VulertSecurity VulertSecurity

Vulnerability Database · Go · Package report

github.com/weaviate/weaviate: vulnerability history, versions and safety

github.com/weaviate/weaviate is a package in the Go ecosystem. Vulert records 9 vulnerabilities for it across 120 releases, from Aug 2023 to Aug 2026. Each vulnerability names the versions it affects, the fixed version to move to, and a workaround where no fix has been published.

i
9 vulnerabilities recorded H3 M1 L1 U4
i
1 with no fix published

No patched version yet — these are the ones to plan around.

See the unfixed vulnerabilities →
i
6 in the last 12 months

Most recent disclosure 18 Aug 2026.

See the disclosure history →
i
0 malicious-package vulnerabilities

No published version shipped hostile code.

See all github.com/weaviate/weaviate vulnerabilities

Vulert verdict on github.com/weaviate/weaviate v1.40.2 i

Updated on 23 Oct 2026

Careful: v1.40.2 has 6 known vulnerabilities, and 1 has no fix yet. Use an earlier safe version, or the workaround listed for each one.

Package health score 60/100
  • Security Some issues to review
  • Maintenance Sustainable
  • Popularity Key ecosystem project
  • Community Active

The current release has a vulnerability with no published fix, which caps this score.

What to do: Pin an earlier, unaffected release if you can, and apply the workaround each vulnerability lists until a fix is published. No fix yet: Vulert alerts you the moment one is published. Monitor it with Vulert →

  • Current release v1.40.2 — affected i
  • Vulnerabilities on record 9 over 2 years · 6 in the last year i
  • Latest disclosure 18 Aug 2026 i
  • Highest CVSS 8.7 i
  • With no published fix 1 i
  • Stars 16,886 i
  • OpenSSF scorecard 7/10 i
  • Last release this month i
  • Licence BSD-3-Clause i

Version list, release dates, licence and dependants published by the Go module proxy, refreshed 23 Oct 2026. Licence information is not legal advice.

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.

01 Versions

Which versions are affected

Every version Vulert tracks for github.com/weaviate/weaviate, newest first, with the vulnerabilities recorded against each one. A version showing none has no vulnerability in the Vulert database — open it for the full picture on that release.

