Go toolchain vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-94447 Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/toolchain go.sum entry and operates a malicious GOMODPROXY the useHigh 7.8 · Oct 8, 2026
• CVE-2026-94444 Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/fips140 and operates a malicious GOMODPROXY the user chooses to coHigh 7.8 · Oct 8, 2026
• CVE-2026-56865 A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-cHigh 8.4 · Aug 13, 2026
• CVE-2026-56864 A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log.High 7.5 · Aug 13, 2026
• CVE-2026-42501 A malicious module proxy can exploit a flaw in the go command's validation of module checksums to bypass checksum database validation.High 7.5 · May 7, 2026
• CVE-2026-27144 The compiler is meant to unwrap pointers which are the operands of a memory move; a no-op interface conversion prevented the compiler from making the correct deHigh 7.1 · Apr 7, 2026
• CVE-2026-27143 Arithmetic over induction variables in loops were not correctly checked for underflow or overflow.Critical 9.8 · Apr 7, 2026
• CVE-2026-27140 SWIG file names containing 'cgo' and well-crafted payloads could lead to code smuggling and arbitrary code execution at build time due to trust layer bypass.High 8.8 · Apr 7, 2026
• CVE-2025-61732 A discrepancy between how Go and C/C++ comments were parsed allowed for code smuggling into the resulting cgo binary.High 8.6 · Feb 4, 2026
• CVE-2025-68119 Downloading and building modules with malicious version strings can cause local code execution.High 7 · Jan 28, 2026
• CVE-2025-61731 Building a malicious file with cmd/go can cause can cause a write to an attacker-controlled file with partial control of the file content.High 7.8 · Jan 28, 2026
• CVE-2025-4674 The go command may execute unexpected commands when operating in untrusted VCS repositories.High 8.6 · Jul 29, 2025
• CVE-2025-22867 On Darwin, building a Go module which contains CGO can trigger arbitrary code execution when using the Apple version of ld, due to usage of the @executable_pathHigh 7.5 · Feb 6, 2025
• CVE-2024-45340 Credentials provided via the new GOAUTH feature were not being properly segmented by domain, allowing a malicious server to request credentials they should not High 8.8 · Jan 27, 2025
• CVE-2023-24531 Command go env is documented as outputting a shell script containing the Go environment.Critical 9.8 · Jul 2, 2024
• CVE-2023-45285 Using go get to fetch a module with the ".git" suffix may unexpectedly fallback to the insecure "git://" protocol if the module is unavailable via the secure "hHigh 7.5 · Dec 6, 2023
• CVE-2023-39323 Line directives ("//line") can be used to bypass the restrictions on "//go:cgo_" directives, allowing blocked linker and compiler flags to be passed during compHigh 8.1 · Oct 5, 2023
• CVE-2023-39320 The go.mod toolchain directive, introduced in Go 1.21, can be leveraged to execute scripts and binaries relative to the root of the module when the "go" commandCritical 9.8 · Sep 8, 2023
• CVE-2023-29405 The go command may execute arbitrary code at build time when using cgo.Critical 9.8 · Jun 8, 2023
• CVE-2023-29404 The go command may execute arbitrary code at build time when using cgo.Critical 9.8 · Jun 8, 2023
• CVE-2023-29402 The go command may generate unexpected code at build time when using cgo.Critical 9.8 · Jun 8, 2023
• CVE-2020-28367 Code injection in the go command with cgo before Go 1.14.12 and Go 1.15.5 allows arbitrary code execution at build time via malicious gcc flags specified via a High 7.5 · Nov 18, 2020
• CVE-2020-28366 Code injection in the go command with cgo before Go 1.14.12 and Go 1.15.5 allows arbitrary code execution at build time via a malicious unquoted symbol name in High 7.5 · Nov 18, 2020