Fix CVE-2026-39821 and other advisories for v0.49.1 - #3210
Open
metalmatze wants to merge 2 commits into
Open
Conversation
Google Cloud Marketplace flagged our published images for CVE-2026-39821 (GO-2026-5026), a Punycode validation flaw in golang.org/x/net/idna where ToASCII/ToUnicode accept an encoded label that decodes to an ASCII-only one, letting it slip past a hostname privilege check. The x/net module was already on v0.56.0, which carries the fix, so this looked like a false positive at first. It isn't: idna is also vendored into the standard library, and v0.49.0 was built with go1.25.11. govulncheck on the published binary still reports GO-2026-5026 reachable through net/http. The stdlib fix landed in go1.25.13, so raise the go directive to require it -- CI resolves go-version '~1.25' to the latest patch anyway, but nothing was stopping an older toolchain from producing a vulnerable build. That clears seven further stdlib advisories that came along for the ride. containerd v1.7.33 is a patch bump and clears two more. Deliberately left alone: cilium/ebpf, grpc and prometheus all need minor-version jumps into core profiling paths, which is not what a security patch release is for. govulncheck on the resulting binary: 21 findings down to 11, none of them in the standard library, and GO-2026-5026 gone.
Google Cloud Marketplace flagged our published images for CVE-2026-39821, with a resubmit deadline of 2026-09-11. This looks like a false positive at first, since `x/net` is already on v0.56.0 which carries the fix, but `idna` is also vendored into the standard library and v0.49.0 was built with go1.25.11. govulncheck on the published binary still reports it reachable through `net/http`. The stdlib fix is in go1.25.13, so the `go` directive now requires it. Kept deliberately small for a patch release. containerd is a patch bump and clears two more advisories, however cilium/ebpf, grpc and prometheus would all need minor version jumps into core profiling paths, so those stay for a regular release. govulncheck goes from 21 findings to 11, with nothing left in the standard library.
brancz
approved these changes
Sep 8, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Google Cloud Marketplace flagged our published images for CVE-2026-39821
(GO-2026-5026), a Punycode validation flaw in golang.org/x/net/idna
where ToASCII/ToUnicode accept an encoded label that decodes to an
ASCII-only one, letting it slip past a hostname privilege check.
The x/net module was already on v0.56.0, which carries the fix, so this
looked like a false positive at first. It isn't: idna is also vendored
into the standard library, and v0.49.0 was built with go1.25.11.
govulncheck on the published binary still reports GO-2026-5026 reachable
through net/http. The stdlib fix landed in go1.25.13, so raise the go
directive to require it -- CI resolves go-version '~1.25' to the latest
patch anyway, but nothing was stopping an older toolchain from producing
a vulnerable build.
That clears seven further stdlib advisories that came along for the
ride. containerd v1.7.33 is a patch bump and clears two more. Deliberately
left alone: cilium/ebpf, grpc and prometheus all need minor-version jumps
into core profiling paths, which is not what a security patch release is
for.
govulncheck on the resulting binary: 21 findings down to 11, none of them
in the standard library, and GO-2026-5026 gone.