Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

Docker image `v1.6.0` contains vulnerable Go stdlib and golang.org/x modules

Closed Beginner friendly
  • Is something wrong?
#1,147 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
76/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
docker, go
Domain
devops, security

Research direction

Start by reading the Go version and indirect dependency entries in go.mod, then check the Docker build configuration to see which Go version produces the v1.6.0 image. Update the Go toolchain and the listed golang.org/x/net and golang.org/x/text versions to the recommended releases, and run the project's available build or security checks. Done when the resulting image no longer contains the reported vulnerable versions.

Written by the indexing model from the issue text.

Description

bug

Summary

Our security scanner reports Go-related vulnerabilities in the hookdeck/outpost:v1.6.0 Docker image.

The v1.6.0 source uses Go 1.27.1 and includes vulnerable Go module versions:

  • Go stdlib from Go 1.27.1; scanner recommends Go 1.27.2
  • golang.org/x/net v0.57.0; scanner recommends v0.60.0
  • golang.org/x/text v0.40.0; scanner recommends v0.41.0

Affected image

Scanner findings

Go stdlib

Scanner summary:

stdlib is affected by 10 unique vulnerabilities. 1 is critical and 9 are high.

In order to fix all of these vulnerabilities, update stdlib to 1.27.2.

Go 1.27.2 was released on 2026-10-08 and includes security fixes in:

  • net/http
  • crypto/tls
  • net/textproto
  • html/template
  • os
  • cmd/go

References:

golang.org/x/net

Scanner summary:

golang.org/x/net is affected by 4 unique vulnerabilities. 4 are high.

In order to fix all of these vulnerabilities, update golang.org/x/net to 0.60.0.

golang.org/x/net v0.60.0 fixes HTTP/2-related DoS/security issues, including:

  • HTTP/2 server memory exhaustion due to Trailer headers
  • excessive CPU consumption from repeated initial window changes
  • double flow-control refund on HTTP/2 server streams
  • HTTP/2 server crash due to HPACK encoder race

Reference:

golang.org/x/text

Scanner summary:

The Nickname profile can panic with an out-of-bounds slice error when transforming crafted input into a short destination buffer.

In order to fix this vulnerability, update golang.org/x/text to 0.41.0.

This appears to be CVE-2026-56851 / GO-2026-6629, affecting golang.org/x/text/secure/precis before v0.41.0.

Reference:

Dominant language
Go
Stars
1.1k
Forks
70
Avg merge
1d 18h
Merged PRs (30d)
56

Getting set up

This project ships no dev container, Dockerfile or contributing guide, so setting up is up to you: start from its README, and see our first-contribution guide for the general steps.

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from hookdeck/outpost

All issues in hookdeck/outpost

Similar issues

More Go issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.