Upgrade embedded Go from vulnerable go1.21.1 (CVE-2024-24790) to go1.22.4+

SonarQube Server / Community Build
, ,
1

We deploy Sonarqube in K8S with the offical docker image: 2025-lta-developer.

We noticed that the current SonarGo plugin (1.18.1.827) embeds ​​Go version 1.21.1​​ (sonar-go/sonar-go-to-slang/Makefile at 1.18.1.827 · SonarSource/sonar-go · GitHub), which is affected by ​​CVE-2024-24790​​ (CVSS 9.8, High Severity). This vulnerability allows malicious IPv6 addresses to bypass security checks.

Our security scans (JFrog Xray) flag this as a critical risk, any plan to upgrade the plugin?

2

Hello,

SonarQube is not affected by CVE-2024-24790, as the Go analyzer does not use the vulnerable net/netip package.

The affected dependency was upgraded in version 2025.2 (the latest version is 2025.4) as part of routine updates, not as a response to a security issue. We do not plan to backport this upgrade to version 2025.1 LTA.