govulncheck — vulnerability scanning

Overview

govulncheck (golang.org/x/vuln) checks a module against the curated Go vulnerability database (vuln.go.dev). Its differentiator is static call-graph analysis: it reports a CVE only when your code can actually reach the vulnerable function, not merely because the module appears in go.mod — cutting the alert noise that makes teams ignore plain dependency scanners.

Key points

• Run it: go install golang.org/x/vuln/cmd/govulncheck@latest, then govulncheck ./... at the module root; non-zero exit on reachable findings makes it a natural CI gate.
• Reachability, not presence: generic SCA scanners flag every vulnerable version in the dependency graph; govulncheck symbol-level analysis distinguishes "you import it" from "you call the broken function" — the difference between a page and a backlog item.
• Curated database: entries are reviewed by the Go security team and mapped to affected symbols, which is what makes reachability analysis possible; standard library vulnerabilities (fixed by toolchain upgrades) are included.
• -mode=binary: scans a built artifact using its embedded module and symbol information — audit what you actually deployed, no source checkout needed.
• Informational tier: unreachable-but-present vulns are still listed (as "affecting your modules") so you can plan upgrades; only reachable ones fail the run.
• Limits: reflection and some dynamic calls defeat static reachability (treated conservatively); the DB covers public Go modules, not C code behind cgo — pair with a container/SCA scanner for the full artifact.
• Fix path: usually just go get module@fixed && go mod tidy — minimal version selection makes the bump surgical.

Examples

govulncheck ./...                 # source mode, CI gate
govulncheck -mode=binary ./app    # audit a built artifact
govulncheck -show verbose ./...   # call stacks proving reachability

Related

• The go command & tool catalog — parent catalog of the toolchain.
• Security testing in Go — where govulncheck sits in the wider SAST/DAST/SCA strategy.
• staticcheck & golangci-lint — sibling analysers for code quality; gosec covers insecure patterns where govulncheck covers known CVEs.
• Security testing in Java — contrast: JVM SCA (OWASP Dependency-Check, Snyk) alerts on presence; Go's official tool alerts on reachability.
• AppSec fundamentals — the vulnerability-management practice this tool feeds.