Go Toolchain vulnerabilities

Products

• Cmd/go 23
• Cmd/cgo 3
• Cmd/compile 2

Newest

• go toolchain cmd/go Checksum database bypass for golang.org/toolchain in cmd/go CVE-2026-94447 Fix available 7.8 HighOctober 8, 2026
• go toolchain cmd/go Checksum bypass for golang.org/fips140 in cmd/go CVE-2026-94444 Fix available 7.8 HighOctober 8, 2026
• golang.org/x/mod golang.org/x/mod/sumdb/tlog, go toolchain cmd/go +1 more Fix transparency log tile verification bypass in golang.org/x/mod/sumdb/tlog CVE-2026-56865 Fix available 8.4 HighAugust 13, 2026
• golang.org/x/mod golang.org/x/mod/sumdb, go toolchain cmd/go +1 more Ignore unrelated, unauthenticated hashes in Lookup in golang.org/x/mod/sumdb CVE-2026-56864 Fix available 7.5 HighAugust 13, 2026
• go toolchain cmd/go, golang go +1 more Malicious module proxy can bypass checksum database in cmd/go CVE-2026-42501 Fix available 7.5 HighMay 7, 2026
• go toolchain cmd/go, golang go +1 more Invoking "go bug" follows symlinks in predictable temporary filenames in cmd/go CVE-2026-39819 Fix available 5.3 MediumMay 7, 2026
• go toolchain cmd/go, golang go +1 more Invoking "go tool pack" does not sanitize output paths in cmd/go CVE-2026-39817 Fix available 5.9 MediumMay 7, 2026
• go toolchain cmd/compile, golang go +1 more Miscompilation allows memory corruption via CONVNOP-wrapped array copy in cmd/compile CVE-2026-27144 Fix available 7.1 HighApril 7, 2026
• go toolchain cmd/compile, golang go +1 more Missing bound checks can lead to memory corruption in safe Go in cmd/compile CVE-2026-27143 Fix available 9.8 CriticalApril 7, 2026
• go toolchain cmd/go, golang go, red hat openshift service mesh 2 +24 more +26 more Code execution vulnerability in SWIG code generation in cmd/go CVE-2026-27140 Fix available 8.8 HighApril 7, 2026
• go toolchain cmd/cgo, golang go, red hat enterprise linux 10 +31 more +33 more Potential code smuggling via doc comments in cmd/cgo CVE-2025-61732 Fix available 8.6 HighFebruary 5, 2026
• go toolchain cmd/go, golang go, red hat enterprise linux 10 +30 more +32 more Arbitrary file write using cgo pkg-config directive in cmd/go CVE-2025-61731 Fix available 7.8 HighJanuary 16, 2026
• go toolchain cmd/go, golang go +1 more Unexpected code execution when invoking toolchain in cmd/go CVE-2025-68119 Fix available 7.0 HighJanuary 16, 2026
• go toolchain cmd/go, golang go +1 more Unexpected command execution in untrusted VCS repositories in cmd/go CVE-2025-4674 Fix available 8.6 HighJuly 9, 2025
• go toolchain cmd/go Arbitrary code execution during build on darwin in cmd/go CVE-2025-22867 Fix available 7.5 HighFebruary 6, 2025
• go toolchain cmd/go GOAUTH credential leak in cmd/go CVE-2024-45340 Fix available 8.8 HighJanuary 24, 2025
• go toolchain cmd/go, gotoolchain cmd\/go +1 more Output of "go env" does not sanitize values in cmd/go CVE-2023-24531 Fix available 9.8 CriticalJuly 2, 2024
• go toolchain cmd/go, golang go +1 more Arbitrary code execution during build on Darwin in cmd/go CVE-2024-24787 Public exploitFix available 6.4 MediumMay 8, 2024
• go toolchain cmd/go, golang go +1 more Command 'go get' may unexpectedly fallback to insecure git in cmd/go CVE-2023-45285 Fix available 7.5 HighDecember 6, 2023
• go toolchain cmd/go, golang go, fedoraproject fedora +2 more Arbitrary code execution during build via line directives in cmd/go CVE-2023-39323 Fix available 8.1 HighOctober 5, 2023
• go toolchain cmd/go, golang go +1 more Arbitrary code execution via go.mod toolchain directive in cmd/go CVE-2023-39320 Public exploitFix available 9.8 CriticalSeptember 7, 2023
• go toolchain cmd/go, golang go, fedoraproject fedora +2 more Code injection via go command with cgo in cmd/go CVE-2023-29402 Fix available 9.8 CriticalJune 8, 2023
• go toolchain cmd/go, golang go, fedoraproject fedora +1 more +3 more Improper sanitization of LDFLAGS with embedded spaces in go command with cgo in cmd/go CVE-2023-29405 Fix available 9.8 CriticalJune 8, 2023
• go toolchain cmd/go, golang go, fedoraproject fedora +2 more Improper handling of non-optional LDFLAGS in go command with cgo in cmd/go CVE-2023-29404 Fix available 9.8 CriticalJune 8, 2023
• go toolchain cmd/go, golang go +1 more Arbitrary code execution via the go command with cgo in cmd/go CVE-2020-28367 Fix available 7.5 HighNovember 18, 2020
• go toolchain cmd/cgo, cmd/go, golang go +3 more +5 more Arbitrary code execution in go command with cgo in cmd/go and cmd/cgo CVE-2020-28366 Fix available 7.5 HighNovember 18, 2020