fix(deps): bump grpc-go and golang.org/x/{mod,net,sys,text} to patch multiple CVEs - #687
Open
aeonframework wants to merge 2 commits into
Open
fix(deps): bump grpc-go and golang.org/x/{mod,net,sys,text} to patch multiple CVEs#687aeonframework wants to merge 2 commits into
aeonframework wants to merge 2 commits into
Conversation
…multiple CVEs - google.golang.org/grpc 1.68.1 -> 1.83.1 - CVE-2026-33186 (GHSA-p77j-4mvh-x3m3, HIGH): authorization bypass via missing leading slash in gRPC :path - GHSA-hrxh-6v49-42gf: xDS RBAC authorization engine + HTTP/2 transport server vulnerabilities - GHSA-vp52-pcj8-j9qc: heap memory exhaustion (OOM) via HTTP/2 DATA frame fragmentation - golang.org/x/net 0.49.0 -> 0.56.0 (indirect): CVE-2026-33814 (HTTP/2 transport infinite loop), CVE-2026-42506/42502/25680/25681/27136 (HTML parser DoS/XSS), CVE-2026-46600 (DNS message parser panic) - golang.org/x/sys 0.40.0 -> 0.44.0 (indirect): CVE-2026-39824 (integer overflow in NewNTUnicodeString) - golang.org/x/text 0.34.0 -> 0.39.0 (indirect): CVE-2026-56852 (infinite loop on invalid input) - golang.org/x/mod 0.32.0 -> 0.40.0 (indirect): CVE-2026-56865/56864 (sumdb transparency log verification bypass) All target versions verified clean against the OSV database (no remaining advisories at the bumped versions). Detected by osv-scanner.
aeonframework
requested review from
a team,
behinddwalls and
sbalabanov
as code owners
September 8, 2026 02:38
|
|
The prior commit bumped go.mod without a matching go.sum, so builds and go mod verify failed. Ran go mod tidy (Go 1.27) to reconcile: go.sum now has hashes for every module and MVS pulled a few transitives forward (golang.org/x/net 0.56.0 to 0.58.0, x/sys 0.44.0 to 0.47.0, x/text 0.39.0 to 0.41.0, plus oauth2/sync/term/tools), all at or above the security-bump targets. Verified: go build ./... and go mod verify pass. The failing gitsandbox tests require SUBMITQUEUE_TEST_GIT, a Bazel test-target env var, and fail identically on untouched base.
|
Note on the red checks: both |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Automated dependency bump to address several disclosed CVEs found by osv-scanner.
google.golang.org/grpc
v1.68.1->v1.83.1(direct dependency)AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:N) — authorization bypass in gRPC-Go via a missing leading slash in the:pathpseudo-header. Fixed in 1.79.3.VI:H/VA:H) — vulnerabilities in the xDS RBAC authorization engine and the HTTP/2 transport server implementation. Fixed in 1.82.1.VA:H) — heap memory exhaustion (OOM) via HTTP/2 DATA frame fragmentation. Fixed in 1.83.1.golang.org/x/net
v0.49.0->v0.56.0(indirect)CVE-2026-33814 (HTTP/2 transport infinite loop on a bad
SETTINGS_MAX_FRAME_SIZE), CVE-2026-42506 / CVE-2026-42502 (incorrect handling of foreign-content HTML elements), CVE-2026-39821 (Punycode/IDNA ASCII-label handling), GHSA-5cv4-jp36-h3mw / CVE-2026-25680 (HTML parser DoS), CVE-2026-25681 (DOCTYPE character-reference handling), CVE-2026-27136 (duplicate-attribute XSS), CVE-2026-46600 (panic parsing an invalid SVCB/HTTPS DNS RR).golang.org/x/sys
v0.40.0->v0.44.0(indirect)CVE-2026-39824 — integer overflow in
NewNTUnicodeString(Windows).golang.org/x/text
v0.34.0->v0.39.0(indirect)CVE-2026-56852 — infinite loop on invalid input.
golang.org/x/mod
v0.32.0->v0.40.0(indirect)CVE-2026-56865 / CVE-2026-56864 — transparency-log (
sumdb/tlog) verification bypass and unauthenticated-hash handling insumdb.Lookup.All five target versions were verified clean against the OSV database (
api.osv.dev) — no remaining advisories at the bumped versions.This PR only updates
go.mod(the Go SDK / toolchain was unavailable in the environment this scan ran in, sogo.sumcould not be regenerated safely).MODULE.bazel'sgo_depsextension reads versions fromgo.moddirectly (go_deps.from_file(go_mod = "//:go.mod")), so no separate Bazel-side version pin needs updating. Please rungo mod tidy(or your usual Bazelgazelle/mod tidyflow) to regeneratego.sumand anyMODULE.bazel.lockbefore merging.Filed by Aeon.