i
Version Released Vulert vulnerabilities Licence Fix published Details
v1.36.24 22 Oct 2026 H1 M1 L1 U3 BSD-3-Clause No Details →
v1.38.22 21 Oct 2026 H1 M1 L1 U3 BSD-3-Clause No Details →
v1.40.2 21 Oct 2026 H1 M1 L1 U3 — No Details →
v1.39.13 21 Oct 2026 H1 M1 L1 U3 — No Details →
v0.0.0-20261016082216-1baf16202f88 16 Oct 2026 H1 M1 L1 U3 — No Details →
v1.40.2-0.20261016082216-1baf16202f88 16 Oct 2026 H1 M1 L1 U3 — No Details →
v0.0.0-20261015102052-3ea41a468974 15 Oct 2026 H1 M1 L1 U3 — No Details →
v0.0.0-20261015094328-e3e014c25846 15 Oct 2026 H1 M1 L1 U3 — No Details →
v0.0.0-20261013105845-69fd5307a49b 13 Oct 2026 H1 M1 L1 U3 — No Details →
v1.40.1-0.20261013105845-69fd5307a49b 13 Oct 2026 H1 M1 L1 U3 — No Details →
v0.0.0-20261013052413-350ad1194906 13 Oct 2026 H1 M1 L1 U3 — No Details →
v0.0.0-20261012133412-a920eab8522d 12 Oct 2026 H1 M1 L1 U3 — No Details →
v1.40.1-0.20261012133412-a920eab8522d 12 Oct 2026 H1 M1 L1 U3 — No Details →
v0.0.0-20261012130853-e0c3f76b59d1 12 Oct 2026 H1 M1 L1 U3 — No Details →
v1.40.1 12 Oct 2026 H1 M1 L1 U3 — No Details →
v1.39.12 12 Oct 2026 H1 M1 L1 U3 — No Details →
v1.38.21 12 Oct 2026 H1 M1 L1 U3 BSD-3-Clause No Details →
v0.0.0-20261012092816-df58c12dcdad 12 Oct 2026 H1 M1 L1 U3 — No Details →
v0.0.0-20261012074425-33105da7c27f 12 Oct 2026 H1 M1 L1 U3 — No Details →
v0.0.0-20261012051827-98d5f50bb4e8 12 Oct 2026 H1 M1 L1 U3 — No Details →
v1.39.11 09 Oct 2026 H1 M1 L1 U3 — No Details →
v0.0.0-20261009105415-0d36ea43cbe7 09 Oct 2026 H1 M1 L1 U3 — No Details →
v0.0.0-20261008185206-240732fa6c29 08 Oct 2026 H1 M1 L1 U3 — No Details →
v0.0.0-20261007133524-519a9ba23b39 07 Oct 2026 H1 M1 L1 U3 — No Details →
v0.0.0-20261006145402-db0ac995b171 06 Oct 2026 H1 M1 L1 U3 — No Details →
v1.40.0 06 Oct 2026 H1 M1 L1 U3 — No Details →
v1.39.10 06 Oct 2026 H1 M1 L1 U3 — No Details →
v1.38.20 06 Oct 2026 H1 M1 L1 U3 BSD-3-Clause No Details →
v0.0.0-20261006121200-406c135518d1 06 Oct 2026 H1 M1 L1 U3 — No Details →
v0.0.0-20261006085201-60feabab5fbd 06 Oct 2026 H1 M1 L1 U3 — No Details →
v1.40.0-rc.2.0.20261006085201-60feabab5fbd 06 Oct 2026 H1 M1 L1 U3 — No Details →
v1.38.19 06 Oct 2026 H1 M1 L1 U3 BSD-3-Clause No Details →
v0.0.0-20261005135823-70d0d68aadd3 05 Oct 2026 H1 M1 L1 U3 — No Details →
v0.0.0-20261005132142-f3b97221cd8d 05 Oct 2026 H1 M1 L1 U3 — No Details →
v1.39.9 05 Oct 2026 H1 M1 L1 U3 — No Details →
v0.0.0-20261001111909-4d69259c3b2d 01 Oct 2026 H1 M1 L1 U3 — No Details →
v1.40.0-rc.2.0.20261001111909-4d69259c3b2d 01 Oct 2026 H1 M1 L1 U3 — No Details →
v1.39.8 01 Oct 2026 H1 M1 L1 U3 — No Details →
v1.38.18 01 Oct 2026 H1 M1 L1 U3 BSD-3-Clause No Details →
v1.40.0-rc.2 30 Sep 2026 H1 M1 L1 U3 — No Details →
v0.0.0-20260929142050-6aefed87bae8 29 Sep 2026 H1 M1 L1 U3 — No Details →
