How many Go standard library net/http CVEs are in CISA KEV?

None of Go standard library net/http's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.

Which versions of Go standard library net/http are affected?

66 distinct Go standard library net/http versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.

What are the most common weakness types in Go standard library net/http CVEs?

Go standard library net/http's CVEs most often map to these CWE weakness types: CWE-444 (Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')), CWE-770 (Allocation of Resources Without Limits or Throttling), CWE-405 (Asymmetric Resource Consumption (Amplification)), CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')).

How many critical Go standard library net/http vulnerabilities are there?

Go standard library net/http has 2 critical and 14 high-severity CVEs.

What is the average severity of Go standard library net/http CVEs?

The average CVSS base score across Go standard library net/http's scored CVEs is 7.0.

Go standard library net/http Vulnerabilities: CVEs, CISA KEV & Security Advisories

Name: Go standard library net/http vulnerability dataset (CVEs)
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

RadicalNotion.AI

Go standard library net/http Vulnerabilities: CVEs, CISA KEV & Security Advisories

Overview

Go standard library net/http has 26 published CVE records since 2022, of which 0 are in CISA's Known Exploited Vulnerabilities catalog and 2 have a known public exploit. The average CVSS base score across scored CVEs is 7.0. Affected platforms include windows.

Severity and exploitation

How the CVSS severity of Go standard library net/http's CVEs breaks down, plus how many are exploited in the wild or have public exploit code.

Critical2

High14

Medium10

Low0

In CISA’s Known Exploited Vulnerabilities catalog

None of Go standard library net/http's CVEs are currently listed in CISA's KEV catalog.

Public exploits

2 of Go standard library net/http's CVEs have a known public exploit available.

Affected versions and CVEs

Browse every Go standard library net/http version named in a CVE, then pick one to see only the CVEs that affect it.

Version ranges

< 1.26.98 CVEs
1.27.0-0 <= v < 1.27.23 CVEs
< 1.17.122 CVEs
< 1.18.92 CVEs
< 1.25.132 CVEs
1.18.0-0 <= v < 1.18.42 CVEs
1.19.0-0 <= v < 1.19.42 CVEs
1.26.0-0 <= v < 1.26.62 CVEs
1.27.0-0 <= v < 1.27.0-rc.32 CVEs
< 1.19.111 CVE
< 1.19.61 CVE
< 1.20.10

Common weakness types

The CWE weakness categories most often found in Go standard library net/http CVEs. Follow any weakness for its full explanation.

Disclosure activity by year

How many Go standard library net/http CVEs were published each year.

2022

2023

2024

2025

2026

Other Go standard library products

Browse vulnerabilities for other products by Go standard library.

crypto/x50914 CVEs html/template14 CVEs crypto/tls13 CVEs net/http/internal/http26 CVEs net/textproto6 CVEs os6 CVEs path/filepath6 CVEs net/url

Frequently asked questions

Common questions about Go standard library net/http vulnerabilities.

How many CVEs does Go standard library net/http have?: Go standard library net/http has 26 published CVE records since 2022.
How many Go standard library net/http CVEs are in CISA KEV?: None of Go standard library net/http's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.
Are there public exploits for Go standard library net/http vulnerabilities?: Yes — 2 of Go standard library net/http's CVEs have a known public exploit.
Which versions of Go standard library net/http are affected?: 66 distinct Go standard library net/http versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.
What are the most common weakness types in Go standard library net/http CVEs?: Go standard library net/http's CVEs most often map to these CWE weakness types: CWE-444 (Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')), CWE-770 (Allocation of Resources Without Limits or Throttling), CWE-405 (Asymmetric Resource Consumption (Amplification)), CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')).
How many critical Go standard library net/http vulnerabilities are there?: Go standard library net/http has 2 critical and 14 high-severity CVEs.
What is the average severity of Go standard library net/http CVEs?: The average CVSS base score across Go standard library net/http's scored CVEs is 7.0.

References

Vulnerability data is sourced from the CVE Program; severity, KEV, and exploit signals are aggregated by RadicalNotion.AI.

Track Go standard library net/http vulnerabilities

Get an alert for each new Go standard library net/http CVE, with AI-written analysis and remediation steps.

Create an account See pricing