Summary
We are running x509-certificate-exporter in production and have a security
VRR deadline of June 30, 2026 for CVE-2026-39821 (golang.org/x/net/idna —
Improper Authentication).
What we found
- v4.1.0 (current latest stable) still contains the vulnerability via golang.org/x/net v0.54.0
- Commit 50ee4ab bumps golang.org/x/net → v0.55.0 which fixes the CVE
- We scanned enix/x509-certificate-exporter:4.2.0-rc.1 (which contains this
commit) with Snyk — 0 vulnerabilities found, CVE-2026-39821 confirmed fixed
Request
Would it be possible to backport commit 50ee4ab and cut a v4.1.1 patch
release? This would be the minimal change needed to resolve the CVE without
requiring a full v4.2.0 stable release. Alternatively a stable v4.2.0 would
also work.
We cannot deploy a release candidate to production at Axon and the June 30 deadline
is tight (18 days away). Thank you!
Summary
We are running x509-certificate-exporter in production and have a security
VRR deadline of June 30, 2026 for CVE-2026-39821 (golang.org/x/net/idna —
Improper Authentication).
What we found
commit) with Snyk — 0 vulnerabilities found, CVE-2026-39821 confirmed fixed
Request
Would it be possible to backport commit 50ee4ab and cut a v4.1.1 patch
release? This would be the minimal change needed to resolve the CVE without
requiring a full v4.2.0 stable release. Alternatively a stable v4.2.0 would
also work.
We cannot deploy a release candidate to production at Axon and the June 30 deadline
is tight (18 days away). Thank you!