# go (Go) vulnerabilities Source: https://junglewise.ai/threats/technologies/go Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/go.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 22 vulnerabilities in go (Go): 5 in the last 7 days and 14 in the last 90 days, 1 of them critical and 1 exploited in the wild. The most recent, CVE-2026-97039, was published on 11 November 2026. Nothing in the last four weeks, down from 9 vulnerabilities in the four before. ## Counts - Last 7 days: 5 - Last 30 days: 5 - Last 90 days: 14 - All time: 22 (1 critical, 1 exploited in the wild) ## About go (Go) Go is a statically-typed compiled programming language designed for simplicity and concurrent execution. ## Latest go (Go) vulnerabilities - [CVE-2026-97039: Go command unsafe pkg-config flag handling in cgo](https://junglewise.ai/threats/cve-2026-97039-building-a-malicious-package-that-uses-cgo-pkg-config-directives) (info, published 11 Nov 2026) - [CVE-2026-97038: Go linker code injection via malicious package compilation](https://junglewise.ai/threats/cve-2026-97038-building-a-malicious-package-containing-syso-files-or-cgo-linker) (info, published 11 Nov 2026) - [CVE-2026-97037: Go arbitrary code execution via malicious cgo linker flags](https://junglewise.ai/threats/cve-2026-97037-building-a-malicious-package-that-uses-cgo-could-cause-arbitrary) (info, published 11 Nov 2026) - [CVE-2026-97036: Go cgo arbitrary code execution via Apple linker argument injection](https://junglewise.ai/threats/cve-2026-97036-on-darwin-building-a-malicious-package-that-uses-cgo-could-cause) (info, published 11 Nov 2026) - [CVE-2026-97033: Go cgo arbitrary code execution via compiler flags](https://junglewise.ai/threats/cve-2026-97033-building-a-malicious-package-that-uses-cgo-could-cause-arbitrary) (info, published 11 Nov 2026) - [CVE-2026-97032: Go net/http HTTP/2 server crash due to HPACK encoder race](https://junglewise.ai/threats/cve-2026-97032-go-2026-6617-http-2-server-crash-due-to-hpack-encoder-race-in-net) (high, CVSS 7.5, published 8 Oct 2026) - [CVE-2026-97031: Go crypto/tls malformed ECH extension DoS](https://junglewise.ai/threats/cve-2026-97031-go-2026-6607-reject-malformed-ech-outer-extension-references-in) (high, CVSS 7.5, published 8 Oct 2026) - [CVE-2026-97030: Go html/template XSS via missing ES2015+ keywords](https://junglewise.ai/threats/cve-2026-97030-go-2026-6600-recognize-yield-as-regexp-preceder-keyword-in-html) (medium, CVSS 6.1, published 8 Oct 2026) - [CVE-2026-94448: Go html/template XSS via stale context in consecutive expressions](https://junglewise.ai/threats/cve-2026-94448-go-2026-6599-reset-context-tracking-on-consecutive-template) (medium, CVSS 6.1, published 8 Oct 2026) - [CVE-2026-94440: Go memory limit bypass in MIME header parsing](https://junglewise.ai/threats/cve-2026-94440-go-2026-6608-memory-limit-bypass-when-parsing-mime-headers-in-net) (high, CVSS 7.5, published 8 Oct 2026) - [CVE-2026-94439: Go net/http HTTP/1 server CONNECT response desynchronization](https://junglewise.ai/threats/cve-2026-94439-go-2026-6613-http-1-server-connection-desynchronization-after-2xx) (high, CVSS 7.5, published 8 Oct 2026) - [CVE-2026-78669: Go net/http excessive CPU consumption from repeated initial window changes](https://junglewise.ai/threats/cve-2026-78669-go-2026-6611-excessive-cpu-consumption-from-repeated-initial) (high, CVSS 7.5, published 8 Oct 2026) - [CVE-2026-78667: Go net/http denial of service in Range header parsing](https://junglewise.ai/threats/cve-2026-78667-go-2026-6609-lack-of-limit-on-size-of-parsed-range-headers-in-net) (high, CVSS 7.5, published 8 Oct 2026) - [CVE-2026-78660: Go net/http HTTP/2 transport malformed framing headers acceptance](https://junglewise.ai/threats/cve-2026-78660-go-2026-6610-http-2-transport-accepts-malformed-framing-related) (high, CVSS 7.5, published 8 Oct 2026) - [CVE-2026-56860: Go path resolution denial of service via parent directory segments](https://junglewise.ai/threats/cve-2026-56860-go-path-resolution-denial-of-service-via-parent-directory) (medium, CVSS 5.9, published 13 Aug 2026) - [CVE-2026-56858: Go path traversal with unescaped forward slash](https://junglewise.ai/threats/cve-2026-56858-go-path-traversal-with-unescaped-forward-slash) (medium, CVSS 6.1, published 13 Aug 2026) - [CVE-2026-56853: Go HTTP/2 timeout bypass in unencrypted connections](https://junglewise.ai/threats/cve-2026-56853-go-http-2-timeout-bypass-in-unencrypted-connections) (high, CVSS 7.5, published 13 Aug 2026) - [CVE-2026-33818: Go Unmarshal stack exhaustion in recursive structure parsing](https://junglewise.ai/threats/cve-2026-33818-go-unmarshal-stack-exhaustion-in-recursive-structure-parsing) (high, CVSS 7.5, published 13 Aug 2026) - [CVE-2026-33810: Google Go crypto/x509 improper DNS constraint validation](https://junglewise.ai/threats/cve-2026-33810-google-go-crypto-x509-improper-dns-constraint-validation) (high, CVSS 8.2, published 8 Apr 2026) - [CVE-2026-27137: Google Go crypto/x509 improper certificate validation in email constraints](https://junglewise.ai/threats/cve-2026-27137-google-go-crypto-x509-improper-certificate-validation-in-email) (high, CVSS 7.5, published 6 Mar 2026) - [CVE-2025-68120: To prevent unexpected untrusted code execution, the Visual Studio Code Go extension is now disabled in Restricted Mode.](https://junglewise.ai/threats/cve-2025-68120-visual-studio-code-go-extension-has-unexpected-untrusted-code) (medium, CVSS 5.4, published 30 Dec 2025) - [CVE-2020-0601: GO-2022-0535 - Certificate validation bypass on Windows in crypto/x509](https://junglewise.ai/threats/cve-2020-0601-microsoft-windows-cryptoapi-spoofing-vulnerability) (critical, exploited in the wild, CVSS 8.1, published 1 Aug 2022) ## Most severe go (Go) vulnerabilities - [CVE-2020-0601: GO-2022-0535 - Certificate validation bypass on Windows in crypto/x509](https://junglewise.ai/threats/cve-2020-0601-microsoft-windows-cryptoapi-spoofing-vulnerability) (critical, exploited in the wild, CVSS 8.1, published 1 Aug 2022) - [CVE-2026-33810: Google Go crypto/x509 improper DNS constraint validation](https://junglewise.ai/threats/cve-2026-33810-google-go-crypto-x509-improper-dns-constraint-validation) (high, CVSS 8.2, published 8 Apr 2026) - [CVE-2026-27137: Google Go crypto/x509 improper certificate validation in email constraints](https://junglewise.ai/threats/cve-2026-27137-google-go-crypto-x509-improper-certificate-validation-in-email) (high, CVSS 7.5, published 6 Mar 2026) - [CVE-2026-78669: Go net/http excessive CPU consumption from repeated initial window changes](https://junglewise.ai/threats/cve-2026-78669-go-2026-6611-excessive-cpu-consumption-from-repeated-initial) (high, CVSS 7.5, published 8 Oct 2026) - [CVE-2026-56853: Go HTTP/2 timeout bypass in unencrypted connections](https://junglewise.ai/threats/cve-2026-56853-go-http-2-timeout-bypass-in-unencrypted-connections) (high, CVSS 7.5, published 13 Aug 2026) - [CVE-2026-33818: Go Unmarshal stack exhaustion in recursive structure parsing](https://junglewise.ai/threats/cve-2026-33818-go-unmarshal-stack-exhaustion-in-recursive-structure-parsing) (high, CVSS 7.5, published 13 Aug 2026) - [CVE-2026-97032: Go net/http HTTP/2 server crash due to HPACK encoder race](https://junglewise.ai/threats/cve-2026-97032-go-2026-6617-http-2-server-crash-due-to-hpack-encoder-race-in-net) (high, CVSS 7.5, published 8 Oct 2026) - [CVE-2026-94440: Go memory limit bypass in MIME header parsing](https://junglewise.ai/threats/cve-2026-94440-go-2026-6608-memory-limit-bypass-when-parsing-mime-headers-in-net) (high, CVSS 7.5, published 8 Oct 2026) - [CVE-2026-97031: Go crypto/tls malformed ECH extension DoS](https://junglewise.ai/threats/cve-2026-97031-go-2026-6607-reject-malformed-ech-outer-extension-references-in) (high, CVSS 7.5, published 8 Oct 2026) - [CVE-2026-78667: Go net/http denial of service in Range header parsing](https://junglewise.ai/threats/cve-2026-78667-go-2026-6609-lack-of-limit-on-size-of-parsed-range-headers-in-net) (high, CVSS 7.5, published 8 Oct 2026) ## Vulnerabilities per week Nothing in the last four weeks, down from 9 vulnerabilities in the four before. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 9 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 5 | 0 | 0 | ## Other Go technologies - [github.com/mattermost/mattermost-server (Go)](https://junglewise.ai/threats/technologies/github-com-mattermost-mattermost-server): 297 vulnerabilities - [github.com/mattermost/mattermost-server/v6 (Go)](https://junglewise.ai/threats/technologies/github-com-mattermost-mattermost-server-v6): 222 vulnerabilities - [github.com/mattermost/mattermost/server/v8 (Go)](https://junglewise.ai/threats/technologies/github-com-mattermost-mattermost-server-v8): 207 vulnerabilities - [github.com/mattermost/mattermost-server/v5 (Go)](https://junglewise.ai/threats/technologies/github-com-mattermost-mattermost-server-v5): 199 vulnerabilities - [stdlib (Go)](https://junglewise.ai/threats/technologies/go-stdlib): 178 vulnerabilities - [github.com/siyuan-note/siyuan/kernel (Go)](https://junglewise.ai/threats/technologies/github-com-siyuan-note-siyuan-kernel): 160 vulnerabilities - [code.gitea.io/gitea (Go)](https://junglewise.ai/threats/technologies/code-gitea-io-gitea): 126 vulnerabilities - [code.vikunja.io/api (Go)](https://junglewise.ai/threats/technologies/code-vikunja-io-api): 91 vulnerabilities - [gogs.io/gogs (Go)](https://junglewise.ai/threats/technologies/gogs-io-gogs): 81 vulnerabilities - [github.com/traefik/traefik/v2 (Go)](https://junglewise.ai/threats/technologies/github-com-traefik-traefik-v2): 78 vulnerabilities - [github.com/traefik/traefik (Go)](https://junglewise.ai/threats/technologies/github-com-traefik-traefik): 75 vulnerabilities - [github.com/usememos/memos (Go)](https://junglewise.ai/threats/technologies/github-com-usememos-memos): 75 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "go (Go) vulnerabilities", https://junglewise.ai/threats/technologies/go, 13 November 2026.