Go Vulnerability Database
Data about new vulnerabilities come directly from Go package maintainers or sources such as MITRE and GitHub. Reports are curated by the Go Security team. Learn more at go.dev/security/vuln.
Search
Recent Reports
GO-2023-2074
- CVE-2023-42821, GHSA-m9xq-6h2j-65r2
- Affects: github.com/gomarkdown/markdown
- Published: Sep 22, 2023
Parser out-of-bounds read vulnerability caused by a malformed markdown input
GO-2023-2052
- CVE-2023-41338, GHSA-3q5p-3558-364f
- Affects: github.com/gofiber/fiber/v2
- Published: Sep 12, 2023
The Ctx.IsFromLocal function can incorrectly report a request as being sent from localhost when the request contains an X-Forwarded-For header containing a localhost IP address.
GO-2023-2048
- GHSA-6xv5-86q9-7xr8
- Affects: github.com/cyphar/filepath-securejoin
- Published: Sep 13, 2023
Certain rootfs and path combinations result in generated paths that are outside of the provided rootfs on Windows.
GO-2023-2045
- CVE-2023-39322
- Affects: crypto/tls
- Published: Sep 07, 2023
- Modified: Sep 11, 2023
QUIC connections do not set an upper bound on the amount of data buffered when reading post-handshake messages, allowing a malicious QUIC connection to cause unbounded memory growth. With fix, connections now consistently reject messages larger than 65KiB in size.
GO-2023-2044
- CVE-2023-39321
- Affects: crypto/tls
- Published: Sep 07, 2023
- Modified: Sep 11, 2023
Processing an incomplete post-handshake message for a QUIC connection can cause a panic.
If you don't see an existing, public Go vulnerability in a publicly importable package in our database, please let us know.