fix(security): [Aikido] [SEC-339, SEC-611] Fix 40 security issues in x/net, x/crypto, vektah/gqlparser/v2

[aikido-autofix]

Upgrade dependencies to fix critical security vulnerabilities: IDNA privilege escalation, SSH resource exhaustion, FIDO/U2F missing presence verification, and SSH integer overflow DoS.

✅ 40 CVEs resolved by this upgrade, including 4 critical 🚨 CVEs

This PR will resolve the following CVEs:

Issue	Severity	Description
CVE-2026-39821	🚨 CRITICAL	[golang.org/x/net] Punycode validation bypass in idna functions allows ASCII-only labels to be incorrectly accepted, enabling privilege escalation when hostname validation is bypassed through encoded domain names. An attacker could exploit inconsistent validation between encoded and decoded hostnames to circumvent access controls.
CVE-2023-39325	HIGH	[golang.org/x/net] A malicious HTTP/2 client can cause excessive server resource consumption by rapidly creating and resetting requests, bypassing concurrency limits. The fix bounds executing handler goroutines to the stream concurrency limit and queues excess requests, terminating connections if the queue grows too large.
CVE-2023-45288	HIGH	[golang.org/x/net] An attacker can send excessive CONTINUATION frames to force an HTTP/2 endpoint to read and parse arbitrary amounts of header data, causing high CPU consumption through expensive Huffman decoding operations. This results in a denial-of-service vulnerability where rejected requests still consume significant server resources.
CVE-2022-41721	HIGH	[golang.org/x/net] MaxBytesHandler fails to fully consume HTTP request bodies, allowing attackers to inject arbitrary HTTP/2 frames that are interpreted as legitimate requests. This enables request smuggling attacks and potential remote code execution.
CVE-2022-41723	HIGH	[golang.org/x/net] A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of service from a small number of small requests.
CVE-2026-33814	HIGH	[golang.org/x/net] When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.
CVE-2025-22872	MEDIUM	[golang.org/x/net] The tokenizer incorrectly interprets tags with unquoted attribute values ending in "/" as self-closing, causing misplacement of subsequent content in the DOM tree when processing foreign content elements like and . This can lead to incorrect HTML parsing and potential information disclosure or bypass of security controls.
CVE-2023-3978	MEDIUM	[golang.org/x/net] Text nodes not in the HTML namespace are incorrectly literally rendered, causing text which should be escaped to not be. This could lead to an XSS attack.
CVE-2026-42506	MEDIUM	[golang.org/x/net] Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.
CVE-2022-41717	MEDIUM	[golang.org/x/net] An attacker can exploit HTTP/2 header caching to cause excessive memory allocation, approximately 64 MiB per connection. This leads to denial of service through memory exhaustion on affected servers.
CVE-2026-25681	MEDIUM	[golang.org/x/net] Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.
CVE-2026-27136	MEDIUM	[golang.org/x/net] Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.
CVE-2026-42502	MEDIUM	[golang.org/x/net] Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.
CVE-2025-47911	MEDIUM	[golang.org/x/net] The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when processing certain inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content.
CVE-2025-58190	MEDIUM	[golang.org/x/net] The html.Parse function in golang.org/x/net/html has an infinite parsing loop when processing certain inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content.
CVE-2025-22870	MEDIUM	[golang.org/x/net] Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component. For example, when the NO_PROXY environment variable is set to "*.example.com", a request to "[::1%25.example.com]:80` will incorrectly match and not be proxied.
CVE-2024-45338	LOW	[golang.org/x/net] An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service.
CVE-2026-25680	LOW	[golang.org/x/net] Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service.
CVE-2026-39830	🚨 CRITICAL	[golang.org/x/crypto] A malicious SSH peer can send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop and causing a resource leak that cannot be released by Close(). This results in a denial of service through goroutine exhaustion.
CVE-2026-39831	🚨 CRITICAL	[golang.org/x/crypto] The Verify() method for FIDO/U2F security keys fails to check the User Presence flag, allowing signatures generated without physical touch to be accepted. This enables unauthorized unattended use of hardware security keys, bypassing intended physical authentication requirements.
CVE-2026-39834	🚨 CRITICAL	[golang.org/x/crypto] An integer overflow in SSH channel write operations causes an infinite loop when writing data larger than 4GB in a single call, resulting in denial of service through empty packet transmission. The vulnerability has been fixed by using int64 for size comparisons to prevent truncation.
CVE-2026-39828	HIGH	[golang.org/x/crypto] An SSH server authentication callback that returns PartialSuccessError with non-nil Permissions silently discards those permissions, potentially bypassing certificate restrictions like force-command after second factor authentication succeeds. This vulnerability allows attackers to bypass security restrictions.
CVE-2026-39832	HIGH	[golang.org/x/crypto] SSH agent key constraint extensions were not serialized when adding keys to remote agents, allowing destination restrictions to be silently stripped and keys to be used without restrictions on remote hosts. The vulnerability has been fixed by serializing all constraint extensions and rejecting keys with unsupported constraints.
CVE-2024-45337	HIGH	[golang.org/x/crypto] A misuse of SSH public key authentication callbacks can lead to authorization bypass when applications incorrectly assume which key was used for authentication. The mitigation enforces that the last key passed to PublicKeyCallback is the one used for successful authentication, preventing attackers from authenticating with one key while the application makes decisions based on another.
CVE-2022-27191	HIGH	[golang.org/x/crypto] The golang.org/x/crypto/ssh package before 0.0.0-20220314234659-1baeb1ce4c0b for Go allows an attacker to crash a server in certain circumstances involving AddHostKey.
CVE-2025-22869	HIGH	[golang.org/x/crypto] SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted.
CVE-2025-47913	HIGH	[golang.org/x/crypto] SSH clients receiving SSH_AGENT_SUCCESS when expecting a typed response will panic and cause early termination of the client process.
CVE-2026-39829	HIGH	[golang.org/x/crypto] RSA and DSA public key parsers lack size limits, allowing crafted keys with excessively large parameters to consume CPU for minutes during signature verification. This enables unauthenticated denial-of-service attacks during public key authentication.
CVE-2026-39835	HIGH	[golang.org/x/crypto] SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate. CertChecker now returns an error instead of panicking when these callbacks are nil.
CVE-2026-46597	HIGH	[golang.org/x/crypto] An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs.
CVE-2022-30636	HIGH	[golang.org/x/crypto] A path traversal vulnerability in HTTP-01 token validation allows attackers to read arbitrary files with a "+http-01" suffix on Windows systems by exploiting differences between path.Base and filepath.Base functions. The vulnerability has limited impact due to the required file suffix constraint.
CVE-2026-42508	HIGH	[golang.org/x/crypto] Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation. Now, both the 'key' and 'key.SignatureKey' are checked for @Revoked.
CVE-2026-46595	HIGH	[golang.org/x/crypto] Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation would be skipped.
CVE-2026-39827	MEDIUM	[golang.org/x/crypto] An authenticated SSH client can cause unbounded memory growth by repeatedly opening rejected channels, leading to server crashes and denial of service for all connected users. The vulnerability has been fixed by properly removing rejected channels from internal state.
CVE-2023-48795	MEDIUM	[golang.org/x/crypto] A vulnerability in SSH transport protocol extensions allows remote attackers to bypass integrity checks and omit packets during handshake, potentially downgrading security features like ChaCha20-Poly1305 encryption. This Terrapin attack exploits sequence number mishandling to disable or weaken SSH security protections.
CVE-2026-39833	MEDIUM	[golang.org/x/crypto] A keyring implementation silently ignored the ConfirmBeforeUse constraint on keys, allowing unauthorized signing without prompts or caller notification. This has been fixed to return an error when unsupported constraints are requested.
CVE-2025-47914	MEDIUM	[golang.org/x/crypto] SSH Agent servers do not validate the size of messages when processing new identity requests, which may cause the program to panic if the message is malformed due to an out of bounds read.
CVE-2025-58181	MEDIUM	[golang.org/x/crypto] SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption.
CVE-2026-46598	MEDIUM	[golang.org/x/crypto] For certain crafted inputs, a 'ed25519.PrivateKey' was created by casting malformed wire bytes, leading to a panic when used.
CVE-2023-49559	MEDIUM	[github.com/vektah/gqlparser/v2] An issue in vektah gqlparser open-source-library v.2.5.10 allows a remote attacker to cause a denial of service via a crafted script to the parserDirectives function.

🔗 Related Tasks

• https://linear.app/honestbank/issue/SEC-339/major-upgrade-for-golangorgxcrypto
• https://linear.app/honestbank/issue/SEC-611/minor-upgrade-for-golangorgxnet

[ChristianWitts]

Approving Aikido security autofix — CI is green. Owning team: please give this a final review and merge.