What’s Vulnerable › Products
Go vulnerabilities
179 known vulnerabilities, 2 confirmed exploited in the wild (CISA KEV), 51 published in the last 12 months.
Check whether your Go version is affected
Exploited Go vulnerabilities
- CVE-2023-44487 — HTTP/2 Rapid Reset Attack Vulnerability
- CVE-2020-0601 — Microsoft Windows CryptoAPI Spoofing Vulnerability
Latest Go vulnerabilities
- CVE-2026-94447 — Checksum database bypass for golang.org/toolchain in cmd/go (CVSS 7.8)
- CVE-2026-94444 — Checksum bypass for golang.org/fips140 in cmd/go (CVSS 7.8)
- CVE-2026-56865 — Fix transparency log tile verification bypass in golang.org/x/mod/sumdb/tlog (CVSS 8.4)
- CVE-2026-56864 — Ignore unrelated, unauthenticated hashes in Lookup in golang.org/x/mod/sumdb (CVSS 7.5)
- CVE-2026-42505 — Invoking Encrypted Client Hello privacy leak in crypto/tls (CVSS 5.3)
- CVE-2026-39822 — Root escape via symlink plus trailing slash in os (CVSS 7.8)
- CVE-2023-54365 — Traefik - Denial of Service via HTTP/2 Request Handling (CVSS 7.5)
- CVE-2026-42501 — Malicious module proxy can bypass checksum database in cmd/go (CVSS 7.5)
- CVE-2026-42499 — Quadratic string concatenation in consumePhrase in net/mail (CVSS 7.5)
- CVE-2026-39836 — Panic in Dial and LookupPort when handling NUL byte on Windows in net (CVSS 7.5)
- CVE-2026-39826 — Escaper bypass leads to XSS in html/template (CVSS 6.1)
- CVE-2026-39825 — ReverseProxy forwards queries with more than urlmaxqueryparams parameters in net/http/httputil (CVSS 5.3)
- CVE-2026-39823 — Bypass of meta content URL escaping causes XSS in html/template (CVSS 6.1)
- CVE-2026-39820 — Quadratic string concatentation in consumeComment in net/mail (CVSS 7.5)
- CVE-2026-39819 — Invoking "go bug" follows symlinks in predictable temporary filenames in cmd/go (CVSS 5.3)
- CVE-2026-39817 — Invoking "go tool pack" does not sanitize output paths in cmd/go (CVSS 5.9)
- CVE-2026-33814 — Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net (CVSS 7.5)
- CVE-2026-33811 — Crash when handling long CNAME response in net (CVSS 7.5)
- CVE-2026-33810 — Case-sensitive excludedSubtrees name constraints cause Auth Bypass in crypto/x509 (CVSS 8.2)
- CVE-2026-32289 — JsBraceDepth Context Tracking Bugs (XSS) in html/template (CVSS 6.1)
- CVE-2026-32288 — Unbounded allocation for old GNU sparse in archive/tar (CVSS 5.5)
- CVE-2026-32283 — Unauthenticated TLS 1.3 KeyUpdate record can cause persistent connection retention and DoS in crypto/tls (CVSS 7.5)
- CVE-2026-32282 — TOCTOU permits root escape on Linux via Root.Chmod in os in internal/syscall/unix (CVSS 6.4)
- CVE-2026-32281 — Inefficient policy validation in crypto/x509 (CVSS 7.5)
- CVE-2026-32280 — Unexpected work during chain building in crypto/x509 (CVSS 7.5)