Go standard library

Calling Parse on a "// +build" build tag line with deeply nested expressions can cause a panic due to stack exhaustion.

Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion. This is a follow-up to CVE-202…

Calling any of the Parse functions on Go source code which contains deeply nested literals can cause a panic due to stack exhaustion.

The net/http HTTP/1.1 client mishandled the case where a server responds to a request with an "Expect: 100-continue" header with a non-informational …

The archive/zip package's handling of certain types of invalid zip files differs from the behavior of most zip implementations. This misalignment cou…

The various Is methods (IsPrivate, IsLoopback, etc) did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which woul…

A malformed DNS message in response to a query can cause the Lookup functions to get stuck in an infinite loop.

An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining …

If errors returned from MarshalJSON methods contain user controlled data, they may be used to break the contextual auto-escaping behavior of the html…

The ParseAddressList function incorrectly handles comments (text within parentheses) within display names. Since this is a misalignment with conformi…