golang image vulnerabilities and exploits

(subscribe to this query)

5.5

CVSSv3

An attacker can craft a malformed TIFF image which will consume a significant amount of memory when passed to DecodeConfig. This could lead to a denial of service.

Golang Image Golang Tiff -Fedoraproject Fedora 37 Fedoraproject Fedora 38

6.5

CVSSv3

A maliciously-crafted image can cause excessive CPU consumption in decoding. A tiled image with a height of 0 and a very large width can cause excessive CPU consumption, despite the image size (width * height) appearing to be zero.

Golang Image Fedoraproject Fedora 37 Fedoraproject Fedora 38

6.5

CVSSv3

The TIFF decoder does not place a limit on the size of compressed tile data. A maliciously-crafted image can exploit this to cause a small image (both in terms of pixel width/height, and encoded size) to make the decoder decode large amounts of compressed data, consuming excessiv...

Golang Image Fedoraproject Fedora 37 Fedoraproject Fedora 38

5.3

CVSSv3

An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server connections contain a cache of HTTP header keys sent by the client. While the total number of entries in this cache is capped, an attacker sending very large keys can cause the s...

Golang Go Golang Http2 Fedoraproject Fedora 37 Fedoraproject Fedora 38

1 Github repository

7.5

CVSSv3

Requests forwarded by ReverseProxy include the raw query parameters from the inbound request, including unparsable parameters rejected by net/http. This could permit query parameter smuggling when a Go proxy forwards a parameter with an unparsable value. After fix, ReverseProxy s...

Golang Go

9.8

CVSSv3

syslabs/sif is the Singularity Image Format (SIF) reference implementation. In versions before 2.8.1the `github.com/sylabs/sif/v2/pkg/integrity` package did not verify that the hash algorithm(s) used are cryptographically secure when verifying digital signatures. A patch is avail...

Sylabs Singularity Image Format

7.5

CVSSv3

Programs which compile regular expressions from untrusted sources may be vulnerable to memory exhaustion or denial of service. The parsed regexp representation is linear in the size of the input, but in some cases the constant factor can be as high as 40,000, making relatively sm...

Golang Go

7.5

CVSSv3

In net/http in Go prior to 1.18.6 and 1.19.x prior to 1.19.1, attackers can cause a denial of service because an HTTP/2 connection can hang during closing if shutdown were preempted by a fatal error.

Golang Go 1.19.0 Golang Go Fedoraproject Fedora 36 Fedoraproject Fedora 37

1 Github repository

7.5

CVSSv3

Reader.Read does not set a limit on the maximum size of file headers. A maliciously crafted archive could cause Read to allocate unbounded amounts of memory, potentially causing resource exhaustion or panics. After fix, Reader.Read limits the maximum size of header blocks to 1 Mi...

Golang Go

7.5

CVSSv3

An attacker may cause a denial of service by crafting an Accept-Language header which ParseAcceptLanguage will take significant time to parse.

Golang Text

Get Started

1 2 3 NEXT »

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook