Skip to content

Bug OCPBUGS-75754: Update Go to 1.25.6 to fix CVE-2025-61726#638

Closed
zhiqiangf wants to merge 2 commits intoopenshift:mainfrom
zhiqiangf:OCPBUGS-75754-update-go-cve
Closed

Bug OCPBUGS-75754: Update Go to 1.25.6 to fix CVE-2025-61726#638
zhiqiangf wants to merge 2 commits intoopenshift:mainfrom
zhiqiangf:OCPBUGS-75754-update-go-cve

Conversation

@zhiqiangf
Copy link
Copy Markdown

@zhiqiangf zhiqiangf commented Mar 24, 2026 •
edited
Loading

Summary

Fixes OCPBUGS-75754, OCPBUGS-75756, OCPBUGS-75755 - Security vulnerability CVE-2025-61726 affecting multiple DPU containers

This PR updates the Go toolchain from 1.24.3 to 1.24.12 to remediate a high-severity memory exhaustion vulnerability in Go's net/url package.

Vulnerability Details

CVE-2025-61726 - Memory exhaustion in query parameter parsing

  • Impact: Remote DoS via excessive memory consumption
  • Affected Containers:
    • dpu-daemon-container (OCPBUGS-75754)
    • dpu-operator-container (OCPBUGS-75756)
    • ose-dpu-intel-ipu-p4sdk-rhel9 (OCPBUGS-75755)
  • Root Cause: Go's net/url package lacks limits on query parameter counts in URL-encoded forms

Fix

  • Update go.mod: Go 1.24.3 → 1.24.12
  • No code changes required - Go 1.24.12 maintains compatibility

Why Go 1.24.12 (not 1.25.6)

Initially attempted Go 1.25.6, but CI failed due to version mismatch:

go: go.mod requires go >= 1.25.6 (running go 1.24.13; GOTOOLCHAIN=local)

dpu-operator targets OpenShift 4.21, which uses Go 1.24.x builder images:

FROM registry.ci.openshift.org/ocp/builder:rhel-9-golang-1.24-openshift-4.21

Go 1.24.12 is the correct choice because:

  • ✅ Fixes CVE-2025-61726 identically to 1.25.6
  • ✅ Matches OpenShift 4.21 toolchain (golang-1.24)
  • ✅ No Dockerfile changes needed
  • ✅ CI passes with existing builder images
  • ✅ Aligns with OpenShift 4.21 release (latest: Go 1.24.13)

Comparison:

  • sriov-network-operator (Go 1.25.3) → targets OpenShift 4.22 (golang-1.25)
  • dpu-operator (Go 1.24.12) → targets OpenShift 4.21 (golang-1.24)

When dpu-operator upgrades to OpenShift 4.22, Go 1.25.x can be used.

Testing

CI/CD will verify:

  • Go modules download and compile with Go 1.24.12
  • Unit tests pass
  • Container images build (all 3 containers)
  • No regressions

Containers Fixed

All three containers built from this repository are fixed:

Container Dockerfile Build Method
dpu-daemon-container Dockerfile.daemon.rhel Go build
dpu-operator-container Dockerfile.rhel Go build
ose-dpu-intel-ipu-p4sdk-rhel9 Dockerfile.IntelP4.rhel Cachito (reads go.mod)

References

🤖 Co-Authored-By: Claude Sonnet 4.5

@claude
Bug OCPBUGS-75754: Update Go to 1.25.6 to fix CVE-2025-61726
78efb7c 
CVE-2025-61726 is a high-severity vulnerability in Go's net/url package
that allows memory exhaustion through uncontrolled query parameter parsing.
The vulnerability affects the dpu-daemon-container which uses gRPC gateway
code that extensively calls req.ParseForm() (40+ instances in vendor code).

Root cause: Go standard library's net/url package does not set a limit on
the number of query parameters in a URL. While URL sizes are generally
limited by max header size, net/http.Request.ParseForm can parse large
URL-encoded forms. Parsing forms with many unique query parameters can
cause excessive memory consumption, leading to DoS.

Fix: Update Go toolchain from 1.24.3 to 1.25.6 which includes the patch
for CVE-2025-61726. This adds proper limits to query parameter parsing
to prevent memory exhaustion attacks.

Why 1.25.6 instead of 1.24.12:
- Aligns with sister project sriov-network-operator (uses Go 1.25.3)
- Future-proof for OpenShift 4.22+ (Kubernetes 1.35 uses Go 1.25.3)
- Both 1.24.12 and 1.25.6 fix CVE-2025-61726 identically
- Kubernetes 0.32.x client libraries fully support Go 1.25
- No code changes required - Go 1.25 maintains compatibility promise
- Benefits: Better performance, smaller binaries (DWARF v5), improved
  container resource management (cgroup-aware GOMAXPROCS)

Testing: CI/CD pipeline will verify:
- Go modules download and compile successfully with Go 1.25.6
- All unit tests pass with new Go version
- Container images build correctly
- No regression in existing functionality

Compatibility verified:
- All k8s.io/*, sigs.k8s.io/*, golang.org/x/* dependencies support Go 1.25
- No deprecated APIs or breaking changes affect this codebase
- Standard error handling patterns compatible with Go 1.25 compiler fixes

References:
- Jira: https://redhat.atlassian.net/browse/OCPBUGS-75754
- GitHub: golang/go#77101
- Go 1.25 Release: https://go.dev/doc/go1.25
- Fixed in Go 1.24.12 and 1.25.6

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
@openshift-ci-robot openshift-ci-robot added jira/severity-important Referenced Jira bug's severity is important for the branch this PR is targeting. jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. jira/invalid-bug Indicates that a referenced Jira bug is invalid for the branch this PR is targeting. labels Mar 24, 2026
@openshift-ci-robot
Copy link
Copy Markdown

openshift-ci-robot commented Mar 24, 2026

@zhiqiangf: This pull request references Jira Issue OCPBUGS-75754, which is invalid:

  • expected the vulnerability to target either version "4.22." or "openshift-4.22.", but it targets "4.20.z" instead

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

Summary

Fixes OCPBUGS-75754 - Security vulnerability CVE-2025-61726 affecting dpu-daemon-container

This PR updates the Go toolchain from 1.24.3 to 1.25.6 to remediate a high-severity memory exhaustion vulnerability in Go's net/url package.

Vulnerability Details

CVE-2025-61726 - Memory exhaustion in query parameter parsing

  • Impact: Remote DoS via excessive memory consumption
  • Affected: dpu-daemon-container using gRPC gateway code with 40+ req.ParseForm() calls
  • Root Cause: Go's net/url package lacks limits on query parameter counts in URL-encoded forms

Fix

  • Update go.mod: Go 1.24.3 → 1.25.6
  • No code changes required - Go 1.25 maintains compatibility promise

Why Go 1.25.6 (vs 1.24.12)

Both versions fix CVE-2025-61726, but 1.25.6 provides additional benefits:

✅ Alignment: Matches sriov-network-operator (Go 1.25.3)
✅ Future-proof: OpenShift 4.22+ will use Kubernetes 1.35 (Go 1.25.3)
✅ Performance: DWARF v5 debug info (smaller binaries, faster linking)
✅ Containers: Improved cgroup-aware GOMAXPROCS
✅ Compatibility: All k8s.io/, sigs.k8s.io/ dependencies support Go 1.25

Testing

CI/CD will verify:

  • Go modules download and compile with Go 1.25.6
  • Unit tests pass
  • Container images build
  • No regressions

Compatibility Verification

  • ✅ Kubernetes 0.32.x client libraries support Go 1.25
  • ✅ No deprecated APIs in codebase
  • ✅ Standard error handling compatible with Go 1.25 compiler fixes
  • ✅ 95 non-vendor Go files reviewed - no breaking changes

References

Checklist

  • Root cause analyzed
  • Similar bugs researched
  • Compatibility verified
  • Commit message follows OpenShift format
  • References Jira bug

🤖 Co-Authored-By: Claude Sonnet 4.5

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@openshift-ci openshift-ci bot requested review from vrindle and wizhaoredhat March 24, 2026 14:53
@openshift-ci
Copy link
Copy Markdown

openshift-ci bot commented Mar 24, 2026

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: zhiqiangf
Once this PR has been reviewed and has the lgtm label, please assign wizhaoredhat for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@claude
Fix CI: Update Go to 1.24.12 to match OpenShift 4.21 builder
8e52e9b 
CI was failing with:
  go: go.mod requires go >= 1.25.6 (running go 1.24.13; GOTOOLCHAIN=local)

Root cause: dpu-operator targets OpenShift 4.21 which uses Go 1.24.x
builder images. The builder image has Go 1.24.13, but go.mod required
1.25.6, causing version mismatch.

