Go Vulnerability Database
Data about new vulnerabilities come directly from Go package maintainers or sources such as MITRE and GitHub. Reports are curated by the Go Security team. Learn more at go.dev/security/vuln.
Search
Recent Reports
GO-2024-2833
- CVE-2024-34079
- Affects: github.com/octo-sts/app
- Published: May 13, 2024
Excessively large requests can be processed, consuming a large amount of resources. This could potentially lead to a denial of service.
GO-2024-2831
- CVE-2024-34360, GHSA-jcqq-g64v-gcm7
- Affects: github.com/spacemeshos/api/release/go, github.com/spacemeshos/go-spacemesh
- Published: May 14, 2024
Nodes can publish ATXs which reference the incorrect previous ATX of the Smesher that created the ATX. ATXs are expected to form a single chain from the newest to the first ATX ever published by an identity. Allowing Smeshers to reference an earlier (but not the latest) ATX as previous breaks this protocol rule.
GO-2024-2830
- CVE-2024-34352, GHSA-f8ch-w75v-c847
- Affects: github.com/1Panel-dev/1Panel
- Published: May 14, 2024
A maliciously crafted packet can write to an arbitrary file.
GO-2024-2826
- CVE-2024-32886, GHSA-649x-hxfx-57j2
- Affects: vitess.io/vitess
- Published: May 10, 2024
When executing a query, the vtgate will go into an endless loop that also keeps consuming memory and eventually will OOM. This causes a denial of service.
GO-2024-2825
- CVE-2024-24787
- Affects: cmd/go
- Published: May 08, 2024
On Darwin, building a Go module which contains CGO can trigger arbitrary code execution when using the Apple version of ld, due to usage of the -lto_library flag in a "#cgo LDFLAGS" directive.
If you don't see an existing, public Go vulnerability in a publicly importable package in our database, please let us know.