fix: upgrade Go toolchain to 1.27.2 to resolve GO-2026-6603-stdlib
Closed
CH
2d ago+0+0+0123456789-0-0-0123456789
Summary
Upgraded the root module Go toolchain from 1.27.1 to 1.27.2 so builds use the first patched stdlib release for GO-2026-6603-stdlib. This removes the vulnerable net/http HTTP/2 server implementation from the project toolchain while keeping the change scoped to the root manifest.
Vulnerability Fixed
GO-2026-6603-stdlib (HIGH): When a Go net/http HTTP/2 server processes a client Trailer header declaring many fields, it can allocate disproportionate memory and bypass normal header limits, enabling denial of service.
Changes Made
- Updated
go.modfromgo 1.27.1togo 1.27.2, matching the first patched Go stdlib release identified in the assessment. - Kept the remediation limited to the root module toolchain declaration so downstream dependency state and application behavior remain unchanged apart from the patched stdlib version.
Verification
Ran syft dir:. -o cyclonedx-json=sbom.json && grype sbom:sbom.json --only-fixed -o json against the patched repository root. Outcome: resolved — grype confirms GO-2026-6603-stdlib is no longer present in the generated SBOM for the patched source tree.