Threat database

Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer.

Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello.

On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /. For example, 'root.Open("symlink/")' will open "symlink" even when "symlink" is a symbolic link pointing outside of the root.

Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU.

The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject "example.com" but permit "xn--example-.com". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name "example.com".

CVE-2026-39836 is a high-severity vulnerability in the Go standard library's net package on Windows platforms. The Dial and LookupPort functions panic when given input containing a NUL (0) character, causing an uncaught exception that can crash the application. This results in a denial of service condition. There is no impact on confidentiality or integrity reported. No official patch or remediation guidance is currently available, and no exploits are known in the wild.

CVE-2026-39826 is a medium severity cross-site scripting (XSS) vulnerability in the Go standard library's html/template package. It occurs when a trusted template author includes a <script> tag with an empty or whitespace-only 'type' attribute, leading to improper escaping of data inside the script block. This can allow injection of malicious scripts if untrusted data is passed into the template. The vulnerability affects Go versions up to and including 1.26.0-0. There is no official patch or remediation guidance available, and no known exploits have been reported in the wild.

CVE-2026-39825 is a medium severity vulnerability in the Go standard library's net/http/httputil ReverseProxy component. It involves inconsistent parsing of HTTP query parameters, where some parameters may be hidden from certain functions like Rewrite or Director but still forwarded by ReverseProxy. This leads to inconsistent interpretation of HTTP requests, classified as HTTP Request/Response Smuggling (CWE-444). No official patch or remediation guidance has been published, and no known exploits exist in the wild.

CVE-2026-39823 is a medium severity cross-site scripting (XSS) vulnerability in the Go standard library's html/template package. The issue arises from improper escaping of URLs within a <meta> tag's content attribute when ASCII whitespaces surround the '=' character, which allows partial bypass of escaping. This affects Go versions up to 1.26.0-0. No official patch or remediation guidance has been confirmed by the vendor, and no known exploits exist in the wild at this time.

Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations.

When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash.

Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322.

CVE-2026-32289 is a medium severity cross-site scripting (XSS) vulnerability in the Go standard library's html/template package. It arises from improper escaping of content within JavaScript template literals due to incorrect context tracking and brace depth handling. This flaw can lead to XSS when template branches are used. The vulnerability affects Go versions up to and including 1.26.0-0. No official patch or remediation guidance is currently available, and no known exploits have been reported in the wild.

CVE-2026-32288 is a medium severity vulnerability in the Go standard library's archive/tar package. The tar.Reader component can consume an unbounded amount of memory when processing malicious tar archives with many sparse regions encoded using the old GNU sparse map format. This can lead to denial of service due to excessive memory use. The vulnerability affects Go versions up to 1.26.0-0. No patch or official remediation is currently available, and no exploits have been reported in the wild.

During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of service. This affects both direct users of crypto/x509 and users of crypto/tls.

Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service. This only affects validation of otherwise trusted certificate chains, issued by a root CA in the VerifyOptions.Roots CertPool, or in the system certificate pool.

If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled consumption of resources. This can lead to a denial of service. This only affects TLS 1.3.

When verifying a certificate chain containing excluded DNS constraints, these constraints are not correctly applied to wildcard DNS SANs which use a different case than the constraint. This only affects validation of otherwise trusted certificate chains, issued by a root CA in the VerifyOptions.Roots CertPool, or in the system certificate pool.

On Linux, if the target of Root.Chmod is replaced with a symlink while the chmod operation is in progress, Chmod can operate on the target of the symlink, even when the target lies outside the root. The Linux fchmodat syscall silently ignores the AT_SYMLINK_NOFOLLOW flag, which Root.Chmod uses to avoid symlink traversal. Root.Chmod checks its target before acting and returns an error if the target is a symlink lying outside the root, so the impact is limited to cases where the target is replaced with a symlink between the check and operation.

CVE-2026-27142 is a medium severity cross-site scripting (XSS) vulnerability in the Go standard library's html/template package. It occurs because URLs inserted into the content attribute of HTML meta tags are not properly escaped when the meta tag includes an http-equiv attribute with the value "refresh". This improper neutralization can allow an attacker to inject malicious scripts. A new GODEBUG setting, htmlmetacontenturlescape, has been introduced to control escaping behavior for URLs in meta content attributes. No official patch or fix details are provided in the available data.