hit CVEs in contour image with version 1.30.5 #7276
Description
What steps did you take and what happened:
[A clear and concise description of what the bug is.]
ghcr.io/projectcontour/contour:v1.30.5
hit CVEs in 1.30.5 version due to use golang 1.24.6
What did you expect to happen:
We should upgrade golang to 1.24.8 or higher version
Anything else you would like to add:
[Miscellaneous information that will assist in solving the issue.]
"CVE-2025-47912": {
"excepted": false,
"scanners": [
{
"type": "https://github.com/aquasecurity/trivy",
"severity": "high",
"description": "The Parse function permits values other than IPv6 addresses to be included in square brackets within the host component of a URL. RFC 3986 permits IPv6 addresses to be included within the host component, enclosed within square brackets. For example: "http://[::1]/". IPv4 addresses and hostnames must not appear within square brackets. Parse did not enforce this requirement.",
"package": "pkg:golang/[email protected]",
"paths": [
"bin/contour",
"github.com/projectcontour/contour"
],
"currentVersion": "v1.24.6"
}
],
"publishedDate": "2025-10-29T23:16:18+00:00",
"recommendation": "Upgrade stdlib to version 1.24.8, 1.25.2"
},
"CVE-2025-58183": {
"excepted": false,
"scanners": [
{
"type": "https://github.com/aquasecurity/trivy",
"severity": "high",
"description": "tar.Reader does not set a maximum size on the number of sparse region data blocks in GNU tar pax 1.0 sparse files. A maliciously-crafted archive containing a large number of sparse regions can cause a Reader to read an unbounded amount of data from the archive into memory. When reading from a compressed source, a small compressed input can result in large allocations.",
"package": "pkg:golang/[email protected]",
"paths": [
"bin/contour",
"github.com/projectcontour/contour"
],
"currentVersion": "v1.24.6"
}
],
"publishedDate": "2025-10-29T23:16:19+00:00",
"recommendation": "Upgrade stdlib to version 1.24.8, 1.25.2"
},
"CVE-2025-58185": {
"excepted": false,
"scanners": [
{
"type": "https://github.com/aquasecurity/trivy",
"severity": "high",
"description": "Parsing a maliciously crafted DER payload could allocate large amounts of memory, causing memory exhaustion.",
"package": "pkg:golang/[email protected]",
"paths": [
"bin/contour",
"github.com/projectcontour/contour"
],
"currentVersion": "v1.24.6"
}
],
"publishedDate": "2025-10-29T23:16:19+00:00",
"recommendation": "Upgrade stdlib to version 1.24.8, 1.25.2"
},
"CVE-2025-58186": {
"excepted": false,
"scanners": [
{
"type": "https://github.com/aquasecurity/trivy",
"severity": "high",
"description": "Despite HTTP headers having a default limit of 1MB, the number of cookies that can be parsed does not have a limit. By sending a lot of very small cookies such as "a=;", an attacker can make an HTTP server allocate a large amount of structs, causing large memory consumption.",
"package": "pkg:golang/[email protected]",
"paths": [
"bin/contour",
"github.com/projectcontour/contour"
],
"currentVersion": "v1.24.6"
}
],
"publishedDate": "2025-10-29T23:16:19+00:00",
"recommendation": "Upgrade stdlib to version 1.24.8, 1.25.2"
},
"CVE-2025-58187": {
"excepted": false,
"scanners": [
{
"type": "https://github.com/aquasecurity/trivy",
"severity": "high",
"description": "Due to the design of the name constraint checking algorithm, the processing time of some inputs scals non-linearly with respect to the size of the certificate. This affects programs which validate arbitrary certificate chains.",
"package": "pkg:golang/[email protected]",
"paths": [
"bin/contour",
"github.com/projectcontour/contour"
],
"currentVersion": "v1.24.6"
}
],
"publishedDate": "2025-10-29T23:16:19+00:00",
"recommendation": "Upgrade stdlib to version 1.24.9, 1.25.3"
},
"CVE-2025-58188": {
"excepted": false,
"scanners": [
{
"type": "https://github.com/aquasecurity/trivy",
"severity": "high",
"description": "Validating certificate chains which contain DSA public keys can cause programs to panic, due to a interface cast that assumes they implement the Equal method. This affects programs which validate arbitrary certificate chains.",
"package": "pkg:golang/[email protected]",
"paths": [
"bin/contour",
"github.com/projectcontour/contour"
],
"currentVersion": "v1.24.6"
}
],
"publishedDate": "2025-10-29T23:16:19+00:00",
"recommendation": "Upgrade stdlib to version 1.24.8, 1.25.2"
},
"CVE-2025-58189": {
"excepted": false,
"scanners": [
{
"type": "https://github.com/aquasecurity/trivy",
"severity": "high",
"description": "When Conn.Handshake fails during ALPN negotiation the error contains attacker controlled information (the ALPN protocols sent by the client) which is not escaped.",
"package": "pkg:golang/[email protected]",
"paths": [
"bin/contour",
"github.com/projectcontour/contour"
],
"currentVersion": "v1.24.6"
}
],
"publishedDate": "2025-10-29T23:16:19+00:00",
"recommendation": "Upgrade stdlib to version 1.24.8, 1.25.2"
},
"CVE-2025-61723": {
"excepted": false,
"scanners": [
{
"type": "https://github.com/aquasecurity/trivy",
"severity": "high",
"description": "The processing time for parsing some invalid inputs scales non-linearly with respect to the size of the input. This affects programs which parse untrusted PEM inputs.",
"package": "pkg:golang/[email protected]",
"paths": [
"bin/contour",
"github.com/projectcontour/contour"
],
"currentVersion": "v1.24.6"
}
],
"publishedDate": "2025-10-29T23:16:19+00:00",
"recommendation": "Upgrade stdlib to version 1.24.8, 1.25.2"
},
"CVE-2025-61724": {
"excepted": false,
"scanners": [
{
"type": "https://github.com/aquasecurity/trivy",
"severity": "high",
"description": "The Reader.ReadResponse function constructs a response string through repeated string concatenation of lines. When the number of lines in a response is large, this can cause excessive CPU consumption.",
"package": "pkg:golang/[email protected]",
"paths": [
"bin/contour",
"github.com/projectcontour/contour"
],
"currentVersion": "v1.24.6"
}
],
"publishedDate": "2025-10-29T23:16:20+00:00",
"recommendation": "Upgrade stdlib to version 1.24.8, 1.25.2"
},
"CVE-2025-61725": {
"excepted": false,
"scanners": [
{
"type": "https://github.com/aquasecurity/trivy",
"severity": "high",
"description": "The ParseAddress function constructeds domain-literal address components through repeated string concatenation. When parsing large domain-literal components, this can cause excessive CPU consumption.",
"package": "pkg:golang/[email protected]",
"paths": [
"bin/contour",
"github.com/projectcontour/contour"
],
"currentVersion": "v1.24.6"
}
],
"publishedDate": "2025-10-29T23:16:20+00:00",
"recommendation": "Upgrade stdlib to version 1.24.8, 1.25.2"
}
Environment:
- Contour version:
- Kubernetes version: (use
kubectl version): - Kubernetes installer & version:
- Cloud provider or hardware configuration:
- OS (e.g. from
/etc/os-release):