Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (15 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2026-39836 1 Go Standard Library 1 Net 2026-05-11 7.5 High
The Dial and LookupPort functions panic on Windows when provided with an input containing a NUL (0).
CVE-2026-39825 1 Go Standard Library 1 Net/http 2026-05-11 5.3 Medium
ReverseProxy can forward queries containing parameters not visible to Rewrite functions. When used with a Rewrite function, or a Director function which parses query parameters, ReverseProxy sanitizes the forwarded request to remove query parameters which are not parsed by url.ParseQuery. ReverseProxy does not take ParseQuery's limit on the total number of query parameters (controlled by GODEBUG=urlmaxqueryparams=N) into account. This can permit ReverseProxy to forward a request containing a query parameter that is not visible to the Rewrite function. For example, the query "a1=x&a2=x&...&a10000=x&hidden=y" can forward the parameter "hidden=y" while hiding it from the proxy's Rewrite function.
CVE-2026-33811 1 Go Standard Library 1 Net 2026-05-11 7.5 High
When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash.
CVE-2026-33814 2 Go Standard Library, Golang 2 Net/http, Http2 2026-05-08 7.5 High
When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.
CVE-2026-42499 1 Go Standard Library 1 Net\/mail 2026-05-08 7.5 High
Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322.
CVE-2026-39820 1 Go Standard Library 1 Net/mail 2026-05-08 7.5 High
Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations.
CVE-2026-25679 2 Go Standard Library, Golang 2 Net/url, Go 2026-04-21 7.5 High
url.Parse insufficiently validated the host/authority component and accepted some invalid URLs.
CVE-2026-27141 1 Go Standard Library 1 Net/http 2026-04-16 7.5 High
Due to missing nil check, sending 0x0a-0x0f HTTP/2 frames will cause a running server to panic
CVE-2023-45288 3 Go Standard Library, Golang, Redhat 33 Net\/http, Http2, Acm and 30 more 2026-04-15 7.5 High
An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a request's headers exceed MaxHeaderBytes, no memory is allocated to store the excess headers, but they are still parsed. This permits an attacker to cause an HTTP/2 endpoint to read arbitrary amounts of header data, all associated with a request which is going to be rejected. These headers can include Huffman-encoded data which is significantly more expensive for the receiver to decode than for an attacker to send. The fix sets a limit on the amount of excess header frames we will process before closing a connection.
CVE-2025-47910 2 Go Standard Library, Golang 3 Net\/http, Http2, Net 2026-04-15 5.4 Medium
When using http.CrossOriginProtection, the AddInsecureBypassPattern method can unexpectedly bypass more requests than intended. CrossOriginProtection then skips validation, but forwards the original request path, which may be served by a different handler without the intended security protections.
CVE-2024-24784 2 Go Standard Library, Redhat 14 Net\/mail, Advanced Cluster Security, Ceph Storage and 11 more 2026-04-15 7.5 High
The ParseAddressList function incorrectly handles comments (text within parentheses) within display names. Since this is a misalignment with conforming address parsers, it can result in different trust decisions being made by programs using different parsers.
CVE-2024-24791 2 Go Standard Library, Redhat 20 Net\/http, Amq Streams, Ceph Storage and 17 more 2026-04-15 7.5 High
The net/http HTTP/1.1 client mishandled the case where a server responds to a request with an "Expect: 100-continue" header with a non-informational (200 or higher) status. This mishandling could leave a client connection in an invalid state, where the next request sent on the connection will fail. An attacker sending a request to a net/http/httputil.ReverseProxy proxy can exploit this mishandling to cause a denial of service by sending "Expect: 100-continue" requests which elicit a non-informational response from the backend. Each such request leaves the proxy with an invalid connection, and causes one subsequent request using that connection to fail.
CVE-2024-34156 2 Go Standard Library, Redhat 19 Encoding\/gob, Advanced Cluster Security, Ceph Storage and 16 more 2026-04-15 7.5 High
Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion. This is a follow-up to CVE-2022-30635.
CVE-2025-61726 2 Go Standard Library, Golang 2 Net/url, Go 2026-02-06 7.5 High
The net/url package does not set a limit on the number of query parameters in a query. While the maximum size of query parameters in URLs is generally limited by the maximum request header size, the net/http.Request.ParseForm method can parse large URL-encoded forms. Parsing a large form containing many unique query parameters can cause excessive memory consumption.
CVE-2023-39322 3 Go Standard Library, Golang, Redhat 18 Crypto Tls, Go, Acm and 15 more 2025-02-13 7.5 High
QUIC connections do not set an upper bound on the amount of data buffered when reading post-handshake messages, allowing a malicious QUIC connection to cause unbounded memory growth. With fix, connections now consistently reject messages larger than 65KiB in size.