WID-SEC-W-2026-0548

DeutschShown in its original language — a full translation is planned for a future version.

Golang Go: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff

view advisory published 2026-02-26

Ein Angreifer kann mehrere Schwachstellen in Golang Go ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen.

describes (5)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2026-27142US	—	0.34% (27th)	—	2026-03-06
Actions which insert URLs into the content attribute of HTML meta tags are not escaped. This can allow XSS if the meta tag also has an http-equiv attribute with the value "refresh"…
CVE-2026-27139US	—	0.21% (11th)	—	2026-03-06
On Unix platforms, when listing the contents of a directory using File.ReadDir or File.Readdir the returned FileInfo could reference a file outside of the Root in which the File wa…
CVE-2026-27138US	—	0.36% (30th)	—	2026-03-06
Certificate verification can panic when a certificate in the chain has an empty DNS name and another certificate in the chain has excluded name constraints. This can crash programs…
CVE-2026-27137US	—	0.63% (50th)	—	2026-03-06
When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these…
CVE-2026-25679US	—	0.77% (56th)	—	2026-03-06
url.Parse insufficiently validated the host/authority component and accepted some invalid URLs.

External citations — patches, advisories, analysis.

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.