GO
Vendor
Golang
234
CVEs
4
On KEV
0
New 30D
Products
GO10.0
GO
Golang
172 CVEs2 on KEV0 new
HT7.5
Http2
Golang
5 CVEs1 on KEV0 new
NE7.5
Networking
Golang
2 CVEs1 on KEV0 new
CR10.0
Crypto
Golang
22 CVEs0 on KEV0 new
NE9.6
Net
Golang
12 CVEs0 on KEV0 new
IM7.5
Image
Golang
6 CVEs0 on KEV0 new
TE7.5
Text
Golang
4 CVEs0 on KEV0 new
SS7.5
Ssh
Golang
3 CVEs0 on KEV0 new
TI7.5
Tiff
Golang
3 CVEs0 on KEV0 new
GO8.8
Gopls
Golang
1 CVEs0 on KEV0 new
H27.5
H2c
Golang
1 CVEs0 on KEV0 new
HP7.5
Hpack
Golang
1 CVEs0 on KEV0 new
PS7.5
Package Ssh
Golang
1 CVEs0 on KEV0 new
PR8.6
Protobuf
Golang
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-56855 | CR Crypto Golang | 7.5 | Sep 2 | Prevent DoS on deadlocked established channel in golang.org/x/crypto/ssh |
| CVE-2026-78662 | CR Crypto Golang | 7.5 | Sep 2 | Prevent DoS on deadlocked undecided channel in golang.org/x/crypto/ssh |
| CVE-2026-42505 | GO GO Golang | 5.3 | Jul 8 | Invoking Encrypted Client Hello privacy leak in crypto/tls |
| CVE-2026-39822 | GO GO Golang | 7.8 | Jul 8 | Root escape via symlink plus trailing slash in os |
| CVE-2026-46604 | TI Tiff Golang | 7.5 | Jun 26 | Panic decoding image with out-of-bounds strip offset in x/image/tiff in golang.org/x/image |
| CVE-2023-54365 | GO GO Golang | 7.5 | Jun 23 | Traefik - Denial of Service via HTTP/2 Request Handling |
| CVE-2026-27136 | NE Net Golang | 6.1 | May 22 | Invoking duplicate attributes can cause XSS in golang.org/x/net/html |
| CVE-2026-25681 | NE Net Golang | 6.1 | May 22 | Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html |
| CVE-2026-25680 | NE Net Golang | 6.5 | May 22 | Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html |
| CVE-2026-42502 | NE Net Golang | 6.1 | May 22 | Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html |
| CVE-2026-39821 | NE Net Golang | 9.6 | May 22 | Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna |
| CVE-2026-42506 | NE Net Golang | 6.1 | May 22 | Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html |
| CVE-2026-46598 | CR Crypto Golang | 5.3 | May 22 | Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent |
| CVE-2026-46595 | CR Crypto Golang | 10.0 | May 22 | Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh |
| CVE-2026-42508 | CR Crypto Golang | 9.1 | May 22 | Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts |
| CVE-2026-39834 | CR Crypto Golang | 9.1 | May 22 | Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh |
| CVE-2026-39831 | CR Crypto Golang | 9.1 | May 22 | Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh |
| CVE-2026-39829 | CR Crypto Golang | 7.5 | May 22 | Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh |
| CVE-2026-39830 | CR Crypto Golang | 9.1 | May 22 | Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh |
| CVE-2026-39827 | CR Crypto Golang | 6.5 | May 22 | Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh |
| CVE-2026-39835 | CR Crypto Golang | 5.3 | May 22 | Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh |
| CVE-2026-39828 | CR Crypto Golang | 6.3 | May 22 | Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh |
| CVE-2026-46597 | CR Crypto Golang | 7.5 | May 22 | Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh |
| CVE-2026-39832 | CR Crypto Golang | 9.1 | May 22 | Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent |
| CVE-2026-39833 | CR Crypto Golang | 9.1 | May 22 | Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent |
| CVE-2026-39820 | GO GO Golang | 7.5 | May 7 | Quadratic string concatentation in consumeComment in net/mail |
| CVE-2026-42501 | GO GO Golang | 7.5 | May 7 | Malicious module proxy can bypass checksum database in cmd/go |
| CVE-2026-39823 | GO GO Golang | 6.1 | May 7 | Bypass of meta content URL escaping causes XSS in html/template |
| CVE-2026-33811 | GO GO Golang | 7.5 | May 7 | Crash when handling long CNAME response in net |
| CVE-2026-39826 | GO GO Golang | 6.1 | May 7 | Escaper bypass leads to XSS in html/template |
| CVE-2026-39817 | GO GO Golang | 5.9 | May 7 | Invoking "go tool pack" does not sanitize output paths in cmd/go |
| CVE-2026-39819 | GO GO Golang | 5.3 | May 7 | Invoking "go bug" follows symlinks in predictable temporary filenames in cmd/go |
| CVE-2026-42499 | GO GO Golang | 7.5 | May 7 | Quadratic string concatenation in consumePhrase in net/mail |
| CVE-2026-39825 | GO GO Golang | 5.3 | May 7 | ReverseProxy forwards queries with more than urlmaxqueryparams parameters in net/http/httputil |
| CVE-2026-39836 | GO GO Golang | 7.5 | May 7 | Panic in Dial and LookupPort when handling NUL byte on Windows in net |
| CVE-2026-33814 | HT Http2 Golang | 7.5 | May 7 | Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net |
| CVE-2026-42503 | GO Gopls Golang | 8.8 | May 6 | Accidental binding to INADDR_ANY might lead to RCE in golang.org/x/tools/gopls |
| CVE-2026-33812 | IM Image Golang | 6.1 | Apr 21 | Excessive memory allocation when decoding malicious SFNT in golang.org/x/image |
| CVE-2026-33813 | IM Image Golang | 7.5 | Apr 21 | Panic when decoding large WEBP image on 32-bit platforms in golang.org/x/image |
| CVE-2026-32280 | GO GO Golang | 7.5 | Apr 8 | Unexpected work during chain building in crypto/x509 |
| CVE-2026-32281 | GO GO Golang | 7.5 | Apr 8 | Inefficient policy validation in crypto/x509 |
| CVE-2026-27140 | GO GO Golang | 8.8 | Apr 8 | Code execution vulnerability in SWIG code generation in cmd/go |
| CVE-2026-32283 | GO GO Golang | 7.5 | Apr 8 | Unauthenticated TLS 1.3 KeyUpdate record can cause persistent connection retention and DoS in crypto/tls |
| CVE-2026-32288 | GO GO Golang | 5.5 | Apr 8 | Unbounded allocation for old GNU sparse in archive/tar |
| CVE-2026-27143 | GO GO Golang | 9.8 | Apr 8 | Missing bound checks can lead to memory corruption in safe Go in cmd/compile |
| CVE-2026-27144 | GO GO Golang | 7.1 | Apr 8 | Miscompilation allows memory corruption via CONVNOP-wrapped array copy in cmd/compile |
| CVE-2026-33810 | GO GO Golang | 8.2 | Apr 8 | Case-sensitive excludedSubtrees name constraints cause Auth Bypass in crypto/x509 |
| CVE-2026-32289 | GO GO Golang | 6.1 | Apr 8 | JsBraceDepth Context Tracking Bugs (XSS) in html/template |
| CVE-2026-32282 | GO GO Golang | 6.4 | Apr 8 | TOCTOU permits root escape on Linux via Root.Chmod in os in internal/syscall/unix |
| CVE-2026-33809 | TI Tiff Golang | 5.3 | Mar 25 | OOM from malicious IFD offset in golang.org/x/image/tiff |
| CVE-2026-27142 | GO GO Golang | 6.1 | Mar 6 | URLs in meta content attribute actions are not escaped in html/template |
| CVE-2026-27139 | GO GO Golang | 2.5 | Mar 6 | FileInfo can escape from a Root in os |
| CVE-2026-25679 | GO GO Golang | 7.5 | Mar 6 | Incorrect parsing of IPv6 host literals in net/url |
| CVE-2026-27138 | GO GO Golang | 5.9 | Mar 6 | Panic in name constraint checking for malformed certificates in crypto/x509 |
| CVE-2026-27137 | GO GO Golang | 7.5 | Mar 6 | Incorrect enforcement of email constraints in crypto/x509 |
| CVE-2025-68121 | GO GO Golang | 10.0 | Feb 5 | Unexpected session resumption in crypto/tls |
| CVE-2025-61732 | GO GO Golang | 8.6 | Feb 5 | Potential code smuggling via doc comments in cmd/cgo |
| CVE-2025-22873 | GO GO Golang | 3.8 | Feb 4 | Improper access to parent directory of root in os |
| CVE-2025-61728 | GO GO Golang | 6.5 | Jan 28 | Excessive CPU consumption when building archive index in archive/zip |
| CVE-2025-61726 | GO GO Golang | 7.5 | Jan 28 | Memory exhaustion in query parameter parsing in net/url |