Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

Go standard library — Vulnerabilities & Security Advisories 107

Browse all 107 CVE security advisories affecting Go standard library. AI-powered Chinese analysis, POCs, and references for each vulnerability.

The Go standard library provides essential built-in packages for networking, cryptography, and system interaction, serving as the foundational runtime for millions of applications. Despite its robust design, it has recorded approximately 100 Common Vulnerabilities and Exposures (CVEs), primarily stemming from logic errors in parsing or concurrency handling rather than complex exploitation chains. Historically, common vulnerability classes include denial-of-service conditions via malformed input, race conditions in concurrent data structures, and occasional remote code execution flaws within specific subsystems like HTTP servers or crypto implementations. Notable incidents often involve improper validation leading to memory corruption or information disclosure. While the library is generally secure, its widespread adoption means even minor flaws can impact a vast ecosystem. Developers must remain vigilant about patching updates, as the standard library’s central role amplifies the risk of any discovered defect affecting dependent software infrastructure.

Found 14 results / 107Clear Filters
Top products by Go standard library: net/http crypto/x509 html/template crypto/tls path/filepath net/mail net/url archive/tar net net/textproto os go/parser archive/zip net/http/internal crypto/internal/nistec mime/multipart syscall encoding/gob encoding/xml os/exec net/http/httputil internal/syscall/unix encoding/pem encoding/asn1 database/sql go/build/constraint net/netip io/fs compress/gzip runtime
CVE IDTitleCVSSSeverityPublished
CVE-2025-58186 Lack of limit when parsing cookies can cause memory exhaustion in net/http — net/http 7.5AIHighAI2025-10-29
CVE-2025-47910 CrossOriginProtection insecure bypass patterns not limited to exact matches in net/http — net/http 7.5AIHighAI2025-09-22
CVE-2025-4673 Sensitive headers not cleared on cross-origin redirect in net/http — net/http 6.5AIMediumAI2025-06-11
CVE-2025-22870 HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net — net/http 5.3 -2025-03-12
CVE-2024-45336 Sensitive headers incorrectly sent after cross-domain redirect in net/http — net/http 8.2 -2025-01-28
CVE-2024-24791 Denial of service due to improper 100-continue handling in net/http — net/http 7.5AIHighAI2024-07-02
CVE-2023-45288 HTTP/2 CONTINUATION flood in net/http — net/http 7.5 -2024-04-04
CVE-2023-45289 Incorrect forwarding of sensitive headers and cookies on HTTP redirect in net/http — net/http 7.1AIHighAI2024-03-05
CVE-2023-39325 HTTP/2 rapid reset can cause excessive work in net/http — net/http 7.5 -2023-10-11
CVE-2023-29406 Insufficient sanitization of Host header in net/http — net/http 7.5 -2023-07-11
CVE-2022-41723 Denial of service via crafted HTTP/2 stream in net/http and golang.org/x/net — net/http 7.5 -2023-02-28
CVE-2022-41717 Excessive memory growth in net/http and golang.org/x/net/http2 — net/http 5.3 -2022-12-08
CVE-2022-32148 Exposure of client IP addresses in net/http — net/http--2022-08-09
CVE-2022-1705 Improper sanitization of Transfer-Encoding headers in net/http — net/http 6.5 -2022-08-09

This page lists every published CVE security advisory associated with Go standard library. Each entry links to a detailed page with CVSS scoring, CWE classification, affected products and references. AI-generated Chinese analysis is provided for fast triage.