{ "SchemaVersion": 2, "Trivy": { "Version": "0.70.0" }, "ReportID": "01a1b919-8f9b-7656-87a7-fe269a538cc5", "CreatedAt": "2026-11-08T04:00:22.555417007+01:00", "ArtifactID": "sha256:b37fbef62cbea17a1c9f82156e446b68f86164b047ee3ef2845714fb8e28d60f", "ArtifactName": "da954fb959a3", "ArtifactType": "container_image", "Metadata": { "Size": 63686144, "OS": { "Family": "alpine", "Name": "3.23.4" }, "ImageID": "sha256:da954fb959a34e2195e6bf622e6396bf338f99e0fe6d8e641b302d9aaa1f0645", "DiffIDs": [ "sha256:29df493baa13de438d6d2ece3a8333032e0b7b9b9d8cce4ee82194da255f61e1", "sha256:b910427bd94b3f8656a5557f6e4f484de3b83065ed7699fbbbeadcc313fbc2d9", "sha256:2b05bd5bca95bd1a5c547a075824071a5ab9e328edae0815be974d4add66bf8d", "sha256:2d9b3b00156747f272144e57a865e3b0dd50e4df65e63d44aed86dd30de88e92", "sha256:906af8ee0f8a8e75fe355b299a02c1d7cae7c1dc4134334f21feb4ef4b6c2488", "sha256:ad8253b95bde4ae533795f5e5730ba07f7f764d66f8af245a3118fb66a8ba546", "sha256:9a2cbc774b1f8a067ead2895c6fe744793f41aef4abd01771df1fadc16ec6f25", "sha256:5519239b187cd3709c07332d1796e87305684dbc91e05de8de1682602b6c3118" ], "RepoDigests": [ "nginx@sha256:7e8ff0a32da368869608f285124b4375b901401d88f5027865d8f88984d35d38", "nginx@sha256:8b1e78743a03dbb2c95171cc58639fef29abc8816598e27fb910ed2e621e589a" ], "Reference": "nginx@sha256:7e8ff0a32da368869608f285124b4375b901401d88f5027865d8f88984d35d38", "ImageConfig": { "architecture": "amd64", "created": "2026-05-22T18:30:44.353373585Z", "history": [ { "created": "2026-04-15T20:01:40Z", "created_by": "ADD alpine-minirootfs-3.23.4-x86_64.tar.gz / # buildkit", "comment": "buildkit.dockerfile.v0" }, { "created": "2026-04-15T20:01:40Z", "created_by": "CMD [\"/bin/sh\"]", "comment": "buildkit.dockerfile.v0", "empty_layer": true }, { "created": "2026-05-22T18:25:12Z", "created_by": "LABEL maintainer=NGINX Docker Maintainers \u003cdocker-maint@nginx.com\u003e", "comment": "buildkit.dockerfile.v0", "empty_layer": true }, { "created": "2026-05-22T18:25:12Z", "created_by": "ENV NGINX_VERSION=1.31.1", "comment": "buildkit.dockerfile.v0", "empty_layer": true }, { "created": "2026-05-22T18:25:12Z", "created_by": "ENV PKG_RELEASE=1", "comment": "buildkit.dockerfile.v0", "empty_layer": true }, { "created": "2026-05-22T18:25:12Z", "created_by": "ENV DYNPKG_RELEASE=1", "comment": "buildkit.dockerfile.v0", "empty_layer": true }, { "created": "2026-05-22T18:25:12Z", "created_by": "RUN /bin/sh -c set -x \u0026\u0026 addgroup -g 101 -S nginx \u0026\u0026 adduser -S -D -H -u 101 -h /var/cache/nginx -s /sbin/nologin -G nginx -g nginx nginx \u0026\u0026 apkArch=\"$(cat /etc/apk/arch)\" \u0026\u0026 nginxPackages=\" nginx=${NGINX_VERSION}-r${PKG_RELEASE} \" \u0026\u0026 apk add --no-cache --virtual .checksum-deps openssl \u0026\u0026 case \"$apkArch\" in x86_64|aarch64) set -x \u0026\u0026 KEY_SHA512=\"e09fa32f0a0eab2b879ccbbc4d0e4fb9751486eedda75e35fac65802cc9faa266425edf83e261137a2f4d16281ce2c1a5f4502930fe75154723da014214f0655\" \u0026\u0026 wget -O /tmp/nginx_signing.rsa.pub https://nginx.org/keys/nginx_signing.rsa.pub \u0026\u0026 if echo \"$KEY_SHA512 */tmp/nginx_signing.rsa.pub\" | sha512sum -c -; then echo \"key verification succeeded!\"; mv /tmp/nginx_signing.rsa.pub /etc/apk/keys/; else echo \"key verification failed!\"; exit 1; fi \u0026\u0026 DEPS=$(apk query --summarize depends --recursive --no-cache --repository \"@nginxorg https://nginx.org/packages/mainline/alpine/v$(egrep -o '^[0-9]+\\.[0-9]+' /etc/alpine-release)/main\" ${nginxPackages/=/@nginxorg=}) \u0026\u0026 apk add --no-cache $DEPS \u0026\u0026 apk add --repositories-file /dev/null -X \"https://nginx.org/packages/mainline/alpine/v$(egrep -o '^[0-9]+\\.[0-9]+' /etc/alpine-release)/main\" --no-cache $nginxPackages ;; *) set -x \u0026\u0026 tempDir=\"$(mktemp -d)\" \u0026\u0026 chown nobody:nobody $tempDir \u0026\u0026 apk add --no-cache --virtual .build-deps gcc libc-dev make openssl-dev pcre2-dev zlib-dev linux-headers bash alpine-sdk findutils curl \u0026\u0026 su nobody -s /bin/sh -c \" export HOME=${tempDir} \u0026\u0026 cd ${tempDir} \u0026\u0026 curl -f -L -O https://github.com/nginx/pkg-oss/archive/b151aac903a6fc121d57f0909415381d0a1c1bbd.tar.gz \u0026\u0026 PKGOSSCHECKSUM=\\\"72c13cfedc25a6c1e01c24dd1f736b0fefd1ef7f73ef569e2726fc99c0137327d2e71c8694bd8b0157be2a7247ec1769904746a852e7698caf7df8a5b0040440 *b151aac903a6fc121d57f0909415381d0a1c1bbd.tar.gz\\\" \u0026\u0026 if [ \\\"\\$(openssl sha512 -r b151aac903a6fc121d57f0909415381d0a1c1bbd.tar.gz)\\\" = \\\"\\$PKGOSSCHECKSUM\\\" ]; then echo \\\"pkg-oss tarball checksum verification succeeded!\\\"; else echo \\\"pkg-oss tarball checksum verification failed!\\\"; exit 1; fi \u0026\u0026 tar xzvf b151aac903a6fc121d57f0909415381d0a1c1bbd.tar.gz \u0026\u0026 cd pkg-oss-b151aac903a6fc121d57f0909415381d0a1c1bbd \u0026\u0026 cd alpine \u0026\u0026 make base \u0026\u0026 apk index --allow-untrusted -o ${tempDir}/packages/alpine/${apkArch}/APKINDEX.tar.gz ${tempDir}/packages/alpine/${apkArch}/*.apk \u0026\u0026 abuild-sign -k ${tempDir}/.abuild/abuild-key.rsa ${tempDir}/packages/alpine/${apkArch}/APKINDEX.tar.gz \" \u0026\u0026 cp ${tempDir}/.abuild/abuild-key.rsa.pub /etc/apk/keys/ \u0026\u0026 apk del --no-network .build-deps \u0026\u0026 DEPS=$(apk query --summarize depends --recursive --no-cache --repository \"@nginxorg ${tempDir}/packages/alpine/\" ${nginxPackages/=/@nginxorg=}) \u0026\u0026 apk add --no-cache $DEPS \u0026\u0026 apk add --repositories-file /dev/null -X ${tempDir}/packages/alpine/ --no-cache $nginxPackages ;; esac \u0026\u0026 apk del --no-network .checksum-deps \u0026\u0026 if [ -n \"$tempDir\" ]; then rm -rf \"$tempDir\"; fi \u0026\u0026 if [ -f \"/etc/apk/keys/abuild-key.rsa.pub\" ]; then rm -f /etc/apk/keys/abuild-key.rsa.pub; fi \u0026\u0026 apk add --no-cache gettext-envsubst \u0026\u0026 apk add --no-cache tzdata \u0026\u0026 ln -sf /dev/stdout /var/log/nginx/access.log \u0026\u0026 ln -sf /dev/stderr /var/log/nginx/error.log \u0026\u0026 mkdir /docker-entrypoint.d # buildkit", "comment": "buildkit.dockerfile.v0" }, { "created": "2026-05-22T18:25:12Z", "created_by": "COPY docker-entrypoint.sh / # buildkit", "comment": "buildkit.dockerfile.v0" }, { "created": "2026-05-22T18:25:12Z", "created_by": "COPY 10-listen-on-ipv6-by-default.sh /docker-entrypoint.d # buildkit", "comment": "buildkit.dockerfile.v0" }, { "created": "2026-05-22T18:25:12Z", "created_by": "COPY 15-local-resolvers.envsh /docker-entrypoint.d # buildkit", "comment": "buildkit.dockerfile.v0" }, { "created": "2026-05-22T18:25:12Z", "created_by": "COPY 20-envsubst-on-templates.sh /docker-entrypoint.d # buildkit", "comment": "buildkit.dockerfile.v0" }, { "created": "2026-05-22T18:25:12Z", "created_by": "COPY 30-tune-worker-processes.sh /docker-entrypoint.d # buildkit", "comment": "buildkit.dockerfile.v0" }, { "created": "2026-05-22T18:25:12Z", "created_by": "ENTRYPOINT [\"/docker-entrypoint.sh\"]", "comment": "buildkit.dockerfile.v0", "empty_layer": true }, { "created": "2026-05-22T18:25:12Z", "created_by": "EXPOSE map[80/tcp:{}]", "comment": "buildkit.dockerfile.v0", "empty_layer": true }, { "created": "2026-05-22T18:25:12Z", "created_by": "STOPSIGNAL SIGQUIT", "comment": "buildkit.dockerfile.v0", "empty_layer": true }, { "created": "2026-05-22T18:25:12Z", "created_by": "CMD [\"nginx\" \"-g\" \"daemon off;\"]", "comment": "buildkit.dockerfile.v0", "empty_layer": true }, { "created": "2026-05-22T18:30:44Z", "created_by": "ENV NJS_VERSION=0.9.9", "comment": "buildkit.dockerfile.v0", "empty_layer": true }, { "created": "2026-05-22T18:30:44Z", "created_by": "ENV NJS_RELEASE=1", "comment": "buildkit.dockerfile.v0", "empty_layer": true }, { "created": "2026-05-22T18:30:44Z", "created_by": "ENV ACME_VERSION=0.4.1", "comment": "buildkit.dockerfile.v0", "empty_layer": true }, { "created": "2026-05-22T18:30:44Z", "created_by": "RUN /bin/sh -c set -x \u0026\u0026 apkArch=\"$(cat /etc/apk/arch)\" \u0026\u0026 nginxPackages=\" nginx=${NGINX_VERSION}-r${PKG_RELEASE} nginx-module-xslt=${NGINX_VERSION}-r${DYNPKG_RELEASE} nginx-module-geoip=${NGINX_VERSION}-r${DYNPKG_RELEASE} nginx-module-image-filter=${NGINX_VERSION}-r${DYNPKG_RELEASE} nginx-module-njs=${NGINX_VERSION}.${NJS_VERSION}-r${NJS_RELEASE} nginx-module-acme=${NGINX_VERSION}.${ACME_VERSION}-r${PKG_RELEASE} \" \u0026\u0026 apk add --no-cache --virtual .checksum-deps openssl \u0026\u0026 case \"$apkArch\" in x86_64|aarch64) apk add -X \"https://nginx.org/packages/mainline/alpine/v$(egrep -o '^[0-9]+\\.[0-9]+' /etc/alpine-release)/main\" --no-cache $nginxPackages ;; *) set -x \u0026\u0026 tempDir=\"$(mktemp -d)\" \u0026\u0026 chown nobody:nobody $tempDir \u0026\u0026 apk add --no-cache --virtual .build-deps gcc libc-dev make openssl-dev pcre2-dev zlib-dev linux-headers libxslt-dev gd-dev geoip-dev libedit-dev bash alpine-sdk findutils curl cargo clang-libclang \u0026\u0026 su nobody -s /bin/sh -c \" export HOME=${tempDir} \u0026\u0026 cd ${tempDir} \u0026\u0026 curl -f -L -O https://github.com/nginx/pkg-oss/archive/b151aac903a6fc121d57f0909415381d0a1c1bbd.tar.gz \u0026\u0026 PKGOSSCHECKSUM=\\\"72c13cfedc25a6c1e01c24dd1f736b0fefd1ef7f73ef569e2726fc99c0137327d2e71c8694bd8b0157be2a7247ec1769904746a852e7698caf7df8a5b0040440 *b151aac903a6fc121d57f0909415381d0a1c1bbd.tar.gz\\\" \u0026\u0026 if [ \\\"\\$(openssl sha512 -r b151aac903a6fc121d57f0909415381d0a1c1bbd.tar.gz)\\\" = \\\"\\$PKGOSSCHECKSUM\\\" ]; then echo \\\"pkg-oss tarball checksum verification succeeded!\\\"; else echo \\\"pkg-oss tarball checksum verification failed!\\\"; exit 1; fi \u0026\u0026 tar xzvf b151aac903a6fc121d57f0909415381d0a1c1bbd.tar.gz \u0026\u0026 cd pkg-oss-b151aac903a6fc121d57f0909415381d0a1c1bbd \u0026\u0026 cd alpine \u0026\u0026 export BUILDTARGET=\\\"module-geoip module-image-filter module-njs module-xslt module-acme\\\" \u0026\u0026 if [ \\\"\\$(apk --print-arch)\\\" = \\\"armhf\\\" ]; then BUILDTARGET=\\\"\\$( echo \\$BUILDTARGET | sed 's,module-acme,,' )\\\"; fi \u0026\u0026 make \\$BUILDTARGET \u0026\u0026 apk index --allow-untrusted -o ${tempDir}/packages/alpine/${apkArch}/APKINDEX.tar.gz ${tempDir}/packages/alpine/${apkArch}/*.apk \u0026\u0026 abuild-sign -k ${tempDir}/.abuild/abuild-key.rsa ${tempDir}/packages/alpine/${apkArch}/APKINDEX.tar.gz \" \u0026\u0026 cp ${tempDir}/.abuild/abuild-key.rsa.pub /etc/apk/keys/ \u0026\u0026 apk del --no-network .build-deps \u0026\u0026 if [ \"$apkArch\" = \"armhf\" ]; then nginxPackages=\"$( echo $nginxPackages | sed 's,nginx-module-acme=.*,,')\"; fi \u0026\u0026 apk add -X ${tempDir}/packages/alpine/ --no-cache $nginxPackages ;; esac \u0026\u0026 apk del --no-network .checksum-deps \u0026\u0026 if [ -n \"$tempDir\" ]; then rm -rf \"$tempDir\"; fi \u0026\u0026 if [ -f \"/etc/apk/keys/abuild-key.rsa.pub\" ]; then rm -f /etc/apk/keys/abuild-key.rsa.pub; fi \u0026\u0026 apk add --no-cache curl ca-certificates # buildkit", "comment": "buildkit.dockerfile.v0" } ], "os": "linux", "rootfs": { "type": "layers", "diff_ids": [ "sha256:29df493baa13de438d6d2ece3a8333032e0b7b9b9d8cce4ee82194da255f61e1", "sha256:b910427bd94b3f8656a5557f6e4f484de3b83065ed7699fbbbeadcc313fbc2d9", "sha256:2b05bd5bca95bd1a5c547a075824071a5ab9e328edae0815be974d4add66bf8d", "sha256:2d9b3b00156747f272144e57a865e3b0dd50e4df65e63d44aed86dd30de88e92", "sha256:906af8ee0f8a8e75fe355b299a02c1d7cae7c1dc4134334f21feb4ef4b6c2488", "sha256:ad8253b95bde4ae533795f5e5730ba07f7f764d66f8af245a3118fb66a8ba546", "sha256:9a2cbc774b1f8a067ead2895c6fe744793f41aef4abd01771df1fadc16ec6f25", "sha256:5519239b187cd3709c07332d1796e87305684dbc91e05de8de1682602b6c3118" ] }, "config": { "Cmd": [ "nginx", "-g", "daemon off;" ], "Entrypoint": [ "/docker-entrypoint.sh" ], "Env": [ "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", "NGINX_VERSION=1.31.1", "PKG_RELEASE=1", "DYNPKG_RELEASE=1", "NJS_VERSION=0.9.9", "NJS_RELEASE=1", "ACME_VERSION=0.4.1" ], "Labels": { "maintainer": "NGINX Docker Maintainers \u003cdocker-maint@nginx.com\u003e" }, "WorkingDir": "/", "ExposedPorts": { "80/tcp": {} }, "StopSignal": "SIGQUIT" } }, "Layers": [ { "Size": 8732160, "DiffID": "sha256:29df493baa13de438d6d2ece3a8333032e0b7b9b9d8cce4ee82194da255f61e1" }, { "Size": 4775424, "DiffID": "sha256:b910427bd94b3f8656a5557f6e4f484de3b83065ed7699fbbbeadcc313fbc2d9" }, { "Size": 3584, "DiffID": "sha256:2b05bd5bca95bd1a5c547a075824071a5ab9e328edae0815be974d4add66bf8d" }, { "Size": 4608, "DiffID": "sha256:2d9b3b00156747f272144e57a865e3b0dd50e4df65e63d44aed86dd30de88e92" }, { "Size": 2560, "DiffID": "sha256:906af8ee0f8a8e75fe355b299a02c1d7cae7c1dc4134334f21feb4ef4b6c2488" }, { "Size": 5120, "DiffID": "sha256:ad8253b95bde4ae533795f5e5730ba07f7f764d66f8af245a3118fb66a8ba546" }, { "Size": 7168, "DiffID": "sha256:9a2cbc774b1f8a067ead2895c6fe744793f41aef4abd01771df1fadc16ec6f25" }, { "Size": 50155520, "DiffID": "sha256:5519239b187cd3709c07332d1796e87305684dbc91e05de8de1682602b6c3118" } ] }, "Results": [ { "Target": "da954fb959a3 (alpine 3.23.4)", "Class": "os-pkgs", "Type": "alpine", "Packages": [ { "ID": "alpine-baselayout@3.7.2-r0", "Name": "alpine-baselayout", "Identifier": { "PURL": "pkg:apk/alpine/alpine-baselayout@3.7.2-r0?arch=x86_64\u0026distro=3.23.4", "UID": "ff3090489ca40326" }, "Version": "3.7.2-r0", "Arch": "x86_64", "SrcName": "alpine-baselayout", "SrcVersion": "3.7.2-r0", "Licenses": [ "GPL-2.0-only" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "alpine-baselayout-data@3.7.2-r0", "busybox-binsh@1.37.0-r30" ], "Layer": { "DiffID": "sha256:29df493baa13de438d6d2ece3a8333032e0b7b9b9d8cce4ee82194da255f61e1" }, "Digest": "sha1:545aa6f291209af89932b761d9e422c2778596cc", "InstalledFiles": [ "etc/motd", "etc/crontabs/root", "etc/modprobe.d/aliases.conf", "etc/modprobe.d/blacklist.conf", "etc/modprobe.d/i386.conf", "etc/profile.d/20locale.sh", "etc/profile.d/README", "etc/profile.d/color_prompt.sh.disabled", "usr/lib/sysctl.d/00-alpine.conf", "var/lock", "var/run", "var/spool/mail", "var/spool/cron/crontabs" ], "AnalyzedBy": "apk" }, { "ID": "alpine-baselayout-data@3.7.2-r0", "Name": "alpine-baselayout-data", "Identifier": { "PURL": "pkg:apk/alpine/alpine-baselayout-data@3.7.2-r0?arch=x86_64\u0026distro=3.23.4", "UID": "78c0ed61d7df9a7e" }, "Version": "3.7.2-r0", "Arch": "x86_64", "SrcName": "alpine-baselayout", "SrcVersion": "3.7.2-r0", "Licenses": [ "GPL-2.0-only" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "Layer": { "DiffID": "sha256:29df493baa13de438d6d2ece3a8333032e0b7b9b9d8cce4ee82194da255f61e1" }, "Digest": "sha1:85816632dbce07ba7e9e7a629fa59eddbd1687fb", "InstalledFiles": [ "etc/fstab", "etc/group", "etc/hostname", "etc/hosts", "etc/inittab", "etc/modules", "etc/mtab", "etc/nsswitch.conf", "etc/passwd", "etc/profile", "etc/protocols", "etc/services", "etc/shadow", "etc/shells", "etc/sysctl.conf" ], "AnalyzedBy": "apk" }, { "ID": "alpine-keys@2.6-r0", "Name": "alpine-keys", "Identifier": { "PURL": "pkg:apk/alpine/alpine-keys@2.6-r0?arch=x86_64\u0026distro=3.23.4", "UID": "2c7cb90de388aa7d" }, "Version": "2.6-r0", "Arch": "x86_64", "SrcName": "alpine-keys", "SrcVersion": "2.6-r0", "Licenses": [ "MIT" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "Layer": { "DiffID": "sha256:29df493baa13de438d6d2ece3a8333032e0b7b9b9d8cce4ee82194da255f61e1" }, "Digest": "sha1:5c45a821cd6b84d543bbd7ff12a7de1855c5cd13", "InstalledFiles": [ "etc/apk/keys/alpine-devel@lists.alpinelinux.org-4a6a0840.rsa.pub", "etc/apk/keys/alpine-devel@lists.alpinelinux.org-5261cecb.rsa.pub", "etc/apk/keys/alpine-devel@lists.alpinelinux.org-6165ee59.rsa.pub", "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-4a6a0840.rsa.pub", "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-5243ef4b.rsa.pub", "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-524d27bb.rsa.pub", "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-5261cecb.rsa.pub", "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-58199dcc.rsa.pub", "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-58cbb476.rsa.pub", "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-58e4f17d.rsa.pub", "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-5e69ca50.rsa.pub", "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-60ac2099.rsa.pub", "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-6165ee59.rsa.pub", "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-61666e3f.rsa.pub", "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-616a9724.rsa.pub", "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-616abc23.rsa.pub", "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-616ac3bc.rsa.pub", "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-616adfeb.rsa.pub", "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-616ae350.rsa.pub", "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-616db30d.rsa.pub", "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-66ba20fe.rsa.pub", "usr/share/apk/keys/aarch64/alpine-devel@lists.alpinelinux.org-58199dcc.rsa.pub", "usr/share/apk/keys/aarch64/alpine-devel@lists.alpinelinux.org-616ae350.rsa.pub", "usr/share/apk/keys/armhf/alpine-devel@lists.alpinelinux.org-524d27bb.rsa.pub", "usr/share/apk/keys/armhf/alpine-devel@lists.alpinelinux.org-616a9724.rsa.pub", "usr/share/apk/keys/armv7/alpine-devel@lists.alpinelinux.org-524d27bb.rsa.pub", "usr/share/apk/keys/armv7/alpine-devel@lists.alpinelinux.org-616adfeb.rsa.pub", "usr/share/apk/keys/loongarch64/alpine-devel@lists.alpinelinux.org-66ba20fe.rsa.pub", "usr/share/apk/keys/mips64/alpine-devel@lists.alpinelinux.org-5e69ca50.rsa.pub", "usr/share/apk/keys/ppc64le/alpine-devel@lists.alpinelinux.org-58cbb476.rsa.pub", "usr/share/apk/keys/ppc64le/alpine-devel@lists.alpinelinux.org-616abc23.rsa.pub", "usr/share/apk/keys/riscv64/alpine-devel@lists.alpinelinux.org-60ac2099.rsa.pub", "usr/share/apk/keys/riscv64/alpine-devel@lists.alpinelinux.org-616db30d.rsa.pub", "usr/share/apk/keys/s390x/alpine-devel@lists.alpinelinux.org-58e4f17d.rsa.pub", "usr/share/apk/keys/s390x/alpine-devel@lists.alpinelinux.org-616ac3bc.rsa.pub", "usr/share/apk/keys/x86/alpine-devel@lists.alpinelinux.org-4a6a0840.rsa.pub", "usr/share/apk/keys/x86/alpine-devel@lists.alpinelinux.org-5243ef4b.rsa.pub", "usr/share/apk/keys/x86/alpine-devel@lists.alpinelinux.org-61666e3f.rsa.pub", "usr/share/apk/keys/x86_64/alpine-devel@lists.alpinelinux.org-4a6a0840.rsa.pub", "usr/share/apk/keys/x86_64/alpine-devel@lists.alpinelinux.org-5261cecb.rsa.pub", "usr/share/apk/keys/x86_64/alpine-devel@lists.alpinelinux.org-6165ee59.rsa.pub" ], "AnalyzedBy": "apk" }, { "ID": "alpine-release@3.23.4-r0", "Name": "alpine-release", "Identifier": { "PURL": "pkg:apk/alpine/alpine-release@3.23.4-r0?arch=x86_64\u0026distro=3.23.4", "UID": "114fb0bc8cc9ff31" }, "Version": "3.23.4-r0", "Arch": "x86_64", "SrcName": "alpine-base", "SrcVersion": "3.23.4-r0", "Licenses": [ "MIT" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "alpine-keys@2.6-r0" ], "Layer": { "DiffID": "sha256:29df493baa13de438d6d2ece3a8333032e0b7b9b9d8cce4ee82194da255f61e1" }, "Digest": "sha1:7ff0b58e52211bb31a84e2afdbcbff0620df55a1", "InstalledFiles": [ "etc/alpine-release", "etc/issue", "etc/os-release", "etc/secfixes.d/alpine", "usr/lib/os-release" ], "AnalyzedBy": "apk" }, { "ID": "aom-libs@3.13.1-r1", "Name": "aom-libs", "Identifier": { "PURL": "pkg:apk/alpine/aom-libs@3.13.1-r1?arch=x86_64\u0026distro=3.23.4", "UID": "5c2e206a9e097520" }, "Version": "3.13.1-r1", "Arch": "x86_64", "SrcName": "aom", "SrcVersion": "3.13.1-r1", "Licenses": [ "BSD-2-Clause", "custom" ], "Maintainer": "Oleg Titov \u003coleg.titov@gmail.com\u003e", "DependsOn": [ "musl@1.2.5-r23" ], "Layer": { "DiffID": "sha256:5519239b187cd3709c07332d1796e87305684dbc91e05de8de1682602b6c3118" }, "Digest": "sha1:97b0c2dffcef97a0253876d015ca217de10b216a", "InstalledFiles": [ "usr/lib/libaom.so.3", "usr/lib/libaom.so.3.13.1" ], "AnalyzedBy": "apk" }, { "ID": "apk-tools@3.0.6-r0", "Name": "apk-tools", "Identifier": { "PURL": "pkg:apk/alpine/apk-tools@3.0.6-r0?arch=x86_64\u0026distro=3.23.4", "UID": "760256a5bdd94a07" }, "Version": "3.0.6-r0", "Arch": "x86_64", "SrcName": "apk-tools", "SrcVersion": "3.0.6-r0", "Licenses": [ "GPL-2.0-only" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "ca-certificates-bundle@20260413-r0", "libapk@3.0.6-r0", "libcrypto3@3.5.6-r0", "musl@1.2.5-r23", "zlib@1.3.2-r0" ], "Layer": { "DiffID": "sha256:29df493baa13de438d6d2ece3a8333032e0b7b9b9d8cce4ee82194da255f61e1" }, "Digest": "sha1:86f3b3ef94d1cb213a4ed1187b34a6bb9f593033", "InstalledFiles": [ "sbin/apk" ], "AnalyzedBy": "apk" }, { "ID": "brotli-libs@1.2.0-r0", "Name": "brotli-libs", "Identifier": { "PURL": "pkg:apk/alpine/brotli-libs@1.2.0-r0?arch=x86_64\u0026distro=3.23.4", "UID": "234da2b3c350083b" }, "Version": "1.2.0-r0", "Arch": "x86_64", "SrcName": "brotli", "SrcVersion": "1.2.0-r0", "Licenses": [ "MIT" ], "Maintainer": "prspkt \u003cprspkt@protonmail.com\u003e", "DependsOn": [ "musl@1.2.5-r23" ], "Layer": { "DiffID": "sha256:5519239b187cd3709c07332d1796e87305684dbc91e05de8de1682602b6c3118" }, "Digest": "sha1:0814694602f35d2741e916fdcb4c9a1e0ec50b42", "InstalledFiles": [ "usr/lib/libbrotlicommon.so.1", "usr/lib/libbrotlicommon.so.1.2.0", "usr/lib/libbrotlidec.so.1", "usr/lib/libbrotlidec.so.1.2.0", "usr/lib/libbrotlienc.so.1", "usr/lib/libbrotlienc.so.1.2.0" ], "AnalyzedBy": "apk" }, { "ID": "busybox@1.37.0-r30", "Name": "busybox", "Identifier": { "PURL": "pkg:apk/alpine/busybox@1.37.0-r30?arch=x86_64\u0026distro=3.23.4", "UID": "9647681d0b54db77" }, "Version": "1.37.0-r30", "Arch": "x86_64", "SrcName": "busybox", "SrcVersion": "1.37.0-r30", "Licenses": [ "GPL-2.0-only" ], "Maintainer": "Sören Tempel \u003csoeren+alpine@soeren-tempel.net\u003e", "DependsOn": [ "musl@1.2.5-r23" ], "Layer": { "DiffID": "sha256:29df493baa13de438d6d2ece3a8333032e0b7b9b9d8cce4ee82194da255f61e1" }, "Digest": "sha1:f1347801bb96b1aa40d17f82237c3f4ff02a4725", "InstalledFiles": [ "bin/busybox", "etc/securetty", "etc/busybox-paths.d/busybox", "etc/logrotate.d/acpid", "etc/network/if-up.d/dad", "etc/udhcpc/udhcpc.conf", "usr/share/udhcpc/default.script" ], "AnalyzedBy": "apk" }, { "ID": "busybox-binsh@1.37.0-r30", "Name": "busybox-binsh", "Identifier": { "PURL": "pkg:apk/alpine/busybox-binsh@1.37.0-r30?arch=x86_64\u0026distro=3.23.4", "UID": "3e18d05d46a6f46f" }, "Version": "1.37.0-r30", "Arch": "x86_64", "SrcName": "busybox", "SrcVersion": "1.37.0-r30", "Licenses": [ "GPL-2.0-only" ], "Maintainer": "Sören Tempel \u003csoeren+alpine@soeren-tempel.net\u003e", "DependsOn": [ "busybox@1.37.0-r30" ], "Layer": { "DiffID": "sha256:29df493baa13de438d6d2ece3a8333032e0b7b9b9d8cce4ee82194da255f61e1" }, "Digest": "sha1:188d2d0110afa58e8a3e3e5fd424b2d996df7a09", "InstalledFiles": [ "bin/sh" ], "AnalyzedBy": "apk" }, { "ID": "c-ares@1.34.6-r0", "Name": "c-ares", "Identifier": { "PURL": "pkg:apk/alpine/c-ares@1.34.6-r0?arch=x86_64\u0026distro=3.23.4", "UID": "5be96d5420bec243" }, "Version": "1.34.6-r0", "Arch": "x86_64", "SrcName": "c-ares", "SrcVersion": "1.34.6-r0", "Licenses": [ "MIT" ], "Maintainer": "Carlo Landmeter \u003cclandmeter@alpinelinux.org\u003e", "DependsOn": [ "musl@1.2.5-r23" ], "Layer": { "DiffID": "sha256:5519239b187cd3709c07332d1796e87305684dbc91e05de8de1682602b6c3118" }, "Digest": "sha1:e3bb3ff47a277ff9409b8c4bb825099cfe2bcbe2", "InstalledFiles": [ "usr/lib/libcares.so.2", "usr/lib/libcares.so.2.19.5" ], "AnalyzedBy": "apk" }, { "ID": "ca-certificates@20260413-r0", "Name": "ca-certificates", "Identifier": { "PURL": "pkg:apk/alpine/ca-certificates@20260413-r0?arch=x86_64\u0026distro=3.23.4", "UID": "63ca5aff4886266d" }, "Version": "20260413-r0", "Arch": "x86_64", "SrcName": "ca-certificates", "SrcVersion": "20260413-r0", "Licenses": [ "MPL-2.0", "MIT" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "busybox-binsh@1.37.0-r30", "libcrypto3@3.5.6-r0", "musl@1.2.5-r23" ], "Layer": { "DiffID": "sha256:5519239b187cd3709c07332d1796e87305684dbc91e05de8de1682602b6c3118" }, "Digest": "sha1:af25e0f0a0412b141942909ed199144cc46f5bbc", "InstalledFiles": [ "etc/ca-certificates.conf", "etc/apk/protected_paths.d/ca-certificates.list", "etc/ca-certificates/update.d/certhash", "usr/bin/c_rehash", "usr/sbin/update-ca-certificates", "usr/share/ca-certificates/mozilla/ACCVRAIZ1.crt", "usr/share/ca-certificates/mozilla/AC_RAIZ_FNMT-RCM.crt", "usr/share/ca-certificates/mozilla/AC_RAIZ_FNMT-RCM_SERVIDORES_SEGUROS.crt", "usr/share/ca-certificates/mozilla/ANF_Secure_Server_Root_CA.crt", "usr/share/ca-certificates/mozilla/Actalis_Authentication_Root_CA.crt", "usr/share/ca-certificates/mozilla/AffirmTrust_Commercial.crt", "usr/share/ca-certificates/mozilla/AffirmTrust_Networking.crt", "usr/share/ca-certificates/mozilla/AffirmTrust_Premium.crt", "usr/share/ca-certificates/mozilla/AffirmTrust_Premium_ECC.crt", "usr/share/ca-certificates/mozilla/Amazon_Root_CA_1.crt", "usr/share/ca-certificates/mozilla/Amazon_Root_CA_2.crt", "usr/share/ca-certificates/mozilla/Amazon_Root_CA_3.crt", "usr/share/ca-certificates/mozilla/Amazon_Root_CA_4.crt", "usr/share/ca-certificates/mozilla/Atos_TrustedRoot_2011.crt", "usr/share/ca-certificates/mozilla/Atos_TrustedRoot_Root_CA_ECC_TLS_2021.crt", "usr/share/ca-certificates/mozilla/Atos_TrustedRoot_Root_CA_RSA_TLS_2021.crt", "usr/share/ca-certificates/mozilla/Autoridad_de_Certificacion_Firmaprofesional_CIF_A62634068.crt", "usr/share/ca-certificates/mozilla/BJCA_Global_Root_CA1.crt", "usr/share/ca-certificates/mozilla/BJCA_Global_Root_CA2.crt", "usr/share/ca-certificates/mozilla/Buypass_Class_2_Root_CA.crt", "usr/share/ca-certificates/mozilla/Buypass_Class_3_Root_CA.crt", "usr/share/ca-certificates/mozilla/CA_Disig_Root_R2.crt", "usr/share/ca-certificates/mozilla/CFCA_EV_ROOT.crt", "usr/share/ca-certificates/mozilla/COMODO_Certification_Authority.crt", "usr/share/ca-certificates/mozilla/COMODO_ECC_Certification_Authority.crt", "usr/share/ca-certificates/mozilla/COMODO_RSA_Certification_Authority.crt", "usr/share/ca-certificates/mozilla/Certainly_Root_E1.crt", "usr/share/ca-certificates/mozilla/Certainly_Root_R1.crt", "usr/share/ca-certificates/mozilla/Certigna.crt", "usr/share/ca-certificates/mozilla/Certigna_Root_CA.crt", "usr/share/ca-certificates/mozilla/Certum_EC-384_CA.crt", "usr/share/ca-certificates/mozilla/Certum_Trusted_Network_CA.crt", "usr/share/ca-certificates/mozilla/Certum_Trusted_Network_CA_2.crt", "usr/share/ca-certificates/mozilla/Certum_Trusted_Root_CA.crt", "usr/share/ca-certificates/mozilla/D-TRUST_BR_Root_CA_1_2020.crt", "usr/share/ca-certificates/mozilla/D-TRUST_BR_Root_CA_2_2023.crt", "usr/share/ca-certificates/mozilla/D-TRUST_EV_Root_CA_1_2020.crt", "usr/share/ca-certificates/mozilla/D-TRUST_EV_Root_CA_2_2023.crt", "usr/share/ca-certificates/mozilla/D-TRUST_Root_Class_3_CA_2_2009.crt", "usr/share/ca-certificates/mozilla/D-TRUST_Root_Class_3_CA_2_EV_2009.crt", "usr/share/ca-certificates/mozilla/DigiCert_Assured_ID_Root_CA.crt", "usr/share/ca-certificates/mozilla/DigiCert_Assured_ID_Root_G2.crt", "usr/share/ca-certificates/mozilla/DigiCert_Assured_ID_Root_G3.crt", "usr/share/ca-certificates/mozilla/DigiCert_Global_Root_CA.crt", "usr/share/ca-certificates/mozilla/DigiCert_Global_Root_G2.crt", "usr/share/ca-certificates/mozilla/DigiCert_Global_Root_G3.crt", "usr/share/ca-certificates/mozilla/DigiCert_High_Assurance_EV_Root_CA.crt", "usr/share/ca-certificates/mozilla/DigiCert_TLS_ECC_P384_Root_G5.crt", "usr/share/ca-certificates/mozilla/DigiCert_TLS_RSA4096_Root_G5.crt", "usr/share/ca-certificates/mozilla/DigiCert_Trusted_Root_G4.crt", "usr/share/ca-certificates/mozilla/Entrust_Root_Certification_Authority.crt", "usr/share/ca-certificates/mozilla/Entrust_Root_Certification_Authority_-_EC1.crt", "usr/share/ca-certificates/mozilla/Entrust_Root_Certification_Authority_-_G2.crt", "usr/share/ca-certificates/mozilla/FIRMAPROFESIONAL_CA_ROOT-A_WEB.crt", "usr/share/ca-certificates/mozilla/GDCA_TrustAUTH_R5_ROOT.crt", "usr/share/ca-certificates/mozilla/GLOBALTRUST_2020.crt", "usr/share/ca-certificates/mozilla/GTS_Root_R1.crt", "usr/share/ca-certificates/mozilla/GTS_Root_R2.crt", "usr/share/ca-certificates/mozilla/GTS_Root_R3.crt", "usr/share/ca-certificates/mozilla/GTS_Root_R4.crt", "usr/share/ca-certificates/mozilla/GlobalSign_ECC_Root_CA_-_R4.crt", "usr/share/ca-certificates/mozilla/GlobalSign_ECC_Root_CA_-_R5.crt", "usr/share/ca-certificates/mozilla/GlobalSign_Root_CA_-_R3.crt", "usr/share/ca-certificates/mozilla/GlobalSign_Root_CA_-_R6.crt", "usr/share/ca-certificates/mozilla/GlobalSign_Root_E46.crt", "usr/share/ca-certificates/mozilla/GlobalSign_Root_R46.crt", "usr/share/ca-certificates/mozilla/Go_Daddy_Root_Certificate_Authority_-_G2.crt", "usr/share/ca-certificates/mozilla/HARICA_TLS_ECC_Root_CA_2021.crt", "usr/share/ca-certificates/mozilla/HARICA_TLS_RSA_Root_CA_2021.crt", "usr/share/ca-certificates/mozilla/Hellenic_Academic_and_Research_Institutions_ECC_RootCA_2015.crt", "usr/share/ca-certificates/mozilla/Hellenic_Academic_and_Research_Institutions_RootCA_2015.crt", "usr/share/ca-certificates/mozilla/HiPKI_Root_CA_-_G1.crt", "usr/share/ca-certificates/mozilla/Hongkong_Post_Root_CA_3.crt", "usr/share/ca-certificates/mozilla/ISRG_Root_X1.crt", "usr/share/ca-certificates/mozilla/ISRG_Root_X2.crt", "usr/share/ca-certificates/mozilla/IdenTrust_Commercial_Root_CA_1.crt", "usr/share/ca-certificates/mozilla/IdenTrust_Public_Sector_Root_CA_1.crt", "usr/share/ca-certificates/mozilla/Izenpe.com.crt", "usr/share/ca-certificates/mozilla/Microsec_e-Szigno_Root_CA_2009.crt", "usr/share/ca-certificates/mozilla/Microsoft_ECC_Root_Certificate_Authority_2017.crt", "usr/share/ca-certificates/mozilla/Microsoft_RSA_Root_Certificate_Authority_2017.crt", "usr/share/ca-certificates/mozilla/NAVER_Global_Root_Certification_Authority.crt", "usr/share/ca-certificates/mozilla/NetLock_Arany_=Class_Gold=_Főtanúsítvány.crt", "usr/share/ca-certificates/mozilla/OISTE_Server_Root_ECC_G1.crt", "usr/share/ca-certificates/mozilla/OISTE_Server_Root_RSA_G1.crt", "usr/share/ca-certificates/mozilla/OISTE_WISeKey_Global_Root_GB_CA.crt", "usr/share/ca-certificates/mozilla/OISTE_WISeKey_Global_Root_GC_CA.crt", "usr/share/ca-certificates/mozilla/QuoVadis_Root_CA_1_G3.crt", "usr/share/ca-certificates/mozilla/QuoVadis_Root_CA_2.crt", "usr/share/ca-certificates/mozilla/QuoVadis_Root_CA_2_G3.crt", "usr/share/ca-certificates/mozilla/QuoVadis_Root_CA_3.crt", "usr/share/ca-certificates/mozilla/QuoVadis_Root_CA_3_G3.crt", "usr/share/ca-certificates/mozilla/SSL.com_EV_Root_Certification_Authority_ECC.crt", "usr/share/ca-certificates/mozilla/SSL.com_EV_Root_Certification_Authority_RSA_R2.crt", "usr/share/ca-certificates/mozilla/SSL.com_Root_Certification_Authority_ECC.crt", "usr/share/ca-certificates/mozilla/SSL.com_Root_Certification_Authority_RSA.crt", "usr/share/ca-certificates/mozilla/SSL.com_TLS_ECC_Root_CA_2022.crt", "usr/share/ca-certificates/mozilla/SSL.com_TLS_RSA_Root_CA_2022.crt", "usr/share/ca-certificates/mozilla/SZAFIR_ROOT_CA2.crt", "usr/share/ca-certificates/mozilla/Sectigo_Public_Server_Authentication_Root_E46.crt", "usr/share/ca-certificates/mozilla/Sectigo_Public_Server_Authentication_Root_R46.crt", "usr/share/ca-certificates/mozilla/SecureSign_Root_CA12.crt", "usr/share/ca-certificates/mozilla/SecureSign_Root_CA14.crt", "usr/share/ca-certificates/mozilla/SecureSign_Root_CA15.crt", "usr/share/ca-certificates/mozilla/SecureTrust_CA.crt", "usr/share/ca-certificates/mozilla/Secure_Global_CA.crt", "usr/share/ca-certificates/mozilla/Security_Communication_ECC_RootCA1.crt", "usr/share/ca-certificates/mozilla/Security_Communication_RootCA2.crt", "usr/share/ca-certificates/mozilla/Starfield_Root_Certificate_Authority_-_G2.crt", "usr/share/ca-certificates/mozilla/Starfield_Services_Root_Certificate_Authority_-_G2.crt", "usr/share/ca-certificates/mozilla/SwissSign_Gold_CA_-_G2.crt", "usr/share/ca-certificates/mozilla/SwissSign_RSA_TLS_Root_CA_2022_-_1.crt", "usr/share/ca-certificates/mozilla/T-TeleSec_GlobalRoot_Class_2.crt", "usr/share/ca-certificates/mozilla/T-TeleSec_GlobalRoot_Class_3.crt", "usr/share/ca-certificates/mozilla/TUBITAK_Kamu_SM_SSL_Kok_Sertifikasi_-_Surum_1.crt", "usr/share/ca-certificates/mozilla/TWCA_CYBER_Root_CA.crt", "usr/share/ca-certificates/mozilla/TWCA_Global_Root_CA.crt", "usr/share/ca-certificates/mozilla/TWCA_Root_Certification_Authority.crt", "usr/share/ca-certificates/mozilla/Telekom_Security_TLS_ECC_Root_2020.crt", "usr/share/ca-certificates/mozilla/Telekom_Security_TLS_RSA_Root_2023.crt", "usr/share/ca-certificates/mozilla/TeliaSonera_Root_CA_v1.crt", "usr/share/ca-certificates/mozilla/Telia_Root_CA_v2.crt", "usr/share/ca-certificates/mozilla/TrustAsia_Global_Root_CA_G3.crt", "usr/share/ca-certificates/mozilla/TrustAsia_Global_Root_CA_G4.crt", "usr/share/ca-certificates/mozilla/TrustAsia_TLS_ECC_Root_CA.crt", "usr/share/ca-certificates/mozilla/TrustAsia_TLS_RSA_Root_CA.crt", "usr/share/ca-certificates/mozilla/Trustwave_Global_Certification_Authority.crt", "usr/share/ca-certificates/mozilla/Trustwave_Global_ECC_P256_Certification_Authority.crt", "usr/share/ca-certificates/mozilla/Trustwave_Global_ECC_P384_Certification_Authority.crt", "usr/share/ca-certificates/mozilla/TunTrust_Root_CA.crt", "usr/share/ca-certificates/mozilla/UCA_Extended_Validation_Root.crt", "usr/share/ca-certificates/mozilla/UCA_Global_G2_Root.crt", "usr/share/ca-certificates/mozilla/USERTrust_ECC_Certification_Authority.crt", "usr/share/ca-certificates/mozilla/USERTrust_RSA_Certification_Authority.crt", "usr/share/ca-certificates/mozilla/certSIGN_ROOT_CA.crt", "usr/share/ca-certificates/mozilla/certSIGN_Root_CA_G2.crt", "usr/share/ca-certificates/mozilla/e-Szigno_Root_CA_2017.crt", "usr/share/ca-certificates/mozilla/e-Szigno_TLS_Root_CA_2023.crt", "usr/share/ca-certificates/mozilla/ePKI_Root_Certification_Authority.crt", "usr/share/ca-certificates/mozilla/emSign_ECC_Root_CA_-_C3.crt", "usr/share/ca-certificates/mozilla/emSign_ECC_Root_CA_-_G3.crt", "usr/share/ca-certificates/mozilla/emSign_Root_CA_-_C1.crt", "usr/share/ca-certificates/mozilla/emSign_Root_CA_-_G1.crt", "usr/share/ca-certificates/mozilla/vTrus_ECC_Root_CA.crt", "usr/share/ca-certificates/mozilla/vTrus_Root_CA.crt" ], "AnalyzedBy": "apk" }, { "ID": "ca-certificates-bundle@20260413-r0", "Name": "ca-certificates-bundle", "Identifier": { "PURL": "pkg:apk/alpine/ca-certificates-bundle@20260413-r0?arch=x86_64\u0026distro=3.23.4", "UID": "d9471547e8751507" }, "Version": "20260413-r0", "Arch": "x86_64", "SrcName": "ca-certificates", "SrcVersion": "20260413-r0", "Licenses": [ "MPL-2.0", "MIT" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "Layer": { "DiffID": "sha256:29df493baa13de438d6d2ece3a8333032e0b7b9b9d8cce4ee82194da255f61e1" }, "Digest": "sha1:44c90827e10115cb6afec51081cb26785dc8f418", "InstalledFiles": [ "etc/ssl/cert.pem", "etc/ssl/certs/ca-certificates.crt", "etc/ssl1.1/cert.pem", "etc/ssl1.1/certs" ], "AnalyzedBy": "apk" }, { "ID": "curl@8.19.0-r0", "Name": "curl", "Identifier": { "PURL": "pkg:apk/alpine/curl@8.19.0-r0?arch=x86_64\u0026distro=3.23.4", "UID": "f9ecf01e03ce7fef" }, "Version": "8.19.0-r0", "Arch": "x86_64", "SrcName": "curl", "SrcVersion": "8.19.0-r0", "Licenses": [ "curl" ], "Maintainer": "Achill Gilgenast \u003cachill@achill.org\u003e", "DependsOn": [ "libcurl@8.19.0-r0", "musl@1.2.5-r23", "zlib@1.3.2-r0" ], "Layer": { "DiffID": "sha256:5519239b187cd3709c07332d1796e87305684dbc91e05de8de1682602b6c3118" }, "Digest": "sha1:812f1083cfc10c65b05b05bb4adfa3acb5cf6058", "InstalledFiles": [ "usr/bin/curl", "usr/bin/wcurl" ], "AnalyzedBy": "apk" }, { "ID": "fontconfig@2.17.1-r0", "Name": "fontconfig", "Identifier": { "PURL": "pkg:apk/alpine/fontconfig@2.17.1-r0?arch=x86_64\u0026distro=3.23.4", "UID": "d805dd422ee9c232" }, "Version": "2.17.1-r0", "Arch": "x86_64", "SrcName": "fontconfig", "SrcVersion": "2.17.1-r0", "Licenses": [ "MIT" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "busybox-binsh@1.37.0-r30", "freetype@2.14.1-r0", "libexpat@2.7.5-r0", "musl@1.2.5-r23" ], "Layer": { "DiffID": "sha256:5519239b187cd3709c07332d1796e87305684dbc91e05de8de1682602b6c3118" }, "Digest": "sha1:8037b007516a65d246442a781a05f627073394d0", "InstalledFiles": [ "etc/fonts/fonts.conf", "etc/fonts/conf.d/10-hinting-slight.conf", "etc/fonts/conf.d/10-scale-bitmap-fonts.conf", "etc/fonts/conf.d/10-sub-pixel-none.conf", "etc/fonts/conf.d/10-yes-antialias.conf", "etc/fonts/conf.d/11-lcdfilter-default.conf", "etc/fonts/conf.d/20-unhint-small-vera.conf", "etc/fonts/conf.d/30-metric-aliases.conf", "etc/fonts/conf.d/40-nonlatin.conf", "etc/fonts/conf.d/45-generic.conf", "etc/fonts/conf.d/45-latin.conf", "etc/fonts/conf.d/48-spacing.conf", "etc/fonts/conf.d/49-sansserif.conf", "etc/fonts/conf.d/50-user.conf", "etc/fonts/conf.d/51-local.conf", "etc/fonts/conf.d/60-generic.conf", "etc/fonts/conf.d/60-latin.conf", "etc/fonts/conf.d/65-fonts-persian.conf", "etc/fonts/conf.d/65-nonlatin.conf", "etc/fonts/conf.d/69-unifont.conf", "etc/fonts/conf.d/70-no-bitmaps-except-emoji.conf", "etc/fonts/conf.d/80-delicious.conf", "etc/fonts/conf.d/90-synthetic.conf", "etc/fonts/conf.d/README", "usr/bin/fc-cache", "usr/bin/fc-cat", "usr/bin/fc-conflist", "usr/bin/fc-list", "usr/bin/fc-match", "usr/bin/fc-pattern", "usr/bin/fc-query", "usr/bin/fc-scan", "usr/bin/fc-validate", "usr/lib/libfontconfig.so.1", "usr/lib/libfontconfig.so.1.16.1", "usr/share/fontconfig/conf.avail/05-reset-dirs-sample.conf", "usr/share/fontconfig/conf.avail/09-autohint-if-no-hinting.conf", "usr/share/fontconfig/conf.avail/10-autohint.conf", "usr/share/fontconfig/conf.avail/10-hinting-full.conf", "usr/share/fontconfig/conf.avail/10-hinting-medium.conf", "usr/share/fontconfig/conf.avail/10-hinting-none.conf", "usr/share/fontconfig/conf.avail/10-hinting-slight.conf", "usr/share/fontconfig/conf.avail/10-no-antialias.conf", "usr/share/fontconfig/conf.avail/10-scale-bitmap-fonts.conf", "usr/share/fontconfig/conf.avail/10-sub-pixel-bgr.conf", "usr/share/fontconfig/conf.avail/10-sub-pixel-none.conf", "usr/share/fontconfig/conf.avail/10-sub-pixel-rgb.conf", "usr/share/fontconfig/conf.avail/10-sub-pixel-vbgr.conf", "usr/share/fontconfig/conf.avail/10-sub-pixel-vrgb.conf", "usr/share/fontconfig/conf.avail/10-unhinted.conf", "usr/share/fontconfig/conf.avail/10-yes-antialias.conf", "usr/share/fontconfig/conf.avail/11-lcdfilter-default.conf", "usr/share/fontconfig/conf.avail/11-lcdfilter-legacy.conf", "usr/share/fontconfig/conf.avail/11-lcdfilter-light.conf", "usr/share/fontconfig/conf.avail/11-lcdfilter-none.conf", "usr/share/fontconfig/conf.avail/20-unhint-small-vera.conf", "usr/share/fontconfig/conf.avail/25-unhint-nonlatin.conf", "usr/share/fontconfig/conf.avail/30-metric-aliases.conf", "usr/share/fontconfig/conf.avail/35-lang-normalize.conf", "usr/share/fontconfig/conf.avail/40-nonlatin.conf", "usr/share/fontconfig/conf.avail/45-generic.conf", "usr/share/fontconfig/conf.avail/45-latin.conf", "usr/share/fontconfig/conf.avail/48-guessfamily.conf", "usr/share/fontconfig/conf.avail/48-spacing.conf", "usr/share/fontconfig/conf.avail/49-sansserif.conf", "usr/share/fontconfig/conf.avail/50-user.conf", "usr/share/fontconfig/conf.avail/51-local.conf", "usr/share/fontconfig/conf.avail/60-generic.conf", "usr/share/fontconfig/conf.avail/60-latin.conf", "usr/share/fontconfig/conf.avail/65-fonts-persian.conf", "usr/share/fontconfig/conf.avail/65-khmer.conf", "usr/share/fontconfig/conf.avail/65-nonlatin.conf", "usr/share/fontconfig/conf.avail/69-unifont.conf", "usr/share/fontconfig/conf.avail/70-no-bitmaps-and-emoji.conf", "usr/share/fontconfig/conf.avail/70-no-bitmaps-except-emoji.conf", "usr/share/fontconfig/conf.avail/70-no-bitmaps.conf", "usr/share/fontconfig/conf.avail/70-yes-bitmaps.conf", "usr/share/fontconfig/conf.avail/80-delicious.conf", "usr/share/fontconfig/conf.avail/90-synthetic.conf", "usr/share/xml/fontconfig/fonts.dtd" ], "AnalyzedBy": "apk" }, { "ID": "freetype@2.14.1-r0", "Name": "freetype", "Identifier": { "PURL": "pkg:apk/alpine/freetype@2.14.1-r0?arch=x86_64\u0026distro=3.23.4", "UID": "d0ae0a3d160c9ff2" }, "Version": "2.14.1-r0", "Arch": "x86_64", "SrcName": "freetype", "SrcVersion": "2.14.1-r0", "Licenses": [ "FTL", "GPL-2.0-or-later" ], "Maintainer": "Carlo Landmeter \u003cclandmeter@alpinelinux.org\u003e", "DependsOn": [ "brotli-libs@1.2.0-r0", "libbz2@1.0.8-r6", "libpng@1.6.58-r1", "musl@1.2.5-r23", "zlib@1.3.2-r0" ], "Layer": { "DiffID": "sha256:5519239b187cd3709c07332d1796e87305684dbc91e05de8de1682602b6c3118" }, "Digest": "sha1:e227f29a00edd7ed5b1e62a050da6532183e60be", "InstalledFiles": [ "usr/lib/libfreetype.so.6", "usr/lib/libfreetype.so.6.20.4" ], "AnalyzedBy": "apk" }, { "ID": "geoip@1.6.12-r6", "Name": "geoip", "Identifier": { "PURL": "pkg:apk/alpine/geoip@1.6.12-r6?arch=x86_64\u0026distro=3.23.4", "UID": "e21c96f348abf9a7" }, "Version": "1.6.12-r6", "Arch": "x86_64", "SrcName": "geoip", "SrcVersion": "1.6.12-r6", "Licenses": [ "LGPL-2.1-or-later" ], "Maintainer": "Leonardo Arena \u003crnalrd@alpinelinux.org\u003e", "DependsOn": [ "musl@1.2.5-r23" ], "Layer": { "DiffID": "sha256:5519239b187cd3709c07332d1796e87305684dbc91e05de8de1682602b6c3118" }, "Digest": "sha1:8f2ea64ecb173949f03ec2371db4b534f142450f", "InstalledFiles": [ "usr/bin/geoiplookup", "usr/bin/geoiplookup6", "usr/lib/libGeoIP.so.1", "usr/lib/libGeoIP.so.1.6.12" ], "AnalyzedBy": "apk" }, { "ID": "gettext-envsubst@0.24.1-r1", "Name": "gettext-envsubst", "Identifier": { "PURL": "pkg:apk/alpine/gettext-envsubst@0.24.1-r1?arch=x86_64\u0026distro=3.23.4", "UID": "74b745a88adcfea9" }, "Version": "0.24.1-r1", "Arch": "x86_64", "SrcName": "gettext", "SrcVersion": "0.24.1-r1", "Licenses": [ "GPL-3.0-or-later", "LGPL-2.1-or-later", "MIT" ], "Maintainer": "Carlo Landmeter \u003cclandmeter@alpinelinux.org\u003e", "DependsOn": [ "libintl@0.24.1-r1", "musl@1.2.5-r23" ], "Layer": { "DiffID": "sha256:b910427bd94b3f8656a5557f6e4f484de3b83065ed7699fbbbeadcc313fbc2d9" }, "Digest": "sha1:7593f7d82a7c943f0114a5f700788c53afb8a554", "InstalledFiles": [ "usr/bin/envsubst" ], "AnalyzedBy": "apk" }, { "ID": "libapk@3.0.6-r0", "Name": "libapk", "Identifier": { "PURL": "pkg:apk/alpine/libapk@3.0.6-r0?arch=x86_64\u0026distro=3.23.4", "UID": "47dcfb9093b112c1" }, "Version": "3.0.6-r0", "Arch": "x86_64", "SrcName": "apk-tools", "SrcVersion": "3.0.6-r0", "Licenses": [ "GPL-2.0-only" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "libcrypto3@3.5.6-r0", "libssl3@3.5.6-r0", "musl@1.2.5-r23", "zlib@1.3.2-r0" ], "Layer": { "DiffID": "sha256:29df493baa13de438d6d2ece3a8333032e0b7b9b9d8cce4ee82194da255f61e1" }, "Digest": "sha1:f064c8318c4f7f17da6a490921ce0d5e709fc063", "InstalledFiles": [ "usr/lib/libapk.so.3.0.0" ], "AnalyzedBy": "apk" }, { "ID": "libavif@1.3.0-r0", "Name": "libavif", "Identifier": { "PURL": "pkg:apk/alpine/libavif@1.3.0-r0?arch=x86_64\u0026distro=3.23.4", "UID": "655cdbc6c9ce9e5b" }, "Version": "1.3.0-r0", "Arch": "x86_64", "SrcName": "libavif", "SrcVersion": "1.3.0-r0", "Licenses": [ "BSD-2-Clause" ], "Maintainer": "Bart Ribbers \u003cbribbers@disroot.org\u003e", "DependsOn": [ "aom-libs@3.13.1-r1", "libdav1d@1.5.2-r0", "libyuv@0.0.1887.20251502-r1", "musl@1.2.5-r23" ], "Layer": { "DiffID": "sha256:5519239b187cd3709c07332d1796e87305684dbc91e05de8de1682602b6c3118" }, "Digest": "sha1:6e0e61c8a9d1cb5a4a5f3faa64fb597844614f93", "InstalledFiles": [ "usr/lib/libavif.so.16", "usr/lib/libavif.so.16.3.0" ], "AnalyzedBy": "apk" }, { "ID": "libbsd@0.12.2-r0", "Name": "libbsd", "Identifier": { "PURL": "pkg:apk/alpine/libbsd@0.12.2-r0?arch=x86_64\u0026distro=3.23.4", "UID": "dd77a74c79623bb3" }, "Version": "0.12.2-r0", "Arch": "x86_64", "SrcName": "libbsd", "SrcVersion": "0.12.2-r0", "Licenses": [ "BSD-3-Clause" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "libmd@1.1.0-r0", "musl@1.2.5-r23" ], "Layer": { "DiffID": "sha256:5519239b187cd3709c07332d1796e87305684dbc91e05de8de1682602b6c3118" }, "Digest": "sha1:33970b157edad359d05a2c3e6f3460e725549c8b", "InstalledFiles": [ "usr/lib/libbsd.so.0", "usr/lib/libbsd.so.0.12.2" ], "AnalyzedBy": "apk" }, { "ID": "libbz2@1.0.8-r6", "Name": "libbz2", "Identifier": { "PURL": "pkg:apk/alpine/libbz2@1.0.8-r6?arch=x86_64\u0026distro=3.23.4", "UID": "d5d1649d0ebe2b41" }, "Version": "1.0.8-r6", "Arch": "x86_64", "SrcName": "bzip2", "SrcVersion": "1.0.8-r6", "Licenses": [ "bzip-2-1.0.6" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "musl@1.2.5-r23" ], "Layer": { "DiffID": "sha256:5519239b187cd3709c07332d1796e87305684dbc91e05de8de1682602b6c3118" }, "Digest": "sha1:864d363da11ee24c7920e0d052d2da7f8429251e", "InstalledFiles": [ "usr/lib/libbz2.so.1", "usr/lib/libbz2.so.1.0.8" ], "AnalyzedBy": "apk" }, { "ID": "libcrypto3@3.5.6-r0", "Name": "libcrypto3", "Identifier": { "PURL": "pkg:apk/alpine/libcrypto3@3.5.6-r0?arch=x86_64\u0026distro=3.23.4", "UID": "975680d851f10fda" }, "Version": "3.5.6-r0", "Arch": "x86_64", "SrcName": "openssl", "SrcVersion": "3.5.6-r0", "Licenses": [ "Apache-2.0" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "musl@1.2.5-r23" ], "Layer": { "DiffID": "sha256:29df493baa13de438d6d2ece3a8333032e0b7b9b9d8cce4ee82194da255f61e1" }, "Digest": "sha1:9e7a866d0d052d290d3f9d621a4c89214188acff", "InstalledFiles": [ "etc/ssl/ct_log_list.cnf", "etc/ssl/ct_log_list.cnf.dist", "etc/ssl/openssl.cnf", "etc/ssl/openssl.cnf.dist", "usr/lib/libcrypto.so.3", "usr/lib/engines-3/afalg.so", "usr/lib/engines-3/capi.so", "usr/lib/engines-3/loader_attic.so", "usr/lib/engines-3/padlock.so", "usr/lib/ossl-modules/legacy.so" ], "AnalyzedBy": "apk" }, { "ID": "libcurl@8.19.0-r0", "Name": "libcurl", "Identifier": { "PURL": "pkg:apk/alpine/libcurl@8.19.0-r0?arch=x86_64\u0026distro=3.23.4", "UID": "ae99b13d03576e54" }, "Version": "8.19.0-r0", "Arch": "x86_64", "SrcName": "curl", "SrcVersion": "8.19.0-r0", "Licenses": [ "curl" ], "Maintainer": "Achill Gilgenast \u003cachill@achill.org\u003e", "DependsOn": [ "brotli-libs@1.2.0-r0", "c-ares@1.34.6-r0", "ca-certificates-bundle@20260413-r0", "libcrypto3@3.5.6-r0", "libidn2@2.3.8-r0", "libpsl@0.21.5-r3", "libssl3@3.5.6-r0", "musl@1.2.5-r23", "nghttp2-libs@1.69.0-r0", "zlib@1.3.2-r0", "zstd-libs@1.5.7-r2" ], "Layer": { "DiffID": "sha256:5519239b187cd3709c07332d1796e87305684dbc91e05de8de1682602b6c3118" }, "Digest": "sha1:c833586b6e5dcd4a10da7cf354b01d9e0ee10da8", "InstalledFiles": [ "usr/lib/libcurl.so.4", "usr/lib/libcurl.so.4.8.0" ], "AnalyzedBy": "apk" }, { "ID": "libdav1d@1.5.2-r0", "Name": "libdav1d", "Identifier": { "PURL": "pkg:apk/alpine/libdav1d@1.5.2-r0?arch=x86_64\u0026distro=3.23.4", "UID": "470e133c6bf6f9c4" }, "Version": "1.5.2-r0", "Arch": "x86_64", "SrcName": "dav1d", "SrcVersion": "1.5.2-r0", "Licenses": [ "BSD-2-Clause" ], "Maintainer": "Bart Ribbers \u003cbribbers@disroot.org\u003e", "DependsOn": [ "musl@1.2.5-r23" ], "Layer": { "DiffID": "sha256:5519239b187cd3709c07332d1796e87305684dbc91e05de8de1682602b6c3118" }, "Digest": "sha1:62a9676453a8b99cfb42148cfd26df3b964bcc1b", "InstalledFiles": [ "usr/lib/libdav1d.so.7", "usr/lib/libdav1d.so.7.0.0" ], "AnalyzedBy": "apk" }, { "ID": "libedit@20251016.3.1-r0", "Name": "libedit", "Identifier": { "PURL": "pkg:apk/alpine/libedit@20251016.3.1-r0?arch=x86_64\u0026distro=3.23.4", "UID": "4cd9b43219994542" }, "Version": "20251016.3.1-r0", "Arch": "x86_64", "SrcName": "libedit", "SrcVersion": "20251016.3.1-r0", "Licenses": [ "BSD-3-Clause" ], "Maintainer": "Celeste \u003ccielesti@protonmail.com\u003e", "DependsOn": [ "libncursesw@6.5_p20251123-r0", "musl@1.2.5-r23" ], "Layer": { "DiffID": "sha256:5519239b187cd3709c07332d1796e87305684dbc91e05de8de1682602b6c3118" }, "Digest": "sha1:463f69335a3223b1ce6856ce3bef5c03fee721bf", "InstalledFiles": [ "usr/lib/libedit.so.0", "usr/lib/libedit.so.0.0.76" ], "AnalyzedBy": "apk" }, { "ID": "libexpat@2.7.5-r0", "Name": "libexpat", "Identifier": { "PURL": "pkg:apk/alpine/libexpat@2.7.5-r0?arch=x86_64\u0026distro=3.23.4", "UID": "28e722d1da61bc2e" }, "Version": "2.7.5-r0", "Arch": "x86_64", "SrcName": "expat", "SrcVersion": "2.7.5-r0", "Licenses": [ "MIT" ], "Maintainer": "Carlo Landmeter \u003cclandmeter@alpinelinux.org\u003e", "DependsOn": [ "musl@1.2.5-r23" ], "Layer": { "DiffID": "sha256:5519239b187cd3709c07332d1796e87305684dbc91e05de8de1682602b6c3118" }, "Digest": "sha1:5760d53ddd7cca8a742c672e4e00a475718eacaa", "InstalledFiles": [ "usr/lib/libexpat.so.1", "usr/lib/libexpat.so.1.11.3" ], "AnalyzedBy": "apk" }, { "ID": "libgcc@15.2.0-r2", "Name": "libgcc", "Identifier": { "PURL": "pkg:apk/alpine/libgcc@15.2.0-r2?arch=x86_64\u0026distro=3.23.4", "UID": "89fff20701e56ab7" }, "Version": "15.2.0-r2", "Arch": "x86_64", "SrcName": "gcc", "SrcVersion": "15.2.0-r2", "Licenses": [ "GPL-2.0-or-later", "LGPL-2.1-or-later" ], "Maintainer": "Ariadne Conill \u003cariadne@dereferenced.org\u003e", "DependsOn": [ "musl@1.2.5-r23" ], "Layer": { "DiffID": "sha256:5519239b187cd3709c07332d1796e87305684dbc91e05de8de1682602b6c3118" }, "Digest": "sha1:57fccbe9eebf23f2c4f38ee2a24f8b0bdd508ff7", "InstalledFiles": [ "usr/lib/libgcc_s.so.1" ], "AnalyzedBy": "apk" }, { "ID": "libgd@2.3.3-r10", "Name": "libgd", "Identifier": { "PURL": "pkg:apk/alpine/libgd@2.3.3-r10?arch=x86_64\u0026distro=3.23.4", "UID": "b67312ef2319dd49" }, "Version": "2.3.3-r10", "Arch": "x86_64", "SrcName": "gd", "SrcVersion": "2.3.3-r10", "Licenses": [ "GD" ], "Maintainer": "Carlo Landmeter \u003cclandmeter@alpinelinux.org\u003e", "DependsOn": [ "fontconfig@2.17.1-r0", "freetype@2.14.1-r0", "libavif@1.3.0-r0", "libjpeg-turbo@3.1.2-r0", "libpng@1.6.58-r1", "libwebp@1.6.0-r0", "libxpm@3.5.19-r0", "musl@1.2.5-r23", "tiff@4.7.1-r0", "zlib@1.3.2-r0" ], "Layer": { "DiffID": "sha256:5519239b187cd3709c07332d1796e87305684dbc91e05de8de1682602b6c3118" }, "Digest": "sha1:948454e00c660b6ddf1338a857959222f0888336", "InstalledFiles": [ "usr/lib/libgd.so.3", "usr/lib/libgd.so.3.0.11" ], "AnalyzedBy": "apk" }, { "ID": "libice@1.1.2-r0", "Name": "libice", "Identifier": { "PURL": "pkg:apk/alpine/libice@1.1.2-r0?arch=x86_64\u0026distro=3.23.4", "UID": "3348caa25e2ecdc4" }, "Version": "1.1.2-r0", "Arch": "x86_64", "SrcName": "libice", "SrcVersion": "1.1.2-r0", "Licenses": [ "X-11" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "musl@1.2.5-r23" ], "Layer": { "DiffID": "sha256:5519239b187cd3709c07332d1796e87305684dbc91e05de8de1682602b6c3118" }, "Digest": "sha1:997a01303f63cee0ba9773f0cd9b26b2eb5e6ace", "InstalledFiles": [ "usr/lib/libICE.so.6", "usr/lib/libICE.so.6.3.0" ], "AnalyzedBy": "apk" }, { "ID": "libidn2@2.3.8-r0", "Name": "libidn2", "Identifier": { "PURL": "pkg:apk/alpine/libidn2@2.3.8-r0?arch=x86_64\u0026distro=3.23.4", "UID": "f2e21ad261c22630" }, "Version": "2.3.8-r0", "Arch": "x86_64", "SrcName": "libidn2", "SrcVersion": "2.3.8-r0", "Licenses": [ "GPL-2.0-or-later", "LGPL-3.0-or-later" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "libunistring@1.4.1-r0", "musl@1.2.5-r23" ], "Layer": { "DiffID": "sha256:5519239b187cd3709c07332d1796e87305684dbc91e05de8de1682602b6c3118" }, "Digest": "sha1:b8c5bfa365da5c360a01230db4d71e65af94af3d", "InstalledFiles": [ "usr/lib/libidn2.so.0", "usr/lib/libidn2.so.0.4.0" ], "AnalyzedBy": "apk" }, { "ID": "libintl@0.24.1-r1", "Name": "libintl", "Identifier": { "PURL": "pkg:apk/alpine/libintl@0.24.1-r1?arch=x86_64\u0026distro=3.23.4", "UID": "6b922bec7f8abaa" }, "Version": "0.24.1-r1", "Arch": "x86_64", "SrcName": "gettext", "SrcVersion": "0.24.1-r1", "Licenses": [ "LGPL-2.1-or-later" ], "Maintainer": "Carlo Landmeter \u003cclandmeter@alpinelinux.org\u003e", "DependsOn": [ "musl@1.2.5-r23" ], "Layer": { "DiffID": "sha256:b910427bd94b3f8656a5557f6e4f484de3b83065ed7699fbbbeadcc313fbc2d9" }, "Digest": "sha1:0222324bb4dfd35e8a3ec821c86eb5afbd43a3af", "InstalledFiles": [ "usr/lib/libintl.so.8", "usr/lib/libintl.so.8.4.3" ], "AnalyzedBy": "apk" }, { "ID": "libjpeg-turbo@3.1.2-r0", "Name": "libjpeg-turbo", "Identifier": { "PURL": "pkg:apk/alpine/libjpeg-turbo@3.1.2-r0?arch=x86_64\u0026distro=3.23.4", "UID": "76e9eea31b92641e" }, "Version": "3.1.2-r0", "Arch": "x86_64", "SrcName": "libjpeg-turbo", "SrcVersion": "3.1.2-r0", "Licenses": [ "BSD-3-Clause", "IJG", "Zlib" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "musl@1.2.5-r23" ], "Layer": { "DiffID": "sha256:5519239b187cd3709c07332d1796e87305684dbc91e05de8de1682602b6c3118" }, "Digest": "sha1:aa025fb7ecf9bd65ef2afe47e3740639521e09ce", "InstalledFiles": [ "usr/lib/libjpeg.so.8", "usr/lib/libjpeg.so.8.3.2" ], "AnalyzedBy": "apk" }, { "ID": "libmd@1.1.0-r0", "Name": "libmd", "Identifier": { "PURL": "pkg:apk/alpine/libmd@1.1.0-r0?arch=x86_64\u0026distro=3.23.4", "UID": "53cb33d88e504fac" }, "Version": "1.1.0-r0", "Arch": "x86_64", "SrcName": "libmd", "SrcVersion": "1.1.0-r0", "Licenses": [ "BSD-3-Clause", "BSD-2-Clause", "ISC", "Beerware", "Public", "Domain" ], "Maintainer": "omni \u003comni+alpine@hack.org\u003e", "DependsOn": [ "musl@1.2.5-r23" ], "Layer": { "DiffID": "sha256:5519239b187cd3709c07332d1796e87305684dbc91e05de8de1682602b6c3118" }, "Digest": "sha1:ce7c57bd1f6628da8ba0d3f2ac18f6d8c93c0346", "InstalledFiles": [ "usr/lib/libmd.so.0", "usr/lib/libmd.so.0.1.0" ], "AnalyzedBy": "apk" }, { "ID": "libncursesw@6.5_p20251123-r0", "Name": "libncursesw", "Identifier": { "PURL": "pkg:apk/alpine/libncursesw@6.5_p20251123-r0?arch=x86_64\u0026distro=3.23.4", "UID": "edc30eb15f442d49" }, "Version": "6.5_p20251123-r0", "Arch": "x86_64", "SrcName": "ncurses", "SrcVersion": "6.5_p20251123-r0", "Licenses": [ "X-11" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "musl@1.2.5-r23", "ncurses-terminfo-base@6.5_p20251123-r0" ], "Layer": { "DiffID": "sha256:5519239b187cd3709c07332d1796e87305684dbc91e05de8de1682602b6c3118" }, "Digest": "sha1:649d3041c52b80620fb50a98f5979d25ebbe1523", "InstalledFiles": [ "usr/lib/libncursesw.so.6", "usr/lib/libncursesw.so.6.5" ], "AnalyzedBy": "apk" }, { "ID": "libpng@1.6.58-r1", "Name": "libpng", "Identifier": { "PURL": "pkg:apk/alpine/libpng@1.6.58-r1?arch=x86_64\u0026distro=3.23.4", "UID": "f22fca42d750ae4d" }, "Version": "1.6.58-r1", "Arch": "x86_64", "SrcName": "libpng", "SrcVersion": "1.6.58-r1", "Licenses": [ "Libpng" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "musl@1.2.5-r23", "zlib@1.3.2-r0" ], "Layer": { "DiffID": "sha256:5519239b187cd3709c07332d1796e87305684dbc91e05de8de1682602b6c3118" }, "Digest": "sha1:2dce71ea975aa82cbbcfcaac80af209bc84dd3c8", "InstalledFiles": [ "usr/lib/libpng16.so.16", "usr/lib/libpng16.so.16.58.0" ], "AnalyzedBy": "apk" }, { "ID": "libpsl@0.21.5-r3", "Name": "libpsl", "Identifier": { "PURL": "pkg:apk/alpine/libpsl@0.21.5-r3?arch=x86_64\u0026distro=3.23.4", "UID": "3b2044e446534821" }, "Version": "0.21.5-r3", "Arch": "x86_64", "SrcName": "libpsl", "SrcVersion": "0.21.5-r3", "Licenses": [ "MIT" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "libidn2@2.3.8-r0", "libunistring@1.4.1-r0", "musl@1.2.5-r23" ], "Layer": { "DiffID": "sha256:5519239b187cd3709c07332d1796e87305684dbc91e05de8de1682602b6c3118" }, "Digest": "sha1:b663c00f920a93be49c825555aa1a212e4287393", "InstalledFiles": [ "usr/lib/libpsl.so.5", "usr/lib/libpsl.so.5.3.5" ], "AnalyzedBy": "apk" }, { "ID": "libsharpyuv@1.6.0-r0", "Name": "libsharpyuv", "Identifier": { "PURL": "pkg:apk/alpine/libsharpyuv@1.6.0-r0?arch=x86_64\u0026distro=3.23.4", "UID": "73fb52723f19371d" }, "Version": "1.6.0-r0", "Arch": "x86_64", "SrcName": "libwebp", "SrcVersion": "1.6.0-r0", "Licenses": [ "BSD-3-Clause" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "musl@1.2.5-r23" ], "Layer": { "DiffID": "sha256:5519239b187cd3709c07332d1796e87305684dbc91e05de8de1682602b6c3118" }, "Digest": "sha1:9bbf3958ac62e163084cde753276246e56ff298b", "InstalledFiles": [ "usr/lib/libsharpyuv.so.0", "usr/lib/libsharpyuv.so.0.1.2" ], "AnalyzedBy": "apk" }, { "ID": "libsm@1.2.6-r0", "Name": "libsm", "Identifier": { "PURL": "pkg:apk/alpine/libsm@1.2.6-r0?arch=x86_64\u0026distro=3.23.4", "UID": "5b884a45ca171ccf" }, "Version": "1.2.6-r0", "Arch": "x86_64", "SrcName": "libsm", "SrcVersion": "1.2.6-r0", "Licenses": [ "MIT" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "libice@1.1.2-r0", "libuuid@2.41.4-r0", "musl@1.2.5-r23" ], "Layer": { "DiffID": "sha256:5519239b187cd3709c07332d1796e87305684dbc91e05de8de1682602b6c3118" }, "Digest": "sha1:244b3b3e68f3c6c11c6202320109d460a2498e76", "InstalledFiles": [ "usr/lib/libSM.so.6", "usr/lib/libSM.so.6.0.1" ], "AnalyzedBy": "apk" }, { "ID": "libssl3@3.5.6-r0", "Name": "libssl3", "Identifier": { "PURL": "pkg:apk/alpine/libssl3@3.5.6-r0?arch=x86_64\u0026distro=3.23.4", "UID": "aece396067dff154" }, "Version": "3.5.6-r0", "Arch": "x86_64", "SrcName": "openssl", "SrcVersion": "3.5.6-r0", "Licenses": [ "Apache-2.0" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "libcrypto3@3.5.6-r0", "musl@1.2.5-r23" ], "Layer": { "DiffID": "sha256:29df493baa13de438d6d2ece3a8333032e0b7b9b9d8cce4ee82194da255f61e1" }, "Digest": "sha1:5a2620d507434903b747470a76b47e24b222de5e", "InstalledFiles": [ "usr/lib/libssl.so.3" ], "AnalyzedBy": "apk" }, { "ID": "libstdc++@15.2.0-r2", "Name": "libstdc++", "Identifier": { "PURL": "pkg:apk/alpine/libstdc%2B%2B@15.2.0-r2?arch=x86_64\u0026distro=3.23.4", "UID": "3ff8ae215a6a54a6" }, "Version": "15.2.0-r2", "Arch": "x86_64", "SrcName": "gcc", "SrcVersion": "15.2.0-r2", "Licenses": [ "GPL-2.0-or-later", "LGPL-2.1-or-later" ], "Maintainer": "Ariadne Conill \u003cariadne@dereferenced.org\u003e", "DependsOn": [ "libgcc@15.2.0-r2", "musl@1.2.5-r23" ], "Layer": { "DiffID": "sha256:5519239b187cd3709c07332d1796e87305684dbc91e05de8de1682602b6c3118" }, "Digest": "sha1:528d77417a16706468af852f2859ad00f176e266", "InstalledFiles": [ "usr/lib/libstdc++.so.6", "usr/lib/libstdc++.so.6.0.34" ], "AnalyzedBy": "apk" }, { "ID": "libunistring@1.4.1-r0", "Name": "libunistring", "Identifier": { "PURL": "pkg:apk/alpine/libunistring@1.4.1-r0?arch=x86_64\u0026distro=3.23.4", "UID": "97a3c9b2cf3d0f9e" }, "Version": "1.4.1-r0", "Arch": "x86_64", "SrcName": "libunistring", "SrcVersion": "1.4.1-r0", "Licenses": [ "GPL-2.0-or-later", "LGPL-3.0-or-later" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "musl@1.2.5-r23" ], "Layer": { "DiffID": "sha256:5519239b187cd3709c07332d1796e87305684dbc91e05de8de1682602b6c3118" }, "Digest": "sha1:6e56562bde456bee5971787d3d95c34e84ced797", "InstalledFiles": [ "usr/lib/libunistring.so.5", "usr/lib/libunistring.so.5.2.1" ], "AnalyzedBy": "apk" }, { "ID": "libuuid@2.41.4-r0", "Name": "libuuid", "Identifier": { "PURL": "pkg:apk/alpine/libuuid@2.41.4-r0?arch=x86_64\u0026distro=3.23.4", "UID": "833419752375af8a" }, "Version": "2.41.4-r0", "Arch": "x86_64", "SrcName": "util-linux", "SrcVersion": "2.41.4-r0", "Licenses": [ "BSD-3-Clause" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "musl@1.2.5-r23" ], "Layer": { "DiffID": "sha256:5519239b187cd3709c07332d1796e87305684dbc91e05de8de1682602b6c3118" }, "Digest": "sha1:d03966d821a1d9454e5576f96ec455824112fe46", "InstalledFiles": [ "usr/lib/libuuid.so.1", "usr/lib/libuuid.so.1.3.0" ], "AnalyzedBy": "apk" }, { "ID": "libwebp@1.6.0-r0", "Name": "libwebp", "Identifier": { "PURL": "pkg:apk/alpine/libwebp@1.6.0-r0?arch=x86_64\u0026distro=3.23.4", "UID": "cf3db5e019392979" }, "Version": "1.6.0-r0", "Arch": "x86_64", "SrcName": "libwebp", "SrcVersion": "1.6.0-r0", "Licenses": [ "BSD-3-Clause" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "libsharpyuv@1.6.0-r0", "musl@1.2.5-r23" ], "Layer": { "DiffID": "sha256:5519239b187cd3709c07332d1796e87305684dbc91e05de8de1682602b6c3118" }, "Digest": "sha1:46f79fe406ce611058a6c0ce995ebe85f7b73c7a", "InstalledFiles": [ "usr/lib/libwebp.so.7", "usr/lib/libwebp.so.7.2.0" ], "AnalyzedBy": "apk" }, { "ID": "libx11@1.8.12-r1", "Name": "libx11", "Identifier": { "PURL": "pkg:apk/alpine/libx11@1.8.12-r1?arch=x86_64\u0026distro=3.23.4", "UID": "e8538d9e85dca6bf" }, "Version": "1.8.12-r1", "Arch": "x86_64", "SrcName": "libx11", "SrcVersion": "1.8.12-r1", "Licenses": [ "X-11" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "libxcb@1.17.0-r1", "musl@1.2.5-r23" ], "Layer": { "DiffID": "sha256:5519239b187cd3709c07332d1796e87305684dbc91e05de8de1682602b6c3118" }, "Digest": "sha1:689b36ec47d6c9abb9cbd0c7067ba4636568dbd5", "InstalledFiles": [ "usr/lib/libX11-xcb.so.1", "usr/lib/libX11-xcb.so.1.0.0", "usr/lib/libX11.so.6", "usr/lib/libX11.so.6.4.0", "usr/share/X11/XErrorDB", "usr/share/X11/Xcms.txt", "usr/share/X11/locale/compose.dir", "usr/share/X11/locale/locale.alias", "usr/share/X11/locale/locale.dir", "usr/share/X11/locale/C/Compose", "usr/share/X11/locale/C/XI18N_OBJS", "usr/share/X11/locale/C/XLC_LOCALE", "usr/share/X11/locale/am_ET.UTF-8/Compose", "usr/share/X11/locale/am_ET.UTF-8/XI18N_OBJS", "usr/share/X11/locale/am_ET.UTF-8/XLC_LOCALE", "usr/share/X11/locale/armscii-8/Compose", "usr/share/X11/locale/armscii-8/XI18N_OBJS", "usr/share/X11/locale/armscii-8/XLC_LOCALE", "usr/share/X11/locale/cs_CZ.UTF-8/Compose", "usr/share/X11/locale/cs_CZ.UTF-8/XI18N_OBJS", "usr/share/X11/locale/cs_CZ.UTF-8/XLC_LOCALE", "usr/share/X11/locale/el_GR.UTF-8/Compose", "usr/share/X11/locale/el_GR.UTF-8/XI18N_OBJS", "usr/share/X11/locale/el_GR.UTF-8/XLC_LOCALE", "usr/share/X11/locale/en_US.UTF-8/Compose", "usr/share/X11/locale/en_US.UTF-8/XI18N_OBJS", "usr/share/X11/locale/en_US.UTF-8/XLC_LOCALE", "usr/share/X11/locale/fi_FI.UTF-8/Compose", "usr/share/X11/locale/fi_FI.UTF-8/XI18N_OBJS", "usr/share/X11/locale/fi_FI.UTF-8/XLC_LOCALE", "usr/share/X11/locale/georgian-academy/Compose", "usr/share/X11/locale/georgian-academy/XI18N_OBJS", "usr/share/X11/locale/georgian-academy/XLC_LOCALE", "usr/share/X11/locale/georgian-ps/Compose", "usr/share/X11/locale/georgian-ps/XI18N_OBJS", "usr/share/X11/locale/georgian-ps/XLC_LOCALE", "usr/share/X11/locale/ibm-cp1133/Compose", "usr/share/X11/locale/ibm-cp1133/XI18N_OBJS", "usr/share/X11/locale/ibm-cp1133/XLC_LOCALE", "usr/share/X11/locale/iscii-dev/Compose", "usr/share/X11/locale/iscii-dev/XI18N_OBJS", "usr/share/X11/locale/iscii-dev/XLC_LOCALE", "usr/share/X11/locale/isiri-3342/Compose", "usr/share/X11/locale/isiri-3342/XI18N_OBJS", "usr/share/X11/locale/isiri-3342/XLC_LOCALE", "usr/share/X11/locale/iso8859-1/Compose", "usr/share/X11/locale/iso8859-1/XI18N_OBJS", "usr/share/X11/locale/iso8859-1/XLC_LOCALE", "usr/share/X11/locale/iso8859-10/Compose", "usr/share/X11/locale/iso8859-10/XI18N_OBJS", "usr/share/X11/locale/iso8859-10/XLC_LOCALE", "usr/share/X11/locale/iso8859-11/Compose", "usr/share/X11/locale/iso8859-11/XI18N_OBJS", "usr/share/X11/locale/iso8859-11/XLC_LOCALE", "usr/share/X11/locale/iso8859-13/Compose", "usr/share/X11/locale/iso8859-13/XI18N_OBJS", "usr/share/X11/locale/iso8859-13/XLC_LOCALE", "usr/share/X11/locale/iso8859-14/Compose", "usr/share/X11/locale/iso8859-14/XI18N_OBJS", "usr/share/X11/locale/iso8859-14/XLC_LOCALE", "usr/share/X11/locale/iso8859-15/Compose", "usr/share/X11/locale/iso8859-15/XI18N_OBJS", "usr/share/X11/locale/iso8859-15/XLC_LOCALE", "usr/share/X11/locale/iso8859-2/Compose", "usr/share/X11/locale/iso8859-2/XI18N_OBJS", "usr/share/X11/locale/iso8859-2/XLC_LOCALE", "usr/share/X11/locale/iso8859-3/Compose", "usr/share/X11/locale/iso8859-3/XI18N_OBJS", "usr/share/X11/locale/iso8859-3/XLC_LOCALE", "usr/share/X11/locale/iso8859-4/Compose", "usr/share/X11/locale/iso8859-4/XI18N_OBJS", "usr/share/X11/locale/iso8859-4/XLC_LOCALE", "usr/share/X11/locale/iso8859-5/Compose", "usr/share/X11/locale/iso8859-5/XI18N_OBJS", "usr/share/X11/locale/iso8859-5/XLC_LOCALE", "usr/share/X11/locale/iso8859-6/Compose", "usr/share/X11/locale/iso8859-6/XI18N_OBJS", "usr/share/X11/locale/iso8859-6/XLC_LOCALE", "usr/share/X11/locale/iso8859-7/Compose", "usr/share/X11/locale/iso8859-7/XI18N_OBJS", "usr/share/X11/locale/iso8859-7/XLC_LOCALE", "usr/share/X11/locale/iso8859-8/Compose", "usr/share/X11/locale/iso8859-8/XI18N_OBJS", "usr/share/X11/locale/iso8859-8/XLC_LOCALE", "usr/share/X11/locale/iso8859-9/Compose", "usr/share/X11/locale/iso8859-9/XI18N_OBJS", "usr/share/X11/locale/iso8859-9/XLC_LOCALE", "usr/share/X11/locale/iso8859-9e/Compose", "usr/share/X11/locale/iso8859-9e/XI18N_OBJS", "usr/share/X11/locale/iso8859-9e/XLC_LOCALE", "usr/share/X11/locale/ja/Compose", "usr/share/X11/locale/ja/XI18N_OBJS", "usr/share/X11/locale/ja/XLC_LOCALE", "usr/share/X11/locale/ja.JIS/Compose", "usr/share/X11/locale/ja.JIS/XI18N_OBJS", "usr/share/X11/locale/ja.JIS/XLC_LOCALE", "usr/share/X11/locale/ja.SJIS/Compose", "usr/share/X11/locale/ja.SJIS/XI18N_OBJS", "usr/share/X11/locale/ja.SJIS/XLC_LOCALE", "usr/share/X11/locale/ja_JP.UTF-8/Compose", "usr/share/X11/locale/ja_JP.UTF-8/XI18N_OBJS", "usr/share/X11/locale/ja_JP.UTF-8/XLC_LOCALE", "usr/share/X11/locale/km_KH.UTF-8/Compose", "usr/share/X11/locale/km_KH.UTF-8/XI18N_OBJS", "usr/share/X11/locale/km_KH.UTF-8/XLC_LOCALE", "usr/share/X11/locale/ko/Compose", "usr/share/X11/locale/ko/XI18N_OBJS", "usr/share/X11/locale/ko/XLC_LOCALE", "usr/share/X11/locale/ko_KR.UTF-8/Compose", "usr/share/X11/locale/ko_KR.UTF-8/XI18N_OBJS", "usr/share/X11/locale/ko_KR.UTF-8/XLC_LOCALE", "usr/share/X11/locale/koi8-c/Compose", "usr/share/X11/locale/koi8-c/XI18N_OBJS", "usr/share/X11/locale/koi8-c/XLC_LOCALE", "usr/share/X11/locale/koi8-r/Compose", "usr/share/X11/locale/koi8-r/XI18N_OBJS", "usr/share/X11/locale/koi8-r/XLC_LOCALE", "usr/share/X11/locale/koi8-u/Compose", "usr/share/X11/locale/koi8-u/XI18N_OBJS", "usr/share/X11/locale/koi8-u/XLC_LOCALE", "usr/share/X11/locale/microsoft-cp1251/Compose", "usr/share/X11/locale/microsoft-cp1251/XI18N_OBJS", "usr/share/X11/locale/microsoft-cp1251/XLC_LOCALE", "usr/share/X11/locale/microsoft-cp1255/Compose", "usr/share/X11/locale/microsoft-cp1255/XI18N_OBJS", "usr/share/X11/locale/microsoft-cp1255/XLC_LOCALE", "usr/share/X11/locale/microsoft-cp1256/Compose", "usr/share/X11/locale/microsoft-cp1256/XI18N_OBJS", "usr/share/X11/locale/microsoft-cp1256/XLC_LOCALE", "usr/share/X11/locale/mulelao-1/Compose", "usr/share/X11/locale/mulelao-1/XI18N_OBJS", "usr/share/X11/locale/mulelao-1/XLC_LOCALE", "usr/share/X11/locale/nokhchi-1/Compose", "usr/share/X11/locale/nokhchi-1/XI18N_OBJS", "usr/share/X11/locale/nokhchi-1/XLC_LOCALE", "usr/share/X11/locale/pt_BR.UTF-8/Compose", "usr/share/X11/locale/pt_BR.UTF-8/XI18N_OBJS", "usr/share/X11/locale/pt_BR.UTF-8/XLC_LOCALE", "usr/share/X11/locale/pt_PT.UTF-8/Compose", "usr/share/X11/locale/pt_PT.UTF-8/XI18N_OBJS", "usr/share/X11/locale/pt_PT.UTF-8/XLC_LOCALE", "usr/share/X11/locale/ru_RU.UTF-8/Compose", "usr/share/X11/locale/ru_RU.UTF-8/XI18N_OBJS", "usr/share/X11/locale/ru_RU.UTF-8/XLC_LOCALE", "usr/share/X11/locale/sr_RS.UTF-8/Compose", "usr/share/X11/locale/sr_RS.UTF-8/XI18N_OBJS", "usr/share/X11/locale/sr_RS.UTF-8/XLC_LOCALE", "usr/share/X11/locale/tatar-cyr/Compose", "usr/share/X11/locale/tatar-cyr/XI18N_OBJS", "usr/share/X11/locale/tatar-cyr/XLC_LOCALE", "usr/share/X11/locale/th_TH/Compose", "usr/share/X11/locale/th_TH/XI18N_OBJS", "usr/share/X11/locale/th_TH/XLC_LOCALE", "usr/share/X11/locale/th_TH.UTF-8/Compose", "usr/share/X11/locale/th_TH.UTF-8/XI18N_OBJS", "usr/share/X11/locale/th_TH.UTF-8/XLC_LOCALE", "usr/share/X11/locale/tscii-0/Compose", "usr/share/X11/locale/tscii-0/XI18N_OBJS", "usr/share/X11/locale/tscii-0/XLC_LOCALE", "usr/share/X11/locale/vi_VN.tcvn/Compose", "usr/share/X11/locale/vi_VN.tcvn/XI18N_OBJS", "usr/share/X11/locale/vi_VN.tcvn/XLC_LOCALE", "usr/share/X11/locale/vi_VN.viscii/Compose", "usr/share/X11/locale/vi_VN.viscii/XI18N_OBJS", "usr/share/X11/locale/vi_VN.viscii/XLC_LOCALE", "usr/share/X11/locale/zh_CN/Compose", "usr/share/X11/locale/zh_CN/XI18N_OBJS", "usr/share/X11/locale/zh_CN/XLC_LOCALE", "usr/share/X11/locale/zh_CN.UTF-8/Compose", "usr/share/X11/locale/zh_CN.UTF-8/XI18N_OBJS", "usr/share/X11/locale/zh_CN.UTF-8/XLC_LOCALE", "usr/share/X11/locale/zh_CN.gb18030/Compose", "usr/share/X11/locale/zh_CN.gb18030/XI18N_OBJS", "usr/share/X11/locale/zh_CN.gb18030/XLC_LOCALE", "usr/share/X11/locale/zh_CN.gbk/Compose", "usr/share/X11/locale/zh_CN.gbk/XI18N_OBJS", "usr/share/X11/locale/zh_CN.gbk/XLC_LOCALE", "usr/share/X11/locale/zh_HK.UTF-8/Compose", "usr/share/X11/locale/zh_HK.UTF-8/XI18N_OBJS", "usr/share/X11/locale/zh_HK.UTF-8/XLC_LOCALE", "usr/share/X11/locale/zh_HK.big5/Compose", "usr/share/X11/locale/zh_HK.big5/XI18N_OBJS", "usr/share/X11/locale/zh_HK.big5/XLC_LOCALE", "usr/share/X11/locale/zh_HK.big5hkscs/Compose", "usr/share/X11/locale/zh_HK.big5hkscs/XI18N_OBJS", "usr/share/X11/locale/zh_HK.big5hkscs/XLC_LOCALE", "usr/share/X11/locale/zh_TW/Compose", "usr/share/X11/locale/zh_TW/XI18N_OBJS", "usr/share/X11/locale/zh_TW/XLC_LOCALE", "usr/share/X11/locale/zh_TW.UTF-8/Compose", "usr/share/X11/locale/zh_TW.UTF-8/XI18N_OBJS", "usr/share/X11/locale/zh_TW.UTF-8/XLC_LOCALE", "usr/share/X11/locale/zh_TW.big5/Compose", "usr/share/X11/locale/zh_TW.big5/XI18N_OBJS", "usr/share/X11/locale/zh_TW.big5/XLC_LOCALE" ], "AnalyzedBy": "apk" }, { "ID": "libxau@1.0.12-r0", "Name": "libxau", "Identifier": { "PURL": "pkg:apk/alpine/libxau@1.0.12-r0?arch=x86_64\u0026distro=3.23.4", "UID": "d485bce96f246b42" }, "Version": "1.0.12-r0", "Arch": "x86_64", "SrcName": "libxau", "SrcVersion": "1.0.12-r0", "Licenses": [ "MIT" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "musl@1.2.5-r23" ], "Layer": { "DiffID": "sha256:5519239b187cd3709c07332d1796e87305684dbc91e05de8de1682602b6c3118" }, "Digest": "sha1:89d2bc9daae3cb0e2ae095db6866357b7653f341", "InstalledFiles": [ "usr/lib/libXau.so.6", "usr/lib/libXau.so.6.0.0" ], "AnalyzedBy": "apk" }, { "ID": "libxcb@1.17.0-r1", "Name": "libxcb", "Identifier": { "PURL": "pkg:apk/alpine/libxcb@1.17.0-r1?arch=x86_64\u0026distro=3.23.4", "UID": "9257eaebc5b55b2" }, "Version": "1.17.0-r1", "Arch": "x86_64", "SrcName": "libxcb", "SrcVersion": "1.17.0-r1", "Licenses": [ "MIT" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "libxau@1.0.12-r0", "libxdmcp@1.1.5-r1", "musl@1.2.5-r23" ], "Layer": { "DiffID": "sha256:5519239b187cd3709c07332d1796e87305684dbc91e05de8de1682602b6c3118" }, "Digest": "sha1:61b06f883e8f8d2d8ee360e4dac04ac037fcca13", "InstalledFiles": [ "usr/lib/libxcb-composite.so.0", "usr/lib/libxcb-composite.so.0.0.0", "usr/lib/libxcb-damage.so.0", "usr/lib/libxcb-damage.so.0.0.0", "usr/lib/libxcb-dbe.so.0", "usr/lib/libxcb-dbe.so.0.0.0", "usr/lib/libxcb-dpms.so.0", "usr/lib/libxcb-dpms.so.0.0.0", "usr/lib/libxcb-dri2.so.0", "usr/lib/libxcb-dri2.so.0.0.0", "usr/lib/libxcb-dri3.so.0", "usr/lib/libxcb-dri3.so.0.1.0", "usr/lib/libxcb-glx.so.0", "usr/lib/libxcb-glx.so.0.0.0", "usr/lib/libxcb-present.so.0", "usr/lib/libxcb-present.so.0.0.0", "usr/lib/libxcb-randr.so.0", "usr/lib/libxcb-randr.so.0.1.0", "usr/lib/libxcb-record.so.0", "usr/lib/libxcb-record.so.0.0.0", "usr/lib/libxcb-render.so.0", "usr/lib/libxcb-render.so.0.0.0", "usr/lib/libxcb-res.so.0", "usr/lib/libxcb-res.so.0.0.0", "usr/lib/libxcb-screensaver.so.0", "usr/lib/libxcb-screensaver.so.0.0.0", "usr/lib/libxcb-shape.so.0", "usr/lib/libxcb-shape.so.0.0.0", "usr/lib/libxcb-shm.so.0", "usr/lib/libxcb-shm.so.0.0.0", "usr/lib/libxcb-sync.so.1", "usr/lib/libxcb-sync.so.1.0.0", "usr/lib/libxcb-xf86dri.so.0", "usr/lib/libxcb-xf86dri.so.0.0.0", "usr/lib/libxcb-xfixes.so.0", "usr/lib/libxcb-xfixes.so.0.0.0", "usr/lib/libxcb-xinerama.so.0", "usr/lib/libxcb-xinerama.so.0.0.0", "usr/lib/libxcb-xinput.so.0", "usr/lib/libxcb-xinput.so.0.1.0", "usr/lib/libxcb-xkb.so.1", "usr/lib/libxcb-xkb.so.1.0.0", "usr/lib/libxcb-xtest.so.0", "usr/lib/libxcb-xtest.so.0.0.0", "usr/lib/libxcb-xv.so.0", "usr/lib/libxcb-xv.so.0.0.0", "usr/lib/libxcb-xvmc.so.0", "usr/lib/libxcb-xvmc.so.0.0.0", "usr/lib/libxcb.so.1", "usr/lib/libxcb.so.1.1.0" ], "AnalyzedBy": "apk" }, { "ID": "libxdmcp@1.1.5-r1", "Name": "libxdmcp", "Identifier": { "PURL": "pkg:apk/alpine/libxdmcp@1.1.5-r1?arch=x86_64\u0026distro=3.23.4", "UID": "4ce7671300ab208e" }, "Version": "1.1.5-r1", "Arch": "x86_64", "SrcName": "libxdmcp", "SrcVersion": "1.1.5-r1", "Licenses": [ "MIT" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "libbsd@0.12.2-r0", "musl@1.2.5-r23" ], "Layer": { "DiffID": "sha256:5519239b187cd3709c07332d1796e87305684dbc91e05de8de1682602b6c3118" }, "Digest": "sha1:99a24c0fa12282b5ef89a6e732a8d494b7696d9d", "InstalledFiles": [ "usr/lib/libXdmcp.so.6", "usr/lib/libXdmcp.so.6.0.0" ], "AnalyzedBy": "apk" }, { "ID": "libxext@1.3.6-r2", "Name": "libxext", "Identifier": { "PURL": "pkg:apk/alpine/libxext@1.3.6-r2?arch=x86_64\u0026distro=3.23.4", "UID": "6995b5d26ca62497" }, "Version": "1.3.6-r2", "Arch": "x86_64", "SrcName": "libxext", "SrcVersion": "1.3.6-r2", "Licenses": [ "MIT" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "libx11@1.8.12-r1", "musl@1.2.5-r23" ], "Layer": { "DiffID": "sha256:5519239b187cd3709c07332d1796e87305684dbc91e05de8de1682602b6c3118" }, "Digest": "sha1:92fb4f12c2170403d6a48c7485ecaee40c84bee2", "InstalledFiles": [ "usr/lib/libXext.so.6", "usr/lib/libXext.so.6.4.0" ], "AnalyzedBy": "apk" }, { "ID": "libxml2@2.13.9-r0", "Name": "libxml2", "Identifier": { "PURL": "pkg:apk/alpine/libxml2@2.13.9-r0?arch=x86_64\u0026distro=3.23.4", "UID": "a4c496351a710b02" }, "Version": "2.13.9-r0", "Arch": "x86_64", "SrcName": "libxml2", "SrcVersion": "2.13.9-r0", "Licenses": [ "MIT" ], "Maintainer": "Carlo Landmeter \u003cclandmeter@alpinelinux.org\u003e", "DependsOn": [ "musl@1.2.5-r23", "xz-libs@5.8.3-r0", "zlib@1.3.2-r0" ], "Layer": { "DiffID": "sha256:5519239b187cd3709c07332d1796e87305684dbc91e05de8de1682602b6c3118" }, "Digest": "sha1:9fb56eb6e62b7b6658a8abe14cded8d87a47ebc7", "InstalledFiles": [ "usr/lib/libxml2.so.2", "usr/lib/libxml2.so.2.13.9" ], "AnalyzedBy": "apk" }, { "ID": "libxpm@3.5.19-r0", "Name": "libxpm", "Identifier": { "PURL": "pkg:apk/alpine/libxpm@3.5.19-r0?arch=x86_64\u0026distro=3.23.4", "UID": "9eb303ee5fb7801a" }, "Version": "3.5.19-r0", "Arch": "x86_64", "SrcName": "libxpm", "SrcVersion": "3.5.19-r0", "Licenses": [ "X-11" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "libx11@1.8.12-r1", "libxext@1.3.6-r2", "libxt@1.3.1-r0", "musl@1.2.5-r23" ], "Layer": { "DiffID": "sha256:5519239b187cd3709c07332d1796e87305684dbc91e05de8de1682602b6c3118" }, "Digest": "sha1:0c1b2467462bd516e1f3b514854ccca30e0e59c0", "InstalledFiles": [ "usr/bin/cxpm", "usr/bin/sxpm", "usr/lib/libXpm.so.4", "usr/lib/libXpm.so.4.11.0" ], "AnalyzedBy": "apk" }, { "ID": "libxslt@1.1.43-r3", "Name": "libxslt", "Identifier": { "PURL": "pkg:apk/alpine/libxslt@1.1.43-r3?arch=x86_64\u0026distro=3.23.4", "UID": "f615d2a6378e26e8" }, "Version": "1.1.43-r3", "Arch": "x86_64", "SrcName": "libxslt", "SrcVersion": "1.1.43-r3", "Licenses": [ "X-11" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "libxml2@2.13.9-r0", "musl@1.2.5-r23" ], "Layer": { "DiffID": "sha256:5519239b187cd3709c07332d1796e87305684dbc91e05de8de1682602b6c3118" }, "Digest": "sha1:7d73182371fbf2141e137329e5432b94551bdd1b", "InstalledFiles": [ "usr/bin/xsltproc", "usr/lib/libexslt.so.0", "usr/lib/libexslt.so.0.8.24", "usr/lib/libxslt.so.1", "usr/lib/libxslt.so.1.1.43" ], "AnalyzedBy": "apk" }, { "ID": "libxt@1.3.1-r0", "Name": "libxt", "Identifier": { "PURL": "pkg:apk/alpine/libxt@1.3.1-r0?arch=x86_64\u0026distro=3.23.4", "UID": "3def3ac035093072" }, "Version": "1.3.1-r0", "Arch": "x86_64", "SrcName": "libxt", "SrcVersion": "1.3.1-r0", "Licenses": [ "MIT" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "libice@1.1.2-r0", "libsm@1.2.6-r0", "libx11@1.8.12-r1", "musl@1.2.5-r23" ], "Layer": { "DiffID": "sha256:5519239b187cd3709c07332d1796e87305684dbc91e05de8de1682602b6c3118" }, "Digest": "sha1:1cffd892c392dcaac9ad017c999f9e268b5f8ee1", "InstalledFiles": [ "usr/lib/libXt.so.6", "usr/lib/libXt.so.6.0.0" ], "AnalyzedBy": "apk" }, { "ID": "libyuv@0.0.1887.20251502-r1", "Name": "libyuv", "Identifier": { "PURL": "pkg:apk/alpine/libyuv@0.0.1887.20251502-r1?arch=x86_64\u0026distro=3.23.4", "UID": "85b1ea36bf9f477d" }, "Version": "0.0.1887.20251502-r1", "Arch": "x86_64", "SrcName": "libyuv", "SrcVersion": "0.0.1887.20251502-r1", "Licenses": [ "BSD-3-Clause" ], "Maintainer": "Andy Postnikov \u003capostnikov@gmail.com\u003e", "DependsOn": [ "libgcc@15.2.0-r2", "libjpeg-turbo@3.1.2-r0", "libstdc++@15.2.0-r2", "musl@1.2.5-r23" ], "Layer": { "DiffID": "sha256:5519239b187cd3709c07332d1796e87305684dbc91e05de8de1682602b6c3118" }, "Digest": "sha1:8335fd57f5a479534322e6ac74968fdc7564d8d0", "InstalledFiles": [ "usr/bin/yuvconvert", "usr/lib/libyuv.so" ], "AnalyzedBy": "apk" }, { "ID": "musl@1.2.5-r23", "Name": "musl", "Identifier": { "PURL": "pkg:apk/alpine/musl@1.2.5-r23?arch=x86_64\u0026distro=3.23.4", "UID": "dca30b3fd6708a32" }, "Version": "1.2.5-r23", "Arch": "x86_64", "SrcName": "musl", "SrcVersion": "1.2.5-r23", "Licenses": [ "MIT" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "Layer": { "DiffID": "sha256:29df493baa13de438d6d2ece3a8333032e0b7b9b9d8cce4ee82194da255f61e1" }, "Digest": "sha1:1b6c50426d3c0656e9c5a567a5a59601c7f4307a", "InstalledFiles": [ "lib/ld-musl-x86_64.so.1", "lib/libc.musl-x86_64.so.1" ], "AnalyzedBy": "apk" }, { "ID": "musl-utils@1.2.5-r23", "Name": "musl-utils", "Identifier": { "PURL": "pkg:apk/alpine/musl-utils@1.2.5-r23?arch=x86_64\u0026distro=3.23.4", "UID": "ffcf7198a9776c5f" }, "Version": "1.2.5-r23", "Arch": "x86_64", "SrcName": "musl", "SrcVersion": "1.2.5-r23", "Licenses": [ "MIT", "BSD-2-Clause", "GPL-2.0-or-later" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "musl@1.2.5-r23", "scanelf@1.3.8-r2" ], "Layer": { "DiffID": "sha256:29df493baa13de438d6d2ece3a8333032e0b7b9b9d8cce4ee82194da255f61e1" }, "Digest": "sha1:92fdbe96d25f13fe3a3d297ada56e4fb907aacec", "InstalledFiles": [ "sbin/ldconfig", "usr/bin/getconf", "usr/bin/getent", "usr/bin/iconv", "usr/bin/ldd" ], "AnalyzedBy": "apk" }, { "ID": "ncurses-terminfo-base@6.5_p20251123-r0", "Name": "ncurses-terminfo-base", "Identifier": { "PURL": "pkg:apk/alpine/ncurses-terminfo-base@6.5_p20251123-r0?arch=x86_64\u0026distro=3.23.4", "UID": "5acf10991828fa7a" }, "Version": "6.5_p20251123-r0", "Arch": "x86_64", "SrcName": "ncurses", "SrcVersion": "6.5_p20251123-r0", "Licenses": [ "X-11" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "Layer": { "DiffID": "sha256:5519239b187cd3709c07332d1796e87305684dbc91e05de8de1682602b6c3118" }, "Digest": "sha1:57bd1d8124ec957eefea2314bdf45b0ed1068cee", "InstalledFiles": [ "etc/terminfo/a/alacritty", "etc/terminfo/a/ansi", "etc/terminfo/d/dumb", "etc/terminfo/g/gnome", "etc/terminfo/g/gnome-256color", "etc/terminfo/k/konsole", "etc/terminfo/k/konsole-256color", "etc/terminfo/k/konsole-linux", "etc/terminfo/l/linux", "etc/terminfo/p/putty", "etc/terminfo/p/putty-256color", "etc/terminfo/r/rxvt", "etc/terminfo/r/rxvt-256color", "etc/terminfo/s/screen", "etc/terminfo/s/screen-256color", "etc/terminfo/s/st-0.6", "etc/terminfo/s/st-0.7", "etc/terminfo/s/st-0.8", "etc/terminfo/s/st-0.8.5", "etc/terminfo/s/st-16color", "etc/terminfo/s/st-256color", "etc/terminfo/s/st-direct", "etc/terminfo/s/sun", "etc/terminfo/t/terminator", "etc/terminfo/t/terminology", "etc/terminfo/t/terminology-0.6.1", "etc/terminfo/t/terminology-1.0.0", "etc/terminfo/t/terminology-1.8.1", "etc/terminfo/t/tmux", "etc/terminfo/t/tmux-256color", "etc/terminfo/v/vt100", "etc/terminfo/v/vt102", "etc/terminfo/v/vt200", "etc/terminfo/v/vt220", "etc/terminfo/v/vt52", "etc/terminfo/v/vte", "etc/terminfo/v/vte-256color", "etc/terminfo/x/xterm", "etc/terminfo/x/xterm-256color", "etc/terminfo/x/xterm-color", "etc/terminfo/x/xterm-xfree86" ], "AnalyzedBy": "apk" }, { "ID": "nghttp2-libs@1.69.0-r0", "Name": "nghttp2-libs", "Identifier": { "PURL": "pkg:apk/alpine/nghttp2-libs@1.69.0-r0?arch=x86_64\u0026distro=3.23.4", "UID": "1d18d06a4faec59f" }, "Version": "1.69.0-r0", "Arch": "x86_64", "SrcName": "nghttp2", "SrcVersion": "1.69.0-r0", "Licenses": [ "MIT" ], "Maintainer": "Francesco Colista \u003cfcolista@alpinelinux.org\u003e", "DependsOn": [ "musl@1.2.5-r23" ], "Layer": { "DiffID": "sha256:5519239b187cd3709c07332d1796e87305684dbc91e05de8de1682602b6c3118" }, "Digest": "sha1:6b8651227dd3f9155ded30ddc171757a7f5b91a5", "InstalledFiles": [ "usr/lib/libnghttp2.so.14", "usr/lib/libnghttp2.so.14.29.4" ], "AnalyzedBy": "apk" }, { "ID": "nginx@1.31.1-r1", "Name": "nginx", "Identifier": { "PURL": "pkg:apk/alpine/nginx@1.31.1-r1?arch=x86_64\u0026distro=3.23.4", "UID": "4c5d476de8066811" }, "Version": "1.31.1-r1", "Arch": "x86_64", "SrcName": "nginx", "SrcVersion": "1.31.1-r1", "Licenses": [ "2-clause", "BSD-3-Clause", "license" ], "Maintainer": "NGINX Packaging \u003cnginx-packaging@f5.com\u003e", "DependsOn": [ "busybox-binsh@1.37.0-r30", "libcrypto3@3.5.6-r0", "libssl3@3.5.6-r0", "musl@1.2.5-r23", "pcre2@10.47-r0", "zlib@1.3.2-r0" ], "Layer": { "DiffID": "sha256:b910427bd94b3f8656a5557f6e4f484de3b83065ed7699fbbbeadcc313fbc2d9" }, "Digest": "sha1:c797ed8613e7525939d2df7648f99d7acbc6fc53", "InstalledFiles": [ "etc/init.d/nginx", "etc/init.d/nginx-debug", "etc/logrotate.d/nginx", "etc/nginx/fastcgi.conf", "etc/nginx/fastcgi_params", "etc/nginx/mime.types", "etc/nginx/modules", "etc/nginx/nginx.conf", "etc/nginx/scgi_params", "etc/nginx/uwsgi_params", "etc/nginx/conf.d/default.conf", "usr/sbin/nginx", "usr/sbin/nginx-debug", "usr/share/licenses/nginx/COPYRIGHT", "usr/share/man/man8/nginx.8.gz", "usr/share/nginx/html/50x.html", "usr/share/nginx/html/index.html" ], "AnalyzedBy": "apk" }, { "ID": "nginx-module-acme@1.31.1.0.4.1-r1", "Name": "nginx-module-acme", "Identifier": { "PURL": "pkg:apk/alpine/nginx-module-acme@1.31.1.0.4.1-r1?arch=x86_64\u0026distro=3.23.4", "UID": "6624db88385db961" }, "Version": "1.31.1.0.4.1-r1", "Arch": "x86_64", "SrcName": "nginx-module-acme", "SrcVersion": "1.31.1.0.4.1-r1", "Licenses": [ "2-clause", "BSD-3-Clause", "license" ], "Maintainer": "NGINX Packaging \u003cnginx-packaging@f5.com\u003e", "DependsOn": [ "busybox-binsh@1.37.0-r30", "libgcc@15.2.0-r2", "musl@1.2.5-r23", "nginx@1.31.1-r1" ], "Layer": { "DiffID": "sha256:5519239b187cd3709c07332d1796e87305684dbc91e05de8de1682602b6c3118" }, "Digest": "sha1:21de11aa54b8c03aad1270acc467eda0c60d2045", "InstalledFiles": [ "usr/lib/nginx/modules/ngx_http_acme_module-debug.so", "usr/lib/nginx/modules/ngx_http_acme_module.so", "usr/share/licenses/nginx-module-acme/COPYRIGHT" ], "AnalyzedBy": "apk" }, { "ID": "nginx-module-geoip@1.31.1-r1", "Name": "nginx-module-geoip", "Identifier": { "PURL": "pkg:apk/alpine/nginx-module-geoip@1.31.1-r1?arch=x86_64\u0026distro=3.23.4", "UID": "2d04d84a8666eb1e" }, "Version": "1.31.1-r1", "Arch": "x86_64", "SrcName": "nginx-module-geoip", "SrcVersion": "1.31.1-r1", "Licenses": [ "2-clause", "BSD-3-Clause", "license" ], "Maintainer": "NGINX Packaging \u003cnginx-packaging@f5.com\u003e", "DependsOn": [ "busybox-binsh@1.37.0-r30", "geoip@1.6.12-r6", "musl@1.2.5-r23", "nginx@1.31.1-r1" ], "Layer": { "DiffID": "sha256:5519239b187cd3709c07332d1796e87305684dbc91e05de8de1682602b6c3118" }, "Digest": "sha1:53ae6a12bb720152f87f7bb1479a5ff8c8374083", "InstalledFiles": [ "usr/lib/nginx/modules/ngx_http_geoip_module-debug.so", "usr/lib/nginx/modules/ngx_http_geoip_module.so", "usr/lib/nginx/modules/ngx_stream_geoip_module-debug.so", "usr/lib/nginx/modules/ngx_stream_geoip_module.so", "usr/share/licenses/nginx-module-geoip/COPYRIGHT" ], "AnalyzedBy": "apk" }, { "ID": "nginx-module-image-filter@1.31.1-r1", "Name": "nginx-module-image-filter", "Identifier": { "PURL": "pkg:apk/alpine/nginx-module-image-filter@1.31.1-r1?arch=x86_64\u0026distro=3.23.4", "UID": "896fb8d7f3e195f2" }, "Version": "1.31.1-r1", "Arch": "x86_64", "SrcName": "nginx-module-image-filter", "SrcVersion": "1.31.1-r1", "Licenses": [ "2-clause", "BSD-3-Clause", "license" ], "Maintainer": "NGINX Packaging \u003cnginx-packaging@f5.com\u003e", "DependsOn": [ "busybox-binsh@1.37.0-r30", "libgd@2.3.3-r10", "musl@1.2.5-r23", "nginx@1.31.1-r1" ], "Layer": { "DiffID": "sha256:5519239b187cd3709c07332d1796e87305684dbc91e05de8de1682602b6c3118" }, "Digest": "sha1:64542ac68e327d823986b23a63c6dedebcbde25a", "InstalledFiles": [ "usr/lib/nginx/modules/ngx_http_image_filter_module-debug.so", "usr/lib/nginx/modules/ngx_http_image_filter_module.so", "usr/share/licenses/nginx-module-image-filter/COPYRIGHT" ], "AnalyzedBy": "apk" }, { "ID": "nginx-module-njs@1.31.1.0.9.9-r1", "Name": "nginx-module-njs", "Identifier": { "PURL": "pkg:apk/alpine/nginx-module-njs@1.31.1.0.9.9-r1?arch=x86_64\u0026distro=3.23.4", "UID": "fe8d570b8f88195b" }, "Version": "1.31.1.0.9.9-r1", "Arch": "x86_64", "SrcName": "nginx-module-njs", "SrcVersion": "1.31.1.0.9.9-r1", "Licenses": [ "2-clause", "BSD-3-Clause", "license" ], "Maintainer": "NGINX Packaging \u003cnginx-packaging@f5.com\u003e", "DependsOn": [ "busybox-binsh@1.37.0-r30", "libcrypto3@3.5.6-r0", "libedit@20251016.3.1-r0", "libxml2@2.13.9-r0", "musl@1.2.5-r23", "nginx@1.31.1-r1", "pcre2@10.47-r0", "zlib@1.3.2-r0" ], "Layer": { "DiffID": "sha256:5519239b187cd3709c07332d1796e87305684dbc91e05de8de1682602b6c3118" }, "Digest": "sha1:1d67699f0c59e5216daad7161b9f7f07bed02041", "InstalledFiles": [ "usr/bin/njs", "usr/lib/nginx/modules/ngx_http_js_module-debug.so", "usr/lib/nginx/modules/ngx_http_js_module.so", "usr/lib/nginx/modules/ngx_stream_js_module-debug.so", "usr/lib/nginx/modules/ngx_stream_js_module.so", "usr/share/doc/nginx-module-njs/CHANGES", "usr/share/licenses/nginx-module-njs/COPYRIGHT" ], "AnalyzedBy": "apk" }, { "ID": "nginx-module-xslt@1.31.1-r1", "Name": "nginx-module-xslt", "Identifier": { "PURL": "pkg:apk/alpine/nginx-module-xslt@1.31.1-r1?arch=x86_64\u0026distro=3.23.4", "UID": "e9be3b5c5690d9e5" }, "Version": "1.31.1-r1", "Arch": "x86_64", "SrcName": "nginx-module-xslt", "SrcVersion": "1.31.1-r1", "Licenses": [ "2-clause", "BSD-3-Clause", "license" ], "Maintainer": "NGINX Packaging \u003cnginx-packaging@f5.com\u003e", "DependsOn": [ "busybox-binsh@1.37.0-r30", "libxml2@2.13.9-r0", "libxslt@1.1.43-r3", "musl@1.2.5-r23", "nginx@1.31.1-r1" ], "Layer": { "DiffID": "sha256:5519239b187cd3709c07332d1796e87305684dbc91e05de8de1682602b6c3118" }, "Digest": "sha1:c051bd186e5fd2e5b42e1d7081e49d3a03effb4b", "InstalledFiles": [ "usr/lib/nginx/modules/ngx_http_xslt_filter_module-debug.so", "usr/lib/nginx/modules/ngx_http_xslt_filter_module.so", "usr/share/licenses/nginx-module-xslt/COPYRIGHT" ], "AnalyzedBy": "apk" }, { "ID": "pcre2@10.47-r0", "Name": "pcre2", "Identifier": { "PURL": "pkg:apk/alpine/pcre2@10.47-r0?arch=x86_64\u0026distro=3.23.4", "UID": "75fb7d2fe836dfdc" }, "Version": "10.47-r0", "Arch": "x86_64", "SrcName": "pcre2", "SrcVersion": "10.47-r0", "Licenses": [ "BSD-3-Clause" ], "Maintainer": "Jakub Jirutka \u003cjakub@jirutka.cz\u003e", "DependsOn": [ "musl@1.2.5-r23" ], "Layer": { "DiffID": "sha256:b910427bd94b3f8656a5557f6e4f484de3b83065ed7699fbbbeadcc313fbc2d9" }, "Digest": "sha1:549059958151627bb0f5469bded945988b1bc24b", "InstalledFiles": [ "usr/lib/libpcre2-8.so.0", "usr/lib/libpcre2-8.so.0.15.0", "usr/lib/libpcre2-posix.so.3", "usr/lib/libpcre2-posix.so.3.0.7" ], "AnalyzedBy": "apk" }, { "ID": "scanelf@1.3.8-r2", "Name": "scanelf", "Identifier": { "PURL": "pkg:apk/alpine/scanelf@1.3.8-r2?arch=x86_64\u0026distro=3.23.4", "UID": "4efd612ed6f16dca" }, "Version": "1.3.8-r2", "Arch": "x86_64", "SrcName": "pax-utils", "SrcVersion": "1.3.8-r2", "Licenses": [ "GPL-2.0-only" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "musl@1.2.5-r23" ], "Layer": { "DiffID": "sha256:29df493baa13de438d6d2ece3a8333032e0b7b9b9d8cce4ee82194da255f61e1" }, "Digest": "sha1:6ea36dd44ef9f6364f0cdfabe09ea15d2fdbe229", "InstalledFiles": [ "usr/bin/scanelf" ], "AnalyzedBy": "apk" }, { "ID": "ssl_client@1.37.0-r30", "Name": "ssl_client", "Identifier": { "PURL": "pkg:apk/alpine/ssl_client@1.37.0-r30?arch=x86_64\u0026distro=3.23.4", "UID": "f1acb8f2a8f94f51" }, "Version": "1.37.0-r30", "Arch": "x86_64", "SrcName": "busybox", "SrcVersion": "1.37.0-r30", "Licenses": [ "GPL-2.0-only" ], "Maintainer": "Sören Tempel \u003csoeren+alpine@soeren-tempel.net\u003e", "DependsOn": [ "libcrypto3@3.5.6-r0", "libssl3@3.5.6-r0", "musl@1.2.5-r23" ], "Layer": { "DiffID": "sha256:29df493baa13de438d6d2ece3a8333032e0b7b9b9d8cce4ee82194da255f61e1" }, "Digest": "sha1:5b6ec0939cfc9be47d9677a3152c547cc18b5edd", "InstalledFiles": [ "usr/bin/ssl_client" ], "AnalyzedBy": "apk" }, { "ID": "tiff@4.7.1-r0", "Name": "tiff", "Identifier": { "PURL": "pkg:apk/alpine/tiff@4.7.1-r0?arch=x86_64\u0026distro=3.23.4", "UID": "551adcb8b716f210" }, "Version": "4.7.1-r0", "Arch": "x86_64", "SrcName": "tiff", "SrcVersion": "4.7.1-r0", "Licenses": [ "libtiff" ], "Maintainer": "Michael Mason \u003cms13sp@gmail.com\u003e", "DependsOn": [ "libjpeg-turbo@3.1.2-r0", "libwebp@1.6.0-r0", "musl@1.2.5-r23", "zlib@1.3.2-r0", "zstd-libs@1.5.7-r2" ], "Layer": { "DiffID": "sha256:5519239b187cd3709c07332d1796e87305684dbc91e05de8de1682602b6c3118" }, "Digest": "sha1:b92c3394d281f51345a9375da14f347b6c1619a6", "InstalledFiles": [ "usr/lib/libtiff.so.6", "usr/lib/libtiff.so.6.2.0" ], "AnalyzedBy": "apk" }, { "ID": "tzdata@2026b-r0", "Name": "tzdata", "Identifier": { "PURL": "pkg:apk/alpine/tzdata@2026b-r0?arch=x86_64\u0026distro=3.23.4", "UID": "86f2dfb9a4acee39" }, "Version": "2026b-r0", "Arch": "x86_64", "SrcName": "tzdata", "SrcVersion": "2026b-r0", "Licenses": [ "Public-Domain" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "Layer": { "DiffID": "sha256:b910427bd94b3f8656a5557f6e4f484de3b83065ed7699fbbbeadcc313fbc2d9" }, "Digest": "sha1:2624b59cfb8182dfb3de19043c6867cd1b3e1779", "InstalledFiles": [ "usr/share/zoneinfo/CET", "usr/share/zoneinfo/CST6CDT", "usr/share/zoneinfo/Cuba", "usr/share/zoneinfo/EET", "usr/share/zoneinfo/EST", "usr/share/zoneinfo/EST5EDT", "usr/share/zoneinfo/Egypt", "usr/share/zoneinfo/Eire", "usr/share/zoneinfo/Factory", "usr/share/zoneinfo/GB", "usr/share/zoneinfo/GB-Eire", "usr/share/zoneinfo/GMT", "usr/share/zoneinfo/GMT+0", "usr/share/zoneinfo/GMT-0", "usr/share/zoneinfo/GMT0", "usr/share/zoneinfo/Greenwich", "usr/share/zoneinfo/HST", "usr/share/zoneinfo/Hongkong", "usr/share/zoneinfo/Iceland", "usr/share/zoneinfo/Iran", "usr/share/zoneinfo/Israel", "usr/share/zoneinfo/Jamaica", "usr/share/zoneinfo/Japan", "usr/share/zoneinfo/Kwajalein", "usr/share/zoneinfo/Libya", "usr/share/zoneinfo/MET", "usr/share/zoneinfo/MST", "usr/share/zoneinfo/MST7MDT", "usr/share/zoneinfo/NZ", "usr/share/zoneinfo/NZ-CHAT", "usr/share/zoneinfo/Navajo", "usr/share/zoneinfo/PRC", "usr/share/zoneinfo/PST8PDT", "usr/share/zoneinfo/Poland", "usr/share/zoneinfo/Portugal", "usr/share/zoneinfo/ROC", "usr/share/zoneinfo/ROK", "usr/share/zoneinfo/Singapore", "usr/share/zoneinfo/Turkey", "usr/share/zoneinfo/UCT", "usr/share/zoneinfo/UTC", "usr/share/zoneinfo/Universal", "usr/share/zoneinfo/W-SU", "usr/share/zoneinfo/WET", "usr/share/zoneinfo/Zulu", "usr/share/zoneinfo/iso3166.tab", "usr/share/zoneinfo/leap-seconds.list", "usr/share/zoneinfo/posixrules", "usr/share/zoneinfo/zone.tab", "usr/share/zoneinfo/zone1970.tab", "usr/share/zoneinfo/Africa/Abidjan", "usr/share/zoneinfo/Africa/Accra", "usr/share/zoneinfo/Africa/Addis_Ababa", "usr/share/zoneinfo/Africa/Algiers", "usr/share/zoneinfo/Africa/Asmara", "usr/share/zoneinfo/Africa/Asmera", "usr/share/zoneinfo/Africa/Bamako", "usr/share/zoneinfo/Africa/Bangui", "usr/share/zoneinfo/Africa/Banjul", "usr/share/zoneinfo/Africa/Bissau", "usr/share/zoneinfo/Africa/Blantyre", "usr/share/zoneinfo/Africa/Brazzaville", "usr/share/zoneinfo/Africa/Bujumbura", "usr/share/zoneinfo/Africa/Cairo", "usr/share/zoneinfo/Africa/Casablanca", "usr/share/zoneinfo/Africa/Ceuta", "usr/share/zoneinfo/Africa/Conakry", "usr/share/zoneinfo/Africa/Dakar", "usr/share/zoneinfo/Africa/Dar_es_Salaam", "usr/share/zoneinfo/Africa/Djibouti", "usr/share/zoneinfo/Africa/Douala", "usr/share/zoneinfo/Africa/El_Aaiun", "usr/share/zoneinfo/Africa/Freetown", "usr/share/zoneinfo/Africa/Gaborone", "usr/share/zoneinfo/Africa/Harare", "usr/share/zoneinfo/Africa/Johannesburg", "usr/share/zoneinfo/Africa/Juba", "usr/share/zoneinfo/Africa/Kampala", "usr/share/zoneinfo/Africa/Khartoum", "usr/share/zoneinfo/Africa/Kigali", "usr/share/zoneinfo/Africa/Kinshasa", "usr/share/zoneinfo/Africa/Lagos", "usr/share/zoneinfo/Africa/Libreville", "usr/share/zoneinfo/Africa/Lome", "usr/share/zoneinfo/Africa/Luanda", "usr/share/zoneinfo/Africa/Lubumbashi", "usr/share/zoneinfo/Africa/Lusaka", "usr/share/zoneinfo/Africa/Malabo", "usr/share/zoneinfo/Africa/Maputo", "usr/share/zoneinfo/Africa/Maseru", "usr/share/zoneinfo/Africa/Mbabane", "usr/share/zoneinfo/Africa/Mogadishu", "usr/share/zoneinfo/Africa/Monrovia", "usr/share/zoneinfo/Africa/Nairobi", "usr/share/zoneinfo/Africa/Ndjamena", "usr/share/zoneinfo/Africa/Niamey", "usr/share/zoneinfo/Africa/Nouakchott", "usr/share/zoneinfo/Africa/Ouagadougou", "usr/share/zoneinfo/Africa/Porto-Novo", "usr/share/zoneinfo/Africa/Sao_Tome", "usr/share/zoneinfo/Africa/Timbuktu", "usr/share/zoneinfo/Africa/Tripoli", "usr/share/zoneinfo/Africa/Tunis", "usr/share/zoneinfo/Africa/Windhoek", "usr/share/zoneinfo/America/Adak", "usr/share/zoneinfo/America/Anchorage", "usr/share/zoneinfo/America/Anguilla", "usr/share/zoneinfo/America/Antigua", "usr/share/zoneinfo/America/Araguaina", "usr/share/zoneinfo/America/Aruba", "usr/share/zoneinfo/America/Asuncion", "usr/share/zoneinfo/America/Atikokan", "usr/share/zoneinfo/America/Atka", "usr/share/zoneinfo/America/Bahia", "usr/share/zoneinfo/America/Bahia_Banderas", "usr/share/zoneinfo/America/Barbados", "usr/share/zoneinfo/America/Belem", "usr/share/zoneinfo/America/Belize", "usr/share/zoneinfo/America/Blanc-Sablon", "usr/share/zoneinfo/America/Boa_Vista", "usr/share/zoneinfo/America/Bogota", "usr/share/zoneinfo/America/Boise", "usr/share/zoneinfo/America/Buenos_Aires", "usr/share/zoneinfo/America/Cambridge_Bay", "usr/share/zoneinfo/America/Campo_Grande", "usr/share/zoneinfo/America/Cancun", "usr/share/zoneinfo/America/Caracas", "usr/share/zoneinfo/America/Catamarca", "usr/share/zoneinfo/America/Cayenne", "usr/share/zoneinfo/America/Cayman", "usr/share/zoneinfo/America/Chicago", "usr/share/zoneinfo/America/Chihuahua", "usr/share/zoneinfo/America/Ciudad_Juarez", "usr/share/zoneinfo/America/Coral_Harbour", "usr/share/zoneinfo/America/Cordoba", "usr/share/zoneinfo/America/Costa_Rica", "usr/share/zoneinfo/America/Coyhaique", "usr/share/zoneinfo/America/Creston", "usr/share/zoneinfo/America/Cuiaba", "usr/share/zoneinfo/America/Curacao", "usr/share/zoneinfo/America/Danmarkshavn", "usr/share/zoneinfo/America/Dawson", "usr/share/zoneinfo/America/Dawson_Creek", "usr/share/zoneinfo/America/Denver", "usr/share/zoneinfo/America/Detroit", "usr/share/zoneinfo/America/Dominica", "usr/share/zoneinfo/America/Edmonton", "usr/share/zoneinfo/America/Eirunepe", "usr/share/zoneinfo/America/El_Salvador", "usr/share/zoneinfo/America/Ensenada", "usr/share/zoneinfo/America/Fort_Nelson", "usr/share/zoneinfo/America/Fort_Wayne", "usr/share/zoneinfo/America/Fortaleza", "usr/share/zoneinfo/America/Glace_Bay", "usr/share/zoneinfo/America/Godthab", "usr/share/zoneinfo/America/Goose_Bay", "usr/share/zoneinfo/America/Grand_Turk", "usr/share/zoneinfo/America/Grenada", "usr/share/zoneinfo/America/Guadeloupe", "usr/share/zoneinfo/America/Guatemala", "usr/share/zoneinfo/America/Guayaquil", "usr/share/zoneinfo/America/Guyana", "usr/share/zoneinfo/America/Halifax", "usr/share/zoneinfo/America/Havana", "usr/share/zoneinfo/America/Hermosillo", "usr/share/zoneinfo/America/Indianapolis", "usr/share/zoneinfo/America/Inuvik", "usr/share/zoneinfo/America/Iqaluit", "usr/share/zoneinfo/America/Jamaica", "usr/share/zoneinfo/America/Jujuy", "usr/share/zoneinfo/America/Juneau", "usr/share/zoneinfo/America/Knox_IN", "usr/share/zoneinfo/America/Kralendijk", "usr/share/zoneinfo/America/La_Paz", "usr/share/zoneinfo/America/Lima", "usr/share/zoneinfo/America/Los_Angeles", "usr/share/zoneinfo/America/Louisville", "usr/share/zoneinfo/America/Lower_Princes", "usr/share/zoneinfo/America/Maceio", "usr/share/zoneinfo/America/Managua", "usr/share/zoneinfo/America/Manaus", "usr/share/zoneinfo/America/Marigot", "usr/share/zoneinfo/America/Martinique", "usr/share/zoneinfo/America/Matamoros", "usr/share/zoneinfo/America/Mazatlan", "usr/share/zoneinfo/America/Mendoza", "usr/share/zoneinfo/America/Menominee", "usr/share/zoneinfo/America/Merida", "usr/share/zoneinfo/America/Metlakatla", "usr/share/zoneinfo/America/Mexico_City", "usr/share/zoneinfo/America/Miquelon", "usr/share/zoneinfo/America/Moncton", "usr/share/zoneinfo/America/Monterrey", "usr/share/zoneinfo/America/Montevideo", "usr/share/zoneinfo/America/Montreal", "usr/share/zoneinfo/America/Montserrat", "usr/share/zoneinfo/America/Nassau", "usr/share/zoneinfo/America/New_York", "usr/share/zoneinfo/America/Nipigon", "usr/share/zoneinfo/America/Nome", "usr/share/zoneinfo/America/Noronha", "usr/share/zoneinfo/America/Nuuk", "usr/share/zoneinfo/America/Ojinaga", "usr/share/zoneinfo/America/Panama", "usr/share/zoneinfo/America/Pangnirtung", "usr/share/zoneinfo/America/Paramaribo", "usr/share/zoneinfo/America/Phoenix", "usr/share/zoneinfo/America/Port-au-Prince", "usr/share/zoneinfo/America/Port_of_Spain", "usr/share/zoneinfo/America/Porto_Acre", "usr/share/zoneinfo/America/Porto_Velho", "usr/share/zoneinfo/America/Puerto_Rico", "usr/share/zoneinfo/America/Punta_Arenas", "usr/share/zoneinfo/America/Rainy_River", "usr/share/zoneinfo/America/Rankin_Inlet", "usr/share/zoneinfo/America/Recife", "usr/share/zoneinfo/America/Regina", "usr/share/zoneinfo/America/Resolute", "usr/share/zoneinfo/America/Rio_Branco", "usr/share/zoneinfo/America/Rosario", "usr/share/zoneinfo/America/Santa_Isabel", "usr/share/zoneinfo/America/Santarem", "usr/share/zoneinfo/America/Santiago", "usr/share/zoneinfo/America/Santo_Domingo", "usr/share/zoneinfo/America/Sao_Paulo", "usr/share/zoneinfo/America/Scoresbysund", "usr/share/zoneinfo/America/Shiprock", "usr/share/zoneinfo/America/Sitka", "usr/share/zoneinfo/America/St_Barthelemy", "usr/share/zoneinfo/America/St_Johns", "usr/share/zoneinfo/America/St_Kitts", "usr/share/zoneinfo/America/St_Lucia", "usr/share/zoneinfo/America/St_Thomas", "usr/share/zoneinfo/America/St_Vincent", "usr/share/zoneinfo/America/Swift_Current", "usr/share/zoneinfo/America/Tegucigalpa", "usr/share/zoneinfo/America/Thule", "usr/share/zoneinfo/America/Thunder_Bay", "usr/share/zoneinfo/America/Tijuana", "usr/share/zoneinfo/America/Toronto", "usr/share/zoneinfo/America/Tortola", "usr/share/zoneinfo/America/Vancouver", "usr/share/zoneinfo/America/Virgin", "usr/share/zoneinfo/America/Whitehorse", "usr/share/zoneinfo/America/Winnipeg", "usr/share/zoneinfo/America/Yakutat", "usr/share/zoneinfo/America/Yellowknife", "usr/share/zoneinfo/America/Argentina/Buenos_Aires", "usr/share/zoneinfo/America/Argentina/Catamarca", "usr/share/zoneinfo/America/Argentina/ComodRivadavia", "usr/share/zoneinfo/America/Argentina/Cordoba", "usr/share/zoneinfo/America/Argentina/Jujuy", "usr/share/zoneinfo/America/Argentina/La_Rioja", "usr/share/zoneinfo/America/Argentina/Mendoza", "usr/share/zoneinfo/America/Argentina/Rio_Gallegos", "usr/share/zoneinfo/America/Argentina/Salta", "usr/share/zoneinfo/America/Argentina/San_Juan", "usr/share/zoneinfo/America/Argentina/San_Luis", "usr/share/zoneinfo/America/Argentina/Tucuman", "usr/share/zoneinfo/America/Argentina/Ushuaia", "usr/share/zoneinfo/America/Indiana/Indianapolis", "usr/share/zoneinfo/America/Indiana/Knox", "usr/share/zoneinfo/America/Indiana/Marengo", "usr/share/zoneinfo/America/Indiana/Petersburg", "usr/share/zoneinfo/America/Indiana/Tell_City", "usr/share/zoneinfo/America/Indiana/Vevay", "usr/share/zoneinfo/America/Indiana/Vincennes", "usr/share/zoneinfo/America/Indiana/Winamac", "usr/share/zoneinfo/America/Kentucky/Louisville", "usr/share/zoneinfo/America/Kentucky/Monticello", "usr/share/zoneinfo/America/North_Dakota/Beulah", "usr/share/zoneinfo/America/North_Dakota/Center", "usr/share/zoneinfo/America/North_Dakota/New_Salem", "usr/share/zoneinfo/Antarctica/Casey", "usr/share/zoneinfo/Antarctica/Davis", "usr/share/zoneinfo/Antarctica/DumontDUrville", "usr/share/zoneinfo/Antarctica/Macquarie", "usr/share/zoneinfo/Antarctica/Mawson", "usr/share/zoneinfo/Antarctica/McMurdo", "usr/share/zoneinfo/Antarctica/Palmer", "usr/share/zoneinfo/Antarctica/Rothera", "usr/share/zoneinfo/Antarctica/South_Pole", "usr/share/zoneinfo/Antarctica/Syowa", "usr/share/zoneinfo/Antarctica/Troll", "usr/share/zoneinfo/Antarctica/Vostok", "usr/share/zoneinfo/Arctic/Longyearbyen", "usr/share/zoneinfo/Asia/Aden", "usr/share/zoneinfo/Asia/Almaty", "usr/share/zoneinfo/Asia/Amman", "usr/share/zoneinfo/Asia/Anadyr", "usr/share/zoneinfo/Asia/Aqtau", "usr/share/zoneinfo/Asia/Aqtobe", "usr/share/zoneinfo/Asia/Ashgabat", "usr/share/zoneinfo/Asia/Ashkhabad", "usr/share/zoneinfo/Asia/Atyrau", "usr/share/zoneinfo/Asia/Baghdad", "usr/share/zoneinfo/Asia/Bahrain", "usr/share/zoneinfo/Asia/Baku", "usr/share/zoneinfo/Asia/Bangkok", "usr/share/zoneinfo/Asia/Barnaul", "usr/share/zoneinfo/Asia/Beirut", "usr/share/zoneinfo/Asia/Bishkek", "usr/share/zoneinfo/Asia/Brunei", "usr/share/zoneinfo/Asia/Calcutta", "usr/share/zoneinfo/Asia/Chita", "usr/share/zoneinfo/Asia/Choibalsan", "usr/share/zoneinfo/Asia/Chongqing", "usr/share/zoneinfo/Asia/Chungking", "usr/share/zoneinfo/Asia/Colombo", "usr/share/zoneinfo/Asia/Dacca", "usr/share/zoneinfo/Asia/Damascus", "usr/share/zoneinfo/Asia/Dhaka", "usr/share/zoneinfo/Asia/Dili", "usr/share/zoneinfo/Asia/Dubai", "usr/share/zoneinfo/Asia/Dushanbe", "usr/share/zoneinfo/Asia/Famagusta", "usr/share/zoneinfo/Asia/Gaza", "usr/share/zoneinfo/Asia/Harbin", "usr/share/zoneinfo/Asia/Hebron", "usr/share/zoneinfo/Asia/Ho_Chi_Minh", "usr/share/zoneinfo/Asia/Hong_Kong", "usr/share/zoneinfo/Asia/Hovd", "usr/share/zoneinfo/Asia/Irkutsk", "usr/share/zoneinfo/Asia/Istanbul", "usr/share/zoneinfo/Asia/Jakarta", "usr/share/zoneinfo/Asia/Jayapura", "usr/share/zoneinfo/Asia/Jerusalem", "usr/share/zoneinfo/Asia/Kabul", "usr/share/zoneinfo/Asia/Kamchatka", "usr/share/zoneinfo/Asia/Karachi", "usr/share/zoneinfo/Asia/Kashgar", "usr/share/zoneinfo/Asia/Kathmandu", "usr/share/zoneinfo/Asia/Katmandu", "usr/share/zoneinfo/Asia/Khandyga", "usr/share/zoneinfo/Asia/Kolkata", "usr/share/zoneinfo/Asia/Krasnoyarsk", "usr/share/zoneinfo/Asia/Kuala_Lumpur", "usr/share/zoneinfo/Asia/Kuching", "usr/share/zoneinfo/Asia/Kuwait", "usr/share/zoneinfo/Asia/Macao", "usr/share/zoneinfo/Asia/Macau", "usr/share/zoneinfo/Asia/Magadan", "usr/share/zoneinfo/Asia/Makassar", "usr/share/zoneinfo/Asia/Manila", "usr/share/zoneinfo/Asia/Muscat", "usr/share/zoneinfo/Asia/Nicosia", "usr/share/zoneinfo/Asia/Novokuznetsk", "usr/share/zoneinfo/Asia/Novosibirsk", "usr/share/zoneinfo/Asia/Omsk", "usr/share/zoneinfo/Asia/Oral", "usr/share/zoneinfo/Asia/Phnom_Penh", "usr/share/zoneinfo/Asia/Pontianak", "usr/share/zoneinfo/Asia/Pyongyang", "usr/share/zoneinfo/Asia/Qatar", "usr/share/zoneinfo/Asia/Qostanay", "usr/share/zoneinfo/Asia/Qyzylorda", "usr/share/zoneinfo/Asia/Rangoon", "usr/share/zoneinfo/Asia/Riyadh", "usr/share/zoneinfo/Asia/Saigon", "usr/share/zoneinfo/Asia/Sakhalin", "usr/share/zoneinfo/Asia/Samarkand", "usr/share/zoneinfo/Asia/Seoul", "usr/share/zoneinfo/Asia/Shanghai", "usr/share/zoneinfo/Asia/Singapore", "usr/share/zoneinfo/Asia/Srednekolymsk", "usr/share/zoneinfo/Asia/Taipei", "usr/share/zoneinfo/Asia/Tashkent", "usr/share/zoneinfo/Asia/Tbilisi", "usr/share/zoneinfo/Asia/Tehran", "usr/share/zoneinfo/Asia/Tel_Aviv", "usr/share/zoneinfo/Asia/Thimbu", "usr/share/zoneinfo/Asia/Thimphu", "usr/share/zoneinfo/Asia/Tokyo", "usr/share/zoneinfo/Asia/Tomsk", "usr/share/zoneinfo/Asia/Ujung_Pandang", "usr/share/zoneinfo/Asia/Ulaanbaatar", "usr/share/zoneinfo/Asia/Ulan_Bator", "usr/share/zoneinfo/Asia/Urumqi", "usr/share/zoneinfo/Asia/Ust-Nera", "usr/share/zoneinfo/Asia/Vientiane", "usr/share/zoneinfo/Asia/Vladivostok", "usr/share/zoneinfo/Asia/Yakutsk", "usr/share/zoneinfo/Asia/Yangon", "usr/share/zoneinfo/Asia/Yekaterinburg", "usr/share/zoneinfo/Asia/Yerevan", "usr/share/zoneinfo/Atlantic/Azores", "usr/share/zoneinfo/Atlantic/Bermuda", "usr/share/zoneinfo/Atlantic/Canary", "usr/share/zoneinfo/Atlantic/Cape_Verde", "usr/share/zoneinfo/Atlantic/Faeroe", "usr/share/zoneinfo/Atlantic/Faroe", "usr/share/zoneinfo/Atlantic/Jan_Mayen", "usr/share/zoneinfo/Atlantic/Madeira", "usr/share/zoneinfo/Atlantic/Reykjavik", "usr/share/zoneinfo/Atlantic/South_Georgia", "usr/share/zoneinfo/Atlantic/St_Helena", "usr/share/zoneinfo/Atlantic/Stanley", "usr/share/zoneinfo/Australia/ACT", "usr/share/zoneinfo/Australia/Adelaide", "usr/share/zoneinfo/Australia/Brisbane", "usr/share/zoneinfo/Australia/Broken_Hill", "usr/share/zoneinfo/Australia/Canberra", "usr/share/zoneinfo/Australia/Currie", "usr/share/zoneinfo/Australia/Darwin", "usr/share/zoneinfo/Australia/Eucla", "usr/share/zoneinfo/Australia/Hobart", "usr/share/zoneinfo/Australia/LHI", "usr/share/zoneinfo/Australia/Lindeman", "usr/share/zoneinfo/Australia/Lord_Howe", "usr/share/zoneinfo/Australia/Melbourne", "usr/share/zoneinfo/Australia/NSW", "usr/share/zoneinfo/Australia/North", "usr/share/zoneinfo/Australia/Perth", "usr/share/zoneinfo/Australia/Queensland", "usr/share/zoneinfo/Australia/South", "usr/share/zoneinfo/Australia/Sydney", "usr/share/zoneinfo/Australia/Tasmania", "usr/share/zoneinfo/Australia/Victoria", "usr/share/zoneinfo/Australia/West", "usr/share/zoneinfo/Australia/Yancowinna", "usr/share/zoneinfo/Brazil/Acre", "usr/share/zoneinfo/Brazil/DeNoronha", "usr/share/zoneinfo/Brazil/East", "usr/share/zoneinfo/Brazil/West", "usr/share/zoneinfo/Canada/Atlantic", "usr/share/zoneinfo/Canada/Central", "usr/share/zoneinfo/Canada/Eastern", "usr/share/zoneinfo/Canada/Mountain", "usr/share/zoneinfo/Canada/Newfoundland", "usr/share/zoneinfo/Canada/Pacific", "usr/share/zoneinfo/Canada/Saskatchewan", "usr/share/zoneinfo/Canada/Yukon", "usr/share/zoneinfo/Chile/Continental", "usr/share/zoneinfo/Chile/EasterIsland", "usr/share/zoneinfo/Etc/GMT", "usr/share/zoneinfo/Etc/GMT+0", "usr/share/zoneinfo/Etc/GMT+1", "usr/share/zoneinfo/Etc/GMT+10", "usr/share/zoneinfo/Etc/GMT+11", "usr/share/zoneinfo/Etc/GMT+12", "usr/share/zoneinfo/Etc/GMT+2", "usr/share/zoneinfo/Etc/GMT+3", "usr/share/zoneinfo/Etc/GMT+4", "usr/share/zoneinfo/Etc/GMT+5", "usr/share/zoneinfo/Etc/GMT+6", "usr/share/zoneinfo/Etc/GMT+7", "usr/share/zoneinfo/Etc/GMT+8", "usr/share/zoneinfo/Etc/GMT+9", "usr/share/zoneinfo/Etc/GMT-0", "usr/share/zoneinfo/Etc/GMT-1", "usr/share/zoneinfo/Etc/GMT-10", "usr/share/zoneinfo/Etc/GMT-11", "usr/share/zoneinfo/Etc/GMT-12", "usr/share/zoneinfo/Etc/GMT-13", "usr/share/zoneinfo/Etc/GMT-14", "usr/share/zoneinfo/Etc/GMT-2", "usr/share/zoneinfo/Etc/GMT-3", "usr/share/zoneinfo/Etc/GMT-4", "usr/share/zoneinfo/Etc/GMT-5", "usr/share/zoneinfo/Etc/GMT-6", "usr/share/zoneinfo/Etc/GMT-7", "usr/share/zoneinfo/Etc/GMT-8", "usr/share/zoneinfo/Etc/GMT-9", "usr/share/zoneinfo/Etc/GMT0", "usr/share/zoneinfo/Etc/Greenwich", "usr/share/zoneinfo/Etc/UCT", "usr/share/zoneinfo/Etc/UTC", "usr/share/zoneinfo/Etc/Universal", "usr/share/zoneinfo/Etc/Zulu", "usr/share/zoneinfo/Europe/Amsterdam", "usr/share/zoneinfo/Europe/Andorra", "usr/share/zoneinfo/Europe/Astrakhan", "usr/share/zoneinfo/Europe/Athens", "usr/share/zoneinfo/Europe/Belfast", "usr/share/zoneinfo/Europe/Belgrade", "usr/share/zoneinfo/Europe/Berlin", "usr/share/zoneinfo/Europe/Bratislava", "usr/share/zoneinfo/Europe/Brussels", "usr/share/zoneinfo/Europe/Bucharest", "usr/share/zoneinfo/Europe/Budapest", "usr/share/zoneinfo/Europe/Busingen", "usr/share/zoneinfo/Europe/Chisinau", "usr/share/zoneinfo/Europe/Copenhagen", "usr/share/zoneinfo/Europe/Dublin", "usr/share/zoneinfo/Europe/Gibraltar", "usr/share/zoneinfo/Europe/Guernsey", "usr/share/zoneinfo/Europe/Helsinki", "usr/share/zoneinfo/Europe/Isle_of_Man", "usr/share/zoneinfo/Europe/Istanbul", "usr/share/zoneinfo/Europe/Jersey", "usr/share/zoneinfo/Europe/Kaliningrad", "usr/share/zoneinfo/Europe/Kiev", "usr/share/zoneinfo/Europe/Kirov", "usr/share/zoneinfo/Europe/Kyiv", "usr/share/zoneinfo/Europe/Lisbon", "usr/share/zoneinfo/Europe/Ljubljana", "usr/share/zoneinfo/Europe/London", "usr/share/zoneinfo/Europe/Luxembourg", "usr/share/zoneinfo/Europe/Madrid", "usr/share/zoneinfo/Europe/Malta", "usr/share/zoneinfo/Europe/Mariehamn", "usr/share/zoneinfo/Europe/Minsk", "usr/share/zoneinfo/Europe/Monaco", "usr/share/zoneinfo/Europe/Moscow", "usr/share/zoneinfo/Europe/Nicosia", "usr/share/zoneinfo/Europe/Oslo", "usr/share/zoneinfo/Europe/Paris", "usr/share/zoneinfo/Europe/Podgorica", "usr/share/zoneinfo/Europe/Prague", "usr/share/zoneinfo/Europe/Riga", "usr/share/zoneinfo/Europe/Rome", "usr/share/zoneinfo/Europe/Samara", "usr/share/zoneinfo/Europe/San_Marino", "usr/share/zoneinfo/Europe/Sarajevo", "usr/share/zoneinfo/Europe/Saratov", "usr/share/zoneinfo/Europe/Simferopol", "usr/share/zoneinfo/Europe/Skopje", "usr/share/zoneinfo/Europe/Sofia", "usr/share/zoneinfo/Europe/Stockholm", "usr/share/zoneinfo/Europe/Tallinn", "usr/share/zoneinfo/Europe/Tirane", "usr/share/zoneinfo/Europe/Tiraspol", "usr/share/zoneinfo/Europe/Ulyanovsk", "usr/share/zoneinfo/Europe/Uzhgorod", "usr/share/zoneinfo/Europe/Vaduz", "usr/share/zoneinfo/Europe/Vatican", "usr/share/zoneinfo/Europe/Vienna", "usr/share/zoneinfo/Europe/Vilnius", "usr/share/zoneinfo/Europe/Volgograd", "usr/share/zoneinfo/Europe/Warsaw", "usr/share/zoneinfo/Europe/Zagreb", "usr/share/zoneinfo/Europe/Zaporozhye", "usr/share/zoneinfo/Europe/Zurich", "usr/share/zoneinfo/Indian/Antananarivo", "usr/share/zoneinfo/Indian/Chagos", "usr/share/zoneinfo/Indian/Christmas", "usr/share/zoneinfo/Indian/Cocos", "usr/share/zoneinfo/Indian/Comoro", "usr/share/zoneinfo/Indian/Kerguelen", "usr/share/zoneinfo/Indian/Mahe", "usr/share/zoneinfo/Indian/Maldives", "usr/share/zoneinfo/Indian/Mauritius", "usr/share/zoneinfo/Indian/Mayotte", "usr/share/zoneinfo/Indian/Reunion", "usr/share/zoneinfo/Mexico/BajaNorte", "usr/share/zoneinfo/Mexico/BajaSur", "usr/share/zoneinfo/Mexico/General", "usr/share/zoneinfo/Pacific/Apia", "usr/share/zoneinfo/Pacific/Auckland", "usr/share/zoneinfo/Pacific/Bougainville", "usr/share/zoneinfo/Pacific/Chatham", "usr/share/zoneinfo/Pacific/Chuuk", "usr/share/zoneinfo/Pacific/Easter", "usr/share/zoneinfo/Pacific/Efate", "usr/share/zoneinfo/Pacific/Enderbury", "usr/share/zoneinfo/Pacific/Fakaofo", "usr/share/zoneinfo/Pacific/Fiji", "usr/share/zoneinfo/Pacific/Funafuti", "usr/share/zoneinfo/Pacific/Galapagos", "usr/share/zoneinfo/Pacific/Gambier", "usr/share/zoneinfo/Pacific/Guadalcanal", "usr/share/zoneinfo/Pacific/Guam", "usr/share/zoneinfo/Pacific/Honolulu", "usr/share/zoneinfo/Pacific/Johnston", "usr/share/zoneinfo/Pacific/Kanton", "usr/share/zoneinfo/Pacific/Kiritimati", "usr/share/zoneinfo/Pacific/Kosrae", "usr/share/zoneinfo/Pacific/Kwajalein", "usr/share/zoneinfo/Pacific/Majuro", "usr/share/zoneinfo/Pacific/Marquesas", "usr/share/zoneinfo/Pacific/Midway", "usr/share/zoneinfo/Pacific/Nauru", "usr/share/zoneinfo/Pacific/Niue", "usr/share/zoneinfo/Pacific/Norfolk", "usr/share/zoneinfo/Pacific/Noumea", "usr/share/zoneinfo/Pacific/Pago_Pago", "usr/share/zoneinfo/Pacific/Palau", "usr/share/zoneinfo/Pacific/Pitcairn", "usr/share/zoneinfo/Pacific/Pohnpei", "usr/share/zoneinfo/Pacific/Ponape", "usr/share/zoneinfo/Pacific/Port_Moresby", "usr/share/zoneinfo/Pacific/Rarotonga", "usr/share/zoneinfo/Pacific/Saipan", "usr/share/zoneinfo/Pacific/Samoa", "usr/share/zoneinfo/Pacific/Tahiti", "usr/share/zoneinfo/Pacific/Tarawa", "usr/share/zoneinfo/Pacific/Tongatapu", "usr/share/zoneinfo/Pacific/Truk", "usr/share/zoneinfo/Pacific/Wake", "usr/share/zoneinfo/Pacific/Wallis", "usr/share/zoneinfo/Pacific/Yap", "usr/share/zoneinfo/US/Alaska", "usr/share/zoneinfo/US/Aleutian", "usr/share/zoneinfo/US/Arizona", "usr/share/zoneinfo/US/Central", "usr/share/zoneinfo/US/East-Indiana", "usr/share/zoneinfo/US/Eastern", "usr/share/zoneinfo/US/Hawaii", "usr/share/zoneinfo/US/Indiana-Starke", "usr/share/zoneinfo/US/Michigan", "usr/share/zoneinfo/US/Mountain", "usr/share/zoneinfo/US/Pacific", "usr/share/zoneinfo/US/Samoa" ], "AnalyzedBy": "apk" }, { "ID": "xz-libs@5.8.3-r0", "Name": "xz-libs", "Identifier": { "PURL": "pkg:apk/alpine/xz-libs@5.8.3-r0?arch=x86_64\u0026distro=3.23.4", "UID": "f68b0b2917b8b773" }, "Version": "5.8.3-r0", "Arch": "x86_64", "SrcName": "xz", "SrcVersion": "5.8.3-r0", "Licenses": [ "GPL-2.0-or-later", "0BSD", "Public-Domain", "LGPL-2.1-or-later" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "musl@1.2.5-r23" ], "Layer": { "DiffID": "sha256:5519239b187cd3709c07332d1796e87305684dbc91e05de8de1682602b6c3118" }, "Digest": "sha1:ddf3f8b1c3d2561ae67523b9baef398f971959bb", "InstalledFiles": [ "usr/lib/liblzma.so.5", "usr/lib/liblzma.so.5.8.3" ], "AnalyzedBy": "apk" }, { "ID": "zlib@1.3.2-r0", "Name": "zlib", "Identifier": { "PURL": "pkg:apk/alpine/zlib@1.3.2-r0?arch=x86_64\u0026distro=3.23.4", "UID": "23a5a7d167a86311" }, "Version": "1.3.2-r0", "Arch": "x86_64", "SrcName": "zlib", "SrcVersion": "1.3.2-r0", "Licenses": [ "Zlib" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "musl@1.2.5-r23" ], "Layer": { "DiffID": "sha256:29df493baa13de438d6d2ece3a8333032e0b7b9b9d8cce4ee82194da255f61e1" }, "Digest": "sha1:68bb97ea5255e77aa974e65476d64832ad56288a", "InstalledFiles": [ "usr/lib/libz.so.1", "usr/lib/libz.so.1.3.2" ], "AnalyzedBy": "apk" }, { "ID": "zstd-libs@1.5.7-r2", "Name": "zstd-libs", "Identifier": { "PURL": "pkg:apk/alpine/zstd-libs@1.5.7-r2?arch=x86_64\u0026distro=3.23.4", "UID": "3653bba6b6680fed" }, "Version": "1.5.7-r2", "Arch": "x86_64", "SrcName": "zstd", "SrcVersion": "1.5.7-r2", "Licenses": [ "BSD-3-Clause", "GPL-2.0-or-later" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "musl@1.2.5-r23" ], "Layer": { "DiffID": "sha256:5519239b187cd3709c07332d1796e87305684dbc91e05de8de1682602b6c3118" }, "Digest": "sha1:d507b8ac3c4335a40405ac20e49bac9d43642be6", "InstalledFiles": [ "usr/lib/libzstd.so.1", "usr/lib/libzstd.so.1.5.7" ], "AnalyzedBy": "apk" } ], "Vulnerabilities": [ { "VulnerabilityID": "CVE-2026-111497", "PkgID": "brotli-libs@1.2.0-r0", "PkgName": "brotli-libs", "PkgIdentifier": { "PURL": "pkg:apk/alpine/brotli-libs@1.2.0-r0?arch=x86_64\u0026distro=3.23.4", "UID": "234da2b3c350083b" }, "InstalledVersion": "1.2.0-r0", "FixedVersion": "1.2.1-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:5519239b187cd3709c07332d1796e87305684dbc91e05de8de1682602b6c3118" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-111497", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:b60682e6ae911f1b7dd01c730830dfbe2082e78b41d1291dbc7a444783d196b2", "Title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "Description": "A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.\n\n\n\n\n\nUsers need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.", "Severity": "CRITICAL", "CweIDs": [ "CWE-252", "CWE-787" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 4, "bitnami": 4, "ghsa": 4, "nvd": 4, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "bitnami": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V40Score": 9.2 }, "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V3Score": 9.8, "V40Score": 9.2 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 9.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/10/23/25", "http://www.openwall.com/lists/oss-security/2026/10/24/6", "http://www.openwall.com/lists/oss-security/2026/10/26/12", "http://www.openwall.com/lists/oss-security/2026/10/26/13", "http://www.openwall.com/lists/oss-security/2026/10/26/16", "http://www.openwall.com/lists/oss-security/2026/11/03/2", "https://access.redhat.com/errata/RHSA-2026:90495", "https://access.redhat.com/errata/RHSA-2026:92492", "https://access.redhat.com/security/cve/CVE-2026-111497", "https://advisory.echohq.com/cve/CVE-2026-111497", "https://broccoli2shell.com", "https://bugzilla.redhat.com/2558973", "https://bugzilla.redhat.com/2562054", "https://bugzilla.redhat.com/show_bug.cgi?id=2558973", "https://cert-portal.siemens.com/productcert/html/ssa-045512.html", "https://cert-portal.siemens.com/productcert/html/ssa-443410.html", "https://cert-portal.siemens.com/productcert/html/ssa-898633.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-111497", "https://devblogs.microsoft.com/dotnet/dotnet-october-2026-oob-security-updates", "https://ellio.tech/en/blog/node2shell-cve-2026-111497-rce-on-stock-nodejs-builds", "https://ellio.tech/en/blog/node2shell-cve-2026-111497-rce-on-stock-nodejs-builds/", "https://errata.almalinux.org/9/ALSA-2026-92492.html", "https://errata.rockylinux.org/RLSA-2026:90495", "https://github.com/advisories/GHSA-9v8h-qqgm-4m35", "https://github.com/andybalholm/brotli/releases/tag/v1.2.7", "https://github.com/dotnet/announcements/issues/494", "https://github.com/google/brotli", "https://github.com/google/brotli/commit/0ed4268a4401abcb4472096340477cf4af7d1a2b", "https://github.com/google/brotli/commit/50a9b70a4d5e1443fc40927952276b68fffa83a0", "https://github.com/google/brotli/commit/b418fa81c48262a86a95332b0bc6d62c30aa78b6", "https://github.com/google/brotli/commit/da9806362874b9bd4b552a3af360b5d6347beb12", "https://github.com/google/brotli/releases/tag/v1.0.10", "https://github.com/google/brotli/releases/tag/v1.1.1", "https://github.com/google/brotli/releases/tag/v1.2.1", "https://github.com/pypa/advisory-database/tree/main/vulns/brotli/PYSEC-2026-4322.yaml", "https://github.com/pypa/advisory-database/tree/main/vulns/brotlicffi/PYSEC-2026-4323.yaml", "https://linux.oracle.com/cve/CVE-2026-111497.html", "https://linux.oracle.com/errata/ELSA-2026-92492.html", "https://lists.debian.org/debian-lts-announce/2026/10/msg00049.html", "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-114148", "https://nodejs.org/en/blog/vulnerability/october-2026-security-releases", "https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#nodejs-brotli-decoder-out-of-bounds-write-permits-remote-code-execution-cve-2026-111497---high", "https://nvd.nist.gov/vuln/detail/CVE-2026-111497", "https://opensourcemalware.com/blog/node2shell-affects-python", "https://patchtheplanet.org/brotli", "https://pypi.org/project/Brotli", "https://pypi.org/project/brotlicffi", "https://ubuntu.com/security/notices/USN-8956-1", "https://ubuntu.com/security/notices/USN-8956-2", "https://ubuntu.com/security/notices/USN-8958-1", "https://www.aikido.dev/blog/node2shell-nodejs-brotli-rce-cve-2026-111497", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-111497", "https://www.cve.org/CVERecord?id=CVE-2026-111497" ], "PublishedDate": "2026-10-22T14:17:37.19Z", "LastModifiedDate": "2026-11-06T16:17:37.393Z" }, { "VulnerabilityID": "CVE-2026-33630", "PkgID": "c-ares@1.34.6-r0", "PkgName": "c-ares", "PkgIdentifier": { "PURL": "pkg:apk/alpine/c-ares@1.34.6-r0?arch=x86_64\u0026distro=3.23.4", "UID": "5be96d5420bec243" }, "InstalledVersion": "1.34.6-r0", "FixedVersion": "1.34.8-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:5519239b187cd3709c07332d1796e87305684dbc91e05de8de1682602b6c3118" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-33630", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:043463af62916e9c50a3895e045c7d094a6379efd5d8b15550011bfeeee3c8b6", "Title": "c-ares: c-ares: Use-after-free / double-free in query-completion handling", "Description": "c-ares is an asynchronous resolver library. From ver 1.32.3 until 1.34.7, a use-after-free / double-free in c-ares' query-completion handling. The same flaw — a query's callback being invoked while the query is still linked in the channel's internal lookup structures — is present at multiple points in the resend/finish path (timeout handling, response handling, and query dispatch). If the query, or for ares_getaddrinfo() the owning host_query, is freed as a side effect of that callback, it is then accessed and/or freed a second time. This vulnerability is fixed in ver 1.34.7.", "Severity": "HIGH", "CweIDs": [ "CWE-415", "CWE-416" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:42096", "https://access.redhat.com/security/cve/CVE-2026-33630", "https://bugzilla.redhat.com/2497686", "https://bugzilla.redhat.com/show_bug.cgi?id=2497686", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33630", "https://errata.almalinux.org/10/ALSA-2026-42096.html", "https://errata.rockylinux.org/RLSA-2026:42096", "https://github.com/c-ares/c-ares/commit/1fa3b86a0b8d18fe7b60f3228a01d770feb026bc", "https://github.com/c-ares/c-ares/commit/d823199b688052dcdc1646f2ab4cb8c16b1c644a", "https://github.com/c-ares/c-ares/pull/1237", "https://github.com/c-ares/c-ares/releases/tag/v1.34.7", "https://github.com/c-ares/c-ares/security/advisories/GHSA-6wfj-rwm7-3542", "https://linux.oracle.com/cve/CVE-2026-33630.html", "https://linux.oracle.com/errata/ELSA-2026-42096.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-33630", "https://ubuntu.com/security/notices/USN-8844-1", "https://www.cve.org/CVERecord?id=CVE-2026-33630", "https://www.openwall.com/lists/oss-security/2026/07/06/8" ], "PublishedDate": "2026-09-03T19:17:27.42Z", "LastModifiedDate": "2026-09-09T21:09:13.08Z" }, { "VulnerabilityID": "CVE-2026-11352", "PkgID": "curl@8.19.0-r0", "PkgName": "curl", "PkgIdentifier": { "PURL": "pkg:apk/alpine/curl@8.19.0-r0?arch=x86_64\u0026distro=3.23.4", "UID": "f9ecf01e03ce7fef" }, "InstalledVersion": "8.19.0-r0", "FixedVersion": "8.22.0-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:5519239b187cd3709c07332d1796e87305684dbc91e05de8de1682602b6c3118" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-11352", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:3acb5fa111c3000f45e1249019fc78390c4b07c54273b01c6fd0bc59bf79f2ce", "Title": "curl: libcurl: curl/libcurl: Remote denial of service via QUIC UDP receive function vulnerability", "Description": "An issue in curl’s QUIC UDP receive function allows a malicious HTTP/3 server\nto trigger a remote denial of service against a curl or libcurl client.\nBecause the helper function discards zero-length UDP datagrams before counting\nthem toward the per-call packet budget, a connected QUIC peer can continuously\nstream empty datagrams to indefinitely stall the client.", "Severity": "HIGH", "CweIDs": [ "CWE-835" ], "VendorSeverity": { "julia": 3, "photon": 3, "redhat": 3, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-11352", "https://curl.se/L7HzKXisfJ/CVE-2026-11352.md", "https://curl.se/docs/CVE-2026-11352.html", "https://curl.se/docs/CVE-2026-11352.json", "https://github.com/advisories/GHSA-qxwx-hr5v-h5q4", "https://hackerone.com/reports/3783438", "https://nvd.nist.gov/vuln/detail/CVE-2026-11352", "https://ubuntu.com/security/notices/USN-8525-1", "https://www.cve.org/CVERecord?id=CVE-2026-11352" ], "PublishedDate": "2026-07-03T07:16:23.693Z", "LastModifiedDate": "2026-09-15T07:16:25.353Z" }, { "VulnerabilityID": "CVE-2026-11586", "PkgID": "curl@8.19.0-r0", "PkgName": "curl", "PkgIdentifier": { "PURL": "pkg:apk/alpine/curl@8.19.0-r0?arch=x86_64\u0026distro=3.23.4", "UID": "f9ecf01e03ce7fef" }, "InstalledVersion": "8.19.0-r0", "FixedVersion": "8.22.0-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:5519239b187cd3709c07332d1796e87305684dbc91e05de8de1682602b6c3118" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-11586", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:a4fc465ee6b60125f9f8c4af40d110665a4fb23838b0c13eb4215c1b2acbcdb3", "Title": "curl: curl: Denial of Service via WebSocket PING flood", "Description": "By default, curl automatically responds to WebSocket PING frames. Because curl\nlacks an upper bound on memory allocation for unacknowledged frames, a\nmalicious server can exhaust all available memory by flooding curl with rapid,\nsequential PING messages.", "Severity": "HIGH", "CweIDs": [ "CWE-770" ], "VendorSeverity": { "amazon": 2, "julia": 3, "photon": 3, "redhat": 3, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-11586", "https://curl.se/L7HzKXisfJ/CVE-2026-11586.md", "https://curl.se/docs/CVE-2026-11586.html", "https://curl.se/docs/CVE-2026-11586.json", "https://github.com/advisories/GHSA-c68q-h477-5646", "https://hackerone.com/reports/3788931", "https://nvd.nist.gov/vuln/detail/CVE-2026-11586", "https://ubuntu.com/security/notices/USN-8525-1", "https://www.cve.org/CVERecord?id=CVE-2026-11586" ], "PublishedDate": "2026-07-03T07:16:23.883Z", "LastModifiedDate": "2026-09-15T07:16:25.7Z" }, { "VulnerabilityID": "CVE-2026-12064", "PkgID": "curl@8.19.0-r0", "PkgName": "curl", "PkgIdentifier": { "PURL": "pkg:apk/alpine/curl@8.19.0-r0?arch=x86_64\u0026distro=3.23.4", "UID": "f9ecf01e03ce7fef" }, "InstalledVersion": "8.19.0-r0", "FixedVersion": "8.22.0-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:5519239b187cd3709c07332d1796e87305684dbc91e05de8de1682602b6c3118" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-12064", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:b08f82569242285d74e14676c75b7435685e4102a836c66cf090bc237a74ef03", "Title": "curl: curl: SSH host verification bypass when using schemeless URLs with SFTP/SCP", "Description": "When a user invokes curl using a schemeless URL combined with\n`--proto-default` sftp (or scp), a disconnect occurs between the tool layer\nand libcurl. The tool layer incorrectly infers the URL scheme, which\nerroneously bypasses the initialization of critical SSH security options like\nCURLOPT_SSH_HOST_PUBLIC_KEY_SHA256 and CURLOPT_SSH_KNOWNHOSTS. Conversely, the\nlibcurl runtime successfully honors CURLOPT_DEFAULT_PROTOCOL and establishes\nthe connection via SFTP/SCP as specified. Because the tool layer skipped the\nsecurity configuration, these SSH host verification options are silently\nomitted, causing curl to connect to an unverified SSH remote host without\nthrowing an error.", "Severity": "HIGH", "CweIDs": [ "CWE-297", "CWE-295" ], "VendorSeverity": { "amazon": 2, "azure": 3, "julia": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-12064", "https://curl.se/L7HzKXisfJ/CVE-2026-12064.md", "https://curl.se/docs/CVE-2026-12064.html", "https://curl.se/docs/CVE-2026-12064.json", "https://github.com/advisories/GHSA-jm94-9f7h-36pr", "https://hackerone.com/reports/3797526", "https://linux.oracle.com/cve/CVE-2026-12064.html", "https://linux.oracle.com/errata/ELSA-2026-55450.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-12064", "https://ubuntu.com/security/notices/USN-8525-1", "https://www.cve.org/CVERecord?id=CVE-2026-12064" ], "PublishedDate": "2026-07-03T07:16:24.217Z", "LastModifiedDate": "2026-09-15T07:16:26.15Z" }, { "VulnerabilityID": "CVE-2026-5773", "PkgID": "curl@8.19.0-r0", "PkgName": "curl", "PkgIdentifier": { "PURL": "pkg:apk/alpine/curl@8.19.0-r0?arch=x86_64\u0026distro=3.23.4", "UID": "f9ecf01e03ce7fef" }, "InstalledVersion": "8.19.0-r0", "FixedVersion": "8.20.0-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:5519239b187cd3709c07332d1796e87305684dbc91e05de8de1682602b6c3118" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-5773", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:c5a3df7e6d7e8a0ab48c2e05d7043f8911ca2265cced5e90f38e47e21773a9c9", "Title": "curl: libcurl: Wrong file transfer due to incorrect SMB connection reuse", "Description": "libcurl might in some circumstances reuse the wrong connection for SMB(S)\ntransfers.\n\nlibcurl features a pool of recent connections so that subsequent requests can\nreuse an existing connection to avoid overhead.\n\nWhen reusing a connection a range of criteria must be met. Due to a logical\nerror in the code, a network transfer operation that was requested by an\napplication could wrongfully reuse an existing SMB connection to the same\nserver that was using a different \"share\" than the new subsequent transfer\nshould.\n\nThis could in unlucky situations lead to the download of the wrong file or the\nupload of a file to the wrong place. When this happens, the same credentials\nare used and the server name is the same.", "Severity": "HIGH", "CweIDs": [ "CWE-488", "CWE-918" ], "VendorSeverity": { "julia": 3, "nvd": 3, "photon": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "V3Score": 6.5 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/04/29/9", "https://access.redhat.com/security/cve/CVE-2026-5773", "https://curl.se/docs/CVE-2026-5773.html", "https://curl.se/docs/CVE-2026-5773.json", "https://github.com/advisories/GHSA-rp9q-8q5w-ch44", "https://hackerone.com/reports/3650689", "https://nvd.nist.gov/vuln/detail/CVE-2026-5773", "https://ubuntu.com/security/notices/USN-8227-1", "https://ubuntu.com/security/notices/USN-8525-1", "https://www.cve.org/CVERecord?id=CVE-2026-5773" ], "PublishedDate": "2026-05-13T13:01:56.307Z", "LastModifiedDate": "2026-09-15T07:16:28.82Z" }, { "VulnerabilityID": "CVE-2026-6276", "PkgID": "curl@8.19.0-r0", "PkgName": "curl", "PkgIdentifier": { "PURL": "pkg:apk/alpine/curl@8.19.0-r0?arch=x86_64\u0026distro=3.23.4", "UID": "f9ecf01e03ce7fef" }, "InstalledVersion": "8.19.0-r0", "FixedVersion": "8.20.0-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:5519239b187cd3709c07332d1796e87305684dbc91e05de8de1682602b6c3118" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-6276", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:a1dd4d032dca2bb4275a702de54d9844918be219676ec8a20f7242aaf455e2e9", "Title": "curl: libcurl: Information disclosure due to cookie leak when reusing connections with custom Host headers", "Description": "Using libcurl, when a custom `Host:` header is first set for an HTTP request\nand a second request is subsequently done using the same *easy handle* but\nwithout the custom `Host:` header set, the second request would use stale\ninformation and pass on cookies meant for the first host in the second\nrequest. Leak them.", "Severity": "HIGH", "CweIDs": [ "CWE-346", "CWE-319" ], "VendorSeverity": { "azure": 2, "julia": 3, "nvd": 3, "photon": 3, "redhat": 1, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "V3Score": 3.7 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/04/29/13", "https://access.redhat.com/security/cve/CVE-2026-6276", "https://curl.se/docs/CVE-2026-6276.html", "https://curl.se/docs/CVE-2026-6276.json", "https://github.com/advisories/GHSA-2jc6-hc33-hv48", "https://hackerone.com/reports/3671818", "https://nvd.nist.gov/vuln/detail/CVE-2026-6276", "https://ubuntu.com/security/notices/USN-8227-1", "https://www.cve.org/CVERecord?id=CVE-2026-6276" ], "PublishedDate": "2026-05-13T13:01:56.8Z", "LastModifiedDate": "2026-09-15T07:16:29.343Z" }, { "VulnerabilityID": "CVE-2026-8286", "PkgID": "curl@8.19.0-r0", "PkgName": "curl", "PkgIdentifier": { "PURL": "pkg:apk/alpine/curl@8.19.0-r0?arch=x86_64\u0026distro=3.23.4", "UID": "f9ecf01e03ce7fef" }, "InstalledVersion": "8.19.0-r0", "FixedVersion": "8.22.0-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:5519239b187cd3709c07332d1796e87305684dbc91e05de8de1682602b6c3118" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-8286", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:537f7abe007db6c937654f9a0bd989db3ae39bb2fca791bd902c387d7418f81f", "Title": "curl: curl: Insecure connection establishment due to TLS configuration mismatch", "Description": "A vulnerability exists where a new transfer that uses STARTTLS to upgrade the\nconnection might reuse an existing live connection even though the TLS\nconfiguration mismatches so it should not.", "Severity": "HIGH", "CweIDs": [ "CWE-295" ], "VendorSeverity": { "alma": 3, "amazon": 2, "azure": 3, "julia": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "V3Score": 8.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:55439", "https://access.redhat.com/security/cve/CVE-2026-8286", "https://bugzilla.redhat.com/2446448", "https://bugzilla.redhat.com/2446450", "https://bugzilla.redhat.com/2496758", "https://bugzilla.redhat.com/2496763", "https://bugzilla.redhat.com/show_bug.cgi?id=2446448", "https://bugzilla.redhat.com/show_bug.cgi?id=2446450", "https://bugzilla.redhat.com/show_bug.cgi?id=2496758", "https://bugzilla.redhat.com/show_bug.cgi?id=2496763", "https://creativecommons.org/licenses/by/4.0/", "https://curl.se/L7HzKXisfJ/CVE-2026-8286.md", "https://curl.se/docs/CVE-2026-8286.html", "https://curl.se/docs/CVE-2026-8286.json", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-1965", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-3783", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8286", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-9547", "https://errata.almalinux.org/9/ALSA-2026-55439.html", "https://errata.rockylinux.org/RLSA-2026:55439", "https://github.com/advisories/GHSA-32xh-3x3c-6g6h", "https://hackerone.com/reports/3718195", "https://linux.oracle.com/cve/CVE-2026-8286.html", "https://linux.oracle.com/errata/ELSA-2026-57462.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-8286", "https://ubuntu.com/security/notices/USN-8487-1", "https://www.cve.org/CVERecord?id=CVE-2026-8286" ], "PublishedDate": "2026-07-03T07:16:24.453Z", "LastModifiedDate": "2026-09-15T07:16:31.617Z" }, { "VulnerabilityID": "CVE-2026-8458", "PkgID": "curl@8.19.0-r0", "PkgName": "curl", "PkgIdentifier": { "PURL": "pkg:apk/alpine/curl@8.19.0-r0?arch=x86_64\u0026distro=3.23.4", "UID": "f9ecf01e03ce7fef" }, "InstalledVersion": "8.19.0-r0", "FixedVersion": "8.22.0-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:5519239b187cd3709c07332d1796e87305684dbc91e05de8de1682602b6c3118" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-8458", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:b45f1d2dc46f012c451bbba066d27ee72ab915aa33138f2bc7d848fac561bfd4", "Title": "curl: libcurl: Unauthorized connection reuse due to a logical error", "Description": "libcurl might in some circumstances reuse the wrong connection when asked to\ndo Negotiate-authenticated ones, even when they are set to use different\n\"services\".\n\nlibcurl features a pool of recent connections so that subsequent requests can\nreuse an existing connection to avoid overhead.\n\nWhen reusing a connection a range of criteria must be met. Due to a logical\nerror in the code, a request that was issued by an application could\nwrongfully reuse an existing connection to the same server that was\nauthenticated using different services.", "Severity": "HIGH", "CweIDs": [ "CWE-488" ], "VendorSeverity": { "alma": 3, "amazon": 2, "azure": 2, "julia": 2, "oracle-oval": 3, "photon": 2, "redhat": 3, "rocky": 3, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "V3Score": 6.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:69126", "https://access.redhat.com/security/cve/CVE-2026-8458", "https://bugzilla.redhat.com/2496764", "https://bugzilla.redhat.com/2496769", "https://bugzilla.redhat.com/show_bug.cgi?id=2496764", "https://bugzilla.redhat.com/show_bug.cgi?id=2496769", "https://creativecommons.org/licenses/by/4.0/", "https://curl.se/L7HzKXisfJ/CVE-2026-8458.md", "https://curl.se/docs/CVE-2026-8458.html", "https://curl.se/docs/CVE-2026-8458.json", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8458", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8927", "https://errata.almalinux.org/9/ALSA-2026-69126.html", "https://errata.rockylinux.org/RLSA-2026:69126", "https://github.com/advisories/GHSA-88c6-6jfq-mm4q", "https://hackerone.com/reports/3721183", "https://linux.oracle.com/cve/CVE-2026-8458.html", "https://linux.oracle.com/errata/ELSA-2026-92368.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-8458", "https://ubuntu.com/security/notices/USN-8487-1", "https://www.cve.org/CVERecord?id=CVE-2026-8458" ], "PublishedDate": "2026-07-03T07:16:24.63Z", "LastModifiedDate": "2026-09-15T07:16:32.327Z" }, { "VulnerabilityID": "CVE-2026-8925", "PkgID": "curl@8.19.0-r0", "PkgName": "curl", "PkgIdentifier": { "PURL": "pkg:apk/alpine/curl@8.19.0-r0?arch=x86_64\u0026distro=3.23.4", "UID": "f9ecf01e03ce7fef" }, "InstalledVersion": "8.19.0-r0", "FixedVersion": "8.22.0-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:5519239b187cd3709c07332d1796e87305684dbc91e05de8de1682602b6c3118" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-8925", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:c2ca61547ccaa558f598df3c9ee1b1f4731c3639e629fb35c867923ec9c0f863", "Title": "curl: curl: Double-free vulnerability in SASL authentication", "Description": "The curl logic that works with SASL authentication could end up cleaning up\nthe GSASL context *twice* without clearing the pointer in between, making it\n`free()` the same pointer twice.", "Severity": "HIGH", "CweIDs": [ "CWE-415" ], "VendorSeverity": { "amazon": 2, "julia": 4, "photon": 4, "redhat": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 9.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-8925", "https://curl.se/L7HzKXisfJ/CVE-2026-8925.md", "https://curl.se/docs/CVE-2026-8925.html", "https://curl.se/docs/CVE-2026-8925.json", "https://github.com/advisories/GHSA-p8x5-c6c9-8cwx", "https://hackerone.com/reports/3735193", "https://nvd.nist.gov/vuln/detail/CVE-2026-8925", "https://ubuntu.com/security/notices/USN-8487-1", "https://www.cve.org/CVERecord?id=CVE-2026-8925" ], "PublishedDate": "2026-07-03T07:16:24.95Z", "LastModifiedDate": "2026-09-15T07:16:32.8Z" }, { "VulnerabilityID": "CVE-2026-8927", "PkgID": "curl@8.19.0-r0", "PkgName": "curl", "PkgIdentifier": { "PURL": "pkg:apk/alpine/curl@8.19.0-r0?arch=x86_64\u0026distro=3.23.4", "UID": "f9ecf01e03ce7fef" }, "InstalledVersion": "8.19.0-r0", "FixedVersion": "8.22.0-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:5519239b187cd3709c07332d1796e87305684dbc91e05de8de1682602b6c3118" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-8927", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:aa45386968cdb5216de84918045552c1ae7763a155b5ed42807c0f1efa5014f5", "Title": "curl: Information disclosure due to uncleared proxy authentication state", "Description": "When reusing a libcurl handle for sequential transfers driven by\nenvironment-variable proxy configuration, libcurl fails to clear the proxy\nauthentication state between requests. Specifically, if the initial transfer\nauthenticates against `proxyA` using Digest auth, a subsequent transfer routed\nthrough `proxyB` erroneously leaks the `Proxy-Authorization:` header intended\nsolely for `proxyA`.", "Severity": "HIGH", "CweIDs": [ "CWE-294" ], "VendorSeverity": { "alma": 3, "amazon": 2, "azure": 2, "julia": 4, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "V3Score": 9.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:69126", "https://access.redhat.com/security/cve/CVE-2026-8927", "https://bugzilla.redhat.com/2496764", "https://bugzilla.redhat.com/2496769", "https://bugzilla.redhat.com/show_bug.cgi?id=2496764", "https://bugzilla.redhat.com/show_bug.cgi?id=2496769", "https://creativecommons.org/licenses/by/4.0/", "https://curl.se/L7HzKXisfJ/CVE-2026-8927.md", "https://curl.se/docs/CVE-2026-8927.html", "https://curl.se/docs/CVE-2026-8927.json", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8458", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8927", "https://errata.almalinux.org/9/ALSA-2026-69126.html", "https://errata.rockylinux.org/RLSA-2026:69126", "https://github.com/advisories/GHSA-jr4f-4564-w3mr", "https://hackerone.com/reports/3744543", "https://linux.oracle.com/cve/CVE-2026-8927.html", "https://linux.oracle.com/errata/ELSA-2026-92368.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-8927", "https://ubuntu.com/security/notices/USN-8487-1", "https://ubuntu.com/security/notices/USN-8820-1", "https://www.cve.org/CVERecord?id=CVE-2026-8927" ], "PublishedDate": "2026-07-03T07:16:25.123Z", "LastModifiedDate": "2026-09-15T07:16:33.157Z" }, { "VulnerabilityID": "CVE-2026-92392", "PkgID": "curl@8.19.0-r0", "PkgName": "curl", "PkgIdentifier": { "PURL": "pkg:apk/alpine/curl@8.19.0-r0?arch=x86_64\u0026distro=3.23.4", "UID": "f9ecf01e03ce7fef" }, "InstalledVersion": "8.19.0-r0", "FixedVersion": "8.23.0-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:5519239b187cd3709c07332d1796e87305684dbc91e05de8de1682602b6c3118" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-92392", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:f3c4c8c800af8959b0242eadbcd416253bb9f7fdcc5c9b6136e97869abe48a51", "Title": "curl: curl: HTTP/2 upload Use-After-Free", "Description": "During an upload, curl mishandles HTTP/2 `RST_STREAM` received from the server\n(with reason `HTTP_1_1_REQUIRED` or `REFUSED_STREAM`) leading to a use after\nfree of a `struct Curl_easy` object.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "amazon": 3, "redhat": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/10/18/5", "http://www.openwall.com/lists/oss-security/2026/10/18/6", "https://access.redhat.com/security/cve/CVE-2026-92392", "https://curl.se/docs/CVE-2026-92392.html", "https://curl.se/docs/CVE-2026-92392.json", "https://hackerone.com/reports/4030333", "https://nvd.nist.gov/vuln/detail/CVE-2026-92392", "https://ubuntu.com/security/notices/USN-8927-1", "https://ubuntu.com/security/notices/USN-8927-2", "https://www.cve.org/CVERecord?id=CVE-2026-92392" ], "PublishedDate": "2026-10-14T08:17:05.997Z", "LastModifiedDate": "2026-10-18T23:16:57.163Z" }, { "VulnerabilityID": "CVE-2026-9547", "PkgID": "curl@8.19.0-r0", "PkgName": "curl", "PkgIdentifier": { "PURL": "pkg:apk/alpine/curl@8.19.0-r0?arch=x86_64\u0026distro=3.23.4", "UID": "f9ecf01e03ce7fef" }, "InstalledVersion": "8.19.0-r0", "FixedVersion": "8.22.0-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:5519239b187cd3709c07332d1796e87305684dbc91e05de8de1682602b6c3118" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-9547", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:af6c8b6f73b3e5d28acf26b30819af2c29f72f13b0f89935c4fa2a64d389bf53", "Title": "curl: curl: Man-in-the-middle attack via SSH host key bypass", "Description": "When a libcurl-based application performs transfers via `SCP://` or `SFTP://`\nand utilizes the `CURLOPT_SSH_KEYFUNCTION` callback, it may silently accept an\nuntrusted server. This vulnerability occurs when a server presents a host key\ntype that does not match the specific key type already recorded for that host\nin the `known_hosts` file. Instead of rejecting the mismatch, the callback\nmechanism fails to properly enforce the restriction, allowing the connection\nto succeed without warning and risking a potential man-in-the-middle attack.", "Severity": "HIGH", "CweIDs": [ "CWE-297" ], "VendorSeverity": { "alma": 3, "amazon": 2, "julia": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "V3Score": 7.4 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "V3Score": 7.4 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:55439", "https://access.redhat.com/security/cve/CVE-2026-9547", "https://bugzilla.redhat.com/2446448", "https://bugzilla.redhat.com/2446450", "https://bugzilla.redhat.com/2496758", "https://bugzilla.redhat.com/2496763", "https://bugzilla.redhat.com/show_bug.cgi?id=2446448", "https://bugzilla.redhat.com/show_bug.cgi?id=2446450", "https://bugzilla.redhat.com/show_bug.cgi?id=2496758", "https://bugzilla.redhat.com/show_bug.cgi?id=2496763", "https://creativecommons.org/licenses/by/4.0/", "https://curl.se/L7HzKXisfJ/CVE-2026-9547.md", "https://curl.se/docs/CVE-2026-9547.html", "https://curl.se/docs/CVE-2026-9547.json", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-1965", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-3783", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8286", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-9547", "https://errata.almalinux.org/9/ALSA-2026-55439.html", "https://errata.rockylinux.org/RLSA-2026:55439", "https://github.com/advisories/GHSA-xq9p-gxg6-f7q6", "https://hackerone.com/reports/3751712", "https://linux.oracle.com/cve/CVE-2026-9547.html", "https://linux.oracle.com/errata/ELSA-2026-55450.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-9547", "https://ubuntu.com/security/notices/USN-8487-1", "https://www.cve.org/CVERecord?id=CVE-2026-9547" ], "PublishedDate": "2026-07-03T07:16:25.99Z", "LastModifiedDate": "2026-09-15T07:16:35.31Z" }, { "VulnerabilityID": "CVE-2026-14456", "PkgID": "libcrypto3@3.5.6-r0", "PkgName": "libcrypto3", "PkgIdentifier": { "PURL": "pkg:apk/alpine/libcrypto3@3.5.6-r0?arch=x86_64\u0026distro=3.23.4", "UID": "975680d851f10fda" }, "InstalledVersion": "3.5.6-r0", "FixedVersion": "3.5.8-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:29df493baa13de438d6d2ece3a8333032e0b7b9b9d8cce4ee82194da255f61e1" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-14456", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:cba83cad18346564b1e1055dbb31104e2a5f026254448bfabc9dc20e81670805", "Title": "openssl: OpenSSL: Denial of Service via unbounded memory growth in QUIC server", "Description": "Issue summary: When an OpenSSL QUIC server (Listener SSL object) processes\nvalid QUIC Initial packets for unknown destination connection IDs, it\ncan allocate and queue new incoming channels without enforcing any limit.\n\nImpact summary: A remote peer that can make many Initial packets reach the\nserver listener faster than the application accepts connections, can cause the\nmemory allocated to store the per-channel state to grow without any limits,\npotentially making the QUIC listener unavailable and causing Denial of Service.\n\nCWE: CWE-770: Allocation of Resources Without Limits or Throttling\n\nDescription: The function that handles inbound QUIC packets uses\nConnection-Id from the packet header to find an existing connection\n(QUIC channel). If no existing connection is found and the packet\ntype is INITIAL, the function treats the packet as a new connection. It\nallocates a new channel object and inserts it into a queue where it\nwaits to be accepted by the local application with SSL_accept(3ossl).\nThe memory occupied by these initial channel objects may grow\nwithout bounds if the application is not able to call SSL_accept()\nfrequently enough to serve these inbound connection requests.\n\nThe issue is present since OpenSSL 3.5 when the QUIC server implementation\nwas added.\n\nThe fix introduces a limit for pending connections. The default limit is set\nto 256 pending connections (waiting to be accepted by the local application).\nApplications may change the default by calling SSL_set_value_uint(3ossl).\n\nFIPS impact: no\nThe FIPS module is not affected as the QUIC implementation is outside of\nthe OpenSSL FIPS module boundary.", "Severity": "HIGH", "CweIDs": [ "CWE-770" ], "VendorSeverity": { "alma": 3, "amazon": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/08/13/4", "https://access.redhat.com/errata/RHSA-2026:67165", "https://access.redhat.com/security/cve/CVE-2026-14456", "https://bugzilla.redhat.com/2515348", "https://bugzilla.redhat.com/2517559", "https://bugzilla.redhat.com/2517560", "https://bugzilla.redhat.com/2517561", "https://bugzilla.redhat.com/2517562", "https://bugzilla.redhat.com/2517564", "https://bugzilla.redhat.com/2517565", "https://bugzilla.redhat.com/2517566", "https://bugzilla.redhat.com/2517570", "https://bugzilla.redhat.com/show_bug.cgi?id=2515348", "https://bugzilla.redhat.com/show_bug.cgi?id=2517559", "https://bugzilla.redhat.com/show_bug.cgi?id=2517560", "https://bugzilla.redhat.com/show_bug.cgi?id=2517561", "https://bugzilla.redhat.com/show_bug.cgi?id=2517562", "https://bugzilla.redhat.com/show_bug.cgi?id=2517564", "https://bugzilla.redhat.com/show_bug.cgi?id=2517565", "https://bugzilla.redhat.com/show_bug.cgi?id=2517566", "https://bugzilla.redhat.com/show_bug.cgi?id=2517570", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-14456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-14457", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-18798", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54874", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63072", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63073", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63074", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63075", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63076", "https://errata.almalinux.org/9/ALSA-2026-67165.html", "https://errata.rockylinux.org/RLSA-2026:67165", "https://github.com/openssl/openssl/commit/08e7756c3900bcfd77a720e7b74e27d6e4ed01a9", "https://github.com/openssl/openssl/commit/4084152e040329ca0194c4c1750b9b46d00a5b6b", "https://github.com/openssl/openssl/commit/f2f1465f2d2e5c61dfeac4d20fd093797d821139", "https://linux.oracle.com/cve/CVE-2026-14456.html", "https://linux.oracle.com/errata/ELSA-2026-67165-0.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-14456", "https://openssl-library.org/news/secadv/20260813.txt", "https://ubuntu.com/security/notices/USN-8678-1", "https://www.cve.org/CVERecord?id=CVE-2026-14456" ], "PublishedDate": "2026-08-13T15:19:31.82Z", "LastModifiedDate": "2026-11-06T20:26:36.04Z" }, { "VulnerabilityID": "CVE-2026-45447", "PkgID": "libcrypto3@3.5.6-r0", "PkgName": "libcrypto3", "PkgIdentifier": { "PURL": "pkg:apk/alpine/libcrypto3@3.5.6-r0?arch=x86_64\u0026distro=3.23.4", "UID": "975680d851f10fda" }, "InstalledVersion": "3.5.6-r0", "FixedVersion": "3.5.7-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:29df493baa13de438d6d2ece3a8333032e0b7b9b9d8cce4ee82194da255f61e1" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-45447", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:f70eada67c34422eb0264d26473c2023aecf8fe334481ef77e14f40538a5113f", "Title": "openssl: Heap Use-After-Free in OpenSSL PKCS7_verify()", "Description": "Issue summary: A specially crafted PKCS#7 or S/MIME signed message could\ntrigger a use-after-free during PKCS#7 signature verification.\n\nImpact summary: A use-after-free may result in process crashes, heap\ncorruption, or potentially remote code execution.\n\nWhen processing a PKCS#7 or S/MIME signed message, if the SignedData\ndigestAlgorithms field is present as an empty ASN.1 SET, OpenSSL may\nincorrectly free a caller-owned BIO during PKCS7_verify(). A subsequent\nuse of the BIO by the calling application results in a use-after-free\ncondition.\n\nIn the common case this occurs when the application later calls\nBIO_free() on the BIO originally passed to PKCS7_verify(). Depending\non allocator behavior and application-specific BIO usage patterns, this\nmay result in a crash or other memory corruption. In some application\ncontexts this may potentially be exploitable for remote code execution.\n\nApplications that process PKCS#7 or S/MIME signed messages using OpenSSL\nPKCS#7 APIs may be affected. Applications using the CMS APIs for this\nprocessing are not affected.\n\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.", "Severity": "HIGH", "CweIDs": [ "CWE-416", "CWE-825" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "julia": 3, "oracle-oval": 2, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:25237", "https://access.redhat.com/errata/RHSA-2026:25239", "https://access.redhat.com/errata/RHSA-2026:26275", "https://access.redhat.com/errata/RHSA-2026:26319", "https://access.redhat.com/errata/RHSA-2026:29197", "https://access.redhat.com/errata/RHSA-2026:34102", "https://access.redhat.com/errata/RHSA-2026:35869", "https://access.redhat.com/errata/RHSA-2026:36215", "https://access.redhat.com/errata/RHSA-2026:36217", "https://access.redhat.com/errata/RHSA-2026:39009", "https://access.redhat.com/errata/RHSA-2026:39012", "https://access.redhat.com/errata/RHSA-2026:39981", "https://access.redhat.com/errata/RHSA-2026:44438", "https://access.redhat.com/errata/RHSA-2026:47735", "https://access.redhat.com/errata/RHSA-2026:47737", "https://access.redhat.com/errata/RHSA-2026:58563", "https://access.redhat.com/errata/RHSA-2026:58981", "https://access.redhat.com/errata/RHSA-2026:59831", "https://access.redhat.com/errata/RHSA-2026:66524", "https://access.redhat.com/security/cve/CVE-2026-45447", "https://bugzilla.redhat.com/2481898", "https://bugzilla.redhat.com/show_bug.cgi?id=2481879", "https://bugzilla.redhat.com/show_bug.cgi?id=2481880", "https://bugzilla.redhat.com/show_bug.cgi?id=2481881", "https://bugzilla.redhat.com/show_bug.cgi?id=2481882", "https://bugzilla.redhat.com/show_bug.cgi?id=2481884", "https://bugzilla.redhat.com/show_bug.cgi?id=2481885", "https://bugzilla.redhat.com/show_bug.cgi?id=2481887", "https://bugzilla.redhat.com/show_bug.cgi?id=2481890", "https://bugzilla.redhat.com/show_bug.cgi?id=2481891", "https://bugzilla.redhat.com/show_bug.cgi?id=2481892", "https://bugzilla.redhat.com/show_bug.cgi?id=2481893", "https://bugzilla.redhat.com/show_bug.cgi?id=2481894", "https://bugzilla.redhat.com/show_bug.cgi?id=2481896", "https://bugzilla.redhat.com/show_bug.cgi?id=2481897", "https://bugzilla.redhat.com/show_bug.cgi?id=2481898", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34180", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34181", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34182", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34183", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42764", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42766", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42767", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42768", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42769", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42770", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45445", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45446", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45447", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-7383", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-9076", "https://errata.almalinux.org/9/ALSA-2026-44438.html", "https://errata.rockylinux.org/RLSA-2026:25239", "https://github.com/advisories/GHSA-f684-cpcq-j565", "https://github.com/openssl/openssl/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c", "https://github.com/openssl/openssl/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8", "https://github.com/openssl/openssl/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54", "https://github.com/openssl/openssl/commit/a541ae8bfe849a30cc885e8780715c0f488e496c", "https://github.com/openssl/openssl/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e", "https://github.com/openssl/security/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c", "https://github.com/openssl/security/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8", "https://github.com/openssl/security/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54", "https://github.com/openssl/security/commit/a541ae8bfe849a30cc885e8780715c0f488e496c", "https://github.com/openssl/security/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e", "https://linux.oracle.com/cve/CVE-2026-45447.html", "https://linux.oracle.com/errata/ELSA-2026-50379.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-45447", "https://openssl-library.org/news/secadv/20260609.txt", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45447.json", "https://ubuntu.com/security/notices/USN-8414-1", "https://ubuntu.com/security/notices/USN-8414-2", "https://www.cve.org/CVERecord?id=CVE-2026-45447" ], "PublishedDate": "2026-06-09T17:17:19.277Z", "LastModifiedDate": "2026-09-18T13:18:26.343Z" }, { "VulnerabilityID": "CVE-2026-11352", "PkgID": "libcurl@8.19.0-r0", "PkgName": "libcurl", "PkgIdentifier": { "PURL": "pkg:apk/alpine/libcurl@8.19.0-r0?arch=x86_64\u0026distro=3.23.4", "UID": "ae99b13d03576e54" }, "InstalledVersion": "8.19.0-r0", "FixedVersion": "8.22.0-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:5519239b187cd3709c07332d1796e87305684dbc91e05de8de1682602b6c3118" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-11352", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:cba15614e0ca3234616ea13fbe577a1736059cd5f120ced00c9cfca7c5a63e47", "Title": "curl: libcurl: curl/libcurl: Remote denial of service via QUIC UDP receive function vulnerability", "Description": "An issue in curl’s QUIC UDP receive function allows a malicious HTTP/3 server\nto trigger a remote denial of service against a curl or libcurl client.\nBecause the helper function discards zero-length UDP datagrams before counting\nthem toward the per-call packet budget, a connected QUIC peer can continuously\nstream empty datagrams to indefinitely stall the client.", "Severity": "HIGH", "CweIDs": [ "CWE-835" ], "VendorSeverity": { "julia": 3, "photon": 3, "redhat": 3, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-11352", "https://curl.se/L7HzKXisfJ/CVE-2026-11352.md", "https://curl.se/docs/CVE-2026-11352.html", "https://curl.se/docs/CVE-2026-11352.json", "https://github.com/advisories/GHSA-qxwx-hr5v-h5q4", "https://hackerone.com/reports/3783438", "https://nvd.nist.gov/vuln/detail/CVE-2026-11352", "https://ubuntu.com/security/notices/USN-8525-1", "https://www.cve.org/CVERecord?id=CVE-2026-11352" ], "PublishedDate": "2026-07-03T07:16:23.693Z", "LastModifiedDate": "2026-09-15T07:16:25.353Z" }, { "VulnerabilityID": "CVE-2026-11586", "PkgID": "libcurl@8.19.0-r0", "PkgName": "libcurl", "PkgIdentifier": { "PURL": "pkg:apk/alpine/libcurl@8.19.0-r0?arch=x86_64\u0026distro=3.23.4", "UID": "ae99b13d03576e54" }, "InstalledVersion": "8.19.0-r0", "FixedVersion": "8.22.0-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:5519239b187cd3709c07332d1796e87305684dbc91e05de8de1682602b6c3118" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-11586", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:4883328129a5ebcd43b1c6279e54aa7d6b61db8cbd13f71b9a7a5120785fd236", "Title": "curl: curl: Denial of Service via WebSocket PING flood", "Description": "By default, curl automatically responds to WebSocket PING frames. Because curl\nlacks an upper bound on memory allocation for unacknowledged frames, a\nmalicious server can exhaust all available memory by flooding curl with rapid,\nsequential PING messages.", "Severity": "HIGH", "CweIDs": [ "CWE-770" ], "VendorSeverity": { "amazon": 2, "julia": 3, "photon": 3, "redhat": 3, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-11586", "https://curl.se/L7HzKXisfJ/CVE-2026-11586.md", "https://curl.se/docs/CVE-2026-11586.html", "https://curl.se/docs/CVE-2026-11586.json", "https://github.com/advisories/GHSA-c68q-h477-5646", "https://hackerone.com/reports/3788931", "https://nvd.nist.gov/vuln/detail/CVE-2026-11586", "https://ubuntu.com/security/notices/USN-8525-1", "https://www.cve.org/CVERecord?id=CVE-2026-11586" ], "PublishedDate": "2026-07-03T07:16:23.883Z", "LastModifiedDate": "2026-09-15T07:16:25.7Z" }, { "VulnerabilityID": "CVE-2026-12064", "PkgID": "libcurl@8.19.0-r0", "PkgName": "libcurl", "PkgIdentifier": { "PURL": "pkg:apk/alpine/libcurl@8.19.0-r0?arch=x86_64\u0026distro=3.23.4", "UID": "ae99b13d03576e54" }, "InstalledVersion": "8.19.0-r0", "FixedVersion": "8.22.0-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:5519239b187cd3709c07332d1796e87305684dbc91e05de8de1682602b6c3118" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-12064", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:257996d91d3bcd4af6de8908409d2db333ac8043789f8b7ba9dc2cc7b21b8075", "Title": "curl: curl: SSH host verification bypass when using schemeless URLs with SFTP/SCP", "Description": "When a user invokes curl using a schemeless URL combined with\n`--proto-default` sftp (or scp), a disconnect occurs between the tool layer\nand libcurl. The tool layer incorrectly infers the URL scheme, which\nerroneously bypasses the initialization of critical SSH security options like\nCURLOPT_SSH_HOST_PUBLIC_KEY_SHA256 and CURLOPT_SSH_KNOWNHOSTS. Conversely, the\nlibcurl runtime successfully honors CURLOPT_DEFAULT_PROTOCOL and establishes\nthe connection via SFTP/SCP as specified. Because the tool layer skipped the\nsecurity configuration, these SSH host verification options are silently\nomitted, causing curl to connect to an unverified SSH remote host without\nthrowing an error.", "Severity": "HIGH", "CweIDs": [ "CWE-297", "CWE-295" ], "VendorSeverity": { "amazon": 2, "azure": 3, "julia": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-12064", "https://curl.se/L7HzKXisfJ/CVE-2026-12064.md", "https://curl.se/docs/CVE-2026-12064.html", "https://curl.se/docs/CVE-2026-12064.json", "https://github.com/advisories/GHSA-jm94-9f7h-36pr", "https://hackerone.com/reports/3797526", "https://linux.oracle.com/cve/CVE-2026-12064.html", "https://linux.oracle.com/errata/ELSA-2026-55450.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-12064", "https://ubuntu.com/security/notices/USN-8525-1", "https://www.cve.org/CVERecord?id=CVE-2026-12064" ], "PublishedDate": "2026-07-03T07:16:24.217Z", "LastModifiedDate": "2026-09-15T07:16:26.15Z" }, { "VulnerabilityID": "CVE-2026-5773", "PkgID": "libcurl@8.19.0-r0", "PkgName": "libcurl", "PkgIdentifier": { "PURL": "pkg:apk/alpine/libcurl@8.19.0-r0?arch=x86_64\u0026distro=3.23.4", "UID": "ae99b13d03576e54" }, "InstalledVersion": "8.19.0-r0", "FixedVersion": "8.20.0-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:5519239b187cd3709c07332d1796e87305684dbc91e05de8de1682602b6c3118" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-5773", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:8a74e56a1fe6fa99244e17f7caa38bbdc05ee5391d8e6c4de6ece5fa17133a0e", "Title": "curl: libcurl: Wrong file transfer due to incorrect SMB connection reuse", "Description": "libcurl might in some circumstances reuse the wrong connection for SMB(S)\ntransfers.\n\nlibcurl features a pool of recent connections so that subsequent requests can\nreuse an existing connection to avoid overhead.\n\nWhen reusing a connection a range of criteria must be met. Due to a logical\nerror in the code, a network transfer operation that was requested by an\napplication could wrongfully reuse an existing SMB connection to the same\nserver that was using a different \"share\" than the new subsequent transfer\nshould.\n\nThis could in unlucky situations lead to the download of the wrong file or the\nupload of a file to the wrong place. When this happens, the same credentials\nare used and the server name is the same.", "Severity": "HIGH", "CweIDs": [ "CWE-488", "CWE-918" ], "VendorSeverity": { "julia": 3, "nvd": 3, "photon": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "V3Score": 6.5 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/04/29/9", "https://access.redhat.com/security/cve/CVE-2026-5773", "https://curl.se/docs/CVE-2026-5773.html", "https://curl.se/docs/CVE-2026-5773.json", "https://github.com/advisories/GHSA-rp9q-8q5w-ch44", "https://hackerone.com/reports/3650689", "https://nvd.nist.gov/vuln/detail/CVE-2026-5773", "https://ubuntu.com/security/notices/USN-8227-1", "https://ubuntu.com/security/notices/USN-8525-1", "https://www.cve.org/CVERecord?id=CVE-2026-5773" ], "PublishedDate": "2026-05-13T13:01:56.307Z", "LastModifiedDate": "2026-09-15T07:16:28.82Z" }, { "VulnerabilityID": "CVE-2026-6276", "PkgID": "libcurl@8.19.0-r0", "PkgName": "libcurl", "PkgIdentifier": { "PURL": "pkg:apk/alpine/libcurl@8.19.0-r0?arch=x86_64\u0026distro=3.23.4", "UID": "ae99b13d03576e54" }, "InstalledVersion": "8.19.0-r0", "FixedVersion": "8.20.0-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:5519239b187cd3709c07332d1796e87305684dbc91e05de8de1682602b6c3118" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-6276", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:794c5cdab0a769def8c3880dfa2dd1a836b793bea962a4d51a1c8a2fd47a9a0e", "Title": "curl: libcurl: Information disclosure due to cookie leak when reusing connections with custom Host headers", "Description": "Using libcurl, when a custom `Host:` header is first set for an HTTP request\nand a second request is subsequently done using the same *easy handle* but\nwithout the custom `Host:` header set, the second request would use stale\ninformation and pass on cookies meant for the first host in the second\nrequest. Leak them.", "Severity": "HIGH", "CweIDs": [ "CWE-346", "CWE-319" ], "VendorSeverity": { "azure": 2, "julia": 3, "nvd": 3, "photon": 3, "redhat": 1, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "V3Score": 3.7 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/04/29/13", "https://access.redhat.com/security/cve/CVE-2026-6276", "https://curl.se/docs/CVE-2026-6276.html", "https://curl.se/docs/CVE-2026-6276.json", "https://github.com/advisories/GHSA-2jc6-hc33-hv48", "https://hackerone.com/reports/3671818", "https://nvd.nist.gov/vuln/detail/CVE-2026-6276", "https://ubuntu.com/security/notices/USN-8227-1", "https://www.cve.org/CVERecord?id=CVE-2026-6276" ], "PublishedDate": "2026-05-13T13:01:56.8Z", "LastModifiedDate": "2026-09-15T07:16:29.343Z" }, { "VulnerabilityID": "CVE-2026-8286", "PkgID": "libcurl@8.19.0-r0", "PkgName": "libcurl", "PkgIdentifier": { "PURL": "pkg:apk/alpine/libcurl@8.19.0-r0?arch=x86_64\u0026distro=3.23.4", "UID": "ae99b13d03576e54" }, "InstalledVersion": "8.19.0-r0", "FixedVersion": "8.22.0-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:5519239b187cd3709c07332d1796e87305684dbc91e05de8de1682602b6c3118" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-8286", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:34757534f7b8df55f46d31524f8e5bd490b0b087023c0aba2523a30813194766", "Title": "curl: curl: Insecure connection establishment due to TLS configuration mismatch", "Description": "A vulnerability exists where a new transfer that uses STARTTLS to upgrade the\nconnection might reuse an existing live connection even though the TLS\nconfiguration mismatches so it should not.", "Severity": "HIGH", "CweIDs": [ "CWE-295" ], "VendorSeverity": { "alma": 3, "amazon": 2, "azure": 3, "julia": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "V3Score": 8.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:55439", "https://access.redhat.com/security/cve/CVE-2026-8286", "https://bugzilla.redhat.com/2446448", "https://bugzilla.redhat.com/2446450", "https://bugzilla.redhat.com/2496758", "https://bugzilla.redhat.com/2496763", "https://bugzilla.redhat.com/show_bug.cgi?id=2446448", "https://bugzilla.redhat.com/show_bug.cgi?id=2446450", "https://bugzilla.redhat.com/show_bug.cgi?id=2496758", "https://bugzilla.redhat.com/show_bug.cgi?id=2496763", "https://creativecommons.org/licenses/by/4.0/", "https://curl.se/L7HzKXisfJ/CVE-2026-8286.md", "https://curl.se/docs/CVE-2026-8286.html", "https://curl.se/docs/CVE-2026-8286.json", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-1965", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-3783", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8286", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-9547", "https://errata.almalinux.org/9/ALSA-2026-55439.html", "https://errata.rockylinux.org/RLSA-2026:55439", "https://github.com/advisories/GHSA-32xh-3x3c-6g6h", "https://hackerone.com/reports/3718195", "https://linux.oracle.com/cve/CVE-2026-8286.html", "https://linux.oracle.com/errata/ELSA-2026-57462.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-8286", "https://ubuntu.com/security/notices/USN-8487-1", "https://www.cve.org/CVERecord?id=CVE-2026-8286" ], "PublishedDate": "2026-07-03T07:16:24.453Z", "LastModifiedDate": "2026-09-15T07:16:31.617Z" }, { "VulnerabilityID": "CVE-2026-8458", "PkgID": "libcurl@8.19.0-r0", "PkgName": "libcurl", "PkgIdentifier": { "PURL": "pkg:apk/alpine/libcurl@8.19.0-r0?arch=x86_64\u0026distro=3.23.4", "UID": "ae99b13d03576e54" }, "InstalledVersion": "8.19.0-r0", "FixedVersion": "8.22.0-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:5519239b187cd3709c07332d1796e87305684dbc91e05de8de1682602b6c3118" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-8458", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:abe64bc14c7d87100d7d35e44860771c815eeb531060b2389f02910034d47283", "Title": "curl: libcurl: Unauthorized connection reuse due to a logical error", "Description": "libcurl might in some circumstances reuse the wrong connection when asked to\ndo Negotiate-authenticated ones, even when they are set to use different\n\"services\".\n\nlibcurl features a pool of recent connections so that subsequent requests can\nreuse an existing connection to avoid overhead.\n\nWhen reusing a connection a range of criteria must be met. Due to a logical\nerror in the code, a request that was issued by an application could\nwrongfully reuse an existing connection to the same server that was\nauthenticated using different services.", "Severity": "HIGH", "CweIDs": [ "CWE-488" ], "VendorSeverity": { "alma": 3, "amazon": 2, "azure": 2, "julia": 2, "oracle-oval": 3, "photon": 2, "redhat": 3, "rocky": 3, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "V3Score": 6.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:69126", "https://access.redhat.com/security/cve/CVE-2026-8458", "https://bugzilla.redhat.com/2496764", "https://bugzilla.redhat.com/2496769", "https://bugzilla.redhat.com/show_bug.cgi?id=2496764", "https://bugzilla.redhat.com/show_bug.cgi?id=2496769", "https://creativecommons.org/licenses/by/4.0/", "https://curl.se/L7HzKXisfJ/CVE-2026-8458.md", "https://curl.se/docs/CVE-2026-8458.html", "https://curl.se/docs/CVE-2026-8458.json", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8458", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8927", "https://errata.almalinux.org/9/ALSA-2026-69126.html", "https://errata.rockylinux.org/RLSA-2026:69126", "https://github.com/advisories/GHSA-88c6-6jfq-mm4q", "https://hackerone.com/reports/3721183", "https://linux.oracle.com/cve/CVE-2026-8458.html", "https://linux.oracle.com/errata/ELSA-2026-92368.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-8458", "https://ubuntu.com/security/notices/USN-8487-1", "https://www.cve.org/CVERecord?id=CVE-2026-8458" ], "PublishedDate": "2026-07-03T07:16:24.63Z", "LastModifiedDate": "2026-09-15T07:16:32.327Z" }, { "VulnerabilityID": "CVE-2026-8925", "PkgID": "libcurl@8.19.0-r0", "PkgName": "libcurl", "PkgIdentifier": { "PURL": "pkg:apk/alpine/libcurl@8.19.0-r0?arch=x86_64\u0026distro=3.23.4", "UID": "ae99b13d03576e54" }, "InstalledVersion": "8.19.0-r0", "FixedVersion": "8.22.0-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:5519239b187cd3709c07332d1796e87305684dbc91e05de8de1682602b6c3118" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-8925", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:4e08e813a5c55d752ffdcd3a51196ae5c90ce290de624521c0dd8a3ca7542408", "Title": "curl: curl: Double-free vulnerability in SASL authentication", "Description": "The curl logic that works with SASL authentication could end up cleaning up\nthe GSASL context *twice* without clearing the pointer in between, making it\n`free()` the same pointer twice.", "Severity": "HIGH", "CweIDs": [ "CWE-415" ], "VendorSeverity": { "amazon": 2, "julia": 4, "photon": 4, "redhat": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 9.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-8925", "https://curl.se/L7HzKXisfJ/CVE-2026-8925.md", "https://curl.se/docs/CVE-2026-8925.html", "https://curl.se/docs/CVE-2026-8925.json", "https://github.com/advisories/GHSA-p8x5-c6c9-8cwx", "https://hackerone.com/reports/3735193", "https://nvd.nist.gov/vuln/detail/CVE-2026-8925", "https://ubuntu.com/security/notices/USN-8487-1", "https://www.cve.org/CVERecord?id=CVE-2026-8925" ], "PublishedDate": "2026-07-03T07:16:24.95Z", "LastModifiedDate": "2026-09-15T07:16:32.8Z" }, { "VulnerabilityID": "CVE-2026-8927", "PkgID": "libcurl@8.19.0-r0", "PkgName": "libcurl", "PkgIdentifier": { "PURL": "pkg:apk/alpine/libcurl@8.19.0-r0?arch=x86_64\u0026distro=3.23.4", "UID": "ae99b13d03576e54" }, "InstalledVersion": "8.19.0-r0", "FixedVersion": "8.22.0-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:5519239b187cd3709c07332d1796e87305684dbc91e05de8de1682602b6c3118" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-8927", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:36f46c303827615ff0fad78c31da940c37a38db676c15aa072624e8a44796541", "Title": "curl: Information disclosure due to uncleared proxy authentication state", "Description": "When reusing a libcurl handle for sequential transfers driven by\nenvironment-variable proxy configuration, libcurl fails to clear the proxy\nauthentication state between requests. Specifically, if the initial transfer\nauthenticates against `proxyA` using Digest auth, a subsequent transfer routed\nthrough `proxyB` erroneously leaks the `Proxy-Authorization:` header intended\nsolely for `proxyA`.", "Severity": "HIGH", "CweIDs": [ "CWE-294" ], "VendorSeverity": { "alma": 3, "amazon": 2, "azure": 2, "julia": 4, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "V3Score": 9.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:69126", "https://access.redhat.com/security/cve/CVE-2026-8927", "https://bugzilla.redhat.com/2496764", "https://bugzilla.redhat.com/2496769", "https://bugzilla.redhat.com/show_bug.cgi?id=2496764", "https://bugzilla.redhat.com/show_bug.cgi?id=2496769", "https://creativecommons.org/licenses/by/4.0/", "https://curl.se/L7HzKXisfJ/CVE-2026-8927.md", "https://curl.se/docs/CVE-2026-8927.html", "https://curl.se/docs/CVE-2026-8927.json", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8458", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8927", "https://errata.almalinux.org/9/ALSA-2026-69126.html", "https://errata.rockylinux.org/RLSA-2026:69126", "https://github.com/advisories/GHSA-jr4f-4564-w3mr", "https://hackerone.com/reports/3744543", "https://linux.oracle.com/cve/CVE-2026-8927.html", "https://linux.oracle.com/errata/ELSA-2026-92368.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-8927", "https://ubuntu.com/security/notices/USN-8487-1", "https://ubuntu.com/security/notices/USN-8820-1", "https://www.cve.org/CVERecord?id=CVE-2026-8927" ], "PublishedDate": "2026-07-03T07:16:25.123Z", "LastModifiedDate": "2026-09-15T07:16:33.157Z" }, { "VulnerabilityID": "CVE-2026-92392", "PkgID": "libcurl@8.19.0-r0", "PkgName": "libcurl", "PkgIdentifier": { "PURL": "pkg:apk/alpine/libcurl@8.19.0-r0?arch=x86_64\u0026distro=3.23.4", "UID": "ae99b13d03576e54" }, "InstalledVersion": "8.19.0-r0", "FixedVersion": "8.23.0-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:5519239b187cd3709c07332d1796e87305684dbc91e05de8de1682602b6c3118" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-92392", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:21a6469abf0058ad3159c926d50f7920b841ea17c541973c02062e9d066de5b2", "Title": "curl: curl: HTTP/2 upload Use-After-Free", "Description": "During an upload, curl mishandles HTTP/2 `RST_STREAM` received from the server\n(with reason `HTTP_1_1_REQUIRED` or `REFUSED_STREAM`) leading to a use after\nfree of a `struct Curl_easy` object.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "amazon": 3, "redhat": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/10/18/5", "http://www.openwall.com/lists/oss-security/2026/10/18/6", "https://access.redhat.com/security/cve/CVE-2026-92392", "https://curl.se/docs/CVE-2026-92392.html", "https://curl.se/docs/CVE-2026-92392.json", "https://hackerone.com/reports/4030333", "https://nvd.nist.gov/vuln/detail/CVE-2026-92392", "https://ubuntu.com/security/notices/USN-8927-1", "https://ubuntu.com/security/notices/USN-8927-2", "https://www.cve.org/CVERecord?id=CVE-2026-92392" ], "PublishedDate": "2026-10-14T08:17:05.997Z", "LastModifiedDate": "2026-10-18T23:16:57.163Z" }, { "VulnerabilityID": "CVE-2026-9547", "PkgID": "libcurl@8.19.0-r0", "PkgName": "libcurl", "PkgIdentifier": { "PURL": "pkg:apk/alpine/libcurl@8.19.0-r0?arch=x86_64\u0026distro=3.23.4", "UID": "ae99b13d03576e54" }, "InstalledVersion": "8.19.0-r0", "FixedVersion": "8.22.0-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:5519239b187cd3709c07332d1796e87305684dbc91e05de8de1682602b6c3118" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-9547", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:f1d34d83b290882d7dd1037bcc80e3009e034e42a1d121c827f3a3678376c009", "Title": "curl: curl: Man-in-the-middle attack via SSH host key bypass", "Description": "When a libcurl-based application performs transfers via `SCP://` or `SFTP://`\nand utilizes the `CURLOPT_SSH_KEYFUNCTION` callback, it may silently accept an\nuntrusted server. This vulnerability occurs when a server presents a host key\ntype that does not match the specific key type already recorded for that host\nin the `known_hosts` file. Instead of rejecting the mismatch, the callback\nmechanism fails to properly enforce the restriction, allowing the connection\nto succeed without warning and risking a potential man-in-the-middle attack.", "Severity": "HIGH", "CweIDs": [ "CWE-297" ], "VendorSeverity": { "alma": 3, "amazon": 2, "julia": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "V3Score": 7.4 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "V3Score": 7.4 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:55439", "https://access.redhat.com/security/cve/CVE-2026-9547", "https://bugzilla.redhat.com/2446448", "https://bugzilla.redhat.com/2446450", "https://bugzilla.redhat.com/2496758", "https://bugzilla.redhat.com/2496763", "https://bugzilla.redhat.com/show_bug.cgi?id=2446448", "https://bugzilla.redhat.com/show_bug.cgi?id=2446450", "https://bugzilla.redhat.com/show_bug.cgi?id=2496758", "https://bugzilla.redhat.com/show_bug.cgi?id=2496763", "https://creativecommons.org/licenses/by/4.0/", "https://curl.se/L7HzKXisfJ/CVE-2026-9547.md", "https://curl.se/docs/CVE-2026-9547.html", "https://curl.se/docs/CVE-2026-9547.json", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-1965", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-3783", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8286", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-9547", "https://errata.almalinux.org/9/ALSA-2026-55439.html", "https://errata.rockylinux.org/RLSA-2026:55439", "https://github.com/advisories/GHSA-xq9p-gxg6-f7q6", "https://hackerone.com/reports/3751712", "https://linux.oracle.com/cve/CVE-2026-9547.html", "https://linux.oracle.com/errata/ELSA-2026-55450.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-9547", "https://ubuntu.com/security/notices/USN-8487-1", "https://www.cve.org/CVERecord?id=CVE-2026-9547" ], "PublishedDate": "2026-07-03T07:16:25.99Z", "LastModifiedDate": "2026-09-15T07:16:35.31Z" }, { "VulnerabilityID": "CVE-2026-113351", "PkgID": "libexpat@2.7.5-r0", "PkgName": "libexpat", "PkgIdentifier": { "PURL": "pkg:apk/alpine/libexpat@2.7.5-r0?arch=x86_64\u0026distro=3.23.4", "UID": "28e722d1da61bc2e" }, "InstalledVersion": "2.7.5-r0", "FixedVersion": "2.10.0-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:5519239b187cd3709c07332d1796e87305684dbc91e05de8de1682602b6c3118" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-113351", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:84156a2a147424b8cc29486d9815a4ff34b174f7342912e1e2acf286b111377f", "Title": "expat: expat: Denial of Service via improper memory tracking in XML_ParserReset", "Description": "libexpat 2.7.2 through 2.9.0 contains a denial of service vulnerability because XML_ParserReset zeroes the direct byte count but never offsets tracked heap allocations. Attackers can submit a large XML document so later documents on the same reset parser fail with XML_ERROR_NO_MEMORY until it is recreated.", "Severity": "HIGH", "CweIDs": [ "CWE-909" ], "VendorSeverity": { "nvd": 3, "redhat": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.9 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-113351", "https://github.com/libexpat/libexpat", "https://github.com/libexpat/libexpat/blob/a76b1174c1ea52abb639a4c69d52b630a8a106a2/expat/lib/xmlparse.c#L1560", "https://github.com/libexpat/libexpat/blob/a76b1174c1ea52abb639a4c69d52b630a8a106a2/expat/lib/xmlparse.c#L860-L884", "https://github.com/libexpat/libexpat/pull/1431", "https://nvd.nist.gov/vuln/detail/CVE-2026-113351", "https://www.cve.org/CVERecord?id=CVE-2026-113351", "https://www.vulncheck.com/advisories/libexpat-2.7.2-through-2.9.0-denial-of-service-via-xml-parserreset" ], "PublishedDate": "2026-10-20T11:17:19.363Z", "LastModifiedDate": "2026-11-03T21:26:47.25Z" }, { "VulnerabilityID": "CVE-2026-115506", "PkgID": "libexpat@2.7.5-r0", "PkgName": "libexpat", "PkgIdentifier": { "PURL": "pkg:apk/alpine/libexpat@2.7.5-r0?arch=x86_64\u0026distro=3.23.4", "UID": "28e722d1da61bc2e" }, "InstalledVersion": "2.7.5-r0", "FixedVersion": "2.10.0-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:5519239b187cd3709c07332d1796e87305684dbc91e05de8de1682602b6c3118" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-115506", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:52bd29cfdc96814f3fc54c9547cf56c1402692110a36b6174d0d3970e5c36ddd", "Title": "expat: expat: Denial of Service via delayed entity amplification detection", "Description": "libexpat through 2.9.0 contains a denial of service vulnerability because billion laughs protection in accountingDiffTolerated() in xmlparse.c detects entity amplification too late. Attackers can supply a moderately sized XML document with a large DTD and nested entity expansions to consume tens of seconds of CPU per parse.", "Severity": "HIGH", "CweIDs": [ "CWE-776" ], "VendorSeverity": { "photon": 3, "redhat": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-115506", "https://github.com/hannob/lololol", "https://github.com/libexpat/libexpat", "https://github.com/libexpat/libexpat/issues/1160", "https://github.com/libexpat/libexpat/pull/1433", "https://nvd.nist.gov/vuln/detail/CVE-2026-115506", "https://www.cve.org/CVERecord?id=CVE-2026-115506", "https://www.vulncheck.com/advisories/libexpat-through-2.9.0-denial-of-service-via-billion-laughs-detection-delay" ], "PublishedDate": "2026-10-22T20:17:06.62Z", "LastModifiedDate": "2026-11-02T18:27:06.127Z" }, { "VulnerabilityID": "CVE-2026-117610", "PkgID": "libexpat@2.7.5-r0", "PkgName": "libexpat", "PkgIdentifier": { "PURL": "pkg:apk/alpine/libexpat@2.7.5-r0?arch=x86_64\u0026distro=3.23.4", "UID": "28e722d1da61bc2e" }, "InstalledVersion": "2.7.5-r0", "FixedVersion": "2.10.0-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:5519239b187cd3709c07332d1796e87305684dbc91e05de8de1682602b6c3118" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-117610", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:933f462b036b12b7f6409ea02283eb14d4f40a18c30be1b9837157d16b177207", "Title": "expat: expat: Denial of Service via NULL pointer dereference in external entity parsing", "Description": "libexpat through 2.9.0 contains a NULL pointer dereference vulnerability in externalEntityInitProcessor2() in lib/xmlparse.c that mishandles the XML_TOK_NONE token from empty input. Attackers who control stream chunking can force an empty non-final first parse on an external entity subparser, causing a later parse to crash the application.", "Severity": "HIGH", "CweIDs": [ "CWE-476" ], "VendorSeverity": { "nvd": 3, "redhat": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.9 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-117610", "https://github.com/libexpat/libexpat", "https://github.com/libexpat/libexpat/blob/a76b1174c1ea52abb639a4c69d52b630a8a106a2/expat/lib/xmlparse.c#L3468-L3510", "https://github.com/libexpat/libexpat/commit/7b0d50e4b1d16fafd55876260701e04279a7489d", "https://github.com/libexpat/libexpat/pull/1444", "https://nvd.nist.gov/vuln/detail/CVE-2026-117610", "https://www.cve.org/CVERecord?id=CVE-2026-117610", "https://www.vulncheck.com/advisories/libexpat-through-2.9.0-null-pointer-dereference-via-external-entity-subparser" ], "PublishedDate": "2026-10-28T03:17:12.777Z", "LastModifiedDate": "2026-11-05T16:17:35.787Z" }, { "VulnerabilityID": "CVE-2026-118370", "PkgID": "libexpat@2.7.5-r0", "PkgName": "libexpat", "PkgIdentifier": { "PURL": "pkg:apk/alpine/libexpat@2.7.5-r0?arch=x86_64\u0026distro=3.23.4", "UID": "28e722d1da61bc2e" }, "InstalledVersion": "2.7.5-r0", "FixedVersion": "2.10.0-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:5519239b187cd3709c07332d1796e87305684dbc91e05de8de1682602b6c3118" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-118370", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:1816535ce457888b6318c8a09bdc70a11268bc21036ff3afeb977d4caff87de8", "Title": "expat: expat: Denial of Service via integer overflow during XML attribute parsing", "Description": "libexpat through 2.9.0 contains a signed integer overflow vulnerability in storeAtts() in lib/xmlparse.c that allows attackers to trigger out-of-bounds writes via oversized attribute counts. Attackers can supply a multi-gigabyte document with a start tag carrying over 2^30 attributes to overflow attIndex and nPrefixes, crashing applications or corrupting heap memory.", "Severity": "HIGH", "CweIDs": [ "CWE-190" ], "VendorSeverity": { "nvd": 3, "redhat": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H", "V3Score": 8.2 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.9 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-118370", "https://github.com/libexpat/libexpat", "https://github.com/libexpat/libexpat/blob/a76b1174c1ea52abb639a4c69d52b630a8a106a2/expat/lib/xmlparse.c#L4138-L4140", "https://github.com/libexpat/libexpat/commit/1bac53c4fc460a03cd9860f39501c7979f6750ae", "https://github.com/libexpat/libexpat/commit/621cb2c78b253ee023a86bc91d6ddb048481c04c", "https://github.com/libexpat/libexpat/pull/1450", "https://nvd.nist.gov/vuln/detail/CVE-2026-118370", "https://www.cve.org/CVERecord?id=CVE-2026-118370", "https://www.vulncheck.com/advisories/libexpat-through-2.9.0-integer-overflow-in-storeatts-via-attindex-and-nprefixes" ], "PublishedDate": "2026-10-28T03:17:13.293Z", "LastModifiedDate": "2026-11-02T20:17:37.377Z" }, { "VulnerabilityID": "CVE-2026-45186", "PkgID": "libexpat@2.7.5-r0", "PkgName": "libexpat", "PkgIdentifier": { "PURL": "pkg:apk/alpine/libexpat@2.7.5-r0?arch=x86_64\u0026distro=3.23.4", "UID": "28e722d1da61bc2e" }, "InstalledVersion": "2.7.5-r0", "FixedVersion": "2.8.1-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:5519239b187cd3709c07332d1796e87305684dbc91e05de8de1682602b6c3118" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-45186", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:908c67cfa9d71ed1f3c87ebbe4866a16f4cd073cca21b2ea33b96bc4da7d3dd8", "Title": "libexpat: denial of service via crafted XML input", "Description": "In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial of service via moderately sized crafted XML input.", "Severity": "HIGH", "CweIDs": [ "CWE-407" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 1, "julia": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/05/11/16", "https://access.redhat.com/errata/RHSA-2026:22715", "https://access.redhat.com/errata/RHSA-2026:22721", "https://access.redhat.com/errata/RHSA-2026:23230", "https://access.redhat.com/errata/RHSA-2026:26319", "https://access.redhat.com/errata/RHSA-2026:27201", "https://access.redhat.com/errata/RHSA-2026:29197", "https://access.redhat.com/errata/RHSA-2026:58981", "https://access.redhat.com/errata/RHSA-2026:93443", "https://access.redhat.com/security/cve/CVE-2026-45186", "https://bugzilla.redhat.com/2468575", "https://bugzilla.redhat.com/2550393", "https://bugzilla.redhat.com/2550394", "https://bugzilla.redhat.com/2550396", "https://bugzilla.redhat.com/2550397", "https://bugzilla.redhat.com/2550400", "https://bugzilla.redhat.com/2550401", "https://bugzilla.redhat.com/2550403", "https://bugzilla.redhat.com/2550404", "https://bugzilla.redhat.com/2550405", "https://bugzilla.redhat.com/2550406", "https://bugzilla.redhat.com/2550408", "https://bugzilla.redhat.com/2550410", "https://bugzilla.redhat.com/2550411", "https://bugzilla.redhat.com/2550412", "https://bugzilla.redhat.com/2550413", "https://bugzilla.redhat.com/2550417", "https://bugzilla.redhat.com/2550418", "https://bugzilla.redhat.com/2550419", "https://bugzilla.redhat.com/2550420", "https://bugzilla.redhat.com/2550421", "https://bugzilla.redhat.com/2550422", "https://bugzilla.redhat.com/2550424", "https://bugzilla.redhat.com/2550425", "https://bugzilla.redhat.com/2550426", "https://bugzilla.redhat.com/2550428", "https://bugzilla.redhat.com/2550429", "https://bugzilla.redhat.com/2550430", "https://bugzilla.redhat.com/2550431", "https://bugzilla.redhat.com/2550432", "https://bugzilla.redhat.com/2550433", "https://bugzilla.redhat.com/2550434", "https://bugzilla.redhat.com/2550436", "https://bugzilla.redhat.com/2550438", "https://bugzilla.redhat.com/2550440", "https://bugzilla.redhat.com/2550442", "https://bugzilla.redhat.com/2550444", "https://bugzilla.redhat.com/2550446", "https://bugzilla.redhat.com/2550450", "https://bugzilla.redhat.com/2550451", "https://bugzilla.redhat.com/2550452", "https://bugzilla.redhat.com/2550454", "https://bugzilla.redhat.com/2550455", "https://bugzilla.redhat.com/2550458", "https://bugzilla.redhat.com/2550459", "https://bugzilla.redhat.com/2550461", "https://bugzilla.redhat.com/2550463", "https://bugzilla.redhat.com/2550464", "https://bugzilla.redhat.com/2550465", "https://bugzilla.redhat.com/2550467", "https://bugzilla.redhat.com/2550468", "https://bugzilla.redhat.com/2550469", "https://bugzilla.redhat.com/2550470", "https://bugzilla.redhat.com/2550471", "https://bugzilla.redhat.com/2550472", "https://bugzilla.redhat.com/2550473", "https://bugzilla.redhat.com/2550474", "https://bugzilla.redhat.com/2550475", "https://bugzilla.redhat.com/2550476", "https://bugzilla.redhat.com/2550477", "https://bugzilla.redhat.com/2550478", "https://bugzilla.redhat.com/2550480", "https://bugzilla.redhat.com/show_bug.cgi?id=2468575", "https://cert-portal.siemens.com/productcert/html/ssa-082556.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45186", "https://errata.almalinux.org/9/ALSA-2026-93443.html", "https://errata.rockylinux.org/RLSA-2026:23230", "https://github.com/libexpat/libexpat/pull/1216", "https://linux.oracle.com/cve/CVE-2026-45186.html", "https://linux.oracle.com/errata/ELSA-2026-93443.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-45186", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45186.json", "https://ubuntu.com/security/notices/USN-8790-1", "https://www.cve.org/CVERecord?id=CVE-2026-45186" ], "PublishedDate": "2026-05-10T07:16:07.883Z", "LastModifiedDate": "2026-09-16T13:17:58.967Z" }, { "VulnerabilityID": "CVE-2026-66046", "PkgID": "libexpat@2.7.5-r0", "PkgName": "libexpat", "PkgIdentifier": { "PURL": "pkg:apk/alpine/libexpat@2.7.5-r0?arch=x86_64\u0026distro=3.23.4", "UID": "28e722d1da61bc2e" }, "InstalledVersion": "2.7.5-r0", "FixedVersion": "2.8.4-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:5519239b187cd3709c07332d1796e87305684dbc91e05de8de1682602b6c3118" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-66046", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:441ba2d2ed3767443d04e501a29f8eab8a2c04ba88949d63f1506d57afc54d56", "Title": "expat: Expat: Denial of Service via quadratic complexity in attribute processing", "Description": "Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts() function in xmlparse.c, where processing N specified attributes with non-normalized values triggers an O(N^2) linear scan of elementType-\u003edefaultAtts to determine CDATA status. A remote unauthenticated attacker can supply a single well-formed XML document of a few megabytes to an application parsing untrusted XML to cause excessive CPU consumption, resulting in denial of service without requiring authentication, external entity resolution, or non-default parser options.", "Severity": "HIGH", "CweIDs": [ "CWE-407" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:72663", "https://access.redhat.com/security/cve/CVE-2026-66046", "https://bugzilla.redhat.com/2538967", "https://bugzilla.redhat.com/show_bug.cgi?id=2517901", "https://bugzilla.redhat.com/show_bug.cgi?id=2538967", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-66046", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93990", "https://errata.almalinux.org/9/ALSA-2026-72663.html", "https://errata.rockylinux.org/RLSA-2026:72663", "https://github.com/libexpat/libexpat/pull/1321", "https://linux.oracle.com/cve/CVE-2026-66046.html", "https://linux.oracle.com/errata/ELSA-2026-74001.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-66046", "https://ubuntu.com/security/notices/USN-8813-1", "https://www.cve.org/CVERecord?id=CVE-2026-66046", "https://www.vulncheck.com/advisories/expat-denial-of-service-via-storeatts-quadratic-complexity" ], "PublishedDate": "2026-08-18T15:16:57Z", "LastModifiedDate": "2026-10-22T22:10:00.25Z" }, { "VulnerabilityID": "CVE-2026-76641", "PkgID": "libexpat@2.7.5-r0", "PkgName": "libexpat", "PkgIdentifier": { "PURL": "pkg:apk/alpine/libexpat@2.7.5-r0?arch=x86_64\u0026distro=3.23.4", "UID": "28e722d1da61bc2e" }, "InstalledVersion": "2.7.5-r0", "FixedVersion": "2.8.4-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:5519239b187cd3709c07332d1796e87305684dbc91e05de8de1682602b6c3118" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-76641", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:24ef57dc1dfa9a8fc815f6f445f179ee0615e3685f5eda49e7b086a9321b0f96", "Title": "expat: Expat: Denial of Service via XML external entity parsing", "Description": "Expat through 2.8.3 contains an out-of-bounds read vulnerability that allows attackers to trigger memory corruption by processing XML with external entity parsers created via XML_ExternalEntityParserCreate. A struct size mismatch between ELEMENT_TYPE members causes storeAtts to read the attIndex member past allocated memory boundaries, resulting in failure to normalize whitespace in non-CDATA attributes or a wild pointer dereference causing a segfault. This vulnerability was introduced by the fix for CVE-2026-66046.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "azure": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-76641", "https://github.com/libexpat/libexpat/commit/98599f6dcc2b460410881fe420f5f55d6bec63bf", "https://github.com/libexpat/libexpat/pull/1331", "https://nvd.nist.gov/vuln/detail/CVE-2026-76641", "https://ubuntu.com/security/notices/USN-8813-1", "https://www.cve.org/CVERecord?id=CVE-2026-76641", "https://www.vulncheck.com/advisories/expat-out-of-bounds-read-via-dtdcopy" ], "PublishedDate": "2026-08-20T18:16:51.887Z", "LastModifiedDate": "2026-10-26T10:10:00.14Z" }, { "VulnerabilityID": "CVE-2026-76956", "PkgID": "libexpat@2.7.5-r0", "PkgName": "libexpat", "PkgIdentifier": { "PURL": "pkg:apk/alpine/libexpat@2.7.5-r0?arch=x86_64\u0026distro=3.23.4", "UID": "28e722d1da61bc2e" }, "InstalledVersion": "2.7.5-r0", "FixedVersion": "2.8.4-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:5519239b187cd3709c07332d1796e87305684dbc91e05de8de1682602b6c3118" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-76956", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:e964f7f01facf5001da1794907bf7e92c780d9682c8b405fec21390ae8abfc91", "Title": "libexpat: libexpat: Denial of Service via hash flooding attack with crafted XML", "Description": "In libexpat 2.8.2 and 2.8.3 before 2.8.4, misinterpretation of getentropy's return code leads to insufficient entropy, which results in being vulnerable to hash flooding attacks, causing a denial of service via crafted XML content.", "Severity": "HIGH", "CweIDs": [ "CWE-394" ], "VendorSeverity": { "azure": 2, "nvd": 3, "redhat": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.9 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-76956", "https://github.com/libexpat/libexpat/pull/1326", "https://github.com/libexpat/libexpat/pull/1329", "https://nvd.nist.gov/vuln/detail/CVE-2026-76956", "https://www.cve.org/CVERecord?id=CVE-2026-76956" ], "PublishedDate": "2026-08-20T05:16:29.61Z", "LastModifiedDate": "2026-09-08T21:08:20.697Z" }, { "VulnerabilityID": "CVE-2026-76957", "PkgID": "libexpat@2.7.5-r0", "PkgName": "libexpat", "PkgIdentifier": { "PURL": "pkg:apk/alpine/libexpat@2.7.5-r0?arch=x86_64\u0026distro=3.23.4", "UID": "28e722d1da61bc2e" }, "InstalledVersion": "2.7.5-r0", "FixedVersion": "2.8.4-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:5519239b187cd3709c07332d1796e87305684dbc91e05de8de1682602b6c3118" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-76957", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:9e3449857cc8eadf42e2a630fd121afed510a6c906cd9089e7ab1f231b3c0894", "Title": "libexpat: libexpat: Memory corruption vulnerability allows arbitrary code execution or denial of service", "Description": "libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. Thus, a use-after-free can occur. NOTE: this is similar to CVE-2026-50219, CVE-2026-56131 and CVE-2026-56412.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "amazon": 3, "azure": 2, "nvd": 3, "photon": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L", "V3Score": 4.9 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-76957", "https://github.com/libexpat/libexpat/pull/1322", "https://github.com/libexpat/libexpat/pull/1329", "https://nvd.nist.gov/vuln/detail/CVE-2026-76957", "https://ubuntu.com/security/notices/USN-8813-1", "https://www.cve.org/CVERecord?id=CVE-2026-76957" ], "PublishedDate": "2026-08-20T05:16:29.747Z", "LastModifiedDate": "2026-09-08T20:56:31.86Z" }, { "VulnerabilityID": "CVE-2026-77214", "PkgID": "libexpat@2.7.5-r0", "PkgName": "libexpat", "PkgIdentifier": { "PURL": "pkg:apk/alpine/libexpat@2.7.5-r0?arch=x86_64\u0026distro=3.23.4", "UID": "28e722d1da61bc2e" }, "InstalledVersion": "2.7.5-r0", "FixedVersion": "2.9.0-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:5519239b187cd3709c07332d1796e87305684dbc91e05de8de1682602b6c3118" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-77214", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:e4d518159270c42d9dcce251e63f2f11407bf55feaae7b77db1491f2dcb71146", "Title": "expat: expat: Information disclosure via heap buffer over-read in XML_ParseBuffer", "Description": "libexpat before commit 13c5f63 contains a heap buffer over-read vulnerability in xmlparse.c. XML_ParseBuffer advances the parse buffer end with parser-\u003em_bufferEnd += len using a caller-supplied length that is not validated against the allocated buffer size, so repeated XML_ParseBuffer calls move m_bufferEnd past the end of the heap allocation and subsequent parsing reads out of bounds. Reaching this path requires a parse buffer to already be present; otherwise XML_ParseBuffer returns XML_ERROR_NO_BUFFER. A buffer is present after a prior call to XML_GetBuffer, either directly (the common case) or indirectly through a prior XML_Parse call that allocates the buffer internally. The over-read discloses adjacent heap memory to the calling application, recovering heap pointers, libc function pointers, and code pointers sufficient to defeat ASLR and build further exploitation primitives.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "alma": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L", "V3Score": 8.2 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:88247", "https://access.redhat.com/security/cve/CVE-2026-77214", "https://bugzilla.redhat.com/2543288", "https://bugzilla.redhat.com/2547476", "https://bugzilla.redhat.com/show_bug.cgi?id=2543288", "https://bugzilla.redhat.com/show_bug.cgi?id=2547476", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-102633", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-77214", "https://errata.almalinux.org/9/ALSA-2026-88247.html", "https://errata.rockylinux.org/RLSA-2026:88247", "https://github.com/libexpat/libexpat/commit/13c5f63a7f1c52c2feee3b16a1134d4fb68e9ea0", "https://github.com/libexpat/libexpat/pull/1393", "https://linux.oracle.com/cve/CVE-2026-77214.html", "https://linux.oracle.com/errata/ELSA-2026-92323.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-77214", "https://www.cve.org/CVERecord?id=CVE-2026-77214", "https://www.vulncheck.com/advisories/libexpat-heap-buffer-over-read-in-xmlparse-c-via-xml-parsebuffer" ], "PublishedDate": "2026-10-07T15:17:53.327Z", "LastModifiedDate": "2026-10-10T03:17:08.487Z" }, { "VulnerabilityID": "CVE-2026-93990", "PkgID": "libexpat@2.7.5-r0", "PkgName": "libexpat", "PkgIdentifier": { "PURL": "pkg:apk/alpine/libexpat@2.7.5-r0?arch=x86_64\u0026distro=3.23.4", "UID": "28e722d1da61bc2e" }, "InstalledVersion": "2.7.5-r0", "FixedVersion": "2.8.5-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:5519239b187cd3709c07332d1796e87305684dbc91e05de8de1682602b6c3118" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-93990", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:993037f77b32140811b61047bdd9d3af65763d776547cc79eb1de59b8193c5d5", "Title": "expat: Expat: XML Injection via Malformed UTF-16 Input", "Description": "Expat before 2.8.5 fails to validate that a high surrogate in UTF-16 input is followed by a low surrogate, allowing malformed UTF-16 sequences to be accepted. Attackers can supply UTF-16 encoded XML containing lone high surrogates that consume the following code unit, causing Expat to pass unpaired surrogates to applications built with XML_UNICODE and to silently replace input characters in other builds.", "Severity": "HIGH", "CweIDs": [ "CWE-176" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:72663", "https://access.redhat.com/security/cve/CVE-2026-93990", "https://blog.hartwork.org/posts/expat-2-8-5-released/", "https://bugzilla.redhat.com/2538967", "https://bugzilla.redhat.com/show_bug.cgi?id=2517901", "https://bugzilla.redhat.com/show_bug.cgi?id=2538967", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-66046", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93990", "https://errata.almalinux.org/9/ALSA-2026-72663.html", "https://errata.rockylinux.org/RLSA-2026:72663", "https://github.com/libexpat/libexpat", "https://github.com/libexpat/libexpat/commit/ff6e1d7e750bbe245178f51a47a965dc8342861a", "https://github.com/libexpat/libexpat/pull/1282", "https://github.com/libexpat/libexpat/releases/tag/R_2_8_5", "https://linux.oracle.com/cve/CVE-2026-93990.html", "https://linux.oracle.com/errata/ELSA-2026-74001.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-93990", "https://www.cve.org/CVERecord?id=CVE-2026-93990", "https://www.vulncheck.com/advisories/expat-through-2.8.4-malformed-utf-16-acceptance-via-unchecked-surrogate" ], "PublishedDate": "2026-09-19T23:17:10.203Z", "LastModifiedDate": "2026-09-28T17:17:53.037Z" }, { "VulnerabilityID": "CVE-2026-14456", "PkgID": "libssl3@3.5.6-r0", "PkgName": "libssl3", "PkgIdentifier": { "PURL": "pkg:apk/alpine/libssl3@3.5.6-r0?arch=x86_64\u0026distro=3.23.4", "UID": "aece396067dff154" }, "InstalledVersion": "3.5.6-r0", "FixedVersion": "3.5.8-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:29df493baa13de438d6d2ece3a8333032e0b7b9b9d8cce4ee82194da255f61e1" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-14456", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:c28d952f12ff9b217d27ab861374ce86f547ad79eebbc64b424a2899f2b35822", "Title": "openssl: OpenSSL: Denial of Service via unbounded memory growth in QUIC server", "Description": "Issue summary: When an OpenSSL QUIC server (Listener SSL object) processes\nvalid QUIC Initial packets for unknown destination connection IDs, it\ncan allocate and queue new incoming channels without enforcing any limit.\n\nImpact summary: A remote peer that can make many Initial packets reach the\nserver listener faster than the application accepts connections, can cause the\nmemory allocated to store the per-channel state to grow without any limits,\npotentially making the QUIC listener unavailable and causing Denial of Service.\n\nCWE: CWE-770: Allocation of Resources Without Limits or Throttling\n\nDescription: The function that handles inbound QUIC packets uses\nConnection-Id from the packet header to find an existing connection\n(QUIC channel). If no existing connection is found and the packet\ntype is INITIAL, the function treats the packet as a new connection. It\nallocates a new channel object and inserts it into a queue where it\nwaits to be accepted by the local application with SSL_accept(3ossl).\nThe memory occupied by these initial channel objects may grow\nwithout bounds if the application is not able to call SSL_accept()\nfrequently enough to serve these inbound connection requests.\n\nThe issue is present since OpenSSL 3.5 when the QUIC server implementation\nwas added.\n\nThe fix introduces a limit for pending connections. The default limit is set\nto 256 pending connections (waiting to be accepted by the local application).\nApplications may change the default by calling SSL_set_value_uint(3ossl).\n\nFIPS impact: no\nThe FIPS module is not affected as the QUIC implementation is outside of\nthe OpenSSL FIPS module boundary.", "Severity": "HIGH", "CweIDs": [ "CWE-770" ], "VendorSeverity": { "alma": 3, "amazon": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/08/13/4", "https://access.redhat.com/errata/RHSA-2026:67165", "https://access.redhat.com/security/cve/CVE-2026-14456", "https://bugzilla.redhat.com/2515348", "https://bugzilla.redhat.com/2517559", "https://bugzilla.redhat.com/2517560", "https://bugzilla.redhat.com/2517561", "https://bugzilla.redhat.com/2517562", "https://bugzilla.redhat.com/2517564", "https://bugzilla.redhat.com/2517565", "https://bugzilla.redhat.com/2517566", "https://bugzilla.redhat.com/2517570", "https://bugzilla.redhat.com/show_bug.cgi?id=2515348", "https://bugzilla.redhat.com/show_bug.cgi?id=2517559", "https://bugzilla.redhat.com/show_bug.cgi?id=2517560", "https://bugzilla.redhat.com/show_bug.cgi?id=2517561", "https://bugzilla.redhat.com/show_bug.cgi?id=2517562", "https://bugzilla.redhat.com/show_bug.cgi?id=2517564", "https://bugzilla.redhat.com/show_bug.cgi?id=2517565", "https://bugzilla.redhat.com/show_bug.cgi?id=2517566", "https://bugzilla.redhat.com/show_bug.cgi?id=2517570", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-14456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-14457", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-18798", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54874", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63072", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63073", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63074", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63075", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63076", "https://errata.almalinux.org/9/ALSA-2026-67165.html", "https://errata.rockylinux.org/RLSA-2026:67165", "https://github.com/openssl/openssl/commit/08e7756c3900bcfd77a720e7b74e27d6e4ed01a9", "https://github.com/openssl/openssl/commit/4084152e040329ca0194c4c1750b9b46d00a5b6b", "https://github.com/openssl/openssl/commit/f2f1465f2d2e5c61dfeac4d20fd093797d821139", "https://linux.oracle.com/cve/CVE-2026-14456.html", "https://linux.oracle.com/errata/ELSA-2026-67165-0.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-14456", "https://openssl-library.org/news/secadv/20260813.txt", "https://ubuntu.com/security/notices/USN-8678-1", "https://www.cve.org/CVERecord?id=CVE-2026-14456" ], "PublishedDate": "2026-08-13T15:19:31.82Z", "LastModifiedDate": "2026-11-06T20:26:36.04Z" }, { "VulnerabilityID": "CVE-2026-45447", "PkgID": "libssl3@3.5.6-r0", "PkgName": "libssl3", "PkgIdentifier": { "PURL": "pkg:apk/alpine/libssl3@3.5.6-r0?arch=x86_64\u0026distro=3.23.4", "UID": "aece396067dff154" }, "InstalledVersion": "3.5.6-r0", "FixedVersion": "3.5.7-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:29df493baa13de438d6d2ece3a8333032e0b7b9b9d8cce4ee82194da255f61e1" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-45447", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:49988fddcb4f54617ad21c65c7baf1375b97c893bc2f93770197fa7b0abbcdcc", "Title": "openssl: Heap Use-After-Free in OpenSSL PKCS7_verify()", "Description": "Issue summary: A specially crafted PKCS#7 or S/MIME signed message could\ntrigger a use-after-free during PKCS#7 signature verification.\n\nImpact summary: A use-after-free may result in process crashes, heap\ncorruption, or potentially remote code execution.\n\nWhen processing a PKCS#7 or S/MIME signed message, if the SignedData\ndigestAlgorithms field is present as an empty ASN.1 SET, OpenSSL may\nincorrectly free a caller-owned BIO during PKCS7_verify(). A subsequent\nuse of the BIO by the calling application results in a use-after-free\ncondition.\n\nIn the common case this occurs when the application later calls\nBIO_free() on the BIO originally passed to PKCS7_verify(). Depending\non allocator behavior and application-specific BIO usage patterns, this\nmay result in a crash or other memory corruption. In some application\ncontexts this may potentially be exploitable for remote code execution.\n\nApplications that process PKCS#7 or S/MIME signed messages using OpenSSL\nPKCS#7 APIs may be affected. Applications using the CMS APIs for this\nprocessing are not affected.\n\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.", "Severity": "HIGH", "CweIDs": [ "CWE-416", "CWE-825" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "julia": 3, "oracle-oval": 2, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:25237", "https://access.redhat.com/errata/RHSA-2026:25239", "https://access.redhat.com/errata/RHSA-2026:26275", "https://access.redhat.com/errata/RHSA-2026:26319", "https://access.redhat.com/errata/RHSA-2026:29197", "https://access.redhat.com/errata/RHSA-2026:34102", "https://access.redhat.com/errata/RHSA-2026:35869", "https://access.redhat.com/errata/RHSA-2026:36215", "https://access.redhat.com/errata/RHSA-2026:36217", "https://access.redhat.com/errata/RHSA-2026:39009", "https://access.redhat.com/errata/RHSA-2026:39012", "https://access.redhat.com/errata/RHSA-2026:39981", "https://access.redhat.com/errata/RHSA-2026:44438", "https://access.redhat.com/errata/RHSA-2026:47735", "https://access.redhat.com/errata/RHSA-2026:47737", "https://access.redhat.com/errata/RHSA-2026:58563", "https://access.redhat.com/errata/RHSA-2026:58981", "https://access.redhat.com/errata/RHSA-2026:59831", "https://access.redhat.com/errata/RHSA-2026:66524", "https://access.redhat.com/security/cve/CVE-2026-45447", "https://bugzilla.redhat.com/2481898", "https://bugzilla.redhat.com/show_bug.cgi?id=2481879", "https://bugzilla.redhat.com/show_bug.cgi?id=2481880", "https://bugzilla.redhat.com/show_bug.cgi?id=2481881", "https://bugzilla.redhat.com/show_bug.cgi?id=2481882", "https://bugzilla.redhat.com/show_bug.cgi?id=2481884", "https://bugzilla.redhat.com/show_bug.cgi?id=2481885", "https://bugzilla.redhat.com/show_bug.cgi?id=2481887", "https://bugzilla.redhat.com/show_bug.cgi?id=2481890", "https://bugzilla.redhat.com/show_bug.cgi?id=2481891", "https://bugzilla.redhat.com/show_bug.cgi?id=2481892", "https://bugzilla.redhat.com/show_bug.cgi?id=2481893", "https://bugzilla.redhat.com/show_bug.cgi?id=2481894", "https://bugzilla.redhat.com/show_bug.cgi?id=2481896", "https://bugzilla.redhat.com/show_bug.cgi?id=2481897", "https://bugzilla.redhat.com/show_bug.cgi?id=2481898", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34180", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34181", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34182", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34183", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42764", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42766", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42767", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42768", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42769", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42770", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45445", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45446", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45447", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-7383", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-9076", "https://errata.almalinux.org/9/ALSA-2026-44438.html", "https://errata.rockylinux.org/RLSA-2026:25239", "https://github.com/advisories/GHSA-f684-cpcq-j565", "https://github.com/openssl/openssl/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c", "https://github.com/openssl/openssl/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8", "https://github.com/openssl/openssl/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54", "https://github.com/openssl/openssl/commit/a541ae8bfe849a30cc885e8780715c0f488e496c", "https://github.com/openssl/openssl/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e", "https://github.com/openssl/security/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c", "https://github.com/openssl/security/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8", "https://github.com/openssl/security/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54", "https://github.com/openssl/security/commit/a541ae8bfe849a30cc885e8780715c0f488e496c", "https://github.com/openssl/security/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e", "https://linux.oracle.com/cve/CVE-2026-45447.html", "https://linux.oracle.com/errata/ELSA-2026-50379.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-45447", "https://openssl-library.org/news/secadv/20260609.txt", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45447.json", "https://ubuntu.com/security/notices/USN-8414-1", "https://ubuntu.com/security/notices/USN-8414-2", "https://www.cve.org/CVERecord?id=CVE-2026-45447" ], "PublishedDate": "2026-06-09T17:17:19.277Z", "LastModifiedDate": "2026-09-18T13:18:26.343Z" }, { "VulnerabilityID": "CVE-2026-53612", "PkgID": "libuuid@2.41.4-r0", "PkgName": "libuuid", "PkgIdentifier": { "PURL": "pkg:apk/alpine/libuuid@2.41.4-r0?arch=x86_64\u0026distro=3.23.4", "UID": "833419752375af8a" }, "InstalledVersion": "2.41.4-r0", "FixedVersion": "2.41.6-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:5519239b187cd3709c07332d1796e87305684dbc91e05de8de1682602b6c3118" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53612", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:acbe7e96544f4a5a4abdcbaaf781c3c374a722bf4032af79b7843301f889b185", "Title": "util-linux: util-linux: TOCTOU in the mount program when applying post-mount ownership/mode changes", "Description": "util-linux is a random collection of Linux utilities. In util-linux 2.39 through 2.41.4 and 2.42 through 2.42.1, the SUID `mount` utility's `hook_owner.c` post-mount hook performs path-based `chmod()` and `lchown()` operations on a previously validated mount target. A local low-privileged user authorized by an `/etc/fstab` entry with `user` or `users` and an `X-mount.mode`, `X-mount.owner`, or `X-mount.group` option can use `renameat2(RENAME_EXCHANGE)` to race a writable ancestor of the target and redirect the privileged ownership or mode change to a root-owned path, potentially gaining root privileges. This issue is fixed in 2.41.5 and 2.42.2.", "Severity": "HIGH", "CweIDs": [ "CWE-367" ], "VendorSeverity": { "alma": 3, "azure": 2, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-53612", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/commit/24da33905c7115c4cbccd0afb2a469804e96467a", "https://github.com/util-linux/util-linux/commit/722c96974dd4009a334e4aee556eedaab5fb94b4", "https://github.com/util-linux/util-linux/commit/897a08c2b11dfa66975c3d24d63c7bf5f5be1a7c", "https://github.com/util-linux/util-linux/commit/d0c5adaeb3a3d823aba1377794de8f009b8152cc", "https://github.com/util-linux/util-linux/releases/tag/v2.41.5", "https://github.com/util-linux/util-linux/releases/tag/v2.42.2", "https://github.com/util-linux/util-linux/security/advisories/GHSA-g8wm-75wr-g2vh", "https://linux.oracle.com/cve/CVE-2026-53612.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-53612", "https://ubuntu.com/security/notices/USN-8702-1", "https://www.cve.org/CVERecord?id=CVE-2026-53612" ], "PublishedDate": "2026-10-14T15:17:20.26Z", "LastModifiedDate": "2026-10-16T16:00:33.533Z" }, { "VulnerabilityID": "CVE-2026-53613", "PkgID": "libuuid@2.41.4-r0", "PkgName": "libuuid", "PkgIdentifier": { "PURL": "pkg:apk/alpine/libuuid@2.41.4-r0?arch=x86_64\u0026distro=3.23.4", "UID": "833419752375af8a" }, "InstalledVersion": "2.41.4-r0", "FixedVersion": "2.41.6-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:5519239b187cd3709c07332d1796e87305684dbc91e05de8de1682602b6c3118" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53613", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:4dc3d07247cc75fb23a90d5d0802899506673cbb242069f46987b4794d0f280f", "Title": "util-linux: TOCTOU in the mount program via ancestor directory swap on target path", "Description": "util-linux is a random collection of Linux utilities. In util-linux 2.17 through 2.41.6 and 2.42 through 2.42.3, and in 2.42.4 when the legacy `mount(2)` path is used without `/proc`, restricted non-root `mount` requests validate an `/etc/fstab` target before the mount operation re-resolves that pathname. A local low-privileged user authorized by an fstab `user` or `users` entry whose target has an attacker-writable ancestor can use `renameat2(RENAME_EXCHANGE)` to swap a path component and redirect an authorized mount to a root-owned location, such as mounting attacker-controlled content over `/etc/sudoers.d`, and thereby gain root privileges. Versions 2.41.5 and 2.42.2 pin targets for the new mount API, and 2.42.4 pins legacy targets through `/proc/self/fd`; the documented legacy fallback without `/proc` remains affected.", "Severity": "HIGH", "CweIDs": [ "CWE-367" ], "VendorSeverity": { "alma": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-53613", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/commit/0b010025a0e429bc80355c94db86a843395d49e2", "https://github.com/util-linux/util-linux/commit/0d3d55975aa3492c62fd345eac38f41cd166c0b0", "https://github.com/util-linux/util-linux/commit/2c773f336134acf016e639abb6f12ba7341fe4b8", "https://github.com/util-linux/util-linux/commit/39fef62bf3226abb6bb018fa8750afa0327e84b4", "https://github.com/util-linux/util-linux/commit/472cc3fb2d4d47cca7aab2e0b59eb3fb8a9359ec", "https://github.com/util-linux/util-linux/commit/646fb66603d10a7ac337e14f566f1af48e3107c9", "https://github.com/util-linux/util-linux/commit/708d1b3c51932dc5ba8082c7368187715e6a8d78", "https://github.com/util-linux/util-linux/commit/78a860982e036f38fe9c0b3344998df5ac2c2ff5", "https://github.com/util-linux/util-linux/commit/85d16b341f7232c9dbb4884b632e1e956584bee9", "https://github.com/util-linux/util-linux/commit/a9508d216eb8977979102782672e0470cc9bf2a2", "https://github.com/util-linux/util-linux/releases/tag/v2.41.5", "https://github.com/util-linux/util-linux/releases/tag/v2.42.2", "https://github.com/util-linux/util-linux/releases/tag/v2.42.4", "https://github.com/util-linux/util-linux/security/advisories/GHSA-8gj5-72r3-428g", "https://linux.oracle.com/cve/CVE-2026-53613.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-53613", "https://ubuntu.com/security/notices/USN-8702-1", "https://www.cve.org/CVERecord?id=CVE-2026-53613" ], "PublishedDate": "2026-10-14T15:17:20.41Z", "LastModifiedDate": "2026-10-16T16:00:33.533Z" }, { "VulnerabilityID": "CVE-2026-53614", "PkgID": "libuuid@2.41.4-r0", "PkgName": "libuuid", "PkgIdentifier": { "PURL": "pkg:apk/alpine/libuuid@2.41.4-r0?arch=x86_64\u0026distro=3.23.4", "UID": "833419752375af8a" }, "InstalledVersion": "2.41.4-r0", "FixedVersion": "2.41.6-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:5519239b187cd3709c07332d1796e87305684dbc91e05de8de1682602b6c3118" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53614", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:2da677425fe0d204da705ae6173161ea7a08a51bdd83e71d4007028f3c419897", "Title": "util-linux: util-linux: SUID mount(8) allows nosuid/noexec bypass via LIBMOUNT_FORCE_MOUNT2", "Description": "util-linux is a random collection of Linux utilities. In util-linux 2.39.1 through 2.41.4 and 2.42 through 2.42.1, the SUID `mount` utility reads the attacker-controlled `LIBMOUNT_FORCE_MOUNT2` environment variable with `getenv()`, allowing a local low-privileged\nuser to force the non-atomic legacy bind-mount path. With an `/etc/fstab` bind mount authorized by `user` or `users` and protected by `nosuid`, `noexec`, or `nodev`, an attacker can race the window between the initial bind mount and the remount that applies those security flags and execute a SUID program from the temporarily unprotected mount, potentially gaining root privileges. This issue is fixed in 2.41.5 and 2.42.2.", "Severity": "HIGH", "CweIDs": [ "CWE-269", "CWE-807" ], "VendorSeverity": { "alma": 3, "azure": 2, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-53614", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/commit/31e37c1c7dcf25b76ccf41391fe934a75644c661", "https://github.com/util-linux/util-linux/commit/53ff0fcdab12d69c60c971c69a3d0d173fa46ca9", "https://github.com/util-linux/util-linux/commit/9cbfb823500f510b34767edabd3ffd5b436987b4", "https://github.com/util-linux/util-linux/commit/cc81bbcec598cb91f0eb8456282f33eed820ed5f", "https://github.com/util-linux/util-linux/commit/fd6b4d94ff013dc7ed680d4e864610da5b9751f1", "https://github.com/util-linux/util-linux/releases/tag/v2.41.5", "https://github.com/util-linux/util-linux/releases/tag/v2.42.2", "https://github.com/util-linux/util-linux/security/advisories/GHSA-67r7-8m5w-22wx", "https://linux.oracle.com/cve/CVE-2026-53614.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-53614", "https://ubuntu.com/security/notices/USN-8702-1", "https://www.cve.org/CVERecord?id=CVE-2026-53614" ], "PublishedDate": "2026-10-14T16:17:45.93Z", "LastModifiedDate": "2026-10-16T16:00:33.533Z" }, { "VulnerabilityID": "CVE-2026-76642", "PkgID": "libuuid@2.41.4-r0", "PkgName": "libuuid", "PkgIdentifier": { "PURL": "pkg:apk/alpine/libuuid@2.41.4-r0?arch=x86_64\u0026distro=3.23.4", "UID": "833419752375af8a" }, "InstalledVersion": "2.41.4-r0", "FixedVersion": "2.41.6-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:5519239b187cd3709c07332d1796e87305684dbc91e05de8de1682602b6c3118" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-76642", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:305d0bcd0c95dbad75aae807bd33e568c74eda049cdad6baa7104a1942ae9b09", "Title": "util-linux: util-linux: failed external mount helper still runs privileged X-mount post-hooks", "Description": "util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation.", "Severity": "HIGH", "CweIDs": [ "CWE-390" ], "VendorSeverity": { "alma": 3, "azure": 2, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/security/cve/CVE-2026-76642", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux", "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L476", "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L892", "https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a", "https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc", "https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf", "https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f", "https://linux.oracle.com/cve/CVE-2026-76642.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-76642", "https://www.cve.org/CVERecord?id=CVE-2026-76642", "https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper" ], "PublishedDate": "2026-09-03T13:06:08.44Z", "LastModifiedDate": "2026-09-24T20:28:01.78Z" }, { "VulnerabilityID": "CVE-2026-78408", "PkgID": "libuuid@2.41.4-r0", "PkgName": "libuuid", "PkgIdentifier": { "PURL": "pkg:apk/alpine/libuuid@2.41.4-r0?arch=x86_64\u0026distro=3.23.4", "UID": "833419752375af8a" }, "InstalledVersion": "2.41.4-r0", "FixedVersion": "2.41.6-r1", "Status": "fixed", "Layer": { "DiffID": "sha256:5519239b187cd3709c07332d1796e87305684dbc91e05de8de1682602b6c3118" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78408", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:e01f77d8ef7f3b63c32afba1678555159600687a1ec9b817c600ed27cdd2eeb7", "Title": "util-linux: util-linux: nsenter --join-cgroup leaks root cgroup migration authority", "Description": "The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes.", "Severity": "HIGH", "CweIDs": [ "CWE-775" ], "VendorSeverity": { "alma": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H", "V3Score": 7.9 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/09/05/2", "https://access.redhat.com/errata/RHSA-2026:63162", "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/errata/RHSA-2026:95365", "https://access.redhat.com/security/cve/CVE-2026-78408", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj", "https://linux.oracle.com/cve/CVE-2026-78408.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-78408", "https://www.cve.org/CVERecord?id=CVE-2026-78408" ], "PublishedDate": "2026-09-02T16:17:23.687Z", "LastModifiedDate": "2026-11-05T03:17:32.977Z" }, { "VulnerabilityID": "CVE-2026-78410", "PkgID": "libuuid@2.41.4-r0", "PkgName": "libuuid", "PkgIdentifier": { "PURL": "pkg:apk/alpine/libuuid@2.41.4-r0?arch=x86_64\u0026distro=3.23.4", "UID": "833419752375af8a" }, "InstalledVersion": "2.41.4-r0", "FixedVersion": "2.41.6-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:5519239b187cd3709c07332d1796e87305684dbc91e05de8de1682602b6c3118" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78410", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:9c848c997fe259b46c5886433551908a9927e52b18f9edfc25893885eed01737", "Title": "util-linux: util-linux: restricted bind mounts do not pin the source, allowing X-mount.owner/group/mode redirection", "Description": "A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode.", "Severity": "HIGH", "CweIDs": [ "CWE-367" ], "VendorSeverity": { "alma": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:63162", "https://access.redhat.com/errata/RHSA-2026:93461", "https://access.redhat.com/errata/RHSA-2026:95365", "https://access.redhat.com/security/cve/CVE-2026-78410", "https://bugzilla.redhat.com/2454956", "https://bugzilla.redhat.com/2494101", "https://bugzilla.redhat.com/2519646", "https://bugzilla.redhat.com/2519647", "https://bugzilla.redhat.com/2519648", "https://bugzilla.redhat.com/2521999", "https://bugzilla.redhat.com/2522497", "https://bugzilla.redhat.com/2522684", "https://bugzilla.redhat.com/2552551", "https://bugzilla.redhat.com/show_bug.cgi?id=2454956", "https://bugzilla.redhat.com/show_bug.cgi?id=2494101", "https://bugzilla.redhat.com/show_bug.cgi?id=2519646", "https://bugzilla.redhat.com/show_bug.cgi?id=2519647", "https://bugzilla.redhat.com/show_bug.cgi?id=2519648", "https://bugzilla.redhat.com/show_bug.cgi?id=2521999", "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "https://bugzilla.redhat.com/show_bug.cgi?id=2552551", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13595", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53612", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53613", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53614", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53615", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76642", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78408", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78410", "https://errata.almalinux.org/10/ALSA-2026-93461.html", "https://errata.rockylinux.org/RLSA-2026:93461", "https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m", "https://linux.oracle.com/cve/CVE-2026-78410.html", "https://linux.oracle.com/errata/ELSA-2026-93461.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-78410", "https://www.cve.org/CVERecord?id=CVE-2026-78410" ], "PublishedDate": "2026-09-02T16:17:23.983Z", "LastModifiedDate": "2026-11-05T03:17:33.15Z" }, { "VulnerabilityID": "CVE-2026-6732", "PkgID": "libxml2@2.13.9-r0", "PkgName": "libxml2", "PkgIdentifier": { "PURL": "pkg:apk/alpine/libxml2@2.13.9-r0?arch=x86_64\u0026distro=3.23.4", "UID": "a4c496351a710b02" }, "InstalledVersion": "2.13.9-r0", "FixedVersion": "2.13.9-r1", "Status": "fixed", "Layer": { "DiffID": "sha256:5519239b187cd3709c07332d1796e87305684dbc91e05de8de1682602b6c3118" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-6732", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:4517ed082f0bb200945db6dcfcf83a145932c07a3ee4aeb95268d5adbc0b92f2", "Title": "libxml2: libxml2: Denial of Service via crafted XSD-validated document", "Description": "A flaw was found in libxml2. This vulnerability occurs when the library processes a specially crafted XML Schema Definition (XSD) validated document that includes an internal entity reference. An attacker could exploit this by providing a malicious document, leading to a type confusion error that causes the application to crash. This results in a denial of service (DoS), making the affected system or application unavailable.", "Severity": "HIGH", "CweIDs": [ "CWE-843" ], "VendorSeverity": { "julia": 3, "nvd": 3, "photon": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 6.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:11503", "https://access.redhat.com/security/cve/CVE-2026-6732", "https://bugzilla.redhat.com/show_bug.cgi?id=2461300", "https://gitlab.gnome.org/GNOME/libxml2/-/issues/1097", "https://gitlab.gnome.org/GNOME/libxml2/-/merge_requests/411", "https://nvd.nist.gov/vuln/detail/CVE-2026-6732", "https://ubuntu.com/security/notices/USN-8460-1", "https://www.cve.org/CVERecord?id=CVE-2026-6732" ], "PublishedDate": "2026-04-23T23:16:16.443Z", "LastModifiedDate": "2026-11-05T22:18:53.58Z" }, { "VulnerabilityID": "CVE-2026-107891", "PkgID": "musl@1.2.5-r23", "PkgName": "musl", "PkgIdentifier": { "PURL": "pkg:apk/alpine/musl@1.2.5-r23?arch=x86_64\u0026distro=3.23.4", "UID": "dca30b3fd6708a32" }, "InstalledVersion": "1.2.5-r23", "FixedVersion": "1.2.5-r24", "Status": "fixed", "Layer": { "DiffID": "sha256:29df493baa13de438d6d2ece3a8333032e0b7b9b9d8cce4ee82194da255f61e1" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-107891", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:aab514782299acd94b844bf5742949de382e10df7534d61f40a6c0afeba659f0", "Title": "musl: musl: Arbitrary code execution via integer overflow in regcomp", "Description": "musl libc before 1.2.7, when an untrusted regular expression is used with regcomp, has multiple integer overflows, possibly leading to incorrect allocation sizes and out-of-bounds heap writes.", "Severity": "HIGH", "CweIDs": [ "CWE-190" ], "VendorSeverity": { "redhat": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/10/21/18", "https://access.redhat.com/security/cve/CVE-2026-107891", "https://git.musl-libc.org/cgit/musl/commit/?id=7813e9119eb5fe681b6750b8a033a0490bca0941", "https://musl.libc.org", "https://nvd.nist.gov/vuln/detail/CVE-2026-107891", "https://www.cve.org/CVERecord?id=CVE-2026-107891", "https://www.openwall.com/lists/musl/2026/10/21/1" ], "PublishedDate": "2026-11-05T16:17:32.15Z", "LastModifiedDate": "2026-11-05T17:17:35.287Z" }, { "VulnerabilityID": "CVE-2026-107891", "PkgID": "musl-utils@1.2.5-r23", "PkgName": "musl-utils", "PkgIdentifier": { "PURL": "pkg:apk/alpine/musl-utils@1.2.5-r23?arch=x86_64\u0026distro=3.23.4", "UID": "ffcf7198a9776c5f" }, "InstalledVersion": "1.2.5-r23", "FixedVersion": "1.2.5-r24", "Status": "fixed", "Layer": { "DiffID": "sha256:29df493baa13de438d6d2ece3a8333032e0b7b9b9d8cce4ee82194da255f61e1" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-107891", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:eed2e245d721aa01ab955d7376c42adddd19458550864626881a726af0b17b41", "Title": "musl: musl: Arbitrary code execution via integer overflow in regcomp", "Description": "musl libc before 1.2.7, when an untrusted regular expression is used with regcomp, has multiple integer overflows, possibly leading to incorrect allocation sizes and out-of-bounds heap writes.", "Severity": "HIGH", "CweIDs": [ "CWE-190" ], "VendorSeverity": { "redhat": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/10/21/18", "https://access.redhat.com/security/cve/CVE-2026-107891", "https://git.musl-libc.org/cgit/musl/commit/?id=7813e9119eb5fe681b6750b8a033a0490bca0941", "https://musl.libc.org", "https://nvd.nist.gov/vuln/detail/CVE-2026-107891", "https://www.cve.org/CVERecord?id=CVE-2026-107891", "https://www.openwall.com/lists/musl/2026/10/21/1" ], "PublishedDate": "2026-11-05T16:17:32.15Z", "LastModifiedDate": "2026-11-05T17:17:35.287Z" }, { "VulnerabilityID": "CVE-2026-103111", "PkgID": "pcre2@10.47-r0", "PkgName": "pcre2", "PkgIdentifier": { "PURL": "pkg:apk/alpine/pcre2@10.47-r0?arch=x86_64\u0026distro=3.23.4", "UID": "75fb7d2fe836dfdc" }, "InstalledVersion": "10.47-r0", "FixedVersion": "10.49-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:b910427bd94b3f8656a5557f6e4f484de3b83065ed7699fbbbeadcc313fbc2d9" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-103111", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:b0e8fa830b2f0cdffae6b3d190d3a0b56d101152312d9ffd43f1c95d3264f1e1", "Title": "pcre2: pcre2: Out-of-bounds write via crafted regular expression", "Description": "PCRE2 before 10.49, when there is an attacker-controlled regular expression and certain JIT API usage, allows an out-of-bounds write with arbitrary data.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L", "V3Score": 7.6 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:81532", "https://access.redhat.com/security/cve/CVE-2026-103111", "https://bugzilla.redhat.com/2528993", "https://bugzilla.redhat.com/2531743", "https://bugzilla.redhat.com/2531744", "https://bugzilla.redhat.com/2531745", "https://bugzilla.redhat.com/2531746", "https://bugzilla.redhat.com/2531747", "https://bugzilla.redhat.com/2543797", "https://bugzilla.redhat.com/show_bug.cgi?id=2528993", "https://bugzilla.redhat.com/show_bug.cgi?id=2531743", "https://bugzilla.redhat.com/show_bug.cgi?id=2531744", "https://bugzilla.redhat.com/show_bug.cgi?id=2531745", "https://bugzilla.redhat.com/show_bug.cgi?id=2531746", "https://bugzilla.redhat.com/show_bug.cgi?id=2531747", "https://bugzilla.redhat.com/show_bug.cgi?id=2543797", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-103111", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86145", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89156", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89157", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89158", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89160", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89161", "https://errata.almalinux.org/9/ALSA-2026-81532.html", "https://errata.rockylinux.org/RLSA-2026:81532", "https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-r9hj-j2rw-4q3m", "https://linux.oracle.com/cve/CVE-2026-103111.html", "https://linux.oracle.com/errata/ELSA-2026-84799.html", "https://lists.debian.org/debian-lts-announce/2026/10/msg00008.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-103111", "https://ubuntu.com/security/notices/USN-8974-1", "https://www.cve.org/CVERecord?id=CVE-2026-103111" ], "PublishedDate": "2026-09-30T05:16:45.863Z", "LastModifiedDate": "2026-10-04T00:16:35.563Z" }, { "VulnerabilityID": "CVE-2026-86145", "PkgID": "pcre2@10.47-r0", "PkgName": "pcre2", "PkgIdentifier": { "PURL": "pkg:apk/alpine/pcre2@10.47-r0?arch=x86_64\u0026distro=3.23.4", "UID": "75fb7d2fe836dfdc" }, "InstalledVersion": "10.47-r0", "FixedVersion": "10.48-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:b910427bd94b3f8656a5557f6e4f484de3b83065ed7699fbbbeadcc313fbc2d9" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-86145", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:8fd651b471066e7d1f6cc4df3aade5339c3ac2f58a5e3a236416f178cf1620b0", "Title": "pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions", "Description": "PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a size check). This outcome requires an attacker-controlled regular expression, or a recursive pattern in conjunction with a small heap limit (this can be set through the API).", "Severity": "HIGH", "CweIDs": [ "CWE-424" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "bottlerocket": 2, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L", "V3Score": 8.2 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86145", "http://www.openwall.com/lists/oss-security/2026/09/05/3", "https://access.redhat.com/errata/RHSA-2026:81532", "https://access.redhat.com/security/cve/CVE-2026-86145", "https://bugzilla.redhat.com/2528993", "https://bugzilla.redhat.com/2531743", "https://bugzilla.redhat.com/2531744", "https://bugzilla.redhat.com/2531745", "https://bugzilla.redhat.com/2531746", "https://bugzilla.redhat.com/2531747", "https://bugzilla.redhat.com/2543797", "https://bugzilla.redhat.com/show_bug.cgi?id=2528993", "https://bugzilla.redhat.com/show_bug.cgi?id=2531743", "https://bugzilla.redhat.com/show_bug.cgi?id=2531744", "https://bugzilla.redhat.com/show_bug.cgi?id=2531745", "https://bugzilla.redhat.com/show_bug.cgi?id=2531746", "https://bugzilla.redhat.com/show_bug.cgi?id=2531747", "https://bugzilla.redhat.com/show_bug.cgi?id=2543797", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-103111", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86145", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89156", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89157", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89158", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89160", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89161", "https://errata.almalinux.org/9/ALSA-2026-81532.html", "https://errata.rockylinux.org/RLSA-2026:81532", "https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48", "https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-3r4p-g7gg-ppmf", "https://github.com/bottlerocket-os/bottlerocket-core-kit/blob/develop/advisories/17.1.0/BRSA-xqvt0yt0g9rb.toml", "https://github.com/bottlerocket-os/bottlerocket/security/advisories/GHSA-3r4p-g7gg-ppmf", "https://linux.oracle.com/cve/CVE-2026-86145.html", "https://linux.oracle.com/errata/ELSA-2026-84799.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-86145", "https://ubuntu.com/security/notices/USN-8974-1", "https://www.cve.org/CVERecord?id=CVE-2026-86145" ], "PublishedDate": "2026-09-05T06:17:10.37Z", "LastModifiedDate": "2026-09-09T16:04:24.933Z" }, { "VulnerabilityID": "CVE-2026-89157", "PkgID": "pcre2@10.47-r0", "PkgName": "pcre2", "PkgIdentifier": { "PURL": "pkg:apk/alpine/pcre2@10.47-r0?arch=x86_64\u0026distro=3.23.4", "UID": "75fb7d2fe836dfdc" }, "InstalledVersion": "10.47-r0", "FixedVersion": "10.48-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:b910427bd94b3f8656a5557f6e4f484de3b83065ed7699fbbbeadcc313fbc2d9" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-89157", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:aa7490272d120b7f14ac14f7538f75e0af3a25b6b9bd4081b1f9ee64e9c92d0e", "Title": "pcre2: PCRE2: Out-of-bounds write via large pattern input", "Description": "PCRE2 before 10.48, on 32-bit platforms, has a pcre2_pattern_convert out-of-bounds write when an attacker can provide a large pattern.", "Severity": "HIGH", "CweIDs": [ "CWE-190" ], "VendorSeverity": { "alma": 3, "azure": 2, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "rocky": 3, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H", "V3Score": 7.4 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L", "V3Score": 5.7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:81532", "https://access.redhat.com/security/cve/CVE-2026-89157", "https://bugzilla.redhat.com/2528993", "https://bugzilla.redhat.com/2531743", "https://bugzilla.redhat.com/2531744", "https://bugzilla.redhat.com/2531745", "https://bugzilla.redhat.com/2531746", "https://bugzilla.redhat.com/2531747", "https://bugzilla.redhat.com/2543797", "https://bugzilla.redhat.com/show_bug.cgi?id=2528993", "https://bugzilla.redhat.com/show_bug.cgi?id=2531743", "https://bugzilla.redhat.com/show_bug.cgi?id=2531744", "https://bugzilla.redhat.com/show_bug.cgi?id=2531745", "https://bugzilla.redhat.com/show_bug.cgi?id=2531746", "https://bugzilla.redhat.com/show_bug.cgi?id=2531747", "https://bugzilla.redhat.com/show_bug.cgi?id=2543797", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-103111", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86145", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89156", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89157", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89158", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89160", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89161", "https://errata.almalinux.org/9/ALSA-2026-81532.html", "https://errata.rockylinux.org/RLSA-2026:81532", "https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48", "https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-q8g2-wprr-34m9", "https://linux.oracle.com/cve/CVE-2026-89157.html", "https://linux.oracle.com/errata/ELSA-2026-81613.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-89157", "https://ubuntu.com/security/notices/USN-8974-1", "https://www.cve.org/CVERecord?id=CVE-2026-89157" ], "PublishedDate": "2026-09-11T04:18:03.753Z", "LastModifiedDate": "2026-09-16T19:25:08.88Z" }, { "VulnerabilityID": "CVE-2026-89161", "PkgID": "pcre2@10.47-r0", "PkgName": "pcre2", "PkgIdentifier": { "PURL": "pkg:apk/alpine/pcre2@10.47-r0?arch=x86_64\u0026distro=3.23.4", "UID": "75fb7d2fe836dfdc" }, "InstalledVersion": "10.47-r0", "FixedVersion": "10.48-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:b910427bd94b3f8656a5557f6e4f484de3b83065ed7699fbbbeadcc313fbc2d9" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-89161", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:94082f8bb74355eca69f0d445b08986717fb1d06557858732b567bcebff3b737", "Title": "pcre2: PCRE2: Memory corruption vulnerability in pcre2_jit_match", "Description": "In PCRE2 before 10.48, pcre2_jit_match mishandles a previously copied subject being passed in as a context. An incorrect free operation can occur.", "Severity": "HIGH", "CweIDs": [ "CWE-590" ], "VendorSeverity": { "alma": 3, "amazon": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.4 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:81532", "https://access.redhat.com/security/cve/CVE-2026-89161", "https://bugzilla.redhat.com/2528993", "https://bugzilla.redhat.com/2531743", "https://bugzilla.redhat.com/2531744", "https://bugzilla.redhat.com/2531745", "https://bugzilla.redhat.com/2531746", "https://bugzilla.redhat.com/2531747", "https://bugzilla.redhat.com/2543797", "https://bugzilla.redhat.com/show_bug.cgi?id=2528993", "https://bugzilla.redhat.com/show_bug.cgi?id=2531743", "https://bugzilla.redhat.com/show_bug.cgi?id=2531744", "https://bugzilla.redhat.com/show_bug.cgi?id=2531745", "https://bugzilla.redhat.com/show_bug.cgi?id=2531746", "https://bugzilla.redhat.com/show_bug.cgi?id=2531747", "https://bugzilla.redhat.com/show_bug.cgi?id=2543797", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-103111", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86145", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89156", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89157", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89158", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89160", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89161", "https://errata.almalinux.org/9/ALSA-2026-81532.html", "https://errata.rockylinux.org/RLSA-2026:81532", "https://github.com/PCRE2Project/pcre2/commit/1dcd0cf42a6a7cb62cc9a7c024196733abcfda95%20%28pcre2-10.48-RC1%29", "https://github.com/PCRE2Project/pcre2/pull/937", "https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48", "https://linux.oracle.com/cve/CVE-2026-89161.html", "https://linux.oracle.com/errata/ELSA-2026-84799.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-89161", "https://ubuntu.com/security/notices/USN-8974-1", "https://www.cve.org/CVERecord?id=CVE-2026-89161" ], "PublishedDate": "2026-09-11T04:18:04.47Z", "LastModifiedDate": "2026-09-16T19:10:47.78Z" }, { "VulnerabilityID": "CVE-2026-4775", "PkgID": "tiff@4.7.1-r0", "PkgName": "tiff", "PkgIdentifier": { "PURL": "pkg:apk/alpine/tiff@4.7.1-r0?arch=x86_64\u0026distro=3.23.4", "UID": "551adcb8b716f210" }, "InstalledVersion": "4.7.1-r0", "FixedVersion": "4.7.2-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:5519239b187cd3709c07332d1796e87305684dbc91e05de8de1682602b6c3118" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-4775", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:c8bcec9074f7ea84bd77d536ab4290788d9a4cad58bf38e4843c71779f916d46", "Title": "libtiff: libtiff: Arbitrary code execution or denial of service via signed integer overflow in TIFF file processing", "Description": "A flaw was found in the libtiff library. A remote attacker could exploit a signed integer overflow vulnerability in the putcontig8bitYCbCr44tile function by providing a specially crafted TIFF file. This flaw can lead to an out-of-bounds heap write due to incorrect memory pointer calculations, potentially causing a denial of service (application crash) or arbitrary code execution.", "Severity": "HIGH", "CweIDs": [ "CWE-190" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:12265", "https://access.redhat.com/errata/RHSA-2026:12271", "https://access.redhat.com/errata/RHSA-2026:14929", "https://access.redhat.com/errata/RHSA-2026:16055", "https://access.redhat.com/errata/RHSA-2026:19150", "https://access.redhat.com/errata/RHSA-2026:19363", "https://access.redhat.com/errata/RHSA-2026:19585", "https://access.redhat.com/errata/RHSA-2026:19586", "https://access.redhat.com/errata/RHSA-2026:19604", "https://access.redhat.com/errata/RHSA-2026:19608", "https://access.redhat.com/errata/RHSA-2026:19609", "https://access.redhat.com/errata/RHSA-2026:19657", "https://access.redhat.com/errata/RHSA-2026:19659", "https://access.redhat.com/errata/RHSA-2026:19702", "https://access.redhat.com/errata/RHSA-2026:20583", "https://access.redhat.com/errata/RHSA-2026:20585", "https://access.redhat.com/errata/RHSA-2026:20591", "https://access.redhat.com/errata/RHSA-2026:20592", "https://access.redhat.com/errata/RHSA-2026:24992", "https://access.redhat.com/errata/RHSA-2026:25096", "https://access.redhat.com/errata/RHSA-2026:25910", "https://access.redhat.com/errata/RHSA-2026:30078", "https://access.redhat.com/errata/RHSA-2026:30087", "https://access.redhat.com/errata/RHSA-2026:30088", "https://access.redhat.com/errata/RHSA-2026:30089", "https://access.redhat.com/errata/RHSA-2026:30349", "https://access.redhat.com/errata/RHSA-2026:33388", "https://access.redhat.com/errata/RHSA-2026:74674", "https://access.redhat.com/security/cve/CVE-2026-4775", "https://bugzilla.redhat.com/2450768", "https://bugzilla.redhat.com/show_bug.cgi?id=2450768", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4775", "https://errata.almalinux.org/9/ALSA-2026-19363.html", "https://errata.rockylinux.org/RLSA-2026:19363", "https://linux.oracle.com/cve/CVE-2026-4775.html", "https://linux.oracle.com/errata/ELSA-2026-24992.html", "https://lists.debian.org/debian-lts-announce/2026/04/msg00016.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-4775", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4775.json", "https://www.cve.org/CVERecord?id=CVE-2026-4775" ], "PublishedDate": "2026-03-24T15:16:39.693Z", "LastModifiedDate": "2026-11-04T23:17:38.283Z" }, { "VulnerabilityID": "CVE-2026-85091", "PkgID": "zlib@1.3.2-r0", "PkgName": "zlib", "PkgIdentifier": { "PURL": "pkg:apk/alpine/zlib@1.3.2-r0?arch=x86_64\u0026distro=3.23.4", "UID": "23a5a7d167a86311" }, "InstalledVersion": "1.3.2-r0", "FixedVersion": "1.3.2-r1", "Status": "fixed", "Layer": { "DiffID": "sha256:29df493baa13de438d6d2ece3a8333032e0b7b9b9d8cce4ee82194da255f61e1" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-85091", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:3e410c12ab02322dd88aa53cc1f28d515f3a3f601fe9a8f321f407c543acf356", "Title": "zlib: zlib: Heap buffer overflow in gz_vacate() allows arbitrary code execution", "Description": "zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "azure": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-85091", "https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490", "https://github.com/madler/zlib", "https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393", "https://nvd.nist.gov/vuln/detail/CVE-2026-85091", "https://ubuntu.com/security/notices/USN-8954-1", "https://www.cve.org/CVERecord?id=CVE-2026-85091", "https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate" ], "PublishedDate": "2026-09-03T13:06:20.573Z", "LastModifiedDate": "2026-09-09T20:41:07.123Z" } ] } ] }