How many CVEs does golang.org/x/net have?

golang.org/x/net has 25 published CVE records since 2022, including 18 in the last two years.

How many golang.org/x/net CVEs are in CISA KEV?

None of golang.org/x/net's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.

Which golang.org/x/net products have the most CVEs?

The golang.org/x/net products with the most published CVEs are golang.org/x/net/http2, golang.org/x/net/html, golang.org/x/net/http2/hpack, golang.org/x/net/http/httpproxy, golang.org/x/net/idna.

What are the most common weakness types in golang.org/x/net CVEs?

golang.org/x/net's CVEs most often map to these CWE weakness types: CWE-1021 (Improper Restriction of Rendered UI Layers or Frames), CWE-405 (Asymmetric Resource Consumption (Amplification)), CWE-444 (Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')), CWE-770 (Allocation of Resources Without Limits or Throttling).

How many critical golang.org/x/net vulnerabilities are there?

golang.org/x/net has 2 critical and 12 high-severity CVEs.

What is the average severity of golang.org/x/net CVEs?

The average CVSS base score across golang.org/x/net's scored CVEs is 6.9.

RadicalNotion.AI

Security data

Weaknesses (CWE)The MITRE CWE weakness catalog
Attack Patterns (CAPEC)MITRE CAPEC attack patterns
CNAsNumbering authorities and report cards
VendorsVulnerabilities by vendor
Patched FunctionsWhere CVE fixes land in code

Tools

CVSS CalculatorScore CVSS 4.0, 3.1, 3.0 & 2.0
Badge BuilderEmbeddable SVG badges for READMEs

Resources

LearnSecurity guides
Data SourcesCVE data sources

About Blog Pricing Demo

Home
Vendors
Golangorgxnet

RadicalNotion.AI

We do not sell or share your personal information.

Security Data

CWE Directory
CAPEC Directory
CNA Directory
CNA Leaderboard
CNA Report Cards
Vendor Directory
Patched Functions
Data Sources

Calculators

CVSS Calculator
CVSS 4.0
CVSS 3.1
CVSS 3.0
CVSS 2.0
Badge Builder

Platform

My Vulnerabilities
Insights
Notifications
Pricing

Learn

Guides
What is a CVE?
What is CVSS?
The CISA KEV catalog
What is EPSS?

Company

About
Blog
Careers
Contact
Demo

Account

Legal

Security
Privacy
Terms

RadicalNotion.AI

Security data

Weaknesses (CWE)The MITRE CWE weakness catalog
Attack Patterns (CAPEC)MITRE CAPEC attack patterns
CNAsNumbering authorities and report cards
VendorsVulnerabilities by vendor
Patched FunctionsWhere CVE fixes land in code

Tools

CVSS CalculatorScore CVSS 4.0, 3.1, 3.0 & 2.0
Badge BuilderEmbeddable SVG badges for READMEs

Resources

LearnSecurity guides
Data SourcesCVE data sources

About Blog Pricing Demo

Home
Vendors
Golangorgxnet

golang.org/x/net Vulnerabilities: CVEs, CISA KEV & Security Advisories

25 CVEs

golang.org/x/net Vulnerabilities

Name: golang.org/x/net vulnerability dataset (CVEs)
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

CVE security advisories and vulnerability history for golang.org/x/net.

Total CVEs

Published

In CISA KEV

Exploited in the wild

Public exploits

PoC or exploit code

6.9

Avg CVSS

2022–2026

Overview

golang.org/x/net has 25 published CVE records since 2022, of which 0 are in CISA's Known Exploited Vulnerabilities catalog and 2 have a known public exploit. The average CVSS base score across scored CVEs is 6.9.

Security scorecard

A quick read on golang.org/x/net's vulnerability posture, as a share of its 25 published CVEs.

Average CVSS: 6.9
Critical / high: 56%
Actively exploited (KEV): 0%
Public exploit available: 8%
Patch available: 100%

Severity and exploitation

How the CVSS severity of golang.org/x/net's CVEs breaks down, plus how many are exploited in the wild or have public exploit code.

Critical2

High12

Medium11

Low0

In CISA’s Known Exploited Vulnerabilities catalog

None of golang.org/x/net's CVEs are currently listed in CISA's KEV catalog.

Public exploits

2 of golang.org/x/net's CVEs have a known public exploit available.

Most affected products

The golang.org/x/net products with the most published CVEs. Follow any product to browse its versions and vulnerabilities.

golang.org/x/net/http211 CVEs
golang.org/x/net/html10 CVEs
golang.org/x/net/http2/hpack1 CVE
golang.org/x/net/http/httpproxy1 CVE
golang.org/x/net/idna1 CVE
golang.org/x/net/dns/dnsmessage1 CVE

Common weakness types

The CWE weakness categories most often found in golang.org/x/net CVEs. Follow any weakness for its full explanation.

CWE-1021Improper Restriction of Rendered UI Layers or Frames3 CVEs
CWE-405Asymmetric Resource Consumption (Amplification)2 CVEs
CWE-444Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')2 CVEs
CWE-770Allocation of Resources Without Limits or Throttling2 CVEs
CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')2 CVEs

CNAs that assign these CVEs

The CVE Numbering Authorities that publish golang.org/x/net CVE records.

Go25 CVEs

Disclosure activity by year

How many golang.org/x/net CVEs were published each year.

2022

2023

2024

2025

2026

Latest golang.org/x/net CVEs

The most recently disclosed vulnerabilities affecting golang.org/x/net.

HTTP/2 server crash due to HPACK encoder race in net/http
CWE-362
High · CVSS 7.5
EPSS 0.4%2026-10-08
Double flow control refund on HTTP/2 server streams in net/http
CWE-675
Critical · CVSS 9.1
EPSS 0.6%2026-10-08
Excessive CPU consumption from repeated initial window changes in net/http
CWE-405
High · CVSS 7.5
EPSS 0.6%2026-10-08
HTTP/2 transport accepts malformed framing-related headers in net/http

Other vendors

CVE counts for other vendors.

microsoft41,739 CVEs linux25,260 CVEs Google17,495 CVEs Apple15,495 CVEs Oracle13,348 CVEs Debian10,233 CVEs IBM9,452 CVEs Red Hat8,581 CVEs

Browse all vendors

Frequently asked questions

Common questions about golang.org/x/net vulnerabilities.

How many CVEs does golang.org/x/net have?: golang.org/x/net has 25 published CVE records since 2022, including 18 in the last two years.
How many golang.org/x/net CVEs are in CISA KEV?: None of golang.org/x/net's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.
Which golang.org/x/net products have the most CVEs?: The golang.org/x/net products with the most published CVEs are golang.org/x/net/http2, golang.org/x/net/html, golang.org/x/net/http2/hpack, golang.org/x/net/http/httpproxy, golang.org/x/net/idna.
What are the most common weakness types in golang.org/x/net CVEs?: golang.org/x/net's CVEs most often map to these CWE weakness types: CWE-1021 (Improper Restriction of Rendered UI Layers or Frames), CWE-405 (Asymmetric Resource Consumption (Amplification)), CWE-444 (Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')), CWE-770 (Allocation of Resources Without Limits or Throttling).
Are there public exploits for golang.org/x/net vulnerabilities?: Yes — 2 of golang.org/x/net's CVEs have a known public exploit.
How many critical golang.org/x/net vulnerabilities are there?: golang.org/x/net has 2 critical and 12 high-severity CVEs.
What is the average severity of golang.org/x/net CVEs?: The average CVSS base score across golang.org/x/net's scored CVEs is 6.9.