# Go Advisories.

Every Go Advisory we hold (Go modules), newest first.

## Records, newest first (an older page)

- [Nuclei: Local File Read via MySQL Client Sandbox Bypass](https://agentprime.io/advisories/GHSA-xhmx-w2j4-rw3q.md)
  `GHSA-xhmx-w2j4-rw3q`, `CVE-2026-76803`, `GO-2026-6577` · Go `github.com/projectdiscovery/nuclei/v3`: affected `>=3.0.0, <3.10.0`, fixed in `3.10.0` · CVSS 5.3 Medium · Not analysed yet · Published 22 Sept 2026 · Tags: Broken access control
- [Nuclei: Arbitrary Command Execution via DAST Code Signature Bypass](https://agentprime.io/advisories/GHSA-jpf4-98qj-qr67.md)
  `GHSA-jpf4-98qj-qr67`, `CVE-2026-76802`, `GO-2026-6570` · Go `github.com/projectdiscovery/nuclei/v3`: affected `>=3.0.0, <3.10.0`, fixed in `3.10.0` · CVSS 4.7 Medium · Not analysed yet · Published 22 Sept 2026 · Tags: Command injection
- [Nuclei: Arbitrary Code Execution via Goja JavaScript Engine Vulnerability](https://agentprime.io/advisories/GHSA-vxg7-f2jj-jmqm.md)
  `GHSA-vxg7-f2jj-jmqm`, `CVE-2026-76819`, `GO-2026-6575` · Go `github.com/projectdiscovery/nuclei/v3`: affected `>=3.0.0, <3.10.0`, fixed in `3.10.0` · CVSS 8.6 High · Not analysed yet · Published 22 Sept 2026 · Tags: Code injection, Memory corruption
- [Tinyauth: Unauthenticated login attempts can trigger global login lockdown denial of service](https://agentprime.io/advisories/GHSA-9xhm-w3wj-xhqh.md)
  `GHSA-9xhm-w3wj-xhqh`, `CVE-2026-77561`, `GO-2026-6564` · Go `github.com/steveiliop56/tinyauth`: affected `<1.0.1-0.20260715123057-dade1e2c8f27`, fixed in `1.0.1-0.20260715123057-dade1e2c8f27` · CVSS 5.3 Medium · Not analysed yet · Published 22 Sept 2026 · Tags: Authentication bypass
- [Tinyauth: forward-auth per-app ACL is matched case-sensitively against the (case-insensitive) hostname, letting an authenticated user reach apps they are not on the allowlist for](https://agentprime.io/advisories/GHSA-328g-jx67-v94g.md)
  `GHSA-328g-jx67-v94g`, `CVE-2026-77560`, `GO-2026-6552` · Go `github.com/tinyauthapp/tinyauth`: affected `<1.0.1-0.20260720133915-80bc87188ec3`, fixed in `1.0.1-0.20260720133915-80bc87188ec3` · CVSS 8.1 High · Not analysed yet · Published 22 Sept 2026 · Tags: Broken access control, CWE-178, CWE-636
- [Tinyauth: User enumeration attack by timing oracle](https://agentprime.io/advisories/GHSA-456h-ww26-f758.md)
  `GHSA-456h-ww26-f758`, `CVE-2026-77582`, `GO-2026-6555` · Go `github.com/tinyauthapp/tinyauth`: affected `<1.0.1-0.20260714134959-c22925c2fba9`, fixed in `1.0.1-0.20260714134959-c22925c2fba9` · CVSS 6.9 Medium · Not analysed yet · Published 22 Sept 2026 · Tags: CWE-208
- [KubeEdge: Command Injection in NodeUpgradeJob - RCE on edge nodes via v1alpha2 API](https://agentprime.io/advisories/GHSA-5jpj-293f-rhvj.md)
  `GHSA-5jpj-293f-rhvj`, `CVE-2026-62371`, `GO-2026-6557` · Go `github.com/kubeedge/kubeedge`: affected `>=1.12.0, <1.21.2 || >=1.22.0, <1.22.2 || >=1.23.0, <1.23.1`, fixed in `1.21.2`, `1.22.2`, `1.23.1` · CVSS 8.8 High · Not analysed yet · Published 22 Sept 2026 · Tags: Command injection
- [KubeEdge: Unbounded allocation in viaduct packer enables authenticated remote DoS against CloudHub](https://agentprime.io/advisories/GHSA-gfw4-49f9-cp25.md)
  `GHSA-gfw4-49f9-cp25`, `CVE-2026-62370`, `GO-2026-6569` · Go `github.com/kubeedge/kubeedge`: affected `>=1.0.0, <1.21.2 || >=1.22.0, <1.22.2 || >=1.23.0, <1.23.1`, fixed in `1.21.2`, `1.22.2`, `1.23.1` · CVSS 6.5 Medium · Not analysed yet · Published 22 Sept 2026 · Tags: Denial of service
- [KubeEdge: keadm DecompressTarGz path traversal enables arbitrary file write on Windows during edge node join](https://agentprime.io/advisories/GHSA-9vm9-pqxx-x83v.md)
  `GHSA-9vm9-pqxx-x83v`, `CVE-2026-62369`, `GO-2026-6563` · Go `github.com/kubeedge/kubeedge`: affected `>=1.16.0, <1.21.2 || >=1.22.0, <1.22.2 || >=1.23.0, <1.23.1`, fixed in `1.21.2`, `1.22.2`, `1.23.1` · CVSS 8.1 High · Not analysed yet · Published 22 Sept 2026 · Tags: Path traversal
- [OpenBao Skips Stricter Deny Policy for LIST operations](https://agentprime.io/advisories/GHSA-xp3c-3jw3-4vcr.md)
  `GHSA-xp3c-3jw3-4vcr`, `BIT-openbao-2026-63131`, `CVE-2026-63131`, `GO-2026-6579` · Go `github.com/openbao/openbao`: affected `<0.0.0-20260713133043-f58d848c139e || >=0.1.0, <=1.1.5`, fixed in `0.0.0-20260713133043-f58d848c139e` · CVSS 6.0 Medium · Not analysed yet · Published 22 Sept 2026 · Tags: Broken access control
- [OpenBao's Recovery Mode Vulnerable To Token Leakage via Timing Attack](https://agentprime.io/advisories/GHSA-34fc-gh42-pj53.md)
  `GHSA-34fc-gh42-pj53`, `BIT-openbao-2026-63132`, `CVE-2026-63132`, `GO-2026-6553` · Go `github.com/openbao/openbao`: affected `<0.0.0-20260713141742-763625a20721 || >=0.1.0, <=1.1.5`, fixed in `0.0.0-20260713141742-763625a20721` · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Sept 2026 · Tags: CWE-208
- [OpenBao's Templated Policies Allow Privilege Escalation via Wildcard Characters](https://agentprime.io/advisories/GHSA-59w7-v8rr-pr4p.md)
  `GHSA-59w7-v8rr-pr4p`, `BIT-openbao-2026-71543`, `CVE-2026-71543`, `GO-2026-6556` · Go `github.com/openbao/openbao`: affected `<0.0.0-20260710001938-2d4ebafec5c5 || >=0.1.0, <=1.1.5`, fixed in `0.0.0-20260710001938-2d4ebafec5c5` · CVSS 7.5 High · Not analysed yet · Published 22 Sept 2026 · Tags: Broken access control
- [OpenBao Agent Writes Secrets to Stdout](https://agentprime.io/advisories/GHSA-444v-8vxr-p36h.md)
  `GHSA-444v-8vxr-p36h`, `BIT-openbao-2026-77285`, `CVE-2026-77285`, `GO-2026-6554` · Go `github.com/openbao/openbao`: affected `<0.0.0-20260714163218-90272575e5f5 || >=0.1.0, <=1.1.5`, fixed in `0.0.0-20260714163218-90272575e5f5` · CVSS 2.4 Low · Not analysed yet · Published 22 Sept 2026 · Tags: Information disclosure
- [KubeEdge: ConfigUpdateJob updateFields enables remote shell injection and code execution on edge nodes](https://agentprime.io/advisories/GHSA-m3c6-2p7h-cfr3.md)
  `GHSA-m3c6-2p7h-cfr3`, `CVE-2026-62182`, `GO-2026-6573` · Go `github.com/kubeedge/kubeedge`: affected `>=1.21.0, <1.21.2 || >=1.22.0, <1.22.2 || >=1.23.0, <1.23.1`, fixed in `1.21.2`, `1.22.2`, `1.23.1` · CVSS 8.8 High · Not analysed yet · Published 22 Sept 2026 · Tags: Command injection
- [SIPGO: DoS via unvalidated WebSocket frame length](https://agentprime.io/advisories/GHSA-8h6x-h86x-75wh.md)
  `GHSA-8h6x-h86x-75wh`, `CVE-2026-77322`, `GO-2026-6559` · Go `github.com/emiago/sipgo`: affected `<1.4.3`, fixed in `1.4.3` · CVSS 7.5 High · Not analysed yet · Published 22 Sept 2026 · Tags: Denial of service
- [Fabio - Incomplete fix for CVE-2025-48865: operator-configured trust headers (clientip/tls/requestid) still strippable via the Connection header](https://agentprime.io/advisories/GHSA-fq95-v8xc-jm3v.md)
  `GHSA-fq95-v8xc-jm3v`, `CVE-2026-62987`, `GO-2026-6566` · Go `github.com/fabiolb/fabio`: affected `>=1.6.6, <1.7.2`, fixed in `1.7.2` · CVSS 5.8 Medium · Not analysed yet · Published 22 Sept 2026 · Tags: Authentication bypass, CWE-348
- [Hatchet: Cross-Tenant Durable Task Event Log Disclosure via Missing Authorization Check](https://agentprime.io/advisories/GHSA-g26x-m427-f48f.md)
  `GHSA-g26x-m427-f48f`, `CVE-2026-63342`, `GO-2026-6567` · Go `github.com/hatchet-dev/hatchet`: affected `<0.91.1`, fixed in `0.91.1` · CVSS 6.3 Medium · Not analysed yet · Published 22 Sept 2026 · Tags: Broken access control
- [Hatchet: SSRF via Unsigned UnsubscribeURL in SNS UnsubscribeConfirmation Handler](https://agentprime.io/advisories/GHSA-fjwv-jf2v-j499.md)
  `GHSA-fjwv-jf2v-j499`, `CVE-2026-61681`, `GO-2026-6565` · Go `github.com/hatchet-dev/hatchet`: affected `<0.91.1`, fixed in `0.91.1` · CVSS 4.1 Medium · Not analysed yet · Published 22 Sept 2026 · Tags: Server-side request forgery (SSRF)
- [SIPGO: DoS via unvalidated Content-Length in the stream parser](https://agentprime.io/advisories/GHSA-pg59-5vwg-4jxq.md)
  `GHSA-pg59-5vwg-4jxq`, `CVE-2026-58268`, `GO-2026-6550` · Go `github.com/emiago/sipgo`: affected `<1.4.1`, fixed in `1.4.1` · CVSS 7.5 High · Not analysed yet · Published 22 Sept 2026 · Tags: Denial of service
- [Dasel: Selector lexer panics on trailing whitespace in \`parseCurRune\`](https://agentprime.io/advisories/GHSA-65gg-g7rw-6cpc.md)
  `GHSA-65gg-g7rw-6cpc`, `CVE-2026-62866`, `GO-2026-6548` · Go `github.com/tomwright/dasel/v3`: affected `>=3.0.0, <3.11.2`, fixed in `3.11.2` · CVSS 6.2 Medium · Not analysed yet · Published 22 Sept 2026 · Tags: CWE-129
- [Dasel: Unbounded recursion in JSON and XML readers causes unrecoverable stack-overflow DoS](https://agentprime.io/advisories/GHSA-cqxr-jxr2-85pq.md)
  `GHSA-cqxr-jxr2-85pq`, `CVE-2026-59168`, `GO-2026-6549` · Go `github.com/tomwright/dasel/v3`: affected `>=3.0.0, <3.11.1`, fixed in `3.11.1` · CVSS 6.2 Medium · Not analysed yet · Published 22 Sept 2026 · Tags: Denial of service
- [nginx ignition has Unauthenticated Admin Account Creation via Onboarding Race Condition](https://agentprime.io/advisories/GHSA-pxcx-fv34-x9p5.md)
  `GHSA-pxcx-fv34-x9p5`, `CVE-2026-61628`, `GO-2026-6540` · Go `github.com/lucasdillmann/nginx-ignition`: affected `<0.0.0-20260621194639-0586b4e55ab`, fixed in `0.0.0-20260621194639-0586b4e55ab` · CVSS 8.1 High · Not analysed yet · Published 21 Sept 2026 · Tags: Race condition
- [nginx ignition has ParseAcceptLanguage \`\_\` separator bypass that enables \~75x CPU amplification via Accept-Language header in i18nMiddleware](https://agentprime.io/advisories/GHSA-jr34-h97m-9hpx.md)
  `GHSA-jr34-h97m-9hpx`, `CVE-2026-61629`, `GO-2026-6539` · Go `github.com/lucasdillmann/nginx-ignition`: affected `>=0.0.0-20260126024607-cbaf0fc16ed8, <0.0.0-20260526022344-0c988fc1277c`, fixed in `0.0.0-20260526022344-0c988fc1277c` · CVSS 7.5 High · Not analysed yet · Published 21 Sept 2026 · Tags: Denial of service
- [nginx ignition has TOTP Reuse During Validity Window](https://agentprime.io/advisories/GHSA-hf33-q6cf-c66f.md)
  `GHSA-hf33-q6cf-c66f`, `CVE-2026-61630`, `GO-2026-6537` · Go `github.com/lucasdillmann/nginx-ignition`: affected `>=0.0.0-20260217145239-1cbfae0296f1, <0.0.0-20260328015550-8d35e1eb5dd6`, fixed in `0.0.0-20260328015550-8d35e1eb5dd6` · CVSS 4.2 Medium · Not analysed yet · Published 21 Sept 2026 · Tags: Authentication bypass
- [k8saudit shipped rules do not detect privileged/sensitive settings on init or ephemeral containers](https://agentprime.io/advisories/GHSA-jhjp-4c2q-xmx4.md)
  `GHSA-jhjp-4c2q-xmx4`, `GO-2026-6538` · Go `github.com/falcosecurity/plugins/plugins/k8saudit` and 4 more: affected `<0.18.0`, fixed in `0.18.0` · CVSS 4.3 Medium · Not analysed yet · Published 21 Sept 2026 · Tags: CWE-693
- [Hatchet - Unauthenticated OAuth state CSRF / login-CSRF via empty-state collision in ValidateOAuthState](https://agentprime.io/advisories/GHSA-phg3-3g28-wq9v.md)
  `GHSA-phg3-3g28-wq9v`, `CVE-2026-61687`, `GO-2026-6535` · Go `github.com/hatchet-dev/hatchet`: affected `<0.91.1`, fixed in `0.91.1` · CVSS 7.1 High · Not analysed yet · Published 21 Sept 2026 · Tags: Authentication bypass, Cross-site request forgery (CSRF), CWE-1275
- [Obot: Server-Side Request Forgery via remote MCP server URL](https://agentprime.io/advisories/GHSA-jgh3-fggc-mcpm.md)
  `GHSA-jgh3-fggc-mcpm`, `CVE-2026-101064`, `GO-2026-6522` · Go `github.com/obot-platform/obot`: affected `<0.23.0`, fixed in `0.23.0` · CVSS 8.3 High · Not analysed yet · Published 18 Sept 2026 · Tags: Server-side request forgery (SSRF), CWE-1188
- [Obot: MCP Registry API readable without authentication](https://agentprime.io/advisories/GHSA-pr6h-vr44-xq8j.md)
  `GHSA-pr6h-vr44-xq8j`, `CVE-2026-101063`, `GO-2026-6525` · Go `github.com/obot-platform/obot`: affected `<0.23.0`, fixed in `0.23.0` · CVSS 6.9 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: Broken access control
- [Obot: OAuth Dynamic Client Registration Enables API Token Theft via Audience Confusion](https://agentprime.io/advisories/GHSA-xwmw-prc4-v3cr.md)
  `GHSA-xwmw-prc4-v3cr`, `CVE-2026-101062`, `GO-2026-6530` · Go `github.com/obot-platform/obot`: affected `<0.23.0`, fixed in `0.23.0` · CVSS 8.7 High · Not analysed yet · Published 18 Sept 2026 · Tags: Broken access control
- [Perses's unvalidated project parameter enables filesystem path traversal](https://agentprime.io/advisories/GHSA-vr5f-w35q-98jp.md)
  `GHSA-vr5f-w35q-98jp`, `CVE-2026-63445`, `GO-2026-6528` · Go `github.com/perses/perses`: affected `<0.54.0-rc.0`, fixed in `0.54.0-rc.0` · CVSS 7.1 High · Not analysed yet · Published 18 Sept 2026 · Tags: Path traversal
- [Perses's missing authorization in datasource proxy allows cross-scope secret disclosure](https://agentprime.io/advisories/GHSA-4227-9989-jrhx.md)
  `GHSA-4227-9989-jrhx`, `CVE-2026-63199`, `GO-2026-6514` · Go `github.com/perses/perses`: affected `>=0.43.0, <0.54.0-rc.0`, fixed in `0.54.0-rc.0` · CVSS 8.3 High · Not analysed yet · Published 18 Sept 2026 · Tags: Broken access control
- [Perses's project query parameter authorization bypass exposes cross-project resources](https://agentprime.io/advisories/GHSA-cjgj-2fwf-4c2w.md)
  `GHSA-cjgj-2fwf-4c2w`, `CVE-2026-63458`, `GO-2026-6518` · Go `github.com/perses/perses`: affected `<0.54.0-beta.3`, fixed in `0.54.0-beta.3` · CVSS 7.1 High · Not analysed yet · Published 18 Sept 2026 · Tags: Broken access control
- [Process Compose: Browser DNS rebinding lets websites control local process-compose MCP tools](https://agentprime.io/advisories/GHSA-5gm3-9crp-6g3v.md)
  `GHSA-5gm3-9crp-6g3v`, `CVE-2026-77339`, `GO-2026-6515` · Go `github.com/f1bonacc1/process-compose`: affected `<1.120.0`, fixed in `1.120.0` · CVSS 5.1 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: Authentication bypass, CWE-346
- [Convoy: Cross-Tenant Source IDOR Leaks Plaintext Message Broker Credentials](https://agentprime.io/advisories/GHSA-p5vg-v7mj-f6q4.md)
  `GHSA-p5vg-v7mj-f6q4`, `CVE-2026-81505`, `GO-2026-6523` · Go `github.com/frain-dev/convoy`: affected `<0.9.3-0.20260724092134-1cc67cd16fb1`, fixed in `0.9.3-0.20260724092134-1cc67cd16fb1` · CVSS 7.1 High · Not analysed yet · Published 18 Sept 2026 · Tags: Broken access control
- [AnyCable: Telemetry Subsystem Contains Hardcoded Authentication Token and Transmits CLI Arguments Including Secrets](https://agentprime.io/advisories/GHSA-w72w-9qmj-c9qm.md)
  `GHSA-w72w-9qmj-c9qm`, `CVE-2026-63406`, `GO-2026-6529` · Go `github.com/anycable/anycable`: affected `<1.6.15`, fixed in `1.6.15` · CVSS 5.9 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: Information disclosure, Hard-coded credentials
- [AnyCable: Pusher REST API Does Not Verify Request Body MD5 Enabling Signed-Request Replay with Arbitrary Body](https://agentprime.io/advisories/GHSA-5p54-whvp-x327.md)
  `GHSA-5p54-whvp-x327`, `CVE-2026-63405`, `GO-2026-6516` · Go `github.com/anycable/anycable`: affected `<1.6.15`, fixed in `1.6.15` · CVSS 5.9 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: CWE-345
- [ToolHive: containerized MCP servers can reach host services via host.docker.internal, enabling lateral movement](https://agentprime.io/advisories/GHSA-qg2g-g9w3-m5h8.md)
  `GHSA-qg2g-g9w3-m5h8`, `CVE-2026-58197`, `GO-2026-6526` · Go `github.com/stacklok/toolhive`: affected `<0.30.1`, fixed in `0.30.1` · CVSS 8.8 High · Not analysed yet · Published 18 Sept 2026 · Tags: Broken access control, Authentication bypass
- [kcp front-proxy does not strip inbound X-Remote-\* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace](https://agentprime.io/advisories/GHSA-c8w2-fgvx-vhv4.md)
  `GHSA-c8w2-fgvx-vhv4`, `CVE-2026-61682`, `GO-2026-6517` · Go `github.com/kcp-dev/kcp`: affected `<0.31.4 || >=0.32.0, <0.32.2`, fixed in `0.31.4`, `0.32.2` · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Sept 2026 · Tags: Authentication bypass, CWE-302, CWE-348
- [zot: Bearer authentication maps DELETE to push scope, allowing unauthorized deletion](https://agentprime.io/advisories/GHSA-qg67-7m6v-qg25.md)
  `GHSA-qg67-7m6v-qg25`, `CVE-2026-61833`, `GO-2026-6527` · Go `zotregistry.dev/zot/v2`: affected `<2.1.18`, fixed in `2.1.18` · CVSS 8.1 High · Not analysed yet · Published 18 Sept 2026 · Tags: Broken access control
- [Capsule: hostnameRegexHandler.OnUpdate validates stale (old) Tenant regex, allowing invalid AllowedHostnames regex to bypass webhook validation](https://agentprime.io/advisories/GHSA-f94q-w3w8-cj67.md)
  `GHSA-f94q-w3w8-cj67`, `CVE-2026-61795`, `GO-2026-6519` · Go `github.com/projectcapsule/capsule`: affected `>=0.13.0, <0.13.7`, fixed in `0.13.7` · CVSS 6.8 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: CWE-697
- [Capsule: Tenant owner bypasses Capsule's forbidden namespace/service/node label and annotation enforcement](https://agentprime.io/advisories/GHSA-gjw4-3v3v-rqxg.md)
  `GHSA-gjw4-3v3v-rqxg`, `CVE-2026-61672`, `GO-2026-6520` · Go `github.com/projectcapsule/capsule`: affected `<0.13.7`, fixed in `0.13.7` · CVSS 7.1 High · Not analysed yet · Published 18 Sept 2026 · Tags: Broken access control, CWE-697
- [Capsule: Malformed ForbiddenAnnotations.Regex can bypass Tenant validation and trigger namespace admission panic](https://agentprime.io/advisories/GHSA-gxjc-74v5-3vx3.md)
  `GHSA-gxjc-74v5-3vx3`, `CVE-2026-61794`, `GO-2026-6521` · Go `github.com/projectcapsule/capsule`: affected `>=0.13.0, <0.13.7`, fixed in `0.13.7` · CVSS 6.8 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: CWE-20
- [Caddy: rewrite placeholder re-expansion, unbounded body buffer DoS, and fileHidden case-sensitivity bypass](https://agentprime.io/advisories/GHSA-j8px-rmrx-76h9.md)
  `GHSA-j8px-rmrx-76h9`, `CVE-2026-77281`, `CVE-2026-92284`, `CVE-2026-92700`, `GO-2026-6512` · Go `github.com/caddyserver/caddy/v2`: affected `<2.11.4`, fixed in `2.11.4` · CVSS 6.9 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: Code injection, Denial of service, CWE-178
- [CoreDNS DoH/DoQ/gRPC bypass UPDATE rejection enforced on UDP/TCP](https://agentprime.io/advisories/GHSA-9gm5-9rfh-m6vx.md)
  `GHSA-9gm5-9rfh-m6vx`, `CVE-2026-86003`, `GO-2026-6506` · Go `github.com/coredns/coredns`: affected `<1.14.7`, fixed in `1.14.7` · CVSS 7.5 High · Not analysed yet · Published 17 Sept 2026 · Tags: CWE-441
- [CoreDNS: Unauthenticated memory exhaustion in custom transports](https://agentprime.io/advisories/GHSA-mrg3-qvqr-jw29.md)
  `GHSA-mrg3-qvqr-jw29`, `CVE-2026-82399`, `GO-2026-6507` · Go `github.com/coredns/coredns`: affected `<1.14.7`, fixed in `1.14.7` · CVSS 7.5 High · Not analysed yet · Published 17 Sept 2026 · Tags: Denial of service
- [OpenTelemetry-Go: Log gRPC exporter ignores env TLS certs, bypassing mTLS/pinning](https://agentprime.io/advisories/GHSA-w34q-cm8f-9c5x.md)
  `GHSA-w34q-cm8f-9c5x`, `CVE-2026-81871`, `GO-2026-6508` · Go `go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc`: affected `<0.21.0`, fixed in `0.21.0` · CVSS 6.3 Medium · Not analysed yet · Published 17 Sept 2026 · Tags: Weak cryptography or TLS, CWE-923
- [OpenTelemetry-Go: Exporter config logging may leak endpoint URLs in info logs](https://agentprime.io/advisories/GHSA-8wmf-6v46-5gfg.md)
  `GHSA-8wmf-6v46-5gfg`, `CVE-2026-81870`, `GO-2026-6505` · Go `go.opentelemetry.io/otel/exporters/otlp/otlptrace` and 4 more: affected `>=1.5.0, <1.45.0`, fixed in `1.45.0` · CVSS 2.0 Low · Not analysed yet · Published 17 Sept 2026 · Tags: Information disclosure
- [oras-go: Blind SSRF via unvalidated Link header URL in pagination allows internal network probing](https://agentprime.io/advisories/GHSA-h7vf-4x9w-h99v.md)
  `GHSA-h7vf-4x9w-h99v`, `CVE-2026-85732`, `GO-2026-6497` · Go `oras.land/oras-go/v2`: affected `<2.6.2`, fixed in `2.6.2` · CVSS 4.7 Medium · Not analysed yet · Published 17 Sept 2026 · Tags: Server-side request forgery (SSRF)
- [oras-go: Arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction (pushDir)](https://agentprime.io/advisories/GHSA-m37j-52j7-pjw7.md)
  `GHSA-m37j-52j7-pjw7`, `CVE-2026-85731`, `GO-2026-6499` · Go `oras.land/oras-go/v2`: affected `<2.6.2`, fixed in `2.6.2` · CVSS 8.8 High · Not analysed yet · Published 17 Sept 2026 · Tags: Path traversal
- [Skipper has OPA body-authz bypass: truncated_body mitigation fails open on chunked/HTTP-2 (incomplete fix GHSA-8qqm-fp2q-v734)](https://agentprime.io/advisories/GHSA-5gpm-rgj3-9q76.md)
  `GHSA-5gpm-rgj3-9q76`, `CVE-2026-86043`, `GO-2026-6495` · Go `github.com/zalando/skipper`: affected `<0.27.37`, fixed in `0.27.37` · CVSS 7.5 High · Not analysed yet · Published 17 Sept 2026 · Tags: Broken access control
- [RabbitMQ amqp091-go: Denial of Service via Malicious Field Length in AMQP Client](https://agentprime.io/advisories/GHSA-4v58-74mf-rjx3.md)
  `GHSA-4v58-74mf-rjx3`, `CVE-2026-77412`, `GO-2026-6494` · Go `github.com/rabbitmq/amqp091-go`: affected `<1.13.0`, fixed in `1.13.0` · CVSS 8.9 High · Not analysed yet · Published 17 Sept 2026 · Tags: CWE-681
- [RabbitMQ amqp091-go: Protocol Desynchronization and Frame Injection via Integer Overflow in readLongstr](https://agentprime.io/advisories/GHSA-c5pq-fr2g-9jpf.md)
  `GHSA-c5pq-fr2g-9jpf`, `CVE-2026-77411`, `GO-2026-6496` · Go `github.com/rabbitmq/amqp091-go`: affected `<1.13.0`, fixed in `1.13.0` · CVSS 9.5 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Sept 2026 · Tags: CWE-754
- [RabbitMQ amqp091-go: Resource Exhaustion (OOM) via Unbounded Body Buffer Allocation](https://agentprime.io/advisories/GHSA-r9c8-gcjp-xfwh.md)
  `GHSA-r9c8-gcjp-xfwh`, `CVE-2026-77410`, `GO-2026-6500` · Go `github.com/rabbitmq/amqp091-go`: affected `<1.13.0`, fixed in `1.13.0` · CVSS 8.9 High · Not analysed yet · Published 17 Sept 2026 · Tags: Denial of service
- [RabbitMQ amqp091-go: Silent Data Truncation and State Corruption via Shortstr Integer Overflow](https://agentprime.io/advisories/GHSA-j497-x9hr-x34x.md)
  `GHSA-j497-x9hr-x34x`, `CVE-2026-77408`, `GO-2026-6498` · Go `github.com/rabbitmq/amqp091-go`: affected `<1.13.0`, fixed in `1.13.0` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Sept 2026 · Tags: Memory corruption
- [RabbitMQ amqp091-go: Plaintext Credential Exposure via Exported PLAIN Authentication Struct Fields](https://agentprime.io/advisories/GHSA-27gv-rfvv-22mv.md)
  `GHSA-27gv-rfvv-22mv`, `CVE-2026-77407`, `GO-2026-6491` · Go `github.com/rabbitmq/amqp091-go`: affected `<1.13.0`, fixed in `1.13.0` · CVSS 7.0 High · Not analysed yet · Published 17 Sept 2026 · Tags: CWE-316
- [RabbitMQ amqp091-go: Consumer Message Flooding via Signed-to-Unsigned Integer Casting in Qos Configuration](https://agentprime.io/advisories/GHSA-rm6m-hrcw-jw33.md)
  `GHSA-rm6m-hrcw-jw33`, `CVE-2026-77406`, `GO-2026-6502` · Go `github.com/rabbitmq/amqp091-go`: affected `<1.13.0`, fixed in `1.13.0` · CVSS 8.2 High · Not analysed yet · Published 17 Sept 2026 · Tags: CWE-195
- [RabbitMQ amqp091-go: Missing Explicit TLS Minimum Version Configuration In URI Parser](https://agentprime.io/advisories/GHSA-33mj-cw25-m34h.md)
  `GHSA-33mj-cw25-m34h`, `CVE-2026-77405`, `GO-2026-6492` · Go `github.com/rabbitmq/amqp091-go`: affected `<1.13.0`, fixed in `1.13.0` · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Sept 2026 · Tags: Weak cryptography or TLS, CWE-316
- [RabbitMQ amqp091-go: Connection Configuration Overwrite via Unsanitized TLS Path Parameter Injection](https://agentprime.io/advisories/GHSA-465g-fh3v-9jw4.md)
  `GHSA-465g-fh3v-9jw4`, `CVE-2026-77404`, `GO-2026-6493` · Go `github.com/rabbitmq/amqp091-go`: affected `<1.13.0`, fixed in `1.13.0` · CVSS 8.7 High · Not analysed yet · Published 17 Sept 2026 · Tags: CWE-116
- [RabbitMQ amqp091-go: Denial of Service via Sub-Spec Frame Size Negotiation](https://agentprime.io/advisories/GHSA-xwwf-m8fg-p9q2.md)
  `GHSA-xwwf-m8fg-p9q2`, `CVE-2026-77403`, `GO-2026-6503` · Go `github.com/rabbitmq/amqp091-go`: affected `<1.13.0`, fixed in `1.13.0` · CVSS 8.9 High · Not analysed yet · Published 17 Sept 2026 · Tags: Denial of service
- [Pocketbase: Unhandled panic in worker goroutines](https://agentprime.io/advisories/GHSA-84vh-m24q-wjjx.md)
  `GHSA-84vh-m24q-wjjx`, `CVE-2026-82410`, `GO-2026-6489` · Go `github.com/pocketbase/pocketbase`: affected `<0.22.48 || >=0.23.0, <0.39.7`, fixed in `0.22.48`, `0.39.7` · CVSS 8.7 High · Not analysed yet · Published 17 Sept 2026 · Tags: CWE-248

Newest: <https://agentprime.io/advisories/ecosystem/go.md>
Older: <https://agentprime.io/advisories/ecosystem/go.md?cursor=WyIyMDI2LTA5LTE3VDE0OjU4OjQyLjAwMDAwMFoiLCJHSFNBLTg0dmgtbTI0cS13amp4Il0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?ecosystem=Go&cursor=WyIyMDI2LTA5LTIyVDIwOjM3OjIxLjAwMDAwMFoiLCJHSFNBLXFndzUtN2o0Zi1mZzk3Il0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/ecosystem/go/?cursor=WyIyMDI2LTA5LTIyVDIwOjM3OjIxLjAwMDAwMFoiLCJHSFNBLXFndzUtN2o0Zi1mZzk3Il0>. Everything for agents: <https://agentprime.io/llms.txt>.