feat(ws): release generic WebSocket client and server v0.31.0-preview
This commit is contained in:
52
reports/websocket-bench-go1.25.txt
Normal file
52
reports/websocket-bench-go1.25.txt
Normal file
@@ -0,0 +1,52 @@
|
||||
goos: darwin
|
||||
goarch: arm64
|
||||
pkg: git.yuntuo.hk/k2safe/go-omni/ws
|
||||
cpu: Apple M2 Max
|
||||
BenchmarkClientRoundTrip-12 15706 47299 ns/op 0.19 MB/s 1520 B/op 13 allocs/op
|
||||
BenchmarkClientRoundTrip-12 24013 26259 ns/op 0.34 MB/s 1520 B/op 13 allocs/op
|
||||
BenchmarkClientRoundTrip-12 23534 25959 ns/op 0.35 MB/s 1520 B/op 13 allocs/op
|
||||
BenchmarkServerRoundTrip/64-12 24288 24335 ns/op 5.26 MB/s 1568 B/op 13 allocs/op
|
||||
BenchmarkServerRoundTrip/64-12 23325 23724 ns/op 5.40 MB/s 1568 B/op 13 allocs/op
|
||||
BenchmarkServerRoundTrip/64-12 25240 23571 ns/op 5.43 MB/s 1568 B/op 13 allocs/op
|
||||
BenchmarkServerRoundTrip/1024-12 23334 26435 ns/op 77.47 MB/s 7136 B/op 17 allocs/op
|
||||
BenchmarkServerRoundTrip/1024-12 22939 28210 ns/op 72.60 MB/s 7136 B/op 17 allocs/op
|
||||
BenchmarkServerRoundTrip/1024-12 23402 30573 ns/op 66.99 MB/s 7136 B/op 17 allocs/op
|
||||
BenchmarkServerRoundTrip/65536-12 4402 140895 ns/op 930.28 MB/s 635956 B/op 45 allocs/op
|
||||
BenchmarkServerRoundTrip/65536-12 4201 144080 ns/op 909.72 MB/s 635955 B/op 45 allocs/op
|
||||
BenchmarkServerRoundTrip/65536-12 4046 145193 ns/op 902.74 MB/s 635953 B/op 45 allocs/op
|
||||
BenchmarkSessionSend-12 110679 5370 ns/op 47.67 MB/s 1168 B/op 9 allocs/op
|
||||
BenchmarkSessionSend-12 110362 5340 ns/op 47.94 MB/s 1168 B/op 9 allocs/op
|
||||
BenchmarkSessionSend-12 113160 5339 ns/op 47.95 MB/s 1168 B/op 9 allocs/op
|
||||
PASS
|
||||
ok git.yuntuo.hk/k2safe/go-omni/ws 12.286s
|
||||
goos: darwin
|
||||
goarch: arm64
|
||||
pkg: git.yuntuo.hk/k2safe/go-omni/ws/hub
|
||||
cpu: Apple M2 Max
|
||||
BenchmarkHubBroadcast/1-12 3537676 152.5 ns/op 256 B/op 2 allocs/op
|
||||
BenchmarkHubBroadcast/1-12 3975487 151.5 ns/op 256 B/op 2 allocs/op
|
||||
BenchmarkHubBroadcast/1-12 3925134 154.0 ns/op 256 B/op 2 allocs/op
|
||||
BenchmarkHubBroadcast/100-12 176622 3444 ns/op 3544 B/op 4 allocs/op
|
||||
BenchmarkHubBroadcast/100-12 170431 3533 ns/op 3544 B/op 4 allocs/op
|
||||
BenchmarkHubBroadcast/100-12 166556 3982 ns/op 3544 B/op 4 allocs/op
|
||||
BenchmarkHubBroadcast/1000-12 8853 64870 ns/op 54656 B/op 6 allocs/op
|
||||
BenchmarkHubBroadcast/1000-12 8582 65407 ns/op 54657 B/op 6 allocs/op
|
||||
BenchmarkHubBroadcast/1000-12 8001 64712 ns/op 54657 B/op 6 allocs/op
|
||||
PASS
|
||||
ok git.yuntuo.hk/k2safe/go-omni/ws/hub 6.195s
|
||||
PASS
|
||||
ok git.yuntuo.hk/k2safe/go-omni/ws/observe 0.280s
|
||||
PASS
|
||||
ok git.yuntuo.hk/k2safe/go-omni/ws/omni 0.300s
|
||||
goos: darwin
|
||||
goarch: arm64
|
||||
pkg: git.yuntuo.hk/k2safe/go-omni/ws/rpc
|
||||
cpu: Apple M2 Max
|
||||
BenchmarkPeerCall-12 31053 17732 ns/op 8386 B/op 193 allocs/op
|
||||
BenchmarkPeerCall-12 33787 17619 ns/op 8386 B/op 193 allocs/op
|
||||
BenchmarkPeerCall-12 33901 17817 ns/op 8386 B/op 193 allocs/op
|
||||
BenchmarkProtocolDecode-12 123168 4893 ns/op 19.62 MB/s 3656 B/op 106 allocs/op
|
||||
BenchmarkProtocolDecode-12 122533 4824 ns/op 19.90 MB/s 3656 B/op 106 allocs/op
|
||||
BenchmarkProtocolDecode-12 125842 4675 ns/op 20.54 MB/s 3656 B/op 106 allocs/op
|
||||
PASS
|
||||
ok git.yuntuo.hk/k2safe/go-omni/ws/rpc 4.531s
|
||||
86
reports/websocket-regression-go1.25.txt
Normal file
86
reports/websocket-regression-go1.25.txt
Normal file
@@ -0,0 +1,86 @@
|
||||
ok git.yuntuo.hk/k2safe/go-omni 0.400s
|
||||
ok git.yuntuo.hk/k2safe/go-omni/app 5.723s
|
||||
ok git.yuntuo.hk/k2safe/go-omni/audit (cached)
|
||||
ok git.yuntuo.hk/k2safe/go-omni/auth 1.045s
|
||||
ok git.yuntuo.hk/k2safe/go-omni/cache (cached)
|
||||
ok git.yuntuo.hk/k2safe/go-omni/cache/redis (cached)
|
||||
ok git.yuntuo.hk/k2safe/go-omni/cmd/go-omni 3.720s
|
||||
ok git.yuntuo.hk/k2safe/go-omni/cmd/go-omni/apigen 31.148s
|
||||
ok git.yuntuo.hk/k2safe/go-omni/cmd/go-omni/internal/genfs (cached)
|
||||
ok git.yuntuo.hk/k2safe/go-omni/cmd/go-omni/projectgen (cached)
|
||||
ok git.yuntuo.hk/k2safe/go-omni/cmd/go-omni/scaffold 2.786s
|
||||
ok git.yuntuo.hk/k2safe/go-omni/config (cached)
|
||||
ok git.yuntuo.hk/k2safe/go-omni/contract (cached)
|
||||
ok git.yuntuo.hk/k2safe/go-omni/copyx (cached)
|
||||
ok git.yuntuo.hk/k2safe/go-omni/cors (cached)
|
||||
ok git.yuntuo.hk/k2safe/go-omni/database 2.063s
|
||||
ok git.yuntuo.hk/k2safe/go-omni/database/gormx (cached)
|
||||
ok git.yuntuo.hk/k2safe/go-omni/database/migrate (cached)
|
||||
ok git.yuntuo.hk/k2safe/go-omni/database/mysql (cached)
|
||||
ok git.yuntuo.hk/k2safe/go-omni/errors (cached)
|
||||
? git.yuntuo.hk/k2safe/go-omni/examples/basic [no test files]
|
||||
? git.yuntuo.hk/k2safe/go-omni/examples/compatibility [no test files]
|
||||
? git.yuntuo.hk/k2safe/go-omni/examples/compatibility/ids [no test files]
|
||||
ok git.yuntuo.hk/k2safe/go-omni/examples/configuration (cached)
|
||||
ok git.yuntuo.hk/k2safe/go-omni/examples/copying (cached)
|
||||
? git.yuntuo.hk/k2safe/go-omni/examples/cors [no test files]
|
||||
? git.yuntuo.hk/k2safe/go-omni/examples/developerTools [no test files]
|
||||
ok git.yuntuo.hk/k2safe/go-omni/examples/httpClient (cached)
|
||||
? git.yuntuo.hk/k2safe/go-omni/examples/httpSafety [no test files]
|
||||
ok git.yuntuo.hk/k2safe/go-omni/examples/i18n 1.968s
|
||||
ok git.yuntuo.hk/k2safe/go-omni/examples/modules 2.777s
|
||||
ok git.yuntuo.hk/k2safe/go-omni/examples/platform 2.707s
|
||||
ok git.yuntuo.hk/k2safe/go-omni/examples/reference 2.993s
|
||||
? git.yuntuo.hk/k2safe/go-omni/examples/reference/handler [no test files]
|
||||
? git.yuntuo.hk/k2safe/go-omni/examples/reference/model [no test files]
|
||||
ok git.yuntuo.hk/k2safe/go-omni/examples/reference/repository (cached)
|
||||
? git.yuntuo.hk/k2safe/go-omni/examples/reference/service [no test files]
|
||||
ok git.yuntuo.hk/k2safe/go-omni/examples/signedRead (cached)
|
||||
ok git.yuntuo.hk/k2safe/go-omni/examples/telemetryHeaders 2.822s
|
||||
? git.yuntuo.hk/k2safe/go-omni/examples/transactions [no test files]
|
||||
? git.yuntuo.hk/k2safe/go-omni/examples/websocket [no test files]
|
||||
ok git.yuntuo.hk/k2safe/go-omni/examples/websocketRPC 2.839s
|
||||
ok git.yuntuo.hk/k2safe/go-omni/health 3.382s
|
||||
ok git.yuntuo.hk/k2safe/go-omni/httpc (cached)
|
||||
ok git.yuntuo.hk/k2safe/go-omni/httpx 3.869s
|
||||
ok git.yuntuo.hk/k2safe/go-omni/i18n (cached)
|
||||
? git.yuntuo.hk/k2safe/go-omni/i18n/browser [no test files]
|
||||
ok git.yuntuo.hk/k2safe/go-omni/i18n/errori18n (cached)
|
||||
ok git.yuntuo.hk/k2safe/go-omni/i18n/httpi18n (cached)
|
||||
ok git.yuntuo.hk/k2safe/go-omni/i18n/i18ntool (cached)
|
||||
? git.yuntuo.hk/k2safe/go-omni/internal/configdiag [no test files]
|
||||
? git.yuntuo.hk/k2safe/go-omni/internal/httplimits [no test files]
|
||||
ok git.yuntuo.hk/k2safe/go-omni/internal/perfcheck (cached)
|
||||
? git.yuntuo.hk/k2safe/go-omni/internal/storagefixture [no test files]
|
||||
? git.yuntuo.hk/k2safe/go-omni/internal/testutil [no test files]
|
||||
ok git.yuntuo.hk/k2safe/go-omni/lifecycle (cached)
|
||||
ok git.yuntuo.hk/k2safe/go-omni/logx (cached)
|
||||
ok git.yuntuo.hk/k2safe/go-omni/metrics (cached)
|
||||
ok git.yuntuo.hk/k2safe/go-omni/middleware (cached)
|
||||
ok git.yuntuo.hk/k2safe/go-omni/middleware/redis 2.257s
|
||||
ok git.yuntuo.hk/k2safe/go-omni/openapi 2.425s
|
||||
ok git.yuntuo.hk/k2safe/go-omni/pagination (cached)
|
||||
? git.yuntuo.hk/k2safe/go-omni/queue [no test files]
|
||||
ok git.yuntuo.hk/k2safe/go-omni/queue/redis (cached)
|
||||
ok git.yuntuo.hk/k2safe/go-omni/resilience (cached)
|
||||
ok git.yuntuo.hk/k2safe/go-omni/response (cached)
|
||||
? git.yuntuo.hk/k2safe/go-omni/scripts/corsBrowser [no test files]
|
||||
ok git.yuntuo.hk/k2safe/go-omni/storage (cached)
|
||||
ok git.yuntuo.hk/k2safe/go-omni/storage/local (cached)
|
||||
ok git.yuntuo.hk/k2safe/go-omni/storage/oss (cached)
|
||||
ok git.yuntuo.hk/k2safe/go-omni/storage/s3 (cached)
|
||||
? git.yuntuo.hk/k2safe/go-omni/storage/storagetest [no test files]
|
||||
ok git.yuntuo.hk/k2safe/go-omni/task (cached)
|
||||
ok git.yuntuo.hk/k2safe/go-omni/telemetry 2.595s
|
||||
ok git.yuntuo.hk/k2safe/go-omni/transport 2.868s
|
||||
ok git.yuntuo.hk/k2safe/go-omni/transport/http2 (cached)
|
||||
? git.yuntuo.hk/k2safe/go-omni/transport/internal/routing [no test files]
|
||||
ok git.yuntuo.hk/k2safe/go-omni/transport/native 5.567s
|
||||
ok git.yuntuo.hk/k2safe/go-omni/transport/nethttp 3.181s
|
||||
? git.yuntuo.hk/k2safe/go-omni/transport/transporttest [no test files]
|
||||
? git.yuntuo.hk/k2safe/go-omni/validate [no test files]
|
||||
ok git.yuntuo.hk/k2safe/go-omni/ws 3.875s
|
||||
ok git.yuntuo.hk/k2safe/go-omni/ws/hub 3.462s
|
||||
ok git.yuntuo.hk/k2safe/go-omni/ws/observe 3.337s
|
||||
ok git.yuntuo.hk/k2safe/go-omni/ws/omni 3.019s
|
||||
ok git.yuntuo.hk/k2safe/go-omni/ws/rpc 3.064s
|
||||
85
reports/websocket-validation-2026-10-29.md
Normal file
85
reports/websocket-validation-2026-10-29.md
Normal file
@@ -0,0 +1,85 @@
|
||||
# WebSocket 验收记录（2026-10-29）
|
||||
|
||||
本次增加通用 WS Client/Server/Session、Hub、可选 RPC/订阅恢复、观测、App 生命周期与生成项目扩展。对应版本 `v0.31.0-preview`，本文记录源码验证；远程发布验收单独记录。
|
||||
|
||||
## 结论
|
||||
|
||||
- 功能、真实 TCP/TLS、并发竞态、静态检查、Go 1.22 兼容性和可运行 Go 示例通过。
|
||||
- 最终全库回归输出见 [websocket-regression-go1.25.txt](websocket-regression-go1.25.txt)；Go 1.27.3 下 `go test ./ws/...` 也通过。生成示例只同步 appGen 与清单，生成漂移检查及消费项目编译通过；新增生成消费回归验证了自定义路由和失败清理。
|
||||
- Origin 模糊测试发现并修复无括号 IPv6 归一化歧义，失败样本保留在 `ws/testdata/fuzz/FuzzOrigin`；修复后 10 秒约 552,325 次执行通过。
|
||||
- 新增核心包在隔离 Go 1.27.3 工具链、govulncheck v1.9.0 下扫描未发现已知漏洞。
|
||||
- **包含 ws/omni 的完整接入安全扫描未通过**：仓库原有 `golang.org/x/net v0.33.0` 报告 4 项 HTTP/2 可达漏洞。不能将本次功能验收解释为整个框架已通过安全发布门槛。
|
||||
- 浏览器自动化访问 `http://127.0.0.1:8088` 被浏览器权限策略拒绝，因此浏览器 UI/浏览器协议实测未完成；不以 Go 客户端测试代替这一项。示例源文件可供手动运行，临时服务已停止。
|
||||
|
||||
## 功能与并发验证
|
||||
|
||||
使用 Apple M2 Max / darwin arm64，主测试工具链 Go 1.25.0。独立 Go 1.22.12 用于最低版本兼容检查，没有替换系统 Go。
|
||||
|
||||
执行过：
|
||||
|
||||
```sh
|
||||
go test ./...
|
||||
go test -race -count=5 -timeout=120s ./ws/... ./examples/websocketRPC ./app ./httpx
|
||||
go test -race -coverprofile=/tmp/go-omni-websocket-coverage.out ./ws/...
|
||||
go vet ./ws/... ./app ./httpx ./examples/websocket ./examples/websocketRPC
|
||||
GOTOOLCHAIN=go1.22.12 go test ./ws/... ./app ./httpx
|
||||
go test ./ws -run '^$' -fuzz FuzzOrigin -fuzztime=10s -parallel=4
|
||||
go test ./ws/rpc -run '^$' -fuzz FuzzProtocolDecode -fuzztime=10s
|
||||
go run ./examples/websocket
|
||||
go run ./examples/websocketRPC
|
||||
```
|
||||
|
||||
真实网络覆盖：回显、文本/二进制、128 个并行连接各 50 次往返、TLS/mTLS、HTTP CONNECT 代理认证、握手取消/超时、重连时刷新认证头、重试预算、快速重连与连接上限、双向嵌套 RPC、断线后两代 Session 的订阅恢复。
|
||||
|
||||
最终审查另修复了远端 `1001 going away` 被当成本地主动关闭、导致 Run 不重连的问题，并验证本地主动关闭仍停止重试；补充累计拨号/失败/重连指标和配置上界。修复后 `go test -race -count=3 ./ws/...` 通过。
|
||||
|
||||
安全与资源覆盖：同源/白名单/无 Origin/重复 Origin/null、拒绝错误子协议、认证拒绝与 panic、连接/握手速率限额、非法 UTF-8、压缩膨胀限额、发送数据拷贝、接收队列满、慢消费者、阻塞业务时仍处理 Ping/Pong、取消写入、断网、反复关闭、握手与停止并发、回调未退出时保留共享资源。
|
||||
|
||||
RPC 覆盖：双向请求、取消、迟到回复、重复在途 ID、未知字段、重复 JSON 键、嵌套深度、消息长度、pending/执行并发上限、公共与内部错误区分、panic 脱敏、订阅期望状态与恢复。RPC fuzz 10 秒约 71,268 次执行通过。
|
||||
|
||||
覆盖率快照：
|
||||
|
||||
| 包 | 语句覆盖率 |
|
||||
| --- | ---: |
|
||||
| ws | 84.7% |
|
||||
| ws/hub | 86.5% |
|
||||
| ws/observe | 88.4% |
|
||||
| ws/omni | 86.7% |
|
||||
| ws/rpc | 80.7% |
|
||||
|
||||
覆盖率只描述这组测试执行到的代码，不等同于正确性或安全证明。测试不包含生产长时间浸泡、跨地区网络容量、HTTP/2 extended CONNECT 或 Autobahn 全套认证。
|
||||
|
||||
## 性能基准
|
||||
|
||||
```sh
|
||||
go test -run '^$' -bench . -benchmem -benchtime=500ms -count=3 ./ws/...
|
||||
```
|
||||
|
||||
原始输出：[websocket-bench-go1.25.txt](websocket-bench-go1.25.txt)。环境为 Apple M2 Max、Go 1.25.0、GOMAXPROCS=12、loopback、无 TLS、压缩关闭。三次样本的范围如下；首轮客户端样本与其它验证有时间重叠，保留原始波动，不选取单个最好值作为承诺。
|
||||
|
||||
| 基准 | 时间/操作 | 分配 |
|
||||
| --- | ---: | ---: |
|
||||
| Client 回声往返（9 B） | 26.0–47.3 μs | 1520 B / 13 allocs |
|
||||
| Server 回声往返（64 B） | 23.6–24.3 μs | 1568 B / 13 allocs |
|
||||
| Server 回声往返（1 KiB） | 26.4–30.6 μs | 7136 B / 17 allocs |
|
||||
| Server 回声往返（64 KiB） | 140.9–145.2 μs | 约 636 KB / 45 allocs |
|
||||
| Session 发送（256 B） | 5.34–5.37 μs | 1168 B / 9 allocs |
|
||||
| Hub 广播到 1000 个模拟连接 | 64.7–65.4 μs | 约 54.7 KB / 6 allocs |
|
||||
| 内存传输 RPC Call | 17.6–17.8 μs | 8386 B / 193 allocs |
|
||||
| 严格 RPC envelope 解析 | 4.68–4.89 μs | 3656 B / 106 allocs |
|
||||
|
||||
网络往返基准包括双方处理及本机 socket 成本；64 KiB 场景的分配包含双方完整读入及安全发送拷贝，后续大消息优化需在保持消息所有权的前提下进行。Hub 基准仅测注册表和分发，RPC 内存基准不包含网络。这里没有从单连接 loopback 数字外推生产 QPS 或最大连接数。
|
||||
|
||||
内存预算需按连接数乘以消息/队列上限估算，并额外计入解码中消息、协议缓冲和业务持有的 payload。默认 4096 连接上限并不意味着任何机器都能承受所有连接同时用满双向 4 MiB 队列。部署时需根据机器容量设置 MaxConnections、消息与队列字节数、RPC 执行并发；压缩及 TLS 应另做容量测量。
|
||||
|
||||
## 漏洞扫描与剩余风险
|
||||
|
||||
扫描包含源码可达性分析，不是人工证明每条告警均可利用。没有隐藏、忽略或豁免扫描结果。
|
||||
|
||||
1. Go 1.25.0 + govulncheck v1.1.4 扫描 `./ws/...`：29 项标准库 symbol findings，以及 4 项 x/net symbol findings；Gorilla WebSocket 没有报告项。工具链版本是现有本机版本。扫描结果摘要保留在 [JSON](websocket-vuln-go1.25.json)。
|
||||
2. 隔离 Go 1.27.3 + govulncheck v1.9.0 扫描 `./ws/...`：标准库告警消除，剩余 4 项 x/net HTTP/2 findings，详见 [完整输出](websocket-vuln-patched-go.txt)。
|
||||
3. 同一修补工具链扫描 `./ws ./ws/hub ./ws/rpc ./ws/observe`：`No vulnerabilities found.`，见 [输出](websocket-vuln-core-patched-go.txt)。这不覆盖 ws/omni 引入的原有 App/HTTP2 依赖图。
|
||||
|
||||
剩余报告：GO-2026-6617（HPACK 并发）、GO-2026-6612（流控退款）、GO-2026-6611（重复窗口变更 CPU）、GO-2026-6603（Trailer 内存）。扫描器给出的修复版本为 `golang.org/x/net v0.60.0`；它的 [官方 go.mod](https://raw.githubusercontent.com/golang/net/v0.60.0/go.mod) 要求 Go 1.26，并升级 x/crypto、x/sys、x/text。此变更会改变框架当前公开的 Go 1.22 基线与多个既有适配器，未在 WS 功能提交中隐式实施。需要作为明确的框架安全升级进行全库与消费项目回归，生产发布前解决。
|
||||
|
||||
生产应使用受支持且已修补的 Go 工具链。Go 1.22 测试只验证源码兼容，不代表该旧工具链具备当前安全修复。对应标准库证书问题的官方说明见 [GO-2026-6809](https://pkg.go.dev/vuln/GO-2026-6809)；HTTP/2 问题见 [GO-2026-6617](https://pkg.go.dev/vuln/GO-2026-6617)。
|
||||
1
reports/websocket-vuln-core-patched-go.txt
Normal file
1
reports/websocket-vuln-core-patched-go.txt
Normal file
@@ -0,0 +1 @@
|
||||
No vulnerabilities found.
