{"action":"Upgrade github.com/ydb-platform/ydb-go-sdk/v3 to 3.134.2 or later.","affected":[{"fixed":"3.134.2","introduced":"3.104.6"}],"component":"github.com/ydb-platform/ydb-go-sdk/v3","cve_ids":[],"ecosystem":"Go","exploited":false,"fixed_versions":["3.134.2"],"ghsa_id":"GHSA-28xx-pppm-vqff","id":"tcs_01M5KGH5V1J37Z3CC4JPG5R3NC","modified_at":"2026-05-20T19:30:12.916456195Z","published_at":"2026-05-20T19:07:16Z","references":["https://osv.dev/vulnerability/GO-2026-4983","https://github.com/ydb-platform/ydb-go-sdk/security/advisories/GHSA-28xx-pppm-vqff","https://github.com/ydb-platform/ydb-go-sdk/commit/251128a64763555d9a79ee7a131dd154c9000eb9","https://github.com/ydb-platform/ydb-go-sdk/commit/25dcff4c41153f1f9413512ba12999b40bf7154d","https://github.com/ydb-platform/ydb-go-sdk/pull/2091","https://github.com/ydb-platform/ydb-go-sdk/releases/tag/v3.104.6","https://github.com/ydb-platform/ydb-go-sdk/releases/tag/v3.134.1","https://github.com/ydb-platform/ydb-go-sdk/releases/tag/v3.134.2"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"GO-2026-4983","url":"https://osv.dev/vulnerability/GO-2026-4983"}],"summary":"ydb-go-sdk's transactions are not committed using the `options.WithCommit()` option on last call `table.Transaction.Execute` in transaction in github.com/ydb-platform/ydb-go-sdk"}