[gh-worker-campaigns-3e9aa4]

Summary: Critical-severity security update — 11 packages upgraded (MINOR changes included)

Manifests changed:

• go.mod (go)

---

✅ Action Required: Please review the changes below. If they look good, approve and merge this PR.

---

Updates

Package	From	To	Type	Dep Type	Vulnerabilities Fixed
golang.org/x/crypto	v0.25.0	v0.58.0	minor	Transitive	8 CRITICAL, 6 HIGH, 6 MEDIUM, 1 UNKNOWN
google.golang.org/grpc	v1.65.0	v1.85.0	minor	Transitive	1 CRITICAL, 3 HIGH, 1 MEDIUM
golang.org/x/net	v0.27.0	v0.62.0	minor	Transitive	1 CRITICAL, 2 HIGH, 8 MEDIUM, 9 UNKNOWN
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream	v1.6.3	v1.7.25	minor	Transitive	1 HIGH
github.com/aws/aws-sdk-go-v2/service/lambda	v1.56.1	v1.113.4	minor	Transitive	1 HIGH
github.com/aws/aws-sdk-go-v2/service/s3	v1.58.0	v1.114.6	minor	Transitive	1 HIGH
github.com/sirupsen/logrus	v1.4.1	v1.10.2	minor	Direct	1 HIGH
golang.org/x/oauth2	v0.21.0	v0.37.0	minor	Transitive	1 HIGH
github.com/golang-jwt/jwt/v5	v5.2.1	v5.2.3	patch	Transitive	1 HIGH
golang.org/x/sys	v0.22.0	v0.49.0	minor	Transitive	1 UNKNOWN
golang.org/x/text	v0.16.0	v0.43.0	minor	Transitive	2 UNKNOWN

---

Security Details

🚨 Critical & High Severity (27 fixed)

Package	CVE	Severity	Summary	Unsafe Version	Fixed In	Case
golang.org/x/crypto	CVE-2024-45337	CRITICAL	Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto	v0.25.0	0.31.0	-
golang.org/x/crypto	CVE-2026-39830	CRITICAL	Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh	v0.25.0	0.52.0	-
golang.org/x/crypto	CVE-2026-39831	CRITICAL	golang.org/x/crypto: FIDO/U2F security key physical presence check can be bypassed	v0.25.0	0.52.0	-
golang.org/x/crypto	CVE-2026-39832	CRITICAL	golang.org/x/crypto doesn't drop invoking agent constraints when forwarding keys	v0.25.0	0.52.0	-
golang.org/x/crypto	CVE-2026-39833	CRITICAL	Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent	v0.25.0	0.52.0	-
golang.org/x/crypto	CVE-2026-39834	CRITICAL	golang.org/x/crypto vulnerable to infinite loop on large channel writes	v0.25.0	0.52.0	-
golang.org/x/crypto	CVE-2026-42508	CRITICAL	Invoking auth bypass via unenforced @Revoked status in golang.org/x/crypto/ssh/knownhosts	v0.25.0	0.52.0	-
golang.org/x/crypto	CVE-2026-46595	CRITICAL	Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh	v0.25.0	0.52.0	-
golang.org/x/net	CVE-2026-39821	CRITICAL	Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna	v0.27.0	0.55.0	-
google.golang.org/grpc	CVE-2026-33186	CRITICAL	gRPC-Go has an authorization bypass via missing leading slash in :path	v1.65.0	1.79.3	-
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream	CVE-2026-89090	HIGH	DoS due to Panic in AWS SDK for Go v2 SDK EventStream Decoder in github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream	v1.6.3	1.7.8	-
github.com/aws/aws-sdk-go-v2/service/lambda	CVE-2026-89090	HIGH	DoS due to Panic in AWS SDK for Go v2 SDK EventStream Decoder in github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream	v1.56.1	1.88.5	-
github.com/aws/aws-sdk-go-v2/service/s3	CVE-2026-89090	HIGH	DoS due to Panic in AWS SDK for Go v2 SDK EventStream Decoder in github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream	v1.58.0	1.97.3	-
github.com/golang-jwt/jwt/v5	CVE-2025-30204	HIGH	jwt-go allows excessive memory allocation during header parsing	v5.2.1	5.2.2	-
github.com/sirupsen/logrus	CVE-2025-65637	HIGH	Logrus is vulnerable to DoS when using Entry.Writer()	v1.4.1	1.8.3	-
golang.org/x/crypto	CVE-2025-22869	HIGH	golang.org/x/crypto Vulnerable to Denial of Service (DoS) via Slow or Incomplete Key Exchange	v0.25.0	0.35.0	-
golang.org/x/crypto	CVE-2025-47913	HIGH	Potential denial of service in golang.org/x/crypto/ssh/agent	v0.25.0	0.43.0	-
golang.org/x/crypto	CVE-2026-39829	HIGH	golang.org/x/crypto: Invoking pathological RSA/DSA parameters may cause DoS	v0.25.0	0.52.0	-
golang.org/x/crypto	CVE-2026-46597	HIGH	Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh	v0.25.0	0.52.0	-
golang.org/x/crypto	CVE-2026-56855	HIGH	Prevent DoS on deadlocked established channel in golang.org/x/crypto/ssh	v0.25.0	0.56.0	-
golang.org/x/crypto	CVE-2026-78662	HIGH	Prevent DoS on deadlocked undecided channel in golang.org/x/crypto/ssh	v0.25.0	0.56.0	-
golang.org/x/net	CVE-2024-45338	HIGH	Non-linear parsing of case-insensitive content in golang.org/x/net/html	v0.27.0	0.33.0	-
golang.org/x/net	CVE-2026-33814	HIGH	Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net	v0.27.0	0.53.0	-
golang.org/x/oauth2	CVE-2025-22868	HIGH	Unexpected memory consumption during token parsing in golang.org/x/oauth2	v0.21.0	0.27.0	-
google.golang.org/grpc	CVE-2026-84304	HIGH	gRPC-Go: Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation	v1.65.0	1.83.1	-
google.golang.org/grpc	CVE-2026-84445	HIGH	gRPC-Go xDS servers: Denial of Service (DoS) via crash due to missing :authority and Host headers	v1.65.0	1.82.2	-
google.golang.org/grpc	GHSA-hrxh-6v49-42gf	HIGH	gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities	v1.65.0	1.82.1	-

