=== Symbol Results ===

Vulnerability #1: GO-2026-6617
    HTTP/2 server crash due to HPACK encoder race in net/http
  More info: https://pkg.go.dev/vuln/GO-2026-6617
  Standard library
    Found in: net/http@go1.26
    Fixed in: net/http@go1.26.9
    Example traces found:
      #1: internal/cloudflare/reach.go:37:36: cloudflare.TokenZones calls http.Client.Do
      #2: internal/cloudflare/reach.go:37:36: cloudflare.TokenZones calls http.Client.Do
      #3: internal/web/server.go:458:15: web.Server.ServeHTTP calls http.Error
      #4: internal/web/server.go:458:15: web.Server.ServeHTTP calls http.Error
      #5: internal/api/handler.go:2867:26: api.Handler.handleArtifactManifest calls http.Header.Get
      #6: internal/api/handler.go:2867:26: api.Handler.handleArtifactManifest calls http.Header.Get
      #7: internal/web/server.go:470:17: web.Server.ServeHTTP calls http.Header.Set
      #8: internal/web/server.go:470:17: web.Server.ServeHTTP calls http.Header.Set
      #9: internal/web/templatefetcher.go:56:29: web.TemplateFetcher.fetch calls http.NewRequest
      #10: internal/web/templatefetcher.go:56:29: web.TemplateFetcher.fetch calls http.NewRequest
      #11: internal/cloudflare/reach.go:32:40: cloudflare.TokenZones calls http.NewRequestWithContext
      #12: internal/cloudflare/reach.go:32:40: cloudflare.TokenZones calls http.NewRequestWithContext
      #13: internal/web/server.go:478:17: web.Server.ServeHTTP calls http.NotFound
      #14: internal/web/server.go:478:17: web.Server.ServeHTTP calls http.NotFound
      #15: internal/web/server.go:855:16: web.Server.ServeHTTP calls http.Redirect
      #16: internal/web/server.go:855:16: web.Server.ServeHTTP calls http.Redirect
      #17: internal/web/server.go:981:29: web.Server.validateCSRF calls http.Request.BasicAuth
      #18: internal/web/server.go:981:29: web.Server.validateCSRF calls http.Request.BasicAuth
      #19: internal/web/server.go:979:25: web.Server.validateCSRF calls http.Request.Cookie
      #20: internal/web/server.go:979:25: web.Server.validateCSRF calls http.Request.Cookie
      #21: internal/web/server.go:762:43: web.Server.ServeHTTP calls http.Request.FormValue
      #22: internal/web/server.go:762:43: web.Server.ServeHTTP calls http.Request.FormValue
      #23: internal/web/configs.go:1592:23: web.Server.handleSetCustomerFloor calls http.Request.ParseForm
      #24: internal/web/configs.go:1592:23: web.Server.handleSetCustomerFloor calls http.Request.ParseForm
      #25: internal/gitea/gitea.go:234:19: gitea.Client.probe calls http.Request.SetBasicAuth
      #26: internal/gitea/gitea.go:234:19: gitea.Client.probe calls http.Request.SetBasicAuth
      #27: internal/api/wait.go:73:20: api.Handler.handleWait calls http.ResponseController.Flush
      #28: internal/api/wait.go:73:20: api.Handler.handleWait calls http.ResponseController.Flush
      #29: internal/api/wait.go:67:25: api.Handler.handleWait calls http.ResponseController.SetWriteDeadline
      #30: internal/api/wait.go:67:25: api.Handler.handleWait calls http.ResponseController.SetWriteDeadline
      #31: internal/assets/assets.go:215:16: assets.Manager.ServeFile calls http.ServeFile
      #32: internal/assets/assets.go:215:16: assets.Manager.ServeFile calls http.ServeFile
      #33: cmd/hub/main.go:640:12: hub.main calls http.ServeMux.Handle
      #34: cmd/hub/main.go:640:12: hub.main calls http.ServeMux.Handle
      #35: cmd/hub/main.go:629:16: hub.main calls http.ServeMux.HandleFunc
      #36: cmd/hub/main.go:629:16: hub.main calls http.ServeMux.HandleFunc
      #37: cmd/hub/main.go:932:33: hub.main calls http.Server.ListenAndServe
      #38: cmd/hub/main.go:932:33: hub.main calls http.Server.ListenAndServe
      #39: cmd/hub/main.go:926:28: hub.main calls http.Server.Shutdown
      #40: cmd/hub/main.go:926:28: hub.main calls http.Server.Shutdown
      #41: internal/web/server.go:939:18: web.Server.handleLogin calls http.SetCookie
      #42: internal/web/server.go:939:18: web.Server.handleLogin calls http.SetCookie
      #43: internal/gitea/gitea.go:42:53: gitea.New calls http.Transport.Clone
      #44: internal/gitea/gitea.go:42:53: gitea.New calls http.Transport.Clone
      #45: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.body.Close
      #46: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.body.Close
      #47: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which calls http.body.Read
      #48: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which calls http.body.Read
      #49: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.bodyEOFSignal.Close
      #50: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.bodyEOFSignal.Close
      #51: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.bodyEOFSignal.Read
      #52: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.bodyEOFSignal.Read
      #53: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.bodyLocked.Read
      #54: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.bodyLocked.Read
      #55: internal/gitea/gitea.go:241:16: gitea.Client.probe calls io.Copy, which eventually calls http.bufioFlushWriter.Write
      #56: internal/gitea/gitea.go:241:16: gitea.Client.probe calls io.Copy, which eventually calls http.bufioFlushWriter.Write
      #57: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.cancelTimerBody.Close
      #58: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.cancelTimerBody.Close
      #59: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.cancelTimerBody.Read
      #60: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.cancelTimerBody.Read
      #61: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which eventually calls http.checkConnErrorWriter.Write
      #62: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which eventually calls http.checkConnErrorWriter.Write
      #63: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which eventually calls http.chunkWriter.Write
      #64: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which eventually calls http.chunkWriter.Write
      #65: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.connReader.Read
      #66: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.connReader.Read
      #67: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which calls http.expectContinueReader.Read
      #68: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which calls http.expectContinueReader.Read
      #69: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.gzipReader.Close
      #70: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.gzipReader.Close
      #71: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.gzipReader.Read
      #72: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.gzipReader.Read
      #73: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2ConnectionError.Error
      #74: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2ConnectionError.Error
      #75: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2ErrCode.String
      #76: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2ErrCode.String
      #77: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2FrameHeader.String
      #78: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2FrameHeader.String
      #79: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2FrameType.String
      #80: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2FrameType.String
      #81: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2FrameWriteRequest.String
      #82: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2FrameWriteRequest.String
      #83: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2GoAwayError.Error
      #84: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2GoAwayError.Error
      #85: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2Setting.String
      #86: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2Setting.String
      #87: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2SettingID.String
      #88: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2SettingID.String
      #89: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2StreamError.Error
      #90: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2StreamError.Error
      #91: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which eventually calls http.http2bufferedWriterTimeoutWriter.Write
      #92: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which eventually calls http.http2bufferedWriterTimeoutWriter.Write
      #93: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which eventually calls http.http2chunkWriter.Write
      #94: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which eventually calls http.http2chunkWriter.Write
      #95: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2connError.Error
      #96: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2connError.Error
      #97: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2duplicatePseudoHeaderError.Error
      #98: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2duplicatePseudoHeaderError.Error
      #99: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.http2gzipReader.Close
      #100: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.http2gzipReader.Close
      #101: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.http2gzipReader.Read
      #102: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.http2gzipReader.Read
      #103: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2headerFieldNameError.Error
      #104: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2headerFieldNameError.Error
      #105: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2headerFieldValueError.Error
      #106: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2headerFieldValueError.Error
      #107: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2pseudoHeaderError.Error
      #108: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2pseudoHeaderError.Error
      #109: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which calls http.http2requestBody.Read
      #110: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which calls http.http2requestBody.Read
      #111: internal/web/server.go:472:10: web.Server.ServeHTTP calls http.http2responseWriter.Write
      #112: internal/web/server.go:472:10: web.Server.ServeHTTP calls http.http2responseWriter.Write
      #113: internal/api/handler.go:2904:15: api.Handler.handleArtifactManifest calls http.http2responseWriter.WriteHeader
      #114: internal/api/handler.go:2904:15: api.Handler.handleArtifactManifest calls http.http2responseWriter.WriteHeader
      #115: internal/store/logbundle.go:141:24: store.Store.SaveLogBundle calls gzip.Writer.Write, which eventually calls http.http2responseWriter.WriteString
      #116: internal/store/logbundle.go:141:24: store.Store.SaveLogBundle calls gzip.Writer.Write, which eventually calls http.http2responseWriter.WriteString
      #117: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which eventually calls http.http2stickyErrWriter.Write
      #118: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which eventually calls http.http2stickyErrWriter.Write
      #119: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.http2transportResponseBody.Close
      #120: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.http2transportResponseBody.Close
      #121: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.http2transportResponseBody.Read
      #122: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.http2transportResponseBody.Read
      #123: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2writeData.String
      #124: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2writeData.String
      #125: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.loggingConn.Read
      #126: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.loggingConn.Read
      #127: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which calls http.loggingConn.Write
      #128: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which calls http.loggingConn.Write
      #129: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.maxBytesReader.Read
      #130: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.maxBytesReader.Read
      #131: internal/i18n/i18n.go:118:15: i18n.Shared calls sync.Once.Do, which eventually calls http.onceCloseListener.Close
      #132: internal/i18n/i18n.go:118:15: i18n.Shared calls sync.Once.Do, which eventually calls http.onceCloseListener.Close
      #133: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.persistConn.Read
      #134: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.persistConn.Read
      #135: internal/gitea/gitea.go:241:16: gitea.Client.probe calls io.Copy, which eventually calls http.persistConnWriter.ReadFrom
      #136: internal/gitea/gitea.go:241:16: gitea.Client.probe calls io.Copy, which eventually calls http.persistConnWriter.ReadFrom
      #137: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which eventually calls http.persistConnWriter.Write
      #138: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which eventually calls http.persistConnWriter.Write
      #139: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which calls http.readTrackingBody.Read
      #140: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which calls http.readTrackingBody.Read
      #141: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.readWriteCloserBody.Read
      #142: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.readWriteCloserBody.Read
      #143: internal/gitea/gitea.go:241:16: gitea.Client.probe calls io.Copy, which eventually calls http.response.ReadFrom
      #144: internal/gitea/gitea.go:241:16: gitea.Client.probe calls io.Copy, which eventually calls http.response.ReadFrom
      #145: internal/web/server.go:472:10: web.Server.ServeHTTP calls http.response.Write
      #146: internal/web/server.go:472:10: web.Server.ServeHTTP calls http.response.Write
      #147: internal/api/handler.go:2904:15: api.Handler.handleArtifactManifest calls http.response.WriteHeader
      #148: internal/api/handler.go:2904:15: api.Handler.handleArtifactManifest calls http.response.WriteHeader
      #149: internal/store/logbundle.go:141:24: store.Store.SaveLogBundle calls gzip.Writer.Write, which eventually calls http.response.WriteString
      #150: internal/store/logbundle.go:141:24: store.Store.SaveLogBundle calls gzip.Writer.Write, which eventually calls http.response.WriteString
      #151: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.transportReadFromServerError.Error
      #152: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.transportReadFromServerError.Error

Vulnerability #2: GO-2026-6613
    HTTP/1 server connection desynchronization after 2xx CONNECT response in
    net/http
  More info: https://pkg.go.dev/vuln/GO-2026-6613
  Standard library
    Found in: net/http@go1.26
    Fixed in: net/http@go1.26.9
    Example traces found:
      #1: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.http2transportResponseBody.Close, which eventually calls http.CanonicalHeaderKey
      #2: internal/cloudflare/reach.go:37:36: cloudflare.TokenZones calls http.Client.Do
      #3: internal/web/server.go:458:15: web.Server.ServeHTTP calls http.Error
      #4: internal/api/handler.go:2904:15: api.Handler.handleArtifactManifest calls http.http2responseWriter.WriteHeader, which eventually calls http.Header.Del
      #5: internal/api/handler.go:2867:26: api.Handler.handleArtifactManifest calls http.Header.Get
      #6: internal/web/server.go:470:17: web.Server.ServeHTTP calls http.Header.Set
      #7: internal/web/templatefetcher.go:56:29: web.TemplateFetcher.fetch calls http.NewRequest
      #8: internal/cloudflare/reach.go:32:40: cloudflare.TokenZones calls http.NewRequestWithContext
      #9: internal/web/server.go:478:17: web.Server.ServeHTTP calls http.NotFound
      #10: internal/web/server.go:855:16: web.Server.ServeHTTP calls http.Redirect
      #11: internal/web/server.go:981:29: web.Server.validateCSRF calls http.Request.BasicAuth
      #12: internal/web/server.go:979:25: web.Server.validateCSRF calls http.Request.Cookie
      #13: internal/web/server.go:762:43: web.Server.ServeHTTP calls http.Request.FormValue
      #14: internal/web/configs.go:1592:23: web.Server.handleSetCustomerFloor calls http.Request.ParseForm
      #15: internal/gitea/gitea.go:234:19: gitea.Client.probe calls http.Request.SetBasicAuth
      #16: internal/api/wait.go:73:20: api.Handler.handleWait calls http.ResponseController.Flush
      #17: internal/api/wait.go:67:25: api.Handler.handleWait calls http.ResponseController.SetWriteDeadline
      #18: internal/assets/assets.go:215:16: assets.Manager.ServeFile calls http.ServeFile
      #19: cmd/hub/main.go:640:12: hub.main calls http.ServeMux.Handle
      #20: cmd/hub/main.go:629:16: hub.main calls http.ServeMux.HandleFunc
      #21: cmd/hub/main.go:932:33: hub.main calls http.Server.ListenAndServe
      #22: cmd/hub/main.go:926:28: hub.main calls http.Server.Shutdown
      #23: internal/web/server.go:939:18: web.Server.handleLogin calls http.SetCookie
      #24: internal/gitea/gitea.go:42:53: gitea.New calls http.Transport.Clone
      #25: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.body.Close
      #26: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which calls http.body.Read
      #27: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.bodyEOFSignal.Close
      #28: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.bodyEOFSignal.Read
      #29: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.bodyLocked.Read
      #30: internal/gitea/gitea.go:241:16: gitea.Client.probe calls io.Copy, which eventually calls http.bufioFlushWriter.Write
      #31: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.cancelTimerBody.Close
      #32: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.cancelTimerBody.Read
      #33: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.http2transportResponseBody.Close, which eventually calls http.checkConnErrorWriter.Write
      #34: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.http2transportResponseBody.Close, which eventually calls http.chunkWriter.Write
      #35: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.connReader.Read
      #36: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.http2transportResponseBody.Close, which eventually calls http.expectContinueReader.Close
      #37: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which calls http.expectContinueReader.Read
      #38: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.gzipReader.Close
      #39: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.gzipReader.Read
      #40: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.loggingConn.Read
      #41: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which calls http.loggingConn.Write
      #42: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.maxBytesReader.Read
      #43: internal/i18n/i18n.go:118:15: i18n.Shared calls sync.Once.Do, which eventually calls http.onceCloseListener.Close
      #44: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.persistConn.Read
      #45: internal/gitea/gitea.go:241:16: gitea.Client.probe calls io.Copy, which eventually calls http.persistConnWriter.ReadFrom
      #46: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.http2transportResponseBody.Close, which eventually calls http.persistConnWriter.Write
      #47: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.http2transportResponseBody.Close, which eventually calls http.readTrackingBody.Close
      #48: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which calls http.readTrackingBody.Read
      #49: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.readWriteCloserBody.Read
      #50: internal/gitea/gitea.go:241:16: gitea.Client.probe calls io.Copy, which eventually calls http.response.ReadFrom
      #51: internal/web/server.go:472:10: web.Server.ServeHTTP calls http.response.Write
      #52: internal/api/handler.go:2904:15: api.Handler.handleArtifactManifest calls http.response.WriteHeader
      #53: internal/store/logbundle.go:141:24: store.Store.SaveLogBundle calls gzip.Writer.Write, which eventually calls http.response.WriteString
      #54: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.transportReadFromServerError.Error

Vulnerability #3: GO-2026-6612
    Double flow control refund on HTTP/2 server streams in net/http
  More info: https://pkg.go.dev/vuln/GO-2026-6612
  Standard library
    Found in: net/http@go1.26
    Fixed in: net/http@go1.26.9
    Example traces found:
      #1: internal/cloudflare/reach.go:37:36: cloudflare.TokenZones calls http.Client.Do
      #2: internal/cloudflare/reach.go:37:36: cloudflare.TokenZones calls http.Client.Do
      #3: internal/web/server.go:458:15: web.Server.ServeHTTP calls http.Error
      #4: internal/web/server.go:458:15: web.Server.ServeHTTP calls http.Error
      #5: internal/api/handler.go:2867:26: api.Handler.handleArtifactManifest calls http.Header.Get
      #6: internal/api/handler.go:2867:26: api.Handler.handleArtifactManifest calls http.Header.Get
      #7: internal/web/server.go:470:17: web.Server.ServeHTTP calls http.Header.Set
      #8: internal/web/server.go:470:17: web.Server.ServeHTTP calls http.Header.Set
      #9: internal/web/templatefetcher.go:56:29: web.TemplateFetcher.fetch calls http.NewRequest
      #10: internal/web/templatefetcher.go:56:29: web.TemplateFetcher.fetch calls http.NewRequest
      #11: internal/cloudflare/reach.go:32:40: cloudflare.TokenZones calls http.NewRequestWithContext
      #12: internal/cloudflare/reach.go:32:40: cloudflare.TokenZones calls http.NewRequestWithContext
      #13: internal/web/server.go:478:17: web.Server.ServeHTTP calls http.NotFound
      #14: internal/web/server.go:478:17: web.Server.ServeHTTP calls http.NotFound
      #15: internal/web/server.go:855:16: web.Server.ServeHTTP calls http.Redirect
      #16: internal/web/server.go:855:16: web.Server.ServeHTTP calls http.Redirect
      #17: internal/web/server.go:981:29: web.Server.validateCSRF calls http.Request.BasicAuth
      #18: internal/web/server.go:981:29: web.Server.validateCSRF calls http.Request.BasicAuth
      #19: internal/web/server.go:979:25: web.Server.validateCSRF calls http.Request.Cookie
      #20: internal/web/server.go:979:25: web.Server.validateCSRF calls http.Request.Cookie
      #21: internal/web/server.go:762:43: web.Server.ServeHTTP calls http.Request.FormValue
      #22: internal/web/server.go:762:43: web.Server.ServeHTTP calls http.Request.FormValue
      #23: internal/web/configs.go:1592:23: web.Server.handleSetCustomerFloor calls http.Request.ParseForm
      #24: internal/web/configs.go:1592:23: web.Server.handleSetCustomerFloor calls http.Request.ParseForm
      #25: internal/gitea/gitea.go:234:19: gitea.Client.probe calls http.Request.SetBasicAuth
      #26: internal/gitea/gitea.go:234:19: gitea.Client.probe calls http.Request.SetBasicAuth
      #27: internal/api/wait.go:73:20: api.Handler.handleWait calls http.ResponseController.Flush
      #28: internal/api/wait.go:73:20: api.Handler.handleWait calls http.ResponseController.Flush
      #29: internal/api/wait.go:67:25: api.Handler.handleWait calls http.ResponseController.SetWriteDeadline
      #30: internal/api/wait.go:67:25: api.Handler.handleWait calls http.ResponseController.SetWriteDeadline
      #31: internal/assets/assets.go:215:16: assets.Manager.ServeFile calls http.ServeFile
      #32: internal/assets/assets.go:215:16: assets.Manager.ServeFile calls http.ServeFile
      #33: cmd/hub/main.go:640:12: hub.main calls http.ServeMux.Handle
      #34: cmd/hub/main.go:640:12: hub.main calls http.ServeMux.Handle
      #35: cmd/hub/main.go:629:16: hub.main calls http.ServeMux.HandleFunc
      #36: cmd/hub/main.go:629:16: hub.main calls http.ServeMux.HandleFunc
      #37: cmd/hub/main.go:932:33: hub.main calls http.Server.ListenAndServe
      #38: cmd/hub/main.go:932:33: hub.main calls http.Server.ListenAndServe
      #39: cmd/hub/main.go:926:28: hub.main calls http.Server.Shutdown
      #40: cmd/hub/main.go:926:28: hub.main calls http.Server.Shutdown
      #41: internal/web/server.go:939:18: web.Server.handleLogin calls http.SetCookie
      #42: internal/web/server.go:939:18: web.Server.handleLogin calls http.SetCookie
      #43: internal/gitea/gitea.go:42:53: gitea.New calls http.Transport.Clone
      #44: internal/gitea/gitea.go:42:53: gitea.New calls http.Transport.Clone
      #45: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.body.Close
      #46: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.body.Close
      #47: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which calls http.body.Read
      #48: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which calls http.body.Read
      #49: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.bodyEOFSignal.Close
      #50: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.bodyEOFSignal.Close
      #51: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.bodyEOFSignal.Read
      #52: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.bodyEOFSignal.Read
      #53: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.bodyLocked.Read
      #54: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.bodyLocked.Read
      #55: internal/gitea/gitea.go:241:16: gitea.Client.probe calls io.Copy, which eventually calls http.bufioFlushWriter.Write
      #56: internal/gitea/gitea.go:241:16: gitea.Client.probe calls io.Copy, which eventually calls http.bufioFlushWriter.Write
      #57: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.cancelTimerBody.Close
      #58: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.cancelTimerBody.Close
      #59: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.cancelTimerBody.Read
      #60: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.cancelTimerBody.Read
      #61: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which eventually calls http.checkConnErrorWriter.Write
      #62: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which eventually calls http.checkConnErrorWriter.Write
      #63: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which eventually calls http.chunkWriter.Write
      #64: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which eventually calls http.chunkWriter.Write
      #65: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.connReader.Read
      #66: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.connReader.Read
      #67: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which calls http.expectContinueReader.Read
      #68: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which calls http.expectContinueReader.Read
      #69: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.gzipReader.Close
      #70: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.gzipReader.Close
      #71: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.gzipReader.Read
      #72: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.gzipReader.Read
      #73: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2ConnectionError.Error
      #74: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2ConnectionError.Error
      #75: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2ErrCode.String
      #76: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2ErrCode.String
      #77: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2FrameHeader.String
      #78: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2FrameHeader.String
      #79: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2FrameType.String
      #80: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2FrameType.String
      #81: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2FrameWriteRequest.String
      #82: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2FrameWriteRequest.String
      #83: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2GoAwayError.Error
      #84: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2GoAwayError.Error
      #85: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2Setting.String
      #86: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2Setting.String
      #87: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2SettingID.String
      #88: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2SettingID.String
      #89: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2StreamError.Error
      #90: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2StreamError.Error
      #91: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which eventually calls http.http2bufferedWriterTimeoutWriter.Write
      #92: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which eventually calls http.http2bufferedWriterTimeoutWriter.Write
      #93: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which eventually calls http.http2chunkWriter.Write
      #94: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which eventually calls http.http2chunkWriter.Write
      #95: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2connError.Error
      #96: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2connError.Error
      #97: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2duplicatePseudoHeaderError.Error
      #98: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2duplicatePseudoHeaderError.Error
      #99: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.http2gzipReader.Close
      #100: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.http2gzipReader.Close
      #101: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.http2gzipReader.Read
      #102: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.http2gzipReader.Read
      #103: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2headerFieldNameError.Error
      #104: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2headerFieldNameError.Error
      #105: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2headerFieldValueError.Error
      #106: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2headerFieldValueError.Error
      #107: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2pseudoHeaderError.Error
      #108: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2pseudoHeaderError.Error
      #109: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which calls http.http2requestBody.Read
      #110: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which calls http.http2requestBody.Read
      #111: internal/web/server.go:472:10: web.Server.ServeHTTP calls http.http2responseWriter.Write
      #112: internal/web/server.go:472:10: web.Server.ServeHTTP calls http.http2responseWriter.Write
      #113: internal/api/handler.go:2904:15: api.Handler.handleArtifactManifest calls http.http2responseWriter.WriteHeader
      #114: internal/api/handler.go:2904:15: api.Handler.handleArtifactManifest calls http.http2responseWriter.WriteHeader
      #115: internal/store/logbundle.go:141:24: store.Store.SaveLogBundle calls gzip.Writer.Write, which eventually calls http.http2responseWriter.WriteString
      #116: internal/store/logbundle.go:141:24: store.Store.SaveLogBundle calls gzip.Writer.Write, which eventually calls http.http2responseWriter.WriteString
      #117: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which eventually calls http.http2stickyErrWriter.Write
      #118: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which eventually calls http.http2stickyErrWriter.Write
      #119: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.http2transportResponseBody.Close
      #120: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.http2transportResponseBody.Close
      #121: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.http2transportResponseBody.Read
      #122: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.http2transportResponseBody.Read
      #123: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2writeData.String
      #124: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2writeData.String
      #125: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.loggingConn.Read
      #126: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.loggingConn.Read
      #127: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which calls http.loggingConn.Write
      #128: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which calls http.loggingConn.Write
      #129: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.maxBytesReader.Read
      #130: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.maxBytesReader.Read
      #131: internal/i18n/i18n.go:118:15: i18n.Shared calls sync.Once.Do, which eventually calls http.onceCloseListener.Close
      #132: internal/i18n/i18n.go:118:15: i18n.Shared calls sync.Once.Do, which eventually calls http.onceCloseListener.Close
      #133: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.persistConn.Read
      #134: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.persistConn.Read
      #135: internal/gitea/gitea.go:241:16: gitea.Client.probe calls io.Copy, which eventually calls http.persistConnWriter.ReadFrom
      #136: internal/gitea/gitea.go:241:16: gitea.Client.probe calls io.Copy, which eventually calls http.persistConnWriter.ReadFrom
      #137: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which eventually calls http.persistConnWriter.Write
      #138: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which eventually calls http.persistConnWriter.Write
      #139: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which calls http.readTrackingBody.Read
      #140: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which calls http.readTrackingBody.Read
      #141: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.readWriteCloserBody.Read
      #142: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.readWriteCloserBody.Read
      #143: internal/gitea/gitea.go:241:16: gitea.Client.probe calls io.Copy, which eventually calls http.response.ReadFrom
      #144: internal/gitea/gitea.go:241:16: gitea.Client.probe calls io.Copy, which eventually calls http.response.ReadFrom
      #145: internal/web/server.go:472:10: web.Server.ServeHTTP calls http.response.Write
      #146: internal/web/server.go:472:10: web.Server.ServeHTTP calls http.response.Write
      #147: internal/api/handler.go:2904:15: api.Handler.handleArtifactManifest calls http.response.WriteHeader
      #148: internal/api/handler.go:2904:15: api.Handler.handleArtifactManifest calls http.response.WriteHeader
      #149: internal/store/logbundle.go:141:24: store.Store.SaveLogBundle calls gzip.Writer.Write, which eventually calls http.response.WriteString
      #150: internal/store/logbundle.go:141:24: store.Store.SaveLogBundle calls gzip.Writer.Write, which eventually calls http.response.WriteString
      #151: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.transportReadFromServerError.Error
      #152: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.transportReadFromServerError.Error

Vulnerability #4: GO-2026-6611
    Excessive CPU consumption from repeated initial window changes in net/http
  More info: https://pkg.go.dev/vuln/GO-2026-6611
  Standard library
    Found in: net/http@go1.26
    Fixed in: net/http@go1.26.9
    Example traces found:
      #1: internal/cloudflare/reach.go:37:36: cloudflare.TokenZones calls http.Client.Do
      #2: internal/cloudflare/reach.go:37:36: cloudflare.TokenZones calls http.Client.Do
      #3: internal/web/server.go:458:15: web.Server.ServeHTTP calls http.Error
      #4: internal/web/server.go:458:15: web.Server.ServeHTTP calls http.Error
      #5: internal/api/handler.go:2867:26: api.Handler.handleArtifactManifest calls http.Header.Get
      #6: internal/api/handler.go:2867:26: api.Handler.handleArtifactManifest calls http.Header.Get
      #7: internal/web/server.go:470:17: web.Server.ServeHTTP calls http.Header.Set
      #8: internal/web/server.go:470:17: web.Server.ServeHTTP calls http.Header.Set
      #9: internal/web/templatefetcher.go:56:29: web.TemplateFetcher.fetch calls http.NewRequest
      #10: internal/web/templatefetcher.go:56:29: web.TemplateFetcher.fetch calls http.NewRequest
      #11: internal/cloudflare/reach.go:32:40: cloudflare.TokenZones calls http.NewRequestWithContext
      #12: internal/cloudflare/reach.go:32:40: cloudflare.TokenZones calls http.NewRequestWithContext
      #13: internal/web/server.go:478:17: web.Server.ServeHTTP calls http.NotFound
      #14: internal/web/server.go:478:17: web.Server.ServeHTTP calls http.NotFound
      #15: internal/web/server.go:855:16: web.Server.ServeHTTP calls http.Redirect
      #16: internal/web/server.go:855:16: web.Server.ServeHTTP calls http.Redirect
      #17: internal/web/server.go:981:29: web.Server.validateCSRF calls http.Request.BasicAuth
      #18: internal/web/server.go:981:29: web.Server.validateCSRF calls http.Request.BasicAuth
      #19: internal/web/server.go:979:25: web.Server.validateCSRF calls http.Request.Cookie
      #20: internal/web/server.go:979:25: web.Server.validateCSRF calls http.Request.Cookie
      #21: internal/web/server.go:762:43: web.Server.ServeHTTP calls http.Request.FormValue
      #22: internal/web/server.go:762:43: web.Server.ServeHTTP calls http.Request.FormValue
      #23: internal/web/configs.go:1592:23: web.Server.handleSetCustomerFloor calls http.Request.ParseForm
      #24: internal/web/configs.go:1592:23: web.Server.handleSetCustomerFloor calls http.Request.ParseForm
      #25: internal/gitea/gitea.go:234:19: gitea.Client.probe calls http.Request.SetBasicAuth
      #26: internal/gitea/gitea.go:234:19: gitea.Client.probe calls http.Request.SetBasicAuth
      #27: internal/api/wait.go:73:20: api.Handler.handleWait calls http.ResponseController.Flush
      #28: internal/api/wait.go:73:20: api.Handler.handleWait calls http.ResponseController.Flush
      #29: internal/api/wait.go:67:25: api.Handler.handleWait calls http.ResponseController.SetWriteDeadline
      #30: internal/api/wait.go:67:25: api.Handler.handleWait calls http.ResponseController.SetWriteDeadline
      #31: internal/assets/assets.go:215:16: assets.Manager.ServeFile calls http.ServeFile
      #32: internal/assets/assets.go:215:16: assets.Manager.ServeFile calls http.ServeFile
      #33: cmd/hub/main.go:640:12: hub.main calls http.ServeMux.Handle
      #34: cmd/hub/main.go:640:12: hub.main calls http.ServeMux.Handle
      #35: cmd/hub/main.go:629:16: hub.main calls http.ServeMux.HandleFunc
      #36: cmd/hub/main.go:629:16: hub.main calls http.ServeMux.HandleFunc
      #37: cmd/hub/main.go:932:33: hub.main calls http.Server.ListenAndServe
      #38: cmd/hub/main.go:932:33: hub.main calls http.Server.ListenAndServe
      #39: cmd/hub/main.go:926:28: hub.main calls http.Server.Shutdown
      #40: cmd/hub/main.go:926:28: hub.main calls http.Server.Shutdown
      #41: internal/web/server.go:939:18: web.Server.handleLogin calls http.SetCookie
      #42: internal/web/server.go:939:18: web.Server.handleLogin calls http.SetCookie
      #43: internal/gitea/gitea.go:42:53: gitea.New calls http.Transport.Clone
      #44: internal/gitea/gitea.go:42:53: gitea.New calls http.Transport.Clone
      #45: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.body.Close
      #46: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.body.Close
      #47: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which calls http.body.Read
      #48: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which calls http.body.Read
      #49: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.bodyEOFSignal.Close
      #50: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.bodyEOFSignal.Close
      #51: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.bodyEOFSignal.Read
      #52: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.bodyEOFSignal.Read
      #53: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.bodyLocked.Read
      #54: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.bodyLocked.Read
      #55: internal/gitea/gitea.go:241:16: gitea.Client.probe calls io.Copy, which eventually calls http.bufioFlushWriter.Write
      #56: internal/gitea/gitea.go:241:16: gitea.Client.probe calls io.Copy, which eventually calls http.bufioFlushWriter.Write
      #57: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.cancelTimerBody.Close
      #58: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.cancelTimerBody.Close
      #59: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.cancelTimerBody.Read
      #60: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.cancelTimerBody.Read
      #61: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which eventually calls http.checkConnErrorWriter.Write
      #62: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which eventually calls http.checkConnErrorWriter.Write
      #63: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which eventually calls http.chunkWriter.Write
      #64: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which eventually calls http.chunkWriter.Write
      #65: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.connReader.Read
      #66: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.connReader.Read
      #67: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which calls http.expectContinueReader.Read
      #68: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which calls http.expectContinueReader.Read
      #69: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.gzipReader.Close
      #70: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.gzipReader.Close
      #71: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.gzipReader.Read
      #72: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.gzipReader.Read
      #73: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2ConnectionError.Error
      #74: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2ConnectionError.Error
      #75: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2ErrCode.String
      #76: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2ErrCode.String
      #77: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2FrameHeader.String
      #78: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2FrameHeader.String
      #79: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2FrameType.String
      #80: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2FrameType.String
      #81: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2FrameWriteRequest.String
      #82: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2FrameWriteRequest.String
      #83: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2GoAwayError.Error
      #84: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2GoAwayError.Error
      #85: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2Setting.String
      #86: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2Setting.String
      #87: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2SettingID.String
      #88: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2SettingID.String
      #89: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2StreamError.Error
      #90: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2StreamError.Error
      #91: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which eventually calls http.http2bufferedWriterTimeoutWriter.Write
      #92: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which eventually calls http.http2bufferedWriterTimeoutWriter.Write
      #93: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which eventually calls http.http2chunkWriter.Write
      #94: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which eventually calls http.http2chunkWriter.Write
      #95: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2connError.Error
      #96: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2connError.Error
      #97: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2duplicatePseudoHeaderError.Error
      #98: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2duplicatePseudoHeaderError.Error
      #99: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.http2gzipReader.Close
      #100: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.http2gzipReader.Close
      #101: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.http2gzipReader.Read
      #102: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.http2gzipReader.Read
      #103: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2headerFieldNameError.Error
      #104: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2headerFieldNameError.Error
      #105: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2headerFieldValueError.Error
      #106: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2headerFieldValueError.Error
      #107: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2pseudoHeaderError.Error
      #108: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2pseudoHeaderError.Error
      #109: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which calls http.http2requestBody.Read
      #110: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which calls http.http2requestBody.Read
      #111: internal/web/server.go:472:10: web.Server.ServeHTTP calls http.http2responseWriter.Write
      #112: internal/web/server.go:472:10: web.Server.ServeHTTP calls http.http2responseWriter.Write
      #113: internal/api/handler.go:2904:15: api.Handler.handleArtifactManifest calls http.http2responseWriter.WriteHeader
      #114: internal/api/handler.go:2904:15: api.Handler.handleArtifactManifest calls http.http2responseWriter.WriteHeader
      #115: internal/store/logbundle.go:141:24: store.Store.SaveLogBundle calls gzip.Writer.Write, which eventually calls http.http2responseWriter.WriteString
      #116: internal/store/logbundle.go:141:24: store.Store.SaveLogBundle calls gzip.Writer.Write, which eventually calls http.http2responseWriter.WriteString
      #117: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which eventually calls http.http2stickyErrWriter.Write
      #118: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which eventually calls http.http2stickyErrWriter.Write
      #119: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.http2transportResponseBody.Close
      #120: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.http2transportResponseBody.Close
      #121: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.http2transportResponseBody.Read
      #122: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.http2transportResponseBody.Read
      #123: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2writeData.String
      #124: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2writeData.String
      #125: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.loggingConn.Read
      #126: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.loggingConn.Read
      #127: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which calls http.loggingConn.Write
      #128: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which calls http.loggingConn.Write
      #129: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.maxBytesReader.Read
      #130: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.maxBytesReader.Read
      #131: internal/i18n/i18n.go:118:15: i18n.Shared calls sync.Once.Do, which eventually calls http.onceCloseListener.Close
      #132: internal/i18n/i18n.go:118:15: i18n.Shared calls sync.Once.Do, which eventually calls http.onceCloseListener.Close
      #133: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.persistConn.Read
      #134: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.persistConn.Read
      #135: internal/gitea/gitea.go:241:16: gitea.Client.probe calls io.Copy, which eventually calls http.persistConnWriter.ReadFrom
      #136: internal/gitea/gitea.go:241:16: gitea.Client.probe calls io.Copy, which eventually calls http.persistConnWriter.ReadFrom
      #137: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which eventually calls http.persistConnWriter.Write
      #138: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which eventually calls http.persistConnWriter.Write
      #139: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which calls http.readTrackingBody.Read
      #140: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which calls http.readTrackingBody.Read
      #141: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.readWriteCloserBody.Read
      #142: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.readWriteCloserBody.Read
      #143: internal/gitea/gitea.go:241:16: gitea.Client.probe calls io.Copy, which eventually calls http.response.ReadFrom
      #144: internal/gitea/gitea.go:241:16: gitea.Client.probe calls io.Copy, which eventually calls http.response.ReadFrom
      #145: internal/web/server.go:472:10: web.Server.ServeHTTP calls http.response.Write
      #146: internal/web/server.go:472:10: web.Server.ServeHTTP calls http.response.Write
      #147: internal/api/handler.go:2904:15: api.Handler.handleArtifactManifest calls http.response.WriteHeader
      #148: internal/api/handler.go:2904:15: api.Handler.handleArtifactManifest calls http.response.WriteHeader
      #149: internal/store/logbundle.go:141:24: store.Store.SaveLogBundle calls gzip.Writer.Write, which eventually calls http.response.WriteString
      #150: internal/store/logbundle.go:141:24: store.Store.SaveLogBundle calls gzip.Writer.Write, which eventually calls http.response.WriteString
      #151: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.transportReadFromServerError.Error
      #152: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.transportReadFromServerError.Error

Vulnerability #5: GO-2026-6610
    HTTP/2 transport accepts malformed framing-related headers in net/http
  More info: https://pkg.go.dev/vuln/GO-2026-6610
  Standard library
    Found in: net/http@go1.26
    Fixed in: net/http@go1.26.9
    Example traces found:
      #1: internal/cloudflare/reach.go:37:36: cloudflare.TokenZones calls http.Client.Do
      #2: internal/cloudflare/reach.go:37:36: cloudflare.TokenZones calls http.Client.Do

Vulnerability #6: GO-2026-6609
    Lack of limit on size of parsed Range headers in net/http
  More info: https://pkg.go.dev/vuln/GO-2026-6609
  Standard library
    Found in: net/http@go1.26
    Fixed in: net/http@go1.26.9
    Example traces found:
      #1: internal/assets/assets.go:215:16: assets.Manager.ServeFile calls http.ServeFile

Vulnerability #7: GO-2026-6608
    Memory limit bypass when parsing MIME headers in net/textproto,
    mime/multipart
  More info: https://pkg.go.dev/vuln/GO-2026-6608
  Standard library
    Found in: net/textproto@go1.26
    Fixed in: net/textproto@go1.26.9
    Example traces found:
      #1: internal/web/server.go:762:43: web.Server.ServeHTTP calls http.Request.FormValue, which eventually calls multipart.Reader.ReadForm
      #2: internal/mailrelay/relay.go:131:30: mailrelay.FromDomain calls mail.ReadMessage, which eventually calls textproto.Reader.ReadContinuedLine
      #3: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls textproto.Reader.ReadMIMEHeader

Vulnerability #8: GO-2026-6607
    Reject malformed ECH outer extension references in crypto/tls
  More info: https://pkg.go.dev/vuln/GO-2026-6607
  Standard library
    Found in: crypto/tls@go1.26
    Fixed in: crypto/tls@go1.26.9
    Example traces found:
      #1: cmd/hub/main.go:932:33: hub.main calls http.Server.ListenAndServe, which eventually calls tls.Conn.HandshakeContext
      #2: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls tls.Conn.Read
      #3: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which calls tls.Conn.Write
      #4: internal/cloudflare/reach.go:37:36: cloudflare.TokenZones calls http.Client.Do, which eventually calls tls.Dialer.DialContext

Vulnerability #9: GO-2026-6605
    HTTP/1 client connection desynchronization after CONNECT rejection in
    net/http
  More info: https://pkg.go.dev/vuln/GO-2026-6605
  Standard library
    Found in: net/http@go1.26
    Fixed in: net/http@go1.26.9
    Example traces found:
      #1: internal/cloudflare/reach.go:37:36: cloudflare.TokenZones calls http.Client.Do

Vulnerability #10: GO-2026-6603
    HTTP/2 server memory exhaustion due to Trailer headers in net/http
  More info: https://pkg.go.dev/vuln/GO-2026-6603
  Standard library
    Found in: net/http@go1.26
    Fixed in: net/http@go1.26.9
    Example traces found:
      #1: internal/cloudflare/reach.go:37:36: cloudflare.TokenZones calls http.Client.Do
      #2: internal/cloudflare/reach.go:37:36: cloudflare.TokenZones calls http.Client.Do
      #3: internal/web/server.go:458:15: web.Server.ServeHTTP calls http.Error
      #4: internal/web/server.go:458:15: web.Server.ServeHTTP calls http.Error
      #5: internal/api/handler.go:2867:26: api.Handler.handleArtifactManifest calls http.Header.Get
      #6: internal/api/handler.go:2867:26: api.Handler.handleArtifactManifest calls http.Header.Get
      #7: internal/web/server.go:470:17: web.Server.ServeHTTP calls http.Header.Set
      #8: internal/web/server.go:470:17: web.Server.ServeHTTP calls http.Header.Set
      #9: internal/web/templatefetcher.go:56:29: web.TemplateFetcher.fetch calls http.NewRequest
      #10: internal/web/templatefetcher.go:56:29: web.TemplateFetcher.fetch calls http.NewRequest
      #11: internal/cloudflare/reach.go:32:40: cloudflare.TokenZones calls http.NewRequestWithContext
      #12: internal/cloudflare/reach.go:32:40: cloudflare.TokenZones calls http.NewRequestWithContext
      #13: internal/web/server.go:478:17: web.Server.ServeHTTP calls http.NotFound
      #14: internal/web/server.go:478:17: web.Server.ServeHTTP calls http.NotFound
      #15: internal/web/server.go:855:16: web.Server.ServeHTTP calls http.Redirect
      #16: internal/web/server.go:855:16: web.Server.ServeHTTP calls http.Redirect
      #17: internal/web/server.go:981:29: web.Server.validateCSRF calls http.Request.BasicAuth
      #18: internal/web/server.go:981:29: web.Server.validateCSRF calls http.Request.BasicAuth
      #19: internal/web/server.go:979:25: web.Server.validateCSRF calls http.Request.Cookie
      #20: internal/web/server.go:979:25: web.Server.validateCSRF calls http.Request.Cookie
      #21: internal/web/server.go:762:43: web.Server.ServeHTTP calls http.Request.FormValue
      #22: internal/web/server.go:762:43: web.Server.ServeHTTP calls http.Request.FormValue
      #23: internal/web/configs.go:1592:23: web.Server.handleSetCustomerFloor calls http.Request.ParseForm
      #24: internal/web/configs.go:1592:23: web.Server.handleSetCustomerFloor calls http.Request.ParseForm
      #25: internal/gitea/gitea.go:234:19: gitea.Client.probe calls http.Request.SetBasicAuth
      #26: internal/gitea/gitea.go:234:19: gitea.Client.probe calls http.Request.SetBasicAuth
      #27: internal/api/wait.go:73:20: api.Handler.handleWait calls http.ResponseController.Flush
      #28: internal/api/wait.go:73:20: api.Handler.handleWait calls http.ResponseController.Flush
      #29: internal/api/wait.go:67:25: api.Handler.handleWait calls http.ResponseController.SetWriteDeadline
      #30: internal/api/wait.go:67:25: api.Handler.handleWait calls http.ResponseController.SetWriteDeadline
      #31: internal/assets/assets.go:215:16: assets.Manager.ServeFile calls http.ServeFile
      #32: internal/assets/assets.go:215:16: assets.Manager.ServeFile calls http.ServeFile
      #33: cmd/hub/main.go:640:12: hub.main calls http.ServeMux.Handle
      #34: cmd/hub/main.go:640:12: hub.main calls http.ServeMux.Handle
      #35: cmd/hub/main.go:629:16: hub.main calls http.ServeMux.HandleFunc
      #36: cmd/hub/main.go:629:16: hub.main calls http.ServeMux.HandleFunc
      #37: cmd/hub/main.go:932:33: hub.main calls http.Server.ListenAndServe
      #38: cmd/hub/main.go:932:33: hub.main calls http.Server.ListenAndServe
      #39: cmd/hub/main.go:926:28: hub.main calls http.Server.Shutdown
      #40: cmd/hub/main.go:926:28: hub.main calls http.Server.Shutdown
      #41: internal/web/server.go:939:18: web.Server.handleLogin calls http.SetCookie
      #42: internal/web/server.go:939:18: web.Server.handleLogin calls http.SetCookie
      #43: internal/gitea/gitea.go:42:53: gitea.New calls http.Transport.Clone
      #44: internal/gitea/gitea.go:42:53: gitea.New calls http.Transport.Clone
      #45: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.body.Close
      #46: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.body.Close
      #47: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which calls http.body.Read
      #48: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which calls http.body.Read
      #49: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.bodyEOFSignal.Close
      #50: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.bodyEOFSignal.Close
      #51: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.bodyEOFSignal.Read
      #52: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.bodyEOFSignal.Read
      #53: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.bodyLocked.Read
      #54: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.bodyLocked.Read
      #55: internal/gitea/gitea.go:241:16: gitea.Client.probe calls io.Copy, which eventually calls http.bufioFlushWriter.Write
      #56: internal/gitea/gitea.go:241:16: gitea.Client.probe calls io.Copy, which eventually calls http.bufioFlushWriter.Write
      #57: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.cancelTimerBody.Close
      #58: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.cancelTimerBody.Close
      #59: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.cancelTimerBody.Read
      #60: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.cancelTimerBody.Read
      #61: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which eventually calls http.checkConnErrorWriter.Write
      #62: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which eventually calls http.checkConnErrorWriter.Write
      #63: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which eventually calls http.chunkWriter.Write
      #64: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which eventually calls http.chunkWriter.Write
      #65: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.connReader.Read
      #66: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.connReader.Read
      #67: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which calls http.expectContinueReader.Read
      #68: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which calls http.expectContinueReader.Read
      #69: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.gzipReader.Close
      #70: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.gzipReader.Close
      #71: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.gzipReader.Read
      #72: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.gzipReader.Read
      #73: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2ConnectionError.Error
      #74: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2ConnectionError.Error
      #75: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2ErrCode.String
      #76: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2ErrCode.String
      #77: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2FrameHeader.String
      #78: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2FrameHeader.String
      #79: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2FrameType.String
      #80: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2FrameType.String
      #81: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2FrameWriteRequest.String
      #82: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2FrameWriteRequest.String
      #83: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2GoAwayError.Error
      #84: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2GoAwayError.Error
      #85: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2Setting.String
      #86: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2Setting.String
      #87: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2SettingID.String
      #88: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2SettingID.String
      #89: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2StreamError.Error
      #90: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2StreamError.Error
      #91: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which eventually calls http.http2bufferedWriterTimeoutWriter.Write
      #92: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which eventually calls http.http2bufferedWriterTimeoutWriter.Write
      #93: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which eventually calls http.http2chunkWriter.Write
      #94: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which eventually calls http.http2chunkWriter.Write
      #95: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2connError.Error
      #96: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2connError.Error
      #97: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2duplicatePseudoHeaderError.Error
      #98: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2duplicatePseudoHeaderError.Error
      #99: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.http2gzipReader.Close
      #100: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.http2gzipReader.Close
      #101: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.http2gzipReader.Read
      #102: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.http2gzipReader.Read
      #103: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2headerFieldNameError.Error
      #104: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2headerFieldNameError.Error
      #105: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2headerFieldValueError.Error
      #106: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2headerFieldValueError.Error
      #107: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2pseudoHeaderError.Error
      #108: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.http2pseudoHeaderError.Error
      #109: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which calls http.http2requestBody.Read
      #110: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which calls http.http2requestBody.Read
      #111: internal/web/server.go:472:10: web.Server.ServeHTTP calls http.http2responseWriter.Write
      #112: internal/web/server.go:472:10: web.Server.ServeHTTP calls http.http2responseWriter.Write
      #113: internal/api/handler.go:2904:15: api.Handler.handleArtifactManifest calls http.http2responseWriter.WriteHeader
      #114: internal/api/handler.go:2904:15: api.Handler.handleArtifactManifest calls http.http2responseWriter.WriteHeader
      #115: internal/store/logbundle.go:141:24: store.Store.SaveLogBundle calls gzip.Writer.Write, which eventually calls http.http2responseWriter.WriteString
      #116: internal/store/logbundle.go:141:24: store.Store.SaveLogBundle calls gzip.Writer.Write, which eventually calls http.http2responseWriter.WriteString
      #117: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which eventually calls http.http2stickyErrWriter.Write
      #118: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which eventually calls http.http2stickyErrWriter.Write
      #119: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.http2transportResponseBody.Close
      #120: internal/cloudflare/reach.go:42:2: cloudflare.TokenZones calls http.http2transportResponseBody.Close
      #121: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.http2transportResponseBody.Read
      #122: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.http2transportResponseBody.Read
      #123: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2writeData.String
      #124: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls http.http2writeData.String
      #125: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.loggingConn.Read
      #126: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.loggingConn.Read
      #127: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which calls http.loggingConn.Write
      #128: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which calls http.loggingConn.Write
      #129: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.maxBytesReader.Read
      #130: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.maxBytesReader.Read
      #131: internal/i18n/i18n.go:118:15: i18n.Shared calls sync.Once.Do, which eventually calls http.onceCloseListener.Close
      #132: internal/i18n/i18n.go:118:15: i18n.Shared calls sync.Once.Do, which eventually calls http.onceCloseListener.Close
      #133: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.persistConn.Read
      #134: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.persistConn.Read
      #135: internal/gitea/gitea.go:241:16: gitea.Client.probe calls io.Copy, which eventually calls http.persistConnWriter.ReadFrom
      #136: internal/gitea/gitea.go:241:16: gitea.Client.probe calls io.Copy, which eventually calls http.persistConnWriter.ReadFrom
      #137: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which eventually calls http.persistConnWriter.Write
      #138: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which eventually calls http.persistConnWriter.Write
      #139: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which calls http.readTrackingBody.Read
      #140: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which calls http.readTrackingBody.Read
      #141: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.readWriteCloserBody.Read
      #142: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls http.readWriteCloserBody.Read
      #143: internal/gitea/gitea.go:241:16: gitea.Client.probe calls io.Copy, which eventually calls http.response.ReadFrom
      #144: internal/gitea/gitea.go:241:16: gitea.Client.probe calls io.Copy, which eventually calls http.response.ReadFrom
      #145: internal/web/server.go:472:10: web.Server.ServeHTTP calls http.response.Write
      #146: internal/web/server.go:472:10: web.Server.ServeHTTP calls http.response.Write
      #147: internal/api/handler.go:2904:15: api.Handler.handleArtifactManifest calls http.response.WriteHeader
      #148: internal/api/handler.go:2904:15: api.Handler.handleArtifactManifest calls http.response.WriteHeader
      #149: internal/store/logbundle.go:141:24: store.Store.SaveLogBundle calls gzip.Writer.Write, which eventually calls http.response.WriteString
      #150: internal/store/logbundle.go:141:24: store.Store.SaveLogBundle calls gzip.Writer.Write, which eventually calls http.response.WriteString
      #151: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.transportReadFromServerError.Error
      #152: internal/cloudflare/reach.go:40:72: cloudflare.TokenZones calls http.transportReadFromServerError.Error

Vulnerability #11: GO-2026-6600
    Recognize yield as regexp preceder keyword in html/template
  More info: https://pkg.go.dev/vuln/GO-2026-6600
  Standard library
    Found in: html/template@go1.26
    Fixed in: html/template@go1.26.9
    Example traces found:
      #1: internal/web/selfbind.go:146:24: web.Server.renderBind calls template.Template.Execute
      #2: internal/web/server.go:1205:39: web.Server.handleConfiguration calls template.Template.ExecuteTemplate

Vulnerability #12: GO-2026-6599
    Reset context tracking on consecutive template expressions in html/template
  More info: https://pkg.go.dev/vuln/GO-2026-6599
  Standard library
    Found in: html/template@go1.26
    Fixed in: html/template@go1.26.9
    Example traces found:
      #1: internal/web/selfbind.go:146:24: web.Server.renderBind calls template.Template.Execute
      #2: internal/web/server.go:1205:39: web.Server.handleConfiguration calls template.Template.ExecuteTemplate

Vulnerability #13: GO-2026-6355
    Prevent DoS on deadlocked established channel in golang.org/x/crypto/ssh
  More info: https://pkg.go.dev/vuln/GO-2026-6355
  Module: golang.org/x/crypto
    Found in: golang.org/x/crypto@v0.31.0
    Fixed in: golang.org/x/crypto@v0.56.0
    Example traces found:
      #1: internal/poke/client.go:106:46: poke.Client.Poke calls ssh.NewClientConn

Vulnerability #14: GO-2026-6354
    Prevent DoS on deadlocked undecided channel in golang.org/x/crypto/ssh
  More info: https://pkg.go.dev/vuln/GO-2026-6354
  Module: golang.org/x/crypto
    Found in: golang.org/x/crypto@v0.31.0
    Fixed in: golang.org/x/crypto@v0.56.0
    Example traces found:
      #1: internal/poke/client.go:106:46: poke.Client.Poke calls ssh.NewClientConn

Vulnerability #15: GO-2026-6218
    Avoid quadratic complexity in resolvePath in net/url
  More info: https://pkg.go.dev/vuln/GO-2026-6218
  Standard library
    Found in: net/url@go1.26
    Fixed in: net/url@go1.26.6
    Example traces found:
      #1: internal/cloudflare/reach.go:37:36: cloudflare.TokenZones calls http.Client.Do, which eventually calls url.URL.Parse

Vulnerability #16: GO-2026-6091
    Fix Javascript regexp context tracking in html/template
  More info: https://pkg.go.dev/vuln/GO-2026-6091
  Standard library
    Found in: html/template@go1.26
    Fixed in: html/template@go1.26.6
    Example traces found:
      #1: internal/web/selfbind.go:146:24: web.Server.renderBind calls template.Template.Execute
      #2: internal/web/server.go:1205:39: web.Server.handleConfiguration calls template.Template.ExecuteTemplate

Vulnerability #17: GO-2026-6090
    Limit handshake messages we are willing to accept post-handshake in
    crypto/tls
  More info: https://pkg.go.dev/vuln/GO-2026-6090
  Standard library
    Found in: crypto/tls@go1.26
    Fixed in: crypto/tls@go1.26.6
    Example traces found:
      #1: cmd/hub/main.go:932:33: hub.main calls http.Server.ListenAndServe, which eventually calls tls.Conn.HandshakeContext
      #2: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls tls.Conn.Read
      #3: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which calls tls.Conn.Write
      #4: internal/cloudflare/reach.go:37:36: cloudflare.TokenZones calls http.Client.Do, which eventually calls tls.Dialer.DialContext

Vulnerability #18: GO-2026-6089
    Apply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/http
  More info: https://pkg.go.dev/vuln/GO-2026-6089
  Standard library
    Found in: net/http@go1.26
    Fixed in: net/http@go1.26.6
    Example traces found:
      #1: cmd/hub/main.go:932:33: hub.main calls http.Server.ListenAndServe

Vulnerability #19: GO-2026-5972
    Enforce maximum recursion depth in encoding/asn1
  More info: https://pkg.go.dev/vuln/GO-2026-5972
  Standard library
    Found in: encoding/asn1@go1.26
    Fixed in: encoding/asn1@go1.26.6
    Example traces found:
      #1: internal/tenantsync/client.go:78:36: tenantsync.New calls ssh.ParsePrivateKey, which eventually calls asn1.Unmarshal

Vulnerability #20: GO-2026-5856
    Invoking Encrypted Client Hello privacy leak in crypto/tls
  More info: https://pkg.go.dev/vuln/GO-2026-5856
  Standard library
    Found in: crypto/tls@go1.26
    Fixed in: crypto/tls@go1.26.5
    Example traces found:
      #1: cmd/hub/main.go:932:33: hub.main calls http.Server.ListenAndServe, which eventually calls tls.Conn.HandshakeContext
      #2: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls tls.Conn.Read
      #3: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which calls tls.Conn.Write
      #4: internal/cloudflare/reach.go:37:36: cloudflare.TokenZones calls http.Client.Do, which eventually calls tls.Dialer.DialContext

Vulnerability #21: GO-2026-5039
    Arbitrary inputs are included in errors without any escaping in
    net/textproto
  More info: https://pkg.go.dev/vuln/GO-2026-5039
  Standard library
    Found in: net/textproto@go1.26
    Fixed in: net/textproto@go1.26.4
    Example traces found:
      #1: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls textproto.Error.Error
      #2: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls textproto.Reader.ReadMIMEHeader
      #3: internal/mailrelay/relay.go:59:26: mailrelay.ResendSMTP.Send calls smtp.NewClient, which calls textproto.Reader.ReadResponse

Vulnerability #22: GO-2026-5037
    Inefficient candidate hostname parsing in crypto/x509
  More info: https://pkg.go.dev/vuln/GO-2026-5037
  Standard library
    Found in: crypto/x509@go1.26
    Fixed in: crypto/x509@go1.26.4
    Example traces found:
      #1: cmd/hub/main.go:932:33: hub.main calls http.Server.ListenAndServe, which eventually calls x509.Certificate.Verify
      #2: cmd/hub/main.go:932:33: hub.main calls http.Server.ListenAndServe, which eventually calls x509.Certificate.VerifyHostname
      #3: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls x509.HostnameError.Error

Vulnerability #23: GO-2026-5026
    Invoking failure to reject ASCII-only Punycode-encoded labels in
    golang.org/x/net/idna
  More info: https://pkg.go.dev/vuln/GO-2026-5026
  Standard library
    Found in: net/http@go1.26
    Fixed in: net/http@go1.26.6
    Example traces found:
      #1: internal/cloudflare/reach.go:37:36: cloudflare.TokenZones calls http.Client.Do

Vulnerability #24: GO-2026-5020
    Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh
  More info: https://pkg.go.dev/vuln/GO-2026-5020
  Module: golang.org/x/crypto
    Found in: golang.org/x/crypto@v0.31.0
    Fixed in: golang.org/x/crypto@v0.52.0
    Example traces found:
      #1: internal/poke/client.go:106:46: poke.Client.Poke calls ssh.NewClientConn
      #2: internal/poke/client.go:129:23: poke.Client.Poke calls ssh.Session.Run
      #3: internal/gitea/gitea.go:241:16: gitea.Client.probe calls io.Copy, which eventually calls ssh.channel.Write

Vulnerability #25: GO-2026-5019
    Invoking bypass of FIDO/U2F security keys physical interaction in
    golang.org/x/crypto/ssh
  More info: https://pkg.go.dev/vuln/GO-2026-5019
  Module: golang.org/x/crypto
    Found in: golang.org/x/crypto@v0.31.0
    Fixed in: golang.org/x/crypto@v0.52.0
    Example traces found:
      #1: internal/poke/client.go:106:46: poke.Client.Poke calls ssh.NewClientConn

Vulnerability #26: GO-2026-5018
    Invoking pathological RSA/DSA parameters may cause DoS in
    golang.org/x/crypto/ssh
  More info: https://pkg.go.dev/vuln/GO-2026-5018
  Module: golang.org/x/crypto
    Found in: golang.org/x/crypto@v0.31.0
    Fixed in: golang.org/x/crypto@v0.52.0
    Example traces found:
      #1: internal/poke/client.go:106:46: poke.Client.Poke calls ssh.NewClientConn
      #2: internal/offsitekeys/offsitekeys.go:100:50: offsitekeys.KeyFingerprint calls ssh.ParseAuthorizedKey
      #3: internal/tenantsync/client.go:78:36: tenantsync.New calls ssh.ParsePrivateKey

Vulnerability #27: GO-2026-5017
    Invoking client can cause server deadlock on unexpected responses in
    golang.org/x/crypto/ssh
  More info: https://pkg.go.dev/vuln/GO-2026-5017
  Module: golang.org/x/crypto
    Found in: golang.org/x/crypto@v0.31.0
    Fixed in: golang.org/x/crypto@v0.52.0
    Example traces found:
      #1: internal/poke/client.go:106:46: poke.Client.Poke calls ssh.NewClientConn
      #2: internal/poke/client.go:129:23: poke.Client.Poke calls ssh.Session.Run

Vulnerability #28: GO-2026-5013
    Invoking byte arithmetic causes underflow and panic in
    golang.org/x/crypto/ssh
  More info: https://pkg.go.dev/vuln/GO-2026-5013
  Module: golang.org/x/crypto
    Found in: golang.org/x/crypto@v0.31.0
    Fixed in: golang.org/x/crypto@v0.52.0
    Example traces found:
      #1: internal/poke/client.go:106:46: poke.Client.Poke calls ssh.NewClientConn

Vulnerability #29: GO-2026-4986
    Quadratic string concatentation in consumeComment in net/mail
  More info: https://pkg.go.dev/vuln/GO-2026-4986
  Standard library
    Found in: net/mail@go1.26
    Fixed in: net/mail@go1.26.3
    Example traces found:
      #1: internal/mailrelay/relay.go:139:32: mailrelay.FromDomain calls mail.ParseAddress
      #2: internal/mailrelay/relay.go:141:38: mailrelay.FromDomain calls mail.ParseAddressList

Vulnerability #30: GO-2026-4982
    Bypass of meta content URL escaping causes XSS in html/template
  More info: https://pkg.go.dev/vuln/GO-2026-4982
  Standard library
    Found in: html/template@go1.26
    Fixed in: html/template@go1.26.3
    Example traces found:
      #1: internal/web/selfbind.go:146:24: web.Server.renderBind calls template.Template.Execute
      #2: internal/web/server.go:1205:39: web.Server.handleConfiguration calls template.Template.ExecuteTemplate

Vulnerability #31: GO-2026-4980
    Escaper bypass leads to XSS in html/template
  More info: https://pkg.go.dev/vuln/GO-2026-4980
  Standard library
    Found in: html/template@go1.26
    Fixed in: html/template@go1.26.3
    Example traces found:
      #1: internal/web/selfbind.go:146:24: web.Server.renderBind calls template.Template.Execute
      #2: internal/web/server.go:1205:39: web.Server.handleConfiguration calls template.Template.ExecuteTemplate

Vulnerability #32: GO-2026-4977
    Quadratic string concatenation in consumePhrase in net/mail
  More info: https://pkg.go.dev/vuln/GO-2026-4977
  Standard library
    Found in: net/mail@go1.26
    Fixed in: net/mail@go1.26.3
    Example traces found:
      #1: internal/mailrelay/relay.go:139:32: mailrelay.FromDomain calls mail.ParseAddress
      #2: internal/mailrelay/relay.go:141:38: mailrelay.FromDomain calls mail.ParseAddressList

Vulnerability #33: GO-2026-4971
    Panic in Dial and LookupPort when handling NUL byte on Windows in net
  More info: https://pkg.go.dev/vuln/GO-2026-4971
  Standard library
    Found in: net@go1.26
    Fixed in: net@go1.26.3
    Example traces found:
      #1: internal/poke/client.go:97:33: poke.Client.Poke calls net.Dialer.DialContext
      #2: cmd/hub/main.go:932:33: hub.main calls http.Server.ListenAndServe, which calls net.Listen

Vulnerability #34: GO-2026-4947
    Unexpected work during chain building in crypto/x509
  More info: https://pkg.go.dev/vuln/GO-2026-4947
  Standard library
    Found in: crypto/x509@go1.26
    Fixed in: crypto/x509@go1.26.2
    Example traces found:
      #1: cmd/hub/main.go:932:33: hub.main calls http.Server.ListenAndServe, which eventually calls x509.Certificate.Verify

Vulnerability #35: GO-2026-4946
    Inefficient policy validation in crypto/x509
  More info: https://pkg.go.dev/vuln/GO-2026-4946
  Standard library
    Found in: crypto/x509@go1.26
    Fixed in: crypto/x509@go1.26.2
    Example traces found:
      #1: cmd/hub/main.go:932:33: hub.main calls http.Server.ListenAndServe, which eventually calls x509.Certificate.Verify

Vulnerability #36: GO-2026-4918
    Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in
    net/http/internal/http2 in golang.org/x/net
  More info: https://pkg.go.dev/vuln/GO-2026-4918
  Standard library
    Found in: net/http@go1.26
    Fixed in: net/http@go1.26.3
    Example traces found:
      #1: internal/cloudflare/reach.go:37:36: cloudflare.TokenZones calls http.Client.Do

Vulnerability #37: GO-2026-4870
    Unauthenticated TLS 1.3 KeyUpdate record can cause persistent connection
    retention and DoS in crypto/tls
  More info: https://pkg.go.dev/vuln/GO-2026-4870
  Standard library
    Found in: crypto/tls@go1.26
    Fixed in: crypto/tls@go1.26.2
    Example traces found:
      #1: cmd/hub/main.go:932:33: hub.main calls http.Server.ListenAndServe, which eventually calls tls.Conn.HandshakeContext
      #2: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls tls.Conn.Read
      #3: internal/osupdates/service.go:380:13: osupdates.fingerprint calls fmt.Fprintf, which calls tls.Conn.Write
      #4: internal/cloudflare/reach.go:37:36: cloudflare.TokenZones calls http.Client.Do, which eventually calls tls.Dialer.DialContext

Vulnerability #38: GO-2026-4866
    Case-sensitive excludedSubtrees name constraints cause Auth Bypass in
    crypto/x509
  More info: https://pkg.go.dev/vuln/GO-2026-4866
  Standard library
    Found in: crypto/x509@go1.26
    Fixed in: crypto/x509@go1.26.2
    Example traces found:
      #1: cmd/hub/main.go:932:33: hub.main calls http.Server.ListenAndServe, which eventually calls x509.Certificate.Verify

Vulnerability #39: GO-2026-4865
    JsBraceDepth Context Tracking Bugs (XSS) in html/template
  More info: https://pkg.go.dev/vuln/GO-2026-4865
  Standard library
    Found in: html/template@go1.26
    Fixed in: html/template@go1.26.2
    Example traces found:
      #1: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls template.Error.Error
      #2: internal/web/selfbind.go:146:24: web.Server.renderBind calls template.Template.Execute
      #3: internal/web/server.go:1205:39: web.Server.handleConfiguration calls template.Template.ExecuteTemplate
      #4: internal/web/server.go:169:46: web.New calls template.Template.Funcs
      #5: internal/web/selfbind.go:129:63: web.buildBindTemplates calls template.Template.Parse
      #6: internal/web/server.go:169:63: web.New calls template.Template.ParseFS
      #7: cmd/hubdb-check/main.go:62:15: hubdb.main calls fmt.Fprintln, which eventually calls template.context.String

Vulnerability #40: GO-2026-4603
    URLs in meta content attribute actions are not escaped in html/template
  More info: https://pkg.go.dev/vuln/GO-2026-4603
  Standard library
    Found in: html/template@go1.26
    Fixed in: html/template@go1.26.1
    Example traces found:
      #1: internal/web/selfbind.go:146:24: web.Server.renderBind calls template.Template.Execute
      #2: internal/web/server.go:1205:39: web.Server.handleConfiguration calls template.Template.ExecuteTemplate

Vulnerability #41: GO-2026-4602
    FileInfo can escape from a Root in os
  More info: https://pkg.go.dev/vuln/GO-2026-4602
  Standard library
    Found in: os@go1.26
    Fixed in: os@go1.26.1
    Example traces found:
      #1: internal/assets/assets.go:215:16: assets.Manager.ServeFile calls http.ServeFile, which eventually calls os.File.ReadDir
      #2: internal/assets/assets.go:215:16: assets.Manager.ServeFile calls http.ServeFile, which eventually calls os.File.Readdir
      #3: internal/dbsnap/dbsnap.go:112:26: dbsnap.List calls os.ReadDir

Vulnerability #42: GO-2026-4601
    Incorrect parsing of IPv6 host literals in net/url
  More info: https://pkg.go.dev/vuln/GO-2026-4601
  Standard library
    Found in: net/url@go1.26
    Fixed in: net/url@go1.26.1
    Example traces found:
      #1: internal/web/server.go:855:16: web.Server.ServeHTTP calls http.Redirect, which calls url.Parse
      #2: cmd/hub/main.go:932:33: hub.main calls http.Server.ListenAndServe, which eventually calls url.ParseRequestURI
      #3: internal/cloudflare/reach.go:37:36: cloudflare.TokenZones calls http.Client.Do, which eventually calls url.URL.Parse

Vulnerability #43: GO-2026-4600
    Panic in name constraint checking for malformed certificates in crypto/x509
  More info: https://pkg.go.dev/vuln/GO-2026-4600
  Standard library
    Found in: crypto/x509@go1.26
    Fixed in: crypto/x509@go1.26.1
    Example traces found:
      #1: cmd/hub/main.go:932:33: hub.main calls http.Server.ListenAndServe, which eventually calls x509.Certificate.Verify

Vulnerability #44: GO-2026-4599
    Incorrect enforcement of email constraints in crypto/x509
  More info: https://pkg.go.dev/vuln/GO-2026-4599
  Standard library
    Found in: crypto/x509@go1.26
    Fixed in: crypto/x509@go1.26.1
    Example traces found:
      #1: cmd/hub/main.go:932:33: hub.main calls http.Server.ListenAndServe, which eventually calls x509.Certificate.Verify

Vulnerability #45: GO-2025-3487
    Potential denial of service in golang.org/x/crypto
  More info: https://pkg.go.dev/vuln/GO-2025-3487
  Module: golang.org/x/crypto
    Found in: golang.org/x/crypto@v0.31.0
    Fixed in: golang.org/x/crypto@v0.35.0
    Example traces found:
      #1: internal/poke/client.go:118:35: poke.Client.Poke calls ssh.Client.NewSession
      #2: internal/poke/client.go:111:25: poke.Client.Poke calls ssh.NewClient
      #3: internal/poke/client.go:106:46: poke.Client.Poke calls ssh.NewClientConn
      #4: internal/poke/client.go:122:2: poke.Client.Poke calls ssh.Session.Close
      #5: internal/poke/client.go:129:23: poke.Client.Poke calls ssh.Session.Run
      #6: internal/store/store.go:1549:19: store.Store.Close calls sql.DB.Close, which eventually calls ssh.channel.CloseWrite
      #7: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls ssh.channel.Read
      #8: internal/gitea/gitea.go:241:16: gitea.Client.probe calls io.Copy, which eventually calls ssh.channel.Write
      #9: internal/store/logbundle.go:222:24: store.Store.GetLogBundleContent calls io.ReadAll, which eventually calls ssh.extChannel.Read

Your code is affected by 45 vulnerabilities from 1 module and the Go standard library.
This scan also found 12 vulnerabilities in packages you import and 11
vulnerabilities in modules you require, but your code doesn't appear to call
these vulnerabilities.
Use '-show verbose' for more details.
