{ "history": [ { "added": 0, "commit": "acc6bd257b9850e22a604ea96815476a83e7a15a", "date": "2026-11-01", "dependencies": 44, "errors": [], "fixable": 27, "go_version": "go1.23.1", "in_binary": { "dependencies": 18, "stdlib": 65, "total": 83 }, "new_vulnerabilities": 0, "osv_confirmed": 27, "osv_only": 0, "ref": "v0.5.1", "release_changed": false, "release_integrity": "checksums-only", "removed": 0, "resolved_vulnerabilities": 0, "scorecard": null, "upgraded": 0, "vulnerabilities": { "Critical": 1, "High": 13, "Low": 1, "Medium": 10, "Negligible": 0, "Unknown": 2 }, "workflow": { "High": 7, "Low": 0, "Medium": 1, "files": 2 } }, { "added": 0, "commit": "acc6bd257b9850e22a604ea96815476a83e7a15a", "date": "2026-11-02", "dependencies": 44, "errors": [], "fixable": 27, "go_version": "go1.23.1", "in_binary": { "dependencies": 19, "stdlib": 64, "total": 83 }, "kev": 0, "kev_new": 0, "new_vulnerabilities": 0, "osv_confirmed": 27, "osv_only": 0, "ref": "v0.5.1", "release_changed": false, "release_integrity": "checksums-only", "removed": 0, "resolved_vulnerabilities": 0, "scorecard": null, "scorecard_date": null, "scorecard_note": "the project is not in the OpenSSF public dataset; the Scorecard CLI fallback failed (exit 1: 2026/11/02 03:07:16 error during command execution: one or more checks failed during execution)", "scorecard_source": null, "upgraded": 0, "vulnerabilities": { "Critical": 1, "High": 13, "Low": 1, "Medium": 10, "Negligible": 0, "Unknown": 2 }, "vulnerable_packages": 5, "workflow": { "High": 7, "Low": 0, "Medium": 1, "files": 2 } } ], "latest": { "archived": false, "category": "Software Composition Analysis (SCA)", "changes": { "added": [], "any": false, "baseline": false, "in_binary_new": [], "in_binary_resolved": [], "integrity_drift": 0, "license_changes": [], "new_vulnerabilities": [], "previous_ref": "v0.5.1", "release_changed": false, "removed": [], "resolved_vulnerabilities": [], "upgraded": [], "workflow_new": 0, "workflow_resolved": 0 }, "commit": "acc6bd257b9850e22a604ea96815476a83e7a15a", "compliance": { "overall_score": 55, "standards": { "bsi_tr03183": { "failed_checks": [ "Component Creator", "Distribution Licences", "SHA-512 Hash", "Dependency Relationship", "SBOM Creator Contact" ], "passed": 4, "score": 44, "total": 9 }, "cisa": { "failed_checks": [ "Software Producer", "Dependency Relationship", "License Information", "Component Hash", "SBOM Author" ], "passed": 5, "score": 50, "total": 10 }, "ntia": { "failed_checks": [ "Supplier Name", "Dependency Relationship" ], "passed": 5, "score": 71, "total": 7 } } }, "components": [ { "ecosystem": "github", "licenses": [], "location": ".github/workflows/go-quality.yml", "name": "actions/checkout", "purl": "pkg:github/actions/checkout@v4", "version": "v4" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/go-quality.yml", "name": "actions/setup-go", "purl": "pkg:github/actions/setup-go@v5", "version": "v5" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/release.yml", "name": "anchore/sbom-action", "purl": "pkg:github/anchore/sbom-action@v0", "version": "v0" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/release.yml", "name": "anchore/sbom-action/publish-sbom", "purl": "pkg:github/anchore/sbom-action@v0#publish-sbom", "version": "v0" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/release.yml", "name": "goreleaser/goreleaser-action", "purl": "pkg:github/goreleaser/goreleaser-action@v5.1.0", "version": "v5.1.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/aymerick/douceur", "purl": "pkg:golang/github.com/aymerick/douceur@v0.2.0", "version": "v0.2.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/briandowns/spinner", "purl": "pkg:golang/github.com/briandowns/spinner@v1.23.1", "version": "v1.23.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/BurntSushi/toml", "purl": "pkg:golang/github.com/BurntSushi/toml@v1.4.0", "version": "v1.4.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/CycloneDX/cyclonedx-go", "purl": "pkg:golang/github.com/CycloneDX/cyclonedx-go@v0.9.1", "version": "v0.9.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/davecgh/go-spew", "purl": "pkg:golang/github.com/davecgh/go-spew@v1.1.1", "version": "v1.1.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/devops-kung-fu/common", "purl": "pkg:golang/github.com/devops-kung-fu/common@v0.2.6", "version": "v0.2.6" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/fatih/color", "purl": "pkg:golang/github.com/fatih/color@v1.17.0", "version": "v1.17.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/go-resty/resty/v2", "purl": "pkg:golang/github.com/go-resty/resty/v2@v2.15.2", "version": "v2.15.2" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/gomarkdown/markdown", "purl": "pkg:golang/github.com/gomarkdown/markdown@v0.0.0-20240730141124-034f12af3bf6", "version": "v0.0.0-20240730141124-034f12af3bf6" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/google/go-github", "purl": "pkg:golang/github.com/google/go-github@v17.0.0%2Bincompatible", "version": "v17.0.0+incompatible" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/google/go-querystring", "purl": "pkg:golang/github.com/google/go-querystring@v1.1.0", "version": "v1.1.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/google/osv-scanner", "purl": "pkg:golang/github.com/google/osv-scanner@v1.8.5", "version": "v1.8.5" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/gookit/color", "purl": "pkg:golang/github.com/gookit/color@v1.5.4", "version": "v1.5.4" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/gorilla/css", "purl": "pkg:golang/github.com/gorilla/css@v1.0.1", "version": "v1.0.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/inconshreveable/mousetrap", "purl": "pkg:golang/github.com/inconshreveable/mousetrap@v1.1.0", "version": "v1.1.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/jarcoal/httpmock", "purl": "pkg:golang/github.com/jarcoal/httpmock@v1.3.1", "version": "v1.3.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/jedib0t/go-pretty/v6", "purl": "pkg:golang/github.com/jedib0t/go-pretty/v6@v6.5.9", "version": "v6.5.9" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/mattn/go-colorable", "purl": "pkg:golang/github.com/mattn/go-colorable@v0.1.13", "version": "v0.1.13" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/mattn/go-isatty", "purl": "pkg:golang/github.com/mattn/go-isatty@v0.0.20", "version": "v0.0.20" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/mattn/go-runewidth", "purl": "pkg:golang/github.com/mattn/go-runewidth@v0.0.16", "version": "v0.0.16" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/microcosm-cc/bluemonday", "purl": "pkg:golang/github.com/microcosm-cc/bluemonday@v1.0.27", "version": "v1.0.27" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/package-url/packageurl-go", "purl": "pkg:golang/github.com/package-url/packageurl-go@v0.1.3", "version": "v0.1.3" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/pmezard/go-difflib", "purl": "pkg:golang/github.com/pmezard/go-difflib@v1.0.0", "version": "v1.0.