What version of Go are you using (go version)?

$ go version
go version go1.20.6 linux/amd64

Does this issue reproduce at the latest version of golang.org/x/vuln?

Yes.

What operating system and processor architecture are you using (go env)?

$ go env
GO111MODULE=""
GOARCH="amd64"
GOBIN=""
GOCACHE="/home/kucm/.cache/go-build"
GOENV="/home/kucm/.config/go/env"
GOEXE=""
GOEXPERIMENT=""
GOFLAGS=""
GOHOSTARCH="amd64"
GOHOSTOS="linux"
GOINSECURE=""
GOMODCACHE="/home/kucm/go/pkg/mod"
GONOPROXY="none"
GONOSUMDB="*.netcraft.com"
GOOS="linux"
GOPATH="/home/kucm/go"
GOPRIVATE="*.netcraft.com"
GOPROXY=""
GOROOT="/usr/lib/go"
GOSUMDB="sum.golang.org"
GOTMPDIR=""
GOTOOLDIR="/usr/lib/go/pkg/tool/linux_amd64"
GOVCS=""
GOVERSION="go1.20.6"
GCCGO="gccgo"
GOAMD64="v1"
AR="ar"
CC="gcc"
CXX="g++"
CGO_ENABLED="1"
GOMOD="/dev/null"
GOWORK=""
CGO_CFLAGS="-O2 -g"
CGO_CPPFLAGS=""
CGO_CXXFLAGS="-O2 -g"
CGO_FFLAGS="-O2 -g"
CGO_LDFLAGS="-O2 -g"
PKG_CONFIG="pkg-config"
GOGCCFLAGS="-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -fdebug-prefix-map=/tmp/go-build3339256111=/tmp/go-build -gno-record-gcc-switches"

What did you do?

$ govulncheck ./...
Using go1.20.6 and govulncheck@v1.0.0 with vulnerability data from https://vuln.go.dev/ (last modified 2023-08-02 20:33:39 +0000 UTC).
Scanning your code and 284 packages across 55 dependent modules for known vulnerabilities...
Vulnerability #1: GO-2023-1987
    Large RSA keys can cause high CPU usage in crypto/tls
  More info: https://pkg.go.dev/vuln/GO-2023-1987
  Standard library
    Found in: crypto/tls@go1.20.6
    Fixed in: crypto/tls@go1.21rc4
    Example traces found:
      --snipped--
Your code is affected by 1 vulnerability from the Go standard library.
Share feedback at https://go.dev/s/govulncheck-feedback.

What did you expect to see?

Fixed in: crypto/tls@go1.20.7

What did you see instead?

Fixed in: crypto/tls@go1.21rc4

Either govulncheck should provide a flag to only recommend stable releases, or the logic should be adjusted so that:

• go < 1.19.12 it should suggest 1.19.12
• 1.20.0 <= go < 1.20.7 it should suggest 1.20.7
• 1.21.0 <= go < 1.21.0-rc.4 it should suggest 1.21.0-rc.4

It doesn't really make sense for the default recommendation to be to use a release candidate, when that is not a stable release yet.