Go standard library vulnerabilities
We track 57 vulnerabilities in Go standard library products across 24 products. 57 are rated high or critical, and none are known to be exploited. The most recent was published on October 8, 2026.
Latest Go standard library vulnerabilities
- 7.5 High severity
net/http: Concurrent Execution using Shared Resource with Improper Synchronization
HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part o
- 7.5 High severity
crypto/tls: Asymmetric Resource Consumption (Amplification)
Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted packet that could trigger memory exhaustion in the server process by specifying multiple references. We now reject these as malformed and c
- 7.5 High severity
net/textproto: Allocation of Resources Without Limits or Throttling
Parsing a multipart form can bypass memory limits and read an arbitrarily long line into memory when the remaining limit at the start of a part is less than 400 bytes.
- 7.5 High severity
net/http: Inconsistent Interpretation of HTTP Requests
When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the connection. Since a 2xx response to an HTTP/1 CONNECT converts the c
- 7.5 High severity
net/http: Asymmetric Resource Consumption (Amplification)
A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values.
- 7.5 High severity
net/http: Allocation of Resources Without Limits or Throttling
When parsing a Range header containing a large number of small ranges, FileServer(FS), ServeContent, and ServeFile(FS) can consume an excessive amount of CPU.
- 9.1 Critical severity
net/http: Multiple Operations on Resource in Single-Operation Context
The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client
- 7.5 High severity
net/http: Inconsistent Interpretation of HTTP Requests
Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers
- 7.5 High severity
net/http: Asymmetric Resource Consumption (Amplification)
When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a maliciou
- 7.5 High severity
net/http: Inconsistent Interpretation of HTTP Requests
When http.Transport sends an HTTP/1 CONNECT request with a non-empty Request.Body, it writes the body directly to the connection without framing after the request headers. If the server rejects the CONNECT request with a non-2xx keep-alive response, Transport
- 9.8 Critical severity
os: Insecure Operation on Windows Junction / Mount Point
On Windows, when the target of Root.Mkdir or Root.MkdirAll is a junction pointing to an empty location, the operation can create a directory at the junction target even when that target is located outside the root. This only applies to operations where the las
- 7.5 High severity
crypto/tls: Allocation of Resources Without Limits or Throttling
Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not. As a result, a malicious client can keep sending KeyUpdate messages to force the server to keep performing key derivat
- 7.5 High severity
net/http: Allocation of Resources Without Limits or Throttling
When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when doing this.
- 7.8 High severity
os: UNIX Symbolic Link (Symlink) Following
On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /. For example, 'root.Open("symlink/")' will open "symlink" even when
- 7.5 High severity
crypto/x509: Unchecked Input for Loop Condition
(*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries. This caused strings.Split(host, ".") to execute repeatedly on the same input hostname. With a large DNS SAN list, verification co
- 8.2 High severity
net/http: Improper Validation of Unsafe Equivalence in Input
The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege e
- 7.5 High severity
golang.org/x/net/http2: Loop with Unreachable Exit Condition
When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.
- 8.2 High severity
crypto/x509: Improper Certificate Validation
When verifying a certificate chain containing excluded DNS constraints, these constraints are not correctly applied to wildcard DNS SANs which use a different case than the constraint. This only affects validation of otherwise trusted certificate chains, issue
- 7.5 High severity
crypto/tls: Allocation of Resources Without Limits or Throttling
If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled consumption of resources. This can lead to a denial of service. This only affects TLS 1.3.
- 7.5 High severity
crypto/x509: Improper Certificate Validation
Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service. This only affects validation of otherwise trusted certificate chains
- 7.5 High severity
crypto/x509: Allocation of Resources Without Limits or Throttling
During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of service. This affects both direct users of crypto/x509 and
- 7.5 High severity
crypto/x509: Improper Certificate Validation
When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly applied, and only the last constraint will be
- 10.0 Critical severity
crypto/tls: Improper Certificate Validation
During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed handshake may succeed when it should have failed. This may happen when a user cal
- 7.5 High severity
net/url: Allocation of Resources Without Limits or Throttling
The net/url package does not set a limit on the number of query parameters in a query. While the maximum size of query parameters in URLs is generally limited by the maximum request header size, the net/http.Request.ParseForm method can parse large URL-encoded
- 7.5 High severity
crypto/x509: Improper Certificate Validation
Within HostnameError.Error(), when constructing an error string, there is no limit to the number of hosts that will be printed out. Furthermore, the error string is constructed by repeated string concatenation, leading to quadratic runtime. Therefore, a certif
- 7.5 High severity
encoding/pem: Allocation of Resources Without Limits or Throttling
The processing time for parsing some invalid inputs scales non-linearly with respect to the size of the input. This affects programs which parse untrusted PEM inputs.
- 7.5 High severity
crypto/x509: Improper Certificate Validation
Validating certificate chains which contain DSA public keys can cause programs to panic, due to a interface cast that assumes they implement the Equal method. This affects programs which validate arbitrary certificate chains.
- 7.5 High severity
crypto/x509: Inefficient Algorithmic Complexity
Due to the design of the name constraint checking algorithm, the processing time of some inputs scale non-linearly with respect to the size of the certificate. This affects programs which validate arbitrary certificate chains.
- 7.0 High severity
database/sql: Concurrent Execution using Shared Resource with Improper Synchronization
Cancelling a query (e.g. by cancelling the context passed to one of the query methods) during a call to the Scan method of the returned Rows can result in unexpected results if other queries are being made in parallel. This can result in a race condition that
- 7.5 High severity
crypto/tls: Observable Discrepancy
Before Go 1.20, the RSA based TLS key exchanges used the math/big library, which is not constant time. RSA blinding was applied to prevent timing attacks, but analysis shows this may not have been fully effective. In particular it appears as if the removal of
- 7.5 High severity
path/filepath: Improper Limitation of a Pathname to a Restricted Directory
The filepath package does not recognize paths with a \??\ prefix as special. On Windows, a path beginning with \??\ is a Root Local Device path equivalent to a path beginning with \\?\. Paths with a \??\ prefix may be used to access arbitrary locations on the
- 7.5 High severity
net/http: Allocation of Resources Without Limits or Throttling
A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption. While the total number of requests is bounded by the http2.Server.MaxConcurrentStreams setting, resetting an in-progress reque
- 7.5 High severity
crypto/tls: Allocation of Resources Without Limits or Throttling
QUIC connections do not set an upper bound on the amount of data buffered when reading post-handshake messages, allowing a malicious QUIC connection to cause unbounded memory growth. With fix, connections now consistently reject messages larger than 65KiB in s
- 7.8 High severity
runtime: Exposure of Resource to Wrong Sphere
On Unix platforms, the Go runtime does not behave differently when a binary is run with the setuid/setgid bits. This can be dangerous in certain cases, such as when dumping memory state, or assuming the status of standard i/o file descriptors. If a setuid/setg
- 7.3 High severity
html/template: Improper Neutralization of Special Elements in Output Used by a Downstream Component
Templates containing actions in unquoted HTML attributes (e.g. "attr={{.}}") executed with empty input can result in output with unexpected results when parsed due to HTML normalization rules. This may allow injection of arbitrary attributes into tags.
- 9.8 Critical severity
html/template: Improper Neutralization of Special Elements used in a Command
Not all valid JavaScript whitespace characters are considered to be whitespace. Templates containing whitespace characters outside of the character set "\t\n\f\r\u0020\u2028\u2029" in JavaScript contexts that also contain actions may not be properly sanitized
- 7.3 High severity
html/template: Improper Neutralization of Special Elements in Output Used by a Downstream Component
Angle brackets (<>) are not considered dangerous characters when inserted into CSS contexts. Templates containing multiple actions separated by a '/' character can result in unexpectedly closing the CSS context and allowing for injection of unexpected HTML, if
- 9.8 Critical severity
html/template: Improper Control of Generation of Code
Templates do not properly consider backticks (`) as Javascript string delimiters, and do not escape them as expected. Backticks are used, since ES6, for JS template literals. If a template contains a Go template action within a Javascript template literal, the
- 7.5 High severity
go/scanner: Integer Overflow or Wraparound
Calling any of the Parse functions on Go source code which contains //line directives with very large line numbers can cause an infinite loop due to integer overflow.
- 7.5 High severity
mime/multipart: Allocation of Resources Without Limits or Throttling
Multipart form parsing can consume large amounts of CPU and memory when processing form inputs containing very large numbers of parts. This stems from several causes: 1. mime/multipart.Reader.ReadForm limits the total memory a parsed multipart form can consume