Fix 21 CVEs (CVE-2026-34986, CVE-2026-39828, CVE-2026-39829, ...)

[oadp-rebasebot-app]

CVE Fixes

Automated scan remediated 21 of 21 fixable Go dependency CVE(s) in migtools/kopia on branch oadp-1.5.

CVE	Severity	Package	Fixed Version	Description
CVE-2026-34986	HIGH	github.com/go-jose/go-jose/v4	4.1.4	github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object
CVE-2026-39828	HIGH	golang.org/x/crypto	0.55.0	golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Unauthorized command execution via discarded SSH permissions
CVE-2026-39829	HIGH	golang.org/x/crypto	0.55.0	golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters
CVE-2026-39830	HIGH	golang.org/x/crypto	0.55.0	golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses
CVE-2026-39831	HIGH	golang.org/x/crypto	0.55.0	golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Security key bypass due to missing user presence check
CVE-2026-39832	HIGH	golang.org/x/crypto	0.55.0	golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to improper handling of key restrictions
CVE-2026-39835	HIGH	golang.org/x/crypto	0.55.0	golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate
CVE-2026-42508	HIGH	golang.org/x/crypto	0.55.0	golang.org/x/crypto/ssh/knownhosts: golang: golang.org/x/crypto/ssh/knownhosts: Revocation bypass via unchecked SignatureKey
CVE-2026-46595	HIGH	golang.org/x/crypto	0.55.0	golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Authorization bypass due to skipped source-address validation
CVE-2026-46597	HIGH	golang.org/x/crypto	0.55.0	golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted AES-GCM packet decoder inputs
CVE-2026-56854	CRITICAL	golang.org/x/crypto	0.55.0	golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Authentication bypass due to unenforced source-address restrictions
CVE-2026-56864	HIGH	golang.org/x/mod	0.40.0	A malicious GOSUMDB was capable of serving arbitrary module content no ...
CVE-2026-56865	HIGH	golang.org/x/mod	0.40.0	golang.org/x/mod/sumdb/tlog: golang.org/x/mod/sumdb/tlog: Supply chain compromise via transparency log tile verification bypass
CVE-2026-25681	HIGH	golang.org/x/net	0.57.0	golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting
CVE-2026-27136	HIGH	golang.org/x/net	0.57.0	golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass
CVE-2026-33814	HIGH	golang.org/x/net	0.57.0	net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame
CVE-2026-39821	HIGH	golang.org/x/net	0.57.0	golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing
CVE-2026-46600	HIGH	golang.org/x/net	0.57.0	golang.org/x/net/dns/dnsmessage: golang.org/x/net/dns/dnsmessage: Denial of Service via invalid DNS record parsing
CVE-2026-56852	HIGH	golang.org/x/text	0.41.0	golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input
CVE-2026-84304	HIGH	google.golang.org/grpc	1.83.1	gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, in ...
GHSA-hrxh-6v49-42gf	HIGH	google.golang.org/grpc	1.83.1	gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities

How this was fixed

• One go get for all vulnerable dependencies, using the highest reported fixed version per package
• go mod tidy to clean up

---

Generated by cve-scan pipeline

[openshift-ci]

Hi @oadp-rebasebot-app[bot]. Thanks for your PR.

I'm waiting for a migtools member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[oadp-snyk]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

✅ All modified and coverable lines are covered by tests.
⚠️ Please upload report for BASE (oadp-1.5@6a146e0). Learn more about missing BASE report.
❗ Your organization needs to install the Codecov GitHub app to enable full functionality.

Additional details and impacted files

@@             Coverage Diff             @@
##             oadp-1.5      #52   +/-   ##
===========================================
  Coverage            ?   77.57%           
===========================================
  Files               ?      527           
  Lines               ?    30398           
  Branches            ?        0           
===========================================
  Hits                ?    23580           
  Misses              ?     4802           
  Partials            ?     2016           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[Joeavaikath]

/ok-to-test

[shubham-pampattiwar]

/lgtm

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: Joeavaikath, oadp-rebasebot-app[bot], shubham-pampattiwar

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [Joeavaikath,shubham-pampattiwar]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment