Vulnerabilities > Golang

DATE CVE VULNERABILITY TITLE RISK
2021-08-08 CVE-2021-36221 Race Condition vulnerability in multiple products
Go before 1.15.15 and 1.16.x before 1.16.7 has a race condition that can lead to a net/http/httputil ReverseProxy panic upon an ErrAbortHandler abort.
4.3
2021-08-07 CVE-2021-29923 Unspecified vulnerability in Golang GO
Go before 1.17 does not properly consider extraneous zero characters at the beginning of an IP address octet, which (in some situations) allows attackers to bypass access control that is based on IP addresses, because of unexpected octal interpretation.
network
low complexity
golang
5.0
2021-08-02 CVE-2021-33195 Injection vulnerability in Golang GO
Go before 1.15.13 and 1.16.x before 1.16.5 has functions for DNS lookups that do not validate replies from DNS servers, and thus a return value may contain an unsafe injection (e.g., XSS) that does not conform to the RFC1035 format.
network
low complexity
golang CWE-74
7.5
2021-08-02 CVE-2021-33196 Resource Exhaustion vulnerability in Golang GO
In archive/zip in Go before 1.15.13 and 1.16.x before 1.16.5, a crafted file count (in an archive's header) can cause a NewReader or OpenReader panic.
network
low complexity
golang CWE-400
5.0
2021-08-02 CVE-2021-33197 Missing Authorization vulnerability in Golang GO
In Go before 1.15.13 and 1.16.x before 1.16.5, some configurations of ReverseProxy (from net/http/httputil) result in a situation where an attacker is able to drop arbitrary headers.
network
golang CWE-862
4.3
2021-08-02 CVE-2021-33198 Unspecified vulnerability in Golang GO
In Go before 1.15.13 and 1.16.x before 1.16.5, there can be a panic for a large exponent to the math/big.Rat SetString or UnmarshalText method.
network
low complexity
golang
5.0
2021-07-15 CVE-2021-34558 Improper Certificate Validation vulnerability in multiple products
The crypto/tls package of Go through 1.16.5 does not properly assert that the type of public key in an X.509 certificate matches the expected type when doing a RSA based key exchange, allowing a malicious TLS server to cause a TLS client to panic.
network
high complexity
golang fedoraproject netapp CWE-295
2.6
2021-07-09 CVE-2012-2666 Insecure Temporary File vulnerability in Golang GO 1.0.2
golang/go in 1.0.2 fixes all.bash on shared machines.
network
low complexity
golang CWE-377
7.5
2021-05-27 CVE-2021-31525 Uncontrolled Recursion vulnerability in Golang GO
net/http in Go before 1.15.12 and 1.16.x before 1.16.4 allows remote attackers to cause a denial of service (panic) via a large header to ReadRequest or ReadResponse.
network
high complexity
golang CWE-674
2.6
2021-05-26 CVE-2021-33194 Infinite Loop vulnerability in Golang GO
golang.org/x/net before v0.0.0-20210520170846-37e1c6afe023 allows attackers to cause a denial of service (infinite loop) via crafted ParseFragment input.
network
low complexity
golang CWE-835
5.0