|
||||
839
reports/websocket-vuln-go1.25.json
Normal file
839
reports/websocket-vuln-go1.25.json
Normal file
@@ -0,0 +1,839 @@
|
||||
{
|
||||
"command": "go run golang.org/x/vuln/cmd/govulncheck@v1.1.4 -format=json ./ws/...",
|
||||
"config": {
|
||||
"protocol_version": "v1.0.0",
|
||||
"scanner_name": "govulncheck",
|
||||
"scanner_version": "v1.1.4",
|
||||
"db": "https://vuln.go.dev",
|
||||
"db_last_modified": "2026-10-27T21:16:18Z",
|
||||
"go_version": "go1.25.0",
|
||||
"scan_level": "symbol",
|
||||
"scan_mode": "source"
|
||||
},
|
||||
"findings": [
|
||||
{
|
||||
"id": "GO-2025-3487",
|
||||
"module": "golang.org/x/crypto",
|
||||
"found": "v0.31.0",
|
||||
"fixed": "v0.35.0",
|
||||
"symbolReachable": false,
|
||||
"summary": "Potential denial of service in golang.org/x/crypto"
|
||||
},
|
||||
{
|
||||
"id": "GO-2025-4116",
|
||||
"module": "golang.org/x/crypto",
|
||||
"found": "v0.31.0",
|
||||
"fixed": "v0.43.0",
|
||||
"symbolReachable": false,
|
||||
"summary": "Potential denial of service in golang.org/x/crypto/ssh/agent"
|
||||
},
|
||||
{
|
||||
"id": "GO-2025-4134",
|
||||
"module": "golang.org/x/crypto",
|
||||
"found": "v0.31.0",
|
||||
"fixed": "v0.45.0",
|
||||
"symbolReachable": false,
|
||||
"summary": "Unbounded memory consumption in golang.org/x/crypto/ssh"
|
||||
},
|
||||
{
|
||||
"id": "GO-2025-4135",
|
||||
"module": "golang.org/x/crypto",
|
||||
"found": "v0.31.0",
|
||||
"fixed": "v0.45.0",
|
||||
"symbolReachable": false,
|
||||
"summary": "Malformed constraint may cause denial of service in golang.org/x/crypto/ssh/agent"
|
||||
},
|
||||
{
|
||||
"id": "GO-2026-5005",
|
||||
"module": "golang.org/x/crypto",
|
||||
"found": "v0.31.0",
|
||||
"fixed": "v0.52.0",
|
||||
"symbolReachable": false,
|
||||
"summary": "Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent"
|
||||
},
|
||||
{
|
||||
"id": "GO-2026-5006",
|
||||
"module": "golang.org/x/crypto",
|
||||
"found": "v0.31.0",
|
||||
"fixed": "v0.52.0",
|
||||
"symbolReachable": false,
|
||||
"summary": "Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent"
|
||||
},
|
||||
{
|
||||
"id": "GO-2026-5013",
|
||||
"module": "golang.org/x/crypto",
|
||||
"found": "v0.31.0",
|
||||
"fixed": "v0.52.0",
|
||||
"symbolReachable": false,
|
||||
"summary": "Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh"
|
||||
},
|
||||
{
|
||||
"id": "GO-2026-5014",
|
||||
"module": "golang.org/x/crypto",
|
||||
"found": "v0.31.0",
|
||||
"fixed": "v0.52.0",
|
||||
"symbolReachable": false,
|
||||
"summary": "Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh"
|
||||
},
|
||||
{
|
||||
"id": "GO-2026-5015",
|
||||
"module": "golang.org/x/crypto",
|
||||
"found": "v0.31.0",
|
||||
"fixed": "v0.52.0",
|
||||
"symbolReachable": false,
|
||||
"summary": "Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh"
|
||||
},
|
||||
{
|
||||
"id": "GO-2026-5016",
|
||||
"module": "golang.org/x/crypto",
|
||||
"found": "v0.31.0",
|
||||
"fixed": "v0.52.0",
|
||||
"symbolReachable": false,
|
||||
"summary": "Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh"
|
||||
},
|
||||
{
|
||||
"id": "GO-2026-5017",
|
||||
"module": "golang.org/x/crypto",
|
||||
"found": "v0.31.0",
|
||||
"fixed": "v0.52.0",
|
||||
"symbolReachable": false,
|
||||
"summary": "Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh"
|
||||
},
|
||||
{
|
||||
"id": "GO-2026-5018",
|
||||
"module": "golang.org/x/crypto",
|
||||
"found": "v0.31.0",
|
||||
"fixed": "v0.52.0",
|
||||
"symbolReachable": false,
|
||||
"summary": "Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh"
|
||||
},
|
||||
{
|
||||
"id": "GO-2026-5019",
|
||||
"module": "golang.org/x/crypto",
|
||||
"found": "v0.31.0",
|
||||
"fixed": "v0.52.0",
|
||||
"symbolReachable": false,
|
||||
"summary": "Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh"
|
||||
},
|
||||
{
|
||||
"id": "GO-2026-5020",
|
||||
"module": "golang.org/x/crypto",
|
||||
"found": "v0.31.0",
|
||||
"fixed": "v0.52.0",
|
||||
"symbolReachable": false,
|
||||
"summary": "Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh"
|
||||
},
|
||||
{
|
||||
"id": "GO-2026-5021",
|
||||
"module": "golang.org/x/crypto",
|
||||
"found": "v0.31.0",
|
||||
"fixed": "v0.52.0",
|
||||
"symbolReachable": false,
|
||||
"summary": "Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts"
|
||||
},
|
||||
{
|
||||
"id": "GO-2026-5023",
|
||||
"module": "golang.org/x/crypto",
|
||||
"found": "v0.31.0",
|
||||
"fixed": "v0.52.0",
|
||||
"symbolReachable": false,
|
||||
"summary": "Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh"
|
||||
},
|
||||
{
|
||||
"id": "GO-2026-5033",
|
||||
"module": "golang.org/x/crypto",
|
||||
"found": "v0.31.0",
|
||||
"fixed": "v0.52.0",
|
||||
"symbolReachable": false,
|
||||
"summary": "Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent"
|
||||
},
|
||||
{
|
||||
"id": "GO-2026-5932",
|
||||
"module": "golang.org/x/crypto",
|
||||
"found": "v0.31.0",
|
||||
"fixed": null,
|
||||
"symbolReachable": false,
|
||||
"summary": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues"
|
||||
},
|
||||
{
|
||||
"id": "GO-2026-6303",
|
||||
"module": "golang.org/x/crypto",
|
||||
"found": "v0.31.0",
|
||||
"fixed": "v0.55.0",
|
||||
"symbolReachable": false,
|
||||
"summary": "Source-address critical option not enforced for non-public-key auth callbacks in golang.org/x/crypto/ssh"
|
||||
},
|
||||
{
|
||||
"id": "GO-2026-6354",
|
||||
"module": "golang.org/x/crypto",
|
||||
"found": "v0.31.0",
|
||||
"fixed": "v0.56.0",
|
||||
"symbolReachable": false,
|
||||
"summary": "Prevent DoS on deadlocked undecided channel in golang.org/x/crypto/ssh"
|
||||
},
|
||||
{
|
||||
"id": "GO-2026-6355",
|
||||
"module": "golang.org/x/crypto",
|
||||
"found": "v0.31.0",
|
||||
"fixed": "v0.56.0",
|
||||
"symbolReachable": false,
|
||||
"summary": "Prevent DoS on deadlocked established channel in golang.org/x/crypto/ssh"
|
||||
},
|
||||
{
|
||||
"id": "GO-2025-3955",
|
||||
"module": "stdlib",
|
||||
"found": "v1.25.0",
|
||||
"fixed": "v1.25.1",
|
||||
"symbolReachable": false,
|
||||
"summary": "CrossOriginProtection insecure bypass patterns not limited to exact matches in net/http"
|
||||
},
|
||||
{
|
||||
"id": "GO-2025-4006",
|
||||
"module": "stdlib",
|
||||
"found": "v1.25.0",
|
||||
"fixed": "v1.25.2",
|
||||
"symbolReachable": false,
|
||||
"summary": "Excessive CPU consumption in ParseAddress in net/mail"
|
||||
},
|
||||
{
|
||||
"id": "GO-2025-4007",
|
||||
"module": "stdlib",
|
||||
"found": "v1.25.0",
|
||||
"fixed": "v1.25.3",
|
||||
"symbolReachable": true,
|
||||
"summary": "Quadratic complexity when checking name constraints in crypto/x509"
|
||||
},
|
||||
{
|
||||
"id": "GO-2025-4008",
|
||||
"module": "stdlib",
|
||||
"found": "v1.25.0",
|
||||
"fixed": "v1.25.2",
|
||||
"symbolReachable": true,
|
||||
"summary": "ALPN negotiation error contains attacker controlled information in crypto/tls"
|
||||
},
|
||||
{
|
||||
"id": "GO-2025-4009",
|
||||
"module": "stdlib",
|
||||
"found": "v1.25.0",
|
||||
"fixed": "v1.25.2",
|
||||
"symbolReachable": false,
|
||||
"summary": "Quadratic complexity when parsing some invalid inputs in encoding/pem"
|
||||
},
|
||||
{
|
||||
"id": "GO-2025-4010",
|
||||
"module": "stdlib",
|
||||
"found": "v1.25.0",
|
||||
"fixed": "v1.25.2",
|
||||
"symbolReachable": true,
|
||||
"summary": "Insufficient validation of bracketed IPv6 hostnames in net/url"
|
||||
},
|
||||
{
|
||||
"id": "GO-2025-4011",
|
||||
"module": "stdlib",
|
||||
"found": "v1.25.0",
|
||||
"fixed": "v1.25.2",
|
||||
"symbolReachable": true,
|
||||
"summary": "Parsing DER payload can cause memory exhaustion in encoding/asn1"
|
||||
},
|
||||
{
|
||||
"id": "GO-2025-4012",
|
||||
"module": "stdlib",
|
||||
"found": "v1.25.0",
|
||||
"fixed": "v1.25.2",
|
||||
"symbolReachable": true,
|
||||
"summary": "Lack of limit when parsing cookies can cause memory exhaustion in net/http"
|
||||
},
|
||||
{
|
||||
"id": "GO-2025-4013",
|
||||
"module": "stdlib",
|
||||
"found": "v1.25.0",
|
||||
"fixed": "v1.25.2",
|
||||
"symbolReachable": true,
|
||||
"summary": "Panic when validating certificates with DSA public keys in crypto/x509"
|
||||
},
|
||||
{
|
||||
"id": "GO-2025-4014",
|
||||
"module": "stdlib",
|
||||
"found": "v1.25.0",
|
||||
"fixed": "v1.25.2",
|
||||
"symbolReachable": false,
|
||||
"summary": "Unbounded allocation when parsing GNU sparse map in archive/tar"
|
||||
},
|
||||
{
|
||||
"id": "GO-2025-4015",
|
||||
"module": "stdlib",
|
||||
"found": "v1.25.0",
|
||||
"fixed": "v1.25.2",
|
||||
"symbolReachable": false,
|
||||
"summary": "Excessive CPU consumption in Reader.ReadResponse in net/textproto"
|
||||
},
|
||||
{
|
||||
"id": "GO-2025-4155",
|
||||
"module": "stdlib",
|
||||
"found": "v1.25.0",
|
||||
"fixed": "v1.25.5",
|
||||
"symbolReachable": true,
|
||||
"summary": "Excessive resource consumption when printing error string for host certificate validation in crypto/x509"
|
||||
},
|
||||
{
|
||||
"id": "GO-2025-4175",
|
||||
"module": "stdlib",
|
||||
"found": "v1.25.0",
|
||||
"fixed": "v1.25.5",
|
||||
"symbolReachable": true,
|
||||
"summary": "Improper application of excluded DNS name constraints when verifying wildcard names in crypto/x509"
|
||||
},
|
||||
{
|
||||
"id": "GO-2026-4337",
|
||||
"module": "stdlib",
|
||||
"found": "v1.25.0",
|
||||
"fixed": "v1.25.7",
|
||||
"symbolReachable": true,
|
||||
"summary": "Unexpected session resumption in crypto/tls"
|
||||
},
|
||||
{
|
||||
"id": "GO-2026-4340",
|
||||
"module": "stdlib",
|
||||
"found": "v1.25.0",
|
||||
"fixed": "v1.25.6",
|
||||
"symbolReachable": true,
|
||||
"summary": "Handshake messages may be processed at the incorrect encryption level in crypto/tls"
|
||||
},
|
||||
{
|
||||
"id": "GO-2026-4341",
|
||||
"module": "stdlib",
|
||||
"found": "v1.25.0",
|
||||
"fixed": "v1.25.6",
|
||||
"symbolReachable": false,
|
||||
"summary": "Memory exhaustion in query parameter parsing in net/url"
|
||||
},
|
||||
{
|
||||
"id": "GO-2026-4342",
|
||||
"module": "stdlib",
|
||||
"found": "v1.25.0",
|
||||
"fixed": "v1.25.6",
|
||||
"symbolReachable": false,
|
||||
"summary": "Excessive CPU consumption when building archive index in archive/zip"
|
||||
},
|
||||
{
|
||||
"id": "GO-2026-4601",
|
||||
"module": "stdlib",
|
||||
"found": "v1.25.0",
|
||||
"fixed": "v1.25.8",
|
||||
"symbolReachable": true,
|
||||
"summary": "Incorrect parsing of IPv6 host literals in net/url"
|
||||
},
|
||||
{
|
||||
"id": "GO-2026-4602",
|
||||
"module": "stdlib",
|
||||
"found": "v1.25.0",
|
||||
"fixed": "v1.25.8",
|
||||
"symbolReachable": true,
|
||||
"summary": "FileInfo can escape from a Root in os"
|
||||
},
|
||||
{
|
||||
"id": "GO-2026-4603",
|
||||
"module": "stdlib",
|
||||
"found": "v1.25.0",
|
||||
"fixed": "v1.25.8",
|
||||
"symbolReachable": false,
|
||||
"summary": "URLs in meta content attribute actions are not escaped in html/template"
|
||||
},
|
||||
{
|
||||
"id": "GO-2026-4864",
|
||||
"module": "stdlib",
|
||||
"found": "v1.25.0",
|
||||
"fixed": "v1.25.9",
|
||||
"symbolReachable": false,
|
||||
"summary": "TOCTOU permits root escape on Linux via Root.Chmod in os in internal/syscall/unix"
|
||||
},
|
||||
{
|
||||
"id": "GO-2026-4865",
|
||||
"module": "stdlib",
|
||||
"found": "v1.25.0",
|
||||
"fixed": "v1.25.9",
|
||||
"symbolReachable": false,
|
||||
"summary": "JsBraceDepth Context Tracking Bugs (XSS) in html/template"
|
||||
},
|
||||
{
|
||||
"id": "GO-2026-4869",
|
||||
"module": "stdlib",
|
||||
"found": "v1.25.0",
|
||||
"fixed": "v1.25.9",
|
||||
"symbolReachable": false,
|
||||
"summary": "Unbounded allocation for old GNU sparse in archive/tar"
|
||||
},
|
||||
{
|
||||
"id": "GO-2026-4870",
|
||||
"module": "stdlib",
|
||||
"found": "v1.25.0",
|
||||
"fixed": "v1.25.9",
|
||||
"symbolReachable": true,
|
||||
"summary": "Unauthenticated TLS 1.3 KeyUpdate record can cause persistent connection retention and DoS in crypto/tls"
|
||||
},
|
||||
{
|
||||
"id": "GO-2026-4918",
|
||||
"module": "stdlib",
|
||||
"found": "v1.25.0",
|
||||
"fixed": "v1.25.10",
|
||||
"symbolReachable": false,
|
||||
"summary": "Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net"
|
||||
},
|
||||
{
|
||||
"id": "GO-2026-4946",
|
||||
"module": "stdlib",
|
||||
"found": "v1.25.0",
|
||||
"fixed": "v1.25.9",
|
||||
"symbolReachable": true,
|
||||
"summary": "Inefficient policy validation in crypto/x509"
|
||||
},
|
||||
{
|
||||
"id": "GO-2026-4947",
|
||||
"module": "stdlib",
|
||||
"found": "v1.25.0",
|
||||
"fixed": "v1.25.9",
|
||||
"symbolReachable": true,
|
||||
"summary": "Unexpected work during chain building in crypto/x509"
|
||||
},
|
||||
{
|
||||
"id": "GO-2026-4970",
|
||||
"module": "stdlib",
|
||||
"found": "v1.25.0",
|
||||
"fixed": "v1.25.12",
|
||||
"symbolReachable": false,
|
||||
"summary": "Root escape via symlink plus trailing slash in os"
|
||||
},
|
||||
{
|
||||
"id": "GO-2026-4971",
|
||||
"module": "stdlib",
|
||||
"found": "v1.25.0",
|
||||
"fixed": "v1.25.10",
|
||||
"symbolReachable": true,
|
||||
"summary": "Panic in Dial and LookupPort when handling NUL byte on Windows in net"
|
||||
},
|
||||
{
|
||||
"id": "GO-2026-4976",
|
||||
"module": "stdlib",
|
||||
"found": "v1.25.0",
|
||||
"fixed": "v1.25.10",
|
||||
"symbolReachable": false,
|
||||
"summary": "ReverseProxy forwards queries with more than urlmaxqueryparams parameters in net/http/httputil"
|
||||
},
|
||||
{
|
||||
"id": "GO-2026-4977",
|
||||
"module": "stdlib",
|
||||
"found": "v1.25.0",
|
||||
"fixed": "v1.25.10",
|
||||
"symbolReachable": false,
|
||||
"summary": "Quadratic string concatenation in consumePhrase in net/mail"
|
||||
},
|
||||
{
|
||||
"id": "GO-2026-4980",
|
||||
"module": "stdlib",
|
||||
"found": "v1.25.0",
|
||||
"fixed": "v1.25.10",
|
||||
"symbolReachable": false,
|
||||
"summary": "Escaper bypass leads to XSS in html/template"
|
||||
},
|
||||
{
|
||||
"id": "GO-2026-4981",
|
||||
"module": "stdlib",
|
||||
"found": "v1.25.0",
|
||||
"fixed": "v1.25.10",
|
||||
"symbolReachable": false,
|
||||
"summary": "Crash when handling long CNAME response in net"
|
||||
},
|
||||
{
|
||||
"id": "GO-2026-4982",
|
||||
"module": "stdlib",
|
||||
"found": "v1.25.0",
|
||||
"fixed": "v1.25.10",
|
||||
"symbolReachable": false,
|
||||
"summary": "Bypass of meta content URL escaping causes XSS in html/template"
|
||||
},
|
||||
{
|
||||
"id": "GO-2026-4986",
|
||||
"module": "stdlib",
|
||||
"found": "v1.25.0",
|
||||
"fixed": "v1.25.10",
|
||||
"symbolReachable": false,
|
||||
"summary": "Quadratic string concatentation in consumeComment in net/mail"
|
||||
},
|
||||
{
|
||||
"id": "GO-2026-5026",
|
||||
"module": "stdlib",
|
||||
"found": "v1.25.0",
|
||||
"fixed": "v1.25.13",
|
||||
"symbolReachable": false,
|
||||
"summary": "Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna"
|
||||
},
|
||||
{
|
||||
"id": "GO-2026-5037",
|
||||
"module": "stdlib",
|
||||
"found": "v1.25.0",
|
||||
"fixed": "v1.25.11",
|
||||
"symbolReachable": true,
|
||||
"summary": "Inefficient candidate hostname parsing in crypto/x509"
|
||||
},
|
||||
{
|
||||
"id": "GO-2026-5038",
|
||||
"module": "stdlib",
|
||||
"found": "v1.25.0",
|
||||
"fixed": "v1.25.11",
|
||||
"symbolReachable": false,
|
||||
"summary": "Quadratic complexity in WordDecoder.DecodeHeader in mime"
|
||||
},
|
||||
{
|
||||
"id": "GO-2026-5039",
|
||||
"module": "stdlib",
|
||||
"found": "v1.25.0",
|
||||
"fixed": "v1.25.11",
|
||||
"symbolReachable": true,
|
||||
"summary": "Arbitrary inputs are included in errors without any escaping in net/textproto"
|
||||
},
|
||||
{
|
||||
"id": "GO-2026-5856",
|
||||
"module": "stdlib",
|
||||
"found": "v1.25.0",
|
||||
"fixed": "v1.25.12",
|
||||
"symbolReachable": true,
|
||||
"summary": "Invoking Encrypted Client Hello privacy leak in crypto/tls"
|
||||
},
|
||||
{
|
||||
"id": "GO-2026-5972",
|
||||
"module": "stdlib",
|
||||
"found": "v1.25.0",
|
||||
"fixed": "v1.25.13",
|
||||
"symbolReachable": true,
|
||||
"summary": "Enforce maximum recursion depth in encoding/asn1"
|
||||
},
|
||||
{
|
||||
"id": "GO-2026-6088",
|
||||
"module": "stdlib",
|
||||
"found": "v1.25.0",
|
||||
"fixed": "v1.25.13",
|
||||
"symbolReachable": false,
|
||||
"summary": "Add recursion depth guard during decode in encoding/xml"
|
||||
},
|
||||
{
|
||||
"id": "GO-2026-6089",
|
||||
"module": "stdlib",
|
||||
"found": "v1.25.0",
|
||||
"fixed": "v1.25.13",
|
||||
"symbolReachable": false,
|
||||
"summary": "Apply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/http"
|
||||
},
|
||||
{
|
||||
"id": "GO-2026-6090",
|
||||
"module": "stdlib",
|
||||
"found": "v1.25.0",
|
||||
"fixed": "v1.25.13",
|
||||
"symbolReachable": true,
|
||||
"summary": "Limit handshake messages we are willing to accept post-handshake in crypto/tls"
|
||||
},
|
||||
{
|
||||
"id": "GO-2026-6091",
|
||||
"module": "stdlib",
|
||||
"found": "v1.25.0",
|
||||
"fixed": "v1.25.13",
|
||||
"symbolReachable": false,
|
||||
"summary": "Fix Javascript regexp context tracking in html/template"
|
||||
},
|
||||
{
|
||||
"id": "GO-2026-6218",
|
||||
"module": "stdlib",
|
||||
"found": "v1.25.0",
|
||||
"fixed": "v1.25.13",
|
||||
"symbolReachable": false,
|
||||
"summary": "Avoid quadratic complexity in resolvePath in net/url"
|
||||
},
|
||||
{
|
||||
"id": "GO-2026-6599",
|
||||
"module": "stdlib",
|
||||
"found": "v1.25.0",
|
||||
"fixed": "v1.26.9",
|
||||
"symbolReachable": false,
|
||||
"summary": "Reset context tracking on consecutive template expressions in html/template"
|
||||
},
|
||||
{
|
||||
"id": "GO-2026-6600",
|
||||
"module": "stdlib",
|
||||
"found": "v1.25.0",
|
||||
"fixed": "v1.26.9",
|
||||
"symbolReachable": false,
|
||||
"summary": "Recognize yield as regexp preceder keyword in html/template"
|
||||
},
|
||||
{
|
||||
"id": "GO-2026-6603",
|
||||
"module": "stdlib",
|
||||
"found": "v1.25.0",
|
||||
"fixed": "v1.26.9",
|
||||
"symbolReachable": true,
|
||||
"summary": "HTTP/2 server memory exhaustion due to Trailer headers in net/http"
|
||||
},
|
||||
{
|
||||
"id": "GO-2026-6604",
|
||||
"module": "stdlib",
|
||||
"found": "v1.25.0",
|
||||
"fixed": "v1.26.9",
|
||||
"symbolReachable": false,
|
||||
"summary": "Root.Mkdir(All) can follow junctions out of the root on Windows in os"
|
||||
},
|
||||
{
|
||||
"id": "GO-2026-6605",
|
||||
"module": "stdlib",
|
||||
"found": "v1.25.0",
|
||||
"fixed": "v1.26.9",
|
||||
"symbolReachable": false,
|
||||
"summary": "HTTP/1 client connection desynchronization after CONNECT rejection in net/http"
|
||||
},
|
||||
{
|
||||
"id": "GO-2026-6607",
|
||||
"module": "stdlib",
|
||||
"found": "v1.25.0",
|
||||
"fixed": "v1.26.9",
|
||||
"symbolReachable": true,
|
||||
"summary": "Reject malformed ECH outer extension references in crypto/tls"
|
||||
},
|
||||
{
|
||||
"id": "GO-2026-6608",
|
||||
"module": "stdlib",
|
||||
"found": "v1.25.0",
|
||||
"fixed": "v1.26.9",
|
||||
"symbolReachable": true,
|
||||
"summary": "Memory limit bypass when parsing MIME headers in net/textproto, mime/multipart"
|
||||
},
|
||||
{
|
||||
"id": "GO-2026-6609",
|
||||
"module": "stdlib",
|
||||
"found": "v1.25.0",
|
||||
"fixed": "v1.26.9",
|
||||
"symbolReachable": false,
|
||||
"summary": "Lack of limit on size of parsed Range headers in net/http"
|
||||
},
|
||||
{
|
||||
"id": "GO-2026-6610",
|
||||
"module": "stdlib",
|
||||
"found": "v1.25.0",
|
||||
"fixed": "v1.26.9",
|
||||
"symbolReachable": false,
|
||||
"summary": "HTTP/2 transport accepts malformed framing-related headers in net/http"
|
||||
},
|
||||
{
|
||||
"id": "GO-2026-6611",
|
||||
"module": "stdlib",
|
||||
"found": "v1.25.0",
|
||||
"fixed": "v1.26.9",
|
||||
"symbolReachable": true,
|
||||
"summary": "Excessive CPU consumption from repeated initial window changes in net/http"
|
||||
},
|
||||
{
|
||||
"id": "GO-2026-6612",
|
||||
"module": "stdlib",
|
||||
"found": "v1.25.0",
|
||||
"fixed": "v1.26.9",
|
||||
"symbolReachable": true,
|
||||
"summary": "Double flow control refund on HTTP/2 server streams in net/http"
|
||||
},
|
||||
{
|
||||
"id": "GO-2026-6613",
|
||||
"module": "stdlib",
|
||||
"found": "v1.25.0",
|
||||
"fixed": "v1.26.9",
|
||||
"symbolReachable": true,
|
||||
"summary": "HTTP/1 server connection desynchronization after 2xx CONNECT response in net/http"
|
||||
},
|
||||
{
|
||||
"id": "GO-2026-6617",
|
||||
"module": "stdlib",
|
||||
"found": "v1.25.0",
|
||||
"fixed": "v1.26.9",
|
||||
"symbolReachable": true,
|
||||
"summary": "HTTP/2 server crash due to HPACK encoder race in net/http"
|
||||
},
|
||||
{
|
||||
"id": "GO-2026-6809",
|
||||
"module": "stdlib",
|
||||
"found": "v1.25.0",
|
||||
"fixed": "v1.26.10",
|
||||
"symbolReachable": true,
|
||||
"summary": "Distrust compromised intermediate certificates in crypto/x509"
|
||||
},
|
||||
{
|
||||
"id": "GO-2025-3503",
|
||||
"module": "golang.org/x/net",
|
||||
"found": "v0.33.0",
|
||||
"fixed": "v0.36.0",
|
||||
"symbolReachable": false,
|
||||
"summary": "HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net"
|
||||
},
|
||||
{
|
||||
"id": "GO-2025-3595",
|
||||
"module": "golang.org/x/net",
|
||||
"found": "v0.33.0",
|
||||
"fixed": "v0.38.0",
|
||||
"symbolReachable": false,
|
||||
"summary": "Incorrect Neutralization of Input During Web Page Generation in x/net in golang.org/x/net"
|
||||
},
|
||||
{
|
||||
"id": "GO-2026-4440",
|
||||
"module": "golang.org/x/net",
|
||||
"found": "v0.33.0",
|
||||
"fixed": "v0.45.0",
|
||||
"symbolReachable": false,
|
||||
"summary": "Quadratic parsing complexity in golang.org/x/net/html"
|
||||
},
|
||||
{
|
||||
"id": "GO-2026-4441",
|
||||
"module": "golang.org/x/net",
|
||||
"found": "v0.33.0",
|
||||
"fixed": "v0.45.0",
|
||||
"symbolReachable": false,
|
||||
"summary": "Infinite parsing loop in golang.org/x/net"
|
||||
},
|
||||
{
|
||||
"id": "GO-2026-4918",
|
||||
"module": "golang.org/x/net",
|
||||
"found": "v0.33.0",
|
||||
"fixed": "v0.53.0",
|
||||
"symbolReachable": false,
|
||||
"summary": "Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net"
|
||||
},
|
||||
{
|
||||
"id": "GO-2026-5025",
|
||||
"module": "golang.org/x/net",
|
||||
"found": "v0.33.0",
|
||||
"fixed": "v0.55.0",
|
||||
"symbolReachable": false,
|
||||
"summary": "Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html"
|
||||
},
|
||||
{
|
||||
"id": "GO-2026-5026",
|
||||
"module": "golang.org/x/net",
|
||||
"found": "v0.33.0",
|
||||
"fixed": "v0.55.0",
|
||||
"symbolReachable": false,
|
||||
"summary": "Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna"
|
||||
},
|
||||
{
|
||||
"id": "GO-2026-5027",
|
||||
"module": "golang.org/x/net",
|
||||
"found": "v0.33.0",
|
||||
"fixed": "v0.55.0",
|
||||
"symbolReachable": false,
|
||||
"summary": "Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html"
|
||||
},
|
||||
{
|
||||
"id": "GO-2026-5028",
|
||||
"module": "golang.org/x/net",
|
||||
"found": "v0.33.0",
|
||||
"fixed": "v0.55.0",
|
||||
"symbolReachable": false,
|
||||
"summary": "Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html"
|
||||
},
|
||||
{
|
||||
"id": "GO-2026-5029",
|
||||
"module": "golang.org/x/net",
|
||||
"found": "v0.33.0",
|
||||
"fixed": "v0.55.0",
|
||||
"symbolReachable": false,
|
||||
"summary": "Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html"
|
||||
},
|
||||
{
|
||||
"id": "GO-2026-5030",
|
||||
"module": "golang.org/x/net",
|
||||
"found": "v0.33.0",
|
||||
"fixed": "v0.55.0",
|
||||
"symbolReachable": false,
|
||||
"summary": "Invoking duplicate attributes can cause XSS in golang.org/x/net/html"
|
||||
},
|
||||
{
|
||||
"id": "GO-2026-5942",
|
||||
"module": "golang.org/x/net",
|
||||
"found": "v0.33.0",
|
||||
"fixed": "v0.56.0",
|
||||
"symbolReachable": false,
|
||||
"summary": "Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage"
|
||||
},
|
||||
{
|
||||
"id": "GO-2026-6603",
|
||||
"module": "golang.org/x/net",
|
||||
"found": "v0.33.0",
|
||||
"fixed": "v0.60.0",
|
||||
"symbolReachable": true,
|
||||
"summary": "HTTP/2 server memory exhaustion due to Trailer headers in net/http"
|
||||
},
|
||||
{
|
||||
"id": "GO-2026-6610",
|
||||
"module": "golang.org/x/net",
|
||||
"found": "v0.33.0",
|
||||
"fixed": "v0.60.0",
|
||||
"symbolReachable": false,
|
||||
"summary": "HTTP/2 transport accepts malformed framing-related headers in net/http"
|
||||
},
|
||||
{
|
||||
"id": "GO-2026-6611",
|
||||
"module": "golang.org/x/net",
|
||||
"found": "v0.33.0",
|
||||
"fixed": "v0.60.0",
|
||||
"symbolReachable": true,
|
||||
"summary": "Excessive CPU consumption from repeated initial window changes in net/http"
|
||||
},
|
||||
{
|
||||
"id": "GO-2026-6612",
|
||||
"module": "golang.org/x/net",
|
||||
"found": "v0.33.0",
|
||||
"fixed": "v0.60.0",
|
||||
"symbolReachable": true,
|
||||
"summary": "Double flow control refund on HTTP/2 server streams in net/http"
|
||||
},
|
||||
{
|
||||
"id": "GO-2026-6617",
|
||||
"module": "golang.org/x/net",
|
||||
"found": "v0.33.0",
|
||||
"fixed": "v0.60.0",
|
||||
"symbolReachable": true,
|
||||
"summary": "HTTP/2 server crash due to HPACK encoder race in net/http"
|
||||
},
|
||||
{
|
||||
"id": "GO-2026-6860",
|
||||
"module": "golang.org/x/net",
|
||||
"found": "v0.33.0",
|
||||
"fixed": "v0.62.0",
|
||||
"symbolReachable": false,
|
||||
"summary": "Avoid quadratic complexity when coalescing text nodes in html in golang.org/x/net"
|
||||
},
|
||||
{
|
||||
"id": "GO-2026-6866",
|
||||
"module": "golang.org/x/net",
|
||||
"found": "v0.33.0",
|
||||
"fixed": "v0.62.0",
|
||||
"symbolReachable": false,
|
||||
"summary": "Check all ancestor namespace transitions when rendering raw text in html in golang.org/x/net"
|
||||
},
|
||||
{
|
||||
"id": "GO-2026-5024",
|
||||
"module": "golang.org/x/sys",
|
||||
"found": "v0.28.0",
|
||||
"fixed": "v0.44.0",
|
||||
"symbolReachable": false,
|
||||
"summary": "Invoking integer overflow in NewNTUnicodeString in golang.org/x/sys/windows"
|
||||
},
|
||||
{
|
||||
"id": "GO-2026-5970",
|
||||
"module": "golang.org/x/text",
|
||||
"found": "v0.21.0",
|
||||
"fixed": "v0.39.0",
|
||||
"symbolReachable": false,
|
||||
"summary": "Infinite loop on invalid input in golang.org/x/text"
|
||||
},
|
||||
{
|
||||
"id": "GO-2026-6629",
|
||||
"module": "golang.org/x/text",
|
||||
"found": "v0.21.0",
|
||||
"fixed": "v0.41.0",
|
||||
"symbolReachable": false,
|
||||
"summary": "Panic parsing crafted input in x/text/secure/precis in golang.org/x/text"
|
||||
}
|
||||
]
|
||||
}
|
||||
83
reports/websocket-vuln-patched-go.txt
Normal file
83
reports/websocket-vuln-patched-go.txt
Normal file
@@ -0,0 +1,83 @@
|
||||
=== Symbol Results ===
|
||||
|
||||
Vulnerability #1: GO-2026-6617
|
||||
HTTP/2 server crash due to HPACK encoder race in net/http
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-6617
|
||||
Module: golang.org/x/net
|
||||
Found in: golang.org/x/net@v0.33.0
|
||||
Fixed in: golang.org/x/net@v0.60.0
|
||||
Example traces found:
|
||||
#1: ws/errors.go:36:20: ws.HandshakeError.Error calls fmt.Sprintf, which eventually calls http2.ErrCode.String
|
||||
#2: ws/errors.go:36:20: ws.HandshakeError.Error calls fmt.Sprintf, which eventually calls http2.FrameType.String
|
||||
#3: ws/errors.go:36:20: ws.HandshakeError.Error calls fmt.Sprintf, which eventually calls http2.Setting.String
|
||||
#4: ws/errors.go:36:20: ws.HandshakeError.Error calls fmt.Sprintf, which eventually calls http2.SettingID.String
|
||||
#5: ws/server.go:320:31: ws.Server.Accept calls websocket.Upgrader.Upgrade, which eventually calls http2.bufferedWriterTimeoutWriter.Write
|
||||
#6: ws/server.go:320:31: ws.Server.Accept calls websocket.Upgrader.Upgrade, which eventually calls http2.chunkWriter.Write
|
||||
#7: ws/rpc/peer.go:234:29: rpc.Peer.Notify calls json.Marshal, which eventually calls http2.duplicatePseudoHeaderError.Error
|
||||
#8: ws/rpc/peer.go:234:29: rpc.Peer.Notify calls json.Marshal, which eventually calls http2.headerFieldNameError.Error
|
||||
#9: ws/rpc/peer.go:234:29: rpc.Peer.Notify calls json.Marshal, which eventually calls http2.headerFieldValueError.Error
|
||||
#10: ws/rpc/peer.go:234:29: rpc.Peer.Notify calls json.Marshal, which eventually calls http2.pseudoHeaderError.Error
|
||||
#11: ws/errors.go:36:20: ws.HandshakeError.Error calls fmt.Sprintf, which eventually calls http2.writeData.String
|
||||
|
||||
Vulnerability #2: GO-2026-6612
|
||||
Double flow control refund on HTTP/2 server streams in net/http
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-6612
|
||||
Module: golang.org/x/net
|
||||
Found in: golang.org/x/net@v0.33.0
|
||||
Fixed in: golang.org/x/net@v0.60.0
|
||||
Example traces found:
|
||||
#1: ws/errors.go:36:20: ws.HandshakeError.Error calls fmt.Sprintf, which eventually calls http2.ErrCode.String
|
||||
#2: ws/errors.go:36:20: ws.HandshakeError.Error calls fmt.Sprintf, which eventually calls http2.FrameType.String
|
||||
#3: ws/errors.go:36:20: ws.HandshakeError.Error calls fmt.Sprintf, which eventually calls http2.Setting.String
|
||||
#4: ws/errors.go:36:20: ws.HandshakeError.Error calls fmt.Sprintf, which eventually calls http2.SettingID.String
|
||||
#5: ws/server.go:320:31: ws.Server.Accept calls websocket.Upgrader.Upgrade, which eventually calls http2.bufferedWriterTimeoutWriter.Write
|
||||
#6: ws/server.go:320:31: ws.Server.Accept calls websocket.Upgrader.Upgrade, which eventually calls http2.chunkWriter.Write
|
||||
#7: ws/rpc/peer.go:234:29: rpc.Peer.Notify calls json.Marshal, which eventually calls http2.duplicatePseudoHeaderError.Error
|
||||
#8: ws/rpc/peer.go:234:29: rpc.Peer.Notify calls json.Marshal, which eventually calls http2.headerFieldNameError.Error
|
||||
#9: ws/rpc/peer.go:234:29: rpc.Peer.Notify calls json.Marshal, which eventually calls http2.headerFieldValueError.Error
|
||||
#10: ws/rpc/peer.go:234:29: rpc.Peer.Notify calls json.Marshal, which eventually calls http2.pseudoHeaderError.Error
|
||||
#11: ws/errors.go:36:20: ws.HandshakeError.Error calls fmt.Sprintf, which eventually calls http2.writeData.String
|
||||
|
||||
Vulnerability #3: GO-2026-6611
|
||||
Excessive CPU consumption from repeated initial window changes in net/http
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-6611
|
||||
Module: golang.org/x/net
|
||||
Found in: golang.org/x/net@v0.33.0
|
||||
Fixed in: golang.org/x/net@v0.60.0
|
||||
Example traces found:
|
||||
#1: ws/errors.go:36:20: ws.HandshakeError.Error calls fmt.Sprintf, which eventually calls http2.ErrCode.String
|
||||
#2: ws/errors.go:36:20: ws.HandshakeError.Error calls fmt.Sprintf, which eventually calls http2.FrameType.String
|
||||
#3: ws/errors.go:36:20: ws.HandshakeError.Error calls fmt.Sprintf, which eventually calls http2.Setting.String
|
||||
#4: ws/errors.go:36:20: ws.HandshakeError.Error calls fmt.Sprintf, which eventually calls http2.SettingID.String
|
||||
#5: ws/server.go:320:31: ws.Server.Accept calls websocket.Upgrader.Upgrade, which eventually calls http2.bufferedWriterTimeoutWriter.Write
|
||||
#6: ws/server.go:320:31: ws.Server.Accept calls websocket.Upgrader.Upgrade, which eventually calls http2.chunkWriter.Write
|
||||
#7: ws/rpc/peer.go:234:29: rpc.Peer.Notify calls json.Marshal, which eventually calls http2.duplicatePseudoHeaderError.Error
|
||||
#8: ws/rpc/peer.go:234:29: rpc.Peer.Notify calls json.Marshal, which eventually calls http2.headerFieldNameError.Error
|
||||
#9: ws/rpc/peer.go:234:29: rpc.Peer.Notify calls json.Marshal, which eventually calls http2.headerFieldValueError.Error
|
||||
#10: ws/rpc/peer.go:234:29: rpc.Peer.Notify calls json.Marshal, which eventually calls http2.pseudoHeaderError.Error
|
||||
#11: ws/errors.go:36:20: ws.HandshakeError.Error calls fmt.Sprintf, which eventually calls http2.writeData.String
|
||||
|
||||
Vulnerability #4: GO-2026-6603
|
||||
HTTP/2 server memory exhaustion due to Trailer headers in net/http
|
||||
More info: https://pkg.go.dev/vuln/GO-2026-6603
|
||||
Module: golang.org/x/net
|
||||
Found in: golang.org/x/net@v0.33.0
|
||||
Fixed in: golang.org/x/net@v0.60.0
|
||||
Example traces found:
|
||||
#1: ws/errors.go:36:20: ws.HandshakeError.Error calls fmt.Sprintf, which eventually calls http2.ErrCode.String
|
||||
#2: ws/errors.go:36:20: ws.HandshakeError.Error calls fmt.Sprintf, which eventually calls http2.FrameType.String
|
||||
#3: ws/errors.go:36:20: ws.HandshakeError.Error calls fmt.Sprintf, which eventually calls http2.Setting.String
|
||||
#4: ws/errors.go:36:20: ws.HandshakeError.Error calls fmt.Sprintf, which eventually calls http2.SettingID.String
|
||||
#5: ws/server.go:320:31: ws.Server.Accept calls websocket.Upgrader.Upgrade, which eventually calls http2.bufferedWriterTimeoutWriter.Write
|
||||
#6: ws/server.go:320:31: ws.Server.Accept calls websocket.Upgrader.Upgrade, which eventually calls http2.chunkWriter.Write
|
||||
#7: ws/rpc/peer.go:234:29: rpc.Peer.Notify calls json.Marshal, which eventually calls http2.duplicatePseudoHeaderError.Error
|
||||
#8: ws/rpc/peer.go:234:29: rpc.Peer.Notify calls json.Marshal, which eventually calls http2.headerFieldNameError.Error
|
||||
#9: ws/rpc/peer.go:234:29: rpc.Peer.Notify calls json.Marshal, which eventually calls http2.headerFieldValueError.Error
|
||||
#10: ws/rpc/peer.go:234:29: rpc.Peer.Notify calls json.Marshal, which eventually calls http2.pseudoHeaderError.Error
|
||||
#11: ws/errors.go:36:20: ws.HandshakeError.Error calls fmt.Sprintf, which eventually calls http2.writeData.String
|
||||
|
||||
Your code is affected by 4 vulnerabilities from 1 module.
|
||||
This scan also found 14 vulnerabilities in packages you import and 25
|
||||
vulnerabilities in modules you require, but your code doesn't appear to call
|
||||
these vulnerabilities.
|
||||
Use '-show verbose' for more details.
|
||||
Reference in New Issue
Block a user