Software
go
Aggregate across all detected versions
Total Hosts
0
distinct hosts
Versions Seen
0
Countries
0
Known CVEs
60
known CVEs
Top Countries
No geolocated hosts.
Top ASNs
No attributed hosts.
CVE Matches
| CVE | CVSS | Severity | Summary |
|---|---|---|---|
| CVE-2025-68121 | 10.0 | N/A | During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed hand... |
| CVE-2012-2666 | 9.8 | N/A | golang/go in 1.0.2 fixes all.bash on shared machines. dotest() in src/pkg/debug/gosym/pclntab_test.go creates a temporary file with predicable name and executes... |
| CVE-2015-5739 | 9.8 | N/A | The net/http library in net/textproto/reader.go in Go before 1.4.3 does not properly parse HTTP header keys, which allows remote attackers to conduct HTTP reque... |
| CVE-2015-5740 | 9.8 | N/A | The net/http library in net/http/transfer.go in Go before 1.4.3 does not properly parse HTTP headers, which allows remote attackers to conduct HTTP request smug... |
| CVE-2015-5741 | 9.8 | N/A | The net/http library in net/http/transfer.go in Go before 1.4.3 does not properly parse HTTP headers, which allows remote attackers to conduct HTTP request smug... |
| CVE-2017-15041 | 9.8 | N/A | Go before 1.8.4 and 1.9.x before 1.9.1 allows "go get" remote command execution. Using custom domains, it is possible to arrange things so that example.com/pkg1... |
| CVE-2019-11888 | 9.8 | N/A | Go through 1.12.5 on Windows mishandles process creation with a nil environment in conjunction with a non-nil token, which allows attackers to obtain sensitive... |
| CVE-2019-14809 | 9.8 | N/A | net/url in Go before 1.11.13 and 1.12.x before 1.12.8 mishandles malformed hosts in URLs, leading to an authorization bypass in some applications. This is relat... |
| CVE-2026-27143 | 9.8 | N/A | Arithmetic over induction variables in loops were not correctly checked for underflow or overflow. As a result, the compiler would allow for invalid indexing to... |
| CVE-2020-29509 | 9.8 | N/A | The encoding/xml package in Go (all versions) does not correctly preserve the semantics of attribute namespace prefixes during tokenization round-trips, which a... |
| CVE-2020-29510 | 9.8 | N/A | The encoding/xml package in Go versions 1.15 and earlier does not correctly preserve the semantics of directives during tokenization round-trips, which allows a... |
| CVE-2020-29511 | 9.8 | N/A | The encoding/xml package in Go (all versions) does not correctly preserve the semantics of element namespace prefixes during tokenization round-trips, which all... |
| CVE-2021-38297 | 9.8 | N/A | Go before 1.16.9 and 1.17.x before 1.17.2 has a Buffer Overflow via large arguments in a function invocation from a WASM module, when GOARCH=wasm GOOS=js is use... |
| CVE-2023-24538 | 9.8 | N/A | Templates do not properly consider backticks (`) as Javascript string delimiters, and do not escape them as expected. Backticks are used, since ES6, for JS temp... |
| CVE-2023-24540 | 9.8 | N/A | Not all valid JavaScript whitespace characters are considered to be whitespace. Templates containing whitespace characters outside of the character set "\t\n\f\... |
| CVE-2023-29402 | 9.8 | N/A | The go command may generate unexpected code at build time when using cgo. This may result in unexpected behavior when running a go program which uses cgo. This... |
| CVE-2023-29404 | 9.8 | N/A | The go command may execute arbitrary code at build time when using cgo. This may occur when running "go get" on a malicious module, or when running any other co... |
| CVE-2023-29405 | 9.8 | N/A | The go command may execute arbitrary code at build time when using cgo. This may occur when running "go get" on a malicious module, or when running any other co... |
| CVE-2023-39320 | 9.8 | N/A | The go.mod toolchain directive, introduced in Go 1.21, can be leveraged to execute scripts and binaries relative to the root of the module when the "go" command... |
