Golang: >> Go >> 1.24.11 Security Vulnerabilities
archive/zip uses a super-linear file name indexing algorithm that is invoked the first time a file in an archive is opened. This can lead to a denial of service when consuming a maliciously constructed ZIP archive.
CVSS Score
6.5
EPSS Score
0.007
Published
2026-01-28
During the TLS 1.3 handshake if multiple messages are sent in records that span encryption level boundaries (for instance the Client Hello and Encrypted Extensions messages), the subsequent messages may be processed before the encryption level changes. This can cause some minor information disclosure if a network-local attacker can inject messages during the handshake.
CVSS Score
5.3
EPSS Score
0.003
Published
2026-01-28
Page 4