ydb-go-sdk's transactions are not committed using the `options.WithCommit()` option on…
Key facts
- Attack vector
- —
- Privileges required
- —
- User interaction
- —
- Attack complexity
- —
- Impact type
- —
- Confidentiality · integrity · availability
- —
- Fix status
- Fixed
No CVSS vector from any source. Fix status from GitHub.
Summary
### Impact Transactions were NOT committed despite the explicit `options.WithCommit` flag using table service client. Because of this, clients did not commit changes to the transaction, relying on the fact that the transaction commit was successful. This led (in rare cases) to a loss of data consistency. ### Patches `ydb-go-sdk` contains this problem in versions from [v3.104.6](https://github.com/ydb-platform/ydb-go-sdk/releases/tag/v3.104.6) to [v3.134.1](https://github.com/ydb-platform/ydb-go-sdk/releases/tag/v3.134.1). The fix for this problem has been released in version [v3.134.2](https://github.com/ydb-platform/ydb-go-sdk/releases/tag/v3.134.2) (https://github.com/ydb-platform/ydb-go-sdk/pull/2091). ### Workarounds 1) Use explicit `table.Transaction.CommitTx(ctx)` instead use `options.WithCommit()`. 2) Use transaction retrier `db.Table().DoTx(ctx, lambda)` instead explicit start transaction on session. 3) Use query client `db.Query().Do(ctx, lambda)` with the same logic in `lambda` ### Resources Commit with bug https://github.com/ydb-platform/ydb-go-sdk/commit/251128a64763555d9a79ee7a131dd154c9000eb9 Commit with fix https://github.com/ydb-platform/ydb-go-sdk/commit/25dcff4c41153f1f9413512ba12999b40bf7154d
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | github.com/ydb-platform/ydb-go-sdk/v3 (Go) | 3.104.6 to before 3.134.2 | 3.134.2 | Patch available | GHSA-28xx-pppm-vqff |
- github.com/ydb-platform/ydb-go-sdk/v3 (Go) Vendor— Affected 3.104.6 to before 3.134.2 Fixed in 3.134.2 Patch available GHSA-28xx-pppm-vqff
Remediation
- Fix · GHSA-28xx-pppm-vqff github.com/ydb-platform/ydb-go-sdk/v3 (Go) Fixed in 3.134.2 Advisory →
Timeline
- 2026-10-03 Threatist record created from GHSA-28xx-pppm-vqff
References
Other 8
- https://github.com/ydb-platform/ydb-go-sdk/security/advisories/GHSA-28xx-pppm-vqff
- https://github.com/ydb-platform/ydb-go-sdk/pull/2091
- https://github.com/ydb-platform/ydb-go-sdk/commit/251128a64763555d9a79ee7a131dd154c9000eb9
- https://github.com/ydb-platform/ydb-go-sdk/commit/25dcff4c41153f1f9413512ba12999b40bf7154d
- https://github.com/ydb-platform/ydb-go-sdk
- https://github.com/ydb-platform/ydb-go-sdk/releases/tag/v3.104.6
- https://github.com/ydb-platform/ydb-go-sdk/releases/tag/v3.134.1
- https://github.com/ydb-platform/ydb-go-sdk/releases/tag/v3.134.2
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences