chore(core): cve mitigation 17-03-26

[LopatinDmitr]

Description

• Fix CVE-2026-25679 net/url: Incorrect parsing of IPv6 host literals in net/url
• Fix CVE-2026-27142 html/template: URLs in meta content attribute actions are not escaped in html/template...
• Fix CVE-2026-27139 os: FileInfo can escape from a Root in golang os module
• Fix CVE-2026-33186 gRPC-Go has an authorization bypass via missing leading slash in :path
• Fix CVE-2026-34040 Moby has AuthZ plugin bypass when provided oversized request bodies
• Fix CVE-2026-33997 Moby has an Off-by-one error in its plugin privilege validation

Also:

• Bump go to 1.25.8
• chore(core): cve mitigation 17-03-26 3p-containerized-data-importer#32
• chore(core): cve mitigation 17-03-26 3p-kubevirt#94

Checklist

• The code is covered by unit tests.
• e2e tests passed.
• Documentation updated according to the changes.
• Changes were tested in the Kubernetes cluster manually.

Changelog entries

section: core
type: fix
summary: Fixed vulnerabilities CVE-2026-25679, CVE-2026-27142, CVE-2026-27139, CVE-2026-33186, CVE-2026-34040, CVE-2026-33997.