Go Vulnerability Database
Data about new vulnerabilities come directly from Go package maintainers or sources such as MITRE and GitHub. Reports are curated by the Go Security team. Learn more at go.dev/security/vuln.
Search
Recent Reports
GO-2024-2826
- CVE-2024-32886, GHSA-649x-hxfx-57j2
- Affects: vitess.io/vitess
- Published: May 10, 2024
When executing a query, the vtgate will go into an endless loop that also keeps consuming memory and eventually will OOM. This causes a denial of service.
GO-2024-2825
- CVE-2024-24787
- Affects: cmd/go
- Published: May 08, 2024
On Darwin, building a Go module which contains CGO can trigger arbitrary code execution when using the Apple version of ld, due to usage of the -lto_library flag in a "#cgo LDFLAGS" directive.
GO-2024-2824
- CVE-2024-24788
- Affects: net
- Published: May 07, 2024
- Modified: May 08, 2024
A malformed DNS message in response to a query can cause the Lookup functions to get stuck in an infinite loop.
GO-2024-2822
- CVE-2024-30850, CVE-2024-33434, and 2 more
- Affects: github.com/tiagorlampert/CHAOS
- Published: May 09, 2024
A remote attacker can execute arbitrary commands via crafted HTTP requests.
GO-2024-2821
- CVE-2024-34084, GHSA-9c5w-9q3f-3hv7
- Affects: github.com/stacklok/minder
- Published: May 10, 2024
HandleGithubWebhook is susceptible to a denial of service attack from an untrusted HTTP request. An untrusted request can cause the server to allocate large amounts of memory resulting in a denial of service.
If you don't see an existing, public Go vulnerability in a publicly importable package in our database, please let us know.