Software Detail
Title
CVE
CRITICAL
HIGH
MEDIUM
LOW
CWE
Number of items displayed
Go Number Of NVD 138 CRITICAL 16 HIGH 83 MEDIUM 37 LOW 2
URL https://golang.org/
Explanation It is a programming language developed by Google.
It has a simple syntax and can be coded by anyone to look the same.
It has been adopted by many companies because it is good at parallel processing and can perform well on multi-core systems.
Since it is cross-compatible, it can be run in a variety of environments including Windows, Linux, Mac, and Android.

As a result of prioritizing simplicity, there are some disadvantages such as the lack of exception handling (there are alternative functions), which is common in other languages.
This may be implemented in the future.

A major release is made about every 6 months.
If a critical bug or security issue is fixed during the major release, a minor release is made.

The last two major releases are supported and covered.
Since major releases are made about every six months, the major version a year ago will no longer be supported.
Tag
  • オープンソース
  • BSD License
Add Information URL
No Type Name URL
1 https://github.com/golang/go/wiki/Go-Release-Cycle
2 https://golang.org/doc/devel/release.html
3 https://github.com/golang/go/wiki/MinorReleases
4 https://golang.org/security
5 https://golang.org/doc/copyright.html
List Of Product  [ Click to show release history and vulnerability information ]
No Name Latest Version Release date Initial release Normal Support Security Support
Service Pack Support		 Extended
for a fee		 Critical High Medium Low
21 go 1.21 1.21.13 Aug. 6, 2024 June 16, 2023 2 14 12 1
22 go 1.20 1.20.7 Aug. 1, 2023 Feb. 1, 2023 6 22 14 1
23 go 1.19 1.19.13 Sept. 6, 2023 Aug. 2, 2022 6 29 15 1
24 Go 1.18 1.18.10 Jan. 10, 2023 March 15, 2022 6 41 19 2
25 Go 1.17 1.17.13 Aug. 1, 2022 Aug. 16, 2021 8 47 20 2
26 Go 1.16 1.16.15 March 3, 2022 Feb. 16, 2021 8 53 27 2
27 Go 1.15 1.15.15 Aug. 4, 2021 Aug. 11, 2020 8 58 29 2
28 Go 1.14 1.14.15 Feb. 4, 2021 Feb. 25, 2020 8 58 31 2
29 Go 1.13 1.13.15 Aug. 6, 2020 Sept. 3, 2019 8 62 31 2
30 Go 1.12 1.12.17 Feb. 12, 2020 Feb. 25, 2019 10 63 31 2
31 go 1.9 1.9.7 11 66 32 2
32 go 1.8 1.8.7 11 66 33 2
33 go 1.7 1.7.6 11 69 33 2
34 go 1.6 1.6.4 11 71 33 2
35 go 1.5 1.5.4 11 72 33 2
36 go 1.4 1.4.3 14 70 33 2
37 go 1.3 1.3.3 14 70 34 2
38 go 1.2 1.20.7 Aug. 1, 2023 14 71 35 2
39 go 1.12 1.12.9 10 63 31 2
40 go 1.11 1.11.9 10 63 32 2
41 go 1.10 1.10.8 10 66 31 2
42 go 1.1 1.19.13 Sept. 6, 2023 14 72 35 2
43 go 1.0 1.0.3 15 70 33 2
44 go 0.0 0.0.0-20201203163018-be400aefbc4c 14 69 33 2
NVD Vulnerability Information
  • CRITICAL
  • HIGH
  • MEDIUM
  • LOW
No CVSS3
CVSS2		 Level
Attach Vector		 Title CWE CVE cpe23Uri or higher or less more than less than Update date
Published date		 Show Affected Exploit
PoC
Search
21 5.3
- 		MEDIUM
Network 		A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network than are in the body. A malicious HTTP client can… NVD-CWE-noinfo
CVE-2023-39326 cpe:2.3:a:golang:go:*:*
1.21.0-0

1.20.12
1.21.5 		2024-11-21 17:15
2023-12-7 		Show GitHub Exploit DB Packet Storm
22 7.5
- 		HIGH
Network 		Before Go 1.20, the RSA based TLS key exchanges used the math/big library, which is not constant time. RSA blinding was applied to prevent timing attacks, but analysis shows this may not have been fu… CWE-203
 Information Exposure Through Discrepancy 		CVE-2023-45287 cpe:2.3:a:golang:go:*:* 1.20.0 2024-11-21 17:26
2023-12-6 		Show GitHub Exploit DB Packet Storm
23 5.3
- 		MEDIUM
Network 		On Windows, The IsLocal function does not correctly detect reserved device names in some cases. Reserved names followed by spaces, such as "COM1 ", and reserved names "COM" and "LPT" followed by supe… NVD-CWE-noinfo
CVE-2023-45284 cpe:2.3:a:golang:go:*:*
1.21.0-0

1.20.11
1.21.4 		2024-11-21 17:26
2023-11-10 		Show GitHub Exploit DB Packet Storm
24 7.5
- 		HIGH
Network 		The filepath package does not recognize paths with a \??\ prefix as special. On Windows, a path beginning with \??\ is a Root Local Device path equivalent to a path beginning with \\?\. Paths with a … CWE-22
Path Traversal 		CVE-2023-45283 cpe:2.3:a:golang:go:*:*
1.21.0-0

1.20.11
1.21.4 		2024-11-21 17:26
2023-11-10 		Show GitHub Exploit DB Packet Storm
25 7.5
- 		HIGH
Network 		A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption. While the total number of requests is bounded by the http2.Server… CWE-770
 Allocation of Resources Without Limits or Throttling 		CVE-2023-39325 cpe:2.3:a:golang:go:*:* 1.21.0
1.20.0

1.21.3
1.20.10 		2024-11-21 17:15
2023-10-12 		Show GitHub Exploit DB Packet Storm
26 7.5
- 		HIGH
Network 		The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023. NVD-CWE-noinfo
CVE-2023-44487 cpe:2.3:a:golang:go:*:* 1.21.0

1.21.3
1.20.10 		2025-03-8 04:15
2023-10-10 		Show GitHub Exploit DB Packet Storm
27 8.1
- 		HIGH
Network 		Line directives ("//line") can be used to bypass the restrictions on "//go:cgo_" directives, allowing blocked linker and compiler flags to be passed during compilation. This can result in unexpected … NVD-CWE-noinfo
CVE-2023-39323 cpe:2.3:a:golang:go:*:*
1.21.0

1.20.9
1.21.2 		2024-11-21 17:15
2023-10-6 		Show GitHub Exploit DB Packet Storm
28 7.5
- 		HIGH
Network 		QUIC connections do not set an upper bound on the amount of data buffered when reading post-handshake messages, allowing a malicious QUIC connection to cause unbounded memory growth. With fix, connec… CWE-770
 Allocation of Resources Without Limits or Throttling 		CVE-2023-39322 cpe:2.3:a:golang:go:*:* 1.21.0 1.21.1 2024-11-21 17:15
2023-09-9 		Show GitHub Exploit DB Packet Storm
29 7.5
- 		HIGH
Network 		Processing an incomplete post-handshake message for a QUIC connection can cause a panic. NVD-CWE-noinfo
CVE-2023-39321 cpe:2.3:a:golang:go:*:* 1.21.0 1.21.1 2024-11-21 17:15
2023-09-9 		Show GitHub Exploit DB Packet Storm
30 9.8
- 		CRITICAL
Network 		The go.mod toolchain directive, introduced in Go 1.21, can be leveraged to execute scripts and binaries relative to the root of the module when the "go" command was executed within the module. This a… CWE-94
Code Injection 		CVE-2023-39320 cpe:2.3:a:golang:go:*:* 1.21.0 1.21.1 2024-11-21 17:15
2023-09-9 		Show GitHub Exploit DB Packet Storm