# Go Advisories.

Every Go Advisory we hold (Go modules), newest first.

## Records, newest first

- [SSRF and credential leak via unvalidated Location header in github.com/mark3labs/mcp-go](https://agentprime.io/advisories/GO-2026-6911.md)
  `GO-2026-6911` · Go `github.com/mark3labs/mcp-go`: affected `*`, no fixed version yet · No CVSS score · Not analysed yet · Published 5 Nov 2026
- [Nil-pointer panic in validateAssertion and namespace-blind Subject.NameID in github.com/crewjam/saml](https://agentprime.io/advisories/GO-2026-6909.md)
  `GO-2026-6909` · Go `github.com/crewjam/saml`: affected `*`, no fixed version yet · No CVSS score · Not analysed yet · Published 5 Nov 2026
- [Panic on negative member size in Reader.Read in github.com/blakesmith/ar](https://agentprime.io/advisories/GO-2026-6905.md)
  `GO-2026-6905` · Go `github.com/blakesmith/ar`: affected `*`, no fixed version yet · No CVSS score · Not analysed yet · Published 5 Nov 2026
- [Event type spoofing via UntrustedType in github.com/google/go-eventlog](https://agentprime.io/advisories/GO-2026-6893.md)
  `GO-2026-6893` · Go `github.com/google/go-eventlog`: affected `<0.0.3-0.20261001001437-1991f15bc4b0`, fixed in `0.0.3-0.20261001001437-1991f15bc4b0` · No CVSS score · Not analysed yet · Published 5 Nov 2026
- [Excessive memory allocation when decompressing crafted streams in github.com/andybalholm/brotli](https://agentprime.io/advisories/GHSA-9v8h-qqgm-4m35.md)
  `GHSA-9v8h-qqgm-4m35`, `BIT-brotli-2026-111497`, `BIT-dotnet-2026-111497`, `BIT-dotnet-sdk-2026-111497`, `BIT-node-2026-111497`, `BIT-node-min-2026-111497`, `BIT-powershell-2026-111497`, `CVE-2026-111497`, `GHSA-c9gr-gmg4-2vqv`, `GO-2026-6888`, `PYSEC-2026-4322`, `PYSEC-2026-4323` · Go `github.com/andybalholm/brotli`: affected `<1.2.7`, fixed in `1.2.7` · CVSS 9.2 Critical · Critical (KEV, CVSS 9+, CVSS 7+ and EPSS) · In CISA KEV · EPSS 0.83 · Not analysed yet · Published 5 Nov 2026 · Tags: Memory corruption, CWE-252
- [kaniko can send the build's Azure (Entra ID) access token to lookalike ACR registry hosts](https://agentprime.io/advisories/GHSA-5q7h-w9jf-cx97.md)
  `GHSA-5q7h-w9jf-cx97`, `CVE-2026-105769`, `GO-2026-6902` · Go `github.com/chainguard-dev/kaniko`: affected `<1.25.20`, fixed in `1.25.20` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Nov 2026 · Tags: Hard-coded credentials, CWE-346
- [lxd allows Cross-guest volume hijack via DevLXD device patch](https://agentprime.io/advisories/GHSA-hhf9-qw4v-72xp.md)
  `GHSA-hhf9-qw4v-72xp`, `CVE-2026-12411`, `GO-2026-6917` · Go `github.com/canonical/lxd`: affected `>=0.0.0-20250721152936-fe86ceb2c3fa, <0.0.0-20260626085133-7cb96ac80a6d`, fixed in `0.0.0-20260626085133-7cb96ac80a6d` · CVSS 8.4 High · Not analysed yet · Published 5 Nov 2026 · Tags: Broken access control
- [Arc: DuckDB I/O aliases bypass database RBAC after CVE-2026-47735](https://agentprime.io/advisories/GHSA-93cm-2v4m-c56c.md)
  `GHSA-93cm-2v4m-c56c`, `CVE-2026-55098`, `GO-2026-6913` · Go `github.com/basekick-labs/arc`: affected `<0.0.0-20260610131716-5dc8f53b70a3`, fixed in `0.0.0-20260610131716-5dc8f53b70a3` · CVSS 6.5 Medium · Not analysed yet · Published 4 Nov 2026 · Tags: Information disclosure, Broken access control
- [praktor: Path traversal in Telegram file uploads allows writing outside the agent workspace uploads/ directory (stored instruction injection)](https://agentprime.io/advisories/GHSA-48v2-6jcm-fc99.md)
  `GHSA-48v2-6jcm-fc99`, `CVE-2026-62331`, `GO-2026-6908` · Go `github.com/mtzanidakis/praktor`: affected `<0.9.1`, fixed in `0.9.1` · CVSS 8.2 High · Not analysed yet · Published 3 Nov 2026 · Tags: Path traversal
- [Netfoil doesn't decrement TTL](https://agentprime.io/advisories/GHSA-9ppr-wfw9-xvr2.md)
  `GHSA-9ppr-wfw9-xvr2`, `GO-2026-6906` · Go `github.com/tinfoil-factory/netfoil`: affected `>=0.3.0, <0.6.1`, fixed in `0.6.1` · No CVSS score · Not analysed yet · Published 3 Nov 2026 · Tags: CWE-672
- [Arc has unauthenticated application log disclosure via \`/api/v1/logs\`](https://agentprime.io/advisories/GHSA-m3qr-fvp4-78xj.md)
  `GHSA-m3qr-fvp4-78xj`, `GO-2026-6907` · Go `github.com/basekick-labs/arc`: affected `<0.0.0-20260615165136-bb7d9761ad98`, fixed in `0.0.0-20260615165136-bb7d9761ad98` · No CVSS score · Not analysed yet · Published 3 Nov 2026 · Tags: Information disclosure, Authentication bypass
- [Kubeflow Pipelines: Pipeline archive upload allows decompression bomb to exhaust server memory](https://agentprime.io/advisories/GHSA-8fmv-6rg5-5924.md)
  `GHSA-8fmv-6rg5-5924`, `CVE-2026-118761`, `GO-2026-6899` · Go `github.com/kubeflow/pipelines`: affected `<0.0.0-20260831164314-ba9ae72cc860`, fixed in `0.0.0-20260831164314-ba9ae72cc860` · CVSS 7.5 High · Not analysed yet · Published 30 Oct 2026 · Tags: CWE-409
- [Kubeflow Pipelines: Run-log endpoint permits unauthorized access to pod logs](https://agentprime.io/advisories/GHSA-wg5q-x4j9-qm54.md)
  `GHSA-wg5q-x4j9-qm54`, `CVE-2026-118759`, `GO-2026-6900` · Go `github.com/kubeflow/pipelines`: affected `<0.0.0-20260904182349-be4723e33727`, fixed in `0.0.0-20260904182349-be4723e33727` · CVSS 7.5 High · Not analysed yet · Published 30 Oct 2026 · Tags: Information disclosure, Broken access control
- [Fiber: CORS wildcard origins matched without a dot boundary, allowing credentialed cross-origin reads](https://agentprime.io/advisories/GHSA-g5jq-qmqr-qrwf.md)
  `GHSA-g5jq-qmqr-qrwf`, `CVE-2026-119285`, `GO-2026-6896` · Go `github.com/gofiber/fiber/v2`: affected `>=2.52.1, <2.52.3`, fixed in `2.52.3` · CVSS 5.9 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: CWE-346, CWE-942
- [imgproxy has integer overflow in imgproxy ICO loader that causes denial of service and may permit remote code execution](https://agentprime.io/advisories/GHSA-hff9-5pqw-6w9f.md)
  `GHSA-hff9-5pqw-6w9f`, `GO-2026-6897` · Go `github.com/imgproxy/imgproxy` and 2 more: affected `>=4.0.0, <4.0.16`, fixed in `4.0.16` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Oct 2026 · Tags: Memory corruption
- [imgproxy has out-of-bounds heap read/write in ICO loader BMP header reconstruction that allows unauthenticated remote worker crash](https://agentprime.io/advisories/GHSA-494m-4556-wf5p.md)
  `GHSA-494m-4556-wf5p`, `GO-2026-6895` · Go `github.com/imgproxy/imgproxy/v3`: affected `>=3.3.0, <4.0.17`, fixed in `4.0.17` · CVSS 7.5 High · Not analysed yet · Published 30 Oct 2026 · Tags: Memory corruption
- [imgproxy has unbounded memory allocation in ICO loader that allows unauthenticated memory-exhaustion DoS via crafted data_size field](https://agentprime.io/advisories/GHSA-mmq5-xm89-9pfg.md)
  `GHSA-mmq5-xm89-9pfg`, `GO-2026-6898` · Go `github.com/imgproxy/imgproxy/v3`: affected `>=3.3.0, <4.0.16`, fixed in `4.0.16` · CVSS 7.5 High · Not analysed yet · Published 30 Oct 2026 · Tags: Denial of service
- [anacrolix torrent has unbounded recursion in the bencode decoder that causes stack-overflow crash and CPU-exhaustion DoS](https://agentprime.io/advisories/GHSA-2wrx-84qj-4pcg.md)
  `GHSA-2wrx-84qj-4pcg`, `GO-2026-6894` · Go `github.com/anacrolix/torrent`: affected `<1.61.1-0.20260911233437-76452a2c8a2f`, fixed in `1.61.1-0.20260911233437-76452a2c8a2f` · CVSS 6.5 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Denial of service
- [charmbracelet/soft-serve: Race in \`SetPrivate\` leaves a private repository readable by unauthenticated users](https://agentprime.io/advisories/GHSA-f3fj-9625-rv3m.md)
  `GHSA-f3fj-9625-rv3m`, `GO-2026-6891` · Go `github.com/charmbracelet/soft-serve`: affected `>=0.6.0, <0.12.3`, fixed in `0.12.3` · CVSS 5.9 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Race condition
- [charmbracelet/soft-serve HTTP responses disclose the existence and names of private repositories](https://agentprime.io/advisories/GHSA-fgxm-5hvv-x4vh.md)
  `GHSA-fgxm-5hvv-x4vh`, `GO-2026-6892` · Go `github.com/charmbracelet/soft-serve`: affected `>=0.5.0, <0.12.3`, fixed in `0.12.3` · CVSS 5.3 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Information disclosure, Broken access control
- [cert-manager: Direct ACME Challenge resources can bypass Issuer DNS01 solver policy and use ClusterIssuer DNS credentials](https://agentprime.io/advisories/GHSA-8rvj-mm4h-c258.md)
  `GHSA-8rvj-mm4h-c258`, `BIT-cert-manager-2026-62290`, `CVE-2026-62290`, `GO-2026-6889` · Go `github.com/cert-manager/cert-manager`: affected `>=1.18.0, <1.19.6 || >=1.20.0-alpha.0, <1.20.3`, fixed in `1.19.6`, `1.20.3` · CVSS 7.3 High · Not analysed yet · Published 29 Oct 2026 · Tags: Broken access control
- [Daptin: ParseAcceptLanguage \`\_\` separator bypass enables >250x CPU amplification via Accept-Language header in LanguageMiddleware](https://agentprime.io/advisories/GHSA-rhj7-vh3v-mcq6.md)
  `GHSA-rhj7-vh3v-mcq6`, `CVE-2026-62160`, `GO-2026-6890` · Go `github.com/daptin/daptin`: affected `<=0.12.15`, no fixed version yet · CVSS 8.7 High · Not analysed yet · Published 29 Oct 2026 · Tags: Denial of service
- [knative.dev/pkg admission webhooks allow unbounded request-body memory exhaustion](https://agentprime.io/advisories/GHSA-2hw4-c9m4-f2fj.md)
  `GHSA-2hw4-c9m4-f2fj`, `CVE-2026-54462`, `GO-2026-6880` · Go `knative.dev/pkg`: affected `<0.0.0-20260531000007-52dbd5ece63f`, fixed in `0.0.0-20260531000007-52dbd5ece63f` · CVSS 6.5 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Denial of service
- [Go JOSE: Panics in JSON parsing](https://agentprime.io/advisories/GHSA-vvm8-gf78-28g4.md)
  `GHSA-vvm8-gf78-28g4`, `CVE-2026-116586` · Go `github.com/go-jose/go-jose/v3` and 1 more: affected `<=3.0.5`, no fixed version yet · CVSS 6.9 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Denial of service
- [Go JOSE: Panic during CBC-HMAC processing](https://agentprime.io/advisories/GHSA-4w3g-jfj2-cw2q.md)
  `GHSA-4w3g-jfj2-cw2q`, `CVE-2026-116585` · Go `github.com/go-jose/go-jose/v3` and 1 more: affected `<=3.0.5`, no fixed version yet · CVSS 6.9 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: CWE-129
- [Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers](https://agentprime.io/advisories/GHSA-2ffq-g2xg-c22p.md)
  `GHSA-2ffq-g2xg-c22p`, `CVE-2026-118657`, `GO-2026-6879` · Go `github.com/labstack/echo/v4` and 1 more: affected `<4.16.0`, fixed in `4.16.0` · CVSS 5.9 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: CWE-346
- [Echo static file middleware route protection bypass via encoded dot-dot traversal](https://agentprime.io/advisories/GHSA-3pmx-cf9f-34xr.md)
  `GHSA-3pmx-cf9f-34xr`, `CVE-2026-118654`, `GO-2026-6881` · Go `github.com/labstack/echo/v4` and 1 more: affected `<4.16.0`, fixed in `4.16.0` · CVSS 5.9 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Path traversal
- [Echo has a Static Middleware Double-Unescape Path Traversal](https://agentprime.io/advisories/GHSA-xwq5-6cqp-vx96.md)
  `GHSA-xwq5-6cqp-vx96`, `CVE-2026-118655`, `GO-2026-6885` · Go `github.com/labstack/echo/v4` and 1 more: affected `<4.15.3`, fixed in `4.15.3` · CVSS 5.9 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: CWE-174
- [Echo has Open Redirect via Control-Character Prefix Defeating sanitizeURI](https://agentprime.io/advisories/GHSA-v753-g4cw-jm48.md)
  `GHSA-v753-g4cw-jm48`, `CVE-2026-118656`, `GO-2026-6883` · Go `github.com/labstack/echo/v4` and 1 more: affected `<4.16.0`, fixed in `4.16.0` · CVSS 6.1 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Open redirect
- [Echo has Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-Proto](https://agentprime.io/advisories/GHSA-23wf-92cp-8pcj.md)
  `GHSA-23wf-92cp-8pcj`, `CVE-2026-118658`, `GO-2026-6878` · Go `github.com/labstack/echo/v4` and 1 more: affected `<4.15.2`, fixed in `4.15.2` · CVSS 4.7 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Open redirect
- [Echo's middleware.Static: \`%2F\`-encoded path bypasses route/group middleware guarding a statically-served path](https://agentprime.io/advisories/GHSA-375p-5qhx-8wq4.md)
  `GHSA-375p-5qhx-8wq4`, `CVE-2026-118650`, `GO-2026-6873` · Go `github.com/labstack/echo/v4` and 1 more: affected `<4.16.0`, fixed in `4.16.0` · CVSS 7.5 High · Not analysed yet · Published 28 Oct 2026 · Tags: Broken access control, CWE-177
- [Echo vulnerable to Reflected Cross-Site Scripting (XSS) via unsanitized JSONP callback in Context.JSONP / Context.JSONPBlob](https://agentprime.io/advisories/GHSA-h9g5-28mm-hx3g.md)
  `GHSA-h9g5-28mm-hx3g`, `CVE-2026-118652`, `GO-2026-6876` · Go `github.com/labstack/echo/v4` and 1 more: affected `<4.16.0`, fixed in `4.16.0` · CVSS 6.1 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Echo has Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration](https://agentprime.io/advisories/GHSA-246p-cpwv-v3jq.md)
  `GHSA-246p-cpwv-v3jq`, `CVE-2026-118653`, `GO-2026-6872` · Go `github.com/labstack/echo/v4` and 1 more: affected `>=4.0.0, <=4.16.2`, no fixed version yet · CVSS 5.3 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Authentication bypass
- [Echo has CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method](https://agentprime.io/advisories/GHSA-r7w9-592q-9vg4.md)
  `GHSA-r7w9-592q-9vg4`, `CVE-2026-118266`, `GO-2026-6877` · Go `github.com/labstack/echo/v4` and 1 more: affected `<4.16.0`, fixed in `4.16.0` · CVSS 5.3 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Cross-site request forgery (CSRF)
- [Echo: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default](https://agentprime.io/advisories/GHSA-99jh-6h7p-pp36.md)
  `GHSA-99jh-6h7p-pp36`, `CVE-2026-118651`, `GO-2026-6875` · Go `github.com/labstack/echo/v4` and 1 more: affected `>=4.0.0, <=4.16.2`, no fixed version yet · CVSS 5.3 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: CWE-346
- [Caddy has an RFC 7230 §6.1 compliance issue / Hop-by-hop headers that leak through](https://agentprime.io/advisories/GHSA-8qx7-j2v2-x6q5.md)
  `GHSA-8qx7-j2v2-x6q5`, `CVE-2026-55458`, `GO-2026-6874` · Go `github.com/caddyserver/caddy/v2`: affected `<2.11.5`, fixed in `2.11.5` · CVSS 2.9 Low · Not analysed yet · Published 28 Oct 2026 · Tags: HTTP request smuggling
- [Check all ancestor namespace transitions when rendering raw text in html in golang.org/x/net](https://agentprime.io/advisories/GO-2026-6866.md)
  `GO-2026-6866`, `CVE-2026-97045` · Go `golang.org/x/net`: affected `<0.62.0`, fixed in `0.62.0` · CVSS 6.1 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Avoid quadratic complexity when coalescing text nodes in html in golang.org/x/net](https://agentprime.io/advisories/GO-2026-6860.md)
  `GO-2026-6860`, `CVE-2026-78661` · Go `golang.org/x/net`: affected `<0.62.0`, fixed in `0.62.0` · CVSS 7.5 High · Not analysed yet · Published 27 Oct 2026 · Tags: Denial of service
- [Neko: Authorization bypass in legacy WebRTC input handling](https://agentprime.io/advisories/GHSA-5cp7-fp4j-wwcv.md)
  `GHSA-5cp7-fp4j-wwcv`, `CVE-2026-116679`, `GO-2026-6869` · Go `github.com/m1k1o/neko/server`: affected `>=0.0.0-20250401220545-fe94c999c6af, <0.0.0-20260805142851-395ca1a6f62b`, fixed in `0.0.0-20260805142851-395ca1a6f62b` · CVSS 5.4 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: Broken access control
- [Atlantis: OS command injection through PR-controlled Terraform workspace enables RCE during plan](https://agentprime.io/advisories/GHSA-rjh2-4xgw-p2hj.md)
  `GHSA-rjh2-4xgw-p2hj`, `CVE-2026-116676`, `GO-2026-6871` · Go `github.com/runatlantis/atlantis`: affected `>=0.4.0, <0.47.1`, fixed in `0.47.1` · CVSS 8.8 High · Not analysed yet · Published 27 Oct 2026 · Tags: Command injection
- [FileBrowser: Symlink following escapes user scope allowing arbitrary file read outside the served directory](https://agentprime.io/advisories/GHSA-mgqf-5mf5-prfj.md)
  `GHSA-mgqf-5mf5-prfj`, `CVE-2026-116682`, `GO-2026-6870` · Go `github.com/gtsteffaniak/filebrowser/backend`: affected `<0.0.0-20260814233832-4126edeb07a0`, fixed in `0.0.0-20260814233832-4126edeb07a0` · CVSS 8.6 High · Not analysed yet · Published 27 Oct 2026 · Tags: Path traversal
- [Go JOSE: DoS when parsing JWKs that contain RSA keys](https://agentprime.io/advisories/GHSA-mgcc-cww5-fp2q.md)
  `GHSA-mgcc-cww5-fp2q`, `CVE-2026-116587` · Go `github.com/go-jose/go-jose/v3` and 1 more: affected `<=3.0.5`, no fixed version yet · CVSS 7.5 High · Not analysed yet · Published 27 Oct 2026 · Tags: Denial of service
- [CTFer.io's CTFd Terraform Provider allows a local or remote attacker to read team passwords in state as non sensitive values](https://agentprime.io/advisories/GHSA-vg84-c5mg-76xh.md)
  `GHSA-vg84-c5mg-76xh`, `CVE-2026-116683`, `GO-2026-6868` · Go `github.com/ctfer-io/terraform-provider-ctfd` and 1 more: affected `>=0.1.5, <=1.1.0`, no fixed version yet · CVSS 7.1 High · Not analysed yet · Published 27 Oct 2026 · Tags: Hard-coded credentials
- [compress zstd: Panic on two-block frames](https://agentprime.io/advisories/GHSA-fpmh-frq8-7rj8.md)
  `GHSA-fpmh-frq8-7rj8`, `CVE-2026-116591`, `GO-2026-6865` · Go `github.com/klauspost/compress/zstd`: affected `<1.20.2`, fixed in `1.20.2` · CVSS 8.7 High · Not analysed yet · Published 27 Oct 2026 · Tags: Memory corruption
- [SiYuan: MCP file tool's blocklist is incomplete relative to the HTTP file API it claims to align with, exposing publish-mode passwords and other sensitive workspace files](https://agentprime.io/advisories/GHSA-c8r8-95hg-mp34.md)
  `GHSA-c8r8-95hg-mp34`, `CVE-2026-60083`, `GO-2026-6863` · Go `github.com/siyuan-note/siyuan/kernel`: affected `<0.0.0-20260808051406-3542530c505f`, fixed in `0.0.0-20260808051406-3542530c505f` · CVSS 6.9 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: Broken access control
- [Wails: wildcardPatternToRegex allows Origin bypass via suffix match in BindingsAllowedOrigins](https://agentprime.io/advisories/GHSA-47hv-j4px-h3c9.md)
  `GHSA-47hv-j4px-h3c9`, `CVE-2026-34157`, `GO-2026-6862` · Go `github.com/wailsapp/wails/v2`: affected `>=2.0.0, <2.13.0`, fixed in `2.13.0` · CVSS 7.6 High · Not analysed yet · Published 27 Oct 2026 · Tags: CWE-625
- [chi: Client IP spoofing in ClientIPFromXFF via X-Forwarded-For](https://agentprime.io/advisories/GHSA-j6qf-3m9c-vwj3.md)
  `GHSA-j6qf-3m9c-vwj3`, `CVE-2026-114437` · Go `github.com/go-chi/chi/v5`: affected `<5.4.0`, fixed in `5.4.0` · CVSS 6.3 Medium · Not analysed yet · Published 23 Oct 2026 · Tags: CWE-345, CWE-348
- [Echo: X-Real-IP extractor trusts the header value instead of the sending peer](https://agentprime.io/advisories/GHSA-h53f-rm2w-w7rg.md)
  `GHSA-h53f-rm2w-w7rg`, `CVE-2026-118265`, `GO-2026-6841` · Go `github.com/labstack/echo/v5`: affected `>=5.0.0, <5.4.1`, fixed in `5.4.1` · CVSS 5.3 Medium · Not analysed yet · Published 23 Oct 2026 · Tags: CWE-348
- [Echo: WebSocket proxy can retain connections and handlers after client disconnect](https://agentprime.io/advisories/GHSA-9969-6676-49h5.md)
  `GHSA-9969-6676-49h5`, `CVE-2026-118262`, `GO-2026-6838` · Go `github.com/labstack/echo/v4` and 1 more: affected `>=4.15.0, <4.16.1`, fixed in `4.16.1` · CVSS 8.2 High · Not analysed yet · Published 23 Oct 2026 · Tags: Denial of service
- [Echo: Decompress permits unbounded gzip expansion in v4](https://agentprime.io/advisories/GHSA-h7wr-284f-5qvc.md)
  `GHSA-h7wr-284f-5qvc`, `CVE-2026-118261`, `GO-2026-6842` · Go `github.com/labstack/echo/v4`: affected `>=4.0.0, <4.16.1`, fixed in `4.16.1` · CVSS 8.2 High · Not analysed yet · Published 23 Oct 2026 · Tags: Denial of service, CWE-409
- [Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls](https://agentprime.io/advisories/GHSA-cxf3-9h37-7rr8.md)
  `GHSA-cxf3-9h37-7rr8`, `CVE-2026-118264`, `GO-2026-6839` · Go `github.com/labstack/echo/v4` and 1 more: affected `>=4.0.0, <4.16.1`, fixed in `4.16.1` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Oct 2026 · Tags: HTTP request smuggling, Broken access control
- [Echo: BodyDump can discard BodyLimit overflow errors for unknown-length requests](https://agentprime.io/advisories/GHSA-x9ff-22gv-65f4.md)
  `GHSA-x9ff-22gv-65f4`, `CVE-2026-118263`, `GO-2026-6844` · Go `github.com/labstack/echo/v5`: affected `>=5.0.0, <5.4.1`, fixed in `5.4.1` · CVSS 6.3 Medium · Not analysed yet · Published 23 Oct 2026 · Tags: CWE-252
- [Echo: BodyDump captures request and response bodies without size limits in v4](https://agentprime.io/advisories/GHSA-f48p-c9v4-h7xv.md)
  `GHSA-f48p-c9v4-h7xv`, `CVE-2026-118260`, `GO-2026-6840` · Go `github.com/labstack/echo/v4`: affected `>=4.0.0, <4.16.1`, fixed in `4.16.1` · CVSS 8.2 High · Not analysed yet · Published 23 Oct 2026 · Tags: Denial of service
- [SiYuan: Missing consistency check between packageName and repoURL/repoHash in bazaar package install allows overwriting an existing, trusted plugin](https://agentprime.io/advisories/GHSA-rpx2-p6hp-x5gj.md)
  `GHSA-rpx2-p6hp-x5gj`, `CVE-2026-62204`, `GO-2026-6834` · Go `github.com/siyuan-note/siyuan/kernel`: affected `<0.0.0-20260808010544-26ccb40d390e`, fixed in `0.0.0-20260808010544-26ccb40d390e` · CVSS 5.9 Medium · Not analysed yet · Published 23 Oct 2026 · Tags: Information disclosure, CWE-345
- [SiYuan: A parser differential between the WebSocket keepalive exemption and the session quarantine allows unauthenticated access to the broadcast event stream](https://agentprime.io/advisories/GHSA-c8w8-3pqp-wr83.md)
  `GHSA-c8w8-3pqp-wr83`, `CVE-2026-73054`, `GO-2026-6831` · Go `github.com/siyuan-note/siyuan/kernel`: affected `<0.0.0-20260731131820-67bc300b6ea6`, fixed in `0.0.0-20260731131820-67bc300b6ea6` · CVSS 8.7 High · Not analysed yet · Published 23 Oct 2026 · Tags: Authentication bypass
- [SiYuan: authFilePublishAccess distinguishes hidden and forbidden documents from public and nonexistent ones, and issues a publish-auth cookie for documents it reports as forbidden](https://agentprime.io/advisories/GHSA-4pjg-x8qj-33j5.md)
  `GHSA-4pjg-x8qj-33j5`, `CVE-2026-73630`, `GO-2026-6828` · Go `github.com/siyuan-note/siyuan/kernel`: affected `<0.0.0-20260731093152-c7522b8db586`, fixed in `0.0.0-20260731093152-c7522b8db586` · CVSS 6.9 Medium · Not analysed yet · Published 23 Oct 2026 · Tags: Information disclosure
- [SiYuan: The publish filter for database backlinks consults the forbidden list instead of the visibility list, disclosing hidden-tier documents to anonymous readers](https://agentprime.io/advisories/GHSA-p4qw-vx5p-g984.md)
  `GHSA-p4qw-vx5p-g984`, `CVE-2026-73049`, `GO-2026-6833` · Go `github.com/siyuan-note/siyuan/kernel`: affected `<0.0.0-20260730150429-5b42614311b0`, fixed in `0.0.0-20260730150429-5b42614311b0` · CVSS 6.9 Medium · Not analysed yet · Published 23 Oct 2026 · Tags: Broken access control
- [SiYuan: The publish filter for local storage returns the administrator's entire storage map with only three keys sanitized](https://agentprime.io/advisories/GHSA-xp3q-r38w-vgqm.md)
  `GHSA-xp3q-r38w-vgqm`, `GO-2026-6836` · Go `github.com/siyuan-note/siyuan/kernel`: affected `<0.0.0-20260729005258-4daee87d4152`, fixed in `0.0.0-20260729005258-4daee87d4152` · CVSS 5.8 Medium · Not analysed yet · Published 23 Oct 2026 · Tags: Broken access control
- [OpenChoreo: Authorization bypass on WorkflowRun update allows cross-project takeover of workflow runs](https://agentprime.io/advisories/GHSA-46r4-q7wv-32fc.md)
  `GHSA-46r4-q7wv-32fc`, `CVE-2026-113727`, `GO-2026-6825` · Go `github.com/openchoreo/openchoreo`: affected `>=1.0.0, <1.0.6 || >=1.1.0, <1.1.7 || >=1.2.0, <1.2.5`, fixed in `1.0.6`, `1.1.7`, `1.2.5` · CVSS 7.4 High · Not analysed yet · Published 21 Oct 2026 · Tags: Broken access control
- [Moov signedxml: Unauthenticated denial of service in exclusive XML canonicalization](https://agentprime.io/advisories/GHSA-5588-rp99-5fjh.md)
  `GHSA-5588-rp99-5fjh`, `CVE-2026-113729`, `GO-2026-6826` · Go `github.com/moov-io/signedxml`: affected `<1.4.1`, fixed in `1.4.1` · CVSS 7.5 High · Not analysed yet · Published 21 Oct 2026 · Tags: Denial of service

Older: <https://agentprime.io/advisories/ecosystem/go.md?cursor=WyIyMDI2LTEwLTIxVDE2OjI3OjU1LjAwMDAwMFoiLCJHSFNBLTU1ODgtcnA5OS01ZmpoIl0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?ecosystem=Go>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/ecosystem/go/>. Everything for agents: <https://agentprime.io/llms.txt>.