Skip to content
Noroxi

Golang records

230 published records for vendor golang.

Researcher profile

Entered KEV
2 · 0.9%
Weaponized
2 · 0.9%
Pre-auth RCE
15
With a fix record
99.1%
Median publish → KEV
330 days

Records by year

  1. 17
  2. 18
  3. 19
  4. 20
  5. 21
  6. 22
  7. 23
  8. 24
  9. 25
  10. 26

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

230 records
  • CVE-2023-44487
    90Now

    The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as

    HighCVSS 7.5KEVWeaponizedEPSS 99%

    siemens · simatic s7-1500 cpu 1518f-4 pn\/dp mfp firmwareOct 10, 2023

  • CVE-2020-0601
    89Now

    A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) certificates.An attac

    HighCVSS 8.1KEVWeaponizedEPSS 89%

    microsoft · windows 10 1507Jan 14, 2020

  • CVE-2023-45288
    57Plan

    HTTP/2 CONTINUATION flood in net/http

    HighCVSS 7.5Proof of conceptEPSS 89%

    go standard library · net/httpApr 4, 2024

  • CVE-2018-7187
    54Plan

    The "go get" implementation in Go 1.9.4, when the -insecure command-line option is used, does not validate the import path (get/vcs.go only

    HighCVSS 8.8No exploitEPSS 63%

    golang · goFeb 16, 2018

  • CVE-2018-16873
    52Plan

    In Go before 1.10.6 and 1.11.x before 1.11.3, the "go get" command is vulnerable to remote code execution when executed with the -u flag and

    HighCVSS 8.1No exploitEPSS 66%

    golang · goDec 14, 2018

  • CVE-2023-48795
    51Plan

    The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypas

    MediumCVSS 5.9Proof of conceptEPSS 93%

    ssh · sshDec 18, 2023

  • CVE-2021-38297
    42Plan

    Go before 1.16.9 and 1.17.x before 1.17.2 has a Buffer Overflow via large arguments in a function invocation from a WASM module, when GOARCH

    CriticalCVSS 9.8Proof of conceptEPSS 10%

    golang · goOct 18, 2021

  • CVE-2015-5739
    42Plan

    The net/http library in net/textproto/reader.go in Go before 1.4.3 does not properly parse HTTP header keys, which allows remote attackers t

    CriticalCVSS 9.8No exploitEPSS 9%

    golang · goOct 18, 2017

  • CVE-2017-15041
    42Plan

    Go before 1.8.4 and 1.9.x before 1.9.1 allows "go get" remote command execution.

    CriticalCVSS 9.8No exploitEPSS 8%

    golang · goOct 5, 2017

  • CVE-2019-14809
    42Plan

    net/url in Go before 1.11.13 and 1.12.x before 1.12.8 mishandles malformed hosts in URLs, leading to an authorization bypass in some applica

    CriticalCVSS 9.8No exploitEPSS 8%

    golang · goAug 13, 2019

  • CVE-2015-5740
    40Plan

    The net/http library in net/http/transfer.go in Go before 1.4.3 does not properly parse HTTP headers, which allows remote attackers to condu

    CriticalCVSS 9.8No exploitEPSS 3%

    golang · goOct 18, 2017

  • CVE-2015-5741
    40Plan

    The net/http library in net/http/transfer.go in Go before 1.4.3 does not properly parse HTTP headers, which allows remote attackers to condu

    CriticalCVSS 9.8No exploitEPSS 2%

    golang · goFeb 8, 2020

  • CVE-2019-11888
    40Plan

    Go through 1.12.5 on Windows mishandles process creation with a nil environment in conjunction with a non-nil token, which allows attackers

    CriticalCVSS 9.8No exploitEPSS 2%

    golang · goMay 13, 2019

  • CVE-2023-24538
    40Plan

    Backticks not treated as string delimiters in html/template

    CriticalCVSS 9.8Proof of conceptEPSS 2%

    golang · goApr 6, 2023

  • CVE-2024-24790
    40Plan

    Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses in net/netip

    CriticalCVSS 9.8No exploitEPSS 1%

    golang · goJun 5, 2024

  • CVE-2012-2666
    40Plan

    golang/go in 1.0.2 fixes all.bash on shared machines.

    CriticalCVSS 9.8No exploitEPSS 1%

    golang · goJul 9, 2021

  • CVE-2023-29404
    40Plan

    Improper handling of non-optional LDFLAGS in go command with cgo in cmd/go

    CriticalCVSS 9.8No exploitEPSS 1%

    golang · goJun 8, 2023

  • CVE-2023-39320
    40Plan

    Arbitrary code execution via go.mod toolchain directive in cmd/go

    CriticalCVSS 9.8Proof of conceptEPSS 1%

    golang · goSep 8, 2023

  • CVE-2023-29405
    40Plan

    Improper sanitization of LDFLAGS with embedded spaces in go command with cgo in cmd/go

    CriticalCVSS 9.8No exploitEPSS 1%

    golang · goJun 8, 2023

  • CVE-2023-29402
    40Plan

    Code injection via go command with cgo in cmd/go

    CriticalCVSS 9.8No exploitEPSS 1%

    golang · goJun 8, 2023

  • CVE-2025-68121
    40Plan

    Unexpected session resumption in crypto/tls

    CriticalCVSS 10.0No exploitEPSS 0%

    golang · goFeb 5, 2026

  • CVE-2026-46595
    40Plan

    Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh

    CriticalCVSS 10.0Proof of conceptEPSS 0%

    golang · cryptoMay 22, 2026

  • CVE-2026-39821
    39Monitor

    Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna

    CriticalCVSS 9.6No exploitEPSS 1%

    golang · netMay 22, 2026

  • CVE-2023-24540
    39Monitor

    Improper handling of JavaScript whitespace in html/template

    CriticalCVSS 9.8No exploitEPSS 1%

    golang · goMay 11, 2023

  • CVE-2026-27143
    39Monitor

    Missing bound checks can lead to memory corruption in safe Go in cmd/compile

    CriticalCVSS 9.8No exploitEPSS 0%

    golang · goApr 7, 2026