Bump Go to 1.24.12+ to fix CVE-2025-61726, CVE-2025-61728, CVE-2025-61729
Open
Nobody has claimed this yet.
kind/bug
- Dominant language
- Go
- Stars
- 461
- Forks
- 277
- Avg merge
- 16h 48m
- Merged PRs (30d)
- 95
Description
Summary
Go 1.24.12 fixes three CVEs affecting tkn:
- CVE-2025-61726: Memory exhaustion in
net/urlquery parameter parsing - CVE-2025-61728: Excessive CPU consumption in
archive/zipindex building - CVE-2025-61729: Resource exhaustion in
crypto/x509certificate validation
Current State
- main: Go 1.24.6
- release-v0.42.0: Go 1.24.3
- release-v0.37.2: Go 1.23.0
Required
Bump to Go 1.24.12+ on main and backport to active release branches.
References
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Inspect the Go version declarations and CI/toolchain configuration on main, release-v0.42.0, and release-v0.37.2. Update each active branch to the required Go 1.24.12+ version, backporting where appropriate, then run the repository's standard checks to confirm the CLI still builds and tests pass.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- cli, security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 52/100