VulnSea

Go standard library has 3 CVEs on record. 1 was published in the last 90 days. The median CVSS is 7.5 (high).

CVEs per month

Last 12 months, by publish date

101112010203040506070809
Exploited share
0% vs 1% corpus
Median CVSS
7.5
Publish → KEV
—
Last 90 days
1 prev 2

Products

  • crypto/x509 1
  • encoding/asn1 1
  • mime 1
Follow Go standard library:RSS feedSave a search →Embed badge ↗
3
Total CVEs
0
Critical
0
CISA KEV
0
Exploited

Worst active — by depth score

Go standard library vulnerabilities

CVEs affecting Go standard library, newest first. Open any entry for full detail, references, and exploit status.

3 CVEsRSS

CVE-2026-33818High· 7.5
1mo ago

Enforce maximum recursion depth in encoding/asn1

Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures.

▾ TwilightGo standard library · encoding/asn1EPSS 0.57%via CVEORG
CVE-2026-42504High· 7.5
3mo ago

Quadratic complexity in WordDecoder.DecodeHeader in mime

Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU.

▾ TwilightGo standard library · mimeEPSS 0.56%via CVEORG
CVE-2026-27145Medium· 6.5PoC
3mo ago

(*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries

(*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries. This caused strings.Split(host, ".") to execute repeatedly on the same input hostname. With a large DNS SA…

▾ TwilightGo standard library · crypto/x509EPSS 0.59%via NVD
Go standard library vulnerabilities (CVEs) · VulnSea