chore(deps): update github/codeql-action action to v4.39.1 by renovate[bot] · Pull Request #398 · Djaytan/docker-papermc-server

Update default CodeQL bundle version to 2.27.3. #4256

`v4.39.0`

Breaking change: Bump the minimum required CodeQL bundle version to 2.20.7. #4205
The codeql-action/analyze step now validates that a correct argument for the checkout_path input has been provided. The checkout_path input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by codeql-action/init, then the CodeQL Action now produces a warning. #4148
Resolved an issue with third-party caching implementations that prevented caches from being restored correctly. #4206
The codeql-action/start-proxy step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as codeql-action/init. This primarily benefits customers who are using GitHub instances other than github.com where the codeql-action/start-proxy step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. #4198

`v4.38.3`

Upcoming breaking change: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. #4188
Update default CodeQL bundle version to 2.27.2. #4203
Fixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. #4184

`v4.38.2`

Update default CodeQL bundle version to 2.27.1. #4160

`v4.38.1`

The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. #4146

`v4.38.0`

On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124
The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072
Update default CodeQL bundle version to 2.27.0. #4129

`v4.37.9`

Update default CodeQL bundle version to 2.26.4. #4106

`v4.37.8`

No user facing changes.

`v4.37.7`

Update default CodeQL bundle version to 2.26.3. #4085

`v4.37.6`

Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070

`v4.37.5`

Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #4061

`v4.37.4`

This version of the CodeQL Action adds support for the tools input for the codeql-action/init step to be specified using a github-codeql-tools repository property. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to toolcache to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for tools in the workflow definition always takes precedence unless the value of the repository property starts with !. #4037
Update default CodeQL bundle version to 2.26.2. #4051

`v4.37.3`

No user facing changes.

`v4.37.2`

The new address format for the config-file input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the remote= prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. #4023
The CodeQL Action can now make use of configured private registries in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. #4007

`v4.37.1`

Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. #3956
Update default CodeQL bundle version to 2.26.1. #4019

`v4.37.0`

Update default CodeQL bundle version to 2.26.0. #3995
In addition to the existing input format, the config-file input for the codeql-action/init step will soon support a new [owner/]repo[@ref][:path] format. All components except the repository name are optional. If omitted, owner defaults to the same owner as the repository the analysis is running for, ref to main, and path to .github/codeql-action.yaml. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. #3973

`v4.36.3`

No user facing changes.

`v4.36.2`

Cache CodeQL CLI version information across Actions steps. #3943
Reduce requests while waiting for analysis processing by using exponential backoff when polling SARIF processing status. #3937
Update default CodeQL bundle version to 2.25.6. #3948

`v4.36.1`

No user facing changes.

`v4.36.0`

Breaking change: Bump the minimum required CodeQL bundle version to 2.19.4. #3894
Add support for SHA-256 Git object IDs. #3893
Update default CodeQL bundle version to 2.25.5. #3926

`v4.35.5`

We have improved how the JavaScript bundles for the CodeQL Action are generated to avoid duplication across bundles and reduce the size of the repository by around 70%. This should have no effect on the runtime behaviour of the CodeQL Action. #3899
For performance and accuracy reasons, improved incremental analysis will now only be enabled on a pull request when diff-informed analysis is also enabled for that run. If diff-informed analysis is unavailable (for example, because the PR diff ranges could not be computed), the action will fall back to a full analysis. #3791
If multiple inputs are provided for the GitHub-internal analysis-kinds input, only code-scanning will be enabled. The analysis-kinds input is experimental, for GitHub-internal use only, and may change without notice at any time. #3892
Added an experimental change which, when running a Code Scanning analysis for a PR with improved incremental analysis enabled, prefers CodeQL CLI versions that have a cached overlay-base database for the configured languages. This speeds up analysis for a repository when there is not yet a cached overlay-base database for the latest CLI version. We expect to roll this change out to everyone in May. #3880

`v4.35.4`

Update default CodeQL bundle version to 2.25.4. #3881

`v4.35.3`

Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.19.3 and earlier. These versions of CodeQL were discontinued on 9 April 2026 alongside GitHub Enterprise Server 3.15, and will be unsupported by the next minor release of the CodeQL Action. #3837
Configurations for private registries that use Cloudsmith or GCP OIDC are now accepted. #3850
Best-effort connection tests for private registries now use GET requests instead of HEAD for better compatibility with various registry implementations. For NuGet feeds, the test is now always performed against the service index. #3853
Fixed a bug where two diagnostics produced within the same millisecond could overwrite each other on disk, causing one of them to be lost. #3852
Update default CodeQL bundle version to 2.25.3. #3865

`v4.35.2`

The undocumented TRAP cache cleanup feature that could be enabled using the CODEQL_ACTION_CLEANUP_TRAP_CACHES environment variable is deprecated and will be removed in May 2026. If you are affected by this, we recommend disabling TRAP caching by passing the trap-caching: false input to the init Action. #3795
The Git version 2.36.0 requirement for improved incremental analysis now only applies to repositories that contain submodules. #3789
Python analysis on GHES no longer extracts the standard library, relying instead on models of the standard library. This should result in significantly faster extraction and analysis times, while the effect on alerts should be minimal. #3794
Fixed a bug in the validation of OIDC configurations for private registries that was added in CodeQL Action 4.33.0 / 3.33.0. #3807
Update default CodeQL bundle version to 2.25.2. #3823

`v4.35.1`

Fix incorrect minimum required Git version for improved incremental analysis: it should have been 2.36.0, not 2.11.0. #3781

`v4.35.0`

Reduced the minimum Git version required for improved incremental analysis from 2.38.0 to 2.11.0. #3767
Update default CodeQL bundle version to 2.25.1. #3773

`v4.34.1`

Downgrade default CodeQL bundle version to 2.24.3 due to issues with a small percentage of Actions and JavaScript analyses. #3762

`v4.34.0`

Added an experimental change which disables TRAP caching when improved incremental analysis is enabled, since improved incremental analysis supersedes TRAP caching. This will improve performance and reduce Actions cache usage. We expect to roll this change out to everyone in March. #3569
We are rolling out improved incremental analysis to C/C++ analyses that use build mode none. We expect this rollout to be complete by the end of April 2026. #3584
Update default CodeQL bundle version to 2.25.0. #3585

`v4.33.0`

Upcoming change: Starting April 2026, the CodeQL Action will skip collecting file coverage information on pull requests to improve analysis performance. File coverage information will still be computed on non-PR analyses. Pull request analyses will log a warning about this upcoming change. #3562

To opt out of this change:
- Repositories owned by an organization: Create a custom repository property with the name github-codeql-file-coverage-on-prs and the type "True/false", then set this property to true in the repository's settings. For more information, see Managing custom properties for repositories in your organization. Alternatively, if you are using an advanced setup workflow, you can set the CODEQL_ACTION_FILE_COVERAGE_ON_PRS environment variable to true in your workflow.
- User-owned repositories using default setup: Switch to an advanced setup workflow and set the CODEQL_ACTION_FILE_COVERAGE_ON_PRS environment variable to true in your workflow.
- User-owned repositories using advanced setup: Set the CODEQL_ACTION_FILE_COVERAGE_ON_PRS environment variable to true in your workflow.
Fixed a bug which caused the CodeQL Action to fail loading repository properties if a "Multi select" repository property was configured for the repository. #3557
The CodeQL Action now loads custom repository properties on GitHub Enterprise Server, enabling the customization of features such as github-codeql-disable-overlay that was previously only available on GitHub.com. #3559
Once private package registries can be configured with OIDC-based authentication for organizations, the CodeQL Action will now be able to accept such configurations. #3563
Fixed the retry mechanism for database uploads. Previously this would fail with the error "Response body object should not be disturbed or locked". #3564
A warning is now emitted if the CodeQL Action detects a repository property whose name suggests that it relates to the CodeQL Action, but which is not one of the properties recognised by the current version of the CodeQL Action. #3570

`v4.32.6`

Update default CodeQL bundle version to 2.24.3. #3548

`v4.32.5`

Repositories owned by an organization can now set up the github-codeql-disable-overlay custom repository property to disable improved incremental analysis for CodeQL. First, create a custom repository property with the name github-codeql-disable-overlay and the type "True/false" in the organization's settings. Then in the repository's settings, set this property to true to disable improved incremental analysis. For more information, see Managing custom properties for repositories in your organization. This feature is not yet available on GitHub Enterprise Server. #3507
Added an experimental change so that when improved incremental analysis fails on a runner — potentially due to insufficient disk space — the failure is recorded in the Actions cache so that subsequent runs will automatically skip improved incremental analysis until something changes (e.g. a larger runner is provisioned or a new CodeQL version is released). We expect to roll this change out to everyone in March. #3487
The minimum memory check for improved incremental analysis is now skipped for CodeQL 2.24.3 and later, which has reduced peak RAM usage. #3515
Reduced log levels for best-effort private package registry connection check failures to reduce noise from workflow annotations. #3516
Added an experimental change which lowers the minimum disk space requirement for improved incremental analysis, enabling it to run on standard GitHub Actions runners. We expect to roll this change out to everyone in March. #3498
Added an experimental change which allows the start-proxy action to resolve the CodeQL CLI version from feature flags instead of using the linked CLI bundle version. We expect to roll this change out to everyone in March. #3512
The previously experimental changes from versions 4.32.3, 4.32.4, 3.32.3 and 3.32.4 are now enabled by default. #3503, #3504

`v4.32.4`

Update default CodeQL bundle version to 2.24.2. #3493
Added an experimental change which improves how certificates are generated for the authentication proxy that is used by the CodeQL Action in Default Setup when private package registries are configured. This is expected to generate more widely compatible certificates and should have no impact on analyses which are working correctly already. We expect to roll this change out to everyone in February. #3473
When the CodeQL Action is run with debugging enabled in Default Setup and private package registries are configured, the "Setup proxy for registries" step will output additional diagnostic information that can be used for troubleshooting. #3486
Added a setting which allows the CodeQL Action to enable network debugging for Java programs. This will help GitHub staff support customers with troubleshooting issues in GitHub-managed CodeQL workflows, such as Default Setup. This setting can only be enabled by GitHub staff. #3485
Added a setting which enables GitHub-managed workflows, such as Default Setup, to use a nightly CodeQL CLI release instead of the latest, stable release that is used by default. This will help GitHub staff support customers whose analyses for a given repository or organization require early access to a change in an upcoming CodeQL CLI release. This setting can only be enabled by GitHub staff. #3484

Configuration

📅 Schedule: (UTC)

Branch creation
- Between 12:00 AM and 03:59 AM, on day 1 of the month (* 0-3 1 * *)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

github-actions · 2026-04-01T00:38:07Z

Overview

Image reference	`djaytan/papermc-server:1.21.11`	`djaytan/papermc-server:test`
- digest	`5a306e36683d`	`0f5f372484a2`
- tag	`1.21.11`	`test`
- stream	latest
- vulnerabilities
- platform	linux/amd64	linux/amd64
- size	82 MB	147 MB (+65 MB)
- packages	93	176 (+83)
Base Image	`alpine:3` also known as: • `3.23` • `latest`	`alpine:3` also known as: • `3.23` • `latest`
- vulnerabilities

Policies (0 improved, 2 worsened, 3 missing data)

Policy Name	`djaytan/papermc-server:1.21.11`	`djaytan/papermc-server:test`	Change	Standing
No unapproved base images	⚠️ 1	❓ No data
Default non-root user	✅	✅		No Change
No AGPL v3 licenses	✅	✅		No Change
No fixable critical or high vulnerabilities	⚠️ 63	⚠️ 121	+58	Worsened
No high-profile vulnerabilities	✅	✅		No Change
No outdated base images	✅	❓ No data
SonarQube quality gates passed	❓ No data	❓ No data
Supply chain attestations	✅	⚠️ 2	+2	Worsened

Packages and Vulnerabilities (107 package changes and 14 vulnerability changes)

➕ 93 packages added

➖ 12 packages removed

♾️ 2 packages changed

76 packages unchanged

❗ 14 vulnerabilities added

Changes for packages of type apk (9 changes)

	Package	Version `djaytan/papermc-server:1.21.11`	Version `djaytan/papermc-server:test`
➕	alpine-base		`3.23.3-r0`
➕	ca-certificates		`20251003-r0`
➕	gcc		`15.2.0-r2`
♾️	libxml2	`2.13.9-r1`	`2.13.9-r0`

			Added vulnerabilities (1):
➕	ncurses		`6.5_p20251123-r0`
➕	openssl		`3.5.5-r0`

			Added vulnerabilities (32):
➕	pax-utils		`1.3.8-r2`
➕	xz		`5.8.2-r0`

			Added vulnerabilities (1):
♾️	xz-libs	`5.8.3-r0`	`5.8.2-r0`

Changes for packages of type generic (2 changes)

	Package	Version `djaytan/papermc-server:1.21.11`	Version `djaytan/papermc-server:test`
➖	openjdk	`21.0.10`
➕	openjdk		`21.0.10`

Changes for packages of type golang (20 changes)

	Package	Version `djaytan/papermc-server:1.21.11`	Version `djaytan/papermc-server:test`
➕	cuelabs.dev/go/oci/ociregistry		`0.0.0-20250304105642-27e071d2c9b1`
➖	cuelabs.dev/go/oci/ociregistry	`0.0.0-20250304105642-27e071d2c9b1`
➕	github.com/cenkalti/backoff/v5		`5.0.3`
➖	github.com/cenkalti/backoff/v5	`5.0.3`
➖	github.com/cespare/xxhash/v2	`2.3.0`
➕	github.com/cespare/xxhash/v2		`2.3.0`
➖	github.com/cockroachdb/apd/v3	`3.2.1`
➕	github.com/cockroachdb/apd/v3		`3.2.1`
➕	github.com/grpc-ecosystem/grpc-gateway/v2		`2.27.7`
➖	github.com/grpc-ecosystem/grpc-gateway/v2	`2.27.7`
➖	github.com/pelletier/go-toml/v2	`2.2.4`
➕	github.com/pelletier/go-toml/v2		`2.2.4`
➕	go.opentelemetry.io/contrib/instrumentation/runtime		`0.65.0`
➖	go.opentelemetry.io/contrib/instrumentation/runtime	`0.65.0`
➕	go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc		`1.40.0`
➖	go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc	`1.40.0`
➖	go.opentelemetry.io/otel/sdk/metric	`1.40.0`
➖	google.golang.org/genproto/googleapis/api	`0.0.0-20260203192932-546029d2fa20`
➖	google.golang.org/genproto/googleapis/rpc	`0.0.0-20260203192932-546029d2fa20`
➕	google.golang.org/genproto/googleapis/rpc		`0.0.0-20260203192932-546029d2fa20`

Changes for packages of type maven (76 changes)

	Package	Version `djaytan/papermc-server:test`
➕	AutoRenamingTool/AutoRenamingTool	`2.0.3`
➕	ansi/ansi	`1.1.1`
➕	asm-utils/asm-utils	`0.0.3`
➕	cli-utils/cli-utils	`2.1.4`
➕	com.google.errorprone/error_prone_annotations	`2.41.0`
➕	com.google.guava/listenablefuture	`9999.0-empty-to-avoid-conflict-with-guava`
➕	com.google.j2objc/j2objc-annotations	`3.1`
➕	com.google.protobuf/protobuf-java	`4.29.0`
➕	com.googlecode.json-simple/json-simple	`1.1.1`
➕	com.lmax.disruptor/disruptor	`3.4.4`
➕	com.mysql/mysql-connector-j	`9.2.0`
➕	commons-codec/commons-codec	`1.16.0`
➕	commons-lang/commons-lang	`2.6`

		Added vulnerabilities (1):
➕	concurrentutil/concurrentutil	`0.0.8`
➕	examination-api/examination-api	`1.3.0`
➕	examination-string/examination-string	`1.3.0`
➕	gson-io/gson-io	`2.0.17`
➕	io.leangen.geantyref/geantyref	`1.3.16`
➕	io.netty/netty-codec-haproxy	`4.2.7.Final`

		Added vulnerabilities (4):
➕	io.papermc.paperclip.Main/papermc-server	`1.21.11-69`
➕	io.sigpipe/jbsdiff	`1.0`
➕	net.kyori.adventure.key/adventure-key	`4.25.0`
➕	net.kyori.adventure.text.logger.slf4j/adventure-text-logger-slf4j	`4.25.0`
➕	net.kyori.adventure.text.minimessage/adventure-text-minimessage	`4.25.0`
➕	net.kyori.adventure.text.serializer.ansi/adventure-text-serializer-ansi	`4.25.0`
➕	net.kyori.adventure.text.serializer.constant/adventure-text-serializer-commons	`4.25.0`
➕	net.kyori.adventure.text.serializer.gson/adventure-text-serializer-gson	`4.25.0`
➕	net.kyori.adventure.text.serializer.json/adventure-text-serializer-json	`4.25.0`
➕	net.kyori.adventure.text.serializer.legacy/adventure-text-serializer-legacy	`4.25.0`
➕	net.kyori.adventure.text.serializer.plain/adventure-text-serializer-plain	`4.25.0`
➕	net.kyori.adventure/adventure-api	`4.25.0`
➕	net.md-5/bungeecord-chat	`1.21-R0.2`
➕	net.minecrell.terminalconsole/terminalconsoleappender	`1.3.0`
➕	option/option	`1.1.0`
➕	org.apache.commons/commons-compress	`1.5`

		Added vulnerabilities (5):
➕	org.apache.httpcomponents/httpclient	`4.5.14`
➕	org.apache.httpcomponents/httpcore	`4.4.16`
➕	org.apache.logging.log4j/log4j-iostreams	`2.24.1`
➕	org.apache.maven.resolver/maven-resolver-api	`1.9.18`
➕	org.apache.maven.resolver/maven-resolver-connector-basic	`1.9.18`
➕	org.apache.maven.resolver/maven-resolver-impl	`1.9.18`
➕	org.apache.maven.resolver/maven-resolver-named-locks	`1.9.18`
➕	org.apache.maven.resolver/maven-resolver-spi	`1.9.18`
➕	org.apache.maven.resolver/maven-resolver-transport-http	`1.9.18`
➕	org.apache.maven.resolver/maven-resolver-util	`1.9.18`
➕	org.apache.maven/maven-artifact	`3.9.6`
➕	org.apache.maven/maven-builder-support	`3.9.6`
➕	org.apache.maven/maven-model	`3.9.6`
➕	org.apache.maven/maven-model-builder	`3.9.6`
➕	org.apache.maven/maven-repository-metadata	`3.9.6`
➕	org.apache.maven/maven-resolver-provider	`3.9.6`
➕	org.bukkit/paper-api	`1.21.11-R0.1-SNAPSHOT`
➕	org.codehaus.plexus/plexus-interpolation	`1.26`
➕	org.codehaus.plexus/plexus-utils	`3.5.1`

		Added vulnerabilities (1):
➕	org.eclipse.sisu/org.eclipse.sisu.inject	`0.9.0.M2`
➕	org.jline/jline-native	`3.27.1`
➕	org.jline/jline-reader	`3.20.0`

		Added vulnerabilities (1):
➕	org.jline/jline-terminal	`3.27.1`
➕	org.jline/jline-terminal-ffm	`3.27.1`
➕	org.jline/jline-terminal-jni	`3.27.1`
➕	org.objectweb.asm.commons/asm-commons	`9.8`
➕	org.objectweb.asm.tree/asm-tree	`9.8`
➕	org.objectweb.asm/asm	`9.8`
➕	org.slf4j/jcl-over-slf4j	`1.7.36`
➕	org.spongepowered.configurate.yaml/configurate-yaml	`4.2.0`
➕	org.spongepowered.configurate/configurate-core	`4.2.0`
➕	org.xerial/sqlite-jdbc	`3.49.1.0`
➕	org.yaml/snakeyaml	`2.2`
➕	reflection-rewriter-proxy-generator/reflection-rewriter-proxy-generator	`0.0.3`
➕	reflection-rewriter-runtime/reflection-rewriter-runtime	`0.0.3`
➕	reflection-rewriter/reflection-rewriter	`0.0.3`
➕	spark-api/spark-api	`0.1-20240720.200737-2`
➕	spark-paper/spark-paper	`1.10.152`
➕	spec/spec	`2.0.17`
➕	srgutils/srgutils	`1.0.9`
➕	velocity-native/velocity-native	`3.4.0-SNAPSHOT`

github-actions · 2026-04-01T00:38:08Z

🔍 Vulnerabilities of `djaytan/papermc-server:test`

📦 Image Reference djaytan/papermc-server:test

digest	`sha256:0f5f372484a22afed7ef08e101d9f9db9264054f6c83797a46360ad761a3c8a1`
vulnerabilities
platform	linux/amd64
size	147 MB
packages	176

📦 Base Image alpine:3

also known as	`3.23` `3.23.3` `latest`
digest	`sha256:59855d3dceb3ae53991193bd03301e082b2a7faa56a514b03527ae0ec2ce3a95`
vulnerabilities

stdlib 1.24.4 (golang)

pkg:golang/stdlib@1.24.4

Affected range	`<1.24.13`
Fixed version	`1.24.13`
EPSS Score	`0.915%`
EPSS Percentile	`60th percentile`

Description

During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed handshake may succeed when it should have failed. This may happen when a user calls Config.Clone and mutates the returned Config, or uses Config.GetConfigForClient. This can cause a client to resume a session with a server that it would not have resumed with during the initial handshake, or cause a server to resume a session with a client that it would not have resumed with during the initial handshake.

Affected range	`<1.26.9`
Fixed version	`1.26.9`
EPSS Score	`0.493%`
EPSS Percentile	`41st percentile`

Description

On Windows, when the target of Root.Mkdir or Root.MkdirAll is a junction pointing to an empty location, the operation can create a directory at the junction target even when that target is located outside the root. This only applies to operations where the last path component is a junction (path/to/junction, but not path/junction/target).

Affected range	`<1.25.13`
Fixed version	`1.25.13`
EPSS Score	`0.692%`
EPSS Percentile	`52nd percentile`

Description

The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error.

This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject "example.com" but permit "xn--example-.com". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name "example.com".

Affected range	`<1.26.9`
Fixed version	`1.26.9`
EPSS Score	`0.574%`
EPSS Percentile	`46th percentile`

Description

The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control.

Affected range	`<1.25.12`
Fixed version	`1.25.12`
EPSS Score	`0.232%`
EPSS Percentile	`13th percentile`

Description

On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /.

For example, 'root.Open("symlink/")' will open "symlink" even when "symlink" is a symbolic link pointing outside of the root.

Affected range	`<1.26.9`
Fixed version	`1.26.9`
EPSS Score	`0.420%`
EPSS Percentile	`35th percentile`

Description

HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the other modifies the encoder's table size when handling a SETTINGS frame containing SETTINGS_HEADER_TABLE_SIZE that a client sends. A malicious client can repeatedly send a request while changing the header table size to crash the server.

Affected range	`<1.26.9`
Fixed version	`1.26.9`
EPSS Score	`0.394%`
EPSS Percentile	`32nd percentile`

Description

Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted packet that could trigger memory exhaustion in the server process by specifying multiple references.

We now reject these as malformed and curb the memory amplification vector as a result.

Affected range	`<1.26.9`
Fixed version	`1.26.9`
EPSS Score	`0.404%`
EPSS Percentile	`33rd percentile`

Description

Parsing a multipart form can bypass memory limits and read an arbitrarily long line into memory when the remaining limit at the start of a part is less than 400 bytes.

Affected range	`<1.26.9`
Fixed version	`1.26.9`
EPSS Score	`0.315%`
EPSS Percentile	`23rd percentile`

Description

When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the connection. Since a 2xx response to an HTTP/1 CONNECT converts the connection into a tunnel, the server should not treat the connection as continuing to contain HTTP.

The impact of this misbehavior is mostly limited to potential request smuggling, where an intermediate proxy considers the data on the connection to be tunneled and the server considers it to be HTTP.

Affected range	`<1.26.9`
Fixed version	`1.26.9`
EPSS Score	`0.568%`
EPSS Percentile	`46th percentile`

Description

A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values.

Affected range	`<1.26.9`
Fixed version	`1.26.9`
EPSS Score	`0.379%`
EPSS Percentile	`31st percentile`

Description

When parsing a Range header containing a large number of small ranges, FileServer(FS), ServeContent, and ServeFile(FS) can consume an excessive amount of CPU.

Affected range	`<1.26.9`
Fixed version	`1.26.9`
EPSS Score	`0.303%`
EPSS Percentile	`22nd percentile`

Description

Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a reverse proxy. If the HTTP/1 client also does not behave strictly enough, this can result in response smuggling.

Affected range	`<1.26.9`
Fixed version	`1.26.9`
EPSS Score	`0.570%`
EPSS Percentile	`46th percentile`

Description

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a "Trailer" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently.

Affected range	`<1.26.9`
Fixed version	`1.26.9`
EPSS Score	`0.309%`
EPSS Percentile	`22nd percentile`

Description

When http.Transport sends an HTTP/1 CONNECT request with a non-empty Request.Body, it writes the body directly to the connection without framing after the request headers. If the server rejects the CONNECT request with a non-2xx keep-alive response, Transport returns the connection to the idle pool. Because CONNECT requests do not have a request body, the server may interpret the trailing body bytes as a subsequent pipelined HTTP/1.1 request on the connection, leaving the pooled connection desynchronized and causing the next caller that reuses it to read the response to the injected request. In reverse proxies (including httputil.ReverseProxy) that forward CONNECT requests through a shared Transport, this can lead to cross-user response poisoning.

Affected range	`<1.25.13`
Fixed version	`1.25.13`
EPSS Score	`0.568%`
EPSS Percentile	`46th percentile`

Description

Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not. As a result, a malicious client can keep sending KeyUpdate messages to force the server to keep performing key derivation operations indefinitely.

Affected range	`<1.25.13`
Fixed version	`1.25.13`
EPSS Score	`0.568%`
EPSS Percentile	`46th percentile`

Description

Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion.

Affected range	`<1.25.13`
Fixed version	`1.25.13`
EPSS Score	`0.568%`
EPSS Percentile	`46th percentile`

Description

When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when doing this.

Affected range	`<1.25.11`
Fixed version	`1.25.11`
EPSS Score	`0.560%`
EPSS Percentile	`46th percentile`

Description

Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU.

Affected range	`<1.25.10`
Fixed version	`1.25.10`
EPSS Score	`0.798%`
EPSS Percentile	`56th percentile`

Description

Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322.

Affected range	`<1.25.10`
Fixed version	`1.25.10`
EPSS Score	`0.620%`
EPSS Percentile	`49th percentile`

Description

The Dial and LookupPort functions panic on Windows when provided with an input containing a NUL (0).

Affected range	`<1.25.10`
Fixed version	`1.25.10`
EPSS Score	`0.784%`
EPSS Percentile	`55th percentile`

Description

Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations.

Affected range	`<1.25.13`
Fixed version	`1.25.13`
EPSS Score	`0.568%`
EPSS Percentile	`46th percentile`

Description

Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures.

Affected range	`<1.25.10`
Fixed version	`1.25.10`
EPSS Score	`0.781%`
EPSS Percentile	`55th percentile`

Description

When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.

Affected range	`<1.25.10`
Fixed version	`1.25.10`
EPSS Score	`0.813%`
EPSS Percentile	`56th percentile`

Description

When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash.

Affected range	`<1.25.9`
Fixed version	`1.25.9`
EPSS Score	`0.621%`
EPSS Percentile	`49th percentile`

Description

If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled consumption of resources. This can lead to a denial of service.

This only affects TLS 1.3.

Affected range	`<1.25.9`
Fixed version	`1.25.9`
EPSS Score	`0.355%`
EPSS Percentile	`28th percentile`

Description

Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service.

This only affects validation of otherwise trusted certificate chains, issued by a root CA in the VerifyOptions.Roots CertPool, or in the system certificate pool.

Affected range	`<1.25.9`
Fixed version	`1.25.9`
EPSS Score	`0.615%`
EPSS Percentile	`49th percentile`

Description

During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of service. This affects both direct users of crypto/x509 and users of crypto/tls.

Affected range	`<1.25.8`
Fixed version	`1.25.8`
EPSS Score	`0.834%`
EPSS Percentile	`57th percentile`

Description

url.Parse insufficiently validated the host/authority component and accepted some invalid URLs.

Affected range	`<1.24.11`
Fixed version	`1.24.11`
EPSS Score	`0.457%`
EPSS Percentile	`38th percentile`

Description

Within HostnameError.Error(), when constructing an error string, there is no limit to the number of hosts that will be printed out. Furthermore, the error string is constructed by repeated string concatenation, leading to quadratic runtime. Therefore, a certificate provided by a malicious actor can result in excessive resource consumption.

Affected range	`<1.24.12`
Fixed version	`1.24.12`
EPSS Score	`2.326%`
EPSS Percentile	`83rd percentile`

Description

The net/url package does not set a limit on the number of query parameters in a query.

While the maximum size of query parameters in URLs is generally limited by the maximum request header size, the net/http.Request.ParseForm method can parse large URL-encoded forms. Parsing a large form containing many unique query parameters can cause excessive memory consumption.

Affected range	`<1.24.8`
Fixed version	`1.24.8`
EPSS Score	`0.647%`
EPSS Percentile	`50th percentile`

Description

The ParseAddress function constructs domain-literal address components through repeated string concatenation. When parsing large domain-literal components, this can cause excessive CPU consumption.

Affected range	`<1.24.8`
Fixed version	`1.24.8`
EPSS Score	`0.661%`
EPSS Percentile	`51st percentile`

Description

The processing time for parsing some invalid inputs scales non-linearly with respect to the size of the input.

This affects programs which parse untrusted PEM inputs.

Affected range	`<1.24.8`
Fixed version	`1.24.8`
EPSS Score	`0.381%`
EPSS Percentile	`31st percentile`

Description

Validating certificate chains which contain DSA public keys can cause programs to panic, due to a interface cast that assumes they implement the Equal method.

This affects programs which validate arbitrary certificate chains.

Affected range	`<1.24.9`
Fixed version	`1.24.9`
EPSS Score	`0.406%`
EPSS Percentile	`33rd percentile`

Description

Due to the design of the name constraint checking algorithm, the processing time of some inputs scale non-linearly with respect to the size of the certificate.

This affects programs which validate arbitrary certificate chains.

Affected range	`<1.25.11`
Fixed version	`1.25.11`
EPSS Score	`0.591%`
EPSS Percentile	`47th percentile`

Description

(*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries. This caused strings.Split(host, ".") to execute repeatedly on the same input hostname.

With a large DNS SAN list, verification costs scaled quadratically based on the number of SAN entries multiplied by the hostname's label count. Because x509.Verify validates hostnames before building the certificate chain, this overhead occurred even for untrusted certificates.

Affected range	`<1.24.12`
Fixed version	`1.24.12`
EPSS Score	`0.749%`
EPSS Percentile	`54th percentile`

Description

archive/zip uses a super-linear file name indexing algorithm that is invoked the first time a file in an archive is opened. This can lead to a denial of service when consuming a maliciously constructed ZIP archive.

Affected range	`<1.24.11`
Fixed version	`1.24.11`
EPSS Score	`0.284%`
EPSS Percentile	`20th percentile`

Description

An excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate. For example a constraint that excludes the subdomain test.example.com does not prevent a leaf certificate from claiming the SAN *.example.com.

Affected range	`>=1.24.0 <1.24.6`
Fixed version	`1.24.6`
EPSS Score	`0.550%`
EPSS Percentile	`45th percentile`

Description

If the PATH environment variable contains paths which are executables (rather than just directories), passing certain strings to LookPath ("", ".", and ".."), can result in the binaries listed in the PATH being unexpectedly returned.

Affected range	`<1.25.9`
Fixed version	`1.25.9`
EPSS Score	`0.292%`
EPSS Percentile	`20th percentile`

Description

On Linux, if the target of Root.Chmod is replaced with a symlink while the chmod operation is in progress, Chmod can operate on the target of the symlink, even when the target lies outside the root.

The Linux fchmodat syscall silently ignores the AT_SYMLINK_NOFOLLOW flag, which Root.Chmod uses to avoid symlink traversal. Root.Chmod checks its target before acting and returns an error if the target is a symlink lying outside the root, so the impact is limited to cases where the target is replaced with a symlink between the check and operation.

Affected range	`<1.26.9`
Fixed version	`1.26.9`
EPSS Score	`0.202%`
EPSS Percentile	`9th percentile`

Description

A trusted template author may have previously written a valid template wherein the use of the 'yield' keyword would not be correctly escaped.

We now ensure that valid keyword uses are escaped and non-keyword uses are not escaped.

Affected range	`<1.26.9`
Fixed version	`1.26.9`
EPSS Score	`0.202%`
EPSS Percentile	`9th percentile`

Description

When a JavaScript template literal contains consecutive expressions, the context tracking state was not properly reset upon entering a new expression.

We now ensure that template-literal expression entries correctly reset context variables so all subsequent regular expression literals are accurately recognized and escaped.

Affected range	`<1.25.13`
Fixed version	`1.25.13`
EPSS Score	`0.310%`
EPSS Percentile	`22nd percentile`

Description

Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS.

Affected range	`<1.25.10`
Fixed version	`1.25.10`
EPSS Score	`0.393%`
EPSS Percentile	`32nd percentile`

Description

If a trusted template author were to write a <script> tag containing an empty 'type' attribute or a 'type' attribute with an ASCII whitespace, the execution of the template would incorrectly escape any data passed into the <script> block.

Affected range	`<1.25.10`
Fixed version	`1.25.10`
EPSS Score	`0.333%`
EPSS Percentile	`25th percentile`

Description

CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a tag's attribute. If the URL content were to insert ASCII whitespaces around the '=' rune inside of the attribute, the escaper would fail to similarly escape it, leading to XSS.

Affected range	`<1.25.9`
Fixed version	`1.25.9`
EPSS Score	`0.290%`
EPSS Percentile	`20th percentile`

Description

Context was not properly tracked across template branches for JS template literals, leading to possibly incorrect escaping of content when branches were used. Additionally template actions within JS template literals did not properly track the brace depth, leading to incorrect escaping being applied.

These issues could cause actions within JS template literals to be incorrectly or improperly escaped, leading to XSS vulnerabilities.

Affected range	`<1.25.8`
Fixed version	`1.25.8`
EPSS Score	`0.346%`
EPSS Percentile	`27th percentile`

Description

Actions which insert URLs into the content attribute of HTML meta tags are not escaped. This can allow XSS if the meta tag also has an http-equiv attribute with the value "refresh".

A new GODEBUG setting has been added, htmlmetacontenturlescape, which can be used to disable escaping URLs in actions in the meta content attribute which follow "url=" by setting htmlmetacontenturlescape=0.

Affected range	`<1.25.13`
Fixed version	`1.25.13`
EPSS Score	`0.550%`
EPSS Percentile	`45th percentile`

Description

Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead.

Now, path resolution operates on a byte buffer using index-based backtracking for '..' segments, eliminating the quadratic time complexity and significantly reducing memory allocations.

Affected range	`<1.25.9`
Fixed version	`1.25.9`
EPSS Score	`0.182%`
EPSS Percentile	`7th percentile`

Description

tar.Reader can allocate an unbounded amount of memory when reading a maliciously-crafted archive containing a large number of sparse regions encoded in the "old GNU sparse map" format.

Affected range	`<1.25.11`
Fixed version	`1.25.11`
EPSS Score	`0.412%`
EPSS Percentile	`34th percentile`

Description

When returning errors, functions in the net/textproto package would include its input as part of the error. This might allow an attacker to inject misleading content to errors that are printed or logged.

Affected range	`<1.25.12`
Fixed version	`1.25.12`
EPSS Score	`0.382%`
EPSS Percentile	`31st percentile`

Description

Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello.

Affected range	`<1.25.10`
Fixed version	`1.25.10`
EPSS Score	`0.413%`
EPSS Percentile	`34th percentile`

Description

ReverseProxy can forward queries containing parameters not visible to Rewrite functions.

When used with a Rewrite function, or a Director function which parses query parameters, ReverseProxy sanitizes the forwarded request to remove query parameters which are not parsed by url.ParseQuery. ReverseProxy does not take ParseQuery's limit on the total number of query parameters (controlled by GODEBUG=urlmaxqueryparams=N) into account. This can permit ReverseProxy to forward a request containing a query parameter that is not visible to the Rewrite function.

For example, the query "a1=x&a2=x&...&a10000=x&hidden=y" can forward the parameter "hidden=y" while hiding it from the proxy's Rewrite function.

Affected range	`<1.24.12`
Fixed version	`1.24.12`
EPSS Score	`0.329%`
EPSS Percentile	`25th percentile`

Description

During the TLS 1.3 handshake if multiple messages are sent in records that span encryption level boundaries (for instance the Client Hello and Encrypted Extensions messages), the subsequent messages may be processed before the encryption level changes. This can cause some minor information disclosure if a network-local attacker can inject messages during the handshake.

Affected range	`<1.24.8`
Fixed version	`1.24.8`
EPSS Score	`0.556%`
EPSS Percentile	`45th percentile`

Description

The Reader.ReadResponse function constructs a response string through repeated string concatenation of lines. When the number of lines in a response is large, this can cause excessive CPU consumption.

Affected range	`<1.24.8`
Fixed version	`1.24.8`
EPSS Score	`0.468%`
EPSS Percentile	`39th percentile`

Description

When Conn.Handshake fails during ALPN negotiation the error contains attacker controlled information (the ALPN protocols sent by the client) which is not escaped.

Affected range	`<1.24.8`
Fixed version	`1.24.8`
EPSS Score	`0.565%`
EPSS Percentile	`46th percentile`

Description

Despite HTTP headers having a default limit of 1MB, the number of cookies that can be parsed does not have a limit. By sending a lot of very small cookies such as "a=;", an attacker can make an HTTP server allocate a large amount of structs, causing large memory consumption.

Affected range	`<1.24.8`
Fixed version	`1.24.8`
EPSS Score	`0.556%`
EPSS Percentile	`45th percentile`

Description

Parsing a maliciously crafted DER payload could allocate large amounts of memory, causing memory exhaustion.

Affected range	`<1.24.8`
Fixed version	`1.24.8`
EPSS Score	`0.468%`
EPSS Percentile	`39th percentile`

Description

The Parse function permits values other than IPv6 addresses to be included in square brackets within the host component of a URL. RFC 3986 permits IPv6 addresses to be included within the host component, enclosed within square brackets. For example: "http://[::1]/". IPv4 addresses and hostnames must not appear within square brackets. Parse did not enforce this requirement.

Affected range	`<1.24.8`
Fixed version	`1.24.8`
EPSS Score	`0.443%`
EPSS Percentile	`37th percentile`

Description

tar.Reader does not set a maximum size on the number of sparse region data blocks in GNU tar pax 1.0 sparse files. A maliciously-crafted archive containing a large number of sparse regions can cause a Reader to read an unbounded amount of data from the archive into memory. When reading from a compressed source, a small compressed input can result in large allocations.

Affected range	`<1.25.8`
Fixed version	`1.25.8`
EPSS Score	`0.118%`
EPSS Percentile	`2nd percentile`

Description

On Unix platforms, when listing the contents of a directory using File.ReadDir or File.Readdir the returned FileInfo could reference a file outside of the Root in which the File was opened.

The impact of this escape is limited to reading metadata provided by lstat from arbitrary locations on the filesystem without permitting reading or writing files outside the root.

Affected range	`<1.26.10`
Fixed version	`1.26.10`

Description

On most platforms, Go uses the given system root certificates. However, in some narrower cases, the system trust stores may not be updated without further action.

