Skip to content

fix(cve): CVE-2026-39828, CVE-2026-39829, CVE-2026-39830 - update golang.org/x/crypto to v0.52.0 [release-v0.37.x] - #2909

Merged
tekton-robot merged 1 commit into
release-v0.37.xfrom
fix/SRVKP-12454-SRVKP-12456-CVE-2026-39828-CVE-2026-39829-xcrypto-release-v0.37.6-attempt-1
Jul 13, 2026
Merged

fix(cve): CVE-2026-39828, CVE-2026-39829, CVE-2026-39830 - update golang.org/x/crypto to v0.52.0 [release-v0.37.x]#2909
tekton-robot merged 1 commit into
release-v0.37.xfrom
fix/SRVKP-12454-SRVKP-12456-CVE-2026-39828-CVE-2026-39829-xcrypto-release-v0.37.6-attempt-1

Conversation

@divyansh42

@divyansh42 divyansh42 commented Jun 18, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

CVE Details

CVE Severity Description Fixed Version
CVE-2026-39828 (GO-2026-5014) High Unauthorized command execution via discarded SSH permissions in golang.org/x/crypto/ssh v0.52.0
CVE-2026-39829 (GO-2026-5018) High DoS via crafted public key with excessive parameters in golang.org/x/crypto/ssh v0.52.0
CVE-2026-39830 (GO-2026-5017) High DoS via resource leak from unsolicited SSH responses in golang.org/x/crypto/ssh v0.52.0

Jira: SRVKP-12454, SRVKP-12456, SRVKP-12481

Fix Summary

Test Results ✅

Command: go test -mod=vendor -count=1 ./...
Status: PASSED

Breaking Changes

No breaking changes. Indirect dependency bump only.

Verification Steps

  • Review go.mod and go.sum for golang.org/x/crypto v0.52.0
  • Confirm CI passes
  • Merge after CI green

Risk Assessment

Low — Indirect dependency bump, no CLI API changes, all tests pass.

Updated by CVE Fixer automation — added CVE-2026-39830 (SRVKP-12481) coverage.

@tekton-robot tekton-robot added the do-not-merge/release-note-label-needed Indicates that a PR should not merge because it's missing one of the release note labels. label Jun 18, 2026
@linux-foundation-easycla

linux-foundation-easycla Bot commented Jun 18, 2026 •
edited
Loading

Copy link
Copy Markdown

CLA Signed
The committers listed above are authorized under a signed CLA.

  • ✅ login: divyansh42 / name: Divyanshu Agrawal (b9d7586)

@tekton-robot tekton-robot added the size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files. label Jun 18, 2026
@divyansh42 divyansh42 changed the title fix(cve): CVE-2026-39828, CVE-2026-39829 - update golang.org/x/crypto to v0.52.0 [pipelines-1.15] fix(cve): CVE-2026-39828, CVE-2026-39829, CVE-2026-39830 - update golang.org/x/crypto to v0.52.0 [pipelines-1.15] Jun 19, 2026
@pratap0007

pratap0007 commented Jun 21, 2026

Copy link
Copy Markdown
Contributor

/retest

@divyansh42

divyansh42 commented Jun 22, 2026

Copy link
Copy Markdown
Member Author

/hold

@tekton-robot tekton-robot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Jun 22, 2026
@divyansh42 divyansh42 changed the title fix(cve): CVE-2026-39828, CVE-2026-39829, CVE-2026-39830 - update golang.org/x/crypto to v0.52.0 [pipelines-1.15] fix(cve): CVE-2026-39828, CVE-2026-39829, CVE-2026-39830 - update golang.org/x/crypto to v0.52.0 [release-v0.37.6] Jul 2, 2026
@divyansh42 divyansh42 added the release-note-none Denotes a PR that doesnt merit a release note. label Jul 2, 2026
@tekton-robot tekton-robot removed the do-not-merge/release-note-label-needed Indicates that a PR should not merge because it's missing one of the release note labels. label Jul 2, 2026
@divyansh42

divyansh42 commented Jul 2, 2026

Copy link
Copy Markdown
Member Author

/retest

@divyansh42

divyansh42 commented Jul 2, 2026

Copy link
Copy Markdown
Member Author

/hold cancel

@tekton-robot tekton-robot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Jul 2, 2026
@divyansh42
divyansh42 force-pushed the fix/SRVKP-12454-SRVKP-12456-CVE-2026-39828-CVE-2026-39829-xcrypto-release-v0.37.6-attempt-1 branch 3 times, most recently from 7180558 to 25f8843 Compare July 3, 2026 12:46
@divyansh42
divyansh42 changed the base branch from release-v0.37.6 to release-v0.37.x July 3, 2026 12:47
@divyansh42
divyansh42 force-pushed the fix/SRVKP-12454-SRVKP-12456-CVE-2026-39828-CVE-2026-39829-xcrypto-release-v0.37.6-attempt-1 branch from 25f8843 to 013169e Compare July 3, 2026 12:50
@divyansh42

divyansh42 commented Jul 3, 2026

Copy link
Copy Markdown
Member Author

/retest

@divyansh42

divyansh42 commented Jul 6, 2026

Copy link
Copy Markdown
Member Author

/hold
PR need to be rebased

@tekton-robot tekton-robot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Jul 6, 2026
@divyansh42
divyansh42 force-pushed the fix/SRVKP-12454-SRVKP-12456-CVE-2026-39828-CVE-2026-39829-xcrypto-release-v0.37.6-attempt-1 branch from 013169e to aef8655 Compare July 9, 2026 09:18
@divyansh42 divyansh42 changed the title fix(cve): CVE-2026-39828, CVE-2026-39829, CVE-2026-39830 - update golang.org/x/crypto to v0.52.0 [release-v0.37.6] fix(cve): CVE-2026-39828, CVE-2026-39829, CVE-2026-39830 - update golang.org/x/crypto to v0.52.0 [release-v0.37.x] Jul 9, 2026
@divyansh42
divyansh42 force-pushed the fix/SRVKP-12454-SRVKP-12456-CVE-2026-39828-CVE-2026-39829-xcrypto-release-v0.37.6-attempt-1 branch 2 times, most recently from fd34c21 to 64d9ac0 Compare July 10, 2026 09:46
@divyansh42

divyansh42 commented Jul 10, 2026

Copy link
Copy Markdown
Member Author

/hold cancel

@tekton-robot tekton-robot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Jul 10, 2026
@divyansh42 @cursoragent
fix(cve): CVE-2026-39828, CVE-2026-39829, CVE-2026-39830 - update gol…
b08bdbf 
…ang.org/x/crypto to v0.52.0

- Update golang.org/x/crypto from v0.46.0 to v0.52.0
- Addresses CVE-2026-39828: Unauthorized command execution via discarded
  SSH permissions in golang.org/x/crypto/ssh (GO-2026-5014)
- Addresses CVE-2026-39829: DoS via crafted public key with excessive
  parameters in golang.org/x/crypto/ssh (GO-2026-5018)
- Addresses CVE-2026-39830: DoS via resource leak from unsolicited SSH
  responses in golang.org/x/crypto/ssh (GO-2026-5017)
- Run go mod tidy, go mod vendor

Resolves: SRVKP-12454, SRVKP-12456, SRVKP-12481

Signed-off-by: Divyanshu Agrawal <diagrawa@redhat.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
@divyansh42
divyansh42 force-pushed the fix/SRVKP-12454-SRVKP-12456-CVE-2026-39828-CVE-2026-39829-xcrypto-release-v0.37.6-attempt-1 branch from 64d9ac0 to b08bdbf Compare July 10, 2026 12:42
@divyansh42

divyansh42 commented Jul 10, 2026

Copy link
Copy Markdown
Member Author

/retest

3 similar comments
@pratap0007

pratap0007 commented Jul 11, 2026

Copy link
Copy Markdown
Contributor

/retest

@divyansh42

divyansh42 commented Jul 11, 2026

Copy link
Copy Markdown
Member Author

/retest

@divyansh42

divyansh42 commented Jul 12, 2026

Copy link
Copy Markdown
Member Author

/retest

@pratap0007

pratap0007 commented Jul 13, 2026

Copy link
Copy Markdown
Contributor

/lgtm
/approve

@tekton-robot tekton-robot added the lgtm Indicates that a PR is ready to be merged. label Jul 13, 2026
@tekton-robot

tekton-robot commented Jul 13, 2026

Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: pratap0007

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@tekton-robot tekton-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jul 13, 2026
@tekton-robot
tekton-robot merged commit 9befafb into release-v0.37.x Jul 13, 2026
48 of 61 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@pradeepitm12 pradeepitm12 Awaiting requested review from pradeepitm12
@pratap0007 pratap0007 Awaiting requested review from pratap0007

Assignees

@pratap0007 pratap0007

Labels

approved Indicates a PR has been approved by an approver from all required OWNERS files. lgtm Indicates that a PR is ready to be merged. release-note-none Denotes a PR that doesnt merit a release note. size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@divyansh42 @pratap0007 @tekton-robot