1171 lines
102 KiB
Plaintext
1171 lines
102 KiB
Plaintext
=== Symbol Results ===
|
|
|
|
Vulnerability #1: GO-2026-6617
|
|
HTTP/2 server crash due to HPACK encoder race in net/http
|
|
More info: https://pkg.go.dev/vuln/GO-2026-6617
|
|
Standard library
|
|
Found in: net/http@go1.26
|
|
Fixed in: net/http@go1.26.9
|
|
Example traces found:
|
|
#1: internal/agentapi/client.go:153:53: agentapi.Client.Close calls http.Client.CloseIdleConnections
|
|
#2: internal/agentapi/client.go:153:53: agentapi.Client.Close calls http.Client.CloseIdleConnections
|
|
#3: internal/notify/notifier.go:1159:30: notify.Notifier.PushTestEventSync calls http.Client.Do
|
|
#4: internal/notify/notifier.go:1159:30: notify.Notifier.PushTestEventSync calls http.Client.Do
|
|
#5: internal/stacks/setup_gate.go:374:20: stacks.init calls http.Client.Get
|
|
#6: internal/stacks/setup_gate.go:374:20: stacks.init calls http.Client.Get
|
|
#7: cmd/controller/main.go:2113:29: controller.main calls http.Client.Head
|
|
#8: cmd/controller/main.go:2113:29: controller.main calls http.Client.Head
|
|
#9: internal/web/setup_gate.go:279:13: web.Server.ServeGateStart calls http.Error
|
|
#10: internal/web/setup_gate.go:279:13: web.Server.ServeGateStart calls http.Error
|
|
#11: internal/web/setup_gate.go:364:35: web.Server.ServeSignupClosed calls http.Header.Get
|
|
#12: internal/web/setup_gate.go:364:35: web.Server.ServeSignupClosed calls http.Header.Get
|
|
#13: internal/notify/notifier.go:1156:16: notify.Notifier.PushTestEventSync calls http.Header.Set
|
|
#14: internal/notify/notifier.go:1156:16: notify.Notifier.PushTestEventSync calls http.Header.Set
|
|
#15: internal/web/clientaddr.go:99:35: web.clientIP calls http.Header.Values
|
|
#16: internal/web/clientaddr.go:99:35: web.clientIP calls http.Header.Values
|
|
#17: internal/notify/notifier.go:1152:29: notify.Notifier.PushTestEventSync calls http.NewRequest
|
|
#18: internal/notify/notifier.go:1152:29: notify.Notifier.PushTestEventSync calls http.NewRequest
|
|
#19: internal/agentapi/client.go:667:40: agentapi.Client.WipeStagedEscrowSecret calls http.NewRequestWithContext
|
|
#20: internal/agentapi/client.go:667:40: agentapi.Client.WipeStagedEscrowSecret calls http.NewRequestWithContext
|
|
#21: internal/web/server.go:865:16: web.Server.ServeHTTP calls http.NotFound
|
|
#22: internal/web/server.go:865:16: web.Server.ServeHTTP calls http.NotFound
|
|
#23: internal/web/server.go:583:16: web.Server.ServeHTTP calls http.Redirect
|
|
#24: internal/web/server.go:583:16: web.Server.ServeHTTP calls http.Redirect
|
|
#25: internal/web/family_gate.go:390:23: web.Server.ServeFamilyLogout calls http.Request.Cookie
|
|
#26: internal/web/family_gate.go:390:23: web.Server.ServeFamilyLogout calls http.Request.Cookie
|
|
#27: internal/web/family_gate.go:352:19: web.Server.ServeFamilyLogin calls http.Request.FormValue
|
|
#28: internal/web/family_gate.go:352:19: web.Server.ServeFamilyLogin calls http.Request.FormValue
|
|
#29: internal/web/family_gate.go:351:17: web.Server.ServeFamilyLogin calls http.Request.ParseForm
|
|
#30: internal/web/family_gate.go:351:17: web.Server.ServeFamilyLogin calls http.Request.ParseForm
|
|
#31: internal/web/recovery_handlers.go:347:25: web.Server.recoveryUnlockHandler calls http.Request.PostFormValue
|
|
#32: internal/web/recovery_handlers.go:347:25: web.Server.recoveryUnlockHandler calls http.Request.PostFormValue
|
|
#33: internal/selfupdate/updater.go:255:18: selfupdate.Updater.queryRegistry calls http.Request.SetBasicAuth
|
|
#34: internal/selfupdate/updater.go:255:18: selfupdate.Updater.queryRegistry calls http.Request.SetBasicAuth
|
|
#35: internal/web/server.go:1163:16: web.Server.serveAsset calls http.ServeFile
|
|
#36: internal/web/server.go:1163:16: web.Server.serveAsset calls http.ServeFile
|
|
#37: cmd/controller/main.go:2138:12: controller.main calls http.ServeMux.Handle
|
|
#38: cmd/controller/main.go:2138:12: controller.main calls http.ServeMux.Handle
|
|
#39: internal/setup/handlers.go:90:16: setup.Server.Handler calls http.ServeMux.HandleFunc
|
|
#40: internal/setup/handlers.go:90:16: setup.Server.Handler calls http.ServeMux.HandleFunc
|
|
#41: cmd/controller/main.go:2214:33: controller.main calls http.Server.ListenAndServe
|
|
#42: cmd/controller/main.go:2214:33: controller.main calls http.Server.ListenAndServe
|
|
#43: cmd/controller/main.go:3759:21: controller.runSetupMode calls http.Server.Shutdown
|
|
#44: cmd/controller/main.go:3759:21: controller.runSetupMode calls http.Server.Shutdown
|
|
#45: internal/web/family_gate.go:395:16: web.Server.ServeFamilyLogout calls http.SetCookie
|
|
#46: internal/web/family_gate.go:395:16: web.Server.ServeFamilyLogout calls http.SetCookie
|
|
#47: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.body.Close
|
|
#48: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.body.Close
|
|
#49: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.body.Read
|
|
#50: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.body.Read
|
|
#51: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.bodyEOFSignal.Close
|
|
#52: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.bodyEOFSignal.Close
|
|
#53: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.bodyEOFSignal.Read
|
|
#54: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.bodyEOFSignal.Read
|
|
#55: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.bodyLocked.Read
|
|
#56: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.bodyLocked.Read
|
|
#57: internal/sockheal/sockheal.go:78:29: sockheal.PingSocket calls io.WriteString, which calls http.bufioFlushWriter.Write
|
|
#58: internal/sockheal/sockheal.go:78:29: sockheal.PingSocket calls io.WriteString, which calls http.bufioFlushWriter.Write
|
|
#59: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.cancelTimerBody.Close
|
|
#60: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.cancelTimerBody.Close
|
|
#61: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.cancelTimerBody.Read
|
|
#62: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.cancelTimerBody.Read
|
|
#63: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.checkConnErrorWriter.Write
|
|
#64: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.checkConnErrorWriter.Write
|
|
#65: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.chunkWriter.Write
|
|
#66: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.chunkWriter.Write
|
|
#67: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.connReader.Read
|
|
#68: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.connReader.Read
|
|
#69: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.expectContinueReader.Read
|
|
#70: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.expectContinueReader.Read
|
|
#71: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.gzipReader.Close
|
|
#72: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.gzipReader.Close
|
|
#73: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.gzipReader.Read
|
|
#74: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.gzipReader.Read
|
|
#75: internal/util/msgerr.go:150:18: util.ErrText calls http.http2ConnectionError.Error
|
|
#76: internal/util/msgerr.go:150:18: util.ErrText calls http.http2ConnectionError.Error
|
|
#77: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2ErrCode.String
|
|
#78: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2ErrCode.String
|
|
#79: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2FrameHeader.String
|
|
#80: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2FrameHeader.String
|
|
#81: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2FrameType.String
|
|
#82: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2FrameType.String
|
|
#83: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2FrameWriteRequest.String
|
|
#84: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2FrameWriteRequest.String
|
|
#85: internal/util/msgerr.go:150:18: util.ErrText calls http.http2GoAwayError.Error
|
|
#86: internal/util/msgerr.go:150:18: util.ErrText calls http.http2GoAwayError.Error
|
|
#87: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2Setting.String
|
|
#88: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2Setting.String
|
|
#89: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2SettingID.String
|
|
#90: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2SettingID.String
|
|
#91: internal/util/msgerr.go:150:18: util.ErrText calls http.http2StreamError.Error
|
|
#92: internal/util/msgerr.go:150:18: util.ErrText calls http.http2StreamError.Error
|
|
#93: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.http2bufferedWriterTimeoutWriter.Write
|
|
#94: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.http2bufferedWriterTimeoutWriter.Write
|
|
#95: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.http2chunkWriter.Write
|
|
#96: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.http2chunkWriter.Write
|
|
#97: internal/util/msgerr.go:150:18: util.ErrText calls http.http2connError.Error
|
|
#98: internal/util/msgerr.go:150:18: util.ErrText calls http.http2connError.Error
|
|
#99: internal/util/msgerr.go:150:18: util.ErrText calls http.http2duplicatePseudoHeaderError.Error
|
|
#100: internal/util/msgerr.go:150:18: util.ErrText calls http.http2duplicatePseudoHeaderError.Error
|
|
#101: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.http2gzipReader.Close
|
|
#102: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.http2gzipReader.Close
|
|
#103: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.http2gzipReader.Read
|
|
#104: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.http2gzipReader.Read
|
|
#105: internal/util/msgerr.go:150:18: util.ErrText calls http.http2headerFieldNameError.Error
|
|
#106: internal/util/msgerr.go:150:18: util.ErrText calls http.http2headerFieldNameError.Error
|
|
#107: internal/util/msgerr.go:150:18: util.ErrText calls http.http2headerFieldValueError.Error
|
|
#108: internal/util/msgerr.go:150:18: util.ErrText calls http.http2headerFieldValueError.Error
|
|
#109: internal/util/msgerr.go:150:18: util.ErrText calls http.http2pseudoHeaderError.Error
|
|
#110: internal/util/msgerr.go:150:18: util.ErrText calls http.http2pseudoHeaderError.Error
|
|
#111: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.http2requestBody.Read
|
|
#112: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.http2requestBody.Read
|
|
#113: internal/api/selfrestart.go:39:10: api.flushResponse calls http.http2responseWriter.Flush
|
|
#114: internal/api/selfrestart.go:39:10: api.flushResponse calls http.http2responseWriter.Flush
|
|
#115: internal/web/setup_gate.go:367:17: web.Server.ServeSignupClosed calls http.http2responseWriter.Write
|
|
#116: internal/web/setup_gate.go:367:17: web.Server.ServeSignupClosed calls http.http2responseWriter.Write
|
|
#117: internal/web/setup_gate.go:366:16: web.Server.ServeSignupClosed calls http.http2responseWriter.WriteHeader
|
|
#118: internal/web/setup_gate.go:366:16: web.Server.ServeSignupClosed calls http.http2responseWriter.WriteHeader
|
|
#119: internal/sockheal/sockheal.go:78:29: sockheal.PingSocket calls io.WriteString, which calls http.http2responseWriter.WriteString
|
|
#120: internal/sockheal/sockheal.go:78:29: sockheal.PingSocket calls io.WriteString, which calls http.http2responseWriter.WriteString
|
|
#121: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.http2stickyErrWriter.Write
|
|
#122: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.http2stickyErrWriter.Write
|
|
#123: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.http2transportResponseBody.Close
|
|
#124: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.http2transportResponseBody.Close
|
|
#125: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.http2transportResponseBody.Read
|
|
#126: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.http2transportResponseBody.Read
|
|
#127: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2writeData.String
|
|
#128: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2writeData.String
|
|
#129: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.loggingConn.Read
|
|
#130: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.loggingConn.Read
|
|
#131: internal/web/claim.go:486:14: web.PrintLocalResetCode calls fmt.Fprintf, which calls http.loggingConn.Write
|
|
#132: internal/web/claim.go:486:14: web.PrintLocalResetCode calls fmt.Fprintf, which calls http.loggingConn.Write
|
|
#133: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.maxBytesReader.Read
|
|
#134: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.maxBytesReader.Read
|
|
#135: internal/web/auth.go:341:16: web.Server.Close calls sync.Once.Do, which eventually calls http.onceCloseListener.Close
|
|
#136: internal/web/auth.go:341:16: web.Server.Close calls sync.Once.Do, which eventually calls http.onceCloseListener.Close
|
|
#137: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.persistConn.Read
|
|
#138: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.persistConn.Read
|
|
#139: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.persistConnWriter.ReadFrom
|
|
#140: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.persistConnWriter.ReadFrom
|
|
#141: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.persistConnWriter.Write
|
|
#142: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.persistConnWriter.Write
|
|
#143: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.readTrackingBody.Read
|
|
#144: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.readTrackingBody.Read
|
|
#145: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.readWriteCloserBody.Read
|
|
#146: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.readWriteCloserBody.Read
|
|
#147: internal/api/selfrestart.go:39:10: api.flushResponse calls http.response.Flush
|
|
#148: internal/api/selfrestart.go:39:10: api.flushResponse calls http.response.Flush
|
|
#149: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.response.ReadFrom
|
|
#150: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.response.ReadFrom
|
|
#151: internal/web/setup_gate.go:367:17: web.Server.ServeSignupClosed calls http.response.Write
|
|
#152: internal/web/setup_gate.go:367:17: web.Server.ServeSignupClosed calls http.response.Write
|
|
#153: internal/web/setup_gate.go:366:16: web.Server.ServeSignupClosed calls http.response.WriteHeader
|
|
#154: internal/web/setup_gate.go:366:16: web.Server.ServeSignupClosed calls http.response.WriteHeader
|
|
#155: internal/sockheal/sockheal.go:78:29: sockheal.PingSocket calls io.WriteString, which calls http.response.WriteString
|
|
#156: internal/sockheal/sockheal.go:78:29: sockheal.PingSocket calls io.WriteString, which calls http.response.WriteString
|
|
#157: internal/util/msgerr.go:150:18: util.ErrText calls http.transportReadFromServerError.Error
|
|
#158: internal/util/msgerr.go:150:18: util.ErrText calls http.transportReadFromServerError.Error
|
|
|
|
Vulnerability #2: GO-2026-6613
|
|
HTTP/1 server connection desynchronization after 2xx CONNECT response in
|
|
net/http
|
|
More info: https://pkg.go.dev/vuln/GO-2026-6613
|
|
Standard library
|
|
Found in: net/http@go1.26
|
|
Fixed in: net/http@go1.26.9
|
|
Example traces found:
|
|
#1: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which eventually calls http.CanonicalHeaderKey
|
|
#2: internal/agentapi/client.go:153:53: agentapi.Client.Close calls http.Client.CloseIdleConnections
|
|
#3: internal/notify/notifier.go:1159:30: notify.Notifier.PushTestEventSync calls http.Client.Do
|
|
#4: internal/stacks/setup_gate.go:374:20: stacks.init calls http.Client.Get
|
|
#5: cmd/controller/main.go:2113:29: controller.main calls http.Client.Head
|
|
#6: internal/web/setup_gate.go:279:13: web.Server.ServeGateStart calls http.Error
|
|
#7: internal/web/setup_gate.go:366:16: web.Server.ServeSignupClosed calls http.http2responseWriter.WriteHeader, which eventually calls http.Header.Del
|
|
#8: internal/web/setup_gate.go:364:35: web.Server.ServeSignupClosed calls http.Header.Get
|
|
#9: internal/notify/notifier.go:1156:16: notify.Notifier.PushTestEventSync calls http.Header.Set
|
|
#10: internal/web/clientaddr.go:99:35: web.clientIP calls http.Header.Values
|
|
#11: internal/notify/notifier.go:1152:29: notify.Notifier.PushTestEventSync calls http.NewRequest
|
|
#12: internal/agentapi/client.go:667:40: agentapi.Client.WipeStagedEscrowSecret calls http.NewRequestWithContext
|
|
#13: internal/web/server.go:865:16: web.Server.ServeHTTP calls http.NotFound
|
|
#14: internal/web/server.go:583:16: web.Server.ServeHTTP calls http.Redirect
|
|
#15: internal/web/family_gate.go:390:23: web.Server.ServeFamilyLogout calls http.Request.Cookie
|
|
#16: internal/web/family_gate.go:352:19: web.Server.ServeFamilyLogin calls http.Request.FormValue
|
|
#17: internal/web/family_gate.go:351:17: web.Server.ServeFamilyLogin calls http.Request.ParseForm
|
|
#18: internal/web/recovery_handlers.go:347:25: web.Server.recoveryUnlockHandler calls http.Request.PostFormValue
|
|
#19: internal/selfupdate/updater.go:255:18: selfupdate.Updater.queryRegistry calls http.Request.SetBasicAuth
|
|
#20: internal/web/server.go:1163:16: web.Server.serveAsset calls http.ServeFile
|
|
#21: cmd/controller/main.go:2138:12: controller.main calls http.ServeMux.Handle
|
|
#22: internal/setup/handlers.go:90:16: setup.Server.Handler calls http.ServeMux.HandleFunc
|
|
#23: cmd/controller/main.go:2214:33: controller.main calls http.Server.ListenAndServe
|
|
#24: cmd/controller/main.go:3759:21: controller.runSetupMode calls http.Server.Shutdown
|
|
#25: internal/web/family_gate.go:395:16: web.Server.ServeFamilyLogout calls http.SetCookie
|
|
#26: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.body.Close
|
|
#27: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.body.Read
|
|
#28: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.bodyEOFSignal.Close
|
|
#29: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.bodyEOFSignal.Read
|
|
#30: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.bodyLocked.Read
|
|
#31: internal/sockheal/sockheal.go:78:29: sockheal.PingSocket calls io.WriteString, which calls http.bufioFlushWriter.Write
|
|
#32: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.cancelTimerBody.Close
|
|
#33: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.cancelTimerBody.Read
|
|
#34: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.checkConnErrorWriter.Write
|
|
#35: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.chunkWriter.Write
|
|
#36: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.connReader.Read
|
|
#37: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.http2transportResponseBody.Close, which eventually calls http.expectContinueReader.Close
|
|
#38: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.expectContinueReader.Read
|
|
#39: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.gzipReader.Close
|
|
#40: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.gzipReader.Read
|
|
#41: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.loggingConn.Read
|
|
#42: internal/web/claim.go:486:14: web.PrintLocalResetCode calls fmt.Fprintf, which calls http.loggingConn.Write
|
|
#43: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.http2transportResponseBody.Close, which eventually calls http.maxBytesReader.Close
|
|
#44: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.maxBytesReader.Read
|
|
#45: internal/web/auth.go:341:16: web.Server.Close calls sync.Once.Do, which eventually calls http.onceCloseListener.Close
|
|
#46: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.persistConn.Read
|
|
#47: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.persistConnWriter.ReadFrom
|
|
#48: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.persistConnWriter.Write
|
|
#49: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.http2transportResponseBody.Close, which eventually calls http.readTrackingBody.Close
|
|
#50: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.readTrackingBody.Read
|
|
#51: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.readWriteCloserBody.Read
|
|
#52: internal/api/selfrestart.go:39:10: api.flushResponse calls http.response.Flush
|
|
#53: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.response.ReadFrom
|
|
#54: internal/web/setup_gate.go:367:17: web.Server.ServeSignupClosed calls http.response.Write
|
|
#55: internal/web/setup_gate.go:366:16: web.Server.ServeSignupClosed calls http.response.WriteHeader
|
|
#56: internal/sockheal/sockheal.go:78:29: sockheal.PingSocket calls io.WriteString, which calls http.response.WriteString
|
|
#57: internal/util/msgerr.go:150:18: util.ErrText calls http.transportReadFromServerError.Error
|
|
|
|
Vulnerability #3: GO-2026-6612
|
|
Double flow control refund on HTTP/2 server streams in net/http
|
|
More info: https://pkg.go.dev/vuln/GO-2026-6612
|
|
Standard library
|
|
Found in: net/http@go1.26
|
|
Fixed in: net/http@go1.26.9
|
|
Example traces found:
|
|
#1: internal/agentapi/client.go:153:53: agentapi.Client.Close calls http.Client.CloseIdleConnections
|
|
#2: internal/agentapi/client.go:153:53: agentapi.Client.Close calls http.Client.CloseIdleConnections
|
|
#3: internal/notify/notifier.go:1159:30: notify.Notifier.PushTestEventSync calls http.Client.Do
|
|
#4: internal/notify/notifier.go:1159:30: notify.Notifier.PushTestEventSync calls http.Client.Do
|
|
#5: internal/stacks/setup_gate.go:374:20: stacks.init calls http.Client.Get
|
|
#6: internal/stacks/setup_gate.go:374:20: stacks.init calls http.Client.Get
|
|
#7: cmd/controller/main.go:2113:29: controller.main calls http.Client.Head
|
|
#8: cmd/controller/main.go:2113:29: controller.main calls http.Client.Head
|
|
#9: internal/web/setup_gate.go:279:13: web.Server.ServeGateStart calls http.Error
|
|
#10: internal/web/setup_gate.go:279:13: web.Server.ServeGateStart calls http.Error
|
|
#11: internal/web/setup_gate.go:364:35: web.Server.ServeSignupClosed calls http.Header.Get
|
|
#12: internal/web/setup_gate.go:364:35: web.Server.ServeSignupClosed calls http.Header.Get
|
|
#13: internal/notify/notifier.go:1156:16: notify.Notifier.PushTestEventSync calls http.Header.Set
|
|
#14: internal/notify/notifier.go:1156:16: notify.Notifier.PushTestEventSync calls http.Header.Set
|
|
#15: internal/web/clientaddr.go:99:35: web.clientIP calls http.Header.Values
|
|
#16: internal/web/clientaddr.go:99:35: web.clientIP calls http.Header.Values
|
|
#17: internal/notify/notifier.go:1152:29: notify.Notifier.PushTestEventSync calls http.NewRequest
|
|
#18: internal/notify/notifier.go:1152:29: notify.Notifier.PushTestEventSync calls http.NewRequest
|
|
#19: internal/agentapi/client.go:667:40: agentapi.Client.WipeStagedEscrowSecret calls http.NewRequestWithContext
|
|
#20: internal/agentapi/client.go:667:40: agentapi.Client.WipeStagedEscrowSecret calls http.NewRequestWithContext
|
|
#21: internal/web/server.go:865:16: web.Server.ServeHTTP calls http.NotFound
|
|
#22: internal/web/server.go:865:16: web.Server.ServeHTTP calls http.NotFound
|
|
#23: internal/web/server.go:583:16: web.Server.ServeHTTP calls http.Redirect
|
|
#24: internal/web/server.go:583:16: web.Server.ServeHTTP calls http.Redirect
|
|
#25: internal/web/family_gate.go:390:23: web.Server.ServeFamilyLogout calls http.Request.Cookie
|
|
#26: internal/web/family_gate.go:390:23: web.Server.ServeFamilyLogout calls http.Request.Cookie
|
|
#27: internal/web/family_gate.go:352:19: web.Server.ServeFamilyLogin calls http.Request.FormValue
|
|
#28: internal/web/family_gate.go:352:19: web.Server.ServeFamilyLogin calls http.Request.FormValue
|
|
#29: internal/web/family_gate.go:351:17: web.Server.ServeFamilyLogin calls http.Request.ParseForm
|
|
#30: internal/web/family_gate.go:351:17: web.Server.ServeFamilyLogin calls http.Request.ParseForm
|
|
#31: internal/web/recovery_handlers.go:347:25: web.Server.recoveryUnlockHandler calls http.Request.PostFormValue
|
|
#32: internal/web/recovery_handlers.go:347:25: web.Server.recoveryUnlockHandler calls http.Request.PostFormValue
|
|
#33: internal/selfupdate/updater.go:255:18: selfupdate.Updater.queryRegistry calls http.Request.SetBasicAuth
|
|
#34: internal/selfupdate/updater.go:255:18: selfupdate.Updater.queryRegistry calls http.Request.SetBasicAuth
|
|
#35: internal/web/server.go:1163:16: web.Server.serveAsset calls http.ServeFile
|
|
#36: internal/web/server.go:1163:16: web.Server.serveAsset calls http.ServeFile
|
|
#37: cmd/controller/main.go:2138:12: controller.main calls http.ServeMux.Handle
|
|
#38: cmd/controller/main.go:2138:12: controller.main calls http.ServeMux.Handle
|
|
#39: internal/setup/handlers.go:90:16: setup.Server.Handler calls http.ServeMux.HandleFunc
|
|
#40: internal/setup/handlers.go:90:16: setup.Server.Handler calls http.ServeMux.HandleFunc
|
|
#41: cmd/controller/main.go:2214:33: controller.main calls http.Server.ListenAndServe
|
|
#42: cmd/controller/main.go:2214:33: controller.main calls http.Server.ListenAndServe
|
|
#43: cmd/controller/main.go:3759:21: controller.runSetupMode calls http.Server.Shutdown
|
|
#44: cmd/controller/main.go:3759:21: controller.runSetupMode calls http.Server.Shutdown
|
|
#45: internal/web/family_gate.go:395:16: web.Server.ServeFamilyLogout calls http.SetCookie
|
|
#46: internal/web/family_gate.go:395:16: web.Server.ServeFamilyLogout calls http.SetCookie
|
|
#47: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.body.Close
|
|
#48: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.body.Close
|
|
#49: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.body.Read
|
|
#50: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.body.Read
|
|
#51: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.bodyEOFSignal.Close
|
|
#52: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.bodyEOFSignal.Close
|
|
#53: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.bodyEOFSignal.Read
|
|
#54: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.bodyEOFSignal.Read
|
|
#55: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.bodyLocked.Read
|
|
#56: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.bodyLocked.Read
|
|
#57: internal/sockheal/sockheal.go:78:29: sockheal.PingSocket calls io.WriteString, which calls http.bufioFlushWriter.Write
|
|
#58: internal/sockheal/sockheal.go:78:29: sockheal.PingSocket calls io.WriteString, which calls http.bufioFlushWriter.Write
|
|
#59: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.cancelTimerBody.Close
|
|
#60: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.cancelTimerBody.Close
|
|
#61: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.cancelTimerBody.Read
|
|
#62: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.cancelTimerBody.Read
|
|
#63: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.checkConnErrorWriter.Write
|
|
#64: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.checkConnErrorWriter.Write
|
|
#65: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.chunkWriter.Write
|
|
#66: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.chunkWriter.Write
|
|
#67: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.connReader.Read
|
|
#68: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.connReader.Read
|
|
#69: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.expectContinueReader.Read
|
|
#70: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.expectContinueReader.Read
|
|
#71: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.gzipReader.Close
|
|
#72: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.gzipReader.Close
|
|
#73: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.gzipReader.Read
|
|
#74: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.gzipReader.Read
|
|
#75: internal/util/msgerr.go:150:18: util.ErrText calls http.http2ConnectionError.Error
|
|
#76: internal/util/msgerr.go:150:18: util.ErrText calls http.http2ConnectionError.Error
|
|
#77: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2ErrCode.String
|
|
#78: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2ErrCode.String
|
|
#79: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2FrameHeader.String
|
|
#80: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2FrameHeader.String
|
|
#81: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2FrameType.String
|
|
#82: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2FrameType.String
|
|
#83: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2FrameWriteRequest.String
|
|
#84: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2FrameWriteRequest.String
|
|
#85: internal/util/msgerr.go:150:18: util.ErrText calls http.http2GoAwayError.Error
|
|
#86: internal/util/msgerr.go:150:18: util.ErrText calls http.http2GoAwayError.Error
|
|
#87: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2Setting.String
|
|
#88: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2Setting.String
|
|
#89: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2SettingID.String
|
|
#90: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2SettingID.String
|
|
#91: internal/util/msgerr.go:150:18: util.ErrText calls http.http2StreamError.Error
|
|
#92: internal/util/msgerr.go:150:18: util.ErrText calls http.http2StreamError.Error
|
|
#93: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.http2bufferedWriterTimeoutWriter.Write
|
|
#94: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.http2bufferedWriterTimeoutWriter.Write
|
|
#95: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.http2chunkWriter.Write
|
|
#96: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.http2chunkWriter.Write
|
|
#97: internal/util/msgerr.go:150:18: util.ErrText calls http.http2connError.Error
|
|
#98: internal/util/msgerr.go:150:18: util.ErrText calls http.http2connError.Error
|
|
#99: internal/util/msgerr.go:150:18: util.ErrText calls http.http2duplicatePseudoHeaderError.Error
|
|
#100: internal/util/msgerr.go:150:18: util.ErrText calls http.http2duplicatePseudoHeaderError.Error
|
|
#101: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.http2gzipReader.Close
|
|
#102: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.http2gzipReader.Close
|
|
#103: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.http2gzipReader.Read
|
|
#104: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.http2gzipReader.Read
|
|
#105: internal/util/msgerr.go:150:18: util.ErrText calls http.http2headerFieldNameError.Error
|
|
#106: internal/util/msgerr.go:150:18: util.ErrText calls http.http2headerFieldNameError.Error
|
|
#107: internal/util/msgerr.go:150:18: util.ErrText calls http.http2headerFieldValueError.Error
|
|
#108: internal/util/msgerr.go:150:18: util.ErrText calls http.http2headerFieldValueError.Error
|
|
#109: internal/util/msgerr.go:150:18: util.ErrText calls http.http2pseudoHeaderError.Error
|
|
#110: internal/util/msgerr.go:150:18: util.ErrText calls http.http2pseudoHeaderError.Error
|
|
#111: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.http2requestBody.Read
|
|
#112: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.http2requestBody.Read
|
|
#113: internal/api/selfrestart.go:39:10: api.flushResponse calls http.http2responseWriter.Flush
|
|
#114: internal/api/selfrestart.go:39:10: api.flushResponse calls http.http2responseWriter.Flush
|
|
#115: internal/web/setup_gate.go:367:17: web.Server.ServeSignupClosed calls http.http2responseWriter.Write
|
|
#116: internal/web/setup_gate.go:367:17: web.Server.ServeSignupClosed calls http.http2responseWriter.Write
|
|
#117: internal/web/setup_gate.go:366:16: web.Server.ServeSignupClosed calls http.http2responseWriter.WriteHeader
|
|
#118: internal/web/setup_gate.go:366:16: web.Server.ServeSignupClosed calls http.http2responseWriter.WriteHeader
|
|
#119: internal/sockheal/sockheal.go:78:29: sockheal.PingSocket calls io.WriteString, which calls http.http2responseWriter.WriteString
|
|
#120: internal/sockheal/sockheal.go:78:29: sockheal.PingSocket calls io.WriteString, which calls http.http2responseWriter.WriteString
|
|
#121: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.http2stickyErrWriter.Write
|
|
#122: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.http2stickyErrWriter.Write
|
|
#123: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.http2transportResponseBody.Close
|
|
#124: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.http2transportResponseBody.Close
|
|
#125: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.http2transportResponseBody.Read
|
|
#126: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.http2transportResponseBody.Read
|
|
#127: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2writeData.String
|
|
#128: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2writeData.String
|
|
#129: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.loggingConn.Read
|
|
