=== Symbol Results ===

Vulnerability #1: GO-2026-6617
    HTTP/2 server crash due to HPACK encoder race in net/http
  More info: https://pkg.go.dev/vuln/GO-2026-6617
  Standard library
    Found in: net/http@go1.26
    Fixed in: net/http@go1.26.9
    Example traces found:
      #1: internal/agentapi/client.go:153:53: agentapi.Client.Close calls http.Client.CloseIdleConnections
      #2: internal/agentapi/client.go:153:53: agentapi.Client.Close calls http.Client.CloseIdleConnections
      #3: internal/notify/notifier.go:1159:30: notify.Notifier.PushTestEventSync calls http.Client.Do
      #4: internal/notify/notifier.go:1159:30: notify.Notifier.PushTestEventSync calls http.Client.Do
      #5: internal/stacks/setup_gate.go:374:20: stacks.init calls http.Client.Get
      #6: internal/stacks/setup_gate.go:374:20: stacks.init calls http.Client.Get
      #7: cmd/controller/main.go:2113:29: controller.main calls http.Client.Head
      #8: cmd/controller/main.go:2113:29: controller.main calls http.Client.Head
      #9: internal/web/setup_gate.go:279:13: web.Server.ServeGateStart calls http.Error
      #10: internal/web/setup_gate.go:279:13: web.Server.ServeGateStart calls http.Error
      #11: internal/web/setup_gate.go:364:35: web.Server.ServeSignupClosed calls http.Header.Get
      #12: internal/web/setup_gate.go:364:35: web.Server.ServeSignupClosed calls http.Header.Get
      #13: internal/notify/notifier.go:1156:16: notify.Notifier.PushTestEventSync calls http.Header.Set
      #14: internal/notify/notifier.go:1156:16: notify.Notifier.PushTestEventSync calls http.Header.Set
      #15: internal/web/clientaddr.go:99:35: web.clientIP calls http.Header.Values
      #16: internal/web/clientaddr.go:99:35: web.clientIP calls http.Header.Values
      #17: internal/notify/notifier.go:1152:29: notify.Notifier.PushTestEventSync calls http.NewRequest
      #18: internal/notify/notifier.go:1152:29: notify.Notifier.PushTestEventSync calls http.NewRequest
      #19: internal/agentapi/client.go:667:40: agentapi.Client.WipeStagedEscrowSecret calls http.NewRequestWithContext
      #20: internal/agentapi/client.go:667:40: agentapi.Client.WipeStagedEscrowSecret calls http.NewRequestWithContext
      #21: internal/web/server.go:865:16: web.Server.ServeHTTP calls http.NotFound
      #22: internal/web/server.go:865:16: web.Server.ServeHTTP calls http.NotFound
      #23: internal/web/server.go:583:16: web.Server.ServeHTTP calls http.Redirect
      #24: internal/web/server.go:583:16: web.Server.ServeHTTP calls http.Redirect
      #25: internal/web/family_gate.go:390:23: web.Server.ServeFamilyLogout calls http.Request.Cookie
      #26: internal/web/family_gate.go:390:23: web.Server.ServeFamilyLogout calls http.Request.Cookie
      #27: internal/web/family_gate.go:352:19: web.Server.ServeFamilyLogin calls http.Request.FormValue
      #28: internal/web/family_gate.go:352:19: web.Server.ServeFamilyLogin calls http.Request.FormValue
      #29: internal/web/family_gate.go:351:17: web.Server.ServeFamilyLogin calls http.Request.ParseForm
      #30: internal/web/family_gate.go:351:17: web.Server.ServeFamilyLogin calls http.Request.ParseForm
      #31: internal/web/recovery_handlers.go:347:25: web.Server.recoveryUnlockHandler calls http.Request.PostFormValue
      #32: internal/web/recovery_handlers.go:347:25: web.Server.recoveryUnlockHandler calls http.Request.PostFormValue
      #33: internal/selfupdate/updater.go:255:18: selfupdate.Updater.queryRegistry calls http.Request.SetBasicAuth
      #34: internal/selfupdate/updater.go:255:18: selfupdate.Updater.queryRegistry calls http.Request.SetBasicAuth
      #35: internal/web/server.go:1163:16: web.Server.serveAsset calls http.ServeFile
      #36: internal/web/server.go:1163:16: web.Server.serveAsset calls http.ServeFile
      #37: cmd/controller/main.go:2138:12: controller.main calls http.ServeMux.Handle
      #38: cmd/controller/main.go:2138:12: controller.main calls http.ServeMux.Handle
      #39: internal/setup/handlers.go:90:16: setup.Server.Handler calls http.ServeMux.HandleFunc
      #40: internal/setup/handlers.go:90:16: setup.Server.Handler calls http.ServeMux.HandleFunc
      #41: cmd/controller/main.go:2214:33: controller.main calls http.Server.ListenAndServe
      #42: cmd/controller/main.go:2214:33: controller.main calls http.Server.ListenAndServe
      #43: cmd/controller/main.go:3759:21: controller.runSetupMode calls http.Server.Shutdown
      #44: cmd/controller/main.go:3759:21: controller.runSetupMode calls http.Server.Shutdown
      #45: internal/web/family_gate.go:395:16: web.Server.ServeFamilyLogout calls http.SetCookie
      #46: internal/web/family_gate.go:395:16: web.Server.ServeFamilyLogout calls http.SetCookie
      #47: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.body.Close
      #48: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.body.Close
      #49: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.body.Read
      #50: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.body.Read
      #51: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.bodyEOFSignal.Close
      #52: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.bodyEOFSignal.Close
      #53: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.bodyEOFSignal.Read
      #54: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.bodyEOFSignal.Read
      #55: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.bodyLocked.Read
      #56: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.bodyLocked.Read
      #57: internal/sockheal/sockheal.go:78:29: sockheal.PingSocket calls io.WriteString, which calls http.bufioFlushWriter.Write
      #58: internal/sockheal/sockheal.go:78:29: sockheal.PingSocket calls io.WriteString, which calls http.bufioFlushWriter.Write
      #59: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.cancelTimerBody.Close
      #60: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.cancelTimerBody.Close
      #61: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.cancelTimerBody.Read
      #62: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.cancelTimerBody.Read
      #63: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.checkConnErrorWriter.Write
      #64: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.checkConnErrorWriter.Write
      #65: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.chunkWriter.Write
      #66: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.chunkWriter.Write
      #67: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.connReader.Read
      #68: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.connReader.Read
      #69: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.expectContinueReader.Read
      #70: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.expectContinueReader.Read
      #71: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.gzipReader.Close
      #72: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.gzipReader.Close
      #73: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.gzipReader.Read
      #74: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.gzipReader.Read
      #75: internal/util/msgerr.go:150:18: util.ErrText calls http.http2ConnectionError.Error
      #76: internal/util/msgerr.go:150:18: util.ErrText calls http.http2ConnectionError.Error
      #77: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2ErrCode.String
      #78: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2ErrCode.String
      #79: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2FrameHeader.String
      #80: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2FrameHeader.String
      #81: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2FrameType.String
      #82: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2FrameType.String
      #83: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2FrameWriteRequest.String
      #84: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2FrameWriteRequest.String
      #85: internal/util/msgerr.go:150:18: util.ErrText calls http.http2GoAwayError.Error
      #86: internal/util/msgerr.go:150:18: util.ErrText calls http.http2GoAwayError.Error
      #87: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2Setting.String
      #88: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2Setting.String
      #89: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2SettingID.String
      #90: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2SettingID.String
      #91: internal/util/msgerr.go:150:18: util.ErrText calls http.http2StreamError.Error
      #92: internal/util/msgerr.go:150:18: util.ErrText calls http.http2StreamError.Error
      #93: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.http2bufferedWriterTimeoutWriter.Write
      #94: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.http2bufferedWriterTimeoutWriter.Write
      #95: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.http2chunkWriter.Write
      #96: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.http2chunkWriter.Write
      #97: internal/util/msgerr.go:150:18: util.ErrText calls http.http2connError.Error
      #98: internal/util/msgerr.go:150:18: util.ErrText calls http.http2connError.Error
      #99: internal/util/msgerr.go:150:18: util.ErrText calls http.http2duplicatePseudoHeaderError.Error
      #100: internal/util/msgerr.go:150:18: util.ErrText calls http.http2duplicatePseudoHeaderError.Error
      #101: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.http2gzipReader.Close
      #102: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.http2gzipReader.Close
      #103: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.http2gzipReader.Read
      #104: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.http2gzipReader.Read
      #105: internal/util/msgerr.go:150:18: util.ErrText calls http.http2headerFieldNameError.Error
      #106: internal/util/msgerr.go:150:18: util.ErrText calls http.http2headerFieldNameError.Error
      #107: internal/util/msgerr.go:150:18: util.ErrText calls http.http2headerFieldValueError.Error
      #108: internal/util/msgerr.go:150:18: util.ErrText calls http.http2headerFieldValueError.Error
      #109: internal/util/msgerr.go:150:18: util.ErrText calls http.http2pseudoHeaderError.Error
      #110: internal/util/msgerr.go:150:18: util.ErrText calls http.http2pseudoHeaderError.Error
      #111: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.http2requestBody.Read
      #112: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.http2requestBody.Read
      #113: internal/api/selfrestart.go:39:10: api.flushResponse calls http.http2responseWriter.Flush
      #114: internal/api/selfrestart.go:39:10: api.flushResponse calls http.http2responseWriter.Flush
      #115: internal/web/setup_gate.go:367:17: web.Server.ServeSignupClosed calls http.http2responseWriter.Write
      #116: internal/web/setup_gate.go:367:17: web.Server.ServeSignupClosed calls http.http2responseWriter.Write
      #117: internal/web/setup_gate.go:366:16: web.Server.ServeSignupClosed calls http.http2responseWriter.WriteHeader
      #118: internal/web/setup_gate.go:366:16: web.Server.ServeSignupClosed calls http.http2responseWriter.WriteHeader
      #119: internal/sockheal/sockheal.go:78:29: sockheal.PingSocket calls io.WriteString, which calls http.http2responseWriter.WriteString
      #120: internal/sockheal/sockheal.go:78:29: sockheal.PingSocket calls io.WriteString, which calls http.http2responseWriter.WriteString
      #121: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.http2stickyErrWriter.Write
      #122: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.http2stickyErrWriter.Write
      #123: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.http2transportResponseBody.Close
      #124: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.http2transportResponseBody.Close
      #125: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.http2transportResponseBody.Read
      #126: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.http2transportResponseBody.Read
      #127: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2writeData.String
      #128: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2writeData.String
      #129: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.loggingConn.Read
      #130: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.loggingConn.Read
      #131: internal/web/claim.go:486:14: web.PrintLocalResetCode calls fmt.Fprintf, which calls http.loggingConn.Write
      #132: internal/web/claim.go:486:14: web.PrintLocalResetCode calls fmt.Fprintf, which calls http.loggingConn.Write
      #133: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.maxBytesReader.Read
      #134: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.maxBytesReader.Read
      #135: internal/web/auth.go:341:16: web.Server.Close calls sync.Once.Do, which eventually calls http.onceCloseListener.Close
      #136: internal/web/auth.go:341:16: web.Server.Close calls sync.Once.Do, which eventually calls http.onceCloseListener.Close
      #137: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.persistConn.Read
      #138: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.persistConn.Read
      #139: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.persistConnWriter.ReadFrom
      #140: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.persistConnWriter.ReadFrom
      #141: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.persistConnWriter.Write
      #142: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.persistConnWriter.Write
      #143: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.readTrackingBody.Read
      #144: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.readTrackingBody.Read
      #145: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.readWriteCloserBody.Read
      #146: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.readWriteCloserBody.Read
      #147: internal/api/selfrestart.go:39:10: api.flushResponse calls http.response.Flush
      #148: internal/api/selfrestart.go:39:10: api.flushResponse calls http.response.Flush
      #149: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.response.ReadFrom
      #150: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.response.ReadFrom
      #151: internal/web/setup_gate.go:367:17: web.Server.ServeSignupClosed calls http.response.Write
      #152: internal/web/setup_gate.go:367:17: web.Server.ServeSignupClosed calls http.response.Write
      #153: internal/web/setup_gate.go:366:16: web.Server.ServeSignupClosed calls http.response.WriteHeader
      #154: internal/web/setup_gate.go:366:16: web.Server.ServeSignupClosed calls http.response.WriteHeader
      #155: internal/sockheal/sockheal.go:78:29: sockheal.PingSocket calls io.WriteString, which calls http.response.WriteString
      #156: internal/sockheal/sockheal.go:78:29: sockheal.PingSocket calls io.WriteString, which calls http.response.WriteString
      #157: internal/util/msgerr.go:150:18: util.ErrText calls http.transportReadFromServerError.Error
      #158: internal/util/msgerr.go:150:18: util.ErrText calls http.transportReadFromServerError.Error

Vulnerability #2: GO-2026-6613
    HTTP/1 server connection desynchronization after 2xx CONNECT response in
    net/http
  More info: https://pkg.go.dev/vuln/GO-2026-6613
  Standard library
    Found in: net/http@go1.26
    Fixed in: net/http@go1.26.9
    Example traces found:
      #1: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which eventually calls http.CanonicalHeaderKey
      #2: internal/agentapi/client.go:153:53: agentapi.Client.Close calls http.Client.CloseIdleConnections
      #3: internal/notify/notifier.go:1159:30: notify.Notifier.PushTestEventSync calls http.Client.Do
      #4: internal/stacks/setup_gate.go:374:20: stacks.init calls http.Client.Get
      #5: cmd/controller/main.go:2113:29: controller.main calls http.Client.Head
      #6: internal/web/setup_gate.go:279:13: web.Server.ServeGateStart calls http.Error
      #7: internal/web/setup_gate.go:366:16: web.Server.ServeSignupClosed calls http.http2responseWriter.WriteHeader, which eventually calls http.Header.Del
      #8: internal/web/setup_gate.go:364:35: web.Server.ServeSignupClosed calls http.Header.Get
      #9: internal/notify/notifier.go:1156:16: notify.Notifier.PushTestEventSync calls http.Header.Set
      #10: internal/web/clientaddr.go:99:35: web.clientIP calls http.Header.Values
      #11: internal/notify/notifier.go:1152:29: notify.Notifier.PushTestEventSync calls http.NewRequest
      #12: internal/agentapi/client.go:667:40: agentapi.Client.WipeStagedEscrowSecret calls http.NewRequestWithContext
      #13: internal/web/server.go:865:16: web.Server.ServeHTTP calls http.NotFound
      #14: internal/web/server.go:583:16: web.Server.ServeHTTP calls http.Redirect
      #15: internal/web/family_gate.go:390:23: web.Server.ServeFamilyLogout calls http.Request.Cookie
      #16: internal/web/family_gate.go:352:19: web.Server.ServeFamilyLogin calls http.Request.FormValue
      #17: internal/web/family_gate.go:351:17: web.Server.ServeFamilyLogin calls http.Request.ParseForm
      #18: internal/web/recovery_handlers.go:347:25: web.Server.recoveryUnlockHandler calls http.Request.PostFormValue
      #19: internal/selfupdate/updater.go:255:18: selfupdate.Updater.queryRegistry calls http.Request.SetBasicAuth
      #20: internal/web/server.go:1163:16: web.Server.serveAsset calls http.ServeFile
      #21: cmd/controller/main.go:2138:12: controller.main calls http.ServeMux.Handle
      #22: internal/setup/handlers.go:90:16: setup.Server.Handler calls http.ServeMux.HandleFunc
      #23: cmd/controller/main.go:2214:33: controller.main calls http.Server.ListenAndServe
      #24: cmd/controller/main.go:3759:21: controller.runSetupMode calls http.Server.Shutdown
      #25: internal/web/family_gate.go:395:16: web.Server.ServeFamilyLogout calls http.SetCookie
      #26: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.body.Close
      #27: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.body.Read
      #28: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.bodyEOFSignal.Close
      #29: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.bodyEOFSignal.Read
      #30: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.bodyLocked.Read
      #31: internal/sockheal/sockheal.go:78:29: sockheal.PingSocket calls io.WriteString, which calls http.bufioFlushWriter.Write
      #32: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.cancelTimerBody.Close
      #33: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.cancelTimerBody.Read
      #34: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.checkConnErrorWriter.Write
      #35: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.chunkWriter.Write
      #36: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.connReader.Read
      #37: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.http2transportResponseBody.Close, which eventually calls http.expectContinueReader.Close
      #38: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.expectContinueReader.Read
      #39: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.gzipReader.Close
      #40: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.gzipReader.Read
      #41: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.loggingConn.Read
      #42: internal/web/claim.go:486:14: web.PrintLocalResetCode calls fmt.Fprintf, which calls http.loggingConn.Write
      #43: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.http2transportResponseBody.Close, which eventually calls http.maxBytesReader.Close
      #44: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.maxBytesReader.Read
      #45: internal/web/auth.go:341:16: web.Server.Close calls sync.Once.Do, which eventually calls http.onceCloseListener.Close
      #46: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.persistConn.Read
      #47: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.persistConnWriter.ReadFrom
      #48: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.persistConnWriter.Write
      #49: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.http2transportResponseBody.Close, which eventually calls http.readTrackingBody.Close
      #50: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.readTrackingBody.Read
      #51: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.readWriteCloserBody.Read
      #52: internal/api/selfrestart.go:39:10: api.flushResponse calls http.response.Flush
      #53: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.response.ReadFrom
      #54: internal/web/setup_gate.go:367:17: web.Server.ServeSignupClosed calls http.response.Write
      #55: internal/web/setup_gate.go:366:16: web.Server.ServeSignupClosed calls http.response.WriteHeader
      #56: internal/sockheal/sockheal.go:78:29: sockheal.PingSocket calls io.WriteString, which calls http.response.WriteString
      #57: internal/util/msgerr.go:150:18: util.ErrText calls http.transportReadFromServerError.Error

Vulnerability #3: GO-2026-6612
    Double flow control refund on HTTP/2 server streams in net/http
  More info: https://pkg.go.dev/vuln/GO-2026-6612
  Standard library
    Found in: net/http@go1.26
    Fixed in: net/http@go1.26.9
    Example traces found:
      #1: internal/agentapi/client.go:153:53: agentapi.Client.Close calls http.Client.CloseIdleConnections
      #2: internal/agentapi/client.go:153:53: agentapi.Client.Close calls http.Client.CloseIdleConnections
      #3: internal/notify/notifier.go:1159:30: notify.Notifier.PushTestEventSync calls http.Client.Do
      #4: internal/notify/notifier.go:1159:30: notify.Notifier.PushTestEventSync calls http.Client.Do
      #5: internal/stacks/setup_gate.go:374:20: stacks.init calls http.Client.Get
      #6: internal/stacks/setup_gate.go:374:20: stacks.init calls http.Client.Get
      #7: cmd/controller/main.go:2113:29: controller.main calls http.Client.Head
      #8: cmd/controller/main.go:2113:29: controller.main calls http.Client.Head
      #9: internal/web/setup_gate.go:279:13: web.Server.ServeGateStart calls http.Error
      #10: internal/web/setup_gate.go:279:13: web.Server.ServeGateStart calls http.Error
      #11: internal/web/setup_gate.go:364:35: web.Server.ServeSignupClosed calls http.Header.Get
      #12: internal/web/setup_gate.go:364:35: web.Server.ServeSignupClosed calls http.Header.Get
      #13: internal/notify/notifier.go:1156:16: notify.Notifier.PushTestEventSync calls http.Header.Set
      #14: internal/notify/notifier.go:1156:16: notify.Notifier.PushTestEventSync calls http.Header.Set
      #15: internal/web/clientaddr.go:99:35: web.clientIP calls http.Header.Values
      #16: internal/web/clientaddr.go:99:35: web.clientIP calls http.Header.Values
      #17: internal/notify/notifier.go:1152:29: notify.Notifier.PushTestEventSync calls http.NewRequest
      #18: internal/notify/notifier.go:1152:29: notify.Notifier.PushTestEventSync calls http.NewRequest
      #19: internal/agentapi/client.go:667:40: agentapi.Client.WipeStagedEscrowSecret calls http.NewRequestWithContext
      #20: internal/agentapi/client.go:667:40: agentapi.Client.WipeStagedEscrowSecret calls http.NewRequestWithContext
      #21: internal/web/server.go:865:16: web.Server.ServeHTTP calls http.NotFound
      #22: internal/web/server.go:865:16: web.Server.ServeHTTP calls http.NotFound
      #23: internal/web/server.go:583:16: web.Server.ServeHTTP calls http.Redirect
      #24: internal/web/server.go:583:16: web.Server.ServeHTTP calls http.Redirect
      #25: internal/web/family_gate.go:390:23: web.Server.ServeFamilyLogout calls http.Request.Cookie
      #26: internal/web/family_gate.go:390:23: web.Server.ServeFamilyLogout calls http.Request.Cookie
      #27: internal/web/family_gate.go:352:19: web.Server.ServeFamilyLogin calls http.Request.FormValue
      #28: internal/web/family_gate.go:352:19: web.Server.ServeFamilyLogin calls http.Request.FormValue
      #29: internal/web/family_gate.go:351:17: web.Server.ServeFamilyLogin calls http.Request.ParseForm
      #30: internal/web/family_gate.go:351:17: web.Server.ServeFamilyLogin calls http.Request.ParseForm
      #31: internal/web/recovery_handlers.go:347:25: web.Server.recoveryUnlockHandler calls http.Request.PostFormValue
      #32: internal/web/recovery_handlers.go:347:25: web.Server.recoveryUnlockHandler calls http.Request.PostFormValue
      #33: internal/selfupdate/updater.go:255:18: selfupdate.Updater.queryRegistry calls http.Request.SetBasicAuth
      #34: internal/selfupdate/updater.go:255:18: selfupdate.Updater.queryRegistry calls http.Request.SetBasicAuth
      #35: internal/web/server.go:1163:16: web.Server.serveAsset calls http.ServeFile
      #36: internal/web/server.go:1163:16: web.Server.serveAsset calls http.ServeFile
      #37: cmd/controller/main.go:2138:12: controller.main calls http.ServeMux.Handle
      #38: cmd/controller/main.go:2138:12: controller.main calls http.ServeMux.Handle
      #39: internal/setup/handlers.go:90:16: setup.Server.Handler calls http.ServeMux.HandleFunc
      #40: internal/setup/handlers.go:90:16: setup.Server.Handler calls http.ServeMux.HandleFunc
      #41: cmd/controller/main.go:2214:33: controller.main calls http.Server.ListenAndServe
      #42: cmd/controller/main.go:2214:33: controller.main calls http.Server.ListenAndServe
      #43: cmd/controller/main.go:3759:21: controller.runSetupMode calls http.Server.Shutdown
      #44: cmd/controller/main.go:3759:21: controller.runSetupMode calls http.Server.Shutdown
      #45: internal/web/family_gate.go:395:16: web.Server.ServeFamilyLogout calls http.SetCookie
      #46: internal/web/family_gate.go:395:16: web.Server.ServeFamilyLogout calls http.SetCookie
      #47: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.body.Close
      #48: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.body.Close
      #49: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.body.Read
      #50: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.body.Read
      #51: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.bodyEOFSignal.Close
      #52: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.bodyEOFSignal.Close
      #53: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.bodyEOFSignal.Read
      #54: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.bodyEOFSignal.Read
      #55: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.bodyLocked.Read
      #56: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.bodyLocked.Read
      #57: internal/sockheal/sockheal.go:78:29: sockheal.PingSocket calls io.WriteString, which calls http.bufioFlushWriter.Write
      #58: internal/sockheal/sockheal.go:78:29: sockheal.PingSocket calls io.WriteString, which calls http.bufioFlushWriter.Write
      #59: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.cancelTimerBody.Close
      #60: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.cancelTimerBody.Close
      #61: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.cancelTimerBody.Read
      #62: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.cancelTimerBody.Read
      #63: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.checkConnErrorWriter.Write
      #64: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.checkConnErrorWriter.Write
      #65: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.chunkWriter.Write
      #66: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.chunkWriter.Write
      #67: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.connReader.Read
      #68: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.connReader.Read
      #69: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.expectContinueReader.Read
      #70: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.expectContinueReader.Read
      #71: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.gzipReader.Close
      #72: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.gzipReader.Close
      #73: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.gzipReader.Read
      #74: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.gzipReader.Read
      #75: internal/util/msgerr.go:150:18: util.ErrText calls http.http2ConnectionError.Error
      #76: internal/util/msgerr.go:150:18: util.ErrText calls http.http2ConnectionError.Error
      #77: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2ErrCode.String
      #78: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2ErrCode.String
      #79: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2FrameHeader.String
      #80: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2FrameHeader.String
      #81: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2FrameType.String
      #82: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2FrameType.String
      #83: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2FrameWriteRequest.String
      #84: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2FrameWriteRequest.String
      #85: internal/util/msgerr.go:150:18: util.ErrText calls http.http2GoAwayError.Error
      #86: internal/util/msgerr.go:150:18: util.ErrText calls http.http2GoAwayError.Error
      #87: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2Setting.String
      #88: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2Setting.String
      #89: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2SettingID.String
      #90: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2SettingID.String
      #91: internal/util/msgerr.go:150:18: util.ErrText calls http.http2StreamError.Error
      #92: internal/util/msgerr.go:150:18: util.ErrText calls http.http2StreamError.Error
      #93: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.http2bufferedWriterTimeoutWriter.Write
      #94: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.http2bufferedWriterTimeoutWriter.Write
      #95: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.http2chunkWriter.Write
      #96: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.http2chunkWriter.Write
      #97: internal/util/msgerr.go:150:18: util.ErrText calls http.http2connError.Error
      #98: internal/util/msgerr.go:150:18: util.ErrText calls http.http2connError.Error
      #99: internal/util/msgerr.go:150:18: util.ErrText calls http.http2duplicatePseudoHeaderError.Error
      #100: internal/util/msgerr.go:150:18: util.ErrText calls http.http2duplicatePseudoHeaderError.Error
      #101: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.http2gzipReader.Close
      #102: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.http2gzipReader.Close
      #103: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.http2gzipReader.Read
      #104: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.http2gzipReader.Read
      #105: internal/util/msgerr.go:150:18: util.ErrText calls http.http2headerFieldNameError.Error
      #106: internal/util/msgerr.go:150:18: util.ErrText calls http.http2headerFieldNameError.Error
      #107: internal/util/msgerr.go:150:18: util.ErrText calls http.http2headerFieldValueError.Error
      #108: internal/util/msgerr.go:150:18: util.ErrText calls http.http2headerFieldValueError.Error
      #109: internal/util/msgerr.go:150:18: util.ErrText calls http.http2pseudoHeaderError.Error
      #110: internal/util/msgerr.go:150:18: util.ErrText calls http.http2pseudoHeaderError.Error
      #111: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.http2requestBody.Read
      #112: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.http2requestBody.Read
      #113: internal/api/selfrestart.go:39:10: api.flushResponse calls http.http2responseWriter.Flush
      #114: internal/api/selfrestart.go:39:10: api.flushResponse calls http.http2responseWriter.Flush
      #115: internal/web/setup_gate.go:367:17: web.Server.ServeSignupClosed calls http.http2responseWriter.Write
      #116: internal/web/setup_gate.go:367:17: web.Server.ServeSignupClosed calls http.http2responseWriter.Write
      #117: internal/web/setup_gate.go:366:16: web.Server.ServeSignupClosed calls http.http2responseWriter.WriteHeader
      #118: internal/web/setup_gate.go:366:16: web.Server.ServeSignupClosed calls http.http2responseWriter.WriteHeader
      #119: internal/sockheal/sockheal.go:78:29: sockheal.PingSocket calls io.WriteString, which calls http.http2responseWriter.WriteString
      #120: internal/sockheal/sockheal.go:78:29: sockheal.PingSocket calls io.WriteString, which calls http.http2responseWriter.WriteString
      #121: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.http2stickyErrWriter.Write
      #122: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.http2stickyErrWriter.Write
      #123: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.http2transportResponseBody.Close
      #124: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.http2transportResponseBody.Close
      #125: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.http2transportResponseBody.Read
      #126: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.http2transportResponseBody.Read
      #127: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2writeData.String
      #128: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2writeData.String
      #129: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.loggingConn.Read
      #130: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.loggingConn.Read
      #131: internal/web/claim.go:486:14: web.PrintLocalResetCode calls fmt.Fprintf, which calls http.loggingConn.Write
      #132: internal/web/claim.go:486:14: web.PrintLocalResetCode calls fmt.Fprintf, which calls http.loggingConn.Write
      #133: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.maxBytesReader.Read
      #134: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.maxBytesReader.Read
      #135: internal/web/auth.go:341:16: web.Server.Close calls sync.Once.Do, which eventually calls http.onceCloseListener.Close
      #136: internal/web/auth.go:341:16: web.Server.Close calls sync.Once.Do, which eventually calls http.onceCloseListener.Close
      #137: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.persistConn.Read
      #138: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.persistConn.Read
      #139: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.persistConnWriter.ReadFrom
      #140: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.persistConnWriter.ReadFrom
      #141: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.persistConnWriter.Write
      #142: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.persistConnWriter.Write
      #143: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.readTrackingBody.Read
      #144: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.readTrackingBody.Read
      #145: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.readWriteCloserBody.Read
      #146: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.readWriteCloserBody.Read
      #147: internal/api/selfrestart.go:39:10: api.flushResponse calls http.response.Flush
      #148: internal/api/selfrestart.go:39:10: api.flushResponse calls http.response.Flush
      #149: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.response.ReadFrom
      #150: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.response.ReadFrom
      #151: internal/web/setup_gate.go:367:17: web.Server.ServeSignupClosed calls http.response.Write
      #152: internal/web/setup_gate.go:367:17: web.Server.ServeSignupClosed calls http.response.Write
      #153: internal/web/setup_gate.go:366:16: web.Server.ServeSignupClosed calls http.response.WriteHeader
      #154: internal/web/setup_gate.go:366:16: web.Server.ServeSignupClosed calls http.response.WriteHeader
      #155: internal/sockheal/sockheal.go:78:29: sockheal.PingSocket calls io.WriteString, which calls http.response.WriteString
      #156: internal/sockheal/sockheal.go:78:29: sockheal.PingSocket calls io.WriteString, which calls http.response.WriteString
      #157: internal/util/msgerr.go:150:18: util.ErrText calls http.transportReadFromServerError.Error
      #158: internal/util/msgerr.go:150:18: util.ErrText calls http.transportReadFromServerError.Error

Vulnerability #4: GO-2026-6611
    Excessive CPU consumption from repeated initial window changes in net/http
  More info: https://pkg.go.dev/vuln/GO-2026-6611
  Standard library
    Found in: net/http@go1.26
    Fixed in: net/http@go1.26.9
    Example traces found:
      #1: internal/agentapi/client.go:153:53: agentapi.Client.Close calls http.Client.CloseIdleConnections
      #2: internal/agentapi/client.go:153:53: agentapi.Client.Close calls http.Client.CloseIdleConnections
      #3: internal/notify/notifier.go:1159:30: notify.Notifier.PushTestEventSync calls http.Client.Do
      #4: internal/notify/notifier.go:1159:30: notify.Notifier.PushTestEventSync calls http.Client.Do
      #5: internal/stacks/setup_gate.go:374:20: stacks.init calls http.Client.Get
      #6: internal/stacks/setup_gate.go:374:20: stacks.init calls http.Client.Get
      #7: cmd/controller/main.go:2113:29: controller.main calls http.Client.Head
      #8: cmd/controller/main.go:2113:29: controller.main calls http.Client.Head
      #9: internal/web/setup_gate.go:279:13: web.Server.ServeGateStart calls http.Error
      #10: internal/web/setup_gate.go:279:13: web.Server.ServeGateStart calls http.Error
      #11: internal/web/setup_gate.go:364:35: web.Server.ServeSignupClosed calls http.Header.Get
      #12: internal/web/setup_gate.go:364:35: web.Server.ServeSignupClosed calls http.Header.Get
      #13: internal/notify/notifier.go:1156:16: notify.Notifier.PushTestEventSync calls http.Header.Set
      #14: internal/notify/notifier.go:1156:16: notify.Notifier.PushTestEventSync calls http.Header.Set
      #15: internal/web/clientaddr.go:99:35: web.clientIP calls http.Header.Values
      #16: internal/web/clientaddr.go:99:35: web.clientIP calls http.Header.Values
      #17: internal/notify/notifier.go:1152:29: notify.Notifier.PushTestEventSync calls http.NewRequest
      #18: internal/notify/notifier.go:1152:29: notify.Notifier.PushTestEventSync calls http.NewRequest
      #19: internal/agentapi/client.go:667:40: agentapi.Client.WipeStagedEscrowSecret calls http.NewRequestWithContext
      #20: internal/agentapi/client.go:667:40: agentapi.Client.WipeStagedEscrowSecret calls http.NewRequestWithContext
      #21: internal/web/server.go:865:16: web.Server.ServeHTTP calls http.NotFound
      #22: internal/web/server.go:865:16: web.Server.ServeHTTP calls http.NotFound
      #23: internal/web/server.go:583:16: web.Server.ServeHTTP calls http.Redirect
      #24: internal/web/server.go:583:16: web.Server.ServeHTTP calls http.Redirect
      #25: internal/web/family_gate.go:390:23: web.Server.ServeFamilyLogout calls http.Request.Cookie
      #26: internal/web/family_gate.go:390:23: web.Server.ServeFamilyLogout calls http.Request.Cookie
      #27: internal/web/family_gate.go:352:19: web.Server.ServeFamilyLogin calls http.Request.FormValue
      #28: internal/web/family_gate.go:352:19: web.Server.ServeFamilyLogin calls http.Request.FormValue
      #29: internal/web/family_gate.go:351:17: web.Server.ServeFamilyLogin calls http.Request.ParseForm
      #30: internal/web/family_gate.go:351:17: web.Server.ServeFamilyLogin calls http.Request.ParseForm
      #31: internal/web/recovery_handlers.go:347:25: web.Server.recoveryUnlockHandler calls http.Request.PostFormValue
      #32: internal/web/recovery_handlers.go:347:25: web.Server.recoveryUnlockHandler calls http.Request.PostFormValue
      #33: internal/selfupdate/updater.go:255:18: selfupdate.Updater.queryRegistry calls http.Request.SetBasicAuth
      #34: internal/selfupdate/updater.go:255:18: selfupdate.Updater.queryRegistry calls http.Request.SetBasicAuth
      #35: internal/web/server.go:1163:16: web.Server.serveAsset calls http.ServeFile
      #36: internal/web/server.go:1163:16: web.Server.serveAsset calls http.ServeFile
      #37: cmd/controller/main.go:2138:12: controller.main calls http.ServeMux.Handle
      #38: cmd/controller/main.go:2138:12: controller.main calls http.ServeMux.Handle
      #39: internal/setup/handlers.go:90:16: setup.Server.Handler calls http.ServeMux.HandleFunc
      #40: internal/setup/handlers.go:90:16: setup.Server.Handler calls http.ServeMux.HandleFunc
      #41: cmd/controller/main.go:2214:33: controller.main calls http.Server.ListenAndServe
      #42: cmd/controller/main.go:2214:33: controller.main calls http.Server.ListenAndServe
      #43: cmd/controller/main.go:3759:21: controller.runSetupMode calls http.Server.Shutdown
      #44: cmd/controller/main.go:3759:21: controller.runSetupMode calls http.Server.Shutdown
      #45: internal/web/family_gate.go:395:16: web.Server.ServeFamilyLogout calls http.SetCookie
      #46: internal/web/family_gate.go:395:16: web.Server.ServeFamilyLogout calls http.SetCookie
      #47: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.body.Close
      #48: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.body.Close
      #49: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.body.Read
      #50: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.body.Read
      #51: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.bodyEOFSignal.Close
      #52: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.bodyEOFSignal.Close
      #53: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.bodyEOFSignal.Read
      #54: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.bodyEOFSignal.Read
      #55: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.bodyLocked.Read
      #56: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.bodyLocked.Read
      #57: internal/sockheal/sockheal.go:78:29: sockheal.PingSocket calls io.WriteString, which calls http.bufioFlushWriter.Write
      #58: internal/sockheal/sockheal.go:78:29: sockheal.PingSocket calls io.WriteString, which calls http.bufioFlushWriter.Write
      #59: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.cancelTimerBody.Close
      #60: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.cancelTimerBody.Close
      #61: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.cancelTimerBody.Read
      #62: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.cancelTimerBody.Read
      #63: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.checkConnErrorWriter.Write
      #64: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.checkConnErrorWriter.Write
      #65: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.chunkWriter.Write
      #66: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.chunkWriter.Write
      #67: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.connReader.Read
      #68: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.connReader.Read
      #69: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.expectContinueReader.Read
      #70: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.expectContinueReader.Read
      #71: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.gzipReader.Close
      #72: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.gzipReader.Close
      #73: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.gzipReader.Read
      #74: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.gzipReader.Read
      #75: internal/util/msgerr.go:150:18: util.ErrText calls http.http2ConnectionError.Error
      #76: internal/util/msgerr.go:150:18: util.ErrText calls http.http2ConnectionError.Error
      #77: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2ErrCode.String
      #78: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2ErrCode.String
      #79: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2FrameHeader.String
      #80: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2FrameHeader.String
      #81: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2FrameType.String
      #82: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2FrameType.String
      #83: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2FrameWriteRequest.String
      #84: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2FrameWriteRequest.String
      #85: internal/util/msgerr.go:150:18: util.ErrText calls http.http2GoAwayError.Error
      #86: internal/util/msgerr.go:150:18: util.ErrText calls http.http2GoAwayError.Error
      #87: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2Setting.String
      #88: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2Setting.String
      #89: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2SettingID.String
      #90: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2SettingID.String
      #91: internal/util/msgerr.go:150:18: util.ErrText calls http.http2StreamError.Error
      #92: internal/util/msgerr.go:150:18: util.ErrText calls http.http2StreamError.Error
      #93: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.http2bufferedWriterTimeoutWriter.Write
      #94: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.http2bufferedWriterTimeoutWriter.Write
      #95: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.http2chunkWriter.Write
      #96: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.http2chunkWriter.Write
      #97: internal/util/msgerr.go:150:18: util.ErrText calls http.http2connError.Error
      #98: internal/util/msgerr.go:150:18: util.ErrText calls http.http2connError.Error
      #99: internal/util/msgerr.go:150:18: util.ErrText calls http.http2duplicatePseudoHeaderError.Error
      #100: internal/util/msgerr.go:150:18: util.ErrText calls http.http2duplicatePseudoHeaderError.Error
      #101: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.http2gzipReader.Close
      #102: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.http2gzipReader.Close
      #103: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.http2gzipReader.Read
      #104: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.http2gzipReader.Read
      #105: internal/util/msgerr.go:150:18: util.ErrText calls http.http2headerFieldNameError.Error
      #106: internal/util/msgerr.go:150:18: util.ErrText calls http.http2headerFieldNameError.Error
      #107: internal/util/msgerr.go:150:18: util.ErrText calls http.http2headerFieldValueError.Error
      #108: internal/util/msgerr.go:150:18: util.ErrText calls http.http2headerFieldValueError.Error
      #109: internal/util/msgerr.go:150:18: util.ErrText calls http.http2pseudoHeaderError.Error
      #110: internal/util/msgerr.go:150:18: util.ErrText calls http.http2pseudoHeaderError.Error
      #111: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.http2requestBody.Read
      #112: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.http2requestBody.Read
      #113: internal/api/selfrestart.go:39:10: api.flushResponse calls http.http2responseWriter.Flush
      #114: internal/api/selfrestart.go:39:10: api.flushResponse calls http.http2responseWriter.Flush
      #115: internal/web/setup_gate.go:367:17: web.Server.ServeSignupClosed calls http.http2responseWriter.Write
      #116: internal/web/setup_gate.go:367:17: web.Server.ServeSignupClosed calls http.http2responseWriter.Write
      #117: internal/web/setup_gate.go:366:16: web.Server.ServeSignupClosed calls http.http2responseWriter.WriteHeader
      #118: internal/web/setup_gate.go:366:16: web.Server.ServeSignupClosed calls http.http2responseWriter.WriteHeader
      #119: internal/sockheal/sockheal.go:78:29: sockheal.PingSocket calls io.WriteString, which calls http.http2responseWriter.WriteString
      #120: internal/sockheal/sockheal.go:78:29: sockheal.PingSocket calls io.WriteString, which calls http.http2responseWriter.WriteString
      #121: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.http2stickyErrWriter.Write
      #122: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.http2stickyErrWriter.Write
      #123: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.http2transportResponseBody.Close
      #124: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.http2transportResponseBody.Close
      #125: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.http2transportResponseBody.Read
      #126: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.http2transportResponseBody.Read
      #127: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2writeData.String
      #128: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2writeData.String
      #129: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.loggingConn.Read
      #130: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.loggingConn.Read
      #131: internal/web/claim.go:486:14: web.PrintLocalResetCode calls fmt.Fprintf, which calls http.loggingConn.Write
      #132: internal/web/claim.go:486:14: web.PrintLocalResetCode calls fmt.Fprintf, which calls http.loggingConn.Write
      #133: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.maxBytesReader.Read
      #134: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.maxBytesReader.Read
      #135: internal/web/auth.go:341:16: web.Server.Close calls sync.Once.Do, which eventually calls http.onceCloseListener.Close
      #136: internal/web/auth.go:341:16: web.Server.Close calls sync.Once.Do, which eventually calls http.onceCloseListener.Close
      #137: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.persistConn.Read
      #138: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.persistConn.Read
      #139: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.persistConnWriter.ReadFrom
      #140: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.persistConnWriter.ReadFrom
      #141: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.persistConnWriter.Write
      #142: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.persistConnWriter.Write
      #143: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.readTrackingBody.Read
      #144: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.readTrackingBody.Read
      #145: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.readWriteCloserBody.Read
      #146: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.readWriteCloserBody.Read
      #147: internal/api/selfrestart.go:39:10: api.flushResponse calls http.response.Flush
      #148: internal/api/selfrestart.go:39:10: api.flushResponse calls http.response.Flush
      #149: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.response.ReadFrom
      #150: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.response.ReadFrom
      #151: internal/web/setup_gate.go:367:17: web.Server.ServeSignupClosed calls http.response.Write
      #152: internal/web/setup_gate.go:367:17: web.Server.ServeSignupClosed calls http.response.Write
      #153: internal/web/setup_gate.go:366:16: web.Server.ServeSignupClosed calls http.response.WriteHeader
      #154: internal/web/setup_gate.go:366:16: web.Server.ServeSignupClosed calls http.response.WriteHeader
      #155: internal/sockheal/sockheal.go:78:29: sockheal.PingSocket calls io.WriteString, which calls http.response.WriteString
      #156: internal/sockheal/sockheal.go:78:29: sockheal.PingSocket calls io.WriteString, which calls http.response.WriteString
      #157: internal/util/msgerr.go:150:18: util.ErrText calls http.transportReadFromServerError.Error
      #158: internal/util/msgerr.go:150:18: util.ErrText calls http.transportReadFromServerError.Error

