golang go 1.20.0 vulnerabilities and exploits

(subscribe to this query)

A path traversal vulnerability exists in filepath.Clean on Windows. On Windows, the filepath.Clean function could transform an invalid path such as "a/../c:/b" into the valid path "c:\b". This transformation of a relative (if invalid) path into an absolute pat...

Golang Go Golang Go 1.20.0

Large handshake records may cause panics in crypto/tls. Both clients and servers may send large TLS handshake records which cause servers and clients, respectively, to panic when attempting to construct responses. This affects all TLS 1.3 clients, TLS 1.2 clients which explicitly...

Golang Go Golang Go 1.20.0

A denial of service is possible from excessive resource consumption in net/http and mime/multipart. Multipart form parsing with mime/multipart.Reader.ReadForm can consume largely unlimited amounts of memory and disk files. This also affects form parsing in the net/http package wi...

Golang Go Golang Go 1.20.0

A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of service from a small number of small requests.

Golang Go Golang Go 1.20.0 Golang Http2 Golang Hpack

2 Github repositories

In archive/zip in Go prior to 1.16.8 and 1.17.x prior to 1.17.1, a crafted archive header (falsely designating that many files are present) can cause a NewReader or OpenReader panic. NOTE: this issue exists because of an incomplete fix for CVE-2021-33196.

Golang Go Netapp Cloud Insights Telegraf -

Go prior to 1.16.9 and 1.17.x prior to 1.17.2 has a Buffer Overflow via large arguments in a function invocation from a WASM module, when GOARCH=wasm GOOS=js is used.

Golang Go Fedoraproject Fedora 34 Fedoraproject Fedora 35

2 Github repositories

Go prior to 1.17 does not properly consider extraneous zero characters at the beginning of an IP address octet, which (in some situations) allows malicious users to bypass access control that is based on IP addresses, because of unexpected octal interpretation. This affects net.P...

Golang Go Oracle Timesten In-memory Database Fedoraproject Fedora 36

1 Github repository

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook