GHSA-h5fq-653g-gxrm: ots has a negative expire override that can bypass its secret retention policy

May 5, 2026

The /api/create endpoint accepted negative expire query values. For the memory storage backend, negative values were passed to secret creation as a negative duration and treated as no expiry, allowing callers to create secrets that persisted longer than intended.

References

github.com/Luzifer/ots/commit/3511bd18a2bec75bd9c6b4d513f2a90ccf4209b7
github.com/Luzifer/ots/releases/tag/v1.21.5
github.com/Luzifer/ots/security/advisories/GHSA-h5fq-653g-gxrm
github.com/advisories/GHSA-h5fq-653g-gxrm

Code Behaviors & Features

Detect and mitigate GHSA-h5fq-653g-gxrm with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →