chore(core): cve mitigation 11-05-2026

[LopatinDmitr]

Description

• Fix CVE-2026-29181: OpenTelemetry-Go: multi-value baggage header extraction causes excessive
  allocations (remote dos amplification)
• Fix CVE-2026-33811: When using LookupCNAME with the cgo DNS resolver, a very long CNAME...
• Fix CVE-2026-33814: When processing HTTP/2 SETTINGS frames, transport will enter an infini ...
• Fix CVE-2026-39820: Well-crafted inputs reaching ParseAddress, ParseAddressList, and Parse ...
• Fix CVE-2026-39823: CVE-2026-27142 fixed a vulnerability in which URLs were not correctly ...
• Fix CVE-2026-39825: ReverseProxy can forward queries containing parameters not visible to ...
• Fix CVE-2026-39826: If a trusted template author were to write a <script> tag containing...
• Fix CVE-2026-39836: Panic in Dial and LookupPort when handling NUL byte on Windows in...
• Fix CVE-2026-41520: Cillium exposes sensitive information included in the cilium-bugtool debug
  archive
• Fix CVE-2026-42499: Pathological inputs could cause DoS through consumePhrase when parsing ...

Why do we need it, and what problem does it solve?

Security vulnerabilities were identified in several Go libraries and bundled components used by the module. These issues may lead to denial of service, incorrect URL handling, HTTP/2 transport problems, template-related risks, DNS resolver issues, and exposure of sensitive debug information. This change updates affected dependencies and image versions to include upstream fixes and reduce security risk.

What is the expected result?

1. Build module images and artifacts with updated dependency versions.
2. Verify the updated Go modules resolve successfully.
3. Ensure the module uses patched component versions instead of vulnerable ones.
4. Confirm regular module workflows continue to operate without regressions.

Checklist

• The code is covered by unit tests.
• e2e tests passed.
• Documentation updated according to the changes.
• Changes were tested in the Kubernetes cluster manually.

Changelog entries

section: core
type: chore
summary: |
  Fixed vulnerability:
  - CVE-2026-29181
  - CVE-2026-33811
  - CVE-2026-33814
  - CVE-2026-39820
  - CVE-2026-39823
  - CVE-2026-39825
  - CVE-2026-39826
  - CVE-2026-39836
  - CVE-2026-41520
  - CVE-2026-42499