golang has 34 CVEs on record between 2022 and 2026. Disclosures have slowed: 0 in the last 90 days after 8 in the 90 before. The busiest recent month was May 2026 with 11. The median CVSS is 7.5 (high), with 5 rated critical. None have a confirmed exploitation report. The dominant weakness classes are CWE-770 (8) and CWE-295 (5). Most affected products: go (26), crypto (5), github.com/golang/glog (1).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.5
- Publish → KEV
- —
- Last 90 days
- 0 prev 8
Weakness classes
Products
- go 26
- crypto 5
- github.com/golang/glog 1
- gopls 1
- net 1
Worst active — by depth score
CVE-2026-27143Critical· 9.8Arithmetic over induction variables in loops were not correctly checked for underflow or overflow54CVE-2026-39821Critical· 9.6The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label53CVE-2026-42508Critical· 9.1Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation51CVE-2026-39832Critical· 9.1When adding a key to a remote agent constraint extensions such as [email protected] were not serialized in the request50CVE-2026-39830Critical· 9.1A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop50
golang vulnerabilities
CVEs affecting golang, newest first. Open any entry for full detail, references, and exploit status.
34 CVEsRSS
CVE-2025-47912Medium· 5.3The Parse function permits values other than IPv6 addresses to be included in square brackets within the host component of a URL
The Parse function permits values other than IPv6 addresses to be included in square brackets within the host component of a URL. RFC 3986 permits IPv6 addresses to be included within the host component, enclosed within square brackets. …
CVE-2025-58188High· 7.5Validating certificate chains which contain DSA public keys can cause programs to panic, due to a interface cast that assumes they implement the Equal method
Validating certificate chains which contain DSA public keys can cause programs to panic, due to a interface cast that assumes they implement the Equal method. This affects programs which validate arbitrary certificate chains.
CVE-2024-45339High· 7.1Insecure Temporary File usage in github.com/golang/glog
Insecure Temporary File usage in github.com/golang/glog
CVE-2022-32189High· 7.5A too-short encoded message can cause a panic in Float.GobDecode and Rat GobDecode in math/big in Go before 1.17.13 and 1.18.5, potentially allowing a denial of service.
A too-short encoded message can cause a panic in Float.GobDecode and Rat GobDecode in math/big in Go before 1.17.13 and 1.18.5, potentially allowing a denial of service.