chore(deps): fix vulnerabilities reported by govulncheck

[github-actions]

Vulnerability Report

stdlib → v1.25.11

GO-2025-3955 (CVE-2025-47910, CVE-2025-47910)

CrossOriginProtection insecure bypass patterns not limited to exact matches in net/http

References

• https://go.dev/cl/699275
• https://go.dev/issue/75054
• https://groups.google.com/g/golang-announce/c/PtW9VW21NPs/m/DJhMQ-m5AQAJ

GO-2025-4006 (CVE-2025-61725, CVE-2025-61725)

Excessive CPU consumption in ParseAddress in net/mail

References

• https://go.dev/cl/709860
• https://go.dev/issue/75680
• https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI

GO-2025-4007 (CVE-2025-58187, CVE-2025-58187)

Quadratic complexity when checking name constraints in crypto/x509

References

• https://go.dev/issue/75681
• https://go.dev/cl/709854
• https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI

GO-2025-4008 (CVE-2025-58189, CVE-2025-58189)

ALPN negotiation error contains attacker controlled information in crypto/tls

References

• https://go.dev/cl/707776
• https://go.dev/issue/75652
• https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI

GO-2025-4009 (CVE-2025-61723, CVE-2025-61723)

Quadratic complexity when parsing some invalid inputs in encoding/pem

References

• https://go.dev/issue/75676
• https://go.dev/cl/709858
• https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI

GO-2025-4010 (CVE-2025-47912, CVE-2025-47912)

Insufficient validation of bracketed IPv6 hostnames in net/url

References

• https://go.dev/issue/75678
• https://go.dev/cl/709857
• https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI

GO-2025-4011 (CVE-2025-58185, CVE-2025-58185)

Parsing DER payload can cause memory exhaustion in encoding/asn1

References

• https://go.dev/issue/75671
• https://go.dev/cl/709856
• https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI

GO-2025-4012 (CVE-2025-58186, CVE-2025-58186)

Lack of limit when parsing cookies can cause memory exhaustion in net/http

References

• https://go.dev/issue/75672
• https://go.dev/cl/709855
• https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI

GO-2025-4013 (CVE-2025-58188, CVE-2025-58188)

Panic when validating certificates with DSA public keys in crypto/x509

References

• https://go.dev/cl/709853
• https://go.dev/issue/75675
• https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI

GO-2025-4014 (CVE-2025-58183, CVE-2025-58183)

Unbounded allocation when parsing GNU sparse map in archive/tar

References

• https://go.dev/cl/709861
• https://go.dev/issue/75677
• https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI

GO-2025-4015 (CVE-2025-61724, CVE-2025-61724)

Excessive CPU consumption in Reader.ReadResponse in net/textproto

References

• https://go.dev/cl/709859
• https://go.dev/issue/75716
• https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI

GO-2025-4155 (CVE-2025-61729, CVE-2025-61729)

Excessive resource consumption when printing error string for host certificate validation in crypto/x509

References

• https://go.dev/cl/725920
• https://go.dev/issue/76445
• https://groups.google.com/g/golang-announce/c/8FJoBkPddm4

GO-2025-4175 (CVE-2025-61727)

Improper application of excluded DNS name constraints when verifying wildcard names in crypto/x509

References

• https://go.dev/cl/723900
• https://go.dev/issue/76442
• https://groups.google.com/g/golang-announce/c/8FJoBkPddm4

GO-2026-4337 (CVE-2025-68121)

Unexpected session resumption in crypto/tls

References

• https://groups.google.com/g/golang-announce/c/K09ubi9FQFk
• https://go.dev/cl/737700
• https://go.dev/issue/77217

GO-2026-4340 (CVE-2025-61730, CVE-2025-61730)

Handshake messages may be processed at the incorrect encryption level in crypto/tls

References

• https://go.dev/cl/724120
• https://go.dev/issue/76443
• https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc

GO-2026-4341 (CVE-2025-61726, CVE-2025-61726)

Memory exhaustion in query parameter parsing in net/url

References

• https://go.dev/cl/736712
• https://go.dev/issue/77101
• https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc

GO-2026-4342 (CVE-2025-61728, CVE-2025-61728)

Excessive CPU consumption when building archive index in archive/zip

References

• https://go.dev/cl/736713
• https://go.dev/issue/77102
• https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc

GO-2026-4601 (CVE-2026-25679)

Incorrect parsing of IPv6 host literals in net/url

References

• https://go.dev/cl/752180
• https://go.dev/issue/77578
• https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk

GO-2026-4602 (CVE-2026-27139)

FileInfo can escape from a Root in os

References

• https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk
• https://go.dev/issue/77827
• https://go.dev/cl/749480

GO-2026-4603 (CVE-2026-27142)

URLs in meta content attribute actions are not escaped in html/template

References

• https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk
• https://go.dev/issue/77954
• https://go.dev/cl/752081

GO-2026-4864 (CVE-2026-32282)

TOCTOU permits root escape on Linux via Root.Chmod in os in internal/syscall/unix

References

• https://go.dev/cl/763761
• https://go.dev/issue/78293
• https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU

GO-2026-4865 (CVE-2026-32289)

JsBraceDepth Context Tracking Bugs (XSS) in html/template

References

• https://go.dev/cl/763762
• https://go.dev/issue/78331
• https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU

GO-2026-4869 (CVE-2026-32288)

Unbounded allocation for old GNU sparse in archive/tar

References

• https://go.dev/cl/763766
• https://go.dev/issue/78301
• https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU

GO-2026-4870 (CVE-2026-32283)

Unauthenticated TLS 1.3 KeyUpdate record can cause persistent connection retention and DoS in crypto/tls

References

• https://go.dev/cl/763767
• https://go.dev/issue/78334
• https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU

GO-2026-4918 (CVE-2026-33814)

Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net

References

• https://go.dev/cl/761581
• https://go.dev/cl/761640
• https://go.dev/issue/78476
• https://groups.google.com/g/golang-announce/c/qcCIEXso47M

GO-2026-4946 (CVE-2026-32281)

Inefficient policy validation in crypto/x509

References

• https://go.dev/cl/758061
• https://go.dev/issue/78281
• https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU

GO-2026-4947 (CVE-2026-32280)

Unexpected work during chain building in crypto/x509

References

• https://go.dev/cl/758320
• https://go.dev/issue/78282
• https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU

GO-2026-4971 (CVE-2026-39836)

Panic in Dial and LookupPort when handling NUL byte on Windows in net

References

• https://go.dev/issue/79006
• https://groups.google.com/g/golang-announce/c/qcCIEXso47M
• https://go.dev/cl/775320

GO-2026-4976 (CVE-2026-39825)

ReverseProxy forwards queries with more than urlmaxqueryparams parameters in net/http/httputil

References

• https://go.dev/cl/770541
• https://go.dev/issue/78948
• https://groups.google.com/g/golang-announce/c/qcCIEXso47M

GO-2026-4977 (CVE-2026-42499)

Quadratic string concatenation in consumePhrase in net/mail

References

• https://go.dev/issue/78987
• https://go.dev/cl/771520
• https://groups.google.com/g/golang-announce/c/qcCIEXso47M

GO-2026-4980 (CVE-2026-39826)

Escaper bypass leads to XSS in html/template

References

• https://go.dev/issue/78981
• https://go.dev/cl/771180
• https://groups.google.com/g/golang-announce/c/qcCIEXso47M

GO-2026-4981 (CVE-2026-33811)

Crash when handling long CNAME response in net

References

• https://go.dev/issue/78803
• https://go.dev/cl/767860
• https://groups.google.com/g/golang-announce/c/qcCIEXso47M

GO-2026-4982 (CVE-2026-39823)

Bypass of meta content URL escaping causes XSS in html/template

References

• https://go.dev/issue/78913
• https://go.dev/cl/769920
• https://groups.google.com/g/golang-announce/c/qcCIEXso47M

GO-2026-4986 (CVE-2026-39820)

Quadratic string concatentation in consumeComment in net/mail

References

• https://go.dev/issue/78566
• https://go.dev/cl/759940
• https://groups.google.com/g/golang-announce/c/qcCIEXso47M

GO-2026-5037 (CVE-2026-27145)

Inefficient candidate hostname parsing in crypto/x509

References

• https://go.dev/cl/783621
• https://go.dev/issue/79694
• https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw

GO-2026-5038 (CVE-2026-42504)

Quadratic complexity in WordDecoder.DecodeHeader in mime

References

• https://go.dev/issue/79217
• https://go.dev/cl/774481
• https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw

GO-2026-5039 (CVE-2026-42507)

Arbitrary inputs are included in errors without any escaping in net/textproto

References

• https://go.dev/issue/79346
• https://go.dev/cl/777060
• https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw