Bump Go toolchain to 1.26.4 to resolve net/textproto vuln (CVE-2026-42507 / GO-2026-5039)

Open Beginner friendly

#11,495 opened on Aug 12, 2026 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty: 2/5
Estimated time: 1-3 hours
Newbie friendliness: 72/100

Issue type: Bug
Clarity: Mostly clear
Activity status: Quiet
Tech stack: go
Domain: build-system, security

Research direction

Start with go.mod line 3, then inspect the repository’s CI toolchain configuration to find every place the Go version is pinned. Verify the project builds with Go 1.26.4 or newer and that the reported GO-2026-5039 finding is cleared; release handling is also mentioned in the issue.

Written by the indexing model from the issue text.

Description

Summary
go.mod currently declares go 1.26.3, which is affected by CVE-2026-42507 (Go advisory GO-2026-5039) in the standard-library net/textproto package. Binaries built with Go 1.26.0–1.26.3 include the vulnerable code.

Impact
Functions in net/textproto include raw input in returned error messages, allowing log/error-message injection. Integrity-only (CVSS ~4–5, no confidentiality/availability impact), but it surfaces in downstream container security scans.

Code pointer

Line to change — go.mod:3 declares go 1.26.3: https://github.com/temporalio/ui-server/blob/a823c54e83bd348fd9cc76f553ca1582195edab6/go.mod#L3
Root cause lives in the Go stdlib net/textproto (e.g. Reader.ReadCodeLine / Reader.ReadMIMEHeader / Error.Error): https://github.com/golang/go/blob/master/src/net/textproto/reader.go

Fix
Build with Go ≥ 1.26.4. Bumping the go directive / CI toolchain and cutting a release would clear the finding for downstream consumers.

References

Advisory: https://pkg.go.dev/vuln/GO-2026-5039
Go issue: https://go.dev/issue/79346
Patch: https://go.dev/cl/777060

Dominant language: Go
Stars: 23.2k
Forks: 1.9k
Avg merge: 2d 6h
Merged PRs (30d): 200

Contributor guide

Open the contributing guide

First steps

Read the whole issue, then the project's contributing guide.
Comment on the issue to say you are picking it up — it saves two people doing the same work.
Fork the repository and make your change on a branch.
Open a pull request that references the issue number.

Similar issues

GrafeasNote is a duplicate resource of ContainerAnalysisNote Open

Difficulty 1/5 Under an hour Newbie friendliness 84/100

GoogleCloudPlatform/k8s-config-connector#13349 · Opened Sep 21, 2026
[receiver/receiverhelper] skip WithLinks when the parent span context is invalid Open

enhancement needs triage

Difficulty 2/5 1-3 hours Newbie friendliness 68/100

open-telemetry/opentelemetry-collector#15998 · Opened Sep 21, 2026
🧹 Use PodSet wrappers in DRA tests Open

kind/cleanup

Difficulty 2/5 1-3 hours Newbie friendliness 88/100

kubernetes-sigs/kueue#15947 · Opened Sep 21, 2026
Custom provider credential is written as `PROVIDER_API_KEY` (apiserver) but the AgentRun controller injects only allowlisted keys, so every custom provider fails with HTTP 401 Open

Difficulty 2/5 1-3 hours Newbie friendliness 78/100

sympozium-ai/sympozium#627 · Opened Sep 21, 2026
A recording that opens with an all-zero last_throw emits a zeroed discThrown at frame 0 Open

Difficulty 2/5 1-3 hours Newbie friendliness 86/100

EchoTools/tape#60 · Opened Sep 21, 2026

More Go issues