GHSA-4c5f-9mj4-m247

Source

https://github.com/advisories/GHSA-4c5f-9mj4-m247

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/01/GHSA-4c5f-9mj4-m247/GHSA-4c5f-9mj4-m247.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-4c5f-9mj4-m247

Aliases

GO-2026-4279

Published

2026-01-05T15:07:05Z

Modified

2026-02-03T03:14:08Z

Summary

flagd: Multiple Go Runtime CVEs Impact Security and Availability

Details

Summary

In 2025, several vulnerabilities in the Go Standard Library were disclosed, impacting Go-based applications like flagd (the evaluation engine for OpenFeature). These CVEs primarily focus on Denial of Service (DoS) through resource exhaustion and Race Conditions in database handling.

CVE ID	Impacted Package	Severity	Description & Impact on flagd
CVE-2025-47907	database/sql	7.0 (High)	Race Condition: Canceling a query during a Scan call can return data from the wrong query. Critical if flagd uses SQL-based sync providers (e.g., Postgres), potentially leading to incorrect flag configurations.
CVE-2025-61725	net/mail	7.5 (High)	DoS: Inefficient complexity in ParseAddress. Attackers can provide crafted email strings with large domain literals to exhaust CPU if flagd parses email-formatted metadata.
CVE-2025-61723	encoding/pem	7.5 (High)	DoS: Quadratic complexity when parsing invalid PEM inputs. Relevant if flagd loads TLS certificates or keys via PEM files from untrusted sources.
CVE-2025-61729	crypto/x509	7.5 (High)	Resource Exhaustion: HostnameError.Error() lacks string concatenation limits. A malicious TLS certificate with thousands of hostnames could crash flagd during connection handshakes.
CVE-2025-58188	net/http	Medium	Request Smuggling: Improper header handling in HTTP/1.1. Could allow attackers to bypass security filters positioned in front of flagd sync or evaluation APIs.
CVE-2025-58187	archive/zip	Medium	DoS: Improper validation of malformed ZIP archives. Impacts flagd if configured to fetch and unpack zipped configuration bundles from remote providers.

Database specific

{
    "cwe_ids": [
        "CWE-20",
        "CWE-362",
        "CWE-400",
        "CWE-407",
        "CWE-444",
        "CWE-770"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-01-05T15:07:05Z",
    "nvd_published_at": null,
    "severity": "HIGH"
}

References

Affected packages

github.com/open-feature/flagd/core

Package

Name: github.com/open-feature/flagd/core; View open source insights on deps.dev
Purl: pkg:golang/github.com/open-feature/flagd/core

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

0.13.1

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/01/GHSA-4c5f-9mj4-m247/GHSA-4c5f-9mj4-m247.json"

github.com/open-feature/flagd/flagd-proxy

Package

Name: github.com/open-feature/flagd/flagd-proxy; View open source insights on deps.dev
Purl: pkg:golang/github.com/open-feature/flagd/flagd-proxy

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

0.8.2

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/01/GHSA-4c5f-9mj4-m247/GHSA-4c5f-9mj4-m247.json"

github.com/open-feature/flagd/flagd

Package

Name: github.com/open-feature/flagd/flagd; View open source insights on deps.dev
Purl: pkg:golang/github.com/open-feature/flagd/flagd

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

0.13.1

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/01/GHSA-4c5f-9mj4-m247/GHSA-4c5f-9mj4-m247.json"