GGo toolchain

Products

Exploited and recent CVEs

• CVE-2026-94447 High 7.8 Checksum database bypass for golang.org/toolchain in cmd/go 0.1%
• CVE-2026-94444 High 7.8 Checksum bypass for golang.org/fips140 in cmd/go <0.1%
• CVE-2026-56864 High 7.5 Ignore unrelated, unauthenticated hashes in Lookup in golang.org/x/mod/sumdb 0.3%
• CVE-2026-56865 High 8.4 Fix transparency log tile verification bypass in golang.org/x/mod/sumdb/tlog 0.1%
• CVE-2026-42501 High 7.5 Malicious module proxy can bypass checksum database in cmd/go 0.2%
• CVE-2026-39817 Medium 5.9 Invoking "go tool pack" does not sanitize output paths in cmd/go 0.2%
• CVE-2026-39819 Medium 5.3 Invoking "go bug" follows symlinks in predictable temporary filenames in cmd/go 0.2%
• CVE-2026-27140 High 8.8 Code execution vulnerability in SWIG code generation in cmd/go 0.7%
• CVE-2026-27143 Critical 9.8 Missing bound checks can lead to memory corruption in safe Go in cmd/compile 0.5%
• CVE-2026-27144 High 7.1 Miscompilation allows memory corruption via CONVNOP-wrapped array copy in cmd/compile 0.3%
• CVE-2025-61732 High 8.6 Potential code smuggling via doc comments in cmd/cgo 0.5%
• CVE-2025-61731 High 7.8 Arbitrary file write using cgo pkg-config directive in cmd/go 0.6%
• CVE-2025-68119 High 7.0 Unexpected code execution when invoking toolchain in cmd/go 0.4%
• CVE-2025-4674 High 8.6 Unexpected command execution in untrusted VCS repositories in cmd/go 0.5%
• CVE-2025-22867 High 7.5 Arbitrary code execution during build on darwin in cmd/go 0.6%
• CVE-2024-45340 High 8.8 GOAUTH credential leak in cmd/go 0.7%
• CVE-2023-24531 Critical 9.8 Output of "go env" does not sanitize values in cmd/go 0.8%
• CVE-2024-24787 Medium 6.4 Arbitrary code execution during build on Darwin in cmd/go 0.8%
• CVE-2023-45285 Unrated Command 'go get' may unexpectedly fallback to insecure git in cmd/go 1.1%
• CVE-2023-39323 High 8.1 Arbitrary code execution during build via line directives in cmd/go 1.9%
• CVE-2023-39320 Unrated Arbitrary code execution via go.mod toolchain directive in cmd/go 1.8%
• CVE-2023-29405 Critical 9.8 Improper sanitization of LDFLAGS with embedded spaces in go command with cgo in cmd/go 1.7%
• CVE-2023-29405 Critical 9.8 Improper sanitization of LDFLAGS with embedded spaces in go command with cgo in cmd/go 1.7%
• CVE-2023-29404 Critical 9.8 Improper handling of non-optional LDFLAGS in go command with cgo in cmd/go 1.8%
• CVE-2023-29402 Critical 9.8 Code injection via go command with cgo in cmd/go 1.7%
• CVE-2020-28366 Unrated Arbitrary code execution in go command with cgo in cmd/go and cmd/cgo 2.3%
• CVE-2020-28366 Unrated Arbitrary code execution in go command with cgo in cmd/go and cmd/cgo 2.3%
• CVE-2020-28367 Unrated Arbitrary code execution via the go command with cgo in cmd/go 2.4%