Skip to content

CVE fixes - #1757

Merged
EnriqueL8 merged 2 commits into
hyperledger-firefly:mainfrom
dan-r:main
Jul 22, 2026
Merged

CVE fixes#1757
EnriqueL8 merged 2 commits into
hyperledger-firefly:mainfrom
dan-r:main

Conversation

@dan-r

@dan-r dan-r commented Jul 22, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Fixes:

go.mod (gomod)

Total: 2 (UNKNOWN: 2, HIGH: 0, CRITICAL: 0)

┌───────────────────┬────────────────┬──────────┬────────┬───────────────────┬───────────────┬─────────────────────────────────────────────────────┐
│      Library      │ Vulnerability  │ Severity │ Status │ Installed Version │ Fixed Version │                        Title                        │
├───────────────────┼────────────────┼──────────┼────────┼───────────────────┼───────────────┼─────────────────────────────────────────────────────┤
│ golang.org/x/net  │ CVE-2026-46600 │ UNKNOWN  │ fixed  │ v0.55.0           │ 0.56.0        │ Parsing an invalid SVCB or HTTPS RR can panic in    │
│                   │                │          │        │                   │               │ golang.org/x/net/dns/dnsmessage                     │
│                   │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-46600          │
├───────────────────┼────────────────┤          │        ├───────────────────┼───────────────┼─────────────────────────────────────────────────────┤
│ golang.org/x/text │ CVE-2026-56852 │          │        │ v0.37.0           │ 0.39.0        │ Infinite loop on invalid input in golang.org/x/text │
│                   │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-56852          │
└───────────────────┴────────────────┴──────────┴────────┴───────────────────┴───────────────┴─────────────────────────────────────────────────────┘

smart_contracts/fabric/custompin-sample/go.mod (gomod)

Total: 3 (UNKNOWN: 2, HIGH: 1, CRITICAL: 0)

┌────────────────────────┬─────────────────────┬──────────┬────────┬───────────────────┬───────────────┬─────────────────────────────────────────────────────┐
│        Library         │    Vulnerability    │ Severity │ Status │ Installed Version │ Fixed Version │                        Title                        │
├────────────────────────┼─────────────────────┼──────────┼────────┼───────────────────┼───────────────┼─────────────────────────────────────────────────────┤
│ golang.org/x/net       │ CVE-2026-46600      │ UNKNOWN  │ fixed  │ v0.55.0           │ 0.56.0        │ Parsing an invalid SVCB or HTTPS RR can panic in    │
│                        │                     │          │        │                   │               │ golang.org/x/net/dns/dnsmessage                     │
│                        │                     │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-46600          │
├────────────────────────┼─────────────────────┤          │        ├───────────────────┼───────────────┼─────────────────────────────────────────────────────┤
│ golang.org/x/text      │ CVE-2026-56852      │          │        │ v0.37.0           │ 0.39.0        │ Infinite loop on invalid input in golang.org/x/text │
│                        │                     │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-56852          │
├────────────────────────┼─────────────────────┼──────────┤        ├───────────────────┼───────────────┼─────────────────────────────────────────────────────┤
│ google.golang.org/grpc │ GHSA-hrxh-6v49-42gf │ HIGH     │        │ v1.79.3           │ 1.82.1        │ gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities        │
│                        │                     │          │        │                   │               │ https://github.com/advisories/GHSA-hrxh-6v49-42gf   │
└────────────────────────┴─────────────────────┴──────────┴────────┴───────────────────┴───────────────┴─────────────────────────────────────────────────────┘

smart_contracts/fabric/firefly-go/go.mod (gomod)

Total: 3 (UNKNOWN: 2, HIGH: 1, CRITICAL: 0)

┌────────────────────────┬─────────────────────┬──────────┬────────┬───────────────────┬───────────────┬─────────────────────────────────────────────────────┐
│        Library         │    Vulnerability    │ Severity │ Status │ Installed Version │ Fixed Version │                        Title                        │
├────────────────────────┼─────────────────────┼──────────┼────────┼───────────────────┼───────────────┼─────────────────────────────────────────────────────┤
│ golang.org/x/net       │ CVE-2026-46600      │ UNKNOWN  │ fixed  │ v0.55.0           │ 0.56.0        │ Parsing an invalid SVCB or HTTPS RR can panic in    │
│                        │                     │          │        │                   │               │ golang.org/x/net/dns/dnsmessage                     │
│                        │                     │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-46600          │
├────────────────────────┼─────────────────────┤          │        ├───────────────────┼───────────────┼─────────────────────────────────────────────────────┤
│ golang.org/x/text      │ CVE-2026-56852      │          │        │ v0.37.0           │ 0.39.0        │ Infinite loop on invalid input in golang.org/x/text │
│                        │                     │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-56852          │
├────────────────────────┼─────────────────────┼──────────┤        ├───────────────────┼───────────────┼─────────────────────────────────────────────────────┤
│ google.golang.org/grpc │ GHSA-hrxh-6v49-42gf │ HIGH     │        │ v1.79.3           │ 1.82.1        │ gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities        │
│                        │                     │          │        │                   │               │ https://github.com/advisories/GHSA-hrxh-6v49-42gf   │
└────────────────────────┴─────────────────────┴──────────┴────────┴───────────────────┴───────────────┴─────────────────────────────────────────────────────┘

test/data/contracts/assetcreator/go.mod (gomod)

Total: 3 (UNKNOWN: 2, HIGH: 1, CRITICAL: 0)

┌────────────────────────┬─────────────────────┬──────────┬────────┬───────────────────┬───────────────┬─────────────────────────────────────────────────────┐
│        Library         │    Vulnerability    │ Severity │ Status │ Installed Version │ Fixed Version │                        Title                        │
├────────────────────────┼─────────────────────┼──────────┼────────┼───────────────────┼───────────────┼─────────────────────────────────────────────────────┤
│ golang.org/x/net       │ CVE-2026-46600      │ UNKNOWN  │ fixed  │ v0.55.0           │ 0.56.0        │ Parsing an invalid SVCB or HTTPS RR can panic in    │
│                        │                     │          │        │                   │               │ golang.org/x/net/dns/dnsmessage                     │
│                        │                     │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-46600          │
├────────────────────────┼─────────────────────┤          │        ├───────────────────┼───────────────┼─────────────────────────────────────────────────────┤
│ golang.org/x/text      │ CVE-2026-56852      │          │        │ v0.37.0           │ 0.39.0        │ Infinite loop on invalid input in golang.org/x/text │
│                        │                     │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-56852          │
├────────────────────────┼─────────────────────┼──────────┤        ├───────────────────┼───────────────┼─────────────────────────────────────────────────────┤
│ google.golang.org/grpc │ GHSA-hrxh-6v49-42gf │ HIGH     │        │ v1.79.3           │ 1.82.1        │ gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities        │
│                        │                     │          │        │                   │               │ https://github.com/advisories/GHSA-hrxh-6v49-42gf   │
└────────────────────────┴─────────────────────┴──────────┴────────┴───────────────────┴───────────────┴─────────────────────────────────────────────────────┘

@dan-r
CVE fixes
503893b 
Signed-off-by: Daniel Raper <daniel.raper@kaleido.io>
@dan-r
dan-r requested a review from a team as a code owner July 22, 2026 10:41
EnriqueL8
EnriqueL8 approved these changes Jul 22, 2026
View reviewed changes

@EnriqueL8 EnriqueL8 left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks @dan-r

@EnriqueL8
EnriqueL8 merged commit 977d80f into hyperledger-firefly:main Jul 22, 2026
17 checks passed
@codecov

codecov Bot commented Jul 22, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
see 2 files with indirect coverage changes

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@EnriqueL8 EnriqueL8 EnriqueL8 approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@dan-r @EnriqueL8