x has 20 CVEs on record between 2022 and 2026. Disclosures have slowed: 1 in the last 90 days after 9 in the 90 before. The busiest recent month was May 2026 with 5. The median CVSS is 7.5 (high). None have a confirmed exploitation report. Most affected products: golang.org/x/net (8), golang.org/x/crypto (4), golang.org/x/image (4).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.5
- Publish → KEV
- —
- Last 90 days
- 1 prev 9
Products
- golang.org/x/net 8
- golang.org/x/crypto 4
- golang.org/x/image 4
- golang.org/x/text 2
- golang.org/x/oauth2 1
- libxfont 1
Worst active — by depth score
CVE-2019-9512High· 7.5golang.org/x/net/http vulnerable to a reset flood58CVE-2026-56852High· 7.5Infinite loop on invalid input in golang.org/x/text53CVE-2026-56002High· 8.5A heap bufferflow in pcfReadFont() due to missing glyph bounds checking in libXfont2 before 2.0.8 allows attackers authenticated as X client to execute code within the X server.47CVE-2022-32149High· 7.5golang.org/x/text/language Denial of service via crafted Accept-Language header42CVE-2022-27664High· 7.5golang.org/x/net/http2 Denial of Service vulnerability42
x vulnerabilities
CVEs affecting x, newest first. Open any entry for full detail, references, and exploit status.
20 CVEsRSS
CVE-2026-97045NoneCheck all ancestor namespace transitions when rendering raw text in html in golang.org/x/net
Check all ancestor namespace transitions when rendering raw text in html in golang.org/x/net
CVE-2026-56852High· 7.5PoCInfinite loop on invalid input in golang.org/x/text
Infinite loop on invalid input in golang.org/x/text
CVE-2026-56002High· 8.5A heap bufferflow in pcfReadFont() due to missing glyph bounds checking in libXfont2 before 2.0.8 allows attackers authenticated as X client to execute code within the X server.
A heap bufferflow in pcfReadFont() due to missing glyph bounds checking in libXfont2 before 2.0.8 allows attackers authenticated as X client to execute code within the X server.
GO-2026-5932NoneThe golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues
The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues
CVE-2026-46599High· 7.5golang.org/x/image/tiff has excessive resource consumption in PackBits decompression
golang.org/x/image/tiff has excessive resource consumption in PackBits decompression
CVE-2026-42500NonePanic when reading out of bound palette index in golang.org/x/image/bmp
Panic when reading out of bound palette index in golang.org/x/image/bmp
CVE-2026-42502Medium· 6.1Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html
Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html
CVE-2026-27136NoneInvoking duplicate attributes can cause XSS in golang.org/x/net/html
Invoking duplicate attributes can cause XSS in golang.org/x/net/html
CVE-2026-25681NoneInvoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html
Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html
CVE-2026-46597High· 7.5Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh
Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh
CVE-2026-33812NoneExcessive memory allocation when decoding malicious SFNT in golang.org/x/image
Excessive memory allocation when decoding malicious SFNT in golang.org/x/image
CVE-2026-33809Medium· 5.3Go Images vulnerable to an out-of-memory error via a crafted TIFF file
Go Images vulnerable to an out-of-memory error via a crafted TIFF file
CVE-2025-22868High· 7.5golang.org/x/oauth2 Improper Validation of Syntactic Correctness of Input vulnerability
golang.org/x/oauth2 Improper Validation of Syntactic Correctness of Input vulnerability
CVE-2024-45337NonePoCMisuse of connection.serverAuthenticate may cause authorization bypass in golang.org/x/crypto
Misuse of connection.serverAuthenticate may cause authorization bypass in golang.org/x/crypto
CVE-2023-3978Medium· 6.1Improper rendering of text nodes in golang.org/x/net/html
Improper rendering of text nodes in golang.org/x/net/html
CVE-2022-32149High· 7.5golang.org/x/text/language Denial of service via crafted Accept-Language header
golang.org/x/text/language Denial of service via crafted Accept-Language header
CVE-2022-27664High· 7.5golang.org/x/net/http2 Denial of Service vulnerability
golang.org/x/net/http2 Denial of Service vulnerability
CVE-2020-29652High· 7.5golang.org/x/crypto/ssh NULL Pointer Dereference vulnerability
golang.org/x/crypto/ssh NULL Pointer Dereference vulnerability
CVE-2019-9512High· 7.5golang.org/x/net/http vulnerable to a reset flood
golang.org/x/net/http vulnerable to a reset flood
CVE-2018-17847High· 7.5golang.org/x/net/html has Improper Restriction of Operations within the Bounds of a Memory Buffer
golang.org/x/net/html has Improper Restriction of Operations within the Bounds of a Memory Buffer