| CVE-2026-39831 | CRÍTICO9.1 | The Verify() method for FIDO/U2F security key types ( [email protected], [email protected]) did not check the User Presence flag. Signatures generated without physical touch were accepted, allowing unattended use of a hardware security key. To restore the previous behavior, return a "no-touch-r | 22/05/2026 |
| CVE-2026-39830 | CRÍTICO9.1 | A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop. The blocked goroutine could not be released by calling Close(), resulting in a resource leak per connection. Unsolicited global responses are now discarded. | 22/05/2026 |
| CVE-2026-39829 | ALTO7.5 | The RSA and DSA public key parsers did not enforce size limits on key parameters. A crafted public key with an excessively large modulus or DSA parameter could cause several minutes of CPU consumption during signature verification. This could be triggered by unauthenticated clients during public key authentication. RSA | 22/05/2026 |
| CVE-2026-39828 | MEDIO6.3 | When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as force-command after a second factor succeeded. Returning non-nil Permissions with PartialSuccessError now results in a connec | 22/05/2026 |
| CVE-2026-39827 | MEDIO6.5 | An authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users. Rejected channels are now properly removed from the connection's internal state and released for garbage collection. | 22/05/2026 |
| CVE-2026-42501 | ALTO7.5 | A malicious module proxy can exploit a flaw in the go command's validation of module checksums to bypass checksum database validation. This vulnerability affects any user using an untrusted module proxy (GOMODPROXY) or checksum database (GOSUMDB). A malicious module proxy can serve altered versions of the Go toolchain. | 07/05/2026 |
| CVE-2026-42499 | ALTO7.5 | Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322. | 07/05/2026 |
| CVE-2026-39836 | ALTO7.5 | The Dial and LookupPort functions panic on Windows when provided with an input containing a NUL (0). | 07/05/2026 |
| CVE-2026-39826 | MEDIO6.1 | If a trusted template author were to write a <script> tag containing an empty 'type' attribute or a 'type' attribute with an ASCII whitespace, the execution of the template would incorrectly escape any data passed into the <script> block. | 07/05/2026 |
| CVE-2026-39825 | MEDIO5.3 | ReverseProxy can forward queries containing parameters not visible to Rewrite functions. When used with a Rewrite function, or a Director function which parses query parameters, ReverseProxy sanitizes the forwarded request to remove query parameters which are not parsed by url.ParseQuery. ReverseProxy does not take Par | 07/05/2026 |
| CVE-2026-39823 | MEDIO6.1 | CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a <meta> tag's <content> attribute. If the URL content were to insert ASCII whitespaces around the '=' rune inside of the <content> attribute, the escaper would fail to similarly escape it, leading to XSS. | 07/05/2026 |
| CVE-2026-39820 | ALTO7.5 | Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations. | 07/05/2026 |
| CVE-2026-39819 | MEDIO5.3 | The "go bug" command writes to two files with predictable names in the system temporary directory (for example, "/tmp"). An attacker with access to the temporary directory can create a symlink in one of these names, causing "go bug" to overwrite the target of the symlink. | 07/05/2026 |
| CVE-2026-39817 | MEDIO5.9 | The "go tool pack" subcommand (usually used only by the compiler as an internal tool with known-good inputs) does not sanitize output filenames. Extracting a malicious archive file with the "pack" subcommand can write files to arbitrary locations on the filesystem. | 07/05/2026 |
| CVE-2026-33814 | ALTO7.5 | When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0. | 07/05/2026 |
| CVE-2026-33811 | ALTO7.5 | When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash. | 07/05/2026 |
| CVE-2026-42503 | ALTO8.8 | gopls by default communicates via pipe. However, -port and -listen flags are supported as means of debugging.
If -listen is given a value without an explicit host (e.g. :8080), or -port is used, gopls will listen on 0.0.0.0.
As a result, users might inadvertently cause gopls to bind 0.0.0.0.
This can allow a malicious | 06/05/2026 |
| CVE-2026-33813 | ALTO7.5 | Parsing a WEBP image with an invalid, large size panics on 32-bit platforms. | 21/04/2026 |
| CVE-2026-33812 | MEDIO6.1 | Parsing a malicious font file can cause excessive memory allocation. | 21/04/2026 |
| CVE-2026-33810 | ALTO8.2 | When verifying a certificate chain containing excluded DNS constraints, these constraints are not correctly applied to wildcard DNS SANs which use a different case than the constraint. This only affects validation of otherwise trusted certificate chains, issued by a root CA in the VerifyOptions.Roots CertPool, or in th | 08/04/2026 |