fix: upgrade Go toolchain to 1.27.2 for GO-2026-6607-stdlib

Merged
CH
2d ago
+4-4

Summary

Upgraded the repository Go toolchain pin and goreleaser builder images from 1.27.1 to 1.27.2 so builds use the patched stdlib release that fixes the crypto/tls ECH parsing denial-of-service issue.

Vulnerability Fixed

GO-2026-6607-stdlib (HIGH): malformed TLS ClientHello messages with multiple ECH outer extension references could trigger memory exhaustion in Go's crypto/tls server-side parser.

Changes Made

  • Updated go.mod from go 1.27.1 to go 1.27.2 so the repository targets the patched Go stdlib release.
  • Updated goreleaser builder images in app/controlplane/Dockerfile.goreleaser, app/artifact-cas/Dockerfile.goreleaser, and app/cli/Dockerfile.goreleaser from golang:1.27.1 to the pinned golang:1.27.2@sha256:2d658507a011f1eadc0114d7a421b312b2e77d9042a24036a26e267cc9231677 image.
  • Kept the fix scoped to version pins only; no application code changes were required for this stdlib vulnerability.

Verification

Ran syft dir:. -o cyclonedx-json=sbom.json && grype sbom:sbom.json --only-fixed -o json against the patched repository. Outcome: resolved — grype no longer reports GO-2026-6607-stdlib in the generated SBOM for repo/.

Risk Assessment

View the risk assessment in Chainloop