agent v0.27.42 image contains Go runtime affected by GO-2026-4337

[loganrosen]

Summary

A final-image scan of the published v0.27.42 agent image reports a Critical Go standard-library finding for GO-2026-4337.

The image contains multiple prebuilt tools. A follow-up scan maps the affected Go runtime to gosu, but this attribution and runtime applicability should be confirmed across the supported image platforms.

Affected artifact

ghcr.io/github/gh-aw-firewall/agent:0.27.42@sha256:26a8af4e5566485b02f52af59ee03803ae798271a9619d4767e94d07806deb9b

Observed finding

Advisory	Package	Severity	Fixed versions
GO-2026-4337	stdlib@go1.24.6	Critical	Go 1.24.13, 1.25.7, or 1.26.0-rc.3

GO-2026-4337 concerns unexpected TLS session resumption and was published February 5, 2026.

A follow-up scan of the same immutable digest using Syft v1.49.0 and Grype v0.116.0 reports the package at:

/usr/local/bin/gosu

The binary identifies as github.com/tianon/gosu v1.19.0. Version 1.19 is currently the latest public gosu release, so no newer released gosu artifact was found that can be selected solely through a version bump.

Upstream tracking: tianon/gosu#176. The maintainer points reports like this to gosu's govulncheck-based reachability policy, so the upstream issue provides context rather than a commitment to publish a rebuilt release.

Please confirm the owning binary and path for each supported architecture, assess whether the affected TLS code is reachable in this executable, and determine the appropriate remediation for the affected runtime.

Scope

The same scan found no Critical findings in the v0.27.42 api-proxy or Squid images.

Related historical reports

• [Security] Update vulnerable dependencies in agent and api-proxy images #6504 covered a different package set: the older Ubuntu gh/Go 1.18 package, npm-bundled dependencies, and curl. It was correctly closed after those findings were addressed.
• Supply-chain scan: High/Critical CVEs in gh-aw-firewall container images (agent, api-proxy, cli-proxy) #6544 also recorded GO-2026-4337 in the earlier v0.27.38 inventory, against a Go 1.18 runtime. This report concerns the later immutable v0.27.42 image and the distinct gosu binary built with Go 1.24.6.

Reproduction

The original finding was observed with Syft v1.46.0 and Grype v0.115.0:

IMAGE='ghcr.io/github/gh-aw-firewall/agent:0.27.42@sha256:26a8af4e5566485b02f52af59ee03803ae798271a9619d4767e94d07806deb9b'

syft --platform linux/amd64 "$IMAGE" -o syft-json=sbom.json
grype sbom:sbom.json

The image is multi-architecture, so package inventories and binary attribution may differ by platform.

Expected outcome

Confirm the binary containing stdlib@go1.24.6, assess whether GO-2026-4337 applies to its executable runtime, and remediate the affected version or document why the finding does not apply.