Language and runtime
Go: supported versions and open vulnerabilities today
Go 1.27 and 1.26 are supported; 1.25 reached end of life on Aug 19, 2026; the latest release is 1.27.2. 63 advisories for Go without a severity rating were published in the last 12 months; one advisory (CVE-2020-0601) is on CISA’s list of vulnerabilities exploited in the wild.
Last checked against endoflife.date, OSV.dev, CISA KEV, FIRST EPSS and deps.dev.
- Latest release
- 1.27.2
- GitHub stars
- 139.3k
- Licence
- BSD-3-Clause
- OpenSSF Scorecard
- 6.2 / 10
Supported versions
Security advisories
63 advisories published in the last 12 months, 63 without a severity rating. 180 in total since records began. Checked packages: stdlib.
Older advisories CISA lists as exploited in the wild
- CVE-2020-0601 added ; fixed in 1.12.16 and 1.13.7.
Reset context tracking on consecutive template expressions in html/template
Fixed in 1.26.9 and 1.27.2.
EPSS: top 91%Recognize yield as regexp preceder keyword in html/template
Fixed in 1.26.9 and 1.27.2.
EPSS: top 91%HTTP/2 server memory exhaustion due to Trailer headers in net/http
Fixed in 1.26.9 and 1.27.2.
EPSS: top 54%
Maintenance and supply chain
OpenSSF Scorecard 6.2 / 10 (scored )
The Scorecard rates the repository’s security practices, not known vulnerabilities. Recent activity: 30 commits and 11 issue updates found in the last 90 days.
Weakest checks
- Binaries checked into the repo (Binary-Artifacts 0/10)
- No static analysis (SAST 0/10)
- No OpenSSF best-practices badge (CII-Best-Practices 0/10)
Docs and release notes
Check Go in your own stack
This page checks Go in general. Your repo pins specific versions: the free dependency check reads your manifests and lists what to fix first. Prism Agent runs the same live checks on your whole stack and turns them into a plan your coding agent can build.