Skip to content

chore(deps): update dependency pygments to v2.20.0 [security] - #385

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/pypi-pygments-vulnerability
Open

chore(deps): update dependency pygments to v2.20.0 [security]#385
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/pypi-pygments-vulnerability

Conversation

@renovate

@renovate renovate Bot commented Mar 29, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Update Change OpenSSF
Pygments (changelog) minor ==2.19.2 → ==2.20.0 OpenSSF Scorecard

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Pygments has Regular Expression Denial of Service (ReDoS) due to Inefficient Regex for GUID Matching

CVE-2026-4539 / GHSA-5239-wwwm-4pmq / PYSEC-2026-2987

More information

Details

A security flaw has been discovered in pygments before 2.20.0. The impacted element is the function AdlLexer of the file pygments/lexers/archetype.py. The manipulation results in inefficient regular expression complexity. The attack is only possible with local access. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

Severity

  • CVSS Score: 1.9 / 10 (Low)
  • Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Pygments has Regular Expression Denial of Service (ReDoS) due to Inefficient Regex for GUID Matching

CVE-2026-4539 / GHSA-5239-wwwm-4pmq / PYSEC-2026-2987

More information

Details

A security flaw has been discovered in pygments before 2.20.0. The impacted element is the function AdlLexer of the file pygments/lexers/archetype.py. The manipulation results in inefficient regular expression complexity. The attack is only possible with local access. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

Severity

  • CVSS Score: 1.9 / 10 (Low)
  • Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P

References

This data is provided by OSV and the PyPI Advisory Database (CC-BY 4.0).

Release Notes

pygments/pygments (Pygments)

v2.20.0

Compare Source

(released March 29th, 2026)

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot added the t:security label Mar 29, 2026
@renovate
renovate Bot requested a review from Djaytan as a code owner March 29, 2026 17:21
@renovate renovate Bot added the t:security label Mar 29, 2026
@sonarqubecloud

sonarqubecloud Bot commented Mar 29, 2026

Copy link
Copy Markdown

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

@github-actions

github-actions Bot commented Mar 29, 2026 •
edited
Loading

Copy link
Copy Markdown

Overview

Image reference djaytan/papermc-server:1.21.11 djaytan/papermc-server:test
- digest 5a306e36683d 0f5f372484a2
- tag 1.21.11 test
- stream latest
- vulnerabilities critical: 6 high: 44 medium: 48 low: 8 unspecified: 5 critical: 6 high: 51 medium: 51 low: 9 unspecified: 5
- platform linux/amd64 linux/amd64
- size 82 MB 147 MB (+65 MB)
- packages 93 176 (+83)
Base Image alpine:3
also known as:
• 3.23
• latest		 alpine:3
also known as:
• 3.23
• latest
- vulnerabilities critical: 2 high: 14 medium: 7 low: 3 critical: 2 high: 14 medium: 7 low: 3
Policies (1 improved, 1 worsened, 3 missing data)
Policy Name djaytan/papermc-server:1.21.11 djaytan/papermc-server:test Change Standing
No unapproved base images ⚠️ 1 ❓ No data
Default non-root user ✅ ✅ No Change
No AGPL v3 licenses ✅ ✅ No Change
No fixable critical or high vulnerabilities ⚠️ 63 ⚠️ 57 -6 Improved
No high-profile vulnerabilities ✅ ✅ No Change
No outdated base images ✅ ❓ No data
SonarQube quality gates passed ❓ No data ❓ No data
Supply chain attestations ✅ ⚠️ 2 +2 Worsened
Packages and Vulnerabilities (107 package changes and 11 vulnerability changes)
  • ➕ 93 packages added
  • ➖ 12 packages removed
  • ♾️ 2 packages changed
  • 76 packages unchanged
  • ❗ 11 vulnerabilities added
Changes for packages of type apk (9 changes)
Package Version
djaytan/papermc-server:1.21.11		 Version
djaytan/papermc-server:test
➕ alpine-base 3.23.3-r0
➕ ca-certificates 20251003-r0
➕ gcc 15.2.0-r2
♾️ libxml2 2.13.9-r1 2.13.9-r0
critical: 0 high: 0 medium: 0 low: 2 unspecified: 1 critical: 0 high: 0 medium: 1 low: 2 unspecified: 1
Added vulnerabilities (1):
  • medium : CVE--2026--6732
➕ ncurses 6.5_p20251123-r0
➕ openssl 3.5.5-r0
critical: 2 high: 13 medium: 5 low: 2
Added vulnerabilities (22):
  • critical : CVE--2026--31789
  • critical : CVE--2026--34182
  • high : CVE--2026--45447
  • high : CVE--2026--7383
  • high : CVE--2026--28387
  • high : CVE--2026--9076
  • high : CVE--2026--45445
  • high : CVE--2026--42764
  • high : CVE--2026--34183
  • high : CVE--2026--34180
  • high : CVE--2026--31790
  • high : CVE--2026--28390
  • high : CVE--2026--28389
  • high : CVE--2026--28388
  • high : CVE--2026--34181
  • medium : CVE--2026--2673
  • medium : CVE--2026--42767
  • medium : CVE--2026--42766
  • medium : CVE--2026--42769
  • medium : CVE--2026--45446
  • low : CVE--2026--42770
  • low : CVE--2026--42768
➕ pax-utils 1.3.8-r2
➕ xz 5.8.2-r0
critical: 0 high: 0 medium: 0 low: 1
Added vulnerabilities (1):
  • low : CVE--2026--34743
♾️ xz-libs 5.8.3-r0 5.8.2-r0
Changes for packages of type generic (2 changes)
Package Version
djaytan/papermc-server:1.21.11		 Version
djaytan/papermc-server:test
➖ openjdk 21.0.10
➕ openjdk 21.0.10
Changes for packages of type golang (20 changes)
Package Version
djaytan/papermc-server:1.21.11		 Version
djaytan/papermc-server:test
➕ cuelabs.dev/go/oci/ociregistry 0.0.0-20250304105642-27e071d2c9b1
➖ cuelabs.dev/go/oci/ociregistry 0.0.0-20250304105642-27e071d2c9b1
➖ github.com/cenkalti/backoff/v5 5.0.3
➕ github.com/cenkalti/backoff/v5 5.0.3
➕ github.com/cespare/xxhash/v2 2.3.0
➖ github.com/cespare/xxhash/v2 2.3.0
➕ github.com/cockroachdb/apd/v3 3.2.1
➖ github.com/cockroachdb/apd/v3 3.2.1
➕ github.com/grpc-ecosystem/grpc-gateway/v2 2.27.7
➖ github.com/grpc-ecosystem/grpc-gateway/v2 2.27.7
➕ github.com/pelletier/go-toml/v2 2.2.4
➖ github.com/pelletier/go-toml/v2 2.2.4
➕ go.opentelemetry.io/contrib/instrumentation/runtime 0.65.0
➖ go.opentelemetry.io/contrib/instrumentation/runtime 0.65.0
➖ go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc 1.40.0
➕ go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc 1.40.0
➖ go.opentelemetry.io/otel/sdk/metric 1.40.0
➖ google.golang.org/genproto/googleapis/api 0.0.0-20260203192932-546029d2fa20
➕ google.golang.org/genproto/googleapis/rpc 0.0.0-20260203192932-546029d2fa20
➖ google.golang.org/genproto/googleapis/rpc 0.0.0-20260203192932-546029d2fa20
Changes for packages of type maven (76 changes)
Package Version
djaytan/papermc-server:1.21.11		 Version
djaytan/papermc-server:test
➕ AutoRenamingTool/AutoRenamingTool 2.0.3
➕ ansi/ansi 1.1.1
➕ asm-utils/asm-utils 0.0.3
➕ cli-utils/cli-utils 2.1.4
➕ com.google.errorprone/error_prone_annotations 2.41.0
➕ com.google.guava/listenablefuture 9999.0-empty-to-avoid-conflict-with-guava
➕ com.google.j2objc/j2objc-annotations 3.1
➕ com.google.protobuf/protobuf-java 4.29.0
➕ com.googlecode.json-simple/json-simple 1.1.1
➕ com.lmax.disruptor/disruptor 3.4.4
➕ com.mysql/mysql-connector-j 9.2.0
➕ commons-codec/commons-codec 1.16.0
➕ commons-lang/commons-lang 2.6
critical: 0 high: 0 medium: 1 low: 0
Added vulnerabilities (1):
  • medium : CVE--2025--48924
➕ concurrentutil/concurrentutil 0.0.8
➕ examination-api/examination-api 1.3.0
➕ examination-string/examination-string 1.3.0
➕ gson-io/gson-io 2.0.17
➕ io.leangen.geantyref/geantyref 1.3.16
➕ io.netty/netty-codec-haproxy 4.2.7.Final
critical: 0 high: 2 medium: 0 low: 0
Added vulnerabilities (2):
  • high : CVE--2026--48059
  • high : CVE--2026--44893
➕ io.papermc.paperclip.Main/papermc-server 1.21.11-69
➕ io.sigpipe/jbsdiff 1.0
➕ net.kyori.adventure.key/adventure-key 4.25.0
➕ net.kyori.adventure.text.logger.slf4j/adventure-text-logger-slf4j 4.25.0
➕ net.kyori.adventure.text.minimessage/adventure-text-minimessage 4.25.0
➕ net.kyori.adventure.text.serializer.ansi/adventure-text-serializer-ansi 4.25.0
➕ net.kyori.adventure.text.serializer.constant/adventure-text-serializer-commons 4.25.0
➕ net.kyori.adventure.text.serializer.gson/adventure-text-serializer-gson 4.25.0
➕ net.kyori.adventure.text.serializer.json/adventure-text-serializer-json 4.25.0
➕ net.kyori.adventure.text.serializer.legacy/adventure-text-serializer-legacy 4.25.0
➕ net.kyori.adventure.text.serializer.plain/adventure-text-serializer-plain 4.25.0
➕ net.kyori.adventure/adventure-api 4.25.0
➕ net.md-5/bungeecord-chat 1.21-R0.2
➕ net.minecrell.terminalconsole/terminalconsoleappender 1.3.0
➕ option/option 1.1.0
➕ org.apache.commons/commons-compress 1.5
critical: 0 high: 4 medium: 1 low: 0
Added vulnerabilities (5):
  • high : CVE--2021--36090
  • high : CVE--2021--35517
  • high : CVE--2021--35516
  • high : CVE--2021--35515
  • medium : CVE--2024--25710
➕ org.apache.httpcomponents/httpclient 4.5.14
➕ org.apache.httpcomponents/httpcore 4.4.16
➕ org.apache.logging.log4j/log4j-iostreams 2.24.1
➕ org.apache.maven.resolver/maven-resolver-api 1.9.18
➕ org.apache.maven.resolver/maven-resolver-connector-basic 1.9.18
➕ org.apache.maven.resolver/maven-resolver-impl 1.9.18
➕ org.apache.maven.resolver/maven-resolver-named-locks 1.9.18
➕ org.apache.maven.resolver/maven-resolver-spi 1.9.18
➕ org.apache.maven.resolver/maven-resolver-transport-http 1.9.18
➕ org.apache.maven.resolver/maven-resolver-util 1.9.18
➕ org.apache.maven/maven-artifact 3.9.6
➕ org.apache.maven/maven-builder-support 3.9.6
➕ org.apache.maven/maven-model 3.9.6
➕ org.apache.maven/maven-model-builder 3.9.6
➕ org.apache.maven/maven-repository-metadata 3.9.6
➕ org.apache.maven/maven-resolver-provider 3.9.6
➕ org.bukkit/paper-api 1.21.11-R0.1-SNAPSHOT
➕ org.codehaus.plexus/plexus-interpolation 1.26
➕ org.codehaus.plexus/plexus-utils 3.5.1
critical: 0 high: 1 medium: 0 low: 0
Added vulnerabilities (1):
  • high : CVE--2025--67030
➕ org.eclipse.sisu/org.eclipse.sisu.inject 0.9.0.M2
➕ org.jline/jline-native 3.27.1
➕ org.jline/jline-reader 3.20.0
➕ org.jline/jline-terminal 3.27.1
➕ org.jline/jline-terminal-ffm 3.27.1
➕ org.jline/jline-terminal-jni 3.27.1
➕ org.objectweb.asm.commons/asm-commons 9.8
➕ org.objectweb.asm.tree/asm-tree 9.8
➕ org.objectweb.asm/asm 9.8
➕ org.slf4j/jcl-over-slf4j 1.7.36
➕ org.spongepowered.configurate.yaml/configurate-yaml 4.2.0
➕ org.spongepowered.configurate/configurate-core 4.2.0
➕ org.xerial/sqlite-jdbc 3.49.1.0
➕ org.yaml/snakeyaml 2.2
➕ reflection-rewriter-proxy-generator/reflection-rewriter-proxy-generator 0.0.3
➕ reflection-rewriter-runtime/reflection-rewriter-runtime 0.0.3
➕ reflection-rewriter/reflection-rewriter 0.0.3
➕ spark-api/spark-api 0.1-20240720.200737-2
➕ spark-paper/spark-paper 1.10.152
➕ spec/spec 2.0.17
➕ srgutils/srgutils 1.0.9
➕ velocity-native/velocity-native 3.4.0-SNAPSHOT

@github-actions

github-actions Bot commented Mar 29, 2026 •
edited
Loading

Copy link
Copy Markdown

🔍 Vulnerabilities of djaytan/papermc-server:test

📦 Image Reference djaytan/papermc-server:test
digestsha256:0f5f372484a22afed7ef08e101d9f9db9264054f6c83797a46360ad761a3c8a1
vulnerabilitiescritical: 6 high: 51 medium: 51 low: 9 unspecified: 5
platformlinux/amd64
size147 MB
packages176
📦 Base Image alpine:3
also known as
  • 3.23
  • 3.23.3
  • latest
digestsha256:59855d3dceb3ae53991193bd03301e082b2a7faa56a514b03527ae0ec2ce3a95
vulnerabilitiescritical: 2 high: 14 medium: 7 low: 3
critical: 2 high: 13 medium: 5 low: 2 openssl 3.5.5-r0 (apk)

pkg:apk/alpine/openssl@3.5.5-r0?os_name=alpine&os_version=3.23

critical : CVE--2026--31789

Affected range<3.5.6-r0
Fixed version3.5.6-r0
EPSS Score0.225%
EPSS Percentile13th percentile
Description

critical : CVE--2026--34182

Affected range<3.5.7-r0
Fixed version3.5.7-r0
EPSS Score0.237%
EPSS Percentile15th percentile
Description

high : CVE--2026--45447

Affected range<3.5.7-r0
Fixed version3.5.7-r0
EPSS Score2.719%
EPSS Percentile84th percentile
Description

high : CVE--2026--7383

Affected range<3.5.7-r0
Fixed version3.5.7-r0
EPSS Score0.358%
EPSS Percentile28th percentile
Description

high : CVE--2026--28387

Affected range<3.5.6-r0
Fixed version3.5.6-r0
EPSS Score0.755%
EPSS Percentile51st percentile
Description

high : CVE--2026--9076

Affected range<3.5.7-r0
Fixed version3.5.7-r0
EPSS Score0.297%
EPSS Percentile22nd percentile
Description

high : CVE--2026--45445

Affected range<3.5.7-r0
Fixed version3.5.7-r0
EPSS Score0.320%
EPSS Percentile24th percentile
Description

high : CVE--2026--42764

Affected range<3.5.7-r0
Fixed version3.5.7-r0
EPSS Score0.684%
EPSS Percentile48th percentile
Description

high : CVE--2026--34183

Affected range<3.5.7-r0
Fixed version3.5.7-r0
EPSS Score0.511%
EPSS Percentile40th percentile
Description

high : CVE--2026--34180

Affected range<3.5.7-r0
Fixed version3.5.7-r0
EPSS Score0.513%
EPSS Percentile40th percentile
Description

high : CVE--2026--31790

Affected range<3.5.6-r0
Fixed version3.5.6-r0
EPSS Score0.981%
EPSS Percentile58th percentile
Description

high : CVE--2026--28390

Affected range<3.5.6-r0
Fixed version3.5.6-r0
EPSS Score0.805%
EPSS Percentile53rd percentile
Description

high : CVE--2026--28389

Affected range<3.5.6-r0
Fixed version3.5.6-r0
EPSS Score1.027%
EPSS Percentile60th percentile
Description

high : CVE--2026--28388

Affected range<3.5.6-r0
Fixed version3.5.6-r0
EPSS Score1.059%
EPSS Percentile61st percentile
Description

high : CVE--2026--34181

Affected range<3.5.7-r0
Fixed version3.5.7-r0
EPSS Score0.196%
EPSS Percentile9th percentile
Description

medium : CVE--2026--2673

Affected range<3.5.6-r0
Fixed version3.5.6-r0
EPSS Score0.435%
EPSS Percentile35th percentile
Description

medium : CVE--2026--42767

Affected range<3.5.7-r0
Fixed version3.5.7-r0
EPSS Score0.349%
EPSS Percentile27th percentile
Description

medium : CVE--2026--42766

Affected range<3.5.7-r0
Fixed version3.5.7-r0
EPSS Score0.595%
EPSS Percentile44th percentile
Description

medium : CVE--2026--42769

Affected range<3.5.7-r0
Fixed version3.5.7-r0
EPSS Score0.262%
EPSS Percentile18th percentile
Description

medium : CVE--2026--45446

Affected range<3.5.7-r0
Fixed version3.5.7-r0
EPSS Score0.210%
EPSS Percentile11th percentile
Description

low : CVE--2026--42770

Affected range<3.5.7-r0
Fixed version3.5.7-r0
EPSS Score0.259%
EPSS Percentile17th percentile
Description

low : CVE--2026--42768

Affected range<3.5.7-r0
Fixed version3.5.7-r0
EPSS Score0.350%
EPSS Percentile27th percentile
Description
critical: 1 high: 16 medium: 19 low: 1 unspecified: 2stdlib 1.24.4 (golang)

pkg:golang/stdlib@1.24.4

critical : CVE--2025--68121

Affected range<1.24.13
Fixed version1.24.13
EPSS Score0.765%
EPSS Percentile51st percentile
Description

During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed handshake may succeed when it should have failed. This may happen when a user calls Config.Clone and mutates the returned Config, or uses Config.GetConfigForClient. This can cause a client to resume a session with a server that it would not have resumed with during the initial handshake, or cause a server to resume a session with a client that it would not have resumed with during the initial handshake.

high : CVE--2026--42504

Affected range<1.25.11
Fixed version1.25.11
EPSS Score0.560%
EPSS Percentile43rd percentile
Description

Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU.

high : CVE--2026--42499

Affected range<1.25.10
Fixed version1.25.10
EPSS Score0.798%
EPSS Percentile52nd percentile
Description

Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322.

high : CVE--2026--39836

Affected range<1.25.10
Fixed version1.25.10
EPSS Score0.588%
EPSS Percentile44th percentile
Description

The Dial and LookupPort functions panic on Windows when provided with an input containing a NUL (0).

high : CVE--2026--39820

Affected range<1.25.10
Fixed version1.25.10
EPSS Score0.784%
EPSS Percentile52nd percentile
Description

Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations.

high : CVE--2026--33814

Affected range<1.25.10
Fixed version1.25.10
EPSS Score0.781%
EPSS Percentile52nd percentile
Description

When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.

high : CVE--2026--33811

Affected range<1.25.10
Fixed version1.25.10
EPSS Score0.813%
EPSS Percentile53rd percentile
Description

When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash.

high : CVE--2026--32283

Affected range<1.25.9
Fixed version1.25.9
EPSS Score0.621%
EPSS Percentile46th percentile
Description

If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled consumption of resources. This can lead to a denial of service.

This only affects TLS 1.3.

high : CVE--2026--32281

Affected range<1.25.9
Fixed version1.25.9
EPSS Score0.349%
EPSS Percentile27th percentile
Description

Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service.

This only affects validation of otherwise trusted certificate chains, issued by a root CA in the VerifyOptions.Roots CertPool, or in the system certificate pool.

high : CVE--2026--32280

Affected range<1.25.9
Fixed version1.25.9
EPSS Score0.615%
EPSS Percentile45th percentile
Description

During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of service. This affects both direct users of crypto/x509 and users of crypto/tls.

high : CVE--2026--25679

Affected range<1.25.8
Fixed version1.25.8
EPSS Score0.728%
EPSS Percentile50th percentile
Description

url.Parse insufficiently validated the host/authority component and accepted some invalid URLs.

high : CVE--2025--61729

Affected range<1.24.11
Fixed version1.24.11
EPSS Score0.459%
EPSS Percentile37th percentile
Description

Within HostnameError.Error(), when constructing an error string, there is no limit to the number of hosts that will be printed out. Furthermore, the error string is constructed by repeated string concatenation, leading to quadratic runtime. Therefore, a certificate provided by a malicious actor can result in excessive resource consumption.

high : CVE--2025--61726

Affected range<1.24.12
Fixed version1.24.12
EPSS Score1.945%
EPSS Percentile78th percentile
Description

The net/url package does not set a limit on the number of query parameters in a query.

While the maximum size of query parameters in URLs is generally limited by the maximum request header size, the net/http.Request.ParseForm method can parse large URL-encoded forms. Parsing a large form containing many unique query parameters can cause excessive memory consumption.

high : CVE--2025--61725

Affected range<1.24.8
Fixed version1.24.8
EPSS Score0.613%
EPSS Percentile45th percentile
Description

The ParseAddress function constructs domain-literal address components through repeated string concatenation. When parsing large domain-literal components, this can cause excessive CPU consumption.

high : CVE--2025--61723

Affected range<1.24.8
Fixed version1.24.8
EPSS Score0.626%
EPSS Percentile46th percentile
Description

The processing time for parsing some invalid inputs scales non-linearly with respect to the size of the input.

This affects programs which parse untrusted PEM inputs.

high : CVE--2025--58188

Affected range<1.24.8
Fixed version1.24.8
EPSS Score0.361%
EPSS Percentile28th percentile
Description

Validating certificate chains which contain DSA public keys can cause programs to panic, due to a interface cast that assumes they implement the Equal method.

This affects programs which validate arbitrary certificate chains.

high : CVE--2025--58187

Affected range<1.24.9
Fixed version1.24.9
EPSS Score0.384%
EPSS Percentile31st percentile
Description

Due to the design of the name constraint checking algorithm, the processing time of some inputs scale non-linearly with respect to the size of the certificate.

This affects programs which validate arbitrary certificate chains.

medium : CVE--2026--27145

Affected range<1.25.11
Fixed version1.25.11
EPSS Score0.939%
EPSS Percentile57th percentile
Description

(*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries. This caused strings.Split(host, ".") to execute repeatedly on the same input hostname.

With a large DNS SAN list, verification costs scaled quadratically based on the number of SAN entries multiplied by the hostname's label count. Because x509.Verify validates hostnames before building the certificate chain, this overhead occurred even for untrusted certificates.

medium : CVE--2025--61728

Affected range<1.24.12
Fixed version1.24.12
EPSS Score0.643%
EPSS Percentile47th percentile
Description

archive/zip uses a super-linear file name indexing algorithm that is invoked the first time a file in an archive is opened. This can lead to a denial of service when consuming a maliciously constructed ZIP archive.

medium : CVE--2025--61727

Affected range<1.24.11
Fixed version1.24.11
EPSS Score0.274%
EPSS Percentile19th percentile
Description

An excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate. For example a constraint that excludes the subdomain test.example.com does not prevent a leaf certificate from claiming the SAN *.example.com.

medium : CVE--2025--47906

Affected range>=1.24.0
<1.24.6
Fixed version1.24.6
EPSS Score0.489%
EPSS Percentile39th percentile
Description

If the PATH environment variable contains paths which are executables (rather than just directories), passing certain strings to LookPath ("", ".", and ".."), can result in the binaries listed in the PATH being unexpectedly returned.

medium : CVE--2026--32282

Affected range<1.25.9
Fixed version1.25.9
EPSS Score0.292%
EPSS Percentile21st percentile
Description

On Linux, if the target of Root.Chmod is replaced with a symlink while the chmod operation is in progress, Chmod can operate on the target of the symlink, even when the target lies outside the root.

The Linux fchmodat syscall silently ignores the AT_SYMLINK_NOFOLLOW flag, which Root.Chmod uses to avoid symlink traversal. Root.Chmod checks its target before acting and returns an error if the target is a symlink lying outside the root, so the impact is limited to cases where the target is replaced with a symlink between the check and operation.

medium : CVE--2026--39826

Affected range<1.25.10
Fixed version1.25.10
EPSS Score0.371%
EPSS Percentile29th percentile
Description

If a trusted template author were to write a <script> tag containing an empty 'type' attribute or a 'type' attribute with an ASCII whitespace, the execution of the template would incorrectly escape any data passed into the <script> block.

medium : CVE--2026--39823

Affected range<1.25.10
Fixed version1.25.10
EPSS Score0.314%
EPSS Percentile23rd percentile
Description

CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a tag's attribute. If the URL content were to insert ASCII whitespaces around the '=' rune inside of the attribute, the escaper would fail to similarly escape it, leading to XSS.

medium : CVE--2026--32289

Affected range<1.25.9
Fixed version1.25.9
EPSS Score0.290%
EPSS Percentile21st percentile
Description

Context was not properly tracked across template branches for JS template literals, leading to possibly incorrect escaping of content when branches were used. Additionally template actions within JS template literals did not properly track the brace depth, leading to incorrect escaping being applied.

These issues could cause actions within JS template literals to be incorrectly or improperly escaped, leading to XSS vulnerabilities.

medium : CVE--2026--27142

Affected range<1.25.8
Fixed version1.25.8
EPSS Score0.328%
EPSS Percentile25th percentile
Description

Actions which insert URLs into the content attribute of HTML meta tags are not escaped. This can allow XSS if the meta tag also has an http-equiv attribute with the value "refresh".

A new GODEBUG setting has been added, htmlmetacontenturlescape, which can be used to disable escaping URLs in actions in the meta content attribute which follow "url=" by setting htmlmetacontenturlescape=0.

medium : CVE--2026--32288

Affected range<1.25.9
Fixed version1.25.9
EPSS Score0.290%
EPSS Percentile21st percentile
Description

tar.Reader can allocate an unbounded amount of memory when reading a maliciously-crafted archive containing a large number of sparse regions encoded in the "old GNU sparse map" format.

medium : CVE--2026--42507

Affected range<1.25.11
Fixed version1.25.11
EPSS Score0.370%
EPSS Percentile29th percentile
Description

When returning errors, functions in the net/textproto package would include its input as part of the error. This might allow an attacker to inject misleading content to errors that are printed or logged.

medium : CVE--2026--39825

Affected range<1.25.10
Fixed version1.25.10
EPSS Score0.390%
EPSS Percentile31st percentile
Description

ReverseProxy can forward queries containing parameters not visible to Rewrite functions.

When used with a Rewrite function, or a Director function which parses query parameters, ReverseProxy sanitizes the forwarded request to remove query parameters which are not parsed by url.ParseQuery. ReverseProxy does not take ParseQuery's limit on the total number of query parameters (controlled by GODEBUG=urlmaxqueryparams=N) into account. This can permit ReverseProxy to forward a request containing a query parameter that is not visible to the Rewrite function.

For example, the query "a1=x&a2=x&...&a10000=x&hidden=y" can forward the parameter "hidden=y" while hiding it from the proxy's Rewrite function.

medium : CVE--2025--61730

Affected range<1.24.12
Fixed version1.24.12
EPSS Score0.276%
EPSS Percentile20th percentile
Description

During the TLS 1.3 handshake if multiple messages are sent in records that span encryption level boundaries (for instance the Client Hello and Encrypted Extensions messages), the subsequent messages may be processed before the encryption level changes. This can cause some minor information disclosure if a network-local attacker can inject messages during the handshake.

medium : CVE--2025--61724

Affected range<1.24.8
Fixed version1.24.8
EPSS Score0.526%
EPSS Percentile41st percentile
Description

The Reader.ReadResponse function constructs a response string through repeated string concatenation of lines. When the number of lines in a response is large, this can cause excessive CPU consumption.

medium : CVE--2025--58189

Affected range<1.24.8
Fixed version1.24.8
EPSS Score0.443%
EPSS Percentile36th percentile
Description

When Conn.Handshake fails during ALPN negotiation the error contains attacker controlled information (the ALPN protocols sent by the client) which is not escaped.

medium : CVE--2025--58186

Affected range<1.24.8
Fixed version1.24.8
EPSS Score0.534%
EPSS Percentile42nd percentile
Description

Despite HTTP headers having a default limit of 1MB, the number of cookies that can be parsed does not have a limit. By sending a lot of very small cookies such as "a=;", an attacker can make an HTTP server allocate a large amount of structs, causing large memory consumption.

medium : CVE--2025--58185

Affected range<1.24.8
Fixed version1.24.8
EPSS Score0.526%
EPSS Percentile41st percentile
Description

Parsing a maliciously crafted DER payload could allocate large amounts of memory, causing memory exhaustion.

medium : CVE--2025--47912

Affected range<1.24.8
Fixed version1.24.8
EPSS Score0.443%
EPSS Percentile36th percentile
Description

The Parse function permits values other than IPv6 addresses to be included in square brackets within the host component of a URL. RFC 3986 permits IPv6 addresses to be included within the host component, enclosed within square brackets. For example: "http://[::1]/". IPv4 addresses and hostnames must not appear within square brackets. Parse did not enforce this requirement.

medium : CVE--2025--58183

Affected range<1.24.8
Fixed version1.24.8
EPSS Score0.419%
EPSS Percentile34th percentile
Description

tar.Reader does not set a maximum size on the number of sparse region data blocks in GNU tar pax 1.0 sparse files. A maliciously-crafted archive containing a large number of sparse regions can cause a Reader to read an unbounded amount of data from the archive into memory. When reading from a compressed source, a small compressed input can result in large allocations.

low : CVE--2026--27139

Affected range<1.25.8
Fixed version1.25.8
EPSS Score0.201%
EPSS Percentile10th percentile
Description

On Unix platforms, when listing the contents of a directory using File.ReadDir or File.Readdir the returned FileInfo could reference a file outside of the Root in which the File was opened.

The impact of this escape is limited to reading metadata provided by lstat from arbitrary locations on the filesystem without permitting reading or writing files outside the root.

unspecified : CVE--2026--42505

Affected range<1.25.12
Fixed version1.25.12
EPSS Score0.413%
EPSS Percentile33rd percentile
Description

Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello.

unspecified : CVE--2026--39822

Affected range<1.25.12
Fixed version1.25.12
EPSS Score0.183%
EPSS Percentile8th percentile
Description

On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /.

For example, 'root.Open("symlink/")' will open "symlink" even when "symlink" is a symbolic link pointing outside of the root.

critical: 1 high: 1 medium: 7 low: 0 golang.org/x/net 0.39.0 (golang)

pkg:golang/golang.org/x/net@0.39.0

critical : CVE--2026--39821

Affected range<0.55.0
Fixed version0.55.0
EPSS Score0.478%
EPSS Percentile38th percentile
Description

The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error.

This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject "example.com" but permit "xn--example-.com". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name "example.com".

high : CVE--2026--33814

Affected range<0.53.0
Fixed version0.53.0
EPSS Score0.781%
EPSS Percentile52nd percentile
Description

When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.

medium 6.5: CVE--2026--25680 Uncontrolled Resource Consumption

Affected range<0.55.0
Fixed version0.55.0
CVSS Score6.5
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
EPSS Score0.248%
EPSS Percentile16th percentile
Description

In Go Net (golang.org/x/net) before verion 0.55.0, parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service.

medium : CVE--2026--42506

Affected range<0.55.0
Fixed version0.55.0
EPSS Score0.188%
EPSS Percentile9th percentile
Description

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

medium : CVE--2026--42502

Affected range<0.55.0
Fixed version0.55.0
EPSS Score0.178%
EPSS Percentile7th percentile
Description

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

medium : CVE--2026--27136

Affected range<0.55.0
Fixed version0.55.0
EPSS Score0.178%
EPSS Percentile7th percentile
Description

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

medium : CVE--2026--25681

Affected range<0.55.0
Fixed version0.55.0
EPSS Score0.178%
EPSS Percentile7th percentile
Description

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

medium : CVE--2025--58190

Affected range<0.45.0
Fixed version0.45.0
EPSS Score0.482%
EPSS Percentile38th percentile
Description

The html.Parse function in golang.org/x/net/html has an infinite parsing loop when processing certain inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content.

medium : CVE--2025--47911

Affected range<0.45.0
Fixed version0.45.0
EPSS Score0.502%
EPSS Percentile40th percentile
Description

The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when processing certain inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content.

critical: 1 high: 1 medium: 5 low: 0 golang.org/x/net 0.49.0 (golang)

pkg:golang/golang.org/x/net@0.49.0

critical : CVE--2026--39821

Affected range<0.55.0
Fixed version0.55.0
EPSS Score0.478%
EPSS Percentile38th percentile
Description

The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error.

This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject "example.com" but permit "xn--example-.com". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name "example.com".

high : CVE--2026--33814

Affected range<0.53.0
Fixed version0.53.0
EPSS Score0.781%
EPSS Percentile52nd percentile
Description

When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.

medium 6.5: CVE--2026--25680 Uncontrolled Resource Consumption

Affected range<0.55.0
Fixed version0.55.0
CVSS Score6.5
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
EPSS Score0.248%
EPSS Percentile16th percentile
Description

In Go Net (golang.org/x/net) before verion 0.55.0, parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service.

medium : CVE--2026--42506

Affected range<0.55.0
Fixed version0.55.0
EPSS Score0.188%
EPSS Percentile9th percentile
Description

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

medium : CVE--2026--42502

Affected range<0.55.0
Fixed version0.55.0
EPSS Score0.178%
EPSS Percentile7th percentile
Description

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

medium : CVE--2026--27136

Affected range<0.55.0
Fixed version0.55.0
EPSS Score0.178%
EPSS Percentile7th percentile
Description

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

medium : CVE--2026--25681

Affected range<0.55.0
Fixed version0.55.0
EPSS Score0.178%
EPSS Percentile7th percentile
Description

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

critical: 1 high: 0 medium: 0 low: 0 google.golang.org/grpc 1.78.0 (golang)

pkg:golang/google.golang.org/grpc@1.78.0

critical 9.1: CVE--2026--33186 Improper Authorization

Affected range<1.79.3
Fixed version1.79.3
CVSS Score9.1
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
EPSS Score1.557%
EPSS Percentile72nd percentile
Description

Impact

What kind of vulnerability is it? Who is impacted?

It is an Authorization Bypass resulting from Improper Input Validation of the HTTP/2 :path pseudo-header.

The gRPC-Go server was too lenient in its routing logic, accepting requests where the :path omitted the mandatory leading slash (e.g., Service/Method instead of /Service/Method). While the server successfully routed these requests to the correct handler, authorization interceptors (including the official grpc/authz package) evaluated the raw, non-canonical path string. Consequently, "deny" rules defined using canonical paths (starting with /) failed to match the incoming request, allowing it to bypass the policy if a fallback "allow" rule was present.

Who is impacted?
This affects gRPC-Go servers that meet both of the following criteria:

  1. They use path-based authorization interceptors, such as the official RBAC implementation in google.golang.org/grpc/authz or custom interceptors relying on info.FullMethod or grpc.Method(ctx).
  2. Their security policy contains specific "deny" rules for canonical paths but allows other requests by default (a fallback "allow" rule).

The vulnerability is exploitable by an attacker who can send raw HTTP/2 frames with malformed :path headers directly to the gRPC server.

Patches

Has the problem been patched? What versions should users upgrade to?

Yes, the issue has been patched. The fix ensures that any request with a :path that does not start with a leading slash is immediately rejected with a codes.Unimplemented error, preventing it from reaching authorization interceptors or handlers with a non-canonical path string.

Users should upgrade to the following versions (or newer):

  • v1.79.3
  • The latest master branch.

It is recommended that all users employing path-based authorization (especially grpc/authz) upgrade as soon as the patch is available in a tagged release.

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

While upgrading is the most secure and recommended path, users can mitigate the vulnerability using one of the following methods:

1. Use a Validating Interceptor (Recommended Mitigation)

Add an "outermost" interceptor to your server that validates the path before any other authorization logic runs:

func pathValidationInterceptor(ctx context.Context, req any, info *grpc.UnaryServerInfo, handler grpc.UnaryHandler) (any, error) {
    if info.FullMethod == "" || info.FullMethod[0] != '/' {
        return nil, status.Errorf(codes.Unimplemented, "malformed method name")
    }   
    return handler(ctx, req)
}

// Ensure this is the FIRST interceptor in your chain
s := grpc.NewServer(
    grpc.ChainUnaryInterceptor(pathValidationInterceptor, authzInterceptor),
)

2. Infrastructure-Level Normalization

If your gRPC server is behind a reverse proxy or load balancer (such as Envoy, NGINX, or an L7 Cloud Load Balancer), ensure it is configured to enforce strict HTTP/2 compliance for pseudo-headers and reject or normalize requests where the :path header does not start with a leading slash.

3. Policy Hardening

Switch to a "default deny" posture in your authorization policies (explicitly listing all allowed paths and denying everything else) to reduce the risk of bypasses via malformed inputs.

critical: 0 high: 10 medium: 9 low: 1 unspecified: 2stdlib 1.25.7 (golang)

pkg:golang/stdlib@1.25.7

high : CVE--2026--42504

Affected range<1.25.11
Fixed version1.25.11
EPSS Score0.560%
EPSS Percentile43rd percentile
Description

Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU.

high : CVE--2026--42499

Affected range<1.25.10
Fixed version1.25.10
EPSS Score0.798%
EPSS Percentile52nd percentile
Description

Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322.

high : CVE--2026--39836

Affected range<1.25.10
Fixed version1.25.10
EPSS Score0.588%
EPSS Percentile44th percentile
Description

The Dial and LookupPort functions panic on Windows when provided with an input containing a NUL (0).

high : CVE--2026--39820

Affected range<1.25.10
Fixed version1.25.10
EPSS Score0.784%
EPSS Percentile52nd percentile
Description

Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations.

high : CVE--2026--33814

Affected range<1.25.10
Fixed version1.25.10
EPSS Score0.781%
EPSS Percentile52nd percentile
Description

When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.

high : CVE--2026--33811

Affected range<1.25.10
Fixed version1.25.10
EPSS Score0.813%
EPSS Percentile53rd percentile
Description

When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash.

high : CVE--2026--32283

Affected range<1.25.9
Fixed version1.25.9
EPSS Score0.621%
EPSS Percentile46th percentile
Description

If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled consumption of resources. This can lead to a denial of service.

This only affects TLS 1.3.

high : CVE--2026--32281

Affected range<1.25.9
Fixed version1.25.9
EPSS Score0.349%
EPSS Percentile27th percentile
Description

Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service.

This only affects validation of otherwise trusted certificate chains, issued by a root CA in the VerifyOptions.Roots CertPool, or in the system certificate pool.

high : CVE--2026--32280

Affected range<1.25.9
Fixed version1.25.9
EPSS Score0.615%
EPSS Percentile45th percentile
Description

During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of service. This affects both direct users of crypto/x509 and users of crypto/tls.

high : CVE--2026--25679

Affected range<1.25.8
Fixed version1.25.8
EPSS Score0.728%
EPSS Percentile50th percentile
Description

url.Parse insufficiently validated the host/authority component and accepted some invalid URLs.

medium : CVE--2026--27145

Affected range<1.25.11
Fixed version1.25.11
EPSS Score0.939%
EPSS Percentile57th percentile
Description

(*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries. This caused strings.Split(host, ".") to execute repeatedly on the same input hostname.

With a large DNS SAN list, verification costs scaled quadratically based on the number of SAN entries multiplied by the hostname's label count. Because x509.Verify validates hostnames before building the certificate chain, this overhead occurred even for untrusted certificates.

medium : CVE--2026--32282

Affected range<1.25.9
Fixed version1.25.9
EPSS Score0.292%
EPSS Percentile21st percentile
Description

On Linux, if the target of Root.Chmod is replaced with a symlink while the chmod operation is in progress, Chmod can operate on the target of the symlink, even when the target lies outside the root.

The Linux fchmodat syscall silently ignores the AT_SYMLINK_NOFOLLOW flag, which Root.Chmod uses to avoid symlink traversal. Root.Chmod checks its target before acting and returns an error if the target is a symlink lying outside the root, so the impact is limited to cases where the target is replaced with a symlink between the check and operation.

medium : CVE--2026--39826

Affected range<1.25.10
Fixed version1.25.10
EPSS Score0.371%
EPSS Percentile29th percentile
Description

If a trusted template author were to write a <script> tag containing an empty 'type' attribute or a 'type' attribute with an ASCII whitespace, the execution of the template would incorrectly escape any data passed into the <script> block.

medium : CVE--2026--39823

Affected range<1.25.10
Fixed version1.25.10
EPSS Score0.314%
EPSS Percentile23rd percentile
Description

CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a tag's attribute. If the URL content were to insert ASCII whitespaces around the '=' rune inside of the attribute, the escaper would fail to similarly escape it, leading to XSS.

medium : CVE--2026--32289

Affected range<1.25.9
Fixed version1.25.9
EPSS Score0.290%
EPSS Percentile21st percentile
Description

Context was not properly tracked across template branches for JS template literals, leading to possibly incorrect escaping of content when branches were used. Additionally template actions within JS template literals did not properly track the brace depth, leading to incorrect escaping being applied.

These issues could cause actions within JS template literals to be incorrectly or improperly escaped, leading to XSS vulnerabilities.

medium : CVE--2026--27142

Affected range<1.25.8
Fixed version1.25.8
EPSS Score0.328%
EPSS Percentile25th percentile
Description

Actions which insert URLs into the content attribute of HTML meta tags are not escaped. This can allow XSS if the meta tag also has an http-equiv attribute with the value "refresh".

A new GODEBUG setting has been added, htmlmetacontenturlescape, which can be used to disable escaping URLs in actions in the meta content attribute which follow "url=" by setting htmlmetacontenturlescape=0.

medium : CVE--2026--32288

Affected range<1.25.9
Fixed version1.25.9
EPSS Score0.290%
EPSS Percentile21st percentile
Description

tar.Reader can allocate an unbounded amount of memory when reading a maliciously-crafted archive containing a large number of sparse regions encoded in the "old GNU sparse map" format.

medium : CVE--2026--42507

Affected range<1.25.11
Fixed version1.25.11
EPSS Score0.370%
EPSS Percentile29th percentile
Description

When returning errors, functions in the net/textproto package would include its input as part of the error. This might allow an attacker to inject misleading content to errors that are printed or logged.

medium : CVE--2026--39825

Affected range<1.25.10
Fixed version1.25.10
EPSS Score0.390%
EPSS Percentile31st percentile
Description

ReverseProxy can forward queries containing parameters not visible to Rewrite functions.

When used with a Rewrite function, or a Director function which parses query parameters, ReverseProxy sanitizes the forwarded request to remove query parameters which are not parsed by url.ParseQuery. ReverseProxy does not take ParseQuery's limit on the total number of query parameters (controlled by GODEBUG=urlmaxqueryparams=N) into account. This can permit ReverseProxy to forward a request containing a query parameter that is not visible to the Rewrite function.

For example, the query "a1=x&a2=x&...&a10000=x&hidden=y" can forward the parameter "hidden=y" while hiding it from the proxy's Rewrite function.

low : CVE--2026--27139

Affected range<1.25.8
Fixed version1.25.8
EPSS Score0.201%
EPSS Percentile10th percentile
Description

On Unix platforms, when listing the contents of a directory using File.ReadDir or File.Readdir the returned FileInfo could reference a file outside of the Root in which the File was opened.

The impact of this escape is limited to reading metadata provided by lstat from arbitrary locations on the filesystem without permitting reading or writing files outside the root.

unspecified : CVE--2026--42505

Affected range<1.25.12
Fixed version1.25.12
EPSS Score0.413%
EPSS Percentile33rd percentile
Description

Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello.

unspecified : CVE--2026--39822

Affected range<1.25.12
Fixed version1.25.12
EPSS Score0.183%
EPSS Percentile8th percentile
Description

On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /.

For example, 'root.Open("symlink/")' will open "symlink" even when "symlink" is a symbolic link pointing outside of the root.

critical: 0 high: 4 medium: 1 low: 0 org.apache.commons/commons-compress 1.5 (maven)

pkg:maven/org.apache.commons/commons-compress@1.5

high 7.5: CVE--2021--36090 Improper Handling of Length Parameter Inconsistency

Affected range<1.21
Fixed version1.21
CVSS Score7.5
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Score12.945%
EPSS Percentile96th percentile
Description

When reading a specially crafted ZIP archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' zip package.

high 7.5: CVE--2021--35517 Improper Handling of Length Parameter Inconsistency

Affected range<1.21
Fixed version1.21
CVSS Score7.5
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Score10.614%
EPSS Percentile95th percentile
Description

When reading a specially crafted TAR archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' tar package.

high 7.5: CVE--2021--35516 Improper Handling of Length Parameter Inconsistency

Affected range<1.21
Fixed version1.21
CVSS Score7.5
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Score12.365%
EPSS Percentile96th percentile
Description

When reading a specially crafted 7Z archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' sevenz package.

high 7.5: CVE--2021--35515 Excessive Iteration

Affected range<1.21
Fixed version1.21
CVSS Score7.5
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Score11.567%
EPSS Percentile96th percentile
Description

When reading a specially crafted 7Z archive, the construction of the list of codecs that decompress an entry can result in an infinite loop. This could be used to mount a denial of service attack against services that use Compress' sevenz package.

medium 5.9: CVE--2024--25710 Loop with Unreachable Exit Condition ('Infinite Loop')

Affected range>=1.3
<1.26.0
Fixed version1.26.0
CVSS Score5.9
CVSS VectorCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H
EPSS Score0.441%
EPSS Percentile36th percentile
Description

Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Commons Compress. This issue affects Apache Commons Compress: from 1.3 through 1.25.0.

Users are recommended to upgrade to version 1.26.0 which fixes the issue.

critical: 0 high: 2 medium: 0 low: 0 io.netty/netty-codec-haproxy 4.2.7.Final (maven)

pkg:maven/io.netty/netty-codec-haproxy@4.2.7.Final

high 8.7: CVE--2026--48059 Improper Validation of Syntactic Correctness of Input

Affected range>=4.2.0.Final
<=4.2.14.Final
Fixed version4.2.15.Final
CVSS Score8.7
CVSS VectorCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS Score0.606%
EPSS Percentile45th percentile
Description

Impact

The HAProxy PROXY protocol v2 codec in netty leaks native or heap memory on every connection when a client sends a syntactically valid header containing nested PP2_TYPE_SSL TLVs (type-length-value records) at depth two or greater. The leak occurs on the successful parse path — no exception is thrown, the message fires downstream, the decoder removes itself, and the application releases the HAProxyMessage normally. Yet the underlying cumulation buffer (a pooled, potentially direct ByteBuf allocated by the channel) remains permanently pinned.

high 7.5: CVE--2026--44893 Improper Check or Handling of Exceptional Conditions

Affected range>=4.2.0.Final
<=4.2.14.Final
Fixed version4.2.15.Final
CVSS Score7.5
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Score0.594%
EPSS Percentile44th percentile
Description

When decoding a PP2_TYPE_SSL TLV, HAProxyMessage.readNextTLV() first calls header.retainedSlice(header.readerIndex(), length) and only then reads the 1-byte client field and 4-byte verify field. If the attacker sets the TLV length below 5, the subsequent readByte/readInt throws IndexOutOfBoundsException. HAProxyMessageDecoder only catches HAProxyProtocolException around this call, so the IOOBE propagates and the retained slice on the pooled cumulation buffer is never released.

critical: 0 high: 1 medium: 1 low: 0 musl 1.2.5-r21 (apk)

pkg:apk/alpine/musl@1.2.5-r21?os_name=alpine&os_version=3.23

high : CVE--2026--40200

Affected range<1.2.5-r23
Fixed version1.2.5-r23
EPSS Score0.128%
EPSS Percentile3rd percentile
Description

medium : CVE--2026--6042

Affected range<1.2.5-r22
Fixed version1.2.5-r22
EPSS Score0.227%
EPSS Percentile13th percentile
Description
critical: 0 high: 1 medium: 0 low: 0 go.opentelemetry.io/otel 1.40.0 (golang)

pkg:golang/go.opentelemetry.io/otel@1.40.0

high 7.5: CVE--2026--29181 Uncontrolled Resource Consumption

Affected range>=1.36.0
<=1.40.0
Fixed version1.41.0
CVSS Score7.5
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Score0.435%
EPSS Percentile35th percentile
Description

multi-value baggage: header extraction parses each header field-value independently and aggregates members across values. this allows an attacker to amplify cpu and allocations by sending many baggage: header lines, even when each individual value is within the 8192-byte per-value parse limit.

severity

HIGH (availability / remote request amplification)

relevant links

vulnerability details

pins: open-telemetry/opentelemetry-go@1ee4a41
as-of: 2026-02-04
policy: direct (no program scope provided)

callsite: propagation/baggage.go:58 (extractMultiBaggage)
attacker control: inbound HTTP request headers (many baggage field-values) → propagation.HeaderCarrier.Values("baggage") → repeated baggage.Parse + member aggregation

root cause

extractMultiBaggage iterates over all baggage header field-values and parses each one independently, then appends members into a shared slice. the 8192-byte parsing cap applies per header value, but the multi-value path repeats that work once per header line (bounded only by the server/proxy header byte limit).

impact

in a default net/http configuration (max header bytes 1mb), a single request with many baggage: header field-values can cause large per-request allocations and increased latency.

example from the attached PoC harness (darwin/arm64; 80 values; 40 requests):

  • canonical: per_req_alloc_bytes=10315458 and p95_ms=7
  • control: per_req_alloc_bytes=133429 and p95_ms=0

proof of concept

canonical:

mkdir -p poc
unzip poc.zip -d poc
cd poc
make test

output (excerpt):

[CALLSITE_HIT]: propagation/baggage.go:58 extractMultiBaggage
[PROOF_MARKER]: baggage_multi_value_amplification p95_ms=7 per_req_alloc_bytes=10315458 per_req_allocs=16165

control:

cd poc
make control

control output (excerpt):

[NC_MARKER]: baggage_single_value_baseline p95_ms=0 per_req_alloc_bytes=133429 per_req_allocs=480

expected: multiple baggage header field-values should be semantically equivalent to a single comma-joined baggage value and should not multiply parsing/alloc work within the effective header byte budget.
actual: multiple baggage header field-values trigger repeated parsing and member aggregation, causing high per-request allocations and increased latency even when each individual value is within 8192 bytes.

fix recommendation

avoid repeated parsing across multi-values by enforcing a global budget and/or normalizing multi-values into a single value before parsing. one mitigation approach is to treat multi-values as a single comma-joined string and cap total parsed bytes (for example 8192 bytes total).

fix accepted when: under the default PoC harness settings, canonical stays within 2x of control for per_req_alloc_bytes and per_req_allocs, and p95_ms stays below 2ms.

poc.zip
PR_DESCRIPTION.md

critical: 0 high: 1 medium: 0 low: 0 go.opentelemetry.io/otel/sdk 1.40.0 (golang)

pkg:golang/go.opentelemetry.io/otel/sdk@1.40.0

high 7.3: CVE--2026--39883 Untrusted Search Path

Affected range>=1.15.0
<=1.42.0
Fixed version1.43.0
CVSS Score7.3
CVSS VectorCVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS Score0.220%
EPSS Percentile12th percentile
Description

Summary

The fix for GHSA-9h8m-3fm2-qjrq (CVE-2026-24051) changed the Darwin ioreg command to use an absolute path but left the BSD kenv command using a bare name, allowing the same PATH hijacking attack on BSD and Solaris platforms.

Root Cause

sdk/resource/host_id.go line 42:

if result, err := r.execCommand("kenv", "-q", "smbios.system.uuid"); err == nil {

Compare with the fixed Darwin path at line 58:

result, err := r.execCommand("/usr/sbin/ioreg", "-rd1", "-c", "IOPlatformExpertDevice")

The execCommand helper at sdk/resource/host_id_exec.go uses exec.Command(name, arg...) which searches $PATH when the command name contains no path separator.

Affected platforms (per build tag in host_id_bsd.go:4): DragonFly BSD, FreeBSD, NetBSD, OpenBSD, Solaris.

The kenv path is reached when /etc/hostid does not exist (line 38-40), which is common on FreeBSD systems.

Attack

  1. Attacker has local access to a system running a Go application that imports go.opentelemetry.io/otel/sdk
  2. Attacker places a malicious kenv binary earlier in $PATH
  3. Application initializes OpenTelemetry resource detection at startup
  4. hostIDReaderBSD.read() calls exec.Command("kenv", ...) which resolves to the malicious binary
  5. Arbitrary code executes in the context of the application

Same attack vector and impact as CVE-2026-24051.

Suggested Fix

Use the absolute path:

if result, err := r.execCommand("/bin/kenv", "-q", "smbios.system.uuid"); err == nil {

On FreeBSD, kenv is located at /bin/kenv.

critical: 0 high: 1 medium: 0 low: 0 org.codehaus.plexus/plexus-utils 3.5.1 (maven)

pkg:maven/org.codehaus.plexus/plexus-utils@3.5.1

high : CVE--2025--67030 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Affected range<3.6.1
Fixed version4.0.3
EPSS Score0.663%
EPSS Percentile48th percentile
Description

Directory Traversal vulnerability in the extractFile method of org.codehaus.plexus.util.Expand in plexus-utils before 6d780b3378829318ba5c2d29547e0012d5b29642. This allows an attacker to execute arbitrary code

critical: 0 high: 0 medium: 1 low: 2 unspecified: 1libxml2 2.13.9-r0 (apk)

pkg:apk/alpine/libxml2@2.13.9-r0?os_name=alpine&os_version=3.23

medium : CVE--2026--6732

Affected range<2.13.9-r1
Fixed version2.13.9-r1
EPSS Score0.632%
EPSS Percentile46th percentile
Description

low : CVE--2026--0989

Affected range<=2.13.9-r0
Fixed versionNot Fixed
EPSS Score0.419%
EPSS Percentile34th percentile
Description

low : CVE--2025--8732

Affected range<=2.13.9-r0
Fixed versionNot Fixed
EPSS Score0.202%
EPSS Percentile10th percentile
Description

unspecified : CVE--2026--11979

Affected range<=2.13.9-r0
Fixed versionNot Fixed
EPSS Score0.148%
EPSS Percentile4th percentile
Description
critical: 0 high: 0 medium: 1 low: 1 zlib 1.3.1-r2 (apk)

pkg:apk/alpine/zlib@1.3.1-r2?os_name=alpine&os_version=3.23

medium : CVE--2026--22184

Affected range<1.3.2-r0
Fixed version1.3.2-r0
EPSS Score0.381%
EPSS Percentile30th percentile
Description

low : CVE--2026--27171

Affected range<1.3.2-r0
Fixed version1.3.2-r0
EPSS Score0.204%
EPSS Percentile10th percentile
Description
critical: 0 high: 0 medium: 1 low: 0 busybox 1.37.0-r30 (apk)

pkg:apk/alpine/busybox@1.37.0-r30?os_name=alpine&os_version=3.23

medium : CVE--2025--60876

Affected range<=1.37.0-r30
Fixed versionNot Fixed
EPSS Score0.285%
EPSS Percentile20th percentile
Description
critical: 0 high: 0 medium: 1 low: 0 commons-lang/commons-lang 2.6 (maven)

pkg:maven/commons-lang/commons-lang@2.6

medium 6.5: CVE--2025--48924 Uncontrolled Recursion

Affected range>=2.0
<=2.6
Fixed versionNot Fixed
CVSS Score6.5
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
EPSS Score2.164%
EPSS Percentile80th percentile
Description

Uncontrolled Recursion vulnerability in Apache Commons Lang.

This issue affects Apache Commons Lang: Starting with commons-lang:commons-lang 2.0 to 2.6, and, from org.apache.commons:commons-lang3 3.0 before 3.18.0.

The methods ClassUtils.getClass(...) can throw StackOverflowError on very long inputs. Because an Error is usually not handled by applications and libraries, a StackOverflowError could cause an application to stop.

Users are recommended to upgrade to version 3.18.0, which fixes the issue.

critical: 0 high: 0 medium: 0 low: 1 xz 5.8.2-r0 (apk)

pkg:apk/alpine/xz@5.8.2-r0?os_name=alpine&os_version=3.23

low : CVE--2026--34743

Affected range<5.8.3-r0
Fixed version5.8.3-r0
EPSS Score0.351%
EPSS Percentile27th percentile
Description
critical: 0 high: 0 medium: 0 low: 1 golang.org/x/sys 0.41.0 (golang)

pkg:golang/golang.org/x/sys@0.41.0

low : CVE--2026--39824

Affected range<0.44.0
Fixed version0.44.0
EPSS Score0.114%
EPSS Percentile2nd percentile
Description

NewNTUnicodeString does not check for string length overflow. When provided with a string that overflows the maximum size of a NTUnicodeString (a 16-bit number of bytes), it returns a truncated string rather than an error.

@renovate renovate Bot changed the title chore(deps): update dependency pygments to v2.20.0 [security] chore(deps): update dependency pygments to v2.20.0 [security] - autoclosed Jul 20, 2026
@renovate renovate Bot closed this Jul 20, 2026
@renovate
renovate Bot deleted the renovate/pypi-pygments-vulnerability branch July 20, 2026 02:06
@renovate renovate Bot changed the title chore(deps): update dependency pygments to v2.20.0 [security] - autoclosed chore(deps): update dependency pygments to v2.20.0 [security] Jul 20, 2026
@renovate renovate Bot reopened this Jul 20, 2026
@renovate
renovate Bot force-pushed the renovate/pypi-pygments-vulnerability branch from 55e06de to eac308c Compare July 20, 2026 08:03
@sonarqubecloud

sonarqubecloud Bot commented Jul 20, 2026

Copy link
Copy Markdown

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

@sonarqubecloud

sonarqubecloud Bot commented Jul 20, 2026

Copy link
Copy Markdown

❌ The last analysis has failed.

See analysis details on SonarQube Cloud

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@Djaytan Djaytan Awaiting requested review from Djaytan Djaytan is a code owner

At least 0 approving reviews are required to merge this pull request.

Assignees

No one assigned

Labels

t:security

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants