govulncheck

Spec sheet

Purpose

Govulncheck reports known vulnerabilities that affect Go code.Read 5 Oct 2026 · pkg.go.dev

Privacy

The package documentation says database requests contain only module paths for vulnerabilities already known to the database, not code or other properties of the program.Read 5 Oct 2026 · pkg.go.dev

Support

The Go docs direct govulncheck issues and feedback to the Go issue tracker.Read 5 Oct 2026 · go.dev

Analysis limits

Reflection calls are not visible to source analysis, and use of `unsafe` may cause false negatives.Read 5 Oct 2026 · pkg.go.dev

Binary limits

Binaries built with Go versions before 1.18 are checked only for standard library vulnerabilities.Read 5 Oct 2026 · pkg.go.dev

Binary scanning

It can scan compiled Go binaries using their symbol information, but binary results omit call stacks.Read 5 Oct 2026 · pkg.go.dev

Custom database

The `-db` flag can point govulncheck to a different database using HTTP, HTTPS, or file URLs, provided it implements the documented API.Read 5 Oct 2026 · go.dev

Editor integration

The Go language server gopls integrates govulncheck analysis, and the Go docs describe use with VS Code and Vim or NeoVim via coc.nvim.Read 5 Oct 2026 · go.dev

Editor limits

The documented editor scanning features currently do not report vulnerabilities in standard libraries or toolchains.Read 5 Oct 2026 · go.dev

Install

The Go docs show installing it with `go install golang.org/x/vuln/cmd/govulncheck@latest`.Read 5 Oct 2026 · go.dev

Output formats

Govulncheck supports streaming JSON, SARIF, and OpenVEX output.Read 5 Oct 2026 · pkg.go.dev

Project status

The Go vulnerability management project is described as a work in progress and under active development.Read 5 Oct 2026 · go.dev

Reachability analysis

It uses source code analysis or a binary’s symbol table to focus reports on vulnerabilities that could affect the application.Read 5 Oct 2026 · pkg.go.dev

Vulnerability data

By default it uses the Go vulnerability database, whose reports use the OSV schema and are reviewed and curated by the Go Security team.Read 5 Oct 2026 · go.dev

Plans and prices

Every govulncheck plan and price →

Where Specifiction places it

• Software Composition Analysis Software#36 of 657.7