Skip to content

fix(security): update vulnerability-updates [security]#1933

Merged
renovate[bot] merged 1 commit intomainfrom
renovate/vulnerability-updates
Apr 9, 2026
Merged

fix(security): update vulnerability-updates [security]#1933
renovate[bot] merged 1 commit intomainfrom
renovate/vulnerability-updates

Conversation

@renovate
Copy link
Copy Markdown
Contributor

@renovate renovate bot commented Apr 8, 2026 •
edited
Loading

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.6.10 → v1.7.8 age confidence
github.com/aws/aws-sdk-go-v2/service/s3 v1.78.2 → v1.97.3 age confidence
go.opentelemetry.io/otel/sdk v1.40.0 → v1.43.0 age confidence
go.opentelemetry.io/otel/sdk v1.42.0 → v1.43.0 age confidence

GitHub Vulnerability Alerts

GHSA-xmrv-pmrh-hhx2

CVSSv3.1 Rating: [Medium]
CVSSv3.1 Score: [5.9]
CVSSv3.1 Vector String: [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H]

Summary and Impact

An issue exists in the the EventStream header decoder in AWS SDK for Go v2 in versions predating 2026-03-23. An actor can send a malformed EventStream response frame containing a crafted header value type byte outside the valid range, which can cause the host process to terminate.

Impacted versions: < 2026-03-23

Patches

This issue has been addressed in versions 2026-03-23 and above. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.

Workarounds

Not Applicable

References

If you have any questions or comments about this advisory, we ask that you contact [AWS/Amazon] Security via our vulnerability reporting page or directly via email to aws-security@amazon.com. Please do not create a public GitHub issue.

CVE-2026-39883

Summary

The fix for GHSA-9h8m-3fm2-qjrq (CVE-2026-24051) changed the Darwin ioreg command to use an absolute path but left the BSD kenv command using a bare name, allowing the same PATH hijacking attack on BSD and Solaris platforms.

Root Cause

sdk/resource/host_id.go line 42:

if result, err := r.execCommand("kenv", "-q", "smbios.system.uuid"); err == nil {

Compare with the fixed Darwin path at line 58:

result, err := r.execCommand("/usr/sbin/ioreg", "-rd1", "-c", "IOPlatformExpertDevice")

The execCommand helper at sdk/resource/host_id_exec.go uses exec.Command(name, arg...) which searches $PATH when the command name contains no path separator.

Affected platforms (per build tag in host_id_bsd.go:4): DragonFly BSD, FreeBSD, NetBSD, OpenBSD, Solaris.

The kenv path is reached when /etc/hostid does not exist (line 38-40), which is common on FreeBSD systems.

Attack

  1. Attacker has local access to a system running a Go application that imports go.opentelemetry.io/otel/sdk
  2. Attacker places a malicious kenv binary earlier in $PATH
  3. Application initializes OpenTelemetry resource detection at startup
  4. hostIDReaderBSD.read() calls exec.Command("kenv", ...) which resolves to the malicious binary
  5. Arbitrary code executes in the context of the application

Same attack vector and impact as CVE-2026-24051.

Suggested Fix

Use the absolute path:

if result, err := r.execCommand("/bin/kenv", "-q", "smbios.system.uuid"); err == nil {

On FreeBSD, kenv is located at /bin/kenv.

Release Notes

aws/aws-sdk-go-v2 (github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream)

v1.7.7

General Highlights

  • Dependency Update: Updated to the latest SDK module versions

Module Highlights

  • github.com/aws/aws-sdk-go-v2/feature/dynamodb/expression: v1.7.79
    • Bug Fix: allow nested list indices in expressions
  • github.com/aws/aws-sdk-go-v2/service/connectcontactlens: v1.28.0
    • Feature: Making sentiment optional for ListRealtimeContactAnalysisSegments Response depending on conversational analytics configuration
  • github.com/aws/aws-sdk-go-v2/service/detective: v1.33.0
    • Feature: Add support for Detective DualStack endpoints
  • github.com/aws/aws-sdk-go-v2/service/dynamodb: v1.42.4
    • Documentation: Doc only update for API descriptions.
  • github.com/aws/aws-sdk-go-v2/service/marketplaceentitlementservice: v1.29.0
    • Feature: Add support for Marketplace Entitlement Service dual-stack endpoints for CN and GOV regions
  • github.com/aws/aws-sdk-go-v2/service/marketplacemetering: v1.29.0
    • Feature: Add support for Marketplace Metering Service dual-stack endpoints for CN regions
  • github.com/aws/aws-sdk-go-v2/service/verifiedpermissions: v1.23.0
    • Feature: Adds deletion protection support to policy stores. Deletion protection is disabled by default, can be enabled via the CreatePolicyStore or UpdatePolicyStore APIs, and is visible in GetPolicyStore.

v1.7.1

General Highlights

  • Dependency Update: Updated to the latest SDK module versions

Module Highlights

  • github.com/aws/aws-sdk-go-v2/service/acm: v1.32.0
    • Feature: Add support for file-based HTTP domain control validation, available through Amazon CloudFront.
  • github.com/aws/aws-sdk-go-v2/service/cloudfront: v1.46.0
    • Feature: Add distribution tenant, connection group, and multi-tenant distribution APIs to the CloudFront SDK.
  • github.com/aws/aws-sdk-go-v2/service/dynamodb: v1.43.1
    • Documentation: Doc only update for GSI descriptions.
  • github.com/aws/aws-sdk-go-v2/service/imagebuilder: v1.42.0
    • Feature: Add integration with SSM Parameter Store to Image Builder.
  • github.com/aws/aws-sdk-go-v2/service/internal/checksum: v1.7.1
    • Bug Fix: Don't emit warnings about lack of checksum validation for non-200 responses.

v1.7.0

Module Highlights

  • github.com/aws/aws-sdk-go-v2/service/billing: v1.10.0
    • Feature: Cost Categories filtering support to BillingView data filter expressions through the new costCategories parameter, enabling users to filter billing views by AWS Cost Categories for more granular cost management and allocation.
  • github.com/aws/aws-sdk-go-v2/service/iotmanagedintegrations: v1.7.0
    • Feature: This release introduces WiFi Simple Setup (WSS) enabling device provisioning via barcode scanning with automated network discovery, authentication, and credential provisioning. Additionally, it introduces 2P Device Capability Rediscovery for updating hub-managed device capabilities post-onboarding.
  • github.com/aws/aws-sdk-go-v2/service/sagemaker: v1.230.0
    • Feature: Added ultraServerType to the UltraServerInfo structure to support server type identification for SageMaker HyperPod
open-telemetry/opentelemetry-go (go.opentelemetry.io/otel/sdk)

v1.43.0: /v0.65.0/v0.19.0

Compare Source

Added

  • Add IsRandom and WithRandom on TraceFlags, and IsRandom on SpanContext in go.opentelemetry.io/otel/trace
    for W3C Trace Context Level 2 Random Trace ID Flag support. (#​8012)
  • Add service detection with WithService in go.opentelemetry.io/otel/sdk/resource. (#​7642)
  • Add DefaultWithContext and EnvironmentWithContext in go.opentelemetry.io/otel/sdk/resource to support plumbing context.Context through default and environment detectors. (#​8051)
  • Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc. (#​8038)
  • Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc. (#​8038)
  • Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc. (#​8038)
  • Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp. (#​8038)
  • Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp. (#​8038)
  • Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp. (#​8038)
  • Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/sdk/metric/metricdata/metricdatatest. (#​8038)
  • Add support for per-series start time tracking for cumulative metrics in go.opentelemetry.io/otel/sdk/metric.
    Set OTEL_GO_X_PER_SERIES_START_TIMESTAMPS=true to enable. (#​8060)
  • Add WithCardinalityLimitSelector for metric reader for configuring cardinality limits specific to the instrument kind. (#​7855)

