Known vulnerabilities in Go programming language

Vendor: Google
Software CPE: cpe:2.3:a:google:golang:*:*:*:*:*:*:*:*
Total vulnerabilities: 177
Public exploits: 4
Known exploited (KEV): 0
Highest CVSSv4 Score: 9.3

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Go programming language Go programming language is affected by 177 known vulnerabilities: 16 high, 125 medium, 36 low Critical High Medium Low

Vulnerabilities (177)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU140622 - Improper Link Resolution Before File Access ('Link Following')
CVE-2026-39822
CWE-59 Low
No
No
1.25.12, 1.26.5, 1.27.0 rc.2 31.07.2026 SB2026073128
SB20260731126
SB20260731127
and 8 more
#VU140621 - Exposure of sensitive information to an unauthorized actor
CVE-2026-42505
CWE-200 Medium
No
No
1.25.12, 1.26.5, 1.27.0 rc.2 31.07.2026 SB2026073128
SB20260731146
SB20260731147
and 5 more
#VU140620 - Resource exhaustion
CVE-2026-27145
CWE-400 Medium
No
No
1.25.11, 1.26.4 31.07.2026 SB2026073127
SB2026073129
SB2026073130
and 34 more
#VU140619 - Resource exhaustion
CVE-2026-42504
CWE-400 Medium
No
No
1.25.11, 1.26.4 31.07.2026 SB2026073127
SB20260731138
SB20260731143
and 5 more
#VU140618 - Improper Output Neutralization for Logs
CVE-2026-42507
CWE-117 Medium
No
No
1.25.11, 1.26.4 31.07.2026 SB2026073127
SB20260731115
SB20260731143
and 6 more
#VU140617 - Improper input validation
CVE-2026-39836
CWE-20 Medium
No
No
1.25.10, 1.26.3 31.07.2026 SB2026073126
#VU140616 - Improper input validation
CVE-2026-39825
CWE-20 Medium
No
No
1.25.10, 1.26.3 31.07.2026 SB2026073126
#VU140615 - Resource exhaustion
CVE-2026-42499
CWE-400 Medium
No
No
1.25.10, 1.26.3 31.07.2026 SB2026073126
#VU140614 - UNIX Symbolic Link (Symlink) Following
CVE-2026-39819
CWE-61 Low
No
No
1.25.10, 1.26.3 31.07.2026 SB2026073126
#VU140613 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2026-39817
CWE-22 Medium
No
No
1.25.10, 1.26.3 31.07.2026 SB2026073126
#VU140612 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-39826
CWE-79 Low
No
No
1.25.10, 1.26.3 31.07.2026 SB2026073126
#VU140611 - Double Free
CVE-2026-33811
CWE-415 Medium
No
No
1.25.10, 1.26.3 31.07.2026 SB2026073126
SB20260731121
SB20260731123
and 7 more
#VU140610 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-39823
CWE-79 Medium
No
No
1.25.10, 1.26.3 31.07.2026 SB2026073126
#VU140609 - Improper input validation
CVE-2026-42501
CWE-20 High
No
No
1.25.10, 1.26.3 31.07.2026 SB2026073126
#VU140608 - Resource exhaustion
CVE-2026-39820
CWE-400 Medium
No
No
1.25.10, 1.26.3 31.07.2026 SB2026073126
#VU140603 - Integer overflow
CVE-2026-27143
CWE-190 Low
No
No
1.25.9, 1.26.2 31.07.2026 SB2026073125
SB2026073157
SB2026073158
and 11 more
#VU140602 - Allocation of Resources Without Limits or Throttling
CVE-2026-32288
CWE-770 Medium
No
No
1.25.9, 1.26.2 31.07.2026 SB2026073125
SB2026073155
SB2026073156
and 8 more
#VU140601 - Protection Mechanism Failure
CVE-2026-27140
CWE-693 High
No
No
1.25.9, 1.26.2 31.07.2026 SB2026073125
SB2026073155
SB2026073156
and 15 more
#VU140600 - Improper input validation
CVE-2026-32281
CWE-20 Medium
No
No
1.25.9, 1.26.2 31.07.2026 SB2026073125
SB2026073183
SB2026073184
and 29 more
#VU140599 - Resource exhaustion
CVE-2026-32280
CWE-400 Medium
No
No
1.25.9, 1.26.2 31.07.2026 SB2026073125
SB2026073160
SB2026073161
and 60 more


Showing elements 1 - 20 out of 177