pkg:Debian/golang-1.25

41 total CVEsCRITICAL2HIGH19MEDIUM19LOW1

✅ Check your installed version

All known vulnerabilities

  • CRITICAL10.0CVE-2025-68121Unexpected session resumption in crypto/tls
    from 0, < 1.25.6-1
  • CRITICAL9.8CVE-2026-27143Missing bound checks can lead to memory corruption in safe Go in cmd/compile
    from 0, < 1.25.9-1
  • HIGH8.8CVE-2026-27140Code execution vulnerability in SWIG code generation in cmd/go
    from 0, < 1.25.9-1
  • HIGH8.6CVE-2025-61732Potential code smuggling via doc comments in cmd/cgo
    from 0, < 1.25.7-1
  • HIGH7.8CVE-2025-61731Arbitrary file write using cgo pkg-config directive in cmd/go
    from 0, < 1.25.6-1
  • HIGH7.5CVE-2026-39820Quadratic string concatentation in consumeComment in net/mail
    from 0, < 1.25.10-1
  • HIGH7.5CVE-2026-33811Crash when handling long CNAME response in net
    from 0, < 1.25.10-1
  • HIGH7.5CVE-2026-42499Quadratic string concatenation in consumePhrase in net/mail
    from 0, < 1.25.10-1
  • HIGH7.5CVE-2026-42501Malicious module proxy can bypass checksum database in cmd/go
    from 0, < 1.25.10-1
  • HIGH7.5CVE-2026-32280Unexpected work during chain building in crypto/x509
    from 0, < 1.25.9-1
  • HIGH7.5CVE-2026-32283Unauthenticated TLS 1.3 KeyUpdate record can cause persistent connection retention and DoS in crypto/tls
    from 0, < 1.25.9-1
  • HIGH7.5CVE-2026-32281Inefficient policy validation in crypto/x509
    from 0, < 1.25.9-1
  • HIGH7.5CVE-2026-25679Incorrect parsing of IPv6 host literals in net/url
    from 0, < 1.25.8-1
  • HIGH7.5CVE-2025-61726Memory exhaustion in query parameter parsing in net/url
    from 0, < 1.25.6-1
  • HIGH7.5CVE-2025-61729Excessive resource consumption when printing error string for host certificate validation in crypto/x509
    from 0, < 1.25.6-1
  • HIGH7.5CVE-2025-58188Panic when validating certificates with DSA public keys in crypto/x509
    from 0, < 1.25.2-1
  • HIGH7.5CVE-2025-61723Quadratic complexity when parsing some invalid inputs in encoding/pem
    from 0, < 1.25.2-1
  • HIGH7.5CVE-2025-58187Quadratic complexity when checking name constraints in crypto/x509
    from 0, < 1.25.2-1
  • HIGH7.5CVE-2025-61725Excessive CPU consumption in ParseAddress in net/mail
    from 0, < 1.25.2-1
  • HIGH7.1CVE-2026-27144Miscompilation allows memory corruption via CONVNOP-wrapped array copy in cmd/compile
    from 0, < 1.25.9-1
  • HIGH7.0CVE-2025-68119Unexpected code execution when invoking toolchain in cmd/go
    from 0, < 1.25.6-1
  • MEDIUM6.5CVE-2025-61728Excessive CPU consumption when building archive index in archive/zip
    from 0, < 1.25.6-1
  • MEDIUM6.5CVE-2025-61727Improper application of excluded DNS name constraints when verifying wildcard names in crypto/x509
    from 0, < 1.25.6-1
  • MEDIUM6.4CVE-2026-32282TOCTOU permits root escape on Linux via Root.Chmod in os in internal/syscall/unix
    from 0, < 1.25.9-1
  • MEDIUM6.1CVE-2026-39826Escaper bypass leads to XSS in html/template
    from 0, < 1.25.10-1
  • MEDIUM6.1CVE-2026-39823Bypass of meta content URL escaping causes XSS in html/template
    from 0, < 1.25.10-1
  • MEDIUM6.1CVE-2026-32289JsBraceDepth Context Tracking Bugs (XSS) in html/template
    from 0, < 1.25.9-1
  • MEDIUM6.1CVE-2026-27142URLs in meta content attribute actions are not escaped in html/template
    from 0, < 1.25.8-1
  • MEDIUM5.9CVE-2026-39817Invoking "go tool pack" does not sanitize output paths in cmd/go
    from 0, < 1.25.10-1
  • MEDIUM5.5CVE-2026-32288Unbounded allocation for old GNU sparse in archive/tar
    from 0, < 1.25.9-1
  • MEDIUM5.4CVE-2025-47910CrossOriginProtection insecure bypass patterns not limited to exact matches in net/http
    from 0, < 1.25.1-1
  • MEDIUM5.3CVE-2026-39825ReverseProxy forwards queries with more than urlmaxqueryparams parameters in net/http/httputil
    from 0, < 1.25.10-1
  • MEDIUM5.3CVE-2026-39819Invoking "go bug" follows symlinks in predictable temporary filenames in cmd/go
    from 0, < 1.25.10-1
  • MEDIUM5.3CVE-2025-61730Handshake messages may be processed at the incorrect encryption level in crypto/tls
    from 0, < 1.25.6-1
  • MEDIUM5.3CVE-2025-61724Excessive CPU consumption in Reader.ReadResponse in net/textproto
    from 0, < 1.25.2-1
  • MEDIUM5.3CVE-2025-58186Lack of limit when parsing cookies can cause memory exhaustion in net/http
    from 0, < 1.25.2-1
  • MEDIUM5.3CVE-2025-58185Parsing DER payload can cause memory exhaustion in encoding/asn1
    from 0, < 1.25.2-1
  • MEDIUM5.3CVE-2025-47912Insufficient validation of bracketed IPv6 hostnames in net/url
    from 0, < 1.25.2-1
  • MEDIUM5.3CVE-2025-58189ALPN negotiation error contains attacker controlled information in crypto/tls
    from 0, < 1.25.2-1
  • MEDIUM4.3CVE-2025-58183Unbounded allocation when parsing GNU sparse map in archive/tar
    from 0, < 1.25.2-1
  • LOW2.5CVE-2026-27139FileInfo can escape from a Root in os
    from 0, < 1.25.8-1