Go Vulnerability Database
Data about new vulnerabilities come directly from Go package maintainers or sources such as MITRE and GitHub. Reports are curated by the Go Security team. Learn more at go.dev/security/vuln.
Search
Recent Reports
GO-2026-6355
- CVE-2026-56855
- Affects: golang.org/x/crypto
- Published: Sep 02, 2026
Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connection down instead of buffering and blocking.
GO-2026-6354
- CVE-2026-78662
- Affects: golang.org/x/crypto
- Published: Sep 02, 2026
Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection. Now, we add an atomic established state, set when a channel becomes usable. Until such a time, handlePacket drops every packet other than the open confirmation/failure, without blocking and without tearing down the connection.
GO-2026-6342
- CVE-2026-26247, GHSA-m5ch-ppfx-xv3v
- Affects: code.gitea.io/gitea
- Published: Sep 02, 2026
Gitea OAuth2 PKCE S256 verifier bypass in code.gitea.io/gitea
GO-2026-6341
- CVE-2026-26307, GHSA-h9c5-x7g8-4q7f
- Affects: code.gitea.io/gitea
- Published: Sep 02, 2026
Gitea git grep searches allow server resource exhaustion in code.gitea.io/gitea
GO-2026-6340
- CVE-2026-25718, GHSA-h697-89cp-24q8
- Affects: code.gitea.io/gitea
- Published: Sep 02, 2026
Gitea template repository generation follows unsafe filesystem paths in code.gitea.io/gitea
If you don't see an existing, public Go vulnerability in a publicly importable package in our database, please let us know.