Vulnerable `x/net` and `MongoDB` Go dependencies

Abierto
  • ¿Algo no está bien?
#1,199 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 4 días

@chiliec ya está trabajando en esto.

Desde el 6/11/2026.

  • #1200 de @chiliec — abierto

Evaluación

Dificultad
2/5
Tiempo estimado
1-3 horas
Aptitud para principiantes
35/100
Tipo de issue
Error
Claridad
Bien especificado
Estado de actividad
Estancado
Stack tecnológico
go
Área
backend, security

Línea de trabajo

Start with the Go dependency declarations and update golang.org/x/net to v0.62.0 or later and go.mongodb.org/mongo-driver/v2 to v2.9.2 or later. Check the resulting dependency versions and run the repository’s relevant Go checks; done when both minimum versions are present. An open linked pull request already addresses this issue.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

bug

Summary

Our security scanner reports vulnerabilities in golang.org/x/net and go.mongodb.org/mongo-driver/v2 in our deployed Outpost Docker image.

The inspected repository checkout includes these indirect dependencies:

  • golang.org/x/net v0.60.0; scanner recommends v0.62.0
  • go.mongodb.org/mongo-driver/v2 v2.8.0; scanner recommends v2.9.0

These findings concern HTML parsing/rendering and BSON value-length validation. Their presence in the dependency list does not by itself establish exploitability in Outpost.

Affected image

  • Source versions observed in the inspected checkout:
    • golang.org/x/net v0.60.0
    • go.mongodb.org/mongo-driver/v2 v2.8.0

Scanner findings

golang.org/x/net

Scanner summary:

golang.org/x/net is affected by 2 unique vulnerabilities. 1 is high and 1 is medium.

In order to fix all of these vulnerabilities, update golang.org/x/net to 0.62.0.

golang.org/x/net v0.62.0 fixes two issues in golang.org/x/net/html:

  • CVE-2026-78661 / GO-2026-6860: Crafted HTML containing repeated short text runs can cause quadratic allocations and copying during parsing, potentially causing denial of service. Affects Parse, ParseFragment and their options variants.
  • CVE-2026-97045 / GO-2026-6866: Incorrect handling of ancestor namespace transitions in Render can produce output that is interpreted differently when parsed again, potentially enabling cross-site scripting.

Both affect versions before v0.62.0.

References:

go.mongodb.org/mongo-driver/v2

The scanner reports an integer overflow in BSON value-length handling:

  • CVE-2026-107324
  • GHSA-xhx9-594p-jcqq
  • Affected v2 versions: before v2.9.0
  • Fixed version: v2.9.0

When processing a malformed BSON value, valueLength() adds fixed overhead to an attacker-controlled length using an int32. The result can overflow to a negative number, pass a bounds check, and cause a slice-bounds panic.

An application that validates or accesses attacker-controlled BSON through an affected path can panic. Without recovery, this can terminate the process and cause denial of service.

References:

Requested fix

  • Update golang.org/x/net to v0.62.0 or later.
  • Update go.mongodb.org/mongo-driver/v2 to at least v2.9.0 for the reported BSON overflow.
  • Prefer MongoDB driver v2.9.2 or later to also cover the separately disclosed BSON array-validation vulnerability.
Lenguaje dominante
Go
Estrellas
1.1k
Forks
70
Merge medio
3 d 21 h
PR fusionados (30 d)
34

Preparar el entorno

Este proyecto no incluye contenedor de desarrollo, Dockerfile ni guía de contribución, así que la configuración corre por tu cuenta: empieza por su README y consulta nuestra guía para la primera contribución para los pasos generales.

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de hookdeck/outpost

Todos los issues de hookdeck/outpost

Issues similares

Más issues de Go

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.