Early Publication Vulnerability in github.com/google/exposure-notifications-server
Summary
GO-2022-0381: Import of incorrectly embargoed keys could cause early publication in github.com/google/exposure-notifications-server. Affects github.com/google/exposure-notifications-server across 2 version ranges.
< 0.18.3
>= 0.19.0, < 0.19.2
Fixed in 0.18.3 or 0.19.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
github.com/google/exposure-notifications-server is a Go package that provides functionality for exposure notifications. It is used to build server applications that handle the exchange of temporary exposure keys between devices for contact tracing purposes. This package is vulnerable to an issue that could result in the early publication of embargoed keys.
Vulnerability Detail
The vulnerability in github.com/google/exposure-notifications-server arises from the incorrect import of embargoed keys. This can lead to the premature publication of these keys, potentially compromising the effectiveness of exposure notifications and contact tracing efforts. The vulnerability affects versions 0.0.0 to 0.18.2 and 0.19.0 to 0.19.1 of the package.
How To Fix
Latest published version: v1.17.0 as of 23 Oct 2026
go get github.com/google/exposure-notifications-server@v1.17.0Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 0.18.30.18.3go get github.com/google/exposure-notifications-server@v0.18.3 -
>= 0.19.0, < 0.19.20.19.2go get github.com/google/exposure-notifications-server@v0.19.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update to the fixed versions of the package as soon as possible.
Conclusion
The vulnerability in github.com/google/exposure-notifications-server can lead to the premature publication of embargoed keys, potentially compromising exposure notifications and contact tracing efforts. It is crucial to update to the fixed versions of the package (0.18.3 or 0.19.2) to mitigate this vulnerability.
See every vulnerability recorded for github.com/google/exposure-notifications-server →
FAQ
The vulnerability could result in the premature publication of embargoed keys, compromising the effectiveness of exposure notifications and contact tracing efforts.
Versions 0.0.0 to 0.18.2 and 0.19.0 to 0.19.1 of the package are affected.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation.
No, there is no known workaround for this vulnerability. It is essential to update to the fixed versions of the package.
You can find more information about this vulnerability in the VulnDB entry at https://pkg.go.dev/vuln/GO-2022-0381.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/google/exposure-notifications-server.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
