- Products & ServicesProducts & Services
- SolutionsSolutions
- PricingPricing
- CompanyCompany
- ResourcesResources
en
en
As of 10/21/2026, Go standard library recorded 20 security vulnerabilities in the last 90 days across 13 products, including 15 rated High or above and 0 known exploited vulnerabilities (KEV) that should be prioritized for immediate remediation.
Over the last 90 days, net/http had the most security vulnerabilities in the Go standard library ecosystem, with 9 vulnerabilities—approximately 45% of the provider's total vulnerabilities during this period.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2026-111943Distrust compromised intermediate certificates in crypto/x509CVE-2026-97032HTTP/2 server crash due to HPACK encoder race in net/httpCVE-2026-94439HTTP/1 server connection desynchronization after 2xx CONNECT response in net/httpCVE-2026-78663Double flow control refund on HTTP/2 server streams in net/httpCVE-2026-78669Excessive CPU consumption from repeated initial window changes in net/http| Vulnerability | Exploitation status | Fix | Affected product | Published | Severity |
|---|---|---|---|---|---|
CVE-2026-111943Distrust compromised intermediate certificates in crypto/x509 | Exploitation statusNot confirmed | FixYes |
| Published10/21/2026 |
| SeverityUnknown |
CVE-2026-97032HTTP/2 server crash due to HPACK encoder race in net/http | Exploitation statusNot exploited | FixYes | Affected productnet/http | Published10/08/2026 | SeverityHigh |
|---|
CVE-2026-94439HTTP/1 server connection desynchronization after 2xx CONNECT response in net/http | Exploitation statusNot exploited | FixYes | Affected productnet/http | Published10/08/2026 | SeverityHigh |
|---|
CVE-2026-78663Double flow control refund on HTTP/2 server streams in net/http | Exploitation statusNot exploited | FixYes | Affected productnet/http | Published10/08/2026 | SeverityCritical |
|---|
CVE-2026-78669Excessive CPU consumption from repeated initial window changes in net/http | Exploitation statusNot exploited | FixYes | Affected productnet/http | Published10/08/2026 | SeverityHigh |
|---|
CVE-2026-78660HTTP/2 transport accepts malformed framing-related headers in net/http | Exploitation statusNot exploited | FixYes | Affected productnet/http | Published10/08/2026 | SeverityHigh |
|---|
CVE-2026-78667Lack of limit on size of parsed Range headers in net/http | Exploitation statusNot exploited | FixYes | Affected productnet/http | Published10/08/2026 | SeverityHigh |
|---|
CVE-2026-94440Memory limit bypass when parsing MIME headers in net/textproto, mime/multipart | Exploitation statusNot exploited | FixYes | Affected productnet/textproto | Published10/08/2026 | SeverityHigh |
|---|
CVE-2026-97031Reject malformed ECH outer extension references in crypto/tls | Exploitation statusNot exploited | FixYes | Affected productcrypto/tls | Published10/08/2026 | SeverityHigh |
|---|
CVE-2026-56866HTTP/1 client connection desynchronization after CONNECT rejection in net/http | Exploitation statusNot exploited | FixYes | Affected productnet/http | Published10/08/2026 | SeverityHigh |
|---|
135 Results | Page 1 of 14