Bug Report: Transitive Vulnerability via golang.org/x/net — Please Upgrade to v0.41.0 #991

Is there an existing issue for this?

• I have searched the existing issues

Current Behavior

We are currently using github.com/gorilla/websocket version v1.5.2, which includes a transitive dependency on golang.org/x/net version v0.28.0.

During a security audit using Black Duck, a critical vulnerability was flagged in this transitive dependency. The issue relates to improper handling of IPv6 zone identifiers in the x/net/proxy and x/net/http/httpproxy modules. This flaw may allow attackers to bypass proxy configurations, posing a serious security risk.

To resolve this, we recommend updating golang.org/x/net to at least v0.41.0, which includes the necessary security patches.

Since this module is pulled in transitively through gorilla/websocket, we are unable to directly enforce this upgrade unless upstream dependencies are updated accordingly.

Please consider updating the dependency or providing guidance on a safe upgrade path.

Let us know if you need help validating or testing this change.

Expected Behavior

No response

Steps To Reproduce

No response

Anything else?

No response