From 8041e21e2e9f5cf925114374025bafd1c99c6da5 Mon Sep 17 00:00:00 2001 From: Thomas Date: Mon, 12 Oct 2026 09:03:28 +0200 Subject: [PATCH] ci: accept Go 1.27.1 DoS CVEs in Telegraf 1.40.1 until upstream fix The scheduled image scan failed on four new HIGH findings in the telegraf binary (CVE-2026-78667, CVE-2026-78669, CVE-2026-97031 in the Go 1.27.1 stdlib and golang.org/x/net 0.59.0). Telegraf 1.40.1 is still the latest upstream release, so no fixed image exists yet. The flaws are server-side or TLS denial-of-service issues; this stack runs only SNMP and execd inputs, exposes no Telegraf listener and talks to InfluxDB over plaintext HTTP/1.1 on the Compose network. Each exception is scoped to usr/bin/telegraf, expires on 2026-10-31, and the non-blocking report step keeps listing them. Co-Authored-By: Claude Opus 5.5 (1M context) --- .trivyignore.yaml | 36 ++++++++++++++++++++++++++++++++++++ 1 file changed, 36 insertions(+) diff --git a/.trivyignore.yaml b/.trivyignore.yaml index 1b52baf..65a207f 100644 --- a/.trivyignore.yaml +++ b/.trivyignore.yaml @@ -9,3 +9,39 @@ vulnerabilities: and execd inputs and exposes no gRPC listener. Remove this exception as soon as an upstream Telegraf image containing the fixed gRPC-Go release is available. + - id: CVE-2026-78667 + paths: + - usr/bin/telegraf + expired_at: 2026-10-31 + statement: >- + Telegraf 1.40.1 is the latest stable upstream release and is built with + Go 1.27.1 and golang.org/x/net 0.59.0. This denial-of-service flaw + affects net/http, HTTP/2 or crypto/tls ECH handling, but this stack + enables only SNMP and execd inputs, exposes no Telegraf listener, and + reaches InfluxDB over plaintext HTTP/1.1 on the internal Compose + network. Remove this exception as soon as an upstream Telegraf image + built with Go 1.27.2 and golang.org/x/net 0.60.0 is available. + - id: CVE-2026-78669 + paths: + - usr/bin/telegraf + expired_at: 2026-10-31 + statement: >- + Telegraf 1.40.1 is the latest stable upstream release and is built with + Go 1.27.1 and golang.org/x/net 0.59.0. This denial-of-service flaw + affects net/http, HTTP/2 or crypto/tls ECH handling, but this stack + enables only SNMP and execd inputs, exposes no Telegraf listener, and + reaches InfluxDB over plaintext HTTP/1.1 on the internal Compose + network. Remove this exception as soon as an upstream Telegraf image + built with Go 1.27.2 and golang.org/x/net 0.60.0 is available. + - id: CVE-2026-97031 + paths: + - usr/bin/telegraf + expired_at: 2026-10-31 + statement: >- + Telegraf 1.40.1 is the latest stable upstream release and is built with + Go 1.27.1 and golang.org/x/net 0.59.0. This denial-of-service flaw + affects net/http, HTTP/2 or crypto/tls ECH handling, but this stack + enables only SNMP and execd inputs, exposes no Telegraf listener, and + reaches InfluxDB over plaintext HTTP/1.1 on the internal Compose + network. Remove this exception as soon as an upstream Telegraf image + built with Go 1.27.2 and golang.org/x/net 0.60.0 is available.