orbisai0security opened a new pull request, #69076: URL: https://github.com/apache/airflow/pull/69076
## Summary Upgrade golang.org/x/net from v0.48.0 to 0.55.0 to fix CVE-2026-25680. ## Vulnerability | Field | Value | |-------|-------| | **ID** | CVE-2026-25680 | | **Severity** | HIGH | | **Scanner** | trivy | | **Rule** | `CVE-2026-25680` | | **File** | `go-sdk/go.mod` | | **Assessment** | Likely exploitable | **Description**: Parsing arbitrary HTML can consume excessive CPU time, possibly leadin ... ## Evidence **Scanner confirmation**: trivy rule `CVE-2026-25680` flagged this pattern. **Production code**: This file is in the production codebase, not test-only code. ## Threat Model Context This is a web service - vulnerabilities in request handlers are directly exploitable by remote attackers. ## Changes - `go-sdk/go.mod` - `go-sdk/go.sum` ## Verification - [x] Build passes - [x] Scanner re-scan confirms fix - [x] LLM code review passed --- *This change addresses a pattern flagged by static analysis. The code path handles user-influenced input and the fix reduces the attack surface against both manual and automated exploitation.* --- *Automated security fix by [OrbisAI Security](https://orbisappsec.com)* -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
