chore(deps): update security updates [security]

[NumaryBot]

This PR contains the following updates:

Package	Type	Update	Change
golang.org/x/crypto	indirect	minor	v0.50.0 -> v0.52.0
golang.org/x/net	indirect	minor	v0.53.0 -> v0.55.0
golang.org/x/sys	indirect	minor	v0.43.0 -> v0.44.0

---

Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh

CVE-2026-39829 / GO-2026-5018

More information

Details

The RSA and DSA public key parsers did not enforce size limits on key parameters. A crafted public key with an excessively large modulus or DSA parameter could cause several minutes of CPU consumption during signature verification. This could be triggered by unauthenticated clients during public key authentication. RSA moduli are now limited to 8192 bits, and DSA parameters are validated per FIPS 186-2.

Severity

Unknown

References

• https://go.dev/issue/79565
• https://groups.google.com/g/golang-announce/c/a082jnz-LvI
• https://go.dev/cl/781641
• https://go.dev/cl/781661

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

---

Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent

CVE-2026-39833 / GO-2026-5005

More information

Details

The in-memory keyring returned by NewKeyring() silently accepted keys with the ConfirmBeforeUse constraint but never enforced it. The key would sign without any confirmation prompt, with no indication to the caller that the constraint was not in effect. NewKeyring() now returns an error when unsupported constraints are requested.

Severity

Unknown

References

• https://go.dev/issue/79436
• https://go.dev/cl/778640
• https://go.dev/cl/778641
• https://groups.google.com/g/golang-announce/c/a082jnz-LvI

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

---

Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh

CVE-2026-46595 / GO-2026-5023

More information

Details

Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation would be skipped.

Severity

Unknown

References

• https://go.dev/issue/79570
• https://groups.google.com/g/golang-announce/c/a082jnz-LvI
• https://go.dev/cl/781642

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

---

Invoking auth bypass via unenforced @​revoked status in golang.org/x/crypto/ssh/knownhosts

CVE-2026-42508 / GO-2026-5021

More information

Details

Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation. Now, both the 'key' and 'key.SignatureKey' are checked for @​revoked.

Severity

Unknown

References

• https://go.dev/issue/79568
• https://go.dev/cl/781220
• https://groups.google.com/g/golang-announce/c/a082jnz-LvI

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

---

Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh

CVE-2026-39830 / GO-2026-5017

More information

Details

A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop. The blocked goroutine could not be released by calling Close(), resulting in a resource leak per connection. Unsolicited global responses are now discarded.

Severity

Unknown

References

• https://go.dev/issue/79564
• https://groups.google.com/g/golang-announce/c/a082jnz-LvI
• https://go.dev/cl/781640
• https://go.dev/cl/781664

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

---

Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh

CVE-2026-39831 / GO-2026-5019

More information

Details

The Verify() method for FIDO/U2F security key types (sk-ecdsa-sha2-nistp256@​openssh.com, sk-ssh-ed25519@​openssh.com) did not check the User Presence flag. Signatures generated without physical touch were accepted, allowing unattended use of a hardware security key. To restore the previous behavior, return a "no-touch-required" extension in Permissions.Extensions from PublicKeyCallback.

Severity

Unknown

References

• https://go.dev/issue/79566
• https://groups.google.com/g/golang-announce/c/a082jnz-LvI
• https://go.dev/cl/781662

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

---

Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent

CVE-2026-46598 / GO-2026-5033

More information

Details

For certain crafted inputs, a 'ed25519.PrivateKey' was created by casting malformed wire bytes, leading to a panic when used.

Severity

Unknown

References

• https://go.dev/issue/79596
• https://go.dev/cl/781360
• https://groups.google.com/g/golang-announce/c/a082jnz-LvI

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

---

Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh

CVE-2026-39827 / GO-2026-5016

More information

Details

An authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users. Rejected channels are now properly removed from the connection's internal state and released for garbage collection.

Severity

Unknown

References

• https://go.dev/issue/35127
• https://go.dev/cl/781320
• https://groups.google.com/g/golang-announce/c/a082jnz-LvI

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

---

Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh

CVE-2026-39835 / GO-2026-5015

More information

Details

SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate. CertChecker now returns an error instead of panicking when these callbacks are nil.

Severity

Unknown

References

• https://go.dev/issue/79563
• https://groups.google.com/g/golang-announce/c/a082jnz-LvI
• https://go.dev/cl/781660

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

---

Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh

CVE-2026-39828 / GO-2026-5014

More information

Details

When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as force-command after a second factor succeeded. Returning non-nil Permissions with PartialSuccessError now results in a connection error.

Severity

Unknown

References

• https://go.dev/issue/79562
• https://groups.google.com/g/golang-announce/c/a082jnz-LvI
• https://go.dev/cl/781621

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

---

Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh

CVE-2026-46597 / GO-2026-5013

More information

Details

An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs.

Severity

Unknown

References

• https://go.dev/issue/79561
• https://groups.google.com/g/golang-announce/c/a082jnz-LvI
• https://go.dev/cl/781620

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

---

Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent

CVE-2026-39832 / GO-2026-5006

More information

Details

When adding a key to a remote agent constraint extensions such as restrict-destination-v00@​openssh.com were not serialized in the request. Destination restrictions were silently stripped when forwarding keys, allowing unrestricted use of the key on the remote host. The client now serializes all constraint extensions. Additionally, the in-memory keyring returned by NewKeyring() now rejects keys with unsupported constraint extensions instead of silently ignoring them.

Severity

Unknown

References

• https://go.dev/issue/79435
• https://go.dev/cl/778642
• https://groups.google.com/g/golang-announce/c/a082jnz-LvI

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

---

Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh

CVE-2026-39834 / GO-2026-5020

More information

Details

When writing data larger than 4GB in a single Write call on an SSH channel, an integer overflow in the internal payload size calculation caused the write loop to spin indefinitely, sending empty packets without making progress. The size comparison now uses int64 to prevent truncation.

Severity

Unknown

References

• https://go.dev/issue/79567
• https://groups.google.com/g/golang-announce/c/a082jnz-LvI
• https://go.dev/cl/781663

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

---

Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html

CVE-2026-25680 / GO-2026-5028

More information

Details

Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service.

Severity

Unknown

References

• https://go.dev/cl/781702
• https://go.dev/issue/79573
• https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

---

Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html

CVE-2026-42502 / GO-2026-5027

More information

Details

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

Severity

Unknown

References

• https://go.dev/issue/79572
• https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8
• https://go.dev/cl/781701

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

---

Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html

CVE-2026-42506 / GO-2026-5025

More information

Details

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

Severity

Unknown

References

• https://go.dev/issue/79571
• https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8
• https://go.dev/cl/781700

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

---

Invoking duplicate attributes can cause XSS in golang.org/x/net/html

CVE-2026-27136 / GO-2026-5030

More information

Details

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

Severity

Unknown

References

• https://go.dev/issue/79575
• https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8
• https://go.dev/cl/781685

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

---

Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html

CVE-2026-25681 / GO-2026-5029

More information

Details

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

Severity

Unknown

References

• https://go.dev/issue/79574
• https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8
• https://go.dev/cl/781703

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

---

Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna

CVE-2026-39821 / GO-2026-5026

More information

Details

The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error.

This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject "example.com" but permit "xn--example-.com". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name "example.com".

Severity

Unknown

References

• https://go.dev/cl/767220
• https://go.dev/issue/78760
• https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

---

Invoking integer overflow in NewNTUnicodeString in golang.org/x/sys/windows

CVE-2026-39824 / GO-2026-5024

More information

Details

NewNTUnicodeString does not check for string length overflow. When provided with a string that overflows the maximum size of a NTUnicodeString (a 16-bit number of bytes), it returns a truncated string rather than an error.

Severity

Unknown

References

• https://go.dev/issue/78916
• https://go.dev/cl/770080
• https://groups.google.com/g/golang-announce/c/6MMI8Lj-Atg

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.

[NumaryBot]

⚠️ Artifact update problem

Renovate failed to update artifacts related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: go.sum

Command failed: go get -d -t ./...
go: -d flag is deprecated. -d=true is a no-op
go: github.com/formancehq/go-libs/v5@v5.1.1-0.20260522083443-d2a60ed2e0dd: invalid version: unknown revision d2a60ed2e0dd

File name: undefined

Command failed: just pre-commit
go: downloading github.com/formancehq/go-libs/v5 v5.1.1-0.20260522083443-d2a60ed2e0dd
go: downloading github.com/ThreeDotsLabs/watermill v1.5.1
go: downloading github.com/formancehq/formance-sdk-go/v3 v3.8.1
go: downloading github.com/spf13/cobra v1.10.2
go: downloading go.uber.org/fx v1.24.0
go: downloading golang.org/x/oauth2 v0.36.0
go: downloading github.com/go-chi/chi/v5 v5.2.5
go: downloading github.com/go-chi/render v1.0.3
go: downloading github.com/formancehq/ledger v0.0.0-20260420112415-04500870a72d
go: downloading github.com/onsi/ginkgo/v2 v2.28.1
go: downloading github.com/go-chi/chi v4.1.2+incompatible
go: downloading github.com/google/uuid v1.6.0
go: downloading github.com/pkg/errors v0.9.1
go: downloading github.com/spf13/pflag v1.0.10
go: downloading go.uber.org/dig v1.19.0
go: downloading go.uber.org/multierr v1.11.0
go: downloading github.com/cenkalti/backoff/v4 v4.3.0
go: downloading github.com/ajg/form v1.7.1
go: downloading go.uber.org/zap v1.27.1
go: downloading github.com/lithammer/shortuuid/v3 v3.0.7
go: downloading github.com/oklog/ulid v1.3.1
go: downloading golang.org/x/sync v0.20.0
go: downloading github.com/ericlagergren/decimal v0.0.0-20240411145413-00de7ca16731
go: downloading github.com/go-logr/logr v1.4.3
go: downloading github.com/Masterminds/semver/v3 v3.4.0
go: downloading golang.org/x/tools v0.43.0
go: downloading golang.org/x/mod v0.34.0
go: downloading github.com/formancehq/go-libs/v5 v5.1.1-0.20260522083443-d2a60ed2e0dd
go: downloading github.com/stretchr/testify v1.11.1
go: downloading github.com/onsi/gomega v1.39.1
go: downloading golang.org/x/sys v0.44.0
go: downloading github.com/inconshreveable/mousetrap v1.1.0
go: downloading github.com/ClickHouse/clickhouse-go/v2 v2.43.0
go: downloading github.com/formancehq/ledger/pkg/client v0.0.0-20260416070424-5a335109905b
go: downloading github.com/olivere/elastic/v7 v7.0.32
go: downloading github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc
go: downloading github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2
go: downloading github.com/google/go-cmp v0.7.0
go: downloading github.com/invopop/jsonschema v0.13.0
go: downloading github.com/mitchellh/mapstructure v1.5.0
go: downloading github.com/robfig/cron/v3 v3.0.1
go: downloading github.com/spf13/viper v1.20.1
go: downloading github.com/uptrace/bun v1.2.18
go: downloading go.opentelemetry.io/otel/sdk/metric v1.43.0
go: downloading google.golang.org/grpc v1.80.0
go: downloading go.opentelemetry.io/otel/sdk v1.43.0
go: downloading github.com/iancoleman/strcase v0.3.0
go: downloading go.opentelemetry.io/otel v1.43.0
go: downloading go.uber.org/mock v0.6.0
go: downloading go.vallahaye.net/batcher v0.6.0
go: downloading gopkg.in/yaml.v3 v3.0.1
go: downloading go.yaml.in/yaml/v3 v3.0.4
go: downloading golang.org/x/net v0.55.0
go: downloading github.com/go-task/slim-sprig/v3 v3.0.0
go: downloading google.golang.org/protobuf v1.36.11
go: downloading github.com/go-chi/cors v1.2.2
go: downloading github.com/riandyrn/otelchi v0.12.2
go: downloading go.opentelemetry.io/otel/metric v1.43.0
go: downloading go.opentelemetry.io/otel/trace v1.43.0
go: downloading github.com/bluele/gcache v0.0.2
go: downloading github.com/formancehq/numscript v0.0.24
go: downloading github.com/alitto/pond v1.9.2
go: downloading github.com/uptrace/bun/dialect/pgdialect v1.2.18
go: downloading go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.62.0
go: downloading github.com/wk8/go-ordered-map/v2 v2.1.9-0.20240816141633-0a40785b4f41
go: downloading github.com/mailru/easyjson v0.9.2
go: downloading github.com/fsnotify/fsnotify v1.9.0
go: downloading github.com/go-viper/mapstructure/v2 v2.5.0
go: downloading github.com/sagikazarmark/locafero v0.9.0
go: downloading github.com/spf13/afero v1.14.0
go: downloading github.com/spf13/cast v1.9.2
go: downloading github.com/ClickHouse/ch-go v0.71.0
go: downloading github.com/andybalholm/brotli v1.2.0
go: downloading github.com/paulmach/orb v0.12.0
go: downloading github.com/shopspring/decimal v1.4.0
go: downloading github.com/google/pprof v0.0.0-20260302011040-a15ffb7f9dcc
go: downloading github.com/go-logr/stdr v1.2.2
go: downloading golang.org/x/text v0.36.0
go: downloading github.com/felixge/httpsnoop v1.0.4
go: downloading github.com/antlr/antlr4/runtime/Go/antlr v1.4.10
go: downloading github.com/logrusorgru/aurora v2.0.3+incompatible
go: downloading github.com/shomali11/xsql v0.0.0-20190608141458-bf76292144df
go: downloading github.com/stoewer/go-strcase v1.3.1
go: downloading google.golang.org/genproto/googleapis/rpc v0.0.0-20260414002931-afd174a4e478
go: downloading github.com/jackc/pgx/v5 v5.9.2
go: downloading github.com/bahlo/generic-list-go v0.2.0
go: downloading github.com/buger/jsonparser v1.1.2
go: downloading github.com/josharian/intern v1.0.0
go: downloading github.com/sourcegraph/conc v0.3.0
go: downloading github.com/subosito/gotenv v1.6.0
go: downloading github.com/pelletier/go-toml/v2 v2.2.4
go: downloading github.com/tmthrgd/go-hex v0.0.0-20190904060850-447a3041c3bc
go: downloading github.com/jinzhu/inflection v1.0.0
go: downloading github.com/puzpuzpuz/xsync/v3 v3.5.1
go: downloading github.com/vmihailenco/msgpack/v5 v5.4.1
go: downloading github.com/go-faster/city v1.0.1
go: downloading github.com/go-faster/errors v0.7.1
go: downloading github.com/klauspost/compress v1.18.4
go: downloading github.com/pierrec/lz4/v4 v4.1.26
go: downloading github.com/segmentio/asm v1.2.1
go: downloading go.opentelemetry.io/auto/sdk v1.2.1
go: downloading github.com/cespare/xxhash/v2 v2.3.0
go: downloading github.com/vmihailenco/tagparser/v2 v2.0.0
go: downloading github.com/shomali11/util v0.0.0-20220717175126-f0771b70947f
go: downloading github.com/antlr4-go/antlr/v4 v4.13.1
go: downloading github.com/jackc/pgpassfile v1.0.0
go: downloading github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761
go: downloading github.com/jackc/puddle/v2 v2.2.2
go: downloading golang.org/x/exp v0.0.0-20250819193227-8b4c13bb791b
go: github.com/formancehq/go-libs/v5@v5.1.1-0.20260522083443-d2a60ed2e0dd: invalid version: unknown revision d2a60ed2e0dd
error: Recipe `tidy` failed on line 13 with exit code 1

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters (2)

• go.mod is excluded by !**/*.mod
• go.sum is excluded by !**/*.sum, !**/*.sum

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: d19640e0-5d0b-4110-b923-c91357c31e88

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch renovate/security

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}