_{Report generated on: February 07, 2026 at 03:20 UTC}

Introduction

Our Commitment to Security

Welcome to the UniDoc Security Hub. At UniDoc, the security of our products is a top priority. We are committed to being transparent with our customers about the security of our UniPDF, UniOffice, and UniHTML libraries. This hub is a key part of that commitment, demonstrating our proactive approach to identifying and addressing security vulnerabilities.

DevSecOps Lifecycle

graph TD
    A[Developer Commits Code] --> B(CI Pipeline Starts);
    subgraph B [Continuous Integration]
        C(Build & Unit Test) --> D{Security Scans};
        subgraph D
            E[SAST Analysis];
            F[Go Package Scan];
            G[Supply Chain Scan];
        end
    end
    D --> H{Vulnerability Found?};
    H -- Yes --> I[Triage & Prioritize];
    I --> J(Remediate Vulnerability);
    J --> A;
    H -- No --> K(Release Secure Product);

Vulnerability Management

graph TD
    A[Discover] --> B(Prioritize);
    B --> C{Remediate};
    C --> D[Verify];
    D --> A;

_{Report generated on: February 07, 2026 at 03:20 UTC}

All Products Vulnerability Report

Covered Products

Product Name	Repository
UniPDF	github.com/unidoc/unipdf
UniOffice	github.com/unidoc/unioffice
UniHTML	github.com/unidoc/unihtml

Key Findings for This Reporting Period

Total Open Vulnerabilities: Across all products, we are currently tracking 12 open vulnerabilities.
Progress: Over the last 12 months, we have fixed 10 vulnerabilities, including 0 critical ones.

12-Month Combined Vulnerability Trend

xychart-beta
    title "New vs. Fixed Vulnerabilities (Last 12 Months)"
    x-axis "Month" ["2025-03", "2025-04", "2025-05", "2025-06", "2025-07", "2025-08", "2025-09", "2025-10", "2025-11", "2025-12", "2026-01", "2026-02"]
    y-axis "Count"
    bar "New" [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]
    bar "Fixed" [0, 0, 0, 0, 0, 3, 7, 0, 0, 0, 0, 0]

Month	Fixed	Total at Month End
2026-02	0	12
2026-01	0	12
2025-12	0	12
2025-11	0	12
2025-10	0	12
2025-09	7	12
2025-08	3	19
2025-07	0	22
2025-06	0	22
2025-05	0	22
2025-04	0	22
2025-03	0	22

Detailed Vulnerability List

Total Open Vulnerabilities: 12

CVE Identifier	Severity	Package Name	Description
CVE-2025-47914	MEDIUM	golang.org/x/crypto	golang.org/x/crypto/ssh/agent: SSH Agent servers: Denial of Service due to malformed messages
CVE-2025-58181	MEDIUM	golang.org/x/crypto	golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via unbounded memory consumption in GSSAPI authentication
CVE-2023-36308	LOW	github.com/disintegration/imaging	disintegration Imaging 1.6.2 allows attackers to cause a panic (becaus ...
CVE-2025-47914	MEDIUM	golang.org/x/crypto	golang.org/x/crypto/ssh/agent: SSH Agent servers: Denial of Service due to malformed messages
CVE-2025-58181	MEDIUM	golang.org/x/crypto	golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via unbounded memory consumption in GSSAPI authentication
CVE-2023-36308	LOW	github.com/disintegration/imaging	disintegration Imaging 1.6.2 allows attackers to cause a panic (becaus ...
CVE-2025-47914	MEDIUM	golang.org/x/crypto	golang.org/x/crypto/ssh/agent: SSH Agent servers: Denial of Service due to malformed messages
CVE-2025-58181	MEDIUM	golang.org/x/crypto	golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via unbounded memory consumption in GSSAPI authentication
CVE-2025-47914	MEDIUM	golang.org/x/crypto	golang.org/x/crypto/ssh/agent: SSH Agent servers: Denial of Service due to malformed messages
CVE-2025-58181	MEDIUM	golang.org/x/crypto	golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via unbounded memory consumption in GSSAPI authentication
CVE-2025-47914	MEDIUM	golang.org/x/crypto	golang.org/x/crypto/ssh/agent: SSH Agent servers: Denial of Service due to malformed messages
CVE-2025-58181	MEDIUM	golang.org/x/crypto	golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via unbounded memory consumption in GSSAPI authentication

Total Fixed Vulnerabilities (Last 12 Months): 10

CVE Identifier	Severity	Package Name	Description
CVE-2025-22869	HIGH	golang.org/x/crypto	golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh
CVE-2025-22870	MEDIUM	golang.org/x/net	golang.org/x/net/proxy: golang.org/x/net/http/httpproxy: HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net
CVE-2025-22872	MEDIUM	golang.org/x/net	golang.org/x/net/html: Incorrect Neutralization of Input During Web Page Generation in x/net in golang.org/x/net
CVE-2025-22869	HIGH	golang.org/x/crypto	golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh
CVE-2025-22870	MEDIUM	golang.org/x/net	golang.org/x/net/proxy: golang.org/x/net/http/httpproxy: HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net
CVE-2025-22872	MEDIUM	golang.org/x/net	golang.org/x/net/html: Incorrect Neutralization of Input During Web Page Generation in x/net in golang.org/x/net
CVE-2025-22869	HIGH	golang.org/x/crypto	golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh
CVE-2025-22870	MEDIUM	golang.org/x/net	golang.org/x/net/proxy: golang.org/x/net/http/httpproxy: HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net
CVE-2025-22872	MEDIUM	golang.org/x/net	golang.org/x/net/html: Incorrect Neutralization of Input During Web Page Generation in x/net in golang.org/x/net
GHSA-vrw8-fxc6-2r93	MEDIUM	github.com/go-chi/chi/v5	chi Allows Host Header Injection which Leads to Open Redirect in RedirectSlashes

_{Report generated on: February 07, 2026 at 03:20 UTC}

UniPDF Vulnerability Report

Current Status

Total Open Vulnerabilities: 2

Severity	Count
CRITICAL	0
HIGH	0
MEDIUM	2
LOW	0
UNKNOWN	0
Total	2

12-Month Vulnerability Trend

xychart-beta
    title "New vs. Fixed Vulnerabilities (Last 12 Months)"
    x-axis "Month" ["2025-03", "2025-04", "2025-05", "2025-06", "2025-07", "2025-08", "2025-09", "2025-10", "2025-11", "2025-12", "2026-01", "2026-02"]
    y-axis "Count"
    bar "New" [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]
    bar "Fixed" [0, 0, 0, 0, 0, 3, 0, 0, 0, 0, 0, 0]

Month	Fixed	Total at Month End
2026-02	0	2
2026-01	0	2
2025-12	0	2
2025-11	0	2
2025-10	0	2
2025-09	0	2
2025-08	3	2
2025-07	0	5
2025-06	0	5
2025-05	0	5
2025-04	0	5
2025-03	0	5

Detailed Vulnerability List

Total Open Vulnerabilities: 2

CVE Identifier	Severity	Package Name	Description
CVE-2025-47914	MEDIUM	golang.org/x/crypto	golang.org/x/crypto/ssh/agent: SSH Agent servers: Denial of Service due to malformed messages
CVE-2025-58181	MEDIUM	golang.org/x/crypto	golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via unbounded memory consumption in GSSAPI authentication

Total Fixed Vulnerabilities (Last 12 Months): 3

CVE Identifier	Severity	Package Name	Description
CVE-2025-22869	HIGH	golang.org/x/crypto	golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh
CVE-2025-22870	MEDIUM	golang.org/x/net	golang.org/x/net/proxy: golang.org/x/net/http/httpproxy: HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net
CVE-2025-22872	MEDIUM	golang.org/x/net	golang.org/x/net/html: Incorrect Neutralization of Input During Web Page Generation in x/net in golang.org/x/net

_{Report generated on: February 07, 2026 at 03:20 UTC}

UniOffice Vulnerability Report

Current Status

Total Open Vulnerabilities: 6

Severity	Count
CRITICAL	0
HIGH	0
MEDIUM	4
LOW	2
UNKNOWN	0
Total	6

12-Month Vulnerability Trend

xychart-beta
    title "New vs. Fixed Vulnerabilities (Last 12 Months)"
    x-axis "Month" ["2025-03", "2025-04", "2025-05", "2025-06", "2025-07", "2025-08", "2025-09", "2025-10", "2025-11", "2025-12", "2026-01", "2026-02"]
    y-axis "Count"
    bar "New" [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]
    bar "Fixed" [0, 0, 0, 0, 0, 0, 3, 0, 0, 0, 0, 0]

Month	Fixed	Total at Month End
2026-02	0	6
2026-01	0	6
2025-12	0	6
2025-11	0	6
2025-10	0	6
2025-09	3	6
2025-08	0	9
2025-07	0	9
2025-06	0	9
2025-05	0	9
2025-04	0	9
2025-03	0	9

Detailed Vulnerability List

Total Open Vulnerabilities: 6

CVE Identifier	Severity	Package Name	Description
CVE-2023-36308	LOW	github.com/disintegration/imaging	disintegration Imaging 1.6.2 allows attackers to cause a panic (becaus ...
CVE-2025-47914	MEDIUM	golang.org/x/crypto	golang.org/x/crypto/ssh/agent: SSH Agent servers: Denial of Service due to malformed messages
CVE-2025-58181	MEDIUM	golang.org/x/crypto	golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via unbounded memory consumption in GSSAPI authentication
CVE-2023-36308	LOW	github.com/disintegration/imaging	disintegration Imaging 1.6.2 allows attackers to cause a panic (becaus ...
CVE-2025-47914	MEDIUM	golang.org/x/crypto	golang.org/x/crypto/ssh/agent: SSH Agent servers: Denial of Service due to malformed messages
CVE-2025-58181	MEDIUM	golang.org/x/crypto	golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via unbounded memory consumption in GSSAPI authentication

Total Fixed Vulnerabilities (Last 12 Months): 3

CVE Identifier	Severity	Package Name	Description
CVE-2025-22869	HIGH	golang.org/x/crypto	golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh
CVE-2025-22870	MEDIUM	golang.org/x/net	golang.org/x/net/proxy: golang.org/x/net/http/httpproxy: HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net
CVE-2025-22872	MEDIUM	golang.org/x/net	golang.org/x/net/html: Incorrect Neutralization of Input During Web Page Generation in x/net in golang.org/x/net

_{Report generated on: February 07, 2026 at 03:20 UTC}

UniHTML Vulnerability Report

Current Status

Total Open Vulnerabilities: 4

Severity	Count
CRITICAL	0
HIGH	0
MEDIUM	4
LOW	0
UNKNOWN	0
Total	4

12-Month Vulnerability Trend

xychart-beta
    title "New vs. Fixed Vulnerabilities (Last 12 Months)"
    x-axis "Month" ["2025-03", "2025-04", "2025-05", "2025-06", "2025-07", "2025-08", "2025-09", "2025-10", "2025-11", "2025-12", "2026-01", "2026-02"]
    y-axis "Count"
    bar "New" [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]
    bar "Fixed" [0, 0, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0]

Month	Fixed	Total at Month End
2026-02	0	4
2026-01	0	4
2025-12	0	4
2025-11	0	4
2025-10	0	4
2025-09	4	4
2025-08	0	8
2025-07	0	8
2025-06	0	8
2025-05	0	8
2025-04	0	8
2025-03	0	8

Detailed Vulnerability List

Total Open Vulnerabilities: 4

CVE Identifier	Severity	Package Name	Description
CVE-2025-47914	MEDIUM	golang.org/x/crypto	golang.org/x/crypto/ssh/agent: SSH Agent servers: Denial of Service due to malformed messages
CVE-2025-58181	MEDIUM	golang.org/x/crypto	golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via unbounded memory consumption in GSSAPI authentication
CVE-2025-47914	MEDIUM	golang.org/x/crypto	golang.org/x/crypto/ssh/agent: SSH Agent servers: Denial of Service due to malformed messages
CVE-2025-58181	MEDIUM	golang.org/x/crypto	golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via unbounded memory consumption in GSSAPI authentication

Total Fixed Vulnerabilities (Last 12 Months): 4

CVE Identifier	Severity	Package Name	Description
CVE-2025-22869	HIGH	golang.org/x/crypto	golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh
CVE-2025-22870	MEDIUM	golang.org/x/net	golang.org/x/net/proxy: golang.org/x/net/http/httpproxy: HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net
CVE-2025-22872	MEDIUM	golang.org/x/net	golang.org/x/net/html: Incorrect Neutralization of Input During Web Page Generation in x/net in golang.org/x/net
GHSA-vrw8-fxc6-2r93	MEDIUM	github.com/go-chi/chi/v5	chi Allows Host Header Injection which Leads to Open Redirect in RedirectSlashes

Keyboard shortcuts

UniDoc Security Hub