How many CVEs does Go toolchain have?

Go toolchain has 24 published CVE records since 2020, including 14 in the last two years.

How many Go toolchain CVEs are in CISA KEV?

None of Go toolchain's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.

Which Go toolchain products have the most CVEs?

The Go toolchain products with the most published CVEs are cmd/go, cmd/cgo, cmd/compile, cmd\/go.

What are the most common weakness types in Go toolchain CVEs?

Go toolchain's CVEs most often map to these CWE weakness types: CWE-347 (Improper Verification of Cryptographic Signature), CWE-641 (Improper Restriction of Names for Files and Other Resources), CWE-73 (External Control of File Name or Path), CWE-88 (Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')).

Are there public exploits for Go toolchain vulnerabilities?

No Go toolchain CVEs currently have a tracked public exploit in this dataset.

How many critical Go toolchain vulnerabilities are there?

Go toolchain has 7 critical and 14 high-severity CVEs.

What is the average severity of Go toolchain CVEs?

The average CVSS base score across Go toolchain's scored CVEs is 8.2.

Go toolchain Vulnerabilities: CVEs, CISA KEV & Security Advisories

Name: Go toolchain vulnerability dataset (CVEs)
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

RadicalNotion.AI

Overview

Go toolchain has 24 published CVE records since 2020, of which 0 are in CISA's Known Exploited Vulnerabilities catalog and 0 have a known public exploit. The average CVSS base score across scored CVEs is 8.2.

This page aggregates every publicly disclosed vulnerability (CVE) affecting Go toolchain products, with severity breakdowns, the most-affected products, the most common weakness types, and the latest disclosures.

Security scorecard

A quick read on Go toolchain's vulnerability posture, as a share of its 24 published CVEs.

Average CVSS: 8.2
Critical / high: 88%
Actively exploited (KEV): 0%
Public exploit available: 0%
Patch available: 100%

Severity and exploitation

How the CVSS severity of Go toolchain's CVEs breaks down, plus how many are exploited in the wild or have public exploit code.

Critical7

High14

Medium3

Low0

In CISA’s Known Exploited Vulnerabilities catalog

None of Go toolchain's CVEs are currently listed in CISA's KEV catalog.

Public exploits

No Go toolchain CVEs currently have a tracked public exploit.

Most affected products

The Go toolchain products with the most published CVEs. Follow any product to browse its versions and vulnerabilities.

Common weakness types

The CWE weakness categories most often found in Go toolchain CVEs. Follow any weakness for its full explanation.

CNAs that assign these CVEs

The CVE Numbering Authorities that publish Go toolchain CVE records.

Go24 CVEs

Disclosure activity by year

How many Go toolchain CVEs were published each year.

2020

2023

2024

2025

2026

Latest Go toolchain CVEs

The most recently disclosed vulnerabilities affecting Go toolchain.

Ignore unrelated, unauthenticated hashes in Lookup in golang.org/x/mod/sumdb
CWE-347
High · CVSS 7.5
EPSS 0.3%2026-08-13
Fix transparency log tile verification bypass in golang.org/x/mod/sumdb/tlog
CWE-347
High · CVSS 8.4
EPSS 0.1%2026-08-13
Malicious module proxy can bypass checksum database in cmd/go
CWE-347
High · CVSS 7.5
EPSS 0.2%2026-05-07
Invoking "go tool pack" does not sanitize output paths in cmd/go

Other vendors

Browse vulnerabilities for other tracked vendors.

microsoft36,673 CVEs linux22,774 CVEs Google16,481 CVEs Apple15,095 CVEs Oracle12,708 CVEs Debian10,226 CVEs IBM8,839 CVEs Red Hat8,111 CVEs

Browse all vendors

Frequently asked questions

Common questions about Go toolchain vulnerabilities.

How many CVEs does Go toolchain have?: Go toolchain has 24 published CVE records since 2020, including 14 in the last two years.
How many Go toolchain CVEs are in CISA KEV?: None of Go toolchain's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.
Which Go toolchain products have the most CVEs?: The Go toolchain products with the most published CVEs are cmd/go, cmd/cgo, cmd/compile, cmd\/go.
What are the most common weakness types in Go toolchain CVEs?: Go toolchain's CVEs most often map to these CWE weakness types: CWE-347 (Improper Verification of Cryptographic Signature), CWE-641 (Improper Restriction of Names for Files and Other Resources), CWE-73 (External Control of File Name or Path), CWE-88 (Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')).
Are there public exploits for Go toolchain vulnerabilities?: No Go toolchain CVEs currently have a tracked public exploit in this dataset.
How many critical Go toolchain vulnerabilities are there?: Go toolchain has 7 critical and 14 high-severity CVEs.
What is the average severity of Go toolchain CVEs?: The average CVSS base score across Go toolchain's scored CVEs is 8.2.

References

Vulnerability data is sourced from the CVE Program; severity, KEV, and exploit signals are aggregated by RadicalNotion.AI.

Track Go toolchain vulnerabilities

Monitor new Go toolchain vulnerabilities as they are disclosed, with AI-written analysis and remediation guidance.

Start free See pricing