Vulnerable `x/net` and `MongoDB` Go dependencies

未关闭
  • 哪里不对？
#1,199 0 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看

维护者通常 4 天内回复

@chiliec 已经在做这个了。

开始于 2026年11月6日。

  • #1200 来自 @chiliec —— 未关闭

评估

难度
2/5
预计耗时
1-3 小时
新手友好度
35/100
Issue 类型
缺陷
描述清晰度
描述清楚
活跃度
停滞
技术栈
go
领域
backend, security

调研方向

Start with the Go dependency declarations and update golang.org/x/net to v0.62.0 or later and go.mongodb.org/mongo-driver/v2 to v2.9.2 or later. Check the resulting dependency versions and run the repository’s relevant Go checks; done when both minimum versions are present. An open linked pull request already addresses this issue.

由索引模型根据 Issue 内容生成。

描述

bug

Summary

Our security scanner reports vulnerabilities in golang.org/x/net and go.mongodb.org/mongo-driver/v2 in our deployed Outpost Docker image.

The inspected repository checkout includes these indirect dependencies:

  • golang.org/x/net v0.60.0; scanner recommends v0.62.0
  • go.mongodb.org/mongo-driver/v2 v2.8.0; scanner recommends v2.9.0

These findings concern HTML parsing/rendering and BSON value-length validation. Their presence in the dependency list does not by itself establish exploitability in Outpost.

Affected image

  • Source versions observed in the inspected checkout:
    • golang.org/x/net v0.60.0
    • go.mongodb.org/mongo-driver/v2 v2.8.0

Scanner findings

golang.org/x/net

Scanner summary:

golang.org/x/net is affected by 2 unique vulnerabilities. 1 is high and 1 is medium.

In order to fix all of these vulnerabilities, update golang.org/x/net to 0.62.0.

golang.org/x/net v0.62.0 fixes two issues in golang.org/x/net/html:

  • CVE-2026-78661 / GO-2026-6860: Crafted HTML containing repeated short text runs can cause quadratic allocations and copying during parsing, potentially causing denial of service. Affects Parse, ParseFragment and their options variants.
  • CVE-2026-97045 / GO-2026-6866: Incorrect handling of ancestor namespace transitions in Render can produce output that is interpreted differently when parsed again, potentially enabling cross-site scripting.

Both affect versions before v0.62.0.

References:

go.mongodb.org/mongo-driver/v2

The scanner reports an integer overflow in BSON value-length handling:

  • CVE-2026-107324
  • GHSA-xhx9-594p-jcqq
  • Affected v2 versions: before v2.9.0
  • Fixed version: v2.9.0

When processing a malformed BSON value, valueLength() adds fixed overhead to an attacker-controlled length using an int32. The result can overflow to a negative number, pass a bounds check, and cause a slice-bounds panic.

An application that validates or accesses attacker-controlled BSON through an affected path can panic. Without recovery, this can terminate the process and cause denial of service.

References:

Requested fix

  • Update golang.org/x/net to v0.62.0 or later.
  • Update go.mongodb.org/mongo-driver/v2 to at least v2.9.0 for the reported BSON overflow.
  • Prefer MongoDB driver v2.9.2 or later to also cover the separately disclosed BSON array-validation vulnerability.
主要语言
Go
星标
1.1k
派生
70
平均合并
3 天 21 小时
30 天内合并 PR
34

环境准备

这个项目没有提供开发容器、Dockerfile 或贡献指南，环境需要你自己搭建：先看它的 README，通用步骤见我们的新手贡献指南。

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

hookdeck/outpost 的其他 Issue

查看 hookdeck/outpost 的全部 Issue

相似的 Issue

更多 Go Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。