| CVE-2024-24790 | 9.8 | N/A | The various Is methods (IsPrivate, IsLoopback, etc) did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would return tr... |
| CVE-2026-27143 | 9.8 | N/A | Arithmetic over induction variables in loops were not correctly checked for underflow or overflow. As a result, the compiler would allow for invalid indexing to... |
| CVE-2025-66630 | 9.4 | N/A | Fiber is an Express inspired web framework written in Go. Before 2.52.11, on Go versions prior to 1.24, the underlying crypto/rand implementation can return an... |
| CVE-2022-23806 | 9.1 | N/A | Curve.IsOnCurve in crypto/elliptic in Go before 1.16.14 and 1.17.x before 1.17.7 can incorrectly return true in situations with a big.Int value that is not a va... |
| CVE-2018-7187 | 8.8 | N/A | The "go get" implementation in Go 1.9.4, when the -insecure command-line option is used, does not validate the import path (get/vcs.go only checks for "://" any... |
| CVE-2026-27140 | 8.8 | N/A | SWIG file names containing 'cgo' and well-crafted payloads could lead to code smuggling and arbitrary code execution at build time due to trust layer bypass. |
| CVE-2026-27140 | 8.8 | N/A | SWIG file names containing 'cgo' and well-crafted payloads could lead to code smuggling and arbitrary code execution at build time due to trust layer bypass. |
| CVE-2025-61732 | 8.6 | N/A | A discrepancy between how Go and C/C++ comments were parsed allowed for code smuggling into the resulting cgo binary. |
| CVE-2025-4674 | 8.6 | N/A | The go command may execute unexpected commands when operating in untrusted VCS repositories. This occurs when possibly dangerous VCS configuration is present in... |
| CVE-2025-61732 | 8.6 | N/A | A discrepancy between how Go and C/C++ comments were parsed allowed for code smuggling into the resulting cgo binary. |
| CVE-2019-6486 | 8.2 | N/A | Go before 1.10.8 and 1.11.x before 1.11.5 mishandles P-521 and P-384 elliptic curves, which allows attackers to cause a denial of service (CPU consumption) or p... |
| CVE-2026-33810 | 8.2 | N/A | When verifying a certificate chain containing excluded DNS constraints, these constraints are not correctly applied to wildcard DNS SANs which use a different c... |
| CVE-2026-33810 | 8.2 | N/A | When verifying a certificate chain containing excluded DNS constraints, these constraints are not correctly applied to wildcard DNS SANs which use a different c... |
| CVE-2016-5386 | 8.1 | N/A | The net/http package in Go through 1.6 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications f... |
| CVE-2018-16873 | 8.1 | N/A | In Go before 1.10.6 and 1.11.x before 1.11.3, the "go get" command is vulnerable to remote code execution when executed with the -u flag and the import path of... |
| CVE-2018-16874 | 8.1 | N/A | In Go before 1.10.6 and 1.11.x before 1.11.3, the "go get" command is vulnerable to directory traversal when executed with the import path of a malicious Go pac... |
| CVE-2020-0601 | 8.1 | N/A | A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) certificates.An attacker could exploit th... |
| CVE-2023-39323 | 8.1 | N/A | Line directives ("//line") can be used to bypass the restrictions on "//go:cgo_" directives, allowing blocked linker and compiler flags to be passed during comp... |
| CVE-2016-3958 | 7.8 | N/A | Untrusted search path vulnerability in Go before 1.5.4 and 1.6.x before 1.6.1 on Windows allows local users to gain privileges via a Trojan horse DLL in the cur... |
| CVE-2018-6574 | 7.8 | N/A | Go before 1.8.7, Go 1.9.x before 1.9.4, and Go 1.10 pre-releases before Go 1.10rc2 allow "go get" remote command execution during source code build, by leveragi... |
| CVE-2019-9634 | 7.8 | N/A | Go through 1.12 on Windows misuses certain LoadLibrary functionality, leading to DLL injection. |