Security vulnerabilities and automated fixes for golang issues
16 posts found
A high-severity vulnerability in `golang.org/x/crypto/ssh` (CVE-2026-39828) allowed attackers to execute unauthorized commands by exploiting discarded SSH permissions. The fix involved upgrading `golang.org/x/crypto` from v0.51.0 to v0.52.0 in `go.mod`, closing an authentication bypass that could be triggered remotely in any Go service using the SSH package.
A high-severity unsafe deserialization vulnerability was discovered in `web/session/session.go` where a type assertion on an `interface{}` value was performed without checking success, enabling arbitrary data structures to flow into the application. The fix adds a two-branch type assertion that returns `nil` when the cast fails, preventing unexpected types from propagating. This pattern is common in Go session management code and is easy to overlook during code review.
CVE-2026-56852 is a high-severity denial-of-service vulnerability in `golang.org/x/text` where a `norm.Iter` iterator can enter an infinite loop when processing specially crafted Unicode input, hanging the process indefinitely. The `fe-tool` module was pinned to `v0.27.0`, which contains the flaw, and was upgraded to `v0.39.0` to eliminate the risk. Because `fe-tool` handles file-format parsing (7-Zip archives and Electron ASAR bundles), any user-supplied filename or archive content could have t
CVE-2026-32285 is a high-severity Denial of Service vulnerability in the Go library `github.com/buger/jsonparser` v1.1.1, triggered by crafted malformed JSON input. The fix is a dependency upgrade to v1.1.2 in `go.mod` and `go.sum`, which tightens input handling without affecting valid JSON processing. Any Go application that parses untrusted JSON through this library is potentially exposed until the upgrade is applied.
CVE-2026-56852 is a high-severity Denial of Service vulnerability in `golang.org/x/text` where `norm.Iter` can enter an infinite loop when processing invalid UTF-8 input, potentially hanging any Go application that normalizes untrusted text. The fix upgrades `golang.org/x/text` from v0.34.0 to v0.39.0 in `parser/go.mod`, closing the loop condition that malformed byte sequences could exploit. Developers using any version of `golang.org/x/text` below 0.39.0 should upgrade immediately.
A Denial of Service vulnerability (CVE-2026-32285) was discovered in the `github.com/buger/jsonparser` dependency used by this Go application, where crafted malformed JSON input could cause the parser to crash or hang, potentially taking down any service that processes untrusted JSON. The fix upgrades the dependency from v1.1.1 to v1.1.2 in `go.mod` and `go.sum`, closing the attack vector without changing any valid-input behavior. This is a practical reminder that transitive dependencies carry r
A high-severity vulnerability in `golang.org/x/mod` (CVE-2026-56864) allowed a malicious GOSUMDB to serve arbitrary module content by exploiting weaknesses in checksum database verification. Upgrading from v0.37.0 to v0.40.0 closes the attack surface by tightening how the module system validates responses from untrusted sources. Any Go project that resolves dependencies through a compromised or attacker-controlled proxy is affected until this upgrade is applied.
CVE-2026-56852 is a high-severity Denial of Service vulnerability in the `golang.org/x/text` package where a `norm.Iter` iterator can enter an infinite loop when processing certain invalid UTF-8 input sequences. Applications using `golang.org/x/text` v0.37.0 or earlier that accept untrusted text input are at risk of complete service disruption. The fix is a one-line dependency bump in `go.mod` from v0.37.0 to v0.39.0.
A Denial of Service vulnerability in `golang.org/x/crypto/ssh` (CVE-2026-39830) allowed attackers to exhaust server resources by sending unsolicited SSH responses that were never properly cleaned up. The fix upgrades `golang.org/x/crypto` from `v0.50.0` to `v0.52.0` in `go.mod`, patching the resource leak in the SSH package's response handling logic. Any Go application that uses the `golang.org/x/crypto/ssh` package for SSH client or server functionality was potentially exposed.
CVE-2026-39827 is a high-severity resource exhaustion vulnerability in `golang.org/x/crypto` where an authenticated SSH client can repeatedly open channels to consume server resources without bound. The vulnerability was present in the `cloud/gcp/functions/acmedns` module at version `v0.49.0` and was resolved by upgrading to `v0.52.0`. Left unpatched, this flaw could allow an attacker with valid SSH credentials to degrade or deny service to other users of the affected GCP Cloud Function.
A high-severity vulnerability (CVE-2026-27896) in the Model Context Protocol Go SDK v1.3.0 allowed attackers to bypass security controls through improper handling of case sensitivity. The fix upgrades the dependency from v1.3.0 to v1.3.1, which correctly normalizes case comparisons. This vulnerability was particularly concerning for CLI tools where attackers could manipulate input to evade validation logic.
A high-severity denial of service vulnerability (CVE-2025-22869) was discovered in the SSH key exchange implementation of Go's `golang.org/x/crypto` library. The `cpdaemon` service depended on the vulnerable version v0.32.0, which could allow an attacker to exhaust server resources during the SSH handshake phase. The fix upgrades the dependency to v0.35.0, which includes the upstream patch for this vulnerability.