How many Go standard library os CVEs are in CISA KEV?

None of Go standard library os's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.

Which versions of Go standard library os are affected?

22 distinct Go standard library os versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.

What are the most common weakness types in Go standard library os CVEs?

Go standard library os's CVEs most often map to these CWE weakness types: CWE-23 (Relative Path Traversal), CWE-61 (UNIX Symbolic Link (Symlink) Following).

What is the average severity of Go standard library os CVEs?

The average CVSS base score across Go standard library os's scored CVEs is 5.4.

RadicalNotion.AI

Log in Start free

Log in

Log in Start free

Go standard library

5 CVEs

Go standard library os Vulnerabilities

Name: Go standard library os vulnerability dataset (CVEs)
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

CVE security advisories and vulnerability history for os by Go standard library.

5

Total CVEs

Published

0

In CISA KEV

Exploited in the wild

0

Public exploits

PoC or exploit code

5.4

Avg CVSS

2022–2026

Last updated July 8, 2026

Overview

Go standard library os has 5 published CVE records since 2022, of which 0 are in CISA's Known Exploited Vulnerabilities catalog and 0 have a known public exploit. The average CVSS base score across scored CVEs is 5.4.

This page aggregates every publicly disclosed vulnerability (CVE) affecting Go standard library os, with a severity breakdown, the affected and patched versions, the most common weakness types, and the full CVE list. Affected platforms include windows.

Severity and exploitation

How the CVSS severity of Go standard library os's CVEs breaks down, plus how many are exploited in the wild or have public exploit code.

Critical0

High2

Medium1

Low2

In CISA’s Known Exploited Vulnerabilities catalog

0

None of Go standard library os's CVEs are currently listed in CISA's KEV catalog.

Public exploits

0

No Go standard library os CVEs currently have a tracked public exploit.

Affected versions and CVEs

Browse every Go standard library os version named in a CVE, then pick one to see only the CVEs that affect it.

Version ranges

< 1.18.91 CVE
< 1.23.101 CVE
< 1.23.91 CVE
< 1.25.121 CVE
< 1.25.81 CVE
1.19.0-0 <= v < 1.19.41 CVE
1.24.0-0 <= v < 1.24.31 CVE
1.24.0-0 <= v < 1.24.41 CVE
1.26.0-0 <= v < 1.26.11 CVE
1.26.0-0 <= v < 1.26.51 CVE
1.27.0-0 <= v < 1.27.0-rc.21 CVE

Fixed in

1.18.91 CVE
1.19.41 CVE
1.23.101 CVE
1.23.91 CVE
1.24.31 CVE
1.24.41 CVE
1.25.121 CVE
1.25.81 CVE
1.26.11 CVE
1.26.51 CVE
1.27.0-rc.21 CVE

Find a version

5 CVEs

Sort

Root escape via symlink plus trailing slash in os
CVE-2026-39822
Patch
CWE-61
High · CVSS 7.8
EPSS 0.2% (14th pct)2026-07-08
FileInfo can escape from a Root in os
CVE-2026-27139
Patch
Low · CVSS 2.5
EPSS 0.2% (10th pct)2026-03-06
Improper access to parent directory of root in os
CVE-2025-22873
Patch
CWE-23
Low · CVSS 3.8
EPSS 0.2% (15th pct)2026-02-04
Inconsistent handling of O_CREATE|O_EXCL on Unix and Windows in os in syscall
CVE-2025-0913
Patch
Medium · CVSS 5.5
EPSS 0.2% (16th pct)2025-06-11
High vulnerability · 2022-12-07
CVE-2022-41720
Patch
High · CVSS 7.5
EPSS 1.2% (65th pct)2022-12-07

Common weakness types

The CWE weakness categories most often found in Go standard library os CVEs. Follow any weakness for its full explanation.

Disclosure activity by year

How many Go standard library os CVEs were published each year.

2022

1

2025

1

2026

3

Other Go standard library products

Browse vulnerabilities for other products by Go standard library.

net/http16 CVEs crypto/x50914 CVEs crypto/tls11 CVEs html/template11 CVEs path/filepath6 CVEs net/textproto5 CVEs net/mail4 CVEs net/url4 CVEs

All Go standard library vulnerabilities

Frequently asked questions

Common questions about Go standard library os vulnerabilities.

How many CVEs does Go standard library os have?: Go standard library os has 5 published CVE records since 2022.
How many Go standard library os CVEs are in CISA KEV?: None of Go standard library os's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.
Are there public exploits for Go standard library os vulnerabilities?: No Go standard library os CVEs currently have a tracked public exploit in this dataset.
Which versions of Go standard library os are affected?: 22 distinct Go standard library os versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.
What are the most common weakness types in Go standard library os CVEs?: Go standard library os's CVEs most often map to these CWE weakness types: CWE-23 (Relative Path Traversal), CWE-61 (UNIX Symbolic Link (Symlink) Following).
What is the average severity of Go standard library os CVEs?: The average CVSS base score across Go standard library os's scored CVEs is 5.4.

References

Vulnerability data is sourced from the CVE Program; severity, KEV, and exploit signals are aggregated by RadicalNotion.AI.

Track Go standard library os vulnerabilities

Monitor new Go standard library os vulnerabilities as they are disclosed, with AI-written analysis and remediation guidance.

Start free See pricing