Please report vulnerabilities by opening a GitHub issue.
Vulnerabilities are tracked with govulncheck via scripts/govulncheck.sh. The wrapper filters out excluded findings with documented tracking issues.
The following vulnerabilities are in transitive dependencies with no upstream fix available and are excluded from CI checks:
| ID | CVE | Package | Reason |
|---|---|---|---|
| GO-2026-4887 | CVE-2026-34040 | github.com/docker/docker |
Test dependency; no fix released. Tracked: #72 |
| GO-2026-4883 | CVE-2026-33997 | github.com/docker/docker |
Test dependency; no fix released. Tracked: #72 |
| GO-2026-5746 | CVE-2026-41567 | github.com/docker/docker |
Test dependency; no fix released. Tracked: #72 |
| GO-2026-5668 | CVE-2026-41568 | github.com/docker/docker |
Test dependency; no fix released. Tracked: #72 |
| GO-2026-5617 | CVE-2026-42306 | github.com/docker/docker |
Test dependency; no fix released. Tracked: #72 |
docker/docker is a transitive dependency for testcontainers-go. Only used in integration tests.
Stdlib vulnerabilities are fixed by upgrading the Go toolchain. This module requires go 1.26 as a minimum language version. Build with go 1.26.3 or later to include fixes for:
| ID | Package | Description |
|---|---|---|
| GO-2026-4918 | net/http |
HTTP/2 SETTINGS infinite loop (CVE-2026-33814) |
| GO-2026-4971 | net |
(see Go 1.26.3 release notes) |
| GO-2026-4977 | net/mail |
Quadratic string concatenation in consumePhrase |
| GO-2026-4986 | net/mail |
Quadratic string concatenation in consumeComment |
| GO-2026-4980 | html/template |
Escaper bypass leading to XSS |
| GO-2026-4982 | html/template |
Meta content URL escaping bypass leading to XSS |
These affect the Go toolchain itself, not this module's dependencies.