Read the docs
TI-2026-66634 Aliases GHSA-28xx-pppm-vqff

ydb-go-sdk's transactions are not committed using the `options.WithCommit()` option on…

Priority LOW 38CWE-670Published · Updated

Key facts

Attack vector
—
Privileges required
—
User interaction
—
Attack complexity
—
Impact type
—
Confidentiality · integrity · availability
—
Fix status
Fixed

No CVSS vector from any source. Fix status from GitHub.

Summary

### Impact Transactions were NOT committed despite the explicit `options.WithCommit` flag using table service client. Because of this, clients did not commit changes to the transaction, relying on the fact that the transaction commit was successful. This led (in rare cases) to a loss of data consistency. ### Patches `ydb-go-sdk` contains this problem in versions from [v3.104.6](https://github.com/ydb-platform/ydb-go-sdk/releases/tag/v3.104.6) to [v3.134.1](https://github.com/ydb-platform/ydb-go-sdk/releases/tag/v3.134.1). The fix for this problem has been released in version [v3.134.2](https://github.com/ydb-platform/ydb-go-sdk/releases/tag/v3.134.2) (https://github.com/ydb-platform/ydb-go-sdk/pull/2091). ### Workarounds 1) Use explicit `table.Transaction.CommitTx(ctx)` instead use `options.WithCommit()`. 2) Use transaction retrier `db.Table().DoTx(ctx, lambda)` instead explicit start transaction on session. 3) Use query client `db.Query().Do(ctx, lambda)` with the same logic in `lambda` ### Resources Commit with bug https://github.com/ydb-platform/ydb-go-sdk/commit/251128a64763555d9a79ee7a131dd154c9000eb9 Commit with fix https://github.com/ydb-platform/ydb-go-sdk/commit/25dcff4c41153f1f9413512ba12999b40bf7154d

Why it matters now

Fix Fixed github.com/ydb-platform/ydb-go-sdk/v3 (Go): 3.134.2

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—github.com/ydb-platform/ydb-go-sdk/v3 (Go)3.104.6 to before 3.134.23.134.2Patch availableGHSA-28xx-pppm-vqff
  • github.com/ydb-platform/ydb-go-sdk/v3 (Go) Vendor— Affected 3.104.6 to before 3.134.2 Fixed in 3.134.2 Patch available GHSA-28xx-pppm-vqff

Remediation

  • Fix · GHSA-28xx-pppm-vqff github.com/ydb-platform/ydb-go-sdk/v3 (Go) Fixed in 3.134.2 Advisory →

Timeline

  1. 2026-10-03 Threatist record created from GHSA-28xx-pppm-vqff

References

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences