{
  "$schema": "https://docs.oasis-open.org/csaf/csaf/v2.2/schema/csaf.json",
  "document": {
    "category": "csaf_security_advisory",
    "csaf_version": "2.2",
    "distribution": {
      "tlp": {
        "label": "AMBER"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Generated from an analysis of SBOM k8s-v1.37.0-source.spdx (spdx-tag, sha256 24022414edc9c0b8942864fe174e82f746c3993800b6e278ac772f587e0437c7)."
      },
      {
        "category": "general",
        "text": "This advisory is based on an INCOMPLETE analysis. The following analyzers did not produce results, so components they would have covered may carry vulnerabilities not listed here: bomdrift (fail), inspektr_cli (fail), shieldbom (fail).",
        "title": "Analysis coverage"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "security@ndaal.eu",
      "name": "ndaal Gesellschaft fuer Sicherheit in der Informationstechnik mbH & Co KG",
      "namespace": "https://ndaal.eu/csaf"
    },
    "references": [
      {
        "category": "self",
        "summary": "This advisory",
        "url": "https://ndaal.eu/csaf/ndaal-sba-1938"
      }
    ],
    "title": "Vulnerabilities found in SBOM k8s-v1.37.0-source.spdx",
    "tracking": {
      "current_release_date": "2026-09-05T09:55:11Z",
      "generator": {
        "engine": {
          "name": "ndaal SBOM Auditor",
          "version": "1.5.22"
        }
      },
      "id": "ndaal-sba-1938",
      "initial_release_date": "2026-09-05T09:55:11Z",
      "revision_history": [
        {
          "date": "2026-09-05T09:55:11Z",
          "number": "1.0.0",
          "summary": "Initial advisory generated from an SBOM analysis."
        }
      ],
      "status": "final",
      "version": "1.0.0"
    }
  },
  "product_tree": {
    "full_product_names": [
      {
        "name": "cel-go@v0.29.2",
        "product_id": "CSAFPID-0009"
      },
      {
        "name": "crypto@v0.54.0",
        "product_id": "CSAFPID-0008"
      },
      {
        "name": "go.etcd.io/etcd/client/pkg/v3@v3.7.0",
        "product_id": "CSAFPID-0002",
        "product_identification_helper": {
          "purls": [
            "pkg:golang/go.etcd.io/etcd/client/pkg/v3@v3.7.0"
          ]
        }
      },
      {
        "name": "go.etcd.io/etcd/server/v3@v3.7.0",
        "product_id": "CSAFPID-0003",
        "product_identification_helper": {
          "purls": [
            "pkg:golang/go.etcd.io/etcd/server/v3@v3.7.0"
          ]
        }
      },
      {
        "name": "golang.org/x/crypto@v0.54.0",
        "product_id": "CSAFPID-0005",
        "product_identification_helper": {
          "purls": [
            "pkg:golang/golang.org/x/crypto@v0.54.0"
          ]
        }
      },
      {
        "name": "golang.org/x/mod@v0.37.0",
        "product_id": "CSAFPID-0004",
        "product_identification_helper": {
          "purls": [
            "pkg:golang/golang.org/x/mod@v0.37.0"
          ]
        }
      },
      {
        "name": "google.golang.org/grpc@v1.82.1",
        "product_id": "CSAFPID-0001",
        "product_identification_helper": {
          "purls": [
            "pkg:golang/google.golang.org/grpc@v1.82.1"
          ]
        }
      },
      {
        "name": "grpc@v1.82.1",
        "product_id": "CSAFPID-0006"
      },
      {
        "name": "mod@v0.37.0",
        "product_id": "CSAFPID-0011"
      },
      {
        "name": "stdlib@v1.1.12",
        "product_id": "CSAFPID-0007"
      },
      {
        "name": "unknown",
        "product_id": "CSAFPID-0012",
        "product_identification_helper": {
          "purls": [
            "pkg:golang/google.golang.org/grpc@v1.82.1"
          ]
        }
      },
      {
        "name": "v3@v3.7.0",
        "product_id": "CSAFPID-0010"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2014-7189",
      "notes": [
        {
          "category": "description",
          "text": "Man-in-the-middle attack with SessionTicketsDisabled in crypto/tls"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0007"
        ]
      },
      "title": "GO-2021-0154"
    },
    {
      "cve": "CVE-2015-5739",
      "notes": [
        {
          "category": "description",
          "text": "Request smuggling due to improper header parsing in net/http"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0007"
        ]
      },
      "title": "GO-2021-0159"
    },
    {
      "cve": "CVE-2016-3958",
      "notes": [
        {
          "category": "description",
          "text": "Privilege escalation on Windows via malicious DLL in syscall"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0007"
        ]
      },
      "title": "GO-2021-0163"
    },
    {
      "cve": "CVE-2016-3959",
      "notes": [
        {
          "category": "description",
          "text": "Denial of service due to unchecked parameters in crypto/dsa"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0007"
        ]
      },
      "title": "GO-2022-0166"
    },
    {
      "cve": "CVE-2016-5386",
      "notes": [
        {
          "category": "description",
          "text": "Improper input validation in net/http and net/http/cgi"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0007"
        ]
      },
      "title": "GO-2022-0761"
    },
    {
      "cve": "CVE-2017-1000097",
      "notes": [
        {
          "category": "description",
          "text": "Mishandled trust preferences for root certificates on Darwin in crypto/x509"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0007"
        ]
      },
      "title": "GO-2022-0171"
    },
    {
      "cve": "CVE-2017-1000098",
      "notes": [
        {
          "category": "description",
          "text": "Denial of service when parsing large forms in mime/multipart"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0007"
        ]
      },
      "title": "GO-2021-0172"
    },
    {
      "cve": "CVE-2017-15042",
      "notes": [
        {
          "category": "description",
          "text": "Cleartext transmission of credentials in net/smtp"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0007"
        ]
      },
      "title": "GO-2021-0178"
    },
    {
      "cve": "CVE-2018-16875",
      "notes": [
        {
          "category": "description",
          "text": "Denial of service in chain verification in crypto/x509"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0007"
        ]
      },
      "title": "GO-2022-0191"
    },
    {
      "cve": "CVE-2019-14809",
      "notes": [
        {
          "category": "description",
          "text": "Incorrect parsing validation in net/url"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0007"
        ]
      },
      "title": "GO-2022-0211"
    },
    {
      "cve": "CVE-2019-16276",
      "notes": [
        {
          "category": "description",
          "text": "Request smuggling due to accepting invalid headers in net/http via net/textproto"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0007"
        ]
      },
      "title": "GO-2022-0212"
    },
    {
      "cve": "CVE-2019-17596",
      "notes": [
        {
          "category": "description",
          "text": "Panic on invalid DSA public keys in crypto/dsa"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0007"
        ]
      },
      "title": "GO-2022-0213"
    },
    {
      "cve": "CVE-2019-6486",
      "notes": [
        {
          "category": "description",
          "text": "Denial of service affecting P-521 and P-384 curves in crypto/elliptic"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0007"
        ]
      },
      "title": "GO-2022-0217"
    },
    {
      "cve": "CVE-2019-9512",
      "notes": [
        {
          "category": "description",
          "text": "Reset flood in net/http and golang.org/x/net/http"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0007"
        ]
      },
      "title": "GO-2022-0536"
    },
    {
      "cve": "CVE-2019-9634",
      "notes": [
        {
          "category": "description",
          "text": "DLL injection on Windows in runtime and syscall"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0007"
        ]
      },
      "title": "GO-2022-0220"
    },
    {
      "cve": "CVE-2020-0601",
      "notes": [
        {
          "category": "description",
          "text": "Certificate validation bypass on Windows in crypto/x509"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0007"
        ]
      },
      "title": "GO-2022-0535"
    },
    {
      "cve": "CVE-2020-14039",
      "notes": [
        {
          "category": "description",
          "text": "Certificate verification error on Windows in crypto/x509"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0007"
        ]
      },
      "title": "GO-2021-0223"
    },
    {
      "cve": "CVE-2020-15586",
      "notes": [
        {
          "category": "description",
          "text": "Data race and crash in net/http"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0007"
        ]
      },
      "title": "GO-2021-0224"
    },
    {
      "cve": "CVE-2020-16845",
      "notes": [
        {
          "category": "description",
          "text": "Unbounded read from invalid inputs in encoding/binary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0007"
        ]
      },
      "title": "GO-2021-0142"
    },
    {
      "cve": "CVE-2020-24553",
      "notes": [
        {
          "category": "description",
          "text": "Cross-site scripting in net/http/cgi and net/http/fcgi"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0007"
        ]
      },
      "title": "GO-2021-0226"
    },
    {
      "cve": "CVE-2020-7919",
      "notes": [
        {
          "category": "description",
          "text": "Panic in certificate parsing in crypto/x509 and golang.org/x/crypto/cryptobyte"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0007"
        ]
      },
      "title": "GO-2022-0229"
    },
    {
      "cve": "CVE-2021-27918",
      "notes": [
        {
          "category": "description",
          "text": "Infinite loop when decoding inputs in encoding/xml"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0007"
        ]
      },
      "title": "GO-2021-0234"
    },
    {
      "cve": "CVE-2021-3114",
      "notes": [
        {
          "category": "description",
          "text": "Incorrect operations on the P-224 curve in crypto/elliptic"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0007"
        ]
      },
      "title": "GO-2021-0235"
    },
    {
      "cve": "CVE-2021-31525",
      "notes": [
        {
          "category": "description",
          "text": "Panic due to large headers in net/http and golang.org/x/net/http/httpguts"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0007"
        ]
      },
      "title": "GO-2022-0236"
    },
    {
      "cve": "CVE-2021-33195",
      "notes": [
        {
          "category": "description",
          "text": "Improper sanitization when resolving values from DNS in net"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0007"
        ]
      },
      "title": "GO-2021-0239"
    },
    {
      "cve": "CVE-2021-33196",
      "notes": [
        {
          "category": "description",
          "text": "Panic when reading certain archives in archive/zip"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0007"
        ]
      },
      "title": "GO-2021-0240"
    },
    {
      "cve": "CVE-2021-33197",
      "notes": [
        {
          "category": "description",
          "text": "Attacker can drop certain headers in net/http/httputil"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0007"
        ]
      },
      "title": "GO-2021-0241"
    },
    {
      "cve": "CVE-2021-33198",
      "notes": [
        {
          "category": "description",
          "text": "Panic on inputs with large exponents in math/big"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0007"
        ]
      },
      "title": "GO-2021-0242"
    },
    {
      "cve": "CVE-2021-34558",
      "notes": [
        {
          "category": "description",
          "text": "Panic on certain certificates in crypto/tls"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0007"
        ]
      },
      "title": "GO-2021-0243"
    },
    {
      "cve": "CVE-2021-36221",
      "notes": [
        {
          "category": "description",
          "text": "Panic in ReverseProxy in net/http/httputil"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0007"
        ]
      },
      "title": "GO-2021-0245"
    },
    {
      "cve": "CVE-2021-39293",
      "notes": [
        {
          "category": "description",
          "text": "Panic due to crafted inputs in archive/zip"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0007"
        ]
      },
      "title": "GO-2022-0273"
    },
    {
      "cve": "CVE-2021-41771",
      "notes": [
        {
          "category": "description",
          "text": "Panic on invalid symbol tables in debug/macho"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0007"
        ]
      },
      "title": "GO-2021-0263"
    },
    {
      "cve": "CVE-2021-41772",
      "notes": [
        {
          "category": "description",
          "text": "Panic when opening certain archives in archive/zip"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0007"
        ]
      },
      "title": "GO-2021-0264"
    },
    {
      "cve": "CVE-2021-44716",
      "notes": [
        {
          "category": "description",
          "text": "Unbounded memory growth in net/http and golang.org/x/net/http2"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0007"
        ]
      },
      "title": "GO-2022-0288"
    },
    {
      "cve": "CVE-2021-44717",
      "notes": [
        {
          "category": "description",
          "text": "Misdirected I/O in syscall"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0007"
        ]
      },
      "title": "GO-2022-0289"
    },
    {
      "cve": "CVE-2022-1705",
      "notes": [
        {
          "category": "description",
          "text": "Improper sanitization of Transfer-Encoding headers in net/http"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0007"
        ]
      },
      "title": "GO-2022-0525"
    },
    {
      "cve": "CVE-2022-1962",
      "notes": [
        {
          "category": "description",
          "text": "Stack exhaustion due to deeply nested types in go/parser"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0007"
        ]
      },
      "title": "GO-2022-0515"
    },
    {
      "cve": "CVE-2022-23772",
      "notes": [
        {
          "category": "description",
          "text": "Uncontrolled memory consumption in math/big"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0007"
        ]
      },
      "title": "GO-2021-0317"
    },
    {
      "cve": "CVE-2022-23806",
      "notes": [
        {
          "category": "description",
          "text": "Incorrect computation for some invalid field elements in crypto/elliptic"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0007"
        ]
      },
      "title": "GO-2021-0319"
    },
    {
      "cve": "CVE-2022-24675",
      "notes": [
        {
          "category": "description",
          "text": "Stack overflow from a large amount of PEM data in encoding/pem"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0007"
        ]
      },
      "title": "GO-2022-0433"
    },
    {
      "cve": "CVE-2022-24921",
      "notes": [
        {
          "category": "description",
          "text": "Stack exhaustion when compiling deeply nested expressions in regexp"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0007"
        ]
      },
      "title": "GO-2021-0347"
    },
    {
      "cve": "CVE-2022-27664",
      "notes": [
        {
          "category": "description",
          "text": "Denial of service in net/http and golang.org/x/net/http2"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0007"
        ]
      },
      "title": "GO-2022-0969"
    },
    {
      "cve": "CVE-2022-28131",
      "notes": [
        {
          "category": "description",
          "text": "Stack exhaustion from deeply nested XML documents in encoding/xml"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0007"
        ]
      },
      "title": "GO-2022-0521"
    },
    {
      "cve": "CVE-2022-28327",
      "notes": [
        {
          "category": "description",
          "text": "Panic due to large inputs affecting P-256 curves in crypto/elliptic"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0007"
        ]
      },
      "title": "GO-2022-0435"
    },
    {
      "cve": "CVE-2022-2879",
      "notes": [
        {
          "category": "description",
          "text": "Unbounded memory consumption when reading headers in archive/tar"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0007"
        ]
      },
      "title": "GO-2022-1037"
    },
    {
      "cve": "CVE-2022-2880",
      "notes": [
        {
          "category": "description",
          "text": "Incorrect sanitization of forwarded query parameters in net/http/httputil"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0007"
        ]
      },
      "title": "GO-2022-1038"
    },
    {
      "cve": "CVE-2022-29526",
      "notes": [
        {
          "category": "description",
          "text": "Incorrect privilege reporting in syscall and golang.org/x/sys/unix"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0007"
        ]
      },
      "title": "GO-2022-0493"
    },
    {
      "cve": "CVE-2022-29804",
      "notes": [
        {
          "category": "description",
          "text": "Path traversal via Clean on Windows in path/filepath"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0007"
        ]
      },
      "title": "GO-2022-0533"
    },
    {
      "cve": "CVE-2022-30580",
      "notes": [
        {
          "category": "description",
          "text": "Empty Cmd.Path can trigger unintended binary in os/exec on Windows"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0007"
        ]
      },
      "title": "GO-2022-0532"
    },
    {
      "cve": "CVE-2022-30629",
      "notes": [
        {
          "category": "description",
          "text": "Session tickets lack random ticket_age_add in crypto/tls"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0007"
        ]
      },
      "title": "GO-2022-0531"
    },
    {
      "cve": "CVE-2022-30630",
      "notes": [
        {
          "category": "description",
          "text": "Stack exhaustion in Glob on certain paths in io/fs"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0007"
        ]
      },
      "title": "GO-2022-0527"
    },
    {
      "cve": "CVE-2022-30631",
      "notes": [
        {
          "category": "description",
          "text": "Stack exhaustion when reading certain archives in compress/gzip"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0007"
        ]
      },
      "title": "GO-2022-0524"
    },
    {
      "cve": "CVE-2022-30632",
      "notes": [
        {
          "category": "description",
          "text": "Stack exhaustion on crafted paths in path/filepath"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0007"
        ]
      },
      "title": "GO-2022-0522"
    },
    {
      "cve": "CVE-2022-30633",
      "notes": [
        {
          "category": "description",
          "text": "Stack exhaustion when unmarshaling certain documents in encoding/xml"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0007"
        ]
      },
      "title": "GO-2022-0523"
    },
    {
      "cve": "CVE-2022-30634",
      "notes": [
        {
          "category": "description",
          "text": "Indefinite hang with large buffers on Windows in crypto/rand"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0007"
        ]
      },
      "title": "GO-2022-0477"
    },
    {
      "cve": "CVE-2022-30635",
      "notes": [
        {
          "category": "description",
          "text": "Stack exhaustion when decoding certain messages in encoding/gob"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0007"
        ]
      },
      "title": "GO-2022-0526"
    },
    {
      "cve": "CVE-2022-32148",
      "notes": [
        {
          "category": "description",
          "text": "Exposure of client IP addresses in net/http"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0007"
        ]
      },
      "title": "GO-2022-0520"
    },
    {
      "cve": "CVE-2022-32189",
      "notes": [
        {
          "category": "description",
          "text": "Panic when decoding Float and Rat types in math/big"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0007"
        ]
      },
      "title": "GO-2022-0537"
    },
    {
      "cve": "CVE-2022-41715",
      "notes": [
        {
          "category": "description",
          "text": "Memory exhaustion when compiling regular expressions in regexp/syntax"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0007"
        ]
      },
      "title": "GO-2022-1039"
    },
    {
      "cve": "CVE-2022-41716",
      "notes": [
        {
          "category": "description",
          "text": "Unsanitized NUL in environment variables on Windows in syscall and os/exec"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0007"
        ]
      },
      "title": "GO-2022-1095"
    },
    {
      "cve": "CVE-2022-41717",
      "notes": [
        {
          "category": "description",
          "text": "Excessive memory growth in net/http and golang.org/x/net/http2"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0007"
        ]
      },
      "title": "GO-2022-1144"
    },
    {
      "cve": "CVE-2022-41720",
      "notes": [
        {
          "category": "description",
          "text": "Restricted file access on Windows in os and net/http"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0007"
        ]
      },
      "title": "GO-2022-1143"
    },
    {
      "cve": "CVE-2022-41722",
      "notes": [
        {
          "category": "description",
          "text": "Path traversal on Windows in path/filepath"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0007"
        ]
      },
      "title": "GO-2023-1568"
    },
    {
      "cve": "CVE-2022-41723",
      "notes": [
        {
          "category": "description",
          "text": "Denial of service via crafted HTTP/2 stream in net/http and golang.org/x/net"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0007"
        ]
      },
      "title": "GO-2023-1571"
    },
    {
      "cve": "CVE-2022-41724",
      "notes": [
        {
          "category": "description",
          "text": "Panic on large handshake records in crypto/tls"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0007"
        ]
      },
      "title": "GO-2023-1570"
    },
    {
      "cve": "CVE-2022-41725",
      "notes": [
        {
          "category": "description",
          "text": "Excessive resource consumption in mime/multipart"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0007"
        ]
      },
      "title": "GO-2023-1569"
    },
    {
      "cve": "CVE-2023-24532",
      "notes": [
        {
          "category": "description",
          "text": "Incorrect calculation on P256 curves in crypto/internal/nistec"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0007"
        ]
      },
      "title": "GO-2023-1621"
    },
    {
      "cve": "CVE-2023-24534",
      "notes": [
        {
          "category": "description",
          "text": "Excessive memory allocation in net/http and net/textproto"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0007"
        ]
      },
      "title": "GO-2023-1704"
    },
    {
      "cve": "CVE-2023-24536",
      "notes": [
        {
          "category": "description",
          "text": "Excessive resource consumption in net/http, net/textproto and mime/multipart"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0007"
        ]
      },
      "title": "GO-2023-1705"
    },
    {
      "cve": "CVE-2023-24537",
      "notes": [
        {
          "category": "description",
          "text": "Infinite loop in parsing in go/scanner"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0007"
        ]
      },
      "title": "GO-2023-1702"
    },
    {
      "cve": "CVE-2023-24538",
      "notes": [
        {
          "category": "description",
          "text": "Backticks not treated as string delimiters in html/template"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0007"
        ]
      },
      "title": "GO-2023-1703"
    },
    {
      "cve": "CVE-2023-24539",
      "notes": [
        {
          "category": "description",
          "text": "Improper sanitization of CSS values in html/template"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0007"
        ]
      },
      "title": "GO-2023-1751"
    },
    {
      "cve": "CVE-2023-24540",
      "notes": [
        {
          "category": "description",
          "text": "Improper handling of JavaScript whitespace in html/template"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0007"
        ]
      },
      "title": "GO-2023-1752"
    },
    {
      "cve": "CVE-2023-29400",
      "notes": [
        {
          "category": "description",
          "text": "Improper handling of empty HTML attributes in html/template"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0007"
        ]
      },
      "title": "GO-2023-1753"
    },
    {
      "cve": "CVE-2023-29403",
      "notes": [
        {
          "category": "description",
          "text": "Unsafe behavior in setuid/setgid binaries in runtime"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0007"
        ]
      },
      "title": "GO-2023-1840"
    },
    {
      "cve": "CVE-2023-29406",
      "notes": [
        {
          "category": "description",
          "text": "Insufficient sanitization of Host header in net/http"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0007"
        ]
      },
      "title": "GO-2023-1878"
    },
    {
      "cve": "CVE-2023-29409",
      "notes": [
        {
          "category": "description",
          "text": "Large RSA keys can cause high CPU usage in crypto/tls"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0007"
        ]
      },
      "title": "GO-2023-1987"
    },
    {
      "cve": "CVE-2023-39318",
      "notes": [
        {
          "category": "description",
          "text": "Improper handling of HTML-like comments in script contexts in html/template"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0007"
        ]
      },
      "title": "GO-2023-2041"
    },
    {
      "cve": "CVE-2023-39319",
      "notes": [
        {
          "category": "description",
          "text": "Improper handling of special tags within script contexts in html/template"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0007"
        ]
      },
      "title": "GO-2023-2043"
    },
    {
      "cve": "CVE-2023-39325",
      "notes": [
        {
          "category": "description",
          "text": "HTTP/2 rapid reset can cause excessive work in net/http"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0007"
        ]
      },
      "title": "GO-2023-2102"
    },
    {
      "cve": "CVE-2023-39326",
      "notes": [
        {
          "category": "description",
          "text": "Denial of service via chunk extensions in net/http"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0007"
        ]
      },
      "title": "GO-2023-2382"
    },
    {
      "cve": "CVE-2023-45283",
      "notes": [
        {
          "category": "description",
          "text": "Insecure parsing of Windows paths with a \\??\\ prefix in path/filepath"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0007"
        ]
      },
      "title": "GO-2023-2185"
    },
    {
      "cve": "CVE-2023-45284",
      "notes": [
        {
          "category": "description",
          "text": "Incorrect detection of reserved device names on Windows in path/filepath"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0007"
        ]
      },
      "title": "GO-2023-2186"
    },
    {
      "cve": "CVE-2023-45287",
      "notes": [
        {
          "category": "description",
          "text": "Before Go 1.20, the RSA based key exchange methods in crypto/tls may exhibit a timing side channel"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0007"
        ]
      },
      "title": "GO-2023-2375"
    },
    {
      "cve": "CVE-2023-45288",
      "notes": [
        {
          "category": "description",
          "text": "HTTP/2 CONTINUATION flood in net/http"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0007"
        ]
      },
      "title": "GO-2024-2687"
    },
    {
      "cve": "CVE-2023-45289",
      "notes": [
        {
          "category": "description",
          "text": "Incorrect forwarding of sensitive headers and cookies on HTTP redirect in net/http"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0007"
        ]
      },
      "title": "GO-2024-2600"
    },
    {
      "cve": "CVE-2023-45290",
      "notes": [
        {
          "category": "description",
          "text": "Memory exhaustion in multipart form parsing in net/textproto and net/http"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0007"
        ]
      },
      "title": "GO-2024-2599"
    },
    {
      "cve": "CVE-2024-24783",
      "notes": [
        {
          "category": "description",
          "text": "Verify panics on certificates with an unknown public key algorithm in crypto/x509"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0007"
        ]
      },
      "title": "GO-2024-2598"
    },
    {
      "cve": "CVE-2024-24784",
      "notes": [
        {
          "category": "description",
          "text": "Comments in display names are incorrectly handled in net/mail"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0007"
        ]
      },
      "title": "GO-2024-2609"
    },
    {
      "cve": "CVE-2024-24785",
      "notes": [
        {
          "category": "description",
          "text": "Errors returned from JSON marshaling may break template escaping in html/template"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0007"
        ]
      },
      "title": "GO-2024-2610"
    },
    {
      "cve": "CVE-2024-24789",
      "notes": [
        {
          "category": "description",
          "text": "Mishandling of corrupt central directory record in archive/zip"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0007"
        ]
      },
      "title": "GO-2024-2888"
    },
    {
      "cve": "CVE-2024-24790",
      "notes": [
        {
          "category": "description",
          "text": "Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses in net/netip"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0007"
        ]
      },
      "title": "GO-2024-2887"
    },
    {
      "cve": "CVE-2024-24791",
      "notes": [
        {
          "category": "description",
          "text": "Denial of service due to improper 100-continue handling in net/http"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0007"
        ]
      },
      "title": "GO-2024-2963"
    },
    {
      "cve": "CVE-2024-34155",
      "notes": [
        {
          "category": "description",
          "text": "Stack exhaustion in all Parse functions in go/parser"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0007"
        ]
      },
      "title": "GO-2024-3105"
    },
    {
      "cve": "CVE-2024-34156",
      "notes": [
        {
          "category": "description",
          "text": "Stack exhaustion in Decoder.Decode in encoding/gob"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0007"
        ]
      },
      "title": "GO-2024-3106"
    },
    {
      "cve": "CVE-2024-34158",
      "notes": [
        {
          "category": "description",
          "text": "Stack exhaustion in Parse in go/build/constraint"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0007"
        ]
      },
      "title": "GO-2024-3107"
    },
    {
      "cve": "CVE-2024-45336",
      "notes": [
        {
          "category": "description",
          "text": "Sensitive headers incorrectly sent after cross-domain redirect in net/http"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0007"
        ]
      },
      "title": "GO-2025-3420"
    },
    {
      "cve": "CVE-2024-45341",
      "notes": [
        {
          "category": "description",
          "text": "Usage of IPv6 zone IDs can bypass URI name constraints in crypto/x509"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0007"
        ]
      },
      "title": "GO-2025-3373"
    },
    {
      "cve": "CVE-2025-0913",
      "notes": [
        {
          "category": "description",
          "text": "Inconsistent handling of O_CREATE|O_EXCL on Unix and Windows in os in syscall"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0007"
        ]
      },
      "title": "GO-2025-3750"
    },
    {
      "cve": "CVE-2025-22866",
      "notes": [
        {
          "category": "description",
          "text": "Timing sidechannel for P-256 on ppc64le in crypto/internal/nistec"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0007"
        ]
      },
      "title": "GO-2025-3447"
    },
    {
      "cve": "CVE-2025-22870",
      "notes": [
        {
          "category": "description",
          "text": "HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0007"
        ]
      },
      "title": "GO-2025-3503"
    },
    {
      "cve": "CVE-2025-22871",
      "notes": [
        {
          "category": "description",
          "text": "Request smuggling due to acceptance of invalid chunked data in net/http"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0007"
        ]
      },
      "title": "GO-2025-3563"
    },
    {
      "cve": "CVE-2025-22873",
      "notes": [
        {
          "category": "description",
          "text": "Improper access to parent directory of root in os"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0007"
        ]
      },
      "title": "GO-2026-4403"
    },
    {
      "cve": "CVE-2025-4673",
      "notes": [
        {
          "category": "description",
          "text": "Sensitive headers not cleared on cross-origin redirect in net/http"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0007"
        ]
      },
      "title": "GO-2025-3751"
    },
    {
      "cve": "CVE-2025-47906",
      "notes": [
        {
          "category": "description",
          "text": "Unexpected paths returned from LookPath in os/exec"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0007"
        ]
      },
      "title": "GO-2025-3956"
    },
    {
      "cve": "CVE-2025-47907",
      "notes": [
        {
          "category": "description",
          "text": "Incorrect results returned from Rows.Scan in database/sql"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0007"
        ]
      },
      "title": "GO-2025-3849"
    },
    {
      "cve": "CVE-2025-47912",
      "notes": [
        {
          "category": "description",
          "text": "Insufficient validation of bracketed IPv6 hostnames in net/url"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0007"
        ]
      },
      "title": "GO-2025-4010"
    },
    {
      "cve": "CVE-2025-58183",
      "notes": [
        {
          "category": "description",
          "text": "Unbounded allocation when parsing GNU sparse map in archive/tar"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0007"
        ]
      },
      "title": "GO-2025-4014"
    },
    {
      "cve": "CVE-2025-58185",
      "notes": [
        {
          "category": "description",
          "text": "Parsing DER payload can cause memory exhaustion in encoding/asn1"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0007"
        ]
      },
      "title": "GO-2025-4011"
    },
    {
      "cve": "CVE-2025-58186",
      "notes": [
        {
          "category": "description",
          "text": "Lack of limit when parsing cookies can cause memory exhaustion in net/http"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0007"
        ]
      },
      "title": "GO-2025-4012"
    },
    {
      "cve": "CVE-2025-58187",
      "notes": [
        {
          "category": "description",
          "text": "Quadratic complexity when checking name constraints in crypto/x509"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0007"
        ]
      },
      "title": "GO-2025-4007"
    },
    {
      "cve": "CVE-2025-58188",
      "notes": [
        {
          "category": "description",
          "text": "Panic when validating certificates with DSA public keys in crypto/x509"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0007"
        ]
      },
      "title": "GO-2025-4013"
    },
    {
      "cve": "CVE-2025-58189",
      "notes": [
        {
          "category": "description",
          "text": "ALPN negotiation error contains attacker controlled information in crypto/tls"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0007"
        ]
      },
      "title": "GO-2025-4008"
    },
    {
      "cve": "CVE-2025-61723",
      "notes": [
        {
          "category": "description",
          "text": "Quadratic complexity when parsing some invalid inputs in encoding/pem"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0007"
        ]
      },
      "title": "GO-2025-4009"
    },
    {
      "cve": "CVE-2025-61724",
      "notes": [
        {
          "category": "description",
          "text": "Excessive CPU consumption in Reader.ReadResponse in net/textproto"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0007"
        ]
      },
      "title": "GO-2025-4015"
    },
    {
      "cve": "CVE-2025-61725",
      "notes": [
        {
          "category": "description",
          "text": "Excessive CPU consumption in ParseAddress in net/mail"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0007"
        ]
      },
      "title": "GO-2025-4006"
    },
    {
      "cve": "CVE-2025-61726",
      "notes": [
        {
          "category": "description",
          "text": "Memory exhaustion in query parameter parsing in net/url"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0007"
        ]
      },
      "title": "GO-2026-4341"
    },
    {
      "cve": "CVE-2025-61727",
      "notes": [
        {
          "category": "description",
          "text": "Improper application of excluded DNS name constraints when verifying wildcard names in crypto/x509"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0007"
        ]
      },
      "title": "GO-2025-4175"
    },
    {
      "cve": "CVE-2025-61728",
      "notes": [
        {
          "category": "description",
          "text": "Excessive CPU consumption when building archive index in archive/zip"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0007"
        ]
      },
      "title": "GO-2026-4342"
    },
    {
      "cve": "CVE-2025-61729",
      "notes": [
        {
          "category": "description",
          "text": "Excessive resource consumption when printing error string for host certificate validation in crypto/x509"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0007"
        ]
      },
      "title": "GO-2025-4155"
    },
    {
      "cve": "CVE-2025-61730",
      "notes": [
        {
          "category": "description",
          "text": "Handshake messages may be processed at the incorrect encryption level in crypto/tls"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0007"
        ]
      },
      "title": "GO-2026-4340"
    },
    {
      "cve": "CVE-2025-68121",
      "notes": [
        {
          "category": "description",
          "text": "Unexpected session resumption in crypto/tls"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0007"
        ]
      },
      "title": "GO-2026-4337"
    },
    {
      "cve": "CVE-2026-25679",
      "notes": [
        {
          "category": "description",
          "text": "Incorrect parsing of IPv6 host literals in net/url"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0007"
        ]
      },
      "title": "GO-2026-4601"
    },
    {
      "cve": "CVE-2026-27139",
      "notes": [
        {
          "category": "description",
          "text": "FileInfo can escape from a Root in os"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0007"
        ]
      },
      "title": "GO-2026-4602"
    },
    {
      "cve": "CVE-2026-27142",
      "notes": [
        {
          "category": "description",
          "text": "URLs in meta content attribute actions are not escaped in html/template"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0007"
        ]
      },
      "title": "GO-2026-4603"
    },
    {
      "cve": "CVE-2026-27145",
      "notes": [
        {
          "category": "description",
          "text": "Inefficient candidate hostname parsing in crypto/x509"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0007"
        ]
      },
      "title": "GO-2026-5037"
    },
    {
      "cve": "CVE-2026-32280",
      "notes": [
        {
          "category": "description",
          "text": "Unexpected work during chain building in crypto/x509"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0007"
        ]
      },
      "title": "GO-2026-4947"
    },
    {
      "cve": "CVE-2026-32281",
      "notes": [
        {
          "category": "description",
          "text": "Inefficient policy validation in crypto/x509"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0007"
        ]
      },
      "title": "GO-2026-4946"
    },
    {
      "cve": "CVE-2026-32282",
      "notes": [
        {
          "category": "description",
          "text": "TOCTOU permits root escape on Linux via Root.Chmod in os in internal/syscall/unix"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0007"
        ]
      },
      "title": "GO-2026-4864"
    },
    {
      "cve": "CVE-2026-32283",
      "notes": [
        {
          "category": "description",
          "text": "Unauthenticated TLS 1.3 KeyUpdate record can cause persistent connection retention and DoS in crypto/tls"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0007"
        ]
      },
      "title": "GO-2026-4870"
    },
    {
      "cve": "CVE-2026-32288",
      "notes": [
        {
          "category": "description",
          "text": "Unbounded allocation for old GNU sparse in archive/tar"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0007"
        ]
      },
      "title": "GO-2026-4869"
    },
    {
      "cve": "CVE-2026-32289",
      "notes": [
        {
          "category": "description",
          "text": "JsBraceDepth Context Tracking Bugs (XSS) in html/template"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0007"
        ]
      },
      "title": "GO-2026-4865"
    },
    {
      "cve": "CVE-2026-33811",
      "notes": [
        {
          "category": "description",
          "text": "Crash when handling long CNAME response in net"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0007"
        ]
      },
      "title": "GO-2026-4981"
    },
    {
      "cve": "CVE-2026-33814",
      "notes": [
        {
          "category": "description",
          "text": "Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0007"
        ]
      },
      "title": "GO-2026-4918"
    },
    {
      "cve": "CVE-2026-33818",
      "notes": [
        {
          "category": "description",
          "text": "Enforce maximum recursion depth in encoding/asn1"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0007"
        ]
      },
      "title": "GO-2026-5972"
    },
    {
      "cve": "CVE-2026-39820",
      "notes": [
        {
          "category": "description",
          "text": "Quadratic string concatentation in consumeComment in net/mail"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0007"
        ]
      },
      "title": "GO-2026-4986"
    },
    {
      "cve": "CVE-2026-39821",
      "notes": [
        {
          "category": "description",
          "text": "Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0007"
        ]
      },
      "title": "GO-2026-5026"
    },
    {
      "cve": "CVE-2026-39822",
      "notes": [
        {
          "category": "description",
          "text": "Root escape via symlink plus trailing slash in os"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0007"
        ]
      },
      "title": "GO-2026-4970"
    },
    {
      "cve": "CVE-2026-39823",
      "notes": [
        {
          "category": "description",
          "text": "Bypass of meta content URL escaping causes XSS in html/template"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0007"
        ]
      },
      "title": "GO-2026-4982"
    },
    {
      "cve": "CVE-2026-39825",
      "notes": [
        {
          "category": "description",
          "text": "ReverseProxy forwards queries with more than urlmaxqueryparams parameters in net/http/httputil"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0007"
        ]
      },
      "title": "GO-2026-4976"
    },
    {
      "cve": "CVE-2026-39826",
      "notes": [
        {
          "category": "description",
          "text": "Escaper bypass leads to XSS in html/template"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0007"
        ]
      },
      "title": "GO-2026-4980"
    },
    {
      "cve": "CVE-2026-39836",
      "notes": [
        {
          "category": "description",
          "text": "Panic in Dial and LookupPort when handling NUL byte on Windows in net"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0007"
        ]
      },
      "title": "GO-2026-4971"
    },
    {
      "cve": "CVE-2026-42499",
      "notes": [
        {
          "category": "description",
          "text": "Quadratic string concatenation in consumePhrase in net/mail"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0007"
        ]
      },
      "title": "GO-2026-4977"
    },
    {
      "cve": "CVE-2026-42504",
      "notes": [
        {
          "category": "description",
          "text": "Quadratic complexity in WordDecoder.DecodeHeader in mime"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0007"
        ]
      },
      "title": "GO-2026-5038"
    },
    {
      "cve": "CVE-2026-42505",
      "notes": [
        {
          "category": "description",
          "text": "Invoking Encrypted Client Hello privacy leak in crypto/tls"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0007"
        ]
      },
      "title": "GO-2026-5856"
    },
    {
      "cve": "CVE-2026-42507",
      "notes": [
        {
          "category": "description",
          "text": "Arbitrary inputs are included in errors without any escaping in net/textproto"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0007"
        ]
      },
      "title": "GO-2026-5039"
    },
    {
      "cve": "CVE-2026-56853",
      "notes": [
        {
          "category": "description",
          "text": "Apply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/http"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0007"
        ]
      },
      "title": "GO-2026-6089"
    },
    {
      "cve": "CVE-2026-56854",
      "notes": [
        {
          "category": "description",
          "text": "The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the PasswordCallback, KeyboardInteractiveCallback, NoClientAuthCallback, and GSSAPIWithMICConfig.AllowLogin callbacks were not validated against the client's remote address, so a source-address restriction set by those callbacks was silently ignored. The check is now applied to the Permissions returned by any authentication callback."
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0005",
          "CSAFPID-0008",
          "CSAFPID-0012"
        ]
      },
      "metrics": [
        {
          "content": {
            "cvss_v3": {
              "version": "3.1",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "attackVector": "NETWORK",
              "attackComplexity": "LOW",
              "privilegesRequired": "NONE",
              "userInteraction": "NONE",
              "scope": "UNCHANGED",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "availabilityImpact": "NONE"
            }
          },
          "products": [
            "CSAFPID-0005",
            "CSAFPID-0008",
            "CSAFPID-0012"
          ]
        }
      ],
      "title": "GO-2026-6303",
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Upgrade to 0.55.0 or later.",
          "product_ids": [
            "CSAFPID-0005",
            "CSAFPID-0008",
            "CSAFPID-0012"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2026-56855",
      "notes": [
        {
          "category": "description",
          "text": "Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection.\n\nNow, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connection down instead of buffering and blocking."
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0005",
          "CSAFPID-0008",
          "CSAFPID-0012"
        ]
      },
      "metrics": [
        {
          "content": {
            "cvss_v3": {
              "version": "3.1",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "attackVector": "NETWORK",
              "attackComplexity": "LOW",
              "privilegesRequired": "NONE",
              "userInteraction": "NONE",
              "scope": "UNCHANGED",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "availabilityImpact": "HIGH"
            }
          },
          "products": [
            "CSAFPID-0005",
            "CSAFPID-0008",
            "CSAFPID-0012"
          ]
        }
      ],
      "title": "GO-2026-6355",
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Upgrade to 0.56.0 or later.",
          "product_ids": [
            "CSAFPID-0005",
            "CSAFPID-0008",
            "CSAFPID-0012"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2026-56858",
      "notes": [
        {
          "category": "description",
          "text": "Fix Javascript regexp context tracking in html/template"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0007"
        ]
      },
      "title": "GO-2026-6091"
    },
    {
      "cve": "CVE-2026-56859",
      "notes": [
        {
          "category": "description",
          "text": "Add recursion depth guard during decode in encoding/xml"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0007"
        ]
      },
      "title": "GO-2026-6088"
    },
    {
      "cve": "CVE-2026-56860",
      "notes": [
        {
          "category": "description",
          "text": "Avoid quadratic complexity in resolvePath in net/url"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0007"
        ]
      },
      "title": "GO-2026-6218"
    },
    {
      "cve": "CVE-2026-56862",
      "notes": [
        {
          "category": "description",
          "text": "Limit handshake messages we are willing to accept post-handshake in crypto/tls"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0007"
        ]
      },
      "title": "GO-2026-6090"
    },
    {
      "cve": "CVE-2026-56864",
      "notes": [
        {
          "category": "description",
          "text": "A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log.\n\nThis attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log.\n\nIn order to determine if you have been affected:\n\nrm -r go.sum go.work.sum vendor/ && go mod tidy"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0004",
          "CSAFPID-0011",
          "CSAFPID-0012"
        ]
      },
      "metrics": [
        {
          "content": {
            "cvss_v3": {
              "version": "3.1",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "attackVector": "NETWORK",
              "attackComplexity": "LOW",
              "privilegesRequired": "NONE",
              "userInteraction": "NONE",
              "scope": "UNCHANGED",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "availabilityImpact": "NONE"
            }
          },
          "products": [
            "CSAFPID-0004",
            "CSAFPID-0011",
            "CSAFPID-0012"
          ]
        }
      ],
      "title": "GO-2026-6180",
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Upgrade to 0.40.0 or later.",
          "product_ids": [
            "CSAFPID-0004",
            "CSAFPID-0011",
            "CSAFPID-0012"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2026-56865",
      "notes": [
        {
          "category": "description",
          "text": "A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache.\n\nThis attack allows for a malicious GOPROXY to serve malicious module content that cannot be detected by evaluating the transparency log.\n\nAll tiles are now correctly verified against their parents.\n\nIn order to determine if you have been affected:\n\nrm -r go.sum go.work.sum vendor/ && go mod tidy"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0004",
          "CSAFPID-0011",
          "CSAFPID-0012"
        ]
      },
      "metrics": [
        {
          "content": {
            "cvss_v3": {
              "version": "3.1",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "baseScore": 8.4,
              "baseSeverity": "HIGH",
              "attackVector": "LOCAL",
              "attackComplexity": "LOW",
              "privilegesRequired": "NONE",
              "userInteraction": "NONE",
              "scope": "UNCHANGED",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "availabilityImpact": "HIGH"
            }
          },
          "products": [
            "CSAFPID-0004",
            "CSAFPID-0011",
            "CSAFPID-0012"
          ]
        }
      ],
      "title": "GO-2026-6179",
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Upgrade to 0.40.0 or later.",
          "product_ids": [
            "CSAFPID-0004",
            "CSAFPID-0011",
            "CSAFPID-0012"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2026-73499",
      "notes": [
        {
          "category": "description",
          "text": "In go.etcd.io/etcd/server/v3 before 3.5.33, 3.6.14, and 3.7.1, an authenticated user with READ permission on a single key can bypass RBAC restrictions by initiating an open-ended range watch using clientv3.WithFromKey(). The Watch RPC handler normalized open-ended range ends prior to authorization checks, causing isWatchPermitted to evaluate the request as a single-key watch while the underlying watch stream received events for all keys lexicographically greater than or equal to the target key."
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0003",
          "CSAFPID-0010",
          "CSAFPID-0012"
        ]
      },
      "metrics": [
        {
          "content": {
            "cvss_v4": {
              "version": "4.0",
              "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
              "baseScore": 7.1,
              "baseSeverity": "HIGH",
              "attackVector": "NETWORK",
              "attackComplexity": "LOW",
              "attackRequirements": "NONE",
              "privilegesRequired": "LOW",
              "userInteraction": "NONE",
              "vulnConfidentialityImpact": "HIGH",
              "vulnIntegrityImpact": "NONE",
              "vulnAvailabilityImpact": "NONE",
              "subConfidentialityImpact": "NONE",
              "subIntegrityImpact": "NONE",
              "subAvailabilityImpact": "NONE"
            }
          },
          "products": [
            "CSAFPID-0003",
            "CSAFPID-0010",
            "CSAFPID-0012"
          ]
        }
      ],
      "title": "GO-2026-6114",
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Upgrade to 3.5.33 or later.",
          "product_ids": [
            "CSAFPID-0003",
            "CSAFPID-0010",
            "CSAFPID-0012"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2026-73500",
      "notes": [
        {
          "category": "description",
          "text": "In go.etcd.io/etcd/client/pkg/v3 before 3.5.33, 3.6.14, and 3.7.1, TLS handshakes on listeners created by NewTLSListener do not enforce a handshake deadline. An unauthenticated network attacker who connects to an etcd TLS listener without sending a ClientHello causes a goroutine and a tracking map entry to block indefinitely. Opening many such connections exhausts memory, leading to a denial of service."
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0002",
          "CSAFPID-0010",
          "CSAFPID-0012"
        ]
      },
      "metrics": [
        {
          "content": {
            "cvss_v4": {
              "version": "4.0",
              "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
              "baseScore": 8.7,
              "baseSeverity": "HIGH",
              "attackVector": "NETWORK",
              "attackComplexity": "LOW",
              "attackRequirements": "NONE",
              "privilegesRequired": "NONE",
              "userInteraction": "NONE",
              "vulnConfidentialityImpact": "NONE",
              "vulnIntegrityImpact": "NONE",
              "vulnAvailabilityImpact": "HIGH",
              "subConfidentialityImpact": "NONE",
              "subIntegrityImpact": "NONE",
              "subAvailabilityImpact": "NONE"
            }
          },
          "products": [
            "CSAFPID-0002",
            "CSAFPID-0010",
            "CSAFPID-0012"
          ]
        }
      ],
      "title": "GO-2026-6107",
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Upgrade to 3.5.33 or later.",
          "product_ids": [
            "CSAFPID-0002",
            "CSAFPID-0010",
            "CSAFPID-0012"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2026-78662",
      "notes": [
        {
          "category": "description",
          "text": "Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection.\n\nNow, we add an atomic established state, set when a channel becomes usable. Until such a time, handlePacket drops every packet other than the open confirmation/failure, without blocking and without tearing down the connection."
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0005",
          "CSAFPID-0008",
          "CSAFPID-0012"
        ]
      },
      "metrics": [
        {
          "content": {
            "cvss_v3": {
              "version": "3.1",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "attackVector": "NETWORK",
              "attackComplexity": "LOW",
              "privilegesRequired": "NONE",
              "userInteraction": "NONE",
              "scope": "UNCHANGED",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "availabilityImpact": "NONE"
            }
          },
          "products": [
            "CSAFPID-0005",
            "CSAFPID-0008",
            "CSAFPID-0012"
          ]
        }
      ],
      "title": "GO-2026-6354",
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Upgrade to 0.56.0 or later.",
          "product_ids": [
            "CSAFPID-0005",
            "CSAFPID-0008",
            "CSAFPID-0012"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2026-84304",
      "notes": [
        {
          "category": "description",
          "text": "gRPC-Go: Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0006",
          "CSAFPID-0012"
        ]
      },
      "metrics": [
        {
          "content": {
            "cvss_v4": {
              "version": "4.0",
              "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
              "baseScore": 8.7,
              "baseSeverity": "HIGH",
              "attackVector": "NETWORK",
              "attackComplexity": "LOW",
              "attackRequirements": "NONE",
              "privilegesRequired": "NONE",
              "userInteraction": "NONE",
              "vulnConfidentialityImpact": "NONE",
              "vulnIntegrityImpact": "NONE",
              "vulnAvailabilityImpact": "HIGH",
              "subConfidentialityImpact": "NONE",
              "subIntegrityImpact": "NONE",
              "subAvailabilityImpact": "NONE"
            }
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0006",
            "CSAFPID-0012"
          ]
        }
      ],
      "title": "GHSA-vp52-pcj8-j9qc",
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Upgrade to 1.83.1 or later.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0006",
            "CSAFPID-0012"
          ]
        }
      ]
    },
    {
      "notes": [
        {
          "category": "description",
          "text": "The golang.org/x/crypto/openpgp package is unsafe by design, has numerous known security issues, is not maintained, and should not be used.\n\nIf you are required to interoperate with OpenPGP systems and need a maintained package, consider github.com/ProtonMail/go-crypto/openpgp which is a maintained fork that aims to be a drop-in replacement for this package."
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0005",
          "CSAFPID-0008",
          "CSAFPID-0012"
        ]
      },
      "title": "GO-2026-5932"
    },
    {
      "notes": [
        {
          "category": "description",
          "text": "JSON private fields exposed via NativeTypes and ParseStructTag in github.com/google/cel-go"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0009",
          "CSAFPID-0012"
        ]
      },
      "title": "GO-2026-6094"
    }
  ]
}