---
source: https://iinventedlight.com/library/notes/go-vulncheck.md
title: "Finding vulnerable dependencies with govulncheck"
license: CC-BY-4.0
license_url: https://creativecommons.org/licenses/by/4.0/
source_license: "CC BY 4.0 (go.dev text); prose restates cited source lines"
attribution: "Summary by iinventedlight (AI-assisted). Sources: The Go Authors (go.dev), Go Vulnerability Management - The Go Programming Language, CC BY 4.0 (go.dev text); The Go Authors (go.dev), Vulnerability Management for Go - The Go Programming Language, CC BY 4.0 (go.dev text)."
author: "iinventedlight (synthesis of cited sources); text drafted with AI assistance"
date: 2026-11-04
status: published
checked_on: 2026-11-04
as_of: 2026-11-04
confidence: medium
untested: "No code was run for this note; only the fetched documentation pages were read."
category: coding-references
topic_area: "code-ai-eng: Go"
tags: ['go', 'security', 'vulnerabilities', 'govulncheck']
sources:
  - id: S1
    title: "Go Vulnerability Management - The Go Programming Language"
    publisher: The Go Authors (go.dev)
    url: https://go.dev/doc/security/vuln/
    accessed: 2026-11-04
    license: "CC BY 4.0 (go.dev text)"
  - id: S2
    title: "Vulnerability Management for Go - The Go Programming Language"
    publisher: The Go Authors (go.dev)
    url: https://go.dev/blog/vuln
    accessed: 2026-11-04
    license: "CC BY 4.0 (go.dev text)"
---
# Finding vulnerable dependencies with govulncheck

**Answer:** `govulncheck` checks a Go module against the Go vulnerability database (vuln.go.dev) and reports only vulnerabilities your code actually reaches, based on which of your functions transitively call vulnerable functions.

## Run it

```bash
go install golang.org/x/vuln/cmd/govulncheck@latest
govulncheck ./...
```


## The database

The Go vulnerability database collects reports from many sources, including direct reports from package maintainers. The Go security team reviews each entry so descriptions and affected functions are accurate.

## Workflow

1. Run govulncheck in CI.

To report a vulnerability in Go itself, follow the Go Security Policy.

## Claims
- id: C1
  claim: Govulncheck provides a low-noise, reliable way to find vulnerabilities.
  source: S1
  evidence: "functions. Govulncheck provides a low-noise, reliable way to find known"
- id: C2
  claim: Each database entry is reviewed.
  source: S1
  evidence: "Each entry in the database is reviewed to ensure that the vulnerability’s description,"
- id: C3
  claim: Govulncheck reports based on transitive calls to vulnerable functions.
  source: S2
  evidence: "based on which functions in your code are transitively calling vulnerable functions."
- id: C4
  claim: Reports are reviewed by the Go security team.
  source: S2
  evidence: "This information is then reviewed by the Go security team and added to the database."

## Sources
- [S1] Go Vulnerability Management - The Go Programming Language. The Go Authors (go.dev). https://go.dev/doc/security/vuln/ . License: CC BY 4.0 (go.dev text). Accessed 2026-11-04.
- [S2] Vulnerability Management for Go - The Go Programming Language. The Go Authors (go.dev). https://go.dev/blog/vuln . License: CC BY 4.0 (go.dev text). Accessed 2026-11-04.

License: this note is CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Summary by iinventedlight (AI-assisted).