Skip to content

Conversation

@yottta
Copy link
Contributor

@yottta yottta commented Aug 12, 2025

Per https://pkg.go.dev/vuln/GO-2025-3849: cancelling a query during a call to the Scan method of the returned Rows can result in unexpected results if other queries are being made in parallel. This can result in a race condition that may overwrite the expected results with those of another query, causing the call to Scan to return either unexpected results from the other query or an error.

Got fixed in 1.24.6

Resolves #3124

ℹ️ Should be backported to all active versions.

Checklist

  • I have read the contribution guide.
  • I have not used an AI coding assistant to create this PR.
  • I have written all code in this PR myself OR I have marked all code I have not written myself (including modified code, e.g. copied from other places and then modified) with a comment indicating where it came from.
  • I (and other contributors to this PR) have not looked at the Terraform source code while implementing this PR.

Go checklist

  • I have run golangci-lint on my change and receive no errors relevant to my code.
  • I have run existing tests to ensure my code doesn't break anything.
  • I have added tests for all relevant use cases of my code, and those tests are passing.
  • I have only exported functions, variables and structs that should be used from other packages.
  • I have added meaningful comments to all exported functions, variables, and structs.

Website/documentation checklist

  • I have locally started the website as described here and checked my changes.

Per the https://pkg.go.dev/vuln/GO-2025-3849: cancelling a query during
a call to the Scan method of the returned Rows can result in unexpected
results if other queries are being made in parallel. This can result in
a race condition that may overwrite the expected results with those of
another query, causing the call to Scan to return either unexpected
results from the other query or an error.

Got fixed in 1.24.6

Signed-off-by: Andrei Ciobanu <[email protected]>
@yottta yottta requested a review from a team as a code owner August 12, 2025 06:42
@github-actions
Copy link

Reminder for the PR assignee: If this is a user-visible change, please update the changelog as part of the PR.

@yottta yottta changed the title Bump go version to the latest one to fix sql/Rows.Scan Bump go version to 1.24.6 to fix sql/Rows.Scan Aug 12, 2025
@yottta yottta self-assigned this Aug 12, 2025
@yottta yottta merged commit e9d5a10 into main Aug 13, 2025
17 checks passed
@yottta yottta deleted the fix-GO-2025-3849 branch August 13, 2025 05:58
jgalais pushed a commit to jgalais/opentofu that referenced this pull request Nov 19, 2025
Signed-off-by: Andrei Ciobanu <[email protected]>
Signed-off-by: Jérôme Galais <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

GO-2025-3849 reported: database/sql race condition when cancelling a query concurrenly with scanning its results

5 participants