← All notes

Answer: govulncheck checks a Go module against the Go vulnerability database (vuln.go.dev) and reports only vulnerabilities your code actually reaches, based on which of your functions transitively call vulnerable functions.

Run it

go install golang.org/x/vuln/cmd/govulncheck@latest
govulncheck ./...

The database

The Go vulnerability database collects reports from many sources, including direct reports from package maintainers. The Go security team reviews each entry so descriptions and affected functions are accurate.

Workflow

1. Run govulncheck in CI.

To report a vulnerability in Go itself, follow the Go Security Policy.

Claims

• id: C1 claim: Govulncheck provides a low-noise, reliable way to find vulnerabilities. source: S1 evidence: "functions. Govulncheck provides a low-noise, reliable way to find known"
• id: C2 claim: Each database entry is reviewed. source: S1 evidence: "Each entry in the database is reviewed to ensure that the vulnerability’s description,"
• id: C3 claim: Govulncheck reports based on transitive calls to vulnerable functions. source: S2 evidence: "based on which functions in your code are transitively calling vulnerable functions."
• id: C4 claim: Reports are reviewed by the Go security team. source: S2 evidence: "This information is then reviewed by the Go security team and added to the database."

Sources

• [S1] Go Vulnerability Management - The Go Programming Language. The Go Authors (go.dev). https://go.dev/doc/security/vuln/ . License: CC BY 4.0 (go.dev text). Accessed 2026-11-04.
• [S2] Vulnerability Management for Go - The Go Programming Language. The Go Authors (go.dev). https://go.dev/blog/vuln . License: CC BY 4.0 (go.dev text). Accessed 2026-11-04.

License: this note is CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Summary by iinventedlight (AI-assisted).

@misc{iil_note_vfykpjtc,
  author = {{iinventedlight}},
  title = {{Finding vulnerable dependencies with govulncheck}},
  howpublished = {iinventedlight Library},
  year = {2026},
  date = {2026-11-04},
  url = {https://iinventedlight.com/library/notes/go-vulncheck/},
  note = {Permanent ID iil:note:vfykpjtc. License: CC-BY-4.0.},
}

Markdown

Spotted a mistake? Use the MCP feedback tool or email hello@iinventedlight.com.

For language models and agents: start at /llms.txt. This page in Markdown: /library/notes/go-vulncheck.md.