Repository navigation
src/compiler: Go 1.24.3 in go.mod ships 29+ known HIGH CVEs into the released Python wheel #1237
Description
src/compiler/go.mod pins Go 1.24.3. When the Python wheel is built, the
compiler backend binary compiled from this module is shipped inside the
frida PyPI package as:
usr/local/lib/python3.13/site-packages/frida/_frida.abi3.so
Trivy's gobinary scanner detects the embedded Go stdlib version and flags
29 known CVEs (1 CRITICAL, 28 HIGH) against Go 1.24.3. This is breaking
security-gated CI/CD pipelines for any downstream user running container
image scanning (Trivy, Grype, etc.) on images that include the frida
Python package.
Affected file
https://github.com/frida/frida-core/blob/main/src/compiler/go.mod
Line 3:
go 1.24.3
CVEs triggered (all stdlib in the embedded Go binary)
The full set of CVEs that currently fire against v1.24.3:
| CVE | Severity | Component | Fixed in Go |
|---|---|---|---|
| CVE-2025-68121 | CRITICAL | crypto/tls session resumption | 1.24.13 / 1.25.7 |
| CVE-2025-22874 | HIGH | crypto/x509 ExtKeyUsageAny | 1.24.4 |
| CVE-2025-47906 | HIGH | PATH env variable bypass | 1.24.6 |
| CVE-2025-47907 | HIGH | database/sql Postgres Scan race | 1.24.6 |
| CVE-2025-47912 | HIGH | net/netip Parse non-IPv6 | 1.24.8 |
| CVE-2025-58183 | HIGH | archive/tar allocation DoS | 1.24.8 |
| CVE-2025-58185 | HIGH | crypto/x509 DER allocation DoS | 1.24.8 |
| CVE-2025-58186 | HIGH | net/http headers count bypass | 1.24.8 |
| CVE-2025-58187 | HIGH | crypto/x509 name constraint DoS | 1.24.9 |
| CVE-2025-58188 | HIGH | crypto/x509 DSA key hang | 1.24.8 |
| CVE-2025-58189 | HIGH | crypto/tls ALPN info disclosure | 1.24.8 |
| CVE-2025-61723 | HIGH | net non-linear parsing DoS | 1.24.12 |
| CVE-2025-61724 | HIGH | net/textproto response DoS | 1.24.12 |
| CVE-2025-61725 | HIGH | net/mail ParseAddress DoS | 1.24.12 |
| CVE-2025-61726 | HIGH | net/url memory exhaustion | 1.24.12 |
| CVE-2025-61727 | HIGH | crypto/x509 subdomain bypass | 1.24.11 |
| CVE-2025-61728 | HIGH | archive/zip CPU DoS | 1.24.12 |
| CVE-2025-61729 | HIGH | crypto/x509 cert DoS | 1.24.11 |
| CVE-2026-25679 | HIGH | net/url IPv6 host literal | 1.25.8 / 1.26.1 |
| CVE-2026-32280 | HIGH | crypto/x509 chain building DoS | 1.25.9 / 1.26.2 |
| CVE-2026-32281 | HIGH | crypto/x509 chain validation DoS | 1.25.9 / 1.26.2 |
| CVE-2026-32283 | HIGH | crypto/tls TLS 1.3 key DoS | 1.25.9 / 1.26.2 |
| CVE-2026-33811 | HIGH | net LookupCNAME DoS | 1.25.10 / 1.26.3 |
| CVE-2026-33814 | HIGH | net/http HTTP/2 SETTINGS loop | 1.25.10 / 1.26.3 |
| CVE-2026-39820 | HIGH | net/mail ParseAddressList DoS | 1.25.10 / 1.26.3 |
| CVE-2026-39823 | HIGH | net/url URL validation bypass | 1.25.10 / 1.26.3 |
| CVE-2026-39825 | HIGH | net/http ReverseProxy param forward | 1.25.10 / 1.26.3 |
| CVE-2026-39826 | HIGH | html/template script tag injection | 1.25.10 / 1.26.3 |
| CVE-2026-39836 | HIGH | net Dial/LookupPort NUL panic | 1.25.10 / 1.26.3 |
| CVE-2026-42499 | HIGH | net/mail consumePhrase DoS | 1.25.10 / 1.26.3 |
Minimum fix
Bumping the go directive in src/compiler/go.mod to Go 1.25.10 (or
any later version) and releasing a new wheel would clear all 30 CVEs listed
above for downstream users.
The fix is one line:
-go 1.24.3
+go 1.25.10
(Plus running go mod tidy and rebuilding the wheel.)
Impact on downstream users
Any project that:
- Installs the
fridaPython package into a container image - Runs a container image vulnerability scanner (Trivy, Grype, Snyk, etc.)
...will fail their security gate with 30 HIGH/CRITICAL findings, all
pointing to the same root cause. Users currently have no mitigation other
than adding per-CVE suppression rules to their scanner config, which
requires updating after every new Go CVE batch (happening weekly as of
May 2026).
Notes
- The Go binary in
_frida.abi3.sodoes not appear to use the
affected code paths (TLS, reverse proxy, templates) at runtime in
typical APK-analysis usage. The risk is low in practice, but scanner
tooling has no way to know that, and the CVEs block CI pipelines. - Frida 17.9.7 release notes mention "compiler Go backend updates" —
so Go version bumps in this module have shipped before. This is
asking for the same. - Confirmed against frida 17.9.11 (latest as of 2026-05-27).
Activity