Port details

lang/go 1.27_21,2

Meta-port for the default version of the Go programming language

unaddressed

VuXML only

fixed

open problem reports

Port info

Maintainer: go@FreeBSD.org
Packages: latest: 1.27_21,2
Upstream: up to date
Last update: 2026-09-03 to 1.27_21,2 · dd0905142a
Quarterly: 2026Q4: 1.26_21,2 28 unaddressed
WWW: https://golang.org
Links: cgit · VuXML

Install

Package

# pkg install go

installs 1.27_21,2 from latest; from quarterly (2026Q4) 1.26_21,2

Port

# cd /usr/ports/lang/go && make install clean

Size

1.5 KiB download · 256 B installed

Depends on

lang/go127 1.27.3

License

Packages by version and architecture

latest

FreeBSD version	amd64	aarch64	i386
FreeBSD 16	1.27_21,2	1.27_21,2	–
FreeBSD 15	1.27_21,2	1.27_21,2	–
FreeBSD 14	1.27_21,2	1.27_21,2	1.27_21,2

quarterly (2026Q4)

FreeBSD version	amd64	aarch64	i386
FreeBSD 15	1.26_21,2	1.26_21,2	–
FreeBSD 14	1.26_21,2	1.26_21,2	1.26_21,2

version as in the ports tree (latest) or the most common one (quarterly) · different version · ✗ not built · – no packages for this platform. Package sets that have not been rebuilt for 60 days are left out.

Unaddressed (2)

The CVE record lists the packaged version 1.27_21,2 as affected, and no VuXML entry names the CVE. What does this mean?

CVE	CVSS	Published	Description
CVE-2026-39822	7.8	2026-07-08	On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link…
CVE-2026-42505	5.3	2026-07-08	Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted cli…

VuXML only (0)

Listed in VuXML, the packaged version 1.27_21,2 is still in the affected range; pkg audit reports it. What does this mean?

None.

Fixed (21)

Show 21 fixed

VuXML entries whose affected range the packaged version has left.

go -- syscall.Faccessat checks wrong group on Linuxentered 2022-05-15

CVE-2022-29526

go -- multiple vulnerabilitiesentered 2022-05-02

CVE-2022-24675, CVE-2022-27536, CVE-2022-28327

go -- multiple vulnerabilitiesentered 2022-03-19

CVE-2022-24921

go -- multiple vulnerabilitiesentered 2022-02-18

CVE-2022-23772, CVE-2022-23773, CVE-2022-23806

go -- multiple vulnerabilitiesentered 2021-12-09

CVE-2021-44716, CVE-2021-44717

go -- multiple vulnerabilitiesentered 2021-11-05

CVE-2021-41771, CVE-2021-41772

go -- misc/wasm, cmd/link: do not let command line arguments overwrite global dataentered 2021-10-09

CVE-2021-38297

go -- archive/zip: overflow in preallocation check can cause OOM panicentered 2021-09-10

CVE-2021-39293

go -- net/http: panic due to racy read of persistConn after handler panicentered 2021-08-05

CVE-2021-36221

go -- crypto/tls: clients can panic when provided a certificate of the wrong type for the negotiated parametersentered 2021-07-12

CVE-2021-34558

go -- multiple vulnerabilitiesentered 2021-06-03

CVE-2021-33195, CVE-2021-33196, CVE-2021-33197, CVE-2021-33198

go -- net/http: ReadRequest can stack overflow due to recursion with very large headersentered 2021-05-06

CVE-2021-31525

go -- encoding/xml: infinite loop when using xml.NewTokenDecoder with a custom TokenReader; archive/zip: panic when calling Reader.Openentered 2021-03-10

CVE-2021-27918, CVE-2021-27919

go -- cmd/go: packages using cgo can cause arbitrary code execution at build time; crypto/elliptic: incorrect operations on the P-224 curveentered 2021-01-19

CVE-2021-3114, CVE-2021-3115

go -- math/big: panic during recursive division of very large numbers; cmd/go: arbitrary code execution at build time through cgoentered 2020-11-12

CVE-2020-28362, CVE-2020-28366, CVE-2020-28367

go -- net/http/cgi, net/http/fcgi: Cross-Site Scripting (XSS) when Content-Type is not specifiedentered 2020-09-01

CVE-2020-24553

go -- encoding/binary: ReadUvarint and ReadVarint can read an unlimited number of bytes from invalid inputsentered 2020-08-06

CVE-2020-16845

go -- invalid headers are normalized, allowing request smugglingentered 2019-09-26

CVE-2019-16276

go -- remote denial of serviceentered 2016-04-14

CVE-2016-3959

go -- information disclosure vulnerabilityentered 2016-01-18

CVE-2015-8618

go -- multiple vulnerabilitiesentered 2015-08-25

CVE-2015-5739, CVE-2015-5740, CVE-2015-5741

Problem reports (4) · open in Bugzilla, most recently changed first

PR	Summary	Status	Changed
273568	maintainer-feedback? lang/go: ease debugging of ports utilizing go	New	2025-09-20
277529	maintainer-feedback? lang/go*: doesn't respect MAKE_JOBS_NUMBER while building	New	2025-07-11
286214	merge-quarterly- lang/go: Provide only one go version	In Progress	2025-06-10
283314	maintainer-feedback? lang/go Go applications segfault on VM infrastructure reliably	New	2025-01-02

Commits (184)

2014-12-07 10:25Baptiste Daroussin (bapt) · 1.3.2,1

Fix build when compiler is clang

f175aaca84

2014-10-27 16:23Baptiste Daroussin (bapt) · 1.3.2,1

Cleanup plist

77cba41a62

2014-09-27 21:07Julien Laffaye (jlaffaye) · 1.3.2,1

Update to 1.3.2

6873226fb0

2014-08-15 23:44Julien Laffaye (jlaffaye) · 1.3.1,1

- Update to 1.3.1

1c72e050cc

2014-08-01 22:09Julien Laffaye (jlaffaye) · 1.3_1,1

Fix plist on i386

PR:		192317
Submitted by:	robak

019ce681c8

2014-06-19 21:04Julien Laffaye (jlaffaye) · 1.3,1

- Update to 1.3

2834c753c7

2014-05-05 11:45Baptiste Daroussin (bapt) · 1.2.1,1

Convert all :U to :tu and :L to :tl

Since FreeBSD 8.4 and FreeBSD 9.1 make(1) do support :tu and :tl as a
replacement for :U and :L (which has been marked as deprecated)

bmake which is the default on FreeBSD 10+ only support by default
:tu/:tl a hack has been added at the time to support :U and :L to ease
migration. This hack is now not necessary anymore

Note that this makes the ports tree incompatible with make(1) from
FreeBSD 8.3 or earlier

With hat:	portmgr

4a4ec28d37

2014-03-09 18:13Julien Laffaye (jlaffaye) · 1.2.1,1

- Update to 1.2.1 - Specify BSD license

4694a6524f

2014-01-11 18:46Julien Laffaye (jlaffaye) · 1.2,1

- Change default location of Go packages to LOCALBASE/share/go   This fixes problems like ports failing to build if the port   is already installed [1] - Bump PORTREVISION of affected ports - Support the install target in bsd.go.mk - STAGE support for free!

PR:		ports/180003 [1]

257ee41338

2013-12-08 14:33Julien Laffaye (jlaffaye) · 1.2,1

- Update to 1.2 [1] - Remove obsolete pkg-message [2]

PR:		ports/184454 [1], ports/176473 [2]
Submitted by:	lwhsu

5d7fab8cad

2013-09-20 21:53Baptiste Daroussin (bapt) · 1.1.2,1

Add NO_STAGE all over the place in preparation for the staging support (cat: lang)

888ab73a81

2013-08-13 22:25Julien Laffaye (jlaffaye) · 1.1.2,1

- Update to 1.1.2

5789e0b8ce

2013-08-04 02:42Baptiste Daroussin (bapt) · 1.1.1,1

Add USE_GCC=any as build fails with clang. Pass CC to build env to properly using the compiler desired This fixes build on head without gcc

659a6d4cf5

2013-06-16 12:25Julien Laffaye (jlaffaye) · 1.1.1,1

- Update to 1.1.1 - Remove bash and bison dependencies - Specify the PATH in regression-test target

PR:             179529
Submitted by:   koobs

9e2a5b4cd3

2013-06-02 17:40Julien Laffaye (jlaffaye) · 1.1,1

- Do not hardcode GOOS, use OPSYS instead [1] - Add -f flag to LN [1] - Add a regression-test target

Submitted by:	sbz (irc) [1]

851e76cacf

2013-05-19 21:59Julien Laffaye (jlaffaye) · 1.1,1

- Update to 1.1

60aa7dc67d

2013-02-13 20:26Julien Laffaye (jlaffaye) · 1.0.3_1,1

Fix plist on i386

Submitted by:	skreuzer (private mail)

7fff875266

2013-01-24 20:11Julien Laffaye (jlaffaye) · 1.0.3,1

Add i386 to supported arch.

b6a6e4384c

2012-10-02 20:17Julien Laffaye (jlaffaye) · 1.0.3,1

- Fix plist

9c26ce0839

2012-09-25 21:11Julien Laffaye (jlaffaye) · 1.0.3,1

- Update to 1.0.3 - Switch to new Makefile header style

449f0c8cbe

2012-06-19 20:41Julien Laffaye (jlaffaye) · 1.0.2,1

- Update to 1.0.2

d95ff34009

2012-05-15 00:00Julien Laffaye (jlaffaye) · 1.0.1,1

- Update to 1.0.1 - Only for amd64 until i386 is fixed

6d356025c0

2011-11-30 21:35Julien Laffaye (jlaffaye) · 20111017_1

- Install sources to fix goinstall and godoc [1] [2] - Unset GOBIN while installing [3]

PR:		ports/154179 [1], ports/162910 [2], ports/162954 [3]
Feature safe:	yes

857da7c9b8

2011-11-26 23:56Julien Laffaye (jlaffaye) · 20111017

- Update go to 20111017 (r60.3) - Install the lib folder to fix goinstall [1]

Reported by:	Andy Kosela <akosela@andykosela.com> [1]
PR:		ports/162621
Feature safe:	yes

1b03a84787

2011-10-07 11:16Julien Laffaye (jlaffaye) · 20111005

Update to 20111005

43c8b924eb

2011-09-22 18:42Julien Laffaye (jlaffaye) · 20110920

- Update to 20110920 - Cleanup - Install into PREFIX/go

e40c2ecc14

2011-09-03 01:30Julien Laffaye (jlaffaye) · 20110515

Take maintainership

Approved by:	maintainer (private mail)

29fc6f0a0c

2011-05-26 22:49Steven Kreuzer (skreuzer) · 20110515

Update to 20110515

PR:		ports/157348
Approved by:	Devon H. O'Dell (maintainer)

ba2e22f535

2011-01-15 01:23Steve Wills (swills) · 20101225

- Update to 20101225 snapshot

PR:		ports/153464
Submitted by:	wen
Approved by:	wxs@ and pgolluci@ (mentor implicit)
Feature safe:	yes

e0a1d111b9

2010-11-25 07:16Wen Heping (wen) · 20101027_1

- Add bsd.go.mk to help create go package port

Submitted by:	Wen Heping(myself)
Approved by:	maintainer(via email)

f82af8989d

2010-11-24 15:45Wesley Shields (wxs) · 20101027_1

Use pkg-message.in. Install Make.* into ${GOROOT}/src so go packages can be used.

Submitted by:	wen@

0c5bb18988

2010-10-31 20:09Wesley Shields (wxs) · 20101027

Update to 20101027.

Submitted by:	wen@
Approved by:	devon.odell@gmail.com (maintainer)

ccfd5fc2ea

2010-04-25 17:37Wesley Shields (wxs) · 20100413

Update to 20100413

Submitted by:	devon.odell@gmail.com (maintainer, private mail)

4a9955fefb

2010-01-23 18:44Wesley Shields (wxs) · 20100113

An experimental, concurrent, garbage collected language.

Submitted by:	devon.odell@gmail.com (private mail)

cec0b576ea

comms/libimobiledevice +1 related 5 unaddressed · 6.9	Oct 26
devel/libgsf 1 unaddressed · 5.3	Oct 26
www/p5-Plack 1 unaddressed · –	Oct 25
www/p5-Starman 4 unaddressed · –	Oct 25
www/p5-Web-Simple 1 unaddressed · –	Oct 24
devel/open62541 1 CVE · 9.2 fixed 1.5.8	Oct 24
dns/lua-resty-dns 1 unaddressed · 6.3	Oct 24
devel/libwasmtime 2 unaddressed · 9.9	Oct 23
devel/py-twisted 7 unaddressed · 8.7	Oct 23
www/p5-HTTP-Headers-ActionPack 1 unaddressed · –	Oct 23
print/py-pypdf 25 unaddressed · 8.7	Oct 23
www/phpbb3 1 unaddressed · 8.3	Oct 23
net-mgmt/cacti 1 unaddressed · 8.8 VuXML	Oct 23
deskutils/xdg-desktop-portal 2 CVEs · 8.8 fixed 1.22.1	Oct 23
graphics/qt6-3d +29 related 7 CVEs · 8.7 fixed 6.11.2	Oct 23

ImageMagick6	Oct 26
ImageMagick6-nox11	Oct 26
ImageMagick7	Oct 26
ImageMagick7-nox11	Oct 26
node	Oct 24
node22	Oct 24
node24	Oct 24
node26	Oct 24
traefik	Oct 24
ca_root_nss	Oct 23
gitlab-ce	Oct 23
gitlab-ee	Oct 23
mailpit	Oct 23
vifm	Oct 23
brotli	Oct 22
chromium	Oct 22
jackson-core	Oct 22
jackson-databind	Oct 22
jackson-databind	Oct 22
keycloak	Oct 22
linux-chrome	Oct 22
ungoogled-chromium	Oct 22
FreeBSD	Oct 21
p5-DBI	Oct 21
php82	Oct 21