x has 17 CVEs on record between 2022 and 2026. Cadence is steady at roughly 4 per quarter. The busiest recent month was May 2026 with 4. The median CVSS is 7.5 (high). None have a confirmed exploitation report. Most affected products: golang.org/x/net (7), golang.org/x/crypto (4), golang.org/x/image (3).

CVEs per month

Weakness classes

Products

Worst active — by depth score

x vulnerabilities

Excessive memory allocation during VP8L decoding in golang.org/x/image

A heap bufferflow in pcfReadFont() due to missing glyph bounds checking in libXfont2 before 2.0.8 allows attackers authenticated as X client to execute code within the X server.

The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues

golang.org/x/image/tiff has excessive resource consumption in PackBits decompression

Go Net HTML parser is vulnerable to denial of service

Invoking duplicate attributes can cause XSS in golang.org/x/net/html

Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html

Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh

Go Images vulnerable to an out-of-memory error via a crafted TIFF file

golang.org/x/oauth2 Improper Validation of Syntactic Correctness of Input vulnerability

Misuse of connection.serverAuthenticate may cause authorization bypass in golang.org/x/crypto

HTTP/2 rapid reset can cause excessive work in net/http

Improper rendering of text nodes in golang.org/x/net/html

golang.org/x/text/language Denial of service via crafted Accept-Language header

golang.org/x/net/http2 Denial of Service vulnerability

golang.org/x/crypto/ssh NULL Pointer Dereference vulnerability

golang.org/x/net/html has Improper Restriction of Operations within the Bounds of a Memory Buffer