Go Vulnerability Database
Data about new vulnerabilities come directly from Go package maintainers or sources such as MITRE and GitHub. Reports are curated by the Go Security team. Learn more at go.dev/security/vuln.
Search
Recent Reports
- CVE-2025-58190
- Affects: golang.org/x/net
- Published: Feb 05, 2026
The html.Parse function in golang.org/x/net/html has an infinite parsing loop when processing certain inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content.
- CVE-2025-47911
- Affects: golang.org/x/net
- Published: Feb 05, 2026
The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when processing certain inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content.
GO-2026-4433
standard library- CVE-2025-61732
- Affects: cmd/cgo
- Published: Feb 05, 2026
A discrepancy between how Go and C/C++ comments were parsed allowed for code smuggling into the resulting cgo binary.
- CVE-2023-43634, GHSA-wc42-fcjp-v8vq
- Affects: github.com/lf-edge/eve
- Published: Feb 05, 2026
- Unreviewed
EVE Doesn't Protect Config Partition with Measured Boot in github.com/lf-edge/eve
- CVE-2023-43630, GHSA-phcg-h58r-gmcq
- Affects: github.com/lf-edge/eve
- Published: Feb 05, 2026
- Unreviewed
EVE Doesn't Measure Config Partition From 2 Fronts in github.com/lf-edge/eve
If you don't see an existing, public Go vulnerability in a publicly importable package in our database, please let us know.