How severe is GHSA-qc6v-5g5m-8cw2?

GHSA-qc6v-5g5m-8cw2 has a CVSS score of 5.3/10, rated MEDIUM. Review your exposure and patch according to your risk tolerance.

Which packages are affected by GHSA-qc6v-5g5m-8cw2?

GHSA-qc6v-5g5m-8cw2 affects the following packages: github.com/zitadel/zitadel-go/v3 (Go). Ecosystems affected: Go.

How do I fix GHSA-qc6v-5g5m-8cw2?

Update github.com/zitadel/zitadel-go/v3 to 3.0.0-next.3 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-qc6v-5g5m-8cw2 is resolved across your whole dependency graph.

How do I detect GHSA-qc6v-5g5m-8cw2 in my Go dependencies?

Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for github.com/zitadel/zitadel-go/v3, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

How do I mitigate GHSA-qc6v-5g5m-8cw2 if there is no patch (or I can't update yet)?

Cap what an attacker can consume: apply request size, rate and timeout limits in front of the affected component, and run it with memory and CPU limits so exhaustion degrades one worker rather than the whole service.

Is GHSA-qc6v-5g5m-8cw2 actively exploited in the wild?

No public exploit code has been indexed for GHSA-qc6v-5g5m-8cw2 yet. This does not mean the vulnerability cannot be exploited — absence of public exploits does not imply safety. Apply the recommended fix and use O3 Security to monitor your exposure.

When was GHSA-qc6v-5g5m-8cw2 published, and has it been updated?

GHSA-qc6v-5g5m-8cw2 was published on July 15, 2024. Advisory data evolves as severity scores, affected ranges, and exploit intelligence are revised — always check the latest version of the advisory before acting.

🐹

🐹 Go

Not in CISA KEV

MEDIUM severity

ZITADEL Go's GRPC example code vulnerability - GO-2024-2687 HTTP/2 CONTINUATION flood in net/httpGHSA-qc6v-5g5m-8cw2

MEDIUM

GHSA-qc6v-5g5m-8cw2 is a medium-severity (CVSS 5.3) vulnerability in github.com/zitadel/zitadel-go/v3. A fix is available for github.com/zitadel/zitadel-go/v3 — see the affected versions and patch details below.

Published

Jul 15, 2024

Updated

Jul 15, 2024

Affected

1 pkg

Patched

1 / 1

Exploits

None indexed

Exploitation data as of Jul 15, 2024 · OSV.dev, FIRST.org (EPSS)

Real-World Exposure

1 pkg affected

🐹github.com/zitadel/zitadel-go/v3

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Go packages — download data is not available via public APIs for these ecosystems.

Description

Summary

Applications using the zitadel-go v3 library (next branch) might be impacted by package vulnerabilities. The output of govulncheck suggests that only example code seems to be impacted, based on 1 of the 3 potential vulnerabilities. This vulnerability is located in the transitive dependency golang.org/x/net v0.19.0, CVE-2023-45288

Patches

3.0.0-next versions are fixed on >= 3.0.0-next.3

ZITADEL recommends upgrading to the latest versions available in due course.

Workarounds

If updating the zitadel-go library is not an option, updating the affected (transient) dependencies works as a workaround.

Details

Direct deps:

GO-2024-2631 Decompression bomb vulnerability in github.com/go-jose/go-jose
- github.com/go-jose/go-jose/v3 Fixed in v3.0.3.

This module is necessary because github.com/go-jose/go-jose/v3 is imported in github.com/zitadel/zitadel-go/v3/pkg/client/system.

GO-2024-2611 Infinite loop in JSON unmarshaling in google.golang.org/protobuf
- google.golang.org/protobuf/encoding/protojson
- google.golang.org/protobuf/internal/encoding/json Fixed in v1.33.0.

This module is necessary because google.golang.org/protobuf/reflect/protoreflect is imported in github.com/zitadel/zitadel-go/v3/example/api/grpc/proto.

Transitive deps:

GO-2024-2687 HTTP/2 CONTINUATION flood in net/http
- golang.org/x/net/http2 Fixed in v0.23.0.

This module is necessary because golang.org/x/net/trace is imported in:

github.com/zitadel/zitadel-go/v3/example/api/grpc
google.golang.org/grpc

`govulncheck`

=== Symbol Results ===

Vulnerability #1: GO-2024-2687
    HTTP/2 CONTINUATION flood in net/http
  More info: https://pkg.go.dev/vuln/GO-2024-2687
  Module: golang.org/x/net
    Found in: golang.org/x/[email protected]
    Fixed in: golang.org/x/[email protected]
    Example traces found:
      #1: example/api/grpc/proto/api_grpc.pb.go:239:34: proto.exampleServiceAddTasksServer.Recv calls grpc.serverStream.RecvMsg, which eventually calls http2.ConnectionError.Error
      #2: pkg/client/auth.go:92:20: client.ScopeProjectID calls fmt.Sprintf, which eventually calls http2.ErrCode.String
      #3: pkg/client/auth.go:92:20: client.ScopeProjectID calls fmt.Sprintf, which eventually calls http2.FrameHeader.String
      #4: pkg/client/auth.go:92:20: client.ScopeProjectID calls fmt.Sprintf, which eventually calls http2.FrameType.String
      #5: example/api/grpc/main.go:63:24: grpc.main calls grpc.Server.Serve, which eventually calls http2.Framer.ReadFrame
      #6: example/api/grpc/main.go:63:24: grpc.main calls grpc.Server.Serve, which eventually calls http2.Framer.WriteContinuation
      #7: example/api/grpc/main.go:63:24: grpc.main calls grpc.Server.Serve, which eventually calls http2.Framer.WriteData
      #8: example/api/grpc/main.go:63:24: grpc.main calls grpc.Server.Serve, which eventually calls http2.Framer.WriteGoAway
      #9: example/api/grpc/main.go:63:24: grpc.main calls grpc.Server.Serve, which eventually calls http2.Framer.WriteHeaders
      #10: example/api/grpc/main.go:63:24: grpc.main calls grpc.Server.Serve, which eventually calls http2.Framer.WritePing
      #11: example/api/grpc/main.go:63:24: grpc.main calls grpc.Server.Serve, which eventually calls http2.Framer.WriteRSTStream
      #12: example/api/grpc/main.go:63:24: grpc.main calls grpc.Server.Serve, which eventually calls http2.Framer.WriteSettings
      #13: example/api/grpc/main.go:63:24: grpc.main calls grpc.Server.Serve, which eventually calls http2.Framer.WriteSettingsAck
      #14: example/api/grpc/main.go:63:24: grpc.main calls grpc.Server.Serve, which eventually calls http2.Framer.WriteWindowUpdate
      #15: example/api/grpc/proto/api_grpc.pb.go:239:34: proto.exampleServiceAddTasksServer.Recv calls grpc.serverStream.RecvMsg, which eventually calls http2.GoAwayError.Error
      #16: pkg/client/auth.go:92:20: client.ScopeProjectID calls fmt.Sprintf, which eventually calls http2.Setting.String
      #17: pkg/client/auth.go:92:20: client.ScopeProjectID calls fmt.Sprintf, which eventually calls http2.SettingID.String
      #18: example/api/grpc/main.go:63:24: grpc.main calls grpc.Server.Serve, which eventually calls http2.SettingsFrame.ForeachSetting
      #19: example/api/grpc/proto/api_grpc.pb.go:239:34: proto.exampleServiceAddTasksServer.Recv calls grpc.serverStream.RecvMsg, which eventually calls http2.StreamError.Error
      #20: example/app/app.go:111:27: app.main calls http.ListenAndServe, which eventually calls http2.chunkWriter.Write
      #21: example/api/grpc/proto/api_grpc.pb.go:239:34: proto.exampleServiceAddTasksServer.Recv calls grpc.serverStream.RecvMsg, which eventually calls http2.connError.Error
      #22: pkg/client/auth.go:92:20: client.ScopeProjectID calls fmt.Sprintf, which eventually calls http2.duplicatePseudoHeaderError.Error
      #23: pkg/client/auth.go:23:42: client.JWTAuthentication calls profile.NewJWTProfileTokenSource, which eventually calls http2.gzipReader.Close
      #24: pkg/authentication/state.go:20:26: authentication.State.Encrypt calls crypto.EncryptAES, which eventually calls http2.gzipReader.Read
      #25: pkg/client/auth.go:92:20: client.ScopeProjectID calls fmt.Sprintf, which eventually calls http2.headerFieldNameError.Error
      #26: pkg/client/auth.go:92:20: client.ScopeProjectID calls fmt.Sprintf, which eventually calls http2.headerFieldValueError.Error
      #27: pkg/client/auth.go:92:20: client.ScopeProjectID calls fmt.Sprintf, which eventually calls http2.pseudoHeaderError.Error
      #28: example/app/app.go:111:27: app.main calls http.ListenAndServe, which eventually calls http2.stickyErrWriter.Write
      #29: pkg/client/auth.go:23:42: client.JWTAuthentication calls profile.NewJWTProfileTokenSource, which eventually calls http2.transportResponseBody.Close
      #30: pkg/authentication/state.go:20:26: authentication.State.Encrypt calls crypto.EncryptAES, which eventually calls http2.transportResponseBody.Read
      #31: pkg/client/auth.go:92:20: client.ScopeProjectID calls fmt.Sprintf, which eventually calls http2.writeData.String

