golang Go

Name: golang Go
Brand: golang

productEU

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

KEV-listed

by severity

3critical15high12medium0low

updated 2026-10-28

vulnerabilities (140)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2023-45288US	—	92.0% (100th)	Exploit	1.22.2	2024-04-04	< 1.22.2
CVE-2024-27316US	high7.5	91.3% (100th)	Exploit	1.22.2	2024-04-04	< 1.22.2
CVE-2024-30255US	high7.5	87.8% (100th)	Exploit	1.22.2	2024-04-04	< 1.22.2
CVE-2023-39320US	critical9.8	1.76% (78th)	Exploit	1.21.1	2023-09-08	< 1.21.1
CVE-2024-24787US	—	0.77% (55th)	Exploit	1.22.3	2024-05-08	2 versions
CVE-2026-27145US	—	0.59% (48th)	Exploit	1.25.11	2026-06-02	2 versions
CVE-2026-46595US	—OT elevated	0.56% (46th)	Exploit	no fix	2026-05-22	≤ crypto module <0.52.0
CVE-2025-22870US	—	0.43% (37th)	Exploit	1.24.1	2025-03-12	2 versions
CVE-2026-111943US	—	0.30% (22nd)	Exploit	1.27.3	2026-10-21	2 versions
CVE-2024-31309US	—	94.6% (100th)	—	1.22.2	2024-04-10	< 1.22.2
CVE-2024-27919US	—	86.7% (100th)	—	1.22.2	2024-04-04	< 1.22.2
CVE-2024-28182US	—	85.0% (100th)	—	1.22.2	2024-04-04	< 1.22.2
CVE-2024-2653US	—	83.4% (100th)	—	1.22.2	2024-04-03	< 1.22.2
CVE-2024-2758US	—	72.8% (99th)	—	1.22.2	2024-04-03	< 1.22.2
CVE-2026-42508US	—	6.91% (94th)	—	no fix	2026-05-22	≤ crypto module <0.52.0
CVE-2025-61726US	—	2.29% (83rd)	—	1.24.12	2026-01-28	2 versions
CVE-2020-29509US	medium5.6	2.10% (82nd)	—	no fix	2020-12-14	≤ All versions
CVE-2020-29510US	medium5.6	2.07% (81st)	—	no fix	2020-12-14	≤ unspecified ≤1.15
CVE-2020-29511US	medium5.6	1.97% (80th)	—	no fix	2020-12-14	≤ All versions
CVE-2023-39323US	high8.1	1.93% (80th)	—	1.20.9	2023-10-05	2 versions
CVE-2026-39821US	—	1.83% (79th)	—	1.26.6	2026-05-22	3 versions
CVE-2024-24791US	—	1.41% (73rd)	—	1.21.12	2024-07-02	2 versions
CVE-2023-39322US	high7.5	1.34% (71st)	—	1.20.8	2023-09-08	2 versions
CVE-2023-39321US	high7.5	1.34% (71st)	—	1.20.8	2023-09-08	2 versions
CVE-2023-45285US	high7.5OT elevated	1.14% (66th)	—	1.20.12	2023-12-06	2 versions
CVE-2024-34156US	—	1.13% (66th)	—	1.22.7	2024-09-06	2 versions
CVE-2023-45289US	—	1.08% (65th)	—	1.22.1	2024-03-05	2 versions
CVE-2024-34158US	—	1.05% (64th)	—	1.23.1	2024-09-06	2 versions
CVE-2023-39318US	medium6.1	0.93% (60th)	—	1.21.1	2023-09-08	2 versions
CVE-2025-68121US	critical10.0	0.92% (60th)	—	1.25.6	2026-02-05	2 versions
CVE-2023-39319US	medium6.1	0.91% (60th)	—	1.20.8	2023-09-08	2 versions
CVE-2023-45284US	medium5.3	0.90% (60th)	—	1.21.4	2023-11-09	< 1.21.4
CVE-2026-33811US	high7.5	0.88% (59th)	—	1.25.10	2026-05-07	2 versions
CVE-2026-33814US	high7.5	0.84% (58th)	—	1.25.10	2026-05-07	2 versions
CVE-2024-34155US	—	0.84% (58th)	—	1.23.1	2024-09-06	2 versions
CVE-2025-22871US	—	0.83% (57th)	—	1.23.8	2025-04-08	2 versions
CVE-2026-42499US	—	0.80% (56th)	—	1.26.3	2026-05-07	2 versions
CVE-2026-39820US	high7.5	0.78% (56th)	—	1.26.3	2026-05-07	2 versions
CVE-2026-25679US	—	0.77% (56th)	—	1.25.8	2026-03-06	2 versions
CVE-2025-61728US	—	0.74% (54th)	—	1.24.12	2026-01-28	2 versions
CVE-2024-45336US	—	0.73% (54th)	—	1.23.5	2025-01-28	4 versions
CVE-2024-45340US	—	0.71% (53rd)	—	1.24	2025-01-28	4 versions
CVE-2026-39832US	—	0.68% (52nd)	—	no fix	2026-05-22	≤ crypto module <0.52.0
CVE-2026-39830US	—	0.68% (52nd)	—	no fix	2026-05-22	≤ crypto module <0.52.0
CVE-2025-47913US	—	0.67% (52nd)	—	no fix	2025-11-13	≤ golang.org/x/crypto <0.43.0
CVE-2025-4673US	—	0.67% (52nd)	—	1.23.10	2025-06-11	2 versions
CVE-2025-61723US	—	0.66% (51st)	—	1.24.8	2025-10-29	2 versions
CVE-2026-27140US	high8.8OT elevated	0.66% (51st)	—	1.25.9	2026-04-08	2 versions
CVE-2025-61725US	—	0.65% (51st)	—	1.25.2	2025-10-29	2 versions
CVE-2025-22867US	—	0.65% (51st)	—	go1.24rc3	2025-02-06	< go1.24rc3

showing 50 of 140

weaknesses (8)

The flaw types (CWEs) most of these CVEs share.

CWE-770Allocation of Resources Without Limits or Throttling22 CVEs
CWE-400Uncontrolled Resource Consumption16 CVEs
CWE-295Improper Certificate Validation12 CVEs
CWE-20Improper Input Validation10 CVEs
CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')9 CVEs
CWE-404Improper Resource Shutdown or Release5 CVEs
CWE-94Improper Control of Generation of Code ('Code Injection')5 CVEs
CWE-115Misinterpretation of Input4 CVEs

sources (2)

Which sources assert this record, and when.

DECERT-Bund (BSI CSAF)137 CVEs
EUEU Vulnerability Database (ENISA)3 CVEs

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan