DeutschShown in its original language — a full translation is planned for a future version.
Golang Go: Mehrere Schwachstellen
view advisory published 2026-05-07
Ein Angreifer kann mehrere Schwachstellen in Golang Go ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Daten zu manipulieren, Cross-Site-Scripting-Angriffe durchzuführen, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand zu verursachen.
01
describes (12)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-42501US | — | — | ||
A malicious module proxy can exploit a flaw in the go command's validation of module checksums to bypass checksum database validation. This vulnerability affects any user using an… | ||||
| CVE-2026-42499US | — | — | ||
Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322. | ||||
| CVE-2026-39836US | high7.5 | — | ||
The Dial and LookupPort functions panic on Windows when provided with an input containing a NUL (0). | ||||
| CVE-2026-39826US | — | — | ||
If a trusted template author were to write a <script> tag containing an empty 'type' attribute or a 'type' attribute with an ASCII whitespace, the execution of the template would i… | ||||
| CVE-2026-39825US | — | — | ||
ReverseProxy can forward queries containing parameters not visible to Rewrite functions. When used with a Rewrite function, or a Director function which parses query parameters, Re… | ||||
| CVE-2026-39823US | — | — | ||
CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a <meta> tag's <content> attribute. If the URL content were to insert ASCII whitespaces arou… | ||||
| CVE-2026-39820US | high7.5 | — | ||
Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations. | ||||
| CVE-2026-39819US | medium5.3 | — | ||
The "go bug" command writes to two files with predictable names in the system temporary directory (for example, "/tmp"). An attacker with access to the temporary directory can crea… | ||||
| CVE-2026-39817US | medium5.9 | — | ||
The "go tool pack" subcommand (usually used only by the compiler as an internal tool with known-good inputs) does not sanitize output filenames. Extracting a malicious archive file… | ||||
| CVE-2026-33814US | high7.5 | — | ||
When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0. | ||||
| CVE-2026-33811US | high7.5 | — | ||
When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash. | ||||
| CVE-2026-27142US | — | — | ||
Actions which insert URLs into the content attribute of HTML meta tags are not escaped. This can allow XSS if the meta tag also has an http-equiv attribute with the value "refresh"… | ||||
02
references
External citations — patches, advisories, analysis.
- Oracle Linux Security Advisory ELSA-2026-35832 vom 2026-07-17external
- Oracle Linux Security Advisory ELSA-2026-38504 vom 2026-07-20external
- Oracle Linux Security Advisory ELSA-2026-39319 vom 2026-07-15external
- Oracle Linux Security Advisory ELSA-2026-39573 vom 2026-07-22external
- Oracle Linux Security Advisory ELSA-2026-70201 vom 2026-09-23external
- Oracle Linux Security Advisory ELSA-2026-89752 vom 2026-10-27external
- Red Hat Security Advisory RHSA-2026:17713 vom 2026-05-27external
- Red Hat Security Advisory RHSA-2026:17714 vom 2026-05-27external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan