fix(cve): CVE-2026-32280, CVE-2026-32281 - update Go 1.25.8 to 1.25.9 [release-v0.37.6]

[divyansh42]

Summary

This PR fixes CVE-2026-32280 and CVE-2026-32281 by updating Go from 1.25.8 to 1.25.9 in the release-v0.37.6 branch (Pipelines 1.15).

CVE Details

CVE	Package	Severity	CVSS	Affected	Fixed
CVE-2026-32280	Go crypto/x509, crypto/tls	HIGH	7.5	< 1.25.9	1.25.9
CVE-2026-32281	Go crypto/x509	HIGH	7.5	< 1.25.9	1.25.9

CVE-2026-32280: During chain building, the amount of work done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions.Intermediates, potentially causing denial of service.

CVE-2026-32281: Validating certificate chains which use policies is unexpectedly inefficient when certificates contain a very large number of policy mappings, possibly causing denial of service.

Fix Summary

• Updated go.mod from go 1.25.8 to go 1.25.9
• Ran go mod tidy, go mod verify, and go mod vendor
• Build verified: go build ./... exits 0

Test Results

Status: ⚠️ No automated unit tests run (build-only verification)

Tests discovered: Build compilation check only
Test command: go build ./...
Result: ✅ PASSED (exit code 0)

ℹ️ Full test suite runs in CI/CD after PR creation. No automated pre-PR test suite was executed — build compilation confirms code integrity.

Breaking Changes

None. This is a Go patch version bump within the same minor line (1.25.8 → 1.25.9). No API changes or breaking changes introduced.

Verification Steps

• Go updated from 1.25.8 to 1.25.9 in go.mod
• go mod tidy completed successfully
• go mod verify: all modules verified
• go mod vendor completed successfully
• Build passes: go build ./...
• CI/CD checks pass
• Verify CVE resolution with security scanner

Risk Assessment

Factor	Assessment
Risk Level	Low
Breaking Changes	None (patch version bump)
Compatibility	Go 1.25.9 is backward compatible
Impact	Removes DoS vulnerability in certificate chain validation

Jira References

Resolves: SRVKP-12045, SRVKP-12003

---

🤖 Generated by CVE Fixer Workflow

[tekton-robot]

@divyansh42: Adding the "do-not-merge/release-note-label-needed" label because no release-note block was detected, please follow our release note process to remove it.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[linux-foundation-easycla]

The committers listed above are authorized under a signed CLA.

• ✅ login: divyansh42 / name: divyansh42 (d9b0f66)

[tekton-robot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
To complete the pull request process, please ask for approval from divyansh42 after the PR has been reviewed.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[divyansh42]

Closing in favor of #2880 which now covers all Go 1.25.9 CVEs (CVE-2026-32282, CVE-2026-32280, CVE-2026-32281, CVE-2026-32283) in a single PR.