admin/felhom.eu
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
ddbcabebb4e380e4c8c679efd92a3aa10d5f2dbe
felhom.eu/documentation/audits/security-review-2026-10-12/scanners/govulncheck-source-agent.txt
T

795 lines
74 KiB
Plaintext
Raw Blame History

=== Symbol Results ===
Vulnerability #1: GO-2026-6617
HTTP/2 server crash due to HPACK encoder race in net/http
More info: https://pkg.go.dev/vuln/GO-2026-6617
Standard library
Found in: net/http@go1.26
Fixed in: net/http@go1.26.9
Example traces found:
#1: internal/hub/client.go:441:22: hub.Client.PostOSReport calls http.Client.Do
#2: internal/hub/client.go:441:22: hub.Client.PostOSReport calls http.Client.Do
#3: internal/hub/client.go:439:16: hub.Client.PostOSReport calls http.Header.Set
#4: internal/hub/client.go:439:16: hub.Client.PostOSReport calls http.Header.Set
#5: cmd/felhom-opsign/main.go:217:29: felhom.upload calls http.NewRequest
#6: cmd/felhom-opsign/main.go:217:29: felhom.upload calls http.NewRequest
#7: internal/hub/client.go:435:40: hub.Client.PostOSReport calls http.NewRequestWithContext
#8: internal/hub/client.go:435:40: hub.Client.PostOSReport calls http.NewRequestWithContext
#9: internal/selfupdate/executor.go:203:19: selfupdate.Executor.download calls http.Request.SetBasicAuth
#10: internal/selfupdate/executor.go:203:19: selfupdate.Executor.download calls http.Request.SetBasicAuth
#11: internal/localapi/server.go:526:16: localapi.Server.Handler calls http.ServeMux.HandleFunc
#12: internal/localapi/server.go:526:16: localapi.Server.Handler calls http.ServeMux.HandleFunc
#13: internal/localapi/server.go:624:34: localapi.Run calls http.Server.ServeTLS
#14: internal/localapi/server.go:624:34: localapi.Run calls http.Server.ServeTLS
#15: internal/localapi/server.go:630:19: localapi.Server.Run calls http.Server.Shutdown
#16: internal/localapi/server.go:630:19: localapi.Server.Run calls http.Server.Shutdown
#17: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.body.Close
#18: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.body.Close
#19: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.body.Read
#20: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.body.Read
#21: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.bodyEOFSignal.Close
#22: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.bodyEOFSignal.Close
#23: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.bodyEOFSignal.Read
#24: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.bodyEOFSignal.Read
#25: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.bodyLocked.Read
#26: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.bodyLocked.Read
#27: internal/selfupdate/executor.go:218:22: selfupdate.Executor.download calls io.Copy, which eventually calls http.bufioFlushWriter.Write
#28: internal/selfupdate/executor.go:218:22: selfupdate.Executor.download calls io.Copy, which eventually calls http.bufioFlushWriter.Write
#29: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.cancelTimerBody.Close
#30: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.cancelTimerBody.Close
#31: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.cancelTimerBody.Read
#32: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.cancelTimerBody.Read
#33: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.checkConnErrorWriter.Write
#34: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.checkConnErrorWriter.Write
#35: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.chunkWriter.Write
#36: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.chunkWriter.Write
#37: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.connReader.Read
#38: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.connReader.Read
#39: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.expectContinueReader.Read
#40: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.expectContinueReader.Read
#41: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.gzipReader.Close
#42: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.gzipReader.Close
#43: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.gzipReader.Read
#44: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.gzipReader.Read
#45: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2ConnectionError.Error
#46: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2ConnectionError.Error
#47: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2ErrCode.String
#48: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2ErrCode.String
#49: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2FrameHeader.String
#50: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2FrameHeader.String
#51: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2FrameType.String
#52: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2FrameType.String
#53: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2FrameWriteRequest.String
#54: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2FrameWriteRequest.String
#55: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2GoAwayError.Error
#56: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2GoAwayError.Error
#57: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2Setting.String
#58: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2Setting.String
#59: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2SettingID.String
#60: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2SettingID.String
#61: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2StreamError.Error
#62: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2StreamError.Error
#63: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.http2bufferedWriterTimeoutWriter.Write
#64: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.http2bufferedWriterTimeoutWriter.Write
#65: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.http2chunkWriter.Write
#66: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.http2chunkWriter.Write
#67: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2connError.Error
#68: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2connError.Error
#69: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2duplicatePseudoHeaderError.Error
#70: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2duplicatePseudoHeaderError.Error
#71: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.http2gzipReader.Close
#72: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.http2gzipReader.Close
#73: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.http2gzipReader.Read
#74: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.http2gzipReader.Read
#75: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2headerFieldNameError.Error
#76: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2headerFieldNameError.Error
#77: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2headerFieldValueError.Error
#78: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2headerFieldValueError.Error
#79: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2pseudoHeaderError.Error
#80: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2pseudoHeaderError.Error
#81: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.http2requestBody.Read
#82: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.http2requestBody.Read
#83: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which calls http.http2responseWriter.Write
#84: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which calls http.http2responseWriter.Write
#85: internal/localapi/debuglogs.go:50:31: localapi.statusRecorder.WriteHeader calls http.http2responseWriter.WriteHeader
#86: internal/localapi/debuglogs.go:50:31: localapi.statusRecorder.WriteHeader calls http.http2responseWriter.WriteHeader
#87: internal/selfupdate/executor.go:218:22: selfupdate.Executor.download calls io.Copy, which eventually calls http.http2responseWriter.WriteString
#88: internal/selfupdate/executor.go:218:22: selfupdate.Executor.download calls io.Copy, which eventually calls http.http2responseWriter.WriteString
#89: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.http2stickyErrWriter.Write
#90: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.http2stickyErrWriter.Write
#91: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.http2transportResponseBody.Close
#92: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.http2transportResponseBody.Close
#93: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.http2transportResponseBody.Read
#94: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.http2transportResponseBody.Read
#95: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2writeData.String
#96: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2writeData.String
#97: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.loggingConn.Read
#98: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.loggingConn.Read
#99: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which calls http.loggingConn.Write
#100: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which calls http.loggingConn.Write
#101: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.maxBytesReader.Read
#102: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.maxBytesReader.Read
#103: internal/pvegate/pvegate.go:76:10: pvegate.Step calls sync.Once.Do, which eventually calls http.onceCloseListener.Close
#104: internal/pvegate/pvegate.go:76:10: pvegate.Step calls sync.Once.Do, which eventually calls http.onceCloseListener.Close
#105: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.persistConn.Read
#106: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.persistConn.Read
#107: internal/selfupdate/executor.go:218:22: selfupdate.Executor.download calls io.Copy, which eventually calls http.persistConnWriter.ReadFrom
#108: internal/selfupdate/executor.go:218:22: selfupdate.Executor.download calls io.Copy, which eventually calls http.persistConnWriter.ReadFrom
#109: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.persistConnWriter.Write
#110: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.persistConnWriter.Write
#111: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.readTrackingBody.Read
#112: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.readTrackingBody.Read
#113: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.readWriteCloserBody.Read
#114: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.readWriteCloserBody.Read
#115: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which calls http.response.Write
#116: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which calls http.response.Write
#117: internal/localapi/debuglogs.go:50:31: localapi.statusRecorder.WriteHeader calls http.response.WriteHeader
#118: internal/localapi/debuglogs.go:50:31: localapi.statusRecorder.WriteHeader calls http.response.WriteHeader
#119: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.transportReadFromServerError.Error
#120: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.transportReadFromServerError.Error
Vulnerability #2: GO-2026-6613
HTTP/1 server connection desynchronization after 2xx CONNECT response in
net/http
More info: https://pkg.go.dev/vuln/GO-2026-6613
Standard library
Found in: net/http@go1.26
Fixed in: net/http@go1.26.9
Example traces found:
#1: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.CanonicalHeaderKey
#2: internal/hub/client.go:441:22: hub.Client.PostOSReport calls http.Client.Do
#3: internal/localapi/debuglogs.go:50:31: localapi.statusRecorder.WriteHeader calls http.http2responseWriter.WriteHeader, which eventually calls http.Header.Del
#4: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.Header.Get
#5: internal/hub/client.go:439:16: hub.Client.PostOSReport calls http.Header.Set
#6: cmd/felhom-opsign/main.go:217:29: felhom.upload calls http.NewRequest
#7: internal/hub/client.go:435:40: hub.Client.PostOSReport calls http.NewRequestWithContext
#8: internal/selfupdate/executor.go:203:19: selfupdate.Executor.download calls http.Request.SetBasicAuth
#9: internal/localapi/server.go:526:16: localapi.Server.Handler calls http.ServeMux.HandleFunc
#10: internal/localapi/server.go:624:34: localapi.Run calls http.Server.ServeTLS
#11: internal/localapi/server.go:630:19: localapi.Server.Run calls http.Server.Shutdown
#12: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.body.Close
#13: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.body.Read
#14: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.bodyEOFSignal.Close
#15: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.bodyEOFSignal.Read
#16: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.bodyLocked.Read
#17: internal/selfupdate/executor.go:218:22: selfupdate.Executor.download calls io.Copy, which eventually calls http.bufioFlushWriter.Write
#18: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.cancelTimerBody.Close
#19: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.cancelTimerBody.Read
#20: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.checkConnErrorWriter.Write
#21: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.chunkWriter.Write
#22: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.connReader.Read
#23: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.http2transportResponseBody.Close, which eventually calls http.expectContinueReader.Close
#24: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.expectContinueReader.Read
#25: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.gzipReader.Close
#26: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.gzipReader.Read
#27: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.loggingConn.Read
#28: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which calls http.loggingConn.Write
#29: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.maxBytesReader.Read
#30: internal/pvegate/pvegate.go:76:10: pvegate.Step calls sync.Once.Do, which eventually calls http.onceCloseListener.Close
#31: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.persistConn.Read
#32: internal/selfupdate/executor.go:218:22: selfupdate.Executor.download calls io.Copy, which eventually calls http.persistConnWriter.ReadFrom
#33: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.persistConnWriter.Write
#34: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.http2transportResponseBody.Close, which eventually calls http.readTrackingBody.Close
#35: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.readTrackingBody.Read
#36: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.readWriteCloserBody.Read
#37: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which calls http.response.Write
#38: internal/localapi/debuglogs.go:50:31: localapi.statusRecorder.WriteHeader calls http.response.WriteHeader
#39: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.transportReadFromServerError.Error
Vulnerability #3: GO-2026-6612
Double flow control refund on HTTP/2 server streams in net/http
More info: https://pkg.go.dev/vuln/GO-2026-6612
Standard library
Found in: net/http@go1.26
Fixed in: net/http@go1.26.9
Example traces found:
#1: internal/hub/client.go:441:22: hub.Client.PostOSReport calls http.Client.Do
#2: internal/hub/client.go:441:22: hub.Client.PostOSReport calls http.Client.Do
#3: internal/hub/client.go:439:16: hub.Client.PostOSReport calls http.Header.Set
#4: internal/hub/client.go:439:16: hub.Client.PostOSReport calls http.Header.Set
#5: cmd/felhom-opsign/main.go:217:29: felhom.upload calls http.NewRequest
#6: cmd/felhom-opsign/main.go:217:29: felhom.upload calls http.NewRequest
#7: internal/hub/client.go:435:40: hub.Client.PostOSReport calls http.NewRequestWithContext
#8: internal/hub/client.go:435:40: hub.Client.PostOSReport calls http.NewRequestWithContext
#9: internal/selfupdate/executor.go:203:19: selfupdate.Executor.download calls http.Request.SetBasicAuth
#10: internal/selfupdate/executor.go:203:19: selfupdate.Executor.download calls http.Request.SetBasicAuth
#11: internal/localapi/server.go:526:16: localapi.Server.Handler calls http.ServeMux.HandleFunc
#12: internal/localapi/server.go:526:16: localapi.Server.Handler calls http.ServeMux.HandleFunc
#13: internal/localapi/server.go:624:34: localapi.Run calls http.Server.ServeTLS
#14: internal/localapi/server.go:624:34: localapi.Run calls http.Server.ServeTLS
#15: internal/localapi/server.go:630:19: localapi.Server.Run calls http.Server.Shutdown
#16: internal/localapi/server.go:630:19: localapi.Server.Run calls http.Server.Shutdown
#17: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.body.Close
#18: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.body.Close
#19: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.body.Read
#20: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.body.Read
#21: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.bodyEOFSignal.Close
#22: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.bodyEOFSignal.Close
#23: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.bodyEOFSignal.Read
#24: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.bodyEOFSignal.Read
#25: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.bodyLocked.Read
#26: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.bodyLocked.Read
#27: internal/selfupdate/executor.go:218:22: selfupdate.Executor.download calls io.Copy, which eventually calls http.bufioFlushWriter.Write
#28: internal/selfupdate/executor.go:218:22: selfupdate.Executor.download calls io.Copy, which eventually calls http.bufioFlushWriter.Write
#29: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.cancelTimerBody.Close
#30: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.cancelTimerBody.Close
#31: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.cancelTimerBody.Read
#32: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.cancelTimerBody.Read
#33: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.checkConnErrorWriter.Write
#34: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.checkConnErrorWriter.Write
#35: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.chunkWriter.Write
#36: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.chunkWriter.Write
#37: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.connReader.Read
#38: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.connReader.Read
#39: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.expectContinueReader.Read
#40: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.expectContinueReader.Read
#41: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.gzipReader.Close
#42: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.gzipReader.Close
#43: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.gzipReader.Read
#44: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.gzipReader.Read
#45: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2ConnectionError.Error
#46: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2ConnectionError.Error
#47: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2ErrCode.String
#48: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2ErrCode.String
#49: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2FrameHeader.String
#50: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2FrameHeader.String
#51: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2FrameType.String
#52: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2FrameType.String
#53: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2FrameWriteRequest.String
#54: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2FrameWriteRequest.String
#55: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2GoAwayError.Error
#56: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2GoAwayError.Error
#57: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2Setting.String
#58: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2Setting.String
#59: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2SettingID.String
#60: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2SettingID.String
#61: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2StreamError.Error
#62: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2StreamError.Error
#63: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.http2bufferedWriterTimeoutWriter.Write
#64: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.http2bufferedWriterTimeoutWriter.Write
#65: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.http2chunkWriter.Write
#66: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.http2chunkWriter.Write
#67: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2connError.Error
#68: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2connError.Error
#69: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2duplicatePseudoHeaderError.Error
#70: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2duplicatePseudoHeaderError.Error
#71: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.http2gzipReader.Close
#72: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.http2gzipReader.Close
#73: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.http2gzipReader.Read
#74: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.http2gzipReader.Read
#75: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2headerFieldNameError.Error
#76: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2headerFieldNameError.Error
#77: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2headerFieldValueError.Error
#78: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2headerFieldValueError.Error
#79: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2pseudoHeaderError.Error
#80: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2pseudoHeaderError.Error
#81: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.http2requestBody.Read
#82: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.http2requestBody.Read
#83: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which calls http.http2responseWriter.Write
#84: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which calls http.http2responseWriter.Write
#85: internal/localapi/debuglogs.go:50:31: localapi.statusRecorder.WriteHeader calls http.http2responseWriter.WriteHeader
#86: internal/localapi/debuglogs.go:50:31: localapi.statusRecorder.WriteHeader calls http.http2responseWriter.WriteHeader
#87: internal/selfupdate/executor.go:218:22: selfupdate.Executor.download calls io.Copy, which eventually calls http.http2responseWriter.WriteString
#88: internal/selfupdate/executor.go:218:22: selfupdate.Executor.download calls io.Copy, which eventually calls http.http2responseWriter.WriteString
#89: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.http2stickyErrWriter.Write
#90: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.http2stickyErrWriter.Write
#91: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.http2transportResponseBody.Close
#92: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.http2transportResponseBody.Close
#93: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.http2transportResponseBody.Read
#94: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.http2transportResponseBody.Read
#95: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2writeData.String
#96: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2writeData.String
#97: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.loggingConn.Read
#98: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.loggingConn.Read
#99: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which calls http.loggingConn.Write
#100: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which calls http.loggingConn.Write
#101: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.maxBytesReader.Read
#102: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.maxBytesReader.Read
#103: internal/pvegate/pvegate.go:76:10: pvegate.Step calls sync.Once.Do, which eventually calls http.onceCloseListener.Close
#104: internal/pvegate/pvegate.go:76:10: pvegate.Step calls sync.Once.Do, which eventually calls http.onceCloseListener.Close
#105: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.persistConn.Read
#106: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.persistConn.Read
#107: internal/selfupdate/executor.go:218:22: selfupdate.Executor.download calls io.Copy, which eventually calls http.persistConnWriter.ReadFrom
#108: internal/selfupdate/executor.go:218:22: selfupdate.Executor.download calls io.Copy, which eventually calls http.persistConnWriter.ReadFrom
#109: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.persistConnWriter.Write
#110: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.persistConnWriter.Write
#111: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.readTrackingBody.Read
#112: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.readTrackingBody.Read
#113: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.readWriteCloserBody.Read
#114: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.readWriteCloserBody.Read
#115: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which calls http.response.Write
#116: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which calls http.response.Write
#117: internal/localapi/debuglogs.go:50:31: localapi.statusRecorder.WriteHeader calls http.response.WriteHeader
#118: internal/localapi/debuglogs.go:50:31: localapi.statusRecorder.WriteHeader calls http.response.WriteHeader
#119: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.transportReadFromServerError.Error
#120: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.transportReadFromServerError.Error
Vulnerability #4: GO-2026-6611
Excessive CPU consumption from repeated initial window changes in net/http
More info: https://pkg.go.dev/vuln/GO-2026-6611
Standard library
Found in: net/http@go1.26
Fixed in: net/http@go1.26.9
Example traces found:
#1: internal/hub/client.go:441:22: hub.Client.PostOSReport calls http.Client.Do
#2: internal/hub/client.go:441:22: hub.Client.PostOSReport calls http.Client.Do
#3: internal/hub/client.go:439:16: hub.Client.PostOSReport calls http.Header.Set
#4: internal/hub/client.go:439:16: hub.Client.PostOSReport calls http.Header.Set
#5: cmd/felhom-opsign/main.go:217:29: felhom.upload calls http.NewRequest
#6: cmd/felhom-opsign/main.go:217:29: felhom.upload calls http.NewRequest
#7: internal/hub/client.go:435:40: hub.Client.PostOSReport calls http.NewRequestWithContext
#8: internal/hub/client.go:435:40: hub.Client.PostOSReport calls http.NewRequestWithContext
#9: internal/selfupdate/executor.go:203:19: selfupdate.Executor.download calls http.Request.SetBasicAuth
#10: internal/selfupdate/executor.go:203:19: selfupdate.Executor.download calls http.Request.SetBasicAuth
#11: internal/localapi/server.go:526:16: localapi.Server.Handler calls http.ServeMux.HandleFunc
#12: internal/localapi/server.go:526:16: localapi.Server.Handler calls http.ServeMux.HandleFunc
#13: internal/localapi/server.go:624:34: localapi.Run calls http.Server.ServeTLS
#14: internal/localapi/server.go:624:34: localapi.Run calls http.Server.ServeTLS
#15: internal/localapi/server.go:630:19: localapi.Server.Run calls http.Server.Shutdown
#16: internal/localapi/server.go:630:19: localapi.Server.Run calls http.Server.Shutdown
#17: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.body.Close
#18: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.body.Close
#19: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.body.Read
#20: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.body.Read
#21: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.bodyEOFSignal.Close
#22: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.bodyEOFSignal.Close
#23: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.bodyEOFSignal.Read
#24: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.bodyEOFSignal.Read
#25: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.bodyLocked.Read
#26: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.bodyLocked.Read
#27: internal/selfupdate/executor.go:218:22: selfupdate.Executor.download calls io.Copy, which eventually calls http.bufioFlushWriter.Write
#28: internal/selfupdate/executor.go:218:22: selfupdate.Executor.download calls io.Copy, which eventually calls http.bufioFlushWriter.Write
#29: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.cancelTimerBody.Close
#30: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.cancelTimerBody.Close
#31: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.cancelTimerBody.Read
#32: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.cancelTimerBody.Read
#33: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.checkConnErrorWriter.Write
#34: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.checkConnErrorWriter.Write
#35: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.chunkWriter.Write
#36: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.chunkWriter.Write
#37: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.connReader.Read
#38: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.connReader.Read
#39: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.expectContinueReader.Read
#40: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.expectContinueReader.Read
#41: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.gzipReader.Close
#42: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.gzipReader.Close
#43: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.gzipReader.Read
#44: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.gzipReader.Read
#45: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2ConnectionError.Error
#46: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2ConnectionError.Error
#47: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2ErrCode.String
#48: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2ErrCode.String
#49: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2FrameHeader.String
#50: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2FrameHeader.String
#51: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2FrameType.String
#52: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2FrameType.String
#53: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2FrameWriteRequest.String
#54: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2FrameWriteRequest.String
#55: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2GoAwayError.Error
#56: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2GoAwayError.Error
#57: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2Setting.String
#58: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2Setting.String
#59: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2SettingID.String
#60: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2SettingID.String
#61: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2StreamError.Error
#62: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2StreamError.Error
#63: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.http2bufferedWriterTimeoutWriter.Write
#64: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.http2bufferedWriterTimeoutWriter.Write
#65: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.http2chunkWriter.Write
#66: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.http2chunkWriter.Write
#67: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2connError.Error
#68: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2connError.Error
#69: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2duplicatePseudoHeaderError.Error
#70: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2duplicatePseudoHeaderError.Error
#71: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.http2gzipReader.Close
#72: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.http2gzipReader.Close
#73: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.http2gzipReader.Read
#74: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.http2gzipReader.Read
#75: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2headerFieldNameError.Error
#76: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2headerFieldNameError.Error
#77: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2headerFieldValueError.Error
#78: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2headerFieldValueError.Error
#79: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2pseudoHeaderError.Error
#80: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2pseudoHeaderError.Error
#81: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.http2requestBody.Read
#82: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.http2requestBody.Read
#83: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which calls http.http2responseWriter.Write
#84: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which calls http.http2responseWriter.Write
#85: internal/localapi/debuglogs.go:50:31: localapi.statusRecorder.WriteHeader calls http.http2responseWriter.WriteHeader
#86: internal/localapi/debuglogs.go:50:31: localapi.statusRecorder.WriteHeader calls http.http2responseWriter.WriteHeader
#87: internal/selfupdate/executor.go:218:22: selfupdate.Executor.download calls io.Copy, which eventually calls http.http2responseWriter.WriteString
#88: internal/selfupdate/executor.go:218:22: selfupdate.Executor.download calls io.Copy, which eventually calls http.http2responseWriter.WriteString
#89: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.http2stickyErrWriter.Write
#90: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.http2stickyErrWriter.Write
#91: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.http2transportResponseBody.Close
#92: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.http2transportResponseBody.Close
#93: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.http2transportResponseBody.Read
#94: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.http2transportResponseBody.Read
#95: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2writeData.String
#96: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2writeData.String
#97: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.loggingConn.Read
#98: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.loggingConn.Read
#99: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which calls http.loggingConn.Write
#100: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which calls http.loggingConn.Write
#101: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.maxBytesReader.Read
#102: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.maxBytesReader.Read
#103: internal/pvegate/pvegate.go:76:10: pvegate.Step calls sync.Once.Do, which eventually calls http.onceCloseListener.Close
#104: internal/pvegate/pvegate.go:76:10: pvegate.Step calls sync.Once.Do, which eventually calls http.onceCloseListener.Close
#105: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.persistConn.Read
#106: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.persistConn.Read
#107: internal/selfupdate/executor.go:218:22: selfupdate.Executor.download calls io.Copy, which eventually calls http.persistConnWriter.ReadFrom
#108: internal/selfupdate/executor.go:218:22: selfupdate.Executor.download calls io.Copy, which eventually calls http.persistConnWriter.ReadFrom
#109: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.persistConnWriter.Write
#110: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.persistConnWriter.Write
#111: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.readTrackingBody.Read
#112: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.readTrackingBody.Read
#113: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.readWriteCloserBody.Read
#114: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.readWriteCloserBody.Read
#115: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which calls http.response.Write
#116: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which calls http.response.Write
#117: internal/localapi/debuglogs.go:50:31: localapi.statusRecorder.WriteHeader calls http.response.WriteHeader
#118: internal/localapi/debuglogs.go:50:31: localapi.statusRecorder.WriteHeader calls http.response.WriteHeader
#119: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.transportReadFromServerError.Error
#120: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.transportReadFromServerError.Error
Vulnerability #5: GO-2026-6610
HTTP/2 transport accepts malformed framing-related headers in net/http
More info: https://pkg.go.dev/vuln/GO-2026-6610
Standard library
Found in: net/http@go1.26
Fixed in: net/http@go1.26.9
Example traces found:
#1: internal/hub/client.go:441:22: hub.Client.PostOSReport calls http.Client.Do
#2: internal/hub/client.go:441:22: hub.Client.PostOSReport calls http.Client.Do
Vulnerability #6: GO-2026-6608
Memory limit bypass when parsing MIME headers in net/textproto,
mime/multipart
More info: https://pkg.go.dev/vuln/GO-2026-6608
Standard library
Found in: net/textproto@go1.26
Fixed in: net/textproto@go1.26.9
Example traces found:
#1: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls textproto.Reader.ReadMIMEHeader
Vulnerability #7: GO-2026-6607
Reject malformed ECH outer extension references in crypto/tls
More info: https://pkg.go.dev/vuln/GO-2026-6607
Standard library
Found in: crypto/tls@go1.26
Fixed in: crypto/tls@go1.26.9
Example traces found:
#1: internal/pbs/probe.go:42:33: pbs.ProbeFingerprint calls tls.Conn.HandshakeContext
#2: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls tls.Conn.Read
#3: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which calls tls.Conn.Write
#4: internal/hub/client.go:441:22: hub.Client.PostOSReport calls http.Client.Do, which eventually calls tls.Dialer.DialContext
Vulnerability #8: GO-2026-6605
HTTP/1 client connection desynchronization after CONNECT rejection in
net/http
More info: https://pkg.go.dev/vuln/GO-2026-6605
Standard library
Found in: net/http@go1.26
Fixed in: net/http@go1.26.9
Example traces found:
#1: internal/hub/client.go:441:22: hub.Client.PostOSReport calls http.Client.Do
Vulnerability #9: GO-2026-6603
HTTP/2 server memory exhaustion due to Trailer headers in net/http
More info: https://pkg.go.dev/vuln/GO-2026-6603
Standard library
Found in: net/http@go1.26
Fixed in: net/http@go1.26.9
Example traces found:
#1: internal/hub/client.go:441:22: hub.Client.PostOSReport calls http.Client.Do
#2: internal/hub/client.go:441:22: hub.Client.PostOSReport calls http.Client.Do
#3: internal/hub/client.go:439:16: hub.Client.PostOSReport calls http.Header.Set
#4: internal/hub/client.go:439:16: hub.Client.PostOSReport calls http.Header.Set
#5: cmd/felhom-opsign/main.go:217:29: felhom.upload calls http.NewRequest
#6: cmd/felhom-opsign/main.go:217:29: felhom.upload calls http.NewRequest
#7: internal/hub/client.go:435:40: hub.Client.PostOSReport calls http.NewRequestWithContext
#8: internal/hub/client.go:435:40: hub.Client.PostOSReport calls http.NewRequestWithContext
#9: internal/selfupdate/executor.go:203:19: selfupdate.Executor.download calls http.Request.SetBasicAuth
#10: internal/selfupdate/executor.go:203:19: selfupdate.Executor.download calls http.Request.SetBasicAuth
#11: internal/localapi/server.go:526:16: localapi.Server.Handler calls http.ServeMux.HandleFunc
#12: internal/localapi/server.go:526:16: localapi.Server.Handler calls http.ServeMux.HandleFunc
#13: internal/localapi/server.go:624:34: localapi.Run calls http.Server.ServeTLS
#14: internal/localapi/server.go:624:34: localapi.Run calls http.Server.ServeTLS
#15: internal/localapi/server.go:630:19: localapi.Server.Run calls http.Server.Shutdown
#16: internal/localapi/server.go:630:19: localapi.Server.Run calls http.Server.Shutdown
#17: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.body.Close
#18: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.body.Close
#19: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.body.Read
#20: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.body.Read
#21: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.bodyEOFSignal.Close
#22: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.bodyEOFSignal.Close
#23: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.bodyEOFSignal.Read
#24: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.bodyEOFSignal.Read
#25: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.bodyLocked.Read
#26: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.bodyLocked.Read
#27: internal/selfupdate/executor.go:218:22: selfupdate.Executor.download calls io.Copy, which eventually calls http.bufioFlushWriter.Write
#28: internal/selfupdate/executor.go:218:22: selfupdate.Executor.download calls io.Copy, which eventually calls http.bufioFlushWriter.Write
#29: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.cancelTimerBody.Close
#30: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.cancelTimerBody.Close
#31: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.cancelTimerBody.Read
#32: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.cancelTimerBody.Read
#33: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.checkConnErrorWriter.Write
#34: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.checkConnErrorWriter.Write
#35: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.chunkWriter.Write
#36: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.chunkWriter.Write
#37: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.connReader.Read
#38: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.connReader.Read
#39: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.expectContinueReader.Read
#40: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.expectContinueReader.Read
#41: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.gzipReader.Close
#42: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.gzipReader.Close
#43: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.gzipReader.Read
#44: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.gzipReader.Read
#45: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2ConnectionError.Error
#46: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2ConnectionError.Error
#47: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2ErrCode.String
#48: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2ErrCode.String
#49: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2FrameHeader.String
#50: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2FrameHeader.String
#51: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2FrameType.String
#52: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2FrameType.String
#53: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2FrameWriteRequest.String
#54: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2FrameWriteRequest.String
#55: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2GoAwayError.Error
#56: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2GoAwayError.Error
#57: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2Setting.String
#58: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2Setting.String
#59: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2SettingID.String
#60: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2SettingID.String
#61: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2StreamError.Error
#62: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2StreamError.Error
#63: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.http2bufferedWriterTimeoutWriter.Write
#64: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.http2bufferedWriterTimeoutWriter.Write
#65: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.http2chunkWriter.Write
#66: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.http2chunkWriter.Write
#67: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2connError.Error
#68: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2connError.Error
#69: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2duplicatePseudoHeaderError.Error
#70: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2duplicatePseudoHeaderError.Error
#71: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.http2gzipReader.Close
#72: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.http2gzipReader.Close
#73: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.http2gzipReader.Read
#74: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.http2gzipReader.Read
#75: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2headerFieldNameError.Error
#76: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2headerFieldNameError.Error
#77: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2headerFieldValueError.Error
#78: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2headerFieldValueError.Error
#79: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2pseudoHeaderError.Error
#80: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.http2pseudoHeaderError.Error
#81: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.http2requestBody.Read
#82: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.http2requestBody.Read
#83: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which calls http.http2responseWriter.Write
#84: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which calls http.http2responseWriter.Write
#85: internal/localapi/debuglogs.go:50:31: localapi.statusRecorder.WriteHeader calls http.http2responseWriter.WriteHeader
#86: internal/localapi/debuglogs.go:50:31: localapi.statusRecorder.WriteHeader calls http.http2responseWriter.WriteHeader
#87: internal/selfupdate/executor.go:218:22: selfupdate.Executor.download calls io.Copy, which eventually calls http.http2responseWriter.WriteString
#88: internal/selfupdate/executor.go:218:22: selfupdate.Executor.download calls io.Copy, which eventually calls http.http2responseWriter.WriteString
#89: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.http2stickyErrWriter.Write
#90: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.http2stickyErrWriter.Write
#91: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.http2transportResponseBody.Close
#92: internal/hub/client.go:445:2: hub.Client.PostOSReport calls http.http2transportResponseBody.Close
#93: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.http2transportResponseBody.Read
#94: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.http2transportResponseBody.Read
#95: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2writeData.String
#96: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls http.http2writeData.String
#97: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.loggingConn.Read
#98: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.loggingConn.Read
#99: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which calls http.loggingConn.Write
#100: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which calls http.loggingConn.Write
#101: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.maxBytesReader.Read
#102: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.maxBytesReader.Read
#103: internal/pvegate/pvegate.go:76:10: pvegate.Step calls sync.Once.Do, which eventually calls http.onceCloseListener.Close
#104: internal/pvegate/pvegate.go:76:10: pvegate.Step calls sync.Once.Do, which eventually calls http.onceCloseListener.Close
#105: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.persistConn.Read
#106: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.persistConn.Read
#107: internal/selfupdate/executor.go:218:22: selfupdate.Executor.download calls io.Copy, which eventually calls http.persistConnWriter.ReadFrom
#108: internal/selfupdate/executor.go:218:22: selfupdate.Executor.download calls io.Copy, which eventually calls http.persistConnWriter.ReadFrom
#109: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.persistConnWriter.Write
#110: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which eventually calls http.persistConnWriter.Write
#111: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.readTrackingBody.Read
#112: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls http.readTrackingBody.Read
#113: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.readWriteCloserBody.Read
#114: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which calls http.readWriteCloserBody.Read
#115: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which calls http.response.Write
#116: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which calls http.response.Write
#117: internal/localapi/debuglogs.go:50:31: localapi.statusRecorder.WriteHeader calls http.response.WriteHeader
#118: internal/localapi/debuglogs.go:50:31: localapi.statusRecorder.WriteHeader calls http.response.WriteHeader
#119: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.transportReadFromServerError.Error
#120: internal/localapi/stalelock.go:284:35: localapi.runnerError.Error calls http.transportReadFromServerError.Error
Vulnerability #10: GO-2026-6218
Avoid quadratic complexity in resolvePath in net/url
More info: https://pkg.go.dev/vuln/GO-2026-6218
Standard library
Found in: net/url@go1.26
Fixed in: net/url@go1.26.6
Example traces found:
#1: internal/hub/client.go:441:22: hub.Client.PostOSReport calls http.Client.Do, which eventually calls url.URL.Parse
Vulnerability #11: GO-2026-6090
Limit handshake messages we are willing to accept post-handshake in
crypto/tls
More info: https://pkg.go.dev/vuln/GO-2026-6090
Standard library
Found in: crypto/tls@go1.26
Fixed in: crypto/tls@go1.26.6
Example traces found:
#1: internal/pbs/probe.go:42:33: pbs.ProbeFingerprint calls tls.Conn.HandshakeContext
#2: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls tls.Conn.Read
#3: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which calls tls.Conn.Write
#4: internal/hub/client.go:441:22: hub.Client.PostOSReport calls http.Client.Do, which eventually calls tls.Dialer.DialContext
Vulnerability #12: GO-2026-6089
Apply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/http
More info: https://pkg.go.dev/vuln/GO-2026-6089
Standard library
Found in: net/http@go1.26
Fixed in: net/http@go1.26.6
Example traces found:
#1: internal/localapi/server.go:624:34: localapi.Run calls http.Server.ServeTLS
Vulnerability #13: GO-2026-5972
Enforce maximum recursion depth in encoding/asn1
More info: https://pkg.go.dev/vuln/GO-2026-5972
Standard library
Found in: encoding/asn1@go1.26
Fixed in: encoding/asn1@go1.26.6
Example traces found:
#1: internal/hub/client.go:48:30: hub.NewClient calls x509.CertPool.AppendCertsFromPEM, which eventually calls asn1.Unmarshal
Vulnerability #14: GO-2026-5856
Invoking Encrypted Client Hello privacy leak in crypto/tls
More info: https://pkg.go.dev/vuln/GO-2026-5856
Standard library
Found in: crypto/tls@go1.26
Fixed in: crypto/tls@go1.26.5
Example traces found:
#1: internal/pbs/probe.go:42:33: pbs.ProbeFingerprint calls tls.Conn.HandshakeContext
#2: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls tls.Conn.Read
#3: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which calls tls.Conn.Write
#4: internal/hub/client.go:441:22: hub.Client.PostOSReport calls http.Client.Do, which eventually calls tls.Dialer.DialContext
Vulnerability #15: GO-2026-5039
Arbitrary inputs are included in errors without any escaping in
net/textproto
More info: https://pkg.go.dev/vuln/GO-2026-5039
Standard library
Found in: net/textproto@go1.26
Fixed in: net/textproto@go1.26.4
Example traces found:
#1: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls textproto.Reader.ReadMIMEHeader
Vulnerability #16: GO-2026-5037
Inefficient candidate hostname parsing in crypto/x509
More info: https://pkg.go.dev/vuln/GO-2026-5037
Standard library
Found in: crypto/x509@go1.26
Fixed in: crypto/x509@go1.26.4
Example traces found:
#1: internal/pbs/probe.go:42:33: pbs.ProbeFingerprint calls tls.Conn.HandshakeContext, which eventually calls x509.Certificate.Verify
#2: internal/pbs/probe.go:42:33: pbs.ProbeFingerprint calls tls.Conn.HandshakeContext, which eventually calls x509.Certificate.VerifyHostname
#3: cmd/felhom-agent/main.go:220:16: felhom.main calls fmt.Fprintln, which eventually calls x509.HostnameError.Error
Vulnerability #17: GO-2026-5026
Invoking failure to reject ASCII-only Punycode-encoded labels in
golang.org/x/net/idna
More info: https://pkg.go.dev/vuln/GO-2026-5026
Standard library
Found in: net/http@go1.26
Fixed in: net/http@go1.26.6
Example traces found:
#1: internal/hub/client.go:441:22: hub.Client.PostOSReport calls http.Client.Do
Vulnerability #18: GO-2026-4971
Panic in Dial and LookupPort when handling NUL byte on Windows in net
More info: https://pkg.go.dev/vuln/GO-2026-4971
Standard library
Found in: net@go1.26
Fixed in: net@go1.26.3
Example traces found:
#1: internal/storage/watchdog.go:404:22: storage.HostLiveness.Present calls net.DialTimeout
#2: internal/pbs/probe.go:31:27: pbs.ProbeFingerprint calls net.Dialer.DialContext
#3: internal/localapi/server.go:617:23: localapi.Server.Run calls net.Listen
#4: internal/poke/poke.go:133:28: poke.Listener.serve calls net.ListenConfig.ListenPacket
#5: internal/wgtunnel/manager.go:62:40: wgtunnel.netResolver.LookupIPv4 calls net.Resolver.LookupNetIP
Vulnerability #19: GO-2026-4947
Unexpected work during chain building in crypto/x509
More info: https://pkg.go.dev/vuln/GO-2026-4947
Standard library
Found in: crypto/x509@go1.26
Fixed in: crypto/x509@go1.26.2
Example traces found:
#1: internal/pbs/probe.go:42:33: pbs.ProbeFingerprint calls tls.Conn.HandshakeContext, which eventually calls x509.Certificate.Verify
Vulnerability #20: GO-2026-4946
Inefficient policy validation in crypto/x509
More info: https://pkg.go.dev/vuln/GO-2026-4946
Standard library
Found in: crypto/x509@go1.26
Fixed in: crypto/x509@go1.26.2
Example traces found:
#1: internal/pbs/probe.go:42:33: pbs.ProbeFingerprint calls tls.Conn.HandshakeContext, which eventually calls x509.Certificate.Verify
Vulnerability #21: GO-2026-4918
Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in
net/http/internal/http2 in golang.org/x/net
More info: https://pkg.go.dev/vuln/GO-2026-4918
Standard library
Found in: net/http@go1.26
Fixed in: net/http@go1.26.3
Example traces found:
#1: internal/hub/client.go:441:22: hub.Client.PostOSReport calls http.Client.Do
Vulnerability #22: GO-2026-4870
Unauthenticated TLS 1.3 KeyUpdate record can cause persistent connection
retention and DoS in crypto/tls
More info: https://pkg.go.dev/vuln/GO-2026-4870
Standard library
Found in: crypto/tls@go1.26
Fixed in: crypto/tls@go1.26.2
Example traces found:
#1: internal/pbs/probe.go:42:33: pbs.ProbeFingerprint calls tls.Conn.HandshakeContext
#2: internal/hub/client.go:446:22: hub.Client.PostOSReport calls io.ReadAll, which eventually calls tls.Conn.Read
#3: internal/lanresolver/lanresolver.go:48:13: lanresolver.RenderBase calls fmt.Fprintf, which calls tls.Conn.Write
#4: internal/hub/client.go:441:22: hub.Client.PostOSReport calls http.Client.Do, which eventually calls tls.Dialer.DialContext
Vulnerability #23: GO-2026-4866
Case-sensitive excludedSubtrees name constraints cause Auth Bypass in
crypto/x509
More info: https://pkg.go.dev/vuln/GO-2026-4866
Standard library
Found in: crypto/x509@go1.26
Fixed in: crypto/x509@go1.26.2
Example traces found:
#1: internal/pbs/probe.go:42:33: pbs.ProbeFingerprint calls tls.Conn.HandshakeContext, which eventually calls x509.Certificate.Verify
Vulnerability #24: GO-2026-4602
FileInfo can escape from a Root in os
More info: https://pkg.go.dev/vuln/GO-2026-4602
Standard library
Found in: os@go1.26
Fixed in: os@go1.26.1
Example traces found:
#1: internal/storage/netmount.go:512:28: storage.SudoHostOps.MigrateNetworkUnits calls os.ReadDir
Vulnerability #25: GO-2026-4601
Incorrect parsing of IPv6 host literals in net/url
More info: https://pkg.go.dev/vuln/GO-2026-4601
Standard library
Found in: net/url@go1.26
Fixed in: net/url@go1.26.1
Example traces found:
#1: internal/config/config.go:999:21: config.HubConfig.Validate calls url.Parse
#2: internal/localapi/server.go:624:34: localapi.Run calls http.Server.ServeTLS, which eventually calls url.ParseRequestURI
#3: internal/hub/client.go:441:22: hub.Client.PostOSReport calls http.Client.Do, which eventually calls url.URL.Parse
Vulnerability #26: GO-2026-4600
Panic in name constraint checking for malformed certificates in crypto/x509
More info: https://pkg.go.dev/vuln/GO-2026-4600
Standard library
Found in: crypto/x509@go1.26
Fixed in: crypto/x509@go1.26.1
Example traces found:
#1: internal/pbs/probe.go:42:33: pbs.ProbeFingerprint calls tls.Conn.HandshakeContext, which eventually calls x509.Certificate.Verify
Vulnerability #27: GO-2026-4599
Incorrect enforcement of email constraints in crypto/x509
More info: https://pkg.go.dev/vuln/GO-2026-4599
Standard library
Found in: crypto/x509@go1.26
Fixed in: crypto/x509@go1.26.1
Example traces found:
#1: internal/pbs/probe.go:42:33: pbs.ProbeFingerprint calls tls.Conn.HandshakeContext, which eventually calls x509.Certificate.Verify
Your code is affected by 27 vulnerabilities from the Go standard library.
This scan also found 10 vulnerabilities in packages you import and 13
vulnerabilities in modules you require, but your code doesn't appear to call
these vulnerabilities.
Use '-show verbose' for more details.
Reference in new issue View Git Blame Copy Permalink