#130: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.loggingConn.Read
|
|
#131: internal/web/claim.go:486:14: web.PrintLocalResetCode calls fmt.Fprintf, which calls http.loggingConn.Write
|
|
#132: internal/web/claim.go:486:14: web.PrintLocalResetCode calls fmt.Fprintf, which calls http.loggingConn.Write
|
|
#133: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.maxBytesReader.Read
|
|
#134: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.maxBytesReader.Read
|
|
#135: internal/web/auth.go:341:16: web.Server.Close calls sync.Once.Do, which eventually calls http.onceCloseListener.Close
|
|
#136: internal/web/auth.go:341:16: web.Server.Close calls sync.Once.Do, which eventually calls http.onceCloseListener.Close
|
|
#137: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.persistConn.Read
|
|
#138: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.persistConn.Read
|
|
#139: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.persistConnWriter.ReadFrom
|
|
#140: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.persistConnWriter.ReadFrom
|
|
#141: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.persistConnWriter.Write
|
|
#142: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.persistConnWriter.Write
|
|
#143: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.readTrackingBody.Read
|
|
#144: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.readTrackingBody.Read
|
|
#145: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.readWriteCloserBody.Read
|
|
#146: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.readWriteCloserBody.Read
|
|
#147: internal/api/selfrestart.go:39:10: api.flushResponse calls http.response.Flush
|
|
#148: internal/api/selfrestart.go:39:10: api.flushResponse calls http.response.Flush
|
|
#149: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.response.ReadFrom
|
|
#150: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.response.ReadFrom
|
|
#151: internal/web/setup_gate.go:367:17: web.Server.ServeSignupClosed calls http.response.Write
|
|
#152: internal/web/setup_gate.go:367:17: web.Server.ServeSignupClosed calls http.response.Write
|
|
#153: internal/web/setup_gate.go:366:16: web.Server.ServeSignupClosed calls http.response.WriteHeader
|
|
#154: internal/web/setup_gate.go:366:16: web.Server.ServeSignupClosed calls http.response.WriteHeader
|
|
#155: internal/sockheal/sockheal.go:78:29: sockheal.PingSocket calls io.WriteString, which calls http.response.WriteString
|
|
#156: internal/sockheal/sockheal.go:78:29: sockheal.PingSocket calls io.WriteString, which calls http.response.WriteString
|
|
#157: internal/util/msgerr.go:150:18: util.ErrText calls http.transportReadFromServerError.Error
|
|
#158: internal/util/msgerr.go:150:18: util.ErrText calls http.transportReadFromServerError.Error
|
|
|
|
Vulnerability #4: GO-2026-6611
|
|
Excessive CPU consumption from repeated initial window changes in net/http
|
|
More info: https://pkg.go.dev/vuln/GO-2026-6611
|
|
Standard library
|
|
Found in: net/http@go1.26
|
|
Fixed in: net/http@go1.26.9
|
|
Example traces found:
|
|
#1: internal/agentapi/client.go:153:53: agentapi.Client.Close calls http.Client.CloseIdleConnections
|
|
#2: internal/agentapi/client.go:153:53: agentapi.Client.Close calls http.Client.CloseIdleConnections
|
|
#3: internal/notify/notifier.go:1159:30: notify.Notifier.PushTestEventSync calls http.Client.Do
|
|
#4: internal/notify/notifier.go:1159:30: notify.Notifier.PushTestEventSync calls http.Client.Do
|
|
#5: internal/stacks/setup_gate.go:374:20: stacks.init calls http.Client.Get
|
|
#6: internal/stacks/setup_gate.go:374:20: stacks.init calls http.Client.Get
|
|
#7: cmd/controller/main.go:2113:29: controller.main calls http.Client.Head
|
|
#8: cmd/controller/main.go:2113:29: controller.main calls http.Client.Head
|
|
#9: internal/web/setup_gate.go:279:13: web.Server.ServeGateStart calls http.Error
|
|
#10: internal/web/setup_gate.go:279:13: web.Server.ServeGateStart calls http.Error
|
|
#11: internal/web/setup_gate.go:364:35: web.Server.ServeSignupClosed calls http.Header.Get
|
|
#12: internal/web/setup_gate.go:364:35: web.Server.ServeSignupClosed calls http.Header.Get
|
|
#13: internal/notify/notifier.go:1156:16: notify.Notifier.PushTestEventSync calls http.Header.Set
|
|
#14: internal/notify/notifier.go:1156:16: notify.Notifier.PushTestEventSync calls http.Header.Set
|
|
#15: internal/web/clientaddr.go:99:35: web.clientIP calls http.Header.Values
|
|
#16: internal/web/clientaddr.go:99:35: web.clientIP calls http.Header.Values
|
|
#17: internal/notify/notifier.go:1152:29: notify.Notifier.PushTestEventSync calls http.NewRequest
|
|
#18: internal/notify/notifier.go:1152:29: notify.Notifier.PushTestEventSync calls http.NewRequest
|
|
#19: internal/agentapi/client.go:667:40: agentapi.Client.WipeStagedEscrowSecret calls http.NewRequestWithContext
|
|
#20: internal/agentapi/client.go:667:40: agentapi.Client.WipeStagedEscrowSecret calls http.NewRequestWithContext
|
|
#21: internal/web/server.go:865:16: web.Server.ServeHTTP calls http.NotFound
|
|
#22: internal/web/server.go:865:16: web.Server.ServeHTTP calls http.NotFound
|
|
#23: internal/web/server.go:583:16: web.Server.ServeHTTP calls http.Redirect
|
|
#24: internal/web/server.go:583:16: web.Server.ServeHTTP calls http.Redirect
|
|
#25: internal/web/family_gate.go:390:23: web.Server.ServeFamilyLogout calls http.Request.Cookie
|
|
#26: internal/web/family_gate.go:390:23: web.Server.ServeFamilyLogout calls http.Request.Cookie
|
|
#27: internal/web/family_gate.go:352:19: web.Server.ServeFamilyLogin calls http.Request.FormValue
|
|
#28: internal/web/family_gate.go:352:19: web.Server.ServeFamilyLogin calls http.Request.FormValue
|
|
#29: internal/web/family_gate.go:351:17: web.Server.ServeFamilyLogin calls http.Request.ParseForm
|
|
#30: internal/web/family_gate.go:351:17: web.Server.ServeFamilyLogin calls http.Request.ParseForm
|
|
#31: internal/web/recovery_handlers.go:347:25: web.Server.recoveryUnlockHandler calls http.Request.PostFormValue
|
|
#32: internal/web/recovery_handlers.go:347:25: web.Server.recoveryUnlockHandler calls http.Request.PostFormValue
|
|
#33: internal/selfupdate/updater.go:255:18: selfupdate.Updater.queryRegistry calls http.Request.SetBasicAuth
|
|
#34: internal/selfupdate/updater.go:255:18: selfupdate.Updater.queryRegistry calls http.Request.SetBasicAuth
|
|
#35: internal/web/server.go:1163:16: web.Server.serveAsset calls http.ServeFile
|
|
#36: internal/web/server.go:1163:16: web.Server.serveAsset calls http.ServeFile
|
|
#37: cmd/controller/main.go:2138:12: controller.main calls http.ServeMux.Handle
|
|
#38: cmd/controller/main.go:2138:12: controller.main calls http.ServeMux.Handle
|
|
#39: internal/setup/handlers.go:90:16: setup.Server.Handler calls http.ServeMux.HandleFunc
|
|
#40: internal/setup/handlers.go:90:16: setup.Server.Handler calls http.ServeMux.HandleFunc
|
|
#41: cmd/controller/main.go:2214:33: controller.main calls http.Server.ListenAndServe
|
|
#42: cmd/controller/main.go:2214:33: controller.main calls http.Server.ListenAndServe
|
|
#43: cmd/controller/main.go:3759:21: controller.runSetupMode calls http.Server.Shutdown
|
|
#44: cmd/controller/main.go:3759:21: controller.runSetupMode calls http.Server.Shutdown
|
|
#45: internal/web/family_gate.go:395:16: web.Server.ServeFamilyLogout calls http.SetCookie
|
|
#46: internal/web/family_gate.go:395:16: web.Server.ServeFamilyLogout calls http.SetCookie
|
|
#47: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.body.Close
|
|
#48: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.body.Close
|
|
#49: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.body.Read
|
|
#50: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.body.Read
|
|
#51: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.bodyEOFSignal.Close
|
|
#52: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.bodyEOFSignal.Close
|
|
#53: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.bodyEOFSignal.Read
|
|
#54: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.bodyEOFSignal.Read
|
|
#55: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.bodyLocked.Read
|
|
#56: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.bodyLocked.Read
|
|
#57: internal/sockheal/sockheal.go:78:29: sockheal.PingSocket calls io.WriteString, which calls http.bufioFlushWriter.Write
|
|
#58: internal/sockheal/sockheal.go:78:29: sockheal.PingSocket calls io.WriteString, which calls http.bufioFlushWriter.Write
|
|
#59: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.cancelTimerBody.Close
|
|
#60: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.cancelTimerBody.Close
|
|
#61: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.cancelTimerBody.Read
|
|
#62: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.cancelTimerBody.Read
|
|
#63: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.checkConnErrorWriter.Write
|
|
#64: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.checkConnErrorWriter.Write
|
|
#65: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.chunkWriter.Write
|
|
#66: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.chunkWriter.Write
|
|
#67: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.connReader.Read
|
|
#68: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.connReader.Read
|
|
#69: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.expectContinueReader.Read
|
|
#70: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.expectContinueReader.Read
|
|
#71: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.gzipReader.Close
|
|
#72: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.gzipReader.Close
|
|
#73: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.gzipReader.Read
|
|
#74: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.gzipReader.Read
|
|
#75: internal/util/msgerr.go:150:18: util.ErrText calls http.http2ConnectionError.Error
|
|
#76: internal/util/msgerr.go:150:18: util.ErrText calls http.http2ConnectionError.Error
|
|
#77: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2ErrCode.String
|
|
#78: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2ErrCode.String
|
|
#79: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2FrameHeader.String
|
|
#80: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2FrameHeader.String
|
|
#81: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2FrameType.String
|
|
#82: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2FrameType.String
|
|
#83: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2FrameWriteRequest.String
|
|
#84: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2FrameWriteRequest.String
|
|
#85: internal/util/msgerr.go:150:18: util.ErrText calls http.http2GoAwayError.Error
|
|
#86: internal/util/msgerr.go:150:18: util.ErrText calls http.http2GoAwayError.Error
|
|
#87: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2Setting.String
|
|
#88: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2Setting.String
|
|
#89: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2SettingID.String
|
|
#90: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2SettingID.String
|
|
#91: internal/util/msgerr.go:150:18: util.ErrText calls http.http2StreamError.Error
|
|
#92: internal/util/msgerr.go:150:18: util.ErrText calls http.http2StreamError.Error
|
|
#93: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.http2bufferedWriterTimeoutWriter.Write
|
|
#94: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.http2bufferedWriterTimeoutWriter.Write
|
|
#95: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.http2chunkWriter.Write
|
|
#96: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.http2chunkWriter.Write
|
|
#97: internal/util/msgerr.go:150:18: util.ErrText calls http.http2connError.Error
|
|
#98: internal/util/msgerr.go:150:18: util.ErrText calls http.http2connError.Error
|
|
#99: internal/util/msgerr.go:150:18: util.ErrText calls http.http2duplicatePseudoHeaderError.Error
|
|
#100: internal/util/msgerr.go:150:18: util.ErrText calls http.http2duplicatePseudoHeaderError.Error
|
|
#101: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.http2gzipReader.Close
|
|
#102: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.http2gzipReader.Close
|
|
#103: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.http2gzipReader.Read
|
|
#104: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.http2gzipReader.Read
|
|
#105: internal/util/msgerr.go:150:18: util.ErrText calls http.http2headerFieldNameError.Error
|
|
#106: internal/util/msgerr.go:150:18: util.ErrText calls http.http2headerFieldNameError.Error
|
|
#107: internal/util/msgerr.go:150:18: util.ErrText calls http.http2headerFieldValueError.Error
|
|
#108: internal/util/msgerr.go:150:18: util.ErrText calls http.http2headerFieldValueError.Error
|
|
#109: internal/util/msgerr.go:150:18: util.ErrText calls http.http2pseudoHeaderError.Error
|
|
#110: internal/util/msgerr.go:150:18: util.ErrText calls http.http2pseudoHeaderError.Error
|
|
#111: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.http2requestBody.Read
|
|
#112: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.http2requestBody.Read
|
|
#113: internal/api/selfrestart.go:39:10: api.flushResponse calls http.http2responseWriter.Flush
|
|
#114: internal/api/selfrestart.go:39:10: api.flushResponse calls http.http2responseWriter.Flush
|
|
#115: internal/web/setup_gate.go:367:17: web.Server.ServeSignupClosed calls http.http2responseWriter.Write
|
|
#116: internal/web/setup_gate.go:367:17: web.Server.ServeSignupClosed calls http.http2responseWriter.Write
|
|
#117: internal/web/setup_gate.go:366:16: web.Server.ServeSignupClosed calls http.http2responseWriter.WriteHeader
|
|
#118: internal/web/setup_gate.go:366:16: web.Server.ServeSignupClosed calls http.http2responseWriter.WriteHeader
|
|
#119: internal/sockheal/sockheal.go:78:29: sockheal.PingSocket calls io.WriteString, which calls http.http2responseWriter.WriteString
|
|
#120: internal/sockheal/sockheal.go:78:29: sockheal.PingSocket calls io.WriteString, which calls http.http2responseWriter.WriteString
|
|
#121: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.http2stickyErrWriter.Write
|
|
#122: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.http2stickyErrWriter.Write
|
|
#123: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.http2transportResponseBody.Close
|
|
#124: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.http2transportResponseBody.Close
|
|
#125: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.http2transportResponseBody.Read
|
|
#126: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.http2transportResponseBody.Read
|
|
#127: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2writeData.String
|
|
#128: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2writeData.String
|
|
#129: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.loggingConn.Read
|
|
#130: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.loggingConn.Read
|
|
#131: internal/web/claim.go:486:14: web.PrintLocalResetCode calls fmt.Fprintf, which calls http.loggingConn.Write
|
|
#132: internal/web/claim.go:486:14: web.PrintLocalResetCode calls fmt.Fprintf, which calls http.loggingConn.Write
|
|
#133: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.maxBytesReader.Read
|
|
#134: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.maxBytesReader.Read
|
|
#135: internal/web/auth.go:341:16: web.Server.Close calls sync.Once.Do, which eventually calls http.onceCloseListener.Close
|
|
#136: internal/web/auth.go:341:16: web.Server.Close calls sync.Once.Do, which eventually calls http.onceCloseListener.Close
|
|
#137: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.persistConn.Read
|
|
#138: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.persistConn.Read
|
|
#139: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.persistConnWriter.ReadFrom
|
|
#140: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.persistConnWriter.ReadFrom
|
|
#141: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.persistConnWriter.Write
|
|
#142: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.persistConnWriter.Write
|
|
#143: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.readTrackingBody.Read
|
|
#144: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.readTrackingBody.Read
|
|
#145: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.readWriteCloserBody.Read
|
|
#146: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.readWriteCloserBody.Read
|
|
#147: internal/api/selfrestart.go:39:10: api.flushResponse calls http.response.Flush
|
|
#148: internal/api/selfrestart.go:39:10: api.flushResponse calls http.response.Flush
|
|
#149: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.response.ReadFrom
|
|
#150: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.response.ReadFrom
|
|
#151: internal/web/setup_gate.go:367:17: web.Server.ServeSignupClosed calls http.response.Write
|
|
#152: internal/web/setup_gate.go:367:17: web.Server.ServeSignupClosed calls http.response.Write
|
|
#153: internal/web/setup_gate.go:366:16: web.Server.ServeSignupClosed calls http.response.WriteHeader
|
|
#154: internal/web/setup_gate.go:366:16: web.Server.ServeSignupClosed calls http.response.WriteHeader
|
|
#155: internal/sockheal/sockheal.go:78:29: sockheal.PingSocket calls io.WriteString, which calls http.response.WriteString
|
|
#156: internal/sockheal/sockheal.go:78:29: sockheal.PingSocket calls io.WriteString, which calls http.response.WriteString
|
|
#157: internal/util/msgerr.go:150:18: util.ErrText calls http.transportReadFromServerError.Error
|
|
#158: internal/util/msgerr.go:150:18: util.ErrText calls http.transportReadFromServerError.Error
|
|
|
|
Vulnerability #5: GO-2026-6610
|
|
HTTP/2 transport accepts malformed framing-related headers in net/http
|
|
More info: https://pkg.go.dev/vuln/GO-2026-6610
|
|
Standard library
|
|
Found in: net/http@go1.26
|
|
Fixed in: net/http@go1.26.9
|
|
Example traces found:
|
|
#1: internal/agentapi/client.go:153:53: agentapi.Client.Close calls http.Client.CloseIdleConnections
|
|
#2: internal/agentapi/client.go:153:53: agentapi.Client.Close calls http.Client.CloseIdleConnections
|
|
#3: internal/notify/notifier.go:1159:30: notify.Notifier.PushTestEventSync calls http.Client.Do
|
|
#4: internal/notify/notifier.go:1159:30: notify.Notifier.PushTestEventSync calls http.Client.Do
|
|
#5: internal/stacks/setup_gate.go:374:20: stacks.init calls http.Client.Get
|
|
#6: internal/stacks/setup_gate.go:374:20: stacks.init calls http.Client.Get
|
|
#7: cmd/controller/main.go:2113:29: controller.main calls http.Client.Head
|
|
#8: cmd/controller/main.go:2113:29: controller.main calls http.Client.Head
|
|
|
|
Vulnerability #6: GO-2026-6609
|
|
Lack of limit on size of parsed Range headers in net/http
|
|
More info: https://pkg.go.dev/vuln/GO-2026-6609
|
|
Standard library
|
|
Found in: net/http@go1.26
|
|
Fixed in: net/http@go1.26.9
|
|
Example traces found:
|
|
#1: internal/web/server.go:1163:16: web.Server.serveAsset calls http.ServeFile
|
|
|
|
Vulnerability #7: GO-2026-6608
|
|
Memory limit bypass when parsing MIME headers in net/textproto,
|
|
mime/multipart
|
|
More info: https://pkg.go.dev/vuln/GO-2026-6608
|
|
Standard library
|
|
Found in: net/textproto@go1.26
|
|
Fixed in: net/textproto@go1.26.9
|
|
Example traces found:
|
|
#1: internal/web/family_gate.go:352:19: web.Server.ServeFamilyLogin calls http.Request.FormValue, which eventually calls multipart.Reader.ReadForm
|
|
#2: internal/mailrelay/policy.go:41:30: mailrelay.FromDomain calls mail.ReadMessage, which eventually calls textproto.Reader.ReadContinuedLine
|
|
#3: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which eventually calls textproto.Reader.ReadMIMEHeader
|
|
|
|
Vulnerability #8: GO-2026-6607
|
|
Reject malformed ECH outer extension references in crypto/tls
|
|
More info: https://pkg.go.dev/vuln/GO-2026-6607
|
|
Standard library
|
|
Found in: crypto/tls@go1.26
|
|
Fixed in: crypto/tls@go1.26.9
|
|
Example traces found:
|
|
#1: internal/mailrelay/server.go:168:34: mailrelay.Start calls smtp.Server.Serve, which eventually calls tls.Conn.Handshake
|
|
#2: cmd/controller/main.go:2214:33: controller.main calls http.Server.ListenAndServe, which eventually calls tls.Conn.HandshakeContext
|
|
#3: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls tls.Conn.Read
|
|
#4: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls tls.Conn.Write
|
|
#5: internal/notify/notifier.go:1159:30: notify.Notifier.PushTestEventSync calls http.Client.Do, which eventually calls tls.Dialer.DialContext
|
|
|
|
Vulnerability #9: GO-2026-6605
|
|
HTTP/1 client connection desynchronization after CONNECT rejection in
|
|
net/http
|
|
More info: https://pkg.go.dev/vuln/GO-2026-6605
|
|
Standard library
|
|
Found in: net/http@go1.26
|
|
Fixed in: net/http@go1.26.9
|
|
Example traces found:
|
|
#1: internal/agentapi/client.go:153:53: agentapi.Client.Close calls http.Client.CloseIdleConnections
|
|
#2: internal/notify/notifier.go:1159:30: notify.Notifier.PushTestEventSync calls http.Client.Do
|
|
#3: internal/stacks/setup_gate.go:374:20: stacks.init calls http.Client.Get
|
|
#4: cmd/controller/main.go:2113:29: controller.main calls http.Client.Head
|
|
|
|
Vulnerability #10: GO-2026-6603
|
|
HTTP/2 server memory exhaustion due to Trailer headers in net/http
|
|
More info: https://pkg.go.dev/vuln/GO-2026-6603
|
|
Standard library
|
|
Found in: net/http@go1.26
|
|
Fixed in: net/http@go1.26.9
|
|
Example traces found:
|
|
#1: internal/agentapi/client.go:153:53: agentapi.Client.Close calls http.Client.CloseIdleConnections
|
|
#2: internal/agentapi/client.go:153:53: agentapi.Client.Close calls http.Client.CloseIdleConnections
|
|
#3: internal/notify/notifier.go:1159:30: notify.Notifier.PushTestEventSync calls http.Client.Do
|
|
#4: internal/notify/notifier.go:1159:30: notify.Notifier.PushTestEventSync calls http.Client.Do
|
|
#5: internal/stacks/setup_gate.go:374:20: stacks.init calls http.Client.Get
|
|
#6: internal/stacks/setup_gate.go:374:20: stacks.init calls http.Client.Get
|
|
#7: cmd/controller/main.go:2113:29: controller.main calls http.Client.Head
|
|
#8: cmd/controller/main.go:2113:29: controller.main calls http.Client.Head
|
|
#9: internal/web/setup_gate.go:279:13: web.Server.ServeGateStart calls http.Error
|
|
#10: internal/web/setup_gate.go:279:13: web.Server.ServeGateStart calls http.Error
|
|
#11: internal/web/setup_gate.go:364:35: web.Server.ServeSignupClosed calls http.Header.Get
|
|
#12: internal/web/setup_gate.go:364:35: web.Server.ServeSignupClosed calls http.Header.Get
|
|
#13: internal/notify/notifier.go:1156:16: notify.Notifier.PushTestEventSync calls http.Header.Set
|
|
#14: internal/notify/notifier.go:1156:16: notify.Notifier.PushTestEventSync calls http.Header.Set
|
|
#15: internal/web/clientaddr.go:99:35: web.clientIP calls http.Header.Values
|
|
#16: internal/web/clientaddr.go:99:35: web.clientIP calls http.Header.Values
|
|
#17: internal/notify/notifier.go:1152:29: notify.Notifier.PushTestEventSync calls http.NewRequest
|
|
#18: internal/notify/notifier.go:1152:29: notify.Notifier.PushTestEventSync calls http.NewRequest
|
|
#19: internal/agentapi/client.go:667:40: agentapi.Client.WipeStagedEscrowSecret calls http.NewRequestWithContext
|
|
#20: internal/agentapi/client.go:667:40: agentapi.Client.WipeStagedEscrowSecret calls http.NewRequestWithContext
|
|
#21: internal/web/server.go:865:16: web.Server.ServeHTTP calls http.NotFound
|
|
#22: internal/web/server.go:865:16: web.Server.ServeHTTP calls http.NotFound
|
|
#23: internal/web/server.go:583:16: web.Server.ServeHTTP calls http.Redirect
|
|
#24: internal/web/server.go:583:16: web.Server.ServeHTTP calls http.Redirect
|
|
#25: internal/web/family_gate.go:390:23: web.Server.ServeFamilyLogout calls http.Request.Cookie
|
|
#26: internal/web/family_gate.go:390:23: web.Server.ServeFamilyLogout calls http.Request.Cookie
|
|
#27: internal/web/family_gate.go:352:19: web.Server.ServeFamilyLogin calls http.Request.FormValue
|
|
#28: internal/web/family_gate.go:352:19: web.Server.ServeFamilyLogin calls http.Request.FormValue
|
|
#29: internal/web/family_gate.go:351:17: web.Server.ServeFamilyLogin calls http.Request.ParseForm
|
|
#30: internal/web/family_gate.go:351:17: web.Server.ServeFamilyLogin calls http.Request.ParseForm
|
|
#31: internal/web/recovery_handlers.go:347:25: web.Server.recoveryUnlockHandler calls http.Request.PostFormValue
|
|
#32: internal/web/recovery_handlers.go:347:25: web.Server.recoveryUnlockHandler calls http.Request.PostFormValue
|
|
#33: internal/selfupdate/updater.go:255:18: selfupdate.Updater.queryRegistry calls http.Request.SetBasicAuth
|
|
#34: internal/selfupdate/updater.go:255:18: selfupdate.Updater.queryRegistry calls http.Request.SetBasicAuth
|
|
#35: internal/web/server.go:1163:16: web.Server.serveAsset calls http.ServeFile
|
|
#36: internal/web/server.go:1163:16: web.Server.serveAsset calls http.ServeFile
|
|
#37: cmd/controller/main.go:2138:12: controller.main calls http.ServeMux.Handle
|
|
#38: cmd/controller/main.go:2138:12: controller.main calls http.ServeMux.Handle
|
|
#39: internal/setup/handlers.go:90:16: setup.Server.Handler calls http.ServeMux.HandleFunc
|
|
#40: internal/setup/handlers.go:90:16: setup.Server.Handler calls http.ServeMux.HandleFunc
|
|
#41: cmd/controller/main.go:2214:33: controller.main calls http.Server.ListenAndServe
|
|
#42: cmd/controller/main.go:2214:33: controller.main calls http.Server.ListenAndServe
|
|
#43: cmd/controller/main.go:3759:21: controller.runSetupMode calls http.Server.Shutdown
|
|
#44: cmd/controller/main.go:3759:21: controller.runSetupMode calls http.Server.Shutdown
|
|
#45: internal/web/family_gate.go:395:16: web.Server.ServeFamilyLogout calls http.SetCookie
|
|
#46: internal/web/family_gate.go:395:16: web.Server.ServeFamilyLogout calls http.SetCookie
|
|
#47: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.body.Close
|
|
#48: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.body.Close
|
|
#49: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.body.Read
|
|
#50: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.body.Read
|
|
#51: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.bodyEOFSignal.Close
|
|
#52: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.bodyEOFSignal.Close
|
|
#53: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.bodyEOFSignal.Read
|
|
#54: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.bodyEOFSignal.Read
|
|
#55: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.bodyLocked.Read
|
|
#56: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.bodyLocked.Read
|
|
#57: internal/sockheal/sockheal.go:78:29: sockheal.PingSocket calls io.WriteString, which calls http.bufioFlushWriter.Write
|
|
#58: internal/sockheal/sockheal.go:78:29: sockheal.PingSocket calls io.WriteString, which calls http.bufioFlushWriter.Write
|
|
#59: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.cancelTimerBody.Close
|
|
#60: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.cancelTimerBody.Close
|
|
#61: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.cancelTimerBody.Read
|
|
#62: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.cancelTimerBody.Read
|
|
#63: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.checkConnErrorWriter.Write
|
|
#64: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.checkConnErrorWriter.Write
|
|
#65: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.chunkWriter.Write
|
|
#66: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.chunkWriter.Write
|
|
#67: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.connReader.Read
|
|
#68: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.connReader.Read
|
|
#69: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.expectContinueReader.Read
|
|
#70: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.expectContinueReader.Read
|
|
#71: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.gzipReader.Close
|
|
#72: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.gzipReader.Close
|
|
#73: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.gzipReader.Read
|
|
#74: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.gzipReader.Read
|
|
#75: internal/util/msgerr.go:150:18: util.ErrText calls http.http2ConnectionError.Error
|
|
#76: internal/util/msgerr.go:150:18: util.ErrText calls http.http2ConnectionError.Error
|
|
#77: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2ErrCode.String
|
|
#78: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2ErrCode.String
|
|
#79: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2FrameHeader.String
|
|
#80: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2FrameHeader.String
|
|
#81: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2FrameType.String
|
|
#82: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2FrameType.String
|
|
#83: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2FrameWriteRequest.String
|
|
#84: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2FrameWriteRequest.String
|
|
#85: internal/util/msgerr.go:150:18: util.ErrText calls http.http2GoAwayError.Error
|
|
#86: internal/util/msgerr.go:150:18: util.ErrText calls http.http2GoAwayError.Error
|
|
#87: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2Setting.String
|
|
#88: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2Setting.String
|
|
#89: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2SettingID.String
|
|
#90: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2SettingID.String
|
|
#91: internal/util/msgerr.go:150:18: util.ErrText calls http.http2StreamError.Error
|
|
#92: internal/util/msgerr.go:150:18: util.ErrText calls http.http2StreamError.Error
|
|
#93: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.http2bufferedWriterTimeoutWriter.Write
|
|
#94: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.http2bufferedWriterTimeoutWriter.Write
|
|
#95: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.http2chunkWriter.Write
|
|
#96: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.http2chunkWriter.Write
|
|
#97: internal/util/msgerr.go:150:18: util.ErrText calls http.http2connError.Error
|
|
#98: internal/util/msgerr.go:150:18: util.ErrText calls http.http2connError.Error
|
|
#99: internal/util/msgerr.go:150:18: util.ErrText calls http.http2duplicatePseudoHeaderError.Error
|
|
#100: internal/util/msgerr.go:150:18: util.ErrText calls http.http2duplicatePseudoHeaderError.Error
|
|
#101: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.http2gzipReader.Close
|
|
#102: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.http2gzipReader.Close
|
|
#103: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.http2gzipReader.Read
|
|
#104: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.http2gzipReader.Read
|
|
#105: internal/util/msgerr.go:150:18: util.ErrText calls http.http2headerFieldNameError.Error
|
|
#106: internal/util/msgerr.go:150:18: util.ErrText calls http.http2headerFieldNameError.Error
|
|
#107: internal/util/msgerr.go:150:18: util.ErrText calls http.http2headerFieldValueError.Error
|
|
#108: internal/util/msgerr.go:150:18: util.ErrText calls http.http2headerFieldValueError.Error
|
|
#109: internal/util/msgerr.go:150:18: util.ErrText calls http.http2pseudoHeaderError.Error
|
|
#110: internal/util/msgerr.go:150:18: util.ErrText calls http.http2pseudoHeaderError.Error
|
|
#111: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.http2requestBody.Read
|
|
#112: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.http2requestBody.Read
|
|
#113: internal/api/selfrestart.go:39:10: api.flushResponse calls http.http2responseWriter.Flush
|
|
#114: internal/api/selfrestart.go:39:10: api.flushResponse calls http.http2responseWriter.Flush
|
|
#115: internal/web/setup_gate.go:367:17: web.Server.ServeSignupClosed calls http.http2responseWriter.Write
|
|
#116: internal/web/setup_gate.go:367:17: web.Server.ServeSignupClosed calls http.http2responseWriter.Write
|
|
#117: internal/web/setup_gate.go:366:16: web.Server.ServeSignupClosed calls http.http2responseWriter.WriteHeader
|
|
#118: internal/web/setup_gate.go:366:16: web.Server.ServeSignupClosed calls http.http2responseWriter.WriteHeader
|
|
#119: internal/sockheal/sockheal.go:78:29: sockheal.PingSocket calls io.WriteString, which calls http.http2responseWriter.WriteString
|
|
#120: internal/sockheal/sockheal.go:78:29: sockheal.PingSocket calls io.WriteString, which calls http.http2responseWriter.WriteString
|
|
#121: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.http2stickyErrWriter.Write
|
|
#122: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.http2stickyErrWriter.Write
|
|
#123: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.http2transportResponseBody.Close
|
|
#124: internal/notify/notifier.go:1165:17: notify.Notifier.PushTestEventSync calls http.http2transportResponseBody.Close
|
|
#125: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.http2transportResponseBody.Read
|
|
#126: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.http2transportResponseBody.Read
|
|
#127: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2writeData.String
|
|
#128: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls http.http2writeData.String
|
|
#129: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.loggingConn.Read
|
|
#130: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.loggingConn.Read
|
|
#131: internal/web/claim.go:486:14: web.PrintLocalResetCode calls fmt.Fprintf, which calls http.loggingConn.Write
|
|
#132: internal/web/claim.go:486:14: web.PrintLocalResetCode calls fmt.Fprintf, which calls http.loggingConn.Write
|
|
#133: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.maxBytesReader.Read
|
|
#134: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.maxBytesReader.Read
|
|
#135: internal/web/auth.go:341:16: web.Server.Close calls sync.Once.Do, which eventually calls http.onceCloseListener.Close
|
|
#136: internal/web/auth.go:341:16: web.Server.Close calls sync.Once.Do, which eventually calls http.onceCloseListener.Close
|
|
#137: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.persistConn.Read
|
|
#138: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.persistConn.Read
|
|
#139: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.persistConnWriter.ReadFrom
|
|
#140: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.persistConnWriter.ReadFrom
|
|
#141: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.persistConnWriter.Write
|
|
#142: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls http.persistConnWriter.Write
|
|
#143: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.readTrackingBody.Read
|
|
#144: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.readTrackingBody.Read
|
|
#145: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.readWriteCloserBody.Read
|
|
#146: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which calls http.readWriteCloserBody.Read
|
|
#147: internal/api/selfrestart.go:39:10: api.flushResponse calls http.response.Flush
|
|
#148: internal/api/selfrestart.go:39:10: api.flushResponse calls http.response.Flush
|
|
#149: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.response.ReadFrom
|
|
#150: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls http.response.ReadFrom
|
|
#151: internal/web/setup_gate.go:367:17: web.Server.ServeSignupClosed calls http.response.Write
|
|
#152: internal/web/setup_gate.go:367:17: web.Server.ServeSignupClosed calls http.response.Write
|
|
#153: internal/web/setup_gate.go:366:16: web.Server.ServeSignupClosed calls http.response.WriteHeader
|
|
#154: internal/web/setup_gate.go:366:16: web.Server.ServeSignupClosed calls http.response.WriteHeader
|
|
#155: internal/sockheal/sockheal.go:78:29: sockheal.PingSocket calls io.WriteString, which calls http.response.WriteString
|
|
#156: internal/sockheal/sockheal.go:78:29: sockheal.PingSocket calls io.WriteString, which calls http.response.WriteString
|
|
#157: internal/util/msgerr.go:150:18: util.ErrText calls http.transportReadFromServerError.Error
|
|
#158: internal/util/msgerr.go:150:18: util.ErrText calls http.transportReadFromServerError.Error
|
|
|
|
Vulnerability #11: GO-2026-6600
|
|
Recognize yield as regexp preceder keyword in html/template
|
|
More info: https://pkg.go.dev/vuln/GO-2026-6600
|
|
Standard library
|
|
Found in: html/template@go1.26
|
|
Fixed in: html/template@go1.26.9
|
|
Example traces found:
|
|
#1: internal/web/server.go:1076:45: web.Server.executeTemplateLang calls template.Template.ExecuteTemplate
|
|
|
|
Vulnerability #12: GO-2026-6599
|
|
Reset context tracking on consecutive template expressions in html/template
|
|
More info: https://pkg.go.dev/vuln/GO-2026-6599
|
|
Standard library
|
|
Found in: html/template@go1.26
|
|
Fixed in: html/template@go1.26.9
|
|
Example traces found:
|
|
#1: internal/web/server.go:1076:45: web.Server.executeTemplateLang calls template.Template.ExecuteTemplate
|
|
|
|
Vulnerability #13: GO-2026-6355
|
|
Prevent DoS on deadlocked established channel in golang.org/x/crypto/ssh
|
|
More info: https://pkg.go.dev/vuln/GO-2026-6355
|
|
Module: golang.org/x/crypto
|
|
Found in: golang.org/x/crypto@v0.31.0
|
|
Fixed in: golang.org/x/crypto@v0.56.0
|
|
Example traces found:
|
|
#1: internal/offsiteapply/seams.go:232:36: offsiteapply.KeyscanScanner.Scan calls ssh.NewClientConn
|
|
|
|
Vulnerability #14: GO-2026-6354
|
|
Prevent DoS on deadlocked undecided channel in golang.org/x/crypto/ssh
|
|
More info: https://pkg.go.dev/vuln/GO-2026-6354
|
|
Module: golang.org/x/crypto
|
|
Found in: golang.org/x/crypto@v0.31.0
|
|
Fixed in: golang.org/x/crypto@v0.56.0
|
|
Example traces found:
|
|
#1: internal/offsiteapply/seams.go:232:36: offsiteapply.KeyscanScanner.Scan calls ssh.NewClientConn
|
|
|
|
Vulnerability #15: GO-2026-6218
|
|
Avoid quadratic complexity in resolvePath in net/url
|
|
More info: https://pkg.go.dev/vuln/GO-2026-6218
|
|
Standard library
|
|
Found in: net/url@go1.26
|
|
Fixed in: net/url@go1.26.6
|
|
Example traces found:
|
|
#1: internal/notify/notifier.go:1159:30: notify.Notifier.PushTestEventSync calls http.Client.Do, which eventually calls url.URL.Parse
|
|
|
|
Vulnerability #16: GO-2026-6091
|
|
Fix Javascript regexp context tracking in html/template
|
|
More info: https://pkg.go.dev/vuln/GO-2026-6091
|
|
Standard library
|
|
Found in: html/template@go1.26
|
|
Fixed in: html/template@go1.26.6
|
|
Example traces found:
|
|
#1: internal/web/server.go:1076:45: web.Server.executeTemplateLang calls template.Template.ExecuteTemplate
|
|
|
|
Vulnerability #17: GO-2026-6090
|
|
Limit handshake messages we are willing to accept post-handshake in
|
|
crypto/tls
|
|
More info: https://pkg.go.dev/vuln/GO-2026-6090
|
|
Standard library
|
|
Found in: crypto/tls@go1.26
|
|
Fixed in: crypto/tls@go1.26.6
|
|
Example traces found:
|
|
#1: internal/mailrelay/server.go:168:34: mailrelay.Start calls smtp.Server.Serve, which eventually calls tls.Conn.Handshake
|
|
#2: cmd/controller/main.go:2214:33: controller.main calls http.Server.ListenAndServe, which eventually calls tls.Conn.HandshakeContext
|
|
#3: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls tls.Conn.Read
|
|
#4: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls tls.Conn.Write
|
|
#5: internal/notify/notifier.go:1159:30: notify.Notifier.PushTestEventSync calls http.Client.Do, which eventually calls tls.Dialer.DialContext
|
|
|
|
Vulnerability #18: GO-2026-6089
|
|
Apply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/http
|
|
More info: https://pkg.go.dev/vuln/GO-2026-6089
|
|
Standard library
|
|
Found in: net/http@go1.26
|
|
Fixed in: net/http@go1.26.6
|
|
Example traces found:
|
|
#1: cmd/controller/main.go:2214:33: controller.main calls http.Server.ListenAndServe
|
|
|
|
Vulnerability #19: GO-2026-5972
|
|
Enforce maximum recursion depth in encoding/asn1
|
|
More info: https://pkg.go.dev/vuln/GO-2026-5972
|
|
Standard library
|
|
Found in: encoding/asn1@go1.26
|
|
Fixed in: encoding/asn1@go1.26.6
|
|
Example traces found:
|
|
#1: internal/offsiteapply/seams.go:312:36: offsiteapply.PublicKeyOf calls ssh.ParsePrivateKey, which eventually calls asn1.Unmarshal
|
|
|
|
Vulnerability #20: GO-2026-5856
|
|
Invoking Encrypted Client Hello privacy leak in crypto/tls
|
|
More info: https://pkg.go.dev/vuln/GO-2026-5856
|
|
Standard library
|
|
Found in: crypto/tls@go1.26
|
|
Fixed in: crypto/tls@go1.26.5
|
|
Example traces found:
|
|
#1: internal/mailrelay/server.go:168:34: mailrelay.Start calls smtp.Server.Serve, which eventually calls tls.Conn.Handshake
|
|
#2: cmd/controller/main.go:2214:33: controller.main calls http.Server.ListenAndServe, which eventually calls tls.Conn.HandshakeContext
|
|
#3: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls tls.Conn.Read
|
|
#4: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls tls.Conn.Write
|
|
#5: internal/notify/notifier.go:1159:30: notify.Notifier.PushTestEventSync calls http.Client.Do, which eventually calls tls.Dialer.DialContext
|
|
|
|
Vulnerability #21: GO-2026-5039
|
|
Arbitrary inputs are included in errors without any escaping in
|
|
net/textproto
|
|
More info: https://pkg.go.dev/vuln/GO-2026-5039
|
|
Standard library
|
|
Found in: net/textproto@go1.26
|
|
Fixed in: net/textproto@go1.26.4
|
|
Example traces found:
|
|
#1: internal/notify/notifier.go:1078:24: notify.Notifier.SyncPreferences calls io.ReadAll, which eventually calls textproto.Reader.ReadMIMEHeader
|
|
|
|
Vulnerability #22: GO-2026-5037
|
|
Inefficient candidate hostname parsing in crypto/x509
|
|
More info: https://pkg.go.dev/vuln/GO-2026-5037
|
|
Standard library
|
|
Found in: crypto/x509@go1.26
|
|
Fixed in: crypto/x509@go1.26.4
|
|
Example traces found:
|
|
#1: cmd/controller/main.go:2214:33: controller.main calls http.Server.ListenAndServe, which eventually calls x509.Certificate.Verify
|
|
#2: cmd/controller/main.go:2214:33: controller.main calls http.Server.ListenAndServe, which eventually calls x509.Certificate.VerifyHostname
|
|
#3: internal/util/msgerr.go:150:18: util.ErrText calls x509.HostnameError.Error
|
|
|
|
Vulnerability #23: GO-2026-5026
|
|
Invoking failure to reject ASCII-only Punycode-encoded labels in
|
|
golang.org/x/net/idna
|
|
More info: https://pkg.go.dev/vuln/GO-2026-5026
|
|
Standard library
|
|
Found in: net/http@go1.26
|
|
Fixed in: net/http@go1.26.6
|
|
Example traces found:
|
|
#1: internal/agentapi/client.go:153:53: agentapi.Client.Close calls http.Client.CloseIdleConnections
|
|
#2: internal/notify/notifier.go:1159:30: notify.Notifier.PushTestEventSync calls http.Client.Do
|
|
#3: internal/stacks/setup_gate.go:374:20: stacks.init calls http.Client.Get
|
|
#4: cmd/controller/main.go:2113:29: controller.main calls http.Client.Head
|
|
|
|
Vulnerability #24: GO-2026-5020
|
|
Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh
|
|
More info: https://pkg.go.dev/vuln/GO-2026-5020
|
|
Module: golang.org/x/crypto
|
|
Found in: golang.org/x/crypto@v0.31.0
|
|
Fixed in: golang.org/x/crypto@v0.52.0
|
|
Example traces found:
|
|
#1: internal/offsiteapply/seams.go:232:36: offsiteapply.KeyscanScanner.Scan calls ssh.NewClientConn
|
|
|
|
Vulnerability #25: GO-2026-5019
|
|
Invoking bypass of FIDO/U2F security keys physical interaction in
|
|
golang.org/x/crypto/ssh
|
|
More info: https://pkg.go.dev/vuln/GO-2026-5019
|
|
Module: golang.org/x/crypto
|
|
Found in: golang.org/x/crypto@v0.31.0
|
|
Fixed in: golang.org/x/crypto@v0.52.0
|
|
Example traces found:
|
|
#1: internal/offsiteapply/seams.go:232:36: offsiteapply.KeyscanScanner.Scan calls ssh.NewClientConn
|
|
|
|
Vulnerability #26: GO-2026-5018
|
|
Invoking pathological RSA/DSA parameters may cause DoS in
|
|
golang.org/x/crypto/ssh
|
|
More info: https://pkg.go.dev/vuln/GO-2026-5018
|
|
Module: golang.org/x/crypto
|
|
Found in: golang.org/x/crypto@v0.31.0
|
|
Fixed in: golang.org/x/crypto@v0.52.0
|
|
Example traces found:
|
|
#1: internal/offsiteapply/seams.go:232:36: offsiteapply.KeyscanScanner.Scan calls ssh.NewClientConn
|
|
#2: internal/offsiteapply/seams.go:321:44: offsiteapply.FingerprintOf calls ssh.ParseAuthorizedKey
|
|
#3: internal/offsiteapply/seams.go:312:36: offsiteapply.PublicKeyOf calls ssh.ParsePrivateKey
|
|
|
|
Vulnerability #27: GO-2026-5017
|
|
Invoking client can cause server deadlock on unexpected responses in
|
|
golang.org/x/crypto/ssh
|
|
More info: https://pkg.go.dev/vuln/GO-2026-5017
|
|
Module: golang.org/x/crypto
|
|
Found in: golang.org/x/crypto@v0.31.0
|
|
Fixed in: golang.org/x/crypto@v0.52.0
|
|
Example traces found:
|
|
#1: internal/offsiteapply/seams.go:232:36: offsiteapply.KeyscanScanner.Scan calls ssh.NewClientConn
|
|
|
|
Vulnerability #28: GO-2026-5013
|
|
Invoking byte arithmetic causes underflow and panic in
|
|
golang.org/x/crypto/ssh
|
|
More info: https://pkg.go.dev/vuln/GO-2026-5013
|
|
Module: golang.org/x/crypto
|
|
Found in: golang.org/x/crypto@v0.31.0
|
|
Fixed in: golang.org/x/crypto@v0.52.0
|
|
Example traces found:
|
|
#1: internal/offsiteapply/seams.go:232:36: offsiteapply.KeyscanScanner.Scan calls ssh.NewClientConn
|
|
|
|
Vulnerability #29: GO-2026-4986
|
|
Quadratic string concatentation in consumeComment in net/mail
|
|
More info: https://pkg.go.dev/vuln/GO-2026-4986
|
|
Standard library
|
|
Found in: net/mail@go1.26
|
|
Fixed in: net/mail@go1.26.3
|
|
Example traces found:
|
|
#1: internal/mailrelay/policy.go:49:32: mailrelay.FromDomain calls mail.ParseAddress
|
|
#2: internal/mailrelay/policy.go:52:38: mailrelay.FromDomain calls mail.ParseAddressList
|
|
|
|
Vulnerability #30: GO-2026-4982
|
|
Bypass of meta content URL escaping causes XSS in html/template
|
|
More info: https://pkg.go.dev/vuln/GO-2026-4982
|
|
Standard library
|
|
Found in: html/template@go1.26
|
|
Fixed in: html/template@go1.26.3
|
|
Example traces found:
|
|
#1: internal/web/server.go:1076:45: web.Server.executeTemplateLang calls template.Template.ExecuteTemplate
|
|
|
|
Vulnerability #31: GO-2026-4980
|
|
Escaper bypass leads to XSS in html/template
|
|
More info: https://pkg.go.dev/vuln/GO-2026-4980
|
|
Standard library
|
|
Found in: html/template@go1.26
|
|
Fixed in: html/template@go1.26.3
|
|
Example traces found:
|
|
#1: internal/web/server.go:1076:45: web.Server.executeTemplateLang calls template.Template.ExecuteTemplate
|
|
|
|
Vulnerability #32: GO-2026-4977
|
|
Quadratic string concatenation in consumePhrase in net/mail
|
|
More info: https://pkg.go.dev/vuln/GO-2026-4977
|
|
Standard library
|
|
Found in: net/mail@go1.26
|
|
Fixed in: net/mail@go1.26.3
|
|
Example traces found:
|
|
#1: internal/mailrelay/policy.go:49:32: mailrelay.FromDomain calls mail.ParseAddress
|
|
#2: internal/mailrelay/policy.go:52:38: mailrelay.FromDomain calls mail.ParseAddressList
|
|
|
|
Vulnerability #33: GO-2026-4971
|
|
Panic in Dial and LookupPort when handling NUL byte on Windows in net
|
|
More info: https://pkg.go.dev/vuln/GO-2026-4971
|
|
Standard library
|
|
Found in: net@go1.26
|
|
Fixed in: net@go1.26.3
|
|
Example traces found:
|
|
#1: internal/stacks/healthprobe.go:227:30: stacks.Manager.probeTCP calls net.DialTimeout
|
|
#2: internal/offsiteapply/seams.go:227:28: offsiteapply.KeyscanScanner.Scan calls net.Dialer.DialContext
|
|
#3: internal/mailrelay/server.go:136:23: mailrelay.Server.Start calls net.Listen
|
|
#4: internal/web/clientaddr.go:68:25: web.peerResolver.has calls net.Resolver.LookupHost
|
|
|
|
Vulnerability #34: GO-2026-4947
|
|
Unexpected work during chain building in crypto/x509
|
|
More info: https://pkg.go.dev/vuln/GO-2026-4947
|
|
Standard library
|
|
Found in: crypto/x509@go1.26
|
|
Fixed in: crypto/x509@go1.26.2
|
|
Example traces found:
|
|
#1: cmd/controller/main.go:2214:33: controller.main calls http.Server.ListenAndServe, which eventually calls x509.Certificate.Verify
|
|
|
|
Vulnerability #35: GO-2026-4946
|
|
Inefficient policy validation in crypto/x509
|
|
More info: https://pkg.go.dev/vuln/GO-2026-4946
|
|
Standard library
|
|
Found in: crypto/x509@go1.26
|
|
Fixed in: crypto/x509@go1.26.2
|
|
Example traces found:
|
|
#1: cmd/controller/main.go:2214:33: controller.main calls http.Server.ListenAndServe, which eventually calls x509.Certificate.Verify
|
|
|
|
Vulnerability #36: GO-2026-4918
|
|
Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in
|
|
net/http/internal/http2 in golang.org/x/net
|
|
More info: https://pkg.go.dev/vuln/GO-2026-4918
|
|
Standard library
|
|
Found in: net/http@go1.26
|
|
Fixed in: net/http@go1.26.3
|
|
Example traces found:
|
|
#1: internal/agentapi/client.go:153:53: agentapi.Client.Close calls http.Client.CloseIdleConnections
|
|
#2: internal/notify/notifier.go:1159:30: notify.Notifier.PushTestEventSync calls http.Client.Do
|
|
#3: internal/stacks/setup_gate.go:374:20: stacks.init calls http.Client.Get
|
|
#4: cmd/controller/main.go:2113:29: controller.main calls http.Client.Head
|
|
|
|
Vulnerability #37: GO-2026-4870
|
|
Unauthenticated TLS 1.3 KeyUpdate record can cause persistent connection
|
|
retention and DoS in crypto/tls
|
|
More info: https://pkg.go.dev/vuln/GO-2026-4870
|
|
Standard library
|
|
Found in: crypto/tls@go1.26
|
|
Fixed in: crypto/tls@go1.26.2
|
|
Example traces found:
|
|
#1: internal/mailrelay/server.go:168:34: mailrelay.Start calls smtp.Server.Serve, which eventually calls tls.Conn.Handshake
|
|
#2: cmd/controller/main.go:2214:33: controller.main calls http.Server.ListenAndServe, which eventually calls tls.Conn.HandshakeContext
|
|
#3: internal/notify/notifier.go:1164:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls tls.Conn.Read
|
|
#4: internal/web/logbuffer.go:199:19: web.LogBuffer.SpillTo calls bufio.Writer.Flush, which calls tls.Conn.Write
|
|
#5: internal/notify/notifier.go:1159:30: notify.Notifier.PushTestEventSync calls http.Client.Do, which eventually calls tls.Dialer.DialContext
|
|
|
|
Vulnerability #38: GO-2026-4869
|
|
Unbounded allocation for old GNU sparse in archive/tar
|
|
More info: https://pkg.go.dev/vuln/GO-2026-4869
|
|
Standard library
|
|
Found in: archive/tar@go1.26
|
|
Fixed in: archive/tar@go1.26.2
|
|
Example traces found:
|
|
#1: internal/appexport/restore.go:145:22: appexport.ReadManifestFromFAB calls tar.Reader.Next
|
|
|
|
Vulnerability #39: GO-2026-4866
|
|
Case-sensitive excludedSubtrees name constraints cause Auth Bypass in
|
|
crypto/x509
|
|
More info: https://pkg.go.dev/vuln/GO-2026-4866
|
|
Standard library
|
|
Found in: crypto/x509@go1.26
|
|
Fixed in: crypto/x509@go1.26.2
|
|
Example traces found:
|
|
#1: cmd/controller/main.go:2214:33: controller.main calls http.Server.ListenAndServe, which eventually calls x509.Certificate.Verify
|
|
|
|
Vulnerability #40: GO-2026-4865
|
|
JsBraceDepth Context Tracking Bugs (XSS) in html/template
|
|
More info: https://pkg.go.dev/vuln/GO-2026-4865
|
|
Standard library
|
|
Found in: html/template@go1.26
|
|
Fixed in: html/template@go1.26.2
|
|
Example traces found:
|
|
#1: internal/util/msgerr.go:150:18: util.ErrText calls template.Error.Error
|
|
#2: internal/web/server.go:1076:45: web.Server.executeTemplateLang calls template.Template.ExecuteTemplate
|
|
#3: internal/setup/handlers.go:78:25: setup.Server.loadTemplates calls template.Template.Funcs
|
|
#4: internal/web/server.go:392:26: web.parseTemplateSet calls template.Template.Parse
|
|
#5: internal/setup/handlers.go:80:13: setup.Server.loadTemplates calls template.Template.ParseFS
|
|
#6: internal/backup/offbox_recovery_cli.go:235:15: backup.RecoverAndInstall calls fmt.Fprintln, which eventually calls template.context.String
|
|
|
|
Vulnerability #41: GO-2026-4603
|
|
URLs in meta content attribute actions are not escaped in html/template
|
|
More info: https://pkg.go.dev/vuln/GO-2026-4603
|
|
Standard library
|
|
Found in: html/template@go1.26
|
|
Fixed in: html/template@go1.26.1
|
|
Example traces found:
|
|
#1: internal/web/server.go:1076:45: web.Server.executeTemplateLang calls template.Template.ExecuteTemplate
|
|
|
|
Vulnerability #42: GO-2026-4602
|
|
FileInfo can escape from a Root in os
|
|
More info: https://pkg.go.dev/vuln/GO-2026-4602
|
|
Standard library
|
|
Found in: os@go1.26
|
|
Fixed in: os@go1.26.1
|
|
Example traces found:
|
|
#1: internal/web/server.go:1163:16: web.Server.serveAsset calls http.ServeFile, which eventually calls os.File.ReadDir
|
|
#2: internal/web/server.go:1163:16: web.Server.serveAsset calls http.ServeFile, which eventually calls os.File.Readdir
|
|
#3: internal/backup/offbox_reconstitute.go:1110:32: backup.Manager.OffsiteScratchPair calls os.ReadDir
|
|
|
|
Vulnerability #43: GO-2026-4601
|
|
Incorrect parsing of IPv6 host literals in net/url
|
|
More info: https://pkg.go.dev/vuln/GO-2026-4601
|
|
Standard library
|
|
Found in: net/url@go1.26
|
|
Fixed in: net/url@go1.26.1
|
|
Example traces found:
|
|
#1: internal/web/family_gate.go:258:24: web.Server.ServeFamilyGateAuth calls url.Parse
|
|
#2: cmd/controller/main.go:2214:33: controller.main calls http.Server.ListenAndServe, which eventually calls url.ParseRequestURI
|
|
#3: internal/notify/notifier.go:1159:30: notify.Notifier.PushTestEventSync calls http.Client.Do, which eventually calls url.URL.Parse
|
|
|
|
Vulnerability #44: GO-2026-4600
|
|
Panic in name constraint checking for malformed certificates in crypto/x509
|
|
More info: https://pkg.go.dev/vuln/GO-2026-4600
|
|
Standard library
|
|
Found in: crypto/x509@go1.26
|
|
Fixed in: crypto/x509@go1.26.1
|
|
Example traces found:
|
|
#1: cmd/controller/main.go:2214:33: controller.main calls http.Server.ListenAndServe, which eventually calls x509.Certificate.Verify
|
|
|
|
Vulnerability #45: GO-2026-4599
|
|
Incorrect enforcement of email constraints in crypto/x509
|
|
More info: https://pkg.go.dev/vuln/GO-2026-4599
|
|
Standard library
|
|
Found in: crypto/x509@go1.26
|
|
Fixed in: crypto/x509@go1.26.1
|
|
Example traces found:
|
|
#1: cmd/controller/main.go:2214:33: controller.main calls http.Server.ListenAndServe, which eventually calls x509.Certificate.Verify
|
|
|
|
Vulnerability #46: GO-2025-3487
|
|
Potential denial of service in golang.org/x/crypto
|
|
More info: https://pkg.go.dev/vuln/GO-2025-3487
|
|
Module: golang.org/x/crypto
|
|
Found in: golang.org/x/crypto@v0.31.0
|
|
Fixed in: golang.org/x/crypto@v0.35.0
|
|
Example traces found:
|
|
#1: internal/offsiteapply/seams.go:232:36: offsiteapply.KeyscanScanner.Scan calls ssh.NewClientConn
|
|
|
|
Your code is affected by 46 vulnerabilities from 1 module and the Go standard library.
|
|
This scan also found 13 vulnerabilities in packages you import and 9
|
|
vulnerabilities in modules you require, but your code doesn't appear to call
|
|
these vulnerabilities.
|
|
Use '-show verbose' for more details.
|