VulnerableCode Package Details - pkg:alpm/archlinux/go@2:1.12.7-1

Search for packages

Vulnerability	Summary	Fixed by
VCID-hbte-dsw2-y7ad Aliases: CVE-2019-9512 GHSA-hgr8-6h9x-f7q9	golang.org/x/net/http vulnerable to ping floods Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service. The attacker sends continual pings to an HTTP/2 peer, causing the peer to build an internal queue of responses. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both. ### Specific Go Packages Affected golang.org/x/net/http2	2:1.12.8-1 Affected by 0 other vulnerabilities.
VCID-n66u-b73u-zucb Aliases: CVE-2019-9514 GHSA-39qc-96h7-956f	golang.org/x/net/http vulnerable to a reset flood Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service. Servers that accept direct connections from untrusted clients could be remotely made to allocate an unlimited amount of memory, until the program crashes. The attacker opens a number of streams and sends an invalid request over each stream that should solicit a stream of RST_STREAM frames from the peer. Depending on how the peer queues the RST_STREAM frames, this can consume excess memory, CPU, or both. ### Specific Go Packages Affected golang.org/x/net/http2	2:1.12.8-1 Affected by 0 other vulnerabilities.
VCID-zvbg-n1t4-ckg9 Aliases: CVE-2019-14809	golang: malformed hosts in URLs leads to authorization bypass	2:1.12.8-1 Affected by 0 other vulnerabilities.

Vulnerability

Summary

Fixed by

VCID-hbte-dsw2-y7ad
Aliases:
CVE-2019-9512
GHSA-hgr8-6h9x-f7q9

golang.org/x/net/http vulnerable to ping floods Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service. The attacker sends continual pings to an HTTP/2 peer, causing the peer to build an internal queue of responses. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both. ### Specific Go Packages Affected golang.org/x/net/http2

2:1.12.8-1
Affected by 0 other vulnerabilities.

VCID-n66u-b73u-zucb
Aliases:
CVE-2019-9514
GHSA-39qc-96h7-956f

golang.org/x/net/http vulnerable to a reset flood Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service. Servers that accept direct connections from untrusted clients could be remotely made to allocate an unlimited amount of memory, until the program crashes. The attacker opens a number of streams and sends an invalid request over each stream that should solicit a stream of RST_STREAM frames from the peer. Depending on how the peer queues the RST_STREAM frames, this can consume excess memory, CPU, or both. ### Specific Go Packages Affected golang.org/x/net/http2

2:1.12.8-1
Affected by 0 other vulnerabilities.

VCID-zvbg-n1t4-ckg9
Aliases:
CVE-2019-14809

golang: malformed hosts in URLs leads to authorization bypass

2:1.12.8-1
Affected by 0 other vulnerabilities.

Vulnerability	Summary	Aliases
This package is not known to fix vulnerabilities.

Vulnerability

Summary

Aliases

This package is not known to fix vulnerabilities.

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2026-04-01T18:27:01.705687+00:00	Arch Linux Importer	Affected by	VCID-zvbg-n1t4-ckg9	https://security.archlinux.org/AVG-1021	38.0.0
2026-04-01T18:27:01.681230+00:00	Arch Linux Importer	Affected by	VCID-hbte-dsw2-y7ad	https://security.archlinux.org/AVG-1021	38.0.0
2026-04-01T18:27:01.649300+00:00	Arch Linux Importer	Affected by	VCID-n66u-b73u-zucb	https://security.archlinux.org/AVG-1021	38.0.0