Vulnerability #5: GO-2026-6610
    HTTP/2 transport accepts malformed framing-related headers in net/http
  More info: https://pkg.go.dev/vuln/GO-2026-6610
  Standard library
    Found in: net/http@go1.26
    Fixed in: net/http@go1.26.9
    Example traces found:
      #1: internal/agentapi/client.go:153:53: agentapi.Client.Close calls http.Client.CloseIdleConnections
      #2: internal/agentapi/client.go:153:53: agentapi.Client.Close calls http.Client.CloseIdleConnections
      #3: internal/notify/notifier.go:1159:30: notify.Notifier.PushTestEventSync calls http.Client.Do
      #4: internal/notify/notifier.go:1159:30: notify.Notifier.PushTestEventSync calls http.Client.Do
      #5: internal/stacks/setup_gate.go:374:20: stacks.init calls http.Client.Get
      #6: internal/stacks/setup_gate.go:374:20: stacks.init calls http.Client.Get
      #7: cmd/controller/main.go:2113:29: controller.main calls http.Client.Head
      #8: cmd/controller/main.go:2113:29: controller.main calls http.Client.Head

Vulnerability #6: GO-2026-6609
    Lack of limit on size of parsed Range headers in net/http
  More info: https://pkg.go.dev/vuln/GO-2026-6609
  Standard library
    Found in: net/http@go1.26
    Fixed in: net/http@go1.26.9
    Example traces found:
      #1: internal/web/server.go:1163:16: web.Server.serveAsset calls http.ServeFile

Vulnerability #7: GO-2026-6608
    Memory limit bypass when parsing MIME headers in net/textproto,
    mime/multipart
  More info: https://pkg.go.dev/vuln/GO-2026-6608
  Standard library
    Found in: net/textproto@go1.26
    Fixed in: net/textproto@go1.26.9
    Example traces found:
      #1: internal/web/family_gate.go:352:19: web.Server.ServeFamilyLogin calls http.Request.FormValue, which eventually calls multipart.Reader.ReadForm
      #2: internal/mailrelay/policy.go:41:30: mailrelay.FromDomain calls mail.ReadMessage, which eventually calls textproto.Reader.ReadContinuedLine
      #3: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which eventually calls textproto.Reader.ReadMIMEHeader

Vulnerability #8: GO-2026-6607
    Reject malformed ECH outer extension references in crypto/tls
  More info: https://pkg.go.dev/vuln/GO-2026-6607
  Standard library
    Found in: crypto/tls@go1.26
    Fixed in: crypto/tls@go1.26.9
    Example traces found:
      #1: internal/mailrelay/server.go:168:34: mailrelay.Start calls smtp.Server.Serve, which eventually calls tls.Conn.Handshake
      #2: cmd/controller/main.go:2214:33: controller.main calls http.Server.ListenAndServe, which eventually calls tls.Conn.HandshakeContext
      #3: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls tls.Conn.Read
      #4: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls tls.Conn.Write
      #5: internal/notify/notifier.go:1159:30: notify.Notifier.PushTestEventSync calls http.Client.Do, which eventually calls tls.Dialer.DialContext

Vulnerability #9: GO-2026-6605
    HTTP/1 client connection desynchronization after CONNECT rejection in
    net/http
  More info: https://pkg.go.dev/vuln/GO-2026-6605
  Standard library
    Found in: net/http@go1.26
    Fixed in: net/http@go1.26.9
    Example traces found:
      #1: internal/agentapi/client.go:153:53: agentapi.Client.Close calls http.Client.CloseIdleConnections
      #2: internal/notify/notifier.go:1159:30: notify.Notifier.PushTestEventSync calls http.Client.Do
      #3: internal/stacks/setup_gate.go:374:20: stacks.init calls http.Client.Get
      #4: cmd/controller/main.go:2113:29: controller.main calls http.Client.Head

Vulnerability #10: GO-2026-6603
    HTTP/2 server memory exhaustion due to Trailer headers in net/http
  More info: https://pkg.go.dev/vuln/GO-2026-6603
  Standard library
    Found in: net/http@go1.26
    Fixed in: net/http@go1.26.9
    Example traces found:
      #1: internal/agentapi/client.go:153:53: agentapi.Client.Close calls http.Client.CloseIdleConnections
      #2: internal/agentapi/client.go:153:53: agentapi.Client.Close calls http.Client.CloseIdleConnections
      #3: internal/notify/notifier.go:1159:30: notify.Notifier.PushTestEventSync calls http.Client.Do
      #4: internal/notify/notifier.go:1159:30: notify.Notifier.PushTestEventSync calls http.Client.Do
      #5: internal/stacks/setup_gate.go:374:20: stacks.init calls http.Client.Get
      #6: internal/stacks/setup_gate.go:374:20: stacks.init calls http.Client.Get
      #7: cmd/controller/main.go:2113:29: controller.main calls http.Client.Head
      #8: cmd/controller/main.go:2113:29: controller.main calls http.Client.Head
      #9: internal/web/setup_gate.go:279:13: web.Server.ServeGateStart calls http.Error
      #10: internal/web/setup_gate.go:279:13: web.Server.ServeGateStart calls http.Error
      #11: internal/web/setup_gate.go:364:35: web.Server.ServeSignupClosed calls http.Header.Get
      #12: internal/web/setup_gate.go:364:35: web.Server.ServeSignupClosed calls http.Header.Get
      #13: internal/notify/notifier.go:1156:16: notify.Notifier.PushTestEventSync calls http.Header.Set
      #14: internal/notify/notifier.go:1156:16: notify.Notifier.PushTestEventSync calls http.Header.Set
      #15: internal/web/clientaddr.go:99:35: web.clientIP calls http.Header.Values
      #16: internal/web/clientaddr.go:99:35: web.clientIP calls http.Header.Values
      #17: internal/notify/notifier.go:1152:29: notify.Notifier.PushTestEventSync calls http.NewRequest
      #18: internal/notify/notifier.go:1152:29: notify.Notifier.PushTestEventSync calls http.NewRequest
      #19: internal/agentapi/client.go:667:40: agentapi.Client.WipeStagedEscrowSecret calls http.NewRequestWithContext
      #20: internal/agentapi/client.go:667:40: agentapi.Client.WipeStagedEscrowSecret calls http.NewRequestWithContext
      #21: internal/web/server.go:865:16: web.Server.ServeHTTP calls http.NotFound
      #22: internal/web/server.go:865:16: web.Server.ServeHTTP calls http.NotFound
      #23: internal/web/server.go:583:16: web.Server.ServeHTTP calls http.Redirect
      #24: internal/web/server.go:583:16: web.Server.ServeHTTP calls http.Redirect
      #25: internal/web/family_gate.go:390:23: web.Server.ServeFamilyLogout calls http.Request.Cookie
      #26: internal/web/family_gate.go:390:23: web.Server.ServeFamilyLogout calls http.Request.Cookie
      #27: internal/web/family_gate.go:352:19: web.Server.ServeFamilyLogin calls http.Request.FormValue
      #28: internal/web/family_gate.go:352:19: web.Server.ServeFamilyLogin calls http.Request.FormValue
      #29: internal/web/family_gate.go:351:17: web.Server.ServeFamilyLogin calls http.Request.ParseForm
      #30: internal/web/family_gate.go:351:17: web.Server.ServeFamilyLogin calls http.Request.ParseForm
      #31: internal/web/recovery_handlers.go:347:25: web.Server.recoveryUnlockHandler calls http.Request.PostFormValue
      #32: internal/web/recovery_handlers.go:347:25: web.Server.recoveryUnlockHandler calls http.Request.PostFormValue
      #33: internal/selfupdate/updater.go:255:18: selfupdate.Updater.queryRegistry calls http.Request.SetBasicAuth
      #34: internal/selfupdate/updater.go:255:18: selfupdate.Updater.queryRegistry calls http.Request.SetBasicAuth
      #35: internal/web/server.go:1163:16: web.Server.serveAsset calls http.ServeFile
      #36: internal/web/server.go:1163:16: web.Server.serveAsset calls http.ServeFile
      #37: cmd/controller/main.go:2138:12: controller.main calls http.ServeMux.Handle
      #38: cmd/controller/main.go:2138:12: controller.main calls http.ServeMux.Handle
      #39: internal/setup/handlers.go:90:16: setup.Server.Handler calls http.ServeMux.HandleFunc
      #40: internal/setup/handlers.go:90:16: setup.Server.Handler calls http.ServeMux.HandleFunc
      #41: cmd/controller/main.go:2214:33: controller.main calls http.Server.ListenAndServe
      #42: cmd/controller/main.go:2214:33: controller.main calls http.Server.ListenAndServe
      #43: cmd/controller/main.go:3759:21: controller.runSetupMode calls http.Server.Shutdown
      #44: cmd/controller/main.go:3759:21: controller.runSetupMode calls http.Server.Shutdown
      #45: internal/web/family_gate.go:395:16: web.Server.ServeFamilyLogout calls http.SetCookie
      #46: internal/web/family_gate.go:395:16: web.Server.ServeFamilyLogout calls http.SetCookie
      #47: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.body.Close
      #48: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.body.Close
      #49: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.body.Read
      #50: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.body.Read
      #51: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.bodyEOFSignal.Close
      #52: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.bodyEOFSignal.Close
      #53: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.bodyEOFSignal.Read
      #54: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.bodyEOFSignal.Read
      #55: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.bodyLocked.Read
      #56: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.bodyLocked.Read
      #57: internal/sockheal/sockheal.go:78:29: sockheal.PingSocket calls io.WriteString, which calls http.bufioFlushWriter.Write
      #58: internal/sockheal/sockheal.go:78:29: sockheal.PingSocket calls io.WriteString, which calls http.bufioFlushWriter.Write
      #59: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.cancelTimerBody.Close
      #60: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.cancelTimerBody.Close
      #61: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.cancelTimerBody.Read
      #62: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.cancelTimerBody.Read
      #63: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.checkConnErrorWriter.Write
      #64: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.checkConnErrorWriter.Write
      #65: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.chunkWriter.Write
      #66: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.chunkWriter.Write
      #67: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.connReader.Read
      #68: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.connReader.Read
      #69: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.expectContinueReader.Read
      #70: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.expectContinueReader.Read
      #71: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.gzipReader.Close
      #72: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.gzipReader.Close
      #73: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.gzipReader.Read
      #74: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.gzipReader.Read
      #75: internal/util/msgerr.go:150:18: util.ErrText calls http.http2ConnectionError.Error
      #76: internal/util/msgerr.go:150:18: util.ErrText calls http.http2ConnectionError.Error
      #77: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2ErrCode.String
      #78: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2ErrCode.String
      #79: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2FrameHeader.String
      #80: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2FrameHeader.String
      #81: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2FrameType.String
      #82: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2FrameType.String
      #83: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2FrameWriteRequest.String
      #84: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2FrameWriteRequest.String
      #85: internal/util/msgerr.go:150:18: util.ErrText calls http.http2GoAwayError.Error
      #86: internal/util/msgerr.go:150:18: util.ErrText calls http.http2GoAwayError.Error
      #87: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2Setting.String
      #88: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2Setting.String
      #89: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2SettingID.String
      #90: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2SettingID.String
      #91: internal/util/msgerr.go:150:18: util.ErrText calls http.http2StreamError.Error
      #92: internal/util/msgerr.go:150:18: util.ErrText calls http.http2StreamError.Error
      #93: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.http2bufferedWriterTimeoutWriter.Write
      #94: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.http2bufferedWriterTimeoutWriter.Write
      #95: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.http2chunkWriter.Write
      #96: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.http2chunkWriter.Write
      #97: internal/util/msgerr.go:150:18: util.ErrText calls http.http2connError.Error
      #98: internal/util/msgerr.go:150:18: util.ErrText calls http.http2connError.Error
      #99: internal/util/msgerr.go:150:18: util.ErrText calls http.http2duplicatePseudoHeaderError.Error
      #100: internal/util/msgerr.go:150:18: util.ErrText calls http.http2duplicatePseudoHeaderError.Error
      #101: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.http2gzipReader.Close
      #102: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.http2gzipReader.Close
      #103: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.http2gzipReader.Read
      #104: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.http2gzipReader.Read
      #105: internal/util/msgerr.go:150:18: util.ErrText calls http.http2headerFieldNameError.Error
      #106: internal/util/msgerr.go:150:18: util.ErrText calls http.http2headerFieldNameError.Error
      #107: internal/util/msgerr.go:150:18: util.ErrText calls http.http2headerFieldValueError.Error
      #108: internal/util/msgerr.go:150:18: util.ErrText calls http.http2headerFieldValueError.Error
      #109: internal/util/msgerr.go:150:18: util.ErrText calls http.http2pseudoHeaderError.Error
      #110: internal/util/msgerr.go:150:18: util.ErrText calls http.http2pseudoHeaderError.Error
      #111: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.http2requestBody.Read
      #112: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.http2requestBody.Read
      #113: internal/api/selfrestart.go:39:10: api.flushResponse calls http.http2responseWriter.Flush
      #114: internal/api/selfrestart.go:39:10: api.flushResponse calls http.http2responseWriter.Flush
      #115: internal/web/setup_gate.go:367:17: web.Server.ServeSignupClosed calls http.http2responseWriter.Write
      #116: internal/web/setup_gate.go:367:17: web.Server.ServeSignupClosed calls http.http2responseWriter.Write
      #117: internal/web/setup_gate.go:366:16: web.Server.ServeSignupClosed calls http.http2responseWriter.WriteHeader
      #118: internal/web/setup_gate.go:366:16: web.Server.ServeSignupClosed calls http.http2responseWriter.WriteHeader
      #119: internal/sockheal/sockheal.go:78:29: sockheal.PingSocket calls io.WriteString, which calls http.http2responseWriter.WriteString
      #120: internal/sockheal/sockheal.go:78:29: sockheal.PingSocket calls io.WriteString, which calls http.http2responseWriter.WriteString
      #121: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.http2stickyErrWriter.Write
      #122: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.http2stickyErrWriter.Write
      #123: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.http2transportResponseBody.Close
      #124: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.http2transportResponseBody.Close
      #125: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.http2transportResponseBody.Read
      #126: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.http2transportResponseBody.Read
      #127: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2writeData.String
      #128: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2writeData.String
      #129: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.loggingConn.Read
      #130: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.loggingConn.Read
      #131: internal/web/claim.go:486:14: web.PrintLocalResetCode calls fmt.Fprintf, which calls http.loggingConn.Write
      #132: internal/web/claim.go:486:14: web.PrintLocalResetCode calls fmt.Fprintf, which calls http.loggingConn.Write
      #133: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.maxBytesReader.Read
      #134: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.maxBytesReader.Read
      #135: internal/web/auth.go:341:16: web.Server.Close calls sync.Once.Do, which eventually calls http.onceCloseListener.Close
      #136: internal/web/auth.go:341:16: web.Server.Close calls sync.Once.Do, which eventually calls http.onceCloseListener.Close
      #137: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.persistConn.Read
      #138: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.persistConn.Read
      #139: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.persistConnWriter.ReadFrom
      #140: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.persistConnWriter.ReadFrom
      #141: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.persistConnWriter.Write
      #142: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.persistConnWriter.Write
      #143: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.readTrackingBody.Read
      #144: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.readTrackingBody.Read
      #145: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.readWriteCloserBody.Read
      #146: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.readWriteCloserBody.Read
      #147: internal/api/selfrestart.go:39:10: api.flushResponse calls http.response.Flush
      #148: internal/api/selfrestart.go:39:10: api.flushResponse calls http.response.Flush
      #149: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.response.ReadFrom
      #150: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.response.ReadFrom
      #151: internal/web/setup_gate.go:367:17: web.Server.ServeSignupClosed calls http.response.Write
      #152: internal/web/setup_gate.go:367:17: web.Server.ServeSignupClosed calls http.response.Write
      #153: internal/web/setup_gate.go:366:16: web.Server.ServeSignupClosed calls http.response.WriteHeader
      #154: internal/web/setup_gate.go:366:16: web.Server.ServeSignupClosed calls http.response.WriteHeader
      #155: internal/sockheal/sockheal.go:78:29: sockheal.PingSocket calls io.WriteString, which calls http.response.WriteString
      #156: internal/sockheal/sockheal.go:78:29: sockheal.PingSocket calls io.WriteString, which calls http.response.WriteString
      #157: internal/util/msgerr.go:150:18: util.ErrText calls http.transportReadFromServerError.Error
      #158: internal/util/msgerr.go:150:18: util.ErrText calls http.transportReadFromServerError.Error

Vulnerability #11: GO-2026-6600
    Recognize yield as regexp preceder keyword in html/template
  More info: https://pkg.go.dev/vuln/GO-2026-6600
  Standard library
    Found in: html/template@go1.26
    Fixed in: html/template@go1.26.9
    Example traces found:
      #1: internal/web/server.go:1076:45: web.Server.executeTemplateLang calls template.Template.ExecuteTemplate

Vulnerability #12: GO-2026-6599
    Reset context tracking on consecutive template expressions in html/template
  More info: https://pkg.go.dev/vuln/GO-2026-6599
  Standard library
    Found in: html/template@go1.26
    Fixed in: html/template@go1.26.9
    Example traces found:
      #1: internal/web/server.go:1076:45: web.Server.executeTemplateLang calls template.Template.ExecuteTemplate

Vulnerability #13: GO-2026-6355
    Prevent DoS on deadlocked established channel in golang.org/x/crypto/ssh
  More info: https://pkg.go.dev/vuln/GO-2026-6355
  Module: golang.org/x/crypto
    Found in: golang.org/x/crypto@v0.31.0
    Fixed in: golang.org/x/crypto@v0.56.0
    Example traces found:
      #1: internal/offsiteapply/seams.go:232:36: offsiteapply.KeyscanScanner.Scan calls ssh.NewClientConn

Vulnerability #14: GO-2026-6354
    Prevent DoS on deadlocked undecided channel in golang.org/x/crypto/ssh
  More info: https://pkg.go.dev/vuln/GO-2026-6354
  Module: golang.org/x/crypto
    Found in: golang.org/x/crypto@v0.31.0
    Fixed in: golang.org/x/crypto@v0.56.0
    Example traces found:
      #1: internal/offsiteapply/seams.go:232:36: offsiteapply.KeyscanScanner.Scan calls ssh.NewClientConn

Vulnerability #15: GO-2026-6218
    Avoid quadratic complexity in resolvePath in net/url
  More info: https://pkg.go.dev/vuln/GO-2026-6218
  Standard library
    Found in: net/url@go1.26
    Fixed in: net/url@go1.26.6
    Example traces found:
      #1: internal/notify/notifier.go:1159:30: notify.Notifier.PushTestEventSync calls http.Client.Do, which eventually calls url.URL.Parse

Vulnerability #16: GO-2026-6091
    Fix Javascript regexp context tracking in html/template
  More info: https://pkg.go.dev/vuln/GO-2026-6091
  Standard library
    Found in: html/template@go1.26
    Fixed in: html/template@go1.26.6
    Example traces found:
      #1: internal/web/server.go:1076:45: web.Server.executeTemplateLang calls template.Template.ExecuteTemplate

Vulnerability #17: GO-2026-6090
    Limit handshake messages we are willing to accept post-handshake in
    crypto/tls
  More info: https://pkg.go.dev/vuln/GO-2026-6090
  Standard library
    Found in: crypto/tls@go1.26
    Fixed in: crypto/tls@go1.26.6
    Example traces found:
      #1: internal/mailrelay/server.go:168:34: mailrelay.Start calls smtp.Server.Serve, which eventually calls tls.Conn.Handshake
      #2: cmd/controller/main.go:2214:33: controller.main calls http.Server.ListenAndServe, which eventually calls tls.Conn.HandshakeContext
      #3: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls tls.Conn.Read
      #4: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls tls.Conn.Write
      #5: internal/notify/notifier.go:1159:30: notify.Notifier.PushTestEventSync calls http.Client.Do, which eventually calls tls.Dialer.DialContext

Vulnerability #18: GO-2026-6089
    Apply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/http
  More info: https://pkg.go.dev/vuln/GO-2026-6089
  Standard library
    Found in: net/http@go1.26
    Fixed in: net/http@go1.26.6
    Example traces found:
      #1: cmd/controller/main.go:2214:33: controller.main calls http.Server.ListenAndServe

Vulnerability #19: GO-2026-5972
    Enforce maximum recursion depth in encoding/asn1
  More info: https://pkg.go.dev/vuln/GO-2026-5972
  Standard library
    Found in: encoding/asn1@go1.26
    Fixed in: encoding/asn1@go1.26.6
    Example traces found:
      #1: internal/offsiteapply/seams.go:312:36: offsiteapply.PublicKeyOf calls ssh.ParsePrivateKey, which eventually calls asn1.Unmarshal

Vulnerability #20: GO-2026-5856
    Invoking Encrypted Client Hello privacy leak in crypto/tls
  More info: https://pkg.go.dev/vuln/GO-2026-5856
  Standard library
    Found in: crypto/tls@go1.26
    Fixed in: crypto/tls@go1.26.5
    Example traces found:
      #1: internal/mailrelay/server.go:168:34: mailrelay.Start calls smtp.Server.Serve, which eventually calls tls.Conn.Handshake
      #2: cmd/controller/main.go:2214:33: controller.main calls http.Server.ListenAndServe, which eventually calls tls.Conn.HandshakeContext
      #3: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls tls.Conn.Read
      #4: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls tls.Conn.Write
      #5: internal/notify/notifier.go:1159:30: notify.Notifier.PushTestEventSync calls http.Client.Do, which eventually calls tls.Dialer.DialContext

Vulnerability #21: GO-2026-5039
    Arbitrary inputs are included in errors without any escaping in
    net/textproto
  More info: https://pkg.go.dev/vuln/GO-2026-5039
  Standard library
    Found in: net/textproto@go1.26
    Fixed in: net/textproto@go1.26.4
    Example traces found:
      #1: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which eventually calls textproto.Reader.ReadMIMEHeader

Vulnerability #22: GO-2026-5037
    Inefficient candidate hostname parsing in crypto/x509
  More info: https://pkg.go.dev/vuln/GO-2026-5037
  Standard library
    Found in: crypto/x509@go1.26
    Fixed in: crypto/x509@go1.26.4
    Example traces found:
      #1: cmd/controller/main.go:2214:33: controller.main calls http.Server.ListenAndServe, which eventually calls x509.Certificate.Verify
      #2: cmd/controller/main.go:2214:33: controller.main calls http.Server.ListenAndServe, which eventually calls x509.Certificate.VerifyHostname
      #3: internal/util/msgerr.go:150:18: util.ErrText calls x509.HostnameError.Error

Vulnerability #23: GO-2026-5026
    Invoking failure to reject ASCII-only Punycode-encoded labels in
    golang.org/x/net/idna
  More info: https://pkg.go.dev/vuln/GO-2026-5026
  Standard library
    Found in: net/http@go1.26
    Fixed in: net/http@go1.26.6
    Example traces found:
      #1: internal/agentapi/client.go:153:53: agentapi.Client.Close calls http.Client.CloseIdleConnections
      #2: internal/notify/notifier.go:1159:30: notify.Notifier.PushTestEventSync calls http.Client.Do
      #3: internal/stacks/setup_gate.go:374:20: stacks.init calls http.Client.Get
      #4: cmd/controller/main.go:2113:29: controller.main calls http.Client.Head

Vulnerability #24: GO-2026-5020
    Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh
  More info: https://pkg.go.dev/vuln/GO-2026-5020
  Module: golang.org/x/crypto
    Found in: golang.org/x/crypto@v0.31.0
    Fixed in: golang.org/x/crypto@v0.52.0
    Example traces found:
      #1: internal/offsiteapply/seams.go:232:36: offsiteapply.KeyscanScanner.Scan calls ssh.NewClientConn

Vulnerability #25: GO-2026-5019
    Invoking bypass of FIDO/U2F security keys physical interaction in
    golang.org/x/crypto/ssh
  More info: https://pkg.go.dev/vuln/GO-2026-5019
  Module: golang.org/x/crypto
    Found in: golang.org/x/crypto@v0.31.0
    Fixed in: golang.org/x/crypto@v0.52.0
    Example traces found:
      #1: internal/offsiteapply/seams.go:232:36: offsiteapply.KeyscanScanner.Scan calls ssh.NewClientConn

Vulnerability #26: GO-2026-5018
    Invoking pathological RSA/DSA parameters may cause DoS in
    golang.org/x/crypto/ssh
  More info: https://pkg.go.dev/vuln/GO-2026-5018
  Module: golang.org/x/crypto
    Found in: golang.org/x/crypto@v0.31.0
    Fixed in: golang.org/x/crypto@v0.52.0
    Example traces found:
      #1: internal/offsiteapply/seams.go:232:36: offsiteapply.KeyscanScanner.Scan calls ssh.NewClientConn
      #2: internal/offsiteapply/seams.go:321:44: offsiteapply.FingerprintOf calls ssh.ParseAuthorizedKey
      #3: internal/offsiteapply/seams.go:312:36: offsiteapply.PublicKeyOf calls ssh.ParsePrivateKey

Vulnerability #27: GO-2026-5017
    Invoking client can cause server deadlock on unexpected responses in
    golang.org/x/crypto/ssh
  More info: https://pkg.go.dev/vuln/GO-2026-5017
  Module: golang.org/x/crypto
    Found in: golang.org/x/crypto@v0.31.0
    Fixed in: golang.org/x/crypto@v0.52.0
    Example traces found:
      #1: internal/offsiteapply/seams.go:232:36: offsiteapply.KeyscanScanner.Scan calls ssh.NewClientConn

Vulnerability #28: GO-2026-5013
    Invoking byte arithmetic causes underflow and panic in
    golang.org/x/crypto/ssh
  More info: https://pkg.go.dev/vuln/GO-2026-5013
  Module: golang.org/x/crypto
    Found in: golang.org/x/crypto@v0.31.0
    Fixed in: golang.org/x/crypto@v0.52.0
    Example traces found:
      #1: internal/offsiteapply/seams.go:232:36: offsiteapply.KeyscanScanner.Scan calls ssh.NewClientConn

Vulnerability #29: GO-2026-4986
    Quadratic string concatentation in consumeComment in net/mail
  More info: https://pkg.go.dev/vuln/GO-2026-4986
  Standard library
    Found in: net/mail@go1.26
    Fixed in: net/mail@go1.26.3
    Example traces found:
      #1: internal/mailrelay/policy.go:49:32: mailrelay.FromDomain calls mail.ParseAddress
      #2: internal/mailrelay/policy.go:52:38: mailrelay.FromDomain calls mail.ParseAddressList

Vulnerability #30: GO-2026-4982
    Bypass of meta content URL escaping causes XSS in html/template
  More info: https://pkg.go.dev/vuln/GO-2026-4982
  Standard library
    Found in: html/template@go1.26
    Fixed in: html/template@go1.26.3
    Example traces found:
      #1: internal/web/server.go:1076:45: web.Server.executeTemplateLang calls template.Template.ExecuteTemplate

Vulnerability #31: GO-2026-4980
    Escaper bypass leads to XSS in html/template
  More info: https://pkg.go.dev/vuln/GO-2026-4980
  Standard library
    Found in: html/template@go1.26
    Fixed in: html/template@go1.26.3
    Example traces found:
      #1: internal/web/server.go:1076:45: web.Server.executeTemplateLang calls template.Template.ExecuteTemplate

Vulnerability #32: GO-2026-4977
    Quadratic string concatenation in consumePhrase in net/mail
  More info: https://pkg.go.dev/vuln/GO-2026-4977
  Standard library
    Found in: net/mail@go1.26
    Fixed in: net/mail@go1.26.3
    Example traces found:
      #1: internal/mailrelay/policy.go:49:32: mailrelay.FromDomain calls mail.ParseAddress
      #2: internal/mailrelay/policy.go:52:38: mailrelay.FromDomain calls mail.ParseAddressList

Vulnerability #33: GO-2026-4971
    Panic in Dial and LookupPort when handling NUL byte on Windows in net
  More info: https://pkg.go.dev/vuln/GO-2026-4971
  Standard library
    Found in: net@go1.26
    Fixed in: net@go1.26.3
    Example traces found:
      #1: internal/stacks/healthprobe.go:227:30: stacks.Manager.probeTCP calls net.DialTimeout
      #2: internal/offsiteapply/seams.go:227:28: offsiteapply.KeyscanScanner.Scan calls net.Dialer.DialContext
      #3: internal/mailrelay/server.go:136:23: mailrelay.Server.Start calls net.Listen
      #4: internal/web/clientaddr.go:68:25: web.peerResolver.has calls net.Resolver.LookupHost

Vulnerability #34: GO-2026-4947
    Unexpected work during chain building in crypto/x509
  More info: https://pkg.go.dev/vuln/GO-2026-4947
  Standard library
    Found in: crypto/x509@go1.26
    Fixed in: crypto/x509@go1.26.2
    Example traces found:
      #1: cmd/controller/main.go:2214:33: controller.main calls http.Server.ListenAndServe, which eventually calls x509.Certificate.Verify

Vulnerability #35: GO-2026-4946
    Inefficient policy validation in crypto/x509
  More info: https://pkg.go.dev/vuln/GO-2026-4946
  Standard library
    Found in: crypto/x509@go1.26
    Fixed in: crypto/x509@go1.26.2
    Example traces found:
      #1: cmd/controller/main.go:2214:33: controller.main calls http.Server.ListenAndServe, which eventually calls x509.Certificate.Verify

Vulnerability #36: GO-2026-4918
    Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in
    net/http/internal/http2 in golang.org/x/net
  More info: https://pkg.go.dev/vuln/GO-2026-4918
  Standard library
    Found in: net/http@go1.26
    Fixed in: net/http@go1.26.3
    Example traces found:
      #1: internal/agentapi/client.go:153:53: agentapi.Client.Close calls http.Client.CloseIdleConnections
      #2: internal/notify/notifier.go:1159:30: notify.Notifier.PushTestEventSync calls http.Client.Do
      #3: internal/stacks/setup_gate.go:374:20: stacks.init calls http.Client.Get
      #4: cmd/controller/main.go:2113:29: controller.main calls http.Client.Head

Vulnerability #37: GO-2026-4870
    Unauthenticated TLS 1.3 KeyUpdate record can cause persistent connection
    retention and DoS in crypto/tls
  More info: https://pkg.go.dev/vuln/GO-2026-4870
  Standard library
    Found in: crypto/tls@go1.26
    Fixed in: crypto/tls@go1.26.2
    Example traces found:
      #1: internal/mailrelay/server.go:168:34: mailrelay.Start calls smtp.Server.Serve, which eventually calls tls.Conn.Handshake
      #2: cmd/controller/main.go:2214:33: controller.main calls http.Server.ListenAndServe, which eventually calls tls.Conn.HandshakeContext
      #3: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls tls.Conn.Read
      #4: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls tls.Conn.Write
      #5: internal/notify/notifier.go:1159:30: notify.Notifier.PushTestEventSync calls http.Client.Do, which eventually calls tls.Dialer.DialContext

Vulnerability #38: GO-2026-4869
    Unbounded allocation for old GNU sparse in archive/tar
  More info: https://pkg.go.dev/vuln/GO-2026-4869
  Standard library
    Found in: archive/tar@go1.26
    Fixed in: archive/tar@go1.26.2
    Example traces found:
      #1: internal/appexport/restore.go:145:22: appexport.ReadManifestFromFAB calls tar.Reader.Next

Vulnerability #39: GO-2026-4866
    Case-sensitive excludedSubtrees name constraints cause Auth Bypass in
    crypto/x509
  More info: https://pkg.go.dev/vuln/GO-2026-4866
  Standard library
    Found in: crypto/x509@go1.26
    Fixed in: crypto/x509@go1.26.2
    Example traces found:
      #1: cmd/controller/main.go:2214:33: controller.main calls http.Server.ListenAndServe, which eventually calls x509.Certificate.Verify

Vulnerability #40: GO-2026-4865
    JsBraceDepth Context Tracking Bugs (XSS) in html/template
  More info: https://pkg.go.dev/vuln/GO-2026-4865
  Standard library
    Found in: html/template@go1.26
    Fixed in: html/template@go1.26.2
    Example traces found:
      #1: internal/util/msgerr.go:150:18: util.ErrText calls template.Error.Error
      #2: internal/web/server.go:1076:45: web.Server.executeTemplateLang calls template.Template.ExecuteTemplate
      #3: internal/setup/handlers.go:78:25: setup.Server.loadTemplates calls template.Template.Funcs
      #4: internal/web/server.go:392:26: web.parseTemplateSet calls template.Template.Parse
      #5: internal/setup/handlers.go:80:13: setup.Server.loadTemplates calls template.Template.ParseFS
      #6: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls template.context.String

Vulnerability #41: GO-2026-4603
    URLs in meta content attribute actions are not escaped in html/template
  More info: https://pkg.go.dev/vuln/GO-2026-4603
  Standard library
    Found in: html/template@go1.26
    Fixed in: html/template@go1.26.1
    Example traces found:
      #1: internal/web/server.go:1076:45: web.Server.executeTemplateLang calls template.Template.ExecuteTemplate

Vulnerability #42: GO-2026-4602
    FileInfo can escape from a Root in os
  More info: https://pkg.go.dev/vuln/GO-2026-4602
  Standard library
    Found in: os@go1.26
    Fixed in: os@go1.26.1
    Example traces found:
      #1: internal/web/server.go:1163:16: web.Server.serveAsset calls http.ServeFile, which eventually calls os.File.ReadDir
      #2: internal/web/server.go:1163:16: web.Server.serveAsset calls http.ServeFile, which eventually calls os.File.Readdir
      #3: internal/backup/offbox_reconstitute.go:1110:32: backup.Manager.OffsiteScratchPair calls os.ReadDir

Vulnerability #43: GO-2026-4601
    Incorrect parsing of IPv6 host literals in net/url
  More info: https://pkg.go.dev/vuln/GO-2026-4601
  Standard library
    Found in: net/url@go1.26
    Fixed in: net/url@go1.26.1
    Example traces found:
      #1: internal/web/family_gate.go:258:24: web.Server.ServeFamilyGateAuth calls url.Parse
      #2: cmd/controller/main.go:2214:33: controller.main calls http.Server.ListenAndServe, which eventually calls url.ParseRequestURI
      #3: internal/notify/notifier.go:1159:30: notify.Notifier.PushTestEventSync calls http.Client.Do, which eventually calls url.URL.Parse

Vulnerability #44: GO-2026-4600
    Panic in name constraint checking for malformed certificates in crypto/x509
  More info: https://pkg.go.dev/vuln/GO-2026-4600
  Standard library
    Found in: crypto/x509@go1.26
    Fixed in: crypto/x509@go1.26.1
    Example traces found:
      #1: cmd/controller/main.go:2214:33: controller.main calls http.Server.ListenAndServe, which eventually calls x509.Certificate.Verify

Vulnerability #45: GO-2026-4599
    Incorrect enforcement of email constraints in crypto/x509
  More info: https://pkg.go.dev/vuln/GO-2026-4599
  Standard library
    Found in: crypto/x509@go1.26
    Fixed in: crypto/x509@go1.26.1
    Example traces found:
      #1: cmd/controller/main.go:2214:33: controller.main calls http.Server.ListenAndServe, which eventually calls x509.Certificate.Verify

Vulnerability #46: GO-2025-3487
    Potential denial of service in golang.org/x/crypto
  More info: https://pkg.go.dev/vuln/GO-2025-3487
  Module: golang.org/x/crypto
    Found in: golang.org/x/crypto@v0.31.0
    Fixed in: golang.org/x/crypto@v0.35.0
    Example traces found:
      #1: internal/offsiteapply/seams.go:232:36: offsiteapply.KeyscanScanner.Scan calls ssh.NewClientConn

Your code is affected by 46 vulnerabilities from 1 module and the Go standard library.
This scan also found 13 vulnerabilities in packages you import and 9
vulnerabilities in modules you require, but your code doesn't appear to call
these vulnerabilities.
Use '-show verbose' for more details.
