GS
Vendor security profile
Go standard library
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs34
Critical3
CISA KEV0
Public exploit1
Patch rate%68
Avg. CVSS7.5
12-month vulnerability rate
0
0
1
0
2
3
5
2
1
6
0
13
CVE KEV
CVE severity distribution
34toplam CVE
Critical3 (9%)
High25 (74%)
Medium5 (15%)
Uncertain1 (3%)
Patch and exploitation view
%68
Verified patch
%0
CISA KEV
%3
Public exploit
23Patch available
0Partial
0Workaround
0Vendor: no patch
11Unknown
Latest vulnerabilities
5.9
CVE-2026-97032
HTTP/2 server crash due to HPACK encoder race in net/http
GS
Patch verifiedEPSS %0
7.5
CVE-2026-94439
HTTP/1 server connection desynchronization after 2xx CONNECT response in net/http
GS
Patch status unknownEPSS %0
9.1
CVE-2026-78663
Double flow control refund on HTTP/2 server streams in net/http
GS
Patch verifiedEPSS %1
7.5
CVE-2026-78669
Excessive CPU consumption from repeated initial window changes in net/http
GS
Patch verifiedEPSS %1
7.5
CVE-2026-78660
HTTP/2 transport accepts malformed framing-related headers in net/http
GS
Patch verifiedEPSS %0
7.5
CVE-2026-78667
Lack of limit on size of parsed Range headers in net/http
GS
Patch status unknownEPSS %0
7.5
CVE-2026-94440
Memory limit bypass when parsing MIME headers in net/textproto, mime/multipart
GS
Patch verifiedEPSS %0
7.5
CVE-2026-97031
Reject malformed ECH outer extension references in crypto/tls
GS
Patch verifiedEPSS %0
7.5
CVE-2026-56866
HTTP/1 client connection desynchronization after CONNECT rejection in net/http
GS
Patch verifiedEPSS %0
9.8
CVE-2026-56857
Root.Mkdir(All) can follow junctions out of the root on Windows in os
GS
Patch verifiedEPSS %0