Your code is affected by 1 vulnerability from 1 module.
This scan also found 2 vulnerabilities in packages you import and 1
vulnerability in modules you require, but your code doesn't appear to call these
vulnerabilities.

PoC

No specific configuration required.

Impact

Indirect package vulnerability. Users following example code might be impacted.

References

Credits

Thanks to @helpisdev for reporting this.

Affected Packages

1 total 1 fixed

Ecosystem	Package	Vulnerable range	Fix
🐹Go	`github.com/zitadel/zitadel-go/v3`	≥ 3.0.0-next.1&&< 3.0.0-next.3	3.0.0-next.3`go get github.com/zitadel/zitadel-go/v3@v3.0.0-next.3`

Detection & mitigation playbook

Open-source dependency

Detect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for github.com/zitadel/zitadel-go/v3, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update github.com/zitadel/zitadel-go/v3 to 3.0.0-next.3 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-qc6v-5g5m-8cw2 is resolved across your whole dependency graph.
Workarounds
Cap what an attacker can consume: apply request size, rate and timeout limits in front of the affected component, and run it with memory and CPU limits so exhaustion degrades one worker rather than the whole service.

Frequently Asked Questions

### Summary Applications using the `zitadel-go` `v3` library (`next` branch) might be impacted by package vulnerabilities. The output of `govulncheck` suggests that only `example` code seems to be impacted, based on 1 of the 3 potential vulnerabilities. This vulnerability is located in the transitive dependency `golang.org/x/net v0.19.0`, [CVE-2023-45288](https://www.cve.org/CVERecord?id=CVE-2023-45288) ### Patches 3.0.0-next versions are fixed on >= [3.0.0-next.3](https://github.com/zitadel/zitadel-go/releases/tag/v3.0.0-next.3) ZITADEL recommends upgrading to the latest versions available

O3 Security · Impact-Aware SCA

Is GHSA-qc6v-5g5m-8cw2 in your dependencies?

Find it across Go, including transitive dependencies.

Scan my dependencies How O3 SCA works

CVSS Score

5.3/10CVSS v3 base

Vector breakdown

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Raw vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Weaponization

No Nuclei template, Metasploit module or public proof-of-concept found.

OpenSSF Scorecard

Package health score

zitadel-go

6.8/10

Maintained10/10

Code-Review10/10

Branch-Protection8/10

Assessed Nov 2, 2026

Timeline

Disclosed

Jul 15, 2024

Identifiers

GHSA-qc6v-5g5m-8cw2

References

Webgithub.com · GHSA qc6v 5g5m 8cw2 Webgithub.com · v3.0.0 next.3 Webpkg.go.dev · GO 2024 2611 Webpkg.go.dev · GO 2024 2631 Webpkg.go.dev · GO 2024 2687 Webcve.org · CVERecord Packagegithub.com · zitadel go

Provenance

Sources

OSV.devFIRST.org (EPSS)

Last verifiedJul 15, 2024