cloudflared/2025.11.1-r2: cve remediation

[octo-sts]

cloudflared/2025.11.1-r2: fix GHSA-93mf-426m-g6x9

Advisory data: https://github.com/wolfi-dev/advisories/blob/main/cloudflared.advisories.yaml

---

"Breadcrumbs" for this automated service

• Source Code: https://go/cve-remedy-automation-source
• Logs: https://go/cve-remedy-automation-logs
• Docs: (not provided yet)

Inspected git repositories: https://github.com/cloudflare/cloudflared@2025.11.1

[octo-sts]

🛑 Build Failed: Compilation

undefined: quic.Conn and related QUIC interface compilation errors in github.com/coredns/coredns/core/dnsserver

Build Details

Category	Details
Build System	Go
Failure Point	go build command during compilation of ./cmd/cloudflared

Root Cause Analysis 🔍

The coredns dependency has incompatible QUIC interface usage after the go/bump step updated dependencies. The quic.Conn type is undefined and *quic.Stream is being used as a pointer to interface rather than interface, causing multiple compilation errors in the QUIC server implementation.

---

🔍 Build failure fix suggestions

Found similar build failures that have been fixed in the past and analyzed them to suggest a fix:

Similar PRs with fixes

• teleport-18/18.2.10 package update #69990
• k3s-1.33/1.33.5.1-r0: cve remediation #68666

Suggested Changes

File: cloudflared.yaml

• modification at line 25-28 (pipeline go/bump step)
  Original:

  - uses: go/bump
    with:
      deps: |-
        golang.org/x/crypto@v0.45.0
        github.com/coredns/coredns@v1.12.4

Replacement:

  - uses: go/bump
    with:
      deps: |-
        golang.org/x/crypto@v0.45.0
        github.com/coredns/coredns@v1.12.4
        github.com/quic-go/quic-go@v0.54.1

Content:

Add github.com/quic-go/quic-go@v0.54.1 to the deps list in the go/bump step

Click to expand fix analysis

Analysis

Both similar fixes follow a consistent pattern: they address QUIC-related compilation errors by upgrading the quic-go dependency to v0.54.1 using go/bump. Fix #0 (teleport-18) upgraded quic-go to v0.54.1 and applied patches for API compatibility changes. Fix #1 (k3s-1.33) upgraded multiple QUIC-related dependencies including quic-go@v0.54.1, webtransport-go@v0.9.0, and go-libp2p@v0.44.0. The pattern indicates that quic.Conn and related QUIC interface issues are resolved by upgrading to compatible versions of the quic-go ecosystem.

Click to expand fix explanation

Explanation

The QUIC compilation errors (undefined: quic.Conn and related interface issues) are occurring because the coredns dependency update introduced incompatible QUIC interface usage. Both similar fixes demonstrate that upgrading quic-go to v0.54.1 resolves these exact compilation errors. The quic-go v0.54.1 version contains the proper API definitions for quic.Conn and fixes the interface compatibility issues. By adding this dependency upgrade to the existing go/bump step, the build system will ensure that all QUIC-related dependencies use compatible versions, resolving the undefined type errors in the coredns/coredns/core/dnsserver package.

Click to expand alternative approaches

Alternative Approaches

• Downgrade github.com/coredns/coredns to an earlier version that's compatible with the current quic-go version, though this would go against Wolfi's principle of using latest versions
• Add additional QUIC-related dependency upgrades like webtransport-go@v0.9.0 if the single quic-go upgrade doesn't resolve all compatibility issues
• Apply source patches to cloudflared code to adapt to QUIC API changes, similar to the teleport fix, but this would require maintaining custom patches

---

Was this comment helpful? Please use 👍 or 👎 reactions on this comment.

[octo-sts]

This vulnerability remediation is stale and no longer needed. 👋

Advisory CGA-w629-mx4q-2f4p has the latest event type of "pending-upstream-fix"

View with: cg advisory show CGA-w629-mx4q-2f4p
Or view on GitHub: https://github.com/wolfi-dev/advisories/blob/main/cloudflared.advisories.yaml

ID:      CGA-w629-mx4q-2f4p
Package: cloudflared
Aliases: CVE-2025-58063 GHSA-93mf-426m-g6x9
Events:
  - "scan/v1" at 2025-09-10 07:05:29 UTC
  - "pending-upstream-fix" at 2025-09-11 10:12:37 UTC

🔀 v2 advisory logic would not have closed this PR: Found 4 advisories, but 2 of them are not resolved (CGA-mx4m-qf9v-55f4, CGA-9cx8-4m3x-r4mr).

[octo-sts]

This vulnerability remediation is stale and no longer needed. 👋

Advisory CGA-w629-mx4q-2f4p has the latest event type of "pending-upstream-fix"

View with: cg advisory show CGA-w629-mx4q-2f4p
Or view on GitHub: https://github.com/wolfi-dev/advisories/blob/main/cloudflared.advisories.yaml

ID:      CGA-w629-mx4q-2f4p
Package: cloudflared
Aliases: CVE-2025-58063 GHSA-93mf-426m-g6x9
Events:
  - "scan/v1" at 2025-09-10 07:05:29 UTC
  - "pending-upstream-fix" at 2025-09-11 10:12:37 UTC

[octo-sts]

This vulnerability remediation is stale and no longer needed. 👋

Advisory CGA-3j73-w8w9-7p5m has the latest event type of "PENDING_UPSTREAM_FIX"

View with: cg adv show CGA-3j73-w8w9-7p5m

ID:      CGA-3j73-w8w9-7p5m
Package: cloudflared
Aliases: CVE-2025-58063 GHSA-93mf-426m-g6x9 GO-2025-3942 CGA-3v87-hwj5-gf23
Events:
  - "DETECTION" at 2025-09-10 07:05:29 UTC
  - "PENDING_UPSTREAM_FIX" at 2025-09-11 10:12:37 UTC