Go toolchain vulnerabilities

CVEs per yearBy the year they were published

1. 20202
2. 20236
3. 20242
4. 20253
5. 202613

Newest CVEs

• CVE-2026-94447

  Checksum database bypass for golang.org/toolchain in cmd/go

  Go toolchain · cmd/go

  High7.8
• CVE-2026-94444

  Checksum bypass for golang.org/fips140 in cmd/go

  Go toolchain · cmd/go

  High7.8
• CVE-2026-56864

  Ignore unrelated, unauthenticated hashes in Lookup in golang.org/x/mod/sumdb

  Go toolchain · cmd/go

  High7.5
• CVE-2026-56865

  Fix transparency log tile verification bypass in golang.org/x/mod/sumdb/tlog

  Go toolchain · cmd/go

  High8.4
• CVE-2026-42501

  Malicious module proxy can bypass checksum database in cmd/go

  Go toolchain · cmd/go

  High7.5
• CVE-2026-39817

  Invoking "go tool pack" does not sanitize output paths in cmd/go

  Go toolchain · cmd/go

  Medium5.9
• CVE-2026-39819

  Invoking "go bug" follows symlinks in predictable temporary filenames in cmd/go

  Go toolchain · cmd/go

  Medium5.3
• CVE-2026-27140

  Code execution vulnerability in SWIG code generation in cmd/go

  Go toolchain · cmd/go

  High8.8
• CVE-2026-27143

  Missing bound checks can lead to memory corruption in safe Go in cmd/compile

  Go toolchain · cmd/compile

  Critical9.8
• CVE-2026-27144

  Miscompilation allows memory corruption via CONVNOP-wrapped array copy in cmd/compile

  Go toolchain · cmd/compile

  High7.1