PT-2026-26793 · Go · Github.Com/Arslanbekov/Terraform-Provider-Sendgrid

Published 2026-03-11 · Updated 2026-03-11

OSV

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Summary

A critical vulnerability has been identified at https://security.snyk.io/package/linux/chainguard:latest/terraform-provider-sendgrid, associated with the underlying Go version.

If the server's TLS configuration is mutated between connections — for example, a CA is removed from the trusted list via Config.Clone() combined with modification or GetConfigForClient — the resumed handshake still succeeds using the cached session. The certificate is not re-checked against the updated CA list.

As a result, a client whose CA was revoked or removed between the first and second connection could still establish a connection on the resumed session.

Details

If the server's TLS configuration is mutated between connections — for example, a CA is removed from the trusted list via Config.Clone() combined with modification or GetConfigForClient — the resumed handshake still succeeds using the cached session. The certificate is not re-checked against the updated CA list.

Consequently, a client whose CA was revoked or removed between the first and second connection could still establish a connection on the resumed session.

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

GHSA-J443-WCQQ-XPRH

Affected Products

Github.Com/Arslanbekov/Terraform-Provider-Sendgrid

References · 5

• https://osv.dev/vulnerability/GHSA-j443-wcqq-xprh · Vendor Advisory
• https://github.com/arslanbekov/terraform-provider-sendgrid · Note
• https://github.com/arslanbekov/terraform-provider-sendgrid/security/advisories/GHSA-j443-wcqq-xprh · Note
• https://github.com/advisories/GHSA-h355-32pf-p2xm · Note
• https://security.snyk.io/vuln/SNYK-CHAINGUARDLATEST-TERRAFORMPROVIDERSENDGRID-15265295 · Note