Vulnerable x/net and MongoDB Go dependencies #1199

Summary

Our security scanner reports vulnerabilities in golang.org/x/net and go.mongodb.org/mongo-driver/v2 in our deployed Outpost Docker image.

The inspected repository checkout includes these indirect dependencies:

• golang.org/x/net v0.60.0; scanner recommends v0.62.0
• go.mongodb.org/mongo-driver/v2 v2.8.0; scanner recommends v2.9.0

These findings concern HTML parsing/rendering and BSON value-length validation. Their presence in the dependency list does not by itself establish exploitability in Outpost.

Affected image

• Source versions observed in the inspected checkout:
  • golang.org/x/net v0.60.0
  • go.mongodb.org/mongo-driver/v2 v2.8.0

Scanner findings

golang.org/x/net

Scanner summary:

golang.org/x/net is affected by 2 unique vulnerabilities. 1 is high and 1 is medium.

In order to fix all of these vulnerabilities, update golang.org/x/net to 0.62.0.

golang.org/x/net v0.62.0 fixes two issues in golang.org/x/net/html:

• CVE-2026-78661 / GO-2026-6860: Crafted HTML containing repeated short text runs can cause quadratic allocations and copying during parsing, potentially causing denial of service. Affects Parse, ParseFragment and their options variants.
• CVE-2026-97045 / GO-2026-6866: Incorrect handling of ancestor namespace transitions in Render can produce output that is interpreted differently when parsed again, potentially enabling cross-site scripting.

Both affect versions before v0.62.0.

References:

• GO-2026-6860
• GO-2026-6866

go.mongodb.org/mongo-driver/v2

The scanner reports an integer overflow in BSON value-length handling:

• CVE-2026-107324
• GHSA-xhx9-594p-jcqq
• Affected v2 versions: before v2.9.0
• Fixed version: v2.9.0

When processing a malformed BSON value, valueLength() adds fixed overhead to an attacker-controlled length using an int32. The result can overflow to a negative number, pass a bounds check, and cause a slice-bounds panic.

An application that validates or accesses attacker-controlled BSON through an affected path can panic. Without recovery, this can terminate the process and cause denial of service.

References:

• MongoDB security advisory
• Upstream fix

Requested fix

• Update golang.org/x/net to v0.62.0 or later.
• Update go.mongodb.org/mongo-driver/v2 to at least v2.9.0 for the reported BSON overflow.
• Prefer MongoDB driver v2.9.2 or later to also cover the separately disclosed BSON array-validation vulnerability.