Skip to content

Conversation

@KrisKennawayDD
Copy link

Resolves two issues showing up on trivy scans (although likely not vulnerable in practice)

go.mod (gomod)

Total: 3 (UNKNOWN: 0, LOW: 0, MEDIUM: 2, HIGH: 1, CRITICAL: 0)

┌─────────────────────┬────────────────┬──────────┬────────┬───────────────────┬───────────────┬───────────────────────────────────────────────────────────┐
│       Library       │ Vulnerability  │ Severity │ Status │ Installed Version │ Fixed Version │                           Title                           │
├─────────────────────┼────────────────┼──────────┼────────┼───────────────────┼───────────────┼───────────────────────────────────────────────────────────┤
│ golang.org/x/net    │ CVE-2025-22870 │ MEDIUM   │ fixed  │ v0.34.0           │ 0.36.0        │ golang.org/x/net/proxy: golang.org/x/net/http/httpproxy:  │
│                     │                │          │        │                   │               │ HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net │
│                     │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2025-22870                │
│                     ├────────────────┤          │        │                   ├───────────────┼───────────────────────────────────────────────────────────┤
│                     │ CVE-2025-22872 │          │        │                   │ 0.38.0        │ golang.org/x/net/html: Incorrect Neutralization of Input  │
│                     │                │          │        │                   │               │ During Web Page Generation in x/net in...                 │
│                     │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2025-22872                │
├─────────────────────┼────────────────┼──────────┤        ├───────────────────┼───────────────┼───────────────────────────────────────────────────────────┤
│ golang.org/x/oauth2 │ CVE-2025-22868 │ HIGH     │        │ v0.24.0           │ 0.27.0        │ golang.org/x/oauth2/jws: Unexpected memory consumption    │
│                     │                │          │        │                   │               │ during token parsing in golang.org/x/oauth2/jws           │
│                     │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2025-22868                │
└─────────────────────┴────────────────┴──────────┴────────┴───────────────────┴───────────────┴───────────────────────────────────────────────────────────┘

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant