cve.nowby Sazabi

GoPackage

github.com/go-acme/lego/v3

2 known vulnerabilities (1 high, 1 low), with the versions each affects and the releases that fix them.

Latest release: v3.9.0 (Sep 1, 2020): affected by 2 advisories
Newest unaffected release: Every release is affected by at least one advisory
Advisories: 2 · 1 high, 1 low

Releases: 13 since v3.0.0 (Aug 7, 2019)
Registry: pkg.go.dev
Releases read: Nov 8, 2026

Version timeline

CVE-2026-40611
Affects v3.0.0 to v3.9.0 (through the newest release)
CVE-2025-54799
Affects v3.0.0 to v3.9.0 (through the newest release)

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 2

CVE-2026-40611High 8.8
Lego: Arbitrary File Write via Path Traversal in Webroot HTTP-01 Provider
Affected: through 3.9.0.
No fix released. The latest release, v3.9.0, is still affected.
CVE-2025-54799Low 2.3
Lego does not enforce HTTPS
Affected: through 4.25.1.
No fix released. The latest release, v3.9.0, is still affected.