go-attestation vulnerabilities

2 known vulnerabilities in go-attestation from Google. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  go-attestation: Uncontrolled Recursion

  CVE-2026-19201Sep 9, 2026Google

  An uncontrolled recursion vulnerability in the Windows SIPA event log parser of Google go-attestation versions up to and including 0.6.1 allows an attacker to cause a denial of service (DoS). The (*WinEvents).readELAMAggregation function recurses for every nes

• 8.9 High severity

  go-attestation: Improper Validation of Specified Index, Position, or Offset in Input

  CVE-2026-12681Jun 24, 2026Google

  Improper Validation of Specified Index, Position, or Offset in Input vulnerability in Google go-attestation. parseEfiSignatureList() does not advance the buffer past vendor bytes before reading entries. For hashSHA256SigGUID lists, this allows attacker-control