← Scan another repo

github.com/gorilla/websocket

@ e064f32e3674

Submitted 8/4/2026, 1:31:57 AM · Status: ok

Risk grade
F
100 / 100
Findings
108
0 critical10 high24 medium0 low74 info0 on CISA KEV0ATT&CK
Showing 108 of 108 findings

Findings

  • Detected private-key: Identified a Private Key, which may compromise cryptographic security and sensitive data encryption
    Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.
    gitleaks
  • Detected private-key: Identified a Private Key, which may compromise cryptographic security and sensitive data encryption
    Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.
    gitleaks
  • Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer.
    grypeCVE-2026-46600EPSS 0.3%
  • The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com"
    The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in progra…
    grypeCVE-2026-39821EPSS 0.7%
  • When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.
    grypeCVE-2026-33814EPSS 0.8%
  • golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass
    Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.
    trivyCVE-2026-27136
  • golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting
    Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.
    trivyCVE-2026-25681
  • golang.org/x/net/html: Non-linear parsing of case-insensitive content in golang.org/x/net/html
    An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service.
    trivyCVE-2024-45338
  • golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing
    The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in program…
    trivyCVE-2026-39821
  • net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame
    When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.
    trivyCVE-2026-33814

This report is public.