Go vulnerabilities
7 vulnerabilities
Known vulnerabilities in Go products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 5 products.
Products
5- Html2 vulnerabilities
- Ssh2 vulnerabilities
- Go1 vulnerabilities
- Jws1 vulnerabilities
- SSH Library1 vulnerabilities
RoutineCVE-2025-58190golang.org/x/net · golang.org/x/net/html +690 moreInfinite parsing loop in golang.org/x/netThe html.Parse function in golang.org/x/net/html has an infinite parsing loop when processing certain inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content.CVSS5.3MediumEPSS0.54%RoutineCVE-2025-47911golang.org/x/net · golang.org/x/net/html +694 moreQuadratic parsing complexity in golang.org/x/net/htmlThe html.Parse function in golang.org/x/net/html has quadratic parsing complexity when processing certain inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content.CVSS5.3MediumEPSS0.56%RoutineCVE-2025-68120github.com/golang/vscode-go +2 moreUnexpected untrusted code execution in github.com/golang/vscode-goTo prevent unexpected untrusted code execution, the Visual Studio Code Go extension is now disabled in Restricted Mode.CVSS5.4MediumEPSS0.45%PrioritiseCVE-2025-47913golang.org/x/crypto · golang.org/x/crypto/ssh/agent +599 morePotential denial of service in golang.org/x/crypto/ssh/agentSSH clients receiving SSH_AGENT_SUCCESS when expecting a typed response will panic and cause early termination of the client process.CVSS7.5HighEPSS0.67%PrioritiseCVE-2025-22868golang.org/x/oauth2 · golang.org/x/oauth2/jws +2497 moreUnexpected memory consumption during token parsing in golang.org/x/oauth2An attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing.CVSS7.5HighEPSS0.87%PrioritiseCVE-2025-22869golang.org/x/crypto · golang.org/x/crypto/ssh +2164 morePotential denial of service in golang.org/x/cryptoSSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted.CVSS7.5HighEPSS0.94%PrioritiseCVE-2017-3204go · ssh library +5 morego ssh libraryThe Go SSH library (x/crypto/ssh) by default does not verify host keys, facilitating man-in-the-middle attacks. Default behavior changed in commit e4e2799 to require explicitly registering a hostkey verification mechanism.CVSS8.1HighEPSS3.16%