Known vulnerabilities in Go programming language

Vendor: Google
Software CPE: cpe:2.3:a:google:golang:*:*:*:*:*:*:*:*
Total vulnerabilities: 185
Public exploits: 4
Known exploited (KEV): 0
Highest CVSSv4 Score: 9.3

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Go programming language Go programming language is affected by 185 known vulnerabilities: 17 high, 132 medium, 36 low Critical High Medium Low

Vulnerabilities (185)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU144181 - Uncontrolled Recursion
CVE-2026-33818
CWE-674 Medium
No
No
1.25.13, 1.26.6, 1.27.0 rc.3 18.08.2026 SB2026081856
SB2026082658
SB2026082659
and 19 more
#VU144180 - Uncontrolled Recursion
CVE-2026-56859
CWE-674 Medium
No
No
1.25.13, 1.26.6, 1.27.0 rc.3 18.08.2026 SB2026081856
SB2026082658
SB2026082659
and 13 more
#VU144179 - Resource exhaustion
CVE-2026-56853
CWE-400 Medium
No
No
1.25.13, 1.26.6, 1.27.0 rc.3 18.08.2026 SB2026081856
SB2026082658
SB2026082659
and 16 more
#VU144178 - Improper control of a resource through its lifetime
CVE-2026-56862
CWE-664 Medium
No
No
1.25.13, 1.26.6, 1.27.0 rc.3 18.08.2026 SB2026081856
SB2026082658
SB2026082659
and 19 more
#VU144177 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-56858
CWE-79 Medium
No
No
1.25.13, 1.26.6, 1.27.0 rc.3 18.08.2026 SB2026081856
SB2026082658
SB2026082659
and 16 more
#VU144176 - Insufficient Verification of Data Authenticity
CVE-2026-56865
CWE-345 High
No
No
1.25.13, 1.26.6, 1.27.0 rc.3 18.08.2026 SB2026081856
#VU144175 - Insufficient Verification of Data Authenticity
CVE-2026-56864
CWE-345 Medium
No
No
1.25.13, 1.26.6, 1.27.0 rc.3 18.08.2026 SB2026081856
#VU144174 - Resource exhaustion
CVE-2026-56860
CWE-400 Medium
No
No
1.25.13, 1.26.6, 1.27.0 rc.3 18.08.2026 SB2026081856
SB2026082658
SB2026082659
and 19 more
#VU140622 - Improper Link Resolution Before File Access ('Link Following')
CVE-2026-39822
CWE-59 Low
No
No
1.25.12, 1.26.5, 1.27.0 rc.2 31.07.2026 SB2026073128
SB20260731126
SB20260731127
and 8 more
#VU140621 - Exposure of sensitive information to an unauthorized actor
CVE-2026-42505
CWE-200 Medium
No
No
1.25.12, 1.26.5, 1.27.0 rc.2 31.07.2026 SB2026073128
SB20260731146
SB20260731147
and 5 more
#VU140620 - Resource exhaustion
CVE-2026-27145
CWE-400 Medium
No
No
1.25.11, 1.26.4 31.07.2026 SB2026073127
SB2026073129
SB2026073130
and 45 more
#VU140619 - Resource exhaustion
CVE-2026-42504
CWE-400 Medium
No
No
1.25.11, 1.26.4 31.07.2026 SB2026073127
SB20260731138
SB20260731143
and 9 more
#VU140618 - Improper Output Neutralization for Logs
CVE-2026-42507
CWE-117 Medium
No
No
1.25.11, 1.26.4 31.07.2026 SB2026073127
SB20260731115
SB20260731143
and 6 more
#VU140614 - UNIX Symbolic Link (Symlink) Following
CVE-2026-39819
CWE-61 Low
No
No
1.25.10, 1.26.3 31.07.2026 SB2026073126
#VU140613 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2026-39817
CWE-22 Medium
No
No
1.25.10, 1.26.3 31.07.2026 SB2026073126
#VU140612 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-39826
CWE-79 Low
No
No
1.25.10, 1.26.3 31.07.2026 SB2026073126
#VU140611 - Double Free
CVE-2026-33811
CWE-415 Medium
No
No
1.25.10, 1.26.3 31.07.2026 SB2026073126
SB20260731121
SB20260731123
and 14 more
#VU140610 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-39823
CWE-79 Medium
No
No
1.25.10, 1.26.3 31.07.2026 SB2026073126
#VU140609 - Improper input validation
CVE-2026-42501
CWE-20 High
No
No
1.25.10, 1.26.3 31.07.2026 SB2026073126
#VU140608 - Resource exhaustion
CVE-2026-39820
CWE-400 Medium
No
No
1.25.10, 1.26.3 31.07.2026 SB2026073126
SB2026081985
SB2026082635
and 10 more


Showing elements 1 - 20 out of 185