Open Source Vulnerabilities

go

regexp

go

encoding/pem in Go before 1

go

Certificate

go

generic P-256 feature in crypto/elliptic in Go before 1

go

Improper exposure of client IP addresses in net/http before Go 1

argo-workflows, argo-workflows, go

Uncontrolled recursion in Decoder

go

Uncontrolled recursion in Unmarshal in encoding/xml before Go 1

go

Uncontrolled recursion in Glob in path/filepath before Go 1

go

Uncontrolled recursion in Reader

go

Uncontrolled recursion in Glob in io/fs before Go 1

go

Uncontrolled recursion in Decoder

go

Uncontrolled recursion in the Parse functions in go/parser before Go 1

go

Acceptance of some invalid Transfer-Encoding headers in the HTTP/1 client in net/http before Go 1

go

too-short encoded message can cause a panic in Float

go

JoinPath and URL

go

In net/http in Go before 1

go

Programs which compile regular expressions from untrusted sources may be vulnerable to memory exhaustion or denial of service

go

Requests forwarded by ReverseProxy include the raw query parameters from the inbound request, including unparsable parameters rejected by net/http

go

Reader

go

attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests

go

maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of service from a small number of small requests

go

Large handshake records may cause panics in crypto/tls

go

denial of service is possible from excessive resource consumption in net/http and mime/multipart

Quest Bot: Server Side Request Forgery in the Image to GIF Feature Lets Any Server Member Reach Internal Services

go

ScalarMult and ScalarBaseMult methods of the P256 Curve may return an incorrect result if called with some specific unreduced scalars (a scalar larger than the order of the curve)

go

Multipart form parsing can consume large amounts of CPU and memory when processing form inputs containing very large numbers of parts

go

HTTP and MIME header parsing can allocate large amounts of memory, even when parsing small inputs, potentially leading to a denial of service

go

Templates do not properly consider backticks (`) as Javascript string delimiters, and do not escape them as expected

go

Calling any of the Parse functions on Go source code which contains //line directives with very large line numbers can cause an infinite loop due to integer overflow

go

Templates containing actions in unquoted HTML attributes (e

go

Not all valid JavaScript whitespace characters are considered to be whitespace

go

Angle brackets (<>) are not considered dangerous characters when inserted into CSS contexts

go

go command may execute arbitrary code at build time when using cgo

go

go command may execute arbitrary code at build time when using cgo

go

On Unix platforms, the Go runtime does not behave differently when a binary is run with the setuid/setgid bits

go

go command may generate unexpected code at build time when using cgo

go

HTTP/1 client does not fully validate the contents of the Host header

go

Extremely large RSA keys in certificate chains can cause a client/server to expend significant CPU time verifying signatures

go

QUIC connections do not set an upper bound on the amount of data buffered when reading post-handshake messages, allowing a malicious QUIC connection to cause unbounded memory growth

go

Processing an incomplete post-handshake message for a QUIC connection can cause a panic

go

go

go

html/template package does not apply the proper rules for handling occurrences of "<script", "<!--", and "</script" within JS literals in <script> contexts

go

html/template package does not properly handle HTML-like "" comment tokens, nor hashbang "#!" comment tokens, in <script> contexts

go

Line directives ("//line") can be used to bypass the restrictions on "//go:cgo_" directives, allowing blocked linker and compiler flags to be passed during compilation

go

malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network than are in the body

go

Rejected reason: reserved but not needed

go

If errors returned from MarshalJSON methods contain user controlled data, they may be used to break the contextual auto-escaping behavior of the html/template package, allowing for subsequent actio...

go

Verifying a certificate chain which contains a certificate with an unknown public key algorithm will cause Certificate

go

malformed DNS message in response to a query can cause the Lookup functions to get stuck in an infinite loop

go

Calling any of the Parse functions on Go source code which contains deeply nested literals can cause a panic due to stack exhaustion