Generated by govulncheck. Only vulnerable functions reachable from the application are reported; dependency-only module and package findings are excluded.
Go version: go1.26.1
Scan level: symbol
| Vuln ID | Package | Function | Version | Fixed | Aliases | Summary |
|---|---|---|---|---|---|---|
| GO-2026-4865 | html/template | *Error.Error, *Template.Execute, *Template.ExecuteTemplate, *Template.Funcs, *Template.Parse, context.String | v1.26.1 | v1.26.2 | CVE-2026-32289 | JsBraceDepth Context Tracking Bugs (XSS) in html/template |
| GO-2026-4866 | crypto/x509 | *Certificate.Verify | v1.26.1 | v1.26.2 | CVE-2026-33810 | Case-sensitive excludedSubtrees name constraints cause Auth Bypass in crypto/x509 |
| GO-2026-4870 | crypto/tls | *Conn.Handshake, *Conn.HandshakeContext, *Conn.Read, *Conn.Write, *Dialer.DialContext | v1.26.1 | v1.26.2 | CVE-2026-32283 | Unauthenticated TLS 1.3 KeyUpdate record can cause persistent connection retention and DoS in crypto/tls |
| GO-2026-4918 | golang.org/x/net/http2, net/http | *Client.Do, *Client.PostForm, *Transport.CloseIdleConnections, *Transport.NewClientConn, *Transport.RoundTrip, *unencryptedTransport.RoundTrip, noDialH2RoundTripper.NewClientConn, noDialH2RoundTripper.RoundTrip | v0.52.0, v1.26.1 | v0.53.0, v1.26.3 | CVE-2026-33814 | Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net |
| GO-2026-4946 | crypto/x509 | *Certificate.Verify | v1.26.1 | v1.26.2 | CVE-2026-32281 | Inefficient policy validation in crypto/x509 |
| GO-2026-4947 | crypto/x509 | *Certificate.Verify | v1.26.1 | v1.26.2 | CVE-2026-32280 | Unexpected work during chain building in crypto/x509 |
| GO-2026-4971 | net | *Dialer.Dial, *Dialer.DialContext, *Resolver.LookupHost, *Resolver.LookupSRV, *Resolver.LookupTXT, DialTimeout, Listen, LookupHost, LookupIP, LookupSRV, ResolveTCPAddr, ResolveUDPAddr | v1.26.1 | v1.26.3 | CVE-2026-39836 | Panic in Dial and LookupPort when handling NUL byte on Windows in net |
| GO-2026-4980 | html/template | *Template.Execute, *Template.ExecuteTemplate | v1.26.1 | v1.26.3 | CVE-2026-39826 | Escaper bypass leads to XSS in html/template |
| GO-2026-4982 | html/template | *Template.Execute, *Template.ExecuteTemplate | v1.26.1 | v1.26.3 | CVE-2026-39823 | Bypass of meta content URL escaping causes XSS in html/template |
| GO-2026-5025 | golang.org/x/net/html | Parse | v0.52.0 | v0.55.0 | CVE-2026-42506 | Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html |
| GO-2026-5026 | golang.org/x/net/idna, net/http | *Client.Do, *Client.PostForm, *Profile.ToASCII, *Profile.ToUnicode, *Transport.CloseIdleConnections, *Transport.RoundTrip, ToASCII | v0.52.0, v1.26.1 | v0.55.0, v1.26.6 | CVE-2026-39821 | Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna |
| GO-2026-5027 | golang.org/x/net/html | Parse | v0.52.0 | v0.55.0 | CVE-2026-42502 | Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html |
| GO-2026-5028 | golang.org/x/net/html | Parse | v0.52.0 | v0.55.0 | CVE-2026-25680 | Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html |
| GO-2026-5029 | golang.org/x/net/html | Parse | v0.52.0 | v0.55.0 | CVE-2026-25681 | Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html |
| GO-2026-5030 | golang.org/x/net/html | Parse | v0.52.0 | v0.55.0 | CVE-2026-27136 | Invoking duplicate attributes can cause XSS in golang.org/x/net/html |
