Skip to content

OCPBUGS-79763: Replace google.golang.org/grpc #401

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
rh-akhatavk wants to merge 3 commits into
base: release-4.12
Choose a base branch
from
Open

OCPBUGS-79763: Replace google.golang.org/grpc #401

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
1ac57bc
Replace google.golang.org/grpc with fork to address CVE-2026-33186
rh-akhatavk May 28, 2026
2d64285
vendor changes
rh-akhatavk May 28, 2026
06ec1e3
Fixed go.opentelemetry.io/proto/otlp to v0.7.0
rh-akhatavk May 28, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
The table of contents is too big for display.
Diff view
Diff view
  •  
  •  
  •  
80 changes: 50 additions & 30 deletions go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,12 +19,12 @@ require (
github.com/spf13/cobra v1.4.0
github.com/spf13/pflag v1.0.5
github.com/spf13/viper v1.12.0
github.com/stretchr/testify v1.8.0
golang.org/x/net v0.17.0
golang.org/x/sys v0.13.0
golang.org/x/term v0.13.0
google.golang.org/grpc v1.48.0
google.golang.org/protobuf v1.28.0
github.com/stretchr/testify v1.8.4
golang.org/x/net v0.26.0
golang.org/x/sys v0.21.0
golang.org/x/term v0.21.0
google.golang.org/grpc v1.62.1
google.golang.org/protobuf v1.33.0
gopkg.in/gcfg.v1 v1.2.3
gopkg.in/godo.v2 v2.0.9
gopkg.in/yaml.v2 v2.4.0
Expand All @@ -50,26 +50,26 @@ require (
github.com/aws/aws-sdk-go v1.38.49 // indirect
github.com/beorn7/perks v1.0.1 // indirect
github.com/blang/semver/v4 v4.0.0 // indirect
github.com/cespare/xxhash/v2 v2.1.2 // indirect
github.com/cespare/xxhash/v2 v2.2.0 // indirect
github.com/coreos/go-semver v0.3.0 // indirect
github.com/coreos/go-systemd/v22 v22.3.2 // indirect
github.com/davecgh/go-spew v1.1.1 // indirect
github.com/docker/distribution v2.8.1+incompatible // indirect
github.com/emicklei/go-restful/v3 v3.8.0 // indirect
github.com/evanphx/json-patch v4.12.0+incompatible // indirect
github.com/felixge/httpsnoop v1.0.1 // indirect
github.com/felixge/httpsnoop v1.0.4 // indirect
github.com/fsnotify/fsnotify v1.5.4 // indirect
github.com/go-logr/logr v1.2.3 // indirect
github.com/go-logr/logr v1.4.1 // indirect
github.com/go-openapi/jsonpointer v0.19.5 // indirect
github.com/go-openapi/jsonreference v0.19.5 // indirect
github.com/go-openapi/swag v0.19.14 // indirect
github.com/gogo/protobuf v1.3.2 // indirect
github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
github.com/golang/protobuf v1.5.2 // indirect
github.com/golang/protobuf v1.5.4 // indirect
github.com/google/gnostic v0.5.7-v3refs // indirect
github.com/google/go-cmp v0.5.8 // indirect
github.com/google/go-cmp v0.6.0 // indirect
github.com/google/gofuzz v1.1.0 // indirect
github.com/google/uuid v1.3.0 // indirect
github.com/google/uuid v1.6.0 // indirect
github.com/grpc-ecosystem/go-grpc-prometheus v1.2.0 // indirect
github.com/grpc-ecosystem/grpc-gateway v1.16.0 // indirect
github.com/hashicorp/hcl v1.0.0 // indirect
Expand All @@ -95,38 +95,40 @@ require (
github.com/pkg/errors v0.9.1 // indirect
github.com/pmezard/go-difflib v1.0.0 // indirect
github.com/prometheus/client_golang v1.12.1 // indirect
github.com/prometheus/client_model v0.2.0 // indirect
github.com/prometheus/client_model v0.5.0 // indirect
github.com/prometheus/common v0.32.1 // indirect
github.com/prometheus/procfs v0.7.3 // indirect
github.com/spf13/afero v1.8.2 // indirect
github.com/spf13/afero v1.10.0 // indirect
github.com/spf13/cast v1.5.0 // indirect
github.com/spf13/jwalterweatherman v1.1.0 // indirect
github.com/stretchr/objx v0.4.0 // indirect
github.com/stretchr/objx v0.5.0 // indirect
github.com/subosito/gotenv v1.3.0 // indirect
go.etcd.io/etcd/api/v3 v3.5.4 // indirect
go.etcd.io/etcd/client/pkg/v3 v3.5.4 // indirect
go.etcd.io/etcd/client/v3 v3.5.4 // indirect
go.opentelemetry.io/contrib v0.20.0 // indirect
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.20.0 // indirect
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.20.0 // indirect
go.opentelemetry.io/otel v0.20.0 // indirect
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.49.0 // indirect
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.49.0 // indirect
go.opentelemetry.io/otel v1.24.0 // indirect
go.opentelemetry.io/otel/exporters/otlp v0.20.0 // indirect
go.opentelemetry.io/otel/metric v0.20.0 // indirect
go.opentelemetry.io/otel/sdk v0.20.0 // indirect
go.opentelemetry.io/otel/metric v1.24.0 // indirect
go.opentelemetry.io/otel/sdk v1.22.0 // indirect
go.opentelemetry.io/otel/sdk/export/metric v0.20.0 // indirect
go.opentelemetry.io/otel/sdk/metric v0.20.0 // indirect
go.opentelemetry.io/otel/trace v0.20.0 // indirect
go.opentelemetry.io/proto/otlp v0.7.0 // indirect
go.opentelemetry.io/otel/trace v1.24.0 // indirect
go.opentelemetry.io/proto/otlp v1.0.0 // indirect
go.uber.org/atomic v1.7.0 // indirect
go.uber.org/multierr v1.6.0 // indirect
go.uber.org/zap v1.19.0 // indirect
golang.org/x/crypto v0.14.0 // indirect
golang.org/x/oauth2 v0.0.0-20220411215720-9780585627b5 // indirect
golang.org/x/sync v0.1.0 // indirect
golang.org/x/text v0.13.0 // indirect
golang.org/x/time v0.0.0-20220210224613-90d013bbcef8 // indirect
google.golang.org/appengine v1.6.7 // indirect
google.golang.org/genproto v0.0.0-20220519153652-3a47de7e79bd // indirect
golang.org/x/crypto v0.24.0 // indirect
golang.org/x/oauth2 v0.18.0 // indirect
Comment on lines +123 to +124
Copy link
Copy Markdown

@coderabbitai coderabbitai Bot May 28, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Verify known advisories for current pinned versions on OSV
set -euo pipefail

cat <<'JSON' > /tmp/osv-query.json
{
  "queries": [
    {"package":{"ecosystem":"Go","name":"golang.org/x/crypto"},"version":"v0.24.0"},
    {"package":{"ecosystem":"Go","name":"golang.org/x/oauth2"},"version":"v0.18.0"}
  ]
}
JSON

curl -sS https://api.osv.dev/v1/querybatch \
  -H 'Content-Type: application/json' \
  --data-binary `@/tmp/osv-query.json` | jq .

Repository: openshift/cloud-provider-openstack

Length of output: 2729

Upgrade golang.org/x/crypto v0.24.0 and golang.org/x/oauth2 v0.18.0 in go.mod (OSV lists advisories for both).

File: go.mod (lines 123-124)

	golang.org/x/crypto v0.24.0 // indirect
	golang.org/x/oauth2 v0.18.0 // indirect

OSV reports multiple vulnerabilities affecting golang.org/x/crypto@v0.24.0, and golang.org/x/oauth2@v0.18.0 is also affected (e.g., GHSA-6v2p-p543-phr9, GO-2025-3488). Upgrade both to the latest patched versions and keep versions pinned in go.mod.

🧰 Tools
🪛 OSV Scanner (2.3.8)

[CRITICAL] 123-123: golang.org/x/crypto 0.24.0: Misuse of connection.serverAuthenticate may cause authorization bypass in golang.org/x/crypto

(GO-2024-3321)

[CRITICAL] 123-123: golang.org/x/crypto 0.24.0: Potential denial of service in golang.org/x/crypto

(GO-2025-3487)

[CRITICAL] 123-123: golang.org/x/crypto 0.24.0: Potential denial of service in golang.org/x/crypto/ssh/agent

(GO-2025-4116)

[CRITICAL] 123-123: golang.org/x/crypto 0.24.0: Unbounded memory consumption in golang.org/x/crypto/ssh

(GO-2025-4134)

[CRITICAL] 123-123: golang.org/x/crypto 0.24.0: Malformed constraint may cause denial of service in golang.org/x/crypto/ssh/agent

(GO-2025-4135)

[CRITICAL] 123-123: golang.org/x/crypto 0.24.0: Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent

(GO-2026-5005)

[CRITICAL] 123-123: golang.org/x/crypto 0.24.0: Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent

(GO-2026-5006)

[CRITICAL] 123-123: golang.org/x/crypto 0.24.0: Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh

(GO-2026-5013)

[CRITICAL] 123-123: golang.org/x/crypto 0.24.0: Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh

(GO-2026-5014)

[CRITICAL] 123-123: golang.org/x/crypto 0.24.0: Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh

(GO-2026-5015)

[CRITICAL] 123-123: golang.org/x/crypto 0.24.0: Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh

(GO-2026-5016)

[CRITICAL] 123-123: golang.org/x/crypto 0.24.0: Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh

(GO-2026-5017)

[CRITICAL] 123-123: golang.org/x/crypto 0.24.0: Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh

(GO-2026-5018)

[CRITICAL] 123-123: golang.org/x/crypto 0.24.0: Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh

(GO-2026-5019)

[CRITICAL] 123-123: golang.org/x/crypto 0.24.0: Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh

(GO-2026-5020)

[CRITICAL] 123-123: golang.org/x/crypto 0.24.0: Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts

(GO-2026-5021)

[CRITICAL] 123-123: golang.org/x/crypto 0.24.0: Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh

(GO-2026-5023)

[CRITICAL] 123-123: golang.org/x/crypto 0.24.0: Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent

(GO-2026-5033)

[CRITICAL] 123-123: golang.org/x/crypto 0.24.0: golang.org/x/crypto/ssh/agent vulnerable to panic if message is malformed due to out of bounds read

(GHSA-f6x5-jh6r-wrfv)

[CRITICAL] 123-123: golang.org/x/crypto 0.24.0: golang.org/x/crypto Vulnerable to Denial of Service (DoS) via Slow or Incomplete Key Exchange

(GHSA-hcg3-q754-cr77)

[CRITICAL] 123-123: golang.org/x/crypto 0.24.0: golang.org/x/crypto/ssh allows an attacker to cause unbounded memory consumption

(GHSA-j5w8-q4qc-rx2x)

[CRITICAL] 123-123: golang.org/x/crypto 0.24.0: Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto

(GHSA-v778-237x-gjrc)

[HIGH] 124-124: golang.org/x/oauth2 0.18.0: Unexpected memory consumption during token parsing in golang.org/x/oauth2

(GO-2025-3488)

[HIGH] 124-124: golang.org/x/oauth2 0.18.0: golang.org/x/oauth2 Improper Validation of Syntactic Correctness of Input vulnerability

(GHSA-6v2p-p543-phr9)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@go.mod` around lines 123 - 124, Update the two indirect module pins in go.mod
for golang.org/x/crypto and golang.org/x/oauth2 to versions that contain the
security patches; specifically bump the golang.org/x/crypto and
golang.org/x/oauth2 entries to the latest patched releases, run `go get
golang.org/x/crypto@latest golang.org/x/oauth2@latest` (or target the specific
patched versions) and then run `go mod tidy` to update go.sum and lock the
versions; ensure the go.mod lines referencing golang.org/x/crypto and
golang.org/x/oauth2 are updated and remain pinned.

golang.org/x/sync v0.7.0 // indirect
golang.org/x/text v0.16.0 // indirect
golang.org/x/time v0.5.0 // indirect
google.golang.org/appengine v1.6.8 // indirect
google.golang.org/genproto v0.0.0-20240213162025-012b6fc9bca9 // indirect
google.golang.org/genproto/googleapis/api v0.0.0-20240318140521-94a12d6c2237 // indirect
google.golang.org/genproto/googleapis/rpc v0.0.0-20240318140521-94a12d6c2237 // indirect
gopkg.in/inf.v0 v0.9.1 // indirect
gopkg.in/ini.v1 v1.66.4 // indirect
gopkg.in/natefinch/lumberjack.v2 v2.0.0 // indirect
Expand All @@ -148,7 +150,7 @@ require (

replace (
github.com/docker/distribution => github.com/docker/distribution v2.8.2+incompatible
google.golang.org/grpc v1.34.0 => google.golang.org/grpc v1.29.0
google.golang.org/grpc => github.com/openshift-sustaining/grpc-go v1.64.1-sec.1
Copy link
Copy Markdown

@coderabbitai coderabbitai Bot May 28, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Check module version metadata and availability
set -euo pipefail

go env GOPROXY >/dev/null 2>&1 || true
echo "Querying module proxy for tagged version..."
curl -sS "https://proxy.golang.org/github.com/openshift-sustaining/grpc-go/@v/list" | tail -n 20
curl -sS "https://proxy.golang.org/github.com/openshift-sustaining/grpc-go/@v/v1.64.1-sec.1.info"

Repository: openshift/cloud-provider-openstack

Length of output: 524

🏁 Script executed:

#!/bin/bash
set -euo pipefail

base="https://proxy.golang.org/github.com/openshift-sustaining/grpc-go/@v/v1.64.1-sec.1"
for ext in info mod zip; do
  code=$(curl -sS -o /dev/null -w "%{http_code}" "${base}.${ext}")
  echo "${ext}: ${code}"
done

Repository: openshift/cloud-provider-openstack

Length of output: 106

🌐 Web query:

v1.64.1-sec.1 openshift-sustaining grpc-go tag

💡 Result:

The tag v1.64.1-sec.1 in the openshift-sustaining/grpc-go repository is a specialized security patch version of the gRPC-Go library maintained by the OpenShift team [1][2][3]. This version was created to address CVE-2026-33186 while allowing OpenShift components (such as csi-driver-nfs) to remain compatible with older Go versions (specifically Go 1.22) [1][4]. Upgrading to the standard upstream gRPC-Go versions containing this fix would have required a mandatory Go toolchain version bump, which was undesirable for certain OpenShift release branches [4]. By using the openshift-sustaining/grpc-go repository, OpenShift developers can apply necessary security patches as a replacement for the standard google.golang.org/grpc dependency [1][4]. The replacement is typically managed in Go projects using the following command in the go.mod file: go mod edit -replace google.golang.org/grpc=github.com/openshift-sustaining/grpc-go@v1.64.1-sec.1 [1][4]

Citations:

🌐 Web query:

github.com/openshift-sustaining/grpc-go v1.64.1-sec.1 release security

💡 Result:

The module github.com/openshift-sustaining/grpc-go v1.64.1-sec.1 is a specialized, downstream fork of the standard google.golang.org/grpc library maintained by OpenShift [1][2]. This specific release was created to address CVE-2026-33186, a critical authorization bypass vulnerability [1][3]. The primary purpose of this version is to provide a patched gRPC implementation for OpenShift components (such as the csi-driver-nfs) without requiring a broader Go version bump or a forced update to newer upstream gRPC versions that might introduce breaking changes or require significant refactoring in existing OpenShift infrastructure [1][2]. In summary: - Purpose: Provides a security backport of the fix for CVE-2026-33186 [1][2]. - Reason for existence: Allows Red Hat/OpenShift engineers to remediate the vulnerability in stable components while maintaining compatibility with existing build environments [1][2]. - Usage: It is used as a direct replacement for the standard google.golang.org/grpc in OpenShift-related projects where patching the upstream dependency directly is not feasible or desired due to dependencies on older Go environments [1][4].

Citations:

Clarify that github.com/openshift-sustaining/grpc-go v1.64.1-sec.1 is an intentional OpenShift security backport release (not a yanked/accidental pre-release).

  • Despite the -sec.1 suffix, OpenShift documents this tag as a downstream security patch backport for CVE-2026-33186 used as a google.golang.org/grpc replacement for release branches.
  • proxy.golang.org returns HTTP 200 for the module info, mod, and zip artifacts for v1.64.1-sec.1 (no indication it’s yanked).

Minor follow-up: align with the project’s “no pre-release” policy definition by documenting/confirming that -sec.* security backport versions are an approved exception.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@go.mod` at line 153, The go.mod replacement line using
"google.golang.org/grpc => github.com/openshift-sustaining/grpc-go
v1.64.1-sec.1" must be documented as an intentional OpenShift security backport
(not a yanked/pre-release); update the repo by adding a short comment near the
replacement in go.mod (or a one-line note in a nearby module comment) that
states this is a downstream security backport for CVE-2026-33186 and is served
by proxy.golang.org, and also update the project's policy/docs to explicitly
permit "-sec.*" security backport versions as an approved exception to the "no
pre-release" rule so reviewers know the replacement is deliberate and supported.

k8s.io/api => k8s.io/api v0.25.10
k8s.io/apiextensions-apiserver => k8s.io/apiextensions-apiserver v0.25.15
k8s.io/apimachinery => k8s.io/apimachinery v0.25.15
Expand Down Expand Up @@ -177,3 +179,21 @@ replace (
k8s.io/sample-cli-plugin => k8s.io/sample-cli-plugin v0.25.10
k8s.io/sample-controller => k8s.io/sample-controller v0.25.10
)

replace go.opentelemetry.io/contrib => go.opentelemetry.io/contrib v0.20.0

replace go.opentelemetry.io/contrib/instrumentation/github.com/emicklei/go-restful/otelrestful => go.opentelemetry.io/contrib/instrumentation/github.com/emicklei/go-restful/otelrestful v0.20.0

replace go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc => go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.20.0

replace go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp => go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.20.0

replace go.opentelemetry.io/otel => go.opentelemetry.io/otel v0.20.0

replace go.opentelemetry.io/otel/metric => go.opentelemetry.io/otel/metric v0.20.0

replace go.opentelemetry.io/otel/sdk => go.opentelemetry.io/otel/sdk v0.20.0

replace go.opentelemetry.io/otel/trace => go.opentelemetry.io/otel/trace v0.20.0

replace go.opentelemetry.io/proto/otlp => go.opentelemetry.io/proto/otlp v0.7.0
Comment on lines +183 to +199
Copy link
Copy Markdown

@coderabbitai coderabbitai Bot May 28, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | 🏗️ Heavy lift

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Verify which OTel versions are actually selected after replace directives
set -euo pipefail

rg -n '^\s*go\.opentelemetry\.io/' go.mod -n
echo "---- advisories for otelhttp v0.20.0 ----"
cat <<'JSON' > /tmp/osv-otel.json
{"package":{"ecosystem":"Go","name":"go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp"},"version":"v0.20.0"}
JSON
curl -sS https://api.osv.dev/v1/query -H 'Content-Type: application/json' --data-binary `@/tmp/osv-otel.json` | jq .

Repository: openshift/cloud-provider-openstack

Length of output: 21569

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "---- go.mod replace directives for go.opentelemetry.io ----"
rg -n '^\s*replace\s+go\.opentelemetry\.io/' go.mod || true

echo
echo "---- go.mod lines 160-220 ----"
nl -ba go.mod | sed -n '160,220p'

echo
echo "---- go.mod require lines for go.opentelemetry.io ----"
rg -n '^\s*go\.opentelemetry\.io/' go.mod || true

Repository: openshift/cloud-provider-openstack

Length of output: 1239

🏁 Script executed:

#!/bin/bash
set -euo pipefail

mods=(
  "go.opentelemetry.io/contrib v0.20.0"
  "go.opentelemetry.io/contrib/instrumentation/github.com/emicklei/go-restful/otelrestful v0.20.0"
  "go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.20.0"
  "go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.20.0"
  "go.opentelemetry.io/otel v0.20.0"
  "go.opentelemetry.io/otel/metric v0.20.0"
  "go.opentelemetry.io/otel/sdk v0.20.0"
  "go.opentelemetry.io/otel/trace v0.20.0"
  "go.opentelemetry.io/proto/otlp v0.7.0"
)

for m in "${mods[@]}"; do
  name="$(echo "$m" | awk '{print $1}')"
  ver="$(echo "$m" | awk '{print $2}')"
  echo "---- osv advisories for $name $ver ----"
  cat <<JSON > /tmp/osv-query.json
{"package":{"ecosystem":"Go","name":"$name"},"version":"$ver"}
JSON
  curl -sS https://api.osv.dev/v1/query \
    -H 'Content-Type: application/json' \
    --data-binary `@/tmp/osv-query.json` \
  | jq '{vulns: [.vulns[]? | {id, summary, severity: (.database_specific.severity // empty)}], result_count: (.vulns|length)}'
  echo
done

Repository: openshift/cloud-provider-openstack

Length of output: 1569

OpenTelemetry replace pins force HIGH-severity OTelHTTP DoS (GHSA-rcjv-mgp8-qvmr / CVE-2023-45142)

In go.mod (lines 183-199), the replace directives pin:

  • go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp => v0.20.0
  • go.opentelemetry.io/contrib/instrumentation/github.com/emicklei/go-restful/otelrestful => v0.20.0

OSV flags GHSA-rcjv-mgp8-qvmr (severity HIGH) for otelhttp due to unbound cardinality metrics leading to potential memory exhaustion/DoS. These replace pins also override newer require versions (e.g., otelhttp v0.49.0 / otel v1.24.0).

Move the replace pins to patched versions compatible with this branch (advisory fix is >= 0.44.0), or document/implement compensating controls to bound/filter high-cardinality attributes.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@go.mod` around lines 183 - 199, The go.mod replace pins for OpenTelemetry
(the replace directives referencing
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp and
go.opentelemetry.io/contrib/instrumentation/github.com/emicklei/go-restful/otelrestful)
lock vulnerable versions (otelhttp <= v0.20.0); update those replace directives
to point at patched upstream versions (at least v0.44.0 or newer) or remove the
replaces so the module uses the newer require versions (e.g., otelhttp >=
v0.44.0 / otel >= v1.24.0), and if you cannot upgrade, add code/config to bound
or filter high-cardinality attributes in the otelhttp/otelrestful
instrumentation to mitigate GHSA-rcjv-mgp8-qvmr.

Loading