GO
Product
GO
On CISA KEVExploited in the wild
171
CVEs
2
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 18High 100Medium 49Low 3
Watch
Add GO to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-68121 | 10.0 | Feb 5 | Unexpected session resumption in crypto/tls Affected: before 1.24.13; 1.25.0 before 1.25.7; 1.26.0; 1.26.0 |
| CVE-2026-27143 | 9.8 | Apr 8 | Missing bound checks can lead to memory corruption in safe Go in cmd/compile Affected: before 1.25.9; 1.26.0 before 1.26.2 |
| CVE-2024-24790 | 9.8 | Jun 5 | The various Is methods (IsPrivate, IsLoopback, etc) did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would return true in their… Affected: before 1.21.11; 1.22.0 before 1.22.4 |
| CVE-2023-39320 | 9.8 | Sep 8 | The go.mod toolchain directive, introduced in Go 1.21, can be leveraged to execute scripts and binaries relative to the root of the module when the "go" command was executed… Affected: 1.21.0 before 1.21.1 |
| CVE-2023-29405 | 9.8 | Jun 8 | The go command may execute arbitrary code at build time when using cgo Affected: before 1.19.10; 1.20.0 before 1.20.5 |
| CVE-2023-29404 | 9.8 | Jun 8 | The go command may execute arbitrary code at build time when using cgo Affected: before 1.19.10; 1.20.0 before 1.20.5 |
| CVE-2023-29402 | 9.8 | Jun 8 | The go command may generate unexpected code at build time when using cgo Affected: before 1.19.10; 1.20.0 before 1.20.5 |
| CVE-2023-24540 | 9.8 | May 11 | Not all valid JavaScript whitespace characters are considered to be whitespace Affected: before 1.19.9; 1.20.0 before 1.20.4 |
| CVE-2023-24538 | 9.8 | Apr 6 | Templates do not properly consider backticks (`) as Javascript string delimiters, and do not escape them as expected Affected: before 1.19.8; 1.20.0 before 1.20.3 |
| CVE-2021-38297 | 9.8 | Oct 18 | Go before 1.16.9 and 1.17.x before 1.17.2 has a Buffer Overflow via large arguments in a function invocation from a WASM module, when GOARCH=wasm GOOS=js is used Affected: before 1.16.9; 1.17.0 before 1.17.2 |
| CVE-2012-2666 | 9.8 | Jul 9 | golang/go in 1.0.2 fixes all.bash on shared machines Affected: 1.0.2 |
| CVE-2015-5741 | 9.8 | Feb 8 | The net/http library in net/http/transfer.go in Go before 1.4.3 does not properly parse HTTP headers, which allows remote attackers to conduct HTTP request smuggling attacks via a… Affected: before 1.4.3 |
| CVE-2019-14809 | 9.8 | Aug 13 | net/url in Go before 1.11.13 and 1.12.x before 1.12.8 mishandles malformed hosts in URLs, leading to an authorization bypass in some applications Affected: before 1.11.13; 1.12.0 before 1.12.8 |
| CVE-2019-11888 | 9.8 | May 13 | Go through 1.12.5 on Windows mishandles process creation with a nil environment in conjunction with a non-nil token, which allows attackers to obtain sensitive information or gain… Affected: through 1.12.5 |
| CVE-2015-5740 | 9.8 | Oct 18 | The net/http library in net/http/transfer.go in Go before 1.4.3 does not properly parse HTTP headers, which allows remote attackers to conduct HTTP request smuggling attacks via a… Affected: through 1.4.2 |
| CVE-2015-5739 | 9.8 | Oct 18 | The net/http library in net/textproto/reader.go in Go before 1.4.3 does not properly parse HTTP header keys, which allows remote attackers to conduct HTTP request smuggling… Affected: through 1.4.2 |
| CVE-2017-15041 | 9.8 | Oct 5 | Go before 1.8.4 and 1.9.x before 1.9.1 allows "go get" remote command execution Affected: through 1.8.3; 1.9 |
| CVE-2022-23806 | 9.1 | Feb 11 | Curve.IsOnCurve in crypto/elliptic in Go before 1.16.14 and 1.17.x before 1.17.7 can incorrectly return true in situations with a big.Int value that is not a valid field element Affected: before 1.16.14; 1.17.0 before 1.17.7 |
Showing 18