Changed

  • Introduce the EMPTY Type in go.opentelemetry.io/otel/attribute to reflect that an empty value is now a valid value, with INVALID remaining as a deprecated alias of EMPTY. (#​8038)
  • Refactor slice handling in go.opentelemetry.io/otel/attribute to optimize short slice values with fixed-size fast paths. (#​8039)
  • Improve performance of span metric recording in go.opentelemetry.io/otel/sdk/trace by returning early if self-observability is not enabled. (#​8067)
  • Improve formatting of metric data diffs in go.opentelemetry.io/otel/sdk/metric/metricdata/metricdatatest. (#​8073)

Deprecated

  • Deprecate INVALID in go.opentelemetry.io/otel/attribute. Use EMPTY instead. (#​8038)

Fixed

  • Return spec-compliant TraceIdRatioBased description. This is a breaking behavioral change, but it is necessary to
    make the implementation spec-compliant. (#​8027)
  • Fix a race condition in go.opentelemetry.io/otel/sdk/metric where the lastvalue aggregation could collect the value 0 even when no zero-value measurements were recorded. (#​8056)
  • Limit HTTP response body to 4 MiB in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp to mitigate excessive memory usage caused by a misconfigured or malicious server.
    Responses exceeding the limit are treated as non-retryable errors. (#​8108)
  • Limit HTTP response body to 4 MiB in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp to mitigate excessive memory usage caused by a misconfigured or malicious server.
    Responses exceeding the limit are treated as non-retryable errors. (#​8108)
  • Limit HTTP response body to 4 MiB in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp to mitigate excessive memory usage caused by a misconfigured or malicious server.
    Responses exceeding the limit are treated as non-retryable errors. (#​8108)
  • WithHostID detector in go.opentelemetry.io/otel/sdk/resource to use full path for kenv command on BSD. (#​8113)
  • Fix missing request.GetBody in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp to correctly handle HTTP2 GOAWAY frame. (#​8096)

What's Changed

New Contributors

Full Changelog: open-telemetry/opentelemetry-go@v1.42.0...v1.43.0

v1.42.0: /v0.64.0/v0.18.0/v0.0.16

Compare Source

Added
  • Add go.opentelemetry.io/otel/semconv/v1.40.0 package.
    The package contains semantic conventions from the v1.40.0 version of the OpenTelemetry Semantic Conventions.
    See the migration documentation for information on how to upgrade from go.opentelemetry.io/otel/semconv/v1.39.0. (#​7985)
  • Add Err and SetErr on Record in go.opentelemetry.io/otel/log to attach an error and set record exception attributes in go.opentelemetry.io/otel/log/sdk. (#​7924)
Changed
  • TracerProvider.ForceFlush in go.opentelemetry.io/otel/sdk/trace joins errors together and continues iteration through SpanProcessors as opposed to returning the first encountered error without attempting exports on subsequent SpanProcessors. (#​7856)
Fixed
  • Fix missing request.GetBody in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp to correctly handle HTTP2 GOAWAY frame. (#​7931)
  • Fix semconv v1.39.0 generated metric helpers skipping required attributes when extra attributes were empty. (#​7964)
  • Preserve W3C TraceFlags bitmask (including the random Trace ID flag) during trace context extraction and injection in go.opentelemetry.io/otel/propagation. (#​7834)
Removed
  • Drop support for [Go 1.24]. (#​7984)

What's Changed

New Contributors

Full Changelog: open-telemetry/opentelemetry-go@v1.41.0...v1.42.0

v1.41.0: /v0.63.0/v0.17.0/v0.0.15

Compare Source

This release is the last to support Go 1.24. The next release will require at least Go 1.25.

Added
Fixed
  • Update Baggage in go.opentelemetry.io/otel/propagation and Parse and New in go.opentelemetry.io/otel/baggage to comply with W3C Baggage specification limits. New and Parse now return partial baggage along with an error when limits are exceeded. Errors from baggage extraction are reported to the global error handler. (#​7880)

What's Changed

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • ""
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate bot requested review from a team as code owners April 8, 2026 16:39
@renovate renovate bot added the renovate label Apr 8, 2026
@renovate
Copy link
Copy Markdown
Contributor Author

renovate bot commented Apr 8, 2026 •
edited
Loading

ℹ️ Artifact update notice

File name: core/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 14 additional dependencies were updated

Details:

Package Change
go.opentelemetry.io/otel v1.42.0 -> v1.43.0
go.opentelemetry.io/otel/metric v1.42.0 -> v1.43.0
go.opentelemetry.io/otel/sdk/metric v1.42.0 -> v1.43.0
go.opentelemetry.io/otel/trace v1.42.0 -> v1.43.0
github.com/aws/aws-sdk-go-v2 v1.36.3 -> v1.41.5
github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.34 -> v1.4.21
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.34 -> v2.7.21
github.com/aws/aws-sdk-go-v2/internal/v4a v1.3.34 -> v1.4.22
github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.12.3 -> v1.13.7
github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.7.0 -> v1.9.13
github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.12.15 -> v1.13.21
github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.18.15 -> v1.19.21
github.com/aws/smithy-go v1.22.3 -> v1.24.2
golang.org/x/sys v0.41.0 -> v0.42.0
File name: flagd-proxy/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 9 additional dependencies were updated

Details:

Package Change
github.com/aws/aws-sdk-go-v2 v1.36.3 -> v1.41.5
github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.34 -> v1.4.21
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.34 -> v2.7.21
github.com/aws/aws-sdk-go-v2/internal/v4a v1.3.34 -> v1.4.22
github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.12.3 -> v1.13.7
github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.7.0 -> v1.9.13
github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.12.15 -> v1.13.21
github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.18.15 -> v1.19.21
github.com/aws/smithy-go v1.22.3 -> v1.24.2
File name: flagd/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 14 additional dependencies were updated

Details:

Package Change
go.opentelemetry.io/otel v1.40.0 -> v1.43.0
go.opentelemetry.io/otel/sdk/metric v1.40.0 -> v1.43.0
go.opentelemetry.io/otel/trace v1.40.0 -> v1.43.0
github.com/aws/aws-sdk-go-v2 v1.36.3 -> v1.41.5
github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.34 -> v1.4.21
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.34 -> v2.7.21
github.com/aws/aws-sdk-go-v2/internal/v4a v1.3.34 -> v1.4.22
github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.12.3 -> v1.13.7
github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.7.0 -> v1.9.13
github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.12.15 -> v1.13.21
github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.18.15 -> v1.19.21
github.com/aws/smithy-go v1.22.3 -> v1.24.2
go.opentelemetry.io/otel/metric v1.40.0 -> v1.43.0
golang.org/x/sys v0.40.0 -> v0.42.0

@netlify
Copy link
Copy Markdown

netlify bot commented Apr 8, 2026 •
edited
Loading

✅ Deploy Preview for polite-licorice-3db33c canceled.

Name Link
🔨 Latest commit dcf6844
🔍 Latest deploy log https://app.netlify.com/projects/polite-licorice-3db33c/deploys/69d6d6d151254d0008f56863

@renovate renovate bot force-pushed the renovate/vulnerability-updates branch from f56c7e7 to dcf6844 Compare April 8, 2026 22:29
@sonarqubecloud
Copy link
Copy Markdown

sonarqubecloud bot commented Apr 8, 2026

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

@renovate renovate bot merged commit 04338dc into main Apr 9, 2026
18 checks passed
@renovate renovate bot deleted the renovate/vulnerability-updates branch April 9, 2026 00:33
@github-actions github-actions bot mentioned this pull request Apr 9, 2026
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@renovate-approve renovate-approve[bot] renovate-approve[bot] approved these changes

@renovate-approve-2 renovate-approve-2[bot] renovate-approve-2[bot] approved these changes

Assignees

No one assigned

Labels

renovate

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants