The Go programming language and its standard library sit at the foundation of a vast ecosystem of cloud infrastructure, containerization platforms, and microservices, making vulnerabilities in the language runtime and core packages propagate across an enormous downstream attack surface despite a narrow upstream product list. Vulnerabilities affecting Go skew toward serious outcomes, with a meaningful share reaching critical severity, though the distributed nature of the language means remediation depends heavily on downstream projects rebuilding and deploying updated binaries. The exposure recurs across core packages including the cryptographic, networking, and HTTP/2 implementations, and clusters through weakness classes including resource exhaustion, certificate validation flaws, code injection, and uncontrolled recursion that reflect both parser complexity and the parsing-heavy demands of protocol implementations. Defenders should treat Go language advisories as high-priority and track them separately from individual application vulnerabilities, since a single flaw in the runtime or standard library can affect thousands of downstream projects; current exploitation activity and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Golang over time
Signals from CVEs in this vendor scope (224 CVEs).
224 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2023-44487HIGH The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through | Oct 10, 2023 | 7.5 | 97 | YES | YES |
CVE-2020-0601HIGH A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) certificates.An attacker could exploit the vulnerability by u | Jan 14, 2020 | 8.1 | 97 | YES | YES |
CVE-2023-48795MEDIUM The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packet | Dec 18, 2023 | 5.9 | 81 | NO | YES |
CVE-2018-16873HIGH In Go before 1.10.6 and 1.11.x before 1.11.3, the "go get" command is vulnerable to remote code execution when executed with the -u flag and the import path of a malicious Go packa | Dec 14, 2018 | 8.1 | 63 | NO | NO |
CVE-2018-7187HIGH The "go get" implementation in Go 1.9.4, when the -insecure command-line option is used, does not validate the import path (get/vcs.go only checks for "://" anywhere in the string) | Feb 16, 2018 | 8.8 | 62 | NO | NO |
CVE-2020-9283HIGH golang.org/x/crypto before v0.0.0-20200220183623-bac4c82f6975 for Go allows a panic during signature verification in the golang.org/x/crypto/ssh package. A client can attack an SSH | Feb 20, 2020 | 7.5 | 47 | NO | YES |
CVE-2026-39821CRITICAL The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns th | May 22, 2026 | 9.6 | 46 | NO | NO |
CVE-2026-46595CRITICAL Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-addre | May 22, 2026 | 10.0 | 44 | NO | NO |
CVE-2026-39830CRITICAL A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop. The blocked goroutine could not be released by | May 22, 2026 | 9.1 | 43 | NO | NO |
CVE-2026-42508CRITICAL Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation. Now, both the 'key' and 'key.SignatureKey' are checked for @revoked. | May 22, 2026 | 9.1 | 42 | NO | NO |
Signals from CVEs in this vendor scope (224 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Golang.
Media articles that mention a CVE ID that affects a product developed by Golang — matched by CVE ID, not by vendor name.