Hung Goroutines Vulnerability in github.com/cloudflare/tableflip
Summary
GHSA-gmq2-39ff-f5qg: A failed upgrade may lead to hung goroutines. Affects github.com/cloudflare/tableflip versions < 1.2.2. Fixed in 1.2.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
github.com/cloudflare/tableflip is a Go package that provides graceful process upgrades for servers. It allows processes to be upgraded without dropping connections or interrupting client requests. The package utilizes the Go runtime and file descriptors to manage the upgrade process.
Vulnerability Detail
The vulnerability in github.com/cloudflare/tableflip can cause hung goroutines in the parent process after a failed upgrade. The issue arises due to the Go runtime's behavior when setting and clearing O_NONBLOCK. This behavior disables the use of the runtime poller and clears O_NONBLOCK from the underlying file descriptor. As a result, goroutines relying on deadlines or interruption via Close() can get stuck in read or accept syscalls. Although this issue is rare and has not been observed in production, it can potentially lead to unresponsive processes.
How To Fix
Latest published version: v1.2.3 as of 23 Oct 2026
go get github.com/cloudflare/tableflip@v1.2.3Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.2.2
This is the first release that contains the fix.
go get github.com/cloudflare/tableflip@v1.2.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for this vulnerability.
Conclusion
The hung goroutines vulnerability in github.com/cloudflare/tableflip can potentially lead to unresponsive processes. It is recommended to update the package dependency to version 1.2.2 to fix the vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for github.com/cloudflare/tableflip →
FAQ
The vulnerability can cause hung goroutines in the parent process after a failed upgrade, potentially leading to unresponsive processes.
No, there have been no reports of this vulnerability being observed in production environments.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation.
No, there are no known workarounds for this vulnerability.
To fix this vulnerability, update your package dependency to version 1.2.2 of github.com/cloudflare/tableflip.