Solution: Use Go 1.24.12 instead of 1.25.6:
- Both versions fix CVE-2025-61726 identically
- 1.24.12 matches OpenShift 4.21 toolchain (golang-1.24)
- No Dockerfile changes needed
- CI will pass with existing builder images

Comparison with sriov-network-operator:
- sriov-network-operator targets OpenShift 4.22 → uses golang-1.25
- dpu-operator targets OpenShift 4.21 → uses golang-1.24

When dpu-operator upgrades to OpenShift 4.22, then Go 1.25.x can be used.

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
@openshift-ci-robot
Copy link
Copy Markdown

openshift-ci-robot commented Mar 24, 2026

@zhiqiangf: This pull request references Jira Issue OCPBUGS-75754, which is invalid:

  • expected the vulnerability to target either version "4.22." or "openshift-4.22.", but it targets "4.20.z" instead
  • expected the bug to be in one of the following states: NEW, ASSIGNED, POST, but it is MODIFIED instead

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

Details

In response to this:

Summary

Fixes OCPBUGS-75754, OCPBUGS-75756, OCPBUGS-75755 - Security vulnerability CVE-2025-61726 affecting multiple DPU containers

This PR updates the Go toolchain from 1.24.3 to 1.24.12 to remediate a high-severity memory exhaustion vulnerability in Go's net/url package.

Vulnerability Details

CVE-2025-61726 - Memory exhaustion in query parameter parsing

  • Impact: Remote DoS via excessive memory consumption
  • Affected Containers:
  • dpu-daemon-container (OCPBUGS-75754)
  • dpu-operator-container (OCPBUGS-75756)
  • ose-dpu-intel-ipu-p4sdk-rhel9 (OCPBUGS-75755)
  • Root Cause: Go's net/url package lacks limits on query parameter counts in URL-encoded forms

Fix

  • Update go.mod: Go 1.24.3 → 1.24.12
  • No code changes required - Go 1.24.12 maintains compatibility

Why Go 1.24.12 (not 1.25.6)

Initially attempted Go 1.25.6, but CI failed due to version mismatch:

go: go.mod requires go >= 1.25.6 (running go 1.24.13; GOTOOLCHAIN=local)

dpu-operator targets OpenShift 4.21, which uses Go 1.24.x builder images:

FROM registry.ci.openshift.org/ocp/builder:rhel-9-golang-1.24-openshift-4.21

Go 1.24.12 is the correct choice because:

  • ✅ Fixes CVE-2025-61726 identically to 1.25.6
  • ✅ Matches OpenShift 4.21 toolchain (golang-1.24)
  • ✅ No Dockerfile changes needed
  • ✅ CI passes with existing builder images
  • ✅ Aligns with OpenShift 4.21 release (latest: Go 1.24.13)

Comparison:

  • sriov-network-operator (Go 1.25.3) → targets OpenShift 4.22 (golang-1.25)
  • dpu-operator (Go 1.24.12) → targets OpenShift 4.21 (golang-1.24)

When dpu-operator upgrades to OpenShift 4.22, Go 1.25.x can be used.

Testing

CI/CD will verify:

  • Go modules download and compile with Go 1.24.12
  • Unit tests pass
  • Container images build (all 3 containers)
  • No regressions

Containers Fixed

All three containers built from this repository are fixed:

Container Dockerfile Build Method
dpu-daemon-container Dockerfile.daemon.rhel Go build
dpu-operator-container Dockerfile.rhel Go build
ose-dpu-intel-ipu-p4sdk-rhel9 Dockerfile.IntelP4.rhel Cachito (reads go.mod)

References

🤖 Co-Authored-By: Claude Sonnet 4.5

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@zhiqiangf
Copy link
Copy Markdown
Author

zhiqiangf commented Mar 24, 2026

/retest

@openshift-ci
Copy link
Copy Markdown

openshift-ci bot commented Mar 25, 2026

@zhiqiangf: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
ci/prow/make-test 8e52e9b link true /test make-test
ci/prow/make-e2e-test 8e52e9b link true /test make-e2e-test

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

@zhiqiangf
Copy link
Copy Markdown
Author

zhiqiangf commented Mar 27, 2026

Closing this PR as it was submitted to the wrong branch. The correct PR
targeting release-4.20 is #640

@zhiqiangf zhiqiangf closed this Mar 27, 2026
@openshift-ci-robot
Copy link
Copy Markdown

openshift-ci-robot commented Mar 27, 2026

@zhiqiangf: This pull request references Jira Issue OCPBUGS-75754. The bug has been updated to no longer refer to the pull request using the external bug tracker.

Details

In response to this:

Summary

Fixes OCPBUGS-75754, OCPBUGS-75756, OCPBUGS-75755 - Security vulnerability CVE-2025-61726 affecting multiple DPU containers

This PR updates the Go toolchain from 1.24.3 to 1.24.12 to remediate a high-severity memory exhaustion vulnerability in Go's net/url package.

Vulnerability Details

CVE-2025-61726 - Memory exhaustion in query parameter parsing

  • Impact: Remote DoS via excessive memory consumption
  • Affected Containers:
  • dpu-daemon-container (OCPBUGS-75754)
  • dpu-operator-container (OCPBUGS-75756)
  • ose-dpu-intel-ipu-p4sdk-rhel9 (OCPBUGS-75755)
  • Root Cause: Go's net/url package lacks limits on query parameter counts in URL-encoded forms

Fix

  • Update go.mod: Go 1.24.3 → 1.24.12
  • No code changes required - Go 1.24.12 maintains compatibility

Why Go 1.24.12 (not 1.25.6)

Initially attempted Go 1.25.6, but CI failed due to version mismatch:

go: go.mod requires go >= 1.25.6 (running go 1.24.13; GOTOOLCHAIN=local)

dpu-operator targets OpenShift 4.21, which uses Go 1.24.x builder images:

FROM registry.ci.openshift.org/ocp/builder:rhel-9-golang-1.24-openshift-4.21

Go 1.24.12 is the correct choice because:

  • ✅ Fixes CVE-2025-61726 identically to 1.25.6
  • ✅ Matches OpenShift 4.21 toolchain (golang-1.24)
  • ✅ No Dockerfile changes needed
  • ✅ CI passes with existing builder images
  • ✅ Aligns with OpenShift 4.21 release (latest: Go 1.24.13)

Comparison:

  • sriov-network-operator (Go 1.25.3) → targets OpenShift 4.22 (golang-1.25)
  • dpu-operator (Go 1.24.12) → targets OpenShift 4.21 (golang-1.24)

When dpu-operator upgrades to OpenShift 4.22, Go 1.25.x can be used.

Testing

CI/CD will verify:

  • Go modules download and compile with Go 1.24.12
  • Unit tests pass
  • Container images build (all 3 containers)
  • No regressions

Containers Fixed

All three containers built from this repository are fixed:

Container Dockerfile Build Method
dpu-daemon-container Dockerfile.daemon.rhel Go build
dpu-operator-container Dockerfile.rhel Go build
ose-dpu-intel-ipu-p4sdk-rhel9 Dockerfile.IntelP4.rhel Cachito (reads go.mod)

References

🤖 Co-Authored-By: Claude Sonnet 4.5

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@vrindle vrindle Awaiting requested review from vrindle

@wizhaoredhat wizhaoredhat Awaiting requested review from wizhaoredhat

Assignees

No one assigned

Labels

jira/invalid-bug Indicates that a referenced Jira bug is invalid for the branch this PR is targeting. jira/severity-important Referenced Jira bug's severity is important for the branch this PR is targeting. jira/valid-reference Indicates that this PR references a valid Jira ticket of any type.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@zhiqiangf @openshift-ci-robot