fix: upgrade Go toolchain to 1.27.2 for GO-2026-6608-stdlib

Closed
CH
1d ago
+4-4

Summary

Bumped the repository Go toolchain declarations and release builder image pins from 1.27.1 to 1.27.2 so Chainloop no longer builds against the vulnerable stdlib release.

Vulnerability Fixed

GO-2026-6608-stdlib, HIGH: parsing a multipart form can bypass memory limits and read an arbitrarily long line into memory when the remaining limit at the start of a part is less than 400 bytes.

Changes Made

  • Updated go.mod from go 1.27.1 to go 1.27.2 so the main module targets the patched Go release.
  • Updated the Go builder image pins in app/controlplane/Dockerfile.goreleaser, app/cli/Dockerfile.goreleaser, and app/artifact-cas/Dockerfile.goreleaser from golang:1.27.1@sha256:1e93e00a31255c07e9a34c4207f3006e1501730c5323697cee7dfb827fdae44c to golang:1.27.2@sha256:007a316059246276cb214df93950be77837545dc78007a73e0291a4963d5d3bf so release builds use the patched stdlib.

Verification

Ran grype golang:1.27.2@sha256:007a316059246276cb214df93950be77837545dc78007a73e0291a4963d5d3bf --only-fixed -o json against the updated builder image digest and confirmed GO-2026-6608 / CVE-2026-94440 are absent; the scan returned zero matches. Also ran syft dir:. -o cyclonedx-json=sbom.json && grype sbom:sbom.json --only-fixed -o json in the patched repository, and the target advisory was not reported there either. Outcome: resolved.

Risk Assessment

View the risk assessment in Chainloop