Skip to content

OCPBUGS-75754: Update Go version to 1.24.12 to fix CVE-2025-61726#640

Open
zhiqiangf wants to merge 1 commit intoopenshift:release-4.20from
zhiqiangf:OCPBUGS-75754-update-go-cve-4.20
Open

OCPBUGS-75754: Update Go version to 1.24.12 to fix CVE-2025-61726#640
zhiqiangf wants to merge 1 commit intoopenshift:release-4.20from
zhiqiangf:OCPBUGS-75754-update-go-cve-4.20

Conversation

@zhiqiangf
Copy link
Copy Markdown

@zhiqiangf zhiqiangf commented Mar 27, 2026

This addresses CVE-2025-61726 (memory exhaustion in net/url query parameter parsing) by updating from Go 1.24.3 to 1.24.12.

Fixes: OCPBUGS-75754

@claude
Update Go version to 1.24.12 to fix CVE-2025-61726
36045ad 
This addresses CVE-2025-61726 (memory exhaustion in net/url query
parameter parsing) by updating from Go 1.24.3 to 1.24.12.

Fixes: OCPBUGS-75754

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
@openshift-ci openshift-ci bot requested review from vrindle and wizhaoredhat March 27, 2026 03:34
@zhiqiangf zhiqiangf mentioned this pull request Mar 27, 2026
Closed
4 tasks
@zhiqiangf
Copy link
Copy Markdown
Author

zhiqiangf commented Mar 27, 2026

/retest

2 similar comments
@zhiqiangf
Copy link
Copy Markdown
Author

zhiqiangf commented Mar 29, 2026

/retest

@zhiqiangf
Copy link
Copy Markdown
Author

zhiqiangf commented Mar 30, 2026

/retest

@zhiqiangf
Copy link
Copy Markdown
Author

zhiqiangf commented Mar 30, 2026

/test make-test

2 similar comments
@zhiqiangf
Copy link
Copy Markdown
Author

zhiqiangf commented Mar 30, 2026

/test make-test

@wizhaoredhat
Copy link
Copy Markdown
Contributor

wizhaoredhat commented Mar 31, 2026

/test make-test

@wizhaoredhat
Copy link
Copy Markdown
Contributor

wizhaoredhat commented Mar 31, 2026

/lgtm
/override ci/prow/make-e2e-test-marvell
/override ci/prow/make-e2e-test
/label backport-risk-assessed

@openshift-ci openshift-ci bot added the backport-risk-assessed Indicates a PR to a release branch has been evaluated and considered safe to accept. label Mar 31, 2026
@openshift-ci openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Mar 31, 2026
@openshift-ci
Copy link
Copy Markdown

openshift-ci bot commented Mar 31, 2026

@zhiqiangf: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

@openshift-ci
Copy link
Copy Markdown

openshift-ci bot commented Mar 31, 2026

@wizhaoredhat: Overrode contexts on behalf of wizhaoredhat: ci/prow/make-e2e-test, ci/prow/make-e2e-test-marvell

Details

In response to this:

/lgtm
/override ci/prow/make-e2e-test-marvell
/override ci/prow/make-e2e-test
/label backport-risk-assessed

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@wizhaoredhat
Copy link
Copy Markdown
Contributor

wizhaoredhat commented Mar 31, 2026

/approve
/verified bypass

@openshift-ci-robot openshift-ci-robot added the verified Signifies that the PR passed pre-merge verification criteria label Mar 31, 2026
@openshift-ci-robot
Copy link
Copy Markdown

openshift-ci-robot commented Mar 31, 2026

@wizhaoredhat: The verified label has been added.

Details

In response to this:

/approve
/verified bypass

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@openshift-ci
Copy link
Copy Markdown

openshift-ci bot commented Mar 31, 2026

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: wizhaoredhat, zhiqiangf

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-ci openshift-ci bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Mar 31, 2026
@zhiqiangf zhiqiangf changed the title Update Go version to 1.24.12 to fix CVE-2025-61726 OCPBUGS-75754: Update Go version to 1.24.12 to fix CVE-2025-61726 Apr 1, 2026
@openshift-ci-robot openshift-ci-robot added jira/severity-important Referenced Jira bug's severity is important for the branch this PR is targeting. jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. labels Apr 1, 2026
@openshift-ci-robot openshift-ci-robot added the jira/invalid-bug Indicates that a referenced Jira bug is invalid for the branch this PR is targeting. label Apr 1, 2026
@openshift-ci-robot
Copy link
Copy Markdown

openshift-ci-robot commented Apr 1, 2026

@zhiqiangf: This pull request references Jira Issue OCPBUGS-75754, which is invalid:

  • release note text must be set and not match the template OR release note type must be set to "Release Note Not Required". For more information you can reference the OpenShift Bug Process.
  • expected Jira Issue OCPBUGS-75754 to depend on a bug targeting a version in 4.21.0, 4.21.z and in one of the following states: VERIFIED, RELEASE PENDING, CLOSED (ERRATA), CLOSED (CURRENT RELEASE), CLOSED (DONE), CLOSED (DONE-ERRATA), but no dependents were found

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

This addresses CVE-2025-61726 (memory exhaustion in net/url query parameter parsing) by updating from Go 1.24.3 to 1.24.12.

Fixes: OCPBUGS-75754

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@zhiqiangf
Copy link
Copy Markdown
Author

zhiqiangf commented Apr 1, 2026

/jira refresh

@openshift-ci-robot
Copy link
Copy Markdown

openshift-ci-robot commented Apr 1, 2026

@zhiqiangf: This pull request references Jira Issue OCPBUGS-75754, which is invalid:

  • expected Jira Issue OCPBUGS-75754 to depend on a bug targeting a version in 4.21.0, 4.21.z and in one of the following states: VERIFIED, RELEASE PENDING, CLOSED (ERRATA), CLOSED (CURRENT RELEASE), CLOSED (DONE), CLOSED (DONE-ERRATA), but no dependents were found

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

Details

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@vrindle vrindle Awaiting requested review from vrindle

@wizhaoredhat wizhaoredhat Awaiting requested review from wizhaoredhat

Assignees

@mffiedler mffiedler

@gsr-shanks gsr-shanks

@zhaozhanqi zhaozhanqi

@anuragthehatter anuragthehatter

@evgenLevin evgenLevin

@yingwang-0320 yingwang-0320

@wizhaoredhat wizhaoredhat

Labels

approved Indicates a PR has been approved by an approver from all required OWNERS files. backport-risk-assessed Indicates a PR to a release branch has been evaluated and considered safe to accept. jira/invalid-bug Indicates that a referenced Jira bug is invalid for the branch this PR is targeting. jira/severity-important Referenced Jira bug's severity is important for the branch this PR is targeting. jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. lgtm Indicates that a PR is ready to be merged. verified Signifies that the PR passed pre-merge verification criteria

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

9 participants

@zhiqiangf @wizhaoredhat @openshift-ci-robot @mffiedler @gsr-shanks @zhaozhanqi @anuragthehatter @evgenLevin @yingwang-0320