VulertSecurity VulertSecurity

Vulnerability Database · Go · Package report

github.com/ory/fosite: vulnerability history, versions and safety

github.com/ory/fosite is a package in the Go ecosystem. Vulert records 8 vulnerabilities for it across 120 releases, from Apr 2021 to Jul 2021. Each vulnerability names the versions it affects, the fixed version to move to, and a workaround where no fix has been published.

i
8 vulnerabilities recorded H2 M2 U4
i
0 with no fix published

Every vulnerability has a patched version to move to.

i
0 in the last 12 months

Nothing new recorded in the last year.

See the disclosure history →
i
0 malicious-package vulnerabilities

No published version shipped hostile code.

See all github.com/ory/fosite vulnerabilities

Vulert verdict on github.com/ory/fosite v0.49.0 i

Updated on 23 Oct 2026

Action needed: v0.49.0 has 7 known vulnerabilities, but every one of them has a fix. Upgrade to the version listed below and you are clear.

Package health score 74/100
  • Security Minor issues
  • Maintenance Maintaining
  • Popularity Key ecosystem project
  • Community Quiet

What to do: Upgrade to the version that resolves each vulnerability below. Fix it, then keep watch: this version is affected today, and the next one may be too — Vulert alerts you when a new vulnerability lands. Monitor it with Vulert →

  • Current release v0.49.0 — affected i
  • Vulnerabilities on record 8 over 1 year · 0 in the last year i
  • Latest disclosure 28 Jul 2021 i
  • Highest CVSS 8.1 i
  • With no published fix 0 i
  • Stars 2,627 i
  • OpenSSF scorecard 3/10 i
  • Last release 22 months ago i
  • Licence Apache-2.0 i

Version list, release dates, licence and dependants published by the Go module proxy, refreshed 23 Oct 2026. Licence information is not legal advice.

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.

01 Versions

Which versions are affected

Every version Vulert tracks for github.com/ory/fosite, newest first, with the vulnerabilities recorded against each one. A version showing none has no vulnerability in the Vulert database — open it for the full picture on that release.

i
Version Released Vulert vulnerabilities Licence Fix published Details
v0.49.1-0.20251120011336-6030cfaca9e7 20 Nov 2025 H2 M1 U4 Apache-2.0 Yes Details →
v0.49.1-0.20251027181656-4ef4b56a3a5b 27 Oct 2025 H2 M1 U4 Apache-2.0 Yes Details →
v0.49.1-0.20251026211318-c26a34c7395b 26 Oct 2025 H2 M1 U4 Apache-2.0 Yes Details →
v0.49.1-0.20251022201143-75fcfbedcd63 22 Oct 2025 H2 M1 U4 Apache-2.0 Yes Details →
v0.49.1-0.20250908151034-d07f8148d88b 08 Sep 2025 H2 M1 U4 Apache-2.0 Yes Details →
v0.49.1-0.20250725105656-b252c87be321 25 Jul 2025 H2 M1 U4 Apache-2.0 Yes Details →
v0.49.1-0.20250725104951-0a94ac09b778 25 Jul 2025 H2 M1 U4 Apache-2.0 Yes Details →
v0.49.1-0.20250725104832-6e1bf8a769e2 25 Jul 2025 H2 M1 U4 Apache-2.0 Yes Details →
v0.49.1-0.20250718182643-f35d70d18290 18 Jul 2025 H2 M1 U4 Apache-2.0 Yes Details →
v0.49.1-0.20250703133629-e7f939b89574 03 Jul 2025 H2 M1 U4 Apache-2.0 Yes Details →
v0.49.1-0.20250703133458-62a38ab68027 03 Jul 2025 H2 M1 U4 Apache-2.0 Yes Details →
v0.0.0-20250703093431-a5f0b09bf31c 03 Jul 2025 H2 M1 U4 Apache-2.0 Yes Details →
v0.49.1-0.20250703093431-a5f0b09bf31c 03 Jul 2025 H2 M1 U4 Apache-2.0 Yes Details →
v0.49.1-0.20250702164222-7634066d7cf0 02 Jul 2025 H2 M1 U4 Apache-2.0 Yes Details →
v0.49.1-0.20250701122924-35ebb052f3b4 01 Jul 2025 H2 M1 U4 Apache-2.0 Yes Details →
v0.49.1-0.20250701112505-24c130678c51 01 Jul 2025 H2 M1 U4 Apache-2.0 Yes Details →
v0.49.1-0.20250701092450-6a9f0d560240 01 Jul 2025 H2 M1 U4 Apache-2.0 Yes Details →
v0.49.1-0.20250701092434-258a3a7bdad6 01 Jul 2025 H2 M1 U4 Apache-2.0 Yes Details →
v0.49.1-0.20250701091301-994eddf5ba91 01 Jul 2025 H2 M1 U4 Apache-2.0 Yes Details →
v0.49.1-0.20250416230107-0bb6e2049377 16 Apr 2025 H2 M1 U4 Apache-2.0 Yes Details →
v0.49.1-0.20250414185526-38e5fbcdf147 14 Apr 2025 H2 M1 U4 Apache-2.0 Yes Details →
v0.49.1-0.20250313014259-c4a7fc21637f 13 Mar 2025 H2 M1 U4 Apache-2.0 Yes Details →
v0.49.1-0.20250312161422-8052806a6efe 12 Mar 2025 H2 M1 U4 Apache-2.0 Yes Details →
v0.49.1-0.20250203124447-75b904ddbee4 03 Feb 2025 H2 M1 U4 Apache-2.0 Yes Details →
v0.49.1-0.20250203124442-e5247ef1751f 03 Feb 2025 H2 M1 U4 Apache-2.0 Yes Details →
v0.49.1-0.20250203124437-0e5aa192dc25 03 Feb 2025 H2 M1 U4 Apache-2.0 Yes Details →
v0.49.1-0.20250203124342-2b393b6b38df 03 Feb 2025 H2 M1 U4 Apache-2.0 Yes Details →
v0.49.1-0.20250102135636-049ed1924cd0 02 Jan 2025 H2 M1 U4 Apache-2.0 Yes Details →
v0.49.1-0.20250102124013-af3992eac835 02 Jan 2025 H2 M1 U4 Apache-2.0 Yes Details →
v0.49.1-0.20250102123458-f2e501049dfa 02 Jan 2025 H2 M1 U4 Apache-2.0 Yes Details →
v0.49.1-0.20250102122136-57c58efbf4dc 02 Jan 2025 H2 M1 U4 Apache-2.0 Yes Details →
v0.49.1-0.20250102121849-398f862fabde 02 Jan 2025 H2 M1 U4 Apache-2.0 Yes Details →
v0.49.1-0.20241231104218-db59a34fd07a 31 Dec 2024 H2 M1 U4 Apache-2.0 Yes Details →
v0.49.1-0.20241231103709-420bb041767e 31 Dec 2024 H2 M1 U4 Apache-2.0 Yes Details →
v0.49.1-0.20241230224904-2985962891c6 30 Dec 2024 H2 M1 U4 Apache-2.0 Yes Details →
v0.49.1-0.20241230220607-451f66de1086 30 Dec 2024 H2 M1 U4 Apache-2.0 Yes Details →
v0.49.1-0.20241230125256-d7b87ac91c72 30 Dec 2024 H2 M1 U4 Apache-2.0 Yes Details →
v0.49.1-0.20241230112550-819c90f5b179 30 Dec 2024 H2 M1 U4 Apache-2.0 Yes Details →
