{ "vulnerabilities": [], "ok": true, "dependencyCount": 128, "org": "sean.graham", "policy": "# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.\nversion: v1.25.1\nignore: {}\npatch: {}\n", "isPrivate": true, "licensesPolicy": { "severities": {}, "orgLicenseRules": { "AGPL-1.0": { "licenseType": "AGPL-1.0", "severity": "high", "instructions": "" }, "AGPL-3.0": { "licenseType": "AGPL-3.0", "severity": "high", "instructions": "" }, "Artistic-1.0": { "licenseType": "Artistic-1.0", "severity": "medium", "instructions": "" }, "Artistic-2.0": { "licenseType": "Artistic-2.0", "severity": "medium", "instructions": "" }, "CDDL-1.0": { "licenseType": "CDDL-1.0", "severity": "medium", "instructions": "" }, "CPOL-1.02": { "licenseType": "CPOL-1.02", "severity": "high", "instructions": "" }, "EPL-1.0": { "licenseType": "EPL-1.0", "severity": "medium", "instructions": "" }, "GPL-2.0": { "licenseType": "GPL-2.0", "severity": "high", "instructions": "" }, "GPL-3.0": { "licenseType": "GPL-3.0", "severity": "high", "instructions": "" }, "LGPL-2.0": { "licenseType": "LGPL-2.0", "severity": "medium", "instructions": "" }, "LGPL-2.1": { "licenseType": "LGPL-2.1", "severity": "medium", "instructions": "" }, "LGPL-3.0": { "licenseType": "LGPL-3.0", "severity": "medium", "instructions": "" }, "MPL-1.1": { "licenseType": "MPL-1.1", "severity": "medium", "instructions": "" }, "MPL-2.0": { "licenseType": "MPL-2.0", "severity": "medium", "instructions": "" }, "MS-RL": { "licenseType": "MS-RL", "severity": "medium", "instructions": "" }, "SimPL-2.0": { "licenseType": "SimPL-2.0", "severity": "high", "instructions": "" } } }, "packageManager": "deb", "ignoreSettings": { "adminOnly": false, "reasonRequired": false, "disregardFilesystemIgnores": false, "autoApproveIgnores": false, "approvalWorkflowEnabled": false }, "docker": { "os": { "prettyName": "Ubuntu 24.04.5 LTS" } }, "summary": "No known operating system vulnerabilities", "severityThreshold": "high", "filesystemPolicy": false, "uniqueCount": 0, "projectName": "docker-image|docker.io/mongo", "platform": "linux/amd64", "hasUnknownVersions": false, "path": "docker.io/mongo:8.0/mongo", "applications": [ { "vulnerabilities": [], "ok": true, "dependencyCount": 105, "org": "sean.graham", "policy": "# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.\nversion: v1.25.1\nignore: {}\npatch: {}\n", "isPrivate": true, "licensesPolicy": { "severities": {}, "orgLicenseRules": { "AGPL-1.0": { "licenseType": "AGPL-1.0", "severity": "high", "instructions": "" }, "AGPL-3.0": { "licenseType": "AGPL-3.0", "severity": "high", "instructions": "" }, "Artistic-1.0": { "licenseType": "Artistic-1.0", "severity": "medium", "instructions": "" }, "Artistic-2.0": { "licenseType": "Artistic-2.0", "severity": "medium", "instructions": "" }, "CDDL-1.0": { "licenseType": "CDDL-1.0", "severity": "medium", "instructions": "" }, "CPOL-1.02": { "licenseType": "CPOL-1.02", "severity": "high", "instructions": "" }, "EPL-1.0": { "licenseType": "EPL-1.0", "severity": "medium", "instructions": "" }, "GPL-2.0": { "licenseType": "GPL-2.0", "severity": "high", "instructions": "" }, "GPL-3.0": { "licenseType": "GPL-3.0", "severity": "high", "instructions": "" }, "LGPL-2.0": { "licenseType": "LGPL-2.0", "severity": "medium", "instructions": "" }, "LGPL-2.1": { "licenseType": "LGPL-2.1", "severity": "medium", "instructions": "" }, "LGPL-3.0": { "licenseType": "LGPL-3.0", "severity": "medium", "instructions": "" }, "MPL-1.1": { "licenseType": "MPL-1.1", "severity": "medium", "instructions": "" }, "MPL-2.0": { "licenseType": "MPL-2.0", "severity": "medium", "instructions": "" }, "MS-RL": { "licenseType": "MS-RL", "severity": "medium", "instructions": "" }, "SimPL-2.0": { "licenseType": "SimPL-2.0", "severity": "high", "instructions": "" } } }, "packageManager": "gomodules", "ignoreSettings": { "adminOnly": false, "reasonRequired": false, "disregardFilesystemIgnores": false, "autoApproveIgnores": false, "approvalWorkflowEnabled": false }, "docker": {}, "summary": "No high or critical severity vulnerabilities", "severityThreshold": "high", "filesystemPolicy": false, "uniqueCount": 0, "targetFile": "/usr/bin/bsondump", "projectName": "go-distribution@command-line-arguments", "displayTargetFile": "/usr/bin/bsondump", "hasUnknownVersions": false, "path": "docker.io/mongo:8.0" }, { "vulnerabilities": [], "ok": true, "dependencyCount": 168, "org": "sean.graham", "policy": "# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.\nversion: v1.25.1\nignore: {}\npatch: {}\n", "isPrivate": true, "licensesPolicy": { "severities": {}, "orgLicenseRules": { "AGPL-1.0": { "licenseType": "AGPL-1.0", "severity": "high", "instructions": "" }, "AGPL-3.0": { "licenseType": "AGPL-3.0", "severity": "high", "instructions": "" }, "Artistic-1.0": { "licenseType": "Artistic-1.0", "severity": "medium", "instructions": "" }, "Artistic-2.0": { "licenseType": "Artistic-2.0", "severity": "medium", "instructions": "" }, "CDDL-1.0": { "licenseType": "CDDL-1.0", "severity": "medium", "instructions": "" }, "CPOL-1.02": { "licenseType": "CPOL-1.02", "severity": "high", "instructions": "" }, "EPL-1.0": { "licenseType": "EPL-1.0", "severity": "medium", "instructions": "" }, "GPL-2.0": { "licenseType": "GPL-2.0", "severity": "high", "instructions": "" }, "GPL-3.0": { "licenseType": "GPL-3.0", "severity": "high", "instructions": "" }, "LGPL-2.0": { "licenseType": "LGPL-2.0", "severity": "medium", "instructions": "" }, "LGPL-2.1": { "licenseType": "LGPL-2.1", "severity": "medium", "instructions": "" }, "LGPL-3.0": { "licenseType": "LGPL-3.0", "severity": "medium", "instructions": "" }, "MPL-1.1": { "licenseType": "MPL-1.1", "severity": "medium", "instructions": "" }, "MPL-2.0": { "licenseType": "MPL-2.0", "severity": "medium", "instructions": "" }, "MS-RL": { "licenseType": "MS-RL", "severity": "medium", "instructions": "" }, "SimPL-2.0": { "licenseType": "SimPL-2.0", "severity": "high", "instructions": "" } } }, "packageManager": "gomodules", "ignoreSettings": { "adminOnly": false, "reasonRequired": false, "disregardFilesystemIgnores": false, "autoApproveIgnores": false, "approvalWorkflowEnabled": false }, "docker": {}, "summary": "No high or critical severity vulnerabilities", "severityThreshold": "high", "filesystemPolicy": false, "uniqueCount": 0, "targetFile": "/usr/bin/mongodump", "projectName": "go-distribution@command-line-arguments", "displayTargetFile": "/usr/bin/mongodump", "hasUnknownVersions": false, "path": "docker.io/mongo:8.0" }, { "vulnerabilities": [], "ok": true, "dependencyCount": 168, "org": "sean.graham", "policy": "# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.\nversion: v1.25.1\nignore: {}\npatch: {}\n", "isPrivate": true, "licensesPolicy": { "severities": {}, "orgLicenseRules": { "AGPL-1.0": { "licenseType": "AGPL-1.0", "severity": "high", "instructions": "" }, "AGPL-3.0": { "licenseType": "AGPL-3.0", "severity": "high", "instructions": "" }, "Artistic-1.0": { "licenseType": "Artistic-1.0", "severity": "medium", "instructions": "" }, "Artistic-2.0": { "licenseType": "Artistic-2.0", "severity": "medium", "instructions": "" }, "CDDL-1.0": { "licenseType": "CDDL-1.0", "severity": "medium", "instructions": "" }, "CPOL-1.02": { "licenseType": "CPOL-1.02", "severity": "high", "instructions": "" }, "EPL-1.0": { "licenseType": "EPL-1.0", "severity": "medium", "instructions": "" }, "GPL-2.0": { "licenseType": "GPL-2.0", "severity": "high", "instructions": "" }, "GPL-3.0": { "licenseType": "GPL-3.0", "severity": "high", "instructions": "" }, "LGPL-2.0": { "licenseType": "LGPL-2.0", "severity": "medium", "instructions": "" }, "LGPL-2.1": { "licenseType": "LGPL-2.1", "severity": "medium", "instructions": "" }, "LGPL-3.0": { "licenseType": "LGPL-3.0", "severity": "medium", "instructions": "" }, "MPL-1.1": { "licenseType": "MPL-1.1", "severity": "medium", "instructions": "" }, "MPL-2.0": { "licenseType": "MPL-2.0", "severity": "medium", "instructions": "" }, "MS-RL": { "licenseType": "MS-RL", "severity": "medium", "instructions": "" }, "SimPL-2.0": { "licenseType": "SimPL-2.0", "severity": "high", "instructions": "" } } }, "packageManager": "gomodules", "ignoreSettings": { "adminOnly": false, "reasonRequired": false, "disregardFilesystemIgnores": false, "autoApproveIgnores": false, "approvalWorkflowEnabled": false }, "docker": {}, "summary": "No high or critical severity vulnerabilities", "severityThreshold": "high", "filesystemPolicy": false, "uniqueCount": 0, "targetFile": "/usr/bin/mongoexport", "projectName": "go-distribution@command-line-arguments", "displayTargetFile": "/usr/bin/mongoexport", "hasUnknownVersions": false, "path": "docker.io/mongo:8.0" }, { "vulnerabilities": [], "ok": true, "dependencyCount": 168, "org": "sean.graham", "policy": "# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.\nversion: v1.25.1\nignore: {}\npatch: {}\n", "isPrivate": true, "licensesPolicy": { "severities": {}, "orgLicenseRules": { "AGPL-1.0": { "licenseType": "AGPL-1.0", "severity": "high", "instructions": "" }, "AGPL-3.0": { "licenseType": "AGPL-3.0", "severity": "high", "instructions": "" }, "Artistic-1.0": { "licenseType": "Artistic-1.0", "severity": "medium", "instructions": "" }, "Artistic-2.0": { "licenseType": "Artistic-2.0", "severity": "medium", "instructions": "" }, "CDDL-1.0": { "licenseType": "CDDL-1.0", "severity": "medium", "instructions": "" }, "CPOL-1.02": { "licenseType": "CPOL-1.02", "severity": "high", "instructions": "" }, "EPL-1.0": { "licenseType": "EPL-1.0", "severity": "medium", "instructions": "" }, "GPL-2.0": { "licenseType": "GPL-2.0", "severity": "high", "instructions": "" }, "GPL-3.0": { "licenseType": "GPL-3.0", "severity": "high", "instructions": "" }, "LGPL-2.0": { "licenseType": "LGPL-2.0", "severity": "medium", "instructions": "" }, "LGPL-2.1": { "licenseType": "LGPL-2.1", "severity": "medium", "instructions": "" }, "LGPL-3.0": { "licenseType": "LGPL-3.0", "severity": "medium", "instructions": "" }, "MPL-1.1": { "licenseType": "MPL-1.1", "severity": "medium", "instructions": "" }, "MPL-2.0": { "licenseType": "MPL-2.0", "severity": "medium", "instructions": "" }, "MS-RL": { "licenseType": "MS-RL", "severity": "medium", "instructions": "" }, "SimPL-2.0": { "licenseType": "SimPL-2.0", "severity": "high", "instructions": "" } } }, "packageManager": "gomodules", "ignoreSettings": { "adminOnly": false, "reasonRequired": false, "disregardFilesystemIgnores": false, "autoApproveIgnores": false, "approvalWorkflowEnabled": false }, "docker": {}, "summary": "No high or critical severity vulnerabilities", "severityThreshold": "high", "filesystemPolicy": false, "uniqueCount": 0, "targetFile": "/usr/bin/mongofiles", "projectName": "go-distribution@command-line-arguments", "displayTargetFile": "/usr/bin/mongofiles", "hasUnknownVersions": false, "path": "docker.io/mongo:8.0" }, { "vulnerabilities": [], "ok": true, "dependencyCount": 170, "org": "sean.graham", "policy": "# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.\nversion: v1.25.1\nignore: {}\npatch: {}\n", "isPrivate": true, "licensesPolicy": { "severities": {}, "orgLicenseRules": { "AGPL-1.0": { "licenseType": "AGPL-1.0", "severity": "high", "instructions": "" }, "AGPL-3.0": { "licenseType": "AGPL-3.0", "severity": "high", "instructions": "" }, "Artistic-1.0": { "licenseType": "Artistic-1.0", "severity": "medium", "instructions": "" }, "Artistic-2.0": { "licenseType": "Artistic-2.0", "severity": "medium", "instructions": "" }, "CDDL-1.0": { "licenseType": "CDDL-1.0", "severity": "medium", "instructions": "" }, "CPOL-1.02": { "licenseType": "CPOL-1.02", "severity": "high", "instructions": "" }, "EPL-1.0": { "licenseType": "EPL-1.0", "severity": "medium", "instructions": "" }, "GPL-2.0": { "licenseType": "GPL-2.0", "severity": "high", "instructions": "" }, "GPL-3.0": { "licenseType": "GPL-3.0", "severity": "high", "instructions": "" }, "LGPL-2.0": { "licenseType": "LGPL-2.0", "severity": "medium", "instructions": "" }, "LGPL-2.1": { "licenseType": "LGPL-2.1", "severity": "medium", "instructions": "" }, "LGPL-3.0": { "licenseType": "LGPL-3.0", "severity": "medium", "instructions": "" }, "MPL-1.1": { "licenseType": "MPL-1.1", "severity": "medium", "instructions": "" }, "MPL-2.0": { "licenseType": "MPL-2.0", "severity": "medium", "instructions": "" }, "MS-RL": { "licenseType": "MS-RL", "severity": "medium", "instructions": "" }, "SimPL-2.0": { "licenseType": "SimPL-2.0", "severity": "high", "instructions": "" } } }, "packageManager": "gomodules", "ignoreSettings": { "adminOnly": false, "reasonRequired": false, "disregardFilesystemIgnores": false, "autoApproveIgnores": false, "approvalWorkflowEnabled": false }, "docker": {}, "summary": "No high or critical severity vulnerabilities", "severityThreshold": "high", "filesystemPolicy": false, "uniqueCount": 0, "targetFile": "/usr/bin/mongoimport", "projectName": "go-distribution@command-line-arguments", "displayTargetFile": "/usr/bin/mongoimport", "hasUnknownVersions": false, "path": "docker.io/mongo:8.0" }, { "vulnerabilities": [], "ok": true, "dependencyCount": 170, "org": "sean.graham", "policy": "# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.\nversion: v1.25.1\nignore: {}\npatch: {}\n", "isPrivate": true, "licensesPolicy": { "severities": {}, "orgLicenseRules": { "AGPL-1.0": { "licenseType": "AGPL-1.0", "severity": "high", "instructions": "" }, "AGPL-3.0": { "licenseType": "AGPL-3.0", "severity": "high", "instructions": "" }, "Artistic-1.0": { "licenseType": "Artistic-1.0", "severity": "medium", "instructions": "" }, "Artistic-2.0": { "licenseType": "Artistic-2.0", "severity": "medium", "instructions": "" }, "CDDL-1.0": { "licenseType": "CDDL-1.0", "severity": "medium", "instructions": "" }, "CPOL-1.02": { "licenseType": "CPOL-1.02", "severity": "high", "instructions": "" }, "EPL-1.0": { "licenseType": "EPL-1.0", "severity": "medium", "instructions": "" }, "GPL-2.0": { "licenseType": "GPL-2.0", "severity": "high", "instructions": "" }, "GPL-3.0": { "licenseType": "GPL-3.0", "severity": "high", "instructions": "" }, "LGPL-2.0": { "licenseType": "LGPL-2.0", "severity": "medium", "instructions": "" }, "LGPL-2.1": { "licenseType": "LGPL-2.1", "severity": "medium", "instructions": "" }, "LGPL-3.0": { "licenseType": "LGPL-3.0", "severity": "medium", "instructions": "" }, "MPL-1.1": { "licenseType": "MPL-1.1", "severity": "medium", "instructions": "" }, "MPL-2.0": { "licenseType": "MPL-2.0", "severity": "medium", "instructions": "" }, "MS-RL": { "licenseType": "MS-RL", "severity": "medium", "instructions": "" }, "SimPL-2.0": { "licenseType": "SimPL-2.0", "severity": "high", "instructions": "" } } }, "packageManager": "gomodules", "ignoreSettings": { "adminOnly": false, "reasonRequired": false, "disregardFilesystemIgnores": false, "autoApproveIgnores": false, "approvalWorkflowEnabled": false }, "docker": {}, "summary": "No high or critical severity vulnerabilities", "severityThreshold": "high", "filesystemPolicy": false, "uniqueCount": 0, "targetFile": "/usr/bin/mongorestore", "projectName": "go-distribution@command-line-arguments", "displayTargetFile": "/usr/bin/mongorestore", "hasUnknownVersions": false, "path": "docker.io/mongo:8.0" }, { "vulnerabilities": [], "ok": true, "dependencyCount": 169, "org": "sean.graham", "policy": "# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.\nversion: v1.25.1\nignore: {}\npatch: {}\n", "isPrivate": true, "licensesPolicy": { "severities": {}, "orgLicenseRules": { "AGPL-1.0": { "licenseType": "AGPL-1.0", "severity": "high", "instructions": "" }, "AGPL-3.0": { "licenseType": "AGPL-3.0", "severity": "high", "instructions": "" }, "Artistic-1.0": { "licenseType": "Artistic-1.0", "severity": "medium", "instructions": "" }, "Artistic-2.0": { "licenseType": "Artistic-2.0", "severity": "medium", "instructions": "" }, "CDDL-1.0": { "licenseType": "CDDL-1.0", "severity": "medium", "instructions": "" }, "CPOL-1.02": { "licenseType": "CPOL-1.02", "severity": "high", "instructions": "" }, "EPL-1.0": { "licenseType": "EPL-1.0", "severity": "medium", "instructions": "" }, "GPL-2.0": { "licenseType": "GPL-2.0", "severity": "high", "instructions": "" }, "GPL-3.0": { "licenseType": "GPL-3.0", "severity": "high", "instructions": "" }, "LGPL-2.0": { "licenseType": "LGPL-2.0", "severity": "medium", "instructions": "" }, "LGPL-2.1": { "licenseType": "LGPL-2.1", "severity": "medium", "instructions": "" }, "LGPL-3.0": { "licenseType": "LGPL-3.0", "severity": "medium", "instructions": "" }, "MPL-1.1": { "licenseType": "MPL-1.1", "severity": "medium", "instructions": "" }, "MPL-2.0": { "licenseType": "MPL-2.0", "severity": "medium", "instructions": "" }, "MS-RL": { "licenseType": "MS-RL", "severity": "medium", "instructions": "" }, "SimPL-2.0": { "licenseType": "SimPL-2.0", "severity": "high", "instructions": "" } } }, "packageManager": "gomodules", "ignoreSettings": { "adminOnly": false, "reasonRequired": false, "disregardFilesystemIgnores": false, "autoApproveIgnores": false, "approvalWorkflowEnabled": false }, "docker": {}, "summary": "No high or critical severity vulnerabilities", "severityThreshold": "high", "filesystemPolicy": false, "uniqueCount": 0, "targetFile": "/usr/bin/mongostat", "projectName": "go-distribution@command-line-arguments", "displayTargetFile": "/usr/bin/mongostat", "hasUnknownVersions": false, "path": "docker.io/mongo:8.0" }, { "vulnerabilities": [], "ok": true, "dependencyCount": 167, "org": "sean.graham", "policy": "# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.\nversion: v1.25.1\nignore: {}\npatch: {}\n", "isPrivate": true, "licensesPolicy": { "severities": {}, "orgLicenseRules": { "AGPL-1.0": { "licenseType": "AGPL-1.0", "severity": "high", "instructions": "" }, "AGPL-3.0": { "licenseType": "AGPL-3.0", "severity": "high", "instructions": "" }, "Artistic-1.0": { "licenseType": "Artistic-1.0", "severity": "medium", "instructions": "" }, "Artistic-2.0": { "licenseType": "Artistic-2.0", "severity": "medium", "instructions": "" }, "CDDL-1.0": { "licenseType": "CDDL-1.0", "severity": "medium", "instructions": "" }, "CPOL-1.02": { "licenseType": "CPOL-1.02", "severity": "high", "instructions": "" }, "EPL-1.0": { "licenseType": "EPL-1.0", "severity": "medium", "instructions": "" }, "GPL-2.0": { "licenseType": "GPL-2.0", "severity": "high", "instructions": "" }, "GPL-3.0": { "licenseType": "GPL-3.0", "severity": "high", "instructions": "" }, "LGPL-2.0": { "licenseType": "LGPL-2.0", "severity": "medium", "instructions": "" }, "LGPL-2.1": { "licenseType": "LGPL-2.1", "severity": "medium", "instructions": "" }, "LGPL-3.0": { "licenseType": "LGPL-3.0", "severity": "medium", "instructions": "" }, "MPL-1.1": { "licenseType": "MPL-1.1", "severity": "medium", "instructions": "" }, "MPL-2.0": { "licenseType": "MPL-2.0", "severity": "medium", "instructions": "" }, "MS-RL": { "licenseType": "MS-RL", "severity": "medium", "instructions": "" }, "SimPL-2.0": { "licenseType": "SimPL-2.0", "severity": "high", "instructions": "" } } }, "packageManager": "gomodules", "ignoreSettings": { "adminOnly": false, "reasonRequired": false, "disregardFilesystemIgnores": false, "autoApproveIgnores": false, "approvalWorkflowEnabled": false }, "docker": {}, "summary": "No high or critical severity vulnerabilities", "severityThreshold": "high", "filesystemPolicy": false, "uniqueCount": 0, "targetFile": "/usr/bin/mongotop", "projectName": "go-distribution@command-line-arguments", "displayTargetFile": "/usr/bin/mongotop", "hasUnknownVersions": false, "path": "docker.io/mongo:8.0" }, { "vulnerabilities": [ { "id": "SNYK-GOLANG-STDARCHIVEZIP-15139795", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "credit": [ "Jakub Ciolek" ], "semver": { "vulnerable": [ "<1.24.12", ">=1.25.0 <1.25.6" ], "hashesRange": [ "=go1.25.0
**Go Vulnerability Report:**
\n\narchive/zip uses a super-linear file name indexing algorithm that is invoked the first time a file in an archive is opened. This can lead to a denial of service when consuming a maliciously constructed ZIP archive.\n## Remediation\nUpgrade `std/archive/zip` to version 1.24.12, 1.25.6 or higher.\n## References\n- [Go Advisory](https://pkg.go.dev/vuln/GO-2026-4342)\n- [Go Commit](https://go.dev/cl/736713)\n- [Go Issue](https://go.dev/issue/77102)\n- [Google Groups Forum](https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc)\n", "epssDetails": { "percentile": "0.52972", "probability": "0.00749", "modelVersion": "v2026.06.15" }, "identifiers": { "GO": [ "GO-2026-4342" ], "CVE": [ "CVE-2025-61728" ], "CWE": [ "CWE-770" ] }, "packageName": "std/archive/zip", "proprietary": false, "creationTime": "2026-01-29T12:42:56.765155Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-01-28T19:08:28Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "golang", "publicationTime": "2026-01-29T12:42:56.993027Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-26T02:00:28.886698Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "github.com/tianon/gosu@*", "stdlib@1.24.6" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "stdlib", "version": "1.24.6" }, { "id": "SNYK-GOLANG-STDCMDGO-16535172", "title": "Resources Downloaded over Insecure Protocol", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H", "credit": [ "Mundur" ], "semver": { "vulnerable": [ "<1.25.10", ">=1.26.0-0 <1.26.3" ], "hashesRange": [ "=go1.26.0-0
**Go Vulnerability Report:**
\n\nA malicious module proxy can exploit a flaw in the go command's validation of module checksums to bypass checksum database validation. This vulnerability affects any user using an untrusted module proxy (GOMODPROXY) or checksum database (GOSUMDB). A malicious module proxy can serve altered versions of the Go toolchain. When selecting a different version of the Go toolchain than the currently installed toolchain (due to the GOTOOLCHAIN environment variable, or a go.work or go.mod with a toolchain line), the go command will download and execute a toolchain provided by the module proxy. A malicious module proxy can bypass checksum database validation for this downloaded toolchain. Since this vulnerability affects the security of toolchain downloads, setting GOTOOLCHAIN to a fixed version is not sufficient. You must upgrade your base Go toolchain. The go tool always validates the hash of a toolchain before executing it, so fixed versions will refuse to execute any cached, altered versions of the toolchain. The go tool trusts go.sum files to contain accurate hashes of the current module's dependencies. A malicious proxy exploiting this vulnerability to serve an altered module will have caused an incorrect hash to be recorded in the go.sum. Users who have configured a non-trusted GOPROXY can determine if they have been affected by running \"rm go.sum ; go mod tidy ; go mod verify\", which will revalidate all dependencies of the current module. The specific flaw in more detail: The go command consults the checksum database to validate downloaded modules, when a module is not listed in the go.sum file. It verifies that the module hash reported by the checksum database matches the hash of the downloaded module. If, however, the checksum database returns a successful response that contains no entry for the module, the go command incorrectly permitted validation to succeed. A module proxy may mirror or proxy the checksum database, in which case the go command will not connect to the checksum database directly. Checksums reported by the checksum database are cryptographically signed, so a malicious proxy cannot alter the reported checksum for a module. However, a proxy which returns an empty checksum response, or a checksum response for an unrelated module, could cause the go command to proceed as if a downloaded module has been validated.\n## Remediation\nUpgrade `std/cmd/go` to version 1.25.10, 1.26.3 or higher.\n## References\n- [Go Advisory](https://pkg.go.dev/vuln/GO-2026-4984)\n- [Go Commit](https://go.dev/cl/775321)\n- [Go Issue](https://go.dev/issue/79070)\n- [Google Groups Forum](https://groups.google.com/g/golang-announce/c/qcCIEXso47M)\n", "epssDetails": { "percentile": "0.18640", "probability": "0.00285", "modelVersion": "v2026.06.15" }, "identifiers": { "GO": [ "GO-2026-4984" ], "CVE": [ "CVE-2026-42501" ], "CWE": [ "CWE-494" ] }, "packageName": "std/cmd/go", "proprietary": false, "creationTime": "2026-05-08T08:12:58.815590Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-07T19:21:40Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "golang", "publicationTime": "2026-05-08T08:12:59.048045Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-24T14:15:11.668672Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "github.com/tianon/gosu@*", "stdlib@1.24.6" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "stdlib", "version": "1.24.6" }, { "id": "SNYK-GOLANG-STDCMDGO-16535174", "title": "Directory Traversal", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N", "credit": [ "Harshit Gupta" ], "semver": { "vulnerable": [ "<1.25.10", ">=1.26.0-0 <1.26.3" ], "hashesRange": [ "=go1.26.0-0
**Go Vulnerability Report:**
\n\nThe \"go tool pack\" subcommand (usually used only by the compiler as an internal tool with known-good inputs) does not sanitize output filenames. Extracting a malicious archive file with the \"pack\" subcommand can write files to arbitrary locations on the filesystem.\n\n## Details\n\nA Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with \"dot-dot-slash (../)\" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.\n\nDirectory Traversal vulnerabilities can be generally divided into two types:\n\n- **Information Disclosure**: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.\n\n`st` is a module for serving static files on web pages, and contains a [vulnerability of this type](https://snyk.io/vuln/npm:st:20140206). In our example, we will serve files from the `public` route.\n\nIf an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.\n\n```\ncurl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa\n```\n**Note** `%2e` is the URL encoded version of `.` (dot).\n\n- **Writing arbitrary files**: Allows the attacker to create or replace existing files. This type of vulnerability is also known as `Zip-Slip`. \n\nOne way to achieve this is by using a malicious `zip` archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.\n\nThe following is an example of a `zip` archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in `/root/.ssh/` overwriting the `authorized_keys` file:\n\n```\n2018-04-15 22:04:29 ..... 19 19 good.txt\n2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys\n```\n\n## Remediation\nUpgrade `std/cmd/go` to version 1.25.10, 1.26.3 or higher.\n## References\n- [Go Advisory](https://pkg.go.dev/vuln/GO-2026-4979)\n- [Go Commit](https://go.dev/cl/767520)\n- [Go Issue](https://go.dev/issue/78778)\n- [Google Groups Forum](https://groups.google.com/g/golang-announce/c/qcCIEXso47M)\n", "epssDetails": { "percentile": "0.04652", "probability": "0.00162", "modelVersion": "v2026.06.15" }, "identifiers": { "GO": [ "GO-2026-4979" ], "CVE": [ "CVE-2026-39817" ], "CWE": [ "CWE-22" ] }, "packageName": "std/cmd/go", "proprietary": false, "creationTime": "2026-05-08T08:16:15.517586Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-07T19:21:40Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "golang", "publicationTime": "2026-05-08T08:16:15.756357Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-24T14:05:24.048199Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "github.com/tianon/gosu@*", "stdlib@1.24.6" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "stdlib", "version": "1.24.6" }, { "id": "SNYK-GOLANG-STDCRYPTOTLS-15928849", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Jakub Ciolek" ], "semver": { "vulnerable": [ "<1.25.9", ">=1.26.0-0 <1.26.2" ], "hashesRange": [ "=go1.26.0-0
**Go Vulnerability Report:**
\n\nIf one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled consumption of resources. This can lead to a denial of service. This only affects TLS 1.3.\n## Remediation\nUpgrade `std/crypto/tls` to version 1.25.9, 1.26.2 or higher.\n## References\n- [Go Advisory](https://pkg.go.dev/vuln/GO-2026-4870)\n- [Go Commit](https://go.dev/cl/763767)\n- [Go Issue](https://go.dev/issue/78334)\n- [Google Groups Forum](https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU)\n", "epssDetails": { "percentile": "0.47726", "probability": "0.00621", "modelVersion": "v2026.06.15" }, "identifiers": { "GO": [ "GO-2026-4870" ], "CVE": [ "CVE-2026-32283" ], "CWE": [ "CWE-770" ] }, "packageName": "std/crypto/tls", "proprietary": false, "creationTime": "2026-04-08T09:53:35.179170Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-04-07T22:53:49Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "golang", "publicationTime": "2026-04-08T09:53:35.396399Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-30T02:00:29.783488Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "github.com/tianon/gosu@*", "stdlib@1.24.6" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "stdlib", "version": "1.24.6" }, { "id": "SNYK-GOLANG-STDCRYPTOTLS-18858453", "title": "Denial of Service (DoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Qi Deng of Aurascape.ai" ], "semver": { "vulnerable": [ "<1.25.13", ">=1.26.0-0 <1.26.6", ">=1.27.0-0 <1.27.0-rc.3" ], "hashesRange": [ "=go1.26.0-0 =go1.27.0-0
**Go Vulnerability Report:**
Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not. As a result, a malicious client can keep sending KeyUpdate messages to force the server to keep performing key derivation operations indefinitely.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.\n\nUnlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.\n\nOne popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.\n\nWhen it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.\n\nTwo common types of DoS vulnerabilities:\n\n* High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, [commons-fileupload:commons-fileupload](https://security.snyk.io/vuln/SNYK-JAVA-COMMONSFILEUPLOAD-30082).\n\n* Crash - An attacker sending crafted requests that could cause the system to crash. For Example, [npm `ws` package](https://snyk.io/vuln/npm:ws:20171108)\n\n## Remediation\nUpgrade `std/crypto/tls` to version 1.25.13, 1.26.6, 1.27.0-rc.3 or higher.\n## References\n- [Go Advisory](https://pkg.go.dev/vuln/GO-2026-6090)\n- [Go Code Review](https://go.dev/cl/804261)\n- [Go Issue](https://go.dev/issue/80528)\n- [Google Groups Forum](https://groups.google.com/g/golang-announce/c/94pEornpRlI)\n", "epssDetails": { "percentile": "0.44650", "probability": "0.00568", "modelVersion": "v2026.06.15" }, "identifiers": { "GO": [ "GO-2026-6090" ], "CVE": [ "CVE-2026-56862" ], "CWE": [ "CWE-400" ] }, "packageName": "std/crypto/tls", "proprietary": false, "creationTime": "2026-08-16T13:30:25.367479Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-13T21:43:54Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "golang", "publicationTime": "2026-08-16T13:30:25.586356Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-10T02:00:45.946419Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "github.com/tianon/gosu@*", "stdlib@1.24.6" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "stdlib", "version": "1.24.6" }, { "id": "SNYK-GOLANG-STDCRYPTOX509-14545542", "title": "Uncaught Exception", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Jakub Ciolek" ], "semver": { "vulnerable": [ "<1.24.8", ">=1.25.0 <1.25.2" ], "hashesRange": [ "=go1.25.0
**Go Vulnerability Report:**
\r\nValidating certificate chains which contain DSA public keys can cause programs to panic, due to a interface cast that assumes they implement the Equal method.This affects programs which validate arbitrary certificate chains.\n## Remediation\nUpgrade `std/crypto/x509` to version 1.24.8, 1.25.2 or higher.\n## References\n- [Go Advisory](https://pkg.go.dev/vuln/GO-2025-4013)\n- [Go Commit](https://go.dev/cl/709853)\n- [Go Issue](https://go.dev/issue/75675)\n- [Google Groups Forum](https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI)\n", "epssDetails": { "percentile": "0.29562", "probability": "0.00381", "modelVersion": "v2026.06.15" }, "identifiers": { "GO": [ "GO-2025-4013" ], "CVE": [ "CVE-2025-58188" ], "CWE": [ "CWE-248" ] }, "packageName": "std/crypto/x509", "proprietary": false, "creationTime": "2025-12-22T14:39:06.297378Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2025-10-29T21:50:08Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "golang", "publicationTime": "2026-01-06T12:33:09.972855Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T02:00:34.583324Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "github.com/tianon/gosu@*", "stdlib@1.24.6" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "stdlib", "version": "1.24.6" }, { "id": "SNYK-GOLANG-STDCRYPTOX509-14545554", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Jakub Ciolek" ], "semver": { "vulnerable": [ "<1.24.9", ">=1.25.0 <1.25.3" ], "hashesRange": [ "=go1.25.0
**Go Vulnerability Report:**
\r\nDue to the design of the name constraint checking algorithm, the processing time of some inputs scale non-linearly with respect to the size of the certificate.This affects programs which validate arbitrary certificate chains.\n## Remediation\nUpgrade `std/crypto/x509` to version 1.24.9, 1.25.3 or higher.\n## References\n- [Go Advisory](https://pkg.go.dev/vuln/GO-2025-4007)\n- [Go Commit](https://go.dev/cl/709854)\n- [Go Issue](https://go.dev/issue/75681)\n- [Google Groups Forum](https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI)\n", "epssDetails": { "percentile": "0.32305", "probability": "0.00406", "modelVersion": "v2026.06.15" }, "identifiers": { "GO": [ "GO-2025-4007" ], "CVE": [ "CVE-2025-58187" ], "CWE": [ "CWE-770" ] }, "packageName": "std/crypto/x509", "proprietary": false, "creationTime": "2025-12-22T14:47:45.885042Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2025-10-29T21:49:50Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "golang", "publicationTime": "2026-01-06T12:33:26.631605Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T02:00:34.584308Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "github.com/tianon/gosu@*", "stdlib@1.24.6" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "stdlib", "version": "1.24.6" }, { "id": "SNYK-GOLANG-STDCRYPTOX509-15928851", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Jakub Ciolek" ], "semver": { "vulnerable": [ "<1.25.9", ">=1.26.0-0 <1.26.2" ], "hashesRange": [ "=go1.26.0-0
**Go Vulnerability Report:**
\r\n\r\nValidating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service. This only affects validation of otherwise trusted certificate chains, issued by a root CA in the VerifyOptions.Roots CertPool, or in the system certificate pool.\n## Remediation\nUpgrade `std/crypto/x509` to version 1.25.9, 1.26.2 or higher.\n## References\n- [Go Advisory](https://pkg.go.dev/vuln/GO-2026-4946)\n- [Go Commit](https://go.dev/cl/758061)\n- [Go Issue](https://go.dev/issue/78281)\n- [Google Groups Forum](https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU)\n", "epssDetails": { "percentile": "0.26751", "probability": "0.00355", "modelVersion": "v2026.06.15" }, "identifiers": { "GO": [ "GO-2026-4946" ], "CVE": [ "CVE-2026-32281" ], "CWE": [ "CWE-770" ] }, "packageName": "std/crypto/x509", "proprietary": false, "creationTime": "2026-04-08T10:01:35.660992Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-04-07T22:53:49Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "golang", "publicationTime": "2026-04-08T10:01:35.927084Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-30T02:00:29.855350Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "github.com/tianon/gosu@*", "stdlib@1.24.6" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "stdlib", "version": "1.24.6" }, { "id": "SNYK-GOLANG-STDCRYPTOX509-17135840", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Jakub Ciolek" ], "semver": { "vulnerable": [ "<1.25.11", ">=1.26.0-0 <1.26.4" ], "hashesRange": [ "=go1.26.0-0
**Go Vulnerability Report:**
\n\n(*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries. This caused strings.Split(host, \".\") to execute repeatedly on the same input hostname. With a large DNS SAN list, verification costs scaled quadratically based on the number of SAN entries multiplied by the hostname's label count. Because x509.Verify validates hostnames before building the certificate chain, this overhead occurred even for untrusted certificates.\n## Remediation\nUpgrade `std/crypto/x509` to version 1.25.11, 1.26.4 or higher.\n## References\n- [Go Advisory](https://pkg.go.dev/vuln/GO-2026-5037)\n- [Go Commit](https://go.dev/cl/783621)\n- [Go Issue](https://go.dev/issue/79694)\n- [Google Groups Forum](https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw)\n", "epssDetails": { "percentile": "0.46081", "probability": "0.00591", "modelVersion": "v2026.06.15" }, "identifiers": { "GO": [ "GO-2026-5037" ], "CVE": [ "CVE-2026-27145" ], "CWE": [ "CWE-770" ] }, "packageName": "std/crypto/x509", "proprietary": false, "creationTime": "2026-06-03T10:36:09.094050Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-02T21:39:47Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "golang", "publicationTime": "2026-06-03T10:36:09.279699Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-27T02:00:38.121971Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "github.com/tianon/gosu@*", "stdlib@1.24.6" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "stdlib", "version": "1.24.6" }, { "id": "SNYK-GOLANG-STDENCODINGASN1-18858463", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Marwan Atia" ], "semver": { "vulnerable": [ "<1.25.13", ">=1.26.0-0 <1.26.6", ">=1.27.0-0 <1.27.0-rc.3" ], "hashesRange": [ "=go1.26.0-0 =go1.27.0-0
**Go Vulnerability Report:**
Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures.\n## Remediation\nUpgrade `std/encoding/asn1` to version 1.25.13, 1.26.6, 1.27.0-rc.3 or higher.\n## References\n- [Go Advisory](https://pkg.go.dev/vuln/GO-2026-5972)\n- [Go Code Review](https://go.dev/cl/814980)\n- [Go Issue](https://go.dev/issue/80405)\n- [Google Groups Forum](https://groups.google.com/g/golang-announce/c/94pEornpRlI)\n", "epssDetails": { "percentile": "0.44468", "probability": "0.00568", "modelVersion": "v2026.06.15" }, "identifiers": { "GO": [ "GO-2026-5972" ], "CVE": [ "CVE-2026-33818" ], "CWE": [ "CWE-674" ] }, "packageName": "std/encoding/asn1", "proprietary": false, "creationTime": "2026-08-16T13:31:49.649800Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-13T21:43:54Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "golang", "publicationTime": "2026-08-16T13:31:49.810065Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-10T02:00:45.337609Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "github.com/tianon/gosu@*", "stdlib@1.24.6" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "stdlib", "version": "1.24.6" }, { "id": "SNYK-GOLANG-STDENCODINGPEM-14545563", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Jakub Ciolek" ], "semver": { "vulnerable": [ "<1.24.8", ">=1.25.0 <1.25.2" ], "hashesRange": [ "=go1.25.0
**Go Vulnerability Report:**
\r\nThe processing time for parsing some invalid inputs scales non-linearly with respect to the size of the input.This affects programs which parse untrusted PEM inputs.\n## Remediation\nUpgrade `std/encoding/pem` to version 1.24.8, 1.25.2 or higher.\n## References\n- [Go Advisory](https://pkg.go.dev/vuln/GO-2025-4009)\n- [Go Commit](https://go.dev/cl/709858)\n- [Go Issue](https://go.dev/issue/75676)\n- [Google Groups Forum](https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI)\n", "epssDetails": { "percentile": "0.49665", "probability": "0.00661", "modelVersion": "v2026.06.15" }, "identifiers": { "GO": [ "GO-2025-4009" ], "CVE": [ "CVE-2025-61723" ], "CWE": [ "CWE-770" ] }, "packageName": "std/encoding/pem", "proprietary": false, "creationTime": "2025-12-22T14:48:45.904796Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2025-10-29T21:49:55Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "golang", "publicationTime": "2026-01-06T12:33:35.197142Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T02:00:34.027261Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "github.com/tianon/gosu@*", "stdlib@1.24.6" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "stdlib", "version": "1.24.6" }, { "id": "SNYK-GOLANG-STDENCODINGXML-18858455", "title": "Uncontrolled Recursion", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.25.13", ">=1.26.0-0 <1.26.6", ">=1.27.0-0 <1.27.0-rc.3" ], "hashesRange": [ "=go1.26.0-0 =go1.27.0-0
**Go Vulnerability Report:**
Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion.\n## Remediation\nUpgrade `std/encoding/xml` to version 1.25.13, 1.26.6, 1.27.0-rc.3 or higher.\n## References\n- [Go Advisory](https://pkg.go.dev/vuln/GO-2026-6088)\n- [Go Code Review](https://go.dev/cl/803320)\n- [Go Issue](https://go.dev/issue/80481)\n- [Google Groups Forum](https://groups.google.com/g/golang-announce/c/94pEornpRlI)\n", "epssDetails": { "percentile": "0.44468", "probability": "0.00568", "modelVersion": "v2026.06.15" }, "identifiers": { "GO": [ "GO-2026-6088" ], "CVE": [ "CVE-2026-56859" ], "CWE": [ "CWE-674" ] }, "packageName": "std/encoding/xml", "proprietary": false, "creationTime": "2026-08-16T13:30:41.577448Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-13T21:43:54Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "golang", "publicationTime": "2026-08-16T13:30:41.759190Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-10T02:00:45.639999Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "github.com/tianon/gosu@*", "stdlib@1.24.6" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "stdlib", "version": "1.24.6" }, { "id": "SNYK-GOLANG-STDINTERNALSYSCALLUNIX-16086164", "title": "Time-of-check Time-of-use (TOCTOU) Race Condition", "CVSSv3": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H", "credit": [ "Uuganbayar Lkhamsuren" ], "semver": { "vulnerable": [ "<1.25.9", ">=1.26.0-0 <1.26.2" ], "hashesRange": [ "=go1.26.0-0
**Go Vulnerability Report:**
On Linux, if the target of Root.Chmod is replaced with a symlink while the chmod operation is in progress, Chmod can operate on the target of the symlink, even when the target lies outside the root. The Linux fchmodat syscall silently ignores the AT_SYMLINK_NOFOLLOW flag, which Root.Chmod uses to avoid symlink traversal. Root.Chmod checks its target before acting and returns an error if the target is a symlink lying outside the root, so the impact is limited to cases where the target is replaced with a symlink between the check and operation.\n## Remediation\nUpgrade `std/internal/syscall/unix` to version 1.25.9, 1.26.2 or higher.\n## References\n- [Go Advisory](https://pkg.go.dev/vuln/GO-2026-4864)\n- [Go Commit](https://go.dev/cl/763761)\n- [Go Issue](https://go.dev/issue/78293)\n- [Google Groups Forum](https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU)\n", "epssDetails": { "percentile": "0.19520", "probability": "0.00292", "modelVersion": "v2026.06.15" }, "identifiers": { "GO": [ "GO-2026-4864" ], "CVE": [ "CVE-2026-32282" ], "CWE": [ "CWE-367" ] }, "packageName": "std/internal/syscall/unix", "proprietary": false, "creationTime": "2026-04-16T19:13:55.553568Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-04-07T22:53:49Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "golang", "publicationTime": "2026-04-16T19:14:32.856527Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-03T02:00:36.408488Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "github.com/tianon/gosu@*", "stdlib@1.24.6" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "stdlib", "version": "1.24.6" }, { "id": "SNYK-GOLANG-STDMIME-17135844", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "p4p3r" ], "semver": { "vulnerable": [ "<1.25.11", ">=1.26.0-0 <1.26.4" ], "hashesRange": [ "=go1.26.0-0
**Go Vulnerability Report:**
\n\nDecoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU.\n## Remediation\nUpgrade `std/mime` to version 1.25.11, 1.26.4 or higher.\n## References\n- [Go Advisory](https://pkg.go.dev/vuln/GO-2026-5038)\n- [Go Commit](https://go.dev/cl/774481)\n- [Go Issue](https://go.dev/issue/79217)\n- [Google Groups Forum](https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw)\n", "epssDetails": { "percentile": "0.42188", "probability": "0.00560", "modelVersion": "v2026.06.15" }, "identifiers": { "GO": [ "GO-2026-5038" ], "CVE": [ "CVE-2026-42504" ], "CWE": [ "CWE-770" ] }, "packageName": "std/mime", "proprietary": false, "creationTime": "2026-06-03T10:42:37.184395Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-06-02T21:39:47Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "golang", "publicationTime": "2026-06-03T10:42:37.356366Z", "severityBasedOn": "CVSS", "modificationTime": "2026-08-11T15:26:21.503952Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "github.com/tianon/gosu@*", "stdlib@1.24.6" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "stdlib", "version": "1.24.6" }, { "id": "SNYK-GOLANG-STDNET-16535159", "title": "Double Free", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "hamayanhamayan" ], "semver": { "vulnerable": [ "<1.25.10", ">=1.26.0-0 <1.26.3" ], "hashesRange": [ "=go1.26.0-0
**Go Vulnerability Report:**
\r\n\r\nWhen using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash.\n## Remediation\nUpgrade `std/net` to version 1.25.10, 1.26.3 or higher.\n## References\n- [Go Advisory](https://pkg.go.dev/vuln/GO-2026-4981)\n- [Go Commit](https://go.dev/cl/767860)\n- [Go Issue](https://go.dev/issue/78803)\n- [Google Groups Forum](https://groups.google.com/g/golang-announce/c/qcCIEXso47M)\n", "epssDetails": { "percentile": "0.55328", "probability": "0.00813", "modelVersion": "v2026.06.15" }, "identifiers": { "GO": [ "GO-2026-4981" ], "CVE": [ "CVE-2026-33811" ], "CWE": [ "CWE-415" ] }, "packageName": "std/net", "proprietary": false, "creationTime": "2026-05-08T07:47:55.531293Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-07T19:21:40Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "golang", "publicationTime": "2026-05-08T07:47:55.737831Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-30T02:00:29.793319Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "github.com/tianon/gosu@*", "stdlib@1.24.6" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "stdlib", "version": "1.24.6" }, { "id": "SNYK-GOLANG-STDNET-16535161", "title": "Uncaught Exception", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.25.10", ">=1.26.0-0 <1.26.3" ], "hashesRange": [ "=go1.26.0-0
**Go Vulnerability Report:**
\n\nThe Dial and LookupPort functions panic on Windows when provided with an input containing a NUL (0).\n## Remediation\nUpgrade `std/net` to version 1.25.10, 1.26.3 or higher.\n## References\n- [Go Advisory](https://pkg.go.dev/vuln/GO-2026-4971)\n- [Go Commit](https://go.dev/cl/775320)\n- [Go Issue](https://go.dev/issue/79006)\n- [Google Groups Forum](https://groups.google.com/g/golang-announce/c/qcCIEXso47M)\n", "epssDetails": { "percentile": "0.47398", "probability": "0.00620", "modelVersion": "v2026.06.15" }, "identifiers": { "GO": [ "GO-2026-4971" ], "CVE": [ "CVE-2026-39836" ], "CWE": [ "CWE-248" ] }, "packageName": "std/net", "proprietary": false, "creationTime": "2026-05-08T07:50:03.529718Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-07T19:21:40Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "golang", "publicationTime": "2026-05-08T07:50:03.729144Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:00:42.458847Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "github.com/tianon/gosu@*", "stdlib@1.24.6" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "stdlib", "version": "1.24.6" }, { "id": "SNYK-GOLANG-STDNETHTTP-16535158", "title": "Infinite loop", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Marwan Atia" ], "semver": { "vulnerable": [ "<1.25.10", ">=1.26.0-0 <1.26.3" ], "hashesRange": [ "=go1.26.0-0
**Go Vulnerability Report:**
\n\nWhen processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a `SETTINGS_MAX_FRAME_SIZE` with a value of 0.\n## Remediation\nUpgrade `std/net/http` to version 1.25.10, 1.26.3 or higher.\n## References\n- [Go Advisory](https://pkg.go.dev/vuln/GO-2026-4918)\n- [Go Commit](https://go.dev/cl/761581)\n- [Go Commit](https://go.dev/cl/761640)\n- [Go Issue](https://go.dev/issue/78476)\n- [Google Groups Forum](https://groups.google.com/g/golang-announce/c/qcCIEXso47M)\n", "epssDetails": { "percentile": "0.54175", "probability": "0.00781", "modelVersion": "v2026.06.15" }, "identifiers": { "GO": [ "GO-2026-4918" ], "CVE": [ "CVE-2026-33814" ], "CWE": [ "CWE-835" ] }, "packageName": "std/net/http", "proprietary": false, "creationTime": "2026-05-08T07:35:59.608372Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-07T19:21:40Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "golang", "publicationTime": "2026-05-08T07:35:59.838416Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-27T02:00:38.361656Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "github.com/tianon/gosu@*", "stdlib@1.24.6" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "stdlib", "version": "1.24.6" }, { "id": "SNYK-GOLANG-STDNETHTTP-18858429", "title": "Denial of Service (DoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.25.13", ">=1.26.0-0 <1.26.6", ">=1.27.0-0 <1.27.0-rc.3" ], "hashesRange": [ "=go1.26.0-0 =go1.27.0-0
**Go Vulnerability Report:**
When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when doing this.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.\n\nUnlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.\n\nOne popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.\n\nWhen it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.\n\nTwo common types of DoS vulnerabilities:\n\n* High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, [commons-fileupload:commons-fileupload](https://security.snyk.io/vuln/SNYK-JAVA-COMMONSFILEUPLOAD-30082).\n\n* Crash - An attacker sending crafted requests that could cause the system to crash. For Example, [npm `ws` package](https://snyk.io/vuln/npm:ws:20171108)\n\n## Remediation\nUpgrade `std/net/http` to version 1.25.13, 1.26.6, 1.27.0-rc.3 or higher.\n## References\n- [Go Advisory](https://pkg.go.dev/vuln/GO-2026-6089)\n- [Go Code Review](https://go.dev/cl/795540)\n- [Go Issue](https://go.dev/issue/80205)\n- [Google Groups Forum](https://groups.google.com/g/golang-announce/c/94pEornpRlI)\n", "epssDetails": { "percentile": "0.44468", "probability": "0.00568", "modelVersion": "v2026.06.15" }, "identifiers": { "GO": [ "GO-2026-6089" ], "CVE": [ "CVE-2026-56853" ], "CWE": [ "CWE-400" ] }, "packageName": "std/net/http", "proprietary": false, "creationTime": "2026-08-16T13:28:12.349185Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-13T21:43:54Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "golang", "publicationTime": "2026-08-16T13:28:12.649447Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-10T02:00:46.191702Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "github.com/tianon/gosu@*", "stdlib@1.24.6" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "stdlib", "version": "1.24.6" }, { "id": "SNYK-GOLANG-STDNETMAIL-14548482", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Philippe Antoine" ], "semver": { "vulnerable": [ "<1.24.8", ">=1.25.0 <1.25.2" ], "hashesRange": [ "=go1.25.0
**Go Vulnerability Report:**
The `ParseAddress` function constructs domain-literal address components through repeated string concatenation. When parsing large domain-literal components, this can cause excessive CPU consumption.\n## Remediation\nUpgrade `std/net/mail` to version 1.24.8, 1.25.2 or higher.\n## References\n- [Go Advisory](https://pkg.go.dev/vuln/GO-2025-4006)\n- [Go Code Review](https://go.dev/cl/709860)\n- [Go Issue](https://go.dev/issue/75680)\n- [Google Groups Forum](https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI)\n", "epssDetails": { "percentile": "0.49004", "probability": "0.00647", "modelVersion": "v2026.06.15" }, "identifiers": { "GO": [ "GO-2025-4006" ], "CVE": [ "CVE-2025-61725" ], "CWE": [ "CWE-770" ] }, "packageName": "std/net/mail", "proprietary": false, "creationTime": "2025-12-23T07:13:08.194725Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2025-10-29T21:48:35Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "golang", "publicationTime": "2026-01-06T12:50:11.738531Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T02:00:32.061873Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "github.com/tianon/gosu@*", "stdlib@1.24.6" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "stdlib", "version": "1.24.6" }, { "id": "SNYK-GOLANG-STDNETMAIL-16535166", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "thatnealpatel" ], "semver": { "vulnerable": [ "<1.25.10", ">=1.26.0-0 <1.26.3" ], "hashesRange": [ "=go1.26.0-0
**Go Vulnerability Report:**
\r\n\r\nWell-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations.\n## Remediation\nUpgrade `std/net/mail` to version 1.25.10, 1.26.3 or higher.\n## References\n- [Go Advisory](https://pkg.go.dev/vuln/GO-2026-4986)\n- [Go Commit](https://go.dev/cl/759940)\n- [Go Issue](https://go.dev/issue/78566)\n- [Google Groups Forum](https://groups.google.com/g/golang-announce/c/qcCIEXso47M)\n", "epssDetails": { "percentile": "0.54463", "probability": "0.00784", "modelVersion": "v2026.06.15" }, "identifiers": { "GO": [ "GO-2026-4986" ], "CVE": [ "CVE-2026-39820" ], "CWE": [ "CWE-770" ] }, "packageName": "std/net/mail", "proprietary": false, "creationTime": "2026-05-08T08:04:44.554244Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-05-07T19:21:40Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "golang", "publicationTime": "2026-05-08T08:04:44.821365Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-03T02:00:40.967914Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "github.com/tianon/gosu@*", "stdlib@1.24.6" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "stdlib", "version": "1.24.6" }, { "id": "SNYK-GOLANG-STDNETURL-15139468", "title": "Allocation of Resources Without Limits or Throttling", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "jub0bs" ], "semver": { "vulnerable": [ "<1.24.12", ">=1.25.0 <1.25.6" ], "hashesRange": [ "=go1.25.0
**Go Vulnerability Report:**
\n\nThe net/url package does not set a limit on the number of query parameters in a query. While the maximum size of query parameters in URLs is generally limited by the maximum request header size, the net/http.Request.ParseForm method can parse large URL-encoded forms. Parsing a large form containing many unique query parameters can cause excessive memory consumption.\n## Remediation\nUpgrade `std/net/url` to version 1.24.12, 1.25.6 or higher.\n## References\n- [Go Advisory](https://pkg.go.dev/vuln/GO-2026-4341)\n- [Go Commit](https://go.dev/cl/736712)\n- [Go Issue](https://go.dev/issue/77101)\n- [Google Groups Forum](https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc)\n", "epssDetails": { "percentile": "0.82788", "probability": "0.02326", "modelVersion": "v2026.06.15" }, "identifiers": { "GO": [ "GO-2026-4341" ], "CVE": [ "CVE-2025-61726" ], "CWE": [ "CWE-770" ] }, "packageName": "std/net/url", "proprietary": false, "creationTime": "2026-01-29T12:37:21.296942Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-01-28T19:08:18Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "golang", "publicationTime": "2026-01-29T12:37:21.488322Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-26T02:00:30.876016Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "github.com/tianon/gosu@*", "stdlib@1.24.6" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "stdlib", "version": "1.24.6" }, { "id": "SNYK-GOLANG-STDNETURL-18858438", "title": "Denial of Service (DoS)", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "credit": [ "Unknown" ], "semver": { "vulnerable": [ "<1.25.13", ">=1.26.0-0 <1.26.6", ">=1.27.0-0 <1.27.0-rc.3" ], "hashesRange": [ "=go1.26.0-0 =go1.27.0-0
**Go Vulnerability Report:**
Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead.Now, path resolution operates on a byte buffer using index-based backtracking for '..' segments, eliminating the quadratic time complexity and significantly reducing memory allocations.\n\n## Details\n\nDenial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.\n\nUnlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.\n\nOne popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.\n\nWhen it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.\n\nTwo common types of DoS vulnerabilities:\n\n* High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, [commons-fileupload:commons-fileupload](https://security.snyk.io/vuln/SNYK-JAVA-COMMONSFILEUPLOAD-30082).\n\n* Crash - An attacker sending crafted requests that could cause the system to crash. For Example, [npm `ws` package](https://snyk.io/vuln/npm:ws:20171108)\n\n## Remediation\nUpgrade `std/net/url` to version 1.25.13, 1.26.6, 1.27.0-rc.3 or higher.\n## References\n- [Go Advisory](https://pkg.go.dev/vuln/GO-2026-6218)\n- [Go Code Review](https://go.dev/cl/803681)\n- [Go Issue](https://go.dev/issue/80494)\n- [Google Groups Forum](https://groups.google.com/g/golang-announce/c/94pEornpRlI)\n", "epssDetails": { "percentile": "0.43587", "probability": "0.00550", "modelVersion": "v2026.06.15" }, "identifiers": { "GO": [ "GO-2026-6218" ], "CVE": [ "CVE-2026-56860" ], "CWE": [ "CWE-400" ] }, "packageName": "std/net/url", "proprietary": false, "creationTime": "2026-08-16T13:28:43.607348Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-08-13T21:43:54Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "golang", "publicationTime": "2026-08-16T13:28:43.780899Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T02:00:42.599966Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "github.com/tianon/gosu@*", "stdlib@1.24.6" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "stdlib", "version": "1.24.6" }, { "id": "SNYK-GOLANG-STDOS-17905377", "title": "Symlink Attack", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "credit": [ "Mundur" ], "semver": { "vulnerable": [ "<1.25.12", ">=1.26.0-0 <1.26.5", ">=1.27.0-0 <1.27.0-rc.2" ], "hashesRange": [ "=go1.26.0-0 =go1.27.0-0
**Go Vulnerability Report:**
On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /.For example, 'root.Open(\"symlink/\")' will open \"symlink\" even when \"symlink\" is a symbolic link pointing outside of the root.\n## Remediation\nUpgrade `std/os` to version 1.25.12, 1.26.5, 1.27.0-rc.2 or higher.\n## References\n- [Go Advisory](https://pkg.go.dev/vuln/GO-2026-4970)\n- [Go Code Review](https://go.dev/cl/797880)\n- [Go Issue](https://go.dev/issue/79005)\n- [Google Groups Forum](https://groups.google.com/g/golang-announce/c/OrmQE_Yp5Sc)\n", "epssDetails": { "percentile": "0.12762", "probability": "0.00232", "modelVersion": "v2026.06.15" }, "identifiers": { "GO": [ "GO-2026-4970" ], "CVE": [ "CVE-2026-39822" ], "CWE": [ "CWE-59" ] }, "packageName": "std/os", "proprietary": false, "creationTime": "2026-07-09T11:52:28.124727Z", "functions_new": [], "alternativeIds": [], "disclosureTime": "2026-07-07T21:34:47Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "golang", "publicationTime": "2026-07-09T11:52:28.309070Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-30T14:05:23.087760Z", "socialTrendAlert": false, "severityWithCritical": "high", "from": [ "github.com/tianon/gosu@*", "stdlib@1.24.6" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "stdlib", "version": "1.24.6" } ], "ok": false, "dependencyCount": 3, "org": "sean.graham", "policy": "# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.\nversion: v1.25.1\nignore: {}\npatch: {}\n", "isPrivate": true, "licensesPolicy": { "severities": {}, "orgLicenseRules": { "AGPL-1.0": { "licenseType": "AGPL-1.0", "severity": "high", "instructions": "" }, "AGPL-3.0": { "licenseType": "AGPL-3.0", "severity": "high", "instructions": "" }, "Artistic-1.0": { "licenseType": "Artistic-1.0", "severity": "medium", "instructions": "" }, "Artistic-2.0": { "licenseType": "Artistic-2.0", "severity": "medium", "instructions": "" }, "CDDL-1.0": { "licenseType": "CDDL-1.0", "severity": "medium", "instructions": "" }, "CPOL-1.02": { "licenseType": "CPOL-1.02", "severity": "high", "instructions": "" }, "EPL-1.0": { "licenseType": "EPL-1.0", "severity": "medium", "instructions": "" }, "GPL-2.0": { "licenseType": "GPL-2.0", "severity": "high", "instructions": "" }, "GPL-3.0": { "licenseType": "GPL-3.0", "severity": "high", "instructions": "" }, "LGPL-2.0": { "licenseType": "LGPL-2.0", "severity": "medium", "instructions": "" }, "LGPL-2.1": { "licenseType": "LGPL-2.1", "severity": "medium", "instructions": "" }, "LGPL-3.0": { "licenseType": "LGPL-3.0", "severity": "medium", "instructions": "" }, "MPL-1.1": { "licenseType": "MPL-1.1", "severity": "medium", "instructions": "" }, "MPL-2.0": { "licenseType": "MPL-2.0", "severity": "medium", "instructions": "" }, "MS-RL": { "licenseType": "MS-RL", "severity": "medium", "instructions": "" }, "SimPL-2.0": { "licenseType": "SimPL-2.0", "severity": "high", "instructions": "" } } }, "packageManager": "gomodules", "ignoreSettings": { "adminOnly": false, "reasonRequired": false, "disregardFilesystemIgnores": false, "autoApproveIgnores": false, "approvalWorkflowEnabled": false }, "docker": {}, "summary": "23 high or critical severity vulnerable dependency paths", "severityThreshold": "high", "filesystemPolicy": false, "filtered": { "ignore": [], "patch": [] }, "uniqueCount": 23, "targetFile": "/usr/local/bin/gosu", "projectName": "github.com/tianon/gosu", "displayTargetFile": "/usr/local/bin/gosu", "hasUnknownVersions": false, "path": "docker.io/mongo:8.0/tianon/gosu" } ] }