[Aikido] Fix 16 security issues in x/crypto, x/net, vektah/gqlparser/v2

[aikido-autofix]

Upgrade crypto, net, and gqlparser to fix SSH authorization bypass, SSH DoS, HTTP/2 resource exhaustion, and request smuggling vulnerabilities.

✅ 16 CVEs resolved by this upgrade, including 1 critical 🚨 CVE

This PR will resolve the following CVEs:

Issue	Severity	Description
CVE-2024-45337	🚨 CRITICAL	[golang.org/x/crypto] A misuse of SSH public key authentication callbacks can lead to authorization bypass when applications incorrectly assume which key was used for authentication. The mitigation enforces that the last key passed to PublicKeyCallback is the one used for successful authentication, preventing attackers from authenticating with one key while the application makes decisions based on another.
CVE-2022-27191	HIGH	[golang.org/x/crypto] The golang.org/x/crypto/ssh package before 0.0.0-20220314234659-1baeb1ce4c0b for Go allows an attacker to crash a server in certain circumstances involving AddHostKey.
CVE-2025-22869	HIGH	[golang.org/x/crypto] SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted.
CVE-2023-48795	MEDIUM	[golang.org/x/crypto] A vulnerability in SSH transport protocol extensions allows remote attackers to bypass integrity checks and omit packets during handshake, potentially downgrading security features like ChaCha20-Poly1305 encryption. This Terrapin attack exploits sequence number mishandling to disable or weaken SSH security protections.
CVE-2025-47914	MEDIUM	[golang.org/x/crypto] SSH Agent servers do not validate the size of messages when processing new identity requests, which may cause the program to panic if the message is malformed due to an out of bounds read.
CVE-2025-58181	MEDIUM	[golang.org/x/crypto] SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption.
CVE-2023-39325	HIGH	[golang.org/x/net] A malicious HTTP/2 client can cause excessive server resource consumption by rapidly creating and resetting requests, bypassing concurrency limits. The fix bounds executing handler goroutines to the stream concurrency limit and queues excess requests, terminating connections if the queue grows too large.
CVE-2022-41721	HIGH	[golang.org/x/net] MaxBytesHandler fails to fully consume HTTP request bodies, allowing attackers to inject arbitrary HTTP/2 frames that are interpreted as legitimate requests. This enables request smuggling attacks and potential remote code execution.
CVE-2022-41723	HIGH	[golang.org/x/net] A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of service from a small number of small requests.
CVE-2023-3978	MEDIUM	[golang.org/x/net] Text nodes not in the HTML namespace are incorrectly literally rendered, causing text which should be escaped to not be. This could lead to an XSS attack.
CVE-2022-41717	MEDIUM	[golang.org/x/net] An attacker can exploit HTTP/2 header caching to cause excessive memory allocation, approximately 64 MiB per connection. This leads to denial of service through memory exhaustion on affected servers.
CVE-2023-45288	MEDIUM	[golang.org/x/net] An attacker can send excessive CONTINUATION frames to force an HTTP/2 endpoint to read and parse arbitrary amounts of header data, causing high CPU consumption through expensive Huffman decoding operations. This results in a denial-of-service vulnerability where rejected requests still consume significant server resources.
CVE-2025-22872	MEDIUM	[golang.org/x/net] The tokenizer incorrectly interprets tags with unquoted attribute values ending in "/" as self-closing, causing misplacement of subsequent content in the DOM tree when processing foreign content elements like and . This can lead to incorrect HTML parsing and potential information disclosure or bypass of security controls.
CVE-2023-44487	MEDIUM	[golang.org/x/net] The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
CVE-2025-22870	MEDIUM	[golang.org/x/net] Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component. For example, when the NO_PROXY environment variable is set to "*.example.com", a request to "[::1%25.example.com]:80` will incorrectly match and not be proxied.
CVE-2023-49559	MEDIUM	[github.com/vektah/gqlparser/v2] An issue in vektah gqlparser open-source-library v.2.5.10 allows a remote attacker to cause a denial of service via a crafted script to the parserDirectives function.

🔗 Related Tasks

• https://linear.app/honestbank/issue/SEC-339/major-upgrade-for-golangorgxcrypto
• https://linear.app/honestbank/issue/SEC-611/minor-upgrade-for-golangorgxnet

[aikido-autofix]

Closed by Aikido: a new AutoFix has been created → #51