To defend against the narrower set of cases that may remain affected, a denylist was added in crypto/x509 to return an error when calling Verify with any of the known intermediate certificates that are no longer considered to be trustworthy.

openssl 3.5.5-r0 (apk)

pkg:apk/alpine/openssl@3.5.5-r0?os_name=alpine&os_version=3.23

Affected range	`<3.5.8-r0`
Fixed version	`3.5.8-r0`
EPSS Score	`1.159%`
EPSS Percentile	`67th percentile`

Description

Affected range	`<3.5.6-r0`
Fixed version	`3.5.6-r0`
EPSS Score	`0.243%`
EPSS Percentile	`15th percentile`

Description

Affected range	`<3.5.8-r0`
Fixed version	`3.5.8-r0`
EPSS Score	`0.232%`
EPSS Percentile	`13th percentile`

Description

Affected range	`<3.5.7-r0`
Fixed version	`3.5.7-r0`
EPSS Score	`1.057%`
EPSS Percentile	`64th percentile`

Description

Affected range	`<3.5.7-r0`
Fixed version	`3.5.7-r0`
EPSS Score	`4.002%`
EPSS Percentile	`90th percentile`

Description

Affected range	`<3.5.7-r0`
Fixed version	`3.5.7-r0`
EPSS Score	`0.804%`
EPSS Percentile	`56th percentile`

Description

Affected range	`<3.5.6-r0`
Fixed version	`3.5.6-r0`
EPSS Score	`0.671%`
EPSS Percentile	`51st percentile`

Description

Affected range	`<3.5.7-r0`
Fixed version	`3.5.7-r0`
EPSS Score	`0.707%`
EPSS Percentile	`53rd percentile`

Description

Affected range	`<3.5.8-r0`
Fixed version	`3.5.8-r0`
EPSS Score	`1.602%`
EPSS Percentile	`75th percentile`

Description

Affected range	`<3.5.8-r0`
Fixed version	`3.5.8-r0`
EPSS Score	`0.778%`
EPSS Percentile	`55th percentile`

Description

Affected range	`<3.5.8-r0`
Fixed version	`3.5.8-r0`
EPSS Score	`0.916%`
EPSS Percentile	`60th percentile`

Description

Affected range	`<3.5.8-r0`
Fixed version	`3.5.8-r0`
EPSS Score	`0.622%`
EPSS Percentile	`49th percentile`

Description

Affected range	`<3.5.7-r0`
Fixed version	`3.5.7-r0`
EPSS Score	`0.704%`
EPSS Percentile	`53rd percentile`

Description

Affected range	`<3.5.7-r0`
Fixed version	`3.5.7-r0`
EPSS Score	`0.778%`
EPSS Percentile	`55th percentile`

Description

Affected range	`<3.5.7-r0`
Fixed version	`3.5.7-r0`
EPSS Score	`1.049%`
EPSS Percentile	`64th percentile`

Description

Affected range	`<3.5.7-r0`
Fixed version	`3.5.7-r0`
EPSS Score	`1.025%`
EPSS Percentile	`63rd percentile`

Description

Affected range	`<3.5.6-r0`
Fixed version	`3.5.6-r0`
EPSS Score	`1.030%`
EPSS Percentile	`63rd percentile`

Description

Affected range	`<3.5.6-r0`
Fixed version	`3.5.6-r0`
EPSS Score	`0.805%`
EPSS Percentile	`56th percentile`

Description

Affected range	`<3.5.6-r0`
Fixed version	`3.5.6-r0`
EPSS Score	`0.805%`
EPSS Percentile	`56th percentile`

Description

Affected range	`<3.5.6-r0`
Fixed version	`3.5.6-r0`
EPSS Score	`0.885%`
EPSS Percentile	`59th percentile`

Description

Affected range	`<3.5.8-r0`
Fixed version	`3.5.8-r0`
EPSS Score	`1.537%`
EPSS Percentile	`75th percentile`

Description

Affected range	`<3.5.8-r0`
Fixed version	`3.5.8-r0`
EPSS Score	`1.021%`
EPSS Percentile	`63rd percentile`

Description

Affected range	`<3.5.8-r0`
Fixed version	`3.5.8-r0`
EPSS Score	`0.729%`
EPSS Percentile	`53rd percentile`

Description

Affected range	`<3.5.7-r0`
Fixed version	`3.5.7-r0`
EPSS Score	`0.182%`
EPSS Percentile	`7th percentile`

Description

Affected range	`<3.5.6-r0`
Fixed version	`3.5.6-r0`
EPSS Score	`0.508%`
EPSS Percentile	`42nd percentile`

Description

Affected range	`<3.5.8-r0`
Fixed version	`3.5.8-r0`
EPSS Score	`0.588%`
EPSS Percentile	`47th percentile`

Description

Affected range	`<3.5.7-r0`
Fixed version	`3.5.7-r0`
EPSS Score	`0.557%`
EPSS Percentile	`45th percentile`

Description

Affected range	`<3.5.7-r0`
Fixed version	`3.5.7-r0`
EPSS Score	`1.060%`
EPSS Percentile	`64th percentile`

Description

Affected range	`<3.5.7-r0`
Fixed version	`3.5.7-r0`
EPSS Score	`0.239%`
EPSS Percentile	`14th percentile`

Description

Affected range	`<3.5.7-r0`
Fixed version	`3.5.7-r0`
EPSS Score	`0.236%`
EPSS Percentile	`14th percentile`

Description

Affected range	`<3.5.7-r0`
Fixed version	`3.5.7-r0`
EPSS Score	`0.503%`
EPSS Percentile	`42nd percentile`

Description

Affected range	`<3.5.7-r0`
Fixed version	`3.5.7-r0`
EPSS Score	`0.801%`
EPSS Percentile	`56th percentile`

Description

stdlib 1.25.7 (golang)

pkg:golang/stdlib@1.25.7

Affected range	`<1.26.9`
Fixed version	`1.26.9`
EPSS Score	`0.493%`
EPSS Percentile	`41st percentile`

Description

On Windows, when the target of Root.Mkdir or Root.MkdirAll is a junction pointing to an empty location, the operation can create a directory at the junction target even when that target is located outside the root. This only applies to operations where the last path component is a junction (path/to/junction, but not path/junction/target).

Affected range	`<1.25.13`
Fixed version	`1.25.13`
EPSS Score	`0.692%`
EPSS Percentile	`52nd percentile`

Description

The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error.

This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject "example.com" but permit "xn--example-.com". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name "example.com".

Affected range	`<1.26.9`
Fixed version	`1.26.9`
EPSS Score	`0.574%`
EPSS Percentile	`46th percentile`

Description

The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control.

Affected range	`<1.25.12`
Fixed version	`1.25.12`
EPSS Score	`0.232%`
EPSS Percentile	`13th percentile`

Description

On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /.

For example, 'root.Open("symlink/")' will open "symlink" even when "symlink" is a symbolic link pointing outside of the root.

Affected range	`<1.26.9`
Fixed version	`1.26.9`
EPSS Score	`0.420%`
EPSS Percentile	`35th percentile`

Description

HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the other modifies the encoder's table size when handling a SETTINGS frame containing SETTINGS_HEADER_TABLE_SIZE that a client sends. A malicious client can repeatedly send a request while changing the header table size to crash the server.

Affected range	`<1.26.9`
Fixed version	`1.26.9`
EPSS Score	`0.394%`
EPSS Percentile	`32nd percentile`

Description

Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted packet that could trigger memory exhaustion in the server process by specifying multiple references.

We now reject these as malformed and curb the memory amplification vector as a result.

Affected range	`<1.26.9`
Fixed version	`1.26.9`
EPSS Score	`0.404%`
EPSS Percentile	`33rd percentile`

Description

Parsing a multipart form can bypass memory limits and read an arbitrarily long line into memory when the remaining limit at the start of a part is less than 400 bytes.

Affected range	`<1.26.9`
Fixed version	`1.26.9`
EPSS Score	`0.315%`
EPSS Percentile	`23rd percentile`

Description

When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the connection. Since a 2xx response to an HTTP/1 CONNECT converts the connection into a tunnel, the server should not treat the connection as continuing to contain HTTP.

The impact of this misbehavior is mostly limited to potential request smuggling, where an intermediate proxy considers the data on the connection to be tunneled and the server considers it to be HTTP.

Affected range	`<1.26.9`
Fixed version	`1.26.9`
EPSS Score	`0.568%`
EPSS Percentile	`46th percentile`

Description

A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values.

Affected range	`<1.26.9`
Fixed version	`1.26.9`
EPSS Score	`0.379%`
EPSS Percentile	`31st percentile`

Description

When parsing a Range header containing a large number of small ranges, FileServer(FS), ServeContent, and ServeFile(FS) can consume an excessive amount of CPU.

Affected range	`<1.26.9`
Fixed version	`1.26.9`
EPSS Score	`0.303%`
EPSS Percentile	`22nd percentile`

Description

Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a reverse proxy. If the HTTP/1 client also does not behave strictly enough, this can result in response smuggling.

Affected range	`<1.26.9`
Fixed version	`1.26.9`
EPSS Score	`0.570%`
EPSS Percentile	`46th percentile`

Description

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a "Trailer" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently.

Affected range	`<1.26.9`
Fixed version	`1.26.9`
EPSS Score	`0.309%`
EPSS Percentile	`22nd percentile`

Description

When http.Transport sends an HTTP/1 CONNECT request with a non-empty Request.Body, it writes the body directly to the connection without framing after the request headers. If the server rejects the CONNECT request with a non-2xx keep-alive response, Transport returns the connection to the idle pool. Because CONNECT requests do not have a request body, the server may interpret the trailing body bytes as a subsequent pipelined HTTP/1.1 request on the connection, leaving the pooled connection desynchronized and causing the next caller that reuses it to read the response to the injected request. In reverse proxies (including httputil.ReverseProxy) that forward CONNECT requests through a shared Transport, this can lead to cross-user response poisoning.

Affected range	`<1.25.13`
Fixed version	`1.25.13`
EPSS Score	`0.568%`
EPSS Percentile	`46th percentile`

Description

Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not. As a result, a malicious client can keep sending KeyUpdate messages to force the server to keep performing key derivation operations indefinitely.

Affected range	`<1.25.13`
Fixed version	`1.25.13`
EPSS Score	`0.568%`
EPSS Percentile	`46th percentile`

Description

Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion.

Affected range	`<1.25.13`
Fixed version	`1.25.13`
EPSS Score	`0.568%`
EPSS Percentile	`46th percentile`

Description

When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when doing this.

Affected range	`<1.25.11`
Fixed version	`1.25.11`
EPSS Score	`0.560%`
EPSS Percentile	`46th percentile`

Description

Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU.

Affected range	`<1.25.10`
Fixed version	`1.25.10`
EPSS Score	`0.798%`
EPSS Percentile	`56th percentile`

Description

Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322.

Affected range	`<1.25.10`
Fixed version	`1.25.10`
EPSS Score	`0.620%`
EPSS Percentile	`49th percentile`

Description

The Dial and LookupPort functions panic on Windows when provided with an input containing a NUL (0).

Affected range	`<1.25.10`
Fixed version	`1.25.10`
EPSS Score	`0.784%`
EPSS Percentile	`55th percentile`

Description

Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations.

Affected range	`<1.25.13`
Fixed version	`1.25.13`
EPSS Score	`0.568%`
EPSS Percentile	`46th percentile`

Description

Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures.

Affected range	`<1.25.10`
Fixed version	`1.25.10`
EPSS Score	`0.781%`
EPSS Percentile	`55th percentile`

Description

When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.

Affected range	`<1.25.10`
Fixed version	`1.25.10`
EPSS Score	`0.813%`
EPSS Percentile	`56th percentile`

Description

When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash.

Affected range	`<1.25.9`
Fixed version	`1.25.9`
EPSS Score	`0.621%`
EPSS Percentile	`49th percentile`

Description

If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled consumption of resources. This can lead to a denial of service.

This only affects TLS 1.3.

Affected range	`<1.25.9`
Fixed version	`1.25.9`
EPSS Score	`0.355%`
EPSS Percentile	`28th percentile`

Description

Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service.

This only affects validation of otherwise trusted certificate chains, issued by a root CA in the VerifyOptions.Roots CertPool, or in the system certificate pool.

Affected range	`<1.25.9`
Fixed version	`1.25.9`
EPSS Score	`0.615%`
EPSS Percentile	`49th percentile`

Description

During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of service. This affects both direct users of crypto/x509 and users of crypto/tls.

Affected range	`<1.25.8`
Fixed version	`1.25.8`
EPSS Score	`0.834%`
EPSS Percentile	`57th percentile`

Description

url.Parse insufficiently validated the host/authority component and accepted some invalid URLs.

Affected range	`<1.25.11`
Fixed version	`1.25.11`
EPSS Score	`0.591%`
EPSS Percentile	`47th percentile`

Description

(*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries. This caused strings.Split(host, ".") to execute repeatedly on the same input hostname.

With a large DNS SAN list, verification costs scaled quadratically based on the number of SAN entries multiplied by the hostname's label count. Because x509.Verify validates hostnames before building the certificate chain, this overhead occurred even for untrusted certificates.

Affected range	`<1.25.9`
Fixed version	`1.25.9`
EPSS Score	`0.292%`
EPSS Percentile	`20th percentile`

Description

On Linux, if the target of Root.Chmod is replaced with a symlink while the chmod operation is in progress, Chmod can operate on the target of the symlink, even when the target lies outside the root.

The Linux fchmodat syscall silently ignores the AT_SYMLINK_NOFOLLOW flag, which Root.Chmod uses to avoid symlink traversal. Root.Chmod checks its target before acting and returns an error if the target is a symlink lying outside the root, so the impact is limited to cases where the target is replaced with a symlink between the check and operation.

Affected range	`<1.26.9`
Fixed version	`1.26.9`
EPSS Score	`0.202%`
EPSS Percentile	`9th percentile`

Description

A trusted template author may have previously written a valid template wherein the use of the 'yield' keyword would not be correctly escaped.

We now ensure that valid keyword uses are escaped and non-keyword uses are not escaped.

Affected range	`<1.26.9`
Fixed version	`1.26.9`
EPSS Score	`0.202%`
EPSS Percentile	`9th percentile`

Description

When a JavaScript template literal contains consecutive expressions, the context tracking state was not properly reset upon entering a new expression.

We now ensure that template-literal expression entries correctly reset context variables so all subsequent regular expression literals are accurately recognized and escaped.

Affected range	`<1.25.13`
Fixed version	`1.25.13`
EPSS Score	`0.310%`
EPSS Percentile	`22nd percentile`

Description

Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS.

Affected range	`<1.25.10`
Fixed version	`1.25.10`
EPSS Score	`0.393%`
EPSS Percentile	`32nd percentile`

Description

If a trusted template author were to write a <script> tag containing an empty 'type' attribute or a 'type' attribute with an ASCII whitespace, the execution of the template would incorrectly escape any data passed into the <script> block.

Affected range	`<1.25.10`
Fixed version	`1.25.10`
EPSS Score	`0.333%`
EPSS Percentile	`25th percentile`

Description

CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a tag's attribute. If the URL content were to insert ASCII whitespaces around the '=' rune inside of the attribute, the escaper would fail to similarly escape it, leading to XSS.

Affected range	`<1.25.9`
Fixed version	`1.25.9`
EPSS Score	`0.290%`
EPSS Percentile	`20th percentile`

Description

Context was not properly tracked across template branches for JS template literals, leading to possibly incorrect escaping of content when branches were used. Additionally template actions within JS template literals did not properly track the brace depth, leading to incorrect escaping being applied.

These issues could cause actions within JS template literals to be incorrectly or improperly escaped, leading to XSS vulnerabilities.

Affected range	`<1.25.8`
Fixed version	`1.25.8`
EPSS Score	`0.346%`
EPSS Percentile	`27th percentile`

Description

Actions which insert URLs into the content attribute of HTML meta tags are not escaped. This can allow XSS if the meta tag also has an http-equiv attribute with the value "refresh".

A new GODEBUG setting has been added, htmlmetacontenturlescape, which can be used to disable escaping URLs in actions in the meta content attribute which follow "url=" by setting htmlmetacontenturlescape=0.

Affected range	`<1.25.13`
Fixed version	`1.25.13`
EPSS Score	`0.550%`
EPSS Percentile	`45th percentile`

Description

Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead.

Now, path resolution operates on a byte buffer using index-based backtracking for '..' segments, eliminating the quadratic time complexity and significantly reducing memory allocations.

Affected range	`<1.25.9`
Fixed version	`1.25.9`
EPSS Score	`0.182%`
EPSS Percentile	`7th percentile`

Description

tar.Reader can allocate an unbounded amount of memory when reading a maliciously-crafted archive containing a large number of sparse regions encoded in the "old GNU sparse map" format.

Affected range	`<1.25.11`
Fixed version	`1.25.11`
EPSS Score	`0.412%`
EPSS Percentile	`34th percentile`

Description

When returning errors, functions in the net/textproto package would include its input as part of the error. This might allow an attacker to inject misleading content to errors that are printed or logged.

Affected range	`<1.25.12`
Fixed version	`1.25.12`
EPSS Score	`0.382%`
EPSS Percentile	`31st percentile`

Description

Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello.

Affected range	`<1.25.10`
Fixed version	`1.25.10`
EPSS Score	`0.413%`
EPSS Percentile	`34th percentile`

Description

ReverseProxy can forward queries containing parameters not visible to Rewrite functions.

When used with a Rewrite function, or a Director function which parses query parameters, ReverseProxy sanitizes the forwarded request to remove query parameters which are not parsed by url.ParseQuery. ReverseProxy does not take ParseQuery's limit on the total number of query parameters (controlled by GODEBUG=urlmaxqueryparams=N) into account. This can permit ReverseProxy to forward a request containing a query parameter that is not visible to the Rewrite function.

For example, the query "a1=x&a2=x&...&a10000=x&hidden=y" can forward the parameter "hidden=y" while hiding it from the proxy's Rewrite function.

Affected range	`<1.25.8`
Fixed version	`1.25.8`
EPSS Score	`0.118%`
EPSS Percentile	`2nd percentile`

Description

On Unix platforms, when listing the contents of a directory using File.ReadDir or File.Readdir the returned FileInfo could reference a file outside of the Root in which the File was opened.

The impact of this escape is limited to reading metadata provided by lstat from arbitrary locations on the filesystem without permitting reading or writing files outside the root.

Affected range	`<1.26.10`
Fixed version	`1.26.10`

Description

On most platforms, Go uses the given system root certificates. However, in some narrower cases, the system trust stores may not be updated without further action.

To defend against the narrower set of cases that may remain affected, a denylist was added in crypto/x509 to return an error when calling Verify with any of the known intermediate certificates that are no longer considered to be trustworthy.

golang.org/x/net 0.39.0 (golang)

pkg:golang/golang.org/x/net@0.39.0

Affected range	`<0.55.0`
Fixed version	`0.55.0`
EPSS Score	`0.692%`
EPSS Percentile	`52nd percentile`

Description

The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error.

This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject "example.com" but permit "xn--example-.com". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name "example.com".

Affected range	`<0.60.0`
Fixed version	`0.60.0`
EPSS Score	`0.574%`
EPSS Percentile	`46th percentile`

Description

The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control.

Affected range	`<0.60.0`
Fixed version	`0.60.0`
EPSS Score	`0.420%`
EPSS Percentile	`35th percentile`

Description

HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the other modifies the encoder's table size when handling a SETTINGS frame containing SETTINGS_HEADER_TABLE_SIZE that a client sends. A malicious client can repeatedly send a request while changing the header table size to crash the server.

Affected range	`<0.60.0`
Fixed version	`0.60.0`
EPSS Score	`0.568%`
EPSS Percentile	`46th percentile`

Description

A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values.

Affected range	`<0.60.0`
Fixed version	`0.60.0`
EPSS Score	`0.303%`
EPSS Percentile	`22nd percentile`

Description

Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a reverse proxy. If the HTTP/1 client also does not behave strictly enough, this can result in response smuggling.

Affected range	`<0.60.0`
Fixed version	`0.60.0`
EPSS Score	`0.570%`
EPSS Percentile	`46th percentile`

Description

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a "Trailer" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently.

Affected range	`<0.56.0`
Fixed version	`0.56.0`
EPSS Score	`0.549%`
EPSS Percentile	`45th percentile`

Description

Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer.

Affected range	`<0.53.0`
Fixed version	`0.53.0`
EPSS Score	`0.781%`
EPSS Percentile	`55th percentile`

Description

When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.

Uncontrolled Resource Consumption

Affected range	`<0.55.0`
Fixed version	`0.55.0`
CVSS Score	`6.5`
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H`
EPSS Score	`0.460%`
EPSS Percentile	`39th percentile`

Description

In Go Net (golang.org/x/net) before verion 0.55.0, parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service.

Affected range	`<0.55.0`
Fixed version	`0.55.0`
EPSS Score	`0.333%`
EPSS Percentile	`25th percentile`

Description

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

Affected range	`<0.55.0`
Fixed version	`0.55.0`
EPSS Score	`0.223%`
EPSS Percentile	`12th percentile`

Description

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

Affected range	`<0.55.0`
Fixed version	`0.55.0`
EPSS Score	`0.223%`
EPSS Percentile	`12th percentile`

Description

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

Affected range	`<0.55.0`
Fixed version	`0.55.0`
EPSS Score	`0.223%`
EPSS Percentile	`12th percentile`

Description

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

Affected range	`<0.45.0`
Fixed version	`0.45.0`
EPSS Score	`0.548%`
EPSS Percentile	`45th percentile`

Description

The html.Parse function in golang.org/x/net/html has an infinite parsing loop when processing certain inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content.

Affected range	`<0.45.0`
Fixed version	`0.45.0`
EPSS Score	`0.570%`
EPSS Percentile	`46th percentile`

Description

The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when processing certain inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content.

golang.org/x/net 0.49.0 (golang)

pkg:golang/golang.org/x/net@0.49.0

Affected range	`<0.55.0`
Fixed version	`0.55.0`
EPSS Score	`0.692%`
EPSS Percentile	`52nd percentile`

Description

The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error.

This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject "example.com" but permit "xn--example-.com". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name "example.com".

Affected range	`<0.60.0`
Fixed version	`0.60.0`
EPSS Score	`0.574%`
EPSS Percentile	`46th percentile`

Description

The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control.

Affected range	`<0.60.0`
Fixed version	`0.60.0`
EPSS Score	`0.420%`
EPSS Percentile	`35th percentile`

Description

HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the other modifies the encoder's table size when handling a SETTINGS frame containing SETTINGS_HEADER_TABLE_SIZE that a client sends. A malicious client can repeatedly send a request while changing the header table size to crash the server.

Affected range	`<0.60.0`
Fixed version	`0.60.0`
EPSS Score	`0.568%`
EPSS Percentile	`46th percentile`

Description

A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values.

Affected range	`<0.60.0`
Fixed version	`0.60.0`
EPSS Score	`0.303%`
EPSS Percentile	`22nd percentile`

Description

Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a reverse proxy. If the HTTP/1 client also does not behave strictly enough, this can result in response smuggling.

Affected range	`<0.60.0`
Fixed version	`0.60.0`
EPSS Score	`0.570%`
EPSS Percentile	`46th percentile`

Description

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a "Trailer" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently.

Affected range	`<0.56.0`
Fixed version	`0.56.0`
EPSS Score	`0.549%`
EPSS Percentile	`45th percentile`

Description

Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer.

Affected range	`<0.53.0`
Fixed version	`0.53.0`
EPSS Score	`0.781%`
EPSS Percentile	`55th percentile`

Description

When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.

Uncontrolled Resource Consumption

Affected range	`<0.55.0`
Fixed version	`0.55.0`
CVSS Score	`6.5`
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H`
EPSS Score	`0.460%`
EPSS Percentile	`39th percentile`

Description

In Go Net (golang.org/x/net) before verion 0.55.0, parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service.

Affected range	`<0.55.0`
Fixed version	`0.55.0`
EPSS Score	`0.333%`
EPSS Percentile	`25th percentile`

Description

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

Affected range	`<0.55.0`
Fixed version	`0.55.0`
EPSS Score	`0.223%`
EPSS Percentile	`12th percentile`

Description

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

Affected range	`<0.55.0`
Fixed version	`0.55.0`
EPSS Score	`0.223%`
EPSS Percentile	`12th percentile`

Description

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

Affected range	`<0.55.0`
Fixed version	`0.55.0`
EPSS Score	`0.223%`
EPSS Percentile	`12th percentile`

Description

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

google.golang.org/grpc 1.78.0 (golang)

pkg:golang/google.golang.org/grpc@1.78.0

Improper Authorization

Affected range	`<1.79.3`
Fixed version	`1.79.3`
CVSS Score	`9.1`
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N`
EPSS Score	`1.688%`
EPSS Percentile	`77th percentile`

Description

Impact

What kind of vulnerability is it? Who is impacted?

It is an Authorization Bypass resulting from Improper Input Validation of the HTTP/2 :path pseudo-header.

The gRPC-Go server was too lenient in its routing logic, accepting requests where the :path omitted the mandatory leading slash (e.g., Service/Method instead of /Service/Method). While the server successfully routed these requests to the correct handler, authorization interceptors (including the official grpc/authz package) evaluated the raw, non-canonical path string. Consequently, "deny" rules defined using canonical paths (starting with /) failed to match the incoming request, allowing it to bypass the policy if a fallback "allow" rule was present.

Who is impacted?
This affects gRPC-Go servers that meet both of the following criteria:

They use path-based authorization interceptors, such as the official RBAC implementation in google.golang.org/grpc/authz or custom interceptors relying on info.FullMethod or grpc.Method(ctx).

Their security policy contains specific "deny" rules for canonical paths but allows other requests by default (a fallback "allow" rule).

The vulnerability is exploitable by an attacker who can send raw HTTP/2 frames with malformed :path headers directly to the gRPC server.

Patches

Has the problem been patched? What versions should users upgrade to?

Yes, the issue has been patched. The fix ensures that any request with a :path that does not start with a leading slash is immediately rejected with a codes.Unimplemented error, preventing it from reaching authorization interceptors or handlers with a non-canonical path string.

Users should upgrade to the following versions (or newer):

v1.79.3

The latest master branch.

It is recommended that all users employing path-based authorization (especially grpc/authz) upgrade as soon as the patch is available in a tagged release.

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

While upgrading is the most secure and recommended path, users can mitigate the vulnerability using one of the following methods:

1. Use a Validating Interceptor (Recommended Mitigation)

Add an "outermost" interceptor to your server that validates the path before any other authorization logic runs:
func pathValidationInterceptor(ctx context.Context, req any, info *grpc.UnaryServerInfo, handler grpc.UnaryHandler) (any, error) {
    if info.FullMethod == "" || info.FullMethod[0] != '/' {
        return nil, status.Errorf(codes.Unimplemented, "malformed method name")
    }   
    return handler(ctx, req)
}

// Ensure this is the FIRST interceptor in your chain
s := grpc.NewServer(
    grpc.ChainUnaryInterceptor(pathValidationInterceptor, authzInterceptor),
)
2. Infrastructure-Level Normalization

If your gRPC server is behind a reverse proxy or load balancer (such as Envoy, NGINX, or an L7 Cloud Load Balancer), ensure it is configured to enforce strict HTTP/2 compliance for pseudo-headers and reject or normalize requests where the :path header does not start with a leading slash.

3. Policy Hardening

Switch to a "default deny" posture in your authorization policies (explicitly listing all allowed paths and denying everything else) to reduce the risk of bypasses via malformed inputs.

Uncaught Exception

Affected range	`<1.82.1`
Fixed version	`1.82.1`
CVSS Score	`8.8`
CVSS Vector	`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N`

Description

Multiple security vulnerabilities have been identified and addressed in grpc-go affecting the xDS RBAC authorization engine (internal/xds/rbac) and the HTTP/2 transport server implementation (internal/transport). These vulnerabilities could result in:

Authorization Bypass (Fail-Open) when translating xDS RBAC policies containing Metadata or RequestedServerName fields.

Denial of Service (High CPU Consumption) due to an HTTP/2 Rapid Reset mitigation bypass during client-initiated stream resets.

Denial of Service (Server Panic) when parsing crafted xDS RBAC policies containing NOT rules around unsupported fields.

Impact

What kind of vulnerability is it? Who is impacted?

xDS RBAC Authorization Bypass via Metadata & RequestedServerName matchers

Affected Component: xDS RBAC

Impact: When building policy matchers for gRPC RBAC from xDS configurations, unsupported permission and principal rules (specifically Metadata and RequestedServerName) were silently ignored and treated as no-ops.

If an authorization policy relied purely on these matchers for access control, treating those rules as no-ops effectively removed the restrictions.

If these unsupported rules were nested inside logical NOT rules (Permission_NotRule / Principal_NotId) or multi-condition OR/AND rules, silently dropping them changed the boolean logic flow of the authorization engine.

As a result, policy evaluation decisions could fail open, allowing unauthorized clients to access protected gRPC services or resources.

HTTP/2 Rapid Reset Mitigation Bypass / Denial of Service via Stream Aborts

Affected Component: HTTP/2 transport

Impact: Earlier mitigations in grpc-go for HTTP/2 Rapid Reset only applied threshold checks to items that directly resulted in control frames being written back to the wire, such as SETTINGS ACKs or server-initiated RST_STREAMs.

When a client initiated a rapid flood of stream creation (HEADERS) immediately followed by stream termination RST_STREAM, items queued up in the control buffer without counting against the transport response frame threshold. An attacker can repeatedly trigger this flood sequence to bypass reader blocking, resulting in high CPU usage, and Denial of Service (DoS).

Denial of Service (Panic) in xDS RBAC Engine via Unsupported Fields inside NOT Rules

Affected Component: xDS RBAC

Impact: The xDS RBAC policy translators recursively generate matchers for nested rules. When a NOT rule wrapped an unsupported or unhandled field (such as SourcedMetadata), the recursive step returned an empty matcher. This could result in a runtime panic when the RBAC engine attempts to authorize an incoming request.

An attacker or misconfigured/malicious xDS management server delivering an LDS/RDS update containing a NOT rule around an unhandled field causes the gRPC server process to crash immediately (CWE-248 / Denial of Service).

Patches

Has the problem been patched? What versions should users upgrade to?

All three issues have been fixed in master and will be released in 1.82.1 shortly.

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

If upgrading grpc-go immediately is not possible, apply the following workarounds based on your deployment architecture:

For xDS RBAC Vulnerabilities & Panics: Ensure that upstream xDS management servers do not push RBAC policies containing Metadata, RequestedServerName, or NOT rules wrapping unsupported fields (such as SourcedMetadata) to grpc-go servers.

For HTTP/2 Rapid Reset DOS: Configure upstream reverse proxies or load balancers (such as Envoy) with strict HTTP/2 max_concurrent_streams limits and active rate limiting on RST_STREAM frequency per connection.

Severity

Vulnerability Qualitative Severity Approximate CVSS v3.1 Score Primary Impact

xDS RBAC Authorization Bypass High 8.2 Unauthorized Access / Fail-Open

HTTP/2 Rapid Reset DOS Bypass High 7.5 High CPU Consumption / Denial of Service

xDS RBAC Engine Server Panic Medium 5.9 Process Crash / Denial of Service

Improper Validation of Array Index

Affected range	`<1.82.2`
Fixed version	`1.82.2`
CVSS Score	`8.7`
CVSS Vector	`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X`
EPSS Score	`0.641%`
EPSS Percentile	`50th percentile`

Description

A vulnerability exists in gRPC-Go servers configured with xds.NewGRPCServer() where a crafted request missing both :authority and Host headers can cause a server panic, resulting in a Denial of Service (DoS).

Servers built with xds.NewGRPCServer install an xDS routing interceptor on every RPC. This interceptor looks up the request’s :authority header to pick a virtual host. The HTTP/2 server transport previously accepted requests that had neither :authority nor Host. When this happened, the xDS routing interceptor attempted to access the first element of an empty slice of authorities, leading to an index out of bounds panic. Since the per-RPC goroutine does not recover from panics, the entire server process would terminate.

This panic occurs in the interceptor pipeline, meaning the transport credentials handshake (TLS, mTLS, or ALTS) and HTTP/2 connection establishment must complete successfully before the crafted request can reach this logic.

Insecure/Standard TLS: If the server permits insecure (plaintext) connections or standard credentials (where client certs are not checked), any unauthenticated remote attacker can trigger the crash.

mTLS / ALTS: If strict transport-level authentication is enforced at the network edge or transport layer (e.g., requiring a valid client certificate), the attacker must possess valid transport credentials to initiate the stream and trigger the panic.

Impact

An attacker can cause a complete outage of the gRPC server by sending a request missing both :authority and Host headers, provided they can successfully establish a transport connection.

Patches

The issue has been addressed in master (and backported to 1.84.0, 1.83.2 and 1.82.2). The fix updates the HTTP/2 transport layer to reject requests missing both :authority and Host headers early, maintaining consistency with and other gRPC language implementations.

Uncontrolled Resource Consumption

Affected range	`<=1.83.0`
Fixed version	`1.83.1`
CVSS Score	`8.7`
CVSS Vector	`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N`
EPSS Score	`0.609%`
EPSS Percentile	`48th percentile`

Description

Impact

An unauthenticated remote attacker can initiate a gRPC stream and purposefully fragment their payload into millions of tiny (e.g., 1-byte) HTTP/2 DATA frames. Even if the total payload volume falls within the configured connection and stream flow-control windows, each independent fragment incurs memory overhead due to internal tracking structures and queue allocation.

Repeated fragmentation massively inflates the heap space consumed by the stream. An attacker multiplexing multiple concurrent streams can exhaust the memory bounds of the runtime, forcing a runtime panic or OutOfMemory condition and leading to a remote Denial of Service (DoS).

Patches

The change to fix this issue is merged in master and a patch release, 1.83.1, has been published that contains this fix.

Workarounds

This vulnerability is mitigated by implementing receive buffer compaction. Consecutive small data buffers are automatically coalesced into larger buffers from a shared pool once the overhead is perceived to be excessive relative to actual payload data, drastically minimizing per-frame memory overheads.

This behavior is enabled by default. A temporary escape hatch is provided via the environment variable GRPC_GO_EXPERIMENTAL_ENABLE_RECEIVE_BUFFER_COMPACTION=false to disable the feature if unforeseen issues arise, but it will be removed in a future release.

Improper Handling of Case Sensitivity

Affected range	`<=1.83.0`
Fixed version	`1.83.1`
CVSS Score	`6.3`
CVSS Vector	`CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N`
EPSS Score	`0.311%`
EPSS Percentile	`23rd percentile`

Description

Summary

A vulnerability in the xDS RBAC HTTP filter implementation in grpc-go allows remote attackers to bypass authorization policies (specifically DENY rules) by using mixed-case or canonical-case header matchers (e.g., X-Role instead of x-role). Additionally, the safety guards introduced by gRFC A41 to block grpc- prefixed headers can be evaded via variations in casing (e.g., Grpc-Status).

Impact

When an operator defines an RBAC policy referencing headers containing uppercase letters (e.g. X-Role), grpc-go fails to match incoming metadata keys because they are unconditionally lowercased. Because of this case-sensitivity mismatch, a policy designed to block requests containing specific header values fails open: the rule is evaluated as a non-match, and traffic that should have been rejected is served.

Furthermore, gRFC A41 requires rejecting configuration schemas specifying header matchers starting with grpc-. Because this check is executed case-sensitively in grpc-go, attackers can bypass the validation by specifying titles like Grpc-Status.

Patches

The problem is fixed in master and in the 1.83.1 release.

org.apache.commons/commons-compress 1.5 (maven)

pkg:maven/org.apache.commons/commons-compress@1.5

Improper Handling of Length Parameter Inconsistency

Affected range	`<1.21`
Fixed version	`1.21`
CVSS Score	`7.5`
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`
EPSS Score	`12.945%`
EPSS Percentile	`96th percentile`

Description

When reading a specially crafted ZIP archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' zip package.

Improper Handling of Length Parameter Inconsistency

Affected range	`<1.21`
Fixed version	`1.21`
CVSS Score	`7.5`
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`
EPSS Score	`10.614%`
EPSS Percentile	`96th percentile`

Description

When reading a specially crafted TAR archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' tar package.

Improper Handling of Length Parameter Inconsistency

Affected range	`<1.21`
Fixed version	`1.21`
CVSS Score	`7.5`
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`
EPSS Score	`12.365%`
EPSS Percentile	`96th percentile`

Description

When reading a specially crafted 7Z archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' sevenz package.

Excessive Iteration

Affected range	`<1.21`
Fixed version	`1.21`
CVSS Score	`7.5`
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`
EPSS Score	`11.567%`
EPSS Percentile	`96th percentile`

Description

When reading a specially crafted 7Z archive, the construction of the list of codecs that decompress an entry can result in an infinite loop. This could be used to mount a denial of service attack against services that use Compress' sevenz package.

Loop with Unreachable Exit Condition ('Infinite Loop')

Affected range	`>=1.3 <1.26.0`
Fixed version	`1.26.0`
CVSS Score	`5.9`
CVSS Vector	`CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H`
EPSS Score	`0.441%`
EPSS Percentile	`37th percentile`

Description

Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Commons Compress. This issue affects Apache Commons Compress: from 1.3 through 1.25.0.

Users are recommended to upgrade to version 1.26.0 which fixes the issue.

io.netty/netty-codec-haproxy 4.2.7.Final (maven)

pkg:maven/io.netty/netty-codec-haproxy@4.2.7.Final

Uncontrolled Resource Consumption

Affected range	`>=4.2.0.Final <=4.2.15.Final`
Fixed version	`4.2.16.Final`
CVSS Score	`8.7`
CVSS Vector	`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N`
EPSS Score	`0.630%`
EPSS Percentile	`49th percentile`

Description

The HAProxyMessageDecoder in netty's codec-haproxy module performs protocol version detection by reading the 13th byte of the inbound stream as a signed Java byte and widening it to int without masking. When an attacker sends a PROXY protocol v2 binary prefix (0D 0A 0D 0A 00 0D 0A 51 55 49 54 0A) followed by version byte 0xFF, the sign extension produces -1, which collides with the decoder's "need more data" sentinel value. This collision traps the decoder in a version-detection loop where it perpetually requests more data without consuming any bytes, never instantiates the HeaderExtractor that enforces header size limits, and causes ByteToMessageDecoder to accumulate all subsequent inbound bytes into an unbounded cumulation buffer until the JVM exhausts its direct memory allocation.

Improper Validation of Syntactic Correctness of Input

Affected range	`>=4.2.0.Final <=4.2.14.Final`
Fixed version	`4.2.15.Final`
CVSS Score	`8.7`
CVSS Vector	`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N`
EPSS Score	`0.882%`
EPSS Percentile	`59th percentile`

Description

Impact

The HAProxy PROXY protocol v2 codec in netty leaks native or heap memory on every connection when a client sends a syntactically valid header containing nested PP2_TYPE_SSL TLVs (type-length-value records) at depth two or greater. The leak occurs on the successful parse path — no exception is thrown, the message fires downstream, the decoder removes itself, and the application releases the HAProxyMessage normally. Yet the underlying cumulation buffer (a pooled, potentially direct ByteBuf allocated by the channel) remains permanently pinned.

Improper Check or Handling of Exceptional Conditions

Affected range	`>=4.2.0.Final <=4.2.14.Final`
Fixed version	`4.2.15.Final`
CVSS Score	`7.5`
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`
EPSS Score	`0.882%`
EPSS Percentile	`59th percentile`

Description

When decoding a PP2_TYPE_SSL TLV, HAProxyMessage.readNextTLV() first calls header.retainedSlice(header.readerIndex(), length) and only then reads the 1-byte client field and 4-byte verify field. If the attacker sets the TLV length below 5, the subsequent readByte/readInt throws IndexOutOfBoundsException. HAProxyMessageDecoder only catches HAProxyProtocolException around this call, so the IOOBE propagates and the retained slice on the pooled cumulation buffer is never released.

Improper Neutralization of CRLF Sequences ('CRLF Injection')

Affected range	`>=4.2.0.Final <4.2.16.Final`
Fixed version	`4.2.16.Final`
CVSS Score	`5.5`
CVSS Vector	`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N`
EPSS Score	`0.165%`
EPSS Percentile	`5th percentile`

Description

Security Vulnerability Report: HAProxy V1 Protocol CRLF Injection via AF_UNIX Address in Netty

1. Vulnerability Summary

Field	Value
Product	Netty
Version	4.2.12.Final (and all prior versions with codec-haproxy)
Component	`io.netty.handler.codec.haproxy.HAProxyMessageEncoder`
Vulnerability Type	CWE-93: Improper Neutralization of CRLF Sequences
Impact	HAProxy PROXY Protocol Injection / Client IP Spoofing
CVSS 3.1 Score	7.5 (High)
CVSS 3.1 Vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N`

2. Affected Components

io.netty.handler.codec.haproxy.HAProxyMessageEncoder — encodeV1() method (lines 63-77): writes sourceAddress and destinationAddress directly to output without CRLF validation
io.netty.handler.codec.haproxy.HAProxyMessage — constructor checkAddress() validates IPv4/IPv6 format but only checks length for AF_UNIX (line 439)

3. Vulnerability Description

Netty's HAProxy protocol encoder writes AF_UNIX socket addresses directly into the HAProxy V1 text protocol format without validating for CRLF characters. The V1 protocol uses CRLF (\r\n) as the line terminator, so CRLF characters in an address split the single PROXY header line into multiple lines, effectively injecting a second PROXY protocol header.

