Skip to content

chore: upgrade Go toolchain (stdlib) to 1.26 to address CVE-2026-46600 - #1586

Open
claude[bot] wants to merge 2 commits into
mainfrom
cursor/cve/stdlib
Open

chore: upgrade Go toolchain (stdlib) to 1.26 to address CVE-2026-46600#1586
claude[bot] wants to merge 2 commits into
mainfrom
cursor/cve/stdlib

Conversation

@claude

@claude claude Bot commented Aug 14, 2026

Copy link
Copy Markdown
Contributor

Fixes SOU-1984

Summary

The Zoekt builder stage in the Dockerfile built against golang:1.25-alpine, which ships Go stdlib 1.25.13. Because the Zoekt binaries are statically linked (CGO_ENABLED=0) and copied into the runtime image, that stdlib version is what Trivy reports on the published container.

CVE-2026-46600 / GO-2026-5942 (HIGH): parsing an invalid SVCB or HTTPS DNS resource record can panic when the size of a parameter value overflows the message buffer, a denial of service in the stdlib copy of golang.org/x/net/dns/dnsmessage.

Upstream fixed this in Go 1.26.6 and 1.27.0-rc.3. The 1.25 line did not receive a backport, so there is no patched 1.25.x to move to. This bumps the builder base image to the 1.26 line:

-FROM golang:1.25-alpine AS go-alpine
+FROM golang:1.26-alpine AS go-alpine

The floating minor tag resolves to the newest 1.26.x patch, which is at or above the 1.26.6 fixed floor, and keeps picking up future patch releases. This matches the convention established when the toolchain moved to 1.25 in #1112.

Scope

One line in Dockerfile. The go-alpine stage is used only by zoekt-builder, and the vendored Zoekt module declares go 1.25.0, which the 1.26 toolchain builds unchanged. No Go source, go.mod, or go.sum changes are involved, and the Node/Alpine stages are untouched.

Verification

  • Confirmed Dockerfile:17 is the only Go toolchain pin in the repository (no setup-go steps, no other golang: references).
  • Confirmed the go-alpine stage feeds only zoekt-builder, whose static binaries are the sole source of the reported stdlib package in the image.
  • The container build itself could not be exercised in the remediation sandbox: it has no Docker or outbound network access, and the vendor/zoekt submodule is not checked out there. The PR Gate workflow builds the image on this PR (with submodules), validating the new base image and the Zoekt build, and the nightly Trivy scan re-verifies that no affected stdlib version remains in the published image.

🤖 Generated with Claude Code


Note

Cursor Bugbot is generating a summary for commit 9632bfc. Configure here.

The Zoekt builder stage used golang:1.25-alpine, which ships Go stdlib
1.25.13. Parsing an invalid SVCB or HTTPS DNS resource record can panic
when a parameter value size overflows the message buffer
(CVE-2026-46600 / GO-2026-5942), a denial of service in the stdlib copy
of golang.org/x/net/dns/dnsmessage.

Upstream fixed this in Go 1.26.6 and 1.27.0-rc.3 only; the 1.25 line did
not receive a backport, so clearing the advisory requires moving the
builder to the 1.26 line. The floating minor tag keeps picking up patch
releases, matching the convention established when the toolchain moved
to 1.25.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
@github-actions

Copy link
Copy Markdown
Contributor

@claude[bot] your pull request is missing a changelog!

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
@claude
claude Bot requested a review from brendan-kellam August 14, 2026 08:59
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants