VulertSecurity VulertSecurity

Vulnerability Database · Go · Package report

github.com/mcu-tools/mcuboot: vulnerability history, versions and safety

github.com/mcu-tools/mcuboot is a package in the Go ecosystem. Vulert records 1 vulnerability for it across 120 releases, first recorded in Jun 2024. Each vulnerability names the versions it affects, the fixed version to move to, and a workaround where no fix has been published.

i
1 vulnerabilities recorded U1
i
1 with no fix published

No patched version yet — these are the ones to plan around.

See the unfixed vulnerabilities →
i
0 in the last 12 months

Nothing new recorded in the last year.

See the disclosure history →
i
0 malicious-package vulnerabilities

No published version shipped hostile code.

See all github.com/mcu-tools/mcuboot vulnerabilities

Vulert verdict on github.com/mcu-tools/mcuboot v1.10.0 i

Updated on 23 Oct 2026

Careful: v1.10.0 has 1 known vulnerability, and 1 has no fix yet. Use an earlier safe version, or the workaround listed for each one.

Package health score 60/100
  • Security Minor issues
  • Maintenance Maintaining
  • Popularity Key ecosystem project
  • Community Moderate

The current release has a vulnerability with no published fix, which caps this score.

What to do: Pin an earlier, unaffected release if you can, and apply the workaround each vulnerability lists until a fix is published. No fix yet: Vulert alerts you the moment one is published. Monitor it with Vulert →

  • Current release v1.10.0 — affected i
  • Vulnerabilities on record 1 over 1 year · 0 in the last year i
  • Latest disclosure 05 Jun 2024 i
  • Highest CVSS n/a i
  • With no published fix 1 i
  • Stars 2,165 i
  • OpenSSF scorecard 5/10 i
  • Last release 42 months ago i
  • Licence Apache-2.0 i

Version list, release dates, licence and dependants published by the Go module proxy, refreshed 23 Oct 2026. Licence information is not legal advice.

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.

01 Versions

Which versions are affected

Every version Vulert tracks for github.com/mcu-tools/mcuboot, newest first, with the vulnerabilities recorded against each one. A version showing none has no vulnerability in the Vulert database — open it for the full picture on that release.

i
Version Released Vulert vulnerabilities Licence Fix published Details
v1.10.1-0.20261022101628-725d63c9d5bc 22 Oct 2026 U1 Apache-2.0 No Details →
v1.10.1-0.20260915124433-184e436f7377 15 Sep 2026 U1 Apache-2.0 No Details →
v1.10.1-0.20260903084956-2c52c9d20a92 03 Sep 2026 U1 Apache-2.0 No Details →
v1.10.1-0.20260831073557-8eeff01c61c7 31 Aug 2026 U1 Apache-2.0 No Details →
v1.10.1-0.20260813120343-b1b886eca7c9 13 Aug 2026 U1 Apache-2.0 No Details →
v1.10.1-0.20260717065400-c437bb46ab54 17 Jul 2026 U1 Apache-2.0 No Details →
v1.10.1-0.20260715063635-74f4d6417260 15 Jul 2026 U1 Apache-2.0 No Details →
v1.10.1-0.20260601061234-f48e87edd473 01 Jun 2026 U1 Apache-2.0 No Details →
v1.10.1-0.20260527070155-d204aaa3ab40 27 May 2026 U1 Apache-2.0 No Details →
v1.10.1-0.20260513145635-e36d3c8d6ca5 13 May 2026 U1 Apache-2.0 No Details →
v1.10.1-0.20260320084157-1da03aa9943f 20 Mar 2026 U1 Apache-2.0 No Details →
v1.10.1-0.20251113153532-cbdfd91a5703 13 Nov 2025 U1 Apache-2.0 No Details →
v1.10.1-0.20251105104043-76036133db1b 05 Nov 2025 U1 Apache-2.0 No Details →
v1.9.8-cypress 04 Nov 2025 U1 Apache-2.0 No Details →
v1.10.1-0.20251024092928-96576b341ee1 24 Oct 2025 U1 Apache-2.0 No Details →
v1.10.1-0.20250926145617-3c8e57177529 26 Sep 2025 U1 Apache-2.0 No Details →
v1.9.7-cypress 24 Sep 2025 U1 Apache-2.0 No Details →
v1.10.1-0.20250807123039-16cfdaf347e5 07 Aug 2025 U1 Apache-2.0 No Details →
v1.10.1-0.20250723151833-7a9f30f64729 23 Jul 2025 U1 Apache-2.0 No Details →
v1.10.1-0.20250718081151-461e060e8687 18 Jul 2025 U1 Apache-2.0 No Details →
v1.9.6-cypress 18 Jul 2025 U1 Apache-2.0 No Details →
v1.10.1-0.20250609140237-ef7d68bf47d7 09 Jun 2025 U1 Apache-2.0 No Details →
v1.10.1-0.20241216131202-f5454f163582 16 Dec 2024 U1 Apache-2.0 No Details →
v1.9.5-cypress 11 Dec 2024 U1 Apache-2.0 No Details →
v1.10.1-0.20241206102731-b778ad9e163d 06 Dec 2024 U1 Apache-2.0 No Details →
v1.10.1-0.20241205070851-5d6471bac184 05 Dec 2024 U1 Apache-2.0 No Details →
v1.10.1-0.20241203124526-7cc60059845d 03 Dec 2024 U1 Apache-2.0 No Details →
v1.10.1-0.20241127121152-742978e7b5c0 27 Nov 2024 U1 Apache-2.0 No Details →
v1.10.1-0.20241126163800-39aab3d87eed 26 Nov 2024 U1 Apache-2.0 No Details →
v1.10.1-0.20241119124253-8a2e2edba596 19 Nov 2024 U1 Apache-2.0 No Details →
v1.10.1-0.20241118104355-e43e6702507a 18 Nov 2024 U1 Apache-2.0 No Details →
v1.10.1-0.20241115125925-d59ae3465a8c 15 Nov 2024 U1 Apache-2.0 No Details →
v1.10.1-0.20241115074141-bcffc62c6666 15 Nov 2024 U1 Apache-2.0 No Details →
v1.10.1-0.20241114154128-099f42846a21 14 Nov 2024 U1 Apache-2.0 No Details →
v1.10.1-0.20241113100650-ab0144360573 13 Nov 2024 U1 Apache-2.0 No Details →
v1.10.1-0.20241112121138-bd7423d1d92a 12 Nov 2024 U1 Apache-2.0 No Details →
v1.10.1-0.20241112073946-9331c924ba69 12 Nov 2024 U1 Apache-2.0 No Details →
v1.10.1-0.20241112071232-bcde2bf447e8 12 Nov 2024 U1 Apache-2.0 No Details →
v1.10.1-0.20241111073007-a03c95f6fc4b 11 Nov 2024 U1 Apache-2.0 No Details →
v1.10.1-0.20241030075259-f74b77cf7808 30 Oct 2024 U1 Apache-2.0 No Details →
v1.10.1-0.20241025152433-439930aee115 25 Oct 2024 U1 Apache-2.0 No Details →
v1.10.1-0.20241025135145-6b2c93cec621 25 Oct 2024 U1 Apache-2.0 No Details →
v1.10.1-0.20241017095448-33de65cebaf7 17 Oct 2024 U1 Apache-2.0 No Details →
v1.10.1-0.20241014112141-b9d69dd2a2d6 14 Oct 2024 U1 Apache-2.0 No Details →
v1.10.1-0.20241014092033-08a71d101897 14 Oct 2024 U1 Apache-2.0 No Details →
v1.10.1-0.20241011141707-d69933cd4627 11 Oct 2024 U1 Apache-2.0 No Details →
v1.10.1-0.20241010173429-a5f28c133dcf 10 Oct 2024 U1 Apache-2.0 No Details →
v1.10.1-0.20240918111236-41df52e69061 18 Sep 2024 U1 Apache-2.0 No Details →
v1.10.1-0.20240917055541-756720003f02 17 Sep 2024 U1 Apache-2.0 No Details →
v1.10.1-0.20240912141548-e890df7ab975 12 Sep 2024 U1 Apache-2.0 No Details →
v1.10.1-0.20240910075759-84b56b61118a 10 Sep 2024 U1 Apache-2.0 No Details →
v1.10.1-0.20240905072905-956311d2d5e5 05 Sep 2024 U1 Apache-2.0 No Details →
v1.10.1-0.20240904094113-242db1a9301d 04 Sep 2024 U1 Apache-2.0 No Details →
v1.10.1-0.20240904061626-a3762626f817 04 Sep 2024 U1 Apache-2.0 No Details →
v1.10.1-0.20240827143427-52e2afc2f809 27 Aug 2024 U1 Apache-2.0 No Details →
v1.10.1-0.20240827115127-bf13555d13a3 27 Aug 2024 U1 Apache-2.0 No Details →
v1.10.1-0.20240821104629-6071ceb1d0d9 21 Aug 2024 U1 Apache-2.0 No Details →
v1.10.1-0.20240821092436-dc03055537f2 21 Aug 2024 U1 Apache-2.0 No Details →
v1.10.1-0.20240819134704-c87d41efc8c7 19 Aug 2024 U1 Apache-2.0 No Details →
v1.10.1-0.20240815130203-12906fdeff4d 15 Aug 2024 U1 Apache-2.0 No Details →
v1.10.1-0.20240814070954-034f58cbf1f9 14 Aug 2024 U1 Apache-2.0 No Details →
v1.10.1-0.20240813083521-148c2c1662f9 13 Aug 2024 U1 Apache-2.0 No Details →
v1.10.1-0.20240813064914-2db0654bc2b8 13 Aug 2024 U1 Apache-2.0 No Details →
v1.10.1-0.20240806170808-6fe259b1b678 06 Aug 2024 U1 Apache-2.0 No Details →
v1.10.1-0.20240802223826-7e69047b7d6b 02 Aug 2024 U1 Apache-2.0 No Details →
v1.10.1-0.20240802222312-6123e9161ffd 02 Aug 2024 U1 Apache-2.0 No Details →
v1.10.1-0.20240801132151-f763c5ffee03 01 Aug 2024 U1 Apache-2.0 No Details →
v1.9.4-cypress 31 Jul 2024 U1 Apache-2.0 No Details →
v1.10.1-0.20240710063743-fb2cf0ec3da3 10 Jul 2024 U1 Apache-2.0 No Details →
v1.10.1-0.20240709151943-c06f7bb36782 09 Jul 2024 U1 Apache-2.0 No Details →
v1.10.1-0.20240628160435-1d79ef35ee56 28 Jun 2024 U1 Apache-2.0 No Details →
v1.10.1-0.20240626225220-86acda9ed4dc 26 Jun 2024 U1 Apache-2.0 No Details →
v1.10.1-0.20240620205401-9ae634f3bfeb 20 Jun 2024 U1 Apache-2.0 No Details →
v1.9.3-cypress 12 Jun 2024 U1 Apache-2.0 No Details →
v1.10.1-0.20240524054503-45d379e715d8 24 May 2024 U1 Apache-2.0 No Details →
v1.10.1-0.20240523175945-2dcbabcb2c0b 23 May 2024 U1 Apache-2.0 No Details →
v1.10.1-0.20240523160936-29f9540db83c 23 May 2024 U1 Apache-2.0 No Details →
v1.10.1-0.20240523123917-3113df8f9fba 23 May 2024 U1 Apache-2.0 No Details →
v1.10.1-0.20240521145251-898a1ca64a75 21 May 2024 U1 Apache-2.0 No Details →
v1.10.1-0.20240513072517-018dc01d4843 13 May 2024 U1 Apache-2.0 No Details →
v1.10.1-0.20240424151854-78bfe750cde0 24 Apr 2024 U1 Apache-2.0 No Details →
v1.10.1-0.20240402203901-a65ea4951554 02 Apr 2024 U1 Apache-2.0 No Details →
v1.9.2-cypress 29 Mar 2024 U1 Apache-2.0 No Details →
v1.10.1-0.20240320074728-8dab2b975e14 20 Mar 2024 U1 Apache-2.0 No Details →
v1.10.1-0.20240314091701-5d067f0e0ca7 14 Mar 2024 U1 Apache-2.0 No Details →
v1.10.1-0.20240307093541-8b4c70ab6dc0 07 Mar 2024 U1 Apache-2.0 No Details →
v1.10.1-0.20240304184701-b794d335a490 04 Mar 2024 U1 Apache-2.0 No Details →
v1.10.1-0.20240223145140-ca02c750602f 23 Feb 2024 U1 Apache-2.0 No Details →
v1.10.1-0.20240220164512-89feb4d8e31f 20 Feb 2024 U1 Apache-2.0 No Details →
v1.10.1-0.20240220152941-6f7f87384da1 20 Feb 2024 U1 Apache-2.0 No Details →
v1.10.1-0.20240213120447-4b4cc85c67bf 13 Feb 2024 U1 Apache-2.0 No Details →
v1.10.1-0.20240207174803-06bc54846d55 07 Feb 2024 U1 Apache-2.0 No Details →
v1.10.1-0.20240131104925-79c284b0a52a 31 Jan 2024 U1 Apache-2.0 No Details →
v1.10.1-0.20240130121851-205d7e5b4194 30 Jan 2024 U1 Apache-2.0 No Details →
v1.10.1-0.20240125081649-f09e205b1e4a 25 Jan 2024 U1 Apache-2.0 No Details →
v1.10.1-0.20240110114635-c3a72e9daf8f 10 Jan 2024 U1 Apache-2.0 No Details →
v1.10.1-0.20240108153553-b994ba2ce294 08 Jan 2024 U1 Apache-2.0 No Details →
v1.10.1-0.20240102102159-8cee3550955b 02 Jan 2024 U1 Apache-2.0 No Details →
v1.10.1-0.20231214153107-12e2b6398b8a 14 Dec 2023 U1 Apache-2.0 No Details →
v1.10.1-0.20231207174845-26d6423b00fa 07 Dec 2023 U1 Apache-2.0 No Details →
v1.10.1-0.20231207104358-212997395ed3 07 Dec 2023 U1 — No Details →
v1.9.1-cypress 05 Dec 2023 U1 — No Details →
v1.10.1-0.20230929141905-4fe28b3cf6d3 29 Sep 2023 U1 — No Details →
v1.10.1-0.20230628132406-34d5a6915fd8 28 Jun 2023 U1 — No Details →
v1.9.0-cypress 22 Jun 2023 U1 — No Details →
v1.10.1-0.20230621114805-e6e4801ce2c7 21 Jun 2023 U1 — No Details →
v1.10.1-0.20230609123528-a5db5151613f 09 Jun 2023 U1 — No Details →
v1.10.1-0.20230605100442-74c4d1c52fd5 05 Jun 2023 U1 — No Details →
v1.10.1-0.20230523104703-9380135afb74 23 May 2023 U1 — No Details →
v1.8.4-cypress 23 May 2023 U1 — No Details →
v1.10.1-0.20230522064143-9ced459b09f3 22 May 2023 U1 — No Details →
v1.10.1-0.20230503064022-2878eb4e32fa 03 May 2023 U1 — No Details →
v1.10.1-0.20230406134342-a97f009d209d 06 Apr 2023 U1 — No Details →
v1.10.0 06 Apr 2023 U1 — No Details →
v1.10.0-rc1.0.20230321141012-f5e7753b9e82 21 Mar 2023 U1 — No Details →
v1.10.0-rc1 20 Mar 2023 U1 — No Details →
v1.9.1-0.20230228150610-472d4c7fed02 28 Feb 2023 U1 — No Details →
v1.9.1-0.20230222155118-c68a600403cf 22 Feb 2023 U1 — No Details →
v1.9.1-0.20230222151409-4a34b0fed1a2 22 Feb 2023 U1 — No Details →
v1.9.1-0.20230217145357-aee388aefa31 17 Feb 2023 U1 — No Details →

The newest 120 of 180 versions Vulert tracks. Severity counts are the vulnerabilities recorded against that exact release.

02 Disclosure history

How often vulnerabilities are recorded

  • 2024 1

Counted by the year Vulert recorded each vulnerability — the same date the table below shows as disclosed. 0 of the 1 were recorded in the last 12 months.

03 Vulnerabilities

Recorded vulnerabilities for github.com/mcu-tools/mcuboot

The 1 most severe of 1 vulnerabilities recorded for this package

Search all 1 in the database →
Vulnerability Severity Fixed version ↓ Disclosed ↓
CVE-2024-32883: MCUboot Injection attack of unprotected TLV values in github.com/mcu-tools/mcuboot N/A unrated No fix published 05 Jun 2024

Vulnerability wrong, a fix missing, or a package we should cover? Report it and we will fix the record. Report Vulnerability Provide Feedback

Updated: 23/Oct/2026 · Vulnerabilities in our DB: 524315

Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

About github.com/mcu-tools/mcuboot

Is github.com/mcu-tools/mcuboot safe to use?

Vulert records 1 vulnerabilities for github.com/mcu-tools/mcuboot in Go: 0 critical, 0 high, 0 medium and 0 low, plus 1 not yet rated. 1 of them has no published fix yet, so that is the one to avoid or mitigate.

What is github.com/mcu-tools/mcuboot's Vulert package health score?

Vulert scores github.com/mcu-tools/mcuboot 60/100, which reads as usable, but worth attention. The score weighs the vulnerability record (40), maintenance and release cadence (25), adoption from dependents and stars (20) and community signals such as the OpenSSF scorecard and forks (15). The current release has a vulnerability with no published fix, which caps this score.

Is the latest version of github.com/mcu-tools/mcuboot affected?

Yes. v1.10.0, the version you would install today, has 1 known vulnerability, and 1 has no published fix yet. Use an earlier unaffected release, or the workaround each vulnerability lists.

Which version of github.com/mcu-tools/mcuboot should I use?

v1.10.0 is the version Vulert recommends for the affected releases. The version table above lists every release with the vulnerabilities recorded against it, so you can confirm the range you actually run.

How many vulnerabilities does github.com/mcu-tools/mcuboot have?

1 vulnerability is recorded for github.com/mcu-tools/mcuboot in the Go ecosystem: 0 critical, 0 high, 0 medium and 0 low, plus 1 not yet rated. The ledger on this page lists the same counts next to the date of the most recent disclosure.

How often are new github.com/mcu-tools/mcuboot vulnerabilities disclosed?

0 vulnerabilities were recorded for github.com/mcu-tools/mcuboot in the last 12 months, and the oldest entry in this database dates to 05 Jun 2024. Recency matters more than a lifetime total: it shows how actively new issues are being disclosed for the package you are considering.

Which versions of github.com/mcu-tools/mcuboot are affected?

Each vulnerability on this page lists the affected version range and the fixed version to move to. Open the vulnerability for the version you actually run — fixes are specific to a release line, not to the package as a whole.

How do I monitor github.com/mcu-tools/mcuboot for upcoming vulnerabilities?

Upload the manifest or SBOM for your application at vulert.com/scanner and Vulert keeps checking the github.com/mcu-tools/mcuboot version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.