Skip to content
Fencer Intel
low —

GHSA-28xx-pppm-vqff json

ydb-go-sdk's transactions are not committed using the `options.WithCommit()` option on last call `table.Transaction.Execute` in transaction

published 6mo ago modified 5mo ago also GO-2026-4983

cvss
—
not scored
cisa kev
Not listed
not in CISA's catalog
epss
—
no score, EPSS covers CVEs only
public exploits
0
none known

Summary

### Impact Transactions were NOT committed despite the explicit `options.WithCommit` flag using table service client. Because of this, clients did not commit changes to the transaction, relying on the fact that the transaction commit was successful. This led (in rare cases) to a loss of data consistency.

### Patches `ydb-go-sdk` contains this problem in versions from [v3.104.6](https://github.com/ydb-platform/ydb-go-sdk/releases/tag/v3.104.6) to [v3.134.1](https://github.com/ydb-platform/ydb-go-sdk/releases/tag/v3.134.1). The fix for this problem has been released in version [v3.134.2](https://github.com/ydb-platform/ydb-go-sdk/releases/tag/v3.134.2) (https://github.com/ydb-platform/ydb-go-sdk/pull/2091).

### Workarounds 1) Use explicit `table.Transaction.CommitTx(ctx)` instead use `options.WithCommit()`. 2) Use transaction retrier `db.Table().DoTx(ctx, lambda)` instead explicit start transaction on session. 3) Use query client `db.Query().Do(ctx, lambda)` with the same logic in `lambda`

### Resources Commit with bug https://github.com/ydb-platform/ydb-go-sdk/commit/251128a64763555d9a79ee7a131dd154c9000eb9 Commit with fix https://github.com/ydb-platform/ydb-go-sdk/commit/25dcff4c41153f1f9413512ba12999b40bf7154d

Patch / fix

  • go github.com/ydb-platform/ydb-go-sdk/v3 3.134.2

Is GHSA-28xx-pppm-vqff in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Affected packages

ecosystem package affected fixed in
go github.com/ydb-platform/ydb-go-sdk/v3
>=3.104.6, <3.134.2
3.134.2

Classification

Weakness
  • CWE-670 Always-Incorrect Control Flow Implementation

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.