Go Vulnerability Management

You can install the latest version of govulncheck using the go install command. This tool allows you to analyze your codebase and binaries to identify known vulnerabilities in your dependencies, specifically focusing on vulnerabilities in functions that your code actually calls to reduce noise.

go install golang.org/x/vuln/cmd/govulncheck@latest

The Go vulnerability database is hosted at https://vuln.go.dev and provides data in JSON format.

Warning: Do not rely on the YAML files in the x/vulndb repository, as they use an internal format that may change without notice. Instead, use the supported JSON endpoints provided below.

Endpoint Variables:

• $base: The base URL https://vuln.go.dev.
• $module: A specific module path (e.g., golang.org/x/crypto).
• $vuln: A Go vulnerability ID (e.g., GO-2021-1234).

Once installed, navigate to your Go module's directory and run govulncheck followed by the package pattern you wish to analyze. Using ./... will scan all packages in the current module.

govulncheck ./...

Use NewInMemoryClient to create a client from a slice of *osv.Entry objects. This is useful for testing or working with transient vulnerability data in memory.

import (
	"golang.org/x/vuln/internal/client"
	"golang.org/x/vuln/internal/osv"
)

client, err := client.NewInMemoryClient([]*osv.Entry{
	// your OSV entries here
})

The ByModules method retrieves vulnerability information for a list of module requests. It returns a slice of *ModuleResponse objects, preserving the original order of the requests.

Even if no vulnerabilities are found for a specific request, a response is still returned with a nil Entries field.

import (
	"context"
	"golang.org/x/vuln/internal/client"
)

reqs := []*client.ModuleRequest{
	{
		Path:    "example.com/module",
		Version: "v1.2.3", // Optional: filter by version
	},
	{
		Path: "another.com/pkg",
		// Version omitted to get all vulnerabilities for this module
	},
}

responses, err := c.ByModules(ctx, reqs)
for _, resp := range responses {
	fmt.Printf("Module: %s, Version: %s, Vulns: %d\n", resp.Path, resp.Version, len(resp.Entries))
}

The LastModifiedTime method returns the timestamp indicating when the vulnerability database was last updated. This is useful for determining if a local cache needs to be refreshed.

time, err := c.LastModifiedTime(ctx)
if err != nil {
	// handle error
}
fmt.Printf("Database last updated: %v\n", time)

Use NewClient to create a client for reading vulnerability databases. The source argument must be a URL prefixed with http, https, or file.

• HTTP/HTTPS: Connects to a remote vulnerability database (e.g., https://vuln.go.dev).
• File: Connects to a local directory containing the vulnerability database.

You can optionally provide Options to configure the underlying http.Client.

import "golang.org/x/vuln/internal/client"

// For a remote database
client, err := client.NewClient("https://vuln.go.dev", &client.Options{})

// For a local database
client, err := client.NewClient("file:///path/to/vulndb", nil)

The ModuleResponse struct contains the results of a ByModules query for a single module.

type ModuleResponse struct {
	Path    string
	Version string
	Entries []*osv.Entry
}

The ModuleRequest struct defines the criteria for searching vulnerabilities for a specific module.

type ModuleRequest struct {
	Path    string
	Version string
}

The govulncheck tool is the command-line entrypoint for scanning Go projects for known vulnerabilities. It uses the golang.org/x/vuln/scan package to execute scanning logic. The tool reports errors to stderr and exits with a non-zero status code if vulnerabilities are found or if an error occurs during execution.

# Example usage (actual flags and arguments are defined in the scan package)
govulncheck ./...