CVEs we hold for Go
Records whose assigning authority named Go as the affected vendor. Newest identifiers first, capped at 200.
CVE-2026-97032HTTP/2 server crash due to HPACK encoder race in net/httpGo standard library net/http/internal/http2…
CVE-2026-97031Reject malformed ECH outer extension references in crypto/tlsGo standard library crypto/tls
CVE-2026-97030Recognize yield as regexp preceder keyword in html/templateGo standard library html/template
CVE-2026-96812Host Root Sandbox Escape in gVisor via Character Device Passthrough and CUSEGoogle gVisor
CVE-2026-95702Code Execution in Host Sentry Process via Double Free in gVisor VFS MemoryFileGoogle gVisor
200 records, read from the index as it stood on 18 Oct 2026. Every row opens the record it names, and every value on that record opens its own receipt.
Everything on this page is free. Public data. Withholding it protects nothing.