Skip to content

fix(helper): recognize raw username prefix in UnanonymizeFilepath - #24

Merged
kkochel merged 1 commit into
mainfrom
bugfix/unanobymize-file-path
Aug 18, 2026
Merged

fix(helper): recognize raw username prefix in UnanonymizeFilepath#24
kkochel merged 1 commit into
mainfrom
bugfix/unanobymize-file-path

Conversation

@kkochel

@kkochel kkochel commented Aug 17, 2026

Copy link
Copy Markdown
Collaborator

Related issue(s) and PR(s)

This PR closes [issue number].

Description

ADR

  • This PR includes an architecturally significant decision (see docs/decisions/README.md)
    • A decision record has been added or updated in docs/decisions/
    • The decision record is listed in the docs/decisions/README.md index table

How to test

@github-actions

github-actions Bot commented Aug 17, 2026

Copy link
Copy Markdown

🔍 Trivy Scan - SDA Services 🔍

Target ghcr.io/biobanklab/sensitive-data-archive:PR24 (debian 13.6)

No Vulnerabilities found

Target usr/local/bin/sda-api

Vulnerabilities (26)

Package ID Severity Installed Version Fixed Version Title
github.com/quic-go/quic-go CVE-2026-40898 MEDIUM v0.59.0 0.59.1 github.com/quic-go/quic-go: quic-go: Denial of Service via excessive memory allocation in HTTP/3 trailers
golang.org/x/crypto CVE-2026-39828 HIGH v0.50.0 0.52.0 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Unauthorized command execution via discarded SSH permissions
golang.org/x/crypto CVE-2026-39829 HIGH v0.50.0 0.52.0 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters
golang.org/x/crypto CVE-2026-39830 HIGH v0.50.0 0.52.0 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses
golang.org/x/crypto CVE-2026-39831 HIGH v0.50.0 0.52.0 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Security key bypass due to missing user presence check
golang.org/x/crypto CVE-2026-39832 HIGH v0.50.0 0.52.0 golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to improper handling of key restrictions
golang.org/x/crypto CVE-2026-39835 HIGH v0.50.0 0.52.0 golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate
golang.org/x/crypto CVE-2026-42508 HIGH v0.50.0 0.52.0 golang.org/x/crypto/ssh/knownhosts: golang: golang.org/x/crypto/ssh/knownhosts: Revocation bypass via unchecked SignatureKey
golang.org/x/crypto CVE-2026-46595 HIGH v0.50.0 0.52.0 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Authorization bypass due to skipped source-address validation
golang.org/x/crypto CVE-2026-46597 HIGH v0.50.0 0.52.0 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted AES-GCM packet decoder inputs
golang.org/x/crypto CVE-2026-39827 MEDIUM v0.50.0 0.52.0 golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via repeated rejected channel openings
golang.org/x/crypto CVE-2026-39833 MEDIUM v0.50.0 0.52.0 golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to unenforced key confirmation
golang.org/x/crypto CVE-2026-39834 MEDIUM v0.50.0 0.52.0 golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service due to integer overflow in SSH channel write
golang.org/x/crypto CVE-2026-46598 MEDIUM v0.50.0 0.52.0 golang.org/x/crypto/ssh/agent: golang: golang.org/x/crypto/ssh/agent: Denial of Service via malformed input
golang.org/x/crypto GO-2026-5932 UNKNOWN v0.50.0 The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues
golang.org/x/net CVE-2026-25681 HIGH v0.52.0 0.55.0 golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting
golang.org/x/net CVE-2026-27136 HIGH v0.52.0 0.55.0 golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass
golang.org/x/net CVE-2026-33814 HIGH v0.52.0 0.53.0 net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame
golang.org/x/net CVE-2026-39821 HIGH v0.52.0 0.55.0 golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing
golang.org/x/net CVE-2026-46600 HIGH v0.52.0 0.56.0 golang.org/x/net/dns/dnsmessage: golang.org/x/net/dns/dnsmessage: Denial of Service via invalid DNS record parsing
golang.org/x/net CVE-2026-25680 MEDIUM v0.52.0 0.55.0 golang.org/x/net/html: golang.org/x/net/html: Denial of Service due to excessive HTML parsing
golang.org/x/net CVE-2026-42502 MEDIUM v0.52.0 0.55.0 golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via unexpected HTML tree rendering
golang.org/x/net CVE-2026-42506 MEDIUM v0.52.0 0.55.0 golang.org/x/net/html: golang.org/x/net/html: Cross-Site Scripting (XSS) via arbitrary HTML parsing
golang.org/x/sys CVE-2026-39824 UNKNOWN v0.43.0 0.44.0 Invoking integer overflow in NewNTUnicodeString in golang.org/x/sys/windows
golang.org/x/text CVE-2026-56852 HIGH v0.36.0 0.39.0 golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input
google.golang.org/grpc GHSA-hrxh-6v49-42gf HIGH v1.81.0 1.82.1 gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities

Target usr/local/bin/sda-auth

Vulnerabilities (26)

Package ID Severity Installed Version Fixed Version Title
github.com/gomarkdown/markdown CVE-2026-40890 HIGH v0.0.0-20260217112301-37c66b85d6ab 0.0.0-20260411013819-759bbc3e3207 github.com/gomarkdown/markdown: github.com/gomarkdown/markdown: Denial of Service via malformed Markdown input
golang.org/x/crypto CVE-2026-39828 HIGH v0.50.0 0.52.0 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Unauthorized command execution via discarded SSH permissions
golang.org/x/crypto CVE-2026-39829 HIGH v0.50.0 0.52.0 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters
golang.org/x/crypto CVE-2026-39830 HIGH v0.50.0 0.52.0 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses
golang.org/x/crypto CVE-2026-39831 HIGH v0.50.0 0.52.0 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Security key bypass due to missing user presence check
golang.org/x/crypto CVE-2026-39832 HIGH v0.50.0 0.52.0 golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to improper handling of key restrictions
golang.org/x/crypto CVE-2026-39835 HIGH v0.50.0 0.52.0 golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate
golang.org/x/crypto CVE-2026-42508 HIGH v0.50.0 0.52.0 golang.org/x/crypto/ssh/knownhosts: golang: golang.org/x/crypto/ssh/knownhosts: Revocation bypass via unchecked SignatureKey
golang.org/x/crypto CVE-2026-46595 HIGH v0.50.0 0.52.0 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Authorization bypass due to skipped source-address validation
golang.org/x/crypto CVE-2026-46597 HIGH v0.50.0 0.52.0 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted AES-GCM packet decoder inputs
golang.org/x/crypto CVE-2026-39827 MEDIUM v0.50.0 0.52.0 golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via repeated rejected channel openings
golang.org/x/crypto CVE-2026-39833 MEDIUM v0.50.0 0.52.0 golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to unenforced key confirmation
golang.org/x/crypto CVE-2026-39834 MEDIUM v0.50.0 0.52.0 golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service due to integer overflow in SSH channel write
golang.org/x/crypto CVE-2026-46598 MEDIUM v0.50.0 0.52.0 golang.org/x/crypto/ssh/agent: golang: golang.org/x/crypto/ssh/agent: Denial of Service via malformed input
golang.org/x/crypto GO-2026-5932 UNKNOWN v0.50.0 The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues
golang.org/x/net CVE-2026-25681 HIGH v0.52.0 0.55.0 golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting
golang.org/x/net CVE-2026-27136 HIGH v0.52.0 0.55.0 golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass
golang.org/x/net CVE-2026-33814 HIGH v0.52.0 0.53.0 net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame
golang.org/x/net CVE-2026-39821 HIGH v0.52.0 0.55.0 golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing
golang.org/x/net CVE-2026-46600 HIGH v0.52.0 0.56.0 golang.org/x/net/dns/dnsmessage: golang.org/x/net/dns/dnsmessage: Denial of Service via invalid DNS record parsing
golang.org/x/net CVE-2026-25680 MEDIUM v0.52.0 0.55.0 golang.org/x/net/html: golang.org/x/net/html: Denial of Service due to excessive HTML parsing
golang.org/x/net CVE-2026-42502 MEDIUM v0.52.0 0.55.0 golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via unexpected HTML tree rendering
golang.org/x/net CVE-2026-42506 MEDIUM v0.52.0 0.55.0 golang.org/x/net/html: golang.org/x/net/html: Cross-Site Scripting (XSS) via arbitrary HTML parsing
golang.org/x/sys CVE-2026-39824 UNKNOWN v0.43.0 0.44.0 Invoking integer overflow in NewNTUnicodeString in golang.org/x/sys/windows
golang.org/x/text CVE-2026-56852 HIGH v0.36.0 0.39.0 golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input
google.golang.org/grpc GHSA-hrxh-6v49-42gf HIGH v1.81.0 1.82.1 gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities

Target usr/local/bin/sda-download

Vulnerabilities (26)

Package ID Severity Installed Version Fixed Version Title
github.com/quic-go/quic-go CVE-2026-40898 MEDIUM v0.59.0 0.59.1 github.com/quic-go/quic-go: quic-go: Denial of Service via excessive memory allocation in HTTP/3 trailers
golang.org/x/crypto CVE-2026-39828 HIGH v0.50.0 0.52.0 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Unauthorized command execution via discarded SSH permissions
golang.org/x/crypto CVE-2026-39829 HIGH v0.50.0 0.52.0 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters
golang.org/x/crypto CVE-2026-39830 HIGH v0.50.0 0.52.0 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses
golang.org/x/crypto CVE-2026-39831 HIGH v0.50.0 0.52.0 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Security key bypass due to missing user presence check
golang.org/x/crypto CVE-2026-39832 HIGH v0.50.0 0.52.0 golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to improper handling of key restrictions
golang.org/x/crypto CVE-2026-39835 HIGH v0.50.0 0.52.0 golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate
golang.org/x/crypto CVE-2026-42508 HIGH v0.50.0 0.52.0 golang.org/x/crypto/ssh/knownhosts: golang: golang.org/x/crypto/ssh/knownhosts: Revocation bypass via unchecked SignatureKey
golang.org/x/crypto CVE-2026-46595 HIGH v0.50.0 0.52.0 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Authorization bypass due to skipped source-address validation
golang.org/x/crypto CVE-2026-46597 HIGH v0.50.0 0.52.0 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted AES-GCM packet decoder inputs
golang.org/x/crypto CVE-2026-39827 MEDIUM v0.50.0 0.52.0 golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via repeated rejected channel openings
golang.org/x/crypto CVE-2026-39833 MEDIUM v0.50.0 0.52.0 golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to unenforced key confirmation
golang.org/x/crypto CVE-2026-39834 MEDIUM v0.50.0 0.52.0 golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service due to integer overflow in SSH channel write
golang.org/x/crypto CVE-2026-46598 MEDIUM v0.50.0 0.52.0 golang.org/x/crypto/ssh/agent: golang: golang.org/x/crypto/ssh/agent: Denial of Service via malformed input
golang.org/x/crypto GO-2026-5932 UNKNOWN v0.50.0 The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues
golang.org/x/net CVE-2026-25681 HIGH v0.52.0 0.55.0 golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting
golang.org/x/net CVE-2026-27136 HIGH v0.52.0 0.55.0 golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass
golang.org/x/net CVE-2026-33814 HIGH v0.52.0 0.53.0 net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame
golang.org/x/net CVE-2026-39821 HIGH v0.52.0 0.55.0 golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing
golang.org/x/net CVE-2026-46600 HIGH v0.52.0 0.56.0 golang.org/x/net/dns/dnsmessage: golang.org/x/net/dns/dnsmessage: Denial of Service via invalid DNS record parsing
golang.org/x/net CVE-2026-25680 MEDIUM v0.52.0 0.55.0 golang.org/x/net/html: golang.org/x/net/html: Denial of Service due to excessive HTML parsing
golang.org/x/net CVE-2026-42502 MEDIUM v0.52.0 0.55.0 golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via unexpected HTML tree rendering
golang.org/x/net CVE-2026-42506 MEDIUM v0.52.0 0.55.0 golang.org/x/net/html: golang.org/x/net/html: Cross-Site Scripting (XSS) via arbitrary HTML parsing
golang.org/x/sys CVE-2026-39824 UNKNOWN v0.43.0 0.44.0 Invoking integer overflow in NewNTUnicodeString in golang.org/x/sys/windows
golang.org/x/text CVE-2026-56852 HIGH v0.36.0 0.39.0 golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input
google.golang.org/grpc GHSA-hrxh-6v49-42gf HIGH v1.81.0 1.82.1 gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities

Target usr/local/bin/sda-finalize

Vulnerabilities (17)

Package ID Severity Installed Version Fixed Version Title
golang.org/x/crypto CVE-2026-39828 HIGH v0.50.0 0.52.0 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Unauthorized command execution via discarded SSH permissions
golang.org/x/crypto CVE-2026-39829 HIGH v0.50.0 0.52.0 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters
golang.org/x/crypto CVE-2026-39830 HIGH v0.50.0 0.52.0 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses
golang.org/x/crypto CVE-2026-39831 HIGH v0.50.0 0.52.0 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Security key bypass due to missing user presence check
golang.org/x/crypto CVE-2026-39832 HIGH v0.50.0 0.52.0 golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to improper handling of key restrictions
golang.org/x/crypto CVE-2026-39835 HIGH v0.50.0 0.52.0 golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate
golang.org/x/crypto CVE-2026-42508 HIGH v0.50.0 0.52.0 golang.org/x/crypto/ssh/knownhosts: golang: golang.org/x/crypto/ssh/knownhosts: Revocation bypass via unchecked SignatureKey
golang.org/x/crypto CVE-2026-46595 HIGH v0.50.0 0.52.0 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Authorization bypass due to skipped source-address validation
golang.org/x/crypto CVE-2026-46597 HIGH v0.50.0 0.52.0 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted AES-GCM packet decoder inputs
golang.org/x/crypto CVE-2026-39827 MEDIUM v0.50.0 0.52.0 golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via repeated rejected channel openings
golang.org/x/crypto CVE-2026-39833 MEDIUM v0.50.0 0.52.0 golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to unenforced key confirmation
golang.org/x/crypto CVE-2026-39834 MEDIUM v0.50.0 0.52.0 golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service due to integer overflow in SSH channel write
golang.org/x/crypto CVE-2026-46598 MEDIUM v0.50.0 0.52.0 golang.org/x/crypto/ssh/agent: golang: golang.org/x/crypto/ssh/agent: Denial of Service via malformed input
golang.org/x/crypto GO-2026-5932 UNKNOWN v0.50.0 The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues
golang.org/x/sys CVE-2026-39824 UNKNOWN v0.43.0 0.44.0 Invoking integer overflow in NewNTUnicodeString in golang.org/x/sys/windows
golang.org/x/text CVE-2026-56852 HIGH v0.36.0 0.39.0 golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input
google.golang.org/grpc GHSA-hrxh-6v49-42gf HIGH v1.81.0 1.82.1 gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities

Target usr/local/bin/sda-ingest

Vulnerabilities (17)

Package ID Severity Installed Version Fixed Version Title
golang.org/x/crypto CVE-2026-39828 HIGH v0.50.0 0.52.0 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Unauthorized command execution via discarded SSH permissions
golang.org/x/crypto CVE-2026-39829 HIGH v0.50.0 0.52.0 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters
golang.org/x/crypto CVE-2026-39830 HIGH v0.50.0 0.52.0 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses
golang.org/x/crypto CVE-2026-39831 HIGH v0.50.0 0.52.0 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Security key bypass due to missing user presence check
golang.org/x/crypto CVE-2026-39832 HIGH v0.50.0 0.52.0 golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to improper handling of key restrictions
golang.org/x/crypto CVE-2026-39835 HIGH v0.50.0 0.52.0 golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate
golang.org/x/crypto CVE-2026-42508 HIGH v0.50.0 0.52.0 golang.org/x/crypto/ssh/knownhosts: golang: golang.org/x/crypto/ssh/knownhosts: Revocation bypass via unchecked SignatureKey
golang.org/x/crypto CVE-2026-46595 HIGH v0.50.0 0.52.0 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Authorization bypass due to skipped source-address validation
golang.org/x/crypto CVE-2026-46597 HIGH v0.50.0 0.52.0 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted AES-GCM packet decoder inputs
golang.org/x/crypto CVE-2026-39827 MEDIUM v0.50.0 0.52.0 golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via repeated rejected channel openings
golang.org/x/crypto CVE-2026-39833 MEDIUM v0.50.0 0.52.0 golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to unenforced key confirmation
golang.org/x/crypto CVE-2026-39834 MEDIUM v0.50.0 0.52.0 golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service due to integer overflow in SSH channel write
golang.org/x/crypto CVE-2026-46598 MEDIUM v0.50.0 0.52.0 golang.org/x/crypto/ssh/agent: golang: golang.org/x/crypto/ssh/agent: Denial of Service via malformed input
golang.org/x/crypto GO-2026-5932 UNKNOWN v0.50.0 The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues
golang.org/x/sys CVE-2026-39824 UNKNOWN v0.43.0 0.44.0 Invoking integer overflow in NewNTUnicodeString in golang.org/x/sys/windows
golang.org/x/text CVE-2026-56852 HIGH v0.36.0 0.39.0 golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input
google.golang.org/grpc GHSA-hrxh-6v49-42gf HIGH v1.81.0 1.82.1 gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities

Target usr/local/bin/sda-intercept

Vulnerabilities (17)

Package ID Severity Installed Version Fixed Version Title
golang.org/x/crypto CVE-2026-39828 HIGH v0.50.0 0.52.0 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Unauthorized command execution via discarded SSH permissions
golang.org/x/crypto CVE-2026-39829 HIGH v0.50.0 0.52.0 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters
golang.org/x/crypto CVE-2026-39830 HIGH v0.50.0 0.52.0 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses
golang.org/x/crypto CVE-2026-39831 HIGH v0.50.0 0.52.0 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Security key bypass due to missing user presence check
golang.org/x/crypto CVE-2026-39832 HIGH v0.50.0 0.52.0 golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to improper handling of key restrictions
golang.org/x/crypto CVE-2026-39835 HIGH v0.50.0 0.52.0 golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate
golang.org/x/crypto CVE-2026-42508 HIGH v0.50.0 0.52.0 golang.org/x/crypto/ssh/knownhosts: golang: golang.org/x/crypto/ssh/knownhosts: Revocation bypass via unchecked SignatureKey
golang.org/x/crypto CVE-2026-46595 HIGH v0.50.0 0.52.0 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Authorization bypass due to skipped source-address validation
golang.org/x/crypto CVE-2026-46597 HIGH v0.50.0 0.52.0 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted AES-GCM packet decoder inputs
golang.org/x/crypto CVE-2026-39827 MEDIUM v0.50.0 0.52.0 golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via repeated rejected channel openings
golang.org/x/crypto CVE-2026-39833 MEDIUM v0.50.0 0.52.0 golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to unenforced key confirmation
golang.org/x/crypto CVE-2026-39834 MEDIUM v0.50.0 0.52.0 golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service due to integer overflow in SSH channel write
golang.org/x/crypto CVE-2026-46598 MEDIUM v0.50.0 0.52.0 golang.org/x/crypto/ssh/agent: golang: golang.org/x/crypto/ssh/agent: Denial of Service via malformed input
golang.org/x/crypto GO-2026-5932 UNKNOWN v0.50.0 The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues
golang.org/x/sys CVE-2026-39824 UNKNOWN v0.43.0 0.44.0 Invoking integer overflow in NewNTUnicodeString in golang.org/x/sys/windows
golang.org/x/text CVE-2026-56852 HIGH v0.36.0 0.39.0 golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input
google.golang.org/grpc GHSA-hrxh-6v49-42gf HIGH v1.81.0 1.82.1 gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities

Target usr/local/bin/sda-mapper

Vulnerabilities (17)

Package ID Severity Installed Version Fixed Version Title
golang.org/x/crypto CVE-2026-39828 HIGH v0.50.0 0.52.0 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Unauthorized command execution via discarded SSH permissions
golang.org/x/crypto CVE-2026-39829 HIGH v0.50.0 0.52.0 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters
golang.org/x/crypto CVE-2026-39830 HIGH v0.50.0 0.52.0 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses
golang.org/x/crypto CVE-2026-39831 HIGH v0.50.0 0.52.0 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Security key bypass due to missing user presence check
golang.org/x/crypto CVE-2026-39832 HIGH v0.50.0 0.52.0 golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to improper handling of key restrictions
golang.org/x/crypto CVE-2026-39835 HIGH v0.50.0 0.52.0 golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate
golang.org/x/crypto CVE-2026-42508 HIGH v0.50.0 0.52.0 golang.org/x/crypto/ssh/knownhosts: golang: golang.org/x/crypto/ssh/knownhosts: Revocation bypass via unchecked SignatureKey
golang.org/x/crypto CVE-2026-46595 HIGH v0.50.0 0.52.0 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Authorization bypass due to skipped source-address validation
golang.org/x/crypto CVE-2026-46597 HIGH v0.50.0 0.52.0 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted AES-GCM packet decoder inputs
golang.org/x/crypto CVE-2026-39827 MEDIUM v0.50.0 0.52.0 golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via repeated rejected channel openings
golang.org/x/crypto CVE-2026-39833 MEDIUM v0.50.0 0.52.0 golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to unenforced key confirmation
golang.org/x/crypto CVE-2026-39834 MEDIUM v0.50.0 0.52.0 golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service due to integer overflow in SSH channel write
golang.org/x/crypto CVE-2026-46598 MEDIUM v0.50.0 0.52.0 golang.org/x/crypto/ssh/agent: golang: golang.org/x/crypto/ssh/agent: Denial of Service via malformed input
golang.org/x/crypto GO-2026-5932 UNKNOWN v0.50.0 The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues
golang.org/x/sys CVE-2026-39824 UNKNOWN v0.43.0 0.44.0 Invoking integer overflow in NewNTUnicodeString in golang.org/x/sys/windows
golang.org/x/text CVE-2026-56852 HIGH v0.36.0 0.39.0 golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input
google.golang.org/grpc GHSA-hrxh-6v49-42gf HIGH v1.81.0 1.82.1 gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities

Target usr/local/bin/sda-notify

Vulnerabilities (17)

Package ID Severity Installed Version Fixed Version Title
golang.org/x/crypto CVE-2026-39828 HIGH v0.50.0 0.52.0 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Unauthorized command execution via discarded SSH permissions
golang.org/x/crypto CVE-2026-39829 HIGH v0.50.0 0.52.0 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters
golang.org/x/crypto CVE-2026-39830 HIGH v0.50.0 0.52.0 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses
golang.org/x/crypto CVE-2026-39831 HIGH v0.50.0 0.52.0 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Security key bypass due to missing user presence check
golang.org/x/crypto CVE-2026-39832 HIGH v0.50.0 0.52.0 golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to improper handling of key restrictions
golang.org/x/crypto CVE-2026-39835 HIGH v0.50.0 0.52.0 golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate
golang.org/x/crypto CVE-2026-42508 HIGH v0.50.0 0.52.0 golang.org/x/crypto/ssh/knownhosts: golang: golang.org/x/crypto/ssh/knownhosts: Revocation bypass via unchecked SignatureKey
golang.org/x/crypto CVE-2026-46595 HIGH v0.50.0 0.52.0 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Authorization bypass due to skipped source-address validation
golang.org/x/crypto CVE-2026-46597 HIGH v0.50.0 0.52.0 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted AES-GCM packet decoder inputs
golang.org/x/crypto CVE-2026-39827 MEDIUM v0.50.0 0.52.0 golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via repeated rejected channel openings
golang.org/x/crypto CVE-2026-39833 MEDIUM v0.50.0 0.52.0 golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to unenforced key confirmation
golang.org/x/crypto CVE-2026-39834 MEDIUM v0.50.0 0.52.0 golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service due to integer overflow in SSH channel write
golang.org/x/crypto CVE-2026-46598 MEDIUM v0.50.0 0.52.0 golang.org/x/crypto/ssh/agent: golang: golang.org/x/crypto/ssh/agent: Denial of Service via malformed input
golang.org/x/crypto GO-2026-5932 UNKNOWN v0.50.0 The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues
golang.org/x/sys CVE-2026-39824 UNKNOWN v0.43.0 0.44.0 Invoking integer overflow in NewNTUnicodeString in golang.org/x/sys/windows
golang.org/x/text CVE-2026-56852 HIGH v0.36.0 0.39.0 golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input
google.golang.org/grpc GHSA-hrxh-6v49-42gf HIGH v1.81.0 1.82.1 gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities

Target usr/local/bin/sda-orchestrate

Vulnerabilities (17)

Package ID Severity Installed Version Fixed Version Title
golang.org/x/crypto CVE-2026-39828 HIGH v0.50.0 0.52.0 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Unauthorized command execution via discarded SSH permissions
golang.org/x/crypto CVE-2026-39829 HIGH v0.50.0 0.52.0 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters
golang.org/x/crypto CVE-2026-39830 HIGH v0.50.0 0.52.0 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses
golang.org/x/crypto CVE-2026-39831 HIGH v0.50.0 0.52.0 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Security key bypass due to missing user presence check
golang.org/x/crypto CVE-2026-39832 HIGH v0.50.0 0.52.0 golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to improper handling of key restrictions
golang.org/x/crypto CVE-2026-39835 HIGH v0.50.0 0.52.0 golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate
golang.org/x/crypto CVE-2026-42508 HIGH v0.50.0 0.52.0 golang.org/x/crypto/ssh/knownhosts: golang: golang.org/x/crypto/ssh/knownhosts: Revocation bypass via unchecked SignatureKey
golang.org/x/crypto CVE-2026-46595 HIGH v0.50.0 0.52.0 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Authorization bypass due to skipped source-address validation
golang.org/x/crypto CVE-2026-46597 HIGH v0.50.0 0.52.0 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted AES-GCM packet decoder inputs
golang.org/x/crypto CVE-2026-39827 MEDIUM v0.50.0 0.52.0 golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via repeated rejected channel openings
golang.org/x/crypto CVE-2026-39833 MEDIUM v0.50.0 0.52.0 golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to unenforced key confirmation
golang.org/x/crypto CVE-2026-39834 MEDIUM v0.50.0 0.52.0 golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service due to integer overflow in SSH channel write
golang.org/x/crypto CVE-2026-46598 MEDIUM v0.50.0 0.52.0 golang.org/x/crypto/ssh/agent: golang: golang.org/x/crypto/ssh/agent: Denial of Service via malformed input
golang.org/x/crypto GO-2026-5932 UNKNOWN v0.50.0 The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues
golang.org/x/sys CVE-2026-39824 UNKNOWN v0.43.0 0.44.0 Invoking integer overflow in NewNTUnicodeString in golang.org/x/sys/windows
golang.org/x/text CVE-2026-56852 HIGH v0.36.0 0.39.0 golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input
google.golang.org/grpc GHSA-hrxh-6v49-42gf HIGH v1.81.0 1.82.1 gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities

Target usr/local/bin/sda-reencrypt

Vulnerabilities (25)

Package ID Severity Installed Version Fixed Version Title
golang.org/x/crypto CVE-2026-39828 HIGH v0.50.0 0.52.0 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Unauthorized command execution via discarded SSH permissions
golang.org/x/crypto CVE-2026-39829 HIGH v0.50.0 0.52.0 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters
golang.org/x/crypto CVE-2026-39830 HIGH v0.50.0 0.52.0 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses
golang.org/x/crypto CVE-2026-39831 HIGH v0.50.0 0.52.0 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Security key bypass due to missing user presence check
golang.org/x/crypto CVE-2026-39832 HIGH v0.50.0 0.52.0 golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to improper handling of key restrictions
golang.org/x/crypto CVE-2026-39835 HIGH v0.50.0 0.52.0 golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate
golang.org/x/crypto CVE-2026-42508 HIGH v0.50.0 0.52.0 golang.org/x/crypto/ssh/knownhosts: golang: golang.org/x/crypto/ssh/knownhosts: Revocation bypass via unchecked SignatureKey
golang.org/x/crypto CVE-2026-46595 HIGH v0.50.0 0.52.0 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Authorization bypass due to skipped source-address validation
golang.org/x/crypto CVE-2026-46597 HIGH v0.50.0 0.52.0 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted AES-GCM packet decoder inputs
golang.org/x/crypto CVE-2026-39827 MEDIUM v0.50.0 0.52.0 golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via repeated rejected channel openings
golang.org/x/crypto CVE-2026-39833 MEDIUM v0.50.0 0.52.0 golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to unenforced key confirmation
golang.org/x/crypto CVE-2026-39834 MEDIUM v0.50.0 0.52.0 golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service due to integer overflow in SSH channel write
golang.org/x/crypto CVE-2026-46598 MEDIUM v0.50.0 0.52.0 golang.org/x/crypto/ssh/agent: golang: golang.org/x/crypto/ssh/agent: Denial of Service via malformed input
golang.org/x/crypto GO-2026-5932 UNKNOWN v0.50.0 The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues
golang.org/x/net CVE-2026-25681 HIGH v0.52.0 0.55.0 golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting
golang.org/x/net CVE-2026-27136 HIGH v0.52.0 0.55.0 golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass
golang.org/x/net CVE-2026-33814 HIGH v0.52.0 0.53.0 net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame
golang.org/x/net CVE-2026-39821 HIGH v0.52.0 0.55.0 golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing
golang.org/x/net CVE-2026-46600 HIGH v0.52.0 0.56.0 golang.org/x/net/dns/dnsmessage: golang.org/x/net/dns/dnsmessage: Denial of Service via invalid DNS record parsing
golang.org/x/net CVE-2026-25680 MEDIUM v0.52.0 0.55.0 golang.org/x/net/html: golang.org/x/net/html: Denial of Service due to excessive HTML parsing
golang.org/x/net CVE-2026-42502 MEDIUM v0.52.0 0.55.0 golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via unexpected HTML tree rendering
golang.org/x/net CVE-2026-42506 MEDIUM v0.52.0 0.55.0 golang.org/x/net/html: golang.org/x/net/html: Cross-Site Scripting (XSS) via arbitrary HTML parsing
golang.org/x/sys CVE-2026-39824 UNKNOWN v0.43.0 0.44.0 Invoking integer overflow in NewNTUnicodeString in golang.org/x/sys/windows
golang.org/x/text CVE-2026-56852 HIGH v0.36.0 0.39.0 golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input
google.golang.org/grpc GHSA-hrxh-6v49-42gf HIGH v1.81.0 1.82.1 gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities

Target usr/local/bin/sda-rotatekey

Vulnerabilities (25)

Package ID Severity Installed Version Fixed Version Title
golang.org/x/crypto CVE-2026-39828 HIGH v0.50.0 0.52.0 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Unauthorized command execution via discarded SSH permissions
golang.org/x/crypto CVE-2026-39829 HIGH v0.50.0 0.52.0 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters
golang.org/x/crypto CVE-2026-39830 HIGH v0.50.0 0.52.0 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses
golang.org/x/crypto CVE-2026-39831 HIGH v0.50.0 0.52.0 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Security key bypass due to missing user presence check
golang.org/x/crypto CVE-2026-39832 HIGH v0.50.0 0.52.0 golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to improper handling of key restrictions
golang.org/x/crypto CVE-2026-39835 HIGH v0.50.0 0.52.0 golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate
golang.org/x/crypto CVE-2026-42508 HIGH v0.50.0 0.52.0 golang.org/x/crypto/ssh/knownhosts: golang: golang.org/x/crypto/ssh/knownhosts: Revocation bypass via unchecked SignatureKey
golang.org/x/crypto CVE-2026-46595 HIGH v0.50.0 0.52.0 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Authorization bypass due to skipped source-address validation
golang.org/x/crypto CVE-2026-46597 HIGH v0.50.0 0.52.0 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted AES-GCM packet decoder inputs
golang.org/x/crypto CVE-2026-39827 MEDIUM v0.50.0 0.52.0 golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via repeated rejected channel openings
golang.org/x/crypto CVE-2026-39833 MEDIUM v0.50.0 0.52.0 golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to unenforced key confirmation
golang.org/x/crypto CVE-2026-39834 MEDIUM v0.50.0 0.52.0 golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service due to integer overflow in SSH channel write
golang.org/x/crypto CVE-2026-46598 MEDIUM v0.50.0 0.52.0 golang.org/x/crypto/ssh/agent: golang: golang.org/x/crypto/ssh/agent: Denial of Service via malformed input
golang.org/x/crypto GO-2026-5932 UNKNOWN v0.50.0 The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues
golang.org/x/net CVE-2026-25681 HIGH v0.52.0 0.55.0 golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting
golang.org/x/net CVE-2026-27136 HIGH v0.52.0 0.55.0 golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass
golang.org/x/net CVE-2026-33814 HIGH v0.52.0 0.53.0 net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame
golang.org/x/net CVE-2026-39821 HIGH v0.52.0 0.55.0 golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing
golang.org/x/net CVE-2026-46600 HIGH v0.52.0 0.56.0 golang.org/x/net/dns/dnsmessage: golang.org/x/net/dns/dnsmessage: Denial of Service via invalid DNS record parsing
golang.org/x/net CVE-2026-25680 MEDIUM v0.52.0 0.55.0 golang.org/x/net/html: golang.org/x/net/html: Denial of Service due to excessive HTML parsing
golang.org/x/net CVE-2026-42502 MEDIUM v0.52.0 0.55.0 golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via unexpected HTML tree rendering
golang.org/x/net CVE-2026-42506 MEDIUM v0.52.0 0.55.0 golang.org/x/net/html: golang.org/x/net/html: Cross-Site Scripting (XSS) via arbitrary HTML parsing
golang.org/x/sys CVE-2026-39824 UNKNOWN v0.43.0 0.44.0 Invoking integer overflow in NewNTUnicodeString in golang.org/x/sys/windows
golang.org/x/text CVE-2026-56852 HIGH v0.36.0 0.39.0 golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input
google.golang.org/grpc GHSA-hrxh-6v49-42gf HIGH v1.81.0 1.82.1 gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities

Target usr/local/bin/sda-s3inbox

Vulnerabilities (17)

Package ID Severity Installed Version Fixed Version Title
golang.org/x/crypto CVE-2026-39828 HIGH v0.50.0 0.52.0 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Unauthorized command execution via discarded SSH permissions
golang.org/x/crypto CVE-2026-39829 HIGH v0.50.0 0.52.0 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters
golang.org/x/crypto CVE-2026-39830 HIGH v0.50.0 0.52.0 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses
golang.org/x/crypto CVE-2026-39831 HIGH v0.50.0 0.52.0 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Security key bypass due to missing user presence check
golang.org/x/crypto CVE-2026-39832 HIGH v0.50.0 0.52.0 golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to improper handling of key restrictions
golang.org/x/crypto CVE-2026-39835 HIGH v0.50.0 0.52.0 golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate
golang.org/x/crypto CVE-2026-42508 HIGH v0.50.0 0.52.0 golang.org/x/crypto/ssh/knownhosts: golang: golang.org/x/crypto/ssh/knownhosts: Revocation bypass via unchecked SignatureKey
golang.org/x/crypto CVE-2026-46595 HIGH v0.50.0 0.52.0 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Authorization bypass due to skipped source-address validation
golang.org/x/crypto CVE-2026-46597 HIGH v0.50.0 0.52.0 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted AES-GCM packet decoder inputs
golang.org/x/crypto CVE-2026-39827 MEDIUM v0.50.0 0.52.0 golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via repeated rejected channel openings
golang.org/x/crypto CVE-2026-39833 MEDIUM v0.50.0 0.52.0 golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to unenforced key confirmation
golang.org/x/crypto CVE-2026-39834 MEDIUM v0.50.0 0.52.0 golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service due to integer overflow in SSH channel write
golang.org/x/crypto CVE-2026-46598 MEDIUM v0.50.0 0.52.0 golang.org/x/crypto/ssh/agent: golang: golang.org/x/crypto/ssh/agent: Denial of Service via malformed input
golang.org/x/crypto GO-2026-5932 UNKNOWN v0.50.0 The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues
golang.org/x/sys CVE-2026-39824 UNKNOWN v0.43.0 0.44.0 Invoking integer overflow in NewNTUnicodeString in golang.org/x/sys/windows
golang.org/x/text CVE-2026-56852 HIGH v0.36.0 0.39.0 golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input
google.golang.org/grpc GHSA-hrxh-6v49-42gf HIGH v1.81.0 1.82.1 gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities

Target usr/local/bin/sda-sync

Vulnerabilities (17)

Package ID Severity Installed Version Fixed Version Title
golang.org/x/crypto CVE-2026-39828 HIGH v0.50.0 0.52.0 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Unauthorized command execution via discarded SSH permissions
golang.org/x/crypto CVE-2026-39829 HIGH v0.50.0 0.52.0 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters
golang.org/x/crypto CVE-2026-39830 HIGH v0.50.0 0.52.0 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses
golang.org/x/crypto CVE-2026-39831 HIGH v0.50.0 0.52.0 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Security key bypass due to missing user presence check
golang.org/x/crypto CVE-2026-39832 HIGH v0.50.0 0.52.0 golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to improper handling of key restrictions
golang.org/x/crypto CVE-2026-39835 HIGH v0.50.0 0.52.0 golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate
golang.org/x/crypto CVE-2026-42508 HIGH v0.50.0 0.52.0 golang.org/x/crypto/ssh/knownhosts: golang: golang.org/x/crypto/ssh/knownhosts: Revocation bypass via unchecked SignatureKey
golang.org/x/crypto CVE-2026-46595 HIGH v0.50.0 0.52.0 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Authorization bypass due to skipped source-address validation
golang.org/x/crypto CVE-2026-46597 HIGH v0.50.0 0.52.0 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted AES-GCM packet decoder inputs
golang.org/x/crypto CVE-2026-39827 MEDIUM v0.50.0 0.52.0 golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via repeated rejected channel openings
golang.org/x/crypto CVE-2026-39833 MEDIUM v0.50.0 0.52.0 golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to unenforced key confirmation
golang.org/x/crypto CVE-2026-39834 MEDIUM v0.50.0 0.52.0 golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service due to integer overflow in SSH channel write
golang.org/x/crypto CVE-2026-46598 MEDIUM v0.50.0 0.52.0 golang.org/x/crypto/ssh/agent: golang: golang.org/x/crypto/ssh/agent: Denial of Service via malformed input
golang.org/x/crypto GO-2026-5932 UNKNOWN v0.50.0 The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues
golang.org/x/sys CVE-2026-39824 UNKNOWN v0.43.0 0.44.0 Invoking integer overflow in NewNTUnicodeString in golang.org/x/sys/windows
golang.org/x/text CVE-2026-56852 HIGH v0.36.0 0.39.0 golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input
google.golang.org/grpc GHSA-hrxh-6v49-42gf HIGH v1.81.0 1.82.1 gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities

Target usr/local/bin/sda-syncapi

Vulnerabilities (17)

Package ID Severity Installed Version Fixed Version Title
golang.org/x/crypto CVE-2026-39828 HIGH v0.50.0 0.52.0 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Unauthorized command execution via discarded SSH permissions
golang.org/x/crypto CVE-2026-39829 HIGH v0.50.0 0.52.0 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters
golang.org/x/crypto CVE-2026-39830 HIGH v0.50.0 0.52.0 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses
golang.org/x/crypto CVE-2026-39831 HIGH v0.50.0 0.52.0 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Security key bypass due to missing user presence check
golang.org/x/crypto CVE-2026-39832 HIGH v0.50.0 0.52.0 golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to improper handling of key restrictions
golang.org/x/crypto CVE-2026-39835 HIGH v0.50.0 0.52.0 golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate
golang.org/x/crypto CVE-2026-42508 HIGH v0.50.0 0.52.0 golang.org/x/crypto/ssh/knownhosts: golang: golang.org/x/crypto/ssh/knownhosts: Revocation bypass via unchecked SignatureKey
golang.org/x/crypto CVE-2026-46595 HIGH v0.50.0 0.52.0 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Authorization bypass due to skipped source-address validation
golang.org/x/crypto CVE-2026-46597 HIGH v0.50.0 0.52.0 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted AES-GCM packet decoder inputs
golang.org/x/crypto CVE-2026-39827 MEDIUM v0.50.0 0.52.0 golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via repeated rejected channel openings
golang.org/x/crypto CVE-2026-39833 MEDIUM v0.50.0 0.52.0 golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to unenforced key confirmation
golang.org/x/crypto CVE-2026-39834 MEDIUM v0.50.0 0.52.0 golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service due to integer overflow in SSH channel write
golang.org/x/crypto CVE-2026-46598 MEDIUM v0.50.0 0.52.0 golang.org/x/crypto/ssh/agent: golang: golang.org/x/crypto/ssh/agent: Denial of Service via malformed input
golang.org/x/crypto GO-2026-5932 UNKNOWN v0.50.0 The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues
golang.org/x/sys CVE-2026-39824 UNKNOWN v0.43.0 0.44.0 Invoking integer overflow in NewNTUnicodeString in golang.org/x/sys/windows
golang.org/x/text CVE-2026-56852 HIGH v0.36.0 0.39.0 golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input
google.golang.org/grpc GHSA-hrxh-6v49-42gf HIGH v1.81.0 1.82.1 gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities

Target usr/local/bin/sda-verify

Vulnerabilities (17)

Package ID Severity Installed Version Fixed Version Title
golang.org/x/crypto CVE-2026-39828 HIGH v0.50.0 0.52.0 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Unauthorized command execution via discarded SSH permissions
golang.org/x/crypto CVE-2026-39829 HIGH v0.50.0 0.52.0 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters
golang.org/x/crypto CVE-2026-39830 HIGH v0.50.0 0.52.0 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses
golang.org/x/crypto CVE-2026-39831 HIGH v0.50.0 0.52.0 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Security key bypass due to missing user presence check
golang.org/x/crypto CVE-2026-39832 HIGH v0.50.0 0.52.0 golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to improper handling of key restrictions
golang.org/x/crypto CVE-2026-39835 HIGH v0.50.0 0.52.0 golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate
golang.org/x/crypto CVE-2026-42508 HIGH v0.50.0 0.52.0 golang.org/x/crypto/ssh/knownhosts: golang: golang.org/x/crypto/ssh/knownhosts: Revocation bypass via unchecked SignatureKey
golang.org/x/crypto CVE-2026-46595 HIGH v0.50.0 0.52.0 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Authorization bypass due to skipped source-address validation
golang.org/x/crypto CVE-2026-46597 HIGH v0.50.0 0.52.0 golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted AES-GCM packet decoder inputs
golang.org/x/crypto CVE-2026-39827 MEDIUM v0.50.0 0.52.0 golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via repeated rejected channel openings
golang.org/x/crypto CVE-2026-39833 MEDIUM v0.50.0 0.52.0 golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to unenforced key confirmation
golang.org/x/crypto CVE-2026-39834 MEDIUM v0.50.0 0.52.0 golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service due to integer overflow in SSH channel write
golang.org/x/crypto CVE-2026-46598 MEDIUM v0.50.0 0.52.0 golang.org/x/crypto/ssh/agent: golang: golang.org/x/crypto/ssh/agent: Denial of Service via malformed input
golang.org/x/crypto GO-2026-5932 UNKNOWN v0.50.0 The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues
golang.org/x/sys CVE-2026-39824 UNKNOWN v0.43.0 0.44.0 Invoking integer overflow in NewNTUnicodeString in golang.org/x/sys/windows
golang.org/x/text CVE-2026-56852 HIGH v0.36.0 0.39.0 golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input
google.golang.org/grpc GHSA-hrxh-6v49-42gf HIGH v1.81.0 1.82.1 gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities

@kkochel
kkochel merged commit 904c8db into main Aug 18, 2026
90 of 104 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@kkochel