Skip to content

Commit 4728b6e

Browse files
azurelinux-securityazurelinux-security
authored
[AutoPR- Security] Patch telegraf for CVE-2026-26014, CVE-2026-2303, CVE-2025-58190, CVE-2025-47911 [MEDIUM] (#15923)
1 parent 2b0032c commit 4728b6e

5 files changed

Lines changed: 341 additions & 1 deletion

File tree

‎SPECS/telegraf/CVE-2025-47911.patch‎

Lines changed: 100 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,100 @@
1+
From ca2fcd298c93ce202150fafa6e48d22e41b328fd Mon Sep 17 00:00:00 2001
2+
From: Roland Shoemaker <roland@golang.org>
3+
Date: Mon, 29 Sep 2025 16:33:18 -0700
4+
Subject: [PATCH] html: impose open element stack size limit
5+
6+
The HTML specification contains a number of algorithms which are
7+
quadratic in complexity by design. Instead of adding complicated
8+
workarounds to prevent these cases from becoming extremely expensive in
9+
pathological cases, we impose a limit of 512 to the size of the stack of
10+
open elements. It is extremely unlikely that non-adversarial HTML
11+
documents will ever hit this limit (but if we see cases of this, we may
12+
want to make the limit configurable via a ParseOption).
13+
14+
Thanks to Guido Vranken and Jakub Ciolek for both independently
15+
reporting this issue.
16+
17+
Fixes CVE-2025-47911
18+
Fixes golang/go#75682
19+
20+
Change-Id: I890517b189af4ffbf427d25d3fde7ad7ec3509ad
21+
Reviewed-on: https://go-review.googlesource.com/c/net/+/709876
22+
Reviewed-by: Damien Neil <dneil@google.com>
23+
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
24+
Signed-off-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com>
25+
Upstream-reference: https://github.com/golang/net/commit/59706cdaa8f95502fdec64b67b4c61d6ca58727d.patch
26+
---
27+
vendor/golang.org/x/net/html/escape.go | 2 +-
28+
vendor/golang.org/x/net/html/parse.go | 21 +++++++++++++++++----
29+
2 files changed, 18 insertions(+), 5 deletions(-)
30+
31+
diff --git a/vendor/golang.org/x/net/html/escape.go b/vendor/golang.org/x/net/html/escape.go
32+
index 04c6bec2..12f22737 100644
33+
--- a/vendor/golang.org/x/net/html/escape.go
34+
+++ b/vendor/golang.org/x/net/html/escape.go
35+
@@ -299,7 +299,7 @@ func escape(w writer, s string) error {
36+
case '\r':
37+
esc = "&#13;"
38+
default:
39+
- panic("unrecognized escape character")
40+
+ panic("html: unrecognized escape character")
41+
}
42+
s = s[i+1:]
43+
if _, err := w.WriteString(esc); err != nil {
44+
diff --git a/vendor/golang.org/x/net/html/parse.go b/vendor/golang.org/x/net/html/parse.go
45+
index 979ef17e..4d12a1c1 100644
46+
--- a/vendor/golang.org/x/net/html/parse.go
47+
+++ b/vendor/golang.org/x/net/html/parse.go
48+
@@ -231,7 +231,14 @@ func (p *parser) addChild(n *Node) {
49+
}
50+
51+
if n.Type == ElementNode {
52+
- p.oe = append(p.oe, n)
53+
+ p.insertOpenElement(n)
54+
+ }
55+
+}
56+
+
57+
+func (p *parser) insertOpenElement(n *Node) {
58+
+ p.oe = append(p.oe, n)
59+
+ if len(p.oe) > 512 {
60+
+ panic("html: open stack of elements exceeds 512 nodes")
61+
}
62+
}
63+
64+
@@ -810,7 +817,7 @@ func afterHeadIM(p *parser) bool {
65+
p.im = inFramesetIM
66+
return true
67+
case a.Base, a.Basefont, a.Bgsound, a.Link, a.Meta, a.Noframes, a.Script, a.Style, a.Template, a.Title:
68+
- p.oe = append(p.oe, p.head)
69+
+ p.insertOpenElement(p.head)
70+
defer p.oe.remove(p.head)
71+
return inHeadIM(p)
72+
case a.Head:
73+
@@ -2320,9 +2327,13 @@ func (p *parser) parseCurrentToken() {
74+
}
75+
}
76+
77+
-func (p *parser) parse() error {
78+
+func (p *parser) parse() (err error) {
79+
+ defer func() {
80+
+ if panicErr := recover(); panicErr != nil {
81+
+ err = fmt.Errorf("%s", panicErr)
82+
+ }
83+
+ }()
84+
// Iterate until EOF. Any other error will cause an early return.
85+
- var err error
86+
for err != io.EOF {
87+
// CDATA sections are allowed only in foreign content.
88+
n := p.oe.top()
89+
@@ -2351,6 +2362,8 @@ func (p *parser) parse() error {
90+
// <tag>s. Conversely, explicit <tag>s in r's data can be silently dropped,
91+
// with no corresponding node in the resulting tree.
92+
//
93+
+// Parse will reject HTML that is nested deeper than 512 elements.
94+
+//
95+
// The input is assumed to be UTF-8 encoded.
96+
func Parse(r io.Reader) (*Node, error) {
97+
return ParseWithOptions(r)
98+
--
99+
2.45.4
100+

