Repository navigation
ARI: Upgrade golang.org/x/net to v0.62.0 to fix 10 HIGH-severity CVEs - #1001
Merged
maoyuwang merged 1 commit intoNov 11, 2026
Merged
Conversation
Raised golang.org/x/net from v0.41.0 to v0.62.0 in ruckus-agent/go.mod and from v0.38.0 to v0.62.0 in tarana-gnmic-agent/go.mod. Both pinned versions were affected by five HIGH-severity CVEs: CVE-2026-25681 (idna incorrect Punycode processing, fixed in v0.55.0), CVE-2026-33814 (http2 DoS via malformed SETTINGS_MAX_FRAME_SIZE, fixed in v0.53.0), CVE-2026-46600 (dns/dnsmessage DoS via invalid DNS record, fixed in v0.56.0), CVE-2026-78661 (html DoS via crafted HTML input, fixed in v0.62.0), and CVE-2026-78669 (http2 DoS via excessive SETTINGS frames, fixed in v0.60.0). v0.62.0 was selected as the minimum version that closes all five CVEs. A comment identifying all five CVE IDs, the previously vulnerable version, and the rationale for v0.62.0 was added above each updated require line. go mod tidy was run in both module directories to regenerate go.sum; the go directive in both modules was updated to 1.26.0 as required by the new dependency. go build ./... and go test ./... pass in both modules with no failures.
maoyuwang
approved these changes
Nov 11, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Raised golang.org/x/net from v0.41.0 to v0.62.0 in ruckus-agent/go.mod and from v0.38.0 to v0.62.0 in tarana-gnmic-agent/go.mod. Both pinned versions were affected by five HIGH-severity CVEs: CVE-2026-25681 (idna incorrect Punycode processing, fixed in v0.55.0), CVE-2026-33814 (http2 DoS via malformed SETTINGS_MAX_FRAME_SIZE, fixed in v0.53.0), CVE-2026-46600 (dns/dnsmessage DoS via invalid DNS record, fixed in v0.56.0), CVE-2026-78661 (html DoS via crafted HTML input, fixed in v0.62.0), and CVE-2026-78669 (http2 DoS via excessive SETTINGS frames, fixed in v0.60.0). v0.62.0 was selected as the minimum version that closes all five CVEs. A comment identifying all five CVE IDs, the previously vulnerable version, and the rationale for v0.62.0 was added above each updated require line. go mod tidy was run in both module directories to regenerate go.sum; the go directive in both modules was updated to 1.26.0 as required by the new dependency. go build ./... and go test ./... pass in both modules with no failures.
InsightFinder incident: View incident and ARI report