Generated by govulncheck. Only vulnerable functions reachable from the application are reported; dependency-only module and package findings are excluded.
Go version: go1.27.0
Scan level: symbol
| Vuln ID | Package | Function | Version | Fixed | Aliases | Summary |
|---|---|---|---|---|---|---|
| GO-2026-6599 | html/template | *Template.Execute, *Template.ExecuteTemplate | v1.27.0 | v1.27.2 | CVE-2026-94448 | Reset context tracking on consecutive template expressions in html/template |
| GO-2026-6600 | html/template | *Template.Execute, *Template.ExecuteTemplate | v1.27.0 | v1.27.2 | CVE-2026-97030 | Recognize yield as regexp preceder keyword in html/template |
| GO-2026-6603 | golang.org/x/net/http2, net/http/internal/http2 | *Framer.ReadFrame, *Framer.ReadFrameForHeader, *Framer.ReadFrameHeader, *Framer.WriteContinuation, *Framer.WriteGoAway, *Framer.WriteHeaders, *Framer.WritePing, *Framer.WriteRSTStream, *Framer.WriteSettings, *Framer.WriteSettingsAck, *Framer.WriteWindowUpdate, *Server.GracefulShutdown, *Server.ServeConn, *SettingsFrame.ForeachSetting, *Transport.AddConn, *Transport.CloseIdleConnections, *Transport.NewClientConn, *Transport.RoundTrip, *bufferedWriterTimeoutWriter.Write, *gzipReader.Close, *gzipReader.Read, *requestBody.Close, *responseWriter.Write, *responseWriter.WriteHeader, *responseWriter.WriteString, ConfigureTransports, ConnectionError.Error, ErrCode.String, FrameHeader.String, FrameType.String, NetHTTPClientConn.Close, NetHTTPClientConn.RoundTrip, SettingID.String, StreamError.Error, chunkWriter.Write, connError.Error, duplicatePseudoHeaderError.Error, headerFieldNameError.Error, headerFieldValueError.Error, pseudoHeaderError.Error, stickyErrWriter.Write, transportResponseBody.Close, transportResponseBody.Read | v0.59.0, v1.27.0 | v0.60.0, v1.27.2 | CVE-2026-78659 | HTTP/2 server memory exhaustion due to Trailer headers in net/http |
| GO-2026-6605 | net/http, net/http/httputil | *Client.Do, *Client.PostForm, *Transport.CloseIdleConnections, *Transport.RoundTrip, DumpRequestOut | v1.27.0 | v1.27.2 | CVE-2026-56866 | HTTP/1 client connection desynchronization after CONNECT rejection in net/http |
| GO-2026-6607 | crypto/tls | *Conn.Handshake, *Conn.HandshakeContext, *Conn.Read, *Conn.Write, *Dialer.DialContext | v1.27.0 | v1.27.2 | CVE-2026-97031 | Reject malformed ECH outer extension references in crypto/tls |
| GO-2026-6608 | mime/multipart, net/textproto | *Reader.ReadForm, *Reader.ReadMIMEHeader | v1.27.0 | v1.27.2 | CVE-2026-94440 | Memory limit bypass when parsing MIME headers in net/textproto, mime/multipart |
| GO-2026-6610 | golang.org/x/net/http2, net/http/internal/http2 | *Transport.AddConn, *Transport.NewClientConn, *Transport.RoundTrip | v0.59.0, v1.27.0 | v0.60.0, v1.27.2 | CVE-2026-78660 | HTTP/2 transport accepts malformed framing-related headers in net/http |
| GO-2026-6611 | golang.org/x/net/http2, net/http/internal/http2 | *Framer.ReadFrame, *Framer.ReadFrameForHeader, *Framer.ReadFrameHeader, *Framer.WriteContinuation, *Framer.WriteGoAway, *Framer.WriteHeaders, *Framer.WritePing, *Framer.WriteRSTStream, *Framer.WriteSettings, *Framer.WriteSettingsAck, *Framer.WriteWindowUpdate, *Server.GracefulShutdown, *Server.ServeConn, *SettingsFrame.ForeachSetting, *Transport.AddConn, *Transport.CloseIdleConnections, *Transport.NewClientConn, *Transport.RoundTrip, *bufferedWriterTimeoutWriter.Write, *gzipReader.Close, *gzipReader.Read, *requestBody.Close, *responseWriter.Write, *responseWriter.WriteHeader, *responseWriter.WriteString, ConfigureTransports, ConnectionError.Error, ErrCode.String, FrameHeader.String, FrameType.String, NetHTTPClientConn.Close, NetHTTPClientConn.RoundTrip, SettingID.String, StreamError.Error, chunkWriter.Write, connError.Error, duplicatePseudoHeaderError.Error, headerFieldNameError.Error, headerFieldValueError.Error, pseudoHeaderError.Error, stickyErrWriter.Write, transportResponseBody.Close, transportResponseBody.Read | v0.59.0, v1.27.0 | v0.60.0, v1.27.2 | CVE-2026-78669 | Excessive CPU consumption from repeated initial window changes in net/http |
| GO-2026-6612 | golang.org/x/net/http2, net/http/internal/http2 | *Framer.ReadFrame, *Framer.ReadFrameForHeader, *Framer.ReadFrameHeader, *Framer.WriteContinuation, *Framer.WriteGoAway, *Framer.WriteHeaders, *Framer.WritePing, *Framer.WriteRSTStream, *Framer.WriteSettings, *Framer.WriteSettingsAck, *Framer.WriteWindowUpdate, *Server.ServeConn, *SettingsFrame.ForeachSetting, *Transport.RoundTrip, *requestBody.Close, *requestBody.Read, ConfigureTransports, ConnectionError.Error, ErrCode.String, FrameHeader.String, FrameType.String, SettingID.String, StreamError.Error, connError.Error, duplicatePseudoHeaderError.Error, headerFieldNameError.Error, headerFieldValueError.Error, pseudoHeaderError.Error | v0.59.0, v1.27.0 | v0.60.0, v1.27.2 | CVE-2026-78663 | Double flow control refund on HTTP/2 server streams in net/http |
| GO-2026-6613 | net/http | *Client.Do, *Client.PostForm, *Request.AddCookie, *Request.SetBasicAuth, *Request.Write, *Response.Write, *ServeMux.HandleFunc, *Server.Serve, *Transport.Clone, *Transport.CloseIdleConnections, *Transport.RoundTrip, *body.Close, *body.Read, *bodyEOFSignal.Close, *bodyEOFSignal.Read, *cancelTimerBody.Close, *cancelTimerBody.Read, *chunkWriter.Write, *connReader.Read, *expectContinueReader.Close, *expectContinueReader.Read, *gzipReader.Close, *gzipReader.Read, *loggingConn.Read, *loggingConn.Write, *maxBytesReader.Close, *maxBytesReader.Read, *onceCloseListener.Close, *persistConn.Read, *readTrackingBody.Close, *readTrackingBody.Read, *readWriteCloserBody.Read, *response.ReadFrom, *response.Write, *response.WriteHeader, *response.WriteString, *timeoutWriter.Write, *timeoutWriter.WriteHeader, CanonicalHeaderKey, Handle, HandleFunc, Header.Add, Header.Del, Header.Get, Header.Set, Header.Values, Header.WriteSubset, ListenAndServe, NewRequest, NewRequestWithContext, ProxyFromEnvironment, ReadRequest, ReadResponse, bodyLocked.Read, bufioFlushWriter.Write, checkConnErrorWriter.Write, persistConnWriter.ReadFrom, persistConnWriter.Write, transportReadFromServerError.Error | v1.27.0 | v1.27.2 | CVE-2026-94439 | HTTP/1 server connection desynchronization after 2xx CONNECT response in net/http |
| GO-2026-6617 | golang.org/x/net/http2, net/http/internal/http2 | *Framer.ReadFrame, *Framer.ReadFrameForHeader, *Framer.ReadFrameHeader, *Framer.WriteContinuation, *Framer.WriteGoAway, *Framer.WriteHeaders, *Framer.WritePing, *Framer.WriteRSTStream, *Framer.WriteSettings, *Framer.WriteSettingsAck, *Framer.WriteWindowUpdate, *Server.GracefulShutdown, *Server.ServeConn, *SettingsFrame.ForeachSetting, *Transport.AddConn, *Transport.CloseIdleConnections, *Transport.NewClientConn, *Transport.RoundTrip, *bufferedWriterTimeoutWriter.Write, *gzipReader.Close, *gzipReader.Read, *requestBody.Close, *responseWriter.Write, *responseWriter.WriteHeader, *responseWriter.WriteString, ConfigureTransports, ConnectionError.Error, ErrCode.String, FrameHeader.String, FrameType.String, NetHTTPClientConn.Close, NetHTTPClientConn.RoundTrip, SettingID.String, StreamError.Error, chunkWriter.Write, connError.Error, duplicatePseudoHeaderError.Error, headerFieldNameError.Error, headerFieldValueError.Error, pseudoHeaderError.Error, stickyErrWriter.Write, transportResponseBody.Close, transportResponseBody.Read | v0.59.0, v1.27.0 | v0.60.0, v1.27.2 | CVE-2026-97032 | HTTP/2 server crash due to HPACK encoder race in net/http |
Go version: go1.27.2
Scan level: symbol
No known reachable vulnerable functions found.