Go toolchain cmd/go vulnerabilities

CVEs per yearBy the year they were published

1. 20202
2. 20236
3. 20242
4. 20253
5. 202610

Newest CVEs

• CVE-2026-94447

  Checksum database bypass for golang.org/toolchain in cmd/go

  Go toolchain · cmd/go

  High7.8
• CVE-2026-94444

  Checksum bypass for golang.org/fips140 in cmd/go

  Go toolchain · cmd/go

  High7.8
• CVE-2026-56864

  Ignore unrelated, unauthenticated hashes in Lookup in golang.org/x/mod/sumdb

  Go toolchain · cmd/go

  High7.5
• CVE-2026-56865

  Fix transparency log tile verification bypass in golang.org/x/mod/sumdb/tlog

  Go toolchain · cmd/go

  High8.4
• CVE-2026-42501

  Malicious module proxy can bypass checksum database in cmd/go

  Go toolchain · cmd/go

  High7.5
• CVE-2026-39817

  Invoking "go tool pack" does not sanitize output paths in cmd/go

  Go toolchain · cmd/go

  Medium5.9
• CVE-2026-39819

  Invoking "go bug" follows symlinks in predictable temporary filenames in cmd/go

  Go toolchain · cmd/go

  Medium5.3
• CVE-2026-27140

  Code execution vulnerability in SWIG code generation in cmd/go

  Go toolchain · cmd/go

  High8.8
• CVE-2025-61731

  Arbitrary file write using cgo pkg-config directive in cmd/go

  Go toolchain · cmd/go

  High7.8
• CVE-2025-68119

  Unexpected code execution when invoking toolchain in cmd/go

  Go toolchain · cmd/go

  High7.0