Go Vulnerability Database
Data about new vulnerabilities come directly from Go package maintainers or sources such as MITRE and GitHub. Reports are curated by the Go Security team. Learn more at go.dev/security/vuln.
Search
Recent Reports
GO-2025-3602
- CVE-2025-32387, GHSA-5xqw-8hwv-wg92
- Affects: helm.sh/helm/v3
- Published: Apr 10, 2025
Helm Allows A Specially Crafted JSON Schema To Cause A Stack Overflow in helm.sh/helm
GO-2025-3601
- CVE-2025-32386, GHSA-4hfp-h4cw-hj8p
- Affects: helm.sh/helm/v3
- Published: Apr 10, 2025
Helm Allows A Specially Crafted Chart Archive To Cause Out Of Memory Termination in helm.sh/helm
GO-2025-3599
- CVE-2025-32025, GHSA-fmhh-rw3h-785m
- Affects: github.com/bep/imagemeta
- Published: Apr 09, 2025
bep/imagemeta allows a potentially large memory allocation in PNG and WebP parsing in github.com/bep/imagemeta
GO-2025-3598
- CVE-2025-32024, GHSA-q7rw-w4cq-2j6w
- Affects: github.com/bep/imagemeta
- Published: Apr 09, 2025
bep/imagemeta allows excessively large EXIF data structures in github.com/bep/imagemeta
GO-2025-3595
- CVE-2025-22872
- Affects: golang.org/x/net
- Published: Apr 16, 2025
The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character (/) as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result in content following such tags as being placed in the wrong scope during DOM construction, but only when tags are in foreign content (e.g. <math>, <svg>, etc contexts).
If you don't see an existing, public Go vulnerability in a publicly importable package in our database, please let us know.