| GO-2026-5037 | crypto/x509 | *Certificate.Verify, *Certificate.VerifyHostname, HostnameError.Error | v1.26.1 | v1.26.4 | CVE-2026-27145 | Inefficient candidate hostname parsing in crypto/x509 |
| GO-2026-5038 | mime | *WordDecoder.DecodeHeader | v1.26.1 | v1.26.4 | CVE-2026-42504 | Quadratic complexity in WordDecoder.DecodeHeader in mime |
| GO-2026-5039 | net/textproto | *Reader.ReadMIMEHeader | v1.26.1 | v1.26.4 | CVE-2026-42507 | Arbitrary inputs are included in errors without any escaping in net/textproto |
| GO-2026-5738 | github.com/projectcontour/contour/apis/projectcontour/v1 | *HTTPProxy.DeepCopyObject, *HTTPProxyList.DeepCopyObject, *TLSCertificateDelegation.DeepCopyObject, *TLSCertificateDelegationList.DeepCopyObject, AddKnownTypes, init | v1.33.3 | v1.33.4 | CVE-2026-41246, GHSA-x4mj-7f9g-29h4 | Contour has Lua code injection via Cookie Path Rewrite Policy in github.com/projectcontour/contour |
| GO-2026-5856 | crypto/tls | *Conn.Handshake, *Conn.HandshakeContext, *Conn.Read, *Conn.Write, *Dialer.DialContext | v1.26.1 | v1.26.5 | CVE-2026-42505 | Invoking Encrypted Client Hello privacy leak in crypto/tls |
| GO-2026-5889 | github.com/projectcontour/contour/apis/projectcontour/v1 | *HTTPProxy.DeepCopyObject, *HTTPProxyList.DeepCopyObject, *TLSCertificateDelegation.DeepCopyObject, *TLSCertificateDelegationList.DeepCopyObject, AddKnownTypes, init | v1.33.3 | v1.33.5 | CVE-2026-50149, GHSA-g3xr-5w5j-w4q4 | Contour has Improper JWT Verification for Non-SNI Requests on Virtual Hosts with Fallback Certificate Enabled in github.com/projectcontour/contour |
| GO-2026-5970 | golang.org/x/text/unicode/norm | Form.Bytes, Form.IsNormalString, Form.QuickSpan, Form.String | v0.35.0 | v0.39.0 | CVE-2026-56852 | Infinite loop on invalid input in golang.org/x/text |
| GO-2026-5972 | encoding/asn1 | Unmarshal | v1.26.1 | v1.26.6 | CVE-2026-33818 | Enforce maximum recursion depth in encoding/asn1 |
| GO-2026-6061 | google.golang.org/grpc/internal/transport | *ClientStream.Close, *ClientStream.Header, *ClientStream.Read, *ClientStream.RecvCompress, *ClientStream.TrailersOnly, *ClientStream.Write, *Stream.ReadMessageHeader, *http2Client.Close, *http2Client.GracefulClose, *http2Client.NewStream, NewHTTP2Client | v1.79.3 | v1.82.1 | GHSA-hrxh-6v49-42gf | Vulnerabilities in the xDS RBAC authorization engine and the HTTP/2 transport server implementation in google.golang.org/grpc |
| GO-2026-6088 | encoding/xml | *Decoder.Decode, *Decoder.Skip, *Decoder.Token, Unmarshal | v1.26.1 | v1.26.6 | CVE-2026-56859 | Add recursion depth guard during decode in encoding/xml |
| GO-2026-6089 | net/http | *Server.Serve, ListenAndServe | v1.26.1 | v1.26.6 | CVE-2026-56853 | Apply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/http |
| GO-2026-6090 | crypto/tls | *Conn.Handshake, *Conn.HandshakeContext, *Conn.Read, *Conn.Write, *Dialer.DialContext | v1.26.1 | v1.26.6 | CVE-2026-56862 | Limit handshake messages we are willing to accept post-handshake in crypto/tls |
| GO-2026-6091 | html/template | *Template.Execute, *Template.ExecuteTemplate | v1.26.1 | v1.26.6 | CVE-2026-56858 | Fix Javascript regexp context tracking in html/template |
| GO-2026-6218 | net/url | *URL.Parse, *URL.ResolveReference | v1.26.1 | v1.26.6 | CVE-2026-56860 | Avoid quadratic complexity in resolvePath in net/url |
Go version: go1.26.6
Scan level: symbol
No known reachable vulnerable functions found.