VulertSecurity VulertSecurity

Vulnerability Database · Go · Package report

github.com/spiffe/spire: vulnerability history, versions and safety

github.com/spiffe/spire is a package in the Go ecosystem. Vulert records 2 vulnerabilities for it across 120 releases, from May 2021 to Jan 2022. Each vulnerability names the versions it affects, the fixed version to move to, and a workaround where no fix has been published.

i
2 vulnerabilities recorded H2
i
0 with no fix published

Every vulnerability has a patched version to move to.

i
0 in the last 12 months

Nothing new recorded in the last year.

See the disclosure history →
i
0 malicious-package vulnerabilities

No published version shipped hostile code.

See all github.com/spiffe/spire vulnerabilities

Vulert verdict on github.com/spiffe/spire v1.15.5 i

Updated on 23 Oct 2026

Action needed: v1.15.5 has 1 known vulnerability, but every one of them has a fix. Upgrade to the version listed below and you are clear.

Package health score 88/100
  • Security Minor issues
  • Maintenance Sustainable
  • Popularity Key ecosystem project
  • Community Active

What to do: Upgrade to the version that resolves each vulnerability below. Fix it, then keep watch: this version is affected today, and the next one may be too — Vulert alerts you when a new vulnerability lands. Monitor it with Vulert →

  • Current release v1.15.5 — affected i
  • Vulnerabilities on record 2 over 1 year · 0 in the last year i
  • Latest disclosure 12 Jan 2022 i
  • Highest CVSS 8.1 i
  • With no published fix 0 i
  • Stars 2,584 i
  • OpenSSF scorecard 7/10 i
  • Last release this month i
  • Licence Apache-2.0 i

Version list, release dates, licence and dependants published by the Go module proxy, refreshed 23 Oct 2026. Licence information is not legal advice.

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.

01 Versions

Which versions are affected

Every version Vulert tracks for github.com/spiffe/spire, newest first, with the vulnerabilities recorded against each one. A version showing none has no vulnerability in the Vulert database — open it for the full picture on that release.

i
Version Released Vulert vulnerabilities Licence Fix published Details
v1.2.1-0.20261021154825-027ce1ed593f 21 Oct 2026 H1 Apache-2.0 Yes Details →
v1.2.1-0.20261020192758-c2795b6891dd 20 Oct 2026 H1 Apache-2.0 Yes Details →
v1.2.1-0.20261020185824-b7ae17367445 20 Oct 2026 H1 Apache-2.0 Yes Details →
v1.15.5 20 Oct 2026 H1 Apache-2.0 Yes Details →
v1.14.9 20 Oct 2026 H1 Apache-2.0 Yes Details →
v1.2.1-0.20261020073139-c870de60b2a4 20 Oct 2026 H1 Apache-2.0 Yes Details →
v1.2.1-0.20261017210748-59f9ccd35f58 17 Oct 2026 H1 Apache-2.0 Yes Details →
v1.15.4 15 Oct 2026 H1 Apache-2.0 Yes Details →
v1.14.8 15 Oct 2026 H1 Apache-2.0 Yes Details →
v1.2.1-0.20261015193658-12c5005d3bb0 15 Oct 2026 H1 Apache-2.0 Yes Details →
v1.2.1-0.20261011063939-6d10e93a4eef 11 Oct 2026 H1 Apache-2.0 Yes Details →
v1.2.1-0.20261002071917-eb3c6af4a51b 02 Oct 2026 H1 Apache-2.0 Yes Details →
v1.2.1-0.20260930112058-05efb5367852 30 Sep 2026 H1 Apache-2.0 Yes Details →
v1.2.1-0.20260928191341-9534a3593e97 28 Sep 2026 H1 Apache-2.0 Yes Details →
v1.2.1-0.20260922185921-559edc2859ef 22 Sep 2026 H1 Apache-2.0 Yes Details →
v1.2.1-0.20260920061040-292f9b6da6be 20 Sep 2026 H1 Apache-2.0 Yes Details →
v1.2.1-0.20260919172524-a3a1ac3d0bd4 19 Sep 2026 H1 Apache-2.0 Yes Details →
v1.2.1-0.20260918055627-6b92bbe257a0 18 Sep 2026 H1 Apache-2.0 Yes Details →
v1.2.1-0.20260917114232-53c6db8fbb61 17 Sep 2026 H1 Apache-2.0 Yes Details →
v1.2.1-0.20260915195927-5d898081fda8 15 Sep 2026 H1 Apache-2.0 Yes Details →
v1.2.1-0.20260913080802-963e8338c6b1 13 Sep 2026 H1 Apache-2.0 Yes Details →
v1.2.1-0.20260911194216-d6ff44893eb9 11 Sep 2026 H1 Apache-2.0 Yes Details →
v1.2.1-0.20260907140559-4cb0d013e72e 07 Sep 2026 H1 Apache-2.0 Yes Details →
v1.2.1-0.20260905184846-6e4ae6f51de0 05 Sep 2026 H1 Apache-2.0 Yes Details →
v1.2.1-0.20260904193136-2ea131e505c0 04 Sep 2026 H1 Apache-2.0 Yes Details →
v1.2.1-0.20260901205940-3916a4c9f107 01 Sep 2026 H1 Apache-2.0 Yes Details →
v1.2.1-0.20260829193009-9f75abeeda27 29 Aug 2026 H1 Apache-2.0 Yes Details →
v1.2.1-0.20260828092725-66f6029f508b 28 Aug 2026 H1 Apache-2.0 Yes Details →
v1.2.1-0.20260827194829-0c08c98f6a45 27 Aug 2026 H1 Apache-2.0 Yes Details →
v1.2.1-0.20260827191530-1422ceb9b42e 27 Aug 2026 H1 Apache-2.0 Yes Details →
v1.2.1-0.20260827154018-187f410332d7 27 Aug 2026 H1 Apache-2.0 Yes Details →
v1.2.1-0.20260825201242-95f9a821d9f8 25 Aug 2026 H1 Apache-2.0 Yes Details →
v1.2.1-0.20260824053534-c87399d32135 24 Aug 2026 H1 Apache-2.0 Yes Details →
v1.15.3 21 Aug 2026 H1 Apache-2.0 Yes Details →
v1.2.1-0.20260821035644-5f6b1af2e325 21 Aug 2026 H1 Apache-2.0 Yes Details →
v1.2.1-0.20260814202812-5bc0cdd4e968 14 Aug 2026 H1 Apache-2.0 Yes Details →
v1.2.1-0.20260813192151-517c2a851540 13 Aug 2026 H1 Apache-2.0 Yes Details →
v1.2.1-0.20260809075013-f9f7c8a43b10 09 Aug 2026 H1 Apache-2.0 Yes Details →
v1.2.1-0.20260809051631-6f22dd5df936 09 Aug 2026 H1 Apache-2.0 Yes Details →
v1.2.1-0.20260729194125-d6046716b257 29 Jul 2026 H1 Apache-2.0 Yes Details →
v1.2.1-0.20260729082132-0a66e2c5e8c4 29 Jul 2026 H1 Apache-2.0 Yes Details →
v1.2.1-0.20260719195305-dbe7b01e35f1 19 Jul 2026 H1 Apache-2.0 Yes Details →
v1.2.1-0.20260718195822-3b5273da24b4 18 Jul 2026 H1 Apache-2.0 Yes Details →
v1.2.1-0.20260716154751-6c257c3d15e3 16 Jul 2026 H1 Apache-2.0 Yes Details →
v0.0.0-20260709191143-e78e2eeca03a 09 Jul 2026 H1 Apache-2.0 Yes Details →
v1.15.2 09 Jul 2026 H1 Apache-2.0 Yes Details →
v1.2.1-0.20260709170841-48a672a0887a 09 Jul 2026 H1 Apache-2.0 Yes Details →
v1.2.1-0.20260623183755-f32a624131a2 23 Jun 2026 H1 Apache-2.0 Yes Details →
v0.11.1-0.20260622093152-73215a39879e 22 Jun 2026 H1 Apache-2.0 Yes Details →
v1.2.1-0.20260620184653-80acd655b3c1 20 Jun 2026 H1 Apache-2.0 Yes Details →
v1.2.1-0.20260614054332-7f3b7be45e93 14 Jun 2026 H1 Apache-2.0 Yes Details →
v1.14.7 28 May 2026 H1 Apache-2.0 Yes Details →
v1.15.1 28 May 2026 H1 Apache-2.0 Yes Details →
v1.2.1-0.20260528113136-09350ea59ca8 28 May 2026 H1 Apache-2.0 Yes Details →
v1.15.0 19 May 2026 H1 Apache-2.0 Yes Details →
v1.2.1-0.20260518130606-dcd2d6253187 18 May 2026 H1 Apache-2.0 Yes Details →
v1.2.1-0.20260515065229-33eb3a0110c0 15 May 2026 H1 Apache-2.0 Yes Details →
v1.14.6 27 Apr 2026 H1 Apache-2.0 Yes Details →
v1.13.6 27 Apr 2026 H1 Apache-2.0 Yes Details →
v1.2.1-0.20260427212056-31a0e213067c 27 Apr 2026 H1 Apache-2.0 Yes Details →
v1.2.1-0.20260424100436-7e6f00b327af 24 Apr 2026 H1 Apache-2.0 Yes Details →
v1.13.5 08 Apr 2026 H1 Apache-2.0 Yes Details →
v1.14.5 08 Apr 2026 H1 Apache-2.0 Yes Details →
v1.2.1-0.20260407185631-9a9832b847f1 07 Apr 2026 H1 Apache-2.0 Yes Details →
v1.2.1-0.20260401100016-db8dcd90a200 01 Apr 2026 H1 Apache-2.0 Yes Details →
v1.2.1-0.20260325230046-806005e5bf40 25 Mar 2026 H1 Apache-2.0 Yes Details →
v1.14.4 19 Mar 2026 H1 Apache-2.0 Yes Details →
v1.2.1-0.20260319121445-6c4539f6592d 19 Mar 2026 H1 Apache-2.0 Yes Details →
v1.14.3 18 Mar 2026 H1 Apache-2.0 Yes Details →
v1.2.1-0.20260317221742-4444c75e78c1 17 Mar 2026 H1 Apache-2.0 Yes Details →
v1.13.4 03 Mar 2026 H1 Apache-2.0 Yes Details →
v1.14.2 03 Mar 2026 H1 Apache-2.0 Yes Details →
v1.2.1-0.20260302193032-3c7a5ff1edeb 02 Mar 2026 H1 Apache-2.0 Yes Details →
v1.14.1 15 Jan 2026 H1 Apache-2.0 Yes Details →
v1.2.1-0.20260114202928-bfdb97ce8f44 14 Jan 2026 H1 Apache-2.0 Yes Details →
v0.0.0-20251229141219-8781d3789094 29 Dec 2025 H1 Apache-2.0 Yes Details →
v0.0.0-20251216194136-febdde02cffc 16 Dec 2025 H1 Apache-2.0 Yes Details →
v1.14.0 11 Dec 2025 H1 Apache-2.0 Yes Details →
v1.2.1-0.20251211201037-dbbe83adf45d 11 Dec 2025 H1 Apache-2.0 Yes Details →
v1.2.1-0.20251114215337-274548dc9e95 14 Nov 2025 H1 Apache-2.0 Yes Details →
v1.2.1-0.20251113211824-a2ce0faf5cf1 13 Nov 2025 H1 Apache-2.0 Yes Details →
v1.2.1-0.20251111152320-9e5e3ab9e453 11 Nov 2025 H1 Apache-2.0 Yes Details →
v1.2.1-0.20251111131741-4659bccf43ed 11 Nov 2025 H1 Apache-2.0 Yes Details →
v1.2.1-0.20251110194558-ff137ea3bc6e 10 Nov 2025 H1 Apache-2.0 Yes Details →
v1.2.1-0.20251108214703-53fd13ce9e45 08 Nov 2025 H1 Apache-2.0 Yes Details →
v1.2.1-0.20251108170700-801d5bf8fe01 08 Nov 2025 H1 Apache-2.0 Yes Details →
v1.2.1-0.20251101165026-dea6009c5a9d 01 Nov 2025 H1 Apache-2.0 Yes Details →
v1.2.1-0.20251029131546-691afc26fb62 29 Oct 2025 H1 Apache-2.0 Yes Details →
v1.2.1-0.20251026064419-56f0954b85db 26 Oct 2025 H1 Apache-2.0 Yes Details →
v1.2.1-0.20251025170241-e87298157fbb 25 Oct 2025 H1 Apache-2.0 Yes Details →
v1.2.1-0.20251022055738-d68279d639f6 22 Oct 2025 H1 Apache-2.0 Yes Details →
v1.13.3 21 Oct 2025 H1 Apache-2.0 Yes Details →
v1.2.1-0.20251011203438-02ed96b8e3bb 11 Oct 2025 H1 Apache-2.0 Yes Details →
v1.2.1-0.20251011095950-c60864f0bd25 11 Oct 2025 H1 Apache-2.0 Yes Details →
v1.2.1-0.20251011060620-3951789ff508 11 Oct 2025 H1 Apache-2.0 Yes Details →
v1.2.1-0.20251009064541-e904ad991fe6 09 Oct 2025 H1 Apache-2.0 Yes Details →
v1.13.2 08 Oct 2025 H1 Apache-2.0 Yes Details →
v1.12.6 08 Oct 2025 H1 Apache-2.0 Yes Details →
v1.2.1-0.20251007201335-c8f399202e16 07 Oct 2025 H1 Apache-2.0 Yes Details →
v1.2.1-0.20250926234246-f3cd19f166a7 26 Sep 2025 H1 Apache-2.0 Yes Details →
v1.2.1-0.20250925221709-d7d33bf7c48c 25 Sep 2025 H1 — Yes Details →
v1.2.1-0.20250919200213-eee93be90852 19 Sep 2025 H1 — Yes Details →
v1.13.1 18 Sep 2025 H1 — Yes Details →
v1.2.1-0.20250911183325-2a38ff929c5d 11 Sep 2025 H1 — Yes Details →
v1.2.1-0.20250903112750-3b16dd7af874 03 Sep 2025 H1 — Yes Details →
v1.2.1-0.20250902130417-eefb529d8782 02 Sep 2025 H1 — Yes Details →
v1.2.1-0.20250902054119-5a2dd73e7ca4 02 Sep 2025 H1 — Yes Details →
v1.2.1-0.20250831154221-193f33f4fd0d 31 Aug 2025 H1 — Yes Details →
v1.2.1-0.20250829223004-36b43f524bf3 29 Aug 2025 H1 — Yes Details →
v1.2.1-0.20250829051841-62bf23973fe2 29 Aug 2025 H1 — Yes Details →
v1.2.1-0.20250828063121-cd83bc40c05e 28 Aug 2025 H1 — Yes Details →
v1.2.1-0.20250826202953-456cee8c5bff 26 Aug 2025 H1 — Yes Details →
v1.2.1-0.20250825051704-75a26d568c94 25 Aug 2025 H1 — Yes Details →
v1.2.1-0.20250824062815-48d29f6bdec1 24 Aug 2025 H1 — Yes Details →
v1.2.1-0.20250821051519-e6cf9b052c11 21 Aug 2025 H1 — Yes Details →
v1.2.1-0.20250819183447-363a1074f12d 19 Aug 2025 H1 — Yes Details →
v1.12.5 18 Aug 2025 H1 — Yes Details →
v1.2.1-0.20250815184737-7f6394bd00c0 15 Aug 2025 H1 — Yes Details →
v1.13.0 15 Aug 2025 H1 — Yes Details →
v1.2.1-0.20250808202555-3e7102304c80 08 Aug 2025 H1 — Yes Details →

The newest 120 of 5,971 versions Vulert tracks. Severity counts are the vulnerabilities recorded against that exact release.

02 Disclosure history

How often vulnerabilities are recorded

  • 2021 1
  • 2022 1

Counted by the year Vulert recorded each vulnerability — the same date the table below shows as disclosed. 0 of the 2 were recorded in the last 12 months.

03 Vulnerabilities

Recorded vulnerabilities for github.com/spiffe/spire

The 2 most severe of 2 vulnerabilities recorded for this package

Search all 2 in the database →
Vulnerability Severity Fixed version ↓ Disclosed ↓
CVE-2021-27098: Legacy Node API Allows Impersonation in github.com/spiffe/spire/pkg/server/endpoints/node 8.1 high 0.8.5 21 May 2021
Unbounded Memory Usage Vulnerability in github.com/spiffe/spire N/A high 1.0.3 12 Jan 2022

Vulnerability wrong, a fix missing, or a package we should cover? Report it and we will fix the record. Report Vulnerability Provide Feedback

Updated: 23/Oct/2026 · Vulnerabilities in our DB: 524315

Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

About github.com/spiffe/spire

Is github.com/spiffe/spire safe to use?

Vulert records 2 vulnerabilities for github.com/spiffe/spire in Go: 0 critical, 2 high, 0 medium and 0 low. Every one of them has a published fix, so the practical answer is to run a supported release and keep it patched.

What is github.com/spiffe/spire's Vulert package health score?

Vulert scores github.com/spiffe/spire 88/100, which reads as healthy. The score weighs the vulnerability record (40), maintenance and release cadence (25), adoption from dependents and stars (20) and community signals such as the OpenSSF scorecard and forks (15).

Is the latest version of github.com/spiffe/spire affected?

Yes. v1.15.5, the version you would install today, has 1 known vulnerability, and every one of them has a published fix. Upgrade to the version listed for each.

How many vulnerabilities does github.com/spiffe/spire have?

2 vulnerabilities are recorded for github.com/spiffe/spire in the Go ecosystem: 0 critical, 2 high, 0 medium and 0 low. The ledger on this page lists the same counts next to the date of the most recent disclosure.

How often are new github.com/spiffe/spire vulnerabilities disclosed?

0 vulnerabilities were recorded for github.com/spiffe/spire in the last 12 months, and the oldest entry in this database dates to 21 May 2021. Recency matters more than a lifetime total: it shows how actively new issues are being disclosed for the package you are considering.

Which versions of github.com/spiffe/spire are affected?

Each vulnerability on this page lists the affected version range and the fixed version to move to. Open the vulnerability for the version you actually run — fixes are specific to a release line, not to the package as a whole.

How do I monitor github.com/spiffe/spire for upcoming vulnerabilities?

Upload the manifest or SBOM for your application at vulert.com/scanner and Vulert keeps checking the github.com/spiffe/spire version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.