Search the public rule index by CVE, GHSA, CWE, language, framework, author, or rule slug. Filter by language, framework, severity, confidence, license, and validation status.
Passing a pointer variable directly to a deferred free/deallocation call evaluates the argument at defer registration time. If the variable is reassigned or reallocated later, the deferred call will free the stale pointer, potentially causing a double-free (CWE-415). Wrap the deallocation in a closure: defer func() { C.free(unsafe.Pointer(buf)) }().
Bundled zlib appears to be a pre-1.3.2 version (ZLIB_VERNUM < 0x1320 or ZLIB_VERSION string matches a pre-1.3.2 release such as "1.3.1.2-audit"). Versions prior to zlib 1.3.2 lack the 7ASecurity audit hardening fixes (CVE-2026-3381 / CVE-2026-27171): missing negative-length checks in crc32_combine, uninitialized-memory disclosure in inflateCopy/deflateCopy,
Vendored copy of zlib at version older than 1.3.2 detected. Versions <= 1.3.1 contain multiple security defects identified by the 7ASecurity audit (CVE-2026-27171, CVE-2026-3381 / CVE-2026-4176 in Perl's Compress::Raw::Zlib): missing NULL/zero-length guard in compress2(), non-thread-safe custom once() pattern in crc32 table init, and size_t-overflow risk in
