Repository navigation
deps: bump golang.org/x/net v0.47.0 to v0.54.0 (CVE-2026-39821) - #6277
cristian-gherghina wants to merge 1 commit into
Conversation
Resolves CVE-2026-39821: golang.org/x/net/idna ToASCII/ToUnicode incorrectly accept Punycode-encoded labels that decode to an ASCII-only label (e.g. ToUnicode("xn--example-.com") returns "example.com" instead of erroring), which can defeat hostname-based authorization checks. Fixed upstream in golang.org/x/net v0.54.0. x/net v0.54.0 requires Go >= 1.25, so `go mod tidy` raises the go directive 1.24.0 -> 1.25.0. No source changes; `go build ./...` passes and `go vet ./...` shows only the two pre-existing findings present on the base.
chrisd8088
left a comment
chrisd8088
left a comment
There was a problem hiding this comment.
Hey, thanks for this PR!
As it happens, we're trying to release a new version of Git LFS soon, so this is a timely reminder to upgrade our Go module dependencies.
Because I think we actually want an even newer version of the x/net module than the one from this PR, and because we also want to update our Dependabot configuration, I opened PR #6278 and credited you for its Go module changes.
If you don't mind, once that's approved and merged I'll close this PR. Thanks again for help!
There was a problem hiding this comment.
If I'm not mistaken, the Punycode-related issue reported as GO-2026-5026 and CVE-2026-39821 is actually only resolved in v0.55.0 of the x/net module. That's based on the notes in the module's version listing and the GO-2026-5026 report.
So I think we want to update to v0.55.0, as I've tried to do in PR #6278, where I've credited you as co-author on the change.
There was a problem hiding this comment.
thank you @chrisd8088 that is even better :).
2 participants
Summary
go.modpinsgolang.org/x/net v0.47.0, which is affected by CVE-2026-39821:idna.ToASCII/ToUnicodeincorrectly accept Punycode-encoded labels that decode to an ASCII-only label (e.g.ToUnicode("xn--example-.com")returnsexample.cominstead of erroring). This can defeat hostname-based authorization checks. Fixed upstream ingolang.org/x/net v0.54.0.This is a public, already-disclosed dependency CVE, so filing as a normal PR rather than a private report.
Change
No source changes.
golang.org/x/netv0.47.0 to v0.54.0x/sync0.18 to 0.20x/sys0.38 to 0.44x/crypto0.45 to 0.51 (indirect)x/text0.31 to 0.37 (indirect)godirective1.24.0t01.25.0x/net v0.54.0requires Go ≥ 1.25, sogo mod tidyraises thegodirective from1.24.0to1.25.0. This raises git-lfs's minimum supported Go version. Flagging explicitly in case that affects your CI matrix / support policy, happy to adjust if you'd prefer a different approach.Verification
go build ./...passesgo test ./...passesgo vet ./...only the two findings already present onmain(lfshttp/client.go:515lock copy,git-lfs.go:15unbuffered signal channel); no new findings introduced.Refs: CVE-2026-39821, go.dev/issue/78760