# Golang Go


- [CVE-2020-0601](https://insights.sbomify.com/CVE-2020-0601/): Microsoft Windows CryptoAPI Spoofing (high 8.1, exploited in the wild)
- [CVE-2023-44487](https://insights.sbomify.com/CVE-2023-44487/): HTTP/2 Rapid Reset Attack (high 7.5, exploited in the wild)
- [CVE-2026-27143](https://insights.sbomify.com/CVE-2026-27143/): Missing bound checks can lead to memory corruption in safe Go in cmd/compile (critical 9.8)
- [CVE-2024-24790](https://insights.sbomify.com/CVE-2024-24790/): Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses in net/netip (critical 9.8)
- [CVE-2023-39320](https://insights.sbomify.com/CVE-2023-39320/): Arbitrary code execution via go.mod toolchain directive in cmd/go (critical 9.8)
- [CVE-2023-29402](https://insights.sbomify.com/CVE-2023-29402/): Code injection via go command with cgo in cmd/go (critical 9.8)
- [CVE-2023-29404](https://insights.sbomify.com/CVE-2023-29404/): Improper handling of non-optional LDFLAGS in go command with cgo in cmd/go (critical 9.8)
- [CVE-2023-29405](https://insights.sbomify.com/CVE-2023-29405/): Improper sanitization of LDFLAGS with embedded spaces in go command with cgo in cmd/go (critical 9.8)
- [CVE-2023-24540](https://insights.sbomify.com/CVE-2023-24540/): Improper handling of JavaScript whitespace in html/template (critical 9.8)
- [CVE-2023-24538](https://insights.sbomify.com/CVE-2023-24538/): Backticks not treated as string delimiters in html/template (critical 9.8)
- [CVE-2021-38297](https://insights.sbomify.com/CVE-2021-38297/): Memory corruption in n/a (critical 9.8)
- [CVE-2012-2666](https://insights.sbomify.com/CVE-2012-2666/): Other in go/golang (critical 9.8)

---
From sbomify Insights: https://insights.sbomify.com/products/golang/go/