[dev-v3] fix(deps): bump golang.org/x/net to v0.55.0 to address GO-2026-5026#32152
Merged
gjenkins8 merged 1 commit intoMay 27, 2026
Merged
Conversation
Upgrades golang.org/x/net from v0.53.0 to v0.55.0 to fix CVE-2026-39821 (GO-2026-5026), where idna.ToASCII/ToUnicode incorrectly accept Punycode- encoded labels that decode to ASCII-only labels, enabling privilege escalation via hostname check bypass. Coordinated x/ upgrades pulled in by the module graph: - golang.org/x/crypto v0.50.0 => v0.51.0 - golang.org/x/sys v0.43.0 => v0.45.0 - golang.org/x/term v0.42.0 => v0.43.0 Signed-off-by: Terry Howe <[email protected]>
pull-request-size
Bot
added
the
size/XS
TerryHowe
added
the
Has One Approval
gjenkins8
changed the title
gjenkins8
approved these changes
May 27, 2026
|
📝 Documentation Updated I've created a docs PR to add this security fix to the changelog: helm/helm-www#2118 The changelog entry documents the |
scottrigby
changed the title
scottrigby
added
needs-pick
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Bumps
golang.org/x/netfrom v0.53.0 to v0.55.0 to fix GO-2026-5026 / CVE-2026-39821.v3 backport of #32153
Vulnerability
The
ToASCIIandToUnicodefunctions in thegolang.org/x/net/idnapackage incorrectly accept Punycode-encoded labels that decode to ASCII-only labels. For example,ToUnicode("xn--example-.com")returns"example.com"instead of an error. This allows privilege escalation by bypassing hostname-based security checks.Helm's call chain that triggers the finding:
registry.LoggingTransport.RoundTrip→http.Transport.RoundTrip→idna.ToASCIIrepotest.OCIServer.Run→registry.Registry.ListenAndServe→idna.Profile.ToASCIIChanges
The
golang.org/x/packages share a coordinated release cycle, so the following were updated together:golang.org/x/netgolang.org/x/cryptogolang.org/x/sysgolang.org/x/termThis also unblocks the dependabot
x/termbump PR (#32151) which was failing govulncheck due to this vulnerability.