Go Vulnerability Database
Data about new vulnerabilities come directly from Go package maintainers or sources such as MITRE and GitHub. Reports are curated by the Go Security team. Learn more at go.dev/security/vuln.
Search
Recent Reports
GO-2026-5033
- CVE-2026-46598
- Affects: golang.org/x/crypto
- Published: May 22, 2026
For certain crafted inputs, a 'ed25519.PrivateKey' was created by casting malformed wire bytes, leading to a panic when used.
GO-2026-5030
- CVE-2026-27136
- Affects: golang.org/x/net
- Published: May 22, 2026
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.
GO-2026-5029
- CVE-2026-25681
- Affects: golang.org/x/net
- Published: May 22, 2026
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.
GO-2026-5028
- CVE-2026-25680
- Affects: golang.org/x/net
- Published: May 22, 2026
Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service.
GO-2026-5027
- CVE-2026-42502
- Affects: golang.org/x/net
- Published: May 22, 2026
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.
If you don't see an existing, public Go vulnerability in a publicly importable package in our database, please let us know.