CSIRTS // UNIFIED SECURITY ADVISORY FEEDSYS ● ONLINE · POWERED BY INTELFUSIONS.COM

CSIRTSSecurity advisory fusion

← All products & vendors

Go — security advisories

22 advisorieslatest 2026-08-20⚡ RSS feed

Tracked Go products:

Go Cryptography Go encoding/xml Go standard library golang.org/x/sys/windows Go standard library (net/http)encoding/asn1 net/http html/template golang.org/x/mod

⚡ Watch Go

Get an email when a new Go advisory drops — max one per day, one-click unsubscribe.

[UPDATE] [high] Golang Go: Multiple vulnerabilities

highCVE-2025-22866 CVE-2025-22867cert-bund2026-08-20

[UPDATE] [medium] Golang Go: Multiple vulnerabilities

mediumCVE-2024-45336 CVE-2024-45340 CVE-2024-45341 CVE-2025-22865cert-bund2026-08-20

[UPDATE] [low] Golang Go: Vulnerability enables information disclosure

lowCVE-2025-22866cert-bund2026-08-13

CVE-2026-56865: Fix transparency log tile verification bypass in golang.org/x/mod/sumdb/tlog

highCVSS 8.4CVE-2026-56865msrc2026-08-11

CVE-2026-33818: Enforce maximum recursion depth in encoding/asn1

highCVSS 7.5CVE-2026-33818msrc2026-08-11

CVE-2026-56853: Apply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/http

highCVSS 7.5CVE-2026-56853msrc2026-08-11

CVE-2026-56858: Fix Javascript regexp context tracking in html/template

mediumCVSS 6.1CVE-2026-56858msrc2026-08-11

CVE-2026-56859: Add recursion depth guard during decode in encoding/xml

highCVSS 7.5CVE-2026-56859msrc2026-08-11

CVE-2026-56860: Avoid quadratic complexity in resolvePath in net/url

mediumCVSS 5.9CVE-2026-56860msrc2026-08-11

CVE-2026-56862: Limit handshake messages we are willing to accept post-handshake in crypto/tls

highCVSS 7.5CVE-2026-56862msrc2026-08-11

CVE-2026-56864: Ignore unrelated, unauthenticated hashes in Lookup in golang.org/x/mod/sumdb

highCVSS 7.5CVE-2026-56864msrc2026-08-11

CVE-2025-58186: Lack of limit when parsing cookies can cause memory exhaustion in net/http

mediumCVSS 5.3CVE-2025-58186msrc2026-08-06

CVE-2025-61725: Excessive CPU consumption in ParseAddress in net/mail

highCVSS 7.5CVE-2025-61725msrc2026-08-06

CVE-2026-39824: Invoking integer overflow in NewNTUnicodeString in golang.org/x/sys/windows

criticalCVSS 9.8CVE-2026-39824msrc2026-08-06

CVE-2026-27137: Incorrect enforcement of email constraints in crypto/x509

mediumCVSS 5.9CVE-2026-27137msrc2026-08-06

CVE-2020-29511: The encoding/xml package in Go (all versions) does not correctly preserve the semantics of element namespace prefixes during tokenization round-trips which allows an attacker to craft inputs that behave in conflicting ways during different stages of processing in affected downstream applications.

mediumCVSS 5.6CVE-2020-29511msrc2026-08-06

CVE-2025-61727: Improper application of excluded DNS name constraints when verifying wildcard names in crypto/x509

mediumCVSS 6.5CVE-2025-61727msrc2026-08-06

CVE-2020-29509: The encoding/xml package in Go (all versions) does not correctly preserve the semantics of attribute namespace prefixes during tokenization round-trips which allows an attacker to craft inputs that behave in conflicting ways during different stages of processing in affected downstream applications.

mediumCVSS 5.6CVE-2020-29509msrc2026-08-06

[UPDATE] [medium] Golang Go: Multiple vulnerabilities enable unspecified attack

mediumCVE-2023-45289 CVE-2023-45290 CVE-2024-24783 CVE-2024-24786cert-bund2026-08-05

[UPDATE] [medium] Golang Go: Multiple vulnerabilities

mediumCVE-2025-0913 CVE-2025-22874 CVE-2025-4673cert-bund2026-08-05

[UPDATE] [medium] Golang Go (sys): Vulnerability enables Denial of Service

mediumCVE-2026-39824cert-bund2026-08-03

USN-8519-1: Go Cryptography vulnerabilities

unknownCVE-2025-47913 CVE-2025-22869ubuntu2026-07-09