Skip to content

[release-1.34] fix: CVE-2026-25680 - #3676

Merged
andyzhangx merged 1 commit into
kubernetes-sigs:release-1.34from
andyzhangx:CVE-2026-25680-1.34
Jun 23, 2026
Merged

[release-1.34] fix: CVE-2026-25680#3676
andyzhangx merged 1 commit into
kubernetes-sigs:release-1.34from
andyzhangx:CVE-2026-25680-1.34

Conversation

@andyzhangx

@andyzhangx andyzhangx commented Jun 23, 2026

Copy link
Copy Markdown
Member

What type of PR is this?
/kind bug

What this PR does / why we need it:
fix: CVE-2026-25680

cherrypick of #3675

blobfuse-proxy/blobfuse-proxy (gobinary)
========================================
Total: 20 (UNKNOWN: 1, MEDIUM: 5, HIGH: 14, CRITICAL: 0)

┌─────────────────────┬────────────────┬──────────┬────────┬───────────────────┬───────────────┬──────────────────────────────────────────────────────────────┐
│       Library       │ Vulnerability  │ Severity │ Status │ Installed Version │ Fixed Version │                            Title                             │
├─────────────────────┼────────────────┼──────────┼────────┼───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ golang.org/x/crypto │ CVE-2026-39827 │ HIGH     │ fixed  │ v0.50.0           │ 0.52.0        │ An authenticated SSH client that repeatedly opened channels  │
│                     │                │          │        │                   │               │ which were ...                                               │
│                     │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-39827                   │
│                     ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│                     │ CVE-2026-39828 │          │        │                   │               │ golang.org/x/crypto/ssh: golang.org/x/crypto/ssh:            │
│                     │                │          │        │                   │               │ Unauthorized command execution via discarded SSH permissions │
│                     │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-39828                   │
│                     ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│                     │ CVE-2026-39829 │          │        │                   │               │ golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of  │
│                     │                │          │        │                   │               │ Service via crafted public key with excessive parameters...  │
│                     │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-39829                   │
│                     ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│                     │ CVE-2026-39830 │          │        │                   │               │ golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of  │
│                     │                │          │        │                   │               │ Service via resource leak from unsolicited SSH responses...  │
│                     │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-39830                   │
│                     ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│                     │ CVE-2026-39835 │          │        │                   │               │ SSH servers which use CertChecker as a public key callback   │
│                     │                │          │        │                   │               │ without set...                                               │
│                     │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-39835                   │
│                     ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│                     │ CVE-2026-42508 │          │        │                   │               │ golang.org/x/crypto/ssh/knownhosts: golang:                  │
│                     │                │          │        │                   │               │ golang.org/x/crypto/ssh/knownhosts: Revocation bypass via    │
│                     │                │          │        │                   │               │ unchecked SignatureKey                                       │
│                     │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-42508                   │
│                     ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│                     │ CVE-2026-46595 │          │        │                   │               │ golang.org/x/crypto/ssh: golang.org/x/crypto/ssh:            │
│                     │                │          │        │                   │               │ Authorization bypass due to skipped source-address           │
│                     │                │          │        │                   │               │ validation                                                   │
│                     │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-46595                   │
│                     ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│                     │ CVE-2026-46597 │          │        │                   │               │ An incorrectly placed cast from bytes to int allowed for     │
│                     │                │          │        │                   │               │ server-side p...                                             │
│                     │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-46597                   │
│                     ├────────────────┼──────────┤        │                   │               ├──────────────────────────────────────────────────────────────┤
│                     │ CVE-2026-39831 │ MEDIUM   │        │                   │               │ The Verify() method for FIDO/U2F security key types          │
│                     │                │          │        │                   │               │ (sk-ecdsa-sha2-nis ...                                       │
│                     │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-39831                   │
│                     ��────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│                     │ CVE-2026-39832 │          │        │                   │               │ When adding a key to a remote agent constraint extensions    │
│                     │                │          │        │                   │               │ such as...                                                   │
│                     │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-39832                   │
│                     ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│                     │ CVE-2026-39833 │          │        │                   │               │ The in-memory keyring returned by NewKeyring() silently      │
│                     │                │          │        │                   │               │ accepted keys ...                                            │
│                     │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-39833                   │
│                     ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│                     │ CVE-2026-39834 │          │        │                   │               │ When writing data larger than 4GB in a single Write call     │
│                     │                │          │        │                   │               │ on...                                                        │
│                     │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-39834                   │
│                     ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│                     │ CVE-2026-46598 │          │        │                   │               │ golang.org/x/crypto/ssh/agent: golang:                       │
│                     │                │          │        │                   │               │ golang.org/x/crypto/ssh/agent: Denial of Service via         │
│                     │                │          │        │                   │               │ malformed input                                              │
│                     │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-46598                   │
├─────────────────────┼────────────────┼──────────┤        ├───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤

📣 Notices:
  - Version 0.71.2 of Trivy is now available, current version is 0.70.0

To suppress version checks, run Trivy scans with the --skip-version-check flag

│ golang.org/x/net    │ CVE-2026-25680 │ HIGH     │        │ v0.53.0           │ 0.55.0        │ Parsing arbitrary HTML can consume excessive CPU time,       │
│                     │                │          │        │                   │               │ possibly leadin ...                                          │
│                     │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-25680                   │
│                     ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│                     │ CVE-2026-25681 │          │        │                   │               │ Parsing arbitrary HTML which is then rendered using Render   │
│                     │                │          │        │                   │               │ can result ...                                               │
│                     │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-25681                   │
│                     ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│                     │ CVE-2026-27136 │          │        │                   │               │ Parsing arbitrary HTML which is then rendered using Render   │
│                     │                │          │        │                   │               │ can result ...                                               │
│                     │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-27136                   │
│                     ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│                     │ CVE-2026-39821 │          │        │                   │               │ golang.org/x/net/idna: golang: golang.org/x/net/idna:        │
│                     │                │          │        │                   │               │ Privilege escalation via incorrect Punycode label processing │
│                     │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-39821                   │
│                     ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│                     │ CVE-2026-42502 │          │        │                   │               │ Parsing arbitrary HTML which is then rendered using Render   │
│                     │                │          │        │                   │               │ can result ...                                               │
│                     │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-42502                   │
│                     ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│                     │ CVE-2026-42506 │          │        │                   │               │ Parsing arbitrary HTML which is then rendered using Render   │
│                     │                │          │        │                   │               │ can result ...                                               │
│                     │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-42506                   │
├─────────────────────┼────────────────┼──────────┤        ├───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ golang.org/x/sys    │ CVE-2026-39824 │ UNKNOWN  │        │ v0.43.0           │ 0.44.0        │ Invoking integer overflow in NewNTUnicodeString in           │
│                     │                │          │        │                   │               │ golang.org/x/sys/windows                                     │
│                     │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-39824                   │
└─────────────────────┴────────────────┴──────────┴────────┴───────────────────┴───────────────┴──────────────────────────────────────────────────────────────┘

blobplugin (gobinary)
=====================
Total: 20 (UNKNOWN: 1, MEDIUM: 5, HIGH: 14, CRITICAL: 0)

┌─────────────────────┬────────────────┬──────────┬────────┬───────────────────┬───────────────┬──────────────────────────────────────────────────────────────┐
│       Library       │ Vulnerability  │ Severity │ Status │ Installed Version │ Fixed Version │                            Title                             │
├─────────────────────┼────────────────┼──────────┼────────┼───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ golang.org/x/crypto │ CVE-2026-39827 │ HIGH     │ fixed  │ v0.50.0           │ 0.52.0        │ An authenticated SSH client that repeatedly opened channels  │
│                     │                │          │        │                   │               │ which were ...                                               │
│                     │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-39827                   │
│                     ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│                     │ CVE-2026-39828 │          │        │                   │               │ golang.org/x/crypto/ssh: golang.org/x/crypto/ssh:            │
│                     │                │          │        │                   │               │ Unauthorized command execution via discarded SSH permissions │
│                     │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-39828                   │
│                     ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│                     │ CVE-2026-39829 │          │        │                   │               │ golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of  │
│                     │                │          │        │                   │               │ Service via crafted public key with excessive parameters...  │
│                     │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-39829                   │
│                     ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│                     │ CVE-2026-39830 │          │        │                   │               │ golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of  │
│                     │                │          │        │                   │               │ Service via resource leak from unsolicited SSH responses...  │
│                     │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-39830                   │
│                     ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│                     │ CVE-2026-39835 │          │        │                   │               │ SSH servers which use CertChecker as a public key callback   │
│                     │                │          │        │                   │               │ without set...                                               │
│                     │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-39835                   │
│                     ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│                     │ CVE-2026-42508 │          │        │                   │               │ golang.org/x/crypto/ssh/knownhosts: golang:                  │
│                     │                │          │        │                   │               │ golang.org/x/crypto/ssh/knownhosts: Revocation bypass via    │
│                     │                │          │        │                   │               │ unchecked SignatureKey                                       │
│                     │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-42508                   │
│                     ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│                     │ CVE-2026-46595 │          │        │                   │               │ golang.org/x/crypto/ssh: golang.org/x/crypto/ssh:            │
│                     │                │          │        │                   │               │ Authorization bypass due to skipped source-address           │
│                     │                │          │        │                   │               │ validation                                                   │
│                     │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-46595                   │
│                     ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│                     │ CVE-2026-46597 │          │        │                   │               │ An incorrectly placed cast from bytes to int allowed for     │
│                     │                │          │        │                   │               │ server-side p...                                             │
│                     │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-46597                   │
│                     ├────────────────┼──────────┤        │                   │               ├──────────────────────────────────────────────────────────────┤
│                     │ CVE-2026-39831 │ MEDIUM   │        │                   │               │ The Verify() method for FIDO/U2F security key types          │
│                     │                │          │        │                   │               │ (sk-ecdsa-sha2-nis ...                                       │
│                     │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-39831                   │
│                     ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│                     │ CVE-2026-39832 │          │        │                   │               │ When adding a key to a remote agent constraint extensions    │
│                     │                │          │        │                   │               │ such as...                                                   │
│                     │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-39832                   │
│                     ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│                     │ CVE-2026-39833 │          │        │                   │               │ The in-memory keyring returned by NewKeyring() silently      │
│                     │                │          │        │                   │               │ accepted keys ...                                            │
│                     │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-39833                   │
│                     ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│                     │ CVE-2026-39834 │          │        │                   │               │ When writing data larger than 4GB in a single Write call     │
│                     │                │          │        │                   │               │ on...                                                        │
│                     │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-39834                   │
│                     ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│                     │ CVE-2026-46598 │          │        │                   │               │ golang.org/x/crypto/ssh/agent: golang:                       │
│                     │                │          │        │                   │               │ golang.org/x/crypto/ssh/agent: Denial of Service via         │
│                     │                │          │        │                   │               │ malformed input                                              │
│                     │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-46598                   │
├─────────────────────┼────────────────┼──────────┤        ├───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ golang.org/x/net    │ CVE-2026-25680 │ HIGH     │        │ v0.53.0           │ 0.55.0        │ Parsing arbitrary HTML can consume excessive CPU time,       │
│                     │                │          │        │                   │               │ possibly leadin ...                                          │
│                     │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-25680                   │
│                     ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│                     │ CVE-2026-25681 │          │        │                   │               │ Parsing arbitrary HTML which is then rendered using Render   │
│                     │                │          │        │                   │               │ can result ...                                               │
│                     │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-25681                   │
│                     ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│                     │ CVE-2026-27136 │          │        │                   │               │ Parsing arbitrary HTML which is then rendered using Render   │
│                     │                │          │        │                   │               │ can result ...                                               │
│                     │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-27136                   │
│                     ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│                     │ CVE-2026-39821 │          │        │                   │               │ golang.org/x/net/idna: golang: golang.org/x/net/idna:        │
│                     │                │          │        │                   │               │ Privilege escalation via incorrect Punycode label processing │
│                     │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-39821                   │
│                     ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│                     │ CVE-2026-42502 │          │        │                   │               │ Parsing arbitrary HTML which is then rendered using Render   │
│                     │                │          │        │                   │               │ can result ...                                               │
│                     │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-42502                   │
│                     ├────────────────┤          │        │                   │               ├──────────────────────────────────────────────────────────────┤
│                     │ CVE-2026-42506 │          │        │                   │               │ Parsing arbitrary HTML which is then rendered using Render   │
│                     │                │          │        │                   │               │ can result ...                                               │
│                     │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-42506                   │
├─────────────────────┼────────────────┼──────────┤        ├───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ golang.org/x/sys    │ CVE-2026-39824 │ UNKNOWN  │        │ v0.43.0           │ 0.44.0        │ Invoking integer overflow in NewNTUnicodeString in           │
│                     │                │          │        │                   │               │ golang.org/x/sys/windows                                     │
│                     │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-39824                   │
└─────────────────────┴────────────────┴──────────┴────────┴───────────────────┴───────────────┴──────────────────────────────────────────────────────────────┘

Which issue(s) this PR fixes:

Fixes #

Requirements:

Special notes for your reviewer:

Release note:

none

@kubernetes-prow kubernetes-prow Bot added kind/bug Categorizes issue or PR as related to a bug. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files. labels Jun 23, 2026
@kubernetes-prow

kubernetes-prow Bot commented Jun 23, 2026

Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: andyzhangx

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@kubernetes-prow kubernetes-prow Bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jun 23, 2026
@kubernetes-prow

kubernetes-prow Bot commented Jun 23, 2026

Copy link
Copy Markdown
Contributor

@andyzhangx: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
pull-azuredisk-csi-driver-e2e-capz-windows-2019-hostprocess 47746bd link true /test pull-azuredisk-csi-driver-e2e-capz-windows-2019-hostprocess
pull-azuredisk-csi-driver-e2e-capz-windows-2022-hostprocess 47746bd link true /test pull-azuredisk-csi-driver-e2e-capz-windows-2022-hostprocess

Full PR test history. Your PR dashboard. Please help us cut down on flakes by linking to an open issue when you hit one in your PR.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

@andyzhangx
andyzhangx merged commit 6edfca8 into kubernetes-sigs:release-1.34 Jun 23, 2026
20 of 23 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@landreasyan landreasyan Awaiting requested review from landreasyan
@nearora-msft nearora-msft Awaiting requested review from nearora-msft

Assignees

No one assigned

Labels

approved Indicates a PR has been approved by an approver from all required OWNERS files. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. kind/bug Categorizes issue or PR as related to a bug. size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@andyzhangx