Skip to content

Bump Go to 1.26.2 to fix critical security vulnerabilities#4491

Open
dhawalseth wants to merge 1 commit intoactions:masterfrom
dhawalseth:bump-go-1.26.2-security-fix
Open

Bump Go to 1.26.2 to fix critical security vulnerabilities#4491
dhawalseth wants to merge 1 commit intoactions:masterfrom
dhawalseth:bump-go-1.26.2-security-fix

Conversation

@dhawalseth
Copy link
Copy Markdown
Contributor

Summary

  • Bumps Go version from 1.26.1 to 1.26.2 in Dockerfile and go.mod
  • Addresses critical and high severity CVEs found in container image scanning

CVEs Addressed

CVE Severity CVSS
CVE-2026-27143 Critical 9.8
CVE-2026-27140 High 8.8
CVE-2026-33810 High 8.2
CVE-2026-32280 High 7.5
CVE-2026-32281 High 7.5
CVE-2026-32283 High 7.5
CVE-2026-27144 High 7.1

Test plan

  • CI passes
  • Container image builds successfully
  • Image scan shows no Go-related CVEs

🤖 Generated with Claude Code

Addresses CVEs found in container image scanning:
- CVE-2026-27143 (Critical, CVSS 9.8)
- CVE-2026-27140 (High, CVSS 8.8)
- CVE-2026-33810 (High, CVSS 8.2)
- CVE-2026-32280 (High, CVSS 7.5)
- CVE-2026-32281 (High, CVSS 7.5)
- CVE-2026-32283 (High, CVSS 7.5)
- CVE-2026-27144 (High, CVSS 7.1)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
@nikola-jokic
Copy link
Copy Markdown
Collaborator

Hey @dhawalseth,

We tend to wait before the release to bump Go in order to have the latest version.

@dhawalseth
Copy link
Copy Markdown
Contributor Author

@nikola-jokic is it possible to publish a patch since it contains a critical 9.8 CVE

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants