stdlib has 31 CVEs on record between 2022 and 2026. Disclosure cadence is accelerating: 18 in the last 90 days against 1 in the 90 before. The busiest recent month was October 2026 with 13. The median CVSS is 7.5 (high), with 2 rated critical. None have a confirmed exploitation report. The dominant weakness classes are CWE-770 (8) and CWE-405 (3).
CVEs per month
Last 12 months, by publish date
1125/111225/120126/010226/020326/030426/040526/050626/060726/070826/080926/091026/10
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.5
- Publish → KEV
- —
- Last 90 days
- 18 prev 1
Weakness classes
Products
- stdlib 31
31
Total CVEs
2
Critical
0
CISA KEV
0
Exploited
Worst active — by depth score
CVE-2026-56857Critical· 9.8On Windows, when the target of Root.Mkdir or Root.MkdirAll is a junction pointing to an empty location, the operation can create a directory at the junction target even when that target is located outside the root54CVE-2023-39325High· 7.5HTTP/2 rapid reset can cause excessive work in net/http54CVE-2026-78663Critical· 9.1The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered da…50CVE-2026-56858High· 8.1Fix Javascript regexp context tracking in html/template45CVE-2026-97032High· 7.5HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently41
stdlib vulnerabilities
CVEs affecting stdlib, newest first. Open any entry for full detail, references, and exploit status.
31 CVEsRSS