Repository navigation
8 HIGH stdlib CVEs in 41.1.3 require rebuild on Go 1.26.3 #784
Description
The gostatsd binary shipped in atlassianlabs/gostatsd:41.1.3 was built with Go 1.26.2, which contains 8 HIGH-severity stdlib CVEs that are fixed in Go 1.26.3. Trivy (and other gobinary scanners) flag the binary against all eight, which is breaking deployment security gates.
No source changes are required — just a Go version bump, most likely resulting in a patch release 41.1.4.
CVEs detected against stdlib v1.26.2
All eight are fixed in 1.26.3:
| CVE | Area |
|---|---|
| CVE-2026-33811 | net — DoS via long input |
| CVE-2026-33814 | net/http — HTTP/2 SETTINGS frame DoS |
| CVE-2026-39820 | net/mail — ParseAddress / ParseAddressList |
| CVE-2026-39823 | net/url — regression of CVE-2026-27142 |
| CVE-2026-39825 | net/http/httputil — ReverseProxy query forwarding |
| CVE-2026-39826 | html/template — <script> tag handling |
| CVE-2026-39836 | net — Dial / LookupPort panic on NUL byte |
| CVE-2026-42499 | net/mail — consumePhrase DoS |
Activity