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/remeh/sizedwaitgroup", "purl": "pkg:golang/github.com/remeh/sizedwaitgroup@v1.0.0", "version": "v1.0.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/rivo/uniseg", "purl": "pkg:golang/github.com/rivo/uniseg@v0.4.7", "version": "v0.4.7" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/sashabaranov/go-openai", "purl": "pkg:golang/github.com/sashabaranov/go-openai@v1.30.3", "version": "v1.30.3" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/spf13/afero", "purl": "pkg:golang/github.com/spf13/afero@v1.11.0", "version": "v1.11.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/spf13/cobra", "purl": "pkg:golang/github.com/spf13/cobra@v1.8.1", "version": "v1.8.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/spf13/pflag", "purl": "pkg:golang/github.com/spf13/pflag@v1.0.5", "version": "v1.0.5" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/stretchr/testify", "purl": "pkg:golang/github.com/stretchr/testify@v1.9.0", "version": "v1.9.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/xo/terminfo", "purl": "pkg:golang/github.com/xo/terminfo@v0.0.0-20220910002029-abceb7e1c41e", "version": "v0.0.0-20220910002029-abceb7e1c41e" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "golang.org/x/exp", "purl": "pkg:golang/golang.org/x/exp@v0.0.0-20240909161429-701f63a606c0", "version": "v0.0.0-20240909161429-701f63a606c0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "golang.org/x/mod", "purl": "pkg:golang/golang.org/x/mod@v0.21.0", "version": "v0.21.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "golang.org/x/net", "purl": "pkg:golang/golang.org/x/net@v0.29.0", "version": "v0.29.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "golang.org/x/sync", "purl": "pkg:golang/golang.org/x/sync@v0.8.0", "version": "v0.8.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "golang.org/x/sys", "purl": "pkg:golang/golang.org/x/sys@v0.25.0", "version": "v0.25.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "golang.org/x/term", "purl": "pkg:golang/golang.org/x/term@v0.24.0", "version": "v0.24.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "golang.org/x/text", "purl": "pkg:golang/golang.org/x/text@v0.18.0", "version": "v0.18.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "gopkg.in/yaml.v3", "purl": "pkg:golang/gopkg.in/yaml.v3@v3.0.1", "version": "v3.0.1" } ], "description": "Scan SBOMs for vulnerabilities", "errors": [], "go_binary": { "asset": "bomber_0.5.1_linux_amd64.tar.gz", "binary": "bomber", "db": "https://vuln.go.dev", "db_last_modified": "2026-10-27T21:16:18Z", "findings": [ { "aliases": [ "CVE-2024-45341" ], "epss": { "cve": "CVE-2024-45341", "percentile": 0.4706, "score": 0.00568 }, "fixed_version": "v1.23.5", "id": "GO-2025-3373", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Usage of IPv6 zone IDs can bypass URI name constraints in crypto/x509", "version": "v1.23.1" }, { "aliases": [ "CVE-2024-45336" ], "epss": { "cve": "CVE-2024-45336", "percentile": 0.54121, "score": 0.00726 }, "fixed_version": "v1.23.5", "id": "GO-2025-3420", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Sensitive headers incorrectly sent after cross-domain redirect in net/http", "version": "v1.23.1" }, { "aliases": [ "CVE-2025-22871" ], "epss": { "cve": "CVE-2025-22871", "percentile": 0.57935, "score": 0.00842 }, "fixed_version": "v1.23.8", "id": "GO-2025-3563", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Request smuggling due to acceptance of invalid chunked data in net/http", "version": "v1.23.1" }, { "aliases": [ "CVE-2025-4673" ], "epss": { "cve": "CVE-2025-4673", "percentile": 0.51827, "score": 0.00666 }, "fixed_version": "v1.23.10", "id": "GO-2025-3751", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Sensitive headers not cleared on cross-origin redirect in net/http", "version": "v1.23.1" }, { "aliases": [ "CVE-2025-47907" ], "epss": { "cve": "CVE-2025-47907", "percentile": 0.34914, "score": 0.00406 }, "fixed_version": "v1.23.12", "id": "GO-2025-3849", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Incorrect results returned from Rows.Scan in database/sql", "version": "v1.23.1" }, { "aliases": [ "CVE-2025-47906", "CVE-2025-47906" ], "epss": { "cve": "CVE-2025-47906", "percentile": 0.46025, "score": 0.0055 }, "fixed_version": "v1.23.12", "id": "GO-2025-3956", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Unexpected paths returned from LookPath in os/exec", "version": "v1.23.1" }, { "aliases": [ "CVE-2025-61725", "CVE-2025-61725" ], "epss": { "cve": "CVE-2025-61725", "percentile": 0.51041, "score": 0.00647 }, "fixed_version": "v1.24.8", "id": "GO-2025-4006", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Excessive CPU consumption in ParseAddress in net/mail", "version": "v1.23.1" }, { "aliases": [ "CVE-2025-58187", "CVE-2025-58187" ], "epss": { "cve": "CVE-2025-58187", "percentile": 0.34877, "score": 0.00406 }, "fixed_version": "v1.24.9", "id": "GO-2025-4007", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Quadratic complexity when checking name constraints in crypto/x509", "version": "v1.23.1" }, { "aliases": [ "CVE-2025-58189", "CVE-2025-58189" ], "epss": { "cve": "CVE-2025-58189", "percentile": 0.40494, "score": 0.00468 }, "fixed_version": "v1.24.8", "id": "GO-2025-4008", "kev": null, "level": "symbol", "module": "stdlib", "summary": "ALPN negotiation error contains attacker controlled information in crypto/tls", "version": "v1.23.1" }, { "aliases": [ "CVE-2025-61723", "CVE-2025-61723" ], "epss": { "cve": "CVE-2025-61723", "percentile": 0.51648, "score": 0.00661 }, "fixed_version": "v1.24.8", "id": "GO-2025-4009", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Quadratic complexity when parsing some invalid inputs in encoding/pem", "version": "v1.23.1" }, { "aliases": [ "CVE-2025-47912", "CVE-2025-47912" ], "epss": { "cve": "CVE-2025-47912", "percentile": 0.40493, "score": 0.00468 }, "fixed_version": "v1.24.8", "id": "GO-2025-4010", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Insufficient validation of bracketed IPv6 hostnames in net/url", "version": "v1.23.1" }, { "aliases": [ "CVE-2025-58185", "CVE-2025-58185" ], "epss": { "cve": "CVE-2025-58185", "percentile": 0.46363, "score": 0.00556 }, "fixed_version": "v1.24.8", "id": "GO-2025-4011", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Parsing DER payload can cause memory exhaustion in encoding/asn1", "version": "v1.23.1" }, { "aliases": [ "CVE-2025-58186", "CVE-2025-58186" ], "epss": { "cve": "CVE-2025-58186", "percentile": 0.46913, "score": 0.00565 }, "fixed_version": "v1.24.8", "id": "GO-2025-4012", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Lack of limit when parsing cookies can cause memory exhaustion in net/http", "version": "v1.23.1" }, { "aliases": [ "CVE-2025-58188", "CVE-2025-58188" ], "epss": { "cve": "CVE-2025-58188", "percentile": 0.32165, "score": 0.00381 }, "fixed_version": "v1.24.8", "id": "GO-2025-4013", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Panic when validating certificates with DSA public keys in crypto/x509", "version": "v1.23.1" }, { "aliases": [ "CVE-2025-58183", "CVE-2025-58183" ], "epss": { "cve": "CVE-2025-58183", "percentile": 0.38512, "score": 0.00443 }, "fixed_version": "v1.24.8", "id": "GO-2025-4014", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Unbounded allocation when parsing GNU sparse map in archive/tar", "version": "v1.23.1" }, { "aliases": [ "CVE-2025-61724", "CVE-2025-61724" ], "epss": { "cve": "CVE-2025-61724", "percentile": 0.46363, "score": 0.00556 }, "fixed_version": "v1.24.8", "id": "GO-2025-4015", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Excessive CPU consumption in Reader.ReadResponse in net/textproto", "version": "v1.23.1" }, { "aliases": [ "CVE-2025-61729", "CVE-2025-61729" ], "epss": { "cve": "CVE-2025-61729", "percentile": 0.39638, "score": 0.00457 }, "fixed_version": "v1.24.11", "id": "GO-2025-4155", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Excessive resource consumption when printing error string for host certificate validation in crypto/x509", "version": "v1.23.1" }, { "aliases": [ "CVE-2025-61727" ], "epss": { "cve": "CVE-2025-61727", "percentile": 0.20933, "score": 0.00284 }, "fixed_version": "v1.24.11", "id": "GO-2025-4175", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Improper application of excluded DNS name constraints when verifying wildcard names in crypto/x509", "version": "v1.23.1" }, { "aliases": [ "CVE-2025-68121" ], "epss": { "cve": "CVE-2025-68121", "percentile": 0.59731, "score": 0.00902 }, "fixed_version": "v1.24.13", "id": "GO-2026-4337", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Unexpected session resumption in crypto/tls", "version": "v1.23.1" }, { "aliases": [ "CVE-2025-61730", "CVE-2025-61730" ], "epss": { "cve": "CVE-2025-61730", "percentile": 0.25445, "score": 0.00324 }, "fixed_version": "v1.24.12", "id": "GO-2026-4340", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Handshake messages may be processed at the incorrect encryption level in crypto/tls", "version": "v1.23.1" }, { "aliases": [ "CVE-2025-61726", "CVE-2025-61726" ], "epss": { "cve": "CVE-2025-61726", "percentile": 0.83237, "score": 0.02292 }, "fixed_version": "v1.24.12", "id": "GO-2026-4341", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Memory exhaustion in query parameter parsing in net/url", "version": "v1.23.1" }, { "aliases": [ "CVE-2025-61728", "CVE-2025-61728" ], "epss": { "cve": "CVE-2025-61728", "percentile": 0.54549, "score": 0.00738 }, "fixed_version": "v1.24.12", "id": "GO-2026-4342", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Excessive CPU consumption when building archive index in archive/zip", "version": "v1.23.1" }, { "aliases": [ "CVE-2025-22873" ], "epss": { "cve": "CVE-2025-22873", "percentile": 0.1423, "score": 0.00233 }, "fixed_version": "v1.23.9", "id": "GO-2026-4403", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Improper access to parent directory of root in os", "version": "v1.23.1" }, { "aliases": [ "CVE-2026-25679" ], "epss": { "cve": "CVE-2026-25679", "percentile": 0.57493, "score": 0.00827 }, "fixed_version": "v1.25.8", "id": "GO-2026-4601", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Incorrect parsing of IPv6 host literals in net/url", "version": "v1.23.1" }, { "aliases": [ "CVE-2026-27139" ], "epss": { "cve": "CVE-2026-27139", "percentile": 0.12457, "score": 0.00219 }, "fixed_version": "v1.25.8", "id": "GO-2026-4602", "kev": null, "level": "symbol", "module": "stdlib", "summary": "FileInfo can escape from a Root in os", "version": "v1.23.1" }, { "aliases": [ "CVE-2026-27142" ], "epss": { "cve": "CVE-2026-27142", "percentile": 0.31368, "score": 0.00374 }, "fixed_version": "v1.25.8", "id": "GO-2026-4603", "kev": null, "level": "symbol", "module": "stdlib", "summary": "URLs in meta content attribute actions are not escaped in html/template", "version": "v1.23.1" }, { "aliases": [ "CVE-2026-32282" ], "epss": { "cve": "CVE-2026-32282", "percentile": 0.21771, "score": 0.00292 }, "fixed_version": "v1.25.9", "id": "GO-2026-4864", "kev": null, "level": "symbol", "module": "stdlib", "summary": "TOCTOU permits root escape on Linux via Root.Chmod in os in internal/syscall/unix", "version": "v1.23.1" }, { "aliases": [ "CVE-2026-32289" ], "epss": { "cve": "CVE-2026-32289", "percentile": 0.21611, "score": 0.0029 }, "fixed_version": "v1.25.9", "id": "GO-2026-4865", "kev": null, "level": "symbol", "module": "stdlib", "summary": "JsBraceDepth Context Tracking Bugs (XSS) in html/template", "version": "v1.23.1" }, { "aliases": [ "CVE-2026-32288" ], "epss": { "cve": "CVE-2026-32288", "percentile": 0.21609, "score": 0.0029 }, "fixed_version": "v1.25.9", "id": "GO-2026-4869", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Unbounded allocation for old GNU sparse in archive/tar", "version": "v1.23.1" }, { "aliases": [ "CVE-2026-32283" ], "epss": { "cve": "CVE-2026-32283", "percentile": 0.49799, "score": 0.00621 }, "fixed_version": "v1.25.9", "id": "GO-2026-4870", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Unauthenticated TLS 1.3 KeyUpdate record can cause persistent connection retention and DoS in crypto/tls", "version": "v1.23.1" }, { "aliases": [ "CVE-2026-33814" ], "epss": { "cve": "CVE-2026-33814", "percentile": 0.57885, "score": 0.0084 }, "fixed_version": "v1.25.10", "id": "GO-2026-4918", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net", "version": "v1.23.1" }, { "aliases": [ "CVE-2026-32281" ], "epss": { "cve": "CVE-2026-32281", "percentile": 0.2925, "score": 0.00355 }, "fixed_version": "v1.25.9", "id": "GO-2026-4946", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Inefficient policy validation in crypto/x509", "version": "v1.23.1" }, { "aliases": [ "CVE-2026-32280" ], "epss": { "cve": "CVE-2026-32280", "percentile": 0.49458, "score": 0.00615 }, "fixed_version": "v1.25.9", "id": "GO-2026-4947", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Unexpected work during chain building in crypto/x509", "version": "v1.23.1" }, { "aliases": [ "CVE-2026-39822" ], "epss": { "cve": "CVE-2026-39822", "percentile": 0.14177, "score": 0.00232 }, "fixed_version": "v1.25.12", "id": "GO-2026-4970", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Root escape via symlink plus trailing slash in os", "version": "v1.23.1" }, { "aliases": [ "CVE-2026-39836" ], "epss": { "cve": "CVE-2026-39836", "percentile": 0.50332, "score": 0.00633 }, "fixed_version": "v1.25.10", "id": "GO-2026-4971", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Panic in Dial and LookupPort when handling NUL byte on Windows in net", "version": "v1.23.1" }, { "aliases": [ "CVE-2026-39825" ], "epss": { "cve": "CVE-2026-39825", "percentile": 0.33182, "score": 0.0039 }, "fixed_version": "v1.25.10", "id": "GO-2026-4976", "kev": null, "level": "symbol", "module": "stdlib", "summary": "ReverseProxy forwards queries with more than urlmaxqueryparams parameters in net/http/httputil", "version": "v1.23.1" }, { "aliases": [ "CVE-2026-42499" ], "epss": { "cve": "CVE-2026-42499", "percentile": 0.56521, "score": 0.00798 }, "fixed_version": "v1.25.10", "id": "GO-2026-4977", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Quadratic string concatenation in consumePhrase in net/mail", "version": "v1.23.1" }, { "aliases": [ "CVE-2026-39826" ], "epss": { "cve": "CVE-2026-39826", "percentile": 0.31066, "score": 0.00371 }, "fixed_version": "v1.25.10", "id": "GO-2026-4980", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Escaper bypass leads to XSS in html/template", "version": "v1.23.1" }, { "aliases": [ "CVE-2026-33811" ], "epss": { "cve": "CVE-2026-33811", "percentile": 0.58975, "score": 0.00875 }, "fixed_version": "v1.25.10", "id": "GO-2026-4981", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Crash when handling long CNAME response in net", "version": "v1.23.1" }, { "aliases": [ "CVE-2026-39823" ], "epss": { "cve": "CVE-2026-39823", "percentile": 0.24388, "score": 0.00314 }, "fixed_version": "v1.25.10", "id": "GO-2026-4982", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Bypass of meta content URL escaping causes XSS in html/template", "version": "v1.23.1" }, { "aliases": [ "CVE-2026-39820" ], "epss": { "cve": "CVE-2026-39820", "percentile": 0.56059, "score": 0.00784 }, "fixed_version": "v1.25.10", "id": "GO-2026-4986", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Quadratic string concatentation in consumeComment in net/mail", "version": "v1.23.1" }, { "aliases": [ "CVE-2026-39821" ], "epss": { "cve": "CVE-2026-39821", "percentile": 0.78915, "score": 0.01834 }, "fixed_version": "v1.25.13", "id": "GO-2026-5026", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna", "version": "v1.23.1" }, { "aliases": [ "CVE-2026-27145" ], "epss": { "cve": "CVE-2026-27145", "percentile": 0.48256, "score": 0.00591 }, "fixed_version": "v1.25.11", "id": "GO-2026-5037", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Inefficient candidate hostname parsing in crypto/x509", "version": "v1.23.1" }, { "aliases": [ "CVE-2026-42504" ], "epss": { "cve": "CVE-2026-42504", "percentile": 0.46636, "score": 0.0056 }, "fixed_version": "v1.25.11", "id": "GO-2026-5038", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Quadratic complexity in WordDecoder.DecodeHeader in mime", "version": "v1.23.1" }, { "aliases": [ "CVE-2026-42507" ], "epss": { "cve": "CVE-2026-42507", "percentile": 0.30985, "score": 0.0037 }, "fixed_version": "v1.25.11", "id": "GO-2026-5039", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Arbitrary inputs are included in errors without any escaping in net/textproto", "version": "v1.23.1" }, { "aliases": [ "CVE-2026-42505" ], "epss": { "cve": "CVE-2026-42505", "percentile": 0.32254, "score": 0.00382 }, "fixed_version": "v1.25.12", "id": "GO-2026-5856", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Invoking Encrypted Client Hello privacy leak in crypto/tls", "version": "v1.23.1" }, { "aliases": [ "CVE-2026-33818" ], "epss": { "cve": "CVE-2026-33818", "percentile": 0.47077, "score": 0.00568 }, "fixed_version": "v1.25.13", "id": "GO-2026-5972", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Enforce maximum recursion depth in encoding/asn1", "version": "v1.23.1" }, { "aliases": [ "CVE-2026-56859" ], "epss": { "cve": "CVE-2026-56859", "percentile": 0.47076, "score": 0.00568 }, "fixed_version": "v1.25.13", "id": "GO-2026-6088", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Add recursion depth guard during decode in encoding/xml", "version": "v1.23.1" }, { "aliases": [ "CVE-2026-56853" ], "epss": { "cve": "CVE-2026-56853", "percentile": 0.47076, "score": 0.00568 }, "fixed_version": "v1.25.13", "id": "GO-2026-6089", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Apply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/http", "version": "v1.23.1" }, { "aliases": [ "CVE-2026-56862" ], "epss": { "cve": "CVE-2026-56862", "percentile": 0.47076, "score": 0.00568 }, "fixed_version": "v1.25.13", "id": "GO-2026-6090", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Limit handshake messages we are willing to accept post-handshake in crypto/tls", "version": "v1.23.1" }, { "aliases": [ "CVE-2026-56858" ], "epss": { "cve": "CVE-2026-56858", "percentile": 0.23831, "score": 0.0031 }, "fixed_version": "v1.25.13", "id": "GO-2026-6091", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Fix Javascript regexp context tracking in html/template", "version": "v1.23.1" }, { "aliases": [ "CVE-2026-56860" ], "epss": { "cve": "CVE-2026-56860", "percentile": 0.46041, "score": 0.0055 }, "fixed_version": "v1.25.13", "id": "GO-2026-6218", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Avoid quadratic complexity in resolvePath in net/url", "version": "v1.23.1" }, { "aliases": [ "CVE-2026-94448" ], "epss": { "cve": "CVE-2026-94448", "percentile": 0.21475, "score": 0.00289 }, "fixed_version": "v1.26.9", "id": "GO-2026-6599", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Reset context tracking on consecutive template expressions in html/template", "version": "v1.23.1" }, { "aliases": [ "CVE-2026-97030" ], "epss": { "cve": "CVE-2026-97030", "percentile": 0.21475, "score": 0.00289 }, "fixed_version": "v1.26.9", "id": "GO-2026-6600", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Recognize yield as regexp preceder keyword in html/template", "version": "v1.23.1" }, { "aliases": [ "CVE-2026-78659" ], "epss": { "cve": "CVE-2026-78659", "percentile": 0.50082, "score": 0.00627 }, "fixed_version": "v1.26.9", "id": "GO-2026-6603", "kev": null, "level": "symbol", "module": "stdlib", "summary": "HTTP/2 server memory exhaustion due to Trailer headers in net/http", "version": "v1.23.1" }, { "aliases": [ "CVE-2026-56866" ], "epss": { "cve": "CVE-2026-56866", "percentile": 0.40968, "score": 0.00473 }, "fixed_version": "v1.26.9", "id": "GO-2026-6605", "kev": null, "level": "symbol", "module": "stdlib", "summary": "HTTP/1 client connection desynchronization after CONNECT rejection in net/http", "version": "v1.23.1" }, { "aliases": [ "CVE-2026-97031" ], "epss": { "cve": "CVE-2026-97031", "percentile": 0.44095, "score": 0.00519 }, "fixed_version": "v1.26.9", "id": "GO-2026-6607", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Reject malformed ECH outer extension references in crypto/tls", "version": "v1.23.1" }, { "aliases": [ "CVE-2026-94440" ], "epss": { "cve": "CVE-2026-94440", "percentile": 0.4362, "score": 0.00511 }, "fixed_version": "v1.26.9", "id": "GO-2026-6608", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Memory limit bypass when parsing MIME headers in net/textproto, mime/multipart", "version": "v1.23.1" }, { "aliases": [ "CVE-2026-78667" ], "epss": { "cve": "CVE-2026-78667", "percentile": 0.41455, "score": 0.0048 }, "fixed_version": "v1.26.9", "id": "GO-2026-6609", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Lack of limit on size of parsed Range headers in net/http", "version": "v1.23.1" }, { "aliases": [ "CVE-2026-78660" ], "epss": { "cve": "CVE-2026-78660", "percentile": 0.36838, "score": 0.00425 }, "fixed_version": "v1.26.9", "id": "GO-2026-6610", "kev": null, "level": "symbol", "module": "stdlib", "summary": "HTTP/2 transport accepts malformed framing-related headers in net/http", "version": "v1.23.1" }, { "aliases": [ "CVE-2026-78663" ], "epss": { "cve": "CVE-2026-78663", "percentile": 0.49813, "score": 0.00622 }, "fixed_version": "v1.26.9", "id": "GO-2026-6612", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Double flow control refund on HTTP/2 server streams in net/http", "version": "v1.23.1" }, { "aliases": [ "CVE-2026-94439" ], "epss": { "cve": "CVE-2026-94439", "percentile": 0.35772, "score": 0.00414 }, "fixed_version": "v1.26.9", "id": "GO-2026-6613", "kev": null, "level": "symbol", "module": "stdlib", "summary": "HTTP/1 server connection desynchronization after 2xx CONNECT response in net/http", "version": "v1.23.1" }, { "aliases": [ "CVE-2026-97032" ], "epss": { "cve": "CVE-2026-97032", "percentile": 0.42154, "score": 0.0049 }, "fixed_version": "v1.26.9", "id": "GO-2026-6617", "kev": null, "level": "symbol", "module": "stdlib", "summary": "HTTP/2 server crash due to HPACK encoder race in net/http", "version": "v1.23.1" }, { "aliases": [ "CVE-2026-111943" ], "epss": { "cve": "CVE-2026-111943", "percentile": 0.33793, "score": 0.00396 }, "fixed_version": "v1.26.10", "id": "GO-2026-6809", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Distrust compromised intermediate certificates in crypto/x509", "version": "v1.23.1" }, { "aliases": [ "CVE-2026-40890", "GHSA-77fj-vx54-gvh7" ], "epss": { "cve": "CVE-2026-40890", "percentile": 0.2815, "score": 0.00346 }, "fixed_version": "v0.0.0-20260411013819-759bbc3e3207", "id": "GO-2026-5208", "kev": null, "level": "symbol", "module": "github.com/gomarkdown/markdown", "summary": "Go Markdown has an out-of-bounds read in SmartypantsRenderer in github.com/gomarkdown/markdown", "version": "v0.0.0-20240730141124-034f12af3bf6" }, { "aliases": [ "CVE-2026-56865" ], "epss": { "cve": "CVE-2026-56865", "percentile": 0.02533, "score": 0.00129 }, "fixed_version": "v0.40.0", "id": "GO-2026-6179", "kev": null, "level": "symbol", "module": "golang.org/x/mod", "summary": "Fix transparency log tile verification bypass in golang.org/x/mod/sumdb/tlog", "version": "v0.21.0" }, { "aliases": [ "CVE-2026-56864" ], "epss": { "cve": "CVE-2026-56864", "percentile": 0.22506, "score": 0.00298 }, "fixed_version": "v0.40.0", "id": "GO-2026-6180", "kev": null, "level": "symbol", "module": "golang.org/x/mod", "summary": "Ignore unrelated, unauthenticated hashes in Lookup in golang.org/x/mod/sumdb", "version": "v0.21.0" }, { "aliases": [ "CVE-2024-45338", "GHSA-w32m-9786-jp63" ], "epss": { "cve": "CVE-2024-45338", "percentile": 0.64906, "score": 0.01072 }, "fixed_version": "v0.33.0", "id": "GO-2024-3333", "kev": null, "level": "symbol", "module": "golang.org/x/net", "summary": "Non-linear parsing of case-insensitive content in golang.org/x/net/html", "version": "v0.29.0" }, { "aliases": [ "CVE-2025-22870", "GHSA-qxp5-gwg8-xv66" ], "epss": { "cve": "CVE-2025-22870", "percentile": 0.36779, "score": 0.00425 }, "fixed_version": "v0.36.0", "id": "GO-2025-3503", "kev": null, "level": "symbol", "module": "golang.org/x/net", "summary": "HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net", "version": "v0.29.0" }, { "aliases": [ "CVE-2025-22872" ], "epss": { "cve": "CVE-2025-22872", "percentile": 0.45712, "score": 0.00545 }, "fixed_version": "v0.38.0", "id": "GO-2025-3595", "kev": null, "level": "symbol", "module": "golang.org/x/net", "summary": "Incorrect Neutralization of Input During Web Page Generation in x/net in golang.org/x/net", "version": "v0.29.0" }, { "aliases": [ "CVE-2025-47911" ], "epss": { "cve": "CVE-2025-47911", "percentile": 0.46695, "score": 0.00561 }, "fixed_version": "v0.45.0", "id": "GO-2026-4440", "kev": null, "level": "symbol", "module": "golang.org/x/net", "summary": "Quadratic parsing complexity in golang.org/x/net/html", "version": "v0.29.0" }, { "aliases": [ "CVE-2025-58190" ], "epss": { "cve": "CVE-2025-58190", "percentile": 0.45427, "score": 0.0054 }, "fixed_version": "v0.45.0", "id": "GO-2026-4441", "kev": null, "level": "symbol", "module": "golang.org/x/net", "summary": "Infinite parsing loop in golang.org/x/net", "version": "v0.29.0" }, { "aliases": [ "CVE-2026-42506" ], "epss": { "cve": "CVE-2026-42506", "percentile": 0.14566, "score": 0.00235 }, "fixed_version": "v0.55.0", "id": "GO-2026-5025", "kev": null, "level": "symbol", "module": "golang.org/x/net", "summary": "Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html", "version": "v0.29.0" }, { "aliases": [ "CVE-2026-42502" ], "epss": { "cve": "CVE-2026-42502", "percentile": 0.12982, "score": 0.00223 }, "fixed_version": "v0.55.0", "id": "GO-2026-5027", "kev": null, "level": "symbol", "module": "golang.org/x/net", "summary": "Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html", "version": "v0.29.0" }, { "aliases": [ "CVE-2026-25680" ], "epss": { "cve": "CVE-2026-25680", "percentile": 0.25766, "score": 0.00326 }, "fixed_version": "v0.55.0", "id": "GO-2026-5028", "kev": null, "level": "symbol", "module": "golang.org/x/net", "summary": "Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html", "version": "v0.29.0" }, { "aliases": [ "CVE-2026-25681" ], "epss": { "cve": "CVE-2026-25681", "percentile": 0.12983, "score": 0.00223 }, "fixed_version": "v0.55.0", "id": "GO-2026-5029", "kev": null, "level": "symbol", "module": "golang.org/x/net", "summary": "Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html", "version": "v0.29.0" }, { "aliases": [ "CVE-2026-27136" ], "epss": { "cve": "CVE-2026-27136", "percentile": 0.12983, "score": 0.00223 }, "fixed_version": "v0.55.0", "id": "GO-2026-5030", "kev": null, "level": "symbol", "module": "golang.org/x/net", "summary": "Invoking duplicate attributes can cause XSS in golang.org/x/net/html", "version": "v0.29.0" }, { "aliases": [ "CVE-2026-46600" ], "epss": { "cve": "CVE-2026-46600", "percentile": 0.45991, "score": 0.00549 }, "fixed_version": "v0.56.0", "id": "GO-2026-5942", "kev": null, "level": "symbol", "module": "golang.org/x/net", "summary": "Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage", "version": "v0.29.0" }, { "aliases": [ "CVE-2026-78669" ], "epss": { "cve": "CVE-2026-78669", "percentile": 0.49426, "score": 0.00614 }, "fixed_version": "v0.60.0", "id": "GO-2026-6611", "kev": null, "level": "symbol", "module": "golang.org/x/net", "summary": "Excessive CPU consumption from repeated initial window changes in net/http", "version": "v0.29.0" }, { "aliases": [ "CVE-2026-78661" ], "epss": { "cve": "CVE-2026-78661", "percentile": 0.08063, "score": 0.00185 }, "fixed_version": "v0.62.0", "id": "GO-2026-6860", "kev": null, "level": "symbol", "module": "golang.org/x/net", "summary": "Avoid quadratic complexity when coalescing text nodes in html in golang.org/x/net", "version": "v0.29.0" }, { "aliases": [ "CVE-2026-97045" ], "epss": { "cve": "CVE-2026-97045", "percentile": 0.10117, "score": 0.00202 }, "fixed_version": "v0.62.0", "id": "GO-2026-6866", "kev": null, "level": "symbol", "module": "golang.org/x/net", "summary": "Check all ancestor namespace transitions when rendering raw text in html in golang.org/x/net", "version": "v0.29.0" }, { "aliases": [ "CVE-2026-56852" ], "epss": { "cve": "CVE-2026-56852", "percentile": 0.41057, "score": 0.00475 }, "fixed_version": "v0.39.0", "id": "GO-2026-5970", "kev": null, "level": "symbol", "module": "golang.org/x/text", "summary": "Infinite loop on invalid input in golang.org/x/text", "version": "v0.18.0" }, { "aliases": [ "CVE-2026-56851" ], "epss": { "cve": "CVE-2026-56851", "percentile": 0.40313, "score": 0.00466 }, "fixed_version": "v0.41.0", "id": "GO-2026-6629", "kev": null, "level": "symbol", "module": "golang.org/x/text", "summary": "Panic parsing crafted input in x/text/secure/precis in golang.org/x/text", "version": "v0.18.0" } ], "go_version": "go1.23.1", "main_module": "github.com/devops-kung-fu/bomber" }, "id": "devops-kung-fu__bomber", "manifests": [ ".github/workflows/go-quality.yml", ".github/workflows/release.yml", "go.mod", "go.sum" ], "name": "bomber", "osv": { "advisories": 27, "available": true, "confirmed": 27, "osv_only": [], "warning": null }, "ref": "v0.5.1", "ref_kind": "release", "release_integrity": { "asset": "bomber_0.5.1_linux_amd64.tar.gz", "assets": 10, "build_provenance": null, "checksums_published": true, "digest_matches_github": null, "immutable_release": null, "methods": [], "provenance_published": false, "sbom_published": false, "signature": null, "signatures_published": false, "signer": null, "verdict": "checksums-only" }, "released_at": "2024-09-23T16:09:01Z", "repository": "devops-kung-fu/bomber", "sbomlyze_diff": { "added": 0, "changed": 0, "drift": {}, "findings": [ "0 version changes among 49 shared packages \u2014 no actual upgrades", "Core system packages stable: golang (39) unchanged" ], "removed": 0 }, "scanned_at": "2026-11-02T03:06:49+00:00", "scorecard": null, "scorecard_note": "the project is not in the OpenSSF public dataset; the Scorecard CLI fallback failed (exit 1: 2026/11/02 03:07:16 error during command execution: one or more checks failed during execution)", "vulnerabilities": [ { "aliases": [ "CVE-2026-78663" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-78663", "percentile": 0.49813, "score": 0.00622 }, "fix_state": "fixed", "fixed_in": [ "0.60.0" ], "id": "GO-2026-6612", "in_binary": "vulnerable code in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/net", "severity": "Critical", "summary": "The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configure", "url": "https://go.dev/cl/847187", "version": "v0.29.0" }, { "aliases": [ "CVE-2026-40890" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-40890", "percentile": 0.2815, "score": 0.00346 }, "fix_state": "fixed", "fixed_in": [ "0.0.0-20260411013819-759bbc3e3207" ], "id": "GHSA-77fj-vx54-gvh7", "in_binary": "vulnerable code in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "github.com/gomarkdown/markdown", "severity": "High", "summary": "Go Markdown has an Out-of-bounds Read in SmartypantsRenderer", "url": "https://github.com/advisories/GHSA-77fj-vx54-gvh7", "version": "v0.0.0-20240730141124-034f12af3bf6" }, { "aliases": [ "CVE-2026-102941" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-102941", "percentile": 0.20376, "score": 0.00279 }, "fix_state": "fixed", "fixed_in": [ "0.0.0-20260724235538-61af6e1e6971" ], "id": "GHSA-cv23-7vc5-jfh7", "in_binary": "vulnerable code not in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "github.com/gomarkdown/markdown", "severity": "High", "summary": "gomarkdown/markdown IsSafeURL panics on short URLs", "url": "https://github.com/advisories/GHSA-cv23-7vc5-jfh7", "version": "v0.0.0-20240730141124-034f12af3bf6" }, { "aliases": [ "CVE-2026-56865" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-56865", "percentile": 0.02533, "score": 0.00129 }, "fix_state": "fixed", "fixed_in": [ "0.40.0" ], "id": "GO-2026-6179", "in_binary": "vulnerable code in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/mod", "severity": "High", "summary": "A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache. This attack allows for a malicious GOPROXY to serve malicious module content that canno", "url": "https://go.dev/issue/80744", "version": "v0.21.0" }, { "aliases": [ "CVE-2026-56864" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-56864", "percentile": 0.22506, "score": 0.00298 }, "fix_state": "fixed", "fixed_in": [ "0.40.0" ], "id": "GO-2026-6180", "in_binary": "vulnerable code in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/mod", "severity": "High", "summary": "A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log. In order to determine if you", "url": "https://go.dev/issue/80745", "version": "v0.21.0" }, { "aliases": [ "CVE-2026-33814" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-33814", "percentile": 0.57885, "score": 0.0084 }, "fix_state": "fixed", "fixed_in": [ "0.53.0" ], "id": "GO-2026-4918", "in_binary": "vulnerable code in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/net", "severity": "High", "summary": "When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.", "url": "https://go.dev/cl/761581", "version": "v0.29.0" }, { "aliases": [ "CVE-2026-39821" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-39821", "percentile": 0.78915, "score": 0.01834 }, "fix_state": "fixed", "fixed_in": [ "0.55.0" ], "id": "GO-2026-5026", "in_binary": "vulnerable code in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/net", "severity": "High", "summary": "The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode(\"xn--example-.com\") incorrectly returns the name \"example.com\" rather than an error. This behavior can lead to privilege escalation in programs using the idna pac", "url": "https://go.dev/cl/767220", "version": "v0.29.0" }, { "aliases": [ "CVE-2026-46600" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-46600", "percentile": 0.45991, "score": 0.00549 }, "fix_state": "fixed", "fixed_in": [ "0.56.0" ], "id": "GO-2026-5942", "in_binary": "vulnerable code in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/net", "severity": "High", "summary": "Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer.", "url": "https://go.dev/cl/786345", "version": "v0.29.0" }, { "aliases": [ "CVE-2026-78659" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-78659", "percentile": 0.50082, "score": 0.00627 }, "fix_state": "fixed", "fixed_in": [ "0.60.0" ], "id": "GO-2026-6603", "in_binary": "vulnerable code in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/net", "severity": "High", "summary": "When \"Trailer\" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a \"", "url": "https://go.dev/cl/847185", "version": "v0.29.0" }, { "aliases": [ "CVE-2026-78660" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-78660", "percentile": 0.36838, "score": 0.00425 }, "fix_state": "fixed", "fixed_in": [ "0.60.0" ], "id": "GO-2026-6610", "in_binary": "vulnerable code in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/net", "severity": "High", "summary": "Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a re", "url": "https://go.dev/cl/835145", "version": "v0.29.0" }, { "aliases": [ "CVE-2026-78669" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-78669", "percentile": 0.49426, "score": 0.00614 }, "fix_state": "fixed", "fixed_in": [ "0.60.0" ], "id": "GO-2026-6611", "in_binary": "vulnerable code in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/net", "severity": "High", "summary": "A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values.", "url": "https://go.dev/cl/847186", "version": "v0.29.0" }, { "aliases": [ "CVE-2026-97032" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-97032", "percentile": 0.42154, "score": 0.0049 }, "fix_state": "fixed", "fixed_in": [ "0.60.0" ], "id": "GO-2026-6617", "in_binary": "vulnerable code in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/net", "severity": "High", "summary": "HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the ot", "url": "https://go.dev/cl/847188", "version": "v0.29.0" }, { "aliases": [ "CVE-2026-56852" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-56852", "percentile": 0.41057, "score": 0.00475 }, "fix_state": "fixed", "fixed_in": [ "0.39.0" ], "id": "GO-2026-5970", "in_binary": "vulnerable code in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/text", "severity": "High", "summary": "A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes.", "url": "https://go.dev/issue/80142", "version": "v0.18.0" }, { "aliases": [ "CVE-2026-56851" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-56851", "percentile": 0.40313, "score": 0.00466 }, "fix_state": "fixed", "fixed_in": [ "0.41.0" ], "id": "GO-2026-6629", "in_binary": "vulnerable code in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/text", "severity": "High", "summary": "The Nickname profile can panic with an out-of-bounds slice error when transforming crafted input into a short destination buffer.", "url": "https://go.dev/cl/793360", "version": "v0.18.0" }, { "aliases": [ "CVE-2026-25680" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-25680", "percentile": 0.25766, "score": 0.00326 }, "fix_state": "fixed", "fixed_in": [ "0.55.0" ], "id": "GHSA-5cv4-jp36-h3mw", "in_binary": "vulnerable code in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/net", "severity": "Medium", "summary": "Go Net HTML parser is vulnerable to denial of service", "url": "https://github.com/advisories/GHSA-5cv4-jp36-h3mw", "version": "v0.29.0" }, { "aliases": [ "CVE-2025-22870" ], "ecosystem": "golang", "epss": { "cve": "CVE-2025-22870", "percentile": 0.36779, "score": 0.00425 }, "fix_state": "fixed", "fixed_in": [ "0.36.0" ], "id": "GHSA-qxp5-gwg8-xv66", "in_binary": "vulnerable code in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/net", "severity": "Medium", "summary": "HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net", "url": "https://github.com/advisories/GHSA-qxp5-gwg8-xv66", "version": "v0.29.0" }, { "aliases": [ "CVE-2025-22872" ], "ecosystem": "golang", "epss": { "cve": "CVE-2025-22872", "percentile": 0.45712, "score": 0.00545 }, "fix_state": "fixed", "fixed_in": [ "0.38.0" ], "id": "GHSA-vvgc-356p-c3xw", "in_binary": "vulnerable code in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/net", "severity": "Medium", "summary": "golang.org/x/net vulnerable to Cross-site Scripting", "url": "https://github.com/advisories/GHSA-vvgc-356p-c3xw", "version": "v0.29.0" }, { "aliases": [ "CVE-2024-45338", "GHSA-w32m-9786-jp63" ], "ecosystem": "golang", "epss": { "cve": "CVE-2024-45338", "percentile": 0.64906, "score": 0.01072 }, "fix_state": "fixed", "fixed_in": [ "0.33.0" ], "id": "GO-2024-3333", "in_binary": "vulnerable code in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/net", "severity": "Medium", "summary": "An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service.", "url": "https://go.dev/cl/637536", "version": "v0.29.0" }, { "aliases": [ "CVE-2025-47911" ], "ecosystem": "golang", "epss": { "cve": "CVE-2025-47911", "percentile": 0.46695, "score": 0.00561 }, "fix_state": "fixed", "fixed_in": [ "0.45.0" ], "id": "GO-2026-4440", "in_binary": "vulnerable code in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/net", "severity": "Medium", "summary": "The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when processing certain inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content.", "url": "https://go.dev/cl/709876", "version": "v0.29.0" }, { "aliases": [ "CVE-2025-58190" ], "ecosystem": "golang", "epss": { "cve": "CVE-2025-58190", "percentile": 0.45427, "score": 0.0054 }, "fix_state": "fixed", "fixed_in": [ "0.45.0" ], "id": "GO-2026-4441", "in_binary": "vulnerable code in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/net", "severity": "Medium", "summary": "The html.Parse function in golang.org/x/net/html has an infinite parsing loop when processing certain inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content.", "url": "https://groups.google.com/g/golang-announce/c/jnQcOYpiR2c", "version": "v0.29.0" }, { "aliases": [ "CVE-2026-42506" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-42506", "percentile": 0.14566, "score": 0.00235 }, "fix_state": "fixed", "fixed_in": [ "0.55.0" ], "id": "GO-2026-5025", "in_binary": "vulnerable code in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/net", "severity": "Medium", "summary": "Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.", "url": "https://go.dev/issue/79571", "version": "v0.29.0" }, { "aliases": [ "CVE-2026-42502" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-42502", "percentile": 0.12982, "score": 0.00223 }, "fix_state": "fixed", "fixed_in": [ "0.55.0" ], "id": "GO-2026-5027", "in_binary": "vulnerable code in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/net", "severity": "Medium", "summary": "Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.", "url": "https://go.dev/issue/79572", "version": "v0.29.0" }, { "aliases": [ "CVE-2026-25681" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-25681", "percentile": 0.12983, "score": 0.00223 }, "fix_state": "fixed", "fixed_in": [ "0.55.0" ], "id": "GO-2026-5029", "in_binary": "vulnerable code in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/net", "severity": "Medium", "summary": "Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.", "url": "https://go.dev/issue/79574", "version": "v0.29.0" }, { "aliases": [ "CVE-2026-27136" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-27136", "percentile": 0.12983, "score": 0.00223 }, "fix_state": "fixed", "fixed_in": [ "0.55.0" ], "id": "GO-2026-5030", "in_binary": "vulnerable code in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/net", "severity": "Medium", "summary": "Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.", "url": "https://go.dev/issue/79575", "version": "v0.29.0" }, { "aliases": [ "CVE-2026-39824" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-39824", "percentile": 0.01457, "score": 0.00114 }, "fix_state": "fixed", "fixed_in": [ "0.44.0" ], "id": "GO-2026-5024", "in_binary": "vulnerable code not in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/sys", "severity": "Low", "summary": "NewNTUnicodeString does not check for string length overflow. When provided with a string that overflows the maximum size of a NTUnicodeString (a 16-bit number of bytes), it returns a truncated string rather than an error.", "url": "https://go.dev/issue/78916", "version": "v0.25.0" }, { "aliases": [ "CVE-2026-78661" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-78661", "percentile": 0.08063, "score": 0.00185 }, "fix_state": "fixed", "fixed_in": [ "0.62.0" ], "id": "GO-2026-6860", "in_binary": "vulnerable code in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/net", "severity": "Unknown", "summary": "When coalescing adjacent text nodes in addText and fosterParent, appending to an existing TextNode's Data via string concatenation (n.Data += text) reallocated and copied the accumulated string on every token. Inputs containing many short text runs separated by ignored end tags (such as \"a\") cau", "url": "https://go.dev/cl/849365", "version": "v0.29.0" }, { "aliases": [ "CVE-2026-97045" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-97045", "percentile": 0.10117, "score": 0.00202 }, "fix_state": "fixed", "fixed_in": [ "0.62.0" ], "id": "GO-2026-6866", "in_binary": "vulnerable code in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/net", "severity": "Unknown", "summary": "In childTextNodesAreLiteral, walking up the tree previously stopped at the nearest foreign ancestor once an HTML integration point was found. However, that integration point may itself be a descendant of an element that was foster-parented into a foreign namespace (such as or f", "url": "https://go.dev/cl/855121", "version": "v0.29.0" } ], "workflow_audit": { "files": 2, "findings": [ { "confidence": "High", "description": "unpinned action reference", "file": ".github/workflows/go-quality.yml", "line": 7, "note": "this step", "rule": "unpinned-uses", "severity": "High", "url": "https://docs.zizmor.sh/audits/#unpinned-uses" }, { "confidence": "High", "description": "unpinned action reference", "file": ".github/workflows/go-quality.yml", "line": 9, "note": "this step", "rule": "unpinned-uses", "severity": "High", "url": "https://docs.zizmor.sh/audits/#unpinned-uses" }, { "confidence": "High", "description": "unpinned action reference", "file": ".github/workflows/release.yml", "line": 15, "note": "this step", "rule": "unpinned-uses", "severity": "High", "url": "https://docs.zizmor.sh/audits/#unpinned-uses" }, { "confidence": "High", "description": "unpinned action reference", "file": ".github/workflows/release.yml", "line": 19, "note": "this step", "rule": "unpinned-uses", "severity": "High", "url": "https://docs.zizmor.sh/audits/#unpinned-uses" }, { "confidence": "High", "description": "unpinned action reference", "file": ".github/workflows/release.yml", "line": 25, "note": "this step", "rule": "unpinned-uses", "severity": "High", "url": "https://docs.zizmor.sh/audits/#unpinned-uses" }, { "confidence": "High", "description": "unpinned action reference", "file": ".github/workflows/release.yml", "line": 31, "note": "this step", "rule": "unpinned-uses", "severity": "High", "url": "https://docs.zizmor.sh/audits/#unpinned-uses" }, { "confidence": "High", "description": "unpinned action reference", "file": ".github/workflows/release.yml", "line": 35, "note": "this step", "rule": "unpinned-uses", "severity": "High", "url": "https://docs.zizmor.sh/audits/#unpinned-uses" }, { "confidence": "Medium", "description": "overly broad permissions", "file": ".github/workflows/go-quality.yml", "line": 4, "note": "this job", "rule": "excessive-permissions", "severity": "Medium", "url": "https://docs.zizmor.sh/audits/#excessive-permissions" } ] } }, "updated": "2026-11-02" }