Vulnerable `x/net` and `MongoDB` Go dependencies

Aperta
  • Qualcosa non va?
#1,199 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 4 giorni

@chiliec ci sta già lavorando.

Dal 6/11/2026.

  • #1200 di @chiliec — aperta

Valutazione

Difficoltà
2/5
Tempo stimato
1-3 ore
Idoneità per principianti
35/100
Tipo di issue
Bug
Chiarezza
Specificata chiaramente
Stato di attività
Ferma
Stack tecnologico
go
Ambito
backend, security

Direzione di ricerca

Start with the Go dependency declarations and update golang.org/x/net to v0.62.0 or later and go.mongodb.org/mongo-driver/v2 to v2.9.2 or later. Check the resulting dependency versions and run the repository’s relevant Go checks; done when both minimum versions are present. An open linked pull request already addresses this issue.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

bug

Summary

Our security scanner reports vulnerabilities in golang.org/x/net and go.mongodb.org/mongo-driver/v2 in our deployed Outpost Docker image.

The inspected repository checkout includes these indirect dependencies:

  • golang.org/x/net v0.60.0; scanner recommends v0.62.0
  • go.mongodb.org/mongo-driver/v2 v2.8.0; scanner recommends v2.9.0

These findings concern HTML parsing/rendering and BSON value-length validation. Their presence in the dependency list does not by itself establish exploitability in Outpost.

Affected image

  • Source versions observed in the inspected checkout:
    • golang.org/x/net v0.60.0
    • go.mongodb.org/mongo-driver/v2 v2.8.0

Scanner findings

golang.org/x/net

Scanner summary:

golang.org/x/net is affected by 2 unique vulnerabilities. 1 is high and 1 is medium.

In order to fix all of these vulnerabilities, update golang.org/x/net to 0.62.0.

golang.org/x/net v0.62.0 fixes two issues in golang.org/x/net/html:

  • CVE-2026-78661 / GO-2026-6860: Crafted HTML containing repeated short text runs can cause quadratic allocations and copying during parsing, potentially causing denial of service. Affects Parse, ParseFragment and their options variants.
  • CVE-2026-97045 / GO-2026-6866: Incorrect handling of ancestor namespace transitions in Render can produce output that is interpreted differently when parsed again, potentially enabling cross-site scripting.

Both affect versions before v0.62.0.

References:

go.mongodb.org/mongo-driver/v2

The scanner reports an integer overflow in BSON value-length handling:

  • CVE-2026-107324
  • GHSA-xhx9-594p-jcqq
  • Affected v2 versions: before v2.9.0
  • Fixed version: v2.9.0

When processing a malformed BSON value, valueLength() adds fixed overhead to an attacker-controlled length using an int32. The result can overflow to a negative number, pass a bounds check, and cause a slice-bounds panic.

An application that validates or accesses attacker-controlled BSON through an affected path can panic. Without recovery, this can terminate the process and cause denial of service.

References:

Requested fix

  • Update golang.org/x/net to v0.62.0 or later.
  • Update go.mongodb.org/mongo-driver/v2 to at least v2.9.0 for the reported BSON overflow.
  • Prefer MongoDB driver v2.9.2 or later to also cover the separately disclosed BSON array-validation vulnerability.
Lingua principale
Go
Stelle
1.1k
Fork
70
Merge medio
3g 21h
PR unite (30g)
34

Preparare l'ambiente

Questo progetto non fornisce container di sviluppo, Dockerfile né guida per i contributori, quindi l'ambiente è a tuo carico: parti dal suo README e consulta la nostra guida al primo contributo per i passaggi generali.

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di hookdeck/outpost

Tutte le issue di hookdeck/outpost

Issue simili

Altre issue su Go

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.