=== Symbol Results ===

Vulnerability #1: GO-2026-6617
    HTTP/2 server crash due to HPACK encoder race in net/http
  More info: https://pkg.go.dev/vuln/GO-2026-6617
  Standard library
    Found in: net/http@go1.24.13
    Fixed in: net/http@go1.26.9
    Vulnerable symbols found:
      #1: http.CanonicalHeaderKey
      #2: http.CanonicalHeaderKey
      #3: http.CanonicalHeaderKey
      #4: http.CanonicalHeaderKey
      #5: http.CanonicalHeaderKey
      Use '-show traces' to see the other 3999 found symbols

Vulnerability #2: GO-2026-6613
    HTTP/1 server connection desynchronization after 2xx CONNECT response in
    net/http
  More info: https://pkg.go.dev/vuln/GO-2026-6613
  Standard library
    Found in: net/http@go1.24.13
    Fixed in: net/http@go1.26.9
    Vulnerable symbols found:
      #1: http.CanonicalHeaderKey
      #2: http.CanonicalHeaderKey
      #3: http.CanonicalHeaderKey
      #4: http.CanonicalHeaderKey
      #5: http.CanonicalHeaderKey
      Use '-show traces' to see the other 1388 found symbols

Vulnerability #3: GO-2026-6612
    Double flow control refund on HTTP/2 server streams in net/http
  More info: https://pkg.go.dev/vuln/GO-2026-6612
  Standard library
    Found in: net/http@go1.24.13
    Fixed in: net/http@go1.26.9
    Vulnerable symbols found:
      #1: http.CanonicalHeaderKey
      #2: http.CanonicalHeaderKey
      #3: http.CanonicalHeaderKey
      #4: http.CanonicalHeaderKey
      #5: http.CanonicalHeaderKey
      Use '-show traces' to see the other 3999 found symbols

Vulnerability #4: GO-2026-6611
    Excessive CPU consumption from repeated initial window changes in net/http
  More info: https://pkg.go.dev/vuln/GO-2026-6611
  Standard library
    Found in: net/http@go1.24.13
    Fixed in: net/http@go1.26.9
    Vulnerable symbols found:
      #1: http.CanonicalHeaderKey
      #2: http.CanonicalHeaderKey
      #3: http.CanonicalHeaderKey
      #4: http.CanonicalHeaderKey
      #5: http.CanonicalHeaderKey
      Use '-show traces' to see the other 4019 found symbols

Vulnerability #5: GO-2026-6610
    HTTP/2 transport accepts malformed framing-related headers in net/http
  More info: https://pkg.go.dev/vuln/GO-2026-6610
  Standard library
    Found in: net/http@go1.24.13
    Fixed in: net/http@go1.26.9
    Vulnerable symbols found:
      #1: http.Client.CloseIdleConnections
      #2: http.Client.CloseIdleConnections
      #3: http.Client.CloseIdleConnections
      #4: http.Client.CloseIdleConnections
      #5: http.Client.CloseIdleConnections
      Use '-show traces' to see the other 647 found symbols

Vulnerability #6: GO-2026-6609
    Lack of limit on size of parsed Range headers in net/http
  More info: https://pkg.go.dev/vuln/GO-2026-6609
  Standard library
    Found in: net/http@go1.24.13
    Fixed in: net/http@go1.26.9
    Vulnerable symbols found:
      #1: http.ServeContent
      #2: http.ServeContent
      #3: http.ServeContent
      #4: http.ServeContent
      #5: http.ServeContent
      Use '-show traces' to see the other 45 found symbols

Vulnerability #7: GO-2026-6608
    Memory limit bypass when parsing MIME headers in net/textproto,
    mime/multipart
  More info: https://pkg.go.dev/vuln/GO-2026-6608
  Standard library
    Found in: mime/multipart@go1.24.13
    Fixed in: mime/multipart@go1.26.9
    Vulnerable symbols found:
      #1: multipart.Reader.NextPart
      #2: multipart.Reader.NextRawPart
      #3: multipart.Reader.ReadForm
      #4: textproto.Reader.ReadContinuedLine
      #5: textproto.Reader.ReadContinuedLineBytes
      Use '-show traces' to see the other 2 found symbols

Vulnerability #8: GO-2026-6607
    Reject malformed ECH outer extension references in crypto/tls
  More info: https://pkg.go.dev/vuln/GO-2026-6607
  Standard library
    Found in: crypto/tls@go1.24.13
    Fixed in: crypto/tls@go1.26.9
    Vulnerable symbols found:
      #1: tls.Conn.Handshake
      #2: tls.Conn.Handshake
      #3: tls.Conn.Handshake
      #4: tls.Conn.Handshake
      #5: tls.Conn.HandshakeContext
      Use '-show traces' to see the other 31 found symbols

Vulnerability #9: GO-2026-6605
    HTTP/1 client connection desynchronization after CONNECT rejection in
    net/http
  More info: https://pkg.go.dev/vuln/GO-2026-6605
  Standard library
    Found in: net/http/httputil@go1.24.13
    Fixed in: net/http/httputil@go1.26.9
    Vulnerable symbols found:
      #1: http.Client.CloseIdleConnections
      #2: http.Client.CloseIdleConnections
      #3: http.Client.CloseIdleConnections
      #4: http.Client.CloseIdleConnections
      #5: http.Client.CloseIdleConnections
      Use '-show traces' to see the other 236 found symbols

Vulnerability #10: GO-2026-6603
    HTTP/2 server memory exhaustion due to Trailer headers in net/http
  More info: https://pkg.go.dev/vuln/GO-2026-6603
  Standard library
    Found in: net/http@go1.24.13
    Fixed in: net/http@go1.26.9
    Vulnerable symbols found:
      #1: http.CanonicalHeaderKey
      #2: http.CanonicalHeaderKey
      #3: http.CanonicalHeaderKey
      #4: http.CanonicalHeaderKey
      #5: http.CanonicalHeaderKey
      Use '-show traces' to see the other 3999 found symbols

Vulnerability #11: GO-2026-6600
    Recognize yield as regexp preceder keyword in html/template
  More info: https://pkg.go.dev/vuln/GO-2026-6600
  Standard library
    Found in: html/template@go1.24.13
    Fixed in: html/template@go1.26.9
    Vulnerable symbols found:
      #1: template.Template.Execute
      #2: template.Template.Execute
      #3: template.Template.Execute
      #4: template.Template.Execute
      #5: template.Template.Execute
      Use '-show traces' to see the other 9 found symbols

Vulnerability #12: GO-2026-6599
    Reset context tracking on consecutive template expressions in html/template
  More info: https://pkg.go.dev/vuln/GO-2026-6599
  Standard library
    Found in: html/template@go1.24.13
    Fixed in: html/template@go1.26.9
    Vulnerable symbols found:
      #1: template.Template.Execute
      #2: template.Template.Execute
      #3: template.Template.Execute
      #4: template.Template.Execute
      #5: template.Template.Execute
      Use '-show traces' to see the other 9 found symbols

Vulnerability #13: GO-2026-6355
    Prevent DoS on deadlocked established channel in golang.org/x/crypto/ssh
  More info: https://pkg.go.dev/vuln/GO-2026-6355
  Module: golang.org/x/crypto
    Found in: golang.org/x/crypto@v0.31.0
    Fixed in: golang.org/x/crypto@v0.56.0
    Vulnerable symbols found:
      #1: ssh.Dial
      #2: ssh.Dial
      #3: ssh.Dial
      #4: ssh.Dial
      #5: ssh.Dial
      Use '-show traces' to see the other 25 found symbols

Vulnerability #14: GO-2026-6354
    Prevent DoS on deadlocked undecided channel in golang.org/x/crypto/ssh
  More info: https://pkg.go.dev/vuln/GO-2026-6354
  Module: golang.org/x/crypto
    Found in: golang.org/x/crypto@v0.31.0
    Fixed in: golang.org/x/crypto@v0.56.0
    Vulnerable symbols found:
      #1: ssh.Dial
      #2: ssh.Dial
      #3: ssh.Dial
      #4: ssh.Dial
      #5: ssh.Dial
      Use '-show traces' to see the other 27 found symbols

Vulnerability #15: GO-2026-6303
    Source-address critical option not enforced for non-public-key auth
    callbacks in golang.org/x/crypto/ssh
  More info: https://pkg.go.dev/vuln/GO-2026-6303
  Module: golang.org/x/crypto
    Found in: golang.org/x/crypto@v0.31.0
    Fixed in: golang.org/x/crypto@v0.55.0
    Vulnerable symbols found:
      #1: ssh.NewServerConn
      #2: ssh.NewServerConn
      #3: ssh.NewServerConn
      #4: ssh.NewServerConn
      #5: ssh.NewServerConn
      Use '-show traces' to see the other 7 found symbols

Vulnerability #16: GO-2026-6218
    Avoid quadratic complexity in resolvePath in net/url
  More info: https://pkg.go.dev/vuln/GO-2026-6218
  Standard library
    Found in: net/url@go1.24.13
    Fixed in: net/url@go1.25.13
    Vulnerable symbols found:
      #1: url.URL.Parse
      #2: url.URL.Parse
      #3: url.URL.ResolveReference

Vulnerability #17: GO-2026-6091
    Fix Javascript regexp context tracking in html/template
  More info: https://pkg.go.dev/vuln/GO-2026-6091
  Standard library
    Found in: html/template@go1.24.13
    Fixed in: html/template@go1.25.13
    Vulnerable symbols found:
      #1: template.Template.Execute
      #2: template.Template.Execute
      #3: template.Template.Execute
      #4: template.Template.Execute
      #5: template.Template.Execute
      Use '-show traces' to see the other 9 found symbols

Vulnerability #18: GO-2026-6090
    Limit handshake messages we are willing to accept post-handshake in
    crypto/tls
  More info: https://pkg.go.dev/vuln/GO-2026-6090
  Standard library
    Found in: crypto/tls@go1.24.13
    Fixed in: crypto/tls@go1.25.13
    Vulnerable symbols found:
      #1: tls.Conn.Handshake
      #2: tls.Conn.Handshake
      #3: tls.Conn.Handshake
      #4: tls.Conn.Handshake
      #5: tls.Conn.HandshakeContext
      Use '-show traces' to see the other 34 found symbols

Vulnerability #19: GO-2026-6089
    Apply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/http
  More info: https://pkg.go.dev/vuln/GO-2026-6089
  Standard library
    Found in: net/http@go1.24.13
    Fixed in: net/http@go1.25.13
    Vulnerable symbols found:
      #1: http.ListenAndServe
      #2: http.ListenAndServe
      #3: http.ListenAndServe
      #4: http.ListenAndServe
      #5: http.ListenAndServe
      Use '-show traces' to see the other 75 found symbols

Vulnerability #20: GO-2026-6088
    Add recursion depth guard during decode in encoding/xml
  More info: https://pkg.go.dev/vuln/GO-2026-6088
  Standard library
    Found in: encoding/xml@go1.24.13
    Fixed in: encoding/xml@go1.25.13
    Vulnerable symbols found:
      #1: xml.Decoder.Decode
      #2: xml.Decoder.DecodeElement
      #3: xml.Decoder.RawToken
      #4: xml.Decoder.Skip
      #5: xml.Decoder.Token
      Use '-show traces' to see the other 1 found symbols

Vulnerability #21: GO-2026-5972
    Enforce maximum recursion depth in encoding/asn1
  More info: https://pkg.go.dev/vuln/GO-2026-5972
  Standard library
    Found in: encoding/asn1@go1.24.13
    Fixed in: encoding/asn1@go1.25.13
    Vulnerable symbols found:
      #1: asn1.Unmarshal
      #2: asn1.UnmarshalWithParams

Vulnerability #22: GO-2026-5932
    The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design,
    and has known security issues
  More info: https://pkg.go.dev/vuln/GO-2026-5932
  Module: golang.org/x/crypto
    Found in: golang.org/x/crypto@v0.31.0
    Fixed in: N/A
    Vulnerable symbols found:
      #1: armor.golang.org/x/crypto/openpgp/armor/*
      #2: clearsign.golang.org/x/crypto/openpgp/clearsign/*
      #3: elgamal.golang.org/x/crypto/openpgp/elgamal/*
      #4: errors.golang.org/x/crypto/openpgp/errors/*
      #5: openpgp.golang.org/x/crypto/openpgp/*
      Use '-show traces' to see the other 2 found symbols

Vulnerability #23: GO-2026-5856
    Invoking Encrypted Client Hello privacy leak in crypto/tls
  More info: https://pkg.go.dev/vuln/GO-2026-5856
  Standard library
    Found in: crypto/tls@go1.24.13
    Fixed in: crypto/tls@go1.25.12
    Vulnerable symbols found:
      #1: tls.Conn.Handshake
      #2: tls.Conn.Handshake
      #3: tls.Conn.Handshake
      #4: tls.Conn.Handshake
      #5: tls.Conn.HandshakeContext
      Use '-show traces' to see the other 35 found symbols

Vulnerability #24: GO-2026-5039
    Arbitrary inputs are included in errors without any escaping in
    net/textproto
  More info: https://pkg.go.dev/vuln/GO-2026-5039
  Standard library
    Found in: net/textproto@go1.24.13
    Fixed in: net/textproto@go1.25.11
    Vulnerable symbols found:
      #1: textproto.Error.Error
      #2: textproto.Reader.ReadCodeLine
      #3: textproto.Reader.ReadMIMEHeader
      #4: textproto.Reader.ReadMIMEHeader
      #5: textproto.Reader.ReadResponse

Vulnerability #25: GO-2026-5038
    Quadratic complexity in WordDecoder.DecodeHeader in mime
  More info: https://pkg.go.dev/vuln/GO-2026-5038
  Standard library
    Found in: mime@go1.24.13
    Fixed in: mime@go1.25.11
    Vulnerable symbols found:
      #1: mime.WordDecoder.DecodeHeader

Vulnerability #26: GO-2026-5037
    Inefficient candidate hostname parsing in crypto/x509
  More info: https://pkg.go.dev/vuln/GO-2026-5037
  Standard library
    Found in: crypto/x509@go1.24.13
    Fixed in: crypto/x509@go1.25.11
    Vulnerable symbols found:
      #1: x509.Certificate.Verify
      #2: x509.Certificate.Verify
      #3: x509.Certificate.Verify
      #4: x509.Certificate.VerifyHostname
      #5: x509.HostnameError.Error

Vulnerability #27: GO-2026-5033
    Invoking pathological inputs can lead to client panic in
    golang.org/x/crypto/ssh/agent
  More info: https://pkg.go.dev/vuln/GO-2026-5033
  Module: golang.org/x/crypto
    Found in: golang.org/x/crypto@v0.31.0
    Fixed in: golang.org/x/crypto@v0.52.0
    Vulnerable symbols found:
      #1: agent.ForwardToAgent
      #2: agent.ForwardToAgent
      #3: agent.ServeAgent
      #4: agent.ServeAgent

Vulnerability #28: GO-2026-5026
    Invoking failure to reject ASCII-only Punycode-encoded labels in
    golang.org/x/net/idna
  More info: https://pkg.go.dev/vuln/GO-2026-5026
  Standard library
    Found in: net/http/internal/http2@go1.24.13
    Fixed in: net/http/internal/http2@go1.25.13
    Vulnerable symbols found:
      #1: http.Client.CloseIdleConnections
      #2: http.Client.CloseIdleConnections
      #3: http.Client.CloseIdleConnections
      #4: http.Client.CloseIdleConnections
      #5: http.Client.CloseIdleConnections
      Use '-show traces' to see the other 248 found symbols

Vulnerability #29: GO-2026-5023
    Invoking VerifiedPublicKeyCallback permissions skip enforcement in
    golang.org/x/crypto/ssh
  More info: https://pkg.go.dev/vuln/GO-2026-5023
  Module: golang.org/x/crypto
    Found in: golang.org/x/crypto@v0.31.0
    Fixed in: golang.org/x/crypto@v0.52.0
    Vulnerable symbols found:
      #1: ssh.NewServerConn
      #2: ssh.NewServerConn
      #3: ssh.NewServerConn
      #4: ssh.NewServerConn
      #5: ssh.NewServerConn
      Use '-show traces' to see the other 7 found symbols

Vulnerability #30: GO-2026-5021
    Invoking auth bypass via unenforced @revoked status in
    golang.org/x/crypto/ssh/knownhosts
  More info: https://pkg.go.dev/vuln/GO-2026-5021
  Module: golang.org/x/crypto
    Found in: golang.org/x/crypto@v0.31.0
    Fixed in: golang.org/x/crypto@v0.52.0
    Vulnerable symbols found:
      #1: knownhosts.hostKeyDB.IsRevoked

Vulnerability #31: GO-2026-5020
    Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh
  More info: https://pkg.go.dev/vuln/GO-2026-5020
  Module: golang.org/x/crypto
    Found in: golang.org/x/crypto@v0.31.0
    Fixed in: golang.org/x/crypto@v0.52.0
    Vulnerable symbols found:
      #1: ssh.Dial
      #2: ssh.Dial
      #3: ssh.Dial
      #4: ssh.Dial
      #5: ssh.Dial
      Use '-show traces' to see the other 72 found symbols

Vulnerability #32: GO-2026-5019
    Invoking bypass of FIDO/U2F security keys physical interaction in
    golang.org/x/crypto/ssh
  More info: https://pkg.go.dev/vuln/GO-2026-5019
  Module: golang.org/x/crypto
    Found in: golang.org/x/crypto@v0.31.0
    Fixed in: golang.org/x/crypto@v0.52.0
    Vulnerable symbols found:
      #1: ssh.CertChecker.Authenticate
      #2: ssh.CertChecker.Authenticate
      #3: ssh.CertChecker.CheckCert
      #4: ssh.CertChecker.CheckHostKey
      #5: ssh.CertChecker.CheckHostKey
      Use '-show traces' to see the other 31 found symbols

Vulnerability #33: GO-2026-5018
    Invoking pathological RSA/DSA parameters may cause DoS in
    golang.org/x/crypto/ssh
  More info: https://pkg.go.dev/vuln/GO-2026-5018
  Module: golang.org/x/crypto
    Found in: golang.org/x/crypto@v0.31.0
    Fixed in: golang.org/x/crypto@v0.52.0
    Vulnerable symbols found:
      #1: ssh.Dial
      #2: ssh.Dial
      #3: ssh.Dial
      #4: ssh.Dial
      #5: ssh.Dial
      Use '-show traces' to see the other 31 found symbols

Vulnerability #34: GO-2026-5017
    Invoking client can cause server deadlock on unexpected responses in
    golang.org/x/crypto/ssh
  More info: https://pkg.go.dev/vuln/GO-2026-5017
  Module: golang.org/x/crypto
    Found in: golang.org/x/crypto@v0.31.0
    Fixed in: golang.org/x/crypto@v0.52.0
    Vulnerable symbols found:
      #1: ssh.Client.Listen
      #2: ssh.Client.Listen
      #3: ssh.Client.ListenTCP
      #4: ssh.Client.ListenTCP
      #5: ssh.Client.ListenUnix
      Use '-show traces' to see the other 64 found symbols

Vulnerability #35: GO-2026-5016
    Invoking memory leak when rejecting channels can lead to DoS in
    golang.org/x/crypto/ssh
  More info: https://pkg.go.dev/vuln/GO-2026-5016
  Module: golang.org/x/crypto
    Found in: golang.org/x/crypto@v0.31.0
    Fixed in: golang.org/x/crypto@v0.52.0
    Vulnerable symbols found:
      #1: ssh.channel.Reject
      #2: ssh.channel.Reject

Vulnerability #36: GO-2026-5015
    Invoking server panic during CheckHostKey/Authenticate in
    golang.org/x/crypto/ssh
  More info: https://pkg.go.dev/vuln/GO-2026-5015
  Module: golang.org/x/crypto
    Found in: golang.org/x/crypto@v0.31.0
    Fixed in: golang.org/x/crypto@v0.52.0
    Vulnerable symbols found:
      #1: ssh.CertChecker.Authenticate
      #2: ssh.CertChecker.Authenticate
      #3: ssh.CertChecker.CheckHostKey
      #4: ssh.CertChecker.CheckHostKey

Vulnerability #37: GO-2026-5014
    Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh
  More info: https://pkg.go.dev/vuln/GO-2026-5014
  Module: golang.org/x/crypto
    Found in: golang.org/x/crypto@v0.31.0
    Fixed in: golang.org/x/crypto@v0.52.0
    Vulnerable symbols found:
      #1: ssh.NewServerConn
      #2: ssh.NewServerConn
      #3: ssh.NewServerConn
      #4: ssh.NewServerConn
      #5: ssh.NewServerConn
      Use '-show traces' to see the other 7 found symbols

Vulnerability #38: GO-2026-5013
    Invoking byte arithmetic causes underflow and panic in
    golang.org/x/crypto/ssh
  More info: https://pkg.go.dev/vuln/GO-2026-5013
  Module: golang.org/x/crypto
    Found in: golang.org/x/crypto@v0.31.0
    Fixed in: golang.org/x/crypto@v0.52.0
    Vulnerable symbols found:
      #1: ssh.Dial
      #2: ssh.Dial
      #3: ssh.Dial
      #4: ssh.Dial
      #5: ssh.Dial
      Use '-show traces' to see the other 51 found symbols

Vulnerability #39: GO-2026-5006
    Invoking agent constraints dropped when forwarding keys in
    golang.org/x/crypto/ssh/agent
  More info: https://pkg.go.dev/vuln/GO-2026-5006
  Module: golang.org/x/crypto
    Found in: golang.org/x/crypto@v0.31.0
    Fixed in: golang.org/x/crypto@v0.52.0
    Vulnerable symbols found:
      #1: agent.client.Add
      #2: agent.keyring.Add
      #3: agent.keyring.Add

Vulnerability #40: GO-2026-5005
    Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent
  More info: https://pkg.go.dev/vuln/GO-2026-5005
  Module: golang.org/x/crypto
    Found in: golang.org/x/crypto@v0.31.0
    Fixed in: golang.org/x/crypto@v0.52.0
    Vulnerable symbols found:
      #1: agent.keyring.Add
      #2: agent.keyring.Add

Vulnerability #41: GO-2026-4986
    Quadratic string concatentation in consumeComment in net/mail
  More info: https://pkg.go.dev/vuln/GO-2026-4986
  Standard library
    Found in: net/mail@go1.24.13
    Fixed in: net/mail@go1.25.10
    Vulnerable symbols found:
      #1: mail.AddressParser.Parse
      #2: mail.AddressParser.Parse
      #3: mail.AddressParser.ParseList
      #4: mail.AddressParser.ParseList
      #5: mail.Header.AddressList
      Use '-show traces' to see the other 7 found symbols

Vulnerability #42: GO-2026-4982
    Bypass of meta content URL escaping causes XSS in html/template
  More info: https://pkg.go.dev/vuln/GO-2026-4982
  Standard library
    Found in: html/template@go1.24.13
    Fixed in: html/template@go1.25.10
    Vulnerable symbols found:
      #1: template.Template.Execute
      #2: template.Template.Execute
      #3: template.Template.Execute
      #4: template.Template.Execute
      #5: template.Template.Execute
      Use '-show traces' to see the other 9 found symbols

Vulnerability #43: GO-2026-4981
    Crash when handling long CNAME response in net
  More info: https://pkg.go.dev/vuln/GO-2026-4981
  Standard library
    Found in: net@go1.24.13
    Fixed in: net@go1.25.10
    Vulnerable symbols found:
      #1: net.LookupCNAME
      #2: net.LookupCNAME
      #3: net.Resolver.LookupCNAME
      #4: net.Resolver.LookupCNAME

Vulnerability #44: GO-2026-4980
    Escaper bypass leads to XSS in html/template
  More info: https://pkg.go.dev/vuln/GO-2026-4980
  Standard library
    Found in: html/template@go1.24.13
    Fixed in: html/template@go1.25.10
    Vulnerable symbols found:
      #1: template.Template.Execute
      #2: template.Template.Execute
      #3: template.Template.Execute
      #4: template.Template.Execute
      #5: template.Template.Execute
      Use '-show traces' to see the other 9 found symbols

Vulnerability #45: GO-2026-4977
    Quadratic string concatenation in consumePhrase in net/mail
  More info: https://pkg.go.dev/vuln/GO-2026-4977
  Standard library
    Found in: net/mail@go1.24.13
    Fixed in: net/mail@go1.25.10
    Vulnerable symbols found:
      #1: mail.AddressParser.Parse
      #2: mail.AddressParser.Parse
      #3: mail.AddressParser.ParseList
      #4: mail.AddressParser.ParseList
      #5: mail.Header.AddressList
      Use '-show traces' to see the other 5 found symbols

Vulnerability #46: GO-2026-4976
    ReverseProxy forwards queries with more than urlmaxqueryparams parameters in
    net/http/httputil
  More info: https://pkg.go.dev/vuln/GO-2026-4976
  Standard library
    Found in: net/http/httputil@go1.24.13
    Fixed in: net/http/httputil@go1.25.10
    Vulnerable symbols found:
      #1: httputil.ReverseProxy.ServeHTTP
      #2: httputil.ReverseProxy.ServeHTTP

Vulnerability #47: GO-2026-4971
    Panic in Dial and LookupPort when handling NUL byte on Windows in net
  More info: https://pkg.go.dev/vuln/GO-2026-4971
  Standard library
    Found in: net@go1.24.13
    Fixed in: net@go1.25.10
    Vulnerable symbols found:
      #1: net.Dial
      #2: net.DialTimeout
      #3: net.Dialer.Dial
      #4: net.Dialer.DialContext
      #5: net.Listen
      Use '-show traces' to see the other 28 found symbols

Vulnerability #48: GO-2026-4970
    Root escape via symlink plus trailing slash in os
  More info: https://pkg.go.dev/vuln/GO-2026-4970
  Standard library
    Found in: os@go1.24.13
    Fixed in: os@go1.25.12
    Vulnerable symbols found:
      #1: os.OpenInRoot
      #2: os.Root.Create
      #3: os.Root.Open
      #4: os.Root.OpenFile
      #5: os.Root.OpenRoot
      Use '-show traces' to see the other 6 found symbols

Vulnerability #49: GO-2026-4947
    Unexpected work during chain building in crypto/x509
  More info: https://pkg.go.dev/vuln/GO-2026-4947
  Standard library
    Found in: crypto/x509@go1.24.13
    Fixed in: crypto/x509@go1.25.9
    Vulnerable symbols found:
      #1: x509.Certificate.Verify
      #2: x509.Certificate.Verify
      #3: x509.Certificate.Verify

Vulnerability #50: GO-2026-4946
    Inefficient policy validation in crypto/x509
  More info: https://pkg.go.dev/vuln/GO-2026-4946
  Standard library
    Found in: crypto/x509@go1.24.13
    Fixed in: crypto/x509@go1.25.9
    Vulnerable symbols found:
      #1: x509.Certificate.Verify
      #2: x509.Certificate.Verify
      #3: x509.Certificate.Verify

Vulnerability #51: GO-2026-4918
    Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in
    net/http/internal/http2 in golang.org/x/net
  More info: https://pkg.go.dev/vuln/GO-2026-4918
  Standard library
    Found in: net/http@go1.24.13
    Fixed in: net/http@go1.25.10
    Vulnerable symbols found:
      #1: http.Client.CloseIdleConnections
      #2: http.Client.CloseIdleConnections
      #3: http.Client.CloseIdleConnections
      #4: http.Client.CloseIdleConnections
      #5: http.Client.CloseIdleConnections
      Use '-show traces' to see the other 321 found symbols

Vulnerability #52: GO-2026-4870
    Unauthenticated TLS 1.3 KeyUpdate record can cause persistent connection
    retention and DoS in crypto/tls
  More info: https://pkg.go.dev/vuln/GO-2026-4870
  Standard library
    Found in: crypto/tls@go1.24.13
    Fixed in: crypto/tls@go1.25.9
    Vulnerable symbols found:
      #1: tls.Conn.Handshake
      #2: tls.Conn.Handshake
      #3: tls.Conn.Handshake
      #4: tls.Conn.Handshake
      #5: tls.Conn.HandshakeContext
      Use '-show traces' to see the other 34 found symbols

Vulnerability #53: GO-2026-4869
    Unbounded allocation for old GNU sparse in archive/tar
  More info: https://pkg.go.dev/vuln/GO-2026-4869
  Standard library
    Found in: archive/tar@go1.24.13
    Fixed in: archive/tar@go1.25.9
    Vulnerable symbols found:
      #1: tar.Reader.Next

Vulnerability #54: GO-2026-4865
    JsBraceDepth Context Tracking Bugs (XSS) in html/template
  More info: https://pkg.go.dev/vuln/GO-2026-4865
  Standard library
    Found in: html/template@go1.24.13
    Fixed in: html/template@go1.25.9
    Vulnerable symbols found:
      #1: template.Error.Error
      #2: template.HTMLEscaper
      #3: template.JSEscape
      #4: template.JSEscapeString
      #5: template.JSEscaper
      Use '-show traces' to see the other 27 found symbols

Vulnerability #55: GO-2026-4864
    TOCTOU permits root escape on Linux via Root.Chmod in os in
    internal/syscall/unix
  More info: https://pkg.go.dev/vuln/GO-2026-4864
  Standard library
    Found in: internal/syscall/unix@go1.24.13
    Fixed in: internal/syscall/unix@go1.25.9
    Platforms: linux
    Vulnerable symbols found:
      #1: unix.Fchmodat

Vulnerability #56: GO-2026-4603
    URLs in meta content attribute actions are not escaped in html/template
  More info: https://pkg.go.dev/vuln/GO-2026-4603
  Standard library
    Found in: html/template@go1.24.13
    Fixed in: html/template@go1.25.8
    Vulnerable symbols found:
      #1: template.Template.Execute
      #2: template.Template.Execute
      #3: template.Template.Execute
      #4: template.Template.Execute
      #5: template.Template.Execute
      Use '-show traces' to see the other 9 found symbols

Vulnerability #57: GO-2026-4602
    FileInfo can escape from a Root in os
  More info: https://pkg.go.dev/vuln/GO-2026-4602
  Standard library
    Found in: os@go1.24.13
    Fixed in: os@go1.25.8
    Vulnerable symbols found:
      #1: os.File.ReadDir
      #2: os.File.Readdir
      #3: os.ReadDir
      #4: os.dirFS.ReadDir
      #5: os.rootFS.ReadDir
      Use '-show traces' to see the other 1 found symbols

Vulnerability #58: GO-2026-4601
    Incorrect parsing of IPv6 host literals in net/url
  More info: https://pkg.go.dev/vuln/GO-2026-4601
  Standard library
    Found in: net/url@go1.24.13
    Fixed in: net/url@go1.25.8
    Vulnerable symbols found:
      #1: url.JoinPath
      #2: url.Parse
      #3: url.ParseRequestURI
      #4: url.URL.Parse
      #5: url.URL.Parse
      Use '-show traces' to see the other 1 found symbols

Vulnerability #59: GO-2025-4135
    Malformed constraint may cause denial of service in
    golang.org/x/crypto/ssh/agent
  More info: https://pkg.go.dev/vuln/GO-2025-4135
  Module: golang.org/x/crypto
    Found in: golang.org/x/crypto@v0.31.0
    Fixed in: golang.org/x/crypto@v0.45.0
    Vulnerable symbols found:
      #1: agent.ForwardToAgent
      #2: agent.ForwardToAgent
      #3: agent.ServeAgent
      #4: agent.ServeAgent

Vulnerability #60: GO-2025-4134
    Unbounded memory consumption in golang.org/x/crypto/ssh
  More info: https://pkg.go.dev/vuln/GO-2025-4134
  Module: golang.org/x/crypto
    Found in: golang.org/x/crypto@v0.31.0
    Fixed in: golang.org/x/crypto@v0.45.0
    Vulnerable symbols found:
      #1: ssh.NewServerConn
      #2: ssh.NewServerConn
      #3: ssh.NewServerConn
      #4: ssh.NewServerConn
      #5: ssh.NewServerConn
      Use '-show traces' to see the other 7 found symbols

Vulnerability #61: GO-2025-4116
    Potential denial of service in golang.org/x/crypto/ssh/agent
  More info: https://pkg.go.dev/vuln/GO-2025-4116
  Module: golang.org/x/crypto
    Found in: golang.org/x/crypto@v0.31.0
    Fixed in: golang.org/x/crypto@v0.43.0
    Vulnerable symbols found:
      #1: agent.agentKeyringSigner.Sign
      #2: agent.agentKeyringSigner.SignWithAlgorithm
      #3: agent.client.List
      #4: agent.client.Sign
      #5: agent.client.SignWithFlags
      Use '-show traces' to see the other 1 found symbols

Vulnerability #62: GO-2025-3487
    Potential denial of service in golang.org/x/crypto
  More info: https://pkg.go.dev/vuln/GO-2025-3487
  Module: golang.org/x/crypto
    Found in: golang.org/x/crypto@v0.31.0
    Fixed in: golang.org/x/crypto@v0.35.0
    Vulnerable symbols found:
      #1: ssh.Client.Dial
      #2: ssh.Client.DialContext
      #3: ssh.Client.DialTCP
      #4: ssh.Client.Listen
      #5: ssh.Client.Listen
      Use '-show traces' to see the other 117 found symbols

Your code is affected by 62 vulnerabilities from 1 module and the Go standard library.
This scan found no other vulnerabilities in packages you import or modules you
require.
Use '-show verbose' for more details.
