SlalomBrinkman opened a new issue, #41056:
URL: https://github.com/apache/beam/issues/41056
### What happened?
The `/opt/apache/beam/boot` binary in the released Python SDK containers is
built with **go1.26.2**. `apache/beam_python3.13_sdk:2.77.0` and `:2.78.0`
(released 2026-11-06) both carry it, and container scanners (Trivy) report 13
HIGH Go standard-library CVEs plus one in `golang.org/x/net` against it. All
have fixes in go1.26.10 / go1.27.3 and x/net v0.62.0.
`sdks/go.mod` on master still pins `toolchain go1.26.2`, so the next release
will ship the same findings unless the toolchain is bumped. The
before-each-release task #27897 ("Ensure the Go version used for container
builds is the latest available") covers exactly this, but it doesn't seem to
have been applied for 2.77/2.78.
Because `boot` is the worker entrypoint, every pipeline using a custom
container `FROM apache/beam_python*_sdk` inherits these findings, and users
can't patch them without rebuilding `boot` themselves.
**Findings (Trivy, `apache/beam_python3.13_sdk:2.78.0`, target
`opt/apache/beam/boot`):**
| CVE | Package | Fixed in | Severity |
|---|---|---|---|
| CVE-2026-111943 | stdlib v1.26.2 | 1.26.10, 1.27.3 | HIGH |
| CVE-2026-33818 | stdlib v1.26.2 | 1.26.6 | HIGH |
| CVE-2026-39822 | stdlib v1.26.2 | 1.26.5 | HIGH |
| CVE-2026-42504 | stdlib v1.26.2 | 1.26.4 | HIGH |
| CVE-2026-46600 | stdlib v1.26.2 | 1.26.6 | HIGH |
| CVE-2026-56853, -56858, -56859, -56860, -56862 | stdlib v1.26.2 | 1.26.6 |
HIGH |
| CVE-2026-78667, -78669, CVE-2026-97031 | stdlib v1.26.2 | 1.26.9 | HIGH |
| CVE-2026-78661 | golang.org/x/net v0.61.0 | v0.62.0 | HIGH |
**Suggested fix:** bump `toolchain` in `sdks/go.mod` to go1.26.10 (or the
latest 1.26.x at release time) and `golang.org/x/net` to ≥ v0.62.0, then
rebuild the SDK containers. A patch release of the containers would let users
pick this up without waiting for 2.79.0.
### Issue Priority
Priority: 2 (default / most bugs should be filed as P2)
### Issue Components
- Component: Python SDK
- Component: Go SDK
- Component: Infrastructure
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
