# stdlib (Go) vulnerabilities Source: https://junglewise.ai/threats/technologies/go-stdlib Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 13 November 2026, 00:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/go-stdlib.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 178 vulnerabilities in stdlib (Go): 1 in the last 7 days and 10 in the last 90 days, 4 of them critical and 1 exploited in the wild. The most recent, CVE-2026-97054, was published on 11 November 2026. 1 vulnerability in the last four weeks, down 87% on the four before (8). 0 critical against 1. ## Counts - Last 7 days: 1 - Last 30 days: 2 - Last 90 days: 10 - All time: 178 (4 critical, 1 exploited in the wild) ## About stdlib (Go) Go programming language standard library. ## Latest stdlib (Go) vulnerabilities - [CVE-2026-97054: Go HTTP/1 server race condition in MaxBytesReader header handling](https://junglewise.ai/threats/cve-2026-97054-for-http-1-servers-when-maxbytesreader-s-limit-is-exceeded) (info, published 11 Nov 2026) - [CVE-2026-111943: Go crypto/x509 untrusted intermediate certificate validation](https://junglewise.ai/threats/cve-2026-111943-on-most-platforms-go-uses-the-given-system-root-certificates) (high, published 21 Oct 2026) - [CVE-2026-97031: Go crypto/tls malformed ECH extension DoS](https://junglewise.ai/threats/cve-2026-97031-go-2026-6607-reject-malformed-ech-outer-extension-references-in) (high, CVSS 7.5, published 8 Oct 2026) - [CVE-2026-97030: Go html/template XSS via missing ES2015+ keywords](https://junglewise.ai/threats/cve-2026-97030-go-2026-6600-recognize-yield-as-regexp-preceder-keyword-in-html) (medium, CVSS 6.1, published 8 Oct 2026) - [CVE-2026-94448: Go html/template XSS via stale context in consecutive expressions](https://junglewise.ai/threats/cve-2026-94448-go-2026-6599-reset-context-tracking-on-consecutive-template) (medium, CVSS 6.1, published 8 Oct 2026) - [CVE-2026-94440: Go memory limit bypass in MIME header parsing](https://junglewise.ai/threats/cve-2026-94440-go-2026-6608-memory-limit-bypass-when-parsing-mime-headers-in-net) (high, CVSS 7.5, published 8 Oct 2026) - [CVE-2026-94439: Go net/http HTTP/1 server CONNECT response desynchronization](https://junglewise.ai/threats/cve-2026-94439-go-2026-6613-http-1-server-connection-desynchronization-after-2xx) (high, CVSS 7.5, published 8 Oct 2026) - [CVE-2026-78667: Go net/http denial of service in Range header parsing](https://junglewise.ai/threats/cve-2026-78667-go-2026-6609-lack-of-limit-on-size-of-parsed-range-headers-in-net) (high, CVSS 7.5, published 8 Oct 2026) - [CVE-2026-56866: Go net/http HTTP/1 client connection desynchronization after CONNECT rejection](https://junglewise.ai/threats/cve-2026-56866-go-2026-6605-http-1-client-connection-desynchronization-after) (high, CVSS 7.5, published 8 Oct 2026) - [CVE-2026-56857: Go os.Root.Mkdir/MkdirAll junction escape on Windows](https://junglewise.ai/threats/cve-2026-56857-go-2026-6604-root-mkdir-all-can-follow-junctions-out-of-the-root) (critical, CVSS 9.8, published 8 Oct 2026) - [CVE-2026-56860: Go path resolution denial of service via parent directory segments](https://junglewise.ai/threats/cve-2026-56860-go-path-resolution-denial-of-service-via-parent-directory) (medium, CVSS 5.9, published 13 Aug 2026) - [CVE-2026-56859: Go DecodeElement stack exhaustion vulnerability](https://junglewise.ai/threats/cve-2026-56859-go-decodeelement-stack-exhaustion-vulnerability) (high, CVSS 7.5, published 13 Aug 2026) - [CVE-2026-56858: Go path traversal with unescaped forward slash](https://junglewise.ai/threats/cve-2026-56858-go-path-traversal-with-unescaped-forward-slash) (medium, CVSS 6.1, published 13 Aug 2026) - [CVE-2026-56853: Go HTTP/2 timeout bypass in unencrypted connections](https://junglewise.ai/threats/cve-2026-56853-go-http-2-timeout-bypass-in-unencrypted-connections) (high, CVSS 7.5, published 13 Aug 2026) - [CVE-2026-33818: Go Unmarshal stack exhaustion in recursive structure parsing](https://junglewise.ai/threats/cve-2026-33818-go-unmarshal-stack-exhaustion-in-recursive-structure-parsing) (high, CVSS 7.5, published 13 Aug 2026) - [CVE-2026-56862: GO-2026-6090 - Limit handshake messages we are willing to accept post-handshake in crypto/tls](https://junglewise.ai/threats/cve-2026-56862-go-2026-6090-limit-handshake-messages-we-are-willing-to-accept) (info, published 13 Aug 2026) - [CVE-2026-46600: Google Go x/net denial of service in dnsmessage parsing](https://junglewise.ai/threats/cve-2026-46600-google-go-x-net-denial-of-service-in-dnsmessage-parsing) (info, published 21 Jul 2026) - [CVE-2026-42505: Go crypto/tls information disclosure in Encrypted Client Hello](https://junglewise.ai/threats/cve-2026-42505-go-crypto-tls-information-disclosure-in-encrypted-client-hello) (info, CVSS 0, published 8 Jul 2026) - [CVE-2026-39822: Go os package path traversal via symlink with trailing slash in os.Root](https://junglewise.ai/threats/cve-2026-39822-go-os-package-path-traversal-via-symlink-with-trailing-slash-in) (info, published 8 Jul 2026) - [CVE-2026-42507: Google Go log injection in net/textproto package](https://junglewise.ai/threats/cve-2026-42507-google-go-log-injection-in-net-textproto-package) (info, published 2 Jun 2026) - [CVE-2026-42504: Google Go CPU exhaustion in mime WordDecoder.DecodeHeader](https://junglewise.ai/threats/cve-2026-42504-google-go-cpu-exhaustion-in-mime-worddecoder-decodeheader) (info, CVSS 0, published 2 Jun 2026) - [CVE-2026-27145: Google Go CPU denial of service in crypto/x509 VerifyHostname](https://junglewise.ai/threats/cve-2026-27145-google-go-cpu-denial-of-service-in-crypto-x509-verifyhostname) (info, CVSS 0, published 2 Jun 2026) - [CVE-2026-39821: Go x/net idna privilege escalation via Punycode decoding](https://junglewise.ai/threats/cve-2026-39821-go-x-net-idna-privilege-escalation-via-punycode-decoding) (critical, CVSS 9.6, published 22 May 2026) - [CVE-2026-42499: Google Go net/mail denial of service in consumePhrase](https://junglewise.ai/threats/cve-2026-42499-google-go-net-mail-denial-of-service-in-consumephrase) (high, CVSS 7.5, published 7 May 2026) - [CVE-2026-39836: Google Go Denial of Service in net Package on Windows](https://junglewise.ai/threats/cve-2026-39836-google-go-denial-of-service-in-net-package-on-windows) (high, CVSS 7.5, published 7 May 2026) ## Most severe stdlib (Go) vulnerabilities - [CVE-2020-0601: GO-2022-0535 - Certificate validation bypass on Windows in crypto/x509](https://junglewise.ai/threats/cve-2020-0601-microsoft-windows-cryptoapi-spoofing-vulnerability) (critical, exploited in the wild, CVSS 8.1, published 1 Aug 2022) - [CVE-2026-56857: Go os.Root.Mkdir/MkdirAll junction escape on Windows](https://junglewise.ai/threats/cve-2026-56857-go-2026-6604-root-mkdir-all-can-follow-junctions-out-of-the-root) (critical, CVSS 9.8, published 8 Oct 2026) - [CVE-2026-39821: Go x/net idna privilege escalation via Punycode decoding](https://junglewise.ai/threats/cve-2026-39821-go-x-net-idna-privilege-escalation-via-punycode-decoding) (critical, CVSS 9.6, published 22 May 2026) - [CVE-2025-22871: Go net/http request smuggling via bare LF in chunked encoding](https://junglewise.ai/threats/cve-2025-22871-go-net-http-request-smuggling-via-bare-lf-in-chunked-encoding) (critical, CVSS 9.1, published 8 Apr 2025) - [CVE-2026-33810: Google Go crypto/x509 improper DNS constraint validation](https://junglewise.ai/threats/cve-2026-33810-google-go-crypto-x509-improper-dns-constraint-validation) (high, CVSS 8.2, published 8 Apr 2026) - [CVE-2020-16845: Go encoding/binary infinite loop in ReadUvarint and ReadVarint](https://junglewise.ai/threats/cve-2020-16845-go-encoding-binary-infinite-loop-in-readuvarint-and-readvarint) (high, CVSS 7.5, published 16 Dec 2021) - [CVE-2025-61726: Go net/url memory exhaustion in query parameter parsing](https://junglewise.ai/threats/cve-2025-61726-go-net-url-memory-exhaustion-in-query-parameter-parsing) (high, CVSS 7.5, published 28 Jan 2026) - [CVE-2026-33811: Go net package double-free in cgo DNS resolver](https://junglewise.ai/threats/cve-2026-33811-go-net-package-double-free-in-cgo-dns-resolver) (high, CVSS 7.5, published 7 May 2026) - [CVE-2026-39820: Go net/mail denial of service in email and date parsing](https://junglewise.ai/threats/cve-2026-39820-go-net-mail-denial-of-service-in-email-and-date-parsing) (high, CVSS 7.5, published 7 May 2026) - [CVE-2026-42499: Google Go net/mail denial of service in consumePhrase](https://junglewise.ai/threats/cve-2026-42499-google-go-net-mail-denial-of-service-in-consumephrase) (high, CVSS 7.5, published 7 May 2026) ## Vulnerabilities per week 1 vulnerability in the last four weeks, down 87% on the four before (8). 0 critical against 1. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 8 | 1 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 1 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 1 | 0 | 0 | ## Other Go technologies - [github.com/mattermost/mattermost-server (Go)](https://junglewise.ai/threats/technologies/github-com-mattermost-mattermost-server): 297 vulnerabilities - [github.com/mattermost/mattermost-server/v6 (Go)](https://junglewise.ai/threats/technologies/github-com-mattermost-mattermost-server-v6): 222 vulnerabilities - [github.com/mattermost/mattermost/server/v8 (Go)](https://junglewise.ai/threats/technologies/github-com-mattermost-mattermost-server-v8): 207 vulnerabilities - [github.com/mattermost/mattermost-server/v5 (Go)](https://junglewise.ai/threats/technologies/github-com-mattermost-mattermost-server-v5): 199 vulnerabilities - [github.com/siyuan-note/siyuan/kernel (Go)](https://junglewise.ai/threats/technologies/github-com-siyuan-note-siyuan-kernel): 160 vulnerabilities - [code.gitea.io/gitea (Go)](https://junglewise.ai/threats/technologies/code-gitea-io-gitea): 126 vulnerabilities - [code.vikunja.io/api (Go)](https://junglewise.ai/threats/technologies/code-vikunja-io-api): 91 vulnerabilities - [gogs.io/gogs (Go)](https://junglewise.ai/threats/technologies/gogs-io-gogs): 81 vulnerabilities - [github.com/traefik/traefik/v2 (Go)](https://junglewise.ai/threats/technologies/github-com-traefik-traefik-v2): 78 vulnerabilities - [github.com/traefik/traefik (Go)](https://junglewise.ai/threats/technologies/github-com-traefik-traefik): 75 vulnerabilities - [github.com/usememos/memos (Go)](https://junglewise.ai/threats/technologies/github-com-usememos-memos): 75 vulnerabilities - [github.com/traefik/traefik/v3 (Go)](https://junglewise.ai/threats/technologies/github-com-traefik-traefik-v3): 70 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "stdlib (Go) vulnerabilities", https://junglewise.ai/threats/technologies/go-stdlib, 13 November 2026.