VulertSecurity VulertSecurity

Vulnerability Database · Go · Package report

github.com/go-kratos/kratos/v2: vulnerability history, versions and safety

github.com/go-kratos/kratos/v2 is a package in the Go ecosystem. Vulert records 2 vulnerabilities for it across 120 releases, from Apr 2026 to Jul 2026. Each vulnerability names the versions it affects, the fixed version to move to, and a workaround where no fix has been published.

i
2 vulnerabilities recorded M1 U1
i
2 with no fix published

No patched version yet — these are the ones to plan around.

See the unfixed vulnerabilities →
i
2 in the last 12 months

Most recent disclosure 24 Jul 2026.

See the disclosure history →
i
0 malicious-package vulnerabilities

No published version shipped hostile code.

See all github.com/go-kratos/kratos/v2 vulnerabilities

Vulert verdict on github.com/go-kratos/kratos/v2 v2.9.2 i

Updated on 22 Oct 2026

Careful: v2.9.2 has 2 known vulnerabilities, and 2 have no fix yet. Use an earlier safe version, or the workaround listed for each one.

Package health score 60/100
  • Security Some issues to review
  • Maintenance Sustainable
  • Popularity Key ecosystem project
  • Community Moderate

The current release has a vulnerability with no published fix, which caps this score.

What to do: Pin an earlier, unaffected release if you can, and apply the workaround each vulnerability lists until a fix is published. No fix yet: Vulert alerts you the moment one is published. Monitor it with Vulert →

  • Current release v2.9.2 — affected i
  • Vulnerabilities on record 2 over 1 year · 2 in the last year i
  • Latest disclosure 24 Jul 2026 i
  • Highest CVSS 5.3 i
  • With no published fix 2 i
  • Stars 25,983 i
  • OpenSSF scorecard 3/10 i
  • Last release 10 months ago i
  • Licence MIT i

Version list, release dates, licence and dependants published by the Go module proxy, refreshed 22 Oct 2026. Licence information is not legal advice.

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.

01 Versions

Which versions are affected

Every version Vulert tracks for github.com/go-kratos/kratos/v2, newest first, with the vulnerabilities recorded against each one. A version showing none has no vulnerability in the Vulert database — open it for the full picture on that release.

i
Version Released Vulert vulnerabilities Licence Fix published Details
v2.0.0-20260404020628-f149714c1d54 04 Apr 2026 M1 U1 MIT No Details →
v2.9.2-0.20260404020628-f149714c1d54 04 Apr 2026 M1 U1 MIT No Details →
v2.9.3-0.20260404020628-f149714c1d54 04 Apr 2026 M1 U1 MIT No Details →
v2.9.3-0.20260327083312-4ed1bedbb024 27 Mar 2026 M1 U1 MIT No Details →
v2.9.3-0.20260312121050-e36259de52a8 12 Mar 2026 M1 U1 MIT No Details →
v2.0.0-20260105075216-c7a58ff59f80 05 Jan 2026 M1 U1 MIT No Details →
v2.9.3-0.20260105075216-c7a58ff59f80 05 Jan 2026 M1 U1 MIT No Details →
v2.9.3-0.20251231122250-a7b85f5cfaa1 31 Dec 2025 M1 U1 MIT No Details →
v2.9.3-0.20251226083916-764398fdbaf8 26 Dec 2025 M1 U1 MIT No Details →
v2.9.3-0.20251226082509-71684e308c11 26 Dec 2025 M1 U1 MIT No Details →
v2.0.0-20251217105121-fb8e43efb207 17 Dec 2025 M1 U1 MIT No Details →
v2.9.3-0.20251217105121-fb8e43efb207 17 Dec 2025 M1 U1 MIT No Details →
v2.0.0-20251205160234-b9fab9a5a5ab 05 Dec 2025 M1 U1 MIT No Details →
v2.9.2 05 Dec 2025 M1 U1 MIT No Details →
v2.0.0-20251201062103-6f0b3015b803 01 Dec 2025 M1 U1 MIT No Details →
v2.9.2-0.20251201062103-6f0b3015b803 01 Dec 2025 M1 U1 MIT No Details →
v2.0.0-20251124035119-6777de2442a7 24 Nov 2025 M1 U1 MIT No Details →
v2.9.2-0.20251124035119-6777de2442a7 24 Nov 2025 M1 U1 MIT No Details →
v2.0.0-20251106012513-9262193e351a 06 Nov 2025 M1 U1 MIT No Details →
v2.9.2-0.20251106012513-9262193e351a 06 Nov 2025 M1 U1 MIT No Details →
v2.0.0-20251105024418-34dacb38494e 05 Nov 2025 M1 U1 MIT No Details →
v2.0.0-20251015020953-cdff24709025 15 Oct 2025 M1 U1 MIT No Details →
v2.9.2-0.20251015020953-cdff24709025 15 Oct 2025 M1 U1 MIT No Details →
v2.9.1 12 Sep 2025 M1 U1 MIT No Details →
v2.8.5-0.20250910124201-593b412234ec 10 Sep 2025 M1 U1 MIT No Details →
v2.9.0 10 Sep 2025 M1 U1 MIT No Details →
v2.8.5-0.20250903025306-5bcf5bbe2743 03 Sep 2025 M1 U1 MIT No Details →
v2.8.5-0.20250828133012-308cfee50a57 28 Aug 2025 M1 U1 MIT No Details →
v2.0.0-20250731084034-f7f150c3f139 31 Jul 2025 M1 U1 MIT No Details →
v2.8.5-0.20250731084034-f7f150c3f139 31 Jul 2025 M1 U1 MIT No Details →
v2.8.5-0.20250716060240-ac92cbe5701c 16 Jul 2025 M1 U1 MIT No Details →
v2.8.5-0.20250714144425-0bf7c1ad32dd 14 Jul 2025 M1 U1 MIT No Details →
v2.0.0-20250527152916-d6f5f00cf562 27 May 2025 M1 U1 MIT No Details →
v2.8.5-0.20250527152916-d6f5f00cf562 27 May 2025 M1 U1 MIT No Details →
v2.8.5-0.20250429074618-c82f7957223f 29 Apr 2025 M1 U1 MIT No Details →
v2.8.5-0.20250427030626-b463dc514714 27 Apr 2025 M1 U1 MIT No Details →
v2.8.5-0.20250427030003-1baa3c6f491e 27 Apr 2025 M1 U1 MIT No Details →
v2.8.5-0.20250425054716-ff2d73a88244 25 Apr 2025 M1 U1 MIT No Details →
v2.8.5-0.20250425021012-15dd2f638e3d 25 Apr 2025 M1 U1 MIT No Details →
v2.8.5-0.20250424101853-48974ef77a44 24 Apr 2025 M1 U1 MIT No Details →
v2.0.0-20250423115721-dbd7664eff95 23 Apr 2025 M1 U1 MIT No Details →
v2.8.5-0.20250423115721-dbd7664eff95 23 Apr 2025 M1 U1 MIT No Details →
v2.8.5-0.20250423095935-5617ff3ff784 23 Apr 2025 M1 U1 MIT No Details →
v2.8.5-0.20250423053944-23ae7cb09654 23 Apr 2025 M1 U1 MIT No Details →
v2.8.5-0.20250421044313-1c3e0c9062f5 21 Apr 2025 M1 U1 MIT No Details →
v2.0.0-20250403070952-9580f086e326 03 Apr 2025 M1 U1 MIT No Details →
v2.8.5-0.20250403070952-9580f086e326 03 Apr 2025 M1 U1 MIT No Details →
v2.8.5-0.20250321075247-025c2dc2b0ff 21 Mar 2025 M1 U1 MIT No Details →
v2.8.5-0.20250320075300-e534ac33dfc0 20 Mar 2025 M1 U1 MIT No Details →
v2.8.5-0.20250314165958-d9aa7ff19541 14 Mar 2025 M1 U1 MIT No Details →
v2.8.5-0.20250312125852-142ea0a93a9f 12 Mar 2025 M1 U1 MIT No Details →
v2.8.4 07 Mar 2025 M1 U1 MIT No Details →
v2.8.4-0.20250304015625-3a0bd5074127 04 Mar 2025 M1 U1 MIT No Details →
v2.8.4-0.20250210091908-15168b5a1b7d 10 Feb 2025 M1 U1 MIT No Details →
v2.8.4-0.20250127095200-20970020a5ef 27 Jan 2025 M1 U1 MIT No Details →
v2.8.4-0.20250127015623-54f8e11d9fc4 27 Jan 2025 M1 U1 MIT No Details →
v2.8.4-0.20250124030557-ff30a75a868d 24 Jan 2025 M1 U1 MIT No Details →
v2.0.0-20241219093211-5087366d2f90 19 Dec 2024 M1 U1 MIT No Details →
v2.8.3 19 Dec 2024 M1 U1 MIT No Details →
v2.8.3-0.20241218102003-f75bdc15ed72 18 Dec 2024 M1 U1 MIT No Details →
v2.8.3-0.20241105072421-f8b97f675b32 05 Nov 2024 M1 U1 MIT No Details →
v2.8.3-0.20241104030238-3ecb1d62dcd4 04 Nov 2024 M1 U1 MIT No Details →
v2.8.3-0.20241031100207-f3c4b23a08df 31 Oct 2024 M1 U1 MIT No Details →
v2.8.3-0.20241031020025-bb85d7eda4b6 31 Oct 2024 M1 U1 MIT No Details →
v2.8.2 30 Oct 2024 M1 U1 MIT No Details →
v2.8.2-0.20241028134144-850877209eaa 28 Oct 2024 M1 U1 MIT No Details →
v2.8.2-0.20241028030050-225532d214d0 28 Oct 2024 M1 U1 MIT No Details →
v2.8.2-0.20241023124908-4e9dac08f1b7 23 Oct 2024 M1 U1 MIT No Details →
v2.8.1 14 Oct 2024 M1 U1 MIT No Details →
v2.8.1-0.20241014124617-8b8dc4b0f8be 14 Oct 2024 M1 U1 MIT No Details →
v2.8.1-0.20241011140022-7cd86eb077dc 11 Oct 2024 M1 U1 MIT No Details →
v2.8.1-0.20241008033159-5b5c253d837f 08 Oct 2024 M1 U1 MIT No Details →
v2.8.1-0.20240918015945-e1f5dc42b1e5 18 Sep 2024 M1 U1 MIT No Details →
v2.0.0-20240909031108-908e6256a9f6 09 Sep 2024 M1 U1 MIT No Details →
v2.8.1-0.20240909031108-908e6256a9f6 09 Sep 2024 M1 U1 MIT No Details →
v2.8.1-0.20240902085548-6963a8a438be 02 Sep 2024 M1 U1 MIT No Details →
v2.8.1-0.20240829015636-da7356560385 29 Aug 2024 M1 U1 MIT No Details →
v2.8.1-0.20240819025634-57b961cba04c 19 Aug 2024 M1 U1 MIT No Details →
v2.8.1-0.20240815090334-084c8b4167e7 15 Aug 2024 M1 U1 MIT No Details →
v2.8.1-0.20240725023016-d6fca5e3e984 25 Jul 2024 M1 U1 MIT No Details →
v2.8.0 22 Jul 2024 M1 U1 MIT No Details →
v2.7.4-0.20240719020056-7eb39d0c396a 19 Jul 2024 M1 U1 MIT No Details →
v2.7.4-0.20240627104009-3198e0b83bf2 27 Jun 2024 M1 U1 MIT No Details →
v2.7.4-0.20240615052815-46362d1a360d 15 Jun 2024 M1 U1 MIT No Details →
v2.7.4-0.20240611160111-eb07954ab60a 11 Jun 2024 M1 U1 MIT No Details →
v2.7.4-0.20240611061859-4aa4f7c7caf6 11 Jun 2024 M1 U1 MIT No Details →
v2.7.4-0.20240606021638-ba5a651b8252 06 Jun 2024 M1 U1 MIT No Details →
v2.7.4-0.20240601080717-c0a7935bb120 01 Jun 2024 M1 U1 MIT No Details →
v2.7.4-0.20240516020449-fbac5fa25e7a 16 May 2024 M1 U1 MIT No Details →
v2.0.0-20240504101732-d0d5761f9ca8 04 May 2024 M1 U1 MIT No Details →
v2.7.4-0.20240504101732-d0d5761f9ca8 04 May 2024 M1 U1 MIT No Details →
v2.7.4-0.20240430092255-be624d035565 30 Apr 2024 M1 U1 MIT No Details →
v2.7.4-0.20240427113814-a803e9d967a6 27 Apr 2024 M1 U1 MIT No Details →
v2.7.4-0.20240422034133-b3b2a3474a2a 22 Apr 2024 M1 U1 MIT No Details →
v2.7.4-0.20240420130141-78b67ad8cd94 20 Apr 2024 M1 U1 MIT No Details →
v2.7.4-0.20240416123913-75711092ab26 16 Apr 2024 M1 U1 MIT No Details →
v2.0.0-20240416033608-d94b7b46c2f8 16 Apr 2024 M1 U1 MIT No Details →
v2.7.4-0.20240416033608-d94b7b46c2f8 16 Apr 2024 M1 U1 MIT No Details →
v2.0.0-20240415113228-92454b019eab 15 Apr 2024 M1 U1 MIT No Details →
v2.7.4-0.20240415113228-92454b019eab 15 Apr 2024 M1 U1 MIT No Details →
v2.0.0-20240415105003-f1669d48a967 15 Apr 2024 M1 U1 — No Details →
v2.7.4-0.20240415105003-f1669d48a967 15 Apr 2024 M1 U1 — No Details →
v2.0.0-20240415082948-38a808c5e5b3 15 Apr 2024 M1 U1 — No Details →
v2.7.4-0.20240415082948-38a808c5e5b3 15 Apr 2024 M1 U1 — No Details →
v2.0.0-20240415075420-60b4d0cafada 15 Apr 2024 M1 U1 — No Details →
v2.7.4-0.20240415075420-60b4d0cafada 15 Apr 2024 M1 U1 — No Details →
v2.7.4-0.20240413103005-e8a58538beb3 13 Apr 2024 M1 U1 — No Details →
v2.7.4-0.20240401040316-f715eb0bd808 01 Apr 2024 M1 U1 — No Details →
v2.0.0-20240322155018-41971ffa647a 22 Mar 2024 M1 U1 — No Details →
v2.7.3 22 Mar 2024 M1 U1 — No Details →
v2.7.3-0.20240322155018-41971ffa647a 22 Mar 2024 M1 U1 — No Details →
v2.7.3-0.20240322154052-bfafeca13daf 22 Mar 2024 M1 U1 — No Details →
v2.7.3-0.20240320015221-1fdaabbd4813 20 Mar 2024 M1 U1 — No Details →
v2.7.3-0.20240316145942-1ab258e53f1b 16 Mar 2024 M1 U1 — No Details →
v2.7.3-0.20240316062537-311016862b20 16 Mar 2024 M1 U1 — No Details →
v2.7.3-0.20240315031937-05b23fbb5b1e 15 Mar 2024 M1 U1 — No Details →
v2.7.3-0.20240311125537-f566bdc2e6ff 11 Mar 2024 M1 U1 — No Details →
v2.0.0-20240301031206-50cad79c96ae 01 Mar 2024 M1 U1 — No Details →
v2.7.3-0.20240301031206-50cad79c96ae 01 Mar 2024 M1 U1 — No Details →
v2.7.3-0.20240228073637-aa0ad99d7c70 28 Feb 2024 M1 U1 — No Details →

The newest 120 of 1,074 versions Vulert tracks. Severity counts are the vulnerabilities recorded against that exact release.

02 Disclosure history

How often vulnerabilities are recorded

  • 2026 2

Counted by the year Vulert recorded each vulnerability — the same date the table below shows as disclosed. 2 of the 2 were recorded in the last 12 months.

03 Vulnerabilities

Recorded vulnerabilities for github.com/go-kratos/kratos/v2

The 2 most severe of 2 vulnerabilities recorded for this package

Search all 2 in the database →
Vulnerability Severity Fixed version ↑ Disclosed ↑
CVE-2026-6993: go-kratos kratos up to 2.9.2 - Confused Deputy Issue in HTTP Server 5.3 medium No fix published 25 Apr 2026
CVE-2026-6993: Confused Deputy Issue in Go-Kratos Package N/A unrated No fix published 24 Jul 2026

Vulnerability wrong, a fix missing, or a package we should cover? Report it and we will fix the record. Report Vulnerability Provide Feedback

Updated: 22/Oct/2026 · Vulnerabilities in our DB: 524173

Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Follow Vulert in Google

Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.

Add Vulert as a Preferred Source

Questions

About github.com/go-kratos/kratos/v2

Is github.com/go-kratos/kratos/v2 safe to use?

Vulert records 2 vulnerabilities for github.com/go-kratos/kratos/v2 in Go: 0 critical, 0 high, 1 medium and 0 low, plus 1 not yet rated. 2 of them have no published fix yet, so those are the ones to avoid or mitigate.

What is github.com/go-kratos/kratos/v2's Vulert package health score?

Vulert scores github.com/go-kratos/kratos/v2 60/100, which reads as usable, but worth attention. The score weighs the vulnerability record (40), maintenance and release cadence (25), adoption from dependents and stars (20) and community signals such as the OpenSSF scorecard and forks (15). The current release has a vulnerability with no published fix, which caps this score.

Is the latest version of github.com/go-kratos/kratos/v2 affected?

Yes. v2.9.2, the version you would install today, has 2 known vulnerabilities, and 2 has no published fix yet. Use an earlier unaffected release, or the workaround each vulnerability lists.

Which version of github.com/go-kratos/kratos/v2 should I use?

v2.9.2 is the version Vulert recommends for the affected releases. The version table above lists every release with the vulnerabilities recorded against it, so you can confirm the range you actually run.

How many vulnerabilities does github.com/go-kratos/kratos/v2 have?

2 vulnerabilities are recorded for github.com/go-kratos/kratos/v2 in the Go ecosystem: 0 critical, 0 high, 1 medium and 0 low, plus 1 not yet rated. The ledger on this page lists the same counts next to the date of the most recent disclosure.

How often are new github.com/go-kratos/kratos/v2 vulnerabilities disclosed?

2 vulnerabilities were recorded for github.com/go-kratos/kratos/v2 in the last 12 months, and the oldest entry in this database dates to 25 Apr 2026. Recency matters more than a lifetime total: it shows how actively new issues are being disclosed for the package you are considering.

Which versions of github.com/go-kratos/kratos/v2 are affected?

Each vulnerability on this page lists the affected version range and the fixed version to move to. Open the vulnerability for the version you actually run — fixes are specific to a release line, not to the package as a whole.

How do I monitor github.com/go-kratos/kratos/v2 for upcoming vulnerabilities?

Upload the manifest or SBOM for your application at vulert.com/scanner and Vulert keeps checking the github.com/go-kratos/kratos/v2 version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.