chore(deps): update cli security deps [security] by renovate-bot · Pull Request #3509 · GoogleCloudPlatform/cloud-foundation-toolkit

renovate-bot · 2026-11-10T16:37:24Z

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/buger/jsonparser	`v1.1.1` → `v1.1.2`
github.com/cloudflare/circl	`v1.6.1` → `v1.6.3`
github.com/go-git/go-billy/v5	`v5.6.2` → `v5.9.0`
github.com/go-git/go-git/v5	`v5.16.5` → `v5.19.2`
github.com/go-jose/go-jose/v4	`v4.1.3` → `v4.1.6`
github.com/klauspost/compress	`v1.18.1` → `v1.18.7`
go.mongodb.org/mongo-driver	`v1.8.3` → `v1.17.7`
go.opentelemetry.io/otel	`v1.39.0` → `v1.41.0`
go.opentelemetry.io/otel/exporters/otlp/otlptrace	`v1.38.0` → `v1.45.0`
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc	`v1.38.0` → `v1.45.0`
go.opentelemetry.io/otel/sdk	`v1.39.0` → `v1.45.0`
golang.org/x/crypto	`v0.47.0` → `v0.52.0`
golang.org/x/net	`v0.49.0` → `v0.55.0`
google.golang.org/grpc	`v1.78.0` → `v1.83.1`

github.com/buger/jsonparser has a denial of service vulnerability

CVE-2026-32285 / GHSA-6g7g-w4f8-9c9x

More information

Details

The Delete function fails to properly validate offsets when processing malformed JSON input. This can lead to a negative slice index and a runtime panic, allowing a denial of service attack.

Severity

CVSS Score: 7.5 / 10 (High)
Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

CIRCL has an incorrect calculation in secp384r1 CombinedMult

CVE-2026-1229 / GHSA-q9hv-hpm4-hj6x

More information

Details

The CombinedMult function in the CIRCL ecc/p384 package (secp384r1 curve) produces an incorrect value for specific inputs. The issue is fixed by using complete addition formulas.
ECDH and ECDSA signing relying on this curve are not affected.

The bug was fixed in v1.6.3.

Severity

CVSS Score: 2.9 / 10 (Low)
Vector String: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P/S:N/AU:Y/U:Amber

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

go-billy: Lack of depth and cycle detection in symlink resolution may lead to infinite loops and resource exhaustion

CVE-2026-44740 / GHSA-m3xc-h892-ggx6

More information

Details

Impact

Multiple components may improperly handle crafted or malformed input, resulting in panics, infinite loops, uncontrolled recursion, or excessive resource consumption.

These issues arise from insufficient validation and missing safety mechanisms such as cycle detection, recursion limits, or defensive handling of unexpected states when processing untrusted repository data and filesystem structures.

Patches

Users should upgrade to a patched version in order to mitigate this vulnerability. Versions prior to v5 are likely to be affected, users are recommended to upgrade to a supported go-billy version.

Credits

Thanks to @faran66 for finding and reporting this issue privately to the go-git project. 🙇

Severity

CVSS Score: 6.5 / 10 (Medium)
Vector String: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

go-billy has path traversal vulnerabilities

CVE-2026-44973 / GHSA-qw64-3x98-g7q2

More information

Details

Impact

Multiple path traversal issues exist across different components of go-billy. Insufficient path sanitization and boundary enforcement may allow crafted paths (e.g., using ..) to escape intended base directories.

While go-billy was not originally designed to provide a strong security boundary, some of these issues were inconsistent across some of the built-in implementations. This results in scenarios where applications relying on go-billy for some level of isolation may inadvertently expose access to unintended filesystem locations.

The osfs.ChrootOS implementation is notably affected by this vulnerability and is now deprecated in v5, removed at v6. Users are recommended to move on to osfs.BoundOS instead: osfs.New(path, WithBoundOS()).

Users requiring stronger security boundary enforcement are recommended to upgrade to v6, where the osfs implementation are backed by the traversal-resistant primitive os.Root.

Patches

Users should upgrade to a patched version in order to mitigate this vulnerability. Versions prior to v5 are likely to be affected, users are recommended to upgrade to a supported go-billy version.

Credits

Thanks to @faran66 and @vnykmshr for finding and separately reporting this issue privately to the go-git project. 🙇

Severity

CVSS Score: 8.1 / 10 (High)
Vector String: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

go-git missing validation decoding Index v4 files leads to panic

CVE-2026-33762 / GHSA-gm2x-2g9h-ccm8

More information

Details

Impact

go-git’s index decoder for format version 4 fails to validate the path name prefix length before applying it to the previously decoded path name. A maliciously crafted index file can trigger an out-of-bounds slice operation, resulting in a runtime panic during normal index parsing.

This issue only affects Git index format version 4. Earlier formats (go-git supports only v2 and v3) are not vulnerable to this issue.

An attacker able to supply a crafted .git/index file can cause applications using go-git to panic while reading the index. If the application does not recover from panics, this results in process termination, leading to a denial-of-service (DoS) condition.

Exploitation requires the ability to modify or inject a Git index file within the local repository in disk. This typically implies write access to the .git directory.

Patches

Users should upgrade to v5.17.1, or the latest v6 pseudo-version, in order to mitigate this vulnerability.

Credit

go-git maintainers thank @kq5y for finding and reporting this issue privately to the go-git project.

Severity

CVSS Score: 2.8 / 10 (Low)
Vector String: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

go-git: Maliciously crafted idx file can cause asymmetric memory consumption

CVE-2026-34165 / GHSA-jhf3-xxhw-2wpp

More information

Details

Impact

A vulnerability has been identified in which a maliciously crafted .idx file can cause asymmetric memory consumption, potentially exhausting available memory and resulting in a Denial of Service (DoS) condition.

Exploitation requires write access to the local repository's .git directory, it order to create or alter existing .idx files.

Patches

Users should upgrade to v5.17.1, or the latest v6 pseudo-version, in order to mitigate this vulnerability.

Credit

The go-git maintainers thank @kq5y for finding and reporting this issue privately to the go-git project.

Severity

CVSS Score: 5.0 / 10 (Medium)
Vector String: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

go-git: Credential leak via cross-host redirect in smart HTTP transport

CVE-2026-41506 / GHSA-3xc5-wrhm-f963

More information

Details

Impact

go-git may leak HTTP authentication credentials when following redirects during smart-HTTP clone and fetch operations.

If a remote repository responds to the initial /info/refs request with a redirect to a different host, go-git updates the session endpoint to the redirected location and reuses the original authentication for subsequent requests. This can result in the credentials (e.g. Authorization headers) being sent to an unintended host.

An attacker controlling or influencing the redirect target can capture these credentials and potentially reuse them to access the victim’s repositories or other resources, depending on the scope of the credential.

Clients using go-git exclusively with trusted remotes (for example, GitHub or GitLab), and over a secure HTTPS connection, are not affected by this issue. The risk arises when interacting with untrusted or misconfigured Git servers, or when using unsecured HTTP connections, which is not recommended. Such configurations also expose clients to a broader class of security risks beyond this issue, including credential interception and tampering of repository data.

Patches

Users should upgrade to v5.18.0, or v6.0.0-alpha.2, in order to mitigate this vulnerability. Versions prior to v5 are likely to be affected, users are recommended to upgrade to a supported go-git version.

The patched versions add support for configuring followRedirects. In line with upstream behaviour, the default is now initial, while users can opt into FollowRedirects or NoFollowRedirects programmatically.

Credit

Thanks to the 3 separate reports from @celinke97, @N0zoM1z0 and @AyushParkara. Thanks for finding and reporting this issue privately to the go-git project. 🙇

Severity

CVSS Score: 4.7 / 10 (Medium)
Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

go-git's improper parsing of specially crafted objects may lead to inconsistent interpretation compared to upstream Git

CVE-2026-45022 / GHSA-389r-gv7p-r3rp

More information

Details

Impact

go-git may parse malformed Git objects in a way that differs from upstream Git. When commit or tag objects contain ambiguous or malformed headers, go-git’s decoded representation may expose values differently from how Git itself would interpret or reject the same object.

Additionally, go-git’s commit signing and verification logic operates over commit data reconstructed from go-git’s parsed representation rather than the original raw object bytes. As a result, go-git may sign or verify a commit payload that is not byte-for-byte equivalent to the object stored in the repository.

This can cause a signature to appear valid for a commit whose displayed or effective metadata differs from the object that was intended to be signed.

Patches

Users should upgrade to a patched version in order to mitigate this vulnerability. Versions prior to v5 are likely to be affected, users are recommended to upgrade to a supported go-git version.

Credit

Thanks to @bugbunny-research (https://bugbunny.ai/) for reporting this to sigstore/gitsign, and to @wlynch, @patzielinski and @adityasaky for coordinating the disclosure with the go-git project. 🙇 🥇

Thanks to @wayphinder for reporting this to the go-git project. 🙇

Severity

CVSS Score: 7.0 / 10 (High)
Vector String: CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

go-git: Improper single-quote escaping in go-git SSH transport

CVE-2026-45570 / GHSA-m7cr-m3pv-hgrp

More information

Details

Impact

go-git's SSH transport constructs the remote exec command by wrapping the repository path in single quotes without escaping single quotes embedded inside the path. This diverges from canonical Git, which shell-quotes the path through sq_quote_buf so that an embedded ' becomes the '\'' close-escape-reopen sequence and the whole path round-trips as a single quoted argument.

A repository path containing a single quote can therefore break out of the quoted region in the exec command and be appended as additional shell tokens. On SSH servers that evaluate the exec command through a shell (for example a user account whose login shell is /bin/sh or /bin/bash, or a ForceCommand wrapper that re-evaluates $SSH_ORIGINAL_COMMAND), those additional tokens execute in that account's command-execution context. SSH servers that tokenize the exec command without shell evaluation, including the canonical git-shell setup, are not affected.

The vulnerable behaviour is on the SSH server side, not in go-git: the same bytes can be produced by any SSH client. The change in go-git is defense-in-depth that restores parity with canonical Git's wire format and prevents go-git from being a vehicle for reaching shell-evaluating servers through attacker-influenced repository paths.

Patches

Users should upgrade to a patched version in order to mitigate this issue. The fix ports sq_quote_buf from canonical Git into go-git's SSH transport so that the wire output is byte-identical to what git itself would send for the same input.

Versions prior to v5 are likely to be affected, users are recommended to upgrade to a supported go-git version.

Credit

Thanks to @N0zoM1z0 for reporting this to the go-git project. 🙇

Severity

CVSS Score: 2.3 / 10 (Low)
Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:L

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

go-git: Crafted repositories may modify main and submodule .git directories

CVE-2026-45571 / GHSA-crhj-59gh-8x96

More information

Details

Impact

A path validation issue in go-git could allow crafted repository data to affect files outside the intended checkout target, including the repository's .git directory.

These validations were introduced in upstream Git years ago, so the vulnerability arose from go-git drifting from those checks. Some attack vectors were platform-specific: certain payloads affected only Windows users, others affected only macOS users, and some applied across all supported platforms.

Using non-descendant go-billy filesystem instances, or different filesystem types, for the Storer and Worktree may provide some isolation against .git directory manipulation. For example, users that store the .git directory through memfs while using osfs for the worktree are not affected by this vulnerability in the main repository, because repository metadata is not materialized inside the worktree filesystem.

However, this isolation does not necessarily apply when the repository contains submodules, since submodule dotgit directories may still be represented or materialized within the worktree context.

It is important to note that exploitation requires a maliciously crafted repository payload. Users should always exercise caution when interacting with repositories or Git servers they do not trust.

Patches

Users should upgrade to a patched version in order to mitigate this vulnerability. Versions prior to v5 are likely to be affected, users are recommended to upgrade to a supported go-git version.

Credits

Thanks to @kodareef5, @AyushParkara and @N0zoM1z0 for reporting this to the go-git project in three separate reports. 🙇

Severity

CVSS Score: 5.4 / 10 (Medium)
Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

go-git: Malformed Git object data may cause panics or resource exhaustion

GHSA-w5pp-99ch-qj29

More information

Details

Impact

Several denial-of-service issues were identified in go-git when parsing maliciously crafted Git repository data.

An attacker may craft a malicious .pack, .idx or loose objects that causes an application using an affected version of go-git to panic or consume excessive resources.

This can lead to denial of service in applications that use go-git to clone, fetch, open, or otherwise process untrusted repositories or Git object data.

Exploitation requires the ability to alter read-only files such as .pack or .idx from the local repository's .git/objects/pack/ directory. Alternatively, the user would need to be interacting with a malicious remote server, which is not recommended and exposes users to a broader class of security risks beyond this issue.

Patches

Users should upgrade to a patched version in order to mitigate this vulnerability. Versions prior to v5 are likely to be affected, users are recommended to upgrade to a supported go-git version.

Credits

go-git thanks @kodareef5, @AyushParkara and @N0zoM1z0 for reporting this in four separate reports. 🙇

Severity

CVSS Score: 6.5 / 10 (Medium)
Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

go-git: Worktree operations may follow symlinks

CVE-2026-71556 / GHSA-hc8v-wwc9-vgxm

More information

Details

Impact

A symlink traversal issue in go-git could allow worktree operations to modify files outside the intended worktree path.

The worktreeFilesystem wrapper rejected dangerous path strings, including paths containing .git, parent-directory components, or control characters. However, it did not prevent filesystem operations from following symbolic links that were already present in the worktree.

As a result, a path that is safe when evaluated as a string could still resolve into the repository's Git metadata directory. For example, if s is a symbolic link to .git, writing to s/config would modify .git/config.

A symbolic link at the final path component could also be followed. For example, if s points directly to .git/config, opening s for writing with truncation could overwrite the repository configuration.

Exploitation requires an attacker to be able to introduce or control a symbolic link in the worktree and cause the application to perform a write through that path.

Applications using storage/memory for their Storer, or go-billy/memfs for their Worktree, are not affected by this vulnerability.

Patches

The issue has been addressed by making the worktree filesystem wrapper a symlink-safe boundary.

Worktree operations now reject paths where an existing symbolic link in any path component could cause the operation to escape the intended worktree location, including symbolic links at the final component.

Users of filesystem-backed worktrees should upgrade to a patched version.

Credits

Thanks to @kodareef5 for reporting this issue and working with the go-git security team toward its resolution. 🥇
We would also like to thank @HughLewis20, who independently reported the same issue while a fix was already in progress.

Severity

CVSS Score: 7.1 / 10 (High)
Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

go-git: Malicious reference names may modify files outside the reference storage

CVE-2026-71557 / GHSA-qgq7-7hm3-q39j

More information

Details

Impact

A path traversal issue in go-git could allow malicious reference names to access files outside the repository's intended reference storage.

Loose references are stored under .git/<reference-name>. The reference name was previously used as a path without verifying that the resolved path remained within the reference storage. A name such as refs/heads/../../config could therefore resolve to unrelated repository metadata such as .git/config or .git/HEAD.

A malicious Git server could advertise such a reference name. The name may also survive refspec mapping; for example, it could be mapped to refs/remotes/origin/../../config during a clone or fetch operation.

This vulnerability affects filesystem-backed repositories using the storage/filesystem package and its dotgit reference storage. Users relying exclusively on the in-memory storage implementation, storage/memory, are not affected, because reference names are not resolved as filesystem paths.

Exploitation requires an application using go-git with filesystem-backed storage to interact with a malicious Git server or otherwise process attacker-controlled reference names.

Patches

The issue has been addressed by validating reference names at the dotgit storage entry points and rejecting names whose resolved paths could escape the reference storage.

Users of filesystem-backed storage should upgrade to a patched version.

Workarounds

Applications that exclusively use storage/memory are not affected and do not require a workaround for this vulnerability.

For applications using filesystem-backed storage, avoid cloning from or fetching from untrusted Git servers until an upgrade is possible.

Applications that directly construct or process reference names may also validate them before passing them to filesystem-backed go-git storage. Application-level validation should only be considered a temporary mitigation and does not replace upgrading to a patched version.

References

Fixes:
- https://github.com/go-git/go-git/pull/2247
- https://github.com/go-git/go-git/pull/2254

Credits

Thanks to @Saku0512 for reporting this issue and @Sahana2524 for proposing the initial fix. 🙇

Severity

CVSS Score: 6.3 / 10 (Medium)
Vector String: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:L

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Go JOSE Panics in JWE decryption

CVE-2026-34986 / GHSA-78h2-9frx-2jm8

More information

Details

Impact

Decrypting a JSON Web Encryption (JWE) object will panic if the alg field indicates a key wrapping algorithm (one ending in KW, with the exception of A128GCMKW, A192GCMKW, and A256GCMKW) and the encrypted_key field is empty. The panic happens when cipher.KeyUnwrap() in key_wrap.go attempts to allocate a slice with a zero or negative length based on the length of the encrypted_key.

This code path is reachable from ParseEncrypted() / ParseEncryptedJSON() / ParseEncryptedCompact() followed by Decrypt() on the resulting object. Note that the parse functions take a list of accepted key algorithms. If the accepted key algorithms do not include any key wrapping algorithms, parsing will fail and the application will be unaffected.

This panic is also reachable by calling cipher.KeyUnwrap() directly with any ciphertext parameter less than 16 bytes long, but calling this function directly is less common.

Panics can lead to denial of service.

Fixed In

4.1.4 and v3.0.5

Workarounds

If the list of keyAlgorithms passed to ParseEncrypted() / ParseEncryptedJSON() / ParseEncryptedCompact() does not include key wrapping algorithms (those ending in KW), your application is unaffected.

If your application uses key wrapping, you can prevalidate to the JWE objects to ensure the encrypted_key field is nonempty. If your application accepts JWE Compact Serialization, apply that validation to the corresponding field of that serialization (the data between the first and second .).

Thanks

Thanks to Datadog's Security team for finding this issue.

Severity

CVSS Score: 7.5 / 10 (High)
Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Go JOSE: DoS when parsing JWKs that contain RSA keys

CVE-2026-116587 / GHSA-mgcc-cww5-fp2q

More information

Details

Summary

A crafted RSA key inside a JWK can cause operations that parse JWKs to consume excess CPU.

Details

go-jose does not check for bounds on RSA modulus and primes before validating them. Values are passed directly to crypto/rsa.PrivateKey.Validate(). On Go 1.24+, this takes cubic time complexity with respect to the RSA modulus and primes. This allows an attacker to supply a crafted JWK to consume excessive CPU.

https://github.com/go-jose/go-jose/blob/5b371aecfcf7aabe06068d67da4344591ecddc76/jwk.go#L655-L700

Proof of concept

No special configuration of go-jose is required to reproduce this vulnerability.

package main

import (
	"encoding/base64"
	"encoding/json"
	"fmt"
	"math/big"
	"time"

	"github.com/go-jose/go-jose/v4"
)

func main() {
	// The RSA parameters can be complete junk. The CPU cost is in validating them.
	primeBits := 16384
	p := new(big.Int).Lsh(big.NewInt(1), uint(primeBits-1))
	p.SetBit(p, 0, 1)
	n := new(big.Int).Lsh(big.NewInt(1), 2048)
	e := big.NewInt(65537)
	d := big.NewInt(3)
	q := big.NewInt(3)

	jwk := map[string]string{
		"kty": "RSA",
		"n":   base64.RawURLEncoding.EncodeToString(n.Bytes()),
		"e":   base64.RawURLEncoding.EncodeToString(e.Bytes()),
		"d":   base64.RawURLEncoding.EncodeToString(d.Bytes()),
		"p":   base64.RawURLEncoding.EncodeToString(p.Bytes()),
		"q":   base64.RawURLEncoding.EncodeToString(q.Bytes()),
	}

	protected := map[string]any{
		"alg": "RS256",
		"jwk": jwk,
	}
	protJSON, _ := json.Marshal(protected)

	jws := map[string]string{
		"protected": base64.RawURLEncoding.EncodeToString(protJSON),
		"payload":   base64.RawURLEncoding.EncodeToString([]byte(`{}`)),
		"signature": base64.RawURLEncoding.EncodeToString([]byte("not-a-real-signature")),
	}
	jwsJSON, _ := json.Marshal(jws)

	start := time.Now()
	_, err := jose.ParseSigned(string(jwsJSON), []jose.SignatureAlgorithm{jose.RS256})
	elapsed := time.Since(start)

	fmt.Printf("prime bits: %d\n", primeBits)
	fmt.Printf("parse time: %s\n", elapsed)
	fmt.Printf("parse error: %v\n", err)
}

Impact

Denial of service vulnerability. Any application that uses go-jose to parse JWKs from untrusted sources is affected and should patch immediately.

Credits

Reported by Yuval Saggie and Mor Weinberger (powered by Echo Frontier)

Severity

CVSS Score: 7.5 / 10 (High)
Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Go JOSE: Panic during CBC-HMAC processing

CVE-2026-116585 / GHSA-4w3g-jfj2-cw2q

More information

Details

Summary

Decrypting a ciphertext with "A128CBC-HS256", "A192CBC-HS384", or "A256CBC-HS512" can result in a panic on untrusted input.

Note this advisory is the same as GHSA-6mp9-8xrw-74r4.

Details

Insufficient validation of parameters can lead to attempting to index into an empty buffer. See https://github.com/go-jose/go-jose/pull/292.

Workarounds

If the application does not require the CBC-HMAC modes for content encryption, and is using github.com/go-jose/go-jose/v4, do not include them in the list of ContentEncryption algorithms passed to ParseEncrypted / ParseEncryptedJSON / ParseEncryptedCompact.

Impact

Denial of service vulnerability. Any application which decrypts untrusted ciphertexts with the indicated algorithms is affected.

Acknowledgements

Thanks to Joshua Rogers of AISLE Research for reporting this problem.

Severity

CVSS Score: 6.9 / 10 (Medium)
Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Go JOSE: Panics in JSON parsing

CVE-2026-116586 / GHSA-vvm8-gf78-28g4

More information

Details

Summary

Parsing deeply nested JSON structures can hit Go's stack limit, causing the application to crash.

Note: this advisory is the same as GHSA-6mp9-8xrw-74r4.

Impact

Denial of service vulnerability. Any application that parses untrusted JSON via go-jose is exposed.

Workarounds

Reject large inputs before parsing them.

Acknowledgements

Thanks to Dohyun Kim (@azza999), Joshua Rogers of AISLE Research, and Sueun Cho for alerting us to the need to patch this.

Severity

CVSS Score: 6.9 / 10 (Medium)
Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Compress/s2: Integer Overflow or Wraparound and Out-of-bounds Write in compress

CVE-2026-63209 / GHSA-259r-337f-4rfw

More information

Details

Signed Integer Overflow in s2.NewDict

Summary

A signed integer overflow vulnerability in s2.NewDict() allows an attacker to bypass repeat index validation by supplying a dictionary with a uvarint-encoded repeat value exceeding MaxInt64. When Dict.Encode() is subsequently called, the overflowed negative repeat value causes an out-of-bounds memory access via `unsafe

[!IMPORTANT]
✂ PR body was truncated to here.

forking-renovate · 2026-11-10T16:37:28Z

ℹ️ Artifact update notice

File name: cli/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

25 additional dependencies were updated
The go directive was updated for compatibility reasons

Details:

Package	Change
`go`	`1.24.6` -> `1.25.0`
`golang.org/x/oauth2`	`v0.35.0` -> `v0.36.0`
`golang.org/x/text`	`v0.34.0` -> `v0.40.0`
`cel.dev/expr`	`v0.24.0` -> `v0.25.2`
`cloud.google.com/go/auth`	`v0.18.1` -> `v0.18.2`
`github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp`	`v1.30.0` -> `v1.33.0`
`github.com/cncf/xds/go`	`v0.0.0-20251022180443-0feb69152e9f` -> `v0.0.0-20260202195803-dba9d589def2`
`github.com/cyphar/filepath-securejoin`	`v0.4.1` -> `v0.6.1`
`github.com/envoyproxy/go-control-plane/envoy`	`v1.35.0` -> `v1.37.0`
`github.com/envoyproxy/protoc-gen-validate`	`v1.2.1` -> `v1.3.3`
`github.com/go-logr/logr`	`v1.4.3` -> `v1.4.4`
`github.com/grpc-ecosystem/grpc-gateway/v2`	`v2.27.2` -> `v2.29.0`
`github.com/pjbgf/sha1cd`	`v0.3.2` -> `v0.6.0`
`github.com/spiffe/go-spiffe/v2`	`v2.6.0` -> `v2.7.0`
`go.opentelemetry.io/contrib/detectors/gcp`	`v1.38.0` -> `v1.44.0`
`go.opentelemetry.io/otel/metric`	`v1.39.0` -> `v1.45.0`
`go.opentelemetry.io/otel/sdk/metric`	`v1.39.0` -> `v1.45.0`
`go.opentelemetry.io/otel/trace`	`v1.39.0` -> `v1.45.0`
`go.opentelemetry.io/proto/otlp`	`v1.7.1` -> `v1.11.0`
`golang.org/x/mod`	`v0.32.0` -> `v0.37.0`
`golang.org/x/sync`	`v0.19.0` -> `v0.22.0`
`golang.org/x/sys`	`v0.40.0` -> `v0.47.0`
`golang.org/x/term`	`v0.39.0` -> `v0.45.0`
`golang.org/x/tools`	`v0.41.0` -> `v0.47.0`
`google.golang.org/genproto/googleapis/api`	`v0.0.0-20260203192932-546029d2fa20` -> `v0.0.0-20260803160001-6ac0973c030d`
`google.golang.org/genproto/googleapis/rpc`	`v0.0.0-20260203192932-546029d2fa20` -> `v0.0.0-20260803160001-6ac0973c030d`

dpebot · 2026-11-10T16:37:42Z

/gcbrun

gemini-code-assist

Code Review

This pull request updates various Go dependencies in the CLI module and attempts to upgrade the Go version to 1.25.0. However, because Go 1.25.0 is not yet released, this change will cause build failures and should be reverted to a stable version like 1.24.6.

gemini-code-assist · 2026-11-10T16:38:17Z

-go 1.24.6
-
-toolchain go1.24.13
+go 1.25.0


Go 1.25.0 is not yet released (the current stable major version is Go 1.24). Upgrading the go directive to 1.25.0 will cause build failures because the toolchain cannot resolve or download this unreleased version. Please revert this to a stable released version of Go, such as 1.24.6.

Suggested change

go 1.25.0

go 1.24.6

dpebot · 2026-11-10T17:14:45Z

/gcbrun

dpebot · 2026-11-10T18:57:59Z

/gcbrun

dpebot · 2026-11-10T19:34:42Z

/gcbrun

dpebot · 2026-11-10T21:37:08Z

/gcbrun

dpebot · 2026-11-10T21:42:00Z

/gcbrun

dpebot · 2026-11-10T22:53:42Z

/gcbrun

dpebot · 2026-11-11T05:53:48Z

/gcbrun

dpebot · 2026-11-12T17:24:01Z

/gcbrun

renovate-bot requested a review from q2w as a code owner November 10, 2026 16:37

forking-renovate Bot added the type:security label Nov 10, 2026

renovate-bot requested a review from a team as a code owner November 10, 2026 16:37

