Security: bump ui-server Go to >= 1.26.5 to address CVE-2026-27145 and CVE-2026-39822
Open
Beginner friendly
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 431
- Forks
- 179
- Avg merge
- 2d 9h
- Merged PRs (30d)
- 71
Description
Summary
Two Go stdlib CVEs affect the ui-server binary (temporalio/ui-server, currently v2.53.1 using go 1.26.3). Note: temporalio/ui-server has issues disabled so filing here.
| CVE | Severity | Description | Patched at |
|---|---|---|---|
| CVE-2026-27145 | MEDIUM (5.3) | crypto/x509 DoS — excessive CPU on x509 cert verification with many DNS SAN entries |
Go 1.26.4 |
| CVE-2026-39822 | MEDIUM (4.4) | os.Root symlink traversal on Unix |
Go 1.26.5 |
Request
Please bump the go directive in temporalio/ui-server go.mod to >= 1.26.5 and cut a new release.
References:
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with temporalio/ui-server's go.mod and check the current go 1.26.3 directive. Update it to >= 1.26.5, verify the ui-server build, and follow the project's release steps so a new release includes the patched Go standard library.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- release, security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Quiet
- Clarity
- Clearly specified
- Newbie friendliness
- 68/100