Current CVEs, Version v0.6.138-2-gb65b0b3

hyrsh commented

2026-09-07 19:05:11 +00:00

Collaborator

CVE-2026-56854
CVE-2026-27145
CVE-2026-33811
CVE-2026-33814
CVE-2026-33818
CVE-2026-39820
CVE-2026-39821
CVE-2026-39822
CVE-2026-39836
CVE-2026-42499
CVE-2026-42504
CVE-2026-46600
CVE-2026-56853
CVE-2026-56858
CVE-2026-56859
CVE-2026-56860
CVE-2026-56862
CVE-2026-84304
CVE-2026-39823
CVE-2026-39825
CVE-2026-39826
CVE-2026-42505
CVE-2026-42507
GO-2026-5932
CVE-2026-56855
CVE-2026-78662

CVE-2026-56854 CVE-2026-27145 CVE-2026-33811 CVE-2026-33814 CVE-2026-33818 CVE-2026-39820 CVE-2026-39821 CVE-2026-39822 CVE-2026-39836 CVE-2026-42499 CVE-2026-42504 CVE-2026-46600 CVE-2026-56853 CVE-2026-56858 CVE-2026-56859 CVE-2026-56860 CVE-2026-56862 CVE-2026-84304 CVE-2026-39823 CVE-2026-39825 CVE-2026-39826 CVE-2026-42505 CVE-2026-42507 GO-2026-5932 CVE-2026-56855 CVE-2026-78662

Cordy added this to the v0.7 — Closed beta (dogfood + hardening) milestone

2026-09-09 20:00:26 +00:00

Cordy referenced this issue from a commit

2026-09-12 17:24:59 +00:00

scout: govulncheck audit for #447 (never commits; branch is deleted after)

Cordy referenced this issue from a commit

2026-09-12 17:29:11 +00:00

one-shot: #447 bump the Go toolchain to the latest 1.25 patch, verify govulncheck clean

forgejo-actions referenced this issue from a commit

2026-09-12 17:33:14 +00:00

#447: bump Go toolchain to the latest 1.25 patch; govulncheck clean

Cordy referenced this issue from a pull request that will close it,

2026-09-12 17:35:45 +00:00

#447: build with Go 1.25.14 — govulncheck clean #507

Cordy closed this issue

2026-09-12 17:38:36 +00:00

Cordy referenced this issue from a commit

2026-09-12 17:38:36 +00:00

Merge pull request '#447: build with Go 1.25.14 — govulncheck clean' (#507) from fix-447 into main

Cordy commented

2026-09-12 17:45:25 +00:00

Owner

Audited with govulncheck (source mode, reachability analysis) against current main, fixed in v0.6.171 (PR #507), live on both dogfoods (cairn_build_info{version="v0.6.171"} verified).

Root cause — one fix covers the whole list

Every reachable finding was in the Go standard library at patch level 1.25.0. The module carried a bare go 1.25 directive, so every build (release.yml uses GOTOOLCHAIN=auto) compiled with the unpatched go1.25.0 toolchain — and a binary scanner sees the stdlib baked into the binary, which is exactly what produced the 26-CVE list against v0.6.138. This class of finding accumulates with every Go patch release until the directive moves.

What govulncheck found (before the fix)

34 reachable stdlib vulnerabilities, all fixed in go1.25.2–go1.25.5: crypto/x509 (cert verification, name constraints, DSA panic), crypto/tls (ALPN), net/http (cookie memory exhaustion), net/url (bracketed IPv6), encoding/asn1, encoding/pem, and friends — reached via the HTTP server, the S3 client, OCM discovery/signatures, LDAP StartTLS.
Zero reachable vulnerabilities in third-party dependencies. The direct deps are current (x/crypto v0.54.0, x/net v0.57.0, x/oauth2 v0.36.0, grpc v1.83.0, protobuf v1.36.11, go-jose v4.1.4, go-oidc v3.20.0) — no dep bumps needed.
The scanner's CVE list maps onto this stdlib set plus module-level advisories in code paths that are never called (govulncheck: "your code doesn't appear to call these vulnerabilities" — 4 such remain, module-level only).

The fix

go get go@patch → go 1.25.14 (latest 1.25 patch). Full test suite green under the new toolchain; govulncheck on the release: "Your code is affected by 0 vulnerabilities."

Keeping it fixed

The scanner list dates to v0.6.138; please rescan the v0.6.171 image — stdlib findings should be gone. Worth adding to the release habit: re-run go get go@patch whenever a Go patch release lands (or on a schedule), since the directive pins the exact stdlib the binary ships. Happy to add a scheduled govulncheck workflow if you want this automated.

Audited with govulncheck (source mode, reachability analysis) against current main, fixed in **v0.6.171** (PR #507), live on both dogfoods (`cairn_build_info{version="v0.6.171"}` verified). ## Root cause — one fix covers the whole list Every reachable finding was in the **Go standard library at patch level 1.25.0**. The module carried a bare `go 1.25` directive, so every build (release.yml uses `GOTOOLCHAIN=auto`) compiled with the unpatched go1.25.0 toolchain — and a binary scanner sees the stdlib baked into the binary, which is exactly what produced the 26-CVE list against v0.6.138. This class of finding accumulates with every Go patch release until the directive moves. ## What govulncheck found (before the fix) - **34 reachable stdlib vulnerabilities**, all fixed in go1.25.2–go1.25.5: `crypto/x509` (cert verification, name constraints, DSA panic), `crypto/tls` (ALPN), `net/http` (cookie memory exhaustion), `net/url` (bracketed IPv6), `encoding/asn1`, `encoding/pem`, and friends — reached via the HTTP server, the S3 client, OCM discovery/signatures, LDAP StartTLS. - **Zero reachable vulnerabilities in third-party dependencies.** The direct deps are current (x/crypto v0.54.0, x/net v0.57.0, x/oauth2 v0.36.0, grpc v1.83.0, protobuf v1.36.11, go-jose v4.1.4, go-oidc v3.20.0) — no dep bumps needed. - The scanner's CVE list maps onto this stdlib set plus module-level advisories in code paths that are never called (govulncheck: "your code doesn't appear to call these vulnerabilities" — 4 such remain, module-level only). ## The fix `go get go@patch` → **`go 1.25.14`** (latest 1.25 patch). Full test suite green under the new toolchain; govulncheck on the release: **"Your code is affected by 0 vulnerabilities."** ## Keeping it fixed The scanner list dates to v0.6.138; please rescan the `v0.6.171` image — stdlib findings should be gone. Worth adding to the release habit: re-run `go get go@patch` whenever a Go patch release lands (or on a schedule), since the directive pins the exact stdlib the binary ships. Happy to add a scheduled govulncheck workflow if you want this automated.

Cordy referenced this issue from a commit

2026-09-12 17:53:35 +00:00

#447 follow-up: weekly scheduled govulncheck (fails + files an issue on reachable vulnerabilities)

Cordy referenced this issue

2026-09-12 17:53:40 +00:00

Weekly scheduled govulncheck (#447 follow-up) #508

Cordy referenced this issue from a commit

2026-09-12 17:56:34 +00:00

Merge pull request 'Weekly scheduled govulncheck (#447 follow-up)' (#508) from add-vulncheck into main

Cordy commented

2026-09-12 17:56:43 +00:00

Owner

Automation added (PR #508): .forgejo/workflows/vulncheck.yml, scheduled Mondays 05:30 UTC, manual dispatch too.

Design decisions:

It fails only on vulnerabilities reachable from our code — the exact condition behind this issue's scanner list. On failure it files a fresh issue with the report attached, but skips filing if an open govulncheck issue already exists, so a red week can't spam the tracker.
A go directive that is merely behind the latest patch (but with nothing reachable — plain bugfix patch releases) is logged as a notice, not treated as a failure.
The filed issue links the fix recipe: go get go@patch on a branch, full suite, release.

Verified with a manual dispatch before merge: drift check reports go 1.25.14 is the latest patch of its line, govulncheck clean (0 reachable).

Automation added (PR #508): **`.forgejo/workflows/vulncheck.yml`**, scheduled Mondays 05:30 UTC, manual dispatch too. Design decisions: - It **fails only on vulnerabilities reachable from our code** — the exact condition behind this issue's scanner list. On failure it files a fresh issue with the report attached, but skips filing if an open govulncheck issue already exists, so a red week can't spam the tracker. - A go directive that is merely behind the latest patch (but with nothing reachable — plain bugfix patch releases) is logged as a notice, not treated as a failure. - The filed issue links the fix recipe: `go get go@patch` on a branch, full suite, release. Verified with a manual dispatch before merge: drift check reports `go 1.25.14` is the latest patch of its line, govulncheck clean (0 reachable).

forgejo-actions referenced this issue

2026-09-14 05:30:49 +00:00

govulncheck: reachable vulnerabilities on main #543

Cordy referenced this issue

2026-09-16 01:42:29 +00:00

govulncheck: reachable vulnerabilities on main #543

Rows
Columns

Current CVEs, Version v0.6.138-2-gb65b0b3 #447

Root cause — one fix covers the whole list

What govulncheck found (before the fix)

The fix

Keeping it fixed