v0.49.1-0.20241230112057-06587840186e 30 Dec 2024 H2 M1 U4 Apache-2.0 Yes Details →
v0.49.1-0.20241230102155-d0fec64b1d0f 30 Dec 2024 H2 M1 U4 Apache-2.0 Yes Details →
v0.49.1-0.20241230101918-b4326d6c7321 30 Dec 2024 H2 M1 U4 Apache-2.0 Yes Details →
v0.49.1-0.20241227130409-782ea3e91fe6 27 Dec 2024 H2 M1 U4 Apache-2.0 Yes Details →
v0.49.1-0.20241216095813-0e8a333bb32f 16 Dec 2024 H2 M1 U4 Apache-2.0 Yes Details →
v0.0.0-20241212132213-653c812bc40c 12 Dec 2024 H2 M1 U4 Apache-2.0 Yes Details →
v0.48.1-0.20241212132213-653c812bc40c 12 Dec 2024 H2 M1 U4 Apache-2.0 Yes Details →
v0.49.0 12 Dec 2024 H2 M1 U4 Apache-2.0 Yes Details →
v0.48.1-0.20241212132153-f3336b1618e7 12 Dec 2024 H2 M1 U4 Apache-2.0 Yes Details →
v0.48.1-0.20241212001009-8bf1ef33f6c7 12 Dec 2024 H2 M1 U4 Apache-2.0 Yes Details →
v0.48.1-0.20241211085529-57cf545ec1a2 11 Dec 2024 H2 M1 U4 Apache-2.0 Yes Details →
v0.48.1-0.20241204214045-6c4e8fd3cd65 04 Dec 2024 H2 M1 U4 Apache-2.0 Yes Details →
v0.48.1-0.20241204153806-6c26dc54eb64 04 Dec 2024 H2 M1 U4 Apache-2.0 Yes Details →
v0.48.1-0.20241204100720-b57570a26c3e 04 Dec 2024 H2 M1 U4 Apache-2.0 Yes Details →
v0.48.1-0.20241204093315-117effbb7b90 04 Dec 2024 H2 M1 U4 Apache-2.0 Yes Details →
v0.48.1-0.20241204090605-9a18e70abd40 04 Dec 2024 H2 M1 U4 Apache-2.0 Yes Details →
v0.47.1-0.20241203211830-4cc28f4867e8 03 Dec 2024 H2 M1 U4 Apache-2.0 Yes Details →
v0.47.1-0.20241202193036-838a43df8317 02 Dec 2024 H2 M1 U4 Apache-2.0 Yes Details →
v0.47.1-0.20241201174130-155559029522 01 Dec 2024 H2 M1 U4 Apache-2.0 Yes Details →
v0.47.1-0.20241129083851-1c338f2f3bc6 29 Nov 2024 H2 M1 U4 Apache-2.0 Yes Details →
v0.0.0-20241128121544-db74aa7abd9f 28 Nov 2024 H2 M1 U4 Apache-2.0 Yes Details →
v0.47.1-0.20241128121544-db74aa7abd9f 28 Nov 2024 H2 M1 U4 Apache-2.0 Yes Details →
v0.48.0 28 Nov 2024 H2 M1 U4 Apache-2.0 Yes Details →
v0.47.1-0.20241128105413-b8df52f58bd2 28 Nov 2024 H2 M1 U4 Apache-2.0 Yes Details →
v0.47.1-0.20241125094724-b6468e644902 25 Nov 2024 H2 M1 U4 Apache-2.0 Yes Details →
v0.47.1-0.20241125094312-cdfe68038a1d 25 Nov 2024 H2 M1 U4 Apache-2.0 Yes Details →
v0.47.1-0.20241104161457-6335f90b7d2c 04 Nov 2024 H2 M1 U4 Apache-2.0 Yes Details →
v0.47.1-0.20241104154849-22d9c378dd50 04 Nov 2024 H2 M1 U4 Apache-2.0 Yes Details →
v0.47.1-0.20241104152244-625707a7a418 04 Nov 2024 H2 M1 U4 Apache-2.0 Yes Details →
v0.47.1-0.20241104095633-f34ee269e9ef 04 Nov 2024 H2 M1 U4 Apache-2.0 Yes Details →
v0.47.1-0.20241101171653-b653f78f00e5 01 Nov 2024 H2 M1 U4 Apache-2.0 Yes Details →
v0.47.1-0.20241101073333-eab241e153a4 01 Nov 2024 H2 M1 U4 Apache-2.0 Yes Details →
v0.47.1-0.20241101072905-50611a5fb261 01 Nov 2024 H2 M1 U4 Apache-2.0 Yes Details →
v0.47.1-0.20241030092116-b40b1cbb1997 30 Oct 2024 H2 M1 U4 Apache-2.0 Yes Details →
v0.47.1-0.20241029134014-168636ff33c7 29 Oct 2024 H2 M1 U4 Apache-2.0 Yes Details →
v0.47.1-0.20241029112424-62f07ce22e57 29 Oct 2024 H2 M1 U4 Apache-2.0 Yes Details →
v0.47.1-0.20241029112237-e776a3f7de75 29 Oct 2024 H2 M1 U4 Apache-2.0 Yes Details →
v0.47.1-0.20241029110627-04c14cdb4bba 29 Oct 2024 H2 M1 U4 Apache-2.0 Yes Details →
v0.47.1-0.20241029110151-7f6e7908e349 29 Oct 2024 H2 M1 U4 Apache-2.0 Yes Details →
v0.47.1-0.20241028135452-199f8ab66014 28 Oct 2024 H2 M1 U4 Apache-2.0 Yes Details →
v0.47.1-0.20241028132122-b35b62fed16e 28 Oct 2024 H2 M1 U4 Apache-2.0 Yes Details →
v0.47.1-0.20241021100128-939bdbfc01a7 21 Oct 2024 H2 M1 U4 Apache-2.0 Yes Details →
v0.47.1-0.20241014122543-c896ec5b35d2 14 Oct 2024 H2 M1 U4 Apache-2.0 Yes Details →
v0.47.1-0.20240916111829-869a37ce486c 16 Sep 2024 H2 M1 U4 Apache-2.0 Yes Details →
v0.47.1-0.20240916111824-11cc70218070 16 Sep 2024 H2 M1 U4 Apache-2.0 Yes Details →
v0.47.1-0.20240916111755-aa7c79e2d3e8 16 Sep 2024 H2 M1 U4 Apache-2.0 Yes Details →
v0.47.1-0.20240827101524-8631deb35b30 27 Aug 2024 H2 M1 U4 Apache-2.0 Yes Details →
v0.47.1-0.20240827101444-b88142c4e09c 27 Aug 2024 H2 M1 U4 Apache-2.0 Yes Details →
v0.47.1-0.20240827094152-482c77b73877 27 Aug 2024 H2 M1 U4 Apache-2.0 Yes Details →
v0.47.1-0.20240827093515-da74f51ad0f1 27 Aug 2024 H2 M1 U4 Apache-2.0 Yes Details →
v0.47.1-0.20240822130008-abe824a9e906 22 Aug 2024 H2 M1 U4 Apache-2.0 Yes Details →
v0.47.1-0.20240822072453-15d55bfb0bfc 22 Aug 2024 H2 M1 U4 Apache-2.0 Yes Details →
v0.46.2-0.20240716082743-3ec8db807b5e 16 Jul 2024 H2 M1 U4 Apache-2.0 Yes Details →
v0.47.0 16 Jul 2024 H2 M1 U4 Apache-2.0 Yes Details →
v0.46.2-0.20240715142127-eb3eeeda87c1 15 Jul 2024 H2 M1 U4 Apache-2.0 Yes Details →
v0.46.2-0.20240715141946-7c454207858e 15 Jul 2024 H2 M1 U4 Apache-2.0 Yes Details →
v0.46.2-0.20240711104656-010f694505e7 11 Jul 2024 H2 M1 U4 Apache-2.0 Yes Details →
v0.46.2-0.20240710131930-27de382c1e51 10 Jul 2024 H2 M1 U4 Apache-2.0 Yes Details →
v0.46.2-0.20240710092018-7ece6b0783d5 10 Jul 2024 H2 M1 U4 Apache-2.0 Yes Details →
v0.46.2-0.20240709132642-e00e96d20589 09 Jul 2024 H2 M1 U4 Apache-2.0 Yes Details →
v0.46.2-0.20240709103151-576230ace1a2 09 Jul 2024 H2 M1 U4 Apache-2.0 Yes Details →
v0.46.2-0.20240709103141-886248bbfbb5 09 Jul 2024 H2 M1 U4 Apache-2.0 Yes Details →
v0.46.1-0.20240709102702-86c8ea516dc3 09 Jul 2024 H2 M1 U4 — Yes Details →
v0.46.2-0.20240709095428-57895bcf1bb1 09 Jul 2024 H2 M1 U4 — Yes Details →
v0.46.2-0.20240709095334-8b7a4703b7d6 09 Jul 2024 H2 M1 U4 — Yes Details →
v0.46.2-0.20240709095314-7f362db216d6 09 Jul 2024 H2 M1 U4 — Yes Details →
v0.46.2-0.20240709095242-b46b256bd514 09 Jul 2024 H2 M1 U4 — Yes Details →
v0.46.2-0.20240709095053-3232d13b7bc0 09 Jul 2024 H2 M1 U4 — Yes Details →
v0.46.2-0.20240704110754-bdcae1b23451 04 Jul 2024 H2 M1 U4 — Yes Details →
v0.46.2-0.20240624221110-e7ca0688906a 24 Jun 2024 H2 M1 U4 — Yes Details →
v0.46.2-0.20240622073819-389fb8b018a0 22 Jun 2024 H2 M1 U4 — Yes Details →
v0.46.2-0.20240522073333-1e7c582e74e4 22 May 2024 H2 M1 U4 — Yes Details →
v0.46.2-0.20240507120550-b03cc94f78e1 07 May 2024 H2 M1 U4 — Yes Details →
v0.46.2-0.20240507120051-8f9df122cfbd 07 May 2024 H2 M1 U4 — Yes Details →
v0.46.2-0.20240507120035-715f5419afd4 07 May 2024 H2 M1 U4 — Yes Details →
v0.46.2-0.20240507114917-199f98cee1bc 07 May 2024 H2 M1 U4 — Yes Details →
v0.46.2-0.20240507114820-bd25aed4a27d 07 May 2024 H2 M1 U4 — Yes Details →
v0.46.2-0.20240419115445-c3589d5cf61f 19 Apr 2024 H2 M1 U4 — Yes Details →
v0.46.2-0.20240403135905-5e039ca9eef1 03 Apr 2024 H2 M1 U4 — Yes Details →
v0.46.2-0.20240403135848-743edee90541 03 Apr 2024 H2 M1 U4 — Yes Details →
v0.46.2-0.20240403095234-624afdb3887d 03 Apr 2024 H2 M1 U4 — Yes Details →
v0.46.2-0.20240403095026-6e3f5b63142a 03 Apr 2024 H2 M1 U4 — Yes Details →

The newest 120 of 1,103 versions Vulert tracks. Severity counts are the vulnerabilities recorded against that exact release.

02 Disclosure history

How often vulnerabilities are recorded

  • 2021 8

Counted by the year Vulert recorded each vulnerability — the same date the table below shows as disclosed. 0 of the 8 were recorded in the last 12 months.

03 Vulnerabilities

Recorded vulnerabilities for github.com/ory/fosite

The 5 most severe of 8 vulnerabilities recorded for this package

Search all 8 in the database →
Vulnerability Severity Fixed version ↓ Disclosed ↓
CVE-2020-15222: Token reuse in Ory fosite 8.1 high 0.31.0 24 May 2021
CVE-2020-15223: Improper Handling of Exceptional Conditions in Ory Fosite 8.0 high 0.34.0 24 May 2021
CVE-2020-15234: Redirect URL matching ignores character casing in github.com/ory/fosite 6.1 medium 0.34.1 24 May 2021
CVE-2020-15233: OAuth2 Redirect URL validity does not respect query parameters and character casing for loopback addresses in github.com/ory/fosite 5.5 medium 0.34.1 24 May 2021
CVE-2020-15223: Improper Handling of Exceptional Conditions in Ory Fosite N/A unrated 0.34.0 28 Jul 2021

Vulnerability wrong, a fix missing, or a package we should cover? Report it and we will fix the record. Report Vulnerability Provide Feedback

Updated: 23/Oct/2026 · Vulnerabilities in our DB: 524315

Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

About github.com/ory/fosite

Is github.com/ory/fosite safe to use?

Vulert records 8 vulnerabilities for github.com/ory/fosite in Go: 0 critical, 2 high, 2 medium and 0 low, plus 4 not yet rated. Every one of them has a published fix, so the practical answer is to run a supported release and keep it patched.

What is github.com/ory/fosite's Vulert package health score?

Vulert scores github.com/ory/fosite 74/100, which reads as in good shape. The score weighs the vulnerability record (40), maintenance and release cadence (25), adoption from dependents and stars (20) and community signals such as the OpenSSF scorecard and forks (15).

Is the latest version of github.com/ory/fosite affected?

Yes. v0.49.0, the version you would install today, has 7 known vulnerabilities, and every one of them has a published fix. Upgrade to the version listed for each.

Which version of github.com/ory/fosite should I use?

v0.49.0 is the version Vulert recommends for the affected releases. The version table above lists every release with the vulnerabilities recorded against it, so you can confirm the range you actually run.

How many vulnerabilities does github.com/ory/fosite have?

8 vulnerabilities are recorded for github.com/ory/fosite in the Go ecosystem: 0 critical, 2 high, 2 medium and 0 low, plus 4 not yet rated. The ledger on this page lists the same counts next to the date of the most recent disclosure.

How often are new github.com/ory/fosite vulnerabilities disclosed?

0 vulnerabilities were recorded for github.com/ory/fosite in the last 12 months, and the oldest entry in this database dates to 14 Apr 2021. Recency matters more than a lifetime total: it shows how actively new issues are being disclosed for the package you are considering.

Which versions of github.com/ory/fosite are affected?

Each vulnerability on this page lists the affected version range and the fixed version to move to. Open the vulnerability for the version you actually run — fixes are specific to a release line, not to the package as a whole.

How do I monitor github.com/ory/fosite for upcoming vulnerabilities?

Upload the manifest or SBOM for your application at vulert.com/scanner and Vulert keeps checking the github.com/ory/fosite version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.