GHSA-h5fq-653g-gxrm

Source

https://github.com/advisories/GHSA-h5fq-653g-gxrm

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-h5fq-653g-gxrm/GHSA-h5fq-653g-gxrm.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-h5fq-653g-gxrm

Aliases

GO-2026-5413

Published

2026-05-05T17:20:36Z

Modified

2026-07-21T14:49:20Z

Severity

5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVSS Calculator

Summary

ots has a negative expire override that can bypass its secret retention policy

Details

Summary

The /api/create endpoint accepted negative expire query values. For the memory storage backend, negative values were passed to secret creation as a negative duration and treated as no expiry, allowing callers to create secrets that persisted longer than intended.

Impact

Unauthenticated users could bypass configured retention expectations for secrets they create by sending POST /api/create?expire=-1.

This does not allow reading or modifying secrets created by other users. Secrets remain one-time-read and, in the normal web flow, client-side encrypted.

Affected versions

Versions up to and including v1.21.4 are affected.

Patched versions

Fixed in v1.21.5.

Workarounds

Disable expiry overrides via disableExpiryOverride: true until upgrading.

Credit

Reported by Chai Cheng Xun via email.

Database specific

{
    "cwe_ids":  [
        "CWE-20"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-05-05T17:20:36Z",
    "nvd_published_at":  null,
    "severity":  "MODERATE"
}

References

Affected packages

Go / github.com/Luzifer/ots

Package

Name: github.com/Luzifer/ots; View open source insights on deps.dev
Purl: pkg:golang/github.com/Luzifer/ots

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.21.5

Database specific

last_known_affected_version_range

"<= 1.21.4"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-h5fq-653g-gxrm/GHSA-h5fq-653g-gxrm.json"