Tyk v5.11.0 CVEs

[Kle0s]

I scanned tyk 5.11.0 with Snyk and it produced the following results (I filter for high / critical severity vulnerabilities):

✗ High severity vulnerability found on golang.org/x/net/html@0.42.0
- desc: Inefficient Algorithmic Complexity
- info: https://snyk.io/vuln/SNYK-GOLANG-GOLANGORGXNETHTML-15237516
- from: github.com/TykTechnologies/tyk@0.0.0 > golang.org/x/net/html/charset@0.42.0 > golang.org/x/net/html@0.42.0


✗ High severity vulnerability found on golang.org/x/net/html@0.42.0
- desc: Infinite loop
- info: https://snyk.io/vuln/SNYK-GOLANG-GOLANGORGXNETHTML-15237740
- from: github.com/TykTechnologies/tyk@0.0.0 > golang.org/x/net/html/charset@0.42.0 > golang.org/x/net/html@0.42.0


✗ High severity vulnerability found on golang.org/x/net/html@0.42.0
- desc: Inefficient Algorithmic Complexity
- info: https://snyk.io/vuln/SNYK-GOLANG-GOLANGORGXNETHTML-15237516
- from: github.com/TykTechnologies/tyk@0.0.0 > gopkg.in/xmlpath.v2@#860cbeca3ebc > golang.org/x/net/html@0.42.0


✗ High severity vulnerability found on golang.org/x/net/html@0.42.0
- desc: Infinite loop
- info: https://snyk.io/vuln/SNYK-GOLANG-GOLANGORGXNETHTML-15237740
- from: github.com/TykTechnologies/tyk@0.0.0 > gopkg.in/xmlpath.v2@#860cbeca3ebc > golang.org/x/net/html@0.42.0


✗ High severity vulnerability found on golang.org/x/net/html@0.42.0
- desc: Inefficient Algorithmic Complexity
- info: https://snyk.io/vuln/SNYK-GOLANG-GOLANGORGXNETHTML-15237516
- from: github.com/TykTechnologies/tyk@0.0.0 > github.com/warpstreamlabs/bento/public/components/all@1.7.1 > github.com/warpstreamlabs/bento/public/components/pure/extended@1.7.1 > github.com/warpstreamlabs/bento/internal/impl/xml@1.7.1 > golang.org/x/net/html/charset@0.42.0 > golang.org/x/net/html@0.42.0


✗ High severity vulnerability found on golang.org/x/net/html@0.42.0
- desc: Infinite loop
- info: https://snyk.io/vuln/SNYK-GOLANG-GOLANGORGXNETHTML-15237740
- from: github.com/TykTechnologies/tyk@0.0.0 > github.com/warpstreamlabs/bento/public/components/all@1.7.1 > github.com/warpstreamlabs/bento/public/components/pure/extended@1.7.1 > github.com/warpstreamlabs/bento/internal/impl/xml@1.7.1 > golang.org/x/net/html/charset@0.42.0 > golang.org/x/net/html@0.42.0


✗ High severity vulnerability found on golang.org/x/net/html@0.42.0
- desc: Inefficient Algorithmic Complexity
- info: https://snyk.io/vuln/SNYK-GOLANG-GOOPENTELEMETRYIOOTELSDKRESOURCE-15182758
- from: github.com/TykTechnologies/tyk@0.0.0 > github.com/warpstreamlabs/bento/public/components/all@1.7.1 > github.com/warpstreamlabs/bento/public/components/otlp@1.7.1 > github.com/warpstreamlabs/bento/internal/impl/otlp@1.7.1 > go.opentelemetry.io/otel/sdk/trace@1.35.0 > go.opentelemetry.io/otel/sdk/resource@1.35.0


✗ High severity vulnerability found on go.opentelemetry.io/otel/sdk/resource@1.35.0
- desc: Untrusted Search Path
- info: https://snyk.io/vuln/SNYK-GOLANG-GOOPENTELEMETRYIOOTELSDKRESOURCE-15182758
- from: github.com/TykTechnologies/tyk@0.0.0 > github.com/warpstreamlabs/bento/public/components/all@1.7.1 > github.com/warpstreamlabs/bento/public/components/jaeger@1.7.1 > github.com/warpstreamlabs/bento/internal/impl/jaeger@1.7.1 > go.opentelemetry.io/otel/exporters/jaeger@1.17.0 > go.opentelemetry.io/otel/sdk/resource@1.35.0


✗ High severity vulnerability found on go.opentelemetry.io/otel/sdk/resource@1.35.0
- desc: Untrusted Search Path
- info: https://snyk.io/vuln/SNYK-GOLANG-GOOPENTELEMETRYIOOTELSDKRESOURCE-15182758
- from: github.com/TykTechnologies/tyk@0.0.0 > github.com/TykTechnologies/opentelemetry/trace@0.0.22 > go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@1.23.1 > go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/internal/otlpconfig@1.23.1 > go.opentelemetry.io/otel/exporters/otlp/otlptrace@1.23.1 > go.opentelemetry.io/otel/exporters/otlp/otlptrace/internal/tracetransform@1.23.1 > go.opentelemetry.io/otel/sdk/resource@1.35.0


✗ High severity vulnerability found on go.opentelemetry.io/otel/sdk/resource@1.35.0
- desc: Untrusted Search Path
- info: https://snyk.io/vuln/SNYK-GOLANG-GOOPENTELEMETRYIOOTELSDKRESOURCE-15182758
- from: github.com/TykTechnologies/tyk@0.0.0 > github.com/warpstreamlabs/bento/public/components/all@1.7.1 > github.com/warpstreamlabs/bento/public/components/sql@1.7.1 > github.com/googleapis/go-sql-spanner@1.7.4 > cloud.google.com/go/spanner@1.71.0 > go.opentelemetry.io/contrib/detectors/gcp@1.32.0 > go.opentelemetry.io/otel/sdk/resource@1.35.0


✗ High severity vulnerability found on go.opentelemetry.io/otel/sdk/resource@1.35.0
- desc: Untrusted Search Path
- info: https://snyk.io/vuln/SNYK-GOLANG-GOOPENTELEMETRYIOOTELSDKRESOURCE-15182758
- from: github.com/TykTechnologies/tyk@0.0.0 > github.com/warpstreamlabs/bento/public/components/all@1.7.1 > github.com/warpstreamlabs/bento/public/components/sql@1.7.1 > github.com/googleapis/go-sql-spanner@1.7.4 > cloud.google.com/go/spanner@1.71.0 > go.opentelemetry.io/otel/sdk/metric@1.32.0 > go.opentelemetry.io/otel/sdk/resource@1.35.0


✗ High severity vulnerability found on go.opentelemetry.io/otel/sdk/resource@1.35.0
- desc: Untrusted Search Path
- info: https://snyk.io/vuln/SNYK-GOLANG-GOOPENTELEMETRYIOOTELSDKRESOURCE-15182758
- from: github.com/TykTechnologies/tyk@0.0.0 > github.com/warpstreamlabs/bento/public/components/all@1.7.1 > github.com/warpstreamlabs/bento/public/components/sql@1.7.1 > github.com/googleapis/go-sql-spanner@1.7.4 > cloud.google.com/go/spanner@1.71.0 > go.opentelemetry.io/otel/sdk/metric/metricdata@1.32.0 > go.opentelemetry.io/otel/sdk/resource@1.35.0


✗ High severity vulnerability found on go.opentelemetry.io/otel/sdk/resource@1.35.0
- desc: Untrusted Search Path
- info: https://snyk.io/vuln/SNYK-GOLANG-GOOPENTELEMETRYIOOTELSDKRESOURCE-15182758
- from: github.com/TykTechnologies/tyk@0.0.0 > github.com/TykTechnologies/opentelemetry/semconv/v1.0.0@0.0.22 > github.com/TykTechnologies/opentelemetry/trace@0.0.22 > go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@1.23.1 > go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/internal/otlpconfig@1.23.1 > go.opentelemetry.io/otel/exporters/otlp/otlptrace@1.23.1 > go.opentelemetry.io/otel/exporters/otlp/otlptrace/internal/tracetransform@1.23.1 > go.opentelemetry.io/otel/sdk/resource@1.35.0


✗ High severity vulnerability found on go.opentelemetry.io/otel/sdk/resource@1.35.0
- desc: Untrusted Search Path
- info: https://snyk.io/vuln/SNYK-GOLANG-GOOPENTELEMETRYIOOTELSDKRESOURCE-15182758
- from: github.com/TykTechnologies/tyk@0.0.0 > github.com/warpstreamlabs/bento/public/components/all@1.7.1 > github.com/warpstreamlabs/bento/public/components/otlp@1.7.1 > github.com/warpstreamlabs/bento/internal/impl/otlp@1.7.1 > go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@1.23.1 > go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/internal/otlpconfig@1.23.1 > go.opentelemetry.io/otel/exporters/otlp/otlptrace@1.23.1 > go.opentelemetry.io/otel/exporters/otlp/otlptrace/internal/tracetransform@1.23.1 > go.opentelemetry.io/otel/sdk/resource@1.35.0

If it's fine, I will solve them on a side branch

[probelabs]

Thank You for Your Contribution!

Hi @Kle0s, thank you for this detailed vulnerability report for Tyk v5.11.0 based on your Snyk scan. We appreciate you taking the time to identify and share these findings with us.

Triage & Analysis

Based on the information you've provided, I understand that there are several high-severity vulnerabilities in transitive dependencies, specifically:

• golang.org/x/net/html (Inefficient Algorithmic Complexity, Infinite loop)
• go.opentelemetry.io/otel/sdk/resource (Untrusted Search Path)

Your analysis correctly points out that these are pulled in through various direct dependencies of the Tyk gateway.

Next Steps

We would welcome a pull request from you to address these vulnerabilities. When you submit it, our team will review the proposed changes to ensure they resolve the issues without introducing any regressions.

Please feel free to open a draft pull request early if you'd like to discuss the approach.

Thank you again for your proactive help in keeping Tyk secure!

References:

• go.mod – Project dependency management.

---

Powered by Visor from Probelabs

💡 TIP: You can chat with Visor using /visor ask <your question>