Vulnerability Database · Go · Package report
github.com/hashicorp/hcl/v2: vulnerability history, versions and safety
github.com/hashicorp/hcl/v2 is a package in the Go ecosystem. Vulert holds no vulnerabilities for it yet.
Nothing recorded for this package in the Go ecosystem.
Every vulnerability has a patched version to move to.
No published version shipped hostile code.
Vulert verdict on github.com/hashicorp/hcl/v2 v2.25.0 i
Updated on 23 Oct 2026
Good news: v2.25.0, the version you would install today, has no known vulnerabilities.
- Security No known security issues
- Maintenance Sustainable
- Popularity Key ecosystem project
- Community Moderate
What to do: Stay on v2.25.0 or newer. This can change: a vulnerability disclosed tomorrow can affect v2.25.0 too — Vulert watches the package and alerts you if that happens. Monitor it with Vulert →
- Current release v2.25.0 — unaffected i
- Vulnerabilities on record 0 i
- Highest CVSS n/a i
- With no published fix 0 i
- Stars 5,822 i
- OpenSSF scorecard 6/10 i
- Last release 1 month ago i
- Licence MPL-2.0 i
Version list, release dates, licence and dependants published by the Go module proxy, refreshed 23 Oct 2026. Licence information is not legal advice.
Concerned about your application's security?
Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.
01 Versions
Which versions are affected
Every version Vulert tracks for github.com/hashicorp/hcl/v2, newest first, with the vulnerabilities recorded against each one. A version showing none has no vulnerability in the Vulert database — open it for the full picture on that release.
- v2.25.1-0.20261019171636-4a347c448ee9 19 Oct 2026
- v2.25.1-0.20261014204556-8b26c6768c67 14 Oct 2026
- v2.25.1-0.20261014123505-8ea3801be7bd 14 Oct 2026
- v2.25.1-0.20261013205928-d3e7bdf00f45 13 Oct 2026
- v2.25.1-0.20261007134741-a786e4fc5566 07 Oct 2026
- v2.25.1-0.20261006094841-966bba9a2ff6 06 Oct 2026
- v2.25.1-0.20260930133426-4c317722d982 30 Sep 2026
- v2.25.1-0.20260925171909-0484d1b316f3 25 Sep 2026
- v2.25.1-0.20260925164628-29a6d1cab283 25 Sep 2026
- v2.25.1-0.20260925164540-53a45a0402e8 25 Sep 2026
- v2.25.1-0.20260925163541-b68a446317f7 25 Sep 2026
- v2.25.1-0.20260925162741-ae1fe30aae53 25 Sep 2026
- v2.25.1-0.20260917140546-4932c1452af6 17 Sep 2026
- v2.0.0-20260915105824-00057cf06d7b 15 Sep 2026
- v2.25.0 15 Sep 2026
- v2.24.1-0.20260827155656-6abbb088cdb8 27 Aug 2026
- v2.24.1-0.20260825213129-2a3b67226841 25 Aug 2026
- v2.24.1-0.20260813234935-5e749351e017 13 Aug 2026
- v2.0.0-20260805121628-6bf1a67a9381 05 Aug 2026
- v2.24.1-0.20260805121628-6bf1a67a9381 05 Aug 2026
- v2.24.1-0.20260725015055-c0998c64456b 25 Jul 2026
- v2.24.1-0.20260720125636-bb9f9cfcd5d1 20 Jul 2026
- v2.24.1-0.20260720041955-4b7cb3313430 20 Jul 2026
- v2.24.1-0.20260720040731-f41574a0018d 20 Jul 2026
- v2.24.1-0.20260719112015-a73f11ff6d5a 19 Jul 2026
- v2.24.1-0.20260719001042-6b6956453407 19 Jul 2026
- v2.24.1-0.20260717021310-51dd32d2231e 17 Jul 2026
- v2.24.1-0.20260715170623-e8be18cc5f64 15 Jul 2026
- v2.24.1-0.20260701192813-8dcfcbecb878 01 Jul 2026
- v2.24.1-0.20260630094124-b0d33301ebb2 30 Jun 2026
- v2.24.1-0.20260627033732-e0fca26ca227 27 Jun 2026
- v2.24.1-0.20260625035954-8934b011b483 25 Jun 2026
- v2.24.1-0.20260625035724-1ebccaeaf22d 25 Jun 2026
- v2.24.1-0.20260618112856-178374d17527 18 Jun 2026
- v2.24.1-0.20260618030758-3d0eee98b001 18 Jun 2026
- v2.24.1-0.20260617182224-b0c778ce79c7 17 Jun 2026
- v2.24.1-0.20260616020810-a668326f4e65 16 Jun 2026
- v2.24.1-0.20260615202735-dc2531680e9f 15 Jun 2026
- v2.20.2-0.20260514123321-9466647a1845 14 May 2026
- v2.24.1-0.20260514123321-9466647a1845 14 May 2026
- v2.24.1-0.20260513195432-ab1acc486c3f 13 May 2026
- v2.24.1-0.20260508160613-3b0a5a25aa77 08 May 2026
- v2.24.1-0.20260331151359-2efc2662361a 31 Mar 2026
- v2.24.1-0.20260327001625-d4195a120f30 27 Mar 2026
- v2.24.1-0.20260302102602-63950438f246 02 Mar 2026
- v2.24.1-0.20260223145215-bd45ab812938 23 Feb 2026
- v2.24.1-0.20260216120737-64b2b6e31c20 16 Feb 2026
- v2.20.2-0.20260105105717-159eddcf987d 05 Jan 2026
- v2.24.1-0.20260105105717-159eddcf987d 05 Jan 2026
- v2.24.1-0.20251215073000-92f12c4e51a0 15 Dec 2025
- v2.24.1-0.20251206195855-0268c1604970 06 Dec 2025
- v2.24.1-0.20251121154017-f26ec7f0fccd 21 Nov 2025
- v2.24.1-0.20251002145941-758176390f22 02 Oct 2025
- v2.24.1-0.20250903041640-a1a1bafd1d2c 03 Sep 2025
- v2.24.0 07 Jul 2025
- v2.23.1-0.20250701113416-dfa124f3c93f 01 Jul 2025
- v2.23.1-0.20250603094700-6b5c4c2bac71 03 Jun 2025
- v2.23.1-0.20250602114041-61bd79dedd73 02 Jun 2025
- v2.23.1-0.20250602054719-8b8cb9c9fa85 02 Jun 2025
- v2.23.1-0.20250527124128-72443636fe97 27 May 2025
- v2.23.1-0.20250526131206-b4e27ae471da 26 May 2025
- v2.23.1-0.20250523062643-314d2366eadc 23 May 2025
- v2.23.1-0.20250522095014-d72dcd25124c 22 May 2025
- v2.23.1-0.20250401095056-b4e1e146a0c3 01 Apr 2025
- v2.23.1-0.20250401063405-b2e5121ba4d2 01 Apr 2025
- v2.23.1-0.20250401060453-6480c18b3fff 01 Apr 2025
- v2.23.1-0.20250324055707-2bade9f7c9ef 24 Mar 2025
- v2.23.1-0.20250321051937-c829697d298c 21 Mar 2025
- v2.0.0-20250211201033-5c140ce1cb20 11 Feb 2025
- v2.23.1-0.20250211201033-5c140ce1cb20 11 Feb 2025
- v2.23.1-0.20250206021604-1ad7abd1d136 06 Feb 2025
- v2.23.1-0.20250203194505-ba0759438da2 03 Feb 2025
- v2.23.1-0.20250130121340-72f3d78f4ada 30 Jan 2025
- v2.23.1-0.20250130075816-371e8c7d5566 30 Jan 2025
- v2.23.1-0.20250117140413-da7ca9a43345 17 Jan 2025
- v2.23.1-0.20241223051751-923b06b5d6ad 23 Dec 2024
- v2.23.1-0.20241217000842-d69d8de449e3 17 Dec 2024
- v2.23.1-0.20241216223545-fe177269ab5a 16 Dec 2024
- v2.23.1-0.20241216213913-03baea4b8683 16 Dec 2024
- v2.23.1-0.20241205152351-419265804ccd 05 Dec 2024
- v2.23.1-0.20241119122020-bee2dc2e75f7 19 Nov 2024
- v2.23.1-0.20241119110423-a369057682f1 19 Nov 2024
- v2.22.1-0.20241115162501-56a9aee5207d 15 Nov 2024
- v2.23.0 15 Nov 2024
- v2.22.1-0.20241021064905-d20d07fa7370 21 Oct 2024
- v2.22.1-0.20241008174059-3883feb0e064 08 Oct 2024
- v2.22.1-0.20241001155952-2eb163fdee4d 01 Oct 2024
- v2.22.1-0.20240924195505-78fe99307e88 24 Sep 2024
- v2.21.1-0.20240826124332-2442aca4bd49 26 Aug 2024
- v2.22.1-0.20240826124332-2442aca4bd49 26 Aug 2024
- v2.22.0 26 Aug 2024
- v2.21.1-0.20240822091348-06aab2a40968 22 Aug 2024
- v2.21.1-0.20240821133923-117baa8bf53b 21 Aug 2024
- v2.21.0 19 Jun 2024
- v2.20.2-0.20240614134156-f7e093a382df 14 Jun 2024
- v2.20.2-0.20240523203956-6e75e170fcd4 23 May 2024
- v2.20.2-0.20240517235513-55d9c02d147d 17 May 2024
- v2.20.2-nomad-1 17 May 2024
- v2.9.2-0.20240517235513-55d9c02d147d 17 May 2024
- v2.20.2-0.20240509185035-212a40e52876 09 May 2024
- v2.20.2-0.20240508110010-bf546973d01a 08 May 2024
- v2.20.2-0.20240422122419-1c5ae8fc88a6 22 Apr 2024
- v2.20.2-0.20240408171805-5fdb81b0624a 08 Apr 2024
- v2.20.1 26 Mar 2024
- v2.20.1-0.20240326145438-303be6113391 26 Mar 2024
- v2.20.1-0.20240314192523-2a0a3f049ccf 14 Mar 2024
- v2.20.1-0.20240313152940-5160967d8e60 13 Mar 2024
- v2.20.1-0.20240312083720-53ee54e0da34 12 Mar 2024
- v2.19.2-0.20240229192112-57f8bbf184a6 29 Feb 2024
- v2.20.0 29 Feb 2024
- v2.19.2-0.20240229164207-21a05d59cd5e 29 Feb 2024
- v2.19.2-0.20240226153113-c152f81a277f 26 Feb 2024
- v2.19.2-0.20240216144606-63380ba29035 16 Feb 2024
- v2.19.2-0.20240216095817-a7f9ab5f338c 16 Feb 2024
- v2.19.2-0.20240215142832-e28daa316df6 15 Feb 2024
- v2.0.0-20240214205714-fe0951f68911 14 Feb 2024
- v2.19.2-0.20240214205714-fe0951f68911 14 Feb 2024
- v2.19.2-0.20240209134327-1e1a6b858a91 09 Feb 2024
- v2.17.1-0.20231116194221-209c5b59503a 16 Nov 2023
- v2.0.0-20231109190535-c964a71ca320 09 Nov 2023
The newest 120 of 265 versions Vulert tracks. Severity counts are the vulnerabilities recorded against that exact release.
02 Disclosure history
How often vulnerabilities are recorded
No dated vulnerabilities are recorded for this package yet.
03 Vulnerabilities
Recorded vulnerabilities for github.com/hashicorp/hcl/v2
No vulnerabilities match this view.
Vulnerability wrong, a fix missing, or a package we should cover? Report it and we will fix the record. Report Vulnerability Provide Feedback
Updated: 23/Oct/2026 · Vulnerabilities in our DB: 524315
Questions
About github.com/hashicorp/hcl/v2
Is github.com/hashicorp/hcl/v2 safe to use?
Vulert has no vulnerabilities on record for github.com/hashicorp/hcl/v2 in Go at this point. That is a good signal rather than a guarantee: new vulnerabilities are published for packages all the time, so the versions you actually run are still worth monitoring.
What is github.com/hashicorp/hcl/v2's Vulert package health score?
Vulert scores github.com/hashicorp/hcl/v2 89/100, which reads as healthy. The score weighs the vulnerability record (40), maintenance and release cadence (25), adoption from dependents and stars (20) and community signals such as the OpenSSF scorecard and forks (15).
Is the latest version of github.com/hashicorp/hcl/v2 affected?
No. v2.25.0, the version you would install today, has no vulnerabilities on record against it. Earlier releases do — the version table above lists each release with what affects it.
Which version of github.com/hashicorp/hcl/v2 should I use?
v2.25.0 is the version Vulert recommends for the affected releases. The version table above lists every release with the vulnerabilities recorded against it, so you can confirm the range you actually run.
How many vulnerabilities does github.com/hashicorp/hcl/v2 have?
0 vulnerabilities are recorded for github.com/hashicorp/hcl/v2 in the Go ecosystem: 0 critical, 0 high, 0 medium and 0 low. The ledger on this page lists the same counts next to the date of the most recent disclosure.
How often are new github.com/hashicorp/hcl/v2 vulnerabilities disclosed?
0 vulnerabilities were recorded for github.com/hashicorp/hcl/v2 in the last 12 months. Recency matters more than a lifetime total: it shows how actively new issues are being disclosed for the package you are considering.
Which versions of github.com/hashicorp/hcl/v2 are affected?
Each vulnerability on this page lists the affected version range and the fixed version to move to. Open the vulnerability for the version you actually run — fixes are specific to a release line, not to the package as a whole.
How do I monitor github.com/hashicorp/hcl/v2 for upcoming vulnerabilities?
Upload the manifest or SBOM for your application at vulert.com/scanner and Vulert keeps checking the github.com/hashicorp/hcl/v2 version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.