v0.0.0-20260929135552-7e252156f560 29 Sep 2026 H1 M1 L1 U3 — No Details →
v0.0.0-20260929124035-2984f1bfbcfe 29 Sep 2026 H1 M1 L1 U3 — No Details →
v0.0.0-20260929083959-fbaa4014e762 29 Sep 2026 H1 M1 L1 U3 — No Details →
v0.0.0-20260928134558-5fe18801455a 28 Sep 2026 H1 M1 L1 U3 — No Details →
v1.40.0-rc.1.0.20260928134558-5fe18801455a 28 Sep 2026 H1 M1 L1 U3 — No Details →
v0.0.0-20260928082313-5a39c0cfc136 28 Sep 2026 H1 M1 L1 U3 — No Details →
v1.39.7 25 Sep 2026 H1 M1 L1 U3 — No Details →
v0.0.0-20260924173817-e3f4df7ba89f 24 Sep 2026 H1 M1 L1 U3 — No Details →
v0.0.0-20260924121146-fef0a1c32617 24 Sep 2026 H1 M1 L1 U3 — No Details →
v1.40.0-rc.1.0.20260924121146-fef0a1c32617 24 Sep 2026 H1 M1 L1 U3 — No Details →
v0.0.0-20260923205942-e4fe80c4be6d 23 Sep 2026 H1 M1 L1 U3 — No Details →
v0.0.0-20260923191605-96860454f431 23 Sep 2026 H1 M1 L1 U3 — No Details →
v0.0.0-20260923130621-da10cfa7ed86 23 Sep 2026 H1 M1 L1 U3 — No Details →
v0.0.0-20260923122336-96028699d11c 23 Sep 2026 H1 M1 L1 U3 — No Details →
v0.0.0-20260923122111-181dce71788d 23 Sep 2026 H1 M1 L1 U3 — No Details →
v0.0.0-20260923102024-1bce044dc8bf 23 Sep 2026 H1 M1 L1 U3 — No Details →
v0.0.0-20260923091510-7ce6e6257966 23 Sep 2026 H1 M1 L1 U3 — No Details →
v0.0.0-20260922135514-7d8139051972 22 Sep 2026 H1 M1 L1 U3 — No Details →
v1.39.6 22 Sep 2026 H1 M1 L1 U3 — No Details →
v0.0.0-20260922122228-8760de4b0ade 22 Sep 2026 H1 M1 L1 U3 — No Details →
v1.38.17 22 Sep 2026 H1 M1 L1 U3 BSD-3-Clause No Details →
v0.0.0-20260922093125-a181d44d3be1 22 Sep 2026 H1 M1 L1 U3 — No Details →
v0.0.0-20260922063434-aee7b0b4b766 22 Sep 2026 H1 M1 L1 U3 — No Details →
v0.0.0-20260921113315-2eda1edd2b50 21 Sep 2026 H1 M1 L1 U3 — No Details →
v0.0.0-20260921104847-2bce7b599936 21 Sep 2026 H1 M1 L1 U3 — No Details →
v0.0.0-20260921095934-73a485ec269d 21 Sep 2026 H1 M1 L1 U3 — No Details →
v0.0.0-20260921094214-b16ce69786a6 21 Sep 2026 H1 M1 L1 U3 — No Details →
v0.0.0-20260921085253-83504668b391 21 Sep 2026 H1 M1 L1 U3 — No Details →
v0.0.0-20260921070250-2340c675a6f7 21 Sep 2026 H1 M1 L1 U3 — No Details →
v0.0.0-20260918151418-bccdb70f4cd5 18 Sep 2026 H1 M1 L1 U3 — No Details →
v1.40.0-rc.1 18 Sep 2026 H1 M1 L1 U3 — No Details →
v0.0.0-20260918113658-f4ac6efe66d3 18 Sep 2026 H1 M1 L1 U3 — No Details →
v0.0.0-20260918104833-4e3f435aaf92 18 Sep 2026 H1 M1 L1 U3 — No Details →
v1.38.16 18 Sep 2026 H1 M1 L1 U3 BSD-3-Clause No Details →
v0.0.0-20260918090933-f15d702a8f2b 18 Sep 2026 H1 M1 L1 U3 — No Details →
v0.0.0-20260918072138-6c7f546e3779 18 Sep 2026 H1 M1 L1 U3 — No Details →
v0.0.0-20260918063509-3c35d26e3161 18 Sep 2026 H1 M1 L1 U3 — No Details →
v0.0.0-20260918053752-827debeec712 18 Sep 2026 H1 M1 L1 U3 — No Details →
v0.0.0-20260917141009-dda239f35697 17 Sep 2026 H1 M1 L1 U3 — No Details →
v0.0.0-20260917135443-87e0119608d8 17 Sep 2026 H1 M1 L1 U3 — No Details →
v0.0.0-20260917125026-0e100abeed6a 17 Sep 2026 H1 M1 L1 U3 — No Details →
v0.0.0-20260917124828-29a72958b0e2 17 Sep 2026 H1 M1 L1 U3 — No Details →
v0.0.0-20260917122106-9e9f4e5c34a3 17 Sep 2026 H1 M1 L1 U3 — No Details →
v0.0.0-20260917114007-19e3da9826eb 17 Sep 2026 H1 M1 L1 U3 — No Details →
v0.0.0-20260917092034-9e7b967372a6 17 Sep 2026 H1 M1 L1 U3 — No Details →
v0.0.0-20260916150407-6e6e49eaf05b 16 Sep 2026 H1 M1 L1 U3 — No Details →
v0.0.0-20260916140717-165b2ef78264 16 Sep 2026 H1 M1 L1 U3 — No Details →
v0.0.0-20260916133818-ccde73c751aa 16 Sep 2026 H1 M1 L1 U3 — No Details →
v0.0.0-20260915193853-5cbbcf703710 15 Sep 2026 H1 M1 L1 U3 — No Details →
v1.40.0-rc.0 15 Sep 2026 H1 M1 L1 U3 — No Details →
v0.0.0-20260915170315-2ba51430bbc4 15 Sep 2026 H1 M1 L1 U3 — No Details →
v0.0.0-20260915145340-4ccd98de43eb 15 Sep 2026 H1 M1 L1 U3 — No Details →
v0.0.0-20260915113240-2e3e7076100e 15 Sep 2026 H1 M1 L1 U3 — No Details →
v0.0.0-20260915111253-17ad9d7314cc 15 Sep 2026 H1 M1 L1 U3 — No Details →
v0.0.0-20260915103618-d7b040ac1acf 15 Sep 2026 H1 M1 L1 U3 — No Details →
v1.38.16-0.20260915093746-7ecf175277a5 15 Sep 2026 H1 M1 L1 U3 BSD-3-Clause No Details →
v0.0.0-20260915091934-9d8d8d99ec4e 15 Sep 2026 H1 M1 L1 U3 — No Details →
v0.0.0-20260915072205-7e9c17f50057 15 Sep 2026 H1 M1 L1 U3 — No Details →
v0.0.0-20260915065807-be197b5ae1d2 15 Sep 2026 H1 M1 L1 U3 — No Details →
v1.39.5 15 Sep 2026 H1 M1 L1 U3 — No Details →
v0.0.0-20260915061927-98d10afb5e8b 15 Sep 2026 H1 M1 L1 U3 — No Details →
v0.0.0-20260914181339-a7af84b6a508 14 Sep 2026 H1 M1 L1 U3 — No Details →
v0.0.0-20260914113549-fb85a41514a2 14 Sep 2026 H1 M1 L1 U3 — No Details →
v1.38.15 14 Sep 2026 H1 M1 L1 U3 — No Details →
v1.37.17 14 Sep 2026 H1 M1 L1 U3 — No Details →
v1.39.4 11 Sep 2026 H1 M1 L1 U3 — No Details →
v0.0.0-20260911143443-77063adc7497 11 Sep 2026 H1 M1 L1 U3 — No Details →
v1.39.4-0.20260911143443-77063adc7497 11 Sep 2026 H1 M1 L1 U3 — No Details →
v0.0.0-20260911105314-39c972612fb3 11 Sep 2026 H1 M1 L1 U3 — No Details →
v0.0.0-20260911085502-c78433e566c9 11 Sep 2026 H1 M1 L1 U3 — No Details →
v0.0.0-20260910114322-ea6fe86ddafd 10 Sep 2026 H1 M1 L1 U3 — No Details →
v0.0.0-20260910110055-ccbf01aa1d36 10 Sep 2026 H1 M1 L1 U3 — No Details →
v0.0.0-20260910093005-4bb2a9968788 10 Sep 2026 H1 M1 L1 U3 — No Details →
v0.0.0-20260910072057-7dd65d0f4bfb 10 Sep 2026 H1 M1 L1 U3 — No Details →
v0.0.0-20260909110441-1746a77de861 09 Sep 2026 H1 M1 L1 U3 — No Details →
v0.0.0-20260908135739-0b0a00f6b794 08 Sep 2026 H1 M1 L1 U3 — No Details →
v0.0.0-20260907111330-58f9f1224096 07 Sep 2026 H1 M1 L1 U3 — No Details →
v0.0.0-20260907105158-edcaea8502f9 07 Sep 2026 H1 M1 L1 U3 — No Details →
v1.39.3 07 Sep 2026 H1 M1 L1 U3 — No Details →

The newest 120 of 1,733 versions Vulert tracks. Severity counts are the vulnerabilities recorded against that exact release.

02 Disclosure history

How often vulnerabilities are recorded

  • 2023 3
  • 2025 4
  • 2026 2

Counted by the year Vulert recorded each vulnerability — the same date the table below shows as disclosed. 6 of the 9 were recorded in the last 12 months.

03 Vulnerabilities

Recorded vulnerabilities for github.com/weaviate/weaviate

The 5 most severe of 9 vulnerabilities recorded for this package

Search all 9 in the database →
Vulnerability Severity Fixed version ↓ Disclosed ↓
Path Traversal Vulnerability in Weaviate OSS: Risk of Arbitrary File Overwrite 8.7 high 1.30.20 12 Dec 2025
Path Traversal Vulnerability in Weaviate OSS: Arbitrary File Read Risk 8.7 high 1.30.20 12 Dec 2025
CVE-2023-38976: Denial of Service Vulnerability in weaviate 7.5 high 1.20.6 22 Aug 2023
CVE-2026-11500: Weaviate Improper Authorization Vulnerability 5.0 low 1.38.0-rc.0 08 Jun 2026
Duplicate Advisory: Denial of Service Vulnerability in weaviate N/A medium No fix published 21 Aug 2023

Vulnerability wrong, a fix missing, or a package we should cover? Report it and we will fix the record. Report Vulnerability Provide Feedback

Updated: 23/Oct/2026 · Vulnerabilities in our DB: 524315

Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

About github.com/weaviate/weaviate

Is github.com/weaviate/weaviate safe to use?

Vulert records 9 vulnerabilities for github.com/weaviate/weaviate in Go: 0 critical, 3 high, 1 medium and 1 low, plus 4 not yet rated. 1 of them has no published fix yet, so that is the one to avoid or mitigate.

What is github.com/weaviate/weaviate's Vulert package health score?

Vulert scores github.com/weaviate/weaviate 60/100, which reads as usable, but worth attention. The score weighs the vulnerability record (40), maintenance and release cadence (25), adoption from dependents and stars (20) and community signals such as the OpenSSF scorecard and forks (15). The current release has a vulnerability with no published fix, which caps this score.

Is the latest version of github.com/weaviate/weaviate affected?

Yes. v1.40.2, the version you would install today, has 6 known vulnerabilities, and 1 has no published fix yet. Use an earlier unaffected release, or the workaround each vulnerability lists.

How many vulnerabilities does github.com/weaviate/weaviate have?

9 vulnerabilities are recorded for github.com/weaviate/weaviate in the Go ecosystem: 0 critical, 3 high, 1 medium and 1 low, plus 4 not yet rated. The ledger on this page lists the same counts next to the date of the most recent disclosure.

How often are new github.com/weaviate/weaviate vulnerabilities disclosed?

6 vulnerabilities were recorded for github.com/weaviate/weaviate in the last 12 months, and the oldest entry in this database dates to 21 Aug 2023. Recency matters more than a lifetime total: it shows how actively new issues are being disclosed for the package you are considering.

Which versions of github.com/weaviate/weaviate are affected?

Each vulnerability on this page lists the affected version range and the fixed version to move to. Open the vulnerability for the version you actually run — fixes are specific to a release line, not to the package as a whole.

How do I monitor github.com/weaviate/weaviate for upcoming vulnerabilities?

Upload the manifest or SBOM for your application at vulert.com/scanner and Vulert keeps checking the github.com/weaviate/weaviate version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.