G
Vendor security profile
golang
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs53
Critical9
CISA KEV0
Public exploit1
Patch rate%94
Avg. CVSS7.3
12-month vulnerability rate
0
0
2
1
2
10
24
2
2
0
2
0
CVE KEV
CVE severity distribution
53toplam CVE
Critical9 (17%)
High27 (51%)
Medium17 (32%)
Patch and exploitation view
%94
Verified patch
%0
CISA KEV
%2
Public exploit
50Patch available
0Partial
0Workaround
0Vendor: no patch
3Unknown
Latest vulnerabilities
-
CVE-2026-97032
HTTP/2 server crash due to HPACK encoder race in net/http
GS
Patch status unknownEPSS %0
9.1
CVE-2026-78663
Double flow control refund on HTTP/2 server streams in net/http
GS
Patch status unknownEPSS %1
7.5
CVE-2026-78669
Excessive CPU consumption from repeated initial window changes in net/http
GS
Patch status unknownEPSS %1
7.5
CVE-2026-78660
HTTP/2 transport accepts malformed framing-related headers in net/http
GS
Patch status unknownEPSS %0
7.5
CVE-2026-78659
HTTP/2 server memory exhaustion due to Trailer headers in net/http
GS
Patch status unknownEPSS %1
7.5
CVE-2026-56851
Panic parsing crafted input in x/text/secure/precis in golang.org/x/text
G
Patch status unknownEPSS %0
8.8
CVE-2026-94445
Malicious user input may lead to RCE in golang.org/x/playground
G
Patch status unknownEPSS %0
7.5
CVE-2026-78662
Resource allocation without limits in Golang Crypto
G
Patch verifiedEPSS %0
7.5
CVE-2026-56855
Resource allocation without limits in Golang Crypto
G
Patch verifiedEPSS %1
7.5
CVE-2026-56854
Source-address critical option not enforced for non-public-key auth callbacks in golang.org/x/crypto/ssh
G
Partial patchEPSS %0