Please release the fix for CVE-2025-22871 with commit/fd27520bbd96d723bb4c851f3ddd5e70c3fcf2b8 urgently

[ricardoamaro]

Hello team,

fd27520 addresses a critical security issue from CVE-2025-22871.

When can we have a new version released for it?

Thank you!

[thaJeztah]

Looks like that CVE is not impacting this code, as the net/http package is not used, so tools detecting it would be a false positive.

That said there's two lower level CVEs that are, and we probably should update to go1.24 or go1.25;

• https://pkg.go.dev/vuln/GO-2025-3956
• https://pkg.go.dev/vuln/GO-2025-3750

git describe --tags
v0.9.3

govulncheck --version
Go: go1.23.6
Scanner: govulncheck@v1.1.4
DB: https://vuln.go.dev
DB updated: 2025-09-24 19:21:41 +0000 UTC


CGO_ENABLED=1 govulncheck -show verbose ./...
Fetching vulnerabilities from the database...

Checking the code against the vulnerabilities...

The package pattern matched the following 7 root packages:
  github.com/docker/docker-credential-helpers/credentials
  github.com/docker/docker-credential-helpers/client
  github.com/docker/docker-credential-helpers/pass
  github.com/docker/docker-credential-helpers/pass/cmd
  github.com/docker/docker-credential-helpers/registryurl
  github.com/docker/docker-credential-helpers/secretservice
  github.com/docker/docker-credential-helpers/secretservice/cmd
Govulncheck scanned the following 1 modules and the go1.23.6 standard library:
  github.com/docker/docker-credential-helpers

=== Symbol Results ===

Vulnerability #1: GO-2025-3956
    Unexpected paths returned from LookPath in os/exec
  More info: https://pkg.go.dev/vuln/GO-2025-3956
  Standard library
    Found in: os/exec@go1.23.6
    Fixed in: os/exec@go1.23.12
    Example traces found:
      #1: pass/pass.go:70:21: pass.Pass.runPassHelper calls exec.Command, which calls exec.LookPath

Vulnerability #2: GO-2025-3750
    Inconsistent handling of O_CREATE|O_EXCL on Unix and Windows in os in
    syscall
  More info: https://pkg.go.dev/vuln/GO-2025-3750
  Standard library
    Found in: os@go1.23.6
    Fixed in: os@go1.23.10
    Platforms: windows
    Example traces found:
      #1: client/command.go:51:21: client.Shell.Output calls exec.Cmd.Output, which eventually calls os.Getwd
      #2: pass/pass.go:13:2: pass.init calls os.init, which calls os.NewFile
      #3: client/command.go:51:21: client.Shell.Output calls exec.Cmd.Output, which eventually calls os.Open
      #4: client/command.go:51:21: client.Shell.Output calls exec.Cmd.Output, which eventually calls os.OpenFile
      #5: client/command.go:51:21: client.Shell.Output calls exec.Cmd.Output, which eventually calls os.Pipe
      #6: pass/pass.go:120:28: pass.listPassDir calls os.ReadDir
      #7: client/command.go:51:21: client.Shell.Output calls exec.Cmd.Output, which eventually calls os.StartProcess
      #8: pass/pass.go:70:21: pass.Pass.runPassHelper calls exec.Command, which eventually calls os.Stat
      #9: pass/pass.go:129:26: pass.listPassDir calls os.unixDirent.Info
      #10: pass/pass.go:13:2: pass.init calls os.init, which eventually calls syscall.Open

=== Package Results ===

No other vulnerabilities found.

=== Module Results ===


Vulnerability #1: GO-2025-3849
    Incorrect results returned from Rows.Scan in database/sql
  More info: https://pkg.go.dev/vuln/GO-2025-3849
  Standard library
    Found in: stdlib@go1.23.6
    Fixed in: stdlib@go1.23.12

Vulnerability #2: GO-2025-3751
    Sensitive headers not cleared on cross-origin redirect in net/http
  More info: https://pkg.go.dev/vuln/GO-2025-3751
  Standard library
    Found in: stdlib@go1.23.6
    Fixed in: stdlib@go1.23.10

Vulnerability #3: GO-2025-3563
    Request smuggling due to acceptance of invalid chunked data in net/http
  More info: https://pkg.go.dev/vuln/GO-2025-3563
  Standard library
    Found in: stdlib@go1.23.6
    Fixed in: stdlib@go1.23.8

Your code is affected by 2 vulnerabilities from the Go standard library.
This scan also found 0 vulnerabilities in packages you import and 3
vulnerabilities in modules you require, but your code doesn't appear to call
these vulnerabilities.

[ricardoamaro]

Much appreciated, @thaJeztah!