Go Vulnerability Database
Data about new vulnerabilities come directly from Go package maintainers or sources such as MITRE and GitHub. Reports are curated by the Go Security team. Learn more at go.dev/security/vuln.
Search
Recent Reports
- CVE-2026-46598
- Affects: golang.org/x/crypto
- Published: May 22, 2026
For certain crafted inputs, a 'ed25519.PrivateKey' was created by casting malformed wire bytes, leading to a panic when used.
- CVE-2026-46599
- Affects: golang.org/x/image
- Published: May 29, 2026
The TIFF decoder does not place a limit on the size of PackBits-compressed data. A maliciously-crafted image can exploit this to cause a small image (both in terms of pixel width/height and encoded size) to make the decoder decode large amounts of compressed data.
- CVE-2026-42500
- Affects: golang.org/x/image
- Published: May 29, 2026
Decoding a paletted BMP file with an out-of-range palette index results in a panic when accessing pixels in the invalid image.
- CVE-2026-27136
- Affects: golang.org/x/net
- Published: May 22, 2026
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.
- CVE-2026-25681
- Affects: golang.org/x/net
- Published: May 22, 2026
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.
If you don't see an existing, public Go vulnerability in a publicly importable package in our database, please let us know.
