products / go

Go

Go is the toolchain and standard library used to build network services, CLIs, and cloud agents. NVD tracks releases under cpe:2.3:a:golang:go. The Go security team assigns CVEs across compiler, cgo, and stdlib packages such as net/http, net/netip, and html/template.

api usage

Querying Go

product sluggo

version format1.20.0, 1.23.0, 1.21.12

bash

curl "https://api.attestd.io/v1/check?product=go&version=1.20.0" \
  -H "Authorization: Bearer $ATTESTD_KEY"

Go 1.20.0 falls inside the HTTP/2 rapid reset and related stdlib ranges fixed later on the 1.20 line. The aggregated response returns risk_state high for this version.

json

{
  "product": "go",
  "version": "1.20.0",
  "supported": true,
  "risk_state": "critical",
  "risk_factors": [
    "active_exploitation",
    "remote_code_execution",
    "no_authentication_required",
    "internet_exposed_service",
    "patch_available"
  ],
  "actively_exploited": true,
  "remote_exploitable": true,
  "authentication_required": false,
  "patch_available": true,
  "fixed_version": null,
  "confidence": 0.35,
  "cve_ids": [
    "CVE-2022-41722",
    "CVE-2022-41723",
    "CVE-2022-41724",
    "CVE-2022-41725",
    "CVE-2023-24532",
    "CVE-2023-24534",
    "CVE-2023-24536",
    "CVE-2023-24537",
    "CVE-2023-24538",
    "CVE-2023-24539",
    "CVE-2023-24540",
    "CVE-2023-29400",
    "CVE-2023-29402",
    "CVE-2023-29403",
    "CVE-2023-29404",
    "CVE-2023-29405",
    "CVE-2023-29406",
    "CVE-2023-29409",
    "CVE-2023-39318",
    "CVE-2023-39319",
    "CVE-2023-39323",
    "CVE-2023-39325",
    "CVE-2023-39326",
    "CVE-2023-44487",
    "CVE-2023-45283",
    "CVE-2023-45284",
    "CVE-2023-45285",
    "CVE-2023-45288",
    "CVE-2023-54365",
    "CVE-2024-24789",
    "CVE-2024-24790",
    "CVE-2025-0913",
    "CVE-2025-22873",
    "CVE-2025-4674",
    "CVE-2025-47906",
    "CVE-2025-47907",
    "CVE-2025-47912",
    "CVE-2025-58185",
    "CVE-2025-58187",
    "CVE-2025-58188",
    "CVE-2025-58189",
    "CVE-2025-61723",
    "CVE-2025-61724",
    "CVE-2025-61726",
    "CVE-2025-61727",
    "CVE-2025-61728",
    "CVE-2025-61729",
    "CVE-2025-61730",
    "CVE-2025-61731",
    "CVE-2025-61732",
    "CVE-2025-68119",
    "CVE-2025-68121",
    "CVE-2026-10081",
    "CVE-2026-10677",
    "CVE-2026-11366",
    "CVE-2026-11591",
    "CVE-2026-11645",
    "CVE-2026-12715",
    "CVE-2026-12761",
    "CVE-2026-13724",
    "CVE-2026-14300",
    "CVE-2026-14439",
    "CVE-2026-15252",
    "CVE-2026-15381",
    "CVE-2026-15739",
    "CVE-2026-15810",
    "CVE-2026-16536",
    "CVE-2026-16597",
    "CVE-2026-16614",
    "CVE-2026-17166",
    "CVE-2026-18059",
    "CVE-2026-25679",
    "CVE-2026-27139",
    "CVE-2026-27140",
    "CVE-2026-27142",
    "CVE-2026-27143",
    "CVE-2026-27144",
    "CVE-2026-32280",
    "CVE-2026-32281",
    "CVE-2026-32282",
    "CVE-2026-32283",
    "CVE-2026-32288",
    "CVE-2026-32289",
    "CVE-2026-33811",
    "CVE-2026-33814",
    "CVE-2026-3552",
    "CVE-2026-39817",
    "CVE-2026-39819",
    "CVE-2026-39820",
    "CVE-2026-39822",
    "CVE-2026-39823",
    "CVE-2026-39825",
    "CVE-2026-39826",
    "CVE-2026-39836",
    "CVE-2026-42499",
    "CVE-2026-42501",
    "CVE-2026-42505",
    "CVE-2026-43644",
    "CVE-2026-44390",
    "CVE-2026-48235",
    "CVE-2026-48244",
    "CVE-2026-48245",
    "CVE-2026-48246",
    "CVE-2026-55990",
    "CVE-2026-57691",
    "CVE-2026-60074",
    "CVE-2026-61448",
    "CVE-2026-62234",
    "CVE-2026-64800",
    "CVE-2026-64802",
    "CVE-2026-64803",
    "CVE-2026-65315",
    "CVE-2026-65599",
    "CVE-2026-68078",
    "CVE-2026-68080",
    "CVE-2026-70442"
  ],
  "cves": null,
  "max_epss": 0.99999,
  "last_updated": "2026-08-05T21:40:35.418975Z",
  "supply_chain": null,
  "supply_chain_monitored": false,
  "typosquat": null
}

safe version

Go 1.23.0 sits outside the CVE-2024-24790, CVE-2023-29402, CVE-2023-39325, and CVE-2023-24540 fixed ranges for current release lines.

bash

curl "https://api.attestd.io/v1/check?product=go&version=1.23.0" \
  -H "Authorization: Bearer $ATTESTD_KEY"

notable cves

CVE history

Go advisories often patch two supported minor lines at once. Critical issues cluster in address classification, cgo codegen for untrusted module paths, HTTP/2 server resource exhaustion, and html/template JS context escaping. Protocol-level cousins such as CVE-2023-44487 may appear in KEV for other products; the golang:go row for rapid reset is CVE-2023-39325 and is not itself a KEV entry.

CVE	Description	Affects	CVSS
`CVE-2024-24790`	net/netip Is* helpers misclassify IPv4-mapped IPv6 addresses and break allow/deny decisions.	<1.21.11 / <1.22.4	9.8
`CVE-2023-29402`	go with cgo can emit unexpected code for untrusted modules whose directory names contain newlines.	<1.19.10 / <1.20.5	9.8
`CVE-2023-39325`	HTTP/2 rapid reset floods exhaust net/http server resources.	<1.20.10 / <1.21.3	7.5
`CVE-2023-24540`	html/template fails to treat all JS whitespace as whitespace and allows template injection into JS contexts.	<1.19.9 / <1.20.4	9.8

KEV = CISA Known Exploited Vulnerabilities catalog. Active exploitation confirmed.

data sources

Single CPE namespace

NVD records Go toolchain and stdlib advisories under one CPE product identifier:

cpe:2.3:a:golang:goCompiler, cgo, and stdlib CVEs

Attestd filters through this prefix and matches version ranges across supported minor lines so a single check covers compiler and stdlib exposures together.

All products Rust Node.js Quickstart