GS
Vendor security profile
Go standard library
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs34
Critical3
CISA KEV0
Public exploit1
Patch rate%38
Avg. CVSS7.6
12-month vulnerability rate
0
0
1
0
2
3
5
2
1
6
0
13
CVE KEV
CVE severity distribution
34toplam CVE
Critical3 (9%)
High25 (74%)
Medium3 (9%)
Uncertain3 (9%)
Patch and exploitation view
%38
Verified patch
%0
CISA KEV
%3
Public exploit
13Patch available
0Partial
0Workaround
0Vendor: no patch
21Unknown
Latest vulnerabilities
-
CVE-2026-97032
HTTP/2 server crash due to HPACK encoder race in net/http
GS
Patch status unknownEPSS %0
7.5
CVE-2026-94439
HTTP/1 server connection desynchronization after 2xx CONNECT response in net/http
GS
Patch status unknownEPSS %0
9.1
CVE-2026-78663
Double flow control refund on HTTP/2 server streams in net/http
GS
Patch status unknownEPSS %1
7.5
CVE-2026-78669
Excessive CPU consumption from repeated initial window changes in net/http
GS
Patch status unknownEPSS %1
7.5
CVE-2026-78660
HTTP/2 transport accepts malformed framing-related headers in net/http
GS
Patch status unknownEPSS %0
7.5
CVE-2026-78667
Lack of limit on size of parsed Range headers in net/http
GS
Patch status unknownEPSS %0
7.5
CVE-2026-94440
Memory limit bypass when parsing MIME headers in net/textproto, mime/multipart
GS
Patch status unknownEPSS %0
7.5
CVE-2026-97031
Reject malformed ECH outer extension references in crypto/tls
GS
Patch status unknownEPSS %0
7.5
CVE-2026-56866
HTTP/1 client connection desynchronization after CONNECT rejection in net/http
GS
Patch status unknownEPSS %0
9.8
CVE-2026-56857
Root.Mkdir(All) can follow junctions out of the root on Windows in os
GS
Patch status unknownEPSS %0