Vulnerabilities in pkg:golang/github.com/arslanbekov/terraform-provider-sendgrid
PACKAGEGHSA-j443-wcqq-xprh is a CRITICAL (CVSS 10.0) tls session resumption bypasses certificate vulnerability (CWE-295: Improper Certificate Validation) affecting Terraform Provider for SendGrid libraries in the Go ecosystem. The issue involves tls session resumption bypasses certificate authority trust store modifications in go. Remediation is available in the latest vendor maintenance releases.
pkg:golang/github.com/arslanbekov/terraform-provider-sendgrid
Vulnerability advisories affecting package pkg:golang/github.com/arslanbekov/terraform-provider-sendgrid. Select an advisory below to view technical details or fixes.
| Advisory ID | CVE / NVD | Severity | Summary |
|---|---|---|---|
| GHSA-j443-wcqq-xprh | - | CRITICAL | Terraform Provider for SendGrid: TLS Session Resumption Bypasses Certificate Authority Trust Store Modifications in Go |
GHSA-j443-wcqq-xprh at a Glance
Security Impact
CVSS: 10.0
The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).
How to Fix GHSA-j443-wcqq-xprh
To remediate this vulnerability, upgrade all affected Terraform Provider for SendGrid dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
Upgrade github.com/arslanbekov/terraform-provider-sendgrid to Latest secure releaseRun the following command in your project directory to verify that all resolved dependencies use the patched release:
inspect dependencies for github.com/arslanbekov/terraform-provider-sendgridHow to Check if You Are Affected
To determine whether your application is affected by GHSA-j443-wcqq-xprh, inspect your project dependencies for Terraform Provider for SendGrid:
inspect dependencies for github.com/arslanbekov/terraform-provider-sendgridAnalyze the terminal output to locate any version of Terraform Provider for SendGrid in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.
Note: Verify declared build manifests and deployed runtime container environments.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-295: Improper Certificate Validation, where the product does not validate, or incorrectly validates, a certificate. In Terraform Provider for SendGrid, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
GHSA-j443-wcqq-xprh Affected Terraform Provider for SendGrid Versions
1 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
github.com/arslanbekov/terraform-provider-sendgrid
|
Go |
≤ 1.1.3-0.20250606002314-b4a2dfeb7b0f
|
|
References
Frequently Asked Questions
What is GHSA-j443-wcqq-xprh?
Which Terraform Provider for SendGrid versions are affected?
What version fixes GHSA-j443-wcqq-xprh?
Is github.com/arslanbekov/terraform-provider-sendgrid affected?
What is the CVSS score of GHSA-j443-wcqq-xprh?
What CWE is associated with GHSA-j443-wcqq-xprh?
How can I check Go dependencies for GHSA-j443-wcqq-xprh?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-j443-wcqq-xprh",
"modified" : "2026-03-11T00:32:49Z",
"published" : "2026-03-11T00:32:49Z",
"aliases" : [ ],
"summary" : "Terraform Provider for SendGrid: TLS Session Resumption Bypasses Certificate Authority Trust Store Modifications in Go",
"details" : "### Summary\n\nA critical vulnerability has been identified at https://security.snyk.io/package/linux/chainguard:latest/terraform-provider-sendgrid, associated with the underlying Go version.\n\nIf the server's TLS configuration is mutated between connections — for example, a CA is removed from the trusted list via `Config.Clone()` combined with modification or `GetConfigForClient` — the resumed handshake still succeeds using the cached session. The certificate is not re-checked against the updated CA list.\n\nAs a result, a client whose CA was revoked or removed between the first and second connection could still establish a connection on the resumed session.\n\n### Details\n\nIf the server's TLS configuration is mutated between connections — for example, a CA is removed from the trusted list via `Config.Clone()` combined with modification or `GetConfigForClient` — the resumed handshake still succeeds using the cached session. The certificate is not re-checked against the updated CA list.\n\nConsequently, a client whose CA was revoked or removed between the first and second connection could still establish a connection on the resumed session.",
"severity" : [ {
"type" : "CVSS_V3",
"score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "Go",
"name" : "github.com/arslanbekov/terraform-provider-sendgrid"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"last_affected" : "1.1.3-0.20250606002314-b4a2dfeb7b0f"
} ]
} ]
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/arslanbekov/terraform-provider-sendgrid/security/advisories/GHSA-j443-wcqq-xprh"
}, {
"type" : "ADVISORY",
"url" : "https://github.com/advisories/GHSA-h355-32pf-p2xm"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/arslanbekov/terraform-provider-sendgrid"
}, {
"type" : "WEB",
"url" : "https://security.snyk.io/vuln/SNYK-CHAINGUARDLATEST-TERRAFORMPROVIDERSENDGRID-15265295"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-295" ],
"severity" : "CRITICAL",
"github_reviewed" : true,
"github_reviewed_at" : "2026-03-11T00:32:49Z",
"nvd_published_at" : null
}
}