Security: Vulnerability remediation request for Go dependencies and Go runtime (x/crypto, x/net,   x/sys, stdlib)

Summary

Multiple known vulnerabilities have been detected in Go dependencies and the Go runtime (stdlib) in the vuls/vuls Docker image (v0.39.2). We have confirmed that these issues are not resolved in v0.39.3 either, and would like to request an update to fixed versions.

Affected Packages and Fixed Versions

Package	Fixed Version
golang.org/x/crypto	v0.52.0 or later
golang.org/x/net	v0.55.0 or later
go/stdlib	Go 1.26.4 or later
golang.org/x/sys	v0.44.0 or later

Status in v0.39.3

We have confirmed that the above Go-related vulnerabilities remain unresolved in v0.39.3.

Related PRs

The following existing PRs appear to update golang.org/x/crypto, golang.org/x/net, and golang.org/x/sys, but we leave the approach to your discretion.

• https://github.com/future-architect/vuls/pull/2573   - golang.org/x/crypto v0.52.0   - golang.org/x/sys v0.45.0
• https://github.com/future-architect/vuls/pull/2575   - golang.org/x/net v0.55.0   - golang.org/x/sys v0.45.0
• https://github.com/future-architect/vuls/pull/2569   - golang.org/x/sys v0.44.0

Remaining Item

The go/stdlib vulnerability is not addressed by the above PRs and requires updating the Go toolchain itself to 1.26.4 or later.

Request

1. Update Go dependencies (x/crypto, x/net, x/sys) — via the existing PRs or otherwise
2. Update the Go toolchain to 1.26.4 or later (to resolve go/stdlib)
3. Release a new version that includes the above fixes

We would greatly appreciate your attention to this matter.

Detection Environment

• Image: vuls/vuls
• Platform: Alpine Linux 3.22
• Detection Tool: Amazon Inspector