 Cross-site scripting in net/http/cgi and net/http/fcgi	Not rated yet EPSS 3.65%	`< 1.14.8` `>= 1.15.0-0, < 1.15.1`	`1.14.8` `1.15.1`
GO-2021-0178 Cleartext transmission of credentials in net/smtp	Not rated yet EPSS 1.28%	`>= 1.1.0-0, < 1.8.4` `>= 1.9.0-0, < 1.9.1`	`1.8.4` `1.9.1`
GO-2021-0163 Privilege escalation on Windows via malicious DLL in syscall	Not rated yet EPSS 0.40%	`< 1.5.4` `>= 1.6.0-0, < 1.6.1`	`1.5.4` `1.6.1`
GO-2021-0159 Request smuggling due to improper header parsing in net/http	Not rated yet EPSS 9.62%	`< 1.4.3`	`1.4.3`
GO-2021-0157 The MIME header parser treated spaces and hyphens as equivalent, which can permit HTTP request smuggling. Withdrawn	Not rated yet	`< 1.4.3`	`1.4.3`
GO-2021-0160 Incorrect calculation affecting RSA computations in math/big	Not rated yet EPSS 2.63%	`>= 1.5.0-0, < 1.5.3`	`1.5.3`
GO-2022-0288 golang.org/x/net/http2 allows uncontrolled memory consumption	High EPSS 4.25%	`< 1.16.12` `>= 1.17.0-0, < 1.17.5`	`1.16.12` `1.17.5`
GO-2021-0142 Withdrawn Advisory: Infinite loop in xz	High EPSS 4.86%	`< 1.13.15` `>= 1.14.0-0, < 1.14.7`	`1.13.15` `1.14.7`
GHSA-cjjc-xp8v-855w Helm uses crypto package vulnerable to panic from malformed X.509 certificate	High EPSS 2.65%	`< 1.12.16` `>= 1.13.0-0, < 1.13.7`	`1.12.16` `1.13.7`
GHSA-h86h-8ppg-mxmh golang.org/x/net/http/httpguts vulnerable to Uncontrolled Recursion	Medium EPSS 3.69%	`< 1.15.12` `>= 1.16.0-0, < 1.16.4`	`1.15.12` `1.16.4`
GO-2021-0069 Panic during division of very large numbers in math/big	Not rated yet EPSS 3.86%	`>= 1.14.0-0, < 1.14.12` `>= 1.15.0-0, < 1.15.5`	`1.14.12` `1.15.5`
GO-2021-0067 Panic when opening archives in archive/zip	Not rated yet EPSS 1.52%	`>= 1.16.0-0, < 1.16.1`	`1.16.1`
CVE-2020-0601 Certificate validation bypass on Windows in crypto/x509 Known exploited	High EPSS 89.08%	`< 1.12.16` `>= 1.13.0-0, < 1.13.7`	`1.12.16` `1.13.7`

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor