cve.nowby Sazabi

GoPackage

github.com/go-acme/lego/v4

2 known vulnerabilities (1 high, 1 low), with the versions each affects and the releases that fix them.

Latest release: v4.35.2 (Apr 24, 2026): no advisory affects it
Newest unaffected release: v4.35.2 (Apr 24, 2026), the latest release
Advisories: 2 · 1 high, 1 low

Releases: 75 since v4.0.0 (Sep 2, 2020)
Registry: pkg.go.dev
Releases read: Nov 8, 2026

Version timeline

CVE-2026-40611
Affects v4.0.0 to v4.33.0 (v4.34.0 is outside it)
CVE-2025-54799
Affects v4.0.0 to v4.25.1 (v4.25.2 is outside it)

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 2

CVE-2026-40611High 8.8
Lego: Arbitrary File Write via Path Traversal in Webroot HTTP-01 Provider
Affected: fixed in 4.34.0.
Fixed in v4.34.0 (released Apr 15, 2026, 6 days before disclosure).
The latest release, v4.35.2, is not affected.
CVE-2025-54799Low 2.3
Lego does not enforce HTTPS
Affected: fixed in 4.25.2.
Fixed in v4.25.2 (released Aug 6, 2025, 1 day before disclosure).
The latest release, v4.35.2, is not affected.