Vendor
Go Standard Library
135 known vulnerabilities in products by Go Standard Library, 0 of them actively exploited (CISA KEV).
Key figures
135
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
7
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| High | CVE-2023-45288 | HTTP/2 CONTINUATION flood in net/http | 7.5 | |
| Critical | CVE-2026-39821 | Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna | 10.0 | |
| High | CVE-2022-41723 | Denial of service via crafted HTTP/2 stream in net/http and golang.org/x/net | 7.5 | |
| High | CVE-2025-61726 | Memory exhaustion in query parameter parsing in net/url | 7.5 | |
| Critical | CVE-2023-24538 | Backticks not treated as string delimiters in html/template | 9.8 | |
| High | CVE-2023-39325 | HTTP/2 rapid reset can cause excessive work in net/http | 7.5 | |
| Critical | CVE-2024-24790 | Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses in net/netip | 9.8 | |
| High | CVE-2023-45283 | Insecure parsing of Windows paths with a \??\ prefix in path/filepath | 7.5 | |
| High | CVE-2022-32189 | Panic when decoding Float and Rat types in math/big | 7.5 | |
| Medium | CVE-2022-41717 | Excessive memory growth in net/http and golang.org/x/net/http2 | 5.3 | |
| Critical | CVE-2023-24540 | Improper handling of JavaScript whitespace in html/template | 9.8 | |
| High | CVE-2022-28131 | Stack exhaustion from deeply nested XML documents in encoding/xml | 7.5 | |
| Critical | CVE-2026-56857 | Root.Mkdir (All) can follow junctions out of the root on Windows in os | 9.8 | |
| High | CVE-2022-29804 | Path traversal via Clean on Windows in path/filepath | 7.5 | |
| High | CVE-2022-30634 | Indefinite hang with large buffers on Windows in crypto/rand | 7.5 | |
| Critical | CVE-2025-22871 | Request smuggling due to acceptance of invalid chunked data in net/http | 9.1 | |
| High | CVE-2022-30633 | Stack exhaustion when unmarshaling certain documents in encoding/xml | 7.5 | |
| High | CVE-2022-30630 | Stack exhaustion in Glob on certain paths in io/fs | 7.5 | |
| High | CVE-2022-30632 | Stack exhaustion on crafted paths in path/filepath | 7.5 | |
| High | CVE-2022-30631 | Stack exhaustion when reading certain archives in compress/gzip | 7.5 | |
| Critical | CVE-2025-68121 | Unexpected session resumption in crypto/tls | 10.0 | |
| High | CVE-2022-32190 | Failure to strip relative path components in net/url | 7.5 | |
| High | CVE-2022-2879 | Unbounded memory consumption when reading headers in archive/tar | 7.5 | |
| High | CVE-2023-24534 | Excessive memory allocation in net/http and net/textproto | 7.5 | |
| High | CVE-2022-30635 | Stack exhaustion when decoding certain messages in encoding/gob | 7.5 |
News
Products
| Net/http | 26 | 0 |
| Crypto/x509 | 15 | 0 |
| Html/template | 14 | 0 |
| Crypto/tls | 13 | 0 |
| Net/http/internal/http2 | 6 | 0 |
| Net/textproto | 6 | 0 |
| OS | 6 | 0 |
| Path/filepath | 6 | 0 |
| Net/url | 5 | 0 |
| Net | 4 | 0 |
| Net/mail | 4 | 0 |
| Archive/tar | 3 | 0 |
| Encoding/xml | 3 | 0 |
| Mime/multipart | 3 | 0 |
| Net/http/httputil | 3 | 0 |
| Os/exec | 3 | 0 |