Update golang.org/x/text, golang.org/x/net and golang.org/x/crypto to fixed releases (GO-2026-6629 is reachable)

Open Beginner friendly
  • Is something wrong?
#800 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
62/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
go, postgresql
Domain
build-system, security

Research direction

The pins live in go.mod and go.sum; the reachable path starts at internal/postgres/global.go, where GetConn calls pgx.ConnectConfig. Run govulncheck -show verbose ./... before and after bumping golang.org/x/text to v0.41.0, golang.org/x/net to v0.62.0 and golang.org/x/crypto to v0.56.0, then run go test ./.... Done when the three versions are pinned, the build and tests pass, and govulncheck no longer reports GO-2026-6629 as reachable.

Written by the indexing model from the issue text.

Description

ldap2pg.yml

Not applicable. This is a dependency advisory, not a runtime bug, so no configuration is needed to reproduce it.

Expectations

  • Expected: the v6.6.0 binary contains no golang.org/x/* release with a published advisory, or each advisory is shown to be unreachable.
  • Actual: the v6.6.0 tag pins golang.org/x/text v0.39.0, golang.org/x/net v0.56.0 and golang.org/x/crypto v0.53.0. Vulnerability scanners flag all three.

Of the advisories listed below, one is reachable from ldap2pg code. The rest are in the module graph but are not called.

Reachable: GO-2026-6629 (golang.org/x/text v0.39.0, CVE-2026-56851)

govulncheck in source mode (Go 1.26.10) reports this call path:

internal/postgres/global.go:59:38  postgres.GetConn
  -> pgx.ConnectConfig            (github.com/jackc/pgx/v5 conn.go:160)
  -> ...                          (pgconn connectOne)
  -> PgConn.scramAuth             (pgconn/auth_scram.go:44)
  -> newScramClient               (pgconn/auth_scram.go:197)
  -> precis.Profile.String        (golang.org/x/text/secure/precis/profile.go:292)

newScramClient passes the connection password to precis.OpaqueString.String. This path runs when the server requests SCRAM authentication. We have not reproduced the panic. Whether an attacker can control the input depends on where the password comes from in a given deployment.

Fix: bump golang.org/x/text to v0.41.0 or later.

Not called: module-level advisories

govulncheck finds no call path from ldap2pg code for these. The binary links only golang.org/x/crypto/md4, golang.org/x/crypto/pbkdf2 and golang.org/x/net/http2/hpack from these modules (checked with go list -deps).

Advisory Module Found in Fixed in Linked into ldap2pg
GO-2026-6303 (CVE-2026-56854) golang.org/x/crypto/ssh v0.53.0 v0.55.0 No
GO-2026-6354 golang.org/x/crypto/ssh v0.53.0 v0.56.0 No
GO-2026-6355 golang.org/x/crypto/ssh v0.53.0 v0.56.0 No
GO-2026-5932 golang.org/x/crypto/openpgp v0.53.0 none No
GO-2026-6611 (CVE-2026-78669) golang.org/x/net (HTTP/2) v0.56.0 v0.60.0 No
GO-2026-6603, 6610, 6612, 6617 golang.org/x/net (HTTP/2) v0.56.0 v0.60.0 No
GO-2026-6860, 6866 golang.org/x/net/html v0.56.0 v0.62.0 No

GO-2026-5932 has no fixed version. ldap2pg does not link openpgp, so we do not expect a code change for it.

Requested versions: golang.org/x/text v0.41.0, golang.org/x/net v0.62.0 and golang.org/x/crypto v0.56.0. These clear every advisory above that has a fix.

Verbose output

Advisory data checked 2026-11-02.

$ GOTOOLCHAIN=go1.26.10 govulncheck -show verbose ./...

=== Symbol Results ===

Vulnerability #1: GO-2026-6629
    Panic parsing crafted input in x/text/secure/precis in golang.org/x/text
  More info: https://pkg.go.dev/vuln/GO-2026-6629
  Module: golang.org/x/text
    Found in: golang.org/x/[email protected]
    Fixed in: golang.org/x/[email protected]
    Example traces found:
      #1: internal/postgres/global.go:59:38: postgres.GetConn calls pgx.ConnectConfig, which eventually calls precis.Profile.String

=== Module Results ===

Vulnerability #1: GO-2026-6866  (golang.org/x/net, fixed in v0.62.0)
Vulnerability #2: GO-2026-6860  (golang.org/x/net, fixed in v0.62.0)
Vulnerability #3: GO-2026-6617  (golang.org/x/net, fixed in v0.60.0)
Vulnerability #4: GO-2026-6612  (golang.org/x/net, fixed in v0.60.0)
Vulnerability #5: GO-2026-6611  (golang.org/x/net, fixed in v0.60.0)
Vulnerability #6: GO-2026-6610  (golang.org/x/net, fixed in v0.60.0)
Vulnerability #7: GO-2026-6603  (golang.org/x/net, fixed in v0.60.0)
Vulnerability #8: GO-2026-6355  (golang.org/x/crypto, fixed in v0.56.0)
Vulnerability #9: GO-2026-6354  (golang.org/x/crypto, fixed in v0.56.0)
Vulnerability #10: GO-2026-6303 (golang.org/x/crypto, fixed in v0.55.0)
Vulnerability #11: GO-2026-5932 (golang.org/x/crypto, no fix)

Your code is affected by 1 vulnerability from 1 module.
This scan also found 0 vulnerabilities in packages you import and 11
vulnerabilities in modules you require, but your code doesn't appear to call
these vulnerabilities.

Reproduce

git clone --branch v6.6.0 https://github.com/dalibo/ldap2pg && cd ldap2pg
go install golang.org/x/vuln/cmd/govulncheck@latest
GOTOOLCHAIN=go1.26.10 govulncheck -show verbose ./...
Dominant language
Go
Stars
241
Forks
38
Avg merge
1d 11h
Merged PRs (30d)
2

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from dalibo/ldap2pg

All issues in dalibo/ldap2pg

Similar issues

More Go issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.