Re: [OE-core][scarthgap][PATCH 1/2] go: Fix CVE-2026-33814

[Paul Barker <paul@pbarker.dev>]

On Mon, 2026-10-19 at 09:52 +0000, Hetvi Thakar -X (hthakar - E
INFOCHIPS PRIVATE LIMITED at Cisco) wrote:
> Hi Paul, Yoann,
> 
> Thanks for the review.
> 
> The go.mod, go.sum, and vendor/modules.txt changes are not required for this Go 1.22 backport, as the upstream Go 1.25 commit updates the entire x/net dependency to revision a9171bc8 [1].
> 
> For Go 1.22, the required security fix is applied directly to src/net/http/h2_bundle.go [2]. The fix addresses the infinite CONTINUATION frame loop described in the CVE.
> 
> Updating only the dependency metadata without updating the complete vendored x/net source would be inconsistent. Since this is a focused security backport, the dependency update is not needed.
> 
> The additional validation-related change in the upstream commit is not applicable to Go 1.22, as the corresponding code is not present in this version [2].
> 
> References:
> [1] https://go.googlesource.com/net/+/a9171bc8c6f19c50efad8880f96e361359ed5307%5E%21/
> [2] https://github.com/golang/go/blob/go1.22.12/src/net/http/h2_bundle.go

Hi Hetvi,

If you've checked this and you're confident that the go.mod/go.sum
changes are not needed then this patch can go ahead.

Best regards,

-- 
Paul Barker