VulertSecurity VulertSecurity

Vulnerability Database · Go · Package report

github.com/couchbase/sync_gateway: vulnerability history, versions and safety

github.com/couchbase/sync_gateway is a package in the Go ecosystem. Vulert records 3 vulnerabilities for it across 120 releases, from Feb 2022 to Jun 2026. Each vulnerability names the versions it affects, the fixed version to move to, and a workaround where no fix has been published.

i
3 vulnerabilities recorded C1 H1 U1
i
1 with no fix published

No patched version yet — these are the ones to plan around.

See the unfixed vulnerabilities →
i
1 in the last 12 months

Most recent disclosure 25 Jun 2026.

See the disclosure history →
i
0 malicious-package vulnerabilities

No published version shipped hostile code.

See all github.com/couchbase/sync_gateway vulnerabilities

Vulert verdict on github.com/couchbase/sync_gateway v0.0.0-20261022142211-d0a2d5b2e560 i

Updated on 23 Oct 2026

Careful: v0.0.0-20261022142211-d0a2d5b2e560 has 3 known vulnerabilities, and 1 has no fix yet. Use an earlier safe version, or the workaround listed for each one.

Package health score 60/100
  • Security Some issues to review
  • Maintenance Sustainable
  • Popularity Niche
  • Community Moderate

The current release has a vulnerability with no published fix, which caps this score.

What to do: Pin an earlier, unaffected release if you can, and apply the workaround each vulnerability lists until a fix is published. No fix yet: Vulert alerts you the moment one is published. Monitor it with Vulert →

  • Current release v0.0.0-20261022142211-d0a2d5b2e560 — affected i
  • Vulnerabilities on record 3 over 4 years · 1 in the last year i
  • Latest disclosure 25 Jun 2026 i
  • Highest CVSS 9.8 i
  • With no published fix 1 i
  • Stars 454 i
  • OpenSSF scorecard 6/10 i
  • Last release this month i
  • Licence non-standard i

Version list, release dates, licence and dependants published by the Go module proxy, refreshed 23 Oct 2026. Licence information is not legal advice.

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.

01 Versions

Which versions are affected

Every version Vulert tracks for github.com/couchbase/sync_gateway, newest first, with the vulnerabilities recorded against each one. A version showing none has no vulnerability in the Vulert database — open it for the full picture on that release.

i
Version Released Vulert vulnerabilities Licence Fix published Details
v0.0.0-20261022142211-d0a2d5b2e560 22 Oct 2026 C1 H1 U1 — No Details →
v0.0.0-20261022115057-cbbbfb866a29 22 Oct 2026 C1 H1 U1 — No Details →
v0.0.0-20261021195051-398f96723c82 21 Oct 2026 C1 H1 U1 — No Details →
v0.0.0-20261021095822-952d3d2856ce 21 Oct 2026 C1 H1 U1 — No Details →
v0.0.0-20261019200100-e28a5f7643ed 19 Oct 2026 C1 H1 U1 — No Details →
v0.0.0-20261019115013-01df425608d0 19 Oct 2026 C1 H1 U1 — No Details →
v0.0.0-20261016134650-0274e7f08c33 16 Oct 2026 C1 H1 U1 — No Details →
v0.0.0-20261015185624-c86dc4646014 15 Oct 2026 C1 H1 U1 — No Details →
v0.0.0-20261015135408-3f77a2cadd39 15 Oct 2026 C1 H1 U1 — No Details →
v0.0.0-20261014154115-201e8b5ed337 14 Oct 2026 C1 H1 U1 — No Details →
v0.0.0-20261014151432-dd74f187418d 14 Oct 2026 C1 H1 U1 — No Details →
v0.0.0-20261014112133-7980db646d5a 14 Oct 2026 C1 H1 U1 — No Details →
v0.0.0-20261014072637-da51f4040b46 14 Oct 2026 C1 H1 U1 — No Details →
v0.0.0-20261014005420-81125b7a8732 14 Oct 2026 C1 H1 U1 — No Details →
v0.0.0-20261013111935-f1c59eb25924 13 Oct 2026 C1 H1 U1 — No Details →
v0.0.0-20261013093712-2d614fa9db7b 13 Oct 2026 C1 H1 U1 — No Details →
v0.0.0-20261012101206-ac1cbc091c7e 12 Oct 2026 C1 H1 U1 — No Details →
v0.0.0-20261012093425-4141528887a5 12 Oct 2026 C1 H1 U1 — No Details →
v0.0.0-20261009140227-6d89178bfc4d 09 Oct 2026 C1 H1 U1 — No Details →
v0.0.0-20261009133234-d353ded0364f 09 Oct 2026 C1 H1 U1 — No Details →
v0.0.0-20261009020433-3b22c29b11ce 09 Oct 2026 C1 H1 U1 — No Details →
v0.0.0-20261008162119-ab7884e54ec3 08 Oct 2026 C1 H1 U1 — No Details →
v0.0.0-20261008151413-b78e2c169b92 08 Oct 2026 C1 H1 U1 — No Details →
v0.0.0-20261008142246-e854f16964c9 08 Oct 2026 C1 H1 U1 — No Details →
v0.0.0-20261008140644-d412cde98749 08 Oct 2026 C1 H1 U1 — No Details →
v0.0.0-20261007164517-80262ea4c8ee 07 Oct 2026 C1 H1 U1 — No Details →
v0.0.0-20261007122631-6841f71ad237 07 Oct 2026 C1 H1 U1 — No Details →
v0.0.0-20261006163921-c665a2f17997 06 Oct 2026 C1 H1 U1 — No Details →
v0.0.0-20261006112911-60b83b7c9fd3 06 Oct 2026 C1 H1 U1 — No Details →
v0.0.0-20261005150101-1e11ecd6ebca 05 Oct 2026 C1 H1 U1 — No Details →
v0.0.0-20261005134032-b4bc5b6dca44 05 Oct 2026 C1 H1 U1 — No Details →
v0.0.0-20261002173920-0ee56649fd96 02 Oct 2026 C1 H1 U1 — No Details →
v0.0.0-20261002152343-4ab3bb9b7431 02 Oct 2026 C1 H1 U1 — No Details →
v0.0.0-20261002133924-532bb7de7c0f 02 Oct 2026 C1 H1 U1 — No Details →
v0.0.0-20261002124603-e1ae048dfd89 02 Oct 2026 C1 H1 U1 — No Details →
v0.0.0-20261002121232-c20ed1618b64 02 Oct 2026 C1 H1 U1 — No Details →
v0.0.0-20260930152443-9b2008d2c6b5 30 Sep 2026 C1 H1 U1 — No Details →
v0.0.0-20260930144602-3952349a6ea3 30 Sep 2026 C1 H1 U1 — No Details →
v0.0.0-20260930143431-0c5ef1b7b831 30 Sep 2026 C1 H1 U1 — No Details →
v0.0.0-20260930134905-ce3c1e0e8ec5 30 Sep 2026 C1 H1 U1 — No Details →
v0.0.0-20260929120913-e3920b232b13 29 Sep 2026 C1 H1 U1 — No Details →
v0.0.0-20260928133506-acea3ed74297 28 Sep 2026 C1 H1 U1 — No Details →
v0.0.0-20260925135423-85b80654b459 25 Sep 2026 C1 H1 U1 — No Details →
v0.0.0-20260925114124-ceace95c048c 25 Sep 2026 C1 H1 U1 — No Details →
v0.0.0-20260925112918-c8bb2aed2219 25 Sep 2026 C1 H1 U1 — No Details →
v0.0.0-20260925104406-cfa72727adf4 25 Sep 2026 C1 H1 U1 — No Details →
v0.0.0-20260924133226-3095fb810462 24 Sep 2026 C1 H1 U1 — No Details →
v0.0.0-20260921113523-34e05db39728 21 Sep 2026 C1 H1 U1 — No Details →
v0.0.0-20260921095304-f17f136b8895 21 Sep 2026 C1 H1 U1 — No Details →
v0.0.0-20260918153514-c0ff7840d10a 18 Sep 2026 C1 H1 U1 — No Details →
v0.0.0-20260918104545-9f4cc23ce0ce 18 Sep 2026 C1 H1 U1 — No Details →
v0.0.0-20260917163537-8ef0dc36ef8d 17 Sep 2026 C1 H1 U1 — No Details →
v0.0.0-20260917085941-24ffd1678bb6 17 Sep 2026 C1 H1 U1 — No Details →
v0.0.0-20260916162717-d81f8620adc0 16 Sep 2026 C1 H1 U1 — No Details →
v0.0.0-20260915183826-060f37fbce10 15 Sep 2026 C1 H1 U1 — No Details →
v0.0.0-20260915135157-3a91008a212e 15 Sep 2026 C1 H1 U1 — No Details →
v0.0.0-20260915131630-4470cf4e8f06 15 Sep 2026 C1 H1 U1 — No Details →
v0.0.0-20260915124143-1a73286dadab 15 Sep 2026 C1 H1 U1 — No Details →
v0.0.0-20260915110639-7a0c3b80e1bb 15 Sep 2026 C1 H1 U1 — No Details →
v0.0.0-20260915105334-c3c096a8a9c5 15 Sep 2026 C1 H1 U1 — No Details →
v0.0.0-20260914162951-270604890066 14 Sep 2026 C1 H1 U1 — No Details →
v0.0.0-20260914150135-20787dfe24ef 14 Sep 2026 C1 H1 U1 — No Details →
v0.0.0-20260914142506-a5d4e6a3336c 14 Sep 2026 C1 H1 U1 — No Details →
v0.0.0-20260914124930-851c95267dac 14 Sep 2026 C1 H1 U1 — No Details →
v0.0.0-20260914111129-c84662ddf525 14 Sep 2026 C1 H1 U1 — No Details →
v0.0.0-20260911152231-1cc481c8e8ef 11 Sep 2026 C1 H1 U1 — No Details →
v0.0.0-20260911141619-c8c5c2a70378 11 Sep 2026 C1 H1 U1 — No Details →
v0.0.0-20260911134151-d68a48d434c9 11 Sep 2026 C1 H1 U1 — No Details →
v0.0.0-20260911132013-2516abcfbfa4 11 Sep 2026 C1 H1 U1 — No Details →
v0.0.0-20260911124448-dc16449b453f 11 Sep 2026 C1 H1 U1 — No Details →
v0.0.0-20260909160332-142507cfc04f 09 Sep 2026 C1 H1 U1 — No Details →
v0.0.0-20260909144432-c63589307197 09 Sep 2026 C1 H1 U1 — No Details →
v0.0.0-20260909113347-c10855404503 09 Sep 2026 C1 H1 U1 — No Details →
v0.0.0-20260909082615-28b60d1a783c 09 Sep 2026 C1 H1 U1 — No Details →
v0.0.0-20260908121104-37b851c5c7ed 08 Sep 2026 C1 H1 U1 — No Details →
v0.0.0-20260907224328-6047f5690453 07 Sep 2026 C1 H1 U1 — No Details →
v0.0.0-20260907214127-0a77aeb6bf4e 07 Sep 2026 C1 H1 U1 — No Details →
v0.0.0-20260907211926-3ef1bdb0ee7f 07 Sep 2026 C1 H1 U1 — No Details →
v0.0.0-20260907205513-09c240030fed 07 Sep 2026 C1 H1 U1 — No Details →
v0.0.0-20260907202737-c7d293dca9ad 07 Sep 2026 C1 H1 U1 — No Details →
v0.0.0-20260907201651-c32102d79888 07 Sep 2026 C1 H1 U1 — No Details →
v0.0.0-20260907200222-b227b3da4ca2 07 Sep 2026 C1 H1 U1 — No Details →
v0.0.0-20260907193246-bb30ed38fa64 07 Sep 2026 C1 H1 U1 — No Details →
v0.0.0-20260907083518-121d921a978c 07 Sep 2026 C1 H1 U1 — No Details →
v0.0.0-20260904163928-c015a407ba52 04 Sep 2026 C1 H1 U1 — No Details →
v0.0.0-20260904163725-deb6c06bae2f 04 Sep 2026 C1 H1 U1 — No Details →
v0.0.0-20260904124555-ce5fb012457d 04 Sep 2026 C1 H1 U1 — No Details →
v0.0.0-20260904115916-95deb1acac8f 04 Sep 2026 C1 H1 U1 — No Details →
v0.0.0-20260903153715-c5b9e757fe22 03 Sep 2026 C1 H1 U1 — No Details →
v0.0.0-20260903133719-c1a9eeca3809 03 Sep 2026 C1 H1 U1 — No Details →
v0.0.0-20260903125814-b375fdc2b3fc 03 Sep 2026 C1 H1 U1 — No Details →
v0.0.0-20260903111820-72afdaaac609 03 Sep 2026 C1 H1 U1 — No Details →
v0.0.0-20260902202713-a97185e2b290 02 Sep 2026 C1 H1 U1 — No Details →
v0.0.0-20260902114824-fe5f4e4d6d92 02 Sep 2026 C1 H1 U1 — No Details →
v0.0.0-20260902083452-04e85ba61e25 02 Sep 2026 C1 H1 U1 — No Details →
v0.0.0-20260901154925-be6eacf7a264 01 Sep 2026 C1 H1 U1 — No Details →
v0.0.0-20260827155303-0a76af569ddc 27 Aug 2026 C1 H1 U1 — No Details →
v0.0.0-20260827150008-8108c19e300a 27 Aug 2026 C1 H1 U1 — No Details →
v0.0.0-20260827145138-c19d1ec7c527 27 Aug 2026 C1 H1 U1 — No Details →
v0.0.0-20260827142850-e512bfe75a59 27 Aug 2026 C1 H1 U1 — No Details →
v0.0.0-20260827134016-02b07b1ba94e 27 Aug 2026 C1 H1 U1 — No Details →
v0.0.0-20260826232355-b7f61bc67844 26 Aug 2026 C1 H1 U1 — No Details →
v0.0.0-20260826173848-318c7f22a251 26 Aug 2026 C1 H1 U1 — No Details →
v0.0.0-20260826163732-c5404b004a3d 26 Aug 2026 C1 H1 U1 — No Details →
v0.0.0-20260826153024-e28640d56403 26 Aug 2026 C1 H1 U1 — No Details →
v0.0.0-20260826150940-04f3f2591f76 26 Aug 2026 C1 H1 U1 — No Details →
v0.0.0-20260826144844-f1e7c8f674ca 26 Aug 2026 C1 H1 U1 — No Details →
v0.0.0-20260826143113-03ceeaaf60f8 26 Aug 2026 C1 H1 U1 — No Details →
v0.0.0-20260826141622-e274a4a1ce22 26 Aug 2026 C1 H1 U1 — No Details →
v0.0.0-20260825174428-e5326239b108 25 Aug 2026 C1 H1 U1 — No Details →
v0.0.0-20260825143817-3d9e67634d10 25 Aug 2026 C1 H1 U1 — No Details →
v0.0.0-20260824151814-ab16652c7ec3 24 Aug 2026 C1 H1 U1 — No Details →
v0.0.0-20260821161435-f39abe11abb4 21 Aug 2026 C1 H1 U1 — No Details →
v0.0.0-20260821155617-dc876a1542b8 21 Aug 2026 C1 H1 U1 — No Details →
v0.0.0-20260821134929-e2c0e8f208c3 21 Aug 2026 C1 H1 U1 — No Details →
v0.0.0-20260821130959-0edc58497a10 21 Aug 2026 C1 H1 U1 — No Details →
v0.0.0-20260821124427-de6bf215ae45 21 Aug 2026 C1 H1 U1 — No Details →
v0.0.0-20260821123417-3a2015b8e216 21 Aug 2026 C1 H1 U1 — No Details →
v0.0.0-20260821104445-6807f221075c 21 Aug 2026 C1 H1 U1 — No Details →
v0.0.0-20260820185733-fdc23320ca4c 20 Aug 2026 C1 H1 U1 — No Details →

The newest 120 of 4,715 versions Vulert tracks. Severity counts are the vulnerabilities recorded against that exact release.

02 Disclosure history

How often vulnerabilities are recorded

  • 2022 1
  • 2025 1
  • 2026 1

Counted by the year Vulert recorded each vulnerability — the same date the table below shows as disclosed. 1 of the 3 were recorded in the last 12 months.

03 Vulnerabilities

Recorded vulnerabilities for github.com/couchbase/sync_gateway

The 3 most severe of 3 vulnerabilities recorded for this package

Search all 3 in the database →
Vulnerability Severity Fixed version ↓ Disclosed ↓
CVE-2019-9039: SQL Injection in Couchbase Sync Gateway 9.8 critical 2.5.0 15 Feb 2022
CVE-2025-52490: Couchbase Sync Gateway Exposes Cleartext Passwords in Logs 7.3 high 3.2.6 29 Jul 2025
CVE-2025-52490: Couchbase Sync Gateway Exposes Cleartext Passwords in Output N/A unrated No fix published 25 Jun 2026

Vulnerability wrong, a fix missing, or a package we should cover? Report it and we will fix the record. Report Vulnerability Provide Feedback

Updated: 23/Oct/2026 · Vulnerabilities in our DB: 524315

Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

About github.com/couchbase/sync_gateway

Is github.com/couchbase/sync_gateway safe to use?

Vulert records 3 vulnerabilities for github.com/couchbase/sync_gateway in Go: 1 critical, 1 high, 0 medium and 0 low, plus 1 not yet rated. 1 of them has no published fix yet, so that is the one to avoid or mitigate.

What is github.com/couchbase/sync_gateway's Vulert package health score?

Vulert scores github.com/couchbase/sync_gateway 60/100, which reads as usable, but worth attention. The score weighs the vulnerability record (40), maintenance and release cadence (25), adoption from dependents and stars (20) and community signals such as the OpenSSF scorecard and forks (15). The current release has a vulnerability with no published fix, which caps this score.

Is the latest version of github.com/couchbase/sync_gateway affected?

Yes. v0.0.0-20261022142211-d0a2d5b2e560, the version you would install today, has 3 known vulnerabilities, and 1 has no published fix yet. Use an earlier unaffected release, or the workaround each vulnerability lists.

How many vulnerabilities does github.com/couchbase/sync_gateway have?

3 vulnerabilities are recorded for github.com/couchbase/sync_gateway in the Go ecosystem: 1 critical, 1 high, 0 medium and 0 low, plus 1 not yet rated. The ledger on this page lists the same counts next to the date of the most recent disclosure.

How often are new github.com/couchbase/sync_gateway vulnerabilities disclosed?

1 vulnerability was recorded for github.com/couchbase/sync_gateway in the last 12 months, and the oldest entry in this database dates to 15 Feb 2022. Recency matters more than a lifetime total: it shows how actively new issues are being disclosed for the package you are considering.

Which versions of github.com/couchbase/sync_gateway are affected?

Each vulnerability on this page lists the affected version range and the fixed version to move to. Open the vulnerability for the version you actually run — fixes are specific to a release line, not to the package as a whole.

How do I monitor github.com/couchbase/sync_gateway for upcoming vulnerabilities?

Upload the manifest or SBOM for your application at vulert.com/scanner and Vulert keeps checking the github.com/couchbase/sync_gateway version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.