renovate-bot added the type:security label Nov 10, 2026

gemini-code-assist Bot reviewed Nov 10, 2026

View reviewed changes

apeabody mentioned this pull request Nov 10, 2026

fix(deps): bump the go_modules group across 5 directories with 10 updates #3466

Closed

renovate-bot force-pushed the renovate/cli-security-deps branch from 05cf39d to aa92414 Compare November 10, 2026 17:14

renovate-bot force-pushed the renovate/cli-security-deps branch from aa92414 to c1f766d Compare November 10, 2026 18:57

renovate-bot force-pushed the renovate/cli-security-deps branch from c1f766d to 788b6cc Compare November 10, 2026 19:34

renovate-bot force-pushed the renovate/cli-security-deps branch from 788b6cc to 417395c Compare November 10, 2026 21:36

renovate-bot force-pushed the renovate/cli-security-deps branch from 417395c to 3b55b94 Compare November 10, 2026 21:41

renovate-bot force-pushed the renovate/cli-security-deps branch from 3b55b94 to e07a7c8 Compare November 10, 2026 22:53

renovate-bot force-pushed the renovate/cli-security-deps branch from e07a7c8 to 0fbbfb2 Compare November 11, 2026 05:53

chore(deps): update cli security deps [security]

d205d80

renovate-bot force-pushed the renovate/cli-security-deps branch from 0fbbfb2 to d205d80 Compare November 12, 2026 17:23

Navigation Menu

Repository navigation

chore(deps): update cli security deps [security] - #3509

chore(deps): update cli security deps [security]#3509
renovate-bot wants to merge 1 commit into
GoogleCloudPlatform:mainfrom
renovate-bot:renovate/cli-security-deps

renovate-bot commented Nov 10, 2026 •

edited

Loading

Uh oh!

forking-renovate Bot commented Nov 10, 2026 •

edited

Loading

Uh oh!

dpebot commented Nov 10, 2026

Uh oh!

gemini-code-assist Bot left a comment

Uh oh!

gemini-code-assist Bot Nov 10, 2026

Uh oh!

dpebot commented Nov 10, 2026

Uh oh!

dpebot commented Nov 10, 2026

Uh oh!

dpebot commented Nov 10, 2026

Uh oh!

dpebot commented Nov 10, 2026

Uh oh!

dpebot commented Nov 10, 2026

Uh oh!

dpebot commented Nov 10, 2026

Uh oh!

dpebot commented Nov 11, 2026

Uh oh!

dpebot commented Nov 12, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

renovate-bot commented Nov 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

github.com/buger/jsonparser has a denial of service vulnerability

Details

Severity

References

CIRCL has an incorrect calculation in secp384r1 CombinedMult

Details

Severity

References

go-billy: Lack of depth and cycle detection in symlink resolution may lead to infinite loops and resource exhaustion

Details

Impact

Patches

Credits

Severity

References

go-billy has path traversal vulnerabilities

Details

Impact

Patches

Credits

Severity

References

go-git missing validation decoding Index v4 files leads to panic

Details

Impact

Patches

Credit

Severity

References

go-git: Maliciously crafted idx file can cause asymmetric memory consumption

Details

Impact

Patches

Credit

Severity

References

go-git: Credential leak via cross-host redirect in smart HTTP transport

Details

Impact

Patches

Credit

Severity

References

go-git's improper parsing of specially crafted objects may lead to inconsistent interpretation compared to upstream Git

Details

Impact

Patches

Credit

Severity

References

go-git: Improper single-quote escaping in go-git SSH transport

Details

Impact

Patches

Credit

Severity

References

go-git: Crafted repositories may modify main and submodule .git directories

Details

Impact

Patches

Credits

Severity

References

go-git: Malformed Git object data may cause panics or resource exhaustion

Details

Impact

Patches

Credits

Severity

References

go-git: Worktree operations may follow symlinks

Details

Impact

Patches

Credits

Severity

renovate-bot commented Nov 10, 2026 •

edited

Loading

forking-renovate Bot commented Nov 10, 2026 •

edited

Loading