chore(core): cve mitigation 15-04-2026 for release 1.6.3

[LopatinDmitr]

Description

• CRITICAL https://github.com/advisories/GHSA-p77j-4mvh-x3m3 — google.golang.org/grpc/grpc-go: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation.
• HIGH https://github.com/advisories/GHSA-hfvc-g4fc-pqhx — opentelemetry-go: BSD kenv command not using absolute path enables PATH hijacking.
• HIGH https://github.com/advisories/GHSA-78h2-9frx-2jm8 — Go JOSE: Denial of Service via crafted JSON Web Encryption.
• HIGH https://github.com/advisories/GHSA-x744-4wpc-v9h2 — Moby: Authorization bypass vulnerability.
• HIGH https://github.com/advisories/GHSA-j3gx-2473-5fp8 — net/url: Incorrect parsing of IPv6 host literals in net/url.
• HIGH https://github.com/advisories/GHSA-m4pr-4j3g-9v7v — During chain building, the amount of work that is done is not properly limited.
• HIGH https://github.com/advisories/GHSA-xj38-jxc5-rppx — golang internal/syscall/unix: Root.Chmod can follow symlinks out of the root.
• MEDIUM https://github.com/advisories/GHSA-hxv8-4j4r-cqgv — Cilium L7 proxy may bypass Kubernetes NetworkPolicy for same-node traffic.
• MEDIUM https://github.com/advisories/GHSA-pxq6-2prw-chj9 — Moby: Privilege validation bypass during plugin installation.
• MEDIUM https://github.com/advisories/GHSA-j4j7-vw47-rhfq — html/template: URLs in meta content attribute actions are not escaped.
• MEDIUM https://github.com/advisories/GHSA-gjvh-7jh8-7xhm — Go crypto/x509: Denial of Service via inefficient certificate chain validation.
• MEDIUM https://github.com/advisories/GHSA-x4jj-h2v8-hqqv — Go archive/tar package: Denial of Service via maliciously-crafted archive.
• MEDIUM https://github.com/advisories/GHSA-7mr4-xjxg-34g6 — html/template: Cross-Site Scripting (XSS) via improper context and brace depth handling.
• LOW https://github.com/advisories/GHSA-rv83-g57w-fr8j — os: FileInfo can escape from a Root in golang os module.
• UNKNOWN https://github.com/advisories/GHSA-jrg3-gfjw-hm96 — If one side of the TLS connection sends multiple key update messages, connection handling may be unsafe.

Checklist

• The code is covered by unit tests.
• e2e tests passed.
• Documentation updated according to the changes.
• Changes were tested in the Kubernetes cluster manually.

Changelog entries

section: core
type: chore
summary: |
  Fixed vulnerabilities:
  - CVE-2026-32283
  - CVE-2026-27139
  - CVE-2026-32289
  - CVE-2026-32288
  - CVE-2026-32281
  - CVE-2026-27142
  - CVE-2026-33997
  - CVE-2026-33726
  - CVE-2026-32282
  - CVE-2026-32280
  - CVE-2026-25679
  - CVE-2026-34040
  - CVE-2026-34986
  - CVE-2026-39883
  - CVE-2026-33186