ℹ️ Other Vulnerabilities (28)

Package	CVE	Severity	Summary	Unsafe Version	Fixed In	Case
golang.org/x/crypto	CVE-2025-47914	MEDIUM	golang.org/x/crypto/ssh/agent vulnerable to panic if message is malformed due to out of bounds read	v0.25.0	0.45.0	-
golang.org/x/crypto	CVE-2025-58181	MEDIUM	Unbounded memory consumption in golang.org/x/crypto/ssh	v0.25.0	0.45.0	-
golang.org/x/crypto	CVE-2026-39827	MEDIUM	golang.org/x/crypto: Invoking memory leak when rejecting channels can lead to DoS	v0.25.0	0.52.0	-
golang.org/x/crypto	CVE-2026-39828	MEDIUM	Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh	v0.25.0	0.52.0	-
golang.org/x/crypto	CVE-2026-39835	MEDIUM	golang.org/x/crypto is vulnerable to invoking server panic during CheckHostKey/Authenticate flow	v0.25.0	0.52.0	-
golang.org/x/crypto	CVE-2026-46598	MEDIUM	Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent	v0.25.0	0.52.0	-
golang.org/x/net	CVE-2025-22870	MEDIUM	HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net	v0.27.0	0.36.0	-
golang.org/x/net	CVE-2025-22872	MEDIUM	golang.org/x/net vulnerable to Cross-site Scripting	v0.27.0	0.38.0	-
golang.org/x/net	CVE-2025-47911	MEDIUM	Quadratic parsing complexity in golang.org/x/net/html	v0.27.0	0.45.0	-
golang.org/x/net	CVE-2026-25680	MEDIUM	Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html	v0.27.0	0.55.0	-
golang.org/x/net	CVE-2026-25681	MEDIUM	Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html	v0.27.0	0.55.0	-
golang.org/x/net	CVE-2026-27136	MEDIUM	Invoking duplicate attributes can cause XSS in golang.org/x/net/html	v0.27.0	0.55.0	-
golang.org/x/net	CVE-2026-42502	MEDIUM	Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html	v0.27.0	0.55.0	-
golang.org/x/net	CVE-2026-42506	MEDIUM	Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html	v0.27.0	0.55.0	-
google.golang.org/grpc	CVE-2026-84303	MEDIUM	Bypass of xDS RBAC HTTP filter header matching in google.golang.org/grpc	v1.65.0	1.83.1	-
golang.org/x/crypto	CVE-2026-56854	UNKNOWN	Source-address critical option not enforced for non-public-key auth callbacks in golang.org/x/crypto/ssh	v0.25.0	0.55.0	-
golang.org/x/net	CVE-2025-58190	UNKNOWN	Infinite parsing loop in golang.org/x/net	v0.27.0	0.45.0	-
golang.org/x/net	CVE-2026-46600	UNKNOWN	Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage	v0.27.0	0.56.0	-
golang.org/x/net	CVE-2026-78659	UNKNOWN	HTTP/2 server memory exhaustion due to Trailer headers in net/http	v0.27.0	0.60.0	-
golang.org/x/net	CVE-2026-78660	UNKNOWN	HTTP/2 transport accepts malformed framing-related headers in net/http	v0.27.0	0.60.0	-
golang.org/x/net	CVE-2026-78661	UNKNOWN	Avoid quadratic complexity when coalescing text nodes in html in golang.org/x/net	v0.27.0	0.62.0	-
golang.org/x/net	CVE-2026-78663	UNKNOWN	Double flow control refund on HTTP/2 server streams in net/http	v0.27.0	0.60.0	-
golang.org/x/net	CVE-2026-78669	UNKNOWN	Excessive CPU consumption from repeated initial window changes in net/http	v0.27.0	0.60.0	-
golang.org/x/net	CVE-2026-97032	UNKNOWN	HTTP/2 server crash due to HPACK encoder race in net/http	v0.27.0	0.60.0	-
golang.org/x/net	CVE-2026-97045	UNKNOWN	Check all ancestor namespace transitions when rendering raw text in html in golang.org/x/net	v0.27.0	0.62.0	-
golang.org/x/sys	CVE-2026-39824	UNKNOWN	Invoking integer overflow in NewNTUnicodeString in golang.org/x/sys/windows	v0.22.0	0.44.0	-
golang.org/x/text	CVE-2026-56851	UNKNOWN	Panic parsing crafted input in x/text/secure/precis in golang.org/x/text	v0.16.0	0.41.0	-
golang.org/x/text	CVE-2026-56852	UNKNOWN	Infinite loop on invalid input in golang.org/x/text	v0.16.0	0.39.0	-

---

Review Checklist

Standard review:

• Review changes for compatibility with your code
• Check for breaking changes in release notes
• Run tests locally or wait for CI
• Approve and merge this PR

---

Update Mode: all_vulns

🤖 Generated by DataDog Automated Dependency Management System