VulertSecurity VulertSecurity

Vulnerability Database · Go · Package report

github.com/gorilla/sessions: vulnerability history, versions and safety

github.com/gorilla/sessions is a package in the Go ecosystem. Vulert records 1 vulnerability for it across 120 releases, first recorded in Apr 2024. Each vulnerability names the versions it affects, the fixed version to move to, and a workaround where no fix has been published.

i
1 vulnerabilities recorded U1
i
1 with no fix published

No patched version yet — these are the ones to plan around.

See the unfixed vulnerabilities →
i
0 in the last 12 months

Nothing new recorded in the last year.

See the disclosure history →
i
0 malicious-package vulnerabilities

No published version shipped hostile code.

See all github.com/gorilla/sessions vulnerabilities

Vulert verdict on github.com/gorilla/sessions v1.4.0 i

Updated on 23 Oct 2026

Careful: v1.4.0 has 1 known vulnerability, and 1 has no fix yet. Use an earlier safe version, or the workaround listed for each one.

Package health score 60/100
  • Security Minor issues
  • Maintenance Maintaining
  • Popularity Key ecosystem project
  • Community Quiet

The current release has a vulnerability with no published fix, which caps this score.

What to do: Pin an earlier, unaffected release if you can, and apply the workaround each vulnerability lists until a fix is published. No fix yet: Vulert alerts you the moment one is published. Monitor it with Vulert →

  • Current release v1.4.0 — affected i
  • Vulnerabilities on record 1 over 1 year · 0 in the last year i
  • Latest disclosure 17 Apr 2024 i
  • Highest CVSS n/a i
  • With no published fix 1 i
  • Stars 3,149 i
  • OpenSSF scorecard 3/10 i
  • Last release 26 months ago i
  • Licence BSD-3-Clause i

Version list, release dates, licence and dependants published by the Go module proxy, refreshed 23 Oct 2026. Licence information is not legal advice.

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.

01 Versions

Which versions are affected

Every version Vulert tracks for github.com/gorilla/sessions, newest first, with the vulnerabilities recorded against each one. A version showing none has no vulnerability in the Vulert database — open it for the full picture on that release.

i
Version Released Vulert vulnerabilities Licence Fix published Details
v0.0.0-20240820140720-bb4cd60c952a 20 Aug 2024 U1 BSD-3-Clause No Details →
v1.2.3-0.20240820140720-bb4cd60c952a 20 Aug 2024 U1 BSD-3-Clause No Details →
v1.4.0 20 Aug 2024 U1 BSD-3-Clause No Details →
v1.2.3-0.20240820133806-a56e60c14e37 20 Aug 2024 U1 BSD-3-Clause No Details →
v1.2.3-0.20240615025808-466d29e7f343 15 Jun 2024 U1 BSD-3-Clause No Details →
v1.2.3-0.20240615025442-7a8159ef2d1b 15 Jun 2024 U1 BSD-3-Clause No Details →
v1.2.3-0.20240615023954-8e2d54718e94 15 Jun 2024 U1 BSD-3-Clause No Details →
v0.0.0-20240615023610-19d52f4a3dff 15 Jun 2024 U1 BSD-3-Clause No Details →
v1.3.0 15 Jun 2024 U1 BSD-3-Clause No Details →
v1.2.3-0.20240615023213-c373b3e334dc 15 Jun 2024 U1 BSD-3-Clause No Details →
v1.2.3-0.20240615022933-ef99c782e9aa 15 Jun 2024 U1 BSD-3-Clause No Details →
v1.2.3-0.20240504160106-bdabf0ac29ab 04 May 2024 U1 BSD-3-Clause No Details →
v1.2.3-0.20240417230643-e308bfd8bdcb 17 Apr 2024 U1 BSD-3-Clause No Details →
v1.2.3-0.20231105215906-4f4a90cc433f 05 Nov 2023 U1 BSD-3-Clause No Details →
v0.0.0-20231105022928-3eed1c4ffcde 05 Nov 2023 U1 BSD-3-Clause No Details →
v1.2.2 05 Nov 2023 U1 BSD-3-Clause No Details →
v1.2.2-0.20231105022928-3eed1c4ffcde 05 Nov 2023 U1 BSD-3-Clause No Details →
v1.2.2-0.20231018111600-26d95ec758d6 18 Oct 2023 U1 BSD-3-Clause No Details →
v0.0.0-20230817170540-dd83328c14c8 17 Aug 2023 U1 BSD-3-Clause No Details →
v1.2.2-0.20230817170540-dd83328c14c8 17 Aug 2023 U1 BSD-3-Clause No Details →
v0.0.0-20230731074345-69327c514c1f 31 Jul 2023 U1 BSD-3-Clause No Details →
v1.2.2-0.20230731074345-69327c514c1f 31 Jul 2023 U1 BSD-3-Clause No Details →
v1.2.2-0.20230726074222-1a1e42e73b07 26 Jul 2023 U1 BSD-3-Clause No Details →
v1.2.2-0.20230725060211-070f6e732a44 25 Jul 2023 U1 BSD-3-Clause No Details →
v1.2.2-0.20230723203259-b1daf6dac741 23 Jul 2023 U1 BSD-3-Clause No Details →
v1.2.2-0.20230715200351-956d3cfa652f 15 Jul 2023 U1 BSD-3-Clause No Details →
v1.2.2-0.20230715145436-7aa6ccf8b686 15 Jul 2023 U1 BSD-3-Clause No Details →
v1.2.2-0.20230710165511-a9ce342f39db 10 Jul 2023 U1 BSD-3-Clause No Details →
v1.2.2-0.20230710164712-8745abca52af 10 Jul 2023 U1 BSD-3-Clause No Details →
v0.0.0-20221209155731-0e1d1d7c3821 09 Dec 2022 U1 BSD-3-Clause No Details →
v1.2.2-0.20221209155731-0e1d1d7c3821 09 Dec 2022 U1 BSD-3-Clause No Details →
v0.0.0-20220207110423-a6a8e49c83a2 07 Feb 2022 U1 BSD-3-Clause No Details →
v1.2.2-0.20220207110423-a6a8e49c83a2 07 Feb 2022 U1 BSD-3-Clause No Details →
v1.2.2-0.20220109151404-d81e0696f6af 09 Jan 2022 U1 BSD-3-Clause No Details →
v1.2.2-0.20210731131350-0a84f353f006 31 Jul 2021 U1 BSD-3-Clause No Details →
v1.2.2-0.20200912192502-9cb0b0a3e38d 12 Sep 2020 U1 BSD-3-Clause No Details →
v0.0.0-20200819152528-61fa50d034f9 19 Aug 2020 U1 BSD-3-Clause No Details →
v1.2.1 19 Aug 2020 U1 BSD-3-Clause No Details →
v1.2.1-0.20200713044738-947297c38923 13 Jul 2020 U1 BSD-3-Clause No Details →
v0.0.0-20200105164144-15ff35117046 05 Jan 2020 U1 BSD-3-Clause No Details →
v1.2.1-0.20200105164144-15ff35117046 05 Jan 2020 U1 BSD-3-Clause No Details →
v0.0.0-20191006151301-400b592ab70b 06 Oct 2019 U1 BSD-3-Clause No Details →
v1.2.1-0.20191006151301-400b592ab70b 06 Oct 2019 U1 BSD-3-Clause No Details →
v0.0.0-20190917125414-36821f6da8fc 17 Sep 2019 U1 BSD-3-Clause No Details →
v1.2.1-0.20190917125414-36821f6da8fc 17 Sep 2019 U1 BSD-3-Clause No Details →
v0.0.0-20190720202136-9c6b24ee2dee 20 Jul 2019 U1 BSD-3-Clause No Details →
v1.2.1-0.20190720202136-9c6b24ee2dee 20 Jul 2019 U1 BSD-3-Clause No Details →
v0.0.0-20190709140413-4355a998706e 09 Jul 2019 U1 BSD-3-Clause No Details →
v1.2.0 09 Jul 2019 U1 BSD-3-Clause No Details →
v0.0.0-20190627040625-56c33e9da484 27 Jun 2019 U1 BSD-3-Clause No Details →
v1.1.4-0.20190627040625-56c33e9da484 27 Jun 2019 U1 BSD-3-Clause No Details →
v0.0.0-20181208214519-12bd4761fc66 08 Dec 2018 U1 BSD-3-Clause No Details →
v1.1.3-0.20181208214519-12bd4761fc66 08 Dec 2018 U1 BSD-3-Clause No Details →
v1.1.4-0.20181208214519-12bd4761fc66 08 Dec 2018 U1 BSD-3-Clause No Details →
v1.1.4-0.20181207164211-b72c0abcab34 07 Dec 2018 U1 BSD-3-Clause No Details →
v0.0.0-20181127123235-4109461f01b3 27 Nov 2018 U1 BSD-3-Clause No Details →
v1.1.4-0.20181127123235-4109461f01b3 27 Nov 2018 U1 BSD-3-Clause No Details →
v0.0.0-20181015005113-68d1edeb366b 15 Oct 2018 U1 BSD-3-Clause No Details →
v1.1.4-0.20181015005113-68d1edeb366b 15 Oct 2018 U1 BSD-3-Clause No Details →
v0.0.0-20181012153309-8619d3c3a2b9 12 Oct 2018 U1 BSD-3-Clause No Details →
v1.1.4-0.20181012153309-8619d3c3a2b9 12 Oct 2018 U1 BSD-3-Clause No Details →
v0.0.0-20180928171057-f57b7e2d29c6 28 Sep 2018 U1 BSD-3-Clause No Details →
v1.1.3 28 Sep 2018 U1 BSD-3-Clause No Details →
v0.0.0-20180913183928-e736060e33a9 13 Sep 2018 U1 BSD-3-Clause No Details →
v1.1.3-0.20180913183928-e736060e33a9 13 Sep 2018 U1 BSD-3-Clause No Details →
v1.1.2 03 Sep 2018 U1 BSD-3-Clause No Details →
v0.0.0-20180606155211-03b6f63cc43e 06 Jun 2018 U1 BSD-3-Clause No Details →
v1.1.1 06 Jun 2018 U1 BSD-3-Clause No Details →
v0.0.0-20180514193723-9ee0d62e031e 14 May 2018 U1 BSD-3-Clause No Details →
v0.0.0-20180321163855-a2f2a3de9a4a 21 Mar 2018 U1 BSD-3-Clause No Details →
v0.0.0-20180321163825-92b749d9bb99 21 Mar 2018 U1 BSD-3-Clause No Details →
v0.0.0-20180312184512-7910f5bb5ac8 12 Mar 2018 U1 BSD-3-Clause No Details →
v0.0.0-20180220201045-7087b4d669d1 20 Feb 2018 U1 BSD-3-Clause No Details →
v0.0.0-20180209192218-6ba88b7f1c1e 09 Feb 2018 U1 BSD-3-Clause No Details →
v0.0.0-20180206202236-41ee504a3bfe 06 Feb 2018 U1 BSD-3-Clause No Details →
v0.0.0-20180115173807-fe21b6a095cd 15 Jan 2018 U1 BSD-3-Clause No Details →
v0.0.0-20171008214740-a3acf13e802c 08 Oct 2017 U1 BSD-3-Clause No Details →
v0.0.0-20170802141718-b61c93cb7f67 02 Aug 2017 U1 BSD-3-Clause No Details →
v0.0.0-20170429192241-8b6b4cd75f07 29 Apr 2017 U1 BSD-3-Clause No Details →
v0.0.0-20170307003530-ba78acc856fe 07 Mar 2017 U1 BSD-3-Clause No Details →
v0.0.0-20170224193918-803ac3201723 24 Feb 2017 U1 BSD-3-Clause No Details →
v0.0.0-20170220203920-697f2d505ac4 20 Feb 2017 U1 BSD-3-Clause No Details →
v0.0.0-20161222013342-83c8db3bdc9b 22 Dec 2016 U1 BSD-3-Clause No Details →
v0.0.0-20161128192017-52389059572b 28 Nov 2016 U1 BSD-3-Clause No Details →
v0.0.0-20160922145804-ca9ada445741 22 Sep 2016 U1 BSD-3-Clause No Details →
v0.0.0-20160917172227-57a8d1b54239 17 Sep 2016 U1 BSD-3-Clause No Details →
v0.0.0-20160901061854-7ab2742f1e37 01 Sep 2016 U1 BSD-3-Clause No Details →
v0.0.0-20160826131312-478cbfc73df0 26 Aug 2016 U1 BSD-3-Clause No Details →
v0.0.0-20160816185042-1bbba13ba476 16 Aug 2016 U1 BSD-3-Clause No Details →
v0.0.0-20160604165408-56ba4b0a11da 04 Jun 2016 U1 BSD-3-Clause No Details →
v0.0.0-20160518151758-a4e6dd28f9e9 18 May 2016 U1 BSD-3-Clause No Details →
v0.0.0-20160410161533-a1216e0aed83 10 Apr 2016 U1 BSD-3-Clause No Details →
v0.0.0-20160226215529-8cd570d8b4ed 26 Feb 2016 U1 BSD-3-Clause No Details →
v0.0.0-20160226213433-08065b2c8868 26 Feb 2016 U1 BSD-3-Clause No Details →
v0.0.0-20160226200909-c7070b76d685 26 Feb 2016 U1 BSD-3-Clause No Details →
v0.0.0-20160122031550-715060ac0b7d 22 Jan 2016 U1 BSD-3-Clause No Details →
v0.0.0-20160122014412-5c34ad53e536 22 Jan 2016 U1 BSD-3-Clause No Details →
v0.0.0-20160107002043-3752dbe3d898 07 Jan 2016 U1 BSD-3-Clause No Details →
v0.0.0-20160106232849-59224c658b34 06 Jan 2016 U1 BSD-3-Clause No Details →
v0.0.0-20151223000050-99b16d2edd22 23 Dec 2015 U1 BSD-3-Clause No Details →
v0.0.0-20151002135952-f7261893ca3e 02 Oct 2015 U1 — No Details →
v0.0.0-20151002134135-28bc6170a1cd 02 Oct 2015 U1 — No Details →
v0.0.0-20150820051745-b6bcae186ac3 20 Aug 2015 U1 — No Details →
v0.0.0-20150811133023-f2f9681165de 11 Aug 2015 U1 — No Details →
v0.0.0-20150811120513-ab250e0cde98 11 Aug 2015 U1 — No Details →
v0.0.0-20150810042115-132cb5b0eebe 10 Aug 2015 U1 — No Details →
v0.0.0-20150808120439-67c3cbe3ac0f 08 Aug 2015 U1 — No Details →
v0.0.0-20150806073625-286213d1c4d3 06 Aug 2015 U1 — No Details →
v0.0.0-20150417174705-f61c3ec2cf65 17 Apr 2015 U1 — No Details →
v0.0.0-20150417140249-93a532e5acf5 17 Apr 2015 U1 — No Details →
v0.0.0-20150410173612-cc7771daaa26 10 Apr 2015 U1 — No Details →
v0.0.0-20150410074437-14656fba266a 10 Apr 2015 U1 — No Details →
v0.0.0-20150401172239-3e759b5c5532 01 Apr 2015 U1 — No Details →
v0.0.0-20150326000844-c8fb5963af5f 26 Mar 2015 U1 — No Details →
v0.0.0-20150325213541-4b0af472301b 25 Mar 2015 U1 — No Details →
v0.0.0-20150302082127-1f45645972a0 02 Mar 2015 U1 — No Details →
v0.0.0-20150301040019-2afdef550c7e 01 Mar 2015 U1 — No Details →
v0.0.0-20150223155235-39dd83d692d0 23 Feb 2015 U1 — No Details →
v0.0.0-20150211173720-0f44a2739111 11 Feb 2015 U1 — No Details →
v0.0.0-20150129183026-13c86220d944 29 Jan 2015 U1 — No Details →

The newest 120 of 149 versions Vulert tracks. Severity counts are the vulnerabilities recorded against that exact release.

02 Disclosure history

How often vulnerabilities are recorded

  • 2024 1

Counted by the year Vulert recorded each vulnerability — the same date the table below shows as disclosed. 0 of the 1 were recorded in the last 12 months.

03 Vulnerabilities

Recorded vulnerabilities for github.com/gorilla/sessions

The 1 most severe of 1 vulnerabilities recorded for this package

Search all 1 in the database →
Vulnerability Severity Fixed version ↓ Disclosed ↓
Directory Traversal Vulnerability in github.com/gorilla/sessions N/A unrated No fix published 17 Apr 2024

Vulnerability wrong, a fix missing, or a package we should cover? Report it and we will fix the record. Report Vulnerability Provide Feedback

Updated: 23/Oct/2026 · Vulnerabilities in our DB: 524315

Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

About github.com/gorilla/sessions

Is github.com/gorilla/sessions safe to use?

Vulert records 1 vulnerabilities for github.com/gorilla/sessions in Go: 0 critical, 0 high, 0 medium and 0 low, plus 1 not yet rated. 1 of them has no published fix yet, so that is the one to avoid or mitigate.

What is github.com/gorilla/sessions's Vulert package health score?

Vulert scores github.com/gorilla/sessions 60/100, which reads as usable, but worth attention. The score weighs the vulnerability record (40), maintenance and release cadence (25), adoption from dependents and stars (20) and community signals such as the OpenSSF scorecard and forks (15). The current release has a vulnerability with no published fix, which caps this score.

Is the latest version of github.com/gorilla/sessions affected?

Yes. v1.4.0, the version you would install today, has 1 known vulnerability, and 1 has no published fix yet. Use an earlier unaffected release, or the workaround each vulnerability lists.

Which version of github.com/gorilla/sessions should I use?

v1.4.0 is the version Vulert recommends for the affected releases. The version table above lists every release with the vulnerabilities recorded against it, so you can confirm the range you actually run.

How many vulnerabilities does github.com/gorilla/sessions have?

1 vulnerability is recorded for github.com/gorilla/sessions in the Go ecosystem: 0 critical, 0 high, 0 medium and 0 low, plus 1 not yet rated. The ledger on this page lists the same counts next to the date of the most recent disclosure.

How often are new github.com/gorilla/sessions vulnerabilities disclosed?

0 vulnerabilities were recorded for github.com/gorilla/sessions in the last 12 months, and the oldest entry in this database dates to 17 Apr 2024. Recency matters more than a lifetime total: it shows how actively new issues are being disclosed for the package you are considering.

Which versions of github.com/gorilla/sessions are affected?

Each vulnerability on this page lists the affected version range and the fixed version to move to. Open the vulnerability for the version you actually run — fixes are specific to a release line, not to the package as a whole.

How do I monitor github.com/gorilla/sessions for upcoming vulnerabilities?

Upload the manifest or SBOM for your application at vulert.com/scanner and Vulert keeps checking the github.com/gorilla/sessions version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.