{
"id": "GHSA-28xx-pppm-vqff",
"aliases": [],
"details": "### Impact\nTransactions were NOT committed despite the explicit `options.WithCommit` flag using table service client. Because of this, clients did not commit changes to the transaction, relying on the fact that the transaction commit was successful. This led (in rare cases) to a loss of data consistency.\n\n### Patches\n`ydb-go-sdk` contains this problem in versions from [v3.104.6](https://github.com/ydb-platform/ydb-go-sdk/releases/tag/v3.104.6) to [v3.134.1](https://github.com/ydb-platform/ydb-go-sdk/releases/tag/v3.134.1). The fix for this problem has been released in version [v3.134.2](https://github.com/ydb-platform/ydb-go-sdk/releases/tag/v3.134.2) (https://github.com/ydb-platform/ydb-go-sdk/pull/2091).\n\n### Workarounds\n1) Use explicit `table.Transaction.CommitTx(ctx)` instead use `options.WithCommit()`.\n2) Use transaction retrier `db.Table().DoTx(ctx, lambda)` instead explicit start transaction on session.\n3) Use query client `db.Query().Do(ctx, lambda)` with the same logic in `lambda`\n\n### Resources\nCommit with bug https://github.com/ydb-platform/ydb-go-sdk/commit/251128a64763555d9a79ee7a131dd154c9000eb9\nCommit with fix https://github.com/ydb-platform/ydb-go-sdk/commit/25dcff4c41153f1f9413512ba12999b40bf7154d",
"summary": "ydb-go-sdk's transactions are not committed using the `options.WithCommit()` option on last call `table.Transaction.Execute` in transaction",
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "3.104.6"
},
{
"fixed": "3.134.2"
}
]
}
],
"package": {
"name": "github.com/ydb-platform/ydb-go-sdk/v3",
"ecosystem": "Go"
},
"database_specific": {
"last_known_affected_version_range": "<= 3.134.1"
}
}
],
"modified": "2026-06-08T20:10:28Z",
"severity": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U"
}
],
"published": "2026-04-30T18:21:04Z",
"references": [
{
"url": "https://github.com/ydb-platform/ydb-go-sdk/security/advisories/GHSA-28xx-pppm-vqff",
"type": "WEB"
},
{
"url": "https://github.com/ydb-platform/ydb-go-sdk/pull/2091",
"type": "WEB"
},
{
"url": "https://github.com/ydb-platform/ydb-go-sdk/commit/251128a64763555d9a79ee7a131dd154c9000eb9",
"type": "WEB"
},
{
"url": "https://github.com/ydb-platform/ydb-go-sdk/commit/25dcff4c41153f1f9413512ba12999b40bf7154d",
"type": "WEB"
},
{
"url": "https://github.com/ydb-platform/ydb-go-sdk",
"type": "PACKAGE"
},
{
"url": "https://github.com/ydb-platform/ydb-go-sdk/releases/tag/v3.104.6",
"type": "WEB"
},
{
"url": "https://github.com/ydb-platform/ydb-go-sdk/releases/tag/v3.134.1",
"type": "WEB"
},
{
"url": "https://github.com/ydb-platform/ydb-go-sdk/releases/tag/v3.134.2",
"type": "WEB"
}
],
"schema_version": "1.4.0",
"database_specific": {
"cwe_ids": [
"CWE-670"
],
"severity": "LOW",
"github_reviewed": true,
"nvd_published_at": null,
"github_reviewed_at": "2026-04-30T18:21:04Z"
}
}