GHSA-gmq2-39ff-f5qg
A failed upgrade may lead to hung goroutines
GHSA-gmq2-39ff-f5qg is a vulnerability with no CVSS score yet in github.com/cloudflare/tableflip, published May 21, 2021. No source lists public exploit code. Fixed in github.com/cloudflare/tableflip 1.2.1.
- Severity
- UnratedNo CVSS score yet
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
1.2.1github.com/cloudflare/tableflip +1 more
Description
Impact
Processes using tableflip may encounter hung goroutines in the parent process, after a failed upgrade.
The Go runtime has annoying behaviour around setting and clearing O_NONBLOCK: exec.Cmd.Start() ends up calling os.File.Fd() for any file in exec.Cmd.ExtraFiles. os.File.Fd() disables both the use of the runtime poller for the file and clears O_NONBLOCK from the underlying open file descriptor.
This can lead to goroutines hanging in a parent process, after at least one failed upgrade. The bug manifests in goroutines which rely on either a deadline or interruption via Close() to be unblocked being stuck in read or accept like syscalls. As far as I can tell we've not experienced this problem in production, so it's most likely quite rare.
Patches
The problem has been fixed in v1.2.2.
Workarounds
None.
References
Affected packages
| Package | Affected | Fixed |
|---|---|---|
github.com/cloudflare/tableflipGo | before 1.2.1 | 1.2.1 |
github.com/cloudflare/tableflipGo | before 1.2.2 | 1.2.2 |
What each source reports
GitHub AdvisoriesNo score
A failed upgrade may lead to hung goroutines
Impact
Processes using tableflip may encounter hung goroutines in the parent process, after a failed upgrade.
The Go runtime has annoying behaviour around setting and clearing O_NONBLOCK: exec.Cmd.Start() ends up calling os.File.Fd() for any file in exec.Cmd.ExtraFiles. os.File.Fd() disables both the use of the runtime poller for the file and clears O_NONBLOCK from the underlying open file descriptor.
This can lead to goroutines hanging in a parent process, after at least one failed upgrade. The bug manifests in goroutines which rely on either a deadline or interruption via Close() to be unblocked being stuck in read or accept like syscalls. As far as I can tell we've not experienced this problem in production, so it's most likely quite rare.
Patches
The problem has been fixed in v1.2.2.
Workarounds
None.
References
- Record
GHSA-gmq2-39ff-f5qg- Updated
- 2026-11-02
OSVNo score
A failed upgrade may lead to hung goroutines
Impact
Processes using tableflip may encounter hung goroutines in the parent process, after a failed upgrade.
The Go runtime has annoying behaviour around setting and clearing O_NONBLOCK: exec.Cmd.Start() ends up calling os.File.Fd() for any file in exec.Cmd.ExtraFiles. os.File.Fd() disables both the use of the runtime poller for the file and clears O_NONBLOCK from the underlying open file descriptor.
This can lead to goroutines hanging in a parent process, after at least one failed upgrade. The bug manifests in goroutines which rely on either a deadline or interruption via Close() to be unblocked being stuck in read or accept like syscalls. As far as I can tell we've not experienced this problem in production, so it's most likely quite rare.
Patches
The problem has been fixed in v1.2.2.
Workarounds
None.
References
- Record
GHSA-gmq2-39ff-f5qg- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.