‎SPECS/telegraf/CVE-2025-58190.patch‎

Lines changed: 126 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,126 @@
1+
From b55299b135a4734bfb23ba12e71b32e67aa1a79f Mon Sep 17 00:00:00 2001
2+
From: Roland Shoemaker <roland@golang.org>
3+
Date: Mon, 29 Sep 2025 19:38:24 -0700
4+
Subject: [PATCH] html: align in row insertion mode with spec
5+
6+
Update inRowIM to match the HTML specification. This fixes an issue
7+
where a specific HTML document could cause the parser to enter an
8+
infinite loop when trying to parse a </tbody> and implied </tr> next to
9+
each other.
10+
11+
Fixes CVE-2025-58190
12+
Fixes golang/go#70179
13+
14+
Change-Id: Idcb133c87c7d475cc8c7eb1f1550ea21d8bdddea
15+
Reviewed-on: https://go-review.googlesource.com/c/net/+/709875
16+
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
17+
Reviewed-by: Damien Neil <dneil@google.com>
18+
Signed-off-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com>
19+
Upstream-reference: https://github.com/golang/net/commit/6ec8895aa5f6594da7356da7d341b98133629009.patch
20+
---
21+
vendor/golang.org/x/net/html/parse.go | 36 ++++++++++++++++++---------
22+
1 file changed, 24 insertions(+), 12 deletions(-)
23+
24+
diff --git a/vendor/golang.org/x/net/html/parse.go b/vendor/golang.org/x/net/html/parse.go
25+
index 5b8374bf..979ef17e 100644
26+
--- a/vendor/golang.org/x/net/html/parse.go
27+
+++ b/vendor/golang.org/x/net/html/parse.go
28+
@@ -136,7 +136,7 @@ func (p *parser) indexOfElementInScope(s scope, matchTags ...a.Atom) int {
29+
return -1
30+
}
31+
default:
32+
- panic("unreachable")
33+
+ panic(fmt.Sprintf("html: internal error: indexOfElementInScope unknown scope: %d", s))
34+
}
35+
}
36+
switch s {
37+
@@ -179,7 +179,7 @@ func (p *parser) clearStackToContext(s scope) {
38+
return
39+
}
40+
default:
41+
- panic("unreachable")
42+
+ panic(fmt.Sprintf("html: internal error: clearStackToContext unknown scope: %d", s))
43+
}
44+
}
45+
}
46+
@@ -1674,7 +1674,7 @@ func inTableBodyIM(p *parser) bool {
47+
return inTableIM(p)
48+
}
49+
50+
-// Section 12.2.6.4.14.
51+
+// Section 13.2.6.4.14.
52+
func inRowIM(p *parser) bool {
53+
switch p.tok.Type {
54+
case StartTagToken:
55+
@@ -1686,7 +1686,9 @@ func inRowIM(p *parser) bool {
56+
p.im = inCellIM
57+
return true
58+
case a.Caption, a.Col, a.Colgroup, a.Tbody, a.Tfoot, a.Thead, a.Tr:
59+
- if p.popUntil(tableScope, a.Tr) {
60+
+ if p.elementInScope(tableScope, a.Tr) {
61+
+ p.clearStackToContext(tableRowScope)
62+
+ p.oe.pop()
63+
p.im = inTableBodyIM
64+
return false
65+
}
66+
@@ -1696,22 +1698,28 @@ func inRowIM(p *parser) bool {
67+
case EndTagToken:
68+
switch p.tok.DataAtom {
69+
case a.Tr:
70+
- if p.popUntil(tableScope, a.Tr) {
71+
+ if p.elementInScope(tableScope, a.Tr) {
72+
+ p.clearStackToContext(tableRowScope)
73+
+ p.oe.pop()
74+
p.im = inTableBodyIM
75+
return true
76+
}
77+
// Ignore the token.
78+
return true
79+
case a.Table:
80+
- if p.popUntil(tableScope, a.Tr) {
81+
+ if p.elementInScope(tableScope, a.Tr) {
82+
+ p.clearStackToContext(tableRowScope)
83+
+ p.oe.pop()
84+
p.im = inTableBodyIM
85+
return false
86+
}
87+
// Ignore the token.
88+
return true
89+
case a.Tbody, a.Tfoot, a.Thead:
90+
- if p.elementInScope(tableScope, p.tok.DataAtom) {
91+
- p.parseImpliedToken(EndTagToken, a.Tr, a.Tr.String())
92+
+ if p.elementInScope(tableScope, p.tok.DataAtom) && p.elementInScope(tableScope, a.Tr) {
93+
+ p.clearStackToContext(tableRowScope)
94+
+ p.oe.pop()
95+
+ p.im = inTableBodyIM
96+
return false
97+
}
98+
// Ignore the token.
99+
@@ -2218,16 +2226,20 @@ func parseForeignContent(p *parser) bool {
100+
p.acknowledgeSelfClosingTag()
101+
}
102+
case EndTagToken:
103+
+ if strings.EqualFold(p.oe[len(p.oe)-1].Data, p.tok.Data) {
104+
+ p.oe = p.oe[:len(p.oe)-1]
105+
+ return true
106+
+ }
107+
for i := len(p.oe) - 1; i >= 0; i-- {
108+
- if p.oe[i].Namespace == "" {
109+
- return p.im(p)
110+
- }
111+
if strings.EqualFold(p.oe[i].Data, p.tok.Data) {
112+
p.oe = p.oe[:i]
113+
+ return true
114+
+ }
115+
+ if i > 0 && p.oe[i-1].Namespace == "" {
116+
break
117+
}
118+
}
119+
- return true
120+
+ return p.im(p)
121+
default:
122+
// Ignore the token.
123+
}
124+
--
125+
2.45.4
126+

‎SPECS/telegraf/CVE-2026-2303.patch‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
From fb04605cdd425ccf4dff7f7e18a11a3ad6fecf5d Mon Sep 17 00:00:00 2001
2+
From: Preston Vasquez <prestonvasquez@icloud.com>
3+
Date: Mon, 26 Jan 2026 09:48:19 -0700
4+
Subject: [PATCH] =?UTF-8?q?GODRIVER-3770=20Fix=20buffer=20handling=20in=20?=
5+
=?UTF-8?q?GSSAPI=20error=20description=20and=20use=E2=80=A6=20(#2304)?=
6+
MIME-Version: 1.0
7+
Content-Type: text/plain; charset=UTF-8
8+
Content-Transfer-Encoding: 8bit
9+
10+
Signed-off-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com>
11+
Upstream-reference: https://github.com/mongodb/mongo-go-driver/commit/76ec2daba15f743989040ce2fdaf83f4a3e69bcb.patch
12+
---
13+
.../x/mongo/driver/auth/internal/gssapi/gss_wrapper.c | 8 ++++----
14+
1 file changed, 4 insertions(+), 4 deletions(-)
15+
16+
diff --git a/vendor/go.mongodb.org/mongo-driver/x/mongo/driver/auth/internal/gssapi/gss_wrapper.c b/vendor/go.mongodb.org/mongo-driver/x/mongo/driver/auth/internal/gssapi/gss_wrapper.c
17+
index 68b72541..e426037e 100644
18+
--- a/vendor/go.mongodb.org/mongo-driver/x/mongo/driver/auth/internal/gssapi/gss_wrapper.c
19+
+++ b/vendor/go.mongodb.org/mongo-driver/x/mongo/driver/auth/internal/gssapi/gss_wrapper.c
20+
@@ -72,8 +72,8 @@ int gssapi_error_desc(
21+
free(*desc);
22+
}
23+
24+
- *desc = malloc(desc_buffer.length+1);
25+
- memcpy(*desc, desc_buffer.value, desc_buffer.length+1);
26+
+ *desc = calloc(1, desc_buffer.length + 1);
27+
+ memcpy(*desc, desc_buffer.value, desc_buffer.length);
28+
29+
gss_release_buffer(&local_min_stat, &desc_buffer);
30+
}
31+
@@ -144,8 +144,8 @@ int gssapi_client_username(
32+
return GSSAPI_ERROR;
33+
}
34+
35+
- *username = malloc(name_buffer.length+1);
36+
- memcpy(*username, name_buffer.value, name_buffer.length+1);
37+
+ *username = calloc(1, name_buffer.length + 1);
38+
+ memcpy(*username, name_buffer.value, name_buffer.length);
39+
40+
gss_release_buffer(&ignored, &name_buffer);
41+
gss_release_name(&ignored, &name);
42+
--
43+
2.45.4
44+

‎SPECS/telegraf/CVE-2026-26014.patch‎

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
From d3834beb654c05530528ff450f2707818edc92fb Mon Sep 17 00:00:00 2001
2+
From: theodorsm <theodor@midtlien.com>
3+
Date: Thu, 12 Feb 2026 21:13:38 +0100
4+
Subject: [PATCH] Backport security fix for CVE-2026-26014
5+
6+
Signed-off-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com>
7+
Upstream-reference: https://github.com/pion/dtls/commit/90e241cfec2985715efdd3d005972847462a67d6.patch
8+
---
9+
.../github.com/pion/dtls/v2/pkg/crypto/ciphersuite/ccm.go | 6 ++----
10+
.../github.com/pion/dtls/v2/pkg/crypto/ciphersuite/gcm.go | 6 ++----
11+
2 files changed, 4 insertions(+), 8 deletions(-)
12+
13+
diff --git a/vendor/github.com/pion/dtls/v2/pkg/crypto/ciphersuite/ccm.go b/vendor/github.com/pion/dtls/v2/pkg/crypto/ciphersuite/ccm.go
14+
index 24050dc9..1cf6aac0 100644
15+
--- a/vendor/github.com/pion/dtls/v2/pkg/crypto/ciphersuite/ccm.go
16+
+++ b/vendor/github.com/pion/dtls/v2/pkg/crypto/ciphersuite/ccm.go
17+
@@ -5,7 +5,6 @@ package ciphersuite
18+
19+
import (
20+
"crypto/aes"
21+
- "crypto/rand"
22+
"encoding/binary"
23+
"fmt"
24+
25+
@@ -66,9 +65,8 @@ func (c *CCM) Encrypt(pkt *recordlayer.RecordLayer, raw []byte) ([]byte, error)
26+
raw = raw[:recordlayer.HeaderSize]
27+
28+
nonce := append(append([]byte{}, c.localWriteIV[:4]...), make([]byte, 8)...)
29+
- if _, err := rand.Read(nonce[4:]); err != nil {
30+
- return nil, err
31+
- }
32+
+ seq64 := (uint64(pkt.Header.Epoch) << 48) | (pkt.Header.SequenceNumber & 0x0000ffffffffffff)
33+
+ binary.BigEndian.PutUint64(nonce[4:], seq64)
34+
35+
additionalData := generateAEADAdditionalData(&pkt.Header, len(payload))
36+
encryptedPayload := c.localCCM.Seal(nil, nonce, payload, additionalData)
37+
diff --git a/vendor/github.com/pion/dtls/v2/pkg/crypto/ciphersuite/gcm.go b/vendor/github.com/pion/dtls/v2/pkg/crypto/ciphersuite/gcm.go
38+
index c0fd1f76..ce557737 100644
39+
--- a/vendor/github.com/pion/dtls/v2/pkg/crypto/ciphersuite/gcm.go
40+
+++ b/vendor/github.com/pion/dtls/v2/pkg/crypto/ciphersuite/gcm.go
41+
@@ -6,7 +6,6 @@ package ciphersuite
42+
import (
43+
"crypto/aes"
44+
"crypto/cipher"
45+
- "crypto/rand"
46+
"encoding/binary"
47+
"fmt"
48+
49+
@@ -60,9 +59,8 @@ func (g *GCM) Encrypt(pkt *recordlayer.RecordLayer, raw []byte) ([]byte, error)
50+
51+
nonce := make([]byte, gcmNonceLength)
52+
copy(nonce, g.localWriteIV[:4])
53+
- if _, err := rand.Read(nonce[4:]); err != nil {
54+
- return nil, err
55+
- }
56+
+ seq64 := (uint64(pkt.Header.Epoch) << 48) | (pkt.Header.SequenceNumber & 0x0000ffffffffffff)
57+
+ binary.BigEndian.PutUint64(nonce[4:], seq64)
58+
59+
additionalData := generateAEADAdditionalData(&pkt.Header, len(payload))
60+
encryptedPayload := g.localGCM.Seal(nil, nonce, payload, additionalData)
61+
--
62+
2.45.4
63+

‎SPECS/telegraf/telegraf.spec‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
Summary: agent for collecting, processing, aggregating, and writing metrics.
22
Name: telegraf
33
Version: 1.31.0
4-
Release: 13%{?dist}
4+
Release: 14%{?dist}
55
License: MIT
66
Vendor: Microsoft Corporation
77
Distribution: Azure Linux
@@ -26,6 +26,10 @@ Patch11: CVE-2025-22872.patch
2626
Patch12: CVE-2025-47913.patch
2727
Patch13: CVE-2025-10543.patch
2828
Patch14: CVE-2025-11065.patch
29+
Patch15: CVE-2025-47911.patch
30+
Patch16: CVE-2025-58190.patch
31+
Patch17: CVE-2026-2303.patch
32+
Patch18: CVE-2026-26014.patch
2933

3034
BuildRequires: golang
3135
BuildRequires: systemd-devel
@@ -90,6 +94,9 @@ fi
9094
%dir %{_sysconfdir}/%{name}/telegraf.d
9195

9296
%changelog
97+
* Thu Feb 19 2026 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 1.31.0-14
98+
- Patch for CVE-2026-26014, CVE-2026-2303, CVE-2025-58190, CVE-2025-47911
99+
93100
* Tue Feb 03 2026 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 1.31.0-13
94101
- Patch for CVE-2025-11065
95102

0 commit comments

Comments
 (0)