—
GO-2025-3509
Vela Server Has Insufficient Webhook Payload Data Verification in github.com/go-vela/server
Quick fix
GO-2025-3509 — github.com/go-vela/server: upgrade to the fixed version with the command below.
go get github.com/go-vela/server@v0.25.3Details
Vela Server Has Insufficient Webhook Payload Data Verification in github.com/go-vela/server
Are you affected?
Enter the version of the package you're using.
Affected packages
Go/github.com/go-vela/server
Introduced in:
0Fixed in: 0.25.3Fix
go get github.com/go-vela/server@v0.25.3References
- https://github.com/go-vela/server/security/advisories/GHSA-9m63-33q3-xq5x[ADVISORY]
- https://nvd.nist.gov/vuln/detail/CVE-2025-27616[ADVISORY]
- https://github.com/go-vela/server/commit/257886e5a3eea518548387885894e239668584f5[FIX]
- https://github.com/go-vela/server/commit/67c1892e2464dc54b8d2588815dfb7819222500b[FIX]
- https://github.com/go-vela/server/releases/tag/v0.25.3[WEB]
- https://github.com/go-vela/server/releases/tag/v0.26.3[WEB]