How many CVEs does golang have?

golang has 239 published CVE records since 2014, including 82 in the last two years.

How many golang CVEs are in CISA KEV?

Yes — 2 of golang's CVEs are listed in CISA's Known Exploited Vulnerabilities catalog, confirmed exploited in the wild and carrying a CISA remediation deadline.

Which golang products have the most CVEs?

The golang products with the most published CVEs are Go, crypto, net, image, http2.

What are the most common weakness types in golang CVEs?

golang's CVEs most often map to these CWE weakness types: CWE-770 (Allocation of Resources Without Limits or Throttling), CWE-295 (Improper Certificate Validation), CWE-94 (Improper Control of Generation of Code ('Code Injection')), CWE-674 (Uncontrolled Recursion).

Are there public exploits for golang vulnerabilities?

Yes — 43 of golang's CVEs have a known public exploit.

How many critical golang vulnerabilities are there?

golang has 33 critical and 133 high-severity CVEs.

What is the average severity of golang CVEs?

The average CVSS base score across golang's scored CVEs is 7.3.

golang Vulnerabilities: CVEs, CISA KEV & Security Advisories

Name: golang vulnerability dataset (CVEs)
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

Overview

golang has 239 published CVE records since 2014, of which 2 are in CISA's Known Exploited Vulnerabilities catalog and 43 have a known public exploit. The average CVSS base score across scored CVEs is 7.3.

Security scorecard

A quick read on golang's vulnerability posture, as a share of its 239 published CVEs.

Average CVSS: 7.3
Critical / high: 69%
Actively exploited (KEV): 1%
Public exploit available: 18%
Patch available: 100%

Severity and exploitation

How the CVSS severity of golang's CVEs breaks down, plus how many are exploited in the wild or have public exploit code.

Critical33

High133

Medium70

Low3

In CISA’s Known Exploited Vulnerabilities catalog

2

2 of golang's CVEs are confirmed exploited in the wild.

Public exploits

43

43 of golang's CVEs have a known public exploit available.

Most affected products

The golang products with the most published CVEs. Follow any product to browse its versions and vulnerabilities.

Common weakness types

The CWE weakness categories most often found in golang CVEs. Follow any weakness for its full explanation.

CNAs that assign these CVEs

The CVE Numbering Authorities that publish golang CVE records.

Disclosure activity by year

How many golang CVEs were published each year.

2019

9

2020

16

2021

21

2022

38

2023

39

2024

8

2025

Latest golang CVEs

The most recently disclosed vulnerabilities affecting golang.

Prevent DoS on deadlocked established channel in golang.org/x/crypto/ssh
CWE-770
High · CVSS 7.5
EPSS 0.5%2026-09-02
Prevent DoS on deadlocked undecided channel in golang.org/x/crypto/ssh
CWE-770
High · CVSS 7.5
EPSS 0.4%2026-09-02
Invoking Encrypted Client Hello privacy leak in crypto/tls
CWE-201
Medium · CVSS 5.3
EPSS 0.4%2026-07-08
Root escape via symlink plus trailing slash in os

Other vendors

CVE counts for other vendors.

Hitachi243 CVEs amazon241 CVEs Trendnet241 CVEs HashiCorp239 CVEs Linksys239 CVEs TIBCO238 CVEs glpi-project237 CVEs Phoenix Contact236 CVEs

Browse all vendors

Frequently asked questions

Common questions about golang vulnerabilities.

How many CVEs does golang have?: golang has 239 published CVE records since 2014, including 82 in the last two years.
How many golang CVEs are in CISA KEV?: Yes — 2 of golang's CVEs are listed in CISA's Known Exploited Vulnerabilities catalog, confirmed exploited in the wild and carrying a CISA remediation deadline.
Which golang products have the most CVEs?: The golang products with the most published CVEs are Go, crypto, net, image, http2.
What are the most common weakness types in golang CVEs?: golang's CVEs most often map to these CWE weakness types: CWE-770 (Allocation of Resources Without Limits or Throttling), CWE-295 (Improper Certificate Validation), CWE-94 (Improper Control of Generation of Code ('Code Injection')), CWE-674 (Uncontrolled Recursion).
Are there public exploits for golang vulnerabilities?: Yes — 43 of golang's CVEs have a known public exploit.
How many critical golang vulnerabilities are there?: golang has 33 critical and 133 high-severity CVEs.
What is the average severity of golang CVEs?: The average CVSS base score across golang's scored CVEs is 7.3.

References

Vulnerability data is sourced from the CVE Program; severity, KEV, and exploit signals are aggregated by RadicalNotion.AI.