How many CVEs does golang.org have?

golang.org has 74 published CVE records since 2017, including 35 in the last two years.

How many golang.org CVEs are in CISA KEV?

Yes — 1 of golang.org's CVEs are listed in CISA's Known Exploited Vulnerabilities catalog, confirmed exploited in the wild and carrying a CISA remediation deadline.

Which golang.org products have the most CVEs?

The golang.org products with the most published CVEs are golang.org/x/net, golang.org/x/crypto, golang.org/x/image, golang.org/x/net/http2, golang.org/x/text.

What are the most common weakness types in golang.org CVEs?

golang.org's CVEs most often map to these CWE weakness types: CWE-770 (Allocation of Resources Without Limits or Throttling), CWE-400 (Uncontrolled Resource Consumption), CWE-835 (Loop with Unreachable Exit Condition ('Infinite Loop')), CWE-476 (NULL Pointer Dereference).

Are there public exploits for golang.org vulnerabilities?

Yes — 15 of golang.org's CVEs have a known public exploit.

How many critical golang.org vulnerabilities are there?

golang.org has 9 critical and 39 high-severity CVEs.

What is the average severity of golang.org CVEs?

The average CVSS base score across golang.org's scored CVEs is 7.2.

golang.org Vulnerabilities: CVEs, CISA KEV & Security Advisories

Name: golang.org vulnerability dataset (CVEs)
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

Overview

golang.org has 74 published CVE records since 2017, of which 1 are in CISA's Known Exploited Vulnerabilities catalog and 15 have a known public exploit. The average CVSS base score across scored CVEs is 7.2.

Security scorecard

A quick read on golang.org's vulnerability posture, as a share of its 74 published CVEs.

Average CVSS: 7.2
Critical / high: 65%
Actively exploited (KEV): 1%
Public exploit available: 20%
Patch available: 100%

Severity and exploitation

How the CVSS severity of golang.org's CVEs breaks down, plus how many are exploited in the wild or have public exploit code.

Critical9

High39

Medium26

Low0

In CISA’s Known Exploited Vulnerabilities catalog

1

One of golang.org's CVEs is confirmed exploited in the wild.

Public exploits

15

15 of golang.org's CVEs have a known public exploit available.

Most affected products

The golang.org products with the most published CVEs. Follow any product to browse its versions and vulnerabilities.

Common weakness types

The CWE weakness categories most often found in golang.org CVEs. Follow any weakness for its full explanation.

CNAs that assign these CVEs

The CVE Numbering Authorities that publish golang.org CVE records.

Disclosure activity by year

How many golang.org CVEs were published each year.

2019

4

2020

4

2021

2

2022

8

2023

9

2024

5

2025

Latest golang.org CVEs

The most recently disclosed vulnerabilities affecting golang.org.

Prevent DoS on deadlocked established channel in golang.org/x/crypto/ssh
CWE-770
High · CVSS 7.5
EPSS 0.5%2026-09-02
Prevent DoS on deadlocked undecided channel in golang.org/x/crypto/ssh
CWE-770
High · CVSS 7.5
EPSS 0.4%2026-09-02
Excessive resource consumption in PackBits decompression in golang.org/x/image/tiff
CWE-770
High · CVSS 7.5
EPSS 0.6%2026-05-29
Invoking duplicate attributes can cause XSS in golang.org/x/net/html

Other vendors

CVE counts for other vendors.

microsoft41,739 CVEs linux25,260 CVEs Google17,495 CVEs Apple15,495 CVEs Oracle13,348 CVEs Debian10,233 CVEs IBM9,452 CVEs Red Hat8,581 CVEs

Browse all vendors

Frequently asked questions

Common questions about golang.org vulnerabilities.

How many CVEs does golang.org have?: golang.org has 74 published CVE records since 2017, including 35 in the last two years.
How many golang.org CVEs are in CISA KEV?: Yes — 1 of golang.org's CVEs are listed in CISA's Known Exploited Vulnerabilities catalog, confirmed exploited in the wild and carrying a CISA remediation deadline.
Which golang.org products have the most CVEs?: The golang.org products with the most published CVEs are golang.org/x/net, golang.org/x/crypto, golang.org/x/image, golang.org/x/net/http2, golang.org/x/text.
What are the most common weakness types in golang.org CVEs?: golang.org's CVEs most often map to these CWE weakness types: CWE-770 (Allocation of Resources Without Limits or Throttling), CWE-400 (Uncontrolled Resource Consumption), CWE-835 (Loop with Unreachable Exit Condition ('Infinite Loop')), CWE-476 (NULL Pointer Dereference).
Are there public exploits for golang.org vulnerabilities?: Yes — 15 of golang.org's CVEs have a known public exploit.
How many critical golang.org vulnerabilities are there?: golang.org has 9 critical and 39 high-severity CVEs.
What is the average severity of golang.org CVEs?: The average CVSS base score across golang.org's scored CVEs is 7.2.

References

Vulnerability data is sourced from the CVE Program; severity, KEV, and exploit signals are aggregated by RadicalNotion.AI.