[CVE] Bump Go to 1.26.6 (release-v1.42) - #5202
Open
dimitri-nicolo wants to merge 1 commit into
Open
Conversation
The operator binary is built by the calico/go-build image selected by GO_VERSION, so its stdlib version is whatever that pin says. At 1.26.5 two stdlib advisories are open against the shipped binary: CVE-2026-39821 idna ToASCII / ToUnicode accept Punycode labels that decode to an ASCII-only label, which can escalate privilege in code that checks the ASCII hostname CVE-2026-46600 parsing an invalid SVCB or HTTPS resource record panics when a parameter value overflows the message buffer Both are fixed in Go 1.26.6. calico/go-build already publishes 1.26.6-llvm21.1.8-k8s1.36.3, matching this branch's LLVM_VERSION and K8S_VERSION, so no go-build change is needed. The go.mod `go` directives move with GO_VERSION, as on previous bumps. These two were the last findings outstanding against the operator image from the same scan; the containerd, oras-go and grpc ones were cleared by the move to helm v3.21.3 in tigera#5172. Release Note ------------ Fixed CVE-2026-39821 and CVE-2026-46600 in the operator image by building with Go 1.26.6. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Contributor
There was a problem hiding this comment.
Pull request overview
This PR bumps the Go toolchain/version pins used to build the operator (via GO_VERSION and the go directives) from 1.26.5 to 1.26.6 to clear the two referenced stdlib CVEs in the operator image.
Changes:
- Update
MakefileGO_VERSIONto1.26.6. - Update the
godirective ingo.modandapi/go.modto1.26.6.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
Makefile |
Bumps the Go toolchain version used by the build image tag to 1.26.6. |
go.mod |
Updates the module’s Go language/toolchain directive to 1.26.6. |
api/go.mod |
Updates the API submodule’s Go language/toolchain directive to 1.26.6. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Clears the two stdlib findings against the operator image from the 2026-08-14 scan of
v1.42.4-40-g0d01e49fe7a5.The operator binary is built by the
calico/go-buildimage selected byGO_VERSION, so its stdlib version is whatever that pin says. At 1.26.5:idna.ToASCII/ToUnicodeaccept Punycode labels that decode to an ASCII-only label, so code that does a privilege check on the ASCII hostname can be bypassed (xn--example-.compasses, then decodes toexample.com).Both are fixed in Go 1.26.6.
Changes
Makefile:GO_VERSION?=1.26.5 -> 1.26.6go.mod,api/go.mod:godirective 1.26.5 -> 1.26.6The
godirectives move withGO_VERSION, matching the previous bump (7d0d1ac). No dependency changes, sogo.sumis untouched.calico/go-buildalready publishes1.26.6-llvm21.1.8-k8s1.36.3, which matches this branch'sLLVM_VERSIONandK8S_VERSION— no go-build change needed. (The pre-commit hook ran in that image while preparing this branch.)Scope
These were the last findings outstanding against the operator image from that scan. The containerd, oras-go and grpc findings were cleared by the move to helm v3.21.3 in #5172, which dropped containerd and grpc from the dependency graph outright and took oras-go to v2.6.2. This branch is rebased on that merge.
Note that
masteris still on 1.26.5, so this does not have a master counterpart to pick from; it is a release-branch-only bump driven by the scan.Release note: