Version 0.8.1-4 of golang-github-containers-gvisor-tap-vsocks is marked for autoremoval from testing on Mon 30 Nov 2026. It depends (transitively) on golang-gvisor-gvisor, affected by #1150508, #1150510. You should try to prevent the removal by fixing these RC bugs.
CVE-2026-107935:
A path traversal vulnerability was found in gvproxy, the network forwarder provided by the gvisor-tap-vsock package. The unauthenticated /services/forwarder/expose endpoint does not validate the caller-supplied socket path, allowing an attacker to delete arbitrary files on the host system.
CVE-2026-107935:
A path traversal vulnerability was found in gvproxy, the network forwarder provided by the gvisor-tap-vsock package. The unauthenticated /services/forwarder/expose endpoint does not validate the caller-supplied socket path, allowing an attacker to delete arbitrary files on the host system.
vcswatch reports that
this package seems to have a new changelog entry (version
0.8.1-6, distribution
unstable) and new commits
in its VCS. You should consider whether it's time to make
an upload.
1 issue left for the package maintainer to handle:
CVE-2026-107935:
(needs triaging)
A path traversal vulnerability was found in gvproxy, the network forwarder provided by the gvisor-tap-vsock package. The unauthenticated /services/forwarder/expose endpoint does not validate the caller-supplied socket path, allowing an attacker to delete arbitrary files on the host system.
Migration status for golang-github-containers-gvisor-tap-vsocks (0.8.1-4 to 0.8.1-5): BLOCKED: Rejected/violates migration policy/introduces a regression
![[bug history graph]](https://qa.debian.org/data/bts/graphs/g/golang-github-containers-gvisor-tap-vsocks.png){kind=link}