Go standard library vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-97032 HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently.High 7.5 · Oct 8, 2026
• CVE-2026-97031 Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted packet that could trigger memory exhausHigh 7.5 · Oct 8, 2026
• CVE-2026-94440 Parsing a multipart form can bypass memory limits and read an arbitrarily long line into memory when the remaining limit at the start of a part is less than 400High 7.5 · Oct 8, 2026
• CVE-2026-94439 When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to rHigh 7.5 · Oct 8, 2026
• CVE-2026-78669 A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frHigh 7.5 · Oct 8, 2026
• CVE-2026-78667 When parsing a Range header containing a large number of small ranges, FileServer(FS), ServeContent, and ServeFile(FS) can consume an excessive amount of CPU.High 7.5 · Oct 8, 2026
• CVE-2026-78663 The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread pCritical 9.1 · Oct 8, 2026
• CVE-2026-78660 Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing.High 7.5 · Oct 8, 2026
• CVE-2026-78659 When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler.High 7.5 · Oct 8, 2026
• CVE-2026-56866 When http.Transport sends an HTTP/1 CONNECT request with a non-empty Request.Body, it writes the body directly to the connection without framing after the requeHigh 7.5 · Oct 8, 2026
• CVE-2026-56857 On Windows, when the target of Root.Mkdir or Root.MkdirAll is a junction pointing to an empty location, the operation can create a directory at the junction tarCritical 9.8 · Oct 8, 2026
• CVE-2026-56862 Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not.High 7.5 · Aug 13, 2026
• CVE-2026-56859 Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion.High 7.5 · Aug 13, 2026
• CVE-2026-56853 When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface.High 7.5 · Aug 13, 2026
• CVE-2026-33818 Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures.High 7.5 · Aug 13, 2026
• CVE-2026-46600 Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer.High 7.5 · Jul 21, 2026
• CVE-2026-39822 On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbHigh 7.8 · Jul 8, 2026
• CVE-2026-42504 Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU.High 7.5 · Jun 2, 2026
• CVE-2026-39821 The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label.Critical 9.6 · May 22, 2026
• CVE-2026-42499 Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322.High 7.5 · May 7, 2026
• CVE-2026-39836 The Dial and LookupPort functions panic on Windows when provided with an input containing a NUL (0).High 7.5 · May 7, 2026
• CVE-2026-39820 Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations.High 7.5 · May 7, 2026
• CVE-2026-33811 When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash.High 7.5 · May 7, 2026
• CVE-2026-33810 When verifying a certificate chain containing excluded DNS constraints, these constraints are not correctly applied to wildcard DNS SANs which use a different cHigh 8.2 · Apr 7, 2026
• CVE-2026-32283 If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled consumHigh 7.5 · Apr 7, 2026