Skip to content

fix(deps): vuln minor upgrades — 4 packages (minor: 4) [third_party/rgo]#203

Draft
gh-worker-campaigns-3e9aa4[bot] wants to merge 1 commit into
mainfrom
engraver-auto-version-upgrade/minorpatch/go/rgo/0-1784608952
Draft

fix(deps): vuln minor upgrades — 4 packages (minor: 4) [third_party/rgo]#203
gh-worker-campaigns-3e9aa4[bot] wants to merge 1 commit into
mainfrom
engraver-auto-version-upgrade/minorpatch/go/rgo/0-1784608952

Conversation

@gh-worker-campaigns-3e9aa4

@gh-worker-campaigns-3e9aa4 gh-worker-campaigns-3e9aa4 Bot commented Jul 21, 2026

Copy link
Copy Markdown
Contributor

Summary: Critical-severity security update — 10 packages upgraded (MINOR changes included)

Manifests changed:

  • third_party/rgo (go)

✅ Action Required: Please review the changes below. If they look good, approve and merge this PR.

Updates

Package From To Type Dep Type Vulnerabilities Fixed
golang.org/x/crypto v0.39.0 v0.54.0 minor Direct 21 CRITICAL, 8 HIGH, 18 MEDIUM, 1 UNKNOWN
golang.org/x/crypto v0.39.0 v0.54.0 minor Direct 21 CRITICAL, 8 HIGH, 18 MEDIUM, 1 UNKNOWN
google.golang.org/grpc v1.71.0 v1.82.1 minor Direct 3 CRITICAL
google.golang.org/grpc v1.71.0 v1.82.1 minor Direct 3 CRITICAL
golang.org/x/net v0.38.0 v0.57.0 minor Direct 2 CRITICAL, 2 HIGH, 13 MEDIUM, 1 UNKNOWN
golang.org/x/net v0.41.0 v0.57.0 minor Direct 2 CRITICAL, 2 HIGH, 13 MEDIUM, 1 UNKNOWN
golang.org/x/net v0.38.0 v0.57.0 minor Direct 2 CRITICAL, 2 HIGH, 13 MEDIUM, 1 UNKNOWN
golang.org/x/net v0.41.0 v0.57.0 minor Direct 2 CRITICAL, 2 HIGH, 13 MEDIUM, 1 UNKNOWN
golang.org/x/sys v0.33.0 v0.47.0 minor Transitive 1 UNKNOWN
golang.org/x/sys v0.33.0 v0.47.0 minor Transitive 1 UNKNOWN

Security Details

🚨 Critical & High Severity (80 fixed)
Package CVE Severity Summary Unsafe Version Fixed In Case
golang.org/x/crypto GHSA-vgwf-h737-ff37 CRITICAL golang.org/x/crypto: Invoking client can cause server deadlock on unexpected responses v0.39.0 0.52.0 -
golang.org/x/crypto CVE-2026-39834 critical Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh v0.39.0 - -
golang.org/x/crypto GHSA-x527-x647-q7gg CRITICAL golang.org/x/crypto: Invoking VerifiedPublicKeyCallback permissions skip enforcement v0.39.0 0.52.0 -
golang.org/x/crypto CVE-2026-46595 critical Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh v0.39.0 - -
golang.org/x/crypto GO-2026-5023 critical Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh v0.39.0 0.52.0 -
golang.org/x/crypto GO-2026-5021 CRITICAL Invoking auth bypass via unenforced @Revoked status in golang.org/x/crypto/ssh/knownhosts v0.39.0 0.52.0 -
golang.org/x/crypto CVE-2026-42508 CRITICAL Invoking auth bypass via unenforced @Revoked status in golang.org/x/crypto/ssh/knownhosts v0.39.0 - -
golang.org/x/crypto GHSA-5cgq-3rg8-m6cv CRITICAL golang.org/x/crypto vulnerable to auth bypass via unenforced @Revoked status v0.39.0 0.52.0 -
golang.org/x/crypto CVE-2026-39831 critical Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh v0.39.0 - -
golang.org/x/crypto CVE-2026-39833 CRITICAL Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent v0.39.0 - -
golang.org/x/crypto GO-2026-5005 CRITICAL Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent v0.39.0 0.52.0 -
golang.org/x/crypto GHSA-jppx-rxg9-jmrx CRITICAL golang.org/x/crypto doesn't enforce invoking key constraints v0.39.0 0.52.0 -
golang.org/x/crypto GO-2026-5017 CRITICAL Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh v0.39.0 0.52.0 -
golang.org/x/crypto CVE-2026-39830 CRITICAL Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh v0.39.0 - -
golang.org/x/crypto GHSA-rm3j-f69w-wqmq CRITICAL golang.org/x/crypto vulnerable to infinite loop on large channel writes v0.39.0 0.52.0 -
golang.org/x/crypto GO-2026-5020 critical Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh v0.39.0 0.52.0 -
golang.org/x/crypto GHSA-89gr-r52h-f8rx CRITICAL golang.org/x/crypto: FIDO/U2F security key physical presence check can be bypassed v0.39.0 0.52.0 -
golang.org/x/crypto GO-2026-5019 critical Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh v0.39.0 0.52.0 -
golang.org/x/crypto GO-2026-5006 CRITICAL Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent v0.39.0 0.52.0 -
golang.org/x/crypto CVE-2026-39832 CRITICAL Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent v0.39.0 - -
golang.org/x/crypto GHSA-f5wc-c3c7-36mc CRITICAL golang.org/x/crypto doesn't drop invoking agent constraints when forwarding keys v0.39.0 0.52.0 -
golang.org/x/crypto GO-2026-5017 CRITICAL Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh v0.39.0 0.52.0 -
golang.org/x/crypto GO-2026-5019 critical Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh v0.39.0 0.52.0 -
golang.org/x/crypto GO-2026-5006 CRITICAL Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent v0.39.0 0.52.0 -
golang.org/x/crypto CVE-2026-39832 CRITICAL Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent v0.39.0 - -
golang.org/x/crypto GHSA-f5wc-c3c7-36mc CRITICAL golang.org/x/crypto doesn't drop invoking agent constraints when forwarding keys v0.39.0 0.52.0 -
golang.org/x/crypto GHSA-89gr-r52h-f8rx CRITICAL golang.org/x/crypto: FIDO/U2F security key physical presence check can be bypassed v0.39.0 0.52.0 -
golang.org/x/crypto GHSA-rm3j-f69w-wqmq CRITICAL golang.org/x/crypto vulnerable to infinite loop on large channel writes v0.39.0 0.52.0 -
golang.org/x/crypto GHSA-vgwf-h737-ff37 CRITICAL golang.org/x/crypto: Invoking client can cause server deadlock on unexpected responses v0.39.0 0.52.0 -
golang.org/x/crypto CVE-2026-39833 CRITICAL Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent v0.39.0 - -
golang.org/x/crypto CVE-2026-39830 CRITICAL Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh v0.39.0 - -
golang.org/x/crypto CVE-2026-39831 critical Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh v0.39.0 - -
golang.org/x/crypto CVE-2026-39834 critical Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh v0.39.0 - -
golang.org/x/crypto GO-2026-5021 CRITICAL Invoking auth bypass via unenforced @Revoked status in golang.org/x/crypto/ssh/knownhosts v0.39.0 0.52.0 -
golang.org/x/crypto GO-2026-5023 critical Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh v0.39.0 0.52.0 -
golang.org/x/crypto CVE-2026-46595 critical Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh v0.39.0 - -
golang.org/x/crypto GHSA-x527-x647-q7gg CRITICAL golang.org/x/crypto: Invoking VerifiedPublicKeyCallback permissions skip enforcement v0.39.0 0.52.0 -
golang.org/x/crypto GO-2026-5020 critical Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh v0.39.0 0.52.0 -
golang.org/x/crypto CVE-2026-42508 CRITICAL Invoking auth bypass via unenforced @Revoked status in golang.org/x/crypto/ssh/knownhosts v0.39.0 - -
golang.org/x/crypto GHSA-jppx-rxg9-jmrx CRITICAL golang.org/x/crypto doesn't enforce invoking key constraints v0.39.0 0.52.0 -
golang.org/x/crypto GHSA-5cgq-3rg8-m6cv CRITICAL golang.org/x/crypto vulnerable to auth bypass via unenforced @Revoked status v0.39.0 0.52.0 -
golang.org/x/crypto GO-2026-5005 CRITICAL Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent v0.39.0 0.52.0 -
golang.org/x/net GO-2026-5026 critical Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna v0.38.0 0.55.0 -
golang.org/x/net CVE-2026-39821 critical Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna v0.38.0 - -
golang.org/x/net CVE-2026-39821 critical Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna v0.41.0 - -
golang.org/x/net GO-2026-5026 critical Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna v0.41.0 0.55.0 -
golang.org/x/net GO-2026-5026 critical Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna v0.38.0 0.55.0 -
golang.org/x/net CVE-2026-39821 critical Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna v0.38.0 - -
golang.org/x/net GO-2026-5026 critical Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna v0.41.0 0.55.0 -
golang.org/x/net CVE-2026-39821 critical Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna v0.41.0 - -
google.golang.org/grpc GO-2026-4762 CRITICAL Authorization bypass in gRPC-Go via missing leading slash in :path in google.golang.org/grpc v1.71.0 1.79.3 -
google.golang.org/grpc CVE-2026-33186 CRITICAL gRPC-Go has an authorization bypass via missing leading slash in :path v1.71.0 - -
google.golang.org/grpc GHSA-p77j-4mvh-x3m3 CRITICAL gRPC-Go has an authorization bypass via missing leading slash in :path v1.71.0 1.79.3 -
google.golang.org/grpc GHSA-p77j-4mvh-x3m3 CRITICAL gRPC-Go has an authorization bypass via missing leading slash in :path v1.71.0 1.79.3 -
google.golang.org/grpc CVE-2026-33186 CRITICAL gRPC-Go has an authorization bypass via missing leading slash in :path v1.71.0 - -
google.golang.org/grpc GO-2026-4762 CRITICAL Authorization bypass in gRPC-Go via missing leading slash in :path in google.golang.org/grpc v1.71.0 1.79.3 -
golang.org/x/crypto CVE-2026-46597 high Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh v0.39.0 - -
golang.org/x/crypto GO-2026-5018 high Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh v0.39.0 0.52.0 -
golang.org/x/crypto CVE-2026-39829 high Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh v0.39.0 - -
golang.org/x/crypto GHSA-w879-237q-wc7r HIGH golang.org/x/crypto: Invoking pathological RSA/DSA parameters may cause DoS v0.39.0 0.52.0 -
golang.org/x/crypto GO-2025-4116 HIGH Potential denial of service in golang.org/x/crypto/ssh/agent v0.39.0 0.43.0 -
golang.org/x/crypto GHSA-56w8-48fp-6mgv HIGH golang.org/x/crypto/ssh/agent has a potential denial of service v0.39.0 - -
golang.org/x/crypto GO-2026-5013 high Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh v0.39.0 0.52.0 -
golang.org/x/crypto GHSA-q4h4-gmj2-qvw2 HIGH golang.org/x/crypto: Invoking byte arithmetic causes underflow and panic v0.39.0 0.52.0 -
golang.org/x/crypto CVE-2026-39829 high Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh v0.39.0 - -
golang.org/x/crypto GO-2026-5013 high Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh v0.39.0 0.52.0 -
golang.org/x/crypto GO-2026-5018 high Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh v0.39.0 0.52.0 -
golang.org/x/crypto GHSA-w879-237q-wc7r HIGH golang.org/x/crypto: Invoking pathological RSA/DSA parameters may cause DoS v0.39.0 0.52.0 -
golang.org/x/crypto GHSA-q4h4-gmj2-qvw2 HIGH golang.org/x/crypto: Invoking byte arithmetic causes underflow and panic v0.39.0 0.52.0 -
golang.org/x/crypto CVE-2026-46597 high Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh v0.39.0 - -
golang.org/x/crypto GO-2025-4116 HIGH Potential denial of service in golang.org/x/crypto/ssh/agent v0.39.0 0.43.0 -
golang.org/x/crypto GHSA-56w8-48fp-6mgv HIGH golang.org/x/crypto/ssh/agent has a potential denial of service v0.39.0 - -
golang.org/x/net CVE-2026-33814 high Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net v0.38.0 - -
golang.org/x/net GO-2026-4918 high Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net v0.38.0 0.53.0 -
golang.org/x/net CVE-2026-33814 high Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net v0.41.0 - -
golang.org/x/net GO-2026-4918 high Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net v0.41.0 0.53.0 -
golang.org/x/net CVE-2026-33814 high Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net v0.38.0 - -
golang.org/x/net GO-2026-4918 high Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net v0.38.0 0.53.0 -
golang.org/x/net GO-2026-4918 high Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net v0.41.0 0.53.0 -
golang.org/x/net CVE-2026-33814 high Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net v0.41.0 - -
ℹ️ Other Vulnerabilities (96)
Package CVE Severity Summary Unsafe Version Fixed In Case
golang.org/x/crypto GO-2025-4135 medium Malformed constraint may cause denial of service in golang.org/x/crypto/ssh/agent v0.39.0 0.45.0 -
golang.org/x/crypto CVE-2025-58181 medium Unbounded memory consumption in golang.org/x/crypto/ssh v0.39.0 - -
golang.org/x/crypto CVE-2025-47914 medium Malformed constraint may cause denial of service in golang.org/x/crypto/ssh/agent v0.39.0 - -
golang.org/x/crypto GO-2025-4134 medium Unbounded memory consumption in golang.org/x/crypto/ssh v0.39.0 0.45.0 -
golang.org/x/crypto GO-2025-4134 medium Unbounded memory consumption in golang.org/x/crypto/ssh v0.39.0 0.45.0 -
golang.org/x/crypto CVE-2025-58181 medium Unbounded memory consumption in golang.org/x/crypto/ssh v0.39.0 - -
golang.org/x/crypto CVE-2025-47914 medium Malformed constraint may cause denial of service in golang.org/x/crypto/ssh/agent v0.39.0 - -
golang.org/x/crypto GO-2025-4135 medium Malformed constraint may cause denial of service in golang.org/x/crypto/ssh/agent v0.39.0 0.45.0 -
golang.org/x/net CVE-2026-42506 medium Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html v0.38.0 - -
golang.org/x/net GO-2026-5025 medium Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html v0.38.0 0.55.0 -
golang.org/x/net GO-2026-5030 medium Invoking duplicate attributes can cause XSS in golang.org/x/net/html v0.38.0 0.55.0 -
golang.org/x/net CVE-2026-25681 medium Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html v0.38.0 - -
golang.org/x/net GO-2026-5029 medium Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html v0.38.0 0.55.0 -
golang.org/x/net CVE-2026-42502 medium Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html v0.38.0 - -
golang.org/x/net GO-2026-5027 medium Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html v0.38.0 0.55.0 -
golang.org/x/net CVE-2026-27136 medium Invoking duplicate attributes can cause XSS in golang.org/x/net/html v0.38.0 - -
golang.org/x/net CVE-2026-42502 medium Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html v0.41.0 - -
golang.org/x/net GO-2026-5028 medium Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html v0.41.0 0.55.0 -
golang.org/x/net GO-2026-5027 medium Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html v0.41.0 0.55.0 -
golang.org/x/net CVE-2026-25680 medium Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html v0.41.0 - -
golang.org/x/net CVE-2026-25681 medium Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html v0.41.0 - -
golang.org/x/net CVE-2026-27136 medium Invoking duplicate attributes can cause XSS in golang.org/x/net/html v0.41.0 - -
golang.org/x/net GO-2026-5030 medium Invoking duplicate attributes can cause XSS in golang.org/x/net/html v0.41.0 0.55.0 -
golang.org/x/net GO-2026-5025 medium Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html v0.41.0 0.55.0 -
golang.org/x/net CVE-2026-42506 medium Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html v0.41.0 - -
golang.org/x/net GO-2026-5029 medium Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html v0.41.0 0.55.0 -
golang.org/x/net GO-2026-5030 medium Invoking duplicate attributes can cause XSS in golang.org/x/net/html v0.38.0 0.55.0 -
golang.org/x/net CVE-2026-42506 medium Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html v0.38.0 - -
golang.org/x/net GO-2026-5025 medium Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html v0.38.0 0.55.0 -
golang.org/x/net CVE-2026-27136 medium Invoking duplicate attributes can cause XSS in golang.org/x/net/html v0.38.0 - -
golang.org/x/net CVE-2026-25681 medium Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html v0.38.0 - -
golang.org/x/net GO-2026-5029 medium Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html v0.38.0 0.55.0 -
golang.org/x/net CVE-2026-42502 medium Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html v0.38.0 - -
golang.org/x/net GO-2026-5027 medium Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html v0.38.0 0.55.0 -
golang.org/x/net CVE-2026-25681 medium Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html v0.41.0 - -
golang.org/x/net CVE-2026-42506 medium Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html v0.41.0 - -
golang.org/x/net CVE-2026-42502 medium Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html v0.41.0 - -
golang.org/x/net GO-2026-5030 medium Invoking duplicate attributes can cause XSS in golang.org/x/net/html v0.41.0 0.55.0 -
golang.org/x/net CVE-2026-27136 medium Invoking duplicate attributes can cause XSS in golang.org/x/net/html v0.41.0 - -
golang.org/x/net GO-2026-5028 medium Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html v0.41.0 0.55.0 -
golang.org/x/net GO-2026-5029 medium Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html v0.41.0 0.55.0 -
golang.org/x/net CVE-2026-25680 medium Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html v0.41.0 - -
golang.org/x/net GO-2026-5027 medium Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html v0.41.0 0.55.0 -
golang.org/x/net GO-2026-5025 medium Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html v0.41.0 0.55.0 -
golang.org/x/crypto GO-2026-5016 MODERATE Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh v0.39.0 0.52.0 -
golang.org/x/crypto GO-2026-5014 MODERATE Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh v0.39.0 0.52.0 -
golang.org/x/crypto CVE-2026-39828 MODERATE Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh v0.39.0 - -
golang.org/x/crypto GHSA-qpw4-5x99-6vjp MODERATE golang.org/x/crypto: Invoking memory leak when rejecting channels can lead to DoS v0.39.0 0.52.0 -
golang.org/x/crypto GHSA-9m57-25v3-79x9 MODERATE golang.org/x/crypto: Invoking pathological inputs can lead to client panic v0.39.0 0.52.0 -
golang.org/x/crypto CVE-2026-39827 MODERATE Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh v0.39.0 - -
golang.org/x/crypto GHSA-45gg-vh54-h5m9 MODERATE golang.org/x/crypto vulnerable to invoking bypass of certificate restrictions v0.39.0 0.52.0 -
golang.org/x/crypto GHSA-f6x5-jh6r-wrfv MODERATE golang.org/x/crypto/ssh/agent vulnerable to panic if message is malformed due to out of bounds read v0.39.0 0.45.0 -
golang.org/x/crypto GHSA-j5w8-q4qc-rx2x MODERATE golang.org/x/crypto/ssh allows an attacker to cause unbounded memory consumption v0.39.0 0.45.0 -
golang.org/x/crypto CVE-2026-39835 MODERATE Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh v0.39.0 - -
golang.org/x/crypto GO-2026-5015 MODERATE Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh v0.39.0 0.52.0 -
golang.org/x/crypto GHSA-78mq-xcr3-xm33 MODERATE golang.org/x/crypto is vulnerable to invoking server panic during CheckHostKey/Authenticate flow v0.39.0 0.52.0 -
golang.org/x/crypto CVE-2026-46598 MODERATE Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent v0.39.0 - -
golang.org/x/crypto GO-2026-5033 MODERATE Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent v0.39.0 0.52.0 -
golang.org/x/crypto CVE-2026-39835 MODERATE Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh v0.39.0 - -
golang.org/x/crypto GHSA-f6x5-jh6r-wrfv MODERATE golang.org/x/crypto/ssh/agent vulnerable to panic if message is malformed due to out of bounds read v0.39.0 0.45.0 -
golang.org/x/crypto GO-2026-5016 MODERATE Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh v0.39.0 0.52.0 -
golang.org/x/crypto GHSA-qpw4-5x99-6vjp MODERATE golang.org/x/crypto: Invoking memory leak when rejecting channels can lead to DoS v0.39.0 0.52.0 -
golang.org/x/crypto GO-2026-5033 MODERATE Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent v0.39.0 0.52.0 -
golang.org/x/crypto CVE-2026-46598 MODERATE Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent v0.39.0 - -
golang.org/x/crypto GHSA-9m57-25v3-79x9 MODERATE golang.org/x/crypto: Invoking pathological inputs can lead to client panic v0.39.0 0.52.0 -
golang.org/x/crypto CVE-2026-39827 MODERATE Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh v0.39.0 - -
golang.org/x/crypto GO-2026-5015 MODERATE Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh v0.39.0 0.52.0 -
golang.org/x/crypto GHSA-78mq-xcr3-xm33 MODERATE golang.org/x/crypto is vulnerable to invoking server panic during CheckHostKey/Authenticate flow v0.39.0 0.52.0 -
golang.org/x/crypto GHSA-j5w8-q4qc-rx2x MODERATE golang.org/x/crypto/ssh allows an attacker to cause unbounded memory consumption v0.39.0 0.45.0 -
golang.org/x/crypto GHSA-45gg-vh54-h5m9 MODERATE golang.org/x/crypto vulnerable to invoking bypass of certificate restrictions v0.39.0 0.52.0 -
golang.org/x/crypto CVE-2026-39828 MODERATE Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh v0.39.0 - -
golang.org/x/crypto GO-2026-5014 MODERATE Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh v0.39.0 0.52.0 -
golang.org/x/net GHSA-w4gw-w5jq-g9jh MODERATE golang.org/x/net/html has a Quadratic Parsing Complexity issue v0.38.0 - -
golang.org/x/net GHSA-5cv4-jp36-h3mw MODERATE Go Net HTML parser is vulnerable to denial of service v0.38.0 0.55.0 -
golang.org/x/net CVE-2026-25680 MODERATE Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html v0.38.0 - -
golang.org/x/net GO-2026-5028 MODERATE Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html v0.38.0 0.55.0 -
golang.org/x/net GO-2026-4440 MODERATE Quadratic parsing complexity in golang.org/x/net/html v0.38.0 0.45.0 -
golang.org/x/net GHSA-w4gw-w5jq-g9jh MODERATE golang.org/x/net/html has a Quadratic Parsing Complexity issue v0.41.0 - -
golang.org/x/net GHSA-5cv4-jp36-h3mw MODERATE Go Net HTML parser is vulnerable to denial of service v0.41.0 0.55.0 -
golang.org/x/net GO-2026-4440 MODERATE Quadratic parsing complexity in golang.org/x/net/html v0.41.0 0.45.0 -
golang.org/x/net GHSA-5cv4-jp36-h3mw MODERATE Go Net HTML parser is vulnerable to denial of service v0.38.0 0.55.0 -
golang.org/x/net GO-2026-5028 MODERATE Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html v0.38.0 0.55.0 -
golang.org/x/net GO-2026-4440 MODERATE Quadratic parsing complexity in golang.org/x/net/html v0.38.0 0.45.0 -
golang.org/x/net GHSA-w4gw-w5jq-g9jh MODERATE golang.org/x/net/html has a Quadratic Parsing Complexity issue v0.38.0 - -
golang.org/x/net CVE-2026-25680 MODERATE Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html v0.38.0 - -
golang.org/x/net GHSA-5cv4-jp36-h3mw MODERATE Go Net HTML parser is vulnerable to denial of service v0.41.0 0.55.0 -
golang.org/x/net GO-2026-4440 MODERATE Quadratic parsing complexity in golang.org/x/net/html v0.41.0 0.45.0 -
golang.org/x/net GHSA-w4gw-w5jq-g9jh MODERATE golang.org/x/net/html has a Quadratic Parsing Complexity issue v0.41.0 - -
golang.org/x/crypto GO-2026-5932 unknown The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues v0.39.0 - -
golang.org/x/crypto GO-2026-5932 unknown The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues v0.39.0 - -
golang.org/x/net GO-2026-4441 unknown Infinite parsing loop in golang.org/x/net v0.38.0 0.45.0 -
golang.org/x/net GO-2026-4441 unknown Infinite parsing loop in golang.org/x/net v0.41.0 0.45.0 -
golang.org/x/net GO-2026-4441 unknown Infinite parsing loop in golang.org/x/net v0.38.0 0.45.0 -
golang.org/x/net GO-2026-4441 unknown Infinite parsing loop in golang.org/x/net v0.41.0 0.45.0 -
golang.org/x/sys GO-2026-5024 unknown Invoking integer overflow in NewNTUnicodeString in golang.org/x/sys/windows v0.33.0 0.44.0 -
golang.org/x/sys GO-2026-5024 unknown Invoking integer overflow in NewNTUnicodeString in golang.org/x/sys/windows v0.33.0 0.44.0 -

Review Checklist

Standard review:

  • Review changes for compatibility with your code
  • Check for breaking changes in release notes
  • Run tests locally or wait for CI
  • Approve and merge this PR

Update Mode: all_vulns

🤖 Generated by DataDog Automated Dependency Management System

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

adms-critical-severity adms-dependency-update adms-go adms-high-severity adms-medium-severity adms-minor-update adms-mode-all-vulns campaigner-automated-change

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants