Go standard library vulnerabilities
We track 57 vulnerabilities in Go standard library products across 24 products. 57 are rated high or critical, and none are known to be exploited. The most recent was published on October 8, 2026.
Latest Go standard library vulnerabilities
- 7.5 High severity
net/textproto: Uncontrolled Resource Consumption
HTTP and MIME header parsing can allocate large amounts of memory, even when parsing small inputs, potentially leading to a denial of service. Certain unusual patterns of input data can cause the common function used to parse HTTP and MIME headers to allocate
- 7.5 High severity
mime/multipart: Allocation of Resources Without Limits or Throttling
A denial of service is possible from excessive resource consumption in net/http and mime/multipart. Multipart form parsing with mime/multipart.Reader.ReadForm can consume largely unlimited amounts of memory and disk files. This also affects form parsing in the
- 7.5 High severity
crypto/tls: Uncontrolled Resource Consumption
Large handshake records may cause panics in crypto/tls. Both clients and servers may send large TLS handshake records which cause servers and clients, respectively, to panic when attempting to construct responses. This affects all TLS 1.3 clients, TLS 1.2 clie
- 7.5 High severity
path/filepath: Improper Limitation of a Pathname to a Restricted Directory
A path traversal vulnerability exists in filepath.Clean on Windows. On Windows, the filepath.Clean function could transform an invalid path such as "a/../c:/b" into the valid path "c:\b". This transformation of a relative (if invalid) path into an absolute pat
- 7.5 High severity
os: Improper Limitation of a Pathname to a Restricted Directory
On Windows, restricted files can be accessed via os.DirFS and http.Dir. The os.DirFS function and http.Dir type provide access to a tree of files rooted at a given directory. These functions permit access to Windows device files under that root. For example, o
- 7.5 High severity
net/http/httputil: Inconsistent Interpretation of HTTP Requests
Requests forwarded by ReverseProxy include the raw query parameters from the inbound request, including unparsable parameters rejected by net/http. This could permit query parameter smuggling when a Go proxy forwards a parameter with an unparsable value. After
- 7.5 High severity
archive/tar: Allocation of Resources Without Limits or Throttling
Reader.Read does not set a limit on the maximum size of file headers. A maliciously crafted archive could cause Read to allocate unbounded amounts of memory, potentially causing resource exhaustion or panics. After fix, Reader.Read limits the maximum size of h
- 7.5 High severity
net/url: Improper Limitation of a Pathname to a Restricted Directory
JoinPath and URL.JoinPath do not remove ../ path elements appended to a relative path. For example, JoinPath("https://go.dev", "../go") returns the URL "https://go.dev/../go", despite the JoinPath documentation stating that ../ path elements are removed from t
- 7.5 High severity
encoding/gob: Uncontrolled Recursion
Uncontrolled recursion in Decoder.Decode in encoding/gob before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a message which contains deeply nested structures.
- 7.5 High severity
encoding/xml: Uncontrolled Recursion
Uncontrolled recursion in Unmarshal in encoding/xml before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via unmarshalling an XML document into a Go struct which has a nested field that uses the 'any' field tag.
- 7.5 High severity
path/filepath: Uncontrolled Recursion
Uncontrolled recursion in Glob in path/filepath before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a path containing a large number of path separators.
- 7.5 High severity
compress/gzip: Uncontrolled Recursion
Uncontrolled recursion in Reader.Read in compress/gzip before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via an archive containing a large number of concatenated 0-length compressed files.
- 7.5 High severity
io/fs: Uncontrolled Recursion
Uncontrolled recursion in Glob in io/fs before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a path which contains a large number of path separators.
- 7.8 High severity
os/exec: Improper Control of Generation of Code
Code injection in Cmd.Start in os/exec before Go 1.17.11 and Go 1.18.3 allows execution of any binaries in the working directory named either "..com" or "..exe" by calling Cmd.Run, Cmd.Start, Cmd.Output, or Cmd.CombinedOutput when Cmd.Path is unset.
- 7.5 High severity
path/filepath: Improper Limitation of a Pathname to a Restricted Directory
Incorrect conversion of certain invalid paths to valid, absolute paths in Clean in path/filepath before Go 1.17.11 and Go 1.18.3 on Windows allows potential directory traversal attack.
- 7.5 High severity
encoding/xml: Uncontrolled Recursion
Uncontrolled recursion in Decoder.Skip in encoding/xml before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a deeply nested XML document.
- 7.5 High severity
crypto/rand: Loop with Unreachable Exit Condition
Infinite loop in Read in crypto/rand before Go 1.17.11 and Go 1.18.3 on Windows allows attacker to cause an indefinite hang by passing a buffer larger than 1 << 32 - 1 bytes.