{"action":"Upgrade github.com/ydb-platform/ydb-go-sdk/v3 to 3.134.2 or later.","affected":[{"fixed":"3.134.2","introduced":"3.104.6"}],"component":"github.com/ydb-platform/ydb-go-sdk/v3","cve_ids":[],"ecosystem":"Go","exploited":false,"fixed_versions":["3.134.2"],"ghsa_id":"GHSA-28xx-pppm-vqff","id":"tcs_01M5KERV8GJPN9S9AH4XPD1DWS","modified_at":"2026-06-08T20:10:28Z","published_at":"2026-04-30T18:21:04Z","references":["https://osv.dev/vulnerability/GHSA-28xx-pppm-vqff","https://github.com/ydb-platform/ydb-go-sdk/security/advisories/GHSA-28xx-pppm-vqff","https://github.com/ydb-platform/ydb-go-sdk/pull/2091","https://github.com/ydb-platform/ydb-go-sdk/commit/251128a64763555d9a79ee7a131dd154c9000eb9","https://github.com/ydb-platform/ydb-go-sdk/commit/25dcff4c41153f1f9413512ba12999b40bf7154d","https://github.com/ydb-platform/ydb-go-sdk","https://github.com/ydb-platform/ydb-go-sdk/releases/tag/v3.104.6","https://github.com/ydb-platform/ydb-go-sdk/releases/tag/v3.134.1","https://github.com/ydb-platform/ydb-go-sdk/releases/tag/v3.134.2"],"severity":{"label":"low"},"sources":[{"source":"osv","source_id":"GHSA-28xx-pppm-vqff","url":"https://osv.dev/vulnerability/GHSA-28xx-pppm-vqff"}],"summary":"ydb-go-sdk's transactions are not committed using the `options.WithCommit()` option on last call `table.Transaction.Execute` in transaction"}