Root Cause — Encoder

// HAProxyMessageEncoder.java:63-77
private static void encodeV1(HAProxyMessage msg, ByteBuf out) {
    out.writeBytes(TEXT_PREFIX);                                    // "PROXY "
    out.writeByte((byte) ' ');
    out.writeCharSequence(msg.proxiedProtocol().name(), US_ASCII); // "UNIX_STREAM"
    out.writeByte((byte) ' ');
    out.writeCharSequence(msg.sourceAddress(), US_ASCII);           // <-- NO CRLF CHECK
    out.writeByte((byte) ' ');
    out.writeCharSequence(msg.destinationAddress(), US_ASCII);      // <-- NO CRLF CHECK
    out.writeByte((byte) ' ');
    // ...
    out.writeByte((byte) '\r');
    out.writeByte((byte) '\n');
}

Root Cause — Insufficient Address Validation

// HAProxyMessage.java:428-442
private static void checkAddress(String address, AddressFamily addrFamily) {
    switch (addrFamily) {
        case AF_UNIX:
            ObjectUtil.checkNotNull(address, "address");
            if (address.getBytes(CharsetUtil.US_ASCII).length > 108) {
                throw new IllegalArgumentException("invalid AF_UNIX address: " + address);
            }
            return;  // ONLY checks length <= 108, NO CRLF validation!
        case AF_IPv4:
            if (!NetUtil.isValidIpV4Address(address)) { ... }  // Format check blocks CRLF
        case AF_IPv6:
            if (!NetUtil.isValidIpV6Address(address)) { ... }  // Format check blocks CRLF
    }
}

IPv4 and IPv6 addresses are validated against format rules that implicitly reject CRLF. But AF_UNIX addresses only check length <= 108 — any characters including CRLF are accepted.

4. Exploitability Prerequisites

This vulnerability is exploitable when:

An application uses Netty's HAProxyMessageEncoder to construct HAProxy V1 protocol headers
AF_UNIX (UNIX_STREAM or UNIX_DGRAM) addresses contain user-controlled input
The encoded PROXY header is sent to a downstream server or load balancer

Affected use cases:

PROXY protocol relays that construct AF_UNIX messages from upstream data
Load balancer integrations where socket paths come from configuration or external sources
Multi-tenant proxies that dynamically construct PROXY headers

5. Attack Scenario

Client IP Spoofing via Second PROXY Line Injection

String maliciousAddr = "/var/run/app.sock\r\nPROXY TCP4 10.0.0.1 10.0.0.2 1234 80";

HAProxyMessage msg = new HAProxyMessage(
    HAProxyProtocolVersion.V1,
    HAProxyCommand.PROXY,
    HAProxyProxiedProtocol.UNIX_STREAM,
    maliciousAddr,                    // CRLF-injected source address
    "/var/run/dest.sock",
    0, 0);

Wire format sent to backend:

PROXY UNIX_STREAM /var/run/app.sock
PROXY TCP4 10.0.0.1 10.0.0.2 1234 80 /var/run/dest.sock 0 0

The backend receives two PROXY lines. Depending on implementation:

HAProxy: may use the first line and ignore the second
Other implementations: may use the second line, treating the connection as TCP4 from 10.0.0.1
This enables client IP spoofing — the backend believes the client is 10.0.0.1 when it's not

6. Proof of Concept

Full Runnable PoC Source Code (HAProxyUnixCRLFPoC.java)

import io.netty.buffer.ByteBuf;
import io.netty.channel.embedded.EmbeddedChannel;
import io.netty.handler.codec.haproxy.*;
import java.nio.charset.StandardCharsets;

public class HAProxyUnixCRLFPoC {
    public static void main(String[] args) {
        System.out.println("=== Netty HAProxy AF_UNIX CRLF Injection PoC ===\n");

        String maliciousAddr = "/var/run/app.sock\r\nPROXY TCP4 10.0.0.1 10.0.0.2 1234 80";
        String destAddr = "/var/run/dest.sock";

        HAProxyMessage msg = new HAProxyMessage(
            HAProxyProtocolVersion.V1,
            HAProxyCommand.PROXY,
            HAProxyProxiedProtocol.UNIX_STREAM,
            maliciousAddr, destAddr, 0, 0);

        EmbeddedChannel ch = new EmbeddedChannel(HAProxyMessageEncoder.INSTANCE);
        ch.writeOutbound(msg);

        ByteBuf out = ch.readOutbound();
        String encoded = out.toString(StandardCharsets.UTF_8);
        out.release();
        ch.finishAndReleaseAll();

        System.out.println("Wire format:");
        for (String line : encoded.split("\n", -1)) {
            System.out.println("  " + line.replace("\r", "\\r"));
        }

        int proxyCount = 0;
        for (String line : encoded.split("\r\n")) {
            if (line.startsWith("PROXY")) proxyCount++;
        }
        System.out.println("PROXY lines: " + proxyCount);
        System.out.println("VULNERABLE: " + (proxyCount > 1 ? "YES" : "NO"));
    }
}

How to Compile and Run

JARS=$(find ~/.m2/repository/io/netty -name "netty-*.jar" -path "*/4.2.12.Final/*" \
  | grep -v sources | grep -v javadoc | tr '\n' ':')
javac -cp "$JARS" HAProxyUnixCRLFPoC.java
java -cp "$JARS:." HAProxyUnixCRLFPoC

PoC Execution Output (Verified on Netty 4.2.12.Final)

=== Netty HAProxy AF_UNIX CRLF Injection PoC ===

[TEST 1] AF_UNIX Source Address CRLF Injection
------------------------------------------------
  Source address: "/var/run/app.sock\r\nPROXY TCP4 10.0.0.1 10.0.0.2 1234 80"
  Wire format:
    PROXY UNIX_STREAM /var/run/app.sock\r
    PROXY TCP4 10.0.0.1 10.0.0.2 1234 80 /var/run/dest.sock 0 0\r

  PROXY lines found: 2
  VULNERABLE: YES - Second PROXY line injected!

7. Remediation Recommendations

Option 1: Validate AF_UNIX Addresses for CRLF

// HAProxyMessage.java checkAddress() - add for AF_UNIX:
case AF_UNIX:
    ObjectUtil.checkNotNull(address, "address");
    byte[] addrBytes = address.getBytes(CharsetUtil.US_ASCII);
    if (addrBytes.length > 108) {
        throw new IllegalArgumentException("invalid AF_UNIX address: too long");
    }
    for (byte b : addrBytes) {
        if (b == '\r' || b == '\n') {
            throw new IllegalArgumentException(
                "AF_UNIX address contains prohibited CRLF character");
        }
    }
    return;

Option 2: Validate in Encoder

// HAProxyMessageEncoder.java encodeV1() - validate before writing:
private static void validateV1Address(String address) {
    for (int i = 0; i < address.length(); i++) {
        char c = address.charAt(i);
        if (c == '\r' || c == '\n' || c == ' ') {
            throw new HAProxyProtocolException(
                "V1 address contains prohibited character at index " + i);
        }
    }
}

8. References

golang.org/x/mod 0.24.0 (golang)

pkg:golang/golang.org/x/mod@0.24.0

Affected range	`<0.40.0`
Fixed version	`0.40.0`
EPSS Score	`0.129%`
EPSS Percentile	`2nd percentile`

Description

A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache.

This attack allows for a malicious GOPROXY to serve malicious module content that cannot be detected by evaluating the transparency log.

All tiles are now correctly verified against their parents.

In order to determine if you have been affected:

rm -r go.sum go.work.sum vendor/ && go mod tidy

Affected range	`<0.40.0`
Fixed version	`0.40.0`
EPSS Score	`0.298%`
EPSS Percentile	`21st percentile`

Description

A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log.

This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log.

In order to determine if you have been affected:

rm -r go.sum go.work.sum vendor/ && go mod tidy

libxml2 2.13.9-r0 (apk)

pkg:apk/alpine/libxml2@2.13.9-r0?os_name=alpine&os_version=3.23

Affected range	`<=2.13.9-r0`
Fixed version	Not Fixed
EPSS Score	`0.157%`
EPSS Percentile	`4th percentile`

Description

Affected range	`<=2.13.9-r0`
Fixed version	Not Fixed
EPSS Score	`0.194%`
EPSS Percentile	`9th percentile`

Description

Affected range	`<=2.13.9-r0`
Fixed version	Not Fixed
EPSS Score	`0.157%`
EPSS Percentile	`4th percentile`

Description

Affected range	`<=2.13.9-r0`
Fixed version	Not Fixed
EPSS Score	`0.166%`
EPSS Percentile	`6th percentile`

Description

Affected range	`<=2.13.9-r0`
Fixed version	Not Fixed
EPSS Score	`0.132%`
EPSS Percentile	`2nd percentile`

Description

Affected range	`<2.13.9-r1`
Fixed version	`2.13.9-r1`
EPSS Score	`0.942%`
EPSS Percentile	`60th percentile`

Description

Affected range	`<=2.13.9-r0`
Fixed version	Not Fixed
EPSS Score	`0.186%`
EPSS Percentile	`8th percentile`

Description

Affected range	`<=2.13.9-r0`
Fixed version	Not Fixed
EPSS Score	`0.530%`
EPSS Percentile	`44th percentile`

Description

Affected range	`<=2.13.9-r0`
Fixed version	Not Fixed
EPSS Score	`0.165%`
EPSS Percentile	`5th percentile`

Description

Affected range	`<=2.13.9-r0`
Fixed version	Not Fixed
EPSS Score	`0.195%`
EPSS Percentile	`9th percentile`

Description

Affected range	`<=2.13.9-r0`
Fixed version	Not Fixed
EPSS Score	`0.216%`
EPSS Percentile	`11th percentile`

Description

Affected range	`<=2.13.9-r0`
Fixed version	Not Fixed
EPSS Score	`0.148%`
EPSS Percentile	`4th percentile`

Description

zlib 1.3.1-r2 (apk)

pkg:apk/alpine/zlib@1.3.1-r2?os_name=alpine&os_version=3.23

Affected range	`<1.3.2-r1`
Fixed version	`1.3.2-r1`
EPSS Score	`0.356%`
EPSS Percentile	`28th percentile`

Description

Affected range	`<1.3.2-r0`
Fixed version	`1.3.2-r0`
EPSS Score	`0.413%`
EPSS Percentile	`34th percentile`

Description

Affected range	`<1.3.2-r0`
Fixed version	`1.3.2-r0`
EPSS Score	`0.209%`
EPSS Percentile	`11th percentile`

Description

musl 1.2.5-r21 (apk)

pkg:apk/alpine/musl@1.2.5-r21?os_name=alpine&os_version=3.23

Affected range	`<1.2.5-r23`
Fixed version	`1.2.5-r23`
EPSS Score	`0.171%`
EPSS Percentile	`6th percentile`

Description

Affected range	`<1.2.5-r22`
Fixed version	`1.2.5-r22`
EPSS Score	`0.160%`
EPSS Percentile	`5th percentile`

Description

go.opentelemetry.io/otel/sdk 1.40.0 (golang)

pkg:golang/go.opentelemetry.io/otel/sdk@1.40.0

Untrusted Search Path

Affected range	`>=1.15.0 <=1.42.0`
Fixed version	`1.43.0`
CVSS Score	`7.3`
CVSS Vector	`CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N`
EPSS Score	`0.207%`
EPSS Percentile	`10th percentile`

Description

Summary

The fix for GHSA-9h8m-3fm2-qjrq (CVE-2026-24051) changed the Darwin ioreg command to use an absolute path but left the BSD kenv command using a bare name, allowing the same PATH hijacking attack on BSD and Solaris platforms.

Root Cause

sdk/resource/host_id.go line 42:
if result, err := r.execCommand("kenv", "-q", "smbios.system.uuid"); err == nil {
Compare with the fixed Darwin path at line 58:
result, err := r.execCommand("/usr/sbin/ioreg", "-rd1", "-c", "IOPlatformExpertDevice")
The execCommand helper at sdk/resource/host_id_exec.go uses exec.Command(name, arg...) which searches $PATH when the command name contains no path separator.

Affected platforms (per build tag in host_id_bsd.go:4): DragonFly BSD, FreeBSD, NetBSD, OpenBSD, Solaris.

The kenv path is reached when /etc/hostid does not exist (line 38-40), which is common on FreeBSD systems.

Attack

Attacker has local access to a system running a Go application that imports go.opentelemetry.io/otel/sdk

Attacker places a malicious kenv binary earlier in $PATH

Application initializes OpenTelemetry resource detection at startup

hostIDReaderBSD.read() calls exec.Command("kenv", ...) which resolves to the malicious binary

Arbitrary code executes in the context of the application

Same attack vector and impact as CVE-2026-24051.

Suggested Fix

Use the absolute path:
if result, err := r.execCommand("/bin/kenv", "-q", "smbios.system.uuid"); err == nil {
On FreeBSD, kenv is located at /bin/kenv.

Exposure of Sensitive Information to an Unauthorized Actor

Affected range	`>=1.5.0 <=1.44.0`
Fixed version	`1.45.0`
CVSS Score	`2`
CVSS Vector	`CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N`
EPSS Score	`0.195%`
EPSS Percentile	`9th percentile`

Description

Summary

OpenTelemetry Go versions 1.5.0 through 1.44.0 can include trace exporter endpoint configuration in an internal diagnostic log emitted when an SDK TracerProvider is created. The default OpenTelemetry logger does not emit this event. Exposure requires an application to install a logger that enables OpenTelemetry's internal Info-level diagnostics and for someone other than the intended audience to have access to those logs.

The logged configuration can disclose the address of the trace collector and whether the OTLP/HTTP connection is configured as insecure. The Zipkin exporter logs its complete collector URL, so credentials in URL userinfo or tokens in the query string are also disclosed if an application embeds them there. OTLP authentication headers, TLS key material, and exported span data are not included in this log.

Exporter MarshalLog implementations that caused this configuration to be included in internal logs were introduced by a1fff3c.

Details

When sdk/trace.NewTracerProvider constructs a provider, it records a TracerProvider created internal Info event containing the provider configuration. In affected versions, the configuration's MarshalLog methods recursively include:

the provider's span processors;

each processor's span exporter; and

for the OTLP trace exporter, its client configuration.

This causes the following values to be present in the event:

OTLP trace gRPC: the configured endpoint;

OTLP trace HTTP: the configured endpoint and the Insecure flag; and

Zipkin: the complete collector URL.

OpenTelemetry Go does not emit this event with its default logger, which only emits errors. An application must explicitly configure a sufficiently verbose logger with otel.SetLogger. The required logr verbosity is version-dependent:

versions 1.5.0 through 1.14.x use V(1) for this Info event; and

versions 1.15.0 through 1.44.0 use V(4).

OTLP header configuration is not part of the marshaled object, so credentials supplied with WithHeaders or the corresponding environment variables are not exposed. The documented OTLP WithEndpoint input is a collector address rather than a credential-bearing URL. The higher-risk case is therefore the Zipkin collector URL, which is retained and logged in full, or an application passing sensitive data in an OTLP endpoint outside the documented format.

Proof of concept

The following program demonstrates the behavior with OpenTelemetry Go 1.44.0. It deliberately places credentials and a token in the Zipkin collector URL and enables internal Info logging:
package main

import (
	"bytes"
	"context"
	"fmt"

	"github.com/go-logr/logr/funcr"
	"go.opentelemetry.io/otel"
	"go.opentelemetry.io/otel/exporters/zipkin"
	sdktrace "go.opentelemetry.io/otel/sdk/trace"
)

func main() {
	var logs bytes.Buffer
	otel.SetLogger(funcr.New(func(_, args string) {
		_, _ = logs.WriteString(args)
	}, funcr.Options{Verbosity: 4}))

	exporter, err := zipkin.New(
		"http://user:pass@zipkin.internal:9411/api/v2/spans?token=secret",
	)
	if err != nil {
		panic(err)
	}

	tp := sdktrace.NewTracerProvider(sdktrace.WithBatcher(exporter))
	_ = tp.Shutdown(context.Background())

	fmt.Println(logs.String())
}
The TracerProvider created event contains:
http://user:pass@zipkin.internal:9411/api/v2/spans?token=secret
For versions before 1.15.0, set funcr.Options{Verbosity: 1} instead.

Impact

This is a conditional disclosure through application logs. Affected applications must enable verbose OpenTelemetry internal diagnostics and configure a trace exporter containing information they do not intend to expose to readers of those logs. In that configuration, a person or system with log access can learn the trace collector address and internal network topology. If credentials or tokens are embedded directly in a Zipkin collector URL, those values can also be recovered from the logs.

There is no exposure with the default OpenTelemetry logger, and the vulnerable log is generated from local application configuration rather than remotely supplied span data. OTLP authentication headers, certificate or private-key contents, and telemetry payloads are not logged by this path.

Remediation

Upgrade the affected OpenTelemetry Go modules to version 1.45.0 or later. The fix in 3a1412d stops recursively marshaling exporter and client configuration and records their types instead.

If an immediate upgrade is not possible:

keep OpenTelemetry internal logging below the Info verbosity described above;

do not embed credentials or tokens in exporter endpoint URLs; use authentication headers or another supported credential mechanism; and

restrict access to existing logs and rotate any credentials that may already have been recorded.

golang.org/x/text 0.24.0 (golang)

pkg:golang/golang.org/x/text@0.24.0

Affected range	`<0.41.0`
Fixed version	`0.41.0`
EPSS Score	`0.335%`
EPSS Percentile	`25th percentile`

Description

The Nickname profile can panic with an out-of-bounds slice error when transforming crafted input into a short destination buffer.

Affected range	`<0.39.0`
Fixed version	`0.39.0`
EPSS Score	`0.475%`
EPSS Percentile	`40th percentile`

Description

A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes.

golang.org/x/text 0.33.0 (golang)

pkg:golang/golang.org/x/text@0.33.0

Affected range	`<0.41.0`
Fixed version	`0.41.0`
EPSS Score	`0.335%`
EPSS Percentile	`25th percentile`

Description

The Nickname profile can panic with an out-of-bounds slice error when transforming crafted input into a short destination buffer.

Affected range	`<0.39.0`
Fixed version	`0.39.0`
EPSS Score	`0.475%`
EPSS Percentile	`40th percentile`

Description

A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes.

org.codehaus.plexus/plexus-utils 3.5.1 (maven)

pkg:maven/org.codehaus.plexus/plexus-utils@3.5.1

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Affected range	`<3.6.1`
Fixed version	`4.0.3`
EPSS Score	`0.663%`
EPSS Percentile	`51st percentile`

Description

Directory Traversal vulnerability in the extractFile method of org.codehaus.plexus.util.Expand in plexus-utils before 6d780b3378829318ba5c2d29547e0012d5b29642. This allows an attacker to execute arbitrary code

go.opentelemetry.io/otel 1.40.0 (golang)

pkg:golang/go.opentelemetry.io/otel@1.40.0

Uncontrolled Resource Consumption

Affected range	`>=1.36.0 <=1.40.0`
Fixed version	`1.41.0`
CVSS Score	`7.5`
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`
EPSS Score	`0.873%`
EPSS Percentile	`58th percentile`

Description

multi-value baggage: header extraction parses each header field-value independently and aggregates members across values. this allows an attacker to amplify cpu and allocations by sending many baggage: header lines, even when each individual value is within the 8192-byte per-value parse limit.

severity

HIGH (availability / remote request amplification)

relevant links

repository: https://github.com/open-telemetry/opentelemetry-go

pinned callsite: https://github.com/open-telemetry/opentelemetry-go/blob/1ee4a4126dbdd1bc79e9fae072fa488beffac52a/propagation/baggage.go#L58

vulnerability details

pins: open-telemetry/opentelemetry-go@1ee4a41
as-of: 2026-02-04
policy: direct (no program scope provided)

callsite: propagation/baggage.go:58 (extractMultiBaggage)
attacker control: inbound HTTP request headers (many baggage field-values) → propagation.HeaderCarrier.Values("baggage") → repeated baggage.Parse + member aggregation

root cause

extractMultiBaggage iterates over all baggage header field-values and parses each one independently, then appends members into a shared slice. the 8192-byte parsing cap applies per header value, but the multi-value path repeats that work once per header line (bounded only by the server/proxy header byte limit).

impact

in a default net/http configuration (max header bytes 1mb), a single request with many baggage: header field-values can cause large per-request allocations and increased latency.

example from the attached PoC harness (darwin/arm64; 80 values; 40 requests):

canonical: per_req_alloc_bytes=10315458 and p95_ms=7

control: per_req_alloc_bytes=133429 and p95_ms=0

proof of concept

canonical:
mkdir -p poc
unzip poc.zip -d poc
cd poc
make test
output (excerpt):
[CALLSITE_HIT]: propagation/baggage.go:58 extractMultiBaggage
[PROOF_MARKER]: baggage_multi_value_amplification p95_ms=7 per_req_alloc_bytes=10315458 per_req_allocs=16165
control:
cd poc
make control
control output (excerpt):
[NC_MARKER]: baggage_single_value_baseline p95_ms=0 per_req_alloc_bytes=133429 per_req_allocs=480
expected: multiple baggage header field-values should be semantically equivalent to a single comma-joined baggage value and should not multiply parsing/alloc work within the effective header byte budget.
actual: multiple baggage header field-values trigger repeated parsing and member aggregation, causing high per-request allocations and increased latency even when each individual value is within 8192 bytes.

fix recommendation

avoid repeated parsing across multi-values by enforcing a global budget and/or normalizing multi-values into a single value before parsing. one mitigation approach is to treat multi-values as a single comma-joined string and cap total parsed bytes (for example 8192 bytes total).

fix accepted when: under the default PoC harness settings, canonical stays within 2x of control for per_req_alloc_bytes and per_req_allocs, and p95_ms stays below 2ms.

poc.zip
PR_DESCRIPTION.md

commons-lang/commons-lang 2.6 (maven)

pkg:maven/commons-lang/commons-lang@2.6

Uncontrolled Recursion

Affected range	`>=2.0 <=2.6`
Fixed version	Not Fixed
CVSS Score	`6.5`
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N`
EPSS Score	`2.632%`
EPSS Percentile	`85th percentile`

Description

Uncontrolled Recursion vulnerability in Apache Commons Lang.

This issue affects Apache Commons Lang: Starting with commons-lang:commons-lang 2.0 to 2.6, and, from org.apache.commons:commons-lang3 3.0 before 3.18.0.

The methods ClassUtils.getClass(...) can throw StackOverflowError on very long inputs. Because an Error is usually not handled by applications and libraries, a StackOverflowError could cause an application to stop.

Users are recommended to upgrade to version 3.18.0, which fixes the issue.

busybox 1.37.0-r30 (apk)

pkg:apk/alpine/busybox@1.37.0-r30?os_name=alpine&os_version=3.23

Affected range	`<=1.37.0-r30`
Fixed version	Not Fixed
EPSS Score	`0.312%`
EPSS Percentile	`23rd percentile`

Description

org.jline/jline-reader 3.20.0 (maven)

pkg:maven/org.jline/jline-reader@3.20.0

Inefficient Regular Expression Complexity

Affected range	`>=3.0.0 <3.30.15`
Fixed version	`3.30.15`
CVSS Score	`5.5`
CVSS Vector	`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H`
EPSS Score	`0.123%`
EPSS Percentile	`2nd percentile`

Description

Summary

The JLine3 HISTORY_IGNORE variable is converted into a Java regular expression with
only partial escaping. As a result, regex metacharacters other than * and : are
passed through to the regex engine. A crafted value such as (a+)+b can cause
catastrophic backtracking each time a command line is added to history, hanging the
reader thread at high CPU.

Details

In reader/src/main/java/org/jline/reader/impl/history/DefaultHistory.java,
matchPatterns() converts HISTORY_IGNORE into a regex:
for (int i = 0; i < patterns.length(); i++) {
    char ch = patterns.charAt(i);
    if (ch == '\\') {
        ch = patterns.charAt(++i);
        sb.append(ch);
    } else if (ch == ':') {
        sb.append('|');
    } else if (ch == '*') {
        sb.append('.').append('*');
    } else {
        sb.append(ch);
    }
}
return line.matches(sb.toString());
This logic translates wildcard syntax but does not escape regex metacharacters such as
(, ), +, ?, {, }, [, and ]. Those characters therefore reach the Java
regex engine unchanged.

Affected source location:

reader/src/main/java/org/jline/reader/impl/history/DefaultHistory.java

matchPatterns(String patterns, String line)

PoC

Configure HISTORY_IGNORE to a malicious pattern, for example:
set history-ignore "(a+)+b"
At the JLine prompt, enter a long non-matching line:
aaaaaaaaaaaaaaaaaaaaaaaaaaax
Press Enter.

Expected result:

The prompt does not return.

The reader thread consumes high CPU.

Reproduction environment:

JLine3 on x86_64 Linux

OpenJDK 25.0.2

Impact

This is a denial-of-service vulnerability caused by catastrophic regex backtracking.
Applications embedding org.jline:jline-reader are impacted if they allow
HISTORY_IGNORE to be configured through user configuration or application settings.
The issue is lower severity than the interactive editor findings because the attacker
must control configuration, but it can still reliably hang a reader session.

Suggested Fix

The safest fix for the current git head is to stop treating arbitrary HISTORY_IGNORE
content as a regex. Instead, escape all characters by default and translate only the
intended JLine wildcard syntax (*) and separator syntax (:).

Suggested patch:
diff --git a/reader/src/main/java/org/jline/reader/impl/history/DefaultHistory.java b/reader/src/main/java/org/jline/reader/impl/history/DefaultHistory.java
--- a/reader/src/main/java/org/jline/reader/impl/history/DefaultHistory.java
+++ b/reader/src/main/java/org/jline/reader/impl/history/DefaultHistory.java
@@
         StringBuilder sb = new StringBuilder();
         for (int i = 0; i < patterns.length(); i++) {
             char ch = patterns.charAt(i);
             if (ch == '\\') {
                 ch = patterns.charAt(++i);
-                sb.append(ch);
+                sb.append(Pattern.quote(Character.toString(ch)));
             } else if (ch == ':') {
                 sb.append('|');
             } else if (ch == '*') {
                 sb.append('.').append('*');
             } else {
-                sb.append(ch);
+                sb.append(Pattern.quote(Character.toString(ch)));
             }
         }
         return line.matches(sb.toString());
Credits

This issue was identified by Michał Majchrowicz and Marcin Wyczechowski, members of the AFINE Team.

golang.org/x/sys 0.41.0 (golang)

pkg:golang/golang.org/x/sys@0.41.0

Affected range	`<0.44.0`
Fixed version	`0.44.0`
EPSS Score	`0.158%`
EPSS Percentile	`5th percentile`

Description

NewNTUnicodeString does not check for string length overflow. When provided with a string that overflows the maximum size of a NTUnicodeString (a 16-bit number of bytes), it returns a truncated string rather than an error.

xz 5.8.2-r0 (apk)

pkg:apk/alpine/xz@5.8.2-r0?os_name=alpine&os_version=3.23

Affected range	`<5.8.3-r0`
Fixed version	`5.8.3-r0`
EPSS Score	`0.514%`
EPSS Percentile	`43rd percentile`

Description

sonarqubecloud · 2026-04-16T10:12:23Z

Quality Gate passed

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

sonarqubecloud · 2026-05-01T16:59:07Z

Quality Gate passed

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

sonarqubecloud · 2026-06-04T17:39:20Z

Quality Gate passed

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

sonarqubecloud · 2026-10-21T20:47:14Z

Quality Gate passed

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code