{ "SchemaVersion": 2, "Trivy": { "Version": "0.70.0" }, "ReportID": "01a1b91c-81d3-7e80-bfd6-3a6eea276f4d", "CreatedAt": "2026-11-08T04:03:35.635951841+01:00", "ArtifactID": "sha256:4df9a9ee9c8efab17182c3c4663cb56f0ee5461570cef97df6c17fc5c84ad2bd", "ArtifactName": "trivy-scanner:local", "ArtifactType": "container_image", "Metadata": { "Size": 234489856, "OS": { "Family": "alpine", "Name": "3.23.3" }, "ImageID": "sha256:1b3df4cd98fe178756d5c0cd9738991e8c7e21074180ace8d830eca9075ee7bd", "DiffIDs": [ "sha256:989e799e634906e94dc9a5ee2ee26fc92ad260522990f26e707861a5f52bf64e", "sha256:66331502f5f6a99cd657f4ef104273d82c78207f11e9d8f5ca16e2b53d08c361", "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463", "sha256:8e24578a3bf2345b8b54eacb75014598922c3f50f6dbc12b5081bec827dcc945", "sha256:bfa66cef88150e054947357ece4a5ef622b49d30ce1021b9369a763334743eaf", "sha256:3c2b2a22a8b623353d36ffdd442d8f955bc91ae69a99ca6776da39ecd6014a4d", "sha256:31ae40aea4dabafcb45976a1960943d1c1f50222aa24bf147c4b2bf0f17e5b90", "sha256:f19811ad4758dd39dcdef323d33bfe98623c05417de2f8c3ec3975b61421b564", "sha256:e2d0ef2f98da9a44e8b8f91f36b240922e71475a574e41bb77fe8ba26ec59966", "sha256:cc85c3d2a3a2f300ec02bf0f7f2e7ff7a5eb87fe9f7f781fbe6e435d2ebd0712" ], "RepoTags": [ "trivy-scanner:local" ], "Reference": "trivy-scanner:local", "ImageConfig": { "architecture": "amd64", "created": "2026-05-17T17:53:47.168106945Z", "history": [ { "created": "2026-01-28T01:18:04Z", "created_by": "ADD alpine-minirootfs-3.23.3-x86_64.tar.gz / # buildkit", "comment": "buildkit.dockerfile.v0" }, { "created": "2026-01-28T01:18:04Z", "created_by": "CMD [\"/bin/sh\"]", "comment": "buildkit.dockerfile.v0", "empty_layer": true }, { "created": "2026-04-17T06:46:17Z", "created_by": "RUN /bin/sh -c apk --no-cache add ca-certificates git # buildkit", "comment": "buildkit.dockerfile.v0" }, { "created": "2026-04-17T06:46:17Z", "created_by": "COPY trivy /usr/local/bin/trivy # buildkit", "comment": "buildkit.dockerfile.v0" }, { "created": "2026-04-17T06:46:17Z", "created_by": "COPY contrib/*.tpl contrib/ # buildkit", "comment": "buildkit.dockerfile.v0" }, { "created": "2026-04-17T06:46:17Z", "created_by": "ENTRYPOINT [\"trivy\"]", "comment": "buildkit.dockerfile.v0", "empty_layer": true }, { "created": "2026-05-17T17:45:31Z", "created_by": "RUN /bin/sh -c apk add --no-cache docker-cli bash jq tzdata coreutils findutils curl # buildkit", "comment": "buildkit.dockerfile.v0" }, { "created": "2026-05-17T17:45:32Z", "created_by": "ARG SUPERCRONIC_VERSION=0.2.33", "comment": "buildkit.dockerfile.v0", "empty_layer": true }, { "created": "2026-05-17T17:45:32Z", "created_by": "RUN |1 SUPERCRONIC_VERSION=0.2.33 /bin/sh -c set -eux; arch=\"$(uname -m)\"; case \"$arch\" in x86_64) url=\"https://github.com/aptible/supercronic/releases/download/v${SUPERCRONIC_VERSION}/supercronic-linux-amd64\";; aarch64) url=\"https://github.com/aptible/supercronic/releases/download/v${SUPERCRONIC_VERSION}/supercronic-linux-arm64\";; *) echo \"unsupported arch: $arch\" \u003e\u00262; exit 1;; esac; curl -fsSL -o /usr/local/bin/supercronic \"$url\"; chmod +x /usr/local/bin/supercronic # buildkit", "comment": "buildkit.dockerfile.v0" }, { "created": "2026-05-17T17:53:46Z", "created_by": "COPY entrypoint.sh /entrypoint.sh # buildkit", "comment": "buildkit.dockerfile.v0" }, { "created": "2026-05-17T17:53:46Z", "created_by": "COPY scan.sh /usr/local/bin/scan.sh # buildkit", "comment": "buildkit.dockerfile.v0" }, { "created": "2026-05-17T17:53:46Z", "created_by": "COPY render.sh /usr/local/bin/render.sh # buildkit", "comment": "buildkit.dockerfile.v0" }, { "created": "2026-05-17T17:53:47Z", "created_by": "RUN |1 SUPERCRONIC_VERSION=0.2.33 /bin/sh -c chmod +x /entrypoint.sh /usr/local/bin/scan.sh /usr/local/bin/render.sh \u0026\u0026 mkdir -p /reports # buildkit", "comment": "buildkit.dockerfile.v0" }, { "created": "2026-05-17T17:53:47Z", "created_by": "ENV TZ=Europe/Bratislava SCAN_CRON=0 4 * * 0 SEVERITY=HIGH,CRITICAL SCAN_FS=true RETAIN_RUNS=8 REPORTS_DIR=/reports", "comment": "buildkit.dockerfile.v0", "empty_layer": true }, { "created": "2026-05-17T17:53:47Z", "created_by": "ENTRYPOINT [\"/entrypoint.sh\"]", "comment": "buildkit.dockerfile.v0", "empty_layer": true } ], "os": "linux", "rootfs": { "type": "layers", "diff_ids": [ "sha256:989e799e634906e94dc9a5ee2ee26fc92ad260522990f26e707861a5f52bf64e", "sha256:66331502f5f6a99cd657f4ef104273d82c78207f11e9d8f5ca16e2b53d08c361", "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463", "sha256:8e24578a3bf2345b8b54eacb75014598922c3f50f6dbc12b5081bec827dcc945", "sha256:bfa66cef88150e054947357ece4a5ef622b49d30ce1021b9369a763334743eaf", "sha256:3c2b2a22a8b623353d36ffdd442d8f955bc91ae69a99ca6776da39ecd6014a4d", "sha256:31ae40aea4dabafcb45976a1960943d1c1f50222aa24bf147c4b2bf0f17e5b90", "sha256:f19811ad4758dd39dcdef323d33bfe98623c05417de2f8c3ec3975b61421b564", "sha256:e2d0ef2f98da9a44e8b8f91f36b240922e71475a574e41bb77fe8ba26ec59966", "sha256:cc85c3d2a3a2f300ec02bf0f7f2e7ff7a5eb87fe9f7f781fbe6e435d2ebd0712" ] }, "config": { "Entrypoint": [ "/entrypoint.sh" ], "Env": [ "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", "TZ=Europe/Bratislava", "SCAN_CRON=0 4 * * 0", "SEVERITY=HIGH,CRITICAL", "SCAN_FS=true", "RETAIN_RUNS=8", "REPORTS_DIR=/reports" ], "Labels": { "com.docker.compose.project": "trivy-stack", "com.docker.compose.service": "trivy-scanner", "com.docker.compose.version": "5.1.3", "org.opencontainers.image.created": "2026-04-17T06:10:29Z", "org.opencontainers.image.description": "A Fast Vulnerability Scanner for Containers", "org.opencontainers.image.documentation": "https://trivy.dev/v0.70.0/", "org.opencontainers.image.revision": "8a3177aedf7ee0864920eb1852eef031cd3742b8", "org.opencontainers.image.source": "https://github.com/aquasecurity/trivy", "org.opencontainers.image.title": "trivy", "org.opencontainers.image.url": "https://www.aquasec.com/products/trivy/", "org.opencontainers.image.vendor": "Aqua Security", "org.opencontainers.image.version": "0.70.0" }, "WorkingDir": "/" } }, "Layers": [ { "Size": 8724480, "DiffID": "sha256:989e799e634906e94dc9a5ee2ee26fc92ad260522990f26e707861a5f52bf64e" }, { "Size": 13867520, "DiffID": "sha256:66331502f5f6a99cd657f4ef104273d82c78207f11e9d8f5ca16e2b53d08c361" }, { "Size": 160177664, "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, { "Size": 27136, "DiffID": "sha256:8e24578a3bf2345b8b54eacb75014598922c3f50f6dbc12b5081bec827dcc945" }, { "Size": 38195712, "DiffID": "sha256:bfa66cef88150e054947357ece4a5ef622b49d30ce1021b9369a763334743eaf" }, { "Size": 13470208, "DiffID": "sha256:3c2b2a22a8b623353d36ffdd442d8f955bc91ae69a99ca6776da39ecd6014a4d" }, { "Size": 2560, "DiffID": "sha256:31ae40aea4dabafcb45976a1960943d1c1f50222aa24bf147c4b2bf0f17e5b90" }, { "Size": 5632, "DiffID": "sha256:f19811ad4758dd39dcdef323d33bfe98623c05417de2f8c3ec3975b61421b564" }, { "Size": 6656, "DiffID": "sha256:e2d0ef2f98da9a44e8b8f91f36b240922e71475a574e41bb77fe8ba26ec59966" }, { "Size": 12288, "DiffID": "sha256:cc85c3d2a3a2f300ec02bf0f7f2e7ff7a5eb87fe9f7f781fbe6e435d2ebd0712" } ] }, "Results": [ { "Target": "trivy-scanner:local (alpine 3.23.3)", "Class": "os-pkgs", "Type": "alpine", "Packages": [ { "ID": "acl-libs@2.3.2-r1", "Name": "acl-libs", "Identifier": { "PURL": "pkg:apk/alpine/acl-libs@2.3.2-r1?arch=x86_64\u0026distro=3.23.3", "UID": "9ff23a69be90c37b" }, "Version": "2.3.2-r1", "Arch": "x86_64", "SrcName": "acl", "SrcVersion": "2.3.2-r1", "Licenses": [ "LGPL-2.1-or-later", "GPL-2.0-or-later" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "musl@1.2.5-r21" ], "Layer": { "DiffID": "sha256:bfa66cef88150e054947357ece4a5ef622b49d30ce1021b9369a763334743eaf" }, "Digest": "sha1:265cbb622b921154d4c3ef1736fe5c1146afd55f", "InstalledFiles": [ "usr/lib/libacl.so.1", "usr/lib/libacl.so.1.1.2302" ], "AnalyzedBy": "apk" }, { "ID": "alpine-baselayout@3.7.1-r8", "Name": "alpine-baselayout", "Identifier": { "PURL": "pkg:apk/alpine/alpine-baselayout@3.7.1-r8?arch=x86_64\u0026distro=3.23.3", "UID": "dc092fc47b5d9e05" }, "Version": "3.7.1-r8", "Arch": "x86_64", "SrcName": "alpine-baselayout", "SrcVersion": "3.7.1-r8", "Licenses": [ "GPL-2.0-only" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "alpine-baselayout-data@3.7.1-r8", "busybox-binsh@1.37.0-r30" ], "Layer": { "DiffID": "sha256:989e799e634906e94dc9a5ee2ee26fc92ad260522990f26e707861a5f52bf64e" }, "Digest": "sha1:9a137c3c8e738bcabac13326c9fc5472fa58aaf4", "InstalledFiles": [ "etc/motd", "etc/crontabs/root", "etc/modprobe.d/aliases.conf", "etc/modprobe.d/blacklist.conf", "etc/modprobe.d/i386.conf", "etc/profile.d/20locale.sh", "etc/profile.d/README", "etc/profile.d/color_prompt.sh.disabled", "usr/lib/sysctl.d/00-alpine.conf", "var/lock", "var/run", "var/spool/mail", "var/spool/cron/crontabs" ], "AnalyzedBy": "apk" }, { "ID": "alpine-baselayout-data@3.7.1-r8", "Name": "alpine-baselayout-data", "Identifier": { "PURL": "pkg:apk/alpine/alpine-baselayout-data@3.7.1-r8?arch=x86_64\u0026distro=3.23.3", "UID": "6542463feabe92df" }, "Version": "3.7.1-r8", "Arch": "x86_64", "SrcName": "alpine-baselayout", "SrcVersion": "3.7.1-r8", "Licenses": [ "GPL-2.0-only" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "Layer": { "DiffID": "sha256:989e799e634906e94dc9a5ee2ee26fc92ad260522990f26e707861a5f52bf64e" }, "Digest": "sha1:9a60b0edb4559ab279cf004b7e685cfd78dd0c15", "InstalledFiles": [ "etc/fstab", "etc/group", "etc/hostname", "etc/hosts", "etc/inittab", "etc/modules", "etc/mtab", "etc/nsswitch.conf", "etc/passwd", "etc/profile", "etc/protocols", "etc/services", "etc/shadow", "etc/shells", "etc/sysctl.conf" ], "AnalyzedBy": "apk" }, { "ID": "alpine-keys@2.6-r0", "Name": "alpine-keys", "Identifier": { "PURL": "pkg:apk/alpine/alpine-keys@2.6-r0?arch=x86_64\u0026distro=3.23.3", "UID": "2c7cb90de388aa7d" }, "Version": "2.6-r0", "Arch": "x86_64", "SrcName": "alpine-keys", "SrcVersion": "2.6-r0", "Licenses": [ "MIT" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "Layer": { "DiffID": "sha256:989e799e634906e94dc9a5ee2ee26fc92ad260522990f26e707861a5f52bf64e" }, "Digest": "sha1:5c45a821cd6b84d543bbd7ff12a7de1855c5cd13", "InstalledFiles": [ "etc/apk/keys/alpine-devel@lists.alpinelinux.org-4a6a0840.rsa.pub", "etc/apk/keys/alpine-devel@lists.alpinelinux.org-5261cecb.rsa.pub", "etc/apk/keys/alpine-devel@lists.alpinelinux.org-6165ee59.rsa.pub", "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-4a6a0840.rsa.pub", "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-5243ef4b.rsa.pub", "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-524d27bb.rsa.pub", "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-5261cecb.rsa.pub", "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-58199dcc.rsa.pub", "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-58cbb476.rsa.pub", "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-58e4f17d.rsa.pub", "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-5e69ca50.rsa.pub", "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-60ac2099.rsa.pub", "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-6165ee59.rsa.pub", "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-61666e3f.rsa.pub", "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-616a9724.rsa.pub", "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-616abc23.rsa.pub", "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-616ac3bc.rsa.pub", "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-616adfeb.rsa.pub", "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-616ae350.rsa.pub", "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-616db30d.rsa.pub", "usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-66ba20fe.rsa.pub", "usr/share/apk/keys/aarch64/alpine-devel@lists.alpinelinux.org-58199dcc.rsa.pub", "usr/share/apk/keys/aarch64/alpine-devel@lists.alpinelinux.org-616ae350.rsa.pub", "usr/share/apk/keys/armhf/alpine-devel@lists.alpinelinux.org-524d27bb.rsa.pub", "usr/share/apk/keys/armhf/alpine-devel@lists.alpinelinux.org-616a9724.rsa.pub", "usr/share/apk/keys/armv7/alpine-devel@lists.alpinelinux.org-524d27bb.rsa.pub", "usr/share/apk/keys/armv7/alpine-devel@lists.alpinelinux.org-616adfeb.rsa.pub", "usr/share/apk/keys/loongarch64/alpine-devel@lists.alpinelinux.org-66ba20fe.rsa.pub", "usr/share/apk/keys/mips64/alpine-devel@lists.alpinelinux.org-5e69ca50.rsa.pub", "usr/share/apk/keys/ppc64le/alpine-devel@lists.alpinelinux.org-58cbb476.rsa.pub", "usr/share/apk/keys/ppc64le/alpine-devel@lists.alpinelinux.org-616abc23.rsa.pub", "usr/share/apk/keys/riscv64/alpine-devel@lists.alpinelinux.org-60ac2099.rsa.pub", "usr/share/apk/keys/riscv64/alpine-devel@lists.alpinelinux.org-616db30d.rsa.pub", "usr/share/apk/keys/s390x/alpine-devel@lists.alpinelinux.org-58e4f17d.rsa.pub", "usr/share/apk/keys/s390x/alpine-devel@lists.alpinelinux.org-616ac3bc.rsa.pub", "usr/share/apk/keys/x86/alpine-devel@lists.alpinelinux.org-4a6a0840.rsa.pub", "usr/share/apk/keys/x86/alpine-devel@lists.alpinelinux.org-5243ef4b.rsa.pub", "usr/share/apk/keys/x86/alpine-devel@lists.alpinelinux.org-61666e3f.rsa.pub", "usr/share/apk/keys/x86_64/alpine-devel@lists.alpinelinux.org-4a6a0840.rsa.pub", "usr/share/apk/keys/x86_64/alpine-devel@lists.alpinelinux.org-5261cecb.rsa.pub", "usr/share/apk/keys/x86_64/alpine-devel@lists.alpinelinux.org-6165ee59.rsa.pub" ], "AnalyzedBy": "apk" }, { "ID": "alpine-release@3.23.3-r0", "Name": "alpine-release", "Identifier": { "PURL": "pkg:apk/alpine/alpine-release@3.23.3-r0?arch=x86_64\u0026distro=3.23.3", "UID": "4820d6f0afb6a834" }, "Version": "3.23.3-r0", "Arch": "x86_64", "SrcName": "alpine-base", "SrcVersion": "3.23.3-r0", "Licenses": [ "MIT" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "alpine-keys@2.6-r0" ], "Layer": { "DiffID": "sha256:989e799e634906e94dc9a5ee2ee26fc92ad260522990f26e707861a5f52bf64e" }, "Digest": "sha1:e71144a1a35c4844507cd1a3281a7189049f3522", "InstalledFiles": [ "etc/alpine-release", "etc/issue", "etc/os-release", "etc/secfixes.d/alpine", "usr/lib/os-release" ], "AnalyzedBy": "apk" }, { "ID": "apk-tools@3.0.3-r1", "Name": "apk-tools", "Identifier": { "PURL": "pkg:apk/alpine/apk-tools@3.0.3-r1?arch=x86_64\u0026distro=3.23.3", "UID": "135e6dc8dcafde4f" }, "Version": "3.0.3-r1", "Arch": "x86_64", "SrcName": "apk-tools", "SrcVersion": "3.0.3-r1", "Licenses": [ "GPL-2.0-only" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "ca-certificates-bundle@20251003-r0", "libapk@3.0.3-r1", "libcrypto3@3.5.5-r0", "musl@1.2.5-r21", "zlib@1.3.1-r2" ], "Layer": { "DiffID": "sha256:989e799e634906e94dc9a5ee2ee26fc92ad260522990f26e707861a5f52bf64e" }, "Digest": "sha1:b2f877e6c9fb945c185cf36ed546064b8b374245", "InstalledFiles": [ "sbin/apk" ], "AnalyzedBy": "apk" }, { "ID": "bash@5.3.3-r1", "Name": "bash", "Identifier": { "PURL": "pkg:apk/alpine/bash@5.3.3-r1?arch=x86_64\u0026distro=3.23.3", "UID": "1ef95f2b957677cf" }, "Version": "5.3.3-r1", "Arch": "x86_64", "SrcName": "bash", "SrcVersion": "5.3.3-r1", "Licenses": [ "GPL-3.0-or-later" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "busybox-binsh@1.37.0-r30", "musl@1.2.5-r21", "readline@8.3.1-r0" ], "Layer": { "DiffID": "sha256:bfa66cef88150e054947357ece4a5ef622b49d30ce1021b9369a763334743eaf" }, "Digest": "sha1:8e9ab21d4dfbe0faa8151517bd855b63b4e3301c", "InstalledFiles": [ "bin/bash", "etc/bash/bashrc", "etc/profile.d/00-bashrc.sh", "usr/lib/bash/accept", "usr/lib/bash/basename", "usr/lib/bash/chmod", "usr/lib/bash/csv", "usr/lib/bash/cut", "usr/lib/bash/dirname", "usr/lib/bash/dsv", "usr/lib/bash/fdflags", "usr/lib/bash/finfo", "usr/lib/bash/fltexpr", "usr/lib/bash/getconf", "usr/lib/bash/head", "usr/lib/bash/id", "usr/lib/bash/kv", "usr/lib/bash/ln", "usr/lib/bash/logname", "usr/lib/bash/mkdir", "usr/lib/bash/mkfifo", "usr/lib/bash/mktemp", "usr/lib/bash/mypid", "usr/lib/bash/pathchk", "usr/lib/bash/print", "usr/lib/bash/printenv", "usr/lib/bash/push", "usr/lib/bash/realpath", "usr/lib/bash/rm", "usr/lib/bash/rmdir", "usr/lib/bash/seq", "usr/lib/bash/setpgid", "usr/lib/bash/sleep", "usr/lib/bash/stat", "usr/lib/bash/strftime", "usr/lib/bash/strptime", "usr/lib/bash/sync", "usr/lib/bash/tee", "usr/lib/bash/truefalse", "usr/lib/bash/tty", "usr/lib/bash/uname", "usr/lib/bash/unlink", "usr/lib/bash/whoami" ], "AnalyzedBy": "apk" }, { "ID": "brotli-libs@1.2.0-r0", "Name": "brotli-libs", "Identifier": { "PURL": "pkg:apk/alpine/brotli-libs@1.2.0-r0?arch=x86_64\u0026distro=3.23.3", "UID": "18708ffc8b6c1544" }, "Version": "1.2.0-r0", "Arch": "x86_64", "SrcName": "brotli", "SrcVersion": "1.2.0-r0", "Licenses": [ "MIT" ], "Maintainer": "prspkt \u003cprspkt@protonmail.com\u003e", "DependsOn": [ "musl@1.2.5-r21" ], "Layer": { "DiffID": "sha256:66331502f5f6a99cd657f4ef104273d82c78207f11e9d8f5ca16e2b53d08c361" }, "Digest": "sha1:0814694602f35d2741e916fdcb4c9a1e0ec50b42", "InstalledFiles": [ "usr/lib/libbrotlicommon.so.1", "usr/lib/libbrotlicommon.so.1.2.0", "usr/lib/libbrotlidec.so.1", "usr/lib/libbrotlidec.so.1.2.0", "usr/lib/libbrotlienc.so.1", "usr/lib/libbrotlienc.so.1.2.0" ], "AnalyzedBy": "apk" }, { "ID": "busybox@1.37.0-r30", "Name": "busybox", "Identifier": { "PURL": "pkg:apk/alpine/busybox@1.37.0-r30?arch=x86_64\u0026distro=3.23.3", "UID": "1701a73d4be0e35a" }, "Version": "1.37.0-r30", "Arch": "x86_64", "SrcName": "busybox", "SrcVersion": "1.37.0-r30", "Licenses": [ "GPL-2.0-only" ], "Maintainer": "Sören Tempel \u003csoeren+alpine@soeren-tempel.net\u003e", "DependsOn": [ "musl@1.2.5-r21" ], "Layer": { "DiffID": "sha256:989e799e634906e94dc9a5ee2ee26fc92ad260522990f26e707861a5f52bf64e" }, "Digest": "sha1:f1347801bb96b1aa40d17f82237c3f4ff02a4725", "InstalledFiles": [ "bin/busybox", "etc/securetty", "etc/busybox-paths.d/busybox", "etc/logrotate.d/acpid", "etc/network/if-up.d/dad", "etc/udhcpc/udhcpc.conf", "usr/share/udhcpc/default.script" ], "AnalyzedBy": "apk" }, { "ID": "busybox-binsh@1.37.0-r30", "Name": "busybox-binsh", "Identifier": { "PURL": "pkg:apk/alpine/busybox-binsh@1.37.0-r30?arch=x86_64\u0026distro=3.23.3", "UID": "3e18d05d46a6f46f" }, "Version": "1.37.0-r30", "Arch": "x86_64", "SrcName": "busybox", "SrcVersion": "1.37.0-r30", "Licenses": [ "GPL-2.0-only" ], "Maintainer": "Sören Tempel \u003csoeren+alpine@soeren-tempel.net\u003e", "DependsOn": [ "busybox@1.37.0-r30" ], "Layer": { "DiffID": "sha256:989e799e634906e94dc9a5ee2ee26fc92ad260522990f26e707861a5f52bf64e" }, "Digest": "sha1:188d2d0110afa58e8a3e3e5fd424b2d996df7a09", "InstalledFiles": [ "bin/sh" ], "AnalyzedBy": "apk" }, { "ID": "c-ares@1.34.6-r0", "Name": "c-ares", "Identifier": { "PURL": "pkg:apk/alpine/c-ares@1.34.6-r0?arch=x86_64\u0026distro=3.23.3", "UID": "2fc69dd6afab16ae" }, "Version": "1.34.6-r0", "Arch": "x86_64", "SrcName": "c-ares", "SrcVersion": "1.34.6-r0", "Licenses": [ "MIT" ], "Maintainer": "Carlo Landmeter \u003cclandmeter@alpinelinux.org\u003e", "DependsOn": [ "musl@1.2.5-r21" ], "Layer": { "DiffID": "sha256:66331502f5f6a99cd657f4ef104273d82c78207f11e9d8f5ca16e2b53d08c361" }, "Digest": "sha1:e3bb3ff47a277ff9409b8c4bb825099cfe2bcbe2", "InstalledFiles": [ "usr/lib/libcares.so.2", "usr/lib/libcares.so.2.19.5" ], "AnalyzedBy": "apk" }, { "ID": "ca-certificates@20260413-r0", "Name": "ca-certificates", "Identifier": { "PURL": "pkg:apk/alpine/ca-certificates@20260413-r0?arch=x86_64\u0026distro=3.23.3", "UID": "48d5a874bbec291a" }, "Version": "20260413-r0", "Arch": "x86_64", "SrcName": "ca-certificates", "SrcVersion": "20260413-r0", "Licenses": [ "MPL-2.0", "MIT" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "busybox-binsh@1.37.0-r30", "libcrypto3@3.5.5-r0", "musl@1.2.5-r21" ], "Layer": { "DiffID": "sha256:66331502f5f6a99cd657f4ef104273d82c78207f11e9d8f5ca16e2b53d08c361" }, "Digest": "sha1:af25e0f0a0412b141942909ed199144cc46f5bbc", "InstalledFiles": [ "etc/ca-certificates.conf", "etc/apk/protected_paths.d/ca-certificates.list", "etc/ca-certificates/update.d/certhash", "usr/bin/c_rehash", "usr/sbin/update-ca-certificates", "usr/share/ca-certificates/mozilla/ACCVRAIZ1.crt", "usr/share/ca-certificates/mozilla/AC_RAIZ_FNMT-RCM.crt", "usr/share/ca-certificates/mozilla/AC_RAIZ_FNMT-RCM_SERVIDORES_SEGUROS.crt", "usr/share/ca-certificates/mozilla/ANF_Secure_Server_Root_CA.crt", "usr/share/ca-certificates/mozilla/Actalis_Authentication_Root_CA.crt", "usr/share/ca-certificates/mozilla/AffirmTrust_Commercial.crt", "usr/share/ca-certificates/mozilla/AffirmTrust_Networking.crt", "usr/share/ca-certificates/mozilla/AffirmTrust_Premium.crt", "usr/share/ca-certificates/mozilla/AffirmTrust_Premium_ECC.crt", "usr/share/ca-certificates/mozilla/Amazon_Root_CA_1.crt", "usr/share/ca-certificates/mozilla/Amazon_Root_CA_2.crt", "usr/share/ca-certificates/mozilla/Amazon_Root_CA_3.crt", "usr/share/ca-certificates/mozilla/Amazon_Root_CA_4.crt", "usr/share/ca-certificates/mozilla/Atos_TrustedRoot_2011.crt", "usr/share/ca-certificates/mozilla/Atos_TrustedRoot_Root_CA_ECC_TLS_2021.crt", "usr/share/ca-certificates/mozilla/Atos_TrustedRoot_Root_CA_RSA_TLS_2021.crt", "usr/share/ca-certificates/mozilla/Autoridad_de_Certificacion_Firmaprofesional_CIF_A62634068.crt", "usr/share/ca-certificates/mozilla/BJCA_Global_Root_CA1.crt", "usr/share/ca-certificates/mozilla/BJCA_Global_Root_CA2.crt", "usr/share/ca-certificates/mozilla/Buypass_Class_2_Root_CA.crt", "usr/share/ca-certificates/mozilla/Buypass_Class_3_Root_CA.crt", "usr/share/ca-certificates/mozilla/CA_Disig_Root_R2.crt", "usr/share/ca-certificates/mozilla/CFCA_EV_ROOT.crt", "usr/share/ca-certificates/mozilla/COMODO_Certification_Authority.crt", "usr/share/ca-certificates/mozilla/COMODO_ECC_Certification_Authority.crt", "usr/share/ca-certificates/mozilla/COMODO_RSA_Certification_Authority.crt", "usr/share/ca-certificates/mozilla/Certainly_Root_E1.crt", "usr/share/ca-certificates/mozilla/Certainly_Root_R1.crt", "usr/share/ca-certificates/mozilla/Certigna.crt", "usr/share/ca-certificates/mozilla/Certigna_Root_CA.crt", "usr/share/ca-certificates/mozilla/Certum_EC-384_CA.crt", "usr/share/ca-certificates/mozilla/Certum_Trusted_Network_CA.crt", "usr/share/ca-certificates/mozilla/Certum_Trusted_Network_CA_2.crt", "usr/share/ca-certificates/mozilla/Certum_Trusted_Root_CA.crt", "usr/share/ca-certificates/mozilla/D-TRUST_BR_Root_CA_1_2020.crt", "usr/share/ca-certificates/mozilla/D-TRUST_BR_Root_CA_2_2023.crt", "usr/share/ca-certificates/mozilla/D-TRUST_EV_Root_CA_1_2020.crt", "usr/share/ca-certificates/mozilla/D-TRUST_EV_Root_CA_2_2023.crt", "usr/share/ca-certificates/mozilla/D-TRUST_Root_Class_3_CA_2_2009.crt", "usr/share/ca-certificates/mozilla/D-TRUST_Root_Class_3_CA_2_EV_2009.crt", "usr/share/ca-certificates/mozilla/DigiCert_Assured_ID_Root_CA.crt", "usr/share/ca-certificates/mozilla/DigiCert_Assured_ID_Root_G2.crt", "usr/share/ca-certificates/mozilla/DigiCert_Assured_ID_Root_G3.crt", "usr/share/ca-certificates/mozilla/DigiCert_Global_Root_CA.crt", "usr/share/ca-certificates/mozilla/DigiCert_Global_Root_G2.crt", "usr/share/ca-certificates/mozilla/DigiCert_Global_Root_G3.crt", "usr/share/ca-certificates/mozilla/DigiCert_High_Assurance_EV_Root_CA.crt", "usr/share/ca-certificates/mozilla/DigiCert_TLS_ECC_P384_Root_G5.crt", "usr/share/ca-certificates/mozilla/DigiCert_TLS_RSA4096_Root_G5.crt", "usr/share/ca-certificates/mozilla/DigiCert_Trusted_Root_G4.crt", "usr/share/ca-certificates/mozilla/Entrust_Root_Certification_Authority.crt", "usr/share/ca-certificates/mozilla/Entrust_Root_Certification_Authority_-_EC1.crt", "usr/share/ca-certificates/mozilla/Entrust_Root_Certification_Authority_-_G2.crt", "usr/share/ca-certificates/mozilla/FIRMAPROFESIONAL_CA_ROOT-A_WEB.crt", "usr/share/ca-certificates/mozilla/GDCA_TrustAUTH_R5_ROOT.crt", "usr/share/ca-certificates/mozilla/GLOBALTRUST_2020.crt", "usr/share/ca-certificates/mozilla/GTS_Root_R1.crt", "usr/share/ca-certificates/mozilla/GTS_Root_R2.crt", "usr/share/ca-certificates/mozilla/GTS_Root_R3.crt", "usr/share/ca-certificates/mozilla/GTS_Root_R4.crt", "usr/share/ca-certificates/mozilla/GlobalSign_ECC_Root_CA_-_R4.crt", "usr/share/ca-certificates/mozilla/GlobalSign_ECC_Root_CA_-_R5.crt", "usr/share/ca-certificates/mozilla/GlobalSign_Root_CA_-_R3.crt", "usr/share/ca-certificates/mozilla/GlobalSign_Root_CA_-_R6.crt", "usr/share/ca-certificates/mozilla/GlobalSign_Root_E46.crt", "usr/share/ca-certificates/mozilla/GlobalSign_Root_R46.crt", "usr/share/ca-certificates/mozilla/Go_Daddy_Root_Certificate_Authority_-_G2.crt", "usr/share/ca-certificates/mozilla/HARICA_TLS_ECC_Root_CA_2021.crt", "usr/share/ca-certificates/mozilla/HARICA_TLS_RSA_Root_CA_2021.crt", "usr/share/ca-certificates/mozilla/Hellenic_Academic_and_Research_Institutions_ECC_RootCA_2015.crt", "usr/share/ca-certificates/mozilla/Hellenic_Academic_and_Research_Institutions_RootCA_2015.crt", "usr/share/ca-certificates/mozilla/HiPKI_Root_CA_-_G1.crt", "usr/share/ca-certificates/mozilla/Hongkong_Post_Root_CA_3.crt", "usr/share/ca-certificates/mozilla/ISRG_Root_X1.crt", "usr/share/ca-certificates/mozilla/ISRG_Root_X2.crt", "usr/share/ca-certificates/mozilla/IdenTrust_Commercial_Root_CA_1.crt", "usr/share/ca-certificates/mozilla/IdenTrust_Public_Sector_Root_CA_1.crt", "usr/share/ca-certificates/mozilla/Izenpe.com.crt", "usr/share/ca-certificates/mozilla/Microsec_e-Szigno_Root_CA_2009.crt", "usr/share/ca-certificates/mozilla/Microsoft_ECC_Root_Certificate_Authority_2017.crt", "usr/share/ca-certificates/mozilla/Microsoft_RSA_Root_Certificate_Authority_2017.crt", "usr/share/ca-certificates/mozilla/NAVER_Global_Root_Certification_Authority.crt", "usr/share/ca-certificates/mozilla/NetLock_Arany_=Class_Gold=_Főtanúsítvány.crt", "usr/share/ca-certificates/mozilla/OISTE_Server_Root_ECC_G1.crt", "usr/share/ca-certificates/mozilla/OISTE_Server_Root_RSA_G1.crt", "usr/share/ca-certificates/mozilla/OISTE_WISeKey_Global_Root_GB_CA.crt", "usr/share/ca-certificates/mozilla/OISTE_WISeKey_Global_Root_GC_CA.crt", "usr/share/ca-certificates/mozilla/QuoVadis_Root_CA_1_G3.crt", "usr/share/ca-certificates/mozilla/QuoVadis_Root_CA_2.crt", "usr/share/ca-certificates/mozilla/QuoVadis_Root_CA_2_G3.crt", "usr/share/ca-certificates/mozilla/QuoVadis_Root_CA_3.crt", "usr/share/ca-certificates/mozilla/QuoVadis_Root_CA_3_G3.crt", "usr/share/ca-certificates/mozilla/SSL.com_EV_Root_Certification_Authority_ECC.crt", "usr/share/ca-certificates/mozilla/SSL.com_EV_Root_Certification_Authority_RSA_R2.crt", "usr/share/ca-certificates/mozilla/SSL.com_Root_Certification_Authority_ECC.crt", "usr/share/ca-certificates/mozilla/SSL.com_Root_Certification_Authority_RSA.crt", "usr/share/ca-certificates/mozilla/SSL.com_TLS_ECC_Root_CA_2022.crt", "usr/share/ca-certificates/mozilla/SSL.com_TLS_RSA_Root_CA_2022.crt", "usr/share/ca-certificates/mozilla/SZAFIR_ROOT_CA2.crt", "usr/share/ca-certificates/mozilla/Sectigo_Public_Server_Authentication_Root_E46.crt", "usr/share/ca-certificates/mozilla/Sectigo_Public_Server_Authentication_Root_R46.crt", "usr/share/ca-certificates/mozilla/SecureSign_Root_CA12.crt", "usr/share/ca-certificates/mozilla/SecureSign_Root_CA14.crt", "usr/share/ca-certificates/mozilla/SecureSign_Root_CA15.crt", "usr/share/ca-certificates/mozilla/SecureTrust_CA.crt", "usr/share/ca-certificates/mozilla/Secure_Global_CA.crt", "usr/share/ca-certificates/mozilla/Security_Communication_ECC_RootCA1.crt", "usr/share/ca-certificates/mozilla/Security_Communication_RootCA2.crt", "usr/share/ca-certificates/mozilla/Starfield_Root_Certificate_Authority_-_G2.crt", "usr/share/ca-certificates/mozilla/Starfield_Services_Root_Certificate_Authority_-_G2.crt", "usr/share/ca-certificates/mozilla/SwissSign_Gold_CA_-_G2.crt", "usr/share/ca-certificates/mozilla/SwissSign_RSA_TLS_Root_CA_2022_-_1.crt", "usr/share/ca-certificates/mozilla/T-TeleSec_GlobalRoot_Class_2.crt", "usr/share/ca-certificates/mozilla/T-TeleSec_GlobalRoot_Class_3.crt", "usr/share/ca-certificates/mozilla/TUBITAK_Kamu_SM_SSL_Kok_Sertifikasi_-_Surum_1.crt", "usr/share/ca-certificates/mozilla/TWCA_CYBER_Root_CA.crt", "usr/share/ca-certificates/mozilla/TWCA_Global_Root_CA.crt", "usr/share/ca-certificates/mozilla/TWCA_Root_Certification_Authority.crt", "usr/share/ca-certificates/mozilla/Telekom_Security_TLS_ECC_Root_2020.crt", "usr/share/ca-certificates/mozilla/Telekom_Security_TLS_RSA_Root_2023.crt", "usr/share/ca-certificates/mozilla/TeliaSonera_Root_CA_v1.crt", "usr/share/ca-certificates/mozilla/Telia_Root_CA_v2.crt", "usr/share/ca-certificates/mozilla/TrustAsia_Global_Root_CA_G3.crt", "usr/share/ca-certificates/mozilla/TrustAsia_Global_Root_CA_G4.crt", "usr/share/ca-certificates/mozilla/TrustAsia_TLS_ECC_Root_CA.crt", "usr/share/ca-certificates/mozilla/TrustAsia_TLS_RSA_Root_CA.crt", "usr/share/ca-certificates/mozilla/Trustwave_Global_Certification_Authority.crt", "usr/share/ca-certificates/mozilla/Trustwave_Global_ECC_P256_Certification_Authority.crt", "usr/share/ca-certificates/mozilla/Trustwave_Global_ECC_P384_Certification_Authority.crt", "usr/share/ca-certificates/mozilla/TunTrust_Root_CA.crt", "usr/share/ca-certificates/mozilla/UCA_Extended_Validation_Root.crt", "usr/share/ca-certificates/mozilla/UCA_Global_G2_Root.crt", "usr/share/ca-certificates/mozilla/USERTrust_ECC_Certification_Authority.crt", "usr/share/ca-certificates/mozilla/USERTrust_RSA_Certification_Authority.crt", "usr/share/ca-certificates/mozilla/certSIGN_ROOT_CA.crt", "usr/share/ca-certificates/mozilla/certSIGN_Root_CA_G2.crt", "usr/share/ca-certificates/mozilla/e-Szigno_Root_CA_2017.crt", "usr/share/ca-certificates/mozilla/e-Szigno_TLS_Root_CA_2023.crt", "usr/share/ca-certificates/mozilla/ePKI_Root_Certification_Authority.crt", "usr/share/ca-certificates/mozilla/emSign_ECC_Root_CA_-_C3.crt", "usr/share/ca-certificates/mozilla/emSign_ECC_Root_CA_-_G3.crt", "usr/share/ca-certificates/mozilla/emSign_Root_CA_-_C1.crt", "usr/share/ca-certificates/mozilla/emSign_Root_CA_-_G1.crt", "usr/share/ca-certificates/mozilla/vTrus_ECC_Root_CA.crt", "usr/share/ca-certificates/mozilla/vTrus_Root_CA.crt" ], "AnalyzedBy": "apk" }, { "ID": "ca-certificates-bundle@20251003-r0", "Name": "ca-certificates-bundle", "Identifier": { "PURL": "pkg:apk/alpine/ca-certificates-bundle@20251003-r0?arch=x86_64\u0026distro=3.23.3", "UID": "f667a2210d1d97c1" }, "Version": "20251003-r0", "Arch": "x86_64", "SrcName": "ca-certificates", "SrcVersion": "20251003-r0", "Licenses": [ "MPL-2.0", "MIT" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "Layer": { "DiffID": "sha256:989e799e634906e94dc9a5ee2ee26fc92ad260522990f26e707861a5f52bf64e" }, "Digest": "sha1:63ebe72ba79f548b6cdc8a9894e16a90d80f42b0", "InstalledFiles": [ "etc/ssl/cert.pem", "etc/ssl/certs/ca-certificates.crt", "etc/ssl1.1/cert.pem", "etc/ssl1.1/certs" ], "AnalyzedBy": "apk" }, { "ID": "coreutils@9.8-r1", "Name": "coreutils", "Identifier": { "PURL": "pkg:apk/alpine/coreutils@9.8-r1?arch=x86_64\u0026distro=3.23.3", "UID": "585461a2708036b6" }, "Version": "9.8-r1", "Arch": "x86_64", "SrcName": "coreutils", "SrcVersion": "9.8-r1", "Licenses": [ "GPL-3.0-or-later" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "acl-libs@2.3.2-r1", "busybox-binsh@1.37.0-r30", "coreutils-env@9.8-r1", "coreutils-fmt@9.8-r1", "coreutils-sha512sum@9.8-r1", "libattr@2.5.2-r2", "libcrypto3@3.5.5-r0", "musl@1.2.5-r21", "utmps-libs@0.1.3.1-r0" ], "Layer": { "DiffID": "sha256:bfa66cef88150e054947357ece4a5ef622b49d30ce1021b9369a763334743eaf" }, "Digest": "sha1:19c9911c952ab8333ed24fa3e5fdf6f92f4d485c", "InstalledFiles": [ "bin/base64", "bin/cat", "bin/chgrp", "bin/chmod", "bin/chown", "bin/coreutils", "bin/cp", "bin/date", "bin/dd", "bin/df", "bin/echo", "bin/false", "bin/link", "bin/ln", "bin/ls", "bin/mkdir", "bin/mknod", "bin/mktemp", "bin/mv", "bin/nice", "bin/printenv", "bin/pwd", "bin/rm", "bin/rmdir", "bin/sleep", "bin/stat", "bin/stty", "bin/sync", "bin/touch", "bin/true", "bin/uname", "usr/bin/[", "usr/bin/b2sum", "usr/bin/base32", "usr/bin/basename", "usr/bin/basenc", "usr/bin/chcon", "usr/bin/cksum", "usr/bin/comm", "usr/bin/csplit", "usr/bin/cut", "usr/bin/dir", "usr/bin/dircolors", "usr/bin/dirname", "usr/bin/du", "usr/bin/expand", "usr/bin/expr", "usr/bin/factor", "usr/bin/fold", "usr/bin/head", "usr/bin/hostid", "usr/bin/id", "usr/bin/install", "usr/bin/join", "usr/bin/logname", "usr/bin/md5sum", "usr/bin/mkfifo", "usr/bin/nl", "usr/bin/nohup", "usr/bin/nproc", "usr/bin/numfmt", "usr/bin/od", "usr/bin/paste", "usr/bin/pathchk", "usr/bin/pinky", "usr/bin/pr", "usr/bin/printf", "usr/bin/ptx", "usr/bin/readlink", "usr/bin/realpath", "usr/bin/runcon", "usr/bin/seq", "usr/bin/sha1sum", "usr/bin/sha224sum", "usr/bin/sha256sum", "usr/bin/sha384sum", "usr/bin/shred", "usr/bin/shuf", "usr/bin/sort", "usr/bin/split", "usr/bin/stdbuf", "usr/bin/sum", "usr/bin/tac", "usr/bin/tail", "usr/bin/tee", "usr/bin/test", "usr/bin/timeout", "usr/bin/tr", "usr/bin/truncate", "usr/bin/tsort", "usr/bin/tty", "usr/bin/unexpand", "usr/bin/uniq", "usr/bin/unlink", "usr/bin/users", "usr/bin/vdir", "usr/bin/wc", "usr/bin/who", "usr/bin/whoami", "usr/bin/yes", "usr/libexec/coreutils/libstdbuf.so", "usr/sbin/chroot" ], "AnalyzedBy": "apk" }, { "ID": "coreutils-env@9.8-r1", "Name": "coreutils-env", "Identifier": { "PURL": "pkg:apk/alpine/coreutils-env@9.8-r1?arch=x86_64\u0026distro=3.23.3", "UID": "810e1d1c1d9507dd" }, "Version": "9.8-r1", "Arch": "x86_64", "SrcName": "coreutils", "SrcVersion": "9.8-r1", "Licenses": [ "GPL-3.0-or-later" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "musl@1.2.5-r21" ], "Layer": { "DiffID": "sha256:bfa66cef88150e054947357ece4a5ef622b49d30ce1021b9369a763334743eaf" }, "Digest": "sha1:b880b4c5f16591516c04f48e109306956cb98880", "InstalledFiles": [ "usr/bin/env" ], "AnalyzedBy": "apk" }, { "ID": "coreutils-fmt@9.8-r1", "Name": "coreutils-fmt", "Identifier": { "PURL": "pkg:apk/alpine/coreutils-fmt@9.8-r1?arch=x86_64\u0026distro=3.23.3", "UID": "c15f8c2852c1f79f" }, "Version": "9.8-r1", "Arch": "x86_64", "SrcName": "coreutils", "SrcVersion": "9.8-r1", "Licenses": [ "GPL-3.0-or-later" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "musl@1.2.5-r21" ], "Layer": { "DiffID": "sha256:bfa66cef88150e054947357ece4a5ef622b49d30ce1021b9369a763334743eaf" }, "Digest": "sha1:8c4b368fd6061b8ade06dab6e1f7a2291a61c1cf", "InstalledFiles": [ "usr/bin/fmt" ], "AnalyzedBy": "apk" }, { "ID": "coreutils-sha512sum@9.8-r1", "Name": "coreutils-sha512sum", "Identifier": { "PURL": "pkg:apk/alpine/coreutils-sha512sum@9.8-r1?arch=x86_64\u0026distro=3.23.3", "UID": "6b202939276f762b" }, "Version": "9.8-r1", "Arch": "x86_64", "SrcName": "coreutils", "SrcVersion": "9.8-r1", "Licenses": [ "GPL-3.0-or-later" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "libcrypto3@3.5.5-r0", "musl@1.2.5-r21" ], "Layer": { "DiffID": "sha256:bfa66cef88150e054947357ece4a5ef622b49d30ce1021b9369a763334743eaf" }, "Digest": "sha1:00e045b8fe5435071b97a5050ce2d10dfe697e6c", "InstalledFiles": [ "usr/bin/sha512sum" ], "AnalyzedBy": "apk" }, { "ID": "curl@8.19.0-r0", "Name": "curl", "Identifier": { "PURL": "pkg:apk/alpine/curl@8.19.0-r0?arch=x86_64\u0026distro=3.23.3", "UID": "9fd7499bdd8d5c3b" }, "Version": "8.19.0-r0", "Arch": "x86_64", "SrcName": "curl", "SrcVersion": "8.19.0-r0", "Licenses": [ "curl" ], "Maintainer": "Achill Gilgenast \u003cachill@achill.org\u003e", "DependsOn": [ "libcurl@8.19.0-r0", "musl@1.2.5-r21", "zlib@1.3.1-r2" ], "Layer": { "DiffID": "sha256:bfa66cef88150e054947357ece4a5ef622b49d30ce1021b9369a763334743eaf" }, "Digest": "sha1:812f1083cfc10c65b05b05bb4adfa3acb5cf6058", "InstalledFiles": [ "usr/bin/curl", "usr/bin/wcurl" ], "AnalyzedBy": "apk" }, { "ID": "docker-cli@29.1.3-r5", "Name": "docker-cli", "Identifier": { "PURL": "pkg:apk/alpine/docker-cli@29.1.3-r5?arch=x86_64\u0026distro=3.23.3", "UID": "75932c5885473348" }, "Version": "29.1.3-r5", "Arch": "x86_64", "SrcName": "docker", "SrcVersion": "29.1.3-r5", "Licenses": [ "Apache-2.0" ], "Maintainer": "Jake Buchholz Göktürk \u003ctomalok@gmail.com\u003e", "DependsOn": [ "ca-certificates@20260413-r0", "musl@1.2.5-r21" ], "Layer": { "DiffID": "sha256:bfa66cef88150e054947357ece4a5ef622b49d30ce1021b9369a763334743eaf" }, "Digest": "sha1:6822d8f6a6e9fdefe8d62760d4969fd2dee538f9", "InstalledFiles": [ "usr/bin/docker" ], "AnalyzedBy": "apk" }, { "ID": "findutils@4.10.0-r0", "Name": "findutils", "Identifier": { "PURL": "pkg:apk/alpine/findutils@4.10.0-r0?arch=x86_64\u0026distro=3.23.3", "UID": "af42ef0f5872cdc2" }, "Version": "4.10.0-r0", "Arch": "x86_64", "SrcName": "findutils", "SrcVersion": "4.10.0-r0", "Licenses": [ "GPL-3.0-or-later" ], "Maintainer": "Michael Mason \u003cms13sp@gmail.com\u003e", "DependsOn": [ "musl@1.2.5-r21" ], "Layer": { "DiffID": "sha256:bfa66cef88150e054947357ece4a5ef622b49d30ce1021b9369a763334743eaf" }, "Digest": "sha1:10d345ec6aec38764a9d2a4e4a13fc0244b79f98", "InstalledFiles": [ "usr/bin/find", "usr/bin/xargs" ], "AnalyzedBy": "apk" }, { "ID": "git@2.52.0-r0", "Name": "git", "Identifier": { "PURL": "pkg:apk/alpine/git@2.52.0-r0?arch=x86_64\u0026distro=3.23.3", "UID": "b9e45144f18de082" }, "Version": "2.52.0-r0", "Arch": "x86_64", "SrcName": "git", "SrcVersion": "2.52.0-r0", "Licenses": [ "GPL-2.0-only" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "libcurl@8.19.0-r0", "libexpat@2.7.5-r0", "musl@1.2.5-r21", "pcre2@10.47-r0", "zlib@1.3.1-r2" ], "Layer": { "DiffID": "sha256:66331502f5f6a99cd657f4ef104273d82c78207f11e9d8f5ca16e2b53d08c361" }, "Digest": "sha1:bd0b28f91894dc75880a22468445a2d084beb009", "InstalledFiles": [ "usr/bin/git", "usr/bin/git-receive-pack", "usr/bin/git-shell", "usr/bin/git-upload-archive", "usr/bin/git-upload-pack", "usr/libexec/git-core/git", "usr/libexec/git-core/git-add", "usr/libexec/git-core/git-am", "usr/libexec/git-core/git-annotate", "usr/libexec/git-core/git-apply", "usr/libexec/git-core/git-archive", "usr/libexec/git-core/git-backfill", "usr/libexec/git-core/git-bisect", "usr/libexec/git-core/git-blame", "usr/libexec/git-core/git-branch", "usr/libexec/git-core/git-bugreport", "usr/libexec/git-core/git-bundle", "usr/libexec/git-core/git-cat-file", "usr/libexec/git-core/git-check-attr", "usr/libexec/git-core/git-check-ignore", "usr/libexec/git-core/git-check-mailmap", "usr/libexec/git-core/git-check-ref-format", "usr/libexec/git-core/git-checkout", "usr/libexec/git-core/git-checkout--worker", "usr/libexec/git-core/git-checkout-index", "usr/libexec/git-core/git-cherry", "usr/libexec/git-core/git-cherry-pick", "usr/libexec/git-core/git-clean", "usr/libexec/git-core/git-clone", "usr/libexec/git-core/git-column", "usr/libexec/git-core/git-commit", "usr/libexec/git-core/git-commit-graph", "usr/libexec/git-core/git-commit-tree", "usr/libexec/git-core/git-config", "usr/libexec/git-core/git-count-objects", "usr/libexec/git-core/git-credential", "usr/libexec/git-core/git-credential-cache", "usr/libexec/git-core/git-credential-cache--daemon", "usr/libexec/git-core/git-credential-store", "usr/libexec/git-core/git-describe", "usr/libexec/git-core/git-diagnose", "usr/libexec/git-core/git-diff", "usr/libexec/git-core/git-diff-files", "usr/libexec/git-core/git-diff-index", "usr/libexec/git-core/git-diff-pairs", "usr/libexec/git-core/git-diff-tree", "usr/libexec/git-core/git-difftool", "usr/libexec/git-core/git-difftool--helper", "usr/libexec/git-core/git-fast-export", "usr/libexec/git-core/git-fetch", "usr/libexec/git-core/git-fetch-pack", "usr/libexec/git-core/git-filter-branch", "usr/libexec/git-core/git-fmt-merge-msg", "usr/libexec/git-core/git-for-each-ref", "usr/libexec/git-core/git-for-each-repo", "usr/libexec/git-core/git-format-patch", "usr/libexec/git-core/git-fsck", "usr/libexec/git-core/git-fsck-objects", "usr/libexec/git-core/git-fsmonitor--daemon", "usr/libexec/git-core/git-gc", "usr/libexec/git-core/git-get-tar-commit-id", "usr/libexec/git-core/git-grep", "usr/libexec/git-core/git-gui--askyesno", "usr/libexec/git-core/git-hash-object", "usr/libexec/git-core/git-help", "usr/libexec/git-core/git-hook", "usr/libexec/git-core/git-http-fetch", "usr/libexec/git-core/git-http-push", "usr/libexec/git-core/git-index-pack", "usr/libexec/git-core/git-init", "usr/libexec/git-core/git-init-db", "usr/libexec/git-core/git-interpret-trailers", "usr/libexec/git-core/git-last-modified", "usr/libexec/git-core/git-log", "usr/libexec/git-core/git-ls-files", "usr/libexec/git-core/git-ls-remote", "usr/libexec/git-core/git-ls-tree", "usr/libexec/git-core/git-mailinfo", "usr/libexec/git-core/git-mailsplit", "usr/libexec/git-core/git-maintenance", "usr/libexec/git-core/git-merge", "usr/libexec/git-core/git-merge-base", "usr/libexec/git-core/git-merge-file", "usr/libexec/git-core/git-merge-index", "usr/libexec/git-core/git-merge-octopus", "usr/libexec/git-core/git-merge-one-file", "usr/libexec/git-core/git-merge-ours", "usr/libexec/git-core/git-merge-recursive", "usr/libexec/git-core/git-merge-resolve", "usr/libexec/git-core/git-merge-subtree", "usr/libexec/git-core/git-merge-tree", "usr/libexec/git-core/git-mergetool", "usr/libexec/git-core/git-mergetool--lib", "usr/libexec/git-core/git-mktag", "usr/libexec/git-core/git-mktree", "usr/libexec/git-core/git-multi-pack-index", "usr/libexec/git-core/git-mv", "usr/libexec/git-core/git-name-rev", "usr/libexec/git-core/git-notes", "usr/libexec/git-core/git-pack-objects", "usr/libexec/git-core/git-pack-redundant", "usr/libexec/git-core/git-pack-refs", "usr/libexec/git-core/git-patch-id", "usr/libexec/git-core/git-prune", "usr/libexec/git-core/git-prune-packed", "usr/libexec/git-core/git-pull", "usr/libexec/git-core/git-push", "usr/libexec/git-core/git-quiltimport", "usr/libexec/git-core/git-range-diff", "usr/libexec/git-core/git-read-tree", "usr/libexec/git-core/git-rebase", "usr/libexec/git-core/git-receive-pack", "usr/libexec/git-core/git-reflog", "usr/libexec/git-core/git-refs", "usr/libexec/git-core/git-remote", "usr/libexec/git-core/git-remote-ext", "usr/libexec/git-core/git-remote-fd", "usr/libexec/git-core/git-remote-ftp", "usr/libexec/git-core/git-remote-ftps", "usr/libexec/git-core/git-remote-http", "usr/libexec/git-core/git-remote-https", "usr/libexec/git-core/git-repack", "usr/libexec/git-core/git-replace", "usr/libexec/git-core/git-replay", "usr/libexec/git-core/git-repo", "usr/libexec/git-core/git-request-pull", "usr/libexec/git-core/git-rerere", "usr/libexec/git-core/git-reset", "usr/libexec/git-core/git-restore", "usr/libexec/git-core/git-rev-list", "usr/libexec/git-core/git-rev-parse", "usr/libexec/git-core/git-revert", "usr/libexec/git-core/git-rm", "usr/libexec/git-core/git-send-pack", "usr/libexec/git-core/git-sh-i18n", "usr/libexec/git-core/git-sh-i18n--envsubst", "usr/libexec/git-core/git-sh-setup", "usr/libexec/git-core/git-shortlog", "usr/libexec/git-core/git-show", "usr/libexec/git-core/git-show-branch", "usr/libexec/git-core/git-show-index", "usr/libexec/git-core/git-show-ref", "usr/libexec/git-core/git-sparse-checkout", "usr/libexec/git-core/git-stage", "usr/libexec/git-core/git-stash", "usr/libexec/git-core/git-status", "usr/libexec/git-core/git-stripspace", "usr/libexec/git-core/git-submodule", "usr/libexec/git-core/git-submodule--helper", "usr/libexec/git-core/git-switch", "usr/libexec/git-core/git-symbolic-ref", "usr/libexec/git-core/git-tag", "usr/libexec/git-core/git-unpack-file", "usr/libexec/git-core/git-unpack-objects", "usr/libexec/git-core/git-update-index", "usr/libexec/git-core/git-update-ref", "usr/libexec/git-core/git-update-server-info", "usr/libexec/git-core/git-upload-archive", "usr/libexec/git-core/git-upload-pack", "usr/libexec/git-core/git-var", "usr/libexec/git-core/git-verify-commit", "usr/libexec/git-core/git-verify-pack", "usr/libexec/git-core/git-verify-tag", "usr/libexec/git-core/git-version", "usr/libexec/git-core/git-web--browse", "usr/libexec/git-core/git-whatchanged", "usr/libexec/git-core/git-worktree", "usr/libexec/git-core/git-write-tree", "usr/libexec/git-core/mergetools/araxis", "usr/libexec/git-core/mergetools/bc", "usr/libexec/git-core/mergetools/codecompare", "usr/libexec/git-core/mergetools/deltawalker", "usr/libexec/git-core/mergetools/diffmerge", "usr/libexec/git-core/mergetools/diffuse", "usr/libexec/git-core/mergetools/ecmerge", "usr/libexec/git-core/mergetools/emerge", "usr/libexec/git-core/mergetools/examdiff", "usr/libexec/git-core/mergetools/guiffy", "usr/libexec/git-core/mergetools/gvimdiff", "usr/libexec/git-core/mergetools/kdiff3", "usr/libexec/git-core/mergetools/kompare", "usr/libexec/git-core/mergetools/meld", "usr/libexec/git-core/mergetools/nvimdiff", "usr/libexec/git-core/mergetools/opendiff", "usr/libexec/git-core/mergetools/smerge", "usr/libexec/git-core/mergetools/tkdiff", "usr/libexec/git-core/mergetools/tortoisemerge", "usr/libexec/git-core/mergetools/vimdiff", "usr/libexec/git-core/mergetools/vscode", "usr/libexec/git-core/mergetools/winmerge", "usr/libexec/git-core/mergetools/xxdiff" ], "AnalyzedBy": "apk" }, { "ID": "git-init-template@2.52.0-r0", "Name": "git-init-template", "Identifier": { "PURL": "pkg:apk/alpine/git-init-template@2.52.0-r0?arch=x86_64\u0026distro=3.23.3", "UID": "3266ef12238e4e14" }, "Version": "2.52.0-r0", "Arch": "x86_64", "SrcName": "git", "SrcVersion": "2.52.0-r0", "Licenses": [ "GPL-2.0-only" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "Layer": { "DiffID": "sha256:66331502f5f6a99cd657f4ef104273d82c78207f11e9d8f5ca16e2b53d08c361" }, "Digest": "sha1:ff15a67d1f4948618a1022091ae7a1bf399f3665", "InstalledFiles": [ "usr/share/git-core/templates/description", "usr/share/git-core/templates/hooks/applypatch-msg.sample", "usr/share/git-core/templates/hooks/commit-msg.sample", "usr/share/git-core/templates/hooks/post-update.sample", "usr/share/git-core/templates/hooks/pre-applypatch.sample", "usr/share/git-core/templates/hooks/pre-commit.sample", "usr/share/git-core/templates/hooks/pre-merge-commit.sample", "usr/share/git-core/templates/hooks/pre-push.sample", "usr/share/git-core/templates/hooks/pre-rebase.sample", "usr/share/git-core/templates/hooks/pre-receive.sample", "usr/share/git-core/templates/hooks/prepare-commit-msg.sample", "usr/share/git-core/templates/hooks/push-to-checkout.sample", "usr/share/git-core/templates/hooks/sendemail-validate.sample", "usr/share/git-core/templates/hooks/update.sample", "usr/share/git-core/templates/info/exclude" ], "AnalyzedBy": "apk" }, { "ID": "jq@1.8.1-r0", "Name": "jq", "Identifier": { "PURL": "pkg:apk/alpine/jq@1.8.1-r0?arch=x86_64\u0026distro=3.23.3", "UID": "ef275774a650dbd5" }, "Version": "1.8.1-r0", "Arch": "x86_64", "SrcName": "jq", "SrcVersion": "1.8.1-r0", "Licenses": [ "MIT" ], "Maintainer": "Patrycja Rosa \u003calpine@ptrcnull.me\u003e", "DependsOn": [ "musl@1.2.5-r21", "oniguruma@6.9.10-r0" ], "Layer": { "DiffID": "sha256:bfa66cef88150e054947357ece4a5ef622b49d30ce1021b9369a763334743eaf" }, "Digest": "sha1:c979cdbef0d68d64a103d0b99244ec384be06742", "InstalledFiles": [ "usr/bin/jq", "usr/lib/libjq.so.1", "usr/lib/libjq.so.1.0.4" ], "AnalyzedBy": "apk" }, { "ID": "libapk@3.0.3-r1", "Name": "libapk", "Identifier": { "PURL": "pkg:apk/alpine/libapk@3.0.3-r1?arch=x86_64\u0026distro=3.23.3", "UID": "d8a4dac06126e84f" }, "Version": "3.0.3-r1", "Arch": "x86_64", "SrcName": "apk-tools", "SrcVersion": "3.0.3-r1", "Licenses": [ "GPL-2.0-only" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "libcrypto3@3.5.5-r0", "libssl3@3.5.5-r0", "musl@1.2.5-r21", "zlib@1.3.1-r2" ], "Layer": { "DiffID": "sha256:989e799e634906e94dc9a5ee2ee26fc92ad260522990f26e707861a5f52bf64e" }, "Digest": "sha1:17d0c18e379eb411aaa3e07392343a2dd6e098cc", "InstalledFiles": [ "usr/lib/libapk.so.3.0.0" ], "AnalyzedBy": "apk" }, { "ID": "libattr@2.5.2-r2", "Name": "libattr", "Identifier": { "PURL": "pkg:apk/alpine/libattr@2.5.2-r2?arch=x86_64\u0026distro=3.23.3", "UID": "dd817d271a34999f" }, "Version": "2.5.2-r2", "Arch": "x86_64", "SrcName": "attr", "SrcVersion": "2.5.2-r2", "Licenses": [ "LGPL-2.1-or-later" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "musl@1.2.5-r21" ], "Layer": { "DiffID": "sha256:bfa66cef88150e054947357ece4a5ef622b49d30ce1021b9369a763334743eaf" }, "Digest": "sha1:6276fce9eec571e50023430e1c2a8cb4009bde53", "InstalledFiles": [ "usr/lib/libattr.so.1", "usr/lib/libattr.so.1.1.2502" ], "AnalyzedBy": "apk" }, { "ID": "libcrypto3@3.5.5-r0", "Name": "libcrypto3", "Identifier": { "PURL": "pkg:apk/alpine/libcrypto3@3.5.5-r0?arch=x86_64\u0026distro=3.23.3", "UID": "6778a588f2cebd48" }, "Version": "3.5.5-r0", "Arch": "x86_64", "SrcName": "openssl", "SrcVersion": "3.5.5-r0", "Licenses": [ "Apache-2.0" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "musl@1.2.5-r21" ], "Layer": { "DiffID": "sha256:989e799e634906e94dc9a5ee2ee26fc92ad260522990f26e707861a5f52bf64e" }, "Digest": "sha1:9ebf6995e814bacff0c04a868b0b27c3e82090f4", "InstalledFiles": [ "etc/ssl/ct_log_list.cnf", "etc/ssl/ct_log_list.cnf.dist", "etc/ssl/openssl.cnf", "etc/ssl/openssl.cnf.dist", "usr/lib/libcrypto.so.3", "usr/lib/engines-3/afalg.so", "usr/lib/engines-3/capi.so", "usr/lib/engines-3/loader_attic.so", "usr/lib/engines-3/padlock.so", "usr/lib/ossl-modules/legacy.so" ], "AnalyzedBy": "apk" }, { "ID": "libcurl@8.19.0-r0", "Name": "libcurl", "Identifier": { "PURL": "pkg:apk/alpine/libcurl@8.19.0-r0?arch=x86_64\u0026distro=3.23.3", "UID": "478d655ffa641497" }, "Version": "8.19.0-r0", "Arch": "x86_64", "SrcName": "curl", "SrcVersion": "8.19.0-r0", "Licenses": [ "curl" ], "Maintainer": "Achill Gilgenast \u003cachill@achill.org\u003e", "DependsOn": [ "brotli-libs@1.2.0-r0", "c-ares@1.34.6-r0", "ca-certificates-bundle@20251003-r0", "libcrypto3@3.5.5-r0", "libidn2@2.3.8-r0", "libpsl@0.21.5-r3", "libssl3@3.5.5-r0", "musl@1.2.5-r21", "nghttp2-libs@1.68.0-r0", "zlib@1.3.1-r2", "zstd-libs@1.5.7-r2" ], "Layer": { "DiffID": "sha256:bfa66cef88150e054947357ece4a5ef622b49d30ce1021b9369a763334743eaf" }, "Digest": "sha1:c833586b6e5dcd4a10da7cf354b01d9e0ee10da8", "InstalledFiles": [ "usr/lib/libcurl.so.4", "usr/lib/libcurl.so.4.8.0" ], "AnalyzedBy": "apk" }, { "ID": "libexpat@2.7.5-r0", "Name": "libexpat", "Identifier": { "PURL": "pkg:apk/alpine/libexpat@2.7.5-r0?arch=x86_64\u0026distro=3.23.3", "UID": "60ae354914fcce6c" }, "Version": "2.7.5-r0", "Arch": "x86_64", "SrcName": "expat", "SrcVersion": "2.7.5-r0", "Licenses": [ "MIT" ], "Maintainer": "Carlo Landmeter \u003cclandmeter@alpinelinux.org\u003e", "DependsOn": [ "musl@1.2.5-r21" ], "Layer": { "DiffID": "sha256:66331502f5f6a99cd657f4ef104273d82c78207f11e9d8f5ca16e2b53d08c361" }, "Digest": "sha1:5760d53ddd7cca8a742c672e4e00a475718eacaa", "InstalledFiles": [ "usr/lib/libexpat.so.1", "usr/lib/libexpat.so.1.11.3" ], "AnalyzedBy": "apk" }, { "ID": "libidn2@2.3.8-r0", "Name": "libidn2", "Identifier": { "PURL": "pkg:apk/alpine/libidn2@2.3.8-r0?arch=x86_64\u0026distro=3.23.3", "UID": "e2fcbba2f74d78bf" }, "Version": "2.3.8-r0", "Arch": "x86_64", "SrcName": "libidn2", "SrcVersion": "2.3.8-r0", "Licenses": [ "GPL-2.0-or-later", "LGPL-3.0-or-later" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "libunistring@1.4.1-r0", "musl@1.2.5-r21" ], "Layer": { "DiffID": "sha256:66331502f5f6a99cd657f4ef104273d82c78207f11e9d8f5ca16e2b53d08c361" }, "Digest": "sha1:b8c5bfa365da5c360a01230db4d71e65af94af3d", "InstalledFiles": [ "usr/lib/libidn2.so.0", "usr/lib/libidn2.so.0.4.0" ], "AnalyzedBy": "apk" }, { "ID": "libncursesw@6.5_p20251123-r0", "Name": "libncursesw", "Identifier": { "PURL": "pkg:apk/alpine/libncursesw@6.5_p20251123-r0?arch=x86_64\u0026distro=3.23.3", "UID": "6a5d130d9eac3aa5" }, "Version": "6.5_p20251123-r0", "Arch": "x86_64", "SrcName": "ncurses", "SrcVersion": "6.5_p20251123-r0", "Licenses": [ "X-11" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "musl@1.2.5-r21", "ncurses-terminfo-base@6.5_p20251123-r0" ], "Layer": { "DiffID": "sha256:bfa66cef88150e054947357ece4a5ef622b49d30ce1021b9369a763334743eaf" }, "Digest": "sha1:649d3041c52b80620fb50a98f5979d25ebbe1523", "InstalledFiles": [ "usr/lib/libncursesw.so.6", "usr/lib/libncursesw.so.6.5" ], "AnalyzedBy": "apk" }, { "ID": "libpsl@0.21.5-r3", "Name": "libpsl", "Identifier": { "PURL": "pkg:apk/alpine/libpsl@0.21.5-r3?arch=x86_64\u0026distro=3.23.3", "UID": "9fb5bd2254e54a0" }, "Version": "0.21.5-r3", "Arch": "x86_64", "SrcName": "libpsl", "SrcVersion": "0.21.5-r3", "Licenses": [ "MIT" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "libidn2@2.3.8-r0", "libunistring@1.4.1-r0", "musl@1.2.5-r21" ], "Layer": { "DiffID": "sha256:66331502f5f6a99cd657f4ef104273d82c78207f11e9d8f5ca16e2b53d08c361" }, "Digest": "sha1:b663c00f920a93be49c825555aa1a212e4287393", "InstalledFiles": [ "usr/lib/libpsl.so.5", "usr/lib/libpsl.so.5.3.5" ], "AnalyzedBy": "apk" }, { "ID": "libssl3@3.5.5-r0", "Name": "libssl3", "Identifier": { "PURL": "pkg:apk/alpine/libssl3@3.5.5-r0?arch=x86_64\u0026distro=3.23.3", "UID": "bca2260902e2ef48" }, "Version": "3.5.5-r0", "Arch": "x86_64", "SrcName": "openssl", "SrcVersion": "3.5.5-r0", "Licenses": [ "Apache-2.0" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "libcrypto3@3.5.5-r0", "musl@1.2.5-r21" ], "Layer": { "DiffID": "sha256:989e799e634906e94dc9a5ee2ee26fc92ad260522990f26e707861a5f52bf64e" }, "Digest": "sha1:12234895b6577cddcbe3450406f357600e8a6951", "InstalledFiles": [ "usr/lib/libssl.so.3" ], "AnalyzedBy": "apk" }, { "ID": "libunistring@1.4.1-r0", "Name": "libunistring", "Identifier": { "PURL": "pkg:apk/alpine/libunistring@1.4.1-r0?arch=x86_64\u0026distro=3.23.3", "UID": "4e0ee8fa7d9a5823" }, "Version": "1.4.1-r0", "Arch": "x86_64", "SrcName": "libunistring", "SrcVersion": "1.4.1-r0", "Licenses": [ "GPL-2.0-or-later", "LGPL-3.0-or-later" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "musl@1.2.5-r21" ], "Layer": { "DiffID": "sha256:66331502f5f6a99cd657f4ef104273d82c78207f11e9d8f5ca16e2b53d08c361" }, "Digest": "sha1:6e56562bde456bee5971787d3d95c34e84ced797", "InstalledFiles": [ "usr/lib/libunistring.so.5", "usr/lib/libunistring.so.5.2.1" ], "AnalyzedBy": "apk" }, { "ID": "musl@1.2.5-r21", "Name": "musl", "Identifier": { "PURL": "pkg:apk/alpine/musl@1.2.5-r21?arch=x86_64\u0026distro=3.23.3", "UID": "750ab06f52f2bfe9" }, "Version": "1.2.5-r21", "Arch": "x86_64", "SrcName": "musl", "SrcVersion": "1.2.5-r21", "Licenses": [ "MIT" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "Layer": { "DiffID": "sha256:989e799e634906e94dc9a5ee2ee26fc92ad260522990f26e707861a5f52bf64e" }, "Digest": "sha1:d05a75ec13e1a7a8bab56ce7cd3dc79bd727e698", "InstalledFiles": [ "lib/ld-musl-x86_64.so.1", "lib/libc.musl-x86_64.so.1" ], "AnalyzedBy": "apk" }, { "ID": "musl-utils@1.2.5-r21", "Name": "musl-utils", "Identifier": { "PURL": "pkg:apk/alpine/musl-utils@1.2.5-r21?arch=x86_64\u0026distro=3.23.3", "UID": "9dadd6d4093981ad" }, "Version": "1.2.5-r21", "Arch": "x86_64", "SrcName": "musl", "SrcVersion": "1.2.5-r21", "Licenses": [ "MIT", "BSD-2-Clause", "GPL-2.0-or-later" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "musl@1.2.5-r21", "scanelf@1.3.8-r2" ], "Layer": { "DiffID": "sha256:989e799e634906e94dc9a5ee2ee26fc92ad260522990f26e707861a5f52bf64e" }, "Digest": "sha1:daa79528d2cf877f6d656207a818d43c8dea9a30", "InstalledFiles": [ "sbin/ldconfig", "usr/bin/getconf", "usr/bin/getent", "usr/bin/iconv", "usr/bin/ldd" ], "AnalyzedBy": "apk" }, { "ID": "ncurses-terminfo-base@6.5_p20251123-r0", "Name": "ncurses-terminfo-base", "Identifier": { "PURL": "pkg:apk/alpine/ncurses-terminfo-base@6.5_p20251123-r0?arch=x86_64\u0026distro=3.23.3", "UID": "5acf10991828fa7a" }, "Version": "6.5_p20251123-r0", "Arch": "x86_64", "SrcName": "ncurses", "SrcVersion": "6.5_p20251123-r0", "Licenses": [ "X-11" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "Layer": { "DiffID": "sha256:bfa66cef88150e054947357ece4a5ef622b49d30ce1021b9369a763334743eaf" }, "Digest": "sha1:57bd1d8124ec957eefea2314bdf45b0ed1068cee", "InstalledFiles": [ "etc/terminfo/a/alacritty", "etc/terminfo/a/ansi", "etc/terminfo/d/dumb", "etc/terminfo/g/gnome", "etc/terminfo/g/gnome-256color", "etc/terminfo/k/konsole", "etc/terminfo/k/konsole-256color", "etc/terminfo/k/konsole-linux", "etc/terminfo/l/linux", "etc/terminfo/p/putty", "etc/terminfo/p/putty-256color", "etc/terminfo/r/rxvt", "etc/terminfo/r/rxvt-256color", "etc/terminfo/s/screen", "etc/terminfo/s/screen-256color", "etc/terminfo/s/st-0.6", "etc/terminfo/s/st-0.7", "etc/terminfo/s/st-0.8", "etc/terminfo/s/st-0.8.5", "etc/terminfo/s/st-16color", "etc/terminfo/s/st-256color", "etc/terminfo/s/st-direct", "etc/terminfo/s/sun", "etc/terminfo/t/terminator", "etc/terminfo/t/terminology", "etc/terminfo/t/terminology-0.6.1", "etc/terminfo/t/terminology-1.0.0", "etc/terminfo/t/terminology-1.8.1", "etc/terminfo/t/tmux", "etc/terminfo/t/tmux-256color", "etc/terminfo/v/vt100", "etc/terminfo/v/vt102", "etc/terminfo/v/vt200", "etc/terminfo/v/vt220", "etc/terminfo/v/vt52", "etc/terminfo/v/vte", "etc/terminfo/v/vte-256color", "etc/terminfo/x/xterm", "etc/terminfo/x/xterm-256color", "etc/terminfo/x/xterm-color", "etc/terminfo/x/xterm-xfree86" ], "AnalyzedBy": "apk" }, { "ID": "nghttp2-libs@1.68.0-r0", "Name": "nghttp2-libs", "Identifier": { "PURL": "pkg:apk/alpine/nghttp2-libs@1.68.0-r0?arch=x86_64\u0026distro=3.23.3", "UID": "802c936f9e7891b2" }, "Version": "1.68.0-r0", "Arch": "x86_64", "SrcName": "nghttp2", "SrcVersion": "1.68.0-r0", "Licenses": [ "MIT" ], "Maintainer": "Francesco Colista \u003cfcolista@alpinelinux.org\u003e", "DependsOn": [ "musl@1.2.5-r21" ], "Layer": { "DiffID": "sha256:66331502f5f6a99cd657f4ef104273d82c78207f11e9d8f5ca16e2b53d08c361" }, "Digest": "sha1:584b6a1b0aed58a3f543bfd77729b0d8a8b1745b", "InstalledFiles": [ "usr/lib/libnghttp2.so.14", "usr/lib/libnghttp2.so.14.29.2" ], "AnalyzedBy": "apk" }, { "ID": "oniguruma@6.9.10-r0", "Name": "oniguruma", "Identifier": { "PURL": "pkg:apk/alpine/oniguruma@6.9.10-r0?arch=x86_64\u0026distro=3.23.3", "UID": "99fc7095695cdc4b" }, "Version": "6.9.10-r0", "Arch": "x86_64", "SrcName": "oniguruma", "SrcVersion": "6.9.10-r0", "Licenses": [ "BSD-2-Clause" ], "Maintainer": "Francesco Colista \u003cfcolista@alpinelinux.org\u003e", "DependsOn": [ "musl@1.2.5-r21" ], "Layer": { "DiffID": "sha256:bfa66cef88150e054947357ece4a5ef622b49d30ce1021b9369a763334743eaf" }, "Digest": "sha1:9ec60a2a173f25403f88ec4a2510cdbe6e2cac28", "InstalledFiles": [ "usr/lib/libonig.so.5", "usr/lib/libonig.so.5.5.0" ], "AnalyzedBy": "apk" }, { "ID": "pcre2@10.47-r0", "Name": "pcre2", "Identifier": { "PURL": "pkg:apk/alpine/pcre2@10.47-r0?arch=x86_64\u0026distro=3.23.3", "UID": "84da847bec967f4e" }, "Version": "10.47-r0", "Arch": "x86_64", "SrcName": "pcre2", "SrcVersion": "10.47-r0", "Licenses": [ "BSD-3-Clause" ], "Maintainer": "Jakub Jirutka \u003cjakub@jirutka.cz\u003e", "DependsOn": [ "musl@1.2.5-r21" ], "Layer": { "DiffID": "sha256:66331502f5f6a99cd657f4ef104273d82c78207f11e9d8f5ca16e2b53d08c361" }, "Digest": "sha1:549059958151627bb0f5469bded945988b1bc24b", "InstalledFiles": [ "usr/lib/libpcre2-8.so.0", "usr/lib/libpcre2-8.so.0.15.0", "usr/lib/libpcre2-posix.so.3", "usr/lib/libpcre2-posix.so.3.0.7" ], "AnalyzedBy": "apk" }, { "ID": "readline@8.3.1-r0", "Name": "readline", "Identifier": { "PURL": "pkg:apk/alpine/readline@8.3.1-r0?arch=x86_64\u0026distro=3.23.3", "UID": "6b729f00ce4a7154" }, "Version": "8.3.1-r0", "Arch": "x86_64", "SrcName": "readline", "SrcVersion": "8.3.1-r0", "Licenses": [ "GPL-3.0-or-later" ], "Maintainer": "Celeste \u003ccielesti@protonmail.com\u003e", "DependsOn": [ "libncursesw@6.5_p20251123-r0", "musl@1.2.5-r21" ], "Layer": { "DiffID": "sha256:bfa66cef88150e054947357ece4a5ef622b49d30ce1021b9369a763334743eaf" }, "Digest": "sha1:8aeb81b3a477f922b9b6a533381114c63dd928fe", "InstalledFiles": [ "etc/inputrc", "usr/lib/libreadline.so.8", "usr/lib/libreadline.so.8.3" ], "AnalyzedBy": "apk" }, { "ID": "scanelf@1.3.8-r2", "Name": "scanelf", "Identifier": { "PURL": "pkg:apk/alpine/scanelf@1.3.8-r2?arch=x86_64\u0026distro=3.23.3", "UID": "948b35f6525ae462" }, "Version": "1.3.8-r2", "Arch": "x86_64", "SrcName": "pax-utils", "SrcVersion": "1.3.8-r2", "Licenses": [ "GPL-2.0-only" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "musl@1.2.5-r21" ], "Layer": { "DiffID": "sha256:989e799e634906e94dc9a5ee2ee26fc92ad260522990f26e707861a5f52bf64e" }, "Digest": "sha1:6ea36dd44ef9f6364f0cdfabe09ea15d2fdbe229", "InstalledFiles": [ "usr/bin/scanelf" ], "AnalyzedBy": "apk" }, { "ID": "skalibs-libs@2.14.4.0-r0", "Name": "skalibs-libs", "Identifier": { "PURL": "pkg:apk/alpine/skalibs-libs@2.14.4.0-r0?arch=x86_64\u0026distro=3.23.3", "UID": "86da47ec2ff915b3" }, "Version": "2.14.4.0-r0", "Arch": "x86_64", "SrcName": "skalibs", "SrcVersion": "2.14.4.0-r0", "Licenses": [ "ISC" ], "Maintainer": "Laurent Bercot \u003cska-devel@skarnet.org\u003e", "DependsOn": [ "musl@1.2.5-r21" ], "Layer": { "DiffID": "sha256:bfa66cef88150e054947357ece4a5ef622b49d30ce1021b9369a763334743eaf" }, "Digest": "sha1:ba2d0ace9fa1948f2f39f3cbf939887add78b207", "InstalledFiles": [ "usr/lib/libskarnet.so.2.14", "usr/lib/libskarnet.so.2.14.4.0" ], "AnalyzedBy": "apk" }, { "ID": "ssl_client@1.37.0-r30", "Name": "ssl_client", "Identifier": { "PURL": "pkg:apk/alpine/ssl_client@1.37.0-r30?arch=x86_64\u0026distro=3.23.3", "UID": "260f15056a81cadb" }, "Version": "1.37.0-r30", "Arch": "x86_64", "SrcName": "busybox", "SrcVersion": "1.37.0-r30", "Licenses": [ "GPL-2.0-only" ], "Maintainer": "Sören Tempel \u003csoeren+alpine@soeren-tempel.net\u003e", "DependsOn": [ "libcrypto3@3.5.5-r0", "libssl3@3.5.5-r0", "musl@1.2.5-r21" ], "Layer": { "DiffID": "sha256:989e799e634906e94dc9a5ee2ee26fc92ad260522990f26e707861a5f52bf64e" }, "Digest": "sha1:5b6ec0939cfc9be47d9677a3152c547cc18b5edd", "InstalledFiles": [ "usr/bin/ssl_client" ], "AnalyzedBy": "apk" }, { "ID": "tzdata@2026b-r0", "Name": "tzdata", "Identifier": { "PURL": "pkg:apk/alpine/tzdata@2026b-r0?arch=x86_64\u0026distro=3.23.3", "UID": "86f2dfb9a4acee39" }, "Version": "2026b-r0", "Arch": "x86_64", "SrcName": "tzdata", "SrcVersion": "2026b-r0", "Licenses": [ "Public-Domain" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "Layer": { "DiffID": "sha256:bfa66cef88150e054947357ece4a5ef622b49d30ce1021b9369a763334743eaf" }, "Digest": "sha1:2624b59cfb8182dfb3de19043c6867cd1b3e1779", "InstalledFiles": [ "usr/share/zoneinfo/CET", "usr/share/zoneinfo/CST6CDT", "usr/share/zoneinfo/Cuba", "usr/share/zoneinfo/EET", "usr/share/zoneinfo/EST", "usr/share/zoneinfo/EST5EDT", "usr/share/zoneinfo/Egypt", "usr/share/zoneinfo/Eire", "usr/share/zoneinfo/Factory", "usr/share/zoneinfo/GB", "usr/share/zoneinfo/GB-Eire", "usr/share/zoneinfo/GMT", "usr/share/zoneinfo/GMT+0", "usr/share/zoneinfo/GMT-0", "usr/share/zoneinfo/GMT0", "usr/share/zoneinfo/Greenwich", "usr/share/zoneinfo/HST", "usr/share/zoneinfo/Hongkong", "usr/share/zoneinfo/Iceland", "usr/share/zoneinfo/Iran", "usr/share/zoneinfo/Israel", "usr/share/zoneinfo/Jamaica", "usr/share/zoneinfo/Japan", "usr/share/zoneinfo/Kwajalein", "usr/share/zoneinfo/Libya", "usr/share/zoneinfo/MET", "usr/share/zoneinfo/MST", "usr/share/zoneinfo/MST7MDT", "usr/share/zoneinfo/NZ", "usr/share/zoneinfo/NZ-CHAT", "usr/share/zoneinfo/Navajo", "usr/share/zoneinfo/PRC", "usr/share/zoneinfo/PST8PDT", "usr/share/zoneinfo/Poland", "usr/share/zoneinfo/Portugal", "usr/share/zoneinfo/ROC", "usr/share/zoneinfo/ROK", "usr/share/zoneinfo/Singapore", "usr/share/zoneinfo/Turkey", "usr/share/zoneinfo/UCT", "usr/share/zoneinfo/UTC", "usr/share/zoneinfo/Universal", "usr/share/zoneinfo/W-SU", "usr/share/zoneinfo/WET", "usr/share/zoneinfo/Zulu", "usr/share/zoneinfo/iso3166.tab", "usr/share/zoneinfo/leap-seconds.list", "usr/share/zoneinfo/posixrules", "usr/share/zoneinfo/zone.tab", "usr/share/zoneinfo/zone1970.tab", "usr/share/zoneinfo/Africa/Abidjan", "usr/share/zoneinfo/Africa/Accra", "usr/share/zoneinfo/Africa/Addis_Ababa", "usr/share/zoneinfo/Africa/Algiers", "usr/share/zoneinfo/Africa/Asmara", "usr/share/zoneinfo/Africa/Asmera", "usr/share/zoneinfo/Africa/Bamako", "usr/share/zoneinfo/Africa/Bangui", "usr/share/zoneinfo/Africa/Banjul", "usr/share/zoneinfo/Africa/Bissau", "usr/share/zoneinfo/Africa/Blantyre", "usr/share/zoneinfo/Africa/Brazzaville", "usr/share/zoneinfo/Africa/Bujumbura", "usr/share/zoneinfo/Africa/Cairo", "usr/share/zoneinfo/Africa/Casablanca", "usr/share/zoneinfo/Africa/Ceuta", "usr/share/zoneinfo/Africa/Conakry", "usr/share/zoneinfo/Africa/Dakar", "usr/share/zoneinfo/Africa/Dar_es_Salaam", "usr/share/zoneinfo/Africa/Djibouti", "usr/share/zoneinfo/Africa/Douala", "usr/share/zoneinfo/Africa/El_Aaiun", "usr/share/zoneinfo/Africa/Freetown", "usr/share/zoneinfo/Africa/Gaborone", "usr/share/zoneinfo/Africa/Harare", "usr/share/zoneinfo/Africa/Johannesburg", "usr/share/zoneinfo/Africa/Juba", "usr/share/zoneinfo/Africa/Kampala", "usr/share/zoneinfo/Africa/Khartoum", "usr/share/zoneinfo/Africa/Kigali", "usr/share/zoneinfo/Africa/Kinshasa", "usr/share/zoneinfo/Africa/Lagos", "usr/share/zoneinfo/Africa/Libreville", "usr/share/zoneinfo/Africa/Lome", "usr/share/zoneinfo/Africa/Luanda", "usr/share/zoneinfo/Africa/Lubumbashi", "usr/share/zoneinfo/Africa/Lusaka", "usr/share/zoneinfo/Africa/Malabo", "usr/share/zoneinfo/Africa/Maputo", "usr/share/zoneinfo/Africa/Maseru", "usr/share/zoneinfo/Africa/Mbabane", "usr/share/zoneinfo/Africa/Mogadishu", "usr/share/zoneinfo/Africa/Monrovia", "usr/share/zoneinfo/Africa/Nairobi", "usr/share/zoneinfo/Africa/Ndjamena", "usr/share/zoneinfo/Africa/Niamey", "usr/share/zoneinfo/Africa/Nouakchott", "usr/share/zoneinfo/Africa/Ouagadougou", "usr/share/zoneinfo/Africa/Porto-Novo", "usr/share/zoneinfo/Africa/Sao_Tome", "usr/share/zoneinfo/Africa/Timbuktu", "usr/share/zoneinfo/Africa/Tripoli", "usr/share/zoneinfo/Africa/Tunis", "usr/share/zoneinfo/Africa/Windhoek", "usr/share/zoneinfo/America/Adak", "usr/share/zoneinfo/America/Anchorage", "usr/share/zoneinfo/America/Anguilla", "usr/share/zoneinfo/America/Antigua", "usr/share/zoneinfo/America/Araguaina", "usr/share/zoneinfo/America/Aruba", "usr/share/zoneinfo/America/Asuncion", "usr/share/zoneinfo/America/Atikokan", "usr/share/zoneinfo/America/Atka", "usr/share/zoneinfo/America/Bahia", "usr/share/zoneinfo/America/Bahia_Banderas", "usr/share/zoneinfo/America/Barbados", "usr/share/zoneinfo/America/Belem", "usr/share/zoneinfo/America/Belize", "usr/share/zoneinfo/America/Blanc-Sablon", "usr/share/zoneinfo/America/Boa_Vista", "usr/share/zoneinfo/America/Bogota", "usr/share/zoneinfo/America/Boise", "usr/share/zoneinfo/America/Buenos_Aires", "usr/share/zoneinfo/America/Cambridge_Bay", "usr/share/zoneinfo/America/Campo_Grande", "usr/share/zoneinfo/America/Cancun", "usr/share/zoneinfo/America/Caracas", "usr/share/zoneinfo/America/Catamarca", "usr/share/zoneinfo/America/Cayenne", "usr/share/zoneinfo/America/Cayman", "usr/share/zoneinfo/America/Chicago", "usr/share/zoneinfo/America/Chihuahua", "usr/share/zoneinfo/America/Ciudad_Juarez", "usr/share/zoneinfo/America/Coral_Harbour", "usr/share/zoneinfo/America/Cordoba", "usr/share/zoneinfo/America/Costa_Rica", "usr/share/zoneinfo/America/Coyhaique", "usr/share/zoneinfo/America/Creston", "usr/share/zoneinfo/America/Cuiaba", "usr/share/zoneinfo/America/Curacao", "usr/share/zoneinfo/America/Danmarkshavn", "usr/share/zoneinfo/America/Dawson", "usr/share/zoneinfo/America/Dawson_Creek", "usr/share/zoneinfo/America/Denver", "usr/share/zoneinfo/America/Detroit", "usr/share/zoneinfo/America/Dominica", "usr/share/zoneinfo/America/Edmonton", "usr/share/zoneinfo/America/Eirunepe", "usr/share/zoneinfo/America/El_Salvador", "usr/share/zoneinfo/America/Ensenada", "usr/share/zoneinfo/America/Fort_Nelson", "usr/share/zoneinfo/America/Fort_Wayne", "usr/share/zoneinfo/America/Fortaleza", "usr/share/zoneinfo/America/Glace_Bay", "usr/share/zoneinfo/America/Godthab", "usr/share/zoneinfo/America/Goose_Bay", "usr/share/zoneinfo/America/Grand_Turk", "usr/share/zoneinfo/America/Grenada", "usr/share/zoneinfo/America/Guadeloupe", "usr/share/zoneinfo/America/Guatemala", "usr/share/zoneinfo/America/Guayaquil", "usr/share/zoneinfo/America/Guyana", "usr/share/zoneinfo/America/Halifax", "usr/share/zoneinfo/America/Havana", "usr/share/zoneinfo/America/Hermosillo", "usr/share/zoneinfo/America/Indianapolis", "usr/share/zoneinfo/America/Inuvik", "usr/share/zoneinfo/America/Iqaluit", "usr/share/zoneinfo/America/Jamaica", "usr/share/zoneinfo/America/Jujuy", "usr/share/zoneinfo/America/Juneau", "usr/share/zoneinfo/America/Knox_IN", "usr/share/zoneinfo/America/Kralendijk", "usr/share/zoneinfo/America/La_Paz", "usr/share/zoneinfo/America/Lima", "usr/share/zoneinfo/America/Los_Angeles", "usr/share/zoneinfo/America/Louisville", "usr/share/zoneinfo/America/Lower_Princes", "usr/share/zoneinfo/America/Maceio", "usr/share/zoneinfo/America/Managua", "usr/share/zoneinfo/America/Manaus", "usr/share/zoneinfo/America/Marigot", "usr/share/zoneinfo/America/Martinique", "usr/share/zoneinfo/America/Matamoros", "usr/share/zoneinfo/America/Mazatlan", "usr/share/zoneinfo/America/Mendoza", "usr/share/zoneinfo/America/Menominee", "usr/share/zoneinfo/America/Merida", "usr/share/zoneinfo/America/Metlakatla", "usr/share/zoneinfo/America/Mexico_City", "usr/share/zoneinfo/America/Miquelon", "usr/share/zoneinfo/America/Moncton", "usr/share/zoneinfo/America/Monterrey", "usr/share/zoneinfo/America/Montevideo", "usr/share/zoneinfo/America/Montreal", "usr/share/zoneinfo/America/Montserrat", "usr/share/zoneinfo/America/Nassau", "usr/share/zoneinfo/America/New_York", "usr/share/zoneinfo/America/Nipigon", "usr/share/zoneinfo/America/Nome", "usr/share/zoneinfo/America/Noronha", "usr/share/zoneinfo/America/Nuuk", "usr/share/zoneinfo/America/Ojinaga", "usr/share/zoneinfo/America/Panama", "usr/share/zoneinfo/America/Pangnirtung", "usr/share/zoneinfo/America/Paramaribo", "usr/share/zoneinfo/America/Phoenix", "usr/share/zoneinfo/America/Port-au-Prince", "usr/share/zoneinfo/America/Port_of_Spain", "usr/share/zoneinfo/America/Porto_Acre", "usr/share/zoneinfo/America/Porto_Velho", "usr/share/zoneinfo/America/Puerto_Rico", "usr/share/zoneinfo/America/Punta_Arenas", "usr/share/zoneinfo/America/Rainy_River", "usr/share/zoneinfo/America/Rankin_Inlet", "usr/share/zoneinfo/America/Recife", "usr/share/zoneinfo/America/Regina", "usr/share/zoneinfo/America/Resolute", "usr/share/zoneinfo/America/Rio_Branco", "usr/share/zoneinfo/America/Rosario", "usr/share/zoneinfo/America/Santa_Isabel", "usr/share/zoneinfo/America/Santarem", "usr/share/zoneinfo/America/Santiago", "usr/share/zoneinfo/America/Santo_Domingo", "usr/share/zoneinfo/America/Sao_Paulo", "usr/share/zoneinfo/America/Scoresbysund", "usr/share/zoneinfo/America/Shiprock", "usr/share/zoneinfo/America/Sitka", "usr/share/zoneinfo/America/St_Barthelemy", "usr/share/zoneinfo/America/St_Johns", "usr/share/zoneinfo/America/St_Kitts", "usr/share/zoneinfo/America/St_Lucia", "usr/share/zoneinfo/America/St_Thomas", "usr/share/zoneinfo/America/St_Vincent", "usr/share/zoneinfo/America/Swift_Current", "usr/share/zoneinfo/America/Tegucigalpa", "usr/share/zoneinfo/America/Thule", "usr/share/zoneinfo/America/Thunder_Bay", "usr/share/zoneinfo/America/Tijuana", "usr/share/zoneinfo/America/Toronto", "usr/share/zoneinfo/America/Tortola", "usr/share/zoneinfo/America/Vancouver", "usr/share/zoneinfo/America/Virgin", "usr/share/zoneinfo/America/Whitehorse", "usr/share/zoneinfo/America/Winnipeg", "usr/share/zoneinfo/America/Yakutat", "usr/share/zoneinfo/America/Yellowknife", "usr/share/zoneinfo/America/Argentina/Buenos_Aires", "usr/share/zoneinfo/America/Argentina/Catamarca", "usr/share/zoneinfo/America/Argentina/ComodRivadavia", "usr/share/zoneinfo/America/Argentina/Cordoba", "usr/share/zoneinfo/America/Argentina/Jujuy", "usr/share/zoneinfo/America/Argentina/La_Rioja", "usr/share/zoneinfo/America/Argentina/Mendoza", "usr/share/zoneinfo/America/Argentina/Rio_Gallegos", "usr/share/zoneinfo/America/Argentina/Salta", "usr/share/zoneinfo/America/Argentina/San_Juan", "usr/share/zoneinfo/America/Argentina/San_Luis", "usr/share/zoneinfo/America/Argentina/Tucuman", "usr/share/zoneinfo/America/Argentina/Ushuaia", "usr/share/zoneinfo/America/Indiana/Indianapolis", "usr/share/zoneinfo/America/Indiana/Knox", "usr/share/zoneinfo/America/Indiana/Marengo", "usr/share/zoneinfo/America/Indiana/Petersburg", "usr/share/zoneinfo/America/Indiana/Tell_City", "usr/share/zoneinfo/America/Indiana/Vevay", "usr/share/zoneinfo/America/Indiana/Vincennes", "usr/share/zoneinfo/America/Indiana/Winamac", "usr/share/zoneinfo/America/Kentucky/Louisville", "usr/share/zoneinfo/America/Kentucky/Monticello", "usr/share/zoneinfo/America/North_Dakota/Beulah", "usr/share/zoneinfo/America/North_Dakota/Center", "usr/share/zoneinfo/America/North_Dakota/New_Salem", "usr/share/zoneinfo/Antarctica/Casey", "usr/share/zoneinfo/Antarctica/Davis", "usr/share/zoneinfo/Antarctica/DumontDUrville", "usr/share/zoneinfo/Antarctica/Macquarie", "usr/share/zoneinfo/Antarctica/Mawson", "usr/share/zoneinfo/Antarctica/McMurdo", "usr/share/zoneinfo/Antarctica/Palmer", "usr/share/zoneinfo/Antarctica/Rothera", "usr/share/zoneinfo/Antarctica/South_Pole", "usr/share/zoneinfo/Antarctica/Syowa", "usr/share/zoneinfo/Antarctica/Troll", "usr/share/zoneinfo/Antarctica/Vostok", "usr/share/zoneinfo/Arctic/Longyearbyen", "usr/share/zoneinfo/Asia/Aden", "usr/share/zoneinfo/Asia/Almaty", "usr/share/zoneinfo/Asia/Amman", "usr/share/zoneinfo/Asia/Anadyr", "usr/share/zoneinfo/Asia/Aqtau", "usr/share/zoneinfo/Asia/Aqtobe", "usr/share/zoneinfo/Asia/Ashgabat", "usr/share/zoneinfo/Asia/Ashkhabad", "usr/share/zoneinfo/Asia/Atyrau", "usr/share/zoneinfo/Asia/Baghdad", "usr/share/zoneinfo/Asia/Bahrain", "usr/share/zoneinfo/Asia/Baku", "usr/share/zoneinfo/Asia/Bangkok", "usr/share/zoneinfo/Asia/Barnaul", "usr/share/zoneinfo/Asia/Beirut", "usr/share/zoneinfo/Asia/Bishkek", "usr/share/zoneinfo/Asia/Brunei", "usr/share/zoneinfo/Asia/Calcutta", "usr/share/zoneinfo/Asia/Chita", "usr/share/zoneinfo/Asia/Choibalsan", "usr/share/zoneinfo/Asia/Chongqing", "usr/share/zoneinfo/Asia/Chungking", "usr/share/zoneinfo/Asia/Colombo", "usr/share/zoneinfo/Asia/Dacca", "usr/share/zoneinfo/Asia/Damascus", "usr/share/zoneinfo/Asia/Dhaka", "usr/share/zoneinfo/Asia/Dili", "usr/share/zoneinfo/Asia/Dubai", "usr/share/zoneinfo/Asia/Dushanbe", "usr/share/zoneinfo/Asia/Famagusta", "usr/share/zoneinfo/Asia/Gaza", "usr/share/zoneinfo/Asia/Harbin", "usr/share/zoneinfo/Asia/Hebron", "usr/share/zoneinfo/Asia/Ho_Chi_Minh", "usr/share/zoneinfo/Asia/Hong_Kong", "usr/share/zoneinfo/Asia/Hovd", "usr/share/zoneinfo/Asia/Irkutsk", "usr/share/zoneinfo/Asia/Istanbul", "usr/share/zoneinfo/Asia/Jakarta", "usr/share/zoneinfo/Asia/Jayapura", "usr/share/zoneinfo/Asia/Jerusalem", "usr/share/zoneinfo/Asia/Kabul", "usr/share/zoneinfo/Asia/Kamchatka", "usr/share/zoneinfo/Asia/Karachi", "usr/share/zoneinfo/Asia/Kashgar", "usr/share/zoneinfo/Asia/Kathmandu", "usr/share/zoneinfo/Asia/Katmandu", "usr/share/zoneinfo/Asia/Khandyga", "usr/share/zoneinfo/Asia/Kolkata", "usr/share/zoneinfo/Asia/Krasnoyarsk", "usr/share/zoneinfo/Asia/Kuala_Lumpur", "usr/share/zoneinfo/Asia/Kuching", "usr/share/zoneinfo/Asia/Kuwait", "usr/share/zoneinfo/Asia/Macao", "usr/share/zoneinfo/Asia/Macau", "usr/share/zoneinfo/Asia/Magadan", "usr/share/zoneinfo/Asia/Makassar", "usr/share/zoneinfo/Asia/Manila", "usr/share/zoneinfo/Asia/Muscat", "usr/share/zoneinfo/Asia/Nicosia", "usr/share/zoneinfo/Asia/Novokuznetsk", "usr/share/zoneinfo/Asia/Novosibirsk", "usr/share/zoneinfo/Asia/Omsk", "usr/share/zoneinfo/Asia/Oral", "usr/share/zoneinfo/Asia/Phnom_Penh", "usr/share/zoneinfo/Asia/Pontianak", "usr/share/zoneinfo/Asia/Pyongyang", "usr/share/zoneinfo/Asia/Qatar", "usr/share/zoneinfo/Asia/Qostanay", "usr/share/zoneinfo/Asia/Qyzylorda", "usr/share/zoneinfo/Asia/Rangoon", "usr/share/zoneinfo/Asia/Riyadh", "usr/share/zoneinfo/Asia/Saigon", "usr/share/zoneinfo/Asia/Sakhalin", "usr/share/zoneinfo/Asia/Samarkand", "usr/share/zoneinfo/Asia/Seoul", "usr/share/zoneinfo/Asia/Shanghai", "usr/share/zoneinfo/Asia/Singapore", "usr/share/zoneinfo/Asia/Srednekolymsk", "usr/share/zoneinfo/Asia/Taipei", "usr/share/zoneinfo/Asia/Tashkent", "usr/share/zoneinfo/Asia/Tbilisi", "usr/share/zoneinfo/Asia/Tehran", "usr/share/zoneinfo/Asia/Tel_Aviv", "usr/share/zoneinfo/Asia/Thimbu", "usr/share/zoneinfo/Asia/Thimphu", "usr/share/zoneinfo/Asia/Tokyo", "usr/share/zoneinfo/Asia/Tomsk", "usr/share/zoneinfo/Asia/Ujung_Pandang", "usr/share/zoneinfo/Asia/Ulaanbaatar", "usr/share/zoneinfo/Asia/Ulan_Bator", "usr/share/zoneinfo/Asia/Urumqi", "usr/share/zoneinfo/Asia/Ust-Nera", "usr/share/zoneinfo/Asia/Vientiane", "usr/share/zoneinfo/Asia/Vladivostok", "usr/share/zoneinfo/Asia/Yakutsk", "usr/share/zoneinfo/Asia/Yangon", "usr/share/zoneinfo/Asia/Yekaterinburg", "usr/share/zoneinfo/Asia/Yerevan", "usr/share/zoneinfo/Atlantic/Azores", "usr/share/zoneinfo/Atlantic/Bermuda", "usr/share/zoneinfo/Atlantic/Canary", "usr/share/zoneinfo/Atlantic/Cape_Verde", "usr/share/zoneinfo/Atlantic/Faeroe", "usr/share/zoneinfo/Atlantic/Faroe", "usr/share/zoneinfo/Atlantic/Jan_Mayen", "usr/share/zoneinfo/Atlantic/Madeira", "usr/share/zoneinfo/Atlantic/Reykjavik", "usr/share/zoneinfo/Atlantic/South_Georgia", "usr/share/zoneinfo/Atlantic/St_Helena", "usr/share/zoneinfo/Atlantic/Stanley", "usr/share/zoneinfo/Australia/ACT", "usr/share/zoneinfo/Australia/Adelaide", "usr/share/zoneinfo/Australia/Brisbane", "usr/share/zoneinfo/Australia/Broken_Hill", "usr/share/zoneinfo/Australia/Canberra", "usr/share/zoneinfo/Australia/Currie", "usr/share/zoneinfo/Australia/Darwin", "usr/share/zoneinfo/Australia/Eucla", "usr/share/zoneinfo/Australia/Hobart", "usr/share/zoneinfo/Australia/LHI", "usr/share/zoneinfo/Australia/Lindeman", "usr/share/zoneinfo/Australia/Lord_Howe", "usr/share/zoneinfo/Australia/Melbourne", "usr/share/zoneinfo/Australia/NSW", "usr/share/zoneinfo/Australia/North", "usr/share/zoneinfo/Australia/Perth", "usr/share/zoneinfo/Australia/Queensland", "usr/share/zoneinfo/Australia/South", "usr/share/zoneinfo/Australia/Sydney", "usr/share/zoneinfo/Australia/Tasmania", "usr/share/zoneinfo/Australia/Victoria", "usr/share/zoneinfo/Australia/West", "usr/share/zoneinfo/Australia/Yancowinna", "usr/share/zoneinfo/Brazil/Acre", "usr/share/zoneinfo/Brazil/DeNoronha", "usr/share/zoneinfo/Brazil/East", "usr/share/zoneinfo/Brazil/West", "usr/share/zoneinfo/Canada/Atlantic", "usr/share/zoneinfo/Canada/Central", "usr/share/zoneinfo/Canada/Eastern", "usr/share/zoneinfo/Canada/Mountain", "usr/share/zoneinfo/Canada/Newfoundland", "usr/share/zoneinfo/Canada/Pacific", "usr/share/zoneinfo/Canada/Saskatchewan", "usr/share/zoneinfo/Canada/Yukon", "usr/share/zoneinfo/Chile/Continental", "usr/share/zoneinfo/Chile/EasterIsland", "usr/share/zoneinfo/Etc/GMT", "usr/share/zoneinfo/Etc/GMT+0", "usr/share/zoneinfo/Etc/GMT+1", "usr/share/zoneinfo/Etc/GMT+10", "usr/share/zoneinfo/Etc/GMT+11", "usr/share/zoneinfo/Etc/GMT+12", "usr/share/zoneinfo/Etc/GMT+2", "usr/share/zoneinfo/Etc/GMT+3", "usr/share/zoneinfo/Etc/GMT+4", "usr/share/zoneinfo/Etc/GMT+5", "usr/share/zoneinfo/Etc/GMT+6", "usr/share/zoneinfo/Etc/GMT+7", "usr/share/zoneinfo/Etc/GMT+8", "usr/share/zoneinfo/Etc/GMT+9", "usr/share/zoneinfo/Etc/GMT-0", "usr/share/zoneinfo/Etc/GMT-1", "usr/share/zoneinfo/Etc/GMT-10", "usr/share/zoneinfo/Etc/GMT-11", "usr/share/zoneinfo/Etc/GMT-12", "usr/share/zoneinfo/Etc/GMT-13", "usr/share/zoneinfo/Etc/GMT-14", "usr/share/zoneinfo/Etc/GMT-2", "usr/share/zoneinfo/Etc/GMT-3", "usr/share/zoneinfo/Etc/GMT-4", "usr/share/zoneinfo/Etc/GMT-5", "usr/share/zoneinfo/Etc/GMT-6", "usr/share/zoneinfo/Etc/GMT-7", "usr/share/zoneinfo/Etc/GMT-8", "usr/share/zoneinfo/Etc/GMT-9", "usr/share/zoneinfo/Etc/GMT0", "usr/share/zoneinfo/Etc/Greenwich", "usr/share/zoneinfo/Etc/UCT", "usr/share/zoneinfo/Etc/UTC", "usr/share/zoneinfo/Etc/Universal", "usr/share/zoneinfo/Etc/Zulu", "usr/share/zoneinfo/Europe/Amsterdam", "usr/share/zoneinfo/Europe/Andorra", "usr/share/zoneinfo/Europe/Astrakhan", "usr/share/zoneinfo/Europe/Athens", "usr/share/zoneinfo/Europe/Belfast", "usr/share/zoneinfo/Europe/Belgrade", "usr/share/zoneinfo/Europe/Berlin", "usr/share/zoneinfo/Europe/Bratislava", "usr/share/zoneinfo/Europe/Brussels", "usr/share/zoneinfo/Europe/Bucharest", "usr/share/zoneinfo/Europe/Budapest", "usr/share/zoneinfo/Europe/Busingen", "usr/share/zoneinfo/Europe/Chisinau", "usr/share/zoneinfo/Europe/Copenhagen", "usr/share/zoneinfo/Europe/Dublin", "usr/share/zoneinfo/Europe/Gibraltar", "usr/share/zoneinfo/Europe/Guernsey", "usr/share/zoneinfo/Europe/Helsinki", "usr/share/zoneinfo/Europe/Isle_of_Man", "usr/share/zoneinfo/Europe/Istanbul", "usr/share/zoneinfo/Europe/Jersey", "usr/share/zoneinfo/Europe/Kaliningrad", "usr/share/zoneinfo/Europe/Kiev", "usr/share/zoneinfo/Europe/Kirov", "usr/share/zoneinfo/Europe/Kyiv", "usr/share/zoneinfo/Europe/Lisbon", "usr/share/zoneinfo/Europe/Ljubljana", "usr/share/zoneinfo/Europe/London", "usr/share/zoneinfo/Europe/Luxembourg", "usr/share/zoneinfo/Europe/Madrid", "usr/share/zoneinfo/Europe/Malta", "usr/share/zoneinfo/Europe/Mariehamn", "usr/share/zoneinfo/Europe/Minsk", "usr/share/zoneinfo/Europe/Monaco", "usr/share/zoneinfo/Europe/Moscow", "usr/share/zoneinfo/Europe/Nicosia", "usr/share/zoneinfo/Europe/Oslo", "usr/share/zoneinfo/Europe/Paris", "usr/share/zoneinfo/Europe/Podgorica", "usr/share/zoneinfo/Europe/Prague", "usr/share/zoneinfo/Europe/Riga", "usr/share/zoneinfo/Europe/Rome", "usr/share/zoneinfo/Europe/Samara", "usr/share/zoneinfo/Europe/San_Marino", "usr/share/zoneinfo/Europe/Sarajevo", "usr/share/zoneinfo/Europe/Saratov", "usr/share/zoneinfo/Europe/Simferopol", "usr/share/zoneinfo/Europe/Skopje", "usr/share/zoneinfo/Europe/Sofia", "usr/share/zoneinfo/Europe/Stockholm", "usr/share/zoneinfo/Europe/Tallinn", "usr/share/zoneinfo/Europe/Tirane", "usr/share/zoneinfo/Europe/Tiraspol", "usr/share/zoneinfo/Europe/Ulyanovsk", "usr/share/zoneinfo/Europe/Uzhgorod", "usr/share/zoneinfo/Europe/Vaduz", "usr/share/zoneinfo/Europe/Vatican", "usr/share/zoneinfo/Europe/Vienna", "usr/share/zoneinfo/Europe/Vilnius", "usr/share/zoneinfo/Europe/Volgograd", "usr/share/zoneinfo/Europe/Warsaw", "usr/share/zoneinfo/Europe/Zagreb", "usr/share/zoneinfo/Europe/Zaporozhye", "usr/share/zoneinfo/Europe/Zurich", "usr/share/zoneinfo/Indian/Antananarivo", "usr/share/zoneinfo/Indian/Chagos", "usr/share/zoneinfo/Indian/Christmas", "usr/share/zoneinfo/Indian/Cocos", "usr/share/zoneinfo/Indian/Comoro", "usr/share/zoneinfo/Indian/Kerguelen", "usr/share/zoneinfo/Indian/Mahe", "usr/share/zoneinfo/Indian/Maldives", "usr/share/zoneinfo/Indian/Mauritius", "usr/share/zoneinfo/Indian/Mayotte", "usr/share/zoneinfo/Indian/Reunion", "usr/share/zoneinfo/Mexico/BajaNorte", "usr/share/zoneinfo/Mexico/BajaSur", "usr/share/zoneinfo/Mexico/General", "usr/share/zoneinfo/Pacific/Apia", "usr/share/zoneinfo/Pacific/Auckland", "usr/share/zoneinfo/Pacific/Bougainville", "usr/share/zoneinfo/Pacific/Chatham", "usr/share/zoneinfo/Pacific/Chuuk", "usr/share/zoneinfo/Pacific/Easter", "usr/share/zoneinfo/Pacific/Efate", "usr/share/zoneinfo/Pacific/Enderbury", "usr/share/zoneinfo/Pacific/Fakaofo", "usr/share/zoneinfo/Pacific/Fiji", "usr/share/zoneinfo/Pacific/Funafuti", "usr/share/zoneinfo/Pacific/Galapagos", "usr/share/zoneinfo/Pacific/Gambier", "usr/share/zoneinfo/Pacific/Guadalcanal", "usr/share/zoneinfo/Pacific/Guam", "usr/share/zoneinfo/Pacific/Honolulu", "usr/share/zoneinfo/Pacific/Johnston", "usr/share/zoneinfo/Pacific/Kanton", "usr/share/zoneinfo/Pacific/Kiritimati", "usr/share/zoneinfo/Pacific/Kosrae", "usr/share/zoneinfo/Pacific/Kwajalein", "usr/share/zoneinfo/Pacific/Majuro", "usr/share/zoneinfo/Pacific/Marquesas", "usr/share/zoneinfo/Pacific/Midway", "usr/share/zoneinfo/Pacific/Nauru", "usr/share/zoneinfo/Pacific/Niue", "usr/share/zoneinfo/Pacific/Norfolk", "usr/share/zoneinfo/Pacific/Noumea", "usr/share/zoneinfo/Pacific/Pago_Pago", "usr/share/zoneinfo/Pacific/Palau", "usr/share/zoneinfo/Pacific/Pitcairn", "usr/share/zoneinfo/Pacific/Pohnpei", "usr/share/zoneinfo/Pacific/Ponape", "usr/share/zoneinfo/Pacific/Port_Moresby", "usr/share/zoneinfo/Pacific/Rarotonga", "usr/share/zoneinfo/Pacific/Saipan", "usr/share/zoneinfo/Pacific/Samoa", "usr/share/zoneinfo/Pacific/Tahiti", "usr/share/zoneinfo/Pacific/Tarawa", "usr/share/zoneinfo/Pacific/Tongatapu", "usr/share/zoneinfo/Pacific/Truk", "usr/share/zoneinfo/Pacific/Wake", "usr/share/zoneinfo/Pacific/Wallis", "usr/share/zoneinfo/Pacific/Yap", "usr/share/zoneinfo/US/Alaska", "usr/share/zoneinfo/US/Aleutian", "usr/share/zoneinfo/US/Arizona", "usr/share/zoneinfo/US/Central", "usr/share/zoneinfo/US/East-Indiana", "usr/share/zoneinfo/US/Eastern", "usr/share/zoneinfo/US/Hawaii", "usr/share/zoneinfo/US/Indiana-Starke", "usr/share/zoneinfo/US/Michigan", "usr/share/zoneinfo/US/Mountain", "usr/share/zoneinfo/US/Pacific", "usr/share/zoneinfo/US/Samoa" ], "AnalyzedBy": "apk" }, { "ID": "utmps-libs@0.1.3.1-r0", "Name": "utmps-libs", "Identifier": { "PURL": "pkg:apk/alpine/utmps-libs@0.1.3.1-r0?arch=x86_64\u0026distro=3.23.3", "UID": "7a038362ff497464" }, "Version": "0.1.3.1-r0", "Arch": "x86_64", "SrcName": "utmps", "SrcVersion": "0.1.3.1-r0", "Licenses": [ "ISC" ], "Maintainer": "Laurent Bercot \u003cska-devel@skarnet.org\u003e", "DependsOn": [ "musl@1.2.5-r21", "skalibs-libs@2.14.4.0-r0" ], "Layer": { "DiffID": "sha256:bfa66cef88150e054947357ece4a5ef622b49d30ce1021b9369a763334743eaf" }, "Digest": "sha1:d0e176370cd60eb0555c6bff49eda1955f355ad4", "InstalledFiles": [ "usr/lib/libutmps.so.0.1", "usr/lib/libutmps.so.0.1.3.1" ], "AnalyzedBy": "apk" }, { "ID": "zlib@1.3.1-r2", "Name": "zlib", "Identifier": { "PURL": "pkg:apk/alpine/zlib@1.3.1-r2?arch=x86_64\u0026distro=3.23.3", "UID": "792cdc69bc59d880" }, "Version": "1.3.1-r2", "Arch": "x86_64", "SrcName": "zlib", "SrcVersion": "1.3.1-r2", "Licenses": [ "Zlib" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "musl@1.2.5-r21" ], "Layer": { "DiffID": "sha256:989e799e634906e94dc9a5ee2ee26fc92ad260522990f26e707861a5f52bf64e" }, "Digest": "sha1:3e8e8e76dfefb4efd27658ada6d792e66ba2775e", "InstalledFiles": [ "usr/lib/libz.so.1", "usr/lib/libz.so.1.3.1" ], "AnalyzedBy": "apk" }, { "ID": "zstd-libs@1.5.7-r2", "Name": "zstd-libs", "Identifier": { "PURL": "pkg:apk/alpine/zstd-libs@1.5.7-r2?arch=x86_64\u0026distro=3.23.3", "UID": "8146f1dd71a6e601" }, "Version": "1.5.7-r2", "Arch": "x86_64", "SrcName": "zstd", "SrcVersion": "1.5.7-r2", "Licenses": [ "BSD-3-Clause", "GPL-2.0-or-later" ], "Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e", "DependsOn": [ "musl@1.2.5-r21" ], "Layer": { "DiffID": "sha256:66331502f5f6a99cd657f4ef104273d82c78207f11e9d8f5ca16e2b53d08c361" }, "Digest": "sha1:d507b8ac3c4335a40405ac20e49bac9d43642be6", "InstalledFiles": [ "usr/lib/libzstd.so.1", "usr/lib/libzstd.so.1.5.7" ], "AnalyzedBy": "apk" } ], "Vulnerabilities": [ { "VulnerabilityID": "CVE-2026-111497", "PkgID": "brotli-libs@1.2.0-r0", "PkgName": "brotli-libs", "PkgIdentifier": { "PURL": "pkg:apk/alpine/brotli-libs@1.2.0-r0?arch=x86_64\u0026distro=3.23.3", "UID": "18708ffc8b6c1544" }, "InstalledVersion": "1.2.0-r0", "FixedVersion": "1.2.1-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:66331502f5f6a99cd657f4ef104273d82c78207f11e9d8f5ca16e2b53d08c361" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-111497", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:b0594eda4fa690faec52c9634b090bf2c22d475e487c483fdf47a630c161c4d7", "Title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "Description": "A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.\n\n\n\n\n\nUsers need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.", "Severity": "CRITICAL", "CweIDs": [ "CWE-252", "CWE-787" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 4, "bitnami": 4, "ghsa": 4, "nvd": 4, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "bitnami": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V40Score": 9.2 }, "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V3Score": 9.8, "V40Score": 9.2 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 9.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/10/23/25", "http://www.openwall.com/lists/oss-security/2026/10/24/6", "http://www.openwall.com/lists/oss-security/2026/10/26/12", "http://www.openwall.com/lists/oss-security/2026/10/26/13", "http://www.openwall.com/lists/oss-security/2026/10/26/16", "http://www.openwall.com/lists/oss-security/2026/11/03/2", "https://access.redhat.com/errata/RHSA-2026:90495", "https://access.redhat.com/errata/RHSA-2026:92492", "https://access.redhat.com/security/cve/CVE-2026-111497", "https://advisory.echohq.com/cve/CVE-2026-111497", "https://broccoli2shell.com", "https://bugzilla.redhat.com/2558973", "https://bugzilla.redhat.com/2562054", "https://bugzilla.redhat.com/show_bug.cgi?id=2558973", "https://cert-portal.siemens.com/productcert/html/ssa-045512.html", "https://cert-portal.siemens.com/productcert/html/ssa-443410.html", "https://cert-portal.siemens.com/productcert/html/ssa-898633.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-111497", "https://devblogs.microsoft.com/dotnet/dotnet-october-2026-oob-security-updates", "https://ellio.tech/en/blog/node2shell-cve-2026-111497-rce-on-stock-nodejs-builds", "https://ellio.tech/en/blog/node2shell-cve-2026-111497-rce-on-stock-nodejs-builds/", "https://errata.almalinux.org/9/ALSA-2026-92492.html", "https://errata.rockylinux.org/RLSA-2026:90495", "https://github.com/advisories/GHSA-9v8h-qqgm-4m35", "https://github.com/andybalholm/brotli/releases/tag/v1.2.7", "https://github.com/dotnet/announcements/issues/494", "https://github.com/google/brotli", "https://github.com/google/brotli/commit/0ed4268a4401abcb4472096340477cf4af7d1a2b", "https://github.com/google/brotli/commit/50a9b70a4d5e1443fc40927952276b68fffa83a0", "https://github.com/google/brotli/commit/b418fa81c48262a86a95332b0bc6d62c30aa78b6", "https://github.com/google/brotli/commit/da9806362874b9bd4b552a3af360b5d6347beb12", "https://github.com/google/brotli/releases/tag/v1.0.10", "https://github.com/google/brotli/releases/tag/v1.1.1", "https://github.com/google/brotli/releases/tag/v1.2.1", "https://github.com/pypa/advisory-database/tree/main/vulns/brotli/PYSEC-2026-4322.yaml", "https://github.com/pypa/advisory-database/tree/main/vulns/brotlicffi/PYSEC-2026-4323.yaml", "https://linux.oracle.com/cve/CVE-2026-111497.html", "https://linux.oracle.com/errata/ELSA-2026-92492.html", "https://lists.debian.org/debian-lts-announce/2026/10/msg00049.html", "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-114148", "https://nodejs.org/en/blog/vulnerability/october-2026-security-releases", "https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#nodejs-brotli-decoder-out-of-bounds-write-permits-remote-code-execution-cve-2026-111497---high", "https://nvd.nist.gov/vuln/detail/CVE-2026-111497", "https://opensourcemalware.com/blog/node2shell-affects-python", "https://patchtheplanet.org/brotli", "https://pypi.org/project/Brotli", "https://pypi.org/project/brotlicffi", "https://ubuntu.com/security/notices/USN-8956-1", "https://ubuntu.com/security/notices/USN-8956-2", "https://ubuntu.com/security/notices/USN-8958-1", "https://www.aikido.dev/blog/node2shell-nodejs-brotli-rce-cve-2026-111497", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-111497", "https://www.cve.org/CVERecord?id=CVE-2026-111497" ], "PublishedDate": "2026-10-22T14:17:37.19Z", "LastModifiedDate": "2026-11-06T16:17:37.393Z" }, { "VulnerabilityID": "CVE-2026-33630", "PkgID": "c-ares@1.34.6-r0", "PkgName": "c-ares", "PkgIdentifier": { "PURL": "pkg:apk/alpine/c-ares@1.34.6-r0?arch=x86_64\u0026distro=3.23.3", "UID": "2fc69dd6afab16ae" }, "InstalledVersion": "1.34.6-r0", "FixedVersion": "1.34.8-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:66331502f5f6a99cd657f4ef104273d82c78207f11e9d8f5ca16e2b53d08c361" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-33630", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:987e7edee122367fb5a6081afff09cbe24b3582b1d2767b6586fa0fda557d6c2", "Title": "c-ares: c-ares: Use-after-free / double-free in query-completion handling", "Description": "c-ares is an asynchronous resolver library. From ver 1.32.3 until 1.34.7, a use-after-free / double-free in c-ares' query-completion handling. The same flaw — a query's callback being invoked while the query is still linked in the channel's internal lookup structures — is present at multiple points in the resend/finish path (timeout handling, response handling, and query dispatch). If the query, or for ares_getaddrinfo() the owning host_query, is freed as a side effect of that callback, it is then accessed and/or freed a second time. This vulnerability is fixed in ver 1.34.7.", "Severity": "HIGH", "CweIDs": [ "CWE-415", "CWE-416" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:42096", "https://access.redhat.com/security/cve/CVE-2026-33630", "https://bugzilla.redhat.com/2497686", "https://bugzilla.redhat.com/show_bug.cgi?id=2497686", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33630", "https://errata.almalinux.org/10/ALSA-2026-42096.html", "https://errata.rockylinux.org/RLSA-2026:42096", "https://github.com/c-ares/c-ares/commit/1fa3b86a0b8d18fe7b60f3228a01d770feb026bc", "https://github.com/c-ares/c-ares/commit/d823199b688052dcdc1646f2ab4cb8c16b1c644a", "https://github.com/c-ares/c-ares/pull/1237", "https://github.com/c-ares/c-ares/releases/tag/v1.34.7", "https://github.com/c-ares/c-ares/security/advisories/GHSA-6wfj-rwm7-3542", "https://linux.oracle.com/cve/CVE-2026-33630.html", "https://linux.oracle.com/errata/ELSA-2026-42096.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-33630", "https://ubuntu.com/security/notices/USN-8844-1", "https://www.cve.org/CVERecord?id=CVE-2026-33630", "https://www.openwall.com/lists/oss-security/2026/07/06/8" ], "PublishedDate": "2026-09-03T19:17:27.42Z", "LastModifiedDate": "2026-09-09T21:09:13.08Z" }, { "VulnerabilityID": "CVE-2026-11352", "PkgID": "curl@8.19.0-r0", "PkgName": "curl", "PkgIdentifier": { "PURL": "pkg:apk/alpine/curl@8.19.0-r0?arch=x86_64\u0026distro=3.23.3", "UID": "9fd7499bdd8d5c3b" }, "InstalledVersion": "8.19.0-r0", "FixedVersion": "8.22.0-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:bfa66cef88150e054947357ece4a5ef622b49d30ce1021b9369a763334743eaf" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-11352", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:179a06ec0d2051838a66620f621e1aa539eca8f8b29ae684b4e97c28d31c34da", "Title": "curl: libcurl: curl/libcurl: Remote denial of service via QUIC UDP receive function vulnerability", "Description": "An issue in curl’s QUIC UDP receive function allows a malicious HTTP/3 server\nto trigger a remote denial of service against a curl or libcurl client.\nBecause the helper function discards zero-length UDP datagrams before counting\nthem toward the per-call packet budget, a connected QUIC peer can continuously\nstream empty datagrams to indefinitely stall the client.", "Severity": "HIGH", "CweIDs": [ "CWE-835" ], "VendorSeverity": { "julia": 3, "photon": 3, "redhat": 3, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-11352", "https://curl.se/L7HzKXisfJ/CVE-2026-11352.md", "https://curl.se/docs/CVE-2026-11352.html", "https://curl.se/docs/CVE-2026-11352.json", "https://github.com/advisories/GHSA-qxwx-hr5v-h5q4", "https://hackerone.com/reports/3783438", "https://nvd.nist.gov/vuln/detail/CVE-2026-11352", "https://ubuntu.com/security/notices/USN-8525-1", "https://www.cve.org/CVERecord?id=CVE-2026-11352" ], "PublishedDate": "2026-07-03T07:16:23.693Z", "LastModifiedDate": "2026-09-15T07:16:25.353Z" }, { "VulnerabilityID": "CVE-2026-11586", "PkgID": "curl@8.19.0-r0", "PkgName": "curl", "PkgIdentifier": { "PURL": "pkg:apk/alpine/curl@8.19.0-r0?arch=x86_64\u0026distro=3.23.3", "UID": "9fd7499bdd8d5c3b" }, "InstalledVersion": "8.19.0-r0", "FixedVersion": "8.22.0-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:bfa66cef88150e054947357ece4a5ef622b49d30ce1021b9369a763334743eaf" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-11586", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:7b74546e1106eb1031f5020c2828ae1ca5b007c261be49344271ccf9595a63ff", "Title": "curl: curl: Denial of Service via WebSocket PING flood", "Description": "By default, curl automatically responds to WebSocket PING frames. Because curl\nlacks an upper bound on memory allocation for unacknowledged frames, a\nmalicious server can exhaust all available memory by flooding curl with rapid,\nsequential PING messages.", "Severity": "HIGH", "CweIDs": [ "CWE-770" ], "VendorSeverity": { "amazon": 2, "julia": 3, "photon": 3, "redhat": 3, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-11586", "https://curl.se/L7HzKXisfJ/CVE-2026-11586.md", "https://curl.se/docs/CVE-2026-11586.html", "https://curl.se/docs/CVE-2026-11586.json", "https://github.com/advisories/GHSA-c68q-h477-5646", "https://hackerone.com/reports/3788931", "https://nvd.nist.gov/vuln/detail/CVE-2026-11586", "https://ubuntu.com/security/notices/USN-8525-1", "https://www.cve.org/CVERecord?id=CVE-2026-11586" ], "PublishedDate": "2026-07-03T07:16:23.883Z", "LastModifiedDate": "2026-09-15T07:16:25.7Z" }, { "VulnerabilityID": "CVE-2026-12064", "PkgID": "curl@8.19.0-r0", "PkgName": "curl", "PkgIdentifier": { "PURL": "pkg:apk/alpine/curl@8.19.0-r0?arch=x86_64\u0026distro=3.23.3", "UID": "9fd7499bdd8d5c3b" }, "InstalledVersion": "8.19.0-r0", "FixedVersion": "8.22.0-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:bfa66cef88150e054947357ece4a5ef622b49d30ce1021b9369a763334743eaf" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-12064", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:4c76e8b937ead240d7270d9fee36597029b1d3ed36a8b45889a85925aaba0da3", "Title": "curl: curl: SSH host verification bypass when using schemeless URLs with SFTP/SCP", "Description": "When a user invokes curl using a schemeless URL combined with\n`--proto-default` sftp (or scp), a disconnect occurs between the tool layer\nand libcurl. The tool layer incorrectly infers the URL scheme, which\nerroneously bypasses the initialization of critical SSH security options like\nCURLOPT_SSH_HOST_PUBLIC_KEY_SHA256 and CURLOPT_SSH_KNOWNHOSTS. Conversely, the\nlibcurl runtime successfully honors CURLOPT_DEFAULT_PROTOCOL and establishes\nthe connection via SFTP/SCP as specified. Because the tool layer skipped the\nsecurity configuration, these SSH host verification options are silently\nomitted, causing curl to connect to an unverified SSH remote host without\nthrowing an error.", "Severity": "HIGH", "CweIDs": [ "CWE-297", "CWE-295" ], "VendorSeverity": { "amazon": 2, "azure": 3, "julia": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-12064", "https://curl.se/L7HzKXisfJ/CVE-2026-12064.md", "https://curl.se/docs/CVE-2026-12064.html", "https://curl.se/docs/CVE-2026-12064.json", "https://github.com/advisories/GHSA-jm94-9f7h-36pr", "https://hackerone.com/reports/3797526", "https://linux.oracle.com/cve/CVE-2026-12064.html", "https://linux.oracle.com/errata/ELSA-2026-55450.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-12064", "https://ubuntu.com/security/notices/USN-8525-1", "https://www.cve.org/CVERecord?id=CVE-2026-12064" ], "PublishedDate": "2026-07-03T07:16:24.217Z", "LastModifiedDate": "2026-09-15T07:16:26.15Z" }, { "VulnerabilityID": "CVE-2026-5773", "PkgID": "curl@8.19.0-r0", "PkgName": "curl", "PkgIdentifier": { "PURL": "pkg:apk/alpine/curl@8.19.0-r0?arch=x86_64\u0026distro=3.23.3", "UID": "9fd7499bdd8d5c3b" }, "InstalledVersion": "8.19.0-r0", "FixedVersion": "8.20.0-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:bfa66cef88150e054947357ece4a5ef622b49d30ce1021b9369a763334743eaf" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-5773", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:94901c7f2c63b44d0f72dcc58615881711b88beac6c3957c17fff821f03f6b5d", "Title": "curl: libcurl: Wrong file transfer due to incorrect SMB connection reuse", "Description": "libcurl might in some circumstances reuse the wrong connection for SMB(S)\ntransfers.\n\nlibcurl features a pool of recent connections so that subsequent requests can\nreuse an existing connection to avoid overhead.\n\nWhen reusing a connection a range of criteria must be met. Due to a logical\nerror in the code, a network transfer operation that was requested by an\napplication could wrongfully reuse an existing SMB connection to the same\nserver that was using a different \"share\" than the new subsequent transfer\nshould.\n\nThis could in unlucky situations lead to the download of the wrong file or the\nupload of a file to the wrong place. When this happens, the same credentials\nare used and the server name is the same.", "Severity": "HIGH", "CweIDs": [ "CWE-488", "CWE-918" ], "VendorSeverity": { "julia": 3, "nvd": 3, "photon": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "V3Score": 6.5 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/04/29/9", "https://access.redhat.com/security/cve/CVE-2026-5773", "https://curl.se/docs/CVE-2026-5773.html", "https://curl.se/docs/CVE-2026-5773.json", "https://github.com/advisories/GHSA-rp9q-8q5w-ch44", "https://hackerone.com/reports/3650689", "https://nvd.nist.gov/vuln/detail/CVE-2026-5773", "https://ubuntu.com/security/notices/USN-8227-1", "https://ubuntu.com/security/notices/USN-8525-1", "https://www.cve.org/CVERecord?id=CVE-2026-5773" ], "PublishedDate": "2026-05-13T13:01:56.307Z", "LastModifiedDate": "2026-09-15T07:16:28.82Z" }, { "VulnerabilityID": "CVE-2026-6276", "PkgID": "curl@8.19.0-r0", "PkgName": "curl", "PkgIdentifier": { "PURL": "pkg:apk/alpine/curl@8.19.0-r0?arch=x86_64\u0026distro=3.23.3", "UID": "9fd7499bdd8d5c3b" }, "InstalledVersion": "8.19.0-r0", "FixedVersion": "8.20.0-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:bfa66cef88150e054947357ece4a5ef622b49d30ce1021b9369a763334743eaf" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-6276", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:c05862560b268d69becec9b01b56de009a7d9bd26f8e07297dd37e3d94ff31dd", "Title": "curl: libcurl: Information disclosure due to cookie leak when reusing connections with custom Host headers", "Description": "Using libcurl, when a custom `Host:` header is first set for an HTTP request\nand a second request is subsequently done using the same *easy handle* but\nwithout the custom `Host:` header set, the second request would use stale\ninformation and pass on cookies meant for the first host in the second\nrequest. Leak them.", "Severity": "HIGH", "CweIDs": [ "CWE-346", "CWE-319" ], "VendorSeverity": { "azure": 2, "julia": 3, "nvd": 3, "photon": 3, "redhat": 1, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "V3Score": 3.7 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/04/29/13", "https://access.redhat.com/security/cve/CVE-2026-6276", "https://curl.se/docs/CVE-2026-6276.html", "https://curl.se/docs/CVE-2026-6276.json", "https://github.com/advisories/GHSA-2jc6-hc33-hv48", "https://hackerone.com/reports/3671818", "https://nvd.nist.gov/vuln/detail/CVE-2026-6276", "https://ubuntu.com/security/notices/USN-8227-1", "https://www.cve.org/CVERecord?id=CVE-2026-6276" ], "PublishedDate": "2026-05-13T13:01:56.8Z", "LastModifiedDate": "2026-09-15T07:16:29.343Z" }, { "VulnerabilityID": "CVE-2026-8286", "PkgID": "curl@8.19.0-r0", "PkgName": "curl", "PkgIdentifier": { "PURL": "pkg:apk/alpine/curl@8.19.0-r0?arch=x86_64\u0026distro=3.23.3", "UID": "9fd7499bdd8d5c3b" }, "InstalledVersion": "8.19.0-r0", "FixedVersion": "8.22.0-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:bfa66cef88150e054947357ece4a5ef622b49d30ce1021b9369a763334743eaf" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-8286", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:5722a40d2bb7c4f850abc66412a2561179f58f9d7bf06730bd7958fbb84b9dc2", "Title": "curl: curl: Insecure connection establishment due to TLS configuration mismatch", "Description": "A vulnerability exists where a new transfer that uses STARTTLS to upgrade the\nconnection might reuse an existing live connection even though the TLS\nconfiguration mismatches so it should not.", "Severity": "HIGH", "CweIDs": [ "CWE-295" ], "VendorSeverity": { "alma": 3, "amazon": 2, "azure": 3, "julia": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "V3Score": 8.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:55439", "https://access.redhat.com/security/cve/CVE-2026-8286", "https://bugzilla.redhat.com/2446448", "https://bugzilla.redhat.com/2446450", "https://bugzilla.redhat.com/2496758", "https://bugzilla.redhat.com/2496763", "https://bugzilla.redhat.com/show_bug.cgi?id=2446448", "https://bugzilla.redhat.com/show_bug.cgi?id=2446450", "https://bugzilla.redhat.com/show_bug.cgi?id=2496758", "https://bugzilla.redhat.com/show_bug.cgi?id=2496763", "https://creativecommons.org/licenses/by/4.0/", "https://curl.se/L7HzKXisfJ/CVE-2026-8286.md", "https://curl.se/docs/CVE-2026-8286.html", "https://curl.se/docs/CVE-2026-8286.json", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-1965", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-3783", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8286", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-9547", "https://errata.almalinux.org/9/ALSA-2026-55439.html", "https://errata.rockylinux.org/RLSA-2026:55439", "https://github.com/advisories/GHSA-32xh-3x3c-6g6h", "https://hackerone.com/reports/3718195", "https://linux.oracle.com/cve/CVE-2026-8286.html", "https://linux.oracle.com/errata/ELSA-2026-57462.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-8286", "https://ubuntu.com/security/notices/USN-8487-1", "https://www.cve.org/CVERecord?id=CVE-2026-8286" ], "PublishedDate": "2026-07-03T07:16:24.453Z", "LastModifiedDate": "2026-09-15T07:16:31.617Z" }, { "VulnerabilityID": "CVE-2026-8458", "PkgID": "curl@8.19.0-r0", "PkgName": "curl", "PkgIdentifier": { "PURL": "pkg:apk/alpine/curl@8.19.0-r0?arch=x86_64\u0026distro=3.23.3", "UID": "9fd7499bdd8d5c3b" }, "InstalledVersion": "8.19.0-r0", "FixedVersion": "8.22.0-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:bfa66cef88150e054947357ece4a5ef622b49d30ce1021b9369a763334743eaf" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-8458", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:9f14d43f0488f35be42b74f821a2dba8eeec6f93442807987ba54246d986fa23", "Title": "curl: libcurl: Unauthorized connection reuse due to a logical error", "Description": "libcurl might in some circumstances reuse the wrong connection when asked to\ndo Negotiate-authenticated ones, even when they are set to use different\n\"services\".\n\nlibcurl features a pool of recent connections so that subsequent requests can\nreuse an existing connection to avoid overhead.\n\nWhen reusing a connection a range of criteria must be met. Due to a logical\nerror in the code, a request that was issued by an application could\nwrongfully reuse an existing connection to the same server that was\nauthenticated using different services.", "Severity": "HIGH", "CweIDs": [ "CWE-488" ], "VendorSeverity": { "alma": 3, "amazon": 2, "azure": 2, "julia": 2, "oracle-oval": 3, "photon": 2, "redhat": 3, "rocky": 3, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "V3Score": 6.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:69126", "https://access.redhat.com/security/cve/CVE-2026-8458", "https://bugzilla.redhat.com/2496764", "https://bugzilla.redhat.com/2496769", "https://bugzilla.redhat.com/show_bug.cgi?id=2496764", "https://bugzilla.redhat.com/show_bug.cgi?id=2496769", "https://creativecommons.org/licenses/by/4.0/", "https://curl.se/L7HzKXisfJ/CVE-2026-8458.md", "https://curl.se/docs/CVE-2026-8458.html", "https://curl.se/docs/CVE-2026-8458.json", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8458", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8927", "https://errata.almalinux.org/9/ALSA-2026-69126.html", "https://errata.rockylinux.org/RLSA-2026:69126", "https://github.com/advisories/GHSA-88c6-6jfq-mm4q", "https://hackerone.com/reports/3721183", "https://linux.oracle.com/cve/CVE-2026-8458.html", "https://linux.oracle.com/errata/ELSA-2026-92368.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-8458", "https://ubuntu.com/security/notices/USN-8487-1", "https://www.cve.org/CVERecord?id=CVE-2026-8458" ], "PublishedDate": "2026-07-03T07:16:24.63Z", "LastModifiedDate": "2026-09-15T07:16:32.327Z" }, { "VulnerabilityID": "CVE-2026-8925", "PkgID": "curl@8.19.0-r0", "PkgName": "curl", "PkgIdentifier": { "PURL": "pkg:apk/alpine/curl@8.19.0-r0?arch=x86_64\u0026distro=3.23.3", "UID": "9fd7499bdd8d5c3b" }, "InstalledVersion": "8.19.0-r0", "FixedVersion": "8.22.0-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:bfa66cef88150e054947357ece4a5ef622b49d30ce1021b9369a763334743eaf" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-8925", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:66f99011467c92d868ea976145035cf50a2560cc2639a66e910d231d0a6ba425", "Title": "curl: curl: Double-free vulnerability in SASL authentication", "Description": "The curl logic that works with SASL authentication could end up cleaning up\nthe GSASL context *twice* without clearing the pointer in between, making it\n`free()` the same pointer twice.", "Severity": "HIGH", "CweIDs": [ "CWE-415" ], "VendorSeverity": { "amazon": 2, "julia": 4, "photon": 4, "redhat": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 9.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-8925", "https://curl.se/L7HzKXisfJ/CVE-2026-8925.md", "https://curl.se/docs/CVE-2026-8925.html", "https://curl.se/docs/CVE-2026-8925.json", "https://github.com/advisories/GHSA-p8x5-c6c9-8cwx", "https://hackerone.com/reports/3735193", "https://nvd.nist.gov/vuln/detail/CVE-2026-8925", "https://ubuntu.com/security/notices/USN-8487-1", "https://www.cve.org/CVERecord?id=CVE-2026-8925" ], "PublishedDate": "2026-07-03T07:16:24.95Z", "LastModifiedDate": "2026-09-15T07:16:32.8Z" }, { "VulnerabilityID": "CVE-2026-8927", "PkgID": "curl@8.19.0-r0", "PkgName": "curl", "PkgIdentifier": { "PURL": "pkg:apk/alpine/curl@8.19.0-r0?arch=x86_64\u0026distro=3.23.3", "UID": "9fd7499bdd8d5c3b" }, "InstalledVersion": "8.19.0-r0", "FixedVersion": "8.22.0-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:bfa66cef88150e054947357ece4a5ef622b49d30ce1021b9369a763334743eaf" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-8927", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:fcad6b8c8738bf1264114bd0b71e7460134caf4d2ad52e6d7c28c332523b4490", "Title": "curl: Information disclosure due to uncleared proxy authentication state", "Description": "When reusing a libcurl handle for sequential transfers driven by\nenvironment-variable proxy configuration, libcurl fails to clear the proxy\nauthentication state between requests. Specifically, if the initial transfer\nauthenticates against `proxyA` using Digest auth, a subsequent transfer routed\nthrough `proxyB` erroneously leaks the `Proxy-Authorization:` header intended\nsolely for `proxyA`.", "Severity": "HIGH", "CweIDs": [ "CWE-294" ], "VendorSeverity": { "alma": 3, "amazon": 2, "azure": 2, "julia": 4, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "V3Score": 9.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:69126", "https://access.redhat.com/security/cve/CVE-2026-8927", "https://bugzilla.redhat.com/2496764", "https://bugzilla.redhat.com/2496769", "https://bugzilla.redhat.com/show_bug.cgi?id=2496764", "https://bugzilla.redhat.com/show_bug.cgi?id=2496769", "https://creativecommons.org/licenses/by/4.0/", "https://curl.se/L7HzKXisfJ/CVE-2026-8927.md", "https://curl.se/docs/CVE-2026-8927.html", "https://curl.se/docs/CVE-2026-8927.json", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8458", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8927", "https://errata.almalinux.org/9/ALSA-2026-69126.html", "https://errata.rockylinux.org/RLSA-2026:69126", "https://github.com/advisories/GHSA-jr4f-4564-w3mr", "https://hackerone.com/reports/3744543", "https://linux.oracle.com/cve/CVE-2026-8927.html", "https://linux.oracle.com/errata/ELSA-2026-92368.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-8927", "https://ubuntu.com/security/notices/USN-8487-1", "https://ubuntu.com/security/notices/USN-8820-1", "https://www.cve.org/CVERecord?id=CVE-2026-8927" ], "PublishedDate": "2026-07-03T07:16:25.123Z", "LastModifiedDate": "2026-09-15T07:16:33.157Z" }, { "VulnerabilityID": "CVE-2026-92392", "PkgID": "curl@8.19.0-r0", "PkgName": "curl", "PkgIdentifier": { "PURL": "pkg:apk/alpine/curl@8.19.0-r0?arch=x86_64\u0026distro=3.23.3", "UID": "9fd7499bdd8d5c3b" }, "InstalledVersion": "8.19.0-r0", "FixedVersion": "8.23.0-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:bfa66cef88150e054947357ece4a5ef622b49d30ce1021b9369a763334743eaf" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-92392", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:d0bdfb9740e29551de09477ed955a7962627fcc97a66fe9d06382556bda9cbfe", "Title": "curl: curl: HTTP/2 upload Use-After-Free", "Description": "During an upload, curl mishandles HTTP/2 `RST_STREAM` received from the server\n(with reason `HTTP_1_1_REQUIRED` or `REFUSED_STREAM`) leading to a use after\nfree of a `struct Curl_easy` object.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "amazon": 3, "redhat": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/10/18/5", "http://www.openwall.com/lists/oss-security/2026/10/18/6", "https://access.redhat.com/security/cve/CVE-2026-92392", "https://curl.se/docs/CVE-2026-92392.html", "https://curl.se/docs/CVE-2026-92392.json", "https://hackerone.com/reports/4030333", "https://nvd.nist.gov/vuln/detail/CVE-2026-92392", "https://ubuntu.com/security/notices/USN-8927-1", "https://ubuntu.com/security/notices/USN-8927-2", "https://www.cve.org/CVERecord?id=CVE-2026-92392" ], "PublishedDate": "2026-10-14T08:17:05.997Z", "LastModifiedDate": "2026-10-18T23:16:57.163Z" }, { "VulnerabilityID": "CVE-2026-9547", "PkgID": "curl@8.19.0-r0", "PkgName": "curl", "PkgIdentifier": { "PURL": "pkg:apk/alpine/curl@8.19.0-r0?arch=x86_64\u0026distro=3.23.3", "UID": "9fd7499bdd8d5c3b" }, "InstalledVersion": "8.19.0-r0", "FixedVersion": "8.22.0-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:bfa66cef88150e054947357ece4a5ef622b49d30ce1021b9369a763334743eaf" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-9547", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:5ef6ffc043a792a716b915964199208529559873bbf63a4c3e37a040e1e8ae37", "Title": "curl: curl: Man-in-the-middle attack via SSH host key bypass", "Description": "When a libcurl-based application performs transfers via `SCP://` or `SFTP://`\nand utilizes the `CURLOPT_SSH_KEYFUNCTION` callback, it may silently accept an\nuntrusted server. This vulnerability occurs when a server presents a host key\ntype that does not match the specific key type already recorded for that host\nin the `known_hosts` file. Instead of rejecting the mismatch, the callback\nmechanism fails to properly enforce the restriction, allowing the connection\nto succeed without warning and risking a potential man-in-the-middle attack.", "Severity": "HIGH", "CweIDs": [ "CWE-297" ], "VendorSeverity": { "alma": 3, "amazon": 2, "julia": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "V3Score": 7.4 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "V3Score": 7.4 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:55439", "https://access.redhat.com/security/cve/CVE-2026-9547", "https://bugzilla.redhat.com/2446448", "https://bugzilla.redhat.com/2446450", "https://bugzilla.redhat.com/2496758", "https://bugzilla.redhat.com/2496763", "https://bugzilla.redhat.com/show_bug.cgi?id=2446448", "https://bugzilla.redhat.com/show_bug.cgi?id=2446450", "https://bugzilla.redhat.com/show_bug.cgi?id=2496758", "https://bugzilla.redhat.com/show_bug.cgi?id=2496763", "https://creativecommons.org/licenses/by/4.0/", "https://curl.se/L7HzKXisfJ/CVE-2026-9547.md", "https://curl.se/docs/CVE-2026-9547.html", "https://curl.se/docs/CVE-2026-9547.json", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-1965", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-3783", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8286", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-9547", "https://errata.almalinux.org/9/ALSA-2026-55439.html", "https://errata.rockylinux.org/RLSA-2026:55439", "https://github.com/advisories/GHSA-xq9p-gxg6-f7q6", "https://hackerone.com/reports/3751712", "https://linux.oracle.com/cve/CVE-2026-9547.html", "https://linux.oracle.com/errata/ELSA-2026-55450.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-9547", "https://ubuntu.com/security/notices/USN-8487-1", "https://www.cve.org/CVERecord?id=CVE-2026-9547" ], "PublishedDate": "2026-07-03T07:16:25.99Z", "LastModifiedDate": "2026-09-15T07:16:35.31Z" }, { "VulnerabilityID": "CVE-2026-33747", "PkgID": "docker-cli@29.1.3-r5", "PkgName": "docker-cli", "PkgIdentifier": { "PURL": "pkg:apk/alpine/docker-cli@29.1.3-r5?arch=x86_64\u0026distro=3.23.3", "UID": "75932c5885473348" }, "InstalledVersion": "29.1.3-r5", "FixedVersion": "29.3.1-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:bfa66cef88150e054947357ece4a5ef622b49d30ce1021b9369a763334743eaf" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-33747", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:c0b1f568a5b4d1301d8d04542a405b1a8618dab28440ff6930a7ed33ad645b93", "Title": "BuildKit: github.com/moby/buildkit: BuildKit: Arbitrary file write and code execution via untrusted frontend", "Description": "BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to version 0.28.1, when using a custom BuildKit frontend, the frontend can craft an API message that causes files to be written outside of the BuildKit state directory for the execution context. The issue has been fixed in v0.28.1. The vulnerability requires using an untrusted BuildKit frontend set with `#syntax` or `--build-arg BUILDKIT_SYNTAX`. Using these options with a well-known frontend image like `docker/dockerfile` is not affected.", "Severity": "CRITICAL", "CweIDs": [ "CWE-22" ], "VendorSeverity": { "ghsa": 3, "nvd": 4, "redhat": 2, "ubuntu": 2 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.4 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 9.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H", "V3Score": 8.2 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-33747", "https://github.com/moby/buildkit", "https://github.com/moby/buildkit/releases/tag/v0.28.1", "https://github.com/moby/buildkit/security/advisories/GHSA-4c29-8rgm-jvjj", "https://nvd.nist.gov/vuln/detail/CVE-2026-33747", "https://ubuntu.com/security/notices/USN-8230-1", "https://www.cve.org/CVERecord?id=CVE-2026-33747" ], "PublishedDate": "2026-03-27T01:16:21.33Z", "LastModifiedDate": "2026-06-17T10:38:01.807Z" }, { "VulnerabilityID": "CVE-2026-31431", "PkgID": "docker-cli@29.1.3-r5", "PkgName": "docker-cli", "PkgIdentifier": { "PURL": "pkg:apk/alpine/docker-cli@29.1.3-r5?arch=x86_64\u0026distro=3.23.3", "UID": "75932c5885473348" }, "InstalledVersion": "29.1.3-r5", "FixedVersion": "29.4.3-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:bfa66cef88150e054947357ece4a5ef622b49d30ce1021b9369a763334743eaf" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-31431", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:a305c4757ab5fbc6de24ff09d59df2737348ed4b148c6ba87e190d4a82c2cb6e", "Title": "kernel: crypto: algif_aead - Revert to operating out-of-place", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: algif_aead - Revert to operating out-of-place\n\nThis mostly reverts commit 72548b093ee3 except for the copying of\nthe associated data.\n\nThere is no benefit in operating in-place in algif_aead since the\nsource and destination come from different mappings. Get rid of\nall the complexity added for in-place operation and just copy the\nAD directly.", "Severity": "HIGH", "CweIDs": [ "CWE-669", "CWE-1288" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "bottlerocket": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31431", "http://www.openwall.com/lists/oss-security/2026/04/29/23", "http://www.openwall.com/lists/oss-security/2026/04/29/25", "http://www.openwall.com/lists/oss-security/2026/04/29/26", "http://www.openwall.com/lists/oss-security/2026/04/30/10", "http://www.openwall.com/lists/oss-security/2026/04/30/11", "http://www.openwall.com/lists/oss-security/2026/04/30/12", "http://www.openwall.com/lists/oss-security/2026/04/30/14", "http://www.openwall.com/lists/oss-security/2026/04/30/15", "http://www.openwall.com/lists/oss-security/2026/04/30/16", "http://www.openwall.com/lists/oss-security/2026/04/30/17", "http://www.openwall.com/lists/oss-security/2026/04/30/18", "http://www.openwall.com/lists/oss-security/2026/04/30/2", "http://www.openwall.com/lists/oss-security/2026/04/30/20", "http://www.openwall.com/lists/oss-security/2026/04/30/5", "http://www.openwall.com/lists/oss-security/2026/04/30/6", "http://www.openwall.com/lists/oss-security/2026/05/01/10", "http://www.openwall.com/lists/oss-security/2026/05/01/12", "http://www.openwall.com/lists/oss-security/2026/05/01/15", "http://www.openwall.com/lists/oss-security/2026/05/01/16", "http://www.openwall.com/lists/oss-security/2026/05/01/17", "http://www.openwall.com/lists/oss-security/2026/05/01/18", "http://www.openwall.com/lists/oss-security/2026/05/01/2", "http://www.openwall.com/lists/oss-security/2026/05/01/22", "http://www.openwall.com/lists/oss-security/2026/05/01/23", "http://www.openwall.com/lists/oss-security/2026/05/01/24", "http://www.openwall.com/lists/oss-security/2026/05/01/3", "http://www.openwall.com/lists/oss-security/2026/05/02/14", "http://www.openwall.com/lists/oss-security/2026/05/02/15", "http://www.openwall.com/lists/oss-security/2026/05/02/16", "http://www.openwall.com/lists/oss-security/2026/05/02/17", "http://www.openwall.com/lists/oss-security/2026/05/02/18", "http://www.openwall.com/lists/oss-security/2026/05/02/19", "http://www.openwall.com/lists/oss-security/2026/05/02/20", "http://www.openwall.com/lists/oss-security/2026/05/02/21", "http://www.openwall.com/lists/oss-security/2026/05/02/23", "http://www.openwall.com/lists/oss-security/2026/05/02/24", "http://www.openwall.com/lists/oss-security/2026/05/02/25", "http://www.openwall.com/lists/oss-security/2026/05/02/4", "http://www.openwall.com/lists/oss-security/2026/05/02/5", "http://www.openwall.com/lists/oss-security/2026/05/02/6", "http://www.openwall.com/lists/oss-security/2026/05/02/7", "http://www.openwall.com/lists/oss-security/2026/05/02/8", "http://www.openwall.com/lists/oss-security/2026/05/03/10", "http://www.openwall.com/lists/oss-security/2026/05/03/12", "http://www.openwall.com/lists/oss-security/2026/05/03/13", "http://www.openwall.com/lists/oss-security/2026/05/03/3", "http://www.openwall.com/lists/oss-security/2026/05/03/4", "http://www.openwall.com/lists/oss-security/2026/05/03/5", "http://www.openwall.com/lists/oss-security/2026/05/03/6", "http://www.openwall.com/lists/oss-security/2026/05/04/1", "http://www.openwall.com/lists/oss-security/2026/05/04/10", "http://www.openwall.com/lists/oss-security/2026/05/04/11", "http://www.openwall.com/lists/oss-security/2026/05/04/12", "http://www.openwall.com/lists/oss-security/2026/05/04/13", "http://www.openwall.com/lists/oss-security/2026/05/04/14", "http://www.openwall.com/lists/oss-security/2026/05/04/2", "http://www.openwall.com/lists/oss-security/2026/05/04/24", "http://www.openwall.com/lists/oss-security/2026/05/04/27", "http://www.openwall.com/lists/oss-security/2026/05/04/28", "http://www.openwall.com/lists/oss-security/2026/05/04/29", "http://www.openwall.com/lists/oss-security/2026/05/04/31", "http://www.openwall.com/lists/oss-security/2026/05/04/8", "http://www.openwall.com/lists/oss-security/2026/05/04/9", "http://www.openwall.com/lists/oss-security/2026/05/06/5", "http://www.openwall.com/lists/oss-security/2026/05/07/12", "http://www.openwall.com/lists/oss-security/2026/05/07/2", "http://www.openwall.com/lists/oss-security/2026/05/08/13", "http://www.openwall.com/lists/oss-security/2026/05/18/3", "https://access.redhat.com/articles/7141989", "https://access.redhat.com/errata/RHSA-2026:13565", "https://access.redhat.com/errata/RHSA-2026:13566", "https://access.redhat.com/errata/RHSA-2026:13577", "https://access.redhat.com/errata/RHSA-2026:13578", "https://access.redhat.com/errata/RHSA-2026:13681", "https://access.redhat.com/errata/RHSA-2026:13690", "https://access.redhat.com/errata/RHSA-2026:13727", "https://access.redhat.com/errata/RHSA-2026:13729", "https://access.redhat.com/errata/RHSA-2026:13734", "https://access.redhat.com/errata/RHSA-2026:13811", "https://access.redhat.com/errata/RHSA-2026:13862", "https://access.redhat.com/errata/RHSA-2026:13885", "https://access.redhat.com/errata/RHSA-2026:13887", "https://access.redhat.com/errata/RHSA-2026:13932", "https://access.redhat.com/errata/RHSA-2026:13936", "https://access.redhat.com/errata/RHSA-2026:14097", "https://access.redhat.com/errata/RHSA-2026:14112", "https://access.redhat.com/errata/RHSA-2026:14137", "https://access.redhat.com/errata/RHSA-2026:14165", "https://access.redhat.com/errata/RHSA-2026:14230", "https://access.redhat.com/errata/RHSA-2026:14301", "https://access.redhat.com/errata/RHSA-2026:14339", "https://access.redhat.com/errata/RHSA-2026:14773", "https://access.redhat.com/errata/RHSA-2026:14926", "https://access.redhat.com/errata/RHSA-2026:15087", "https://access.redhat.com/errata/RHSA-2026:15976", "https://access.redhat.com/errata/RHSA-2026:15978", "https://access.redhat.com/errata/RHSA-2026:16018", "https://access.redhat.com/errata/RHSA-2026:16063", "https://access.redhat.com/errata/RHSA-2026:16111", "https://access.redhat.com/errata/RHSA-2026:16208", "https://access.redhat.com/errata/RHSA-2026:16209", "https://access.redhat.com/errata/RHSA-2026:16210", "https://access.redhat.com/errata/RHSA-2026:19074", "https://access.redhat.com/errata/RHSA-2026:19225", "https://access.redhat.com/errata/RHSA-2026:33486", "https://access.redhat.com/security/cve/CVE-2026-31431", "https://access.redhat.com/security/cve/cve-2026-31431#cve-details-mitigation", "https://access.redhat.com/solutions/7141931", "https://access.redhat.com/solutions/7141979", "https://access.redhat.com/solutions/7141990", "https://access.redhat.com/solutions/7141996", "https://access.redhat.com/solutions/7142032", "https://bugzilla.redhat.com/show_bug.cgi?id=2439852", "https://bugzilla.redhat.com/show_bug.cgi?id=2448745", "https://bugzilla.redhat.com/show_bug.cgi?id=2454844", "https://bugzilla.redhat.com/show_bug.cgi?id=2460538", "https://bugzilla.redhat.com/show_bug.cgi?id=2467022", "https://cert-portal.siemens.com/productcert/html/ssa-019113.html", "https://cert-portal.siemens.com/productcert/html/ssa-082556.html", "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "https://cert-portal.siemens.com/productcert/html/ssa-328642.html", "https://copy.fail", "https://copy.fail/", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23136", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23270", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31402", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31431", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43077", "https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/9/html/managing_monitoring_and_updating_the_kernel/configuring-kernel-command-line-parameters_managing-monitoring-and-updating-the-kernel", "https://errata.almalinux.org/9/ALSA-2026-A002.html", "https://errata.rockylinux.org/RLSA-2026:13565", "https://git.kernel.org/linus/a664bf3d603dc3bdcf9ae47cc21e0daec706d7a5%20%287.0-rc7%29", "https://git.kernel.org/stable/c/19d43105a97be0810edbda875f2cd03f30dc130c", "https://git.kernel.org/stable/c/3115af9644c342b356f3f07a4dd1c8905cd9a6fc", "https://git.kernel.org/stable/c/893d22e0135fa394db81df88697fba6032747667", "https://git.kernel.org/stable/c/8b88d99341f139e23bdeb1027a2a3ae10d341d82", "https://git.kernel.org/stable/c/961cfa271a918ad4ae452420e7c303149002875b", "https://git.kernel.org/stable/c/a664bf3d603dc3bdcf9ae47cc21e0daec706d7a5", "https://git.kernel.org/stable/c/ce42ee423e58dffa5ec03524054c9d8bfd4f6237", "https://git.kernel.org/stable/c/fafe0fa2995a0f7073c1c358d7d3145bcc9aedd8", "https://github.com/bottlerocket-os/bottlerocket-kernel-kit/blob/develop/advisories/5.4.1/BRSA-qflqp6rcsegb.toml", "https://github.com/theori-io/copy-fail-CVE-2026-31431", "https://linux.oracle.com/cve/CVE-2026-31431.html", "https://linux.oracle.com/errata/ELSA-2026-50372.html", "https://lore.kernel.org/linux-cve-announce/2026042214-CVE-2026-31431-3d65@gregkh/", "https://lore.kernel.org/linux-cve-announce/2026042214-CVE-2026-31431-3d65@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-31431", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-31431.json", "https://ubuntu.com/blog/copy-fail-vulnerability-fixes-available", "https://ubuntu.com/security/notices/USN-8226-1", "https://ubuntu.com/security/notices/USN-8277-1", "https://ubuntu.com/security/notices/USN-8277-2", "https://ubuntu.com/security/notices/USN-8278-1", "https://ubuntu.com/security/notices/USN-8278-2", "https://ubuntu.com/security/notices/USN-8279-1", "https://ubuntu.com/security/notices/USN-8279-2", "https://ubuntu.com/security/notices/USN-8279-3", "https://ubuntu.com/security/notices/USN-8280-1", "https://ubuntu.com/security/notices/USN-8280-2", "https://ubuntu.com/security/notices/USN-8280-3", "https://ubuntu.com/security/notices/USN-8281-1", "https://ubuntu.com/security/notices/USN-8281-2", "https://ubuntu.com/security/notices/USN-8289-1", "https://ubuntu.com/security/notices/USN-8289-2", "https://ubuntu.com/security/notices/USN-8305-1", "https://ubuntu.com/security/notices/USN-8305-2", "https://ubuntu.com/security/notices/USN-8310-1", "https://ubuntu.com/security/notices/USN-8350-1", "https://ubuntu.com/security/notices/USN-8351-1", "https://ubuntu.com/security/notices/USN-8374-1", "https://ubuntu.com/security/notices/USN-8391-1", "https://ubuntu.com/security/notices/USN-8392-1", "https://ubuntu.com/security/notices/USN-8393-1", "https://ubuntu.com/security/notices/USN-8426-1", "https://ubuntu.com/security/notices/USN-8426-2", "https://ubuntu.com/security/notices/USN-8440-1", "https://ubuntu.com/security/notices/USN-8441-1", "https://ubuntu.com/security/notices/USN-8462-1", "https://ubuntu.com/security/notices/USN-8499-1", "https://ubuntu.com/security/notices/USN-8528-1", "https://websec.net/blog/cve-2026-31431-linux-algifaead-page-cache-write-to-root-69f38a4ccddd2db1f520f170", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-31431", "https://www.cve.org/CVERecord?id=CVE-2026-31431", "https://www.kb.cert.org/vuls/id/260001", "https://www.openwall.com/lists/oss-security/2026/04/29/23", "https://xint.io/blog/copy-fail-linux-distributions", "https://xint.io/blog/copy-fail-linux-distributions#the-fix-6" ], "PublishedDate": "2026-04-22T09:16:21.27Z", "LastModifiedDate": "2026-09-08T15:13:07.273Z" }, { "VulnerabilityID": "CVE-2026-33748", "PkgID": "docker-cli@29.1.3-r5", "PkgName": "docker-cli", "PkgIdentifier": { "PURL": "pkg:apk/alpine/docker-cli@29.1.3-r5?arch=x86_64\u0026distro=3.23.3", "UID": "75932c5885473348" }, "InstalledVersion": "29.1.3-r5", "FixedVersion": "29.3.1-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:bfa66cef88150e054947357ece4a5ef622b49d30ce1021b9369a763334743eaf" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-33748", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:c17ee57a670c30ab33c1095ec36ce8e3e6679ea003d9b76a74531f4e057db7ce", "Title": "github.com/moby/buildkit: BuildKit: Unauthorized file access via Git URL fragment subdir components", "Description": "BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to version 0.28.1, insufficient validation of Git URL fragment subdir components may allow access to files outside the checked-out Git repository root. Possible access is limited to files on the same mounted filesystem. The issue has been fixed in version v0.28.1 The issue affects only builds that use Git URLs with a subpath component. As a workaround, avoid building Dockerfiles from untrusted sources or using the subdir component from an untrusted Git repository where the subdir component could point to a symlink.", "Severity": "HIGH", "CweIDs": [ "CWE-22", "CWE-59" ], "VendorSeverity": { "amazon": 2, "ghsa": 3, "nvd": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "V3Score": 7.5, "V40Score": 8.2 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "V3Score": 6.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-33748", "https://docs.docker.com/build/concepts/context/#url-fragments", "https://github.com/moby/buildkit", "https://github.com/moby/buildkit/releases/tag/v0.28.1", "https://github.com/moby/buildkit/security/advisories/GHSA-4vrq-3vrq-g6gg", "https://nvd.nist.gov/vuln/detail/CVE-2026-33748", "https://ubuntu.com/security/notices/USN-8230-1", "https://www.cve.org/CVERecord?id=CVE-2026-33748" ], "PublishedDate": "2026-03-27T15:16:57.127Z", "LastModifiedDate": "2026-10-26T21:10:00.17Z" }, { "VulnerabilityID": "CVE-2026-33997", "PkgID": "docker-cli@29.1.3-r5", "PkgName": "docker-cli", "PkgIdentifier": { "PURL": "pkg:apk/alpine/docker-cli@29.1.3-r5?arch=x86_64\u0026distro=3.23.3", "UID": "75932c5885473348" }, "InstalledVersion": "29.1.3-r5", "FixedVersion": "29.3.1-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:bfa66cef88150e054947357ece4a5ef622b49d30ce1021b9369a763334743eaf" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-33997", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:69974eb29333fd11d1bb7067730c0bdb298668ff2d2d9591a901dcc913c9e9c8", "Title": "moby: docker: github.com/moby/moby: Moby: Privilege validation bypass during plugin installation", "Description": "Moby is an open source container framework. Prior to version 29.3.1, a security vulnerability has been detected that allows plugins privilege validation to be bypassed during docker plugin install. Due to an error in the daemon's privilege comparison logic, the daemon may incorrectly accept a privilege set that differs from the one approved by the user. Plugins that request exactly one privilege are also affected, because no comparison is performed at all. This issue has been patched in version 29.3.1.", "Severity": "HIGH", "CweIDs": [ "CWE-193", "CWE-266" ], "VendorSeverity": { "amazon": 2, "ghsa": 2, "nvd": 3, "photon": 3, "redhat": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N", "V3Score": 6.8 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "V3Score": 8.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H", "V3Score": 8.4 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:21769", "https://access.redhat.com/errata/RHSA-2026:22347", "https://access.redhat.com/errata/RHSA-2026:23345", "https://access.redhat.com/security/cve/CVE-2026-33997", "https://bugzilla.redhat.com/show_bug.cgi?id=2453277", "https://docs.docker.com/engine/extend/legacy_plugins", "https://github.com/moby/moby", "https://github.com/moby/moby/commit/f4d6f25bf0c3fa12d4968320a45685947756a22a", "https://github.com/moby/moby/releases/tag/docker-v29.3.1", "https://github.com/moby/moby/security/advisories/GHSA-pxq6-2prw-chj9", "https://nvd.nist.gov/vuln/detail/CVE-2026-33997", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33997.json", "https://www.cve.org/CVERecord?id=CVE-2026-33997" ], "PublishedDate": "2026-03-31T03:15:57.523Z", "LastModifiedDate": "2026-09-09T13:19:32.963Z" }, { "VulnerabilityID": "CVE-2026-34040", "PkgID": "docker-cli@29.1.3-r5", "PkgName": "docker-cli", "PkgIdentifier": { "PURL": "pkg:apk/alpine/docker-cli@29.1.3-r5?arch=x86_64\u0026distro=3.23.3", "UID": "75932c5885473348" }, "InstalledVersion": "29.1.3-r5", "FixedVersion": "29.3.1-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:bfa66cef88150e054947357ece4a5ef622b49d30ce1021b9369a763334743eaf" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-34040", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:aa2f25034ddc978ca14da6c1976a269a93b78097accfab2bc990b7668ef671b3", "Title": "Moby: Moby: Authorization bypass vulnerability", "Description": "Moby is an open source container framework. Prior to version 29.3.1, a security vulnerability has been detected that allows attackers to bypass authorization plugins (AuthZ). This issue has been patched in version 29.3.1.", "Severity": "HIGH", "CweIDs": [ "CWE-288" ], "VendorSeverity": { "amazon": 3, "ghsa": 3, "nvd": 3, "photon": 3, "redhat": 2 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "V3Score": 8.8 }, "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N", "V3Score": 8.4 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-34040", "https://docs.docker.com/engine/extend/plugins_authorization", "https://github.com/moby/moby", "https://github.com/moby/moby/commit/e89edb19ad7de0407a5d31e3111cb01aa10b5a38", "https://github.com/moby/moby/releases/tag/docker-v29.3.1", "https://github.com/moby/moby/security/advisories/GHSA-v23v-6jw2-98fq", "https://github.com/moby/moby/security/advisories/GHSA-x744-4wpc-v9h2", "https://nvd.nist.gov/vuln/detail/CVE-2026-34040", "https://www.cve.org/CVERecord?id=CVE-2026-34040" ], "PublishedDate": "2026-03-31T03:15:57.883Z", "LastModifiedDate": "2026-06-17T10:38:28.383Z" }, { "VulnerabilityID": "CVE-2026-41567", "PkgID": "docker-cli@29.1.3-r5", "PkgName": "docker-cli", "PkgIdentifier": { "PURL": "pkg:apk/alpine/docker-cli@29.1.3-r5?arch=x86_64\u0026distro=3.23.3", "UID": "75932c5885473348" }, "InstalledVersion": "29.1.3-r5", "FixedVersion": "29.5.1-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:bfa66cef88150e054947357ece4a5ef622b49d30ce1021b9369a763334743eaf" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-41567", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:69c08d447caac2ea45ef64be2e344a43d5a47c53d72cf489fb030362d744c2f8", "Title": "docker: Moby/Docker Engine: Arbitrary Code Execution via malicious container image and compressed archive upload", "Description": "Moby is an open source container framework. In versions prior to 29.5.1 and in moby/moby v2 prior to v2.0.0-beta.14, when a compressed archive is uploaded to a container via `PUT /containers/{id}/archive` or piped through `docker cp -`, the daemon resolves decompression binaries (such as `xz` or `unpigz`) from the container's filesystem rather than the host's due to incorrect ordering of operations. A malicious container image containing a trojanized decompression binary can achieve arbitrary code execution with full daemon privileges, including host root UID and unrestricted capabilities, when a user uploads a compressed (xz or gzip) archive into that container. This issue is fixed in Docker Engine 29.5.1 and moby/moby v2.0.0-beta.14. Workarounds include only running containers from trusted images, using authorization plugins to restrict access to the `PUT /containers/{id}/archive` endpoint, and avoiding piping compressed archives into containers created from untrusted images", "Severity": "HIGH", "CweIDs": [ "CWE-427" ], "VendorSeverity": { "amazon": 3, "ghsa": 3, "photon": 3, "redhat": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N", "V3Score": 7.2 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:37387", "https://access.redhat.com/errata/RHSA-2026:41030", "https://access.redhat.com/errata/RHSA-2026:42852", "https://access.redhat.com/errata/RHSA-2026:44622", "https://access.redhat.com/errata/RHSA-2026:51057", "https://access.redhat.com/security/cve/CVE-2026-41567", "https://bugzilla.redhat.com/show_bug.cgi?id=2485356", "https://github.com/moby/moby", "https://github.com/moby/moby/security/advisories/GHSA-x86f-5xw2-fm2r", "https://nvd.nist.gov/vuln/detail/CVE-2026-41567", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41567.json", "https://www.cve.org/CVERecord?id=CVE-2026-41567" ], "PublishedDate": "2026-06-05T02:17:13.817Z", "LastModifiedDate": "2026-09-09T13:19:53.313Z" }, { "VulnerabilityID": "CVE-2026-43206", "PkgID": "docker-cli@29.1.3-r5", "PkgName": "docker-cli", "PkgIdentifier": { "PURL": "pkg:apk/alpine/docker-cli@29.1.3-r5?arch=x86_64\u0026distro=3.23.3", "UID": "75932c5885473348" }, "InstalledVersion": "29.1.3-r5", "FixedVersion": "29.5.1-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:bfa66cef88150e054947357ece4a5ef622b49d30ce1021b9369a763334743eaf" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-43206", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:1baf73ebeb76eca1804b5af0a548009278ed33603e45ae59798bf765f6e07888", "Title": "kernel: drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set()", "Description": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdkfd: Fix out-of-bounds write in kfd_event_page_set()\n\nThe kfd_event_page_set() function writes KFD_SIGNAL_EVENT_LIMIT * 8\nbytes via memset without checking the buffer size parameter. This allows\nunprivileged userspace to trigger an out-of bounds kernel memory write\nby passing a small buffer, leading to potential privilege\nescalation.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "alma": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:57252", "https://access.redhat.com/security/cve/CVE-2026-43206", "https://bugzilla.redhat.com/2467135", "https://bugzilla.redhat.com/2467156", "https://bugzilla.redhat.com/2467202", "https://bugzilla.redhat.com/2482113", "https://bugzilla.redhat.com/2482124", "https://bugzilla.redhat.com/2482614", "https://bugzilla.redhat.com/2492403", "https://bugzilla.redhat.com/2492719", "https://bugzilla.redhat.com/2492768", "https://bugzilla.redhat.com/2492788", "https://bugzilla.redhat.com/2495941", "https://bugzilla.redhat.com/2495950", "https://bugzilla.redhat.com/2502188", "https://bugzilla.redhat.com/2502321", "https://bugzilla.redhat.com/2502361", "https://bugzilla.redhat.com/2502422", "https://bugzilla.redhat.com/2502443", "https://bugzilla.redhat.com/2502463", "https://bugzilla.redhat.com/2502589", "https://bugzilla.redhat.com/2506790", "https://bugzilla.redhat.com/2507042", "https://bugzilla.redhat.com/2507135", "https://bugzilla.redhat.com/2507216", "https://bugzilla.redhat.com/2508504", "https://bugzilla.redhat.com/2513373", "https://bugzilla.redhat.com/2513470", "https://bugzilla.redhat.com/show_bug.cgi?id=2467135", "https://bugzilla.redhat.com/show_bug.cgi?id=2467156", "https://bugzilla.redhat.com/show_bug.cgi?id=2467202", "https://bugzilla.redhat.com/show_bug.cgi?id=2482113", "https://bugzilla.redhat.com/show_bug.cgi?id=2482124", "https://bugzilla.redhat.com/show_bug.cgi?id=2482614", "https://bugzilla.redhat.com/show_bug.cgi?id=2492403", "https://bugzilla.redhat.com/show_bug.cgi?id=2492719", "https://bugzilla.redhat.com/show_bug.cgi?id=2492768", "https://bugzilla.redhat.com/show_bug.cgi?id=2492788", "https://bugzilla.redhat.com/show_bug.cgi?id=2495941", "https://bugzilla.redhat.com/show_bug.cgi?id=2495950", "https://bugzilla.redhat.com/show_bug.cgi?id=2502188", "https://bugzilla.redhat.com/show_bug.cgi?id=2502321", "https://bugzilla.redhat.com/show_bug.cgi?id=2502361", "https://bugzilla.redhat.com/show_bug.cgi?id=2502422", "https://bugzilla.redhat.com/show_bug.cgi?id=2502443", "https://bugzilla.redhat.com/show_bug.cgi?id=2502463", "https://bugzilla.redhat.com/show_bug.cgi?id=2502589", "https://bugzilla.redhat.com/show_bug.cgi?id=2506790", "https://bugzilla.redhat.com/show_bug.cgi?id=2507042", "https://bugzilla.redhat.com/show_bug.cgi?id=2507135", "https://bugzilla.redhat.com/show_bug.cgi?id=2507216", "https://bugzilla.redhat.com/show_bug.cgi?id=2508504", "https://bugzilla.redhat.com/show_bug.cgi?id=2513373", "https://bugzilla.redhat.com/show_bug.cgi?id=2513470", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43206", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43233", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43237", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45878", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45991", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46120", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52991", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53136", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53143", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53189", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53329", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53356", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53374", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63879", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63884", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63888", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63952", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64007", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64048", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64219", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64379", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64382", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64386", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-64560", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68343", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-68388", "https://errata.almalinux.org/9/ALSA-2026-57252.html", "https://errata.rockylinux.org/RLSA-2026:57252", "https://git.kernel.org/linus/8a70a26c9f34baea6c3199a9862ddaff4554a96d%20%287.0-rc1%29", "https://git.kernel.org/stable/c/3e04bc310d80b46eaf481f1fefcbcb37a187412d", "https://git.kernel.org/stable/c/4857c37c7ba9aa38b9a4c694e8bd8d0091c87940", "https://git.kernel.org/stable/c/4e72f419e4ed44cb3b60506752d8688c20a60a9b", "https://git.kernel.org/stable/c/75fb57efdd7863fffbc39db23e9cad7aafda26ed", "https://git.kernel.org/stable/c/8a70a26c9f34baea6c3199a9862ddaff4554a96d", "https://git.kernel.org/stable/c/b4034442cb090e4a980bdcc1540948606cbc951b", "https://git.kernel.org/stable/c/bfcd6b53e1f4feb182952f4ff9a137c36ceaf20b", "https://git.kernel.org/stable/c/de8d7a25cd2eb5875b1d8d4fbc7fe4b4138b781f", "https://linux.oracle.com/cve/CVE-2026-43206.html", "https://linux.oracle.com/errata/ELSA-2026-57252.html", "https://lore.kernel.org/linux-cve-announce/2026050647-CVE-2026-43206-ca61@gregkh/T", "https://nvd.nist.gov/vuln/detail/CVE-2026-43206", "https://ubuntu.com/security/notices/USN-8492-1", "https://ubuntu.com/security/notices/USN-8492-2", "https://ubuntu.com/security/notices/USN-8492-3", "https://ubuntu.com/security/notices/USN-8492-4", "https://ubuntu.com/security/notices/USN-8492-5", "https://ubuntu.com/security/notices/USN-8497-1", "https://ubuntu.com/security/notices/USN-8498-1", "https://ubuntu.com/security/notices/USN-8499-1", "https://ubuntu.com/security/notices/USN-8575-1", "https://ubuntu.com/security/notices/USN-8575-2", "https://ubuntu.com/security/notices/USN-8575-3", "https://ubuntu.com/security/notices/USN-8576-1", "https://ubuntu.com/security/notices/USN-8576-2", "https://ubuntu.com/security/notices/USN-8597-1", "https://ubuntu.com/security/notices/USN-8606-1", "https://ubuntu.com/security/notices/USN-8607-1", "https://ubuntu.com/security/notices/USN-8609-1", "https://ubuntu.com/security/notices/USN-8610-1", "https://ubuntu.com/security/notices/USN-8619-1", "https://ubuntu.com/security/notices/USN-8620-1", "https://ubuntu.com/security/notices/USN-8620-2", "https://ubuntu.com/security/notices/USN-8620-3", "https://ubuntu.com/security/notices/USN-8620-4", "https://ubuntu.com/security/notices/USN-8668-1", "https://ubuntu.com/security/notices/USN-8668-2", "https://www.cve.org/CVERecord?id=CVE-2026-43206" ], "PublishedDate": "2026-05-06T12:16:39.903Z", "LastModifiedDate": "2026-10-19T20:18:10.89Z" }, { "VulnerabilityID": "CVE-2026-32316", "PkgID": "jq@1.8.1-r0", "PkgName": "jq", "PkgIdentifier": { "PURL": "pkg:apk/alpine/jq@1.8.1-r0?arch=x86_64\u0026distro=3.23.3", "UID": "ef275774a650dbd5" }, "InstalledVersion": "1.8.1-r0", "FixedVersion": "1.8.2-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:bfa66cef88150e054947357ece4a5ef622b49d30ce1021b9369a763334743eaf" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-32316", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:e40cec6c0ccdcde4d7def3900e1677c34996745d8cc708a924f46a273b630697", "Title": "jq: jq: Denial of Service or potential arbitrary code execution due to integer overflow and heap-based buffer overflow", "Description": "jq is a command-line JSON processor. An integer overflow vulnerability exists through version 1.8.1 within the jvp_string_append() and jvp_string_copy_replace_bad functions, where concatenating strings with a combined length exceeding 2^31 bytes causes a 32-bit unsigned integer overflow in the buffer allocation size calculation, resulting in a drastically undersized heap buffer. Subsequent memory copy operations then write the full string data into this undersized buffer, causing a heap buffer overflow classified as CWE-190 (Integer Overflow) leading to CWE-122 (Heap-based Buffer Overflow). Any system evaluating untrusted jq queries is affected, as an attacker can crash the process or potentially achieve further exploitation through heap corruption by crafting queries that produce extremely large strings. The root cause is the absence of string size bounds checking, unlike arrays and objects which already have size limits. The issue has been addressed in commit e47e56d226519635768e6aab2f38f0ab037c09e5.", "Severity": "HIGH", "CweIDs": [ "CWE-122", "CWE-190" ], "VendorSeverity": { "amazon": 2, "azure": 3, "nvd": 3, "photon": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:H", "V3Score": 6.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-32316", "https://github.com/jqlang/jq/commit/e47e56d226519635768e6aab2f38f0ab037c09e5", "https://github.com/jqlang/jq/security/advisories/GHSA-q3h9-m34w-h76f", "https://lists.debian.org/debian-lts-announce/2026/10/msg00034.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-32316", "https://ubuntu.com/security/notices/USN-8202-1", "https://ubuntu.com/security/notices/USN-8202-2", "https://www.cve.org/CVERecord?id=CVE-2026-32316" ], "PublishedDate": "2026-04-13T18:16:29.42Z", "LastModifiedDate": "2026-10-26T22:10:00.163Z" }, { "VulnerabilityID": "CVE-2026-40164", "PkgID": "jq@1.8.1-r0", "PkgName": "jq", "PkgIdentifier": { "PURL": "pkg:apk/alpine/jq@1.8.1-r0?arch=x86_64\u0026distro=3.23.3", "UID": "ef275774a650dbd5" }, "InstalledVersion": "1.8.1-r0", "FixedVersion": "1.8.2-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:bfa66cef88150e054947357ece4a5ef622b49d30ce1021b9369a763334743eaf" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-40164", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:d43f519db6d5fee5249546d29e6ef0aef252233115f1fd576ce7821d863eff59", "Title": "jq: jq: Denial of Service via crafted JSON object causing hash collisions", "Description": "jq is a command-line JSON processor. Before commit 0c7d133c3c7e37c00b6d46b658a02244fdd3c784, jq used MurmurHash3 with a hardcoded, publicly visible seed (0x432A9843) for all JSON object hash table operations, which allowed an attacker to precompute key collisions offline. By supplying a crafted JSON object (~100 KB) where all keys hashed to the same bucket, hash table lookups degraded from O(1) to O(n), turning any jq expression into an O(n²) operation and causing significant CPU exhaustion. This affected common jq use cases such as CI/CD pipelines, web services, and data processing scripts, and was far more practical to exploit than existing heap overflow issues since it required only a small payload. This issue has been patched in commit 0c7d133c3c7e37c00b6d46b658a02244fdd3c784.", "Severity": "HIGH", "CweIDs": [ "CWE-328", "CWE-407", "CWE-341" ], "VendorSeverity": { "alma": 3, "amazon": 2, "azure": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:16252", "https://access.redhat.com/errata/RHSA-2026:16692", "https://access.redhat.com/errata/RHSA-2026:16693", "https://access.redhat.com/errata/RHSA-2026:18040", "https://access.redhat.com/errata/RHSA-2026:18042", "https://access.redhat.com/errata/RHSA-2026:18043", "https://access.redhat.com/errata/RHSA-2026:18044", "https://access.redhat.com/errata/RHSA-2026:18045", "https://access.redhat.com/errata/RHSA-2026:18046", "https://access.redhat.com/errata/RHSA-2026:18047", "https://access.redhat.com/errata/RHSA-2026:18048", "https://access.redhat.com/errata/RHSA-2026:19151", "https://access.redhat.com/errata/RHSA-2026:19365", "https://access.redhat.com/errata/RHSA-2026:23233", "https://access.redhat.com/errata/RHSA-2026:23245", "https://access.redhat.com/errata/RHSA-2026:25044", "https://access.redhat.com/errata/RHSA-2026:25096", "https://access.redhat.com/errata/RHSA-2026:25181", "https://access.redhat.com/errata/RHSA-2026:26528", "https://access.redhat.com/errata/RHSA-2026:26542", "https://access.redhat.com/errata/RHSA-2026:28887", "https://access.redhat.com/errata/RHSA-2026:30078", "https://access.redhat.com/errata/RHSA-2026:30087", "https://access.redhat.com/errata/RHSA-2026:30088", "https://access.redhat.com/errata/RHSA-2026:30089", "https://access.redhat.com/errata/RHSA-2026:34098", "https://access.redhat.com/errata/RHSA-2026:8579", "https://access.redhat.com/security/cve/CVE-2026-40164", "https://bugzilla.redhat.com/2458077", "https://bugzilla.redhat.com/2458084", "https://bugzilla.redhat.com/show_bug.cgi?id=2458077", "https://bugzilla.redhat.com/show_bug.cgi?id=2458084", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39979", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-40164", "https://errata.almalinux.org/9/ALSA-2026-19365.html", "https://errata.rockylinux.org/RLSA-2026:19365", "https://github.com/jqlang/jq/commit/0c7d133c3c7e37c00b6d46b658a02244fdd3c784", "https://github.com/jqlang/jq/security/advisories/GHSA-wwj8-gxm6-jc29", "https://linux.oracle.com/cve/CVE-2026-40164.html", "https://linux.oracle.com/errata/ELSA-2026-19365.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-40164", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40164.json", "https://ubuntu.com/security/notices/USN-8202-1", "https://ubuntu.com/security/notices/USN-8202-2", "https://www.cve.org/CVERecord?id=CVE-2026-40164" ], "PublishedDate": "2026-04-14T00:16:07.36Z", "LastModifiedDate": "2026-10-26T22:10:00.163Z" }, { "VulnerabilityID": "CVE-2026-31789", "PkgID": "libcrypto3@3.5.5-r0", "PkgName": "libcrypto3", "PkgIdentifier": { "PURL": "pkg:apk/alpine/libcrypto3@3.5.5-r0?arch=x86_64\u0026distro=3.23.3", "UID": "6778a588f2cebd48" }, "InstalledVersion": "3.5.5-r0", "FixedVersion": "3.5.6-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:989e799e634906e94dc9a5ee2ee26fc92ad260522990f26e707861a5f52bf64e" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-31789", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:d31a3247b88b19ea96d197b4a7d0044a4ba53e151300b7a6437bf5401a8830f3", "Title": "openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing", "Description": "Issue summary: Converting an excessively large OCTET STRING value to\na hexadecimal string leads to a heap buffer overflow on 32 bit platforms.\n\nImpact summary: A heap buffer overflow may lead to a crash or possibly\nan attacker controlled code execution or other undefined behavior.\n\nIf an attacker can supply a crafted X.509 certificate with an excessively\nlarge OCTET STRING value in extensions such as the Subject Key Identifier\n(SKID) or Authority Key Identifier (AKID) which are being converted to hex,\nthe size of the buffer needed for the result is calculated as multiplication\nof the input length by 3. On 32 bit platforms, this multiplication may overflow\nresulting in the allocation of a smaller buffer and a heap buffer overflow.\n\nApplications and services that print or log contents of untrusted X.509\ncertificates are vulnerable to this issue. As the certificates would have\nto have sizes of over 1 Gigabyte, printing or logging such certificates\nis a fairly unlikely operation and only 32 bit platforms are affected,\nthis issue was assigned Low severity.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.", "Severity": "CRITICAL", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "azure": 2, "julia": 4, "nvd": 4, "photon": 4, "redhat": 1, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 9.8 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 9.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H", "V3Score": 5.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-31789", "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "https://github.com/advisories/GHSA-j79m-9jxq-788r", "https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde", "https://github.com/openssl/openssl/commit/7a9087efd769f362ad9c0e30c7baaa6bbfa65ecf", "https://github.com/openssl/openssl/commit/945b935ac66cc7f1a41f1b849c7c25adb5351f49", "https://github.com/openssl/openssl/commit/a24216018e1ede8ff01a4ff5afff7dfbd443e2f9", "https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521", "https://nvd.nist.gov/vuln/detail/CVE-2026-31789", "https://openssl-library.org/news/secadv/20260407.txt", "https://ubuntu.com/security/notices/USN-8155-1", "https://www.cve.org/CVERecord?id=CVE-2026-31789", "https://www.openwall.com/lists/oss-security/2026/04/07/11" ], "PublishedDate": "2026-04-07T22:16:21.617Z", "LastModifiedDate": "2026-07-24T23:10:00.563Z" }, { "VulnerabilityID": "CVE-2026-14456", "PkgID": "libcrypto3@3.5.5-r0", "PkgName": "libcrypto3", "PkgIdentifier": { "PURL": "pkg:apk/alpine/libcrypto3@3.5.5-r0?arch=x86_64\u0026distro=3.23.3", "UID": "6778a588f2cebd48" }, "InstalledVersion": "3.5.5-r0", "FixedVersion": "3.5.8-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:989e799e634906e94dc9a5ee2ee26fc92ad260522990f26e707861a5f52bf64e" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-14456", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:7f485c9af21dd6cc64670ff1e8788f15bef15aafc3883d6dbf38e9305813adee", "Title": "openssl: OpenSSL: Denial of Service via unbounded memory growth in QUIC server", "Description": "Issue summary: When an OpenSSL QUIC server (Listener SSL object) processes\nvalid QUIC Initial packets for unknown destination connection IDs, it\ncan allocate and queue new incoming channels without enforcing any limit.\n\nImpact summary: A remote peer that can make many Initial packets reach the\nserver listener faster than the application accepts connections, can cause the\nmemory allocated to store the per-channel state to grow without any limits,\npotentially making the QUIC listener unavailable and causing Denial of Service.\n\nCWE: CWE-770: Allocation of Resources Without Limits or Throttling\n\nDescription: The function that handles inbound QUIC packets uses\nConnection-Id from the packet header to find an existing connection\n(QUIC channel). If no existing connection is found and the packet\ntype is INITIAL, the function treats the packet as a new connection. It\nallocates a new channel object and inserts it into a queue where it\nwaits to be accepted by the local application with SSL_accept(3ossl).\nThe memory occupied by these initial channel objects may grow\nwithout bounds if the application is not able to call SSL_accept()\nfrequently enough to serve these inbound connection requests.\n\nThe issue is present since OpenSSL 3.5 when the QUIC server implementation\nwas added.\n\nThe fix introduces a limit for pending connections. The default limit is set\nto 256 pending connections (waiting to be accepted by the local application).\nApplications may change the default by calling SSL_set_value_uint(3ossl).\n\nFIPS impact: no\nThe FIPS module is not affected as the QUIC implementation is outside of\nthe OpenSSL FIPS module boundary.", "Severity": "HIGH", "CweIDs": [ "CWE-770" ], "VendorSeverity": { "alma": 3, "amazon": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/08/13/4", "https://access.redhat.com/errata/RHSA-2026:67165", "https://access.redhat.com/security/cve/CVE-2026-14456", "https://bugzilla.redhat.com/2515348", "https://bugzilla.redhat.com/2517559", "https://bugzilla.redhat.com/2517560", "https://bugzilla.redhat.com/2517561", "https://bugzilla.redhat.com/2517562", "https://bugzilla.redhat.com/2517564", "https://bugzilla.redhat.com/2517565", "https://bugzilla.redhat.com/2517566", "https://bugzilla.redhat.com/2517570", "https://bugzilla.redhat.com/show_bug.cgi?id=2515348", "https://bugzilla.redhat.com/show_bug.cgi?id=2517559", "https://bugzilla.redhat.com/show_bug.cgi?id=2517560", "https://bugzilla.redhat.com/show_bug.cgi?id=2517561", "https://bugzilla.redhat.com/show_bug.cgi?id=2517562", "https://bugzilla.redhat.com/show_bug.cgi?id=2517564", "https://bugzilla.redhat.com/show_bug.cgi?id=2517565", "https://bugzilla.redhat.com/show_bug.cgi?id=2517566", "https://bugzilla.redhat.com/show_bug.cgi?id=2517570", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-14456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-14457", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-18798", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54874", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63072", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63073", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63074", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63075", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63076", "https://errata.almalinux.org/9/ALSA-2026-67165.html", "https://errata.rockylinux.org/RLSA-2026:67165", "https://github.com/openssl/openssl/commit/08e7756c3900bcfd77a720e7b74e27d6e4ed01a9", "https://github.com/openssl/openssl/commit/4084152e040329ca0194c4c1750b9b46d00a5b6b", "https://github.com/openssl/openssl/commit/f2f1465f2d2e5c61dfeac4d20fd093797d821139", "https://linux.oracle.com/cve/CVE-2026-14456.html", "https://linux.oracle.com/errata/ELSA-2026-67165-0.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-14456", "https://openssl-library.org/news/secadv/20260813.txt", "https://ubuntu.com/security/notices/USN-8678-1", "https://www.cve.org/CVERecord?id=CVE-2026-14456" ], "PublishedDate": "2026-08-13T15:19:31.82Z", "LastModifiedDate": "2026-11-06T20:26:36.04Z" }, { "VulnerabilityID": "CVE-2026-28387", "PkgID": "libcrypto3@3.5.5-r0", "PkgName": "libcrypto3", "PkgIdentifier": { "PURL": "pkg:apk/alpine/libcrypto3@3.5.5-r0?arch=x86_64\u0026distro=3.23.3", "UID": "6778a588f2cebd48" }, "InstalledVersion": "3.5.5-r0", "FixedVersion": "3.5.6-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:989e799e634906e94dc9a5ee2ee26fc92ad260522990f26e707861a5f52bf64e" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-28387", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:332ffc4fcdc239e78fa4c7067013b1c5fc12680a440a0f882fe88a182298533b", "Title": "openssl: OpenSSL: Arbitrary code execution due to use-after-free in DANE TLSA authentication", "Description": "Issue summary: An uncommon configuration of clients performing DANE TLSA-based\nserver authentication, when paired with uncommon server DANE TLSA records, may\nresult in a use-after-free and/or double-free on the client side.\n\nImpact summary: A use after free can have a range of potential consequences\nsuch as the corruption of valid data, crashes or execution of arbitrary code.\n\nHowever, the issue only affects clients that make use of TLSA records with both\nthe PKIX-TA(0/PKIX-EE(1) certificate usages and the DANE-TA(2) certificate\nusage.\n\nBy far the most common deployment of DANE is in SMTP MTAs for which RFC7672\nrecommends that clients treat as 'unusable' any TLSA records that have the PKIX\ncertificate usages. These SMTP (or other similar) clients are not vulnerable\nto this issue. Conversely, any clients that support only the PKIX usages, and\nignore the DANE-TA(2) usage are also not vulnerable.\n\nThe client would also need to be communicating with a server that publishes a\nTLSA RRset with both types of TLSA records.\n\nNo FIPS modules are affected by this issue, the problem code is outside the\nFIPS module boundary.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "amazon": 3, "azure": 1, "julia": 3, "nvd": 3, "photon": 3, "redhat": 1, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "V3Score": 3.7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-28387", "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b", "https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe", "https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3", "https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7", "https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177", "https://nvd.nist.gov/vuln/detail/CVE-2026-28387", "https://openssl-library.org/news/secadv/20260407.txt", "https://ubuntu.com/security/notices/USN-8155-1", "https://ubuntu.com/security/notices/USN-8155-2", "https://www.cve.org/CVERecord?id=CVE-2026-28387", "https://www.openwall.com/lists/oss-security/2026/04/07/11" ], "PublishedDate": "2026-04-07T22:16:20.7Z", "LastModifiedDate": "2026-07-24T23:10:00.563Z" }, { "VulnerabilityID": "CVE-2026-28388", "PkgID": "libcrypto3@3.5.5-r0", "PkgName": "libcrypto3", "PkgIdentifier": { "PURL": "pkg:apk/alpine/libcrypto3@3.5.5-r0?arch=x86_64\u0026distro=3.23.3", "UID": "6778a588f2cebd48" }, "InstalledVersion": "3.5.5-r0", "FixedVersion": "3.5.6-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:989e799e634906e94dc9a5ee2ee26fc92ad260522990f26e707861a5f52bf64e" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-28388", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:c8331cf408d855302be304848d3025c5acda54fb26bfb7a9945e4cc42d7f16db", "Title": "openssl: OpenSSL: Denial of Service due to NULL pointer dereference in delta CRL processing", "Description": "Issue summary: When a delta CRL that contains a Delta CRL Indicator extension\nis processed a NULL pointer dereference might happen if the required CRL\nNumber extension is missing.\n\nImpact summary: A NULL pointer dereference can trigger a crash which\nleads to a Denial of Service for an application.\n\nWhen CRL processing and delta CRL processing is enabled during X.509\ncertificate verification, the delta CRL processing does not check\nwhether the CRL Number extension is NULL before dereferencing it.\nWhen a malformed delta CRL file is being processed, this parameter\ncan be NULL, causing a NULL pointer dereference.\n\nExploiting this issue requires the X509_V_FLAG_USE_DELTAS flag to be enabled in\nthe verification context, the certificate being verified to contain a\nfreshestCRL extension or the base CRL to have the EXFLAG_FRESHEST flag set, and\nan attacker to provide a malformed CRL to an application that processes it.\n\nThe vulnerability is limited to Denial of Service and cannot be escalated to\nachieve code execution or memory disclosure. For that reason the issue was\nassessed as Low severity according to our Security Policy.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the affected code is outside the OpenSSL FIPS module boundary.", "Severity": "HIGH", "CweIDs": [ "CWE-476" ], "VendorSeverity": { "amazon": 3, "azure": 2, "julia": 3, "nvd": 3, "photon": 3, "redhat": 1, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.9 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-28388", "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e", "https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139", "https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3", "https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8", "https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726", "https://nvd.nist.gov/vuln/detail/CVE-2026-28388", "https://openssl-library.org/news/secadv/20260407.txt", "https://ubuntu.com/security/notices/USN-8155-1", "https://ubuntu.com/security/notices/USN-8155-2", "https://www.cve.org/CVERecord?id=CVE-2026-28388", "https://www.openwall.com/lists/oss-security/2026/04/07/11" ], "PublishedDate": "2026-04-07T22:16:20.863Z", "LastModifiedDate": "2026-07-24T23:10:00.563Z" }, { "VulnerabilityID": "CVE-2026-28389", "PkgID": "libcrypto3@3.5.5-r0", "PkgName": "libcrypto3", "PkgIdentifier": { "PURL": "pkg:apk/alpine/libcrypto3@3.5.5-r0?arch=x86_64\u0026distro=3.23.3", "UID": "6778a588f2cebd48" }, "InstalledVersion": "3.5.5-r0", "FixedVersion": "3.5.6-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:989e799e634906e94dc9a5ee2ee26fc92ad260522990f26e707861a5f52bf64e" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-28389", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:d722b26ba938149e7585b8267e008d2fa8321c554a180ec8ca54bfc7b933b3f1", "Title": "openssl: OpenSSL: Denial of Service vulnerability in CMS processing", "Description": "Issue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyAgreeRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyAgreeRecipientInfo is\nprocessed, the optional parameters field of KeyEncryptionAlgorithmIdentifier\nis examined without checking for its presence. This results in a NULL\npointer dereference if the field is missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.", "Severity": "HIGH", "CweIDs": [ "CWE-476" ], "VendorSeverity": { "amazon": 3, "azure": 2, "julia": 3, "nvd": 3, "photon": 3, "redhat": 1, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.9 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-28389", "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "https://github.com/advisories/GHSA-7x88-9hgc-69gf", "https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5", "https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616", "https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f", "https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a", "https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686", "https://nvd.nist.gov/vuln/detail/CVE-2026-28389", "https://openssl-library.org/news/secadv/20260407.txt", "https://ubuntu.com/security/notices/USN-8155-1", "https://ubuntu.com/security/notices/USN-8155-2", "https://www.cve.org/CVERecord?id=CVE-2026-28389", "https://www.openwall.com/lists/oss-security/2026/04/07/11" ], "PublishedDate": "2026-04-07T22:16:21.03Z", "LastModifiedDate": "2026-07-24T23:10:00.563Z" }, { "VulnerabilityID": "CVE-2026-28390", "PkgID": "libcrypto3@3.5.5-r0", "PkgName": "libcrypto3", "PkgIdentifier": { "PURL": "pkg:apk/alpine/libcrypto3@3.5.5-r0?arch=x86_64\u0026distro=3.23.3", "UID": "6778a588f2cebd48" }, "InstalledVersion": "3.5.5-r0", "FixedVersion": "3.5.6-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:989e799e634906e94dc9a5ee2ee26fc92ad260522990f26e707861a5f52bf64e" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-28390", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:7aedd28ccc063ff9968d09f3f491b73d0ee6f2993258578c7f606b316aef63c2", "Title": "openssl: OpenSSL: Denial of Service due to NULL pointer dereference in CMS EnvelopedData processing", "Description": "Issue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyTransportRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyTransportRecipientInfo with\nRSA-OAEP encryption is processed, the optional parameters field of\nRSA-OAEP SourceFunc algorithm identifier is examined without checking\nfor its presence. This results in a NULL pointer dereference if the field\nis missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.", "Severity": "HIGH", "CweIDs": [ "CWE-476" ], "VendorSeverity": { "alma": 2, "amazon": 3, "azure": 2, "julia": 3, "nvd": 3, "oracle-oval": 2, "photon": 3, "redhat": 2, "rocky": 2, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:22312", "https://access.redhat.com/errata/RHSA-2026:22313", "https://access.redhat.com/security/cve/CVE-2026-28390", "https://bugzilla.redhat.com/2456314", "https://bugzilla.redhat.com/show_bug.cgi?id=2456314", "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-28390", "https://errata.almalinux.org/9/ALSA-2026-22313.html", "https://errata.rockylinux.org/RLSA-2026:22312", "https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc", "https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6", "https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4", "https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788", "https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75", "https://linux.oracle.com/cve/CVE-2026-28390.html", "https://linux.oracle.com/errata/ELSA-2026-50345.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-28390", "https://openssl-library.org/news/secadv/20260407.txt", "https://ubuntu.com/security/notices/USN-8155-1", "https://ubuntu.com/security/notices/USN-8155-2", "https://www.cve.org/CVERecord?id=CVE-2026-28390", "https://www.openwall.com/lists/oss-security/2026/04/07/11" ], "PublishedDate": "2026-04-07T22:16:21.19Z", "LastModifiedDate": "2026-07-24T23:10:00.563Z" }, { "VulnerabilityID": "CVE-2026-45447", "PkgID": "libcrypto3@3.5.5-r0", "PkgName": "libcrypto3", "PkgIdentifier": { "PURL": "pkg:apk/alpine/libcrypto3@3.5.5-r0?arch=x86_64\u0026distro=3.23.3", "UID": "6778a588f2cebd48" }, "InstalledVersion": "3.5.5-r0", "FixedVersion": "3.5.7-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:989e799e634906e94dc9a5ee2ee26fc92ad260522990f26e707861a5f52bf64e" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-45447", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:70b3a8ab6677cf45aa8389ebaf31b20b1e5091b6f8b556e1f98ce96b0f32fb2f", "Title": "openssl: Heap Use-After-Free in OpenSSL PKCS7_verify()", "Description": "Issue summary: A specially crafted PKCS#7 or S/MIME signed message could\ntrigger a use-after-free during PKCS#7 signature verification.\n\nImpact summary: A use-after-free may result in process crashes, heap\ncorruption, or potentially remote code execution.\n\nWhen processing a PKCS#7 or S/MIME signed message, if the SignedData\ndigestAlgorithms field is present as an empty ASN.1 SET, OpenSSL may\nincorrectly free a caller-owned BIO during PKCS7_verify(). A subsequent\nuse of the BIO by the calling application results in a use-after-free\ncondition.\n\nIn the common case this occurs when the application later calls\nBIO_free() on the BIO originally passed to PKCS7_verify(). Depending\non allocator behavior and application-specific BIO usage patterns, this\nmay result in a crash or other memory corruption. In some application\ncontexts this may potentially be exploitable for remote code execution.\n\nApplications that process PKCS#7 or S/MIME signed messages using OpenSSL\nPKCS#7 APIs may be affected. Applications using the CMS APIs for this\nprocessing are not affected.\n\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.", "Severity": "HIGH", "CweIDs": [ "CWE-416", "CWE-825" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "julia": 3, "oracle-oval": 2, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:25237", "https://access.redhat.com/errata/RHSA-2026:25239", "https://access.redhat.com/errata/RHSA-2026:26275", "https://access.redhat.com/errata/RHSA-2026:26319", "https://access.redhat.com/errata/RHSA-2026:29197", "https://access.redhat.com/errata/RHSA-2026:34102", "https://access.redhat.com/errata/RHSA-2026:35869", "https://access.redhat.com/errata/RHSA-2026:36215", "https://access.redhat.com/errata/RHSA-2026:36217", "https://access.redhat.com/errata/RHSA-2026:39009", "https://access.redhat.com/errata/RHSA-2026:39012", "https://access.redhat.com/errata/RHSA-2026:39981", "https://access.redhat.com/errata/RHSA-2026:44438", "https://access.redhat.com/errata/RHSA-2026:47735", "https://access.redhat.com/errata/RHSA-2026:47737", "https://access.redhat.com/errata/RHSA-2026:58563", "https://access.redhat.com/errata/RHSA-2026:58981", "https://access.redhat.com/errata/RHSA-2026:59831", "https://access.redhat.com/errata/RHSA-2026:66524", "https://access.redhat.com/security/cve/CVE-2026-45447", "https://bugzilla.redhat.com/2481898", "https://bugzilla.redhat.com/show_bug.cgi?id=2481879", "https://bugzilla.redhat.com/show_bug.cgi?id=2481880", "https://bugzilla.redhat.com/show_bug.cgi?id=2481881", "https://bugzilla.redhat.com/show_bug.cgi?id=2481882", "https://bugzilla.redhat.com/show_bug.cgi?id=2481884", "https://bugzilla.redhat.com/show_bug.cgi?id=2481885", "https://bugzilla.redhat.com/show_bug.cgi?id=2481887", "https://bugzilla.redhat.com/show_bug.cgi?id=2481890", "https://bugzilla.redhat.com/show_bug.cgi?id=2481891", "https://bugzilla.redhat.com/show_bug.cgi?id=2481892", "https://bugzilla.redhat.com/show_bug.cgi?id=2481893", "https://bugzilla.redhat.com/show_bug.cgi?id=2481894", "https://bugzilla.redhat.com/show_bug.cgi?id=2481896", "https://bugzilla.redhat.com/show_bug.cgi?id=2481897", "https://bugzilla.redhat.com/show_bug.cgi?id=2481898", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34180", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34181", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34182", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34183", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42764", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42766", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42767", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42768", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42769", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42770", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45445", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45446", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45447", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-7383", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-9076", "https://errata.almalinux.org/9/ALSA-2026-44438.html", "https://errata.rockylinux.org/RLSA-2026:25239", "https://github.com/advisories/GHSA-f684-cpcq-j565", "https://github.com/openssl/openssl/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c", "https://github.com/openssl/openssl/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8", "https://github.com/openssl/openssl/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54", "https://github.com/openssl/openssl/commit/a541ae8bfe849a30cc885e8780715c0f488e496c", "https://github.com/openssl/openssl/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e", "https://github.com/openssl/security/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c", "https://github.com/openssl/security/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8", "https://github.com/openssl/security/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54", "https://github.com/openssl/security/commit/a541ae8bfe849a30cc885e8780715c0f488e496c", "https://github.com/openssl/security/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e", "https://linux.oracle.com/cve/CVE-2026-45447.html", "https://linux.oracle.com/errata/ELSA-2026-50379.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-45447", "https://openssl-library.org/news/secadv/20260609.txt", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45447.json", "https://ubuntu.com/security/notices/USN-8414-1", "https://ubuntu.com/security/notices/USN-8414-2", "https://www.cve.org/CVERecord?id=CVE-2026-45447" ], "PublishedDate": "2026-06-09T17:17:19.277Z", "LastModifiedDate": "2026-09-18T13:18:26.343Z" }, { "VulnerabilityID": "CVE-2026-11352", "PkgID": "libcurl@8.19.0-r0", "PkgName": "libcurl", "PkgIdentifier": { "PURL": "pkg:apk/alpine/libcurl@8.19.0-r0?arch=x86_64\u0026distro=3.23.3", "UID": "478d655ffa641497" }, "InstalledVersion": "8.19.0-r0", "FixedVersion": "8.22.0-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:bfa66cef88150e054947357ece4a5ef622b49d30ce1021b9369a763334743eaf" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-11352", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:07efd1ab5adadd06858672199ce3d5a42ecc02cb8452f7c82cc745d3d7f009fe", "Title": "curl: libcurl: curl/libcurl: Remote denial of service via QUIC UDP receive function vulnerability", "Description": "An issue in curl’s QUIC UDP receive function allows a malicious HTTP/3 server\nto trigger a remote denial of service against a curl or libcurl client.\nBecause the helper function discards zero-length UDP datagrams before counting\nthem toward the per-call packet budget, a connected QUIC peer can continuously\nstream empty datagrams to indefinitely stall the client.", "Severity": "HIGH", "CweIDs": [ "CWE-835" ], "VendorSeverity": { "julia": 3, "photon": 3, "redhat": 3, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-11352", "https://curl.se/L7HzKXisfJ/CVE-2026-11352.md", "https://curl.se/docs/CVE-2026-11352.html", "https://curl.se/docs/CVE-2026-11352.json", "https://github.com/advisories/GHSA-qxwx-hr5v-h5q4", "https://hackerone.com/reports/3783438", "https://nvd.nist.gov/vuln/detail/CVE-2026-11352", "https://ubuntu.com/security/notices/USN-8525-1", "https://www.cve.org/CVERecord?id=CVE-2026-11352" ], "PublishedDate": "2026-07-03T07:16:23.693Z", "LastModifiedDate": "2026-09-15T07:16:25.353Z" }, { "VulnerabilityID": "CVE-2026-11586", "PkgID": "libcurl@8.19.0-r0", "PkgName": "libcurl", "PkgIdentifier": { "PURL": "pkg:apk/alpine/libcurl@8.19.0-r0?arch=x86_64\u0026distro=3.23.3", "UID": "478d655ffa641497" }, "InstalledVersion": "8.19.0-r0", "FixedVersion": "8.22.0-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:bfa66cef88150e054947357ece4a5ef622b49d30ce1021b9369a763334743eaf" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-11586", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:13e7765bb7766425a78063afdda2f062f408addc0b61be9994d5b6a4755a06a0", "Title": "curl: curl: Denial of Service via WebSocket PING flood", "Description": "By default, curl automatically responds to WebSocket PING frames. Because curl\nlacks an upper bound on memory allocation for unacknowledged frames, a\nmalicious server can exhaust all available memory by flooding curl with rapid,\nsequential PING messages.", "Severity": "HIGH", "CweIDs": [ "CWE-770" ], "VendorSeverity": { "amazon": 2, "julia": 3, "photon": 3, "redhat": 3, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-11586", "https://curl.se/L7HzKXisfJ/CVE-2026-11586.md", "https://curl.se/docs/CVE-2026-11586.html", "https://curl.se/docs/CVE-2026-11586.json", "https://github.com/advisories/GHSA-c68q-h477-5646", "https://hackerone.com/reports/3788931", "https://nvd.nist.gov/vuln/detail/CVE-2026-11586", "https://ubuntu.com/security/notices/USN-8525-1", "https://www.cve.org/CVERecord?id=CVE-2026-11586" ], "PublishedDate": "2026-07-03T07:16:23.883Z", "LastModifiedDate": "2026-09-15T07:16:25.7Z" }, { "VulnerabilityID": "CVE-2026-12064", "PkgID": "libcurl@8.19.0-r0", "PkgName": "libcurl", "PkgIdentifier": { "PURL": "pkg:apk/alpine/libcurl@8.19.0-r0?arch=x86_64\u0026distro=3.23.3", "UID": "478d655ffa641497" }, "InstalledVersion": "8.19.0-r0", "FixedVersion": "8.22.0-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:bfa66cef88150e054947357ece4a5ef622b49d30ce1021b9369a763334743eaf" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-12064", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:00034aa96abba99bac7724102bc76777aea7e20d4dd1dfb8ae71e32ba07f2e3c", "Title": "curl: curl: SSH host verification bypass when using schemeless URLs with SFTP/SCP", "Description": "When a user invokes curl using a schemeless URL combined with\n`--proto-default` sftp (or scp), a disconnect occurs between the tool layer\nand libcurl. The tool layer incorrectly infers the URL scheme, which\nerroneously bypasses the initialization of critical SSH security options like\nCURLOPT_SSH_HOST_PUBLIC_KEY_SHA256 and CURLOPT_SSH_KNOWNHOSTS. Conversely, the\nlibcurl runtime successfully honors CURLOPT_DEFAULT_PROTOCOL and establishes\nthe connection via SFTP/SCP as specified. Because the tool layer skipped the\nsecurity configuration, these SSH host verification options are silently\nomitted, causing curl to connect to an unverified SSH remote host without\nthrowing an error.", "Severity": "HIGH", "CweIDs": [ "CWE-297", "CWE-295" ], "VendorSeverity": { "amazon": 2, "azure": 3, "julia": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-12064", "https://curl.se/L7HzKXisfJ/CVE-2026-12064.md", "https://curl.se/docs/CVE-2026-12064.html", "https://curl.se/docs/CVE-2026-12064.json", "https://github.com/advisories/GHSA-jm94-9f7h-36pr", "https://hackerone.com/reports/3797526", "https://linux.oracle.com/cve/CVE-2026-12064.html", "https://linux.oracle.com/errata/ELSA-2026-55450.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-12064", "https://ubuntu.com/security/notices/USN-8525-1", "https://www.cve.org/CVERecord?id=CVE-2026-12064" ], "PublishedDate": "2026-07-03T07:16:24.217Z", "LastModifiedDate": "2026-09-15T07:16:26.15Z" }, { "VulnerabilityID": "CVE-2026-5773", "PkgID": "libcurl@8.19.0-r0", "PkgName": "libcurl", "PkgIdentifier": { "PURL": "pkg:apk/alpine/libcurl@8.19.0-r0?arch=x86_64\u0026distro=3.23.3", "UID": "478d655ffa641497" }, "InstalledVersion": "8.19.0-r0", "FixedVersion": "8.20.0-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:bfa66cef88150e054947357ece4a5ef622b49d30ce1021b9369a763334743eaf" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-5773", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:7b790d8b978d8b24dafe5dbe5bacf8b3e2ef3966d8b14a70871f8c77e01fd0c0", "Title": "curl: libcurl: Wrong file transfer due to incorrect SMB connection reuse", "Description": "libcurl might in some circumstances reuse the wrong connection for SMB(S)\ntransfers.\n\nlibcurl features a pool of recent connections so that subsequent requests can\nreuse an existing connection to avoid overhead.\n\nWhen reusing a connection a range of criteria must be met. Due to a logical\nerror in the code, a network transfer operation that was requested by an\napplication could wrongfully reuse an existing SMB connection to the same\nserver that was using a different \"share\" than the new subsequent transfer\nshould.\n\nThis could in unlucky situations lead to the download of the wrong file or the\nupload of a file to the wrong place. When this happens, the same credentials\nare used and the server name is the same.", "Severity": "HIGH", "CweIDs": [ "CWE-488", "CWE-918" ], "VendorSeverity": { "julia": 3, "nvd": 3, "photon": 3, "redhat": 2, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "V3Score": 6.5 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/04/29/9", "https://access.redhat.com/security/cve/CVE-2026-5773", "https://curl.se/docs/CVE-2026-5773.html", "https://curl.se/docs/CVE-2026-5773.json", "https://github.com/advisories/GHSA-rp9q-8q5w-ch44", "https://hackerone.com/reports/3650689", "https://nvd.nist.gov/vuln/detail/CVE-2026-5773", "https://ubuntu.com/security/notices/USN-8227-1", "https://ubuntu.com/security/notices/USN-8525-1", "https://www.cve.org/CVERecord?id=CVE-2026-5773" ], "PublishedDate": "2026-05-13T13:01:56.307Z", "LastModifiedDate": "2026-09-15T07:16:28.82Z" }, { "VulnerabilityID": "CVE-2026-6276", "PkgID": "libcurl@8.19.0-r0", "PkgName": "libcurl", "PkgIdentifier": { "PURL": "pkg:apk/alpine/libcurl@8.19.0-r0?arch=x86_64\u0026distro=3.23.3", "UID": "478d655ffa641497" }, "InstalledVersion": "8.19.0-r0", "FixedVersion": "8.20.0-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:bfa66cef88150e054947357ece4a5ef622b49d30ce1021b9369a763334743eaf" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-6276", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:12974293bb8899e8c75842fed2476357393a3a24efed6d455aa4db073434116c", "Title": "curl: libcurl: Information disclosure due to cookie leak when reusing connections with custom Host headers", "Description": "Using libcurl, when a custom `Host:` header is first set for an HTTP request\nand a second request is subsequently done using the same *easy handle* but\nwithout the custom `Host:` header set, the second request would use stale\ninformation and pass on cookies meant for the first host in the second\nrequest. Leak them.", "Severity": "HIGH", "CweIDs": [ "CWE-346", "CWE-319" ], "VendorSeverity": { "azure": 2, "julia": 3, "nvd": 3, "photon": 3, "redhat": 1, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "V3Score": 3.7 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/04/29/13", "https://access.redhat.com/security/cve/CVE-2026-6276", "https://curl.se/docs/CVE-2026-6276.html", "https://curl.se/docs/CVE-2026-6276.json", "https://github.com/advisories/GHSA-2jc6-hc33-hv48", "https://hackerone.com/reports/3671818", "https://nvd.nist.gov/vuln/detail/CVE-2026-6276", "https://ubuntu.com/security/notices/USN-8227-1", "https://www.cve.org/CVERecord?id=CVE-2026-6276" ], "PublishedDate": "2026-05-13T13:01:56.8Z", "LastModifiedDate": "2026-09-15T07:16:29.343Z" }, { "VulnerabilityID": "CVE-2026-8286", "PkgID": "libcurl@8.19.0-r0", "PkgName": "libcurl", "PkgIdentifier": { "PURL": "pkg:apk/alpine/libcurl@8.19.0-r0?arch=x86_64\u0026distro=3.23.3", "UID": "478d655ffa641497" }, "InstalledVersion": "8.19.0-r0", "FixedVersion": "8.22.0-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:bfa66cef88150e054947357ece4a5ef622b49d30ce1021b9369a763334743eaf" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-8286", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:024da9172a108ff7e98c9974baaa986c51e02ebdf7b1c560afa1ca3f669090a7", "Title": "curl: curl: Insecure connection establishment due to TLS configuration mismatch", "Description": "A vulnerability exists where a new transfer that uses STARTTLS to upgrade the\nconnection might reuse an existing live connection even though the TLS\nconfiguration mismatches so it should not.", "Severity": "HIGH", "CweIDs": [ "CWE-295" ], "VendorSeverity": { "alma": 3, "amazon": 2, "azure": 3, "julia": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "V3Score": 8.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:55439", "https://access.redhat.com/security/cve/CVE-2026-8286", "https://bugzilla.redhat.com/2446448", "https://bugzilla.redhat.com/2446450", "https://bugzilla.redhat.com/2496758", "https://bugzilla.redhat.com/2496763", "https://bugzilla.redhat.com/show_bug.cgi?id=2446448", "https://bugzilla.redhat.com/show_bug.cgi?id=2446450", "https://bugzilla.redhat.com/show_bug.cgi?id=2496758", "https://bugzilla.redhat.com/show_bug.cgi?id=2496763", "https://creativecommons.org/licenses/by/4.0/", "https://curl.se/L7HzKXisfJ/CVE-2026-8286.md", "https://curl.se/docs/CVE-2026-8286.html", "https://curl.se/docs/CVE-2026-8286.json", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-1965", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-3783", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8286", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-9547", "https://errata.almalinux.org/9/ALSA-2026-55439.html", "https://errata.rockylinux.org/RLSA-2026:55439", "https://github.com/advisories/GHSA-32xh-3x3c-6g6h", "https://hackerone.com/reports/3718195", "https://linux.oracle.com/cve/CVE-2026-8286.html", "https://linux.oracle.com/errata/ELSA-2026-57462.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-8286", "https://ubuntu.com/security/notices/USN-8487-1", "https://www.cve.org/CVERecord?id=CVE-2026-8286" ], "PublishedDate": "2026-07-03T07:16:24.453Z", "LastModifiedDate": "2026-09-15T07:16:31.617Z" }, { "VulnerabilityID": "CVE-2026-8458", "PkgID": "libcurl@8.19.0-r0", "PkgName": "libcurl", "PkgIdentifier": { "PURL": "pkg:apk/alpine/libcurl@8.19.0-r0?arch=x86_64\u0026distro=3.23.3", "UID": "478d655ffa641497" }, "InstalledVersion": "8.19.0-r0", "FixedVersion": "8.22.0-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:bfa66cef88150e054947357ece4a5ef622b49d30ce1021b9369a763334743eaf" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-8458", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:0b05c82242b9cfbcb68f96e31d6ef4ffd0f718b167cdf90a777c6d3806dfd1a8", "Title": "curl: libcurl: Unauthorized connection reuse due to a logical error", "Description": "libcurl might in some circumstances reuse the wrong connection when asked to\ndo Negotiate-authenticated ones, even when they are set to use different\n\"services\".\n\nlibcurl features a pool of recent connections so that subsequent requests can\nreuse an existing connection to avoid overhead.\n\nWhen reusing a connection a range of criteria must be met. Due to a logical\nerror in the code, a request that was issued by an application could\nwrongfully reuse an existing connection to the same server that was\nauthenticated using different services.", "Severity": "HIGH", "CweIDs": [ "CWE-488" ], "VendorSeverity": { "alma": 3, "amazon": 2, "azure": 2, "julia": 2, "oracle-oval": 3, "photon": 2, "redhat": 3, "rocky": 3, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "V3Score": 6.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:69126", "https://access.redhat.com/security/cve/CVE-2026-8458", "https://bugzilla.redhat.com/2496764", "https://bugzilla.redhat.com/2496769", "https://bugzilla.redhat.com/show_bug.cgi?id=2496764", "https://bugzilla.redhat.com/show_bug.cgi?id=2496769", "https://creativecommons.org/licenses/by/4.0/", "https://curl.se/L7HzKXisfJ/CVE-2026-8458.md", "https://curl.se/docs/CVE-2026-8458.html", "https://curl.se/docs/CVE-2026-8458.json", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8458", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8927", "https://errata.almalinux.org/9/ALSA-2026-69126.html", "https://errata.rockylinux.org/RLSA-2026:69126", "https://github.com/advisories/GHSA-88c6-6jfq-mm4q", "https://hackerone.com/reports/3721183", "https://linux.oracle.com/cve/CVE-2026-8458.html", "https://linux.oracle.com/errata/ELSA-2026-92368.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-8458", "https://ubuntu.com/security/notices/USN-8487-1", "https://www.cve.org/CVERecord?id=CVE-2026-8458" ], "PublishedDate": "2026-07-03T07:16:24.63Z", "LastModifiedDate": "2026-09-15T07:16:32.327Z" }, { "VulnerabilityID": "CVE-2026-8925", "PkgID": "libcurl@8.19.0-r0", "PkgName": "libcurl", "PkgIdentifier": { "PURL": "pkg:apk/alpine/libcurl@8.19.0-r0?arch=x86_64\u0026distro=3.23.3", "UID": "478d655ffa641497" }, "InstalledVersion": "8.19.0-r0", "FixedVersion": "8.22.0-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:bfa66cef88150e054947357ece4a5ef622b49d30ce1021b9369a763334743eaf" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-8925", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:9ded8eb636d9cd9b391e6fc15fa006fd91506b05e99783e1bd875d887d2de8cc", "Title": "curl: curl: Double-free vulnerability in SASL authentication", "Description": "The curl logic that works with SASL authentication could end up cleaning up\nthe GSASL context *twice* without clearing the pointer in between, making it\n`free()` the same pointer twice.", "Severity": "HIGH", "CweIDs": [ "CWE-415" ], "VendorSeverity": { "amazon": 2, "julia": 4, "photon": 4, "redhat": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 9.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-8925", "https://curl.se/L7HzKXisfJ/CVE-2026-8925.md", "https://curl.se/docs/CVE-2026-8925.html", "https://curl.se/docs/CVE-2026-8925.json", "https://github.com/advisories/GHSA-p8x5-c6c9-8cwx", "https://hackerone.com/reports/3735193", "https://nvd.nist.gov/vuln/detail/CVE-2026-8925", "https://ubuntu.com/security/notices/USN-8487-1", "https://www.cve.org/CVERecord?id=CVE-2026-8925" ], "PublishedDate": "2026-07-03T07:16:24.95Z", "LastModifiedDate": "2026-09-15T07:16:32.8Z" }, { "VulnerabilityID": "CVE-2026-8927", "PkgID": "libcurl@8.19.0-r0", "PkgName": "libcurl", "PkgIdentifier": { "PURL": "pkg:apk/alpine/libcurl@8.19.0-r0?arch=x86_64\u0026distro=3.23.3", "UID": "478d655ffa641497" }, "InstalledVersion": "8.19.0-r0", "FixedVersion": "8.22.0-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:bfa66cef88150e054947357ece4a5ef622b49d30ce1021b9369a763334743eaf" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-8927", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:bd516b8036af2191202f2d8c65121124e3a1c0631a9d6da02de37b74f15d8182", "Title": "curl: Information disclosure due to uncleared proxy authentication state", "Description": "When reusing a libcurl handle for sequential transfers driven by\nenvironment-variable proxy configuration, libcurl fails to clear the proxy\nauthentication state between requests. Specifically, if the initial transfer\nauthenticates against `proxyA` using Digest auth, a subsequent transfer routed\nthrough `proxyB` erroneously leaks the `Proxy-Authorization:` header intended\nsolely for `proxyA`.", "Severity": "HIGH", "CweIDs": [ "CWE-294" ], "VendorSeverity": { "alma": 3, "amazon": 2, "azure": 2, "julia": 4, "oracle-oval": 3, "photon": 4, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "V3Score": 9.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:69126", "https://access.redhat.com/security/cve/CVE-2026-8927", "https://bugzilla.redhat.com/2496764", "https://bugzilla.redhat.com/2496769", "https://bugzilla.redhat.com/show_bug.cgi?id=2496764", "https://bugzilla.redhat.com/show_bug.cgi?id=2496769", "https://creativecommons.org/licenses/by/4.0/", "https://curl.se/L7HzKXisfJ/CVE-2026-8927.md", "https://curl.se/docs/CVE-2026-8927.html", "https://curl.se/docs/CVE-2026-8927.json", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8458", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8927", "https://errata.almalinux.org/9/ALSA-2026-69126.html", "https://errata.rockylinux.org/RLSA-2026:69126", "https://github.com/advisories/GHSA-jr4f-4564-w3mr", "https://hackerone.com/reports/3744543", "https://linux.oracle.com/cve/CVE-2026-8927.html", "https://linux.oracle.com/errata/ELSA-2026-92368.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-8927", "https://ubuntu.com/security/notices/USN-8487-1", "https://ubuntu.com/security/notices/USN-8820-1", "https://www.cve.org/CVERecord?id=CVE-2026-8927" ], "PublishedDate": "2026-07-03T07:16:25.123Z", "LastModifiedDate": "2026-09-15T07:16:33.157Z" }, { "VulnerabilityID": "CVE-2026-92392", "PkgID": "libcurl@8.19.0-r0", "PkgName": "libcurl", "PkgIdentifier": { "PURL": "pkg:apk/alpine/libcurl@8.19.0-r0?arch=x86_64\u0026distro=3.23.3", "UID": "478d655ffa641497" }, "InstalledVersion": "8.19.0-r0", "FixedVersion": "8.23.0-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:bfa66cef88150e054947357ece4a5ef622b49d30ce1021b9369a763334743eaf" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-92392", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:eab0ee0fac0321dbc6cc54423ece19183520a98958eb1e0f4aa518980bd94df2", "Title": "curl: curl: HTTP/2 upload Use-After-Free", "Description": "During an upload, curl mishandles HTTP/2 `RST_STREAM` received from the server\n(with reason `HTTP_1_1_REQUIRED` or `REFUSED_STREAM`) leading to a use after\nfree of a `struct Curl_easy` object.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "amazon": 3, "redhat": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/10/18/5", "http://www.openwall.com/lists/oss-security/2026/10/18/6", "https://access.redhat.com/security/cve/CVE-2026-92392", "https://curl.se/docs/CVE-2026-92392.html", "https://curl.se/docs/CVE-2026-92392.json", "https://hackerone.com/reports/4030333", "https://nvd.nist.gov/vuln/detail/CVE-2026-92392", "https://ubuntu.com/security/notices/USN-8927-1", "https://ubuntu.com/security/notices/USN-8927-2", "https://www.cve.org/CVERecord?id=CVE-2026-92392" ], "PublishedDate": "2026-10-14T08:17:05.997Z", "LastModifiedDate": "2026-10-18T23:16:57.163Z" }, { "VulnerabilityID": "CVE-2026-9547", "PkgID": "libcurl@8.19.0-r0", "PkgName": "libcurl", "PkgIdentifier": { "PURL": "pkg:apk/alpine/libcurl@8.19.0-r0?arch=x86_64\u0026distro=3.23.3", "UID": "478d655ffa641497" }, "InstalledVersion": "8.19.0-r0", "FixedVersion": "8.22.0-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:bfa66cef88150e054947357ece4a5ef622b49d30ce1021b9369a763334743eaf" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-9547", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:3abd4a4fe5fc0535ec4a4c48baf951ff19d8c59ae87456b132f164ca29b91b64", "Title": "curl: curl: Man-in-the-middle attack via SSH host key bypass", "Description": "When a libcurl-based application performs transfers via `SCP://` or `SFTP://`\nand utilizes the `CURLOPT_SSH_KEYFUNCTION` callback, it may silently accept an\nuntrusted server. This vulnerability occurs when a server presents a host key\ntype that does not match the specific key type already recorded for that host\nin the `known_hosts` file. Instead of rejecting the mismatch, the callback\nmechanism fails to properly enforce the restriction, allowing the connection\nto succeed without warning and risking a potential man-in-the-middle attack.", "Severity": "HIGH", "CweIDs": [ "CWE-297" ], "VendorSeverity": { "alma": 3, "amazon": 2, "julia": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "V3Score": 7.4 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "V3Score": 7.4 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:55439", "https://access.redhat.com/security/cve/CVE-2026-9547", "https://bugzilla.redhat.com/2446448", "https://bugzilla.redhat.com/2446450", "https://bugzilla.redhat.com/2496758", "https://bugzilla.redhat.com/2496763", "https://bugzilla.redhat.com/show_bug.cgi?id=2446448", "https://bugzilla.redhat.com/show_bug.cgi?id=2446450", "https://bugzilla.redhat.com/show_bug.cgi?id=2496758", "https://bugzilla.redhat.com/show_bug.cgi?id=2496763", "https://creativecommons.org/licenses/by/4.0/", "https://curl.se/L7HzKXisfJ/CVE-2026-9547.md", "https://curl.se/docs/CVE-2026-9547.html", "https://curl.se/docs/CVE-2026-9547.json", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-1965", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-3783", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8286", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-9547", "https://errata.almalinux.org/9/ALSA-2026-55439.html", "https://errata.rockylinux.org/RLSA-2026:55439", "https://github.com/advisories/GHSA-xq9p-gxg6-f7q6", "https://hackerone.com/reports/3751712", "https://linux.oracle.com/cve/CVE-2026-9547.html", "https://linux.oracle.com/errata/ELSA-2026-55450.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-9547", "https://ubuntu.com/security/notices/USN-8487-1", "https://www.cve.org/CVERecord?id=CVE-2026-9547" ], "PublishedDate": "2026-07-03T07:16:25.99Z", "LastModifiedDate": "2026-09-15T07:16:35.31Z" }, { "VulnerabilityID": "CVE-2026-113351", "PkgID": "libexpat@2.7.5-r0", "PkgName": "libexpat", "PkgIdentifier": { "PURL": "pkg:apk/alpine/libexpat@2.7.5-r0?arch=x86_64\u0026distro=3.23.3", "UID": "60ae354914fcce6c" }, "InstalledVersion": "2.7.5-r0", "FixedVersion": "2.10.0-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:66331502f5f6a99cd657f4ef104273d82c78207f11e9d8f5ca16e2b53d08c361" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-113351", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:1b16e1524b782190755eee2d64d50a297a001c2d2fd1b35d912ae61c8924bc15", "Title": "expat: expat: Denial of Service via improper memory tracking in XML_ParserReset", "Description": "libexpat 2.7.2 through 2.9.0 contains a denial of service vulnerability because XML_ParserReset zeroes the direct byte count but never offsets tracked heap allocations. Attackers can submit a large XML document so later documents on the same reset parser fail with XML_ERROR_NO_MEMORY until it is recreated.", "Severity": "HIGH", "CweIDs": [ "CWE-909" ], "VendorSeverity": { "nvd": 3, "redhat": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.9 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-113351", "https://github.com/libexpat/libexpat", "https://github.com/libexpat/libexpat/blob/a76b1174c1ea52abb639a4c69d52b630a8a106a2/expat/lib/xmlparse.c#L1560", "https://github.com/libexpat/libexpat/blob/a76b1174c1ea52abb639a4c69d52b630a8a106a2/expat/lib/xmlparse.c#L860-L884", "https://github.com/libexpat/libexpat/pull/1431", "https://nvd.nist.gov/vuln/detail/CVE-2026-113351", "https://www.cve.org/CVERecord?id=CVE-2026-113351", "https://www.vulncheck.com/advisories/libexpat-2.7.2-through-2.9.0-denial-of-service-via-xml-parserreset" ], "PublishedDate": "2026-10-20T11:17:19.363Z", "LastModifiedDate": "2026-11-03T21:26:47.25Z" }, { "VulnerabilityID": "CVE-2026-115506", "PkgID": "libexpat@2.7.5-r0", "PkgName": "libexpat", "PkgIdentifier": { "PURL": "pkg:apk/alpine/libexpat@2.7.5-r0?arch=x86_64\u0026distro=3.23.3", "UID": "60ae354914fcce6c" }, "InstalledVersion": "2.7.5-r0", "FixedVersion": "2.10.0-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:66331502f5f6a99cd657f4ef104273d82c78207f11e9d8f5ca16e2b53d08c361" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-115506", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:ffaf5db15b55adb3b42ec1586f9a707d56fa8086e2284cd77707523c9b9bf87d", "Title": "expat: expat: Denial of Service via delayed entity amplification detection", "Description": "libexpat through 2.9.0 contains a denial of service vulnerability because billion laughs protection in accountingDiffTolerated() in xmlparse.c detects entity amplification too late. Attackers can supply a moderately sized XML document with a large DTD and nested entity expansions to consume tens of seconds of CPU per parse.", "Severity": "HIGH", "CweIDs": [ "CWE-776" ], "VendorSeverity": { "photon": 3, "redhat": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-115506", "https://github.com/hannob/lololol", "https://github.com/libexpat/libexpat", "https://github.com/libexpat/libexpat/issues/1160", "https://github.com/libexpat/libexpat/pull/1433", "https://nvd.nist.gov/vuln/detail/CVE-2026-115506", "https://www.cve.org/CVERecord?id=CVE-2026-115506", "https://www.vulncheck.com/advisories/libexpat-through-2.9.0-denial-of-service-via-billion-laughs-detection-delay" ], "PublishedDate": "2026-10-22T20:17:06.62Z", "LastModifiedDate": "2026-11-02T18:27:06.127Z" }, { "VulnerabilityID": "CVE-2026-117610", "PkgID": "libexpat@2.7.5-r0", "PkgName": "libexpat", "PkgIdentifier": { "PURL": "pkg:apk/alpine/libexpat@2.7.5-r0?arch=x86_64\u0026distro=3.23.3", "UID": "60ae354914fcce6c" }, "InstalledVersion": "2.7.5-r0", "FixedVersion": "2.10.0-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:66331502f5f6a99cd657f4ef104273d82c78207f11e9d8f5ca16e2b53d08c361" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-117610", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:492097d35f3d5c35623e412f46638d28d839bcfd37445923593e816556fb275c", "Title": "expat: expat: Denial of Service via NULL pointer dereference in external entity parsing", "Description": "libexpat through 2.9.0 contains a NULL pointer dereference vulnerability in externalEntityInitProcessor2() in lib/xmlparse.c that mishandles the XML_TOK_NONE token from empty input. Attackers who control stream chunking can force an empty non-final first parse on an external entity subparser, causing a later parse to crash the application.", "Severity": "HIGH", "CweIDs": [ "CWE-476" ], "VendorSeverity": { "nvd": 3, "redhat": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.9 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-117610", "https://github.com/libexpat/libexpat", "https://github.com/libexpat/libexpat/blob/a76b1174c1ea52abb639a4c69d52b630a8a106a2/expat/lib/xmlparse.c#L3468-L3510", "https://github.com/libexpat/libexpat/commit/7b0d50e4b1d16fafd55876260701e04279a7489d", "https://github.com/libexpat/libexpat/pull/1444", "https://nvd.nist.gov/vuln/detail/CVE-2026-117610", "https://www.cve.org/CVERecord?id=CVE-2026-117610", "https://www.vulncheck.com/advisories/libexpat-through-2.9.0-null-pointer-dereference-via-external-entity-subparser" ], "PublishedDate": "2026-10-28T03:17:12.777Z", "LastModifiedDate": "2026-11-05T16:17:35.787Z" }, { "VulnerabilityID": "CVE-2026-118370", "PkgID": "libexpat@2.7.5-r0", "PkgName": "libexpat", "PkgIdentifier": { "PURL": "pkg:apk/alpine/libexpat@2.7.5-r0?arch=x86_64\u0026distro=3.23.3", "UID": "60ae354914fcce6c" }, "InstalledVersion": "2.7.5-r0", "FixedVersion": "2.10.0-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:66331502f5f6a99cd657f4ef104273d82c78207f11e9d8f5ca16e2b53d08c361" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-118370", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:d3967177cf1805538c651526f2270288720516631a865f2f2fb917e86c77a098", "Title": "expat: expat: Denial of Service via integer overflow during XML attribute parsing", "Description": "libexpat through 2.9.0 contains a signed integer overflow vulnerability in storeAtts() in lib/xmlparse.c that allows attackers to trigger out-of-bounds writes via oversized attribute counts. Attackers can supply a multi-gigabyte document with a start tag carrying over 2^30 attributes to overflow attIndex and nPrefixes, crashing applications or corrupting heap memory.", "Severity": "HIGH", "CweIDs": [ "CWE-190" ], "VendorSeverity": { "nvd": 3, "redhat": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H", "V3Score": 8.2 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.9 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-118370", "https://github.com/libexpat/libexpat", "https://github.com/libexpat/libexpat/blob/a76b1174c1ea52abb639a4c69d52b630a8a106a2/expat/lib/xmlparse.c#L4138-L4140", "https://github.com/libexpat/libexpat/commit/1bac53c4fc460a03cd9860f39501c7979f6750ae", "https://github.com/libexpat/libexpat/commit/621cb2c78b253ee023a86bc91d6ddb048481c04c", "https://github.com/libexpat/libexpat/pull/1450", "https://nvd.nist.gov/vuln/detail/CVE-2026-118370", "https://www.cve.org/CVERecord?id=CVE-2026-118370", "https://www.vulncheck.com/advisories/libexpat-through-2.9.0-integer-overflow-in-storeatts-via-attindex-and-nprefixes" ], "PublishedDate": "2026-10-28T03:17:13.293Z", "LastModifiedDate": "2026-11-02T20:17:37.377Z" }, { "VulnerabilityID": "CVE-2026-45186", "PkgID": "libexpat@2.7.5-r0", "PkgName": "libexpat", "PkgIdentifier": { "PURL": "pkg:apk/alpine/libexpat@2.7.5-r0?arch=x86_64\u0026distro=3.23.3", "UID": "60ae354914fcce6c" }, "InstalledVersion": "2.7.5-r0", "FixedVersion": "2.8.1-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:66331502f5f6a99cd657f4ef104273d82c78207f11e9d8f5ca16e2b53d08c361" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-45186", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:a97c7948f29c89ab9039d8e4f54e12da5e4a55983f52348b92985c321a76f7b7", "Title": "libexpat: denial of service via crafted XML input", "Description": "In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial of service via moderately sized crafted XML input.", "Severity": "HIGH", "CweIDs": [ "CWE-407" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 1, "julia": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/05/11/16", "https://access.redhat.com/errata/RHSA-2026:22715", "https://access.redhat.com/errata/RHSA-2026:22721", "https://access.redhat.com/errata/RHSA-2026:23230", "https://access.redhat.com/errata/RHSA-2026:26319", "https://access.redhat.com/errata/RHSA-2026:27201", "https://access.redhat.com/errata/RHSA-2026:29197", "https://access.redhat.com/errata/RHSA-2026:58981", "https://access.redhat.com/errata/RHSA-2026:93443", "https://access.redhat.com/security/cve/CVE-2026-45186", "https://bugzilla.redhat.com/2468575", "https://bugzilla.redhat.com/2550393", "https://bugzilla.redhat.com/2550394", "https://bugzilla.redhat.com/2550396", "https://bugzilla.redhat.com/2550397", "https://bugzilla.redhat.com/2550400", "https://bugzilla.redhat.com/2550401", "https://bugzilla.redhat.com/2550403", "https://bugzilla.redhat.com/2550404", "https://bugzilla.redhat.com/2550405", "https://bugzilla.redhat.com/2550406", "https://bugzilla.redhat.com/2550408", "https://bugzilla.redhat.com/2550410", "https://bugzilla.redhat.com/2550411", "https://bugzilla.redhat.com/2550412", "https://bugzilla.redhat.com/2550413", "https://bugzilla.redhat.com/2550417", "https://bugzilla.redhat.com/2550418", "https://bugzilla.redhat.com/2550419", "https://bugzilla.redhat.com/2550420", "https://bugzilla.redhat.com/2550421", "https://bugzilla.redhat.com/2550422", "https://bugzilla.redhat.com/2550424", "https://bugzilla.redhat.com/2550425", "https://bugzilla.redhat.com/2550426", "https://bugzilla.redhat.com/2550428", "https://bugzilla.redhat.com/2550429", "https://bugzilla.redhat.com/2550430", "https://bugzilla.redhat.com/2550431", "https://bugzilla.redhat.com/2550432", "https://bugzilla.redhat.com/2550433", "https://bugzilla.redhat.com/2550434", "https://bugzilla.redhat.com/2550436", "https://bugzilla.redhat.com/2550438", "https://bugzilla.redhat.com/2550440", "https://bugzilla.redhat.com/2550442", "https://bugzilla.redhat.com/2550444", "https://bugzilla.redhat.com/2550446", "https://bugzilla.redhat.com/2550450", "https://bugzilla.redhat.com/2550451", "https://bugzilla.redhat.com/2550452", "https://bugzilla.redhat.com/2550454", "https://bugzilla.redhat.com/2550455", "https://bugzilla.redhat.com/2550458", "https://bugzilla.redhat.com/2550459", "https://bugzilla.redhat.com/2550461", "https://bugzilla.redhat.com/2550463", "https://bugzilla.redhat.com/2550464", "https://bugzilla.redhat.com/2550465", "https://bugzilla.redhat.com/2550467", "https://bugzilla.redhat.com/2550468", "https://bugzilla.redhat.com/2550469", "https://bugzilla.redhat.com/2550470", "https://bugzilla.redhat.com/2550471", "https://bugzilla.redhat.com/2550472", "https://bugzilla.redhat.com/2550473", "https://bugzilla.redhat.com/2550474", "https://bugzilla.redhat.com/2550475", "https://bugzilla.redhat.com/2550476", "https://bugzilla.redhat.com/2550477", "https://bugzilla.redhat.com/2550478", "https://bugzilla.redhat.com/2550480", "https://bugzilla.redhat.com/show_bug.cgi?id=2468575", "https://cert-portal.siemens.com/productcert/html/ssa-082556.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45186", "https://errata.almalinux.org/9/ALSA-2026-93443.html", "https://errata.rockylinux.org/RLSA-2026:23230", "https://github.com/libexpat/libexpat/pull/1216", "https://linux.oracle.com/cve/CVE-2026-45186.html", "https://linux.oracle.com/errata/ELSA-2026-93443.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-45186", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45186.json", "https://ubuntu.com/security/notices/USN-8790-1", "https://www.cve.org/CVERecord?id=CVE-2026-45186" ], "PublishedDate": "2026-05-10T07:16:07.883Z", "LastModifiedDate": "2026-09-16T13:17:58.967Z" }, { "VulnerabilityID": "CVE-2026-66046", "PkgID": "libexpat@2.7.5-r0", "PkgName": "libexpat", "PkgIdentifier": { "PURL": "pkg:apk/alpine/libexpat@2.7.5-r0?arch=x86_64\u0026distro=3.23.3", "UID": "60ae354914fcce6c" }, "InstalledVersion": "2.7.5-r0", "FixedVersion": "2.8.4-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:66331502f5f6a99cd657f4ef104273d82c78207f11e9d8f5ca16e2b53d08c361" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-66046", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:0a6930d31bfff06ff6a345fce2c9e44970e833d8c78ab1062f80495f8d87f2e2", "Title": "expat: Expat: Denial of Service via quadratic complexity in attribute processing", "Description": "Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts() function in xmlparse.c, where processing N specified attributes with non-normalized values triggers an O(N^2) linear scan of elementType-\u003edefaultAtts to determine CDATA status. A remote unauthenticated attacker can supply a single well-formed XML document of a few megabytes to an application parsing untrusted XML to cause excessive CPU consumption, resulting in denial of service without requiring authentication, external entity resolution, or non-default parser options.", "Severity": "HIGH", "CweIDs": [ "CWE-407" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:72663", "https://access.redhat.com/security/cve/CVE-2026-66046", "https://bugzilla.redhat.com/2538967", "https://bugzilla.redhat.com/show_bug.cgi?id=2517901", "https://bugzilla.redhat.com/show_bug.cgi?id=2538967", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-66046", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93990", "https://errata.almalinux.org/9/ALSA-2026-72663.html", "https://errata.rockylinux.org/RLSA-2026:72663", "https://github.com/libexpat/libexpat/pull/1321", "https://linux.oracle.com/cve/CVE-2026-66046.html", "https://linux.oracle.com/errata/ELSA-2026-74001.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-66046", "https://ubuntu.com/security/notices/USN-8813-1", "https://www.cve.org/CVERecord?id=CVE-2026-66046", "https://www.vulncheck.com/advisories/expat-denial-of-service-via-storeatts-quadratic-complexity" ], "PublishedDate": "2026-08-18T15:16:57Z", "LastModifiedDate": "2026-10-22T22:10:00.25Z" }, { "VulnerabilityID": "CVE-2026-76641", "PkgID": "libexpat@2.7.5-r0", "PkgName": "libexpat", "PkgIdentifier": { "PURL": "pkg:apk/alpine/libexpat@2.7.5-r0?arch=x86_64\u0026distro=3.23.3", "UID": "60ae354914fcce6c" }, "InstalledVersion": "2.7.5-r0", "FixedVersion": "2.8.4-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:66331502f5f6a99cd657f4ef104273d82c78207f11e9d8f5ca16e2b53d08c361" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-76641", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:050106e600142a8c892495117d2e42f443d5046a4434671f656536c1e7ac7a27", "Title": "expat: Expat: Denial of Service via XML external entity parsing", "Description": "Expat through 2.8.3 contains an out-of-bounds read vulnerability that allows attackers to trigger memory corruption by processing XML with external entity parsers created via XML_ExternalEntityParserCreate. A struct size mismatch between ELEMENT_TYPE members causes storeAtts to read the attIndex member past allocated memory boundaries, resulting in failure to normalize whitespace in non-CDATA attributes or a wild pointer dereference causing a segfault. This vulnerability was introduced by the fix for CVE-2026-66046.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "azure": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-76641", "https://github.com/libexpat/libexpat/commit/98599f6dcc2b460410881fe420f5f55d6bec63bf", "https://github.com/libexpat/libexpat/pull/1331", "https://nvd.nist.gov/vuln/detail/CVE-2026-76641", "https://ubuntu.com/security/notices/USN-8813-1", "https://www.cve.org/CVERecord?id=CVE-2026-76641", "https://www.vulncheck.com/advisories/expat-out-of-bounds-read-via-dtdcopy" ], "PublishedDate": "2026-08-20T18:16:51.887Z", "LastModifiedDate": "2026-10-26T10:10:00.14Z" }, { "VulnerabilityID": "CVE-2026-76956", "PkgID": "libexpat@2.7.5-r0", "PkgName": "libexpat", "PkgIdentifier": { "PURL": "pkg:apk/alpine/libexpat@2.7.5-r0?arch=x86_64\u0026distro=3.23.3", "UID": "60ae354914fcce6c" }, "InstalledVersion": "2.7.5-r0", "FixedVersion": "2.8.4-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:66331502f5f6a99cd657f4ef104273d82c78207f11e9d8f5ca16e2b53d08c361" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-76956", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:8b9a7f983ed6603a98c1b5e4ec7dde2278b4af5021c4b345b9cc2ede6380f5e8", "Title": "libexpat: libexpat: Denial of Service via hash flooding attack with crafted XML", "Description": "In libexpat 2.8.2 and 2.8.3 before 2.8.4, misinterpretation of getentropy's return code leads to insufficient entropy, which results in being vulnerable to hash flooding attacks, causing a denial of service via crafted XML content.", "Severity": "HIGH", "CweIDs": [ "CWE-394" ], "VendorSeverity": { "azure": 2, "nvd": 3, "redhat": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.9 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-76956", "https://github.com/libexpat/libexpat/pull/1326", "https://github.com/libexpat/libexpat/pull/1329", "https://nvd.nist.gov/vuln/detail/CVE-2026-76956", "https://www.cve.org/CVERecord?id=CVE-2026-76956" ], "PublishedDate": "2026-08-20T05:16:29.61Z", "LastModifiedDate": "2026-09-08T21:08:20.697Z" }, { "VulnerabilityID": "CVE-2026-76957", "PkgID": "libexpat@2.7.5-r0", "PkgName": "libexpat", "PkgIdentifier": { "PURL": "pkg:apk/alpine/libexpat@2.7.5-r0?arch=x86_64\u0026distro=3.23.3", "UID": "60ae354914fcce6c" }, "InstalledVersion": "2.7.5-r0", "FixedVersion": "2.8.4-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:66331502f5f6a99cd657f4ef104273d82c78207f11e9d8f5ca16e2b53d08c361" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-76957", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:7bc1f59a993cbf511fc926dcd513cb9bff0eff150da0d8653e91be39e5e640a9", "Title": "libexpat: libexpat: Memory corruption vulnerability allows arbitrary code execution or denial of service", "Description": "libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. Thus, a use-after-free can occur. NOTE: this is similar to CVE-2026-50219, CVE-2026-56131 and CVE-2026-56412.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "amazon": 3, "azure": 2, "nvd": 3, "photon": 3, "redhat": 2, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L", "V3Score": 4.9 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-76957", "https://github.com/libexpat/libexpat/pull/1322", "https://github.com/libexpat/libexpat/pull/1329", "https://nvd.nist.gov/vuln/detail/CVE-2026-76957", "https://ubuntu.com/security/notices/USN-8813-1", "https://www.cve.org/CVERecord?id=CVE-2026-76957" ], "PublishedDate": "2026-08-20T05:16:29.747Z", "LastModifiedDate": "2026-09-08T20:56:31.86Z" }, { "VulnerabilityID": "CVE-2026-77214", "PkgID": "libexpat@2.7.5-r0", "PkgName": "libexpat", "PkgIdentifier": { "PURL": "pkg:apk/alpine/libexpat@2.7.5-r0?arch=x86_64\u0026distro=3.23.3", "UID": "60ae354914fcce6c" }, "InstalledVersion": "2.7.5-r0", "FixedVersion": "2.9.0-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:66331502f5f6a99cd657f4ef104273d82c78207f11e9d8f5ca16e2b53d08c361" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-77214", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:8a8f24cdf9a285f5a257206f53639a2c16a6b3ed80a6a577e9758702da6c95b4", "Title": "expat: expat: Information disclosure via heap buffer over-read in XML_ParseBuffer", "Description": "libexpat before commit 13c5f63 contains a heap buffer over-read vulnerability in xmlparse.c. XML_ParseBuffer advances the parse buffer end with parser-\u003em_bufferEnd += len using a caller-supplied length that is not validated against the allocated buffer size, so repeated XML_ParseBuffer calls move m_bufferEnd past the end of the heap allocation and subsequent parsing reads out of bounds. Reaching this path requires a parse buffer to already be present; otherwise XML_ParseBuffer returns XML_ERROR_NO_BUFFER. A buffer is present after a prior call to XML_GetBuffer, either directly (the common case) or indirectly through a prior XML_Parse call that allocates the buffer internally. The over-read discloses adjacent heap memory to the calling application, recovering heap pointers, libc function pointers, and code pointers sufficient to defeat ASLR and build further exploitation primitives.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "alma": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L", "V3Score": 8.2 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:88247", "https://access.redhat.com/security/cve/CVE-2026-77214", "https://bugzilla.redhat.com/2543288", "https://bugzilla.redhat.com/2547476", "https://bugzilla.redhat.com/show_bug.cgi?id=2543288", "https://bugzilla.redhat.com/show_bug.cgi?id=2547476", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-102633", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-77214", "https://errata.almalinux.org/9/ALSA-2026-88247.html", "https://errata.rockylinux.org/RLSA-2026:88247", "https://github.com/libexpat/libexpat/commit/13c5f63a7f1c52c2feee3b16a1134d4fb68e9ea0", "https://github.com/libexpat/libexpat/pull/1393", "https://linux.oracle.com/cve/CVE-2026-77214.html", "https://linux.oracle.com/errata/ELSA-2026-92323.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-77214", "https://www.cve.org/CVERecord?id=CVE-2026-77214", "https://www.vulncheck.com/advisories/libexpat-heap-buffer-over-read-in-xmlparse-c-via-xml-parsebuffer" ], "PublishedDate": "2026-10-07T15:17:53.327Z", "LastModifiedDate": "2026-10-10T03:17:08.487Z" }, { "VulnerabilityID": "CVE-2026-93990", "PkgID": "libexpat@2.7.5-r0", "PkgName": "libexpat", "PkgIdentifier": { "PURL": "pkg:apk/alpine/libexpat@2.7.5-r0?arch=x86_64\u0026distro=3.23.3", "UID": "60ae354914fcce6c" }, "InstalledVersion": "2.7.5-r0", "FixedVersion": "2.8.5-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:66331502f5f6a99cd657f4ef104273d82c78207f11e9d8f5ca16e2b53d08c361" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-93990", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:49959716421dfe0df7f1932e9bb684029f433d208ce5b64e0b370fb2f47dfb9d", "Title": "expat: Expat: XML Injection via Malformed UTF-16 Input", "Description": "Expat before 2.8.5 fails to validate that a high surrogate in UTF-16 input is followed by a low surrogate, allowing malformed UTF-16 sequences to be accepted. Attackers can supply UTF-16 encoded XML containing lone high surrogates that consume the following code unit, causing Expat to pass unpaired surrogates to applications built with XML_UNICODE and to silently replace input characters in other builds.", "Severity": "HIGH", "CweIDs": [ "CWE-176" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:72663", "https://access.redhat.com/security/cve/CVE-2026-93990", "https://blog.hartwork.org/posts/expat-2-8-5-released/", "https://bugzilla.redhat.com/2538967", "https://bugzilla.redhat.com/show_bug.cgi?id=2517901", "https://bugzilla.redhat.com/show_bug.cgi?id=2538967", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-66046", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-93990", "https://errata.almalinux.org/9/ALSA-2026-72663.html", "https://errata.rockylinux.org/RLSA-2026:72663", "https://github.com/libexpat/libexpat", "https://github.com/libexpat/libexpat/commit/ff6e1d7e750bbe245178f51a47a965dc8342861a", "https://github.com/libexpat/libexpat/pull/1282", "https://github.com/libexpat/libexpat/releases/tag/R_2_8_5", "https://linux.oracle.com/cve/CVE-2026-93990.html", "https://linux.oracle.com/errata/ELSA-2026-74001.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-93990", "https://www.cve.org/CVERecord?id=CVE-2026-93990", "https://www.vulncheck.com/advisories/expat-through-2.8.4-malformed-utf-16-acceptance-via-unchecked-surrogate" ], "PublishedDate": "2026-09-19T23:17:10.203Z", "LastModifiedDate": "2026-09-28T17:17:53.037Z" }, { "VulnerabilityID": "CVE-2026-31789", "PkgID": "libssl3@3.5.5-r0", "PkgName": "libssl3", "PkgIdentifier": { "PURL": "pkg:apk/alpine/libssl3@3.5.5-r0?arch=x86_64\u0026distro=3.23.3", "UID": "bca2260902e2ef48" }, "InstalledVersion": "3.5.5-r0", "FixedVersion": "3.5.6-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:989e799e634906e94dc9a5ee2ee26fc92ad260522990f26e707861a5f52bf64e" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-31789", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:f79e364365ded85ecfbe44207685d08e26f1d00d88caf56fcd2a11e4ba147960", "Title": "openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing", "Description": "Issue summary: Converting an excessively large OCTET STRING value to\na hexadecimal string leads to a heap buffer overflow on 32 bit platforms.\n\nImpact summary: A heap buffer overflow may lead to a crash or possibly\nan attacker controlled code execution or other undefined behavior.\n\nIf an attacker can supply a crafted X.509 certificate with an excessively\nlarge OCTET STRING value in extensions such as the Subject Key Identifier\n(SKID) or Authority Key Identifier (AKID) which are being converted to hex,\nthe size of the buffer needed for the result is calculated as multiplication\nof the input length by 3. On 32 bit platforms, this multiplication may overflow\nresulting in the allocation of a smaller buffer and a heap buffer overflow.\n\nApplications and services that print or log contents of untrusted X.509\ncertificates are vulnerable to this issue. As the certificates would have\nto have sizes of over 1 Gigabyte, printing or logging such certificates\nis a fairly unlikely operation and only 32 bit platforms are affected,\nthis issue was assigned Low severity.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.", "Severity": "CRITICAL", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "azure": 2, "julia": 4, "nvd": 4, "photon": 4, "redhat": 1, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 9.8 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 9.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H", "V3Score": 5.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-31789", "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "https://github.com/advisories/GHSA-j79m-9jxq-788r", "https://github.com/openssl/openssl/commit/364f095b80601db632b0def6a33316967f863bde", "https://github.com/openssl/openssl/commit/7a9087efd769f362ad9c0e30c7baaa6bbfa65ecf", "https://github.com/openssl/openssl/commit/945b935ac66cc7f1a41f1b849c7c25adb5351f49", "https://github.com/openssl/openssl/commit/a24216018e1ede8ff01a4ff5afff7dfbd443e2f9", "https://github.com/openssl/openssl/commit/a91e537d16d74050dbde50bb0dfb1fe9930f0521", "https://nvd.nist.gov/vuln/detail/CVE-2026-31789", "https://openssl-library.org/news/secadv/20260407.txt", "https://ubuntu.com/security/notices/USN-8155-1", "https://www.cve.org/CVERecord?id=CVE-2026-31789", "https://www.openwall.com/lists/oss-security/2026/04/07/11" ], "PublishedDate": "2026-04-07T22:16:21.617Z", "LastModifiedDate": "2026-07-24T23:10:00.563Z" }, { "VulnerabilityID": "CVE-2026-14456", "PkgID": "libssl3@3.5.5-r0", "PkgName": "libssl3", "PkgIdentifier": { "PURL": "pkg:apk/alpine/libssl3@3.5.5-r0?arch=x86_64\u0026distro=3.23.3", "UID": "bca2260902e2ef48" }, "InstalledVersion": "3.5.5-r0", "FixedVersion": "3.5.8-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:989e799e634906e94dc9a5ee2ee26fc92ad260522990f26e707861a5f52bf64e" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-14456", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:d35f3dd9b2e29e251258f3621ee09f86571e518e429a1381402421bbe4eca7e7", "Title": "openssl: OpenSSL: Denial of Service via unbounded memory growth in QUIC server", "Description": "Issue summary: When an OpenSSL QUIC server (Listener SSL object) processes\nvalid QUIC Initial packets for unknown destination connection IDs, it\ncan allocate and queue new incoming channels without enforcing any limit.\n\nImpact summary: A remote peer that can make many Initial packets reach the\nserver listener faster than the application accepts connections, can cause the\nmemory allocated to store the per-channel state to grow without any limits,\npotentially making the QUIC listener unavailable and causing Denial of Service.\n\nCWE: CWE-770: Allocation of Resources Without Limits or Throttling\n\nDescription: The function that handles inbound QUIC packets uses\nConnection-Id from the packet header to find an existing connection\n(QUIC channel). If no existing connection is found and the packet\ntype is INITIAL, the function treats the packet as a new connection. It\nallocates a new channel object and inserts it into a queue where it\nwaits to be accepted by the local application with SSL_accept(3ossl).\nThe memory occupied by these initial channel objects may grow\nwithout bounds if the application is not able to call SSL_accept()\nfrequently enough to serve these inbound connection requests.\n\nThe issue is present since OpenSSL 3.5 when the QUIC server implementation\nwas added.\n\nThe fix introduces a limit for pending connections. The default limit is set\nto 256 pending connections (waiting to be accepted by the local application).\nApplications may change the default by calling SSL_set_value_uint(3ossl).\n\nFIPS impact: no\nThe FIPS module is not affected as the QUIC implementation is outside of\nthe OpenSSL FIPS module boundary.", "Severity": "HIGH", "CweIDs": [ "CWE-770" ], "VendorSeverity": { "alma": 3, "amazon": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/08/13/4", "https://access.redhat.com/errata/RHSA-2026:67165", "https://access.redhat.com/security/cve/CVE-2026-14456", "https://bugzilla.redhat.com/2515348", "https://bugzilla.redhat.com/2517559", "https://bugzilla.redhat.com/2517560", "https://bugzilla.redhat.com/2517561", "https://bugzilla.redhat.com/2517562", "https://bugzilla.redhat.com/2517564", "https://bugzilla.redhat.com/2517565", "https://bugzilla.redhat.com/2517566", "https://bugzilla.redhat.com/2517570", "https://bugzilla.redhat.com/show_bug.cgi?id=2515348", "https://bugzilla.redhat.com/show_bug.cgi?id=2517559", "https://bugzilla.redhat.com/show_bug.cgi?id=2517560", "https://bugzilla.redhat.com/show_bug.cgi?id=2517561", "https://bugzilla.redhat.com/show_bug.cgi?id=2517562", "https://bugzilla.redhat.com/show_bug.cgi?id=2517564", "https://bugzilla.redhat.com/show_bug.cgi?id=2517565", "https://bugzilla.redhat.com/show_bug.cgi?id=2517566", "https://bugzilla.redhat.com/show_bug.cgi?id=2517570", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-14456", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-14457", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-18798", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54874", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63072", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63073", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63074", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63075", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63076", "https://errata.almalinux.org/9/ALSA-2026-67165.html", "https://errata.rockylinux.org/RLSA-2026:67165", "https://github.com/openssl/openssl/commit/08e7756c3900bcfd77a720e7b74e27d6e4ed01a9", "https://github.com/openssl/openssl/commit/4084152e040329ca0194c4c1750b9b46d00a5b6b", "https://github.com/openssl/openssl/commit/f2f1465f2d2e5c61dfeac4d20fd093797d821139", "https://linux.oracle.com/cve/CVE-2026-14456.html", "https://linux.oracle.com/errata/ELSA-2026-67165-0.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-14456", "https://openssl-library.org/news/secadv/20260813.txt", "https://ubuntu.com/security/notices/USN-8678-1", "https://www.cve.org/CVERecord?id=CVE-2026-14456" ], "PublishedDate": "2026-08-13T15:19:31.82Z", "LastModifiedDate": "2026-11-06T20:26:36.04Z" }, { "VulnerabilityID": "CVE-2026-28387", "PkgID": "libssl3@3.5.5-r0", "PkgName": "libssl3", "PkgIdentifier": { "PURL": "pkg:apk/alpine/libssl3@3.5.5-r0?arch=x86_64\u0026distro=3.23.3", "UID": "bca2260902e2ef48" }, "InstalledVersion": "3.5.5-r0", "FixedVersion": "3.5.6-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:989e799e634906e94dc9a5ee2ee26fc92ad260522990f26e707861a5f52bf64e" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-28387", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:fbec2b8bc9148175ea5b93e4d31045a710a317c7ae7c75b461235a7a981482ed", "Title": "openssl: OpenSSL: Arbitrary code execution due to use-after-free in DANE TLSA authentication", "Description": "Issue summary: An uncommon configuration of clients performing DANE TLSA-based\nserver authentication, when paired with uncommon server DANE TLSA records, may\nresult in a use-after-free and/or double-free on the client side.\n\nImpact summary: A use after free can have a range of potential consequences\nsuch as the corruption of valid data, crashes or execution of arbitrary code.\n\nHowever, the issue only affects clients that make use of TLSA records with both\nthe PKIX-TA(0/PKIX-EE(1) certificate usages and the DANE-TA(2) certificate\nusage.\n\nBy far the most common deployment of DANE is in SMTP MTAs for which RFC7672\nrecommends that clients treat as 'unusable' any TLSA records that have the PKIX\ncertificate usages. These SMTP (or other similar) clients are not vulnerable\nto this issue. Conversely, any clients that support only the PKIX usages, and\nignore the DANE-TA(2) usage are also not vulnerable.\n\nThe client would also need to be communicating with a server that publishes a\nTLSA RRset with both types of TLSA records.\n\nNo FIPS modules are affected by this issue, the problem code is outside the\nFIPS module boundary.", "Severity": "HIGH", "CweIDs": [ "CWE-416" ], "VendorSeverity": { "amazon": 3, "azure": 1, "julia": 3, "nvd": 3, "photon": 3, "redhat": 1, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "V3Score": 3.7 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-28387", "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b", "https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe", "https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3", "https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7", "https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177", "https://nvd.nist.gov/vuln/detail/CVE-2026-28387", "https://openssl-library.org/news/secadv/20260407.txt", "https://ubuntu.com/security/notices/USN-8155-1", "https://ubuntu.com/security/notices/USN-8155-2", "https://www.cve.org/CVERecord?id=CVE-2026-28387", "https://www.openwall.com/lists/oss-security/2026/04/07/11" ], "PublishedDate": "2026-04-07T22:16:20.7Z", "LastModifiedDate": "2026-07-24T23:10:00.563Z" }, { "VulnerabilityID": "CVE-2026-28388", "PkgID": "libssl3@3.5.5-r0", "PkgName": "libssl3", "PkgIdentifier": { "PURL": "pkg:apk/alpine/libssl3@3.5.5-r0?arch=x86_64\u0026distro=3.23.3", "UID": "bca2260902e2ef48" }, "InstalledVersion": "3.5.5-r0", "FixedVersion": "3.5.6-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:989e799e634906e94dc9a5ee2ee26fc92ad260522990f26e707861a5f52bf64e" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-28388", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:1e7f2108aa864c192a93121091bac6365c3d6777a70546686d27ac46e7d0f118", "Title": "openssl: OpenSSL: Denial of Service due to NULL pointer dereference in delta CRL processing", "Description": "Issue summary: When a delta CRL that contains a Delta CRL Indicator extension\nis processed a NULL pointer dereference might happen if the required CRL\nNumber extension is missing.\n\nImpact summary: A NULL pointer dereference can trigger a crash which\nleads to a Denial of Service for an application.\n\nWhen CRL processing and delta CRL processing is enabled during X.509\ncertificate verification, the delta CRL processing does not check\nwhether the CRL Number extension is NULL before dereferencing it.\nWhen a malformed delta CRL file is being processed, this parameter\ncan be NULL, causing a NULL pointer dereference.\n\nExploiting this issue requires the X509_V_FLAG_USE_DELTAS flag to be enabled in\nthe verification context, the certificate being verified to contain a\nfreshestCRL extension or the base CRL to have the EXFLAG_FRESHEST flag set, and\nan attacker to provide a malformed CRL to an application that processes it.\n\nThe vulnerability is limited to Denial of Service and cannot be escalated to\nachieve code execution or memory disclosure. For that reason the issue was\nassessed as Low severity according to our Security Policy.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the affected code is outside the OpenSSL FIPS module boundary.", "Severity": "HIGH", "CweIDs": [ "CWE-476" ], "VendorSeverity": { "amazon": 3, "azure": 2, "julia": 3, "nvd": 3, "photon": 3, "redhat": 1, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.9 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-28388", "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e", "https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139", "https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3", "https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8", "https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726", "https://nvd.nist.gov/vuln/detail/CVE-2026-28388", "https://openssl-library.org/news/secadv/20260407.txt", "https://ubuntu.com/security/notices/USN-8155-1", "https://ubuntu.com/security/notices/USN-8155-2", "https://www.cve.org/CVERecord?id=CVE-2026-28388", "https://www.openwall.com/lists/oss-security/2026/04/07/11" ], "PublishedDate": "2026-04-07T22:16:20.863Z", "LastModifiedDate": "2026-07-24T23:10:00.563Z" }, { "VulnerabilityID": "CVE-2026-28389", "PkgID": "libssl3@3.5.5-r0", "PkgName": "libssl3", "PkgIdentifier": { "PURL": "pkg:apk/alpine/libssl3@3.5.5-r0?arch=x86_64\u0026distro=3.23.3", "UID": "bca2260902e2ef48" }, "InstalledVersion": "3.5.5-r0", "FixedVersion": "3.5.6-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:989e799e634906e94dc9a5ee2ee26fc92ad260522990f26e707861a5f52bf64e" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-28389", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:bde6c3276b0712e5e927e237ed70e3873bf0aaea45b15c876e14787f14f86fc0", "Title": "openssl: OpenSSL: Denial of Service vulnerability in CMS processing", "Description": "Issue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyAgreeRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyAgreeRecipientInfo is\nprocessed, the optional parameters field of KeyEncryptionAlgorithmIdentifier\nis examined without checking for its presence. This results in a NULL\npointer dereference if the field is missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.", "Severity": "HIGH", "CweIDs": [ "CWE-476" ], "VendorSeverity": { "amazon": 3, "azure": 2, "julia": 3, "nvd": 3, "photon": 3, "redhat": 1, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.9 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-28389", "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "https://github.com/advisories/GHSA-7x88-9hgc-69gf", "https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5", "https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616", "https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f", "https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a", "https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686", "https://nvd.nist.gov/vuln/detail/CVE-2026-28389", "https://openssl-library.org/news/secadv/20260407.txt", "https://ubuntu.com/security/notices/USN-8155-1", "https://ubuntu.com/security/notices/USN-8155-2", "https://www.cve.org/CVERecord?id=CVE-2026-28389", "https://www.openwall.com/lists/oss-security/2026/04/07/11" ], "PublishedDate": "2026-04-07T22:16:21.03Z", "LastModifiedDate": "2026-07-24T23:10:00.563Z" }, { "VulnerabilityID": "CVE-2026-28390", "PkgID": "libssl3@3.5.5-r0", "PkgName": "libssl3", "PkgIdentifier": { "PURL": "pkg:apk/alpine/libssl3@3.5.5-r0?arch=x86_64\u0026distro=3.23.3", "UID": "bca2260902e2ef48" }, "InstalledVersion": "3.5.5-r0", "FixedVersion": "3.5.6-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:989e799e634906e94dc9a5ee2ee26fc92ad260522990f26e707861a5f52bf64e" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-28390", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:12087ea821b3b83f6f91a04209120aa24c0bc774d14fb980f6ca158800742b0a", "Title": "openssl: OpenSSL: Denial of Service due to NULL pointer dereference in CMS EnvelopedData processing", "Description": "Issue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyTransportRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyTransportRecipientInfo with\nRSA-OAEP encryption is processed, the optional parameters field of\nRSA-OAEP SourceFunc algorithm identifier is examined without checking\nfor its presence. This results in a NULL pointer dereference if the field\nis missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.", "Severity": "HIGH", "CweIDs": [ "CWE-476" ], "VendorSeverity": { "alma": 2, "amazon": 3, "azure": 2, "julia": 3, "nvd": 3, "oracle-oval": 2, "photon": 3, "redhat": 2, "rocky": 2, "ubuntu": 1 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:22312", "https://access.redhat.com/errata/RHSA-2026:22313", "https://access.redhat.com/security/cve/CVE-2026-28390", "https://bugzilla.redhat.com/2456314", "https://bugzilla.redhat.com/show_bug.cgi?id=2456314", "https://cert-portal.siemens.com/productcert/html/ssa-032379.html", "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-28390", "https://errata.almalinux.org/9/ALSA-2026-22313.html", "https://errata.rockylinux.org/RLSA-2026:22312", "https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc", "https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6", "https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4", "https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788", "https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75", "https://linux.oracle.com/cve/CVE-2026-28390.html", "https://linux.oracle.com/errata/ELSA-2026-50345.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-28390", "https://openssl-library.org/news/secadv/20260407.txt", "https://ubuntu.com/security/notices/USN-8155-1", "https://ubuntu.com/security/notices/USN-8155-2", "https://www.cve.org/CVERecord?id=CVE-2026-28390", "https://www.openwall.com/lists/oss-security/2026/04/07/11" ], "PublishedDate": "2026-04-07T22:16:21.19Z", "LastModifiedDate": "2026-07-24T23:10:00.563Z" }, { "VulnerabilityID": "CVE-2026-45447", "PkgID": "libssl3@3.5.5-r0", "PkgName": "libssl3", "PkgIdentifier": { "PURL": "pkg:apk/alpine/libssl3@3.5.5-r0?arch=x86_64\u0026distro=3.23.3", "UID": "bca2260902e2ef48" }, "InstalledVersion": "3.5.5-r0", "FixedVersion": "3.5.7-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:989e799e634906e94dc9a5ee2ee26fc92ad260522990f26e707861a5f52bf64e" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-45447", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:12f6cc8863efdb463de7b7a9b0ca98bbbc0db751e19fc65233e207b10da8d015", "Title": "openssl: Heap Use-After-Free in OpenSSL PKCS7_verify()", "Description": "Issue summary: A specially crafted PKCS#7 or S/MIME signed message could\ntrigger a use-after-free during PKCS#7 signature verification.\n\nImpact summary: A use-after-free may result in process crashes, heap\ncorruption, or potentially remote code execution.\n\nWhen processing a PKCS#7 or S/MIME signed message, if the SignedData\ndigestAlgorithms field is present as an empty ASN.1 SET, OpenSSL may\nincorrectly free a caller-owned BIO during PKCS7_verify(). A subsequent\nuse of the BIO by the calling application results in a use-after-free\ncondition.\n\nIn the common case this occurs when the application later calls\nBIO_free() on the BIO originally passed to PKCS7_verify(). Depending\non allocator behavior and application-specific BIO usage patterns, this\nmay result in a crash or other memory corruption. In some application\ncontexts this may potentially be exploitable for remote code execution.\n\nApplications that process PKCS#7 or S/MIME signed messages using OpenSSL\nPKCS#7 APIs may be affected. Applications using the CMS APIs for this\nprocessing are not affected.\n\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary.", "Severity": "HIGH", "CweIDs": [ "CWE-416", "CWE-825" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "julia": 3, "oracle-oval": 2, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:25237", "https://access.redhat.com/errata/RHSA-2026:25239", "https://access.redhat.com/errata/RHSA-2026:26275", "https://access.redhat.com/errata/RHSA-2026:26319", "https://access.redhat.com/errata/RHSA-2026:29197", "https://access.redhat.com/errata/RHSA-2026:34102", "https://access.redhat.com/errata/RHSA-2026:35869", "https://access.redhat.com/errata/RHSA-2026:36215", "https://access.redhat.com/errata/RHSA-2026:36217", "https://access.redhat.com/errata/RHSA-2026:39009", "https://access.redhat.com/errata/RHSA-2026:39012", "https://access.redhat.com/errata/RHSA-2026:39981", "https://access.redhat.com/errata/RHSA-2026:44438", "https://access.redhat.com/errata/RHSA-2026:47735", "https://access.redhat.com/errata/RHSA-2026:47737", "https://access.redhat.com/errata/RHSA-2026:58563", "https://access.redhat.com/errata/RHSA-2026:58981", "https://access.redhat.com/errata/RHSA-2026:59831", "https://access.redhat.com/errata/RHSA-2026:66524", "https://access.redhat.com/security/cve/CVE-2026-45447", "https://bugzilla.redhat.com/2481898", "https://bugzilla.redhat.com/show_bug.cgi?id=2481879", "https://bugzilla.redhat.com/show_bug.cgi?id=2481880", "https://bugzilla.redhat.com/show_bug.cgi?id=2481881", "https://bugzilla.redhat.com/show_bug.cgi?id=2481882", "https://bugzilla.redhat.com/show_bug.cgi?id=2481884", "https://bugzilla.redhat.com/show_bug.cgi?id=2481885", "https://bugzilla.redhat.com/show_bug.cgi?id=2481887", "https://bugzilla.redhat.com/show_bug.cgi?id=2481890", "https://bugzilla.redhat.com/show_bug.cgi?id=2481891", "https://bugzilla.redhat.com/show_bug.cgi?id=2481892", "https://bugzilla.redhat.com/show_bug.cgi?id=2481893", "https://bugzilla.redhat.com/show_bug.cgi?id=2481894", "https://bugzilla.redhat.com/show_bug.cgi?id=2481896", "https://bugzilla.redhat.com/show_bug.cgi?id=2481897", "https://bugzilla.redhat.com/show_bug.cgi?id=2481898", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34180", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34181", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34182", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34183", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42764", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42766", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42767", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42768", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42769", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42770", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45445", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45446", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45447", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-7383", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-9076", "https://errata.almalinux.org/9/ALSA-2026-44438.html", "https://errata.rockylinux.org/RLSA-2026:25239", "https://github.com/advisories/GHSA-f684-cpcq-j565", "https://github.com/openssl/openssl/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c", "https://github.com/openssl/openssl/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8", "https://github.com/openssl/openssl/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54", "https://github.com/openssl/openssl/commit/a541ae8bfe849a30cc885e8780715c0f488e496c", "https://github.com/openssl/openssl/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e", "https://github.com/openssl/security/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c", "https://github.com/openssl/security/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8", "https://github.com/openssl/security/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54", "https://github.com/openssl/security/commit/a541ae8bfe849a30cc885e8780715c0f488e496c", "https://github.com/openssl/security/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e", "https://linux.oracle.com/cve/CVE-2026-45447.html", "https://linux.oracle.com/errata/ELSA-2026-50379.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-45447", "https://openssl-library.org/news/secadv/20260609.txt", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45447.json", "https://ubuntu.com/security/notices/USN-8414-1", "https://ubuntu.com/security/notices/USN-8414-2", "https://www.cve.org/CVERecord?id=CVE-2026-45447" ], "PublishedDate": "2026-06-09T17:17:19.277Z", "LastModifiedDate": "2026-09-18T13:18:26.343Z" }, { "VulnerabilityID": "CVE-2026-107891", "PkgID": "musl@1.2.5-r21", "PkgName": "musl", "PkgIdentifier": { "PURL": "pkg:apk/alpine/musl@1.2.5-r21?arch=x86_64\u0026distro=3.23.3", "UID": "750ab06f52f2bfe9" }, "InstalledVersion": "1.2.5-r21", "FixedVersion": "1.2.5-r24", "Status": "fixed", "Layer": { "DiffID": "sha256:989e799e634906e94dc9a5ee2ee26fc92ad260522990f26e707861a5f52bf64e" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-107891", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:6a4563ac4caf6cfe91e71d5b150b308cd646fff877e54c3c1c978f52d2f44eed", "Title": "musl: musl: Arbitrary code execution via integer overflow in regcomp", "Description": "musl libc before 1.2.7, when an untrusted regular expression is used with regcomp, has multiple integer overflows, possibly leading to incorrect allocation sizes and out-of-bounds heap writes.", "Severity": "HIGH", "CweIDs": [ "CWE-190" ], "VendorSeverity": { "redhat": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/10/21/18", "https://access.redhat.com/security/cve/CVE-2026-107891", "https://git.musl-libc.org/cgit/musl/commit/?id=7813e9119eb5fe681b6750b8a033a0490bca0941", "https://musl.libc.org", "https://nvd.nist.gov/vuln/detail/CVE-2026-107891", "https://www.cve.org/CVERecord?id=CVE-2026-107891", "https://www.openwall.com/lists/musl/2026/10/21/1" ], "PublishedDate": "2026-11-05T16:17:32.15Z", "LastModifiedDate": "2026-11-05T17:17:35.287Z" }, { "VulnerabilityID": "CVE-2026-40200", "PkgID": "musl@1.2.5-r21", "PkgName": "musl", "PkgIdentifier": { "PURL": "pkg:apk/alpine/musl@1.2.5-r21?arch=x86_64\u0026distro=3.23.3", "UID": "750ab06f52f2bfe9" }, "InstalledVersion": "1.2.5-r21", "FixedVersion": "1.2.5-r23", "Status": "fixed", "Layer": { "DiffID": "sha256:989e799e634906e94dc9a5ee2ee26fc92ad260522990f26e707861a5f52bf64e" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-40200", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:a83e2f7858ba0c94e8fdb3eb5a9e7be015a842e220960cab627dcbaa4a566f21", "Title": "musl: musl libc: Arbitrary code execution and denial of service via stack-based memory corruption in qsort", "Description": "An issue was discovered in musl libc 0.7.10 through 1.2.6. Stack-based memory corruption can occur during qsort of very large arrays, due to incorrectly implemented double-word primitives. The number of elements must exceed about seven million, i.e., the 32nd Leonardo number on 32-bit platforms (or the 64th Leonardo number on 64-bit platforms, which is not practical).", "Severity": "HIGH", "CweIDs": [ "CWE-670" ], "VendorSeverity": { "redhat": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/04/10/13", "https://access.redhat.com/security/cve/CVE-2026-40200", "https://musl.libc.org/releases.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-40200", "https://www.cve.org/CVERecord?id=CVE-2026-40200", "https://www.openwall.com/lists/oss-security/2026/04/10/13" ], "PublishedDate": "2026-04-10T17:17:14.107Z", "LastModifiedDate": "2026-06-17T10:44:51.887Z" }, { "VulnerabilityID": "CVE-2026-107891", "PkgID": "musl-utils@1.2.5-r21", "PkgName": "musl-utils", "PkgIdentifier": { "PURL": "pkg:apk/alpine/musl-utils@1.2.5-r21?arch=x86_64\u0026distro=3.23.3", "UID": "9dadd6d4093981ad" }, "InstalledVersion": "1.2.5-r21", "FixedVersion": "1.2.5-r24", "Status": "fixed", "Layer": { "DiffID": "sha256:989e799e634906e94dc9a5ee2ee26fc92ad260522990f26e707861a5f52bf64e" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-107891", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:7fbfed4604ea1a61e2921bcc28884834ccdea710d73a1ee0b10709059e78ccca", "Title": "musl: musl: Arbitrary code execution via integer overflow in regcomp", "Description": "musl libc before 1.2.7, when an untrusted regular expression is used with regcomp, has multiple integer overflows, possibly leading to incorrect allocation sizes and out-of-bounds heap writes.", "Severity": "HIGH", "CweIDs": [ "CWE-190" ], "VendorSeverity": { "redhat": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/10/21/18", "https://access.redhat.com/security/cve/CVE-2026-107891", "https://git.musl-libc.org/cgit/musl/commit/?id=7813e9119eb5fe681b6750b8a033a0490bca0941", "https://musl.libc.org", "https://nvd.nist.gov/vuln/detail/CVE-2026-107891", "https://www.cve.org/CVERecord?id=CVE-2026-107891", "https://www.openwall.com/lists/musl/2026/10/21/1" ], "PublishedDate": "2026-11-05T16:17:32.15Z", "LastModifiedDate": "2026-11-05T17:17:35.287Z" }, { "VulnerabilityID": "CVE-2026-40200", "PkgID": "musl-utils@1.2.5-r21", "PkgName": "musl-utils", "PkgIdentifier": { "PURL": "pkg:apk/alpine/musl-utils@1.2.5-r21?arch=x86_64\u0026distro=3.23.3", "UID": "9dadd6d4093981ad" }, "InstalledVersion": "1.2.5-r21", "FixedVersion": "1.2.5-r23", "Status": "fixed", "Layer": { "DiffID": "sha256:989e799e634906e94dc9a5ee2ee26fc92ad260522990f26e707861a5f52bf64e" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-40200", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:3443bba3614a4da13eba3274926e0d7df8dc4a33546cc03d70d3edcf6675a0bd", "Title": "musl: musl libc: Arbitrary code execution and denial of service via stack-based memory corruption in qsort", "Description": "An issue was discovered in musl libc 0.7.10 through 1.2.6. Stack-based memory corruption can occur during qsort of very large arrays, due to incorrectly implemented double-word primitives. The number of elements must exceed about seven million, i.e., the 32nd Leonardo number on 32-bit platforms (or the 64th Leonardo number on 64-bit platforms, which is not practical).", "Severity": "HIGH", "CweIDs": [ "CWE-670" ], "VendorSeverity": { "redhat": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/04/10/13", "https://access.redhat.com/security/cve/CVE-2026-40200", "https://musl.libc.org/releases.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-40200", "https://www.cve.org/CVERecord?id=CVE-2026-40200", "https://www.openwall.com/lists/oss-security/2026/04/10/13" ], "PublishedDate": "2026-04-10T17:17:14.107Z", "LastModifiedDate": "2026-06-17T10:44:51.887Z" }, { "VulnerabilityID": "CVE-2026-27135", "PkgID": "nghttp2-libs@1.68.0-r0", "PkgName": "nghttp2-libs", "PkgIdentifier": { "PURL": "pkg:apk/alpine/nghttp2-libs@1.68.0-r0?arch=x86_64\u0026distro=3.23.3", "UID": "802c936f9e7891b2" }, "InstalledVersion": "1.68.0-r0", "FixedVersion": "1.68.1", "Status": "fixed", "Layer": { "DiffID": "sha256:66331502f5f6a99cd657f4ef104273d82c78207f11e9d8f5ca16e2b53d08c361" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-27135", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:2d92e26e207927da1467e74ef95eeb7eb8bd7c6cf312c415a9d20d0838b52085", "Title": "nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination", "Description": "nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. Prior to version 1.68.1, the nghttp2 library stops reading the incoming data when user facing public API `nghttp2_session_terminate_session` or `nghttp2_session_terminate_session2` is called by the application. They might be called internally by the library when it detects the situation that is subject to connection error. Due to the missing internal state validation, the library keeps reading the rest of the data after one of those APIs is called. Then receiving a malformed frame that causes FRAME_SIZE_ERROR causes assertion failure. nghttp2 v1.68.1 adds missing state validation to avoid assertion failure. No known workarounds are available.", "Severity": "HIGH", "CweIDs": [ "CWE-617" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "cbl-mariner": 3, "julia": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "julia": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/03/20/3", "https://access.redhat.com/errata/RHSA-2026:10065", "https://access.redhat.com/errata/RHSA-2026:11768", "https://access.redhat.com/errata/RHSA-2026:13812", "https://access.redhat.com/errata/RHSA-2026:14773", "https://access.redhat.com/errata/RHSA-2026:14937", "https://access.redhat.com/errata/RHSA-2026:15087", "https://access.redhat.com/errata/RHSA-2026:16008", "https://access.redhat.com/errata/RHSA-2026:16009", "https://access.redhat.com/errata/RHSA-2026:16030", "https://access.redhat.com/errata/RHSA-2026:16174", "https://access.redhat.com/errata/RHSA-2026:17596", "https://access.redhat.com/errata/RHSA-2026:19724", "https://access.redhat.com/errata/RHSA-2026:19725", "https://access.redhat.com/errata/RHSA-2026:20040", "https://access.redhat.com/errata/RHSA-2026:20087", "https://access.redhat.com/errata/RHSA-2026:21656", "https://access.redhat.com/errata/RHSA-2026:21690", "https://access.redhat.com/errata/RHSA-2026:21695", "https://access.redhat.com/errata/RHSA-2026:25096", "https://access.redhat.com/errata/RHSA-2026:27200", "https://access.redhat.com/errata/RHSA-2026:27201", "https://access.redhat.com/errata/RHSA-2026:6190", "https://access.redhat.com/errata/RHSA-2026:7080", "https://access.redhat.com/errata/RHSA-2026:7123", "https://access.redhat.com/errata/RHSA-2026:7302", "https://access.redhat.com/errata/RHSA-2026:7310", "https://access.redhat.com/errata/RHSA-2026:7350", "https://access.redhat.com/errata/RHSA-2026:7666", "https://access.redhat.com/errata/RHSA-2026:7667", "https://access.redhat.com/errata/RHSA-2026:7668", "https://access.redhat.com/errata/RHSA-2026:7670", "https://access.redhat.com/errata/RHSA-2026:7675", "https://access.redhat.com/errata/RHSA-2026:7896", "https://access.redhat.com/errata/RHSA-2026:7983", "https://access.redhat.com/errata/RHSA-2026:8339", "https://access.redhat.com/errata/RHSA-2026:8538", "https://access.redhat.com/errata/RHSA-2026:8539", "https://access.redhat.com/errata/RHSA-2026:8540", "https://access.redhat.com/errata/RHSA-2026:8541", "https://access.redhat.com/errata/RHSA-2026:8545", "https://access.redhat.com/errata/RHSA-2026:8546", "https://access.redhat.com/errata/RHSA-2026:8547", "https://access.redhat.com/errata/RHSA-2026:8548", "https://access.redhat.com/errata/RHSA-2026:8868", "https://access.redhat.com/errata/RHSA-2026:9711", "https://access.redhat.com/errata/RHSA-2026:9832", "https://access.redhat.com/errata/RHSA-2026:9874", "https://access.redhat.com/security/cve/CVE-2026-27135", "https://bugzilla.redhat.com/2441268", "https://bugzilla.redhat.com/2442922", "https://bugzilla.redhat.com/2448754", "https://bugzilla.redhat.com/2453151", "https://bugzilla.redhat.com/show_bug.cgi?id=2448754", "https://cert-portal.siemens.com/productcert/html/ssa-019113.html", "https://cert-portal.siemens.com/productcert/html/ssa-457936.html", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27135", "https://errata.almalinux.org/9/ALSA-2026-7896.html", "https://errata.rockylinux.org/RLSA-2026:7668", "https://github.com/nghttp2/nghttp2/commit/5c7df8fa815ac1004d9ecb9d1f7595c4d37f46e1", "https://github.com/nghttp2/nghttp2/security/advisories/GHSA-6933-cjhr-5qg6", "https://linux.oracle.com/cve/CVE-2026-27135.html", "https://linux.oracle.com/errata/ELSA-2026-8339.html", "https://lists.debian.org/debian-lts-announce/2026/05/msg00025.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-27135", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27135.json", "https://ubuntu.com/security/notices/USN-8233-1", "https://ubuntu.com/security/notices/USN-8233-2", "https://www.cve.org/CVERecord?id=CVE-2026-27135" ], "PublishedDate": "2026-03-18T18:16:26.723Z", "LastModifiedDate": "2026-10-15T02:18:59.883Z" }, { "VulnerabilityID": "CVE-2026-103111", "PkgID": "pcre2@10.47-r0", "PkgName": "pcre2", "PkgIdentifier": { "PURL": "pkg:apk/alpine/pcre2@10.47-r0?arch=x86_64\u0026distro=3.23.3", "UID": "84da847bec967f4e" }, "InstalledVersion": "10.47-r0", "FixedVersion": "10.49-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:66331502f5f6a99cd657f4ef104273d82c78207f11e9d8f5ca16e2b53d08c361" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-103111", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:02d9de600cb499ed4ba831f14a39f758778db3893739aac13e08c994d95b4025", "Title": "pcre2: pcre2: Out-of-bounds write via crafted regular expression", "Description": "PCRE2 before 10.49, when there is an attacker-controlled regular expression and certain JIT API usage, allows an out-of-bounds write with arbitrary data.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L", "V3Score": 7.6 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:81532", "https://access.redhat.com/security/cve/CVE-2026-103111", "https://bugzilla.redhat.com/2528993", "https://bugzilla.redhat.com/2531743", "https://bugzilla.redhat.com/2531744", "https://bugzilla.redhat.com/2531745", "https://bugzilla.redhat.com/2531746", "https://bugzilla.redhat.com/2531747", "https://bugzilla.redhat.com/2543797", "https://bugzilla.redhat.com/show_bug.cgi?id=2528993", "https://bugzilla.redhat.com/show_bug.cgi?id=2531743", "https://bugzilla.redhat.com/show_bug.cgi?id=2531744", "https://bugzilla.redhat.com/show_bug.cgi?id=2531745", "https://bugzilla.redhat.com/show_bug.cgi?id=2531746", "https://bugzilla.redhat.com/show_bug.cgi?id=2531747", "https://bugzilla.redhat.com/show_bug.cgi?id=2543797", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-103111", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86145", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89156", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89157", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89158", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89160", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89161", "https://errata.almalinux.org/9/ALSA-2026-81532.html", "https://errata.rockylinux.org/RLSA-2026:81532", "https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-r9hj-j2rw-4q3m", "https://linux.oracle.com/cve/CVE-2026-103111.html", "https://linux.oracle.com/errata/ELSA-2026-84799.html", "https://lists.debian.org/debian-lts-announce/2026/10/msg00008.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-103111", "https://ubuntu.com/security/notices/USN-8974-1", "https://www.cve.org/CVERecord?id=CVE-2026-103111" ], "PublishedDate": "2026-09-30T05:16:45.863Z", "LastModifiedDate": "2026-10-04T00:16:35.563Z" }, { "VulnerabilityID": "CVE-2026-86145", "PkgID": "pcre2@10.47-r0", "PkgName": "pcre2", "PkgIdentifier": { "PURL": "pkg:apk/alpine/pcre2@10.47-r0?arch=x86_64\u0026distro=3.23.3", "UID": "84da847bec967f4e" }, "InstalledVersion": "10.47-r0", "FixedVersion": "10.48-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:66331502f5f6a99cd657f4ef104273d82c78207f11e9d8f5ca16e2b53d08c361" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-86145", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:1ba518d4b46744871cd7e4a76bded81dbcb9e93cbb99a1340c36016e94d99d28", "Title": "pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions", "Description": "PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a size check). This outcome requires an attacker-controlled regular expression, or a recursive pattern in conjunction with a small heap limit (this can be set through the API).", "Severity": "HIGH", "CweIDs": [ "CWE-424" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "bottlerocket": 2, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L", "V3Score": 8.2 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86145", "http://www.openwall.com/lists/oss-security/2026/09/05/3", "https://access.redhat.com/errata/RHSA-2026:81532", "https://access.redhat.com/security/cve/CVE-2026-86145", "https://bugzilla.redhat.com/2528993", "https://bugzilla.redhat.com/2531743", "https://bugzilla.redhat.com/2531744", "https://bugzilla.redhat.com/2531745", "https://bugzilla.redhat.com/2531746", "https://bugzilla.redhat.com/2531747", "https://bugzilla.redhat.com/2543797", "https://bugzilla.redhat.com/show_bug.cgi?id=2528993", "https://bugzilla.redhat.com/show_bug.cgi?id=2531743", "https://bugzilla.redhat.com/show_bug.cgi?id=2531744", "https://bugzilla.redhat.com/show_bug.cgi?id=2531745", "https://bugzilla.redhat.com/show_bug.cgi?id=2531746", "https://bugzilla.redhat.com/show_bug.cgi?id=2531747", "https://bugzilla.redhat.com/show_bug.cgi?id=2543797", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-103111", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86145", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89156", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89157", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89158", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89160", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89161", "https://errata.almalinux.org/9/ALSA-2026-81532.html", "https://errata.rockylinux.org/RLSA-2026:81532", "https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48", "https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-3r4p-g7gg-ppmf", "https://github.com/bottlerocket-os/bottlerocket-core-kit/blob/develop/advisories/17.1.0/BRSA-xqvt0yt0g9rb.toml", "https://github.com/bottlerocket-os/bottlerocket/security/advisories/GHSA-3r4p-g7gg-ppmf", "https://linux.oracle.com/cve/CVE-2026-86145.html", "https://linux.oracle.com/errata/ELSA-2026-84799.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-86145", "https://ubuntu.com/security/notices/USN-8974-1", "https://www.cve.org/CVERecord?id=CVE-2026-86145" ], "PublishedDate": "2026-09-05T06:17:10.37Z", "LastModifiedDate": "2026-09-09T16:04:24.933Z" }, { "VulnerabilityID": "CVE-2026-89157", "PkgID": "pcre2@10.47-r0", "PkgName": "pcre2", "PkgIdentifier": { "PURL": "pkg:apk/alpine/pcre2@10.47-r0?arch=x86_64\u0026distro=3.23.3", "UID": "84da847bec967f4e" }, "InstalledVersion": "10.47-r0", "FixedVersion": "10.48-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:66331502f5f6a99cd657f4ef104273d82c78207f11e9d8f5ca16e2b53d08c361" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-89157", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:ed8d07b32a55e12af3e84aebfcd0bc3e3583283c28b6313eb23612b7f3240450", "Title": "pcre2: PCRE2: Out-of-bounds write via large pattern input", "Description": "PCRE2 before 10.48, on 32-bit platforms, has a pcre2_pattern_convert out-of-bounds write when an attacker can provide a large pattern.", "Severity": "HIGH", "CweIDs": [ "CWE-190" ], "VendorSeverity": { "alma": 3, "azure": 2, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "rocky": 3, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H", "V3Score": 7.4 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L", "V3Score": 5.7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:81532", "https://access.redhat.com/security/cve/CVE-2026-89157", "https://bugzilla.redhat.com/2528993", "https://bugzilla.redhat.com/2531743", "https://bugzilla.redhat.com/2531744", "https://bugzilla.redhat.com/2531745", "https://bugzilla.redhat.com/2531746", "https://bugzilla.redhat.com/2531747", "https://bugzilla.redhat.com/2543797", "https://bugzilla.redhat.com/show_bug.cgi?id=2528993", "https://bugzilla.redhat.com/show_bug.cgi?id=2531743", "https://bugzilla.redhat.com/show_bug.cgi?id=2531744", "https://bugzilla.redhat.com/show_bug.cgi?id=2531745", "https://bugzilla.redhat.com/show_bug.cgi?id=2531746", "https://bugzilla.redhat.com/show_bug.cgi?id=2531747", "https://bugzilla.redhat.com/show_bug.cgi?id=2543797", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-103111", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86145", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89156", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89157", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89158", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89160", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89161", "https://errata.almalinux.org/9/ALSA-2026-81532.html", "https://errata.rockylinux.org/RLSA-2026:81532", "https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48", "https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-q8g2-wprr-34m9", "https://linux.oracle.com/cve/CVE-2026-89157.html", "https://linux.oracle.com/errata/ELSA-2026-81613.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-89157", "https://ubuntu.com/security/notices/USN-8974-1", "https://www.cve.org/CVERecord?id=CVE-2026-89157" ], "PublishedDate": "2026-09-11T04:18:03.753Z", "LastModifiedDate": "2026-09-16T19:25:08.88Z" }, { "VulnerabilityID": "CVE-2026-89161", "PkgID": "pcre2@10.47-r0", "PkgName": "pcre2", "PkgIdentifier": { "PURL": "pkg:apk/alpine/pcre2@10.47-r0?arch=x86_64\u0026distro=3.23.3", "UID": "84da847bec967f4e" }, "InstalledVersion": "10.47-r0", "FixedVersion": "10.48-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:66331502f5f6a99cd657f4ef104273d82c78207f11e9d8f5ca16e2b53d08c361" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-89161", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:2b43fd15f91803aa86fabbe03b26206b594a8006fe0798872e53b8a767a7400f", "Title": "pcre2: PCRE2: Memory corruption vulnerability in pcre2_jit_match", "Description": "In PCRE2 before 10.48, pcre2_jit_match mishandles a previously copied subject being passed in as a context. An incorrect free operation can occur.", "Severity": "HIGH", "CweIDs": [ "CWE-590" ], "VendorSeverity": { "alma": 3, "amazon": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.4 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:81532", "https://access.redhat.com/security/cve/CVE-2026-89161", "https://bugzilla.redhat.com/2528993", "https://bugzilla.redhat.com/2531743", "https://bugzilla.redhat.com/2531744", "https://bugzilla.redhat.com/2531745", "https://bugzilla.redhat.com/2531746", "https://bugzilla.redhat.com/2531747", "https://bugzilla.redhat.com/2543797", "https://bugzilla.redhat.com/show_bug.cgi?id=2528993", "https://bugzilla.redhat.com/show_bug.cgi?id=2531743", "https://bugzilla.redhat.com/show_bug.cgi?id=2531744", "https://bugzilla.redhat.com/show_bug.cgi?id=2531745", "https://bugzilla.redhat.com/show_bug.cgi?id=2531746", "https://bugzilla.redhat.com/show_bug.cgi?id=2531747", "https://bugzilla.redhat.com/show_bug.cgi?id=2543797", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-103111", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86145", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89156", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89157", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89158", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89160", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89161", "https://errata.almalinux.org/9/ALSA-2026-81532.html", "https://errata.rockylinux.org/RLSA-2026:81532", "https://github.com/PCRE2Project/pcre2/commit/1dcd0cf42a6a7cb62cc9a7c024196733abcfda95%20%28pcre2-10.48-RC1%29", "https://github.com/PCRE2Project/pcre2/pull/937", "https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48", "https://linux.oracle.com/cve/CVE-2026-89161.html", "https://linux.oracle.com/errata/ELSA-2026-84799.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-89161", "https://ubuntu.com/security/notices/USN-8974-1", "https://www.cve.org/CVERecord?id=CVE-2026-89161" ], "PublishedDate": "2026-09-11T04:18:04.47Z", "LastModifiedDate": "2026-09-16T19:10:47.78Z" }, { "VulnerabilityID": "CVE-2026-22184", "PkgID": "zlib@1.3.1-r2", "PkgName": "zlib", "PkgIdentifier": { "PURL": "pkg:apk/alpine/zlib@1.3.1-r2?arch=x86_64\u0026distro=3.23.3", "UID": "792cdc69bc59d880" }, "InstalledVersion": "1.3.1-r2", "FixedVersion": "1.3.2-r0", "Status": "fixed", "Layer": { "DiffID": "sha256:989e799e634906e94dc9a5ee2ee26fc92ad260522990f26e707861a5f52bf64e" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-22184", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:7abc18ce74e6a0871a13946ddb3d53acafd47f07ea5f70070f59930b8a5f4711", "Title": "zlib: zlib: Arbitrary code execution via buffer overflow in untgz utility", "Description": "zlib versions up to and including 1.3.1.2 include a global buffer overflow in the untgz utility located under contrib/untgz. The vulnerability is limited to the standalone demonstration utility and does not affect the core zlib compression library. The flaw occurs when a user executes the untgz command with an excessively long archive name supplied via the command line, leading to an out-of-bounds write in a fixed-size global buffer.", "Severity": "HIGH", "CweIDs": [ "CWE-787", "CWE-120" ], "VendorSeverity": { "nvd": 3, "redhat": 3 }, "CVSS": { "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H", "V3Score": 8.6 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-22184", "https://bugzilla.redhat.com/show_bug.cgi?id=2427688", "https://cert-portal.siemens.com/productcert/html/ssa-470355.html", "https://github.com/madler/zlib", "https://github.com/madler/zlib/issues/1142", "https://nvd.nist.gov/vuln/detail/CVE-2026-22184", "https://seclists.org/fulldisclosure/2026/Jan/3", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-22184.json", "https://www.cve.org/CVERecord?id=CVE-2026-22184", "https://www.vulncheck.com/advisories/zlib-untgz-global-buffer-overflow-in-tgzfname", "https://zlib.net/" ], "PublishedDate": "2026-01-07T21:16:01.563Z", "LastModifiedDate": "2026-09-01T13:18:19.867Z" }, { "VulnerabilityID": "CVE-2026-85091", "PkgID": "zlib@1.3.1-r2", "PkgName": "zlib", "PkgIdentifier": { "PURL": "pkg:apk/alpine/zlib@1.3.1-r2?arch=x86_64\u0026distro=3.23.3", "UID": "792cdc69bc59d880" }, "InstalledVersion": "1.3.1-r2", "FixedVersion": "1.3.2-r1", "Status": "fixed", "Layer": { "DiffID": "sha256:989e799e634906e94dc9a5ee2ee26fc92ad260522990f26e707861a5f52bf64e" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-85091", "DataSource": { "ID": "alpine", "Name": "Alpine Secdb", "URL": "https://secdb.alpinelinux.org/" }, "Fingerprint": "sha256:03526792efc804fcec8d56cef63dfed8dd7045f921ba4ff7119a58bfcd4c0cc3", "Title": "zlib: zlib: Heap buffer overflow in gz_vacate() allows arbitrary code execution", "Description": "zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "azure": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-85091", "https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490", "https://github.com/madler/zlib", "https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393", "https://nvd.nist.gov/vuln/detail/CVE-2026-85091", "https://ubuntu.com/security/notices/USN-8954-1", "https://www.cve.org/CVERecord?id=CVE-2026-85091", "https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate" ], "PublishedDate": "2026-09-03T13:06:20.573Z", "LastModifiedDate": "2026-09-09T20:41:07.123Z" } ] }, { "Target": "usr/local/bin/supercronic", "Class": "lang-pkgs", "Type": "gobinary", "Packages": [ { "ID": "github.com/aptible/supercronic@v0.2.33", "Name": "github.com/aptible/supercronic", "Identifier": { "PURL": "pkg:golang/github.com/aptible/supercronic@v0.2.33", "UID": "fc5f7cb477bf9be" }, "Version": "v0.2.33", "Relationship": "root", "DependsOn": [ "github.com/beorn7/perks@v1.0.1", "github.com/certifi/gocertifi@v0.0.0-20210507211836-431795d63e8d", "github.com/cespare/xxhash/v2@v2.3.0", "github.com/evalphobia/logrus_sentry@v0.8.2", "github.com/fsnotify/fsnotify@v1.7.0", "github.com/getsentry/raven-go@v0.2.0", "github.com/klauspost/compress@v1.17.9", "github.com/munnerz/goautoneg@v0.0.0-20191010083416-a7dc8b61c822", "github.com/pkg/errors@v0.9.1", "github.com/prometheus/client_golang@v1.20.2", "github.com/prometheus/client_model@v0.6.1", "github.com/prometheus/common@v0.57.0", "github.com/prometheus/procfs@v0.15.1", "github.com/sirupsen/logrus@v1.9.3", "golang.org/x/sys@v0.24.0", "google.golang.org/protobuf@v1.34.2", "stdlib@v1.23.1" ], "Layer": { "DiffID": "sha256:3c2b2a22a8b623353d36ffdd442d8f955bc91ae69a99ca6776da39ecd6014a4d" }, "AnalyzedBy": "gobinary" }, { "ID": "stdlib@v1.23.1", "Name": "stdlib", "Identifier": { "PURL": "pkg:golang/stdlib@v1.23.1", "UID": "b5bc065575324e13" }, "Version": "v1.23.1", "Relationship": "direct", "Layer": { "DiffID": "sha256:3c2b2a22a8b623353d36ffdd442d8f955bc91ae69a99ca6776da39ecd6014a4d" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/beorn7/perks@v1.0.1", "Name": "github.com/beorn7/perks", "Identifier": { "PURL": "pkg:golang/github.com/beorn7/perks@v1.0.1", "UID": "97156baddcb4d017" }, "Version": "v1.0.1", "Layer": { "DiffID": "sha256:3c2b2a22a8b623353d36ffdd442d8f955bc91ae69a99ca6776da39ecd6014a4d" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/certifi/gocertifi@v0.0.0-20210507211836-431795d63e8d", "Name": "github.com/certifi/gocertifi", "Identifier": { "PURL": "pkg:golang/github.com/certifi/gocertifi@v0.0.0-20210507211836-431795d63e8d", "UID": "5822aed6e2646b5c" }, "Version": "v0.0.0-20210507211836-431795d63e8d", "Layer": { "DiffID": "sha256:3c2b2a22a8b623353d36ffdd442d8f955bc91ae69a99ca6776da39ecd6014a4d" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/cespare/xxhash/v2@v2.3.0", "Name": "github.com/cespare/xxhash/v2", "Identifier": { "PURL": "pkg:golang/github.com/cespare/xxhash/v2@v2.3.0", "UID": "f3c413caf25245d6" }, "Version": "v2.3.0", "Layer": { "DiffID": "sha256:3c2b2a22a8b623353d36ffdd442d8f955bc91ae69a99ca6776da39ecd6014a4d" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/evalphobia/logrus_sentry@v0.8.2", "Name": "github.com/evalphobia/logrus_sentry", "Identifier": { "PURL": "pkg:golang/github.com/evalphobia/logrus_sentry@v0.8.2", "UID": "b5326f1546c22155" }, "Version": "v0.8.2", "Layer": { "DiffID": "sha256:3c2b2a22a8b623353d36ffdd442d8f955bc91ae69a99ca6776da39ecd6014a4d" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/fsnotify/fsnotify@v1.7.0", "Name": "github.com/fsnotify/fsnotify", "Identifier": { "PURL": "pkg:golang/github.com/fsnotify/fsnotify@v1.7.0", "UID": "f7c4f67334db18cc" }, "Version": "v1.7.0", "Layer": { "DiffID": "sha256:3c2b2a22a8b623353d36ffdd442d8f955bc91ae69a99ca6776da39ecd6014a4d" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/getsentry/raven-go@v0.2.0", "Name": "github.com/getsentry/raven-go", "Identifier": { "PURL": "pkg:golang/github.com/getsentry/raven-go@v0.2.0", "UID": "368e01fd98ac73d7" }, "Version": "v0.2.0", "Layer": { "DiffID": "sha256:3c2b2a22a8b623353d36ffdd442d8f955bc91ae69a99ca6776da39ecd6014a4d" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/klauspost/compress@v1.17.9", "Name": "github.com/klauspost/compress", "Identifier": { "PURL": "pkg:golang/github.com/klauspost/compress@v1.17.9", "UID": "94d31ae6230f7c2d" }, "Version": "v1.17.9", "Layer": { "DiffID": "sha256:3c2b2a22a8b623353d36ffdd442d8f955bc91ae69a99ca6776da39ecd6014a4d" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/munnerz/goautoneg@v0.0.0-20191010083416-a7dc8b61c822", "Name": "github.com/munnerz/goautoneg", "Identifier": { "PURL": "pkg:golang/github.com/munnerz/goautoneg@v0.0.0-20191010083416-a7dc8b61c822", "UID": "68a3575abc03f657" }, "Version": "v0.0.0-20191010083416-a7dc8b61c822", "Layer": { "DiffID": "sha256:3c2b2a22a8b623353d36ffdd442d8f955bc91ae69a99ca6776da39ecd6014a4d" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/pkg/errors@v0.9.1", "Name": "github.com/pkg/errors", "Identifier": { "PURL": "pkg:golang/github.com/pkg/errors@v0.9.1", "UID": "27a0707276f4d879" }, "Version": "v0.9.1", "Layer": { "DiffID": "sha256:3c2b2a22a8b623353d36ffdd442d8f955bc91ae69a99ca6776da39ecd6014a4d" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/prometheus/client_golang@v1.20.2", "Name": "github.com/prometheus/client_golang", "Identifier": { "PURL": "pkg:golang/github.com/prometheus/client_golang@v1.20.2", "UID": "c7da7d92e2f1036d" }, "Version": "v1.20.2", "Layer": { "DiffID": "sha256:3c2b2a22a8b623353d36ffdd442d8f955bc91ae69a99ca6776da39ecd6014a4d" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/prometheus/client_model@v0.6.1", "Name": "github.com/prometheus/client_model", "Identifier": { "PURL": "pkg:golang/github.com/prometheus/client_model@v0.6.1", "UID": "3d905024974a2aa1" }, "Version": "v0.6.1", "Layer": { "DiffID": "sha256:3c2b2a22a8b623353d36ffdd442d8f955bc91ae69a99ca6776da39ecd6014a4d" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/prometheus/common@v0.57.0", "Name": "github.com/prometheus/common", "Identifier": { "PURL": "pkg:golang/github.com/prometheus/common@v0.57.0", "UID": "6fa126f7ad500d8d" }, "Version": "v0.57.0", "Layer": { "DiffID": "sha256:3c2b2a22a8b623353d36ffdd442d8f955bc91ae69a99ca6776da39ecd6014a4d" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/prometheus/procfs@v0.15.1", "Name": "github.com/prometheus/procfs", "Identifier": { "PURL": "pkg:golang/github.com/prometheus/procfs@v0.15.1", "UID": "93b3cf3df4777006" }, "Version": "v0.15.1", "Layer": { "DiffID": "sha256:3c2b2a22a8b623353d36ffdd442d8f955bc91ae69a99ca6776da39ecd6014a4d" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/sirupsen/logrus@v1.9.3", "Name": "github.com/sirupsen/logrus", "Identifier": { "PURL": "pkg:golang/github.com/sirupsen/logrus@v1.9.3", "UID": "19866eca5813342b" }, "Version": "v1.9.3", "Layer": { "DiffID": "sha256:3c2b2a22a8b623353d36ffdd442d8f955bc91ae69a99ca6776da39ecd6014a4d" }, "AnalyzedBy": "gobinary" }, { "ID": "golang.org/x/sys@v0.24.0", "Name": "golang.org/x/sys", "Identifier": { "PURL": "pkg:golang/golang.org/x/sys@v0.24.0", "UID": "3fa2b9ddeadb9e4e" }, "Version": "v0.24.0", "Layer": { "DiffID": "sha256:3c2b2a22a8b623353d36ffdd442d8f955bc91ae69a99ca6776da39ecd6014a4d" }, "AnalyzedBy": "gobinary" }, { "ID": "google.golang.org/protobuf@v1.34.2", "Name": "google.golang.org/protobuf", "Identifier": { "PURL": "pkg:golang/google.golang.org/protobuf@v1.34.2", "UID": "f1f14adb80c09ce0" }, "Version": "v1.34.2", "Layer": { "DiffID": "sha256:3c2b2a22a8b623353d36ffdd442d8f955bc91ae69a99ca6776da39ecd6014a4d" }, "AnalyzedBy": "gobinary" } ], "Vulnerabilities": [ { "VulnerabilityID": "CVE-2026-63209", "VendorIDs": [ "GHSA-259r-337f-4rfw" ], "PkgID": "github.com/klauspost/compress@v1.17.9", "PkgName": "github.com/klauspost/compress", "PkgIdentifier": { "PURL": "pkg:golang/github.com/klauspost/compress@v1.17.9", "UID": "94d31ae6230f7c2d" }, "InstalledVersion": "v1.17.9", "FixedVersion": "1.18.7", "Status": "fixed", "Layer": { "DiffID": "sha256:3c2b2a22a8b623353d36ffdd442d8f955bc91ae69a99ca6776da39ecd6014a4d" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-63209", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory Go", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Ago" }, "Fingerprint": "sha256:df1b53ba82e496d39f6d79c7323cffb09df552d425241034b93027e07fcc5b76", "Title": "github.com/klauspost/compress: klauspost/compress: Denial of Service via integer overflow in dictionary processing", "Description": "compress provides various compression algorithms. Prior to version 1.18.7, a signed integer overflow vulnerability in s2.NewDict() allows an attacker to bypass repeat index validation by supplying a dictionary with a uvarint-encoded repeat value exceeding MaxInt64. When Dict.Encode() is subsequently called, the overflowed negative repeat value causes an out-of-bounds memory access via unsafe.Pointer arithmetic, crashing the process with SIGSEGV. This issue has been patched in version 1.18.7.", "Severity": "HIGH", "CweIDs": [ "CWE-190", "CWE-787" ], "VendorSeverity": { "ghsa": 3, "redhat": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-63209", "https://github.com/klauspost/compress", "https://github.com/klauspost/compress/commit/539243b8823ee8f03e49969823d57c348c917536", "https://github.com/klauspost/compress/commit/8668e357e776d5152ed62f33c17f21b8690664fa", "https://github.com/klauspost/compress/pull/1163", "https://github.com/klauspost/compress/releases/tag/v1.18.7", "https://github.com/klauspost/compress/security/advisories/GHSA-259r-337f-4rfw", "https://nvd.nist.gov/vuln/detail/CVE-2026-63209", "https://www.cve.org/CVERecord?id=CVE-2026-63209" ], "PublishedDate": "2026-09-29T15:17:27.13Z", "LastModifiedDate": "2026-09-30T19:57:08.043Z" }, { "VulnerabilityID": "CVE-2025-68121", "VendorIDs": [ "GO-2026-4337" ], "PkgID": "stdlib@v1.23.1", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.23.1", "UID": "b5bc065575324e13" }, "InstalledVersion": "v1.23.1", "FixedVersion": "1.24.13, 1.25.7, 1.26.0-rc.3", "Status": "fixed", "Layer": { "DiffID": "sha256:3c2b2a22a8b623353d36ffdd442d8f955bc91ae69a99ca6776da39ecd6014a4d" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-68121", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:98d627f0c2671aca871be557db95dfa0e73126137111a52800c1461f81f686f3", "Title": "crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption", "Description": "During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed handshake may succeed when it should have failed. This may happen when a user calls Config.Clone and mutates the returned Config, or uses Config.GetConfigForClient. This can cause a client to resume a session with a server that it would not have resumed with during the initial handshake, or cause a server to resume a session with a client that it would not have resumed with during the initial handshake.", "Severity": "CRITICAL", "CweIDs": [ "CWE-295" ], "VendorSeverity": { "alma": 3, "amazon": 2, "azure": 2, "bitnami": 4, "cbl-mariner": 2, "nvd": 4, "oracle-oval": 3, "photon": 4, "redhat": 2, "rocky": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "V3Score": 9.1 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "V3Score": 10 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "V3Score": 7.4 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:4177", "https://access.redhat.com/security/cve/CVE-2025-68121", "https://bugzilla.redhat.com/2434432", "https://bugzilla.redhat.com/2437111", "https://bugzilla.redhat.com/show_bug.cgi?id=2434432", "https://bugzilla.redhat.com/show_bug.cgi?id=2437111", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-61726", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68121", "https://errata.almalinux.org/9/ALSA-2026-4177.html", "https://errata.rockylinux.org/RLSA-2026:4177", "https://github.com/golang/go/issues/77113", "https://go.dev/cl/737700", "https://go.dev/issue/77217", "https://groups.google.com/g/golang-announce/c/K09ubi9FQFk", "https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc", "https://linux.oracle.com/cve/CVE-2025-68121.html", "https://linux.oracle.com/errata/ELSA-2026-5146.html", "https://nvd.nist.gov/vuln/detail/CVE-2025-68121", "https://pkg.go.dev/vuln/GO-2026-4337", "https://www.cve.org/CVERecord?id=CVE-2025-68121" ], "PublishedDate": "2026-02-05T18:16:10.857Z", "LastModifiedDate": "2026-06-17T09:58:33.833Z" }, { "VulnerabilityID": "CVE-2025-61726", "VendorIDs": [ "GO-2026-4341" ], "PkgID": "stdlib@v1.23.1", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.23.1", "UID": "b5bc065575324e13" }, "InstalledVersion": "v1.23.1", "FixedVersion": "1.24.12, 1.25.6", "Status": "fixed", "Layer": { "DiffID": "sha256:3c2b2a22a8b623353d36ffdd442d8f955bc91ae69a99ca6776da39ecd6014a4d" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-61726", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:0c7c6f053ad1735249022fa1b74e9360306dee1b16600f2afb17f9af6cf78a37", "Title": "golang: net/url: Memory exhaustion in query parameter parsing in net/url", "Description": "The net/url package does not set a limit on the number of query parameters in a query. While the maximum size of query parameters in URLs is generally limited by the maximum request header size, the net/http.Request.ParseForm method can parse large URL-encoded forms. Parsing a large form containing many unique query parameters can cause excessive memory consumption.", "Severity": "HIGH", "CweIDs": [ "CWE-770" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "bitnami": 3, "cbl-mariner": 2, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:10096", "https://access.redhat.com/errata/RHSA-2026:10104", "https://access.redhat.com/errata/RHSA-2026:10184", "https://access.redhat.com/errata/RHSA-2026:10225", "https://access.redhat.com/errata/RHSA-2026:10250", "https://access.redhat.com/errata/RHSA-2026:11408", "https://access.redhat.com/errata/RHSA-2026:11414", "https://access.redhat.com/errata/RHSA-2026:11747", "https://access.redhat.com/errata/RHSA-2026:11749", "https://access.redhat.com/errata/RHSA-2026:12028", "https://access.redhat.com/errata/RHSA-2026:12029", "https://access.redhat.com/errata/RHSA-2026:12030", "https://access.redhat.com/errata/RHSA-2026:12031", "https://access.redhat.com/errata/RHSA-2026:12032", "https://access.redhat.com/errata/RHSA-2026:12033", "https://access.redhat.com/errata/RHSA-2026:12279", "https://access.redhat.com/errata/RHSA-2026:12282", "https://access.redhat.com/errata/RHSA-2026:13542", "https://access.redhat.com/errata/RHSA-2026:13548", "https://access.redhat.com/errata/RHSA-2026:13571", "https://access.redhat.com/errata/RHSA-2026:14100", "https://access.redhat.com/errata/RHSA-2026:14774", "https://access.redhat.com/errata/RHSA-2026:14868", "https://access.redhat.com/errata/RHSA-2026:14879", "https://access.redhat.com/errata/RHSA-2026:15091", "https://access.redhat.com/errata/RHSA-2026:15984", "https://access.redhat.com/errata/RHSA-2026:16102", "https://access.redhat.com/errata/RHSA-2026:16696", "https://access.redhat.com/errata/RHSA-2026:17040", "https://access.redhat.com/errata/RHSA-2026:17084", "https://access.redhat.com/errata/RHSA-2026:17446", "https://access.redhat.com/errata/RHSA-2026:17460", "https://access.redhat.com/errata/RHSA-2026:17463", "https://access.redhat.com/errata/RHSA-2026:17468", "https://access.redhat.com/errata/RHSA-2026:17595", "https://access.redhat.com/errata/RHSA-2026:17598", "https://access.redhat.com/errata/RHSA-2026:18913", "https://access.redhat.com/errata/RHSA-2026:19013", "https://access.redhat.com/errata/RHSA-2026:19132", "https://access.redhat.com/errata/RHSA-2026:19375", "https://access.redhat.com/errata/RHSA-2026:19634", "https://access.redhat.com/errata/RHSA-2026:19712", "https://access.redhat.com/errata/RHSA-2026:20041", "https://access.redhat.com/errata/RHSA-2026:21017", "https://access.redhat.com/errata/RHSA-2026:21657", "https://access.redhat.com/errata/RHSA-2026:21691", "https://access.redhat.com/errata/RHSA-2026:22450", "https://access.redhat.com/errata/RHSA-2026:22627", "https://access.redhat.com/errata/RHSA-2026:22714", "https://access.redhat.com/errata/RHSA-2026:22937", "https://access.redhat.com/errata/RHSA-2026:23228", "https://access.redhat.com/errata/RHSA-2026:23361", "https://access.redhat.com/errata/RHSA-2026:24977", "https://access.redhat.com/errata/RHSA-2026:25089", "https://access.redhat.com/errata/RHSA-2026:25127", "https://access.redhat.com/errata/RHSA-2026:25248", "https://access.redhat.com/errata/RHSA-2026:25250", "https://access.redhat.com/errata/RHSA-2026:25251", "https://access.redhat.com/errata/RHSA-2026:25252", "https://access.redhat.com/errata/RHSA-2026:25253", "https://access.redhat.com/errata/RHSA-2026:26420", "https://access.redhat.com/errata/RHSA-2026:26527", "https://access.redhat.com/errata/RHSA-2026:26541", "https://access.redhat.com/errata/RHSA-2026:26636", "https://access.redhat.com/errata/RHSA-2026:2681", "https://access.redhat.com/errata/RHSA-2026:2706", "https://access.redhat.com/errata/RHSA-2026:2708", "https://access.redhat.com/errata/RHSA-2026:2709", "https://access.redhat.com/errata/RHSA-2026:2754", "https://access.redhat.com/errata/RHSA-2026:28047", "https://access.redhat.com/errata/RHSA-2026:2844", "https://access.redhat.com/errata/RHSA-2026:28441", "https://access.redhat.com/errata/RHSA-2026:28886", "https://access.redhat.com/errata/RHSA-2026:28961", "https://access.redhat.com/errata/RHSA-2026:2914", "https://access.redhat.com/errata/RHSA-2026:2920", "https://access.redhat.com/errata/RHSA-2026:3035", "https://access.redhat.com/errata/RHSA-2026:3040", "https://access.redhat.com/errata/RHSA-2026:3089", "https://access.redhat.com/errata/RHSA-2026:3092", "https://access.redhat.com/errata/RHSA-2026:3184", "https://access.redhat.com/errata/RHSA-2026:3186", "https://access.redhat.com/errata/RHSA-2026:3187", "https://access.redhat.com/errata/RHSA-2026:3188", "https://access.redhat.com/errata/RHSA-2026:3192", "https://access.redhat.com/errata/RHSA-2026:3193", "https://access.redhat.com/errata/RHSA-2026:3291", "https://access.redhat.com/errata/RHSA-2026:3296", "https://access.redhat.com/errata/RHSA-2026:3297", "https://access.redhat.com/errata/RHSA-2026:3298", "https://access.redhat.com/errata/RHSA-2026:3336", "https://access.redhat.com/errata/RHSA-2026:3337", "https://access.redhat.com/errata/RHSA-2026:3340", "https://access.redhat.com/errata/RHSA-2026:3341", "https://access.redhat.com/errata/RHSA-2026:3343", "https://access.redhat.com/errata/RHSA-2026:3391", "https://access.redhat.com/errata/RHSA-2026:3416", "https://access.redhat.com/errata/RHSA-2026:3427", "https://access.redhat.com/errata/RHSA-2026:3459", "https://access.redhat.com/errata/RHSA-2026:3468", "https://access.redhat.com/errata/RHSA-2026:3469", "https://access.redhat.com/errata/RHSA-2026:3470", "https://access.redhat.com/errata/RHSA-2026:3471", "https://access.redhat.com/errata/RHSA-2026:3472", "https://access.redhat.com/errata/RHSA-2026:3473", "https://access.redhat.com/errata/RHSA-2026:3489", "https://access.redhat.com/errata/RHSA-2026:3506", "https://access.redhat.com/errata/RHSA-2026:3556", "https://access.redhat.com/errata/RHSA-2026:3559", "https://access.redhat.com/errata/RHSA-2026:3668", "https://access.redhat.com/errata/RHSA-2026:3669", "https://access.redhat.com/errata/RHSA-2026:36873", "https://access.redhat.com/errata/RHSA-2026:36882", "https://access.redhat.com/errata/RHSA-2026:3699", "https://access.redhat.com/errata/RHSA-2026:3713", "https://access.redhat.com/errata/RHSA-2026:37275", "https://access.redhat.com/errata/RHSA-2026:3752", "https://access.redhat.com/errata/RHSA-2026:3753", "https://access.redhat.com/errata/RHSA-2026:3782", "https://access.redhat.com/errata/RHSA-2026:3812", "https://access.redhat.com/errata/RHSA-2026:3813", "https://access.redhat.com/errata/RHSA-2026:3814", "https://access.redhat.com/errata/RHSA-2026:3815", "https://access.redhat.com/errata/RHSA-2026:3816", "https://access.redhat.com/errata/RHSA-2026:3817", "https://access.redhat.com/errata/RHSA-2026:3818", "https://access.redhat.com/errata/RHSA-2026:3820", "https://access.redhat.com/errata/RHSA-2026:3821", "https://access.redhat.com/errata/RHSA-2026:3822", "https://access.redhat.com/errata/RHSA-2026:3831", "https://access.redhat.com/errata/RHSA-2026:3833", "https://access.redhat.com/errata/RHSA-2026:3835", "https://access.redhat.com/errata/RHSA-2026:3836", "https://access.redhat.com/errata/RHSA-2026:3838", "https://access.redhat.com/errata/RHSA-2026:3839", "https://access.redhat.com/errata/RHSA-2026:3840", "https://access.redhat.com/errata/RHSA-2026:3841", "https://access.redhat.com/errata/RHSA-2026:3843", "https://access.redhat.com/errata/RHSA-2026:3854", "https://access.redhat.com/errata/RHSA-2026:3855", "https://access.redhat.com/errata/RHSA-2026:3856", "https://access.redhat.com/errata/RHSA-2026:3864", "https://access.redhat.com/errata/RHSA-2026:3869", "https://access.redhat.com/errata/RHSA-2026:3874", "https://access.redhat.com/errata/RHSA-2026:3875", "https://access.redhat.com/errata/RHSA-2026:3879", "https://access.redhat.com/errata/RHSA-2026:3880", "https://access.redhat.com/errata/RHSA-2026:3884", "https://access.redhat.com/errata/RHSA-2026:3898", "https://access.redhat.com/errata/RHSA-2026:3905", "https://access.redhat.com/errata/RHSA-2026:3906", "https://access.redhat.com/errata/RHSA-2026:3928", "https://access.redhat.com/errata/RHSA-2026:3929", "https://access.redhat.com/errata/RHSA-2026:3930", "https://access.redhat.com/errata/RHSA-2026:3931", "https://access.redhat.com/errata/RHSA-2026:3932", "https://access.redhat.com/errata/RHSA-2026:3958", "https://access.redhat.com/errata/RHSA-2026:3959", "https://access.redhat.com/errata/RHSA-2026:3960", "https://access.redhat.com/errata/RHSA-2026:3970", "https://access.redhat.com/errata/RHSA-2026:3971", "https://access.redhat.com/errata/RHSA-2026:3972", "https://access.redhat.com/errata/RHSA-2026:3973", "https://access.redhat.com/errata/RHSA-2026:3974", "https://access.redhat.com/errata/RHSA-2026:3977", "https://access.redhat.com/errata/RHSA-2026:39810", "https://access.redhat.com/errata/RHSA-2026:3985", "https://access.redhat.com/errata/RHSA-2026:40924", "https://access.redhat.com/errata/RHSA-2026:4164", "https://access.redhat.com/errata/RHSA-2026:4166", "https://access.redhat.com/errata/RHSA-2026:4170", "https://access.redhat.com/errata/RHSA-2026:4174", "https://access.redhat.com/errata/RHSA-2026:4177", "https://access.redhat.com/errata/RHSA-2026:41928", "https://access.redhat.com/errata/RHSA-2026:41941", "https://access.redhat.com/errata/RHSA-2026:4211", "https://access.redhat.com/errata/RHSA-2026:4220", "https://access.redhat.com/errata/RHSA-2026:4256", "https://access.redhat.com/errata/RHSA-2026:4264", "https://access.redhat.com/errata/RHSA-2026:4267", "https://access.redhat.com/errata/RHSA-2026:4270", "https://access.redhat.com/errata/RHSA-2026:4276", "https://access.redhat.com/errata/RHSA-2026:4434", "https://access.redhat.com/errata/RHSA-2026:4435", "https://access.redhat.com/errata/RHSA-2026:4460", "https://access.redhat.com/errata/RHSA-2026:4466", "https://access.redhat.com/errata/RHSA-2026:4467", "https://access.redhat.com/errata/RHSA-2026:4498", "https://access.redhat.com/errata/RHSA-2026:4500", "https://access.redhat.com/errata/RHSA-2026:4510", "https://access.redhat.com/errata/RHSA-2026:4511", "https://access.redhat.com/errata/RHSA-2026:4672", "https://access.redhat.com/errata/RHSA-2026:46903", "https://access.redhat.com/errata/RHSA-2026:4753", "https://access.redhat.com/errata/RHSA-2026:4892", "https://access.redhat.com/errata/RHSA-2026:4901", "https://access.redhat.com/errata/RHSA-2026:4907", "https://access.redhat.com/errata/RHSA-2026:4939", "https://access.redhat.com/errata/RHSA-2026:4942", "https://access.redhat.com/errata/RHSA-2026:4943", "https://access.redhat.com/errata/RHSA-2026:4952", "https://access.redhat.com/errata/RHSA-2026:49944", "https://access.redhat.com/errata/RHSA-2026:5022", "https://access.redhat.com/errata/RHSA-2026:5030", "https://access.redhat.com/errata/RHSA-2026:5031", "https://access.redhat.com/errata/RHSA-2026:5076", "https://access.redhat.com/errata/RHSA-2026:5077", "https://access.redhat.com/errata/RHSA-2026:5078", "https://access.redhat.com/errata/RHSA-2026:5079", "https://access.redhat.com/errata/RHSA-2026:51033", "https://access.redhat.com/errata/RHSA-2026:5110", "https://access.redhat.com/errata/RHSA-2026:51288", "https://access.redhat.com/errata/RHSA-2026:5129", "https://access.redhat.com/errata/RHSA-2026:5130", "https://access.redhat.com/errata/RHSA-2026:5131", "https://access.redhat.com/errata/RHSA-2026:5132", "https://access.redhat.com/errata/RHSA-2026:5145", "https://access.redhat.com/errata/RHSA-2026:5146", "https://access.redhat.com/errata/RHSA-2026:5168", "https://access.redhat.com/errata/RHSA-2026:5327", "https://access.redhat.com/errata/RHSA-2026:5394", "https://access.redhat.com/errata/RHSA-2026:5439", "https://access.redhat.com/errata/RHSA-2026:5444", "https://access.redhat.com/errata/RHSA-2026:5447", "https://access.redhat.com/errata/RHSA-2026:5452", "https://access.redhat.com/errata/RHSA-2026:5461", "https://access.redhat.com/errata/RHSA-2026:5463", "https://access.redhat.com/errata/RHSA-2026:54757", "https://access.redhat.com/errata/RHSA-2026:5533", "https://access.redhat.com/errata/RHSA-2026:5544", "https://access.redhat.com/errata/RHSA-2026:5549", "https://access.redhat.com/errata/RHSA-2026:5636", "https://access.redhat.com/errata/RHSA-2026:56366", "https://access.redhat.com/errata/RHSA-2026:56431", "https://access.redhat.com/errata/RHSA-2026:5645", "https://access.redhat.com/errata/RHSA-2026:5649", "https://access.redhat.com/errata/RHSA-2026:5665", "https://access.redhat.com/errata/RHSA-2026:57013", "https://access.redhat.com/errata/RHSA-2026:5807", "https://access.redhat.com/errata/RHSA-2026:5851", "https://access.redhat.com/errata/RHSA-2026:5852", "https://access.redhat.com/errata/RHSA-2026:5853", "https://access.redhat.com/errata/RHSA-2026:5948", "https://access.redhat.com/errata/RHSA-2026:5950", "https://access.redhat.com/errata/RHSA-2026:5952", "https://access.redhat.com/errata/RHSA-2026:5968", "https://access.redhat.com/errata/RHSA-2026:6184", "https://access.redhat.com/errata/RHSA-2026:6192", "https://access.redhat.com/errata/RHSA-2026:6226", "https://access.redhat.com/errata/RHSA-2026:6251", "https://access.redhat.com/errata/RHSA-2026:6277", "https://access.redhat.com/errata/RHSA-2026:6278", "https://access.redhat.com/errata/RHSA-2026:6428", "https://access.redhat.com/errata/RHSA-2026:6429", "https://access.redhat.com/errata/RHSA-2026:6497", "https://access.redhat.com/errata/RHSA-2026:6554", "https://access.redhat.com/errata/RHSA-2026:6564", "https://access.redhat.com/errata/RHSA-2026:6567", "https://access.redhat.com/errata/RHSA-2026:6568", "https://access.redhat.com/errata/RHSA-2026:66401", "https://access.redhat.com/errata/RHSA-2026:7052", "https://access.redhat.com/errata/RHSA-2026:7249", "https://access.redhat.com/errata/RHSA-2026:7291", "https://access.redhat.com/errata/RHSA-2026:7385", "https://access.redhat.com/errata/RHSA-2026:7676", "https://access.redhat.com/errata/RHSA-2026:7854", "https://access.redhat.com/errata/RHSA-2026:7942", "https://access.redhat.com/errata/RHSA-2026:8151", "https://access.redhat.com/errata/RHSA-2026:8167", "https://access.redhat.com/errata/RHSA-2026:8218", "https://access.redhat.com/errata/RHSA-2026:8229", "https://access.redhat.com/errata/RHSA-2026:8337", "https://access.redhat.com/errata/RHSA-2026:8338", "https://access.redhat.com/errata/RHSA-2026:8431", "https://access.redhat.com/errata/RHSA-2026:8433", "https://access.redhat.com/errata/RHSA-2026:8483", "https://access.redhat.com/errata/RHSA-2026:9097", "https://access.redhat.com/errata/RHSA-2026:9098", "https://access.redhat.com/errata/RHSA-2026:9108", "https://access.redhat.com/errata/RHSA-2026:9109", "https://access.redhat.com/errata/RHSA-2026:9848", "https://access.redhat.com/security/cve/CVE-2025-61726", "https://bugzilla.redhat.com/2434432", "https://bugzilla.redhat.com/2437111", "https://bugzilla.redhat.com/show_bug.cgi?id=2434432", "https://bugzilla.redhat.com/show_bug.cgi?id=2437111", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-61726", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68121", "https://errata.almalinux.org/9/ALSA-2026-4177.html", "https://errata.rockylinux.org/RLSA-2026:4177", "https://go.dev/cl/736712", "https://go.dev/issue/77101", "https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc", "https://linux.oracle.com/cve/CVE-2025-61726.html", "https://linux.oracle.com/errata/ELSA-2026-5146.html", "https://nvd.nist.gov/vuln/detail/CVE-2025-61726", "https://pkg.go.dev/vuln/GO-2026-4341", "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-61726.json", "https://www.cve.org/CVERecord?id=CVE-2025-61726" ], "PublishedDate": "2026-01-28T20:16:09.713Z", "LastModifiedDate": "2026-09-17T12:17:11.443Z" }, { "VulnerabilityID": "CVE-2025-61729", "VendorIDs": [ "GO-2025-4155" ], "PkgID": "stdlib@v1.23.1", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.23.1", "UID": "b5bc065575324e13" }, "InstalledVersion": "v1.23.1", "FixedVersion": "1.24.11, 1.25.5", "Status": "fixed", "Layer": { "DiffID": "sha256:3c2b2a22a8b623353d36ffdd442d8f955bc91ae69a99ca6776da39ecd6014a4d" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2025-61729", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:0236caba17534453786e59eb86080a2a8e1e9ed0aca5d05b064e9321deecfe13", "Title": "crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate", "Description": "Within HostnameError.Error(), when constructing an error string, there is no limit to the number of hosts that will be printed out. Furthermore, the error string is constructed by repeated string concatenation, leading to quadratic runtime. Therefore, a certificate provided by a malicious actor can result in excessive resource consumption.", "Severity": "HIGH", "CweIDs": [ "CWE-295" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "bitnami": 3, "cbl-mariner": 1, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:3928", "https://access.redhat.com/security/cve/CVE-2025-61729", "https://bugzilla.redhat.com/2418462", "https://bugzilla.redhat.com/2434432", "https://bugzilla.redhat.com/2437111", "https://bugzilla.redhat.com/show_bug.cgi?id=2418462", "https://bugzilla.redhat.com/show_bug.cgi?id=2434432", "https://bugzilla.redhat.com/show_bug.cgi?id=2437111", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-61726", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-61729", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68121", "https://errata.almalinux.org/9/ALSA-2026-3928.html", "https://errata.rockylinux.org/RLSA-2026:3928", "https://go.dev/cl/725920", "https://go.dev/issue/76445", "https://groups.google.com/g/golang-announce/c/8FJoBkPddm4", "https://linux.oracle.com/cve/CVE-2025-61729.html", "https://linux.oracle.com/errata/ELSA-2026-5146.html", "https://nvd.nist.gov/vuln/detail/CVE-2025-61729", "https://pkg.go.dev/vuln/GO-2025-4155", "https://www.cve.org/CVERecord?id=CVE-2025-61729" ], "PublishedDate": "2025-12-02T19:15:51.447Z", "LastModifiedDate": "2026-10-18T18:10:00.1Z" }, { "VulnerabilityID": "CVE-2026-111943", "VendorIDs": [ "GO-2026-6809" ], "PkgID": "stdlib@v1.23.1", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.23.1", "UID": "b5bc065575324e13" }, "InstalledVersion": "v1.23.1", "FixedVersion": "1.26.10, 1.27.3", "Status": "fixed", "Layer": { "DiffID": "sha256:3c2b2a22a8b623353d36ffdd442d8f955bc91ae69a99ca6776da39ecd6014a4d" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-111943", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:56798b775571ccd94b800ce2a097e34d19be28a9f5f22c2e8218ac4d3dee86e4", "Title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "Description": "On most platforms, Go uses the given system root certificates. However, in some narrower cases, the system trust stores may not be updated without further action. To defend against the narrower set of cases that may remain affected, a denylist was added in crypto/x509 to return an error when calling Verify with any of the known intermediate certificates that are no longer considered to be trustworthy.", "Severity": "HIGH", "CweIDs": [ "CWE-299" ], "VendorSeverity": { "alma": 3, "amazon": 2, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N", "V3Score": 6.8 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/10/20/29", "https://access.redhat.com/errata/RHSA-2026:95518", "https://access.redhat.com/security/cve/CVE-2026-111943", "https://bugzilla.redhat.com/2548336", "https://bugzilla.redhat.com/2556068", "https://bugzilla.redhat.com/show_bug.cgi?id=2548336", "https://bugzilla.redhat.com/show_bug.cgi?id=2556068", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-111943", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-97031", "https://errata.almalinux.org/9/ALSA-2026-95518.html", "https://errata.rockylinux.org/RLSA-2026:95518", "https://github.com/golang/go/issues/82345", "https://go.dev/cl/851047", "https://go.dev/issue/82345", "https://groups.google.com/g/golang-announce/c/66pojueaQek", "https://groups.google.com/g/golang-nuts/c/K22sG2AYnKU", "https://linux.oracle.com/cve/CVE-2026-111943.html", "https://linux.oracle.com/errata/ELSA-2026-95519.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-111943", "https://pkg.go.dev/vuln/GO-2026-6809", "https://www.cve.org/CVERecord?id=CVE-2026-111943" ], "PublishedDate": "2026-10-21T01:17:20.797Z", "LastModifiedDate": "2026-10-30T13:18:28.74Z" }, { "VulnerabilityID": "CVE-2026-25679", "VendorIDs": [ "GO-2026-4601" ], "PkgID": "stdlib@v1.23.1", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.23.1", "UID": "b5bc065575324e13" }, "InstalledVersion": "v1.23.1", "FixedVersion": "1.25.8, 1.26.1", "Status": "fixed", "Layer": { "DiffID": "sha256:3c2b2a22a8b623353d36ffdd442d8f955bc91ae69a99ca6776da39ecd6014a4d" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-25679", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:2360850a5db4bbb75f9f5dea2564f751e2c5c07c136fb91d04823dee8c9c0a9d", "Title": "net/url: Incorrect parsing of IPv6 host literals in net/url", "Description": "url.Parse insufficiently validated the host/authority component and accepted some invalid URLs.", "Severity": "HIGH", "CweIDs": [ "CWE-425", "CWE-1286" ], "VendorSeverity": { "alma": 3, "amazon": 2, "azure": 3, "bitnami": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:10065", "https://access.redhat.com/errata/RHSA-2026:10125", "https://access.redhat.com/errata/RHSA-2026:10133", "https://access.redhat.com/errata/RHSA-2026:10140", "https://access.redhat.com/errata/RHSA-2026:10141", "https://access.redhat.com/errata/RHSA-2026:10158", "https://access.redhat.com/errata/RHSA-2026:10169", "https://access.redhat.com/errata/RHSA-2026:10175", "https://access.redhat.com/errata/RHSA-2026:10184", "https://access.redhat.com/errata/RHSA-2026:10225", "https://access.redhat.com/errata/RHSA-2026:10250", "https://access.redhat.com/errata/RHSA-2026:10701", "https://access.redhat.com/errata/RHSA-2026:10712", "https://access.redhat.com/errata/RHSA-2026:10929", "https://access.redhat.com/errata/RHSA-2026:11217", "https://access.redhat.com/errata/RHSA-2026:11375", "https://access.redhat.com/errata/RHSA-2026:11412", "https://access.redhat.com/errata/RHSA-2026:11413", "https://access.redhat.com/errata/RHSA-2026:11686", "https://access.redhat.com/errata/RHSA-2026:11688", "https://access.redhat.com/errata/RHSA-2026:11747", "https://access.redhat.com/errata/RHSA-2026:11749", "https://access.redhat.com/errata/RHSA-2026:11768", "https://access.redhat.com/errata/RHSA-2026:11800", "https://access.redhat.com/errata/RHSA-2026:11856", "https://access.redhat.com/errata/RHSA-2026:11916", "https://access.redhat.com/errata/RHSA-2026:11996", "https://access.redhat.com/errata/RHSA-2026:12028", "https://access.redhat.com/errata/RHSA-2026:12029", "https://access.redhat.com/errata/RHSA-2026:12030", "https://access.redhat.com/errata/RHSA-2026:12031", "https://access.redhat.com/errata/RHSA-2026:12032", "https://access.redhat.com/errata/RHSA-2026:12033", "https://access.redhat.com/errata/RHSA-2026:12282", "https://access.redhat.com/errata/RHSA-2026:13508", "https://access.redhat.com/errata/RHSA-2026:13512", "https://access.redhat.com/errata/RHSA-2026:13545", "https://access.redhat.com/errata/RHSA-2026:13642", "https://access.redhat.com/errata/RHSA-2026:13643", "https://access.redhat.com/errata/RHSA-2026:13671", "https://access.redhat.com/errata/RHSA-2026:13791", "https://access.redhat.com/errata/RHSA-2026:13829", "https://access.redhat.com/errata/RHSA-2026:14020", "https://access.redhat.com/errata/RHSA-2026:14100", "https://access.redhat.com/errata/RHSA-2026:14774", "https://access.redhat.com/errata/RHSA-2026:14868", "https://access.redhat.com/errata/RHSA-2026:14879", "https://access.redhat.com/errata/RHSA-2026:15091", "https://access.redhat.com/errata/RHSA-2026:16102", "https://access.redhat.com/errata/RHSA-2026:16696", "https://access.redhat.com/errata/RHSA-2026:16874", "https://access.redhat.com/errata/RHSA-2026:16875", "https://access.redhat.com/errata/RHSA-2026:17040", "https://access.redhat.com/errata/RHSA-2026:17084", "https://access.redhat.com/errata/RHSA-2026:17287", "https://access.redhat.com/errata/RHSA-2026:17598", "https://access.redhat.com/errata/RHSA-2026:19017", "https://access.redhat.com/errata/RHSA-2026:19022", "https://access.redhat.com/errata/RHSA-2026:19026", "https://access.redhat.com/errata/RHSA-2026:19027", "https://access.redhat.com/errata/RHSA-2026:19031", "https://access.redhat.com/errata/RHSA-2026:19032", "https://access.redhat.com/errata/RHSA-2026:19049", "https://access.redhat.com/errata/RHSA-2026:19055", "https://access.redhat.com/errata/RHSA-2026:19126", "https://access.redhat.com/errata/RHSA-2026:19128", "https://access.redhat.com/errata/RHSA-2026:19132", "https://access.redhat.com/errata/RHSA-2026:19133", "https://access.redhat.com/errata/RHSA-2026:19135", "https://access.redhat.com/errata/RHSA-2026:19181", "https://access.redhat.com/errata/RHSA-2026:19184", "https://access.redhat.com/errata/RHSA-2026:19185", "https://access.redhat.com/errata/RHSA-2026:19207", "https://access.redhat.com/errata/RHSA-2026:19350", "https://access.redhat.com/errata/RHSA-2026:19353", "https://access.redhat.com/errata/RHSA-2026:19375", "https://access.redhat.com/errata/RHSA-2026:19475", "https://access.redhat.com/errata/RHSA-2026:19634", "https://access.redhat.com/errata/RHSA-2026:19719", "https://access.redhat.com/errata/RHSA-2026:19720", "https://access.redhat.com/errata/RHSA-2026:19721", "https://access.redhat.com/errata/RHSA-2026:19750", "https://access.redhat.com/errata/RHSA-2026:20041", "https://access.redhat.com/errata/RHSA-2026:20088", "https://access.redhat.com/errata/RHSA-2026:20581", "https://access.redhat.com/errata/RHSA-2026:20582", "https://access.redhat.com/errata/RHSA-2026:20584", "https://access.redhat.com/errata/RHSA-2026:20889", "https://access.redhat.com/errata/RHSA-2026:21017", "https://access.redhat.com/errata/RHSA-2026:21655", "https://access.redhat.com/errata/RHSA-2026:21657", "https://access.redhat.com/errata/RHSA-2026:21691", "https://access.redhat.com/errata/RHSA-2026:21696", "https://access.redhat.com/errata/RHSA-2026:21769", "https://access.redhat.com/errata/RHSA-2026:22347", "https://access.redhat.com/errata/RHSA-2026:22423", "https://access.redhat.com/errata/RHSA-2026:22450", "https://access.redhat.com/errata/RHSA-2026:22627", "https://access.redhat.com/errata/RHSA-2026:22714", "https://access.redhat.com/errata/RHSA-2026:22733", "https://access.redhat.com/errata/RHSA-2026:22862", "https://access.redhat.com/errata/RHSA-2026:22937", "https://access.redhat.com/errata/RHSA-2026:23228", "https://access.redhat.com/errata/RHSA-2026:23345", "https://access.redhat.com/errata/RHSA-2026:24386", "https://access.redhat.com/errata/RHSA-2026:24853", "https://access.redhat.com/errata/RHSA-2026:25043", "https://access.redhat.com/errata/RHSA-2026:25127", "https://access.redhat.com/errata/RHSA-2026:25180", "https://access.redhat.com/errata/RHSA-2026:25248", "https://access.redhat.com/errata/RHSA-2026:25250", "https://access.redhat.com/errata/RHSA-2026:25251", "https://access.redhat.com/errata/RHSA-2026:25252", "https://access.redhat.com/errata/RHSA-2026:25253", "https://access.redhat.com/errata/RHSA-2026:26445", "https://access.redhat.com/errata/RHSA-2026:26527", "https://access.redhat.com/errata/RHSA-2026:26541", "https://access.redhat.com/errata/RHSA-2026:26568", "https://access.redhat.com/errata/RHSA-2026:26585", "https://access.redhat.com/errata/RHSA-2026:26636", "https://access.redhat.com/errata/RHSA-2026:27076", "https://access.redhat.com/errata/RHSA-2026:28047", "https://access.redhat.com/errata/RHSA-2026:28441", "https://access.redhat.com/errata/RHSA-2026:28886", "https://access.redhat.com/errata/RHSA-2026:28893", "https://access.redhat.com/errata/RHSA-2026:28961", "https://access.redhat.com/errata/RHSA-2026:29035", "https://access.redhat.com/errata/RHSA-2026:29195", "https://access.redhat.com/errata/RHSA-2026:29455", "https://access.redhat.com/errata/RHSA-2026:29702", "https://access.redhat.com/errata/RHSA-2026:29703", "https://access.redhat.com/errata/RHSA-2026:29854", "https://access.redhat.com/errata/RHSA-2026:33722", "https://access.redhat.com/errata/RHSA-2026:34097", "https://access.redhat.com/errata/RHSA-2026:34365", "https://access.redhat.com/errata/RHSA-2026:36317", "https://access.redhat.com/errata/RHSA-2026:36319", "https://access.redhat.com/errata/RHSA-2026:36651", "https://access.redhat.com/errata/RHSA-2026:36796", "https://access.redhat.com/errata/RHSA-2026:39810", "https://access.redhat.com/errata/RHSA-2026:40118", "https://access.redhat.com/errata/RHSA-2026:40945", "https://access.redhat.com/errata/RHSA-2026:41019", "https://access.redhat.com/errata/RHSA-2026:41928", "https://access.redhat.com/errata/RHSA-2026:42150", "https://access.redhat.com/errata/RHSA-2026:42151", "https://access.redhat.com/errata/RHSA-2026:48036", "https://access.redhat.com/errata/RHSA-2026:49944", "https://access.redhat.com/errata/RHSA-2026:5110", "https://access.redhat.com/errata/RHSA-2026:51288", "https://access.redhat.com/errata/RHSA-2026:52389", "https://access.redhat.com/errata/RHSA-2026:52390", "https://access.redhat.com/errata/RHSA-2026:52391", "https://access.redhat.com/errata/RHSA-2026:54191", "https://access.redhat.com/errata/RHSA-2026:54757", "https://access.redhat.com/errata/RHSA-2026:5549", "https://access.redhat.com/errata/RHSA-2026:56785", "https://access.redhat.com/errata/RHSA-2026:56852", "https://access.redhat.com/errata/RHSA-2026:56910", "https://access.redhat.com/errata/RHSA-2026:57482", "https://access.redhat.com/errata/RHSA-2026:5941", "https://access.redhat.com/errata/RHSA-2026:5942", "https://access.redhat.com/errata/RHSA-2026:5943", "https://access.redhat.com/errata/RHSA-2026:5944", "https://access.redhat.com/errata/RHSA-2026:59830", "https://access.redhat.com/errata/RHSA-2026:60018", "https://access.redhat.com/errata/RHSA-2026:6341", "https://access.redhat.com/errata/RHSA-2026:6344", "https://access.redhat.com/errata/RHSA-2026:6382", "https://access.redhat.com/errata/RHSA-2026:6383", "https://access.redhat.com/errata/RHSA-2026:6388", "https://access.redhat.com/errata/RHSA-2026:6564", "https://access.redhat.com/errata/RHSA-2026:65838", "https://access.redhat.com/errata/RHSA-2026:66401", "https://access.redhat.com/errata/RHSA-2026:6720", "https://access.redhat.com/errata/RHSA-2026:6802", "https://access.redhat.com/errata/RHSA-2026:6949", "https://access.redhat.com/errata/RHSA-2026:7005", "https://access.redhat.com/errata/RHSA-2026:7009", "https://access.redhat.com/errata/RHSA-2026:7011", "https://access.redhat.com/errata/RHSA-2026:7259", "https://access.redhat.com/errata/RHSA-2026:7291", "https://access.redhat.com/errata/RHSA-2026:7315", "https://access.redhat.com/errata/RHSA-2026:7328", "https://access.redhat.com/errata/RHSA-2026:7385", "https://access.redhat.com/errata/RHSA-2026:7665", "https://access.redhat.com/errata/RHSA-2026:7669", "https://access.redhat.com/errata/RHSA-2026:7674", "https://access.redhat.com/errata/RHSA-2026:7833", "https://access.redhat.com/errata/RHSA-2026:7834", "https://access.redhat.com/errata/RHSA-2026:7876", "https://access.redhat.com/errata/RHSA-2026:7877", "https://access.redhat.com/errata/RHSA-2026:7878", "https://access.redhat.com/errata/RHSA-2026:7879", "https://access.redhat.com/errata/RHSA-2026:7883", "https://access.redhat.com/errata/RHSA-2026:7992", "https://access.redhat.com/errata/RHSA-2026:8151", "https://access.redhat.com/errata/RHSA-2026:8167", "https://access.redhat.com/errata/RHSA-2026:8314", "https://access.redhat.com/errata/RHSA-2026:8322", "https://access.redhat.com/errata/RHSA-2026:8324", "https://access.redhat.com/errata/RHSA-2026:8337", "https://access.redhat.com/errata/RHSA-2026:8338", "https://access.redhat.com/errata/RHSA-2026:8433", "https://access.redhat.com/errata/RHSA-2026:8434", "https://access.redhat.com/errata/RHSA-2026:8456", "https://access.redhat.com/errata/RHSA-2026:8483", "https://access.redhat.com/errata/RHSA-2026:8484", "https://access.redhat.com/errata/RHSA-2026:8490", "https://access.redhat.com/errata/RHSA-2026:8491", "https://access.redhat.com/errata/RHSA-2026:8493", "https://access.redhat.com/errata/RHSA-2026:8840", "https://access.redhat.com/errata/RHSA-2026:8841", "https://access.redhat.com/errata/RHSA-2026:8842", "https://access.redhat.com/errata/RHSA-2026:8845", "https://access.redhat.com/errata/RHSA-2026:8847", "https://access.redhat.com/errata/RHSA-2026:8848", "https://access.redhat.com/errata/RHSA-2026:8849", "https://access.redhat.com/errata/RHSA-2026:8851", "https://access.redhat.com/errata/RHSA-2026:8852", "https://access.redhat.com/errata/RHSA-2026:8853", "https://access.redhat.com/errata/RHSA-2026:8855", "https://access.redhat.com/errata/RHSA-2026:8856", "https://access.redhat.com/errata/RHSA-2026:8860", "https://access.redhat.com/errata/RHSA-2026:8877", "https://access.redhat.com/errata/RHSA-2026:8878", "https://access.redhat.com/errata/RHSA-2026:8879", "https://access.redhat.com/errata/RHSA-2026:8881", "https://access.redhat.com/errata/RHSA-2026:8882", "https://access.redhat.com/errata/RHSA-2026:8930", "https://access.redhat.com/errata/RHSA-2026:8931", "https://access.redhat.com/errata/RHSA-2026:8949", "https://access.redhat.com/errata/RHSA-2026:9043", "https://access.redhat.com/errata/RHSA-2026:9044", "https://access.redhat.com/errata/RHSA-2026:9052", "https://access.redhat.com/errata/RHSA-2026:9090", "https://access.redhat.com/errata/RHSA-2026:9093", "https://access.redhat.com/errata/RHSA-2026:9094", "https://access.redhat.com/errata/RHSA-2026:9097", "https://access.redhat.com/errata/RHSA-2026:9098", "https://access.redhat.com/errata/RHSA-2026:9108", "https://access.redhat.com/errata/RHSA-2026:9109", "https://access.redhat.com/errata/RHSA-2026:9385", "https://access.redhat.com/errata/RHSA-2026:9434", "https://access.redhat.com/errata/RHSA-2026:9435", "https://access.redhat.com/errata/RHSA-2026:9436", "https://access.redhat.com/errata/RHSA-2026:9439", "https://access.redhat.com/errata/RHSA-2026:9440", "https://access.redhat.com/errata/RHSA-2026:9448", "https://access.redhat.com/errata/RHSA-2026:9453", "https://access.redhat.com/errata/RHSA-2026:9461", "https://access.redhat.com/errata/RHSA-2026:9695", "https://access.redhat.com/errata/RHSA-2026:9742", "https://access.redhat.com/errata/RHSA-2026:9872", "https://access.redhat.com/security/cve/CVE-2026-25679", "https://bugzilla.redhat.com/2445356", "https://bugzilla.redhat.com/show_bug.cgi?id=2445356", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25679", "https://errata.almalinux.org/9/ALSA-2026-9044.html", "https://errata.rockylinux.org/RLSA-2026:9044", "https://go.dev/cl/752180", "https://go.dev/issue/77578", "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk", "https://linux.oracle.com/cve/CVE-2026-25679.html", "https://linux.oracle.com/errata/ELSA-2026-9044.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-25679", "https://pkg.go.dev/vuln/GO-2026-4601", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-25679.json", "https://www.cve.org/CVERecord?id=CVE-2026-25679" ], "PublishedDate": "2026-03-06T22:16:00.72Z", "LastModifiedDate": "2026-09-18T13:17:30.067Z" }, { "VulnerabilityID": "CVE-2026-27145", "VendorIDs": [ "GO-2026-5037" ], "PkgID": "stdlib@v1.23.1", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.23.1", "UID": "b5bc065575324e13" }, "InstalledVersion": "v1.23.1", "FixedVersion": "1.25.11, 1.26.4", "Status": "fixed", "Layer": { "DiffID": "sha256:3c2b2a22a8b623353d36ffdd442d8f955bc91ae69a99ca6776da39ecd6014a4d" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-27145", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:b0f6f494c351e58cf0cfe9a3d04af28f5699c89fb0fe9ecb967be37e889aef10", "Title": "crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries", "Description": "(*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries. This caused strings.Split(host, \".\") to execute repeatedly on the same input hostname. With a large DNS SAN list, verification costs scaled quadratically based on the number of SAN entries multiplied by the hostname's label count. Because x509.Verify validates hostnames before building the certificate chain, this overhead occurred even for untrusted certificates.", "Severity": "HIGH", "CweIDs": [ "CWE-606" ], "VendorSeverity": { "alma": 3, "amazon": 2, "azure": 2, "bitnami": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:23262", "https://access.redhat.com/errata/RHSA-2026:23264", "https://access.redhat.com/errata/RHSA-2026:29980", "https://access.redhat.com/errata/RHSA-2026:29981", "https://access.redhat.com/errata/RHSA-2026:33574", "https://access.redhat.com/errata/RHSA-2026:34357", "https://access.redhat.com/errata/RHSA-2026:34359", "https://access.redhat.com/errata/RHSA-2026:35832", "https://access.redhat.com/errata/RHSA-2026:36317", "https://access.redhat.com/errata/RHSA-2026:36648", "https://access.redhat.com/errata/RHSA-2026:36797", "https://access.redhat.com/errata/RHSA-2026:38995", "https://access.redhat.com/errata/RHSA-2026:39005", "https://access.redhat.com/errata/RHSA-2026:39573", "https://access.redhat.com/errata/RHSA-2026:39879", "https://access.redhat.com/errata/RHSA-2026:41030", "https://access.redhat.com/errata/RHSA-2026:41036", "https://access.redhat.com/errata/RHSA-2026:41930", "https://access.redhat.com/errata/RHSA-2026:42043", "https://access.redhat.com/errata/RHSA-2026:42047", "https://access.redhat.com/errata/RHSA-2026:42049", "https://access.redhat.com/errata/RHSA-2026:42050", "https://access.redhat.com/errata/RHSA-2026:42051", "https://access.redhat.com/errata/RHSA-2026:42079", "https://access.redhat.com/errata/RHSA-2026:42080", "https://access.redhat.com/errata/RHSA-2026:42082", "https://access.redhat.com/errata/RHSA-2026:42142", "https://access.redhat.com/errata/RHSA-2026:42150", "https://access.redhat.com/errata/RHSA-2026:42151", "https://access.redhat.com/errata/RHSA-2026:42240", "https://access.redhat.com/errata/RHSA-2026:42644", "https://access.redhat.com/errata/RHSA-2026:42946", "https://access.redhat.com/errata/RHSA-2026:44622", "https://access.redhat.com/errata/RHSA-2026:46394", "https://access.redhat.com/errata/RHSA-2026:46395", "https://access.redhat.com/errata/RHSA-2026:47149", "https://access.redhat.com/errata/RHSA-2026:47735", "https://access.redhat.com/errata/RHSA-2026:47737", "https://access.redhat.com/errata/RHSA-2026:49702", "https://access.redhat.com/errata/RHSA-2026:49703", "https://access.redhat.com/errata/RHSA-2026:49705", "https://access.redhat.com/errata/RHSA-2026:49712", "https://access.redhat.com/errata/RHSA-2026:49729", "https://access.redhat.com/errata/RHSA-2026:49744", "https://access.redhat.com/errata/RHSA-2026:49765", "https://access.redhat.com/errata/RHSA-2026:49770", "https://access.redhat.com/errata/RHSA-2026:50205", "https://access.redhat.com/errata/RHSA-2026:50319", "https://access.redhat.com/errata/RHSA-2026:51057", "https://access.redhat.com/errata/RHSA-2026:51187", "https://access.redhat.com/errata/RHSA-2026:52946", "https://access.redhat.com/errata/RHSA-2026:53374", "https://access.redhat.com/errata/RHSA-2026:53412", "https://access.redhat.com/errata/RHSA-2026:53413", "https://access.redhat.com/errata/RHSA-2026:53415", "https://access.redhat.com/errata/RHSA-2026:53416", "https://access.redhat.com/errata/RHSA-2026:53530", "https://access.redhat.com/errata/RHSA-2026:54168", "https://access.redhat.com/errata/RHSA-2026:54401", "https://access.redhat.com/errata/RHSA-2026:54427", "https://access.redhat.com/errata/RHSA-2026:54432", "https://access.redhat.com/errata/RHSA-2026:54435", "https://access.redhat.com/errata/RHSA-2026:54441", "https://access.redhat.com/errata/RHSA-2026:54500", "https://access.redhat.com/errata/RHSA-2026:54525", "https://access.redhat.com/errata/RHSA-2026:54531", "https://access.redhat.com/errata/RHSA-2026:54603", "https://access.redhat.com/errata/RHSA-2026:54757", "https://access.redhat.com/errata/RHSA-2026:55899", "https://access.redhat.com/errata/RHSA-2026:57194", "https://access.redhat.com/errata/RHSA-2026:57482", "https://access.redhat.com/errata/RHSA-2026:57488", "https://access.redhat.com/errata/RHSA-2026:57649", "https://access.redhat.com/errata/RHSA-2026:59556", "https://access.redhat.com/errata/RHSA-2026:59557", "https://access.redhat.com/errata/RHSA-2026:59558", "https://access.redhat.com/errata/RHSA-2026:59559", "https://access.redhat.com/errata/RHSA-2026:59579", "https://access.redhat.com/errata/RHSA-2026:59593", "https://access.redhat.com/errata/RHSA-2026:60025", "https://access.redhat.com/errata/RHSA-2026:60315", "https://access.redhat.com/errata/RHSA-2026:60354", "https://access.redhat.com/errata/RHSA-2026:60386", "https://access.redhat.com/errata/RHSA-2026:60387", "https://access.redhat.com/errata/RHSA-2026:60388", "https://access.redhat.com/errata/RHSA-2026:60390", "https://access.redhat.com/errata/RHSA-2026:60391", "https://access.redhat.com/errata/RHSA-2026:61253", "https://access.redhat.com/errata/RHSA-2026:61314", "https://access.redhat.com/errata/RHSA-2026:63016", "https://access.redhat.com/errata/RHSA-2026:66022", "https://access.redhat.com/errata/RHSA-2026:68334", "https://access.redhat.com/errata/RHSA-2026:68335", "https://access.redhat.com/security/cve/CVE-2026-27145", "https://bugzilla.redhat.com/2445356", "https://bugzilla.redhat.com/2484207", "https://bugzilla.redhat.com/show_bug.cgi?id=2445356", "https://bugzilla.redhat.com/show_bug.cgi?id=2484207", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25679", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27145", "https://errata.almalinux.org/9/ALSA-2026-36317.html", "https://errata.rockylinux.org/RLSA-2026:36317", "https://go.dev/cl/783621", "https://go.dev/issue/79694", "https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw", "https://linux.oracle.com/cve/CVE-2026-27145.html", "https://linux.oracle.com/errata/ELSA-2026-53416.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-27145", "https://pkg.go.dev/vuln/GO-2026-5037", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27145.json", "https://www.cve.org/CVERecord?id=CVE-2026-27145" ], "PublishedDate": "2026-06-02T23:16:35.57Z", "LastModifiedDate": "2026-09-18T13:17:43.283Z" }, { "VulnerabilityID": "CVE-2026-32280", "VendorIDs": [ "GO-2026-4947" ], "PkgID": "stdlib@v1.23.1", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.23.1", "UID": "b5bc065575324e13" }, "InstalledVersion": "v1.23.1", "FixedVersion": "1.25.9, 1.26.2", "Status": "fixed", "Layer": { "DiffID": "sha256:3c2b2a22a8b623353d36ffdd442d8f955bc91ae69a99ca6776da39ecd6014a4d" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-32280", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:bb419f51c16f5802cc8f82f2c68d0995985b22891783c8632d05d1fd1f8457c5", "Title": "crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building", "Description": "During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of service. This affects both direct users of crypto/x509 and users of crypto/tls.", "Severity": "HIGH", "CweIDs": [ "CWE-770" ], "VendorSeverity": { "alma": 3, "amazon": 3, "bitnami": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:10217", "https://access.redhat.com/errata/RHSA-2026:10219", "https://access.redhat.com/errata/RHSA-2026:10704", "https://access.redhat.com/errata/RHSA-2026:11507", "https://access.redhat.com/errata/RHSA-2026:11514", "https://access.redhat.com/errata/RHSA-2026:11688", "https://access.redhat.com/errata/RHSA-2026:13545", "https://access.redhat.com/errata/RHSA-2026:13791", "https://access.redhat.com/errata/RHSA-2026:13826", "https://access.redhat.com/errata/RHSA-2026:13829", "https://access.redhat.com/errata/RHSA-2026:14020", "https://access.redhat.com/errata/RHSA-2026:14162", "https://access.redhat.com/errata/RHSA-2026:14200", "https://access.redhat.com/errata/RHSA-2026:14391", "https://access.redhat.com/errata/RHSA-2026:15980", "https://access.redhat.com/errata/RHSA-2026:16021", "https://access.redhat.com/errata/RHSA-2026:16024", "https://access.redhat.com/errata/RHSA-2026:16101", "https://access.redhat.com/errata/RHSA-2026:16476", "https://access.redhat.com/errata/RHSA-2026:16477", "https://access.redhat.com/errata/RHSA-2026:16505", "https://access.redhat.com/errata/RHSA-2026:16508", "https://access.redhat.com/errata/RHSA-2026:16532", "https://access.redhat.com/errata/RHSA-2026:16534", "https://access.redhat.com/errata/RHSA-2026:16535", "https://access.redhat.com/errata/RHSA-2026:16537", "https://access.redhat.com/errata/RHSA-2026:16542", "https://access.redhat.com/errata/RHSA-2026:16874", "https://access.redhat.com/errata/RHSA-2026:16875", "https://access.redhat.com/errata/RHSA-2026:17084", "https://access.redhat.com/errata/RHSA-2026:17287", "https://access.redhat.com/errata/RHSA-2026:18027", "https://access.redhat.com/errata/RHSA-2026:18032", "https://access.redhat.com/errata/RHSA-2026:19133", "https://access.redhat.com/errata/RHSA-2026:19135", "https://access.redhat.com/errata/RHSA-2026:19144", "https://access.redhat.com/errata/RHSA-2026:19350", "https://access.redhat.com/errata/RHSA-2026:19353", "https://access.redhat.com/errata/RHSA-2026:19375", "https://access.redhat.com/errata/RHSA-2026:19450", "https://access.redhat.com/errata/RHSA-2026:19550", "https://access.redhat.com/errata/RHSA-2026:19634", "https://access.redhat.com/errata/RHSA-2026:19714", "https://access.redhat.com/errata/RHSA-2026:19715", "https://access.redhat.com/errata/RHSA-2026:19719", "https://access.redhat.com/errata/RHSA-2026:19720", "https://access.redhat.com/errata/RHSA-2026:19721", "https://access.redhat.com/errata/RHSA-2026:19722", "https://access.redhat.com/errata/RHSA-2026:19750", "https://access.redhat.com/errata/RHSA-2026:19839", "https://access.redhat.com/errata/RHSA-2026:20556", "https://access.redhat.com/errata/RHSA-2026:20569", "https://access.redhat.com/errata/RHSA-2026:20570", "https://access.redhat.com/errata/RHSA-2026:20571", "https://access.redhat.com/errata/RHSA-2026:20607", "https://access.redhat.com/errata/RHSA-2026:20608", "https://access.redhat.com/errata/RHSA-2026:20609", "https://access.redhat.com/errata/RHSA-2026:20889", "https://access.redhat.com/errata/RHSA-2026:21017", "https://access.redhat.com/errata/RHSA-2026:21338", "https://access.redhat.com/errata/RHSA-2026:21655", "https://access.redhat.com/errata/RHSA-2026:21769", "https://access.redhat.com/errata/RHSA-2026:21772", "https://access.redhat.com/errata/RHSA-2026:22130", "https://access.redhat.com/errata/RHSA-2026:22141", "https://access.redhat.com/errata/RHSA-2026:22258", "https://access.redhat.com/errata/RHSA-2026:22260", "https://access.redhat.com/errata/RHSA-2026:22268", "https://access.redhat.com/errata/RHSA-2026:22309", "https://access.redhat.com/errata/RHSA-2026:22347", "https://access.redhat.com/errata/RHSA-2026:22415", "https://access.redhat.com/errata/RHSA-2026:22422", "https://access.redhat.com/errata/RHSA-2026:22465", "https://access.redhat.com/errata/RHSA-2026:22485", "https://access.redhat.com/errata/RHSA-2026:22709", "https://access.redhat.com/errata/RHSA-2026:22713", "https://access.redhat.com/errata/RHSA-2026:22840", "https://access.redhat.com/errata/RHSA-2026:22862", "https://access.redhat.com/errata/RHSA-2026:22958", "https://access.redhat.com/errata/RHSA-2026:22959", "https://access.redhat.com/errata/RHSA-2026:22960", "https://access.redhat.com/errata/RHSA-2026:22961", "https://access.redhat.com/errata/RHSA-2026:22962", "https://access.redhat.com/errata/RHSA-2026:23102", "https://access.redhat.com/errata/RHSA-2026:23103", "https://access.redhat.com/errata/RHSA-2026:23244", "https://access.redhat.com/errata/RHSA-2026:23345", "https://access.redhat.com/errata/RHSA-2026:23361", "https://access.redhat.com/errata/RHSA-2026:24337", "https://access.redhat.com/errata/RHSA-2026:24359", "https://access.redhat.com/errata/RHSA-2026:24470", "https://access.redhat.com/errata/RHSA-2026:24478", "https://access.redhat.com/errata/RHSA-2026:24716", "https://access.redhat.com/errata/RHSA-2026:24761", "https://access.redhat.com/errata/RHSA-2026:24762", "https://access.redhat.com/errata/RHSA-2026:24853", "https://access.redhat.com/errata/RHSA-2026:24977", "https://access.redhat.com/errata/RHSA-2026:25089", "https://access.redhat.com/errata/RHSA-2026:25127", "https://access.redhat.com/errata/RHSA-2026:25180", "https://access.redhat.com/errata/RHSA-2026:25248", "https://access.redhat.com/errata/RHSA-2026:25250", "https://access.redhat.com/errata/RHSA-2026:25251", "https://access.redhat.com/errata/RHSA-2026:25252", "https://access.redhat.com/errata/RHSA-2026:25253", "https://access.redhat.com/errata/RHSA-2026:26447", "https://access.redhat.com/errata/RHSA-2026:26568", "https://access.redhat.com/errata/RHSA-2026:26571", "https://access.redhat.com/errata/RHSA-2026:26585", "https://access.redhat.com/errata/RHSA-2026:26636", "https://access.redhat.com/errata/RHSA-2026:27076", "https://access.redhat.com/errata/RHSA-2026:28038", "https://access.redhat.com/errata/RHSA-2026:28047", "https://access.redhat.com/errata/RHSA-2026:28074", "https://access.redhat.com/errata/RHSA-2026:28196", "https://access.redhat.com/errata/RHSA-2026:28198", "https://access.redhat.com/errata/RHSA-2026:28441", "https://access.redhat.com/errata/RHSA-2026:28886", "https://access.redhat.com/errata/RHSA-2026:28961", "https://access.redhat.com/errata/RHSA-2026:29035", "https://access.redhat.com/errata/RHSA-2026:29195", "https://access.redhat.com/errata/RHSA-2026:29455", "https://access.redhat.com/errata/RHSA-2026:29702", "https://access.redhat.com/errata/RHSA-2026:29703", "https://access.redhat.com/errata/RHSA-2026:29854", "https://access.redhat.com/errata/RHSA-2026:33722", "https://access.redhat.com/errata/RHSA-2026:34097", "https://access.redhat.com/errata/RHSA-2026:34192", "https://access.redhat.com/errata/RHSA-2026:34196", "https://access.redhat.com/errata/RHSA-2026:34197", "https://access.redhat.com/errata/RHSA-2026:34365", "https://access.redhat.com/errata/RHSA-2026:36319", "https://access.redhat.com/errata/RHSA-2026:36625", "https://access.redhat.com/errata/RHSA-2026:36651", "https://access.redhat.com/errata/RHSA-2026:36796", "https://access.redhat.com/errata/RHSA-2026:39810", "https://access.redhat.com/errata/RHSA-2026:39894", "https://access.redhat.com/errata/RHSA-2026:40118", "https://access.redhat.com/errata/RHSA-2026:40945", "https://access.redhat.com/errata/RHSA-2026:41019", "https://access.redhat.com/errata/RHSA-2026:41928", "https://access.redhat.com/errata/RHSA-2026:42043", "https://access.redhat.com/errata/RHSA-2026:42047", "https://access.redhat.com/errata/RHSA-2026:42049", "https://access.redhat.com/errata/RHSA-2026:42050", "https://access.redhat.com/errata/RHSA-2026:42051", "https://access.redhat.com/errata/RHSA-2026:47712", "https://access.redhat.com/errata/RHSA-2026:47714", "https://access.redhat.com/errata/RHSA-2026:47716", "https://access.redhat.com/errata/RHSA-2026:47719", "https://access.redhat.com/errata/RHSA-2026:47721", "https://access.redhat.com/errata/RHSA-2026:47722", "https://access.redhat.com/errata/RHSA-2026:47910", "https://access.redhat.com/errata/RHSA-2026:47952", "https://access.redhat.com/errata/RHSA-2026:48036", "https://access.redhat.com/errata/RHSA-2026:48790", "https://access.redhat.com/errata/RHSA-2026:49509", "https://access.redhat.com/errata/RHSA-2026:49526", "https://access.redhat.com/errata/RHSA-2026:49600", "https://access.redhat.com/errata/RHSA-2026:49838", "https://access.redhat.com/errata/RHSA-2026:49944", "https://access.redhat.com/errata/RHSA-2026:51033", "https://access.redhat.com/errata/RHSA-2026:51288", "https://access.redhat.com/errata/RHSA-2026:54191", "https://access.redhat.com/errata/RHSA-2026:54603", "https://access.redhat.com/errata/RHSA-2026:54757", "https://access.redhat.com/errata/RHSA-2026:56785", "https://access.redhat.com/errata/RHSA-2026:56789", "https://access.redhat.com/errata/RHSA-2026:56852", "https://access.redhat.com/errata/RHSA-2026:56855", "https://access.redhat.com/errata/RHSA-2026:56910", "https://access.redhat.com/errata/RHSA-2026:56912", "https://access.redhat.com/errata/RHSA-2026:56913", "https://access.redhat.com/errata/RHSA-2026:57409", "https://access.redhat.com/errata/RHSA-2026:57482", "https://access.redhat.com/errata/RHSA-2026:57488", "https://access.redhat.com/errata/RHSA-2026:59830", "https://access.redhat.com/errata/RHSA-2026:59833", "https://access.redhat.com/errata/RHSA-2026:59834", "https://access.redhat.com/errata/RHSA-2026:60018", "https://access.redhat.com/errata/RHSA-2026:60520", "https://access.redhat.com/errata/RHSA-2026:61685", "https://access.redhat.com/errata/RHSA-2026:61906", "https://access.redhat.com/errata/RHSA-2026:61907", "https://access.redhat.com/errata/RHSA-2026:65534", "https://access.redhat.com/errata/RHSA-2026:65838", "https://access.redhat.com/errata/RHSA-2026:65886", "https://access.redhat.com/errata/RHSA-2026:66401", "https://access.redhat.com/errata/RHSA-2026:67319", "https://access.redhat.com/errata/RHSA-2026:68504", "https://access.redhat.com/errata/RHSA-2026:9385", "https://access.redhat.com/security/cve/CVE-2026-32280", "https://bugzilla.redhat.com/2456333", "https://bugzilla.redhat.com/2456339", "https://bugzilla.redhat.com/show_bug.cgi?id=2456333", "https://bugzilla.redhat.com/show_bug.cgi?id=2456339", "https://bugzilla.redhat.com/show_bug.cgi?id=2467809", "https://bugzilla.redhat.com/show_bug.cgi?id=2467820", "https://bugzilla.redhat.com/show_bug.cgi?id=2467822", "https://bugzilla.redhat.com/show_bug.cgi?id=2480756", "https://bugzilla.redhat.com/show_bug.cgi?id=2484204", "https://bugzilla.redhat.com/show_bug.cgi?id=2515815", "https://bugzilla.redhat.com/show_bug.cgi?id=2515820", "https://bugzilla.redhat.com/show_bug.cgi?id=2515827", "https://bugzilla.redhat.com/show_bug.cgi?id=2515838", "https://bugzilla.redhat.com/show_bug.cgi?id=2515839", "https://bugzilla.redhat.com/show_bug.cgi?id=2515840", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32280", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32281", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33811", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39820", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39821", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42499", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42504", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56859", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862", "https://errata.almalinux.org/9/ALSA-2026-49838.html", "https://errata.rockylinux.org/RLSA-2026:65886", "https://go.dev/cl/758320", "https://go.dev/issue/78282", "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU", "https://linux.oracle.com/cve/CVE-2026-32280.html", "https://linux.oracle.com/errata/ELSA-2026-65886-0.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-32280", "https://pkg.go.dev/vuln/GO-2026-4947", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32280.json", "https://www.cve.org/CVERecord?id=CVE-2026-32280" ], "PublishedDate": "2026-04-08T02:16:03.247Z", "LastModifiedDate": "2026-09-18T13:17:45.92Z" }, { "VulnerabilityID": "CVE-2026-32281", "VendorIDs": [ "GO-2026-4946" ], "PkgID": "stdlib@v1.23.1", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.23.1", "UID": "b5bc065575324e13" }, "InstalledVersion": "v1.23.1", "FixedVersion": "1.25.9, 1.26.2", "Status": "fixed", "Layer": { "DiffID": "sha256:3c2b2a22a8b623353d36ffdd442d8f955bc91ae69a99ca6776da39ecd6014a4d" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-32281", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:539a493d7480da19a8bc7fd6f02e63be667c2adfc13d790eeb6a093d382b8a0f", "Title": "crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation", "Description": "Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service. This only affects validation of otherwise trusted certificate chains, issued by a root CA in the VerifyOptions.Roots CertPool, or in the system certificate pool.", "Severity": "HIGH", "CweIDs": [ "CWE-295" ], "VendorSeverity": { "alma": 3, "amazon": 3, "bitnami": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "rocky": 3 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.9 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:49838", "https://access.redhat.com/errata/RHSA-2026:65886", "https://access.redhat.com/security/cve/CVE-2026-32281", "https://bugzilla.redhat.com/2456333", "https://bugzilla.redhat.com/2456339", "https://bugzilla.redhat.com/show_bug.cgi?id=2456333", "https://bugzilla.redhat.com/show_bug.cgi?id=2456339", "https://bugzilla.redhat.com/show_bug.cgi?id=2467809", "https://bugzilla.redhat.com/show_bug.cgi?id=2467820", "https://bugzilla.redhat.com/show_bug.cgi?id=2467822", "https://bugzilla.redhat.com/show_bug.cgi?id=2480756", "https://bugzilla.redhat.com/show_bug.cgi?id=2484204", "https://bugzilla.redhat.com/show_bug.cgi?id=2515815", "https://bugzilla.redhat.com/show_bug.cgi?id=2515820", "https://bugzilla.redhat.com/show_bug.cgi?id=2515827", "https://bugzilla.redhat.com/show_bug.cgi?id=2515838", "https://bugzilla.redhat.com/show_bug.cgi?id=2515839", "https://bugzilla.redhat.com/show_bug.cgi?id=2515840", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32280", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32281", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33811", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39820", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39821", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42499", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42504", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56859", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862", "https://errata.almalinux.org/9/ALSA-2026-49838.html", "https://errata.rockylinux.org/RLSA-2026:65886", "https://go.dev/cl/758061", "https://go.dev/issue/78281", "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU", "https://linux.oracle.com/cve/CVE-2026-32281.html", "https://linux.oracle.com/errata/ELSA-2026-67148-0.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-32281", "https://pkg.go.dev/vuln/GO-2026-4946", "https://www.cve.org/CVERecord?id=CVE-2026-32281" ], "PublishedDate": "2026-04-08T02:16:03.35Z", "LastModifiedDate": "2026-07-25T10:10:00.167Z" }, { "VulnerabilityID": "CVE-2026-32283", "VendorIDs": [ "GO-2026-4870" ], "PkgID": "stdlib@v1.23.1", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.23.1", "UID": "b5bc065575324e13" }, "InstalledVersion": "v1.23.1", "FixedVersion": "1.25.9, 1.26.2", "Status": "fixed", "Layer": { "DiffID": "sha256:3c2b2a22a8b623353d36ffdd442d8f955bc91ae69a99ca6776da39ecd6014a4d" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-32283", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:e9fb458582e5c76d3a33b3bfd745c5c6fee8a23d8c3477b5ed76ea5344f1c50b", "Title": "crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages", "Description": "If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled consumption of resources. This can lead to a denial of service. This only affects TLS 1.3.", "Severity": "HIGH", "CweIDs": [ "CWE-770", "CWE-764" ], "VendorSeverity": { "alma": 3, "amazon": 3, "bitnami": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:10217", "https://access.redhat.com/errata/RHSA-2026:10219", "https://access.redhat.com/errata/RHSA-2026:10704", "https://access.redhat.com/errata/RHSA-2026:11507", "https://access.redhat.com/errata/RHSA-2026:11514", "https://access.redhat.com/errata/RHSA-2026:11704", "https://access.redhat.com/errata/RHSA-2026:11711", "https://access.redhat.com/errata/RHSA-2026:11712", "https://access.redhat.com/errata/RHSA-2026:11863", "https://access.redhat.com/errata/RHSA-2026:11881", "https://access.redhat.com/errata/RHSA-2026:14162", "https://access.redhat.com/errata/RHSA-2026:14200", "https://access.redhat.com/errata/RHSA-2026:14391", "https://access.redhat.com/errata/RHSA-2026:15980", "https://access.redhat.com/errata/RHSA-2026:16021", "https://access.redhat.com/errata/RHSA-2026:16024", "https://access.redhat.com/errata/RHSA-2026:16101", "https://access.redhat.com/errata/RHSA-2026:16102", "https://access.redhat.com/errata/RHSA-2026:16875", "https://access.redhat.com/errata/RHSA-2026:17075", "https://access.redhat.com/errata/RHSA-2026:17084", "https://access.redhat.com/errata/RHSA-2026:17287", "https://access.redhat.com/errata/RHSA-2026:18027", "https://access.redhat.com/errata/RHSA-2026:18032", "https://access.redhat.com/errata/RHSA-2026:19126", "https://access.redhat.com/errata/RHSA-2026:19132", "https://access.redhat.com/errata/RHSA-2026:19133", "https://access.redhat.com/errata/RHSA-2026:19134", "https://access.redhat.com/errata/RHSA-2026:19135", "https://access.redhat.com/errata/RHSA-2026:19136", "https://access.redhat.com/errata/RHSA-2026:19137", "https://access.redhat.com/errata/RHSA-2026:19139", "https://access.redhat.com/errata/RHSA-2026:19144", "https://access.redhat.com/errata/RHSA-2026:19156", "https://access.redhat.com/errata/RHSA-2026:19350", "https://access.redhat.com/errata/RHSA-2026:19351", "https://access.redhat.com/errata/RHSA-2026:19352", "https://access.redhat.com/errata/RHSA-2026:19353", "https://access.redhat.com/errata/RHSA-2026:19369", "https://access.redhat.com/errata/RHSA-2026:19450", "https://access.redhat.com/errata/RHSA-2026:19550", "https://access.redhat.com/errata/RHSA-2026:19634", "https://access.redhat.com/errata/RHSA-2026:19714", "https://access.redhat.com/errata/RHSA-2026:19715", "https://access.redhat.com/errata/RHSA-2026:19719", "https://access.redhat.com/errata/RHSA-2026:19720", "https://access.redhat.com/errata/RHSA-2026:19721", "https://access.redhat.com/errata/RHSA-2026:19722", "https://access.redhat.com/errata/RHSA-2026:19750", "https://access.redhat.com/errata/RHSA-2026:19839", "https://access.redhat.com/errata/RHSA-2026:20556", "https://access.redhat.com/errata/RHSA-2026:20569", "https://access.redhat.com/errata/RHSA-2026:20570", "https://access.redhat.com/errata/RHSA-2026:20571", "https://access.redhat.com/errata/RHSA-2026:20607", "https://access.redhat.com/errata/RHSA-2026:20608", "https://access.redhat.com/errata/RHSA-2026:20609", "https://access.redhat.com/errata/RHSA-2026:21769", "https://access.redhat.com/errata/RHSA-2026:22347", "https://access.redhat.com/errata/RHSA-2026:22423", "https://access.redhat.com/errata/RHSA-2026:22450", "https://access.redhat.com/errata/RHSA-2026:22485", "https://access.redhat.com/errata/RHSA-2026:22709", "https://access.redhat.com/errata/RHSA-2026:22713", "https://access.redhat.com/errata/RHSA-2026:22714", "https://access.redhat.com/errata/RHSA-2026:22937", "https://access.redhat.com/errata/RHSA-2026:23102", "https://access.redhat.com/errata/RHSA-2026:23103", "https://access.redhat.com/errata/RHSA-2026:23228", "https://access.redhat.com/errata/RHSA-2026:23345", "https://access.redhat.com/errata/RHSA-2026:24337", "https://access.redhat.com/errata/RHSA-2026:24470", "https://access.redhat.com/errata/RHSA-2026:24761", "https://access.redhat.com/errata/RHSA-2026:24762", "https://access.redhat.com/errata/RHSA-2026:25248", "https://access.redhat.com/errata/RHSA-2026:25250", "https://access.redhat.com/errata/RHSA-2026:25251", "https://access.redhat.com/errata/RHSA-2026:25252", "https://access.redhat.com/errata/RHSA-2026:26447", "https://access.redhat.com/errata/RHSA-2026:26571", "https://access.redhat.com/errata/RHSA-2026:26636", "https://access.redhat.com/errata/RHSA-2026:27076", "https://access.redhat.com/errata/RHSA-2026:28038", "https://access.redhat.com/errata/RHSA-2026:28047", "https://access.redhat.com/errata/RHSA-2026:28074", "https://access.redhat.com/errata/RHSA-2026:29035", "https://access.redhat.com/errata/RHSA-2026:29195", "https://access.redhat.com/errata/RHSA-2026:29455", "https://access.redhat.com/errata/RHSA-2026:29703", "https://access.redhat.com/errata/RHSA-2026:33722", "https://access.redhat.com/errata/RHSA-2026:34192", "https://access.redhat.com/errata/RHSA-2026:34196", "https://access.redhat.com/errata/RHSA-2026:34197", "https://access.redhat.com/errata/RHSA-2026:34365", "https://access.redhat.com/errata/RHSA-2026:36796", "https://access.redhat.com/errata/RHSA-2026:39810", "https://access.redhat.com/errata/RHSA-2026:41019", "https://access.redhat.com/errata/RHSA-2026:41928", "https://access.redhat.com/errata/RHSA-2026:42644", "https://access.redhat.com/errata/RHSA-2026:47712", "https://access.redhat.com/errata/RHSA-2026:47714", "https://access.redhat.com/errata/RHSA-2026:47716", "https://access.redhat.com/errata/RHSA-2026:47719", "https://access.redhat.com/errata/RHSA-2026:47721", "https://access.redhat.com/errata/RHSA-2026:47722", "https://access.redhat.com/errata/RHSA-2026:47910", "https://access.redhat.com/errata/RHSA-2026:48036", "https://access.redhat.com/errata/RHSA-2026:48790", "https://access.redhat.com/errata/RHSA-2026:49509", "https://access.redhat.com/errata/RHSA-2026:49600", "https://access.redhat.com/errata/RHSA-2026:49944", "https://access.redhat.com/errata/RHSA-2026:51288", "https://access.redhat.com/errata/RHSA-2026:54191", "https://access.redhat.com/errata/RHSA-2026:54435", "https://access.redhat.com/errata/RHSA-2026:54757", "https://access.redhat.com/errata/RHSA-2026:55898", "https://access.redhat.com/errata/RHSA-2026:55900", "https://access.redhat.com/errata/RHSA-2026:55901", "https://access.redhat.com/errata/RHSA-2026:55902", "https://access.redhat.com/errata/RHSA-2026:55903", "https://access.redhat.com/errata/RHSA-2026:56910", "https://access.redhat.com/errata/RHSA-2026:57409", "https://access.redhat.com/errata/RHSA-2026:57801", "https://access.redhat.com/errata/RHSA-2026:57802", "https://access.redhat.com/errata/RHSA-2026:60520", "https://access.redhat.com/errata/RHSA-2026:65126", "https://access.redhat.com/errata/RHSA-2026:65343", "https://access.redhat.com/errata/RHSA-2026:65514", "https://access.redhat.com/errata/RHSA-2026:66022", "https://access.redhat.com/errata/RHSA-2026:66084", "https://access.redhat.com/errata/RHSA-2026:66401", "https://access.redhat.com/errata/RHSA-2026:66523", "https://access.redhat.com/errata/RHSA-2026:67319", "https://access.redhat.com/errata/RHSA-2026:68504", "https://access.redhat.com/errata/RHSA-2026:7291", "https://access.redhat.com/errata/RHSA-2026:7385", "https://access.redhat.com/security/cve/CVE-2026-32283", "https://bugzilla.redhat.com/2445356", "https://bugzilla.redhat.com/2456333", "https://bugzilla.redhat.com/2456338", "https://bugzilla.redhat.com/2456339", "https://bugzilla.redhat.com/show_bug.cgi?id=2445356", "https://bugzilla.redhat.com/show_bug.cgi?id=2456333", "https://bugzilla.redhat.com/show_bug.cgi?id=2456338", "https://bugzilla.redhat.com/show_bug.cgi?id=2456339", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25679", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32280", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32281", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32283", "https://errata.almalinux.org/9/ALSA-2026-29703.html", "https://errata.rockylinux.org/RLSA-2026:29703", "https://go.dev/cl/763767", "https://go.dev/issue/78334", "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU", "https://linux.oracle.com/cve/CVE-2026-32283.html", "https://linux.oracle.com/errata/ELSA-2026-48790.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-32283", "https://pkg.go.dev/vuln/GO-2026-4870", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32283.json", "https://www.cve.org/CVERecord?id=CVE-2026-32283" ], "PublishedDate": "2026-04-08T02:16:03.58Z", "LastModifiedDate": "2026-09-18T13:17:48.437Z" }, { "VulnerabilityID": "CVE-2026-33811", "VendorIDs": [ "GO-2026-4981" ], "PkgID": "stdlib@v1.23.1", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.23.1", "UID": "b5bc065575324e13" }, "InstalledVersion": "v1.23.1", "FixedVersion": "1.25.10, 1.26.3", "Status": "fixed", "Layer": { "DiffID": "sha256:3c2b2a22a8b623353d36ffdd442d8f955bc91ae69a99ca6776da39ecd6014a4d" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-33811", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:cb7596023b84fd600c5ac8172bddbbced2eb8c1dad4c725b3d3c51fd7a616d23", "Title": "net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME", "Description": "When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash.", "Severity": "HIGH", "CweIDs": [ "CWE-415", "CWE-1341" ], "VendorSeverity": { "alma": 3, "amazon": 3, "bitnami": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:22112", "https://access.redhat.com/errata/RHSA-2026:22120", "https://access.redhat.com/errata/RHSA-2026:22121", "https://access.redhat.com/errata/RHSA-2026:23262", "https://access.redhat.com/errata/RHSA-2026:23264", "https://access.redhat.com/errata/RHSA-2026:33120", "https://access.redhat.com/errata/RHSA-2026:33123", "https://access.redhat.com/errata/RHSA-2026:33142", "https://access.redhat.com/errata/RHSA-2026:33150", "https://access.redhat.com/errata/RHSA-2026:33574", "https://access.redhat.com/errata/RHSA-2026:34357", "https://access.redhat.com/errata/RHSA-2026:34359", "https://access.redhat.com/errata/RHSA-2026:34364", "https://access.redhat.com/errata/RHSA-2026:35832", "https://access.redhat.com/errata/RHSA-2026:35993", "https://access.redhat.com/errata/RHSA-2026:35994", "https://access.redhat.com/errata/RHSA-2026:35995", "https://access.redhat.com/errata/RHSA-2026:36207", "https://access.redhat.com/errata/RHSA-2026:36319", "https://access.redhat.com/errata/RHSA-2026:36617", "https://access.redhat.com/errata/RHSA-2026:36625", "https://access.redhat.com/errata/RHSA-2026:36648", "https://access.redhat.com/errata/RHSA-2026:36651", "https://access.redhat.com/errata/RHSA-2026:36776", "https://access.redhat.com/errata/RHSA-2026:36796", "https://access.redhat.com/errata/RHSA-2026:36797", "https://access.redhat.com/errata/RHSA-2026:38504", "https://access.redhat.com/errata/RHSA-2026:39266", "https://access.redhat.com/errata/RHSA-2026:39272", "https://access.redhat.com/errata/RHSA-2026:39319", "https://access.redhat.com/errata/RHSA-2026:39573", "https://access.redhat.com/errata/RHSA-2026:39810", "https://access.redhat.com/errata/RHSA-2026:40118", "https://access.redhat.com/errata/RHSA-2026:40119", "https://access.redhat.com/errata/RHSA-2026:40945", "https://access.redhat.com/errata/RHSA-2026:41019", "https://access.redhat.com/errata/RHSA-2026:41030", "https://access.redhat.com/errata/RHSA-2026:41055", "https://access.redhat.com/errata/RHSA-2026:41928", "https://access.redhat.com/errata/RHSA-2026:42043", "https://access.redhat.com/errata/RHSA-2026:42047", "https://access.redhat.com/errata/RHSA-2026:42048", "https://access.redhat.com/errata/RHSA-2026:42049", "https://access.redhat.com/errata/RHSA-2026:42050", "https://access.redhat.com/errata/RHSA-2026:42051", "https://access.redhat.com/errata/RHSA-2026:42078", "https://access.redhat.com/errata/RHSA-2026:42079", "https://access.redhat.com/errata/RHSA-2026:42082", "https://access.redhat.com/errata/RHSA-2026:42132", "https://access.redhat.com/errata/RHSA-2026:42150", "https://access.redhat.com/errata/RHSA-2026:42151", "https://access.redhat.com/errata/RHSA-2026:42240", "https://access.redhat.com/errata/RHSA-2026:42644", "https://access.redhat.com/errata/RHSA-2026:42852", "https://access.redhat.com/errata/RHSA-2026:42946", "https://access.redhat.com/errata/RHSA-2026:43038", "https://access.redhat.com/errata/RHSA-2026:43692", "https://access.redhat.com/errata/RHSA-2026:44622", "https://access.redhat.com/errata/RHSA-2026:46885", "https://access.redhat.com/errata/RHSA-2026:47149", "https://access.redhat.com/errata/RHSA-2026:47735", "https://access.redhat.com/errata/RHSA-2026:47952", "https://access.redhat.com/errata/RHSA-2026:48151", "https://access.redhat.com/errata/RHSA-2026:49702", "https://access.redhat.com/errata/RHSA-2026:49703", "https://access.redhat.com/errata/RHSA-2026:49712", "https://access.redhat.com/errata/RHSA-2026:50205", "https://access.redhat.com/errata/RHSA-2026:50300", "https://access.redhat.com/errata/RHSA-2026:50319", "https://access.redhat.com/errata/RHSA-2026:50336", "https://access.redhat.com/errata/RHSA-2026:50843", "https://access.redhat.com/errata/RHSA-2026:51033", "https://access.redhat.com/errata/RHSA-2026:51057", "https://access.redhat.com/errata/RHSA-2026:51187", "https://access.redhat.com/errata/RHSA-2026:51194", "https://access.redhat.com/errata/RHSA-2026:51341", "https://access.redhat.com/errata/RHSA-2026:53412", "https://access.redhat.com/errata/RHSA-2026:53413", "https://access.redhat.com/errata/RHSA-2026:53415", "https://access.redhat.com/errata/RHSA-2026:53530", "https://access.redhat.com/errata/RHSA-2026:54168", "https://access.redhat.com/errata/RHSA-2026:54191", "https://access.redhat.com/errata/RHSA-2026:54274", "https://access.redhat.com/errata/RHSA-2026:54283", "https://access.redhat.com/errata/RHSA-2026:54284", "https://access.redhat.com/errata/RHSA-2026:54285", "https://access.redhat.com/errata/RHSA-2026:54286", "https://access.redhat.com/errata/RHSA-2026:54287", "https://access.redhat.com/errata/RHSA-2026:54435", "https://access.redhat.com/errata/RHSA-2026:54441", "https://access.redhat.com/errata/RHSA-2026:54500", "https://access.redhat.com/errata/RHSA-2026:54552", "https://access.redhat.com/errata/RHSA-2026:54556", "https://access.redhat.com/errata/RHSA-2026:54584", "https://access.redhat.com/errata/RHSA-2026:54602", "https://access.redhat.com/errata/RHSA-2026:54603", "https://access.redhat.com/errata/RHSA-2026:54757", "https://access.redhat.com/errata/RHSA-2026:56340", "https://access.redhat.com/errata/RHSA-2026:56785", "https://access.redhat.com/errata/RHSA-2026:56789", "https://access.redhat.com/errata/RHSA-2026:56790", "https://access.redhat.com/errata/RHSA-2026:56852", "https://access.redhat.com/errata/RHSA-2026:56855", "https://access.redhat.com/errata/RHSA-2026:56910", "https://access.redhat.com/errata/RHSA-2026:56912", "https://access.redhat.com/errata/RHSA-2026:56913", "https://access.redhat.com/errata/RHSA-2026:57191", "https://access.redhat.com/errata/RHSA-2026:57194", "https://access.redhat.com/errata/RHSA-2026:57482", "https://access.redhat.com/errata/RHSA-2026:57488", "https://access.redhat.com/errata/RHSA-2026:57649", "https://access.redhat.com/errata/RHSA-2026:59467", "https://access.redhat.com/errata/RHSA-2026:59559", "https://access.redhat.com/errata/RHSA-2026:60018", "https://access.redhat.com/errata/RHSA-2026:60025", "https://access.redhat.com/errata/RHSA-2026:60302", "https://access.redhat.com/errata/RHSA-2026:60520", "https://access.redhat.com/errata/RHSA-2026:61253", "https://access.redhat.com/errata/RHSA-2026:61313", "https://access.redhat.com/errata/RHSA-2026:65126", "https://access.redhat.com/errata/RHSA-2026:65534", "https://access.redhat.com/errata/RHSA-2026:65886", "https://access.redhat.com/errata/RHSA-2026:66022", "https://access.redhat.com/errata/RHSA-2026:67149", "https://access.redhat.com/errata/RHSA-2026:67287", "https://access.redhat.com/errata/RHSA-2026:67319", "https://access.redhat.com/security/cve/CVE-2026-33811", "https://bugzilla.redhat.com/2467822", "https://bugzilla.redhat.com/show_bug.cgi?id=2456333", "https://bugzilla.redhat.com/show_bug.cgi?id=2456339", "https://bugzilla.redhat.com/show_bug.cgi?id=2467809", "https://bugzilla.redhat.com/show_bug.cgi?id=2467820", "https://bugzilla.redhat.com/show_bug.cgi?id=2467822", "https://bugzilla.redhat.com/show_bug.cgi?id=2480756", "https://bugzilla.redhat.com/show_bug.cgi?id=2484204", "https://bugzilla.redhat.com/show_bug.cgi?id=2515815", "https://bugzilla.redhat.com/show_bug.cgi?id=2515820", "https://bugzilla.redhat.com/show_bug.cgi?id=2515827", "https://bugzilla.redhat.com/show_bug.cgi?id=2515838", "https://bugzilla.redhat.com/show_bug.cgi?id=2515839", "https://bugzilla.redhat.com/show_bug.cgi?id=2515840", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32280", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32281", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33811", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39820", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39821", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42499", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42504", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56859", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862", "https://errata.almalinux.org/9/ALSA-2026-39319.html", "https://errata.rockylinux.org/RLSA-2026:65886", "https://go.dev/cl/767860", "https://go.dev/issue/78803", "https://groups.google.com/g/golang-announce/c/qcCIEXso47M", "https://linux.oracle.com/cve/CVE-2026-33811.html", "https://linux.oracle.com/errata/ELSA-2026-65886-0.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-33811", "https://pkg.go.dev/vuln/GO-2026-4981", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33811.json", "https://www.cve.org/CVERecord?id=CVE-2026-33811" ], "PublishedDate": "2026-05-07T20:16:42.77Z", "LastModifiedDate": "2026-10-26T00:10:00.15Z" }, { "VulnerabilityID": "CVE-2026-33814", "VendorIDs": [ "GO-2026-4918" ], "PkgID": "stdlib@v1.23.1", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.23.1", "UID": "b5bc065575324e13" }, "InstalledVersion": "v1.23.1", "FixedVersion": "1.25.10, 1.26.3", "Status": "fixed", "Layer": { "DiffID": "sha256:3c2b2a22a8b623353d36ffdd442d8f955bc91ae69a99ca6776da39ecd6014a4d" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-33814", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:189f434e2313abbb7912a0fbd1c26dcf463a9b1358439fe55fb0128afe2758a7", "Title": "net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame", "Description": "When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.", "Severity": "HIGH", "CweIDs": [ "CWE-835", "CWE-606" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "bitnami": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:22112", "https://access.redhat.com/errata/RHSA-2026:22120", "https://access.redhat.com/errata/RHSA-2026:22121", "https://access.redhat.com/errata/RHSA-2026:23262", "https://access.redhat.com/errata/RHSA-2026:23264", "https://access.redhat.com/errata/RHSA-2026:33120", "https://access.redhat.com/errata/RHSA-2026:33123", "https://access.redhat.com/errata/RHSA-2026:33142", "https://access.redhat.com/errata/RHSA-2026:33150", "https://access.redhat.com/errata/RHSA-2026:34342", "https://access.redhat.com/errata/RHSA-2026:37387", "https://access.redhat.com/errata/RHSA-2026:42644", "https://access.redhat.com/errata/RHSA-2026:43692", "https://access.redhat.com/errata/RHSA-2026:49702", "https://access.redhat.com/errata/RHSA-2026:49712", "https://access.redhat.com/errata/RHSA-2026:50205", "https://access.redhat.com/errata/RHSA-2026:54274", "https://access.redhat.com/errata/RHSA-2026:54283", "https://access.redhat.com/errata/RHSA-2026:54284", "https://access.redhat.com/errata/RHSA-2026:54285", "https://access.redhat.com/errata/RHSA-2026:54286", "https://access.redhat.com/errata/RHSA-2026:54287", "https://access.redhat.com/errata/RHSA-2026:56854", "https://access.redhat.com/errata/RHSA-2026:56912", "https://access.redhat.com/errata/RHSA-2026:57191", "https://access.redhat.com/errata/RHSA-2026:57194", "https://access.redhat.com/errata/RHSA-2026:57365", "https://access.redhat.com/errata/RHSA-2026:57367", "https://access.redhat.com/errata/RHSA-2026:57408", "https://access.redhat.com/errata/RHSA-2026:57545", "https://access.redhat.com/errata/RHSA-2026:57649", "https://access.redhat.com/errata/RHSA-2026:57845", "https://access.redhat.com/errata/RHSA-2026:59833", "https://access.redhat.com/errata/RHSA-2026:60023", "https://access.redhat.com/errata/RHSA-2026:60025", "https://access.redhat.com/errata/RHSA-2026:60441", "https://access.redhat.com/errata/RHSA-2026:60442", "https://access.redhat.com/errata/RHSA-2026:60446", "https://access.redhat.com/errata/RHSA-2026:60447", "https://access.redhat.com/errata/RHSA-2026:60454", "https://access.redhat.com/errata/RHSA-2026:60477", "https://access.redhat.com/errata/RHSA-2026:60478", "https://access.redhat.com/errata/RHSA-2026:60520", "https://access.redhat.com/errata/RHSA-2026:60668", "https://access.redhat.com/errata/RHSA-2026:61253", "https://access.redhat.com/errata/RHSA-2026:62410", "https://access.redhat.com/errata/RHSA-2026:62550", "https://access.redhat.com/errata/RHSA-2026:62551", "https://access.redhat.com/errata/RHSA-2026:63046", "https://access.redhat.com/errata/RHSA-2026:63047", "https://access.redhat.com/errata/RHSA-2026:63048", "https://access.redhat.com/errata/RHSA-2026:63050", "https://access.redhat.com/errata/RHSA-2026:63091", "https://access.redhat.com/errata/RHSA-2026:63096", "https://access.redhat.com/errata/RHSA-2026:63097", "https://access.redhat.com/errata/RHSA-2026:63103", "https://access.redhat.com/errata/RHSA-2026:63104", "https://access.redhat.com/errata/RHSA-2026:63636", "https://access.redhat.com/errata/RHSA-2026:63637", "https://access.redhat.com/errata/RHSA-2026:63639", "https://access.redhat.com/errata/RHSA-2026:65126", "https://access.redhat.com/errata/RHSA-2026:66350", "https://access.redhat.com/security/cve/CVE-2026-33814", "https://bugzilla.redhat.com/2467822", "https://bugzilla.redhat.com/show_bug.cgi?id=2467809", "https://bugzilla.redhat.com/show_bug.cgi?id=2467810", "https://bugzilla.redhat.com/show_bug.cgi?id=2467811", "https://bugzilla.redhat.com/show_bug.cgi?id=2467813", "https://bugzilla.redhat.com/show_bug.cgi?id=2467815", "https://bugzilla.redhat.com/show_bug.cgi?id=2467820", "https://bugzilla.redhat.com/show_bug.cgi?id=2467822", "https://bugzilla.redhat.com/show_bug.cgi?id=2467823", "https://bugzilla.redhat.com/show_bug.cgi?id=2467825", "https://bugzilla.redhat.com/show_bug.cgi?id=2467826", "https://bugzilla.redhat.com/show_bug.cgi?id=2467827", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33811", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33814", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39817", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39819", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39820", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39823", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39825", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39826", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39836", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42499", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42501", "https://errata.almalinux.org/9/ALSA-2026-22121.html", "https://errata.rockylinux.org/RLSA-2026:22121", "https://github.com/golang/go/issues/78476", "https://go-review.googlesource.com/c/go/+/761581", "https://go-review.googlesource.com/c/net/+/761640", "https://go.dev/cl/761581", "https://go.dev/cl/761640", "https://go.dev/issue/78476", "https://groups.google.com/g/golang-announce/c/qcCIEXso47M", "https://linux.oracle.com/cve/CVE-2026-33814.html", "https://linux.oracle.com/errata/ELSA-2026-22121.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-33814", "https://pkg.go.dev/vuln/GO-2026-4918", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33814.json", "https://ubuntu.com/security/notices/USN-8430-1", "https://ubuntu.com/security/notices/USN-8471-1", "https://ubuntu.com/security/notices/USN-8472-1", "https://ubuntu.com/security/notices/USN-8473-1", "https://www.cve.org/CVERecord?id=CVE-2026-33814" ], "PublishedDate": "2026-05-07T20:16:42.88Z", "LastModifiedDate": "2026-10-26T20:10:00.16Z" }, { "VulnerabilityID": "CVE-2026-33818", "VendorIDs": [ "GO-2026-5972" ], "PkgID": "stdlib@v1.23.1", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.23.1", "UID": "b5bc065575324e13" }, "InstalledVersion": "v1.23.1", "FixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3", "Status": "fixed", "Layer": { "DiffID": "sha256:3c2b2a22a8b623353d36ffdd442d8f955bc91ae69a99ca6776da39ecd6014a4d" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-33818", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:49de4cf28850989e4637985c28f588c5bba8786a96621b68539fcb56342a43ad", "Title": "encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal", "Description": "Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures.", "Severity": "HIGH", "CweIDs": [ "CWE-400" ], "VendorSeverity": { "alma": 3, "amazon": 3, "bitnami": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:70641", "https://access.redhat.com/security/cve/CVE-2026-33818", "https://bugzilla.redhat.com/2515815", "https://bugzilla.redhat.com/2515820", "https://bugzilla.redhat.com/2515827", "https://bugzilla.redhat.com/2515838", "https://bugzilla.redhat.com/2515839", "https://bugzilla.redhat.com/show_bug.cgi?id=2402034", "https://bugzilla.redhat.com/show_bug.cgi?id=2515815", "https://bugzilla.redhat.com/show_bug.cgi?id=2515820", "https://bugzilla.redhat.com/show_bug.cgi?id=2515827", "https://bugzilla.redhat.com/show_bug.cgi?id=2515838", "https://bugzilla.redhat.com/show_bug.cgi?id=2515839", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11395", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862", "https://errata.almalinux.org/9/ALSA-2026-70641.html", "https://errata.rockylinux.org/RLSA-2026:70641", "https://github.com/golang/go/issues/80405", "https://go.dev/cl/814980", "https://go.dev/issue/80405", "https://groups.google.com/g/golang-announce/c/94pEornpRlI", "https://linux.oracle.com/cve/CVE-2026-33818.html", "https://linux.oracle.com/errata/ELSA-2026-70641.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-33818", "https://pkg.go.dev/vuln/GO-2026-5972", "https://ubuntu.com/security/notices/USN-8935-1", "https://www.cve.org/CVERecord?id=CVE-2026-33818" ], "PublishedDate": "2026-08-13T22:17:19.84Z", "LastModifiedDate": "2026-09-03T16:37:52.17Z" }, { "VulnerabilityID": "CVE-2026-39820", "VendorIDs": [ "GO-2026-4986" ], "PkgID": "stdlib@v1.23.1", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.23.1", "UID": "b5bc065575324e13" }, "InstalledVersion": "v1.23.1", "FixedVersion": "1.25.10, 1.26.3", "Status": "fixed", "Layer": { "DiffID": "sha256:3c2b2a22a8b623353d36ffdd442d8f955bc91ae69a99ca6776da39ecd6014a4d" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-39820", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:b659ba39f32123a94f30480ede4fbd7101a9ae08c1e1e5d01692e17192bc3f24", "Title": "net/mail: golang: Go net/mail: Denial of Service via crafted email inputs", "Description": "Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations.", "Severity": "HIGH", "CweIDs": [ "CWE-770", "CWE-606" ], "VendorSeverity": { "alma": 3, "amazon": 3, "bitnami": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:22112", "https://access.redhat.com/errata/RHSA-2026:22120", "https://access.redhat.com/errata/RHSA-2026:22121", "https://access.redhat.com/errata/RHSA-2026:23262", "https://access.redhat.com/errata/RHSA-2026:23264", "https://access.redhat.com/errata/RHSA-2026:33120", "https://access.redhat.com/errata/RHSA-2026:33123", "https://access.redhat.com/errata/RHSA-2026:33142", "https://access.redhat.com/errata/RHSA-2026:33150", "https://access.redhat.com/errata/RHSA-2026:33574", "https://access.redhat.com/errata/RHSA-2026:34364", "https://access.redhat.com/errata/RHSA-2026:36319", "https://access.redhat.com/errata/RHSA-2026:36625", "https://access.redhat.com/errata/RHSA-2026:36754", "https://access.redhat.com/errata/RHSA-2026:36797", "https://access.redhat.com/errata/RHSA-2026:40262", "https://access.redhat.com/errata/RHSA-2026:41031", "https://access.redhat.com/errata/RHSA-2026:41066", "https://access.redhat.com/errata/RHSA-2026:41928", "https://access.redhat.com/errata/RHSA-2026:42146", "https://access.redhat.com/errata/RHSA-2026:42644", "https://access.redhat.com/errata/RHSA-2026:42796", "https://access.redhat.com/errata/RHSA-2026:43038", "https://access.redhat.com/errata/RHSA-2026:43052", "https://access.redhat.com/errata/RHSA-2026:43692", "https://access.redhat.com/errata/RHSA-2026:47952", "https://access.redhat.com/errata/RHSA-2026:49702", "https://access.redhat.com/errata/RHSA-2026:49712", "https://access.redhat.com/errata/RHSA-2026:50205", "https://access.redhat.com/errata/RHSA-2026:50300", "https://access.redhat.com/errata/RHSA-2026:50319", "https://access.redhat.com/errata/RHSA-2026:50336", "https://access.redhat.com/errata/RHSA-2026:50843", "https://access.redhat.com/errata/RHSA-2026:51033", "https://access.redhat.com/errata/RHSA-2026:51112", "https://access.redhat.com/errata/RHSA-2026:54274", "https://access.redhat.com/errata/RHSA-2026:54283", "https://access.redhat.com/errata/RHSA-2026:54284", "https://access.redhat.com/errata/RHSA-2026:54285", "https://access.redhat.com/errata/RHSA-2026:54286", "https://access.redhat.com/errata/RHSA-2026:54287", "https://access.redhat.com/errata/RHSA-2026:54531", "https://access.redhat.com/errata/RHSA-2026:54552", "https://access.redhat.com/errata/RHSA-2026:54555", "https://access.redhat.com/errata/RHSA-2026:54583", "https://access.redhat.com/errata/RHSA-2026:54602", "https://access.redhat.com/errata/RHSA-2026:54883", "https://access.redhat.com/errata/RHSA-2026:56340", "https://access.redhat.com/errata/RHSA-2026:56789", "https://access.redhat.com/errata/RHSA-2026:56852", "https://access.redhat.com/errata/RHSA-2026:56854", "https://access.redhat.com/errata/RHSA-2026:57194", "https://access.redhat.com/errata/RHSA-2026:57401", "https://access.redhat.com/errata/RHSA-2026:57482", "https://access.redhat.com/errata/RHSA-2026:57487", "https://access.redhat.com/errata/RHSA-2026:57649", "https://access.redhat.com/errata/RHSA-2026:57845", "https://access.redhat.com/errata/RHSA-2026:57914", "https://access.redhat.com/errata/RHSA-2026:59467", "https://access.redhat.com/errata/RHSA-2026:59830", "https://access.redhat.com/errata/RHSA-2026:59833", "https://access.redhat.com/errata/RHSA-2026:60018", "https://access.redhat.com/errata/RHSA-2026:60023", "https://access.redhat.com/errata/RHSA-2026:60520", "https://access.redhat.com/errata/RHSA-2026:61253", "https://access.redhat.com/errata/RHSA-2026:62260", "https://access.redhat.com/errata/RHSA-2026:62406", "https://access.redhat.com/errata/RHSA-2026:62407", "https://access.redhat.com/errata/RHSA-2026:62753", "https://access.redhat.com/errata/RHSA-2026:62754", "https://access.redhat.com/errata/RHSA-2026:62803", "https://access.redhat.com/errata/RHSA-2026:63022", "https://access.redhat.com/errata/RHSA-2026:65116", "https://access.redhat.com/errata/RHSA-2026:65117", "https://access.redhat.com/errata/RHSA-2026:65153", "https://access.redhat.com/errata/RHSA-2026:65335", "https://access.redhat.com/errata/RHSA-2026:65336", "https://access.redhat.com/errata/RHSA-2026:65534", "https://access.redhat.com/errata/RHSA-2026:65838", "https://access.redhat.com/errata/RHSA-2026:65886", "https://access.redhat.com/errata/RHSA-2026:65895", "https://access.redhat.com/errata/RHSA-2026:66016", "https://access.redhat.com/errata/RHSA-2026:66022", "https://access.redhat.com/errata/RHSA-2026:66327", "https://access.redhat.com/errata/RHSA-2026:67517", "https://access.redhat.com/errata/RHSA-2026:67974", "https://access.redhat.com/errata/RHSA-2026:67975", "https://access.redhat.com/errata/RHSA-2026:68334", "https://access.redhat.com/errata/RHSA-2026:68504", "https://access.redhat.com/errata/RHSA-2026:68527", "https://access.redhat.com/security/cve/CVE-2026-39820", "https://bugzilla.redhat.com/2467809", "https://bugzilla.redhat.com/2467820", "https://bugzilla.redhat.com/2480756", "https://bugzilla.redhat.com/2484204", "https://bugzilla.redhat.com/2515815", "https://bugzilla.redhat.com/2515820", "https://bugzilla.redhat.com/2515827", "https://bugzilla.redhat.com/2515838", "https://bugzilla.redhat.com/2515839", "https://bugzilla.redhat.com/2515840", "https://bugzilla.redhat.com/show_bug.cgi?id=2456333", "https://bugzilla.redhat.com/show_bug.cgi?id=2456339", "https://bugzilla.redhat.com/show_bug.cgi?id=2467809", "https://bugzilla.redhat.com/show_bug.cgi?id=2467820", "https://bugzilla.redhat.com/show_bug.cgi?id=2467822", "https://bugzilla.redhat.com/show_bug.cgi?id=2480756", "https://bugzilla.redhat.com/show_bug.cgi?id=2484204", "https://bugzilla.redhat.com/show_bug.cgi?id=2515815", "https://bugzilla.redhat.com/show_bug.cgi?id=2515820", "https://bugzilla.redhat.com/show_bug.cgi?id=2515827", "https://bugzilla.redhat.com/show_bug.cgi?id=2515838", "https://bugzilla.redhat.com/show_bug.cgi?id=2515839", "https://bugzilla.redhat.com/show_bug.cgi?id=2515840", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32280", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32281", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33811", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39820", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39821", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42499", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42504", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56859", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862", "https://errata.almalinux.org/9/ALSA-2026-65153.html", "https://errata.rockylinux.org/RLSA-2026:65886", "https://go.dev/cl/759940", "https://go.dev/issue/78566", "https://groups.google.com/g/golang-announce/c/qcCIEXso47M", "https://linux.oracle.com/cve/CVE-2026-39820.html", "https://linux.oracle.com/errata/ELSA-2026-65895-0.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-39820", "https://pkg.go.dev/vuln/GO-2026-4986", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39820.json", "https://www.cve.org/CVERecord?id=CVE-2026-39820" ], "PublishedDate": "2026-05-07T20:16:43.187Z", "LastModifiedDate": "2026-10-26T00:10:00.15Z" }, { "VulnerabilityID": "CVE-2026-39821", "VendorIDs": [ "GO-2026-5026" ], "PkgID": "stdlib@v1.23.1", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.23.1", "UID": "b5bc065575324e13" }, "InstalledVersion": "v1.23.1", "FixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3", "Status": "fixed", "Layer": { "DiffID": "sha256:3c2b2a22a8b623353d36ffdd442d8f955bc91ae69a99ca6776da39ecd6014a4d" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-39821", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:0e6e6bb74d2652a414e1ab4107d46ee0772531db93cc13de159a698ff1fd93ab", "Title": "golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing", "Description": "The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode(\"xn--example-.com\") incorrectly returns the name \"example.com\" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject \"example.com\" but permit \"xn--example-.com\". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name \"example.com\".", "Severity": "HIGH", "CweIDs": [ "CWE-1289" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 4, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N", "V3Score": 8.2 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:23262", "https://access.redhat.com/errata/RHSA-2026:23264", "https://access.redhat.com/errata/RHSA-2026:26546", "https://access.redhat.com/errata/RHSA-2026:26547", "https://access.redhat.com/errata/RHSA-2026:30650", "https://access.redhat.com/errata/RHSA-2026:30651", "https://access.redhat.com/errata/RHSA-2026:30853", "https://access.redhat.com/errata/RHSA-2026:30854", "https://access.redhat.com/errata/RHSA-2026:30855", "https://access.redhat.com/errata/RHSA-2026:33155", "https://access.redhat.com/errata/RHSA-2026:33160", "https://access.redhat.com/errata/RHSA-2026:33163", "https://access.redhat.com/errata/RHSA-2026:33173", "https://access.redhat.com/errata/RHSA-2026:33183", "https://access.redhat.com/errata/RHSA-2026:33524", "https://access.redhat.com/errata/RHSA-2026:33531", "https://access.redhat.com/errata/RHSA-2026:34342", "https://access.redhat.com/errata/RHSA-2026:34357", "https://access.redhat.com/errata/RHSA-2026:34359", "https://access.redhat.com/errata/RHSA-2026:34364", "https://access.redhat.com/errata/RHSA-2026:34789", "https://access.redhat.com/errata/RHSA-2026:35826", "https://access.redhat.com/errata/RHSA-2026:35827", "https://access.redhat.com/errata/RHSA-2026:35828", "https://access.redhat.com/errata/RHSA-2026:35829", "https://access.redhat.com/errata/RHSA-2026:35830", "https://access.redhat.com/errata/RHSA-2026:35831", "https://access.redhat.com/errata/RHSA-2026:35993", "https://access.redhat.com/errata/RHSA-2026:35994", "https://access.redhat.com/errata/RHSA-2026:36105", "https://access.redhat.com/errata/RHSA-2026:36167", "https://access.redhat.com/errata/RHSA-2026:36207", "https://access.redhat.com/errata/RHSA-2026:36648", "https://access.redhat.com/errata/RHSA-2026:36651", "https://access.redhat.com/errata/RHSA-2026:36796", "https://access.redhat.com/errata/RHSA-2026:36797", "https://access.redhat.com/errata/RHSA-2026:36808", "https://access.redhat.com/errata/RHSA-2026:36820", "https://access.redhat.com/errata/RHSA-2026:36883", "https://access.redhat.com/errata/RHSA-2026:37387", "https://access.redhat.com/errata/RHSA-2026:37435", "https://access.redhat.com/errata/RHSA-2026:37436", "https://access.redhat.com/errata/RHSA-2026:38995", "https://access.redhat.com/errata/RHSA-2026:39005", "https://access.redhat.com/errata/RHSA-2026:39573", "https://access.redhat.com/errata/RHSA-2026:39879", "https://access.redhat.com/errata/RHSA-2026:40118", "https://access.redhat.com/errata/RHSA-2026:40262", "https://access.redhat.com/errata/RHSA-2026:40945", "https://access.redhat.com/errata/RHSA-2026:41019", "https://access.redhat.com/errata/RHSA-2026:41030", "https://access.redhat.com/errata/RHSA-2026:41031", "https://access.redhat.com/errata/RHSA-2026:41036", "https://access.redhat.com/errata/RHSA-2026:41055", "https://access.redhat.com/errata/RHSA-2026:41066", "https://access.redhat.com/errata/RHSA-2026:41928", "https://access.redhat.com/errata/RHSA-2026:41930", "https://access.redhat.com/errata/RHSA-2026:42043", "https://access.redhat.com/errata/RHSA-2026:42047", "https://access.redhat.com/errata/RHSA-2026:42048", "https://access.redhat.com/errata/RHSA-2026:42049", "https://access.redhat.com/errata/RHSA-2026:42050", "https://access.redhat.com/errata/RHSA-2026:42051", "https://access.redhat.com/errata/RHSA-2026:42078", "https://access.redhat.com/errata/RHSA-2026:42079", "https://access.redhat.com/errata/RHSA-2026:42080", "https://access.redhat.com/errata/RHSA-2026:42082", "https://access.redhat.com/errata/RHSA-2026:42132", "https://access.redhat.com/errata/RHSA-2026:42142", "https://access.redhat.com/errata/RHSA-2026:42146", "https://access.redhat.com/errata/RHSA-2026:42150", "https://access.redhat.com/errata/RHSA-2026:42151", "https://access.redhat.com/errata/RHSA-2026:42240", "https://access.redhat.com/errata/RHSA-2026:42644", "https://access.redhat.com/errata/RHSA-2026:42796", "https://access.redhat.com/errata/RHSA-2026:42852", "https://access.redhat.com/errata/RHSA-2026:43038", "https://access.redhat.com/errata/RHSA-2026:43052", "https://access.redhat.com/errata/RHSA-2026:43692", "https://access.redhat.com/errata/RHSA-2026:44622", "https://access.redhat.com/errata/RHSA-2026:44624", "https://access.redhat.com/errata/RHSA-2026:46395", "https://access.redhat.com/errata/RHSA-2026:47149", "https://access.redhat.com/errata/RHSA-2026:47735", "https://access.redhat.com/errata/RHSA-2026:47737", "https://access.redhat.com/errata/RHSA-2026:47952", "https://access.redhat.com/errata/RHSA-2026:49702", "https://access.redhat.com/errata/RHSA-2026:49712", "https://access.redhat.com/errata/RHSA-2026:50300", "https://access.redhat.com/errata/RHSA-2026:50843", "https://access.redhat.com/errata/RHSA-2026:51033", "https://access.redhat.com/errata/RHSA-2026:51112", "https://access.redhat.com/errata/RHSA-2026:51187", "https://access.redhat.com/errata/RHSA-2026:51194", "https://access.redhat.com/errata/RHSA-2026:51341", "https://access.redhat.com/errata/RHSA-2026:52826", "https://access.redhat.com/errata/RHSA-2026:53374", "https://access.redhat.com/errata/RHSA-2026:53412", "https://access.redhat.com/errata/RHSA-2026:53413", "https://access.redhat.com/errata/RHSA-2026:53415", "https://access.redhat.com/errata/RHSA-2026:53530", "https://access.redhat.com/errata/RHSA-2026:54191", "https://access.redhat.com/errata/RHSA-2026:54274", "https://access.redhat.com/errata/RHSA-2026:54283", "https://access.redhat.com/errata/RHSA-2026:54284", "https://access.redhat.com/errata/RHSA-2026:54285", "https://access.redhat.com/errata/RHSA-2026:54286", "https://access.redhat.com/errata/RHSA-2026:54287", "https://access.redhat.com/errata/RHSA-2026:54395", "https://access.redhat.com/errata/RHSA-2026:54401", "https://access.redhat.com/errata/RHSA-2026:54435", "https://access.redhat.com/errata/RHSA-2026:54441", "https://access.redhat.com/errata/RHSA-2026:54531", "https://access.redhat.com/errata/RHSA-2026:54580", "https://access.redhat.com/errata/RHSA-2026:54757", "https://access.redhat.com/errata/RHSA-2026:56143", "https://access.redhat.com/errata/RHSA-2026:56223", "https://access.redhat.com/errata/RHSA-2026:56340", "https://access.redhat.com/errata/RHSA-2026:56431", "https://access.redhat.com/errata/RHSA-2026:57194", "https://access.redhat.com/errata/RHSA-2026:57541", "https://access.redhat.com/errata/RHSA-2026:57649", "https://access.redhat.com/errata/RHSA-2026:57845", "https://access.redhat.com/errata/RHSA-2026:59546", "https://access.redhat.com/errata/RHSA-2026:59549", "https://access.redhat.com/errata/RHSA-2026:59562", "https://access.redhat.com/errata/RHSA-2026:60315", "https://access.redhat.com/errata/RHSA-2026:60354", "https://access.redhat.com/errata/RHSA-2026:60387", "https://access.redhat.com/errata/RHSA-2026:60520", "https://access.redhat.com/errata/RHSA-2026:61245", "https://access.redhat.com/errata/RHSA-2026:61253", "https://access.redhat.com/errata/RHSA-2026:62549", "https://access.redhat.com/errata/RHSA-2026:63134", "https://access.redhat.com/errata/RHSA-2026:65126", "https://access.redhat.com/errata/RHSA-2026:65153", "https://access.redhat.com/errata/RHSA-2026:65359", "https://access.redhat.com/errata/RHSA-2026:65534", "https://access.redhat.com/errata/RHSA-2026:65851", "https://access.redhat.com/errata/RHSA-2026:65886", "https://access.redhat.com/errata/RHSA-2026:66016", "https://access.redhat.com/errata/RHSA-2026:66022", "https://access.redhat.com/errata/RHSA-2026:66350", "https://access.redhat.com/errata/RHSA-2026:66432", "https://access.redhat.com/errata/RHSA-2026:67149", "https://access.redhat.com/errata/RHSA-2026:67159", "https://access.redhat.com/errata/RHSA-2026:67160", "https://access.redhat.com/errata/RHSA-2026:67287", "https://access.redhat.com/errata/RHSA-2026:67319", "https://access.redhat.com/errata/RHSA-2026:67517", "https://access.redhat.com/errata/RHSA-2026:68504", "https://access.redhat.com/security/cve/CVE-2026-39821", "https://bugzilla.redhat.com/2467809", "https://bugzilla.redhat.com/2467820", "https://bugzilla.redhat.com/2480756", "https://bugzilla.redhat.com/2484204", "https://bugzilla.redhat.com/2515815", "https://bugzilla.redhat.com/2515820", "https://bugzilla.redhat.com/2515827", "https://bugzilla.redhat.com/2515838", "https://bugzilla.redhat.com/2515839", "https://bugzilla.redhat.com/2515840", "https://bugzilla.redhat.com/show_bug.cgi?id=2456333", "https://bugzilla.redhat.com/show_bug.cgi?id=2456339", "https://bugzilla.redhat.com/show_bug.cgi?id=2467809", "https://bugzilla.redhat.com/show_bug.cgi?id=2467820", "https://bugzilla.redhat.com/show_bug.cgi?id=2467822", "https://bugzilla.redhat.com/show_bug.cgi?id=2480756", "https://bugzilla.redhat.com/show_bug.cgi?id=2484204", "https://bugzilla.redhat.com/show_bug.cgi?id=2515815", "https://bugzilla.redhat.com/show_bug.cgi?id=2515820", "https://bugzilla.redhat.com/show_bug.cgi?id=2515827", "https://bugzilla.redhat.com/show_bug.cgi?id=2515838", "https://bugzilla.redhat.com/show_bug.cgi?id=2515839", "https://bugzilla.redhat.com/show_bug.cgi?id=2515840", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32280", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32281", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33811", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39820", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39821", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42499", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42504", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56859", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862", "https://errata.almalinux.org/9/ALSA-2026-65153.html", "https://errata.rockylinux.org/RLSA-2026:65886", "https://go.dev/cl/767220", "https://go.dev/issue/78760", "https://groups.google.com/g/golang-announce/c/94pEornpRlI", "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8", "https://linux.oracle.com/cve/CVE-2026-39821.html", "https://linux.oracle.com/errata/ELSA-2026-66432-0.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-39821", "https://pkg.go.dev/vuln/GO-2026-5026", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39821.json", "https://ubuntu.com/security/notices/USN-8416-1", "https://ubuntu.com/security/notices/USN-8883-1", "https://ubuntu.com/security/notices/USN-8883-2", "https://ubuntu.com/security/notices/USN-8900-1", "https://ubuntu.com/security/notices/USN-8914-1", "https://www.cve.org/CVERecord?id=CVE-2026-39821" ], "PublishedDate": "2026-05-22T16:16:20.41Z", "LastModifiedDate": "2026-09-17T12:18:05.767Z" }, { "VulnerabilityID": "CVE-2026-39822", "VendorIDs": [ "GO-2026-4970" ], "PkgID": "stdlib@v1.23.1", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.23.1", "UID": "b5bc065575324e13" }, "InstalledVersion": "v1.23.1", "FixedVersion": "1.25.12, 1.26.5, 1.27.0-rc.2", "Status": "fixed", "Layer": { "DiffID": "sha256:3c2b2a22a8b623353d36ffdd442d8f955bc91ae69a99ca6776da39ecd6014a4d" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-39822", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:69c5663722bac5c4b5557589369d4cf2f6b833adb3a27a4489c353c8aa7a0a15", "Title": "golang: Go os.Root: Symlink following vulnerability allows directory traversal", "Description": "On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /. For example, 'root.Open(\"symlink/\")' will open \"symlink\" even when \"symlink\" is a symbolic link pointing outside of the root.", "Severity": "HIGH", "CweIDs": [ "CWE-61" ], "VendorSeverity": { "alma": 3, "amazon": 2, "azure": 3, "bitnami": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:38878", "https://access.redhat.com/security/cve/CVE-2026-39822", "https://bugzilla.redhat.com/2498152", "https://bugzilla.redhat.com/show_bug.cgi?id=2498152", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39822", "https://errata.almalinux.org/9/ALSA-2026-38878.html", "https://errata.rockylinux.org/RLSA-2026:38878", "https://github.com/golang/go/issues/79005", "https://go.dev/cl/797880", "https://go.dev/issue/79005", "https://groups.google.com/g/golang-announce/c/OrmQE_Yp5Sc", "https://linux.oracle.com/cve/CVE-2026-39822.html", "https://linux.oracle.com/errata/ELSA-2026-38995.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-39822", "https://pkg.go.dev/vuln/GO-2026-4970", "https://www.cve.org/CVERecord?id=CVE-2026-39822" ], "PublishedDate": "2026-07-08T17:17:21.31Z", "LastModifiedDate": "2026-10-25T17:10:00.197Z" }, { "VulnerabilityID": "CVE-2026-39836", "VendorIDs": [ "GO-2026-4971" ], "PkgID": "stdlib@v1.23.1", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.23.1", "UID": "b5bc065575324e13" }, "InstalledVersion": "v1.23.1", "FixedVersion": "1.25.10, 1.26.3", "Status": "fixed", "Layer": { "DiffID": "sha256:3c2b2a22a8b623353d36ffdd442d8f955bc91ae69a99ca6776da39ecd6014a4d" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-39836", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:31d4aa4b6a2ac76100de616b7691a60f288314be91301f4d2d5949f9493117f0", "Title": "net: golang: Go net package: Denial of Service via NUL byte in Dial and LookupPort on Windows", "Description": "The Dial and LookupPort functions panic on Windows when provided with an input containing a NUL (0).", "Severity": "HIGH", "CweIDs": [ "CWE-476" ], "VendorSeverity": { "alma": 3, "bitnami": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "rocky": 3 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:22121", "https://access.redhat.com/security/cve/CVE-2026-39836", "https://bugzilla.redhat.com/2467822", "https://bugzilla.redhat.com/show_bug.cgi?id=2467809", "https://bugzilla.redhat.com/show_bug.cgi?id=2467810", "https://bugzilla.redhat.com/show_bug.cgi?id=2467811", "https://bugzilla.redhat.com/show_bug.cgi?id=2467813", "https://bugzilla.redhat.com/show_bug.cgi?id=2467815", "https://bugzilla.redhat.com/show_bug.cgi?id=2467820", "https://bugzilla.redhat.com/show_bug.cgi?id=2467822", "https://bugzilla.redhat.com/show_bug.cgi?id=2467823", "https://bugzilla.redhat.com/show_bug.cgi?id=2467825", "https://bugzilla.redhat.com/show_bug.cgi?id=2467826", "https://bugzilla.redhat.com/show_bug.cgi?id=2467827", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33811", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33814", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39817", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39819", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39820", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39823", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39825", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39826", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39836", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42499", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42501", "https://errata.almalinux.org/9/ALSA-2026-22121.html", "https://errata.rockylinux.org/RLSA-2026:22121", "https://go.dev/cl/775320", "https://go.dev/issue/79006", "https://groups.google.com/g/golang-announce/c/qcCIEXso47M", "https://linux.oracle.com/cve/CVE-2026-39836.html", "https://linux.oracle.com/errata/ELSA-2026-22121.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-39836", "https://pkg.go.dev/vuln/GO-2026-4971", "https://www.cve.org/CVERecord?id=CVE-2026-39836" ], "PublishedDate": "2026-05-07T20:16:43.593Z", "LastModifiedDate": "2026-10-26T20:10:00.16Z" }, { "VulnerabilityID": "CVE-2026-42499", "VendorIDs": [ "GO-2026-4977" ], "PkgID": "stdlib@v1.23.1", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.23.1", "UID": "b5bc065575324e13" }, "InstalledVersion": "v1.23.1", "FixedVersion": "1.25.10, 1.26.3", "Status": "fixed", "Layer": { "DiffID": "sha256:3c2b2a22a8b623353d36ffdd442d8f955bc91ae69a99ca6776da39ecd6014a4d" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-42499", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:e309f50d3c5b51fafaae27d77d92aff7c0a46408527a5af1b8fd1ccf763a7da0", "Title": "net/mail: golang: net/mail: Denial of Service via pathological email address parsing", "Description": "Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322.", "Severity": "HIGH", "CweIDs": [ "CWE-1046" ], "VendorSeverity": { "alma": 3, "amazon": 3, "bitnami": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:17713", "https://access.redhat.com/errata/RHSA-2026:17714", "https://access.redhat.com/errata/RHSA-2026:22112", "https://access.redhat.com/errata/RHSA-2026:22120", "https://access.redhat.com/errata/RHSA-2026:22121", "https://access.redhat.com/errata/RHSA-2026:33120", "https://access.redhat.com/errata/RHSA-2026:33123", "https://access.redhat.com/errata/RHSA-2026:33142", "https://access.redhat.com/errata/RHSA-2026:33150", "https://access.redhat.com/errata/RHSA-2026:33574", "https://access.redhat.com/errata/RHSA-2026:34364", "https://access.redhat.com/errata/RHSA-2026:36319", "https://access.redhat.com/errata/RHSA-2026:36625", "https://access.redhat.com/errata/RHSA-2026:36754", "https://access.redhat.com/errata/RHSA-2026:36797", "https://access.redhat.com/errata/RHSA-2026:40262", "https://access.redhat.com/errata/RHSA-2026:41031", "https://access.redhat.com/errata/RHSA-2026:41066", "https://access.redhat.com/errata/RHSA-2026:41928", "https://access.redhat.com/errata/RHSA-2026:42146", "https://access.redhat.com/errata/RHSA-2026:42644", "https://access.redhat.com/errata/RHSA-2026:42796", "https://access.redhat.com/errata/RHSA-2026:43038", "https://access.redhat.com/errata/RHSA-2026:43052", "https://access.redhat.com/errata/RHSA-2026:43692", "https://access.redhat.com/errata/RHSA-2026:47952", "https://access.redhat.com/errata/RHSA-2026:49702", "https://access.redhat.com/errata/RHSA-2026:49712", "https://access.redhat.com/errata/RHSA-2026:50300", "https://access.redhat.com/errata/RHSA-2026:50319", "https://access.redhat.com/errata/RHSA-2026:50336", "https://access.redhat.com/errata/RHSA-2026:50843", "https://access.redhat.com/errata/RHSA-2026:51033", "https://access.redhat.com/errata/RHSA-2026:51112", "https://access.redhat.com/errata/RHSA-2026:54274", "https://access.redhat.com/errata/RHSA-2026:54283", "https://access.redhat.com/errata/RHSA-2026:54284", "https://access.redhat.com/errata/RHSA-2026:54285", "https://access.redhat.com/errata/RHSA-2026:54286", "https://access.redhat.com/errata/RHSA-2026:54287", "https://access.redhat.com/errata/RHSA-2026:54531", "https://access.redhat.com/errata/RHSA-2026:54552", "https://access.redhat.com/errata/RHSA-2026:54555", "https://access.redhat.com/errata/RHSA-2026:54583", "https://access.redhat.com/errata/RHSA-2026:54602", "https://access.redhat.com/errata/RHSA-2026:56340", "https://access.redhat.com/errata/RHSA-2026:56785", "https://access.redhat.com/errata/RHSA-2026:56789", "https://access.redhat.com/errata/RHSA-2026:56852", "https://access.redhat.com/errata/RHSA-2026:56854", "https://access.redhat.com/errata/RHSA-2026:56910", "https://access.redhat.com/errata/RHSA-2026:56912", "https://access.redhat.com/errata/RHSA-2026:57194", "https://access.redhat.com/errata/RHSA-2026:57482", "https://access.redhat.com/errata/RHSA-2026:57487", "https://access.redhat.com/errata/RHSA-2026:57649", "https://access.redhat.com/errata/RHSA-2026:57845", "https://access.redhat.com/errata/RHSA-2026:57914", "https://access.redhat.com/errata/RHSA-2026:59467", "https://access.redhat.com/errata/RHSA-2026:59830", "https://access.redhat.com/errata/RHSA-2026:59833", "https://access.redhat.com/errata/RHSA-2026:60018", "https://access.redhat.com/errata/RHSA-2026:60023", "https://access.redhat.com/errata/RHSA-2026:60520", "https://access.redhat.com/errata/RHSA-2026:61253", "https://access.redhat.com/errata/RHSA-2026:62260", "https://access.redhat.com/errata/RHSA-2026:62406", "https://access.redhat.com/errata/RHSA-2026:62407", "https://access.redhat.com/errata/RHSA-2026:62753", "https://access.redhat.com/errata/RHSA-2026:62754", "https://access.redhat.com/errata/RHSA-2026:62803", "https://access.redhat.com/errata/RHSA-2026:63022", "https://access.redhat.com/errata/RHSA-2026:63163", "https://access.redhat.com/errata/RHSA-2026:63332", "https://access.redhat.com/errata/RHSA-2026:63636", "https://access.redhat.com/errata/RHSA-2026:64818", "https://access.redhat.com/errata/RHSA-2026:65116", "https://access.redhat.com/errata/RHSA-2026:65117", "https://access.redhat.com/errata/RHSA-2026:65153", "https://access.redhat.com/errata/RHSA-2026:65335", "https://access.redhat.com/errata/RHSA-2026:65336", "https://access.redhat.com/errata/RHSA-2026:65534", "https://access.redhat.com/errata/RHSA-2026:65838", "https://access.redhat.com/errata/RHSA-2026:65886", "https://access.redhat.com/errata/RHSA-2026:65895", "https://access.redhat.com/errata/RHSA-2026:66022", "https://access.redhat.com/errata/RHSA-2026:66327", "https://access.redhat.com/errata/RHSA-2026:67148", "https://access.redhat.com/errata/RHSA-2026:67517", "https://access.redhat.com/errata/RHSA-2026:67974", "https://access.redhat.com/errata/RHSA-2026:67975", "https://access.redhat.com/errata/RHSA-2026:68334", "https://access.redhat.com/errata/RHSA-2026:68504", "https://access.redhat.com/errata/RHSA-2026:68527", "https://access.redhat.com/security/cve/CVE-2026-42499", "https://bugzilla.redhat.com/2467809", "https://bugzilla.redhat.com/2467820", "https://bugzilla.redhat.com/2480756", "https://bugzilla.redhat.com/2484204", "https://bugzilla.redhat.com/2515815", "https://bugzilla.redhat.com/2515820", "https://bugzilla.redhat.com/2515827", "https://bugzilla.redhat.com/2515838", "https://bugzilla.redhat.com/2515839", "https://bugzilla.redhat.com/2515840", "https://bugzilla.redhat.com/show_bug.cgi?id=2456333", "https://bugzilla.redhat.com/show_bug.cgi?id=2456339", "https://bugzilla.redhat.com/show_bug.cgi?id=2467809", "https://bugzilla.redhat.com/show_bug.cgi?id=2467820", "https://bugzilla.redhat.com/show_bug.cgi?id=2467822", "https://bugzilla.redhat.com/show_bug.cgi?id=2480756", "https://bugzilla.redhat.com/show_bug.cgi?id=2484204", "https://bugzilla.redhat.com/show_bug.cgi?id=2515815", "https://bugzilla.redhat.com/show_bug.cgi?id=2515820", "https://bugzilla.redhat.com/show_bug.cgi?id=2515827", "https://bugzilla.redhat.com/show_bug.cgi?id=2515838", "https://bugzilla.redhat.com/show_bug.cgi?id=2515839", "https://bugzilla.redhat.com/show_bug.cgi?id=2515840", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32280", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32281", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33811", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39820", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39821", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42499", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42504", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56859", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862", "https://errata.almalinux.org/9/ALSA-2026-65153.html", "https://errata.rockylinux.org/RLSA-2026:65886", "https://go.dev/cl/771520", "https://go.dev/issue/78987", "https://groups.google.com/g/golang-announce/c/qcCIEXso47M", "https://linux.oracle.com/cve/CVE-2026-42499.html", "https://linux.oracle.com/errata/ELSA-2026-70201.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-42499", "https://pkg.go.dev/vuln/GO-2026-4977", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42499.json", "https://www.cve.org/CVERecord?id=CVE-2026-42499" ], "PublishedDate": "2026-05-07T20:16:44.54Z", "LastModifiedDate": "2026-10-26T00:10:00.15Z" }, { "VulnerabilityID": "CVE-2026-42504", "VendorIDs": [ "GO-2026-5038" ], "PkgID": "stdlib@v1.23.1", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.23.1", "UID": "b5bc065575324e13" }, "InstalledVersion": "v1.23.1", "FixedVersion": "1.25.11, 1.26.4", "Status": "fixed", "Layer": { "DiffID": "sha256:3c2b2a22a8b623353d36ffdd442d8f955bc91ae69a99ca6776da39ecd6014a4d" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-42504", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:1c7562fc3433edbdca1ecf2bdbbc82a33d1e35856ebb3f1557b696c3ab0e99d2", "Title": "mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header", "Description": "Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU.", "Severity": "HIGH", "CweIDs": [ "CWE-407" ], "VendorSeverity": { "alma": 3, "amazon": 2, "azure": 3, "bitnami": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:65153", "https://access.redhat.com/errata/RHSA-2026:65886", "https://access.redhat.com/security/cve/CVE-2026-42504", "https://bugzilla.redhat.com/2467809", "https://bugzilla.redhat.com/2467820", "https://bugzilla.redhat.com/2480756", "https://bugzilla.redhat.com/2484204", "https://bugzilla.redhat.com/2515815", "https://bugzilla.redhat.com/2515820", "https://bugzilla.redhat.com/2515827", "https://bugzilla.redhat.com/2515838", "https://bugzilla.redhat.com/2515839", "https://bugzilla.redhat.com/2515840", "https://bugzilla.redhat.com/show_bug.cgi?id=2456333", "https://bugzilla.redhat.com/show_bug.cgi?id=2456339", "https://bugzilla.redhat.com/show_bug.cgi?id=2467809", "https://bugzilla.redhat.com/show_bug.cgi?id=2467820", "https://bugzilla.redhat.com/show_bug.cgi?id=2467822", "https://bugzilla.redhat.com/show_bug.cgi?id=2480756", "https://bugzilla.redhat.com/show_bug.cgi?id=2484204", "https://bugzilla.redhat.com/show_bug.cgi?id=2515815", "https://bugzilla.redhat.com/show_bug.cgi?id=2515820", "https://bugzilla.redhat.com/show_bug.cgi?id=2515827", "https://bugzilla.redhat.com/show_bug.cgi?id=2515838", "https://bugzilla.redhat.com/show_bug.cgi?id=2515839", "https://bugzilla.redhat.com/show_bug.cgi?id=2515840", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32280", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32281", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33811", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39820", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39821", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42499", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42504", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56859", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862", "https://errata.almalinux.org/9/ALSA-2026-65153.html", "https://errata.rockylinux.org/RLSA-2026:65886", "https://go.dev/cl/774481", "https://go.dev/issue/79217", "https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw", "https://linux.oracle.com/cve/CVE-2026-42504.html", "https://linux.oracle.com/errata/ELSA-2026-69308.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-42504", "https://pkg.go.dev/vuln/GO-2026-5038", "https://www.cve.org/CVERecord?id=CVE-2026-42504" ], "PublishedDate": "2026-06-02T23:16:37.927Z", "LastModifiedDate": "2026-07-22T19:10:00.12Z" }, { "VulnerabilityID": "CVE-2026-56853", "VendorIDs": [ "GO-2026-6089" ], "PkgID": "stdlib@v1.23.1", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.23.1", "UID": "b5bc065575324e13" }, "InstalledVersion": "v1.23.1", "FixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3", "Status": "fixed", "Layer": { "DiffID": "sha256:3c2b2a22a8b623353d36ffdd442d8f955bc91ae69a99ca6776da39ecd6014a4d" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-56853", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:f9de56b44f35c30538ed832817e48fa23dd598d21f3d81dfa5f581bebd758b2f", "Title": "net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service", "Description": "When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when doing this.", "Severity": "HIGH", "CweIDs": [ "CWE-770" ], "VendorSeverity": { "alma": 3, "amazon": 3, "bitnami": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:70641", "https://access.redhat.com/security/cve/CVE-2026-56853", "https://bugzilla.redhat.com/2515815", "https://bugzilla.redhat.com/2515820", "https://bugzilla.redhat.com/2515827", "https://bugzilla.redhat.com/2515838", "https://bugzilla.redhat.com/2515839", "https://bugzilla.redhat.com/show_bug.cgi?id=2402034", "https://bugzilla.redhat.com/show_bug.cgi?id=2515815", "https://bugzilla.redhat.com/show_bug.cgi?id=2515820", "https://bugzilla.redhat.com/show_bug.cgi?id=2515827", "https://bugzilla.redhat.com/show_bug.cgi?id=2515838", "https://bugzilla.redhat.com/show_bug.cgi?id=2515839", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11395", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862", "https://errata.almalinux.org/9/ALSA-2026-70641.html", "https://errata.rockylinux.org/RLSA-2026:70641", "https://go.dev/cl/795540", "https://go.dev/issue/80205", "https://groups.google.com/g/golang-announce/c/94pEornpRlI", "https://linux.oracle.com/cve/CVE-2026-56853.html", "https://linux.oracle.com/errata/ELSA-2026-89752.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-56853", "https://pkg.go.dev/vuln/GO-2026-6089", "https://www.cve.org/CVERecord?id=CVE-2026-56853" ], "PublishedDate": "2026-08-13T22:17:22.093Z", "LastModifiedDate": "2026-09-03T16:37:52.17Z" }, { "VulnerabilityID": "CVE-2026-56858", "VendorIDs": [ "GO-2026-6091" ], "PkgID": "stdlib@v1.23.1", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.23.1", "UID": "b5bc065575324e13" }, "InstalledVersion": "v1.23.1", "FixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3", "Status": "fixed", "Layer": { "DiffID": "sha256:3c2b2a22a8b623353d36ffdd442d8f955bc91ae69a99ca6776da39ecd6014a4d" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-56858", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:4f98f51bfa7c9c40af989e435a66d34e244189199fa4fcbbff5e23d0c2e6ba47", "Title": "html/template: golang: Go html/template: Cross-Site Scripting via pathological input", "Description": "Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS.", "Severity": "HIGH", "CweIDs": [ "CWE-79" ], "VendorSeverity": { "alma": 3, "amazon": 3, "bitnami": 2, "oracle-oval": 3, "photon": 2, "redhat": 3, "rocky": 3 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "V3Score": 6.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:70641", "https://access.redhat.com/security/cve/CVE-2026-56858", "https://bugzilla.redhat.com/2515815", "https://bugzilla.redhat.com/2515820", "https://bugzilla.redhat.com/2515827", "https://bugzilla.redhat.com/2515838", "https://bugzilla.redhat.com/2515839", "https://bugzilla.redhat.com/show_bug.cgi?id=2402034", "https://bugzilla.redhat.com/show_bug.cgi?id=2515815", "https://bugzilla.redhat.com/show_bug.cgi?id=2515820", "https://bugzilla.redhat.com/show_bug.cgi?id=2515827", "https://bugzilla.redhat.com/show_bug.cgi?id=2515838", "https://bugzilla.redhat.com/show_bug.cgi?id=2515839", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11395", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862", "https://errata.almalinux.org/9/ALSA-2026-70641.html", "https://errata.rockylinux.org/RLSA-2026:70641", "https://go.dev/cl/807100", "https://go.dev/issue/80435", "https://groups.google.com/g/golang-announce/c/94pEornpRlI", "https://linux.oracle.com/cve/CVE-2026-56858.html", "https://linux.oracle.com/errata/ELSA-2026-70641.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-56858", "https://pkg.go.dev/vuln/GO-2026-6091", "https://www.cve.org/CVERecord?id=CVE-2026-56858" ], "PublishedDate": "2026-08-13T22:17:22.207Z", "LastModifiedDate": "2026-09-03T16:37:52.17Z" }, { "VulnerabilityID": "CVE-2026-56859", "VendorIDs": [ "GO-2026-6088" ], "PkgID": "stdlib@v1.23.1", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.23.1", "UID": "b5bc065575324e13" }, "InstalledVersion": "v1.23.1", "FixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3", "Status": "fixed", "Layer": { "DiffID": "sha256:3c2b2a22a8b623353d36ffdd442d8f955bc91ae69a99ca6776da39ecd6014a4d" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-56859", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:0c33e794cf380f138b58ff9a157ad127e0ea67c28b24b0d55d5cd72332c011f1", "Title": "encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue", "Description": "Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion.", "Severity": "HIGH", "CweIDs": [ "CWE-770" ], "VendorSeverity": { "alma": 3, "amazon": 3, "bitnami": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:69961", "https://access.redhat.com/security/cve/CVE-2026-56859", "https://bugzilla.redhat.com/2480684", "https://bugzilla.redhat.com/2508234", "https://bugzilla.redhat.com/2515815", "https://bugzilla.redhat.com/2515820", "https://bugzilla.redhat.com/2515827", "https://bugzilla.redhat.com/2515838", "https://bugzilla.redhat.com/2515839", "https://bugzilla.redhat.com/2515840", "https://bugzilla.redhat.com/show_bug.cgi?id=2480684", "https://bugzilla.redhat.com/show_bug.cgi?id=2508234", "https://bugzilla.redhat.com/show_bug.cgi?id=2515815", "https://bugzilla.redhat.com/show_bug.cgi?id=2515820", "https://bugzilla.redhat.com/show_bug.cgi?id=2515827", "https://bugzilla.redhat.com/show_bug.cgi?id=2515838", "https://bugzilla.redhat.com/show_bug.cgi?id=2515839", "https://bugzilla.redhat.com/show_bug.cgi?id=2515840", "https://bugzilla.redhat.com/show_bug.cgi?id=2518147", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-17106", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-19730", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39830", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56859", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862", "https://errata.almalinux.org/9/ALSA-2026-69961.html", "https://errata.rockylinux.org/RLSA-2026:69961", "https://github.com/golang/go/issues/80481", "https://go.dev/cl/803320", "https://go.dev/issue/80481", "https://groups.google.com/g/golang-announce/c/94pEornpRlI", "https://linux.oracle.com/cve/CVE-2026-56859.html", "https://linux.oracle.com/errata/ELSA-2026-70201.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-56859", "https://pkg.go.dev/vuln/GO-2026-6088", "https://ubuntu.com/security/notices/USN-8935-1", "https://www.cve.org/CVERecord?id=CVE-2026-56859" ], "PublishedDate": "2026-08-13T22:17:22.32Z", "LastModifiedDate": "2026-09-03T16:37:52.17Z" }, { "VulnerabilityID": "CVE-2026-56860", "VendorIDs": [ "GO-2026-6218" ], "PkgID": "stdlib@v1.23.1", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.23.1", "UID": "b5bc065575324e13" }, "InstalledVersion": "v1.23.1", "FixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3", "Status": "fixed", "Layer": { "DiffID": "sha256:3c2b2a22a8b623353d36ffdd442d8f955bc91ae69a99ca6776da39ecd6014a4d" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-56860", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:830af6d518cbfe2c43a781bdadfb74f4f64b73b92c713ecb87fced554402bf47", "Title": "net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution", "Description": "Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead. Now, path resolution operates on a byte buffer using index-based backtracking for '..' segments, eliminating the quadratic time complexity and significantly reducing memory allocations.", "Severity": "HIGH", "CweIDs": [ "CWE-407" ], "VendorSeverity": { "alma": 3, "amazon": 3, "bitnami": 2, "oracle-oval": 3, "photon": 2, "redhat": 3, "rocky": 3 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.9 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:70641", "https://access.redhat.com/security/cve/CVE-2026-56860", "https://bugzilla.redhat.com/2515815", "https://bugzilla.redhat.com/2515820", "https://bugzilla.redhat.com/2515827", "https://bugzilla.redhat.com/2515838", "https://bugzilla.redhat.com/2515839", "https://bugzilla.redhat.com/show_bug.cgi?id=2402034", "https://bugzilla.redhat.com/show_bug.cgi?id=2515815", "https://bugzilla.redhat.com/show_bug.cgi?id=2515820", "https://bugzilla.redhat.com/show_bug.cgi?id=2515827", "https://bugzilla.redhat.com/show_bug.cgi?id=2515838", "https://bugzilla.redhat.com/show_bug.cgi?id=2515839", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11395", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862", "https://errata.almalinux.org/9/ALSA-2026-70641.html", "https://errata.rockylinux.org/RLSA-2026:70641", "https://go.dev/cl/803681", "https://go.dev/issue/80494", "https://groups.google.com/g/golang-announce/c/94pEornpRlI", "https://linux.oracle.com/cve/CVE-2026-56860.html", "https://linux.oracle.com/errata/ELSA-2026-71619.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-56860", "https://pkg.go.dev/vuln/GO-2026-6218", "https://www.cve.org/CVERecord?id=CVE-2026-56860" ], "PublishedDate": "2026-08-13T22:17:22.44Z", "LastModifiedDate": "2026-09-03T16:37:52.17Z" }, { "VulnerabilityID": "CVE-2026-56862", "VendorIDs": [ "GO-2026-6090" ], "PkgID": "stdlib@v1.23.1", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.23.1", "UID": "b5bc065575324e13" }, "InstalledVersion": "v1.23.1", "FixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3", "Status": "fixed", "Layer": { "DiffID": "sha256:3c2b2a22a8b623353d36ffdd442d8f955bc91ae69a99ca6776da39ecd6014a4d" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-56862", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:50266e5be96102d21976c7d9ec190d07f14c595d519f6f64e533f190eb6225d3", "Title": "crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages", "Description": "Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not. As a result, a malicious client can keep sending KeyUpdate messages to force the server to keep performing key derivation operations indefinitely.", "Severity": "HIGH", "CweIDs": [ "CWE-770" ], "VendorSeverity": { "alma": 3, "amazon": 3, "bitnami": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:70641", "https://access.redhat.com/security/cve/CVE-2026-56862", "https://bugzilla.redhat.com/2515815", "https://bugzilla.redhat.com/2515820", "https://bugzilla.redhat.com/2515827", "https://bugzilla.redhat.com/2515838", "https://bugzilla.redhat.com/2515839", "https://bugzilla.redhat.com/show_bug.cgi?id=2402034", "https://bugzilla.redhat.com/show_bug.cgi?id=2515815", "https://bugzilla.redhat.com/show_bug.cgi?id=2515820", "https://bugzilla.redhat.com/show_bug.cgi?id=2515827", "https://bugzilla.redhat.com/show_bug.cgi?id=2515838", "https://bugzilla.redhat.com/show_bug.cgi?id=2515839", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11395", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862", "https://errata.almalinux.org/9/ALSA-2026-70641.html", "https://errata.rockylinux.org/RLSA-2026:70641", "https://github.com/golang/go/issues/80528", "https://go.dev/cl/804261", "https://go.dev/issue/80528", "https://groups.google.com/g/golang-announce/c/94pEornpRlI", "https://linux.oracle.com/cve/CVE-2026-56862.html", "https://linux.oracle.com/errata/ELSA-2026-70641.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-56862", "https://pkg.go.dev/vuln/GO-2026-6090", "https://ubuntu.com/security/notices/USN-8935-1", "https://www.cve.org/CVERecord?id=CVE-2026-56862" ], "PublishedDate": "2026-08-13T22:17:22.55Z", "LastModifiedDate": "2026-10-24T16:10:00.153Z" }, { "VulnerabilityID": "CVE-2026-78667", "VendorIDs": [ "GO-2026-6609" ], "PkgID": "stdlib@v1.23.1", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.23.1", "UID": "b5bc065575324e13" }, "InstalledVersion": "v1.23.1", "FixedVersion": "1.26.9, 1.27.2", "Status": "fixed", "Layer": { "DiffID": "sha256:3c2b2a22a8b623353d36ffdd442d8f955bc91ae69a99ca6776da39ecd6014a4d" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78667", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:4a5d0f1692c411cea83dddedf35b2e51668a8608cfbdbe924cd9aa7bc4b47160", "Title": "net/http: golang: golang: Denial of Service via crafted HTTP Range headers", "Description": "When parsing a Range header containing a large number of small ranges, FileServer(FS), ServeContent, and ServeFile(FS) can consume an excessive amount of CPU.", "Severity": "HIGH", "CweIDs": [ "CWE-770" ], "VendorSeverity": { "alma": 3, "amazon": 3, "bitnami": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93617", "https://access.redhat.com/security/cve/CVE-2026-78667", "https://bugzilla.redhat.com/2548334", "https://bugzilla.redhat.com/2548336", "https://bugzilla.redhat.com/2548341", "https://bugzilla.redhat.com/2548344", "https://bugzilla.redhat.com/2556068", "https://bugzilla.redhat.com/show_bug.cgi?id=2548334", "https://bugzilla.redhat.com/show_bug.cgi?id=2548336", "https://bugzilla.redhat.com/show_bug.cgi?id=2548341", "https://bugzilla.redhat.com/show_bug.cgi?id=2548344", "https://bugzilla.redhat.com/show_bug.cgi?id=2556068", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-111943", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78667", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78669", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-94440", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-97031", "https://errata.almalinux.org/9/ALSA-2026-93617.html", "https://errata.rockylinux.org/RLSA-2026:93617", "https://github.com/golang/go/issues/81858", "https://go.dev/cl/847309", "https://go.dev/issue/81858", "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI", "https://linux.oracle.com/cve/CVE-2026-78667.html", "https://linux.oracle.com/errata/ELSA-2026-95519.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-78667", "https://pkg.go.dev/vuln/GO-2026-6609", "https://ubuntu.com/security/notices/USN-8935-1", "https://www.cve.org/CVERecord?id=CVE-2026-78667", "https://www.openwall.com/lists/oss-security/2026/10/08/9" ], "PublishedDate": "2026-10-08T23:17:03.88Z", "LastModifiedDate": "2026-10-09T17:16:49.69Z" }, { "VulnerabilityID": "CVE-2026-78669", "VendorIDs": [ "GO-2026-6611" ], "PkgID": "stdlib@v1.23.1", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.23.1", "UID": "b5bc065575324e13" }, "InstalledVersion": "v1.23.1", "FixedVersion": "1.26.9, 1.27.2", "Status": "fixed", "Layer": { "DiffID": "sha256:3c2b2a22a8b623353d36ffdd442d8f955bc91ae69a99ca6776da39ecd6014a4d" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78669", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:3be81cef42de1f466244f07e046c3371268f92d3432a4ea431b1d79d904af934", "Title": "net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive HTTP/2 SETTINGS frames", "Description": "A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values.", "Severity": "HIGH", "CweIDs": [ "CWE-405" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "bitnami": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93617", "https://access.redhat.com/security/cve/CVE-2026-78669", "https://bugzilla.redhat.com/2548334", "https://bugzilla.redhat.com/2548336", "https://bugzilla.redhat.com/2548341", "https://bugzilla.redhat.com/2548344", "https://bugzilla.redhat.com/2556068", "https://bugzilla.redhat.com/show_bug.cgi?id=2548334", "https://bugzilla.redhat.com/show_bug.cgi?id=2548336", "https://bugzilla.redhat.com/show_bug.cgi?id=2548341", "https://bugzilla.redhat.com/show_bug.cgi?id=2548344", "https://bugzilla.redhat.com/show_bug.cgi?id=2556068", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-111943", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78667", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78669", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-94440", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-97031", "https://errata.almalinux.org/9/ALSA-2026-93617.html", "https://errata.rockylinux.org/RLSA-2026:93617", "https://github.com/golang/go/issues/81742", "https://go.dev/cl/847186", "https://go.dev/cl/847308", "https://go.dev/issue/81742", "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI", "https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs", "https://linux.oracle.com/cve/CVE-2026-78669.html", "https://linux.oracle.com/errata/ELSA-2026-95519.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-78669", "https://pkg.go.dev/vuln/GO-2026-6611", "https://ubuntu.com/security/notices/USN-8935-1", "https://www.cve.org/CVERecord?id=CVE-2026-78669", "https://www.openwall.com/lists/oss-security/2026/10/08/9" ], "PublishedDate": "2026-10-08T23:17:04.01Z", "LastModifiedDate": "2026-10-09T17:16:49.857Z" }, { "VulnerabilityID": "CVE-2026-97031", "VendorIDs": [ "GO-2026-6607" ], "PkgID": "stdlib@v1.23.1", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.23.1", "UID": "b5bc065575324e13" }, "InstalledVersion": "v1.23.1", "FixedVersion": "1.26.9, 1.27.2", "Status": "fixed", "Layer": { "DiffID": "sha256:3c2b2a22a8b623353d36ffdd442d8f955bc91ae69a99ca6776da39ecd6014a4d" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-97031", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:5140ca6742e42137fc7065616e4dbee98098c6a468bdbcd03a12d5a10edc9b03", "Title": "crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references", "Description": "Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted packet that could trigger memory exhaustion in the server process by specifying multiple references. We now reject these as malformed and curb the memory amplification vector as a result.", "Severity": "HIGH", "CweIDs": [ "CWE-405" ], "VendorSeverity": { "alma": 3, "amazon": 3, "bitnami": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:95518", "https://access.redhat.com/security/cve/CVE-2026-97031", "https://bugzilla.redhat.com/2548336", "https://bugzilla.redhat.com/2556068", "https://bugzilla.redhat.com/show_bug.cgi?id=2548336", "https://bugzilla.redhat.com/show_bug.cgi?id=2556068", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-111943", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-97031", "https://errata.almalinux.org/9/ALSA-2026-95518.html", "https://errata.rockylinux.org/RLSA-2026:95518", "https://go.dev/cl/847312", "https://go.dev/issue/81855", "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI", "https://linux.oracle.com/cve/CVE-2026-97031.html", "https://linux.oracle.com/errata/ELSA-2026-95519.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-97031", "https://pkg.go.dev/vuln/GO-2026-6607", "https://www.cve.org/CVERecord?id=CVE-2026-97031" ], "PublishedDate": "2026-10-08T23:17:06.037Z", "LastModifiedDate": "2026-10-09T16:35:35.9Z" } ] }, { "Target": "usr/local/bin/trivy", "Class": "lang-pkgs", "Type": "gobinary", "Packages": [ { "ID": "github.com/aquasecurity/trivy@v0.70.0", "Name": "github.com/aquasecurity/trivy", "Identifier": { "PURL": "pkg:golang/github.com/aquasecurity/trivy@v0.70.0", "UID": "3b38ce3f34d371cf" }, "Version": "v0.70.0", "Relationship": "root", "DependsOn": [ "cel.dev/expr@v0.25.1", "cloud.google.com/go/auth/oauth2adapt@v0.2.8", "cloud.google.com/go/auth@v0.18.2", "cloud.google.com/go/compute/metadata@v0.9.0", "cloud.google.com/go/iam@v1.5.3", "cloud.google.com/go/monitoring@v1.24.3", "cloud.google.com/go/storage@v1.61.3", "cloud.google.com/go@v0.123.0", "dario.cat/mergo@v1.0.2", "github.com/Azure/azure-sdk-for-go/sdk/azcore@v1.21.0", "github.com/Azure/azure-sdk-for-go/sdk/azidentity@v1.13.1", "github.com/Azure/azure-sdk-for-go/sdk/containers/azcontainerregistry@v0.2.3", "github.com/Azure/azure-sdk-for-go/sdk/internal@v1.11.2", "github.com/AzureAD/microsoft-authentication-library-for-go@v1.6.0", "github.com/BurntSushi/toml@v1.6.0", "github.com/CycloneDX/cyclonedx-go@v0.10.0", "github.com/GoogleCloudPlatform/docker-credential-gcr/v2@v2.1.32", "github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp@v1.30.0", "github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric@v0.55.0", "github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping@v0.55.0", "github.com/Intevation/gval@v1.3.0", "github.com/Intevation/jsonpath@v0.2.1", "github.com/MakeNowJust/heredoc@v1.0.0", "github.com/Masterminds/goutils@v1.1.1", "github.com/Masterminds/semver/v3@v3.4.0", "github.com/Masterminds/sprig/v3@v3.3.0", "github.com/Masterminds/squirrel@v1.5.4", "github.com/NYTimes/gziphandler@v1.1.1", "github.com/ProtonMail/go-crypto@v1.3.0", "github.com/VividCortex/ewma@v1.2.0", "github.com/agext/levenshtein@v1.2.3", "github.com/agnivade/levenshtein@v1.2.1", "github.com/alecthomas/chroma@v0.10.0", "github.com/anchore/go-struct-converter@v0.1.0", "github.com/apparentlymart/go-cidr@v1.1.0", "github.com/apparentlymart/go-textseg/v15@v15.0.0", "github.com/aquasecurity/go-gem-version@v0.0.0-20201115065557-8eed6fe000ce", "github.com/aquasecurity/go-npm-version@v0.0.2", "github.com/aquasecurity/go-pep440-version@v0.0.1", "github.com/aquasecurity/go-version@v0.0.1", "github.com/aquasecurity/iamgo@v0.0.10", "github.com/aquasecurity/jfather@v0.0.8", "github.com/aquasecurity/table@v1.11.0", "github.com/aquasecurity/tml@v0.6.1", "github.com/aquasecurity/trivy-checks@v1.12.2-0.20251219190323-79d27547baf5", "github.com/aquasecurity/trivy-db@v0.0.0-20251222105351-a833f47f8f0d", "github.com/aquasecurity/trivy-java-db@v0.0.0-20240109071736-184bd7481d48", "github.com/aquasecurity/trivy-kubernetes@v0.9.1", "github.com/asaskevich/govalidator@v0.0.0-20230301143203-a9d515a09cc2", "github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.7.8", "github.com/aws/aws-sdk-go-v2/config@v1.32.12", "github.com/aws/aws-sdk-go-v2/credentials@v1.19.12", "github.com/aws/aws-sdk-go-v2/feature/ec2/imds@v1.18.20", "github.com/aws/aws-sdk-go-v2/internal/configsources@v1.4.21", "github.com/aws/aws-sdk-go-v2/internal/endpoints/v2@v2.7.21", "github.com/aws/aws-sdk-go-v2/internal/ini@v1.8.6", "github.com/aws/aws-sdk-go-v2/internal/v4a@v1.4.22", "github.com/aws/aws-sdk-go-v2/service/ebs@v1.22.1", "github.com/aws/aws-sdk-go-v2/service/ec2@v1.290.0", "github.com/aws/aws-sdk-go-v2/service/ecr@v1.55.2", "github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding@v1.13.7", "github.com/aws/aws-sdk-go-v2/service/internal/checksum@v1.9.13", "github.com/aws/aws-sdk-go-v2/service/internal/presigned-url@v1.13.21", "github.com/aws/aws-sdk-go-v2/service/internal/s3shared@v1.19.21", "github.com/aws/aws-sdk-go-v2/service/s3@v1.97.3", "github.com/aws/aws-sdk-go-v2/service/signin@v1.0.8", "github.com/aws/aws-sdk-go-v2/service/sso@v1.30.13", "github.com/aws/aws-sdk-go-v2/service/ssooidc@v1.35.17", "github.com/aws/aws-sdk-go-v2/service/sts@v1.41.9", "github.com/aws/aws-sdk-go-v2@v1.41.5", "github.com/aws/smithy-go@v1.24.2", "github.com/bgentry/go-netrc@v0.0.0-20140422174119-9fd32a8b3d3d", "github.com/bitnami/go-version@v0.0.0-20231130084017-bb00604d650c", "github.com/blang/semver/v4@v4.0.0", "github.com/blang/semver@v3.5.1+incompatible", "github.com/bmatcuk/doublestar/v4@v4.10.0", "github.com/briandowns/spinner@v1.23.0", "github.com/cenkalti/backoff/v4@v4.3.0", "github.com/cenkalti/backoff/v5@v5.0.3", "github.com/cespare/xxhash/v2@v2.3.0", "github.com/chai2010/gettext-go@v1.0.2", "github.com/cheggaaa/pb/v3@v3.1.7", "github.com/cloudflare/circl@v1.6.3", "github.com/cncf/xds/go@v0.0.0-20251210132809-ee656c7534f5", "github.com/containerd/containerd/api@v1.10.0", "github.com/containerd/containerd/v2@v2.2.2", "github.com/containerd/containerd@v1.7.30", "github.com/containerd/continuity@v0.4.5", "github.com/containerd/errdefs/pkg@v0.3.0", "github.com/containerd/errdefs@v1.0.0", "github.com/containerd/fifo@v1.1.0", "github.com/containerd/log@v0.1.0", "github.com/containerd/platforms@v1.0.0-rc.4", "github.com/containerd/plugin@v1.0.0", "github.com/containerd/stargz-snapshotter/estargz@v0.18.2", "github.com/containerd/ttrpc@v1.2.8", "github.com/containerd/typeurl/v2@v2.2.3", "github.com/coreos/go-oidc/v3@v3.17.0", "github.com/cyberphone/json-canonicalization@v0.0.0-20241213102144-19d51d7fe467", "github.com/cyphar/filepath-securejoin@v0.6.1", "github.com/davecgh/go-spew@v1.1.2-0.20180830191138-d8f796af33cc", "github.com/dgryski/go-rendezvous@v0.0.0-20200823014737-9f7001d12a5f", "github.com/digitorus/pkcs7@v0.0.0-20230818184609-3a137a874352", "github.com/digitorus/timestamp@v0.0.0-20231217203849-220c5c2851b7", "github.com/distribution/reference@v0.6.0", "github.com/dlclark/regexp2@v1.11.0", "github.com/docker/cli@v29.4.0+incompatible", "github.com/docker/distribution@v2.8.3+incompatible", "github.com/docker/docker-credential-helpers@v0.9.5", "github.com/docker/go-connections@v0.6.0", "github.com/docker/go-units@v0.5.0", "github.com/dsnet/compress@v0.0.2-0.20230904184137-39efe44ab707", "github.com/dustin/go-humanize@v1.0.1", "github.com/emicklei/go-restful/v3@v3.13.0", "github.com/emirpasic/gods@v1.18.1", "github.com/envoyproxy/go-control-plane/envoy@v1.36.0", "github.com/envoyproxy/protoc-gen-validate@v1.3.0", "github.com/evanphx/json-patch@v5.9.11+incompatible", "github.com/exponent-io/jsonpath@v0.0.0-20210407135951-1de76d718b3f", "github.com/fatih/color@v1.19.0", "github.com/felixge/httpsnoop@v1.0.4", "github.com/fsnotify/fsnotify@v1.9.0", "github.com/fvbommel/sortorder@v1.1.0", "github.com/fxamacker/cbor/v2@v2.9.0", "github.com/go-chi/chi/v5@v5.2.5", "github.com/go-errors/errors@v1.4.2", "github.com/go-git/gcfg@v1.5.1-0.20230307220236-3a3c6141e376", "github.com/go-git/go-billy/v5@v5.8.0", "github.com/go-git/go-git/v5@v5.17.2", "github.com/go-gorp/gorp/v3@v3.1.0", "github.com/go-ini/ini@v1.67.0", "github.com/go-jose/go-jose/v4@v4.1.4", "github.com/go-logr/logr@v1.4.3", "github.com/go-logr/stdr@v1.2.2", "github.com/go-openapi/analysis@v0.24.3", "github.com/go-openapi/errors@v0.22.7", "github.com/go-openapi/jsonpointer@v0.22.5", "github.com/go-openapi/jsonreference@v0.21.5", "github.com/go-openapi/loads@v0.23.3", "github.com/go-openapi/runtime@v0.29.3", "github.com/go-openapi/spec@v0.22.4", "github.com/go-openapi/strfmt@v0.26.1", "github.com/go-openapi/swag/cmdutils@v0.25.5", "github.com/go-openapi/swag/conv@v0.25.5", "github.com/go-openapi/swag/fileutils@v0.25.5", "github.com/go-openapi/swag/jsonname@v0.25.5", "github.com/go-openapi/swag/jsonutils@v0.25.5", "github.com/go-openapi/swag/loading@v0.25.5", "github.com/go-openapi/swag/mangling@v0.25.5", "github.com/go-openapi/swag/netutils@v0.25.5", "github.com/go-openapi/swag/stringutils@v0.25.5", "github.com/go-openapi/swag/typeutils@v0.25.5", "github.com/go-openapi/swag/yamlutils@v0.25.5", "github.com/go-openapi/swag@v0.25.5", "github.com/go-openapi/validate@v0.25.2", "github.com/go-redis/redis/v8@v8.11.5", "github.com/go-viper/mapstructure/v2@v2.5.0", "github.com/gobwas/glob@v0.2.3", "github.com/gocsaf/csaf/v3@v3.5.1", "github.com/gogo/protobuf@v1.3.2", "github.com/golang-jwt/jwt/v5@v5.3.1", "github.com/golang/groupcache@v0.0.0-20241129210726-2c02b8208cf8", "github.com/golang/snappy@v0.0.4", "github.com/google/btree@v1.1.3", "github.com/google/certificate-transparency-go@v1.3.2", "github.com/google/gnostic-models@v0.7.0", "github.com/google/go-cmp@v0.7.0", "github.com/google/go-containerregistry@v0.21.2", "github.com/google/go-github/v62@v62.0.0", "github.com/google/go-querystring@v1.1.0", "github.com/google/licenseclassifier/v2@v2.0.0", "github.com/google/s2a-go@v0.1.9", "github.com/google/uuid@v1.6.0", "github.com/googleapis/enterprise-certificate-proxy@v0.3.14", "github.com/googleapis/gax-go/v2@v2.19.0", "github.com/gosuri/uitable@v0.0.4", "github.com/gregjones/httpcache@v0.0.0-20190611155906-901d90724c79", "github.com/grpc-ecosystem/grpc-gateway/v2@v2.27.7", "github.com/hashicorp/aws-sdk-go-base/v2@v2.0.0-beta.72", "github.com/hashicorp/errwrap@v1.1.0", "github.com/hashicorp/go-cleanhttp@v0.5.2", "github.com/hashicorp/go-getter@v1.8.6", "github.com/hashicorp/go-multierror@v1.1.1", "github.com/hashicorp/go-retryablehttp@v0.7.8", "github.com/hashicorp/go-uuid@v1.0.3", "github.com/hashicorp/go-version@v1.9.0", "github.com/hashicorp/golang-lru/v2@v2.0.7", "github.com/hashicorp/hcl/v2@v2.24.0", "github.com/huandu/xstrings@v1.5.0", "github.com/in-toto/attestation@v1.1.2", "github.com/in-toto/in-toto-golang@v0.10.0", "github.com/jbenet/go-context@v0.0.0-20150711004518-d14ea06fba99", "github.com/jedisct1/go-minisign@v0.0.0-20230811132847-661be99b8267", "github.com/jmoiron/sqlx@v1.4.0", "github.com/josephburnett/jd/v2@v2.3.0", "github.com/json-iterator/go@v1.1.12", "github.com/kevinburke/ssh_config@v1.2.0", "github.com/klauspost/compress@v1.18.5", "github.com/knqyf263/go-apk-version@v0.0.0-20200609155635-041fdbb8563f", "github.com/knqyf263/go-deb-version@v0.0.0-20241115132648-6f4aee6ccd23", "github.com/knqyf263/go-rpm-version@v0.0.0-20220614171824-631e686d1075", "github.com/knqyf263/go-rpmdb@v0.1.1", "github.com/knqyf263/nested@v0.0.1", "github.com/kylelemons/godebug@v1.1.0", "github.com/lann/builder@v0.0.0-20180802200727-47ae307949d0", "github.com/lann/ps@v0.0.0-20150810152359-62de8c46ede0", "github.com/lestrrat-go/blackmagic@v1.0.4", "github.com/lestrrat-go/dsig@v1.0.0", "github.com/lestrrat-go/httpcc@v1.0.1", "github.com/lestrrat-go/httprc/v3@v3.0.2", "github.com/lestrrat-go/jwx/v3@v3.0.13", "github.com/lestrrat-go/option/v2@v2.0.0", "github.com/letsencrypt/boulder@v0.20260223.0", "github.com/lib/pq@v1.10.9", "github.com/liggitt/tabwriter@v0.0.0-20181228230101-89fcab3d43de", "github.com/lunixbochs/struc@v0.0.0-20200707160740-784aaebc1d40", "github.com/masahiro331/go-disk@v0.0.0-20240625071113-56c933208fee", "github.com/masahiro331/go-ebs-file@v0.0.0-20240917043618-e6d2bea5c32e", "github.com/masahiro331/go-ext4-filesystem@v0.0.0-20240620024024-ca14e6327bbd", "github.com/masahiro331/go-mvn-version@v0.0.0-20250131095131-f4974fa13b8a", "github.com/masahiro331/go-vmdk-parser@v0.0.0-20221225061455-612096e4bbbd", "github.com/masahiro331/go-xfs-filesystem@v0.0.0-20231205045356-1b22259a6c44", "github.com/mattn/go-colorable@v0.1.14", "github.com/mattn/go-isatty@v0.0.20", "github.com/mattn/go-runewidth@v0.0.16", "github.com/mattn/go-shellwords@v1.0.12", "github.com/mitchellh/copystructure@v1.2.0", "github.com/mitchellh/go-homedir@v1.1.0", "github.com/mitchellh/go-wordwrap@v1.0.1", "github.com/mitchellh/hashstructure/v2@v2.0.2", "github.com/mitchellh/mapstructure@v1.5.1-0.20231216201459-8508981c8b6c", "github.com/mitchellh/reflectwalk@v1.0.2", "github.com/moby/buildkit@v0.29.0", "github.com/moby/docker-image-spec@v1.3.1", "github.com/moby/locker@v1.0.1", "github.com/moby/moby/api@v1.54.1", "github.com/moby/moby/client@v0.4.0", "github.com/moby/sys/atomicwriter@v0.1.0", "github.com/moby/sys/mountinfo@v0.7.2", "github.com/moby/sys/sequential@v0.6.0", "github.com/moby/sys/signal@v0.7.1", "github.com/moby/sys/user@v0.4.0", "github.com/moby/sys/userns@v0.1.0", "github.com/moby/term@v0.5.2", "github.com/modern-go/concurrent@v0.0.0-20180306012644-bacd9c7ef1dd", "github.com/modern-go/reflect2@v1.0.3-0.20250322232337-35a7c28c31ee", "github.com/monochromegane/go-gitignore@v0.0.0-20200626010858-205db1a8cc00", "github.com/morikuni/aec@v1.1.0", "github.com/munnerz/goautoneg@v0.0.0-20191010083416-a7dc8b61c822", "github.com/nikolalohinski/gonja/v2@v2.7.0", "github.com/nozzle/throttler@v0.0.0-20180817012639-2ea982251481", "github.com/oklog/ulid/v2@v2.1.1", "github.com/open-policy-agent/opa@v1.15.2", "github.com/opencontainers/go-digest@v1.0.0", "github.com/opencontainers/image-spec@v1.1.1", "github.com/opencontainers/runtime-spec@v1.3.0", "github.com/opencontainers/selinux@v1.13.1", "github.com/openvex/discovery@v0.1.1-0.20240802171711-7c54efc57553", "github.com/openvex/go-vex@v0.2.7", "github.com/owenrumney/go-sarif/v2@v2.3.3", "github.com/owenrumney/squealer@v1.2.12", "github.com/package-url/packageurl-go@v0.1.5", "github.com/pandatix/go-cvss@v0.6.2", "github.com/pelletier/go-toml/v2@v2.2.4", "github.com/peterbourgon/diskv@v2.0.1+incompatible", "github.com/pjbgf/sha1cd@v0.3.2", "github.com/pkg/browser@v0.0.0-20240102092130-5ac0b6a4141c", "github.com/pkg/errors@v0.9.1", "github.com/planetscale/vtprotobuf@v0.6.1-0.20240319094008-0393e58bdf10", "github.com/pmezard/go-difflib@v1.0.1-0.20181226105442-5d4384ee4fb2", "github.com/rcrowley/go-metrics@v0.0.0-20250401214520-65e299d6c5c9", "github.com/remyoudompheng/bigfft@v0.0.0-20230129092748-24d4a6f8daec", "github.com/rivo/uniseg@v0.4.7", "github.com/rubenv/sql-migrate@v1.8.1", "github.com/russross/blackfriday/v2@v2.1.0", "github.com/rust-secure-code/go-rustaudit@v0.0.0-20250226111315-e20ec32e963c", "github.com/sagikazarmark/locafero@v0.11.0", "github.com/samber/lo@v1.53.0", "github.com/samber/oops@v1.18.1", "github.com/santhosh-tekuri/jsonschema/v6@v6.0.2", "github.com/sassoftware/go-rpmutils@v0.4.0", "github.com/sassoftware/relic@v7.2.1+incompatible", "github.com/secure-systems-lab/go-securesystemslib@v0.10.0", "github.com/sergi/go-diff@v1.4.0", "github.com/shibumi/go-pathspec@v1.3.0", "github.com/shopspring/decimal@v1.4.0", "github.com/sigstore/cosign/v2@v2.6.2", "github.com/sigstore/protobuf-specs@v0.5.0", "github.com/sigstore/rekor-tiles/v2@v2.0.1", "github.com/sigstore/rekor@v1.5.1", "github.com/sigstore/sigstore-go@v1.1.4", "github.com/sigstore/sigstore@v1.10.5", "github.com/sigstore/timestamp-authority/v2@v2.0.6", "github.com/sirupsen/logrus@v1.9.4", "github.com/skeema/knownhosts@v1.3.1", "github.com/sourcegraph/conc@v0.3.1-0.20240121214520-5f936abd7ae8", "github.com/spdx/tools-golang@v0.5.7", "github.com/spf13/afero@v1.15.0", "github.com/spf13/cast@v1.10.0", "github.com/spf13/cobra@v1.10.2", "github.com/spf13/pflag@v1.0.10", "github.com/spf13/viper@v1.21.0", "github.com/spiffe/go-spiffe/v2@v2.6.0", "github.com/stretchr/objx@v0.5.3", "github.com/stretchr/testify@v1.11.1", "github.com/subosito/gotenv@v1.6.0", "github.com/syndtr/goleveldb@v1.0.1-0.20220721030215-126854af5e6d", "github.com/tchap/go-patricia/v2@v2.3.3", "github.com/tetratelabs/wazero@v1.11.0", "github.com/theupdateframework/go-tuf/v2@v2.4.1", "github.com/theupdateframework/go-tuf@v0.7.0", "github.com/titanous/rocacheck@v0.0.0-20171023193734-afe73141d399", "github.com/tonistiigi/go-csvvalue@v0.0.0-20240814133006-030d3b2625d0", "github.com/toqueteos/webbrowser@v1.2.0", "github.com/transparency-dev/formats@v0.0.0-20251017110053-404c0d5b696c", "github.com/transparency-dev/merkle@v0.0.2", "github.com/twitchtv/twirp@v8.1.3+incompatible", "github.com/ulikunitz/xz@v0.5.15", "github.com/valyala/fastjson@v1.6.7", "github.com/vbatts/tar-split@v0.12.2", "github.com/vektah/gqlparser/v2@v2.5.32", "github.com/vmihailenco/msgpack/v5@v5.4.1", "github.com/vmihailenco/tagparser/v2@v2.0.0", "github.com/x448/float16@v0.8.4", "github.com/xanzy/ssh-agent@v0.3.3", "github.com/xeipuuv/gojsonpointer@v0.0.0-20190905194746-02993c407bfb", "github.com/xeipuuv/gojsonreference@v0.0.0-20180127040603-bd5ef7bd5415", "github.com/xeipuuv/gojsonschema@v1.2.0", "github.com/xi2/xz@v0.0.0-20171230120015-48954b6210f8", "github.com/xlab/treeprint@v1.2.0", "github.com/yashtewari/glob-intersection@v0.2.0", "github.com/zclconf/go-cty-yaml@v1.2.0", "github.com/zclconf/go-cty@v1.18.0", "go.etcd.io/bbolt@v1.4.3", "go.opentelemetry.io/auto/sdk@v1.2.1", "go.opentelemetry.io/contrib/detectors/gcp@v1.39.0", "go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc@v0.63.0", "go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp@v0.65.0", "go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc@v1.40.0", "go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc@v1.40.0", "go.opentelemetry.io/otel/exporters/otlp/otlptrace@v1.40.0", "go.opentelemetry.io/otel/metric@v1.43.0", "go.opentelemetry.io/otel/sdk/metric@v1.43.0", "go.opentelemetry.io/otel/sdk@v1.43.0", "go.opentelemetry.io/otel/trace@v1.43.0", "go.opentelemetry.io/otel@v1.43.0", "go.opentelemetry.io/proto/otlp@v1.9.0", "go.uber.org/multierr@v1.11.0", "go.uber.org/zap@v1.27.1", "go.yaml.in/yaml/v2@v2.4.3", "go.yaml.in/yaml/v3@v3.0.4", "go.yaml.in/yaml/v4@v4.0.0-rc.3", "golang.org/x/crypto@v0.50.0", "golang.org/x/exp@v0.0.0-20251023183803-a4bb9ffd2546", "golang.org/x/mod@v0.34.0", "golang.org/x/net@v0.53.0", "golang.org/x/oauth2@v0.36.0", "golang.org/x/sync@v0.20.0", "golang.org/x/sys@v0.43.0", "golang.org/x/term@v0.42.0", "golang.org/x/text@v0.36.0", "golang.org/x/time@v0.15.0", "golang.org/x/xerrors@v0.0.0-20240903120638-7835f813f4da", "google.golang.org/api@v0.272.0", "google.golang.org/genproto/googleapis/api@v0.0.0-20260316180232-0b37fe3546d5", "google.golang.org/genproto/googleapis/rpc@v0.0.0-20260316180232-0b37fe3546d5", "google.golang.org/genproto@v0.0.0-20260316180232-0b37fe3546d5", "google.golang.org/grpc@v1.79.3", "google.golang.org/protobuf@v1.36.11", "gopkg.in/evanphx/json-patch.v4@v4.13.0", "gopkg.in/inf.v0@v0.9.1", "gopkg.in/warnings.v0@v0.1.2", "gopkg.in/yaml.v3@v3.0.1", "helm.sh/helm/v3@v3.20.2", "k8s.io/api@v0.35.3", "k8s.io/apiextensions-apiserver@v0.35.1", "k8s.io/apimachinery@v0.35.3", "k8s.io/apiserver@v0.35.1", "k8s.io/cli-runtime@v0.35.1", "k8s.io/client-go@v0.35.1", "k8s.io/component-base@v0.35.1", "k8s.io/klog/v2@v2.130.1", "k8s.io/kube-openapi@v0.0.0-20250910181357-589584f1c912", "k8s.io/kubectl@v0.35.1", "k8s.io/utils@v0.0.0-20251002143259-bc988d571ff4", "modernc.org/libc@v1.70.0", "modernc.org/mathutil@v1.7.1", "modernc.org/memory@v1.11.0", "modernc.org/sqlite@v1.48.2", "mvdan.cc/sh/v3@v3.12.0", "oras.land/oras-go/v2@v2.6.0", "sigs.k8s.io/json@v0.0.0-20250730193827-2d320260d730", "sigs.k8s.io/kustomize/api@v0.20.1", "sigs.k8s.io/kustomize/kyaml@v0.20.1", "sigs.k8s.io/randfill@v1.0.0", "sigs.k8s.io/structured-merge-diff/v6@v6.3.0", "sigs.k8s.io/yaml@v1.6.0", "stdlib@v1.25.9" ], "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "stdlib@v1.25.9", "Name": "stdlib", "Identifier": { "PURL": "pkg:golang/stdlib@v1.25.9", "UID": "2185fb41a98d095a" }, "Version": "v1.25.9", "Relationship": "direct", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "cel.dev/expr@v0.25.1", "Name": "cel.dev/expr", "Identifier": { "PURL": "pkg:golang/cel.dev/expr@v0.25.1", "UID": "3a3f81106e986320" }, "Version": "v0.25.1", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "cloud.google.com/go@v0.123.0", "Name": "cloud.google.com/go", "Identifier": { "PURL": "pkg:golang/cloud.google.com/go@v0.123.0", "UID": "b8e3ea83df2ce9f" }, "Version": "v0.123.0", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "cloud.google.com/go/auth@v0.18.2", "Name": "cloud.google.com/go/auth", "Identifier": { "PURL": "pkg:golang/cloud.google.com/go/auth@v0.18.2", "UID": "4585a7e6f2769abf" }, "Version": "v0.18.2", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "cloud.google.com/go/auth/oauth2adapt@v0.2.8", "Name": "cloud.google.com/go/auth/oauth2adapt", "Identifier": { "PURL": "pkg:golang/cloud.google.com/go/auth/oauth2adapt@v0.2.8", "UID": "89722113ab90a828" }, "Version": "v0.2.8", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "cloud.google.com/go/compute/metadata@v0.9.0", "Name": "cloud.google.com/go/compute/metadata", "Identifier": { "PURL": "pkg:golang/cloud.google.com/go/compute/metadata@v0.9.0", "UID": "fc19f40bf2534128" }, "Version": "v0.9.0", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "cloud.google.com/go/iam@v1.5.3", "Name": "cloud.google.com/go/iam", "Identifier": { "PURL": "pkg:golang/cloud.google.com/go/iam@v1.5.3", "UID": "f4b3ea708216af4f" }, "Version": "v1.5.3", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "cloud.google.com/go/monitoring@v1.24.3", "Name": "cloud.google.com/go/monitoring", "Identifier": { "PURL": "pkg:golang/cloud.google.com/go/monitoring@v1.24.3", "UID": "748f52b62b891361" }, "Version": "v1.24.3", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "cloud.google.com/go/storage@v1.61.3", "Name": "cloud.google.com/go/storage", "Identifier": { "PURL": "pkg:golang/cloud.google.com/go/storage@v1.61.3", "UID": "1c5a375112375afd" }, "Version": "v1.61.3", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "dario.cat/mergo@v1.0.2", "Name": "dario.cat/mergo", "Identifier": { "PURL": "pkg:golang/dario.cat/mergo@v1.0.2", "UID": "845249a35e27a89c" }, "Version": "v1.0.2", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/Azure/azure-sdk-for-go/sdk/azcore@v1.21.0", "Name": "github.com/Azure/azure-sdk-for-go/sdk/azcore", "Identifier": { "PURL": "pkg:golang/github.com/azure/azure-sdk-for-go/sdk/azcore@v1.21.0", "UID": "831d39c1af1cf2b9" }, "Version": "v1.21.0", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/Azure/azure-sdk-for-go/sdk/azidentity@v1.13.1", "Name": "github.com/Azure/azure-sdk-for-go/sdk/azidentity", "Identifier": { "PURL": "pkg:golang/github.com/azure/azure-sdk-for-go/sdk/azidentity@v1.13.1", "UID": "bfc00f17f19945a6" }, "Version": "v1.13.1", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/Azure/azure-sdk-for-go/sdk/containers/azcontainerregistry@v0.2.3", "Name": "github.com/Azure/azure-sdk-for-go/sdk/containers/azcontainerregistry", "Identifier": { "PURL": "pkg:golang/github.com/azure/azure-sdk-for-go/sdk/containers/azcontainerregistry@v0.2.3", "UID": "c4797b4a61dc7864" }, "Version": "v0.2.3", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/Azure/azure-sdk-for-go/sdk/internal@v1.11.2", "Name": "github.com/Azure/azure-sdk-for-go/sdk/internal", "Identifier": { "PURL": "pkg:golang/github.com/azure/azure-sdk-for-go/sdk/internal@v1.11.2", "UID": "59875928d7d3bcc3" }, "Version": "v1.11.2", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/AzureAD/microsoft-authentication-library-for-go@v1.6.0", "Name": "github.com/AzureAD/microsoft-authentication-library-for-go", "Identifier": { "PURL": "pkg:golang/github.com/azuread/microsoft-authentication-library-for-go@v1.6.0", "UID": "ad99691021c61587" }, "Version": "v1.6.0", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/BurntSushi/toml@v1.6.0", "Name": "github.com/BurntSushi/toml", "Identifier": { "PURL": "pkg:golang/github.com/burntsushi/toml@v1.6.0", "UID": "320cfbc135c8727" }, "Version": "v1.6.0", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/CycloneDX/cyclonedx-go@v0.10.0", "Name": "github.com/CycloneDX/cyclonedx-go", "Identifier": { "PURL": "pkg:golang/github.com/cyclonedx/cyclonedx-go@v0.10.0", "UID": "bbd2f34327d37edd" }, "Version": "v0.10.0", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/GoogleCloudPlatform/docker-credential-gcr/v2@v2.1.32", "Name": "github.com/GoogleCloudPlatform/docker-credential-gcr/v2", "Identifier": { "PURL": "pkg:golang/github.com/googlecloudplatform/docker-credential-gcr/v2@v2.1.32", "UID": "c69f2c152939e7fa" }, "Version": "v2.1.32", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp@v1.30.0", "Name": "github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp", "Identifier": { "PURL": "pkg:golang/github.com/googlecloudplatform/opentelemetry-operations-go/detectors/gcp@v1.30.0", "UID": "bd076868acc12bb8" }, "Version": "v1.30.0", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric@v0.55.0", "Name": "github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric", "Identifier": { "PURL": "pkg:golang/github.com/googlecloudplatform/opentelemetry-operations-go/exporter/metric@v0.55.0", "UID": "50288f5cba67d6e7" }, "Version": "v0.55.0", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping@v0.55.0", "Name": "github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping", "Identifier": { "PURL": "pkg:golang/github.com/googlecloudplatform/opentelemetry-operations-go/internal/resourcemapping@v0.55.0", "UID": "a9a9981d7f0bff4e" }, "Version": "v0.55.0", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/Intevation/gval@v1.3.0", "Name": "github.com/Intevation/gval", "Identifier": { "PURL": "pkg:golang/github.com/intevation/gval@v1.3.0", "UID": "fa3c462812e871fb" }, "Version": "v1.3.0", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/Intevation/jsonpath@v0.2.1", "Name": "github.com/Intevation/jsonpath", "Identifier": { "PURL": "pkg:golang/github.com/intevation/jsonpath@v0.2.1", "UID": "a9a60cabd7f99c0c" }, "Version": "v0.2.1", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/MakeNowJust/heredoc@v1.0.0", "Name": "github.com/MakeNowJust/heredoc", "Identifier": { "PURL": "pkg:golang/github.com/makenowjust/heredoc@v1.0.0", "UID": "b068af423e564eea" }, "Version": "v1.0.0", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/Masterminds/goutils@v1.1.1", "Name": "github.com/Masterminds/goutils", "Identifier": { "PURL": "pkg:golang/github.com/masterminds/goutils@v1.1.1", "UID": "37d89d1f385187b5" }, "Version": "v1.1.1", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/Masterminds/semver/v3@v3.4.0", "Name": "github.com/Masterminds/semver/v3", "Identifier": { "PURL": "pkg:golang/github.com/masterminds/semver/v3@v3.4.0", "UID": "c049fe793ba31e7e" }, "Version": "v3.4.0", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/Masterminds/sprig/v3@v3.3.0", "Name": "github.com/Masterminds/sprig/v3", "Identifier": { "PURL": "pkg:golang/github.com/masterminds/sprig/v3@v3.3.0", "UID": "166233e18a533d23" }, "Version": "v3.3.0", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/Masterminds/squirrel@v1.5.4", "Name": "github.com/Masterminds/squirrel", "Identifier": { "PURL": "pkg:golang/github.com/masterminds/squirrel@v1.5.4", "UID": "e315e6d3604bd0ec" }, "Version": "v1.5.4", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/NYTimes/gziphandler@v1.1.1", "Name": "github.com/NYTimes/gziphandler", "Identifier": { "PURL": "pkg:golang/github.com/nytimes/gziphandler@v1.1.1", "UID": "52a6f5a72031c19d" }, "Version": "v1.1.1", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/ProtonMail/go-crypto@v1.3.0", "Name": "github.com/ProtonMail/go-crypto", "Identifier": { "PURL": "pkg:golang/github.com/protonmail/go-crypto@v1.3.0", "UID": "8c7dc483cbcf244" }, "Version": "v1.3.0", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/VividCortex/ewma@v1.2.0", "Name": "github.com/VividCortex/ewma", "Identifier": { "PURL": "pkg:golang/github.com/vividcortex/ewma@v1.2.0", "UID": "7360e300aa1d5c1c" }, "Version": "v1.2.0", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/agext/levenshtein@v1.2.3", "Name": "github.com/agext/levenshtein", "Identifier": { "PURL": "pkg:golang/github.com/agext/levenshtein@v1.2.3", "UID": "ba61c4617bd20321" }, "Version": "v1.2.3", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/agnivade/levenshtein@v1.2.1", "Name": "github.com/agnivade/levenshtein", "Identifier": { "PURL": "pkg:golang/github.com/agnivade/levenshtein@v1.2.1", "UID": "6ee11ca5cc59261f" }, "Version": "v1.2.1", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/alecthomas/chroma@v0.10.0", "Name": "github.com/alecthomas/chroma", "Identifier": { "PURL": "pkg:golang/github.com/alecthomas/chroma@v0.10.0", "UID": "b8841d03c63fae79" }, "Version": "v0.10.0", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/anchore/go-struct-converter@v0.1.0", "Name": "github.com/anchore/go-struct-converter", "Identifier": { "PURL": "pkg:golang/github.com/anchore/go-struct-converter@v0.1.0", "UID": "8c9a62b90209b70b" }, "Version": "v0.1.0", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/apparentlymart/go-cidr@v1.1.0", "Name": "github.com/apparentlymart/go-cidr", "Identifier": { "PURL": "pkg:golang/github.com/apparentlymart/go-cidr@v1.1.0", "UID": "67e2533915fe7827" }, "Version": "v1.1.0", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/apparentlymart/go-textseg/v15@v15.0.0", "Name": "github.com/apparentlymart/go-textseg/v15", "Identifier": { "PURL": "pkg:golang/github.com/apparentlymart/go-textseg/v15@v15.0.0", "UID": "7302b909c1a14cd3" }, "Version": "v15.0.0", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/aquasecurity/go-gem-version@v0.0.0-20201115065557-8eed6fe000ce", "Name": "github.com/aquasecurity/go-gem-version", "Identifier": { "PURL": "pkg:golang/github.com/aquasecurity/go-gem-version@v0.0.0-20201115065557-8eed6fe000ce", "UID": "da90d30f7b6732ee" }, "Version": "v0.0.0-20201115065557-8eed6fe000ce", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/aquasecurity/go-npm-version@v0.0.2", "Name": "github.com/aquasecurity/go-npm-version", "Identifier": { "PURL": "pkg:golang/github.com/aquasecurity/go-npm-version@v0.0.2", "UID": "aa93be567b62bbfe" }, "Version": "v0.0.2", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/aquasecurity/go-pep440-version@v0.0.1", "Name": "github.com/aquasecurity/go-pep440-version", "Identifier": { "PURL": "pkg:golang/github.com/aquasecurity/go-pep440-version@v0.0.1", "UID": "cedc73fe91c54bda" }, "Version": "v0.0.1", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/aquasecurity/go-version@v0.0.1", "Name": "github.com/aquasecurity/go-version", "Identifier": { "PURL": "pkg:golang/github.com/aquasecurity/go-version@v0.0.1", "UID": "5cf24bc2cd5d0fdb" }, "Version": "v0.0.1", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/aquasecurity/iamgo@v0.0.10", "Name": "github.com/aquasecurity/iamgo", "Identifier": { "PURL": "pkg:golang/github.com/aquasecurity/iamgo@v0.0.10", "UID": "93152bd8e471e265" }, "Version": "v0.0.10", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/aquasecurity/jfather@v0.0.8", "Name": "github.com/aquasecurity/jfather", "Identifier": { "PURL": "pkg:golang/github.com/aquasecurity/jfather@v0.0.8", "UID": "bf15b08043cea001" }, "Version": "v0.0.8", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/aquasecurity/table@v1.11.0", "Name": "github.com/aquasecurity/table", "Identifier": { "PURL": "pkg:golang/github.com/aquasecurity/table@v1.11.0", "UID": "14a3aabc245ea1dc" }, "Version": "v1.11.0", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/aquasecurity/tml@v0.6.1", "Name": "github.com/aquasecurity/tml", "Identifier": { "PURL": "pkg:golang/github.com/aquasecurity/tml@v0.6.1", "UID": "7661a770247124b5" }, "Version": "v0.6.1", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/aquasecurity/trivy-checks@v1.12.2-0.20251219190323-79d27547baf5", "Name": "github.com/aquasecurity/trivy-checks", "Identifier": { "PURL": "pkg:golang/github.com/aquasecurity/trivy-checks@v1.12.2-0.20251219190323-79d27547baf5", "UID": "9faa6481b79673ca" }, "Version": "v1.12.2-0.20251219190323-79d27547baf5", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/aquasecurity/trivy-db@v0.0.0-20251222105351-a833f47f8f0d", "Name": "github.com/aquasecurity/trivy-db", "Identifier": { "PURL": "pkg:golang/github.com/aquasecurity/trivy-db@v0.0.0-20251222105351-a833f47f8f0d", "UID": "3bfa832052a25e02" }, "Version": "v0.0.0-20251222105351-a833f47f8f0d", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/aquasecurity/trivy-java-db@v0.0.0-20240109071736-184bd7481d48", "Name": "github.com/aquasecurity/trivy-java-db", "Identifier": { "PURL": "pkg:golang/github.com/aquasecurity/trivy-java-db@v0.0.0-20240109071736-184bd7481d48", "UID": "333174c279cee4b4" }, "Version": "v0.0.0-20240109071736-184bd7481d48", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/aquasecurity/trivy-kubernetes@v0.9.1", "Name": "github.com/aquasecurity/trivy-kubernetes", "Identifier": { "PURL": "pkg:golang/github.com/aquasecurity/trivy-kubernetes@v0.9.1", "UID": "57e7108b9dbce948" }, "Version": "v0.9.1", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/asaskevich/govalidator@v0.0.0-20230301143203-a9d515a09cc2", "Name": "github.com/asaskevich/govalidator", "Identifier": { "PURL": "pkg:golang/github.com/asaskevich/govalidator@v0.0.0-20230301143203-a9d515a09cc2", "UID": "748caa937e831829" }, "Version": "v0.0.0-20230301143203-a9d515a09cc2", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/aws/aws-sdk-go-v2@v1.41.5", "Name": "github.com/aws/aws-sdk-go-v2", "Identifier": { "PURL": "pkg:golang/github.com/aws/aws-sdk-go-v2@v1.41.5", "UID": "d0f15a16c6e2ebd9" }, "Version": "v1.41.5", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.7.8", "Name": "github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream", "Identifier": { "PURL": "pkg:golang/github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.7.8", "UID": "7139731b3c2d4f0b" }, "Version": "v1.7.8", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/aws/aws-sdk-go-v2/config@v1.32.12", "Name": "github.com/aws/aws-sdk-go-v2/config", "Identifier": { "PURL": "pkg:golang/github.com/aws/aws-sdk-go-v2/config@v1.32.12", "UID": "98ddbead56697e85" }, "Version": "v1.32.12", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/aws/aws-sdk-go-v2/credentials@v1.19.12", "Name": "github.com/aws/aws-sdk-go-v2/credentials", "Identifier": { "PURL": "pkg:golang/github.com/aws/aws-sdk-go-v2/credentials@v1.19.12", "UID": "743d75746fff57b8" }, "Version": "v1.19.12", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/aws/aws-sdk-go-v2/feature/ec2/imds@v1.18.20", "Name": "github.com/aws/aws-sdk-go-v2/feature/ec2/imds", "Identifier": { "PURL": "pkg:golang/github.com/aws/aws-sdk-go-v2/feature/ec2/imds@v1.18.20", "UID": "86e8cf7982efa9f7" }, "Version": "v1.18.20", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/aws/aws-sdk-go-v2/internal/configsources@v1.4.21", "Name": "github.com/aws/aws-sdk-go-v2/internal/configsources", "Identifier": { "PURL": "pkg:golang/github.com/aws/aws-sdk-go-v2/internal/configsources@v1.4.21", "UID": "b1e5c4852b425059" }, "Version": "v1.4.21", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/aws/aws-sdk-go-v2/internal/endpoints/v2@v2.7.21", "Name": "github.com/aws/aws-sdk-go-v2/internal/endpoints/v2", "Identifier": { "PURL": "pkg:golang/github.com/aws/aws-sdk-go-v2/internal/endpoints/v2@v2.7.21", "UID": "6109162ea01bb525" }, "Version": "v2.7.21", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/aws/aws-sdk-go-v2/internal/ini@v1.8.6", "Name": "github.com/aws/aws-sdk-go-v2/internal/ini", "Identifier": { "PURL": "pkg:golang/github.com/aws/aws-sdk-go-v2/internal/ini@v1.8.6", "UID": "352227855b3f8171" }, "Version": "v1.8.6", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/aws/aws-sdk-go-v2/internal/v4a@v1.4.22", "Name": "github.com/aws/aws-sdk-go-v2/internal/v4a", "Identifier": { "PURL": "pkg:golang/github.com/aws/aws-sdk-go-v2/internal/v4a@v1.4.22", "UID": "e042f682bd481bae" }, "Version": "v1.4.22", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/aws/aws-sdk-go-v2/service/ebs@v1.22.1", "Name": "github.com/aws/aws-sdk-go-v2/service/ebs", "Identifier": { "PURL": "pkg:golang/github.com/aws/aws-sdk-go-v2/service/ebs@v1.22.1", "UID": "d376858ebfa4efc5" }, "Version": "v1.22.1", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/aws/aws-sdk-go-v2/service/ec2@v1.290.0", "Name": "github.com/aws/aws-sdk-go-v2/service/ec2", "Identifier": { "PURL": "pkg:golang/github.com/aws/aws-sdk-go-v2/service/ec2@v1.290.0", "UID": "4c6d110a4b1a2b9" }, "Version": "v1.290.0", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/aws/aws-sdk-go-v2/service/ecr@v1.55.2", "Name": "github.com/aws/aws-sdk-go-v2/service/ecr", "Identifier": { "PURL": "pkg:golang/github.com/aws/aws-sdk-go-v2/service/ecr@v1.55.2", "UID": "d313cd21e64bd3b5" }, "Version": "v1.55.2", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding@v1.13.7", "Name": "github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding", "Identifier": { "PURL": "pkg:golang/github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding@v1.13.7", "UID": "264e4852134677d" }, "Version": "v1.13.7", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/aws/aws-sdk-go-v2/service/internal/checksum@v1.9.13", "Name": "github.com/aws/aws-sdk-go-v2/service/internal/checksum", "Identifier": { "PURL": "pkg:golang/github.com/aws/aws-sdk-go-v2/service/internal/checksum@v1.9.13", "UID": "bc993c0e51723c61" }, "Version": "v1.9.13", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/aws/aws-sdk-go-v2/service/internal/presigned-url@v1.13.21", "Name": "github.com/aws/aws-sdk-go-v2/service/internal/presigned-url", "Identifier": { "PURL": "pkg:golang/github.com/aws/aws-sdk-go-v2/service/internal/presigned-url@v1.13.21", "UID": "b7d5cb751e275ce7" }, "Version": "v1.13.21", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/aws/aws-sdk-go-v2/service/internal/s3shared@v1.19.21", "Name": "github.com/aws/aws-sdk-go-v2/service/internal/s3shared", "Identifier": { "PURL": "pkg:golang/github.com/aws/aws-sdk-go-v2/service/internal/s3shared@v1.19.21", "UID": "a8fd92a1eb41ecd6" }, "Version": "v1.19.21", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/aws/aws-sdk-go-v2/service/s3@v1.97.3", "Name": "github.com/aws/aws-sdk-go-v2/service/s3", "Identifier": { "PURL": "pkg:golang/github.com/aws/aws-sdk-go-v2/service/s3@v1.97.3", "UID": "52116e8eca12d5af" }, "Version": "v1.97.3", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/aws/aws-sdk-go-v2/service/signin@v1.0.8", "Name": "github.com/aws/aws-sdk-go-v2/service/signin", "Identifier": { "PURL": "pkg:golang/github.com/aws/aws-sdk-go-v2/service/signin@v1.0.8", "UID": "7d647df9ee9b6e87" }, "Version": "v1.0.8", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/aws/aws-sdk-go-v2/service/sso@v1.30.13", "Name": "github.com/aws/aws-sdk-go-v2/service/sso", "Identifier": { "PURL": "pkg:golang/github.com/aws/aws-sdk-go-v2/service/sso@v1.30.13", "UID": "6df2547c61b3a33d" }, "Version": "v1.30.13", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/aws/aws-sdk-go-v2/service/ssooidc@v1.35.17", "Name": "github.com/aws/aws-sdk-go-v2/service/ssooidc", "Identifier": { "PURL": "pkg:golang/github.com/aws/aws-sdk-go-v2/service/ssooidc@v1.35.17", "UID": "41a36a54098d454c" }, "Version": "v1.35.17", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/aws/aws-sdk-go-v2/service/sts@v1.41.9", "Name": "github.com/aws/aws-sdk-go-v2/service/sts", "Identifier": { "PURL": "pkg:golang/github.com/aws/aws-sdk-go-v2/service/sts@v1.41.9", "UID": "38fa3cce8bd090bb" }, "Version": "v1.41.9", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/aws/smithy-go@v1.24.2", "Name": "github.com/aws/smithy-go", "Identifier": { "PURL": "pkg:golang/github.com/aws/smithy-go@v1.24.2", "UID": "6dce721f3a9fe03" }, "Version": "v1.24.2", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/bgentry/go-netrc@v0.0.0-20140422174119-9fd32a8b3d3d", "Name": "github.com/bgentry/go-netrc", "Identifier": { "PURL": "pkg:golang/github.com/bgentry/go-netrc@v0.0.0-20140422174119-9fd32a8b3d3d", "UID": "7155361c56c63d88" }, "Version": "v0.0.0-20140422174119-9fd32a8b3d3d", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/bitnami/go-version@v0.0.0-20231130084017-bb00604d650c", "Name": "github.com/bitnami/go-version", "Identifier": { "PURL": "pkg:golang/github.com/bitnami/go-version@v0.0.0-20231130084017-bb00604d650c", "UID": "c60f8b011537a993" }, "Version": "v0.0.0-20231130084017-bb00604d650c", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/blang/semver@v3.5.1+incompatible", "Name": "github.com/blang/semver", "Identifier": { "PURL": "pkg:golang/github.com/blang/semver@v3.5.1%2Bincompatible", "UID": "6aea81035a2e6920" }, "Version": "v3.5.1+incompatible", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/blang/semver/v4@v4.0.0", "Name": "github.com/blang/semver/v4", "Identifier": { "PURL": "pkg:golang/github.com/blang/semver/v4@v4.0.0", "UID": "3459292fd94134d7" }, "Version": "v4.0.0", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/bmatcuk/doublestar/v4@v4.10.0", "Name": "github.com/bmatcuk/doublestar/v4", "Identifier": { "PURL": "pkg:golang/github.com/bmatcuk/doublestar/v4@v4.10.0", "UID": "f7f88ed60346878f" }, "Version": "v4.10.0", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/briandowns/spinner@v1.23.0", "Name": "github.com/briandowns/spinner", "Identifier": { "PURL": "pkg:golang/github.com/briandowns/spinner@v1.23.0", "UID": "f9e42def9281dc64" }, "Version": "v1.23.0", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/cenkalti/backoff/v4@v4.3.0", "Name": "github.com/cenkalti/backoff/v4", "Identifier": { "PURL": "pkg:golang/github.com/cenkalti/backoff/v4@v4.3.0", "UID": "d60a15ccb83435c3" }, "Version": "v4.3.0", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/cenkalti/backoff/v5@v5.0.3", "Name": "github.com/cenkalti/backoff/v5", "Identifier": { "PURL": "pkg:golang/github.com/cenkalti/backoff/v5@v5.0.3", "UID": "b413c9d5ede90ef1" }, "Version": "v5.0.3", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/cespare/xxhash/v2@v2.3.0", "Name": "github.com/cespare/xxhash/v2", "Identifier": { "PURL": "pkg:golang/github.com/cespare/xxhash/v2@v2.3.0", "UID": "7420e8489ac3e3df" }, "Version": "v2.3.0", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/chai2010/gettext-go@v1.0.2", "Name": "github.com/chai2010/gettext-go", "Identifier": { "PURL": "pkg:golang/github.com/chai2010/gettext-go@v1.0.2", "UID": "31122e61f0e8c561" }, "Version": "v1.0.2", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/cheggaaa/pb/v3@v3.1.7", "Name": "github.com/cheggaaa/pb/v3", "Identifier": { "PURL": "pkg:golang/github.com/cheggaaa/pb/v3@v3.1.7", "UID": "c49347f7daeef85f" }, "Version": "v3.1.7", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/cloudflare/circl@v1.6.3", "Name": "github.com/cloudflare/circl", "Identifier": { "PURL": "pkg:golang/github.com/cloudflare/circl@v1.6.3", "UID": "7dd212f6b7e4add7" }, "Version": "v1.6.3", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/cncf/xds/go@v0.0.0-20251210132809-ee656c7534f5", "Name": "github.com/cncf/xds/go", "Identifier": { "PURL": "pkg:golang/github.com/cncf/xds/go@v0.0.0-20251210132809-ee656c7534f5", "UID": "12e0fd4ab66a4933" }, "Version": "v0.0.0-20251210132809-ee656c7534f5", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/containerd/containerd@v1.7.30", "Name": "github.com/containerd/containerd", "Identifier": { "PURL": "pkg:golang/github.com/containerd/containerd@v1.7.30", "UID": "8a3aa4155939eb09" }, "Version": "v1.7.30", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/containerd/containerd/api@v1.10.0", "Name": "github.com/containerd/containerd/api", "Identifier": { "PURL": "pkg:golang/github.com/containerd/containerd/api@v1.10.0", "UID": "b54dc237d643f400" }, "Version": "v1.10.0", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/containerd/containerd/v2@v2.2.2", "Name": "github.com/containerd/containerd/v2", "Identifier": { "PURL": "pkg:golang/github.com/containerd/containerd/v2@v2.2.2", "UID": "e463cbb6b7f5a5c1" }, "Version": "v2.2.2", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/containerd/continuity@v0.4.5", "Name": "github.com/containerd/continuity", "Identifier": { "PURL": "pkg:golang/github.com/containerd/continuity@v0.4.5", "UID": "24fc0316059e88fc" }, "Version": "v0.4.5", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/containerd/errdefs@v1.0.0", "Name": "github.com/containerd/errdefs", "Identifier": { "PURL": "pkg:golang/github.com/containerd/errdefs@v1.0.0", "UID": "2f6a100f51f96d0b" }, "Version": "v1.0.0", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/containerd/errdefs/pkg@v0.3.0", "Name": "github.com/containerd/errdefs/pkg", "Identifier": { "PURL": "pkg:golang/github.com/containerd/errdefs/pkg@v0.3.0", "UID": "a2e103ed59fc1a8b" }, "Version": "v0.3.0", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/containerd/fifo@v1.1.0", "Name": "github.com/containerd/fifo", "Identifier": { "PURL": "pkg:golang/github.com/containerd/fifo@v1.1.0", "UID": "74f97782f798c55a" }, "Version": "v1.1.0", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/containerd/log@v0.1.0", "Name": "github.com/containerd/log", "Identifier": { "PURL": "pkg:golang/github.com/containerd/log@v0.1.0", "UID": "521059ac4c61a913" }, "Version": "v0.1.0", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/containerd/platforms@v1.0.0-rc.4", "Name": "github.com/containerd/platforms", "Identifier": { "PURL": "pkg:golang/github.com/containerd/platforms@v1.0.0-rc.4", "UID": "fe4a42a0d011600c" }, "Version": "v1.0.0-rc.4", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/containerd/plugin@v1.0.0", "Name": "github.com/containerd/plugin", "Identifier": { "PURL": "pkg:golang/github.com/containerd/plugin@v1.0.0", "UID": "90d7a4cd62ba315" }, "Version": "v1.0.0", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/containerd/stargz-snapshotter/estargz@v0.18.2", "Name": "github.com/containerd/stargz-snapshotter/estargz", "Identifier": { "PURL": "pkg:golang/github.com/containerd/stargz-snapshotter/estargz@v0.18.2", "UID": "14b6d6355aae7692" }, "Version": "v0.18.2", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/containerd/ttrpc@v1.2.8", "Name": "github.com/containerd/ttrpc", "Identifier": { "PURL": "pkg:golang/github.com/containerd/ttrpc@v1.2.8", "UID": "7002e885ca0711a" }, "Version": "v1.2.8", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/containerd/typeurl/v2@v2.2.3", "Name": "github.com/containerd/typeurl/v2", "Identifier": { "PURL": "pkg:golang/github.com/containerd/typeurl/v2@v2.2.3", "UID": "545d3a854aa31468" }, "Version": "v2.2.3", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/coreos/go-oidc/v3@v3.17.0", "Name": "github.com/coreos/go-oidc/v3", "Identifier": { "PURL": "pkg:golang/github.com/coreos/go-oidc/v3@v3.17.0", "UID": "228c0c54f092b6fc" }, "Version": "v3.17.0", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/cyberphone/json-canonicalization@v0.0.0-20241213102144-19d51d7fe467", "Name": "github.com/cyberphone/json-canonicalization", "Identifier": { "PURL": "pkg:golang/github.com/cyberphone/json-canonicalization@v0.0.0-20241213102144-19d51d7fe467", "UID": "de38c87c6788664b" }, "Version": "v0.0.0-20241213102144-19d51d7fe467", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/cyphar/filepath-securejoin@v0.6.1", "Name": "github.com/cyphar/filepath-securejoin", "Identifier": { "PURL": "pkg:golang/github.com/cyphar/filepath-securejoin@v0.6.1", "UID": "ae3fbe4ef77ee834" }, "Version": "v0.6.1", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/davecgh/go-spew@v1.1.2-0.20180830191138-d8f796af33cc", "Name": "github.com/davecgh/go-spew", "Identifier": { "PURL": "pkg:golang/github.com/davecgh/go-spew@v1.1.2-0.20180830191138-d8f796af33cc", "UID": "177deb7bf0e6e1da" }, "Version": "v1.1.2-0.20180830191138-d8f796af33cc", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/dgryski/go-rendezvous@v0.0.0-20200823014737-9f7001d12a5f", "Name": "github.com/dgryski/go-rendezvous", "Identifier": { "PURL": "pkg:golang/github.com/dgryski/go-rendezvous@v0.0.0-20200823014737-9f7001d12a5f", "UID": "8e6aeda998d11e9" }, "Version": "v0.0.0-20200823014737-9f7001d12a5f", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/digitorus/pkcs7@v0.0.0-20230818184609-3a137a874352", "Name": "github.com/digitorus/pkcs7", "Identifier": { "PURL": "pkg:golang/github.com/digitorus/pkcs7@v0.0.0-20230818184609-3a137a874352", "UID": "c0e08d90f6138dd3" }, "Version": "v0.0.0-20230818184609-3a137a874352", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/digitorus/timestamp@v0.0.0-20231217203849-220c5c2851b7", "Name": "github.com/digitorus/timestamp", "Identifier": { "PURL": "pkg:golang/github.com/digitorus/timestamp@v0.0.0-20231217203849-220c5c2851b7", "UID": "ff13c2f135349018" }, "Version": "v0.0.0-20231217203849-220c5c2851b7", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/distribution/reference@v0.6.0", "Name": "github.com/distribution/reference", "Identifier": { "PURL": "pkg:golang/github.com/distribution/reference@v0.6.0", "UID": "e0231b6ce8eedfdc" }, "Version": "v0.6.0", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/dlclark/regexp2@v1.11.0", "Name": "github.com/dlclark/regexp2", "Identifier": { "PURL": "pkg:golang/github.com/dlclark/regexp2@v1.11.0", "UID": "8463b6fd36d46358" }, "Version": "v1.11.0", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/docker/cli@v29.4.0+incompatible", "Name": "github.com/docker/cli", "Identifier": { "PURL": "pkg:golang/github.com/docker/cli@v29.4.0%2Bincompatible", "UID": "bae265f20ee2749" }, "Version": "v29.4.0+incompatible", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/docker/distribution@v2.8.3+incompatible", "Name": "github.com/docker/distribution", "Identifier": { "PURL": "pkg:golang/github.com/docker/distribution@v2.8.3%2Bincompatible", "UID": "f609c2b0edbf528c" }, "Version": "v2.8.3+incompatible", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/docker/docker-credential-helpers@v0.9.5", "Name": "github.com/docker/docker-credential-helpers", "Identifier": { "PURL": "pkg:golang/github.com/docker/docker-credential-helpers@v0.9.5", "UID": "664cef0f793703cb" }, "Version": "v0.9.5", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/docker/go-connections@v0.6.0", "Name": "github.com/docker/go-connections", "Identifier": { "PURL": "pkg:golang/github.com/docker/go-connections@v0.6.0", "UID": "c390a1201a106d4d" }, "Version": "v0.6.0", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/docker/go-units@v0.5.0", "Name": "github.com/docker/go-units", "Identifier": { "PURL": "pkg:golang/github.com/docker/go-units@v0.5.0", "UID": "7699d652ae140b3d" }, "Version": "v0.5.0", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/dsnet/compress@v0.0.2-0.20230904184137-39efe44ab707", "Name": "github.com/dsnet/compress", "Identifier": { "PURL": "pkg:golang/github.com/dsnet/compress@v0.0.2-0.20230904184137-39efe44ab707", "UID": "341d202e7fbf0123" }, "Version": "v0.0.2-0.20230904184137-39efe44ab707", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/dustin/go-humanize@v1.0.1", "Name": "github.com/dustin/go-humanize", "Identifier": { "PURL": "pkg:golang/github.com/dustin/go-humanize@v1.0.1", "UID": "25825162961c806c" }, "Version": "v1.0.1", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/emicklei/go-restful/v3@v3.13.0", "Name": "github.com/emicklei/go-restful/v3", "Identifier": { "PURL": "pkg:golang/github.com/emicklei/go-restful/v3@v3.13.0", "UID": "457fed7f74a7bb23" }, "Version": "v3.13.0", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/emirpasic/gods@v1.18.1", "Name": "github.com/emirpasic/gods", "Identifier": { "PURL": "pkg:golang/github.com/emirpasic/gods@v1.18.1", "UID": "df2f169083665ebb" }, "Version": "v1.18.1", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/envoyproxy/go-control-plane/envoy@v1.36.0", "Name": "github.com/envoyproxy/go-control-plane/envoy", "Identifier": { "PURL": "pkg:golang/github.com/envoyproxy/go-control-plane/envoy@v1.36.0", "UID": "f376c48de84dc16a" }, "Version": "v1.36.0", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/envoyproxy/protoc-gen-validate@v1.3.0", "Name": "github.com/envoyproxy/protoc-gen-validate", "Identifier": { "PURL": "pkg:golang/github.com/envoyproxy/protoc-gen-validate@v1.3.0", "UID": "d963ad27de6540ba" }, "Version": "v1.3.0", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/evanphx/json-patch@v5.9.11+incompatible", "Name": "github.com/evanphx/json-patch", "Identifier": { "PURL": "pkg:golang/github.com/evanphx/json-patch@v5.9.11%2Bincompatible", "UID": "ada729514d5237d8" }, "Version": "v5.9.11+incompatible", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/exponent-io/jsonpath@v0.0.0-20210407135951-1de76d718b3f", "Name": "github.com/exponent-io/jsonpath", "Identifier": { "PURL": "pkg:golang/github.com/exponent-io/jsonpath@v0.0.0-20210407135951-1de76d718b3f", "UID": "932561f5279c2e0" }, "Version": "v0.0.0-20210407135951-1de76d718b3f", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/fatih/color@v1.19.0", "Name": "github.com/fatih/color", "Identifier": { "PURL": "pkg:golang/github.com/fatih/color@v1.19.0", "UID": "75527f86957cee76" }, "Version": "v1.19.0", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/felixge/httpsnoop@v1.0.4", "Name": "github.com/felixge/httpsnoop", "Identifier": { "PURL": "pkg:golang/github.com/felixge/httpsnoop@v1.0.4", "UID": "8cd8c4aa1f9cbb59" }, "Version": "v1.0.4", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/fsnotify/fsnotify@v1.9.0", "Name": "github.com/fsnotify/fsnotify", "Identifier": { "PURL": "pkg:golang/github.com/fsnotify/fsnotify@v1.9.0", "UID": "442635c0cd3c2f64" }, "Version": "v1.9.0", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/fvbommel/sortorder@v1.1.0", "Name": "github.com/fvbommel/sortorder", "Identifier": { "PURL": "pkg:golang/github.com/fvbommel/sortorder@v1.1.0", "UID": "c9d2cd52a9cbcb3d" }, "Version": "v1.1.0", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/fxamacker/cbor/v2@v2.9.0", "Name": "github.com/fxamacker/cbor/v2", "Identifier": { "PURL": "pkg:golang/github.com/fxamacker/cbor/v2@v2.9.0", "UID": "f1e66889e749c6f8" }, "Version": "v2.9.0", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/go-chi/chi/v5@v5.2.5", "Name": "github.com/go-chi/chi/v5", "Identifier": { "PURL": "pkg:golang/github.com/go-chi/chi/v5@v5.2.5", "UID": "a4efc862bac87022" }, "Version": "v5.2.5", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/go-errors/errors@v1.4.2", "Name": "github.com/go-errors/errors", "Identifier": { "PURL": "pkg:golang/github.com/go-errors/errors@v1.4.2", "UID": "a8ccf9e9b2b48be" }, "Version": "v1.4.2", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/go-git/gcfg@v1.5.1-0.20230307220236-3a3c6141e376", "Name": "github.com/go-git/gcfg", "Identifier": { "PURL": "pkg:golang/github.com/go-git/gcfg@v1.5.1-0.20230307220236-3a3c6141e376", "UID": "68d2db0be8cd7b36" }, "Version": "v1.5.1-0.20230307220236-3a3c6141e376", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/go-git/go-billy/v5@v5.8.0", "Name": "github.com/go-git/go-billy/v5", "Identifier": { "PURL": "pkg:golang/github.com/go-git/go-billy/v5@v5.8.0", "UID": "a9d04c20d96dbd1f" }, "Version": "v5.8.0", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/go-git/go-git/v5@v5.17.2", "Name": "github.com/go-git/go-git/v5", "Identifier": { "PURL": "pkg:golang/github.com/go-git/go-git/v5@v5.17.2", "UID": "d4aabe835d9af77e" }, "Version": "v5.17.2", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/go-gorp/gorp/v3@v3.1.0", "Name": "github.com/go-gorp/gorp/v3", "Identifier": { "PURL": "pkg:golang/github.com/go-gorp/gorp/v3@v3.1.0", "UID": "6da688dfefb3f370" }, "Version": "v3.1.0", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/go-ini/ini@v1.67.0", "Name": "github.com/go-ini/ini", "Identifier": { "PURL": "pkg:golang/github.com/go-ini/ini@v1.67.0", "UID": "4ae900b73cd81f6e" }, "Version": "v1.67.0", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/go-jose/go-jose/v4@v4.1.4", "Name": "github.com/go-jose/go-jose/v4", "Identifier": { "PURL": "pkg:golang/github.com/go-jose/go-jose/v4@v4.1.4", "UID": "75bc8b9f782c4e3b" }, "Version": "v4.1.4", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/go-logr/logr@v1.4.3", "Name": "github.com/go-logr/logr", "Identifier": { "PURL": "pkg:golang/github.com/go-logr/logr@v1.4.3", "UID": "9b65828b74992e71" }, "Version": "v1.4.3", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/go-logr/stdr@v1.2.2", "Name": "github.com/go-logr/stdr", "Identifier": { "PURL": "pkg:golang/github.com/go-logr/stdr@v1.2.2", "UID": "b63365cd332e6c8a" }, "Version": "v1.2.2", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/go-openapi/analysis@v0.24.3", "Name": "github.com/go-openapi/analysis", "Identifier": { "PURL": "pkg:golang/github.com/go-openapi/analysis@v0.24.3", "UID": "c37ba67596b9ac1e" }, "Version": "v0.24.3", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/go-openapi/errors@v0.22.7", "Name": "github.com/go-openapi/errors", "Identifier": { "PURL": "pkg:golang/github.com/go-openapi/errors@v0.22.7", "UID": "a868f9fe9c399df9" }, "Version": "v0.22.7", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/go-openapi/jsonpointer@v0.22.5", "Name": "github.com/go-openapi/jsonpointer", "Identifier": { "PURL": "pkg:golang/github.com/go-openapi/jsonpointer@v0.22.5", "UID": "ab316ef725e2dcca" }, "Version": "v0.22.5", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/go-openapi/jsonreference@v0.21.5", "Name": "github.com/go-openapi/jsonreference", "Identifier": { "PURL": "pkg:golang/github.com/go-openapi/jsonreference@v0.21.5", "UID": "383fdd803290f543" }, "Version": "v0.21.5", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/go-openapi/loads@v0.23.3", "Name": "github.com/go-openapi/loads", "Identifier": { "PURL": "pkg:golang/github.com/go-openapi/loads@v0.23.3", "UID": "da38871085d1e5e2" }, "Version": "v0.23.3", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/go-openapi/runtime@v0.29.3", "Name": "github.com/go-openapi/runtime", "Identifier": { "PURL": "pkg:golang/github.com/go-openapi/runtime@v0.29.3", "UID": "1287c4a9b21ecc1" }, "Version": "v0.29.3", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/go-openapi/spec@v0.22.4", "Name": "github.com/go-openapi/spec", "Identifier": { "PURL": "pkg:golang/github.com/go-openapi/spec@v0.22.4", "UID": "cb4af003201cfff0" }, "Version": "v0.22.4", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/go-openapi/strfmt@v0.26.1", "Name": "github.com/go-openapi/strfmt", "Identifier": { "PURL": "pkg:golang/github.com/go-openapi/strfmt@v0.26.1", "UID": "90dca1913340f7d" }, "Version": "v0.26.1", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/go-openapi/swag@v0.25.5", "Name": "github.com/go-openapi/swag", "Identifier": { "PURL": "pkg:golang/github.com/go-openapi/swag@v0.25.5", "UID": "cd98a5968759c59a" }, "Version": "v0.25.5", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/go-openapi/swag/cmdutils@v0.25.5", "Name": "github.com/go-openapi/swag/cmdutils", "Identifier": { "PURL": "pkg:golang/github.com/go-openapi/swag/cmdutils@v0.25.5", "UID": "2251e3e073452027" }, "Version": "v0.25.5", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/go-openapi/swag/conv@v0.25.5", "Name": "github.com/go-openapi/swag/conv", "Identifier": { "PURL": "pkg:golang/github.com/go-openapi/swag/conv@v0.25.5", "UID": "af277c8e160446c2" }, "Version": "v0.25.5", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/go-openapi/swag/fileutils@v0.25.5", "Name": "github.com/go-openapi/swag/fileutils", "Identifier": { "PURL": "pkg:golang/github.com/go-openapi/swag/fileutils@v0.25.5", "UID": "c98e912a19b1153" }, "Version": "v0.25.5", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/go-openapi/swag/jsonname@v0.25.5", "Name": "github.com/go-openapi/swag/jsonname", "Identifier": { "PURL": "pkg:golang/github.com/go-openapi/swag/jsonname@v0.25.5", "UID": "c3fe991888a31cf9" }, "Version": "v0.25.5", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/go-openapi/swag/jsonutils@v0.25.5", "Name": "github.com/go-openapi/swag/jsonutils", "Identifier": { "PURL": "pkg:golang/github.com/go-openapi/swag/jsonutils@v0.25.5", "UID": "abb77528d461238e" }, "Version": "v0.25.5", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/go-openapi/swag/loading@v0.25.5", "Name": "github.com/go-openapi/swag/loading", "Identifier": { "PURL": "pkg:golang/github.com/go-openapi/swag/loading@v0.25.5", "UID": "685b41496b381af5" }, "Version": "v0.25.5", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/go-openapi/swag/mangling@v0.25.5", "Name": "github.com/go-openapi/swag/mangling", "Identifier": { "PURL": "pkg:golang/github.com/go-openapi/swag/mangling@v0.25.5", "UID": "c3dc10871d1fe56a" }, "Version": "v0.25.5", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/go-openapi/swag/netutils@v0.25.5", "Name": "github.com/go-openapi/swag/netutils", "Identifier": { "PURL": "pkg:golang/github.com/go-openapi/swag/netutils@v0.25.5", "UID": "fc64e297d4730486" }, "Version": "v0.25.5", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/go-openapi/swag/stringutils@v0.25.5", "Name": "github.com/go-openapi/swag/stringutils", "Identifier": { "PURL": "pkg:golang/github.com/go-openapi/swag/stringutils@v0.25.5", "UID": "96b887c052452258" }, "Version": "v0.25.5", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/go-openapi/swag/typeutils@v0.25.5", "Name": "github.com/go-openapi/swag/typeutils", "Identifier": { "PURL": "pkg:golang/github.com/go-openapi/swag/typeutils@v0.25.5", "UID": "f9ffcec6f9f7d4e9" }, "Version": "v0.25.5", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/go-openapi/swag/yamlutils@v0.25.5", "Name": "github.com/go-openapi/swag/yamlutils", "Identifier": { "PURL": "pkg:golang/github.com/go-openapi/swag/yamlutils@v0.25.5", "UID": "19a94317bd31eb24" }, "Version": "v0.25.5", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/go-openapi/validate@v0.25.2", "Name": "github.com/go-openapi/validate", "Identifier": { "PURL": "pkg:golang/github.com/go-openapi/validate@v0.25.2", "UID": "31f101a2dc168a5" }, "Version": "v0.25.2", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/go-redis/redis/v8@v8.11.5", "Name": "github.com/go-redis/redis/v8", "Identifier": { "PURL": "pkg:golang/github.com/go-redis/redis/v8@v8.11.5", "UID": "a6b25aa71308a0be" }, "Version": "v8.11.5", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/go-viper/mapstructure/v2@v2.5.0", "Name": "github.com/go-viper/mapstructure/v2", "Identifier": { "PURL": "pkg:golang/github.com/go-viper/mapstructure/v2@v2.5.0", "UID": "670ec7107ce43c3" }, "Version": "v2.5.0", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/gobwas/glob@v0.2.3", "Name": "github.com/gobwas/glob", "Identifier": { "PURL": "pkg:golang/github.com/gobwas/glob@v0.2.3", "UID": "4bfc27b14d8230cd" }, "Version": "v0.2.3", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/gocsaf/csaf/v3@v3.5.1", "Name": "github.com/gocsaf/csaf/v3", "Identifier": { "PURL": "pkg:golang/github.com/gocsaf/csaf/v3@v3.5.1", "UID": "6da99e8e9e275b0e" }, "Version": "v3.5.1", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/gogo/protobuf@v1.3.2", "Name": "github.com/gogo/protobuf", "Identifier": { "PURL": "pkg:golang/github.com/gogo/protobuf@v1.3.2", "UID": "bd605447eccb6b6" }, "Version": "v1.3.2", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/golang-jwt/jwt/v5@v5.3.1", "Name": "github.com/golang-jwt/jwt/v5", "Identifier": { "PURL": "pkg:golang/github.com/golang-jwt/jwt/v5@v5.3.1", "UID": "28944257493e3b0b" }, "Version": "v5.3.1", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/golang/groupcache@v0.0.0-20241129210726-2c02b8208cf8", "Name": "github.com/golang/groupcache", "Identifier": { "PURL": "pkg:golang/github.com/golang/groupcache@v0.0.0-20241129210726-2c02b8208cf8", "UID": "f7634b74afb299e5" }, "Version": "v0.0.0-20241129210726-2c02b8208cf8", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/golang/snappy@v0.0.4", "Name": "github.com/golang/snappy", "Identifier": { "PURL": "pkg:golang/github.com/golang/snappy@v0.0.4", "UID": "b3ace0027834640d" }, "Version": "v0.0.4", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/google/btree@v1.1.3", "Name": "github.com/google/btree", "Identifier": { "PURL": "pkg:golang/github.com/google/btree@v1.1.3", "UID": "ce96f8e1fe72622a" }, "Version": "v1.1.3", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/google/certificate-transparency-go@v1.3.2", "Name": "github.com/google/certificate-transparency-go", "Identifier": { "PURL": "pkg:golang/github.com/google/certificate-transparency-go@v1.3.2", "UID": "cfce12744a264325" }, "Version": "v1.3.2", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/google/gnostic-models@v0.7.0", "Name": "github.com/google/gnostic-models", "Identifier": { "PURL": "pkg:golang/github.com/google/gnostic-models@v0.7.0", "UID": "fd1a49f61e834953" }, "Version": "v0.7.0", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/google/go-cmp@v0.7.0", "Name": "github.com/google/go-cmp", "Identifier": { "PURL": "pkg:golang/github.com/google/go-cmp@v0.7.0", "UID": "e3c84b5fba3830a0" }, "Version": "v0.7.0", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/google/go-containerregistry@v0.21.2", "Name": "github.com/google/go-containerregistry", "Identifier": { "PURL": "pkg:golang/github.com/google/go-containerregistry@v0.21.2", "UID": "ed3919294eb028ee" }, "Version": "v0.21.2", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/google/go-github/v62@v62.0.0", "Name": "github.com/google/go-github/v62", "Identifier": { "PURL": "pkg:golang/github.com/google/go-github/v62@v62.0.0", "UID": "19b5e2550861be92" }, "Version": "v62.0.0", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/google/go-querystring@v1.1.0", "Name": "github.com/google/go-querystring", "Identifier": { "PURL": "pkg:golang/github.com/google/go-querystring@v1.1.0", "UID": "5f3daded25b8c1d4" }, "Version": "v1.1.0", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/google/licenseclassifier/v2@v2.0.0", "Name": "github.com/google/licenseclassifier/v2", "Identifier": { "PURL": "pkg:golang/github.com/google/licenseclassifier/v2@v2.0.0", "UID": "2aec5b25a72ccee9" }, "Version": "v2.0.0", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/google/s2a-go@v0.1.9", "Name": "github.com/google/s2a-go", "Identifier": { "PURL": "pkg:golang/github.com/google/s2a-go@v0.1.9", "UID": "94f441342607d6a2" }, "Version": "v0.1.9", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/google/uuid@v1.6.0", "Name": "github.com/google/uuid", "Identifier": { "PURL": "pkg:golang/github.com/google/uuid@v1.6.0", "UID": "4adfd753a865f35c" }, "Version": "v1.6.0", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/googleapis/enterprise-certificate-proxy@v0.3.14", "Name": "github.com/googleapis/enterprise-certificate-proxy", "Identifier": { "PURL": "pkg:golang/github.com/googleapis/enterprise-certificate-proxy@v0.3.14", "UID": "6b3e9f2b79ed48f2" }, "Version": "v0.3.14", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/googleapis/gax-go/v2@v2.19.0", "Name": "github.com/googleapis/gax-go/v2", "Identifier": { "PURL": "pkg:golang/github.com/googleapis/gax-go/v2@v2.19.0", "UID": "ab6bdbe52288f04c" }, "Version": "v2.19.0", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/gosuri/uitable@v0.0.4", "Name": "github.com/gosuri/uitable", "Identifier": { "PURL": "pkg:golang/github.com/gosuri/uitable@v0.0.4", "UID": "635e731e4f2c4de1" }, "Version": "v0.0.4", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/gregjones/httpcache@v0.0.0-20190611155906-901d90724c79", "Name": "github.com/gregjones/httpcache", "Identifier": { "PURL": "pkg:golang/github.com/gregjones/httpcache@v0.0.0-20190611155906-901d90724c79", "UID": "c4b2ee53fc8b5507" }, "Version": "v0.0.0-20190611155906-901d90724c79", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/grpc-ecosystem/grpc-gateway/v2@v2.27.7", "Name": "github.com/grpc-ecosystem/grpc-gateway/v2", "Identifier": { "PURL": "pkg:golang/github.com/grpc-ecosystem/grpc-gateway/v2@v2.27.7", "UID": "ae8690ef198e0f" }, "Version": "v2.27.7", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/hashicorp/aws-sdk-go-base/v2@v2.0.0-beta.72", "Name": "github.com/hashicorp/aws-sdk-go-base/v2", "Identifier": { "PURL": "pkg:golang/github.com/hashicorp/aws-sdk-go-base/v2@v2.0.0-beta.72", "UID": "5d4401a17b34519e" }, "Version": "v2.0.0-beta.72", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/hashicorp/errwrap@v1.1.0", "Name": "github.com/hashicorp/errwrap", "Identifier": { "PURL": "pkg:golang/github.com/hashicorp/errwrap@v1.1.0", "UID": "f9f174fc60d72c60" }, "Version": "v1.1.0", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/hashicorp/go-cleanhttp@v0.5.2", "Name": "github.com/hashicorp/go-cleanhttp", "Identifier": { "PURL": "pkg:golang/github.com/hashicorp/go-cleanhttp@v0.5.2", "UID": "319168650022a808" }, "Version": "v0.5.2", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/hashicorp/go-getter@v1.8.6", "Name": "github.com/hashicorp/go-getter", "Identifier": { "PURL": "pkg:golang/github.com/hashicorp/go-getter@v1.8.6", "UID": "5f2672a787440ada" }, "Version": "v1.8.6", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/hashicorp/go-multierror@v1.1.1", "Name": "github.com/hashicorp/go-multierror", "Identifier": { "PURL": "pkg:golang/github.com/hashicorp/go-multierror@v1.1.1", "UID": "f8a807dbd0ac6b8e" }, "Version": "v1.1.1", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/hashicorp/go-retryablehttp@v0.7.8", "Name": "github.com/hashicorp/go-retryablehttp", "Identifier": { "PURL": "pkg:golang/github.com/hashicorp/go-retryablehttp@v0.7.8", "UID": "850c3b8b1967c5cb" }, "Version": "v0.7.8", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/hashicorp/go-uuid@v1.0.3", "Name": "github.com/hashicorp/go-uuid", "Identifier": { "PURL": "pkg:golang/github.com/hashicorp/go-uuid@v1.0.3", "UID": "a6cc044877c2ba56" }, "Version": "v1.0.3", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/hashicorp/go-version@v1.9.0", "Name": "github.com/hashicorp/go-version", "Identifier": { "PURL": "pkg:golang/github.com/hashicorp/go-version@v1.9.0", "UID": "a9df302b362a91b0" }, "Version": "v1.9.0", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/hashicorp/golang-lru/v2@v2.0.7", "Name": "github.com/hashicorp/golang-lru/v2", "Identifier": { "PURL": "pkg:golang/github.com/hashicorp/golang-lru/v2@v2.0.7", "UID": "892de27466788eb3" }, "Version": "v2.0.7", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/hashicorp/hcl/v2@v2.24.0", "Name": "github.com/hashicorp/hcl/v2", "Identifier": { "PURL": "pkg:golang/github.com/hashicorp/hcl/v2@v2.24.0", "UID": "63418544b8efe68" }, "Version": "v2.24.0", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/huandu/xstrings@v1.5.0", "Name": "github.com/huandu/xstrings", "Identifier": { "PURL": "pkg:golang/github.com/huandu/xstrings@v1.5.0", "UID": "eff1932730483db9" }, "Version": "v1.5.0", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/in-toto/attestation@v1.1.2", "Name": "github.com/in-toto/attestation", "Identifier": { "PURL": "pkg:golang/github.com/in-toto/attestation@v1.1.2", "UID": "79bfbbf807da507b" }, "Version": "v1.1.2", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/in-toto/in-toto-golang@v0.10.0", "Name": "github.com/in-toto/in-toto-golang", "Identifier": { "PURL": "pkg:golang/github.com/in-toto/in-toto-golang@v0.10.0", "UID": "74c4305e96ee4efa" }, "Version": "v0.10.0", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/jbenet/go-context@v0.0.0-20150711004518-d14ea06fba99", "Name": "github.com/jbenet/go-context", "Identifier": { "PURL": "pkg:golang/github.com/jbenet/go-context@v0.0.0-20150711004518-d14ea06fba99", "UID": "b187397dc575a5b8" }, "Version": "v0.0.0-20150711004518-d14ea06fba99", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/jedisct1/go-minisign@v0.0.0-20230811132847-661be99b8267", "Name": "github.com/jedisct1/go-minisign", "Identifier": { "PURL": "pkg:golang/github.com/jedisct1/go-minisign@v0.0.0-20230811132847-661be99b8267", "UID": "ba594e09b3ea77d1" }, "Version": "v0.0.0-20230811132847-661be99b8267", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/jmoiron/sqlx@v1.4.0", "Name": "github.com/jmoiron/sqlx", "Identifier": { "PURL": "pkg:golang/github.com/jmoiron/sqlx@v1.4.0", "UID": "c2bbf8c046c155bf" }, "Version": "v1.4.0", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/josephburnett/jd/v2@v2.3.0", "Name": "github.com/josephburnett/jd/v2", "Identifier": { "PURL": "pkg:golang/github.com/josephburnett/jd/v2@v2.3.0", "UID": "4dc86ae1c3ce3a53" }, "Version": "v2.3.0", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/json-iterator/go@v1.1.12", "Name": "github.com/json-iterator/go", "Identifier": { "PURL": "pkg:golang/github.com/json-iterator/go@v1.1.12", "UID": "ccf474b777dd1d0a" }, "Version": "v1.1.12", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/kevinburke/ssh_config@v1.2.0", "Name": "github.com/kevinburke/ssh_config", "Identifier": { "PURL": "pkg:golang/github.com/kevinburke/ssh_config@v1.2.0", "UID": "984f626e5be33db1" }, "Version": "v1.2.0", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/klauspost/compress@v1.18.5", "Name": "github.com/klauspost/compress", "Identifier": { "PURL": "pkg:golang/github.com/klauspost/compress@v1.18.5", "UID": "bdf42e01995337d9" }, "Version": "v1.18.5", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/knqyf263/go-apk-version@v0.0.0-20200609155635-041fdbb8563f", "Name": "github.com/knqyf263/go-apk-version", "Identifier": { "PURL": "pkg:golang/github.com/knqyf263/go-apk-version@v0.0.0-20200609155635-041fdbb8563f", "UID": "5a439fea08385dc1" }, "Version": "v0.0.0-20200609155635-041fdbb8563f", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/knqyf263/go-deb-version@v0.0.0-20241115132648-6f4aee6ccd23", "Name": "github.com/knqyf263/go-deb-version", "Identifier": { "PURL": "pkg:golang/github.com/knqyf263/go-deb-version@v0.0.0-20241115132648-6f4aee6ccd23", "UID": "59a0ea1156563560" }, "Version": "v0.0.0-20241115132648-6f4aee6ccd23", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/knqyf263/go-rpm-version@v0.0.0-20220614171824-631e686d1075", "Name": "github.com/knqyf263/go-rpm-version", "Identifier": { "PURL": "pkg:golang/github.com/knqyf263/go-rpm-version@v0.0.0-20220614171824-631e686d1075", "UID": "2889647244f1e914" }, "Version": "v0.0.0-20220614171824-631e686d1075", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/knqyf263/go-rpmdb@v0.1.1", "Name": "github.com/knqyf263/go-rpmdb", "Identifier": { "PURL": "pkg:golang/github.com/knqyf263/go-rpmdb@v0.1.1", "UID": "6baa1f6fea56525f" }, "Version": "v0.1.1", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/knqyf263/nested@v0.0.1", "Name": "github.com/knqyf263/nested", "Identifier": { "PURL": "pkg:golang/github.com/knqyf263/nested@v0.0.1", "UID": "548f1f2ebc2981ff" }, "Version": "v0.0.1", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/kylelemons/godebug@v1.1.0", "Name": "github.com/kylelemons/godebug", "Identifier": { "PURL": "pkg:golang/github.com/kylelemons/godebug@v1.1.0", "UID": "ff906bab37369ddd" }, "Version": "v1.1.0", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/lann/builder@v0.0.0-20180802200727-47ae307949d0", "Name": "github.com/lann/builder", "Identifier": { "PURL": "pkg:golang/github.com/lann/builder@v0.0.0-20180802200727-47ae307949d0", "UID": "7681856814d3464c" }, "Version": "v0.0.0-20180802200727-47ae307949d0", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/lann/ps@v0.0.0-20150810152359-62de8c46ede0", "Name": "github.com/lann/ps", "Identifier": { "PURL": "pkg:golang/github.com/lann/ps@v0.0.0-20150810152359-62de8c46ede0", "UID": "11f18e42e534d361" }, "Version": "v0.0.0-20150810152359-62de8c46ede0", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/lestrrat-go/blackmagic@v1.0.4", "Name": "github.com/lestrrat-go/blackmagic", "Identifier": { "PURL": "pkg:golang/github.com/lestrrat-go/blackmagic@v1.0.4", "UID": "2f116dd30f37c68e" }, "Version": "v1.0.4", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/lestrrat-go/dsig@v1.0.0", "Name": "github.com/lestrrat-go/dsig", "Identifier": { "PURL": "pkg:golang/github.com/lestrrat-go/dsig@v1.0.0", "UID": "b4561b8403a5cbb7" }, "Version": "v1.0.0", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/lestrrat-go/httpcc@v1.0.1", "Name": "github.com/lestrrat-go/httpcc", "Identifier": { "PURL": "pkg:golang/github.com/lestrrat-go/httpcc@v1.0.1", "UID": "92f5816769ba0dce" }, "Version": "v1.0.1", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/lestrrat-go/httprc/v3@v3.0.2", "Name": "github.com/lestrrat-go/httprc/v3", "Identifier": { "PURL": "pkg:golang/github.com/lestrrat-go/httprc/v3@v3.0.2", "UID": "f2f414be14728a9b" }, "Version": "v3.0.2", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/lestrrat-go/jwx/v3@v3.0.13", "Name": "github.com/lestrrat-go/jwx/v3", "Identifier": { "PURL": "pkg:golang/github.com/lestrrat-go/jwx/v3@v3.0.13", "UID": "540841d527ca89e4" }, "Version": "v3.0.13", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/lestrrat-go/option/v2@v2.0.0", "Name": "github.com/lestrrat-go/option/v2", "Identifier": { "PURL": "pkg:golang/github.com/lestrrat-go/option/v2@v2.0.0", "UID": "c9370e1dcc031bd" }, "Version": "v2.0.0", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/letsencrypt/boulder@v0.20260223.0", "Name": "github.com/letsencrypt/boulder", "Identifier": { "PURL": "pkg:golang/github.com/letsencrypt/boulder@v0.20260223.0", "UID": "5e08636e166d3ed5" }, "Version": "v0.20260223.0", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/lib/pq@v1.10.9", "Name": "github.com/lib/pq", "Identifier": { "PURL": "pkg:golang/github.com/lib/pq@v1.10.9", "UID": "cfa2eb3385a0302e" }, "Version": "v1.10.9", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/liggitt/tabwriter@v0.0.0-20181228230101-89fcab3d43de", "Name": "github.com/liggitt/tabwriter", "Identifier": { "PURL": "pkg:golang/github.com/liggitt/tabwriter@v0.0.0-20181228230101-89fcab3d43de", "UID": "55b742e7cde03956" }, "Version": "v0.0.0-20181228230101-89fcab3d43de", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/lunixbochs/struc@v0.0.0-20200707160740-784aaebc1d40", "Name": "github.com/lunixbochs/struc", "Identifier": { "PURL": "pkg:golang/github.com/lunixbochs/struc@v0.0.0-20200707160740-784aaebc1d40", "UID": "6bd0cb0f40593335" }, "Version": "v0.0.0-20200707160740-784aaebc1d40", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/masahiro331/go-disk@v0.0.0-20240625071113-56c933208fee", "Name": "github.com/masahiro331/go-disk", "Identifier": { "PURL": "pkg:golang/github.com/masahiro331/go-disk@v0.0.0-20240625071113-56c933208fee", "UID": "cbe1fc9b3028b1f1" }, "Version": "v0.0.0-20240625071113-56c933208fee", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/masahiro331/go-ebs-file@v0.0.0-20240917043618-e6d2bea5c32e", "Name": "github.com/masahiro331/go-ebs-file", "Identifier": { "PURL": "pkg:golang/github.com/masahiro331/go-ebs-file@v0.0.0-20240917043618-e6d2bea5c32e", "UID": "d73fafbc7b8e192e" }, "Version": "v0.0.0-20240917043618-e6d2bea5c32e", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/masahiro331/go-ext4-filesystem@v0.0.0-20240620024024-ca14e6327bbd", "Name": "github.com/masahiro331/go-ext4-filesystem", "Identifier": { "PURL": "pkg:golang/github.com/masahiro331/go-ext4-filesystem@v0.0.0-20240620024024-ca14e6327bbd", "UID": "98b8046f540c5afe" }, "Version": "v0.0.0-20240620024024-ca14e6327bbd", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/masahiro331/go-mvn-version@v0.0.0-20250131095131-f4974fa13b8a", "Name": "github.com/masahiro331/go-mvn-version", "Identifier": { "PURL": "pkg:golang/github.com/masahiro331/go-mvn-version@v0.0.0-20250131095131-f4974fa13b8a", "UID": "4fe113cc4ecb2529" }, "Version": "v0.0.0-20250131095131-f4974fa13b8a", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/masahiro331/go-vmdk-parser@v0.0.0-20221225061455-612096e4bbbd", "Name": "github.com/masahiro331/go-vmdk-parser", "Identifier": { "PURL": "pkg:golang/github.com/masahiro331/go-vmdk-parser@v0.0.0-20221225061455-612096e4bbbd", "UID": "3f3e6b539a89f83f" }, "Version": "v0.0.0-20221225061455-612096e4bbbd", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/masahiro331/go-xfs-filesystem@v0.0.0-20231205045356-1b22259a6c44", "Name": "github.com/masahiro331/go-xfs-filesystem", "Identifier": { "PURL": "pkg:golang/github.com/masahiro331/go-xfs-filesystem@v0.0.0-20231205045356-1b22259a6c44", "UID": "ac3ec924bcd08a18" }, "Version": "v0.0.0-20231205045356-1b22259a6c44", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/mattn/go-colorable@v0.1.14", "Name": "github.com/mattn/go-colorable", "Identifier": { "PURL": "pkg:golang/github.com/mattn/go-colorable@v0.1.14", "UID": "78a083a3b6b6f949" }, "Version": "v0.1.14", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/mattn/go-isatty@v0.0.20", "Name": "github.com/mattn/go-isatty", "Identifier": { "PURL": "pkg:golang/github.com/mattn/go-isatty@v0.0.20", "UID": "a634dfff900e18d9" }, "Version": "v0.0.20", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/mattn/go-runewidth@v0.0.16", "Name": "github.com/mattn/go-runewidth", "Identifier": { "PURL": "pkg:golang/github.com/mattn/go-runewidth@v0.0.16", "UID": "3e8619b76f70a00a" }, "Version": "v0.0.16", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/mattn/go-shellwords@v1.0.12", "Name": "github.com/mattn/go-shellwords", "Identifier": { "PURL": "pkg:golang/github.com/mattn/go-shellwords@v1.0.12", "UID": "d8b7a20ae7a3f459" }, "Version": "v1.0.12", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/mitchellh/copystructure@v1.2.0", "Name": "github.com/mitchellh/copystructure", "Identifier": { "PURL": "pkg:golang/github.com/mitchellh/copystructure@v1.2.0", "UID": "e30f0cbc5f8bfc95" }, "Version": "v1.2.0", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/mitchellh/go-homedir@v1.1.0", "Name": "github.com/mitchellh/go-homedir", "Identifier": { "PURL": "pkg:golang/github.com/mitchellh/go-homedir@v1.1.0", "UID": "fa8f0e1153843461" }, "Version": "v1.1.0", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/mitchellh/go-wordwrap@v1.0.1", "Name": "github.com/mitchellh/go-wordwrap", "Identifier": { "PURL": "pkg:golang/github.com/mitchellh/go-wordwrap@v1.0.1", "UID": "dc4c0112b3745677" }, "Version": "v1.0.1", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/mitchellh/hashstructure/v2@v2.0.2", "Name": "github.com/mitchellh/hashstructure/v2", "Identifier": { "PURL": "pkg:golang/github.com/mitchellh/hashstructure/v2@v2.0.2", "UID": "2b15407a4f16411e" }, "Version": "v2.0.2", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/mitchellh/mapstructure@v1.5.1-0.20231216201459-8508981c8b6c", "Name": "github.com/mitchellh/mapstructure", "Identifier": { "PURL": "pkg:golang/github.com/mitchellh/mapstructure@v1.5.1-0.20231216201459-8508981c8b6c", "UID": "9a667c12cebf833c" }, "Version": "v1.5.1-0.20231216201459-8508981c8b6c", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/mitchellh/reflectwalk@v1.0.2", "Name": "github.com/mitchellh/reflectwalk", "Identifier": { "PURL": "pkg:golang/github.com/mitchellh/reflectwalk@v1.0.2", "UID": "9d3e22e67a4104dc" }, "Version": "v1.0.2", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/moby/buildkit@v0.29.0", "Name": "github.com/moby/buildkit", "Identifier": { "PURL": "pkg:golang/github.com/moby/buildkit@v0.29.0", "UID": "5c4e512424da2407" }, "Version": "v0.29.0", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/moby/docker-image-spec@v1.3.1", "Name": "github.com/moby/docker-image-spec", "Identifier": { "PURL": "pkg:golang/github.com/moby/docker-image-spec@v1.3.1", "UID": "207218627447f3da" }, "Version": "v1.3.1", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/moby/locker@v1.0.1", "Name": "github.com/moby/locker", "Identifier": { "PURL": "pkg:golang/github.com/moby/locker@v1.0.1", "UID": "1b784e9739956710" }, "Version": "v1.0.1", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/moby/moby/api@v1.54.1", "Name": "github.com/moby/moby/api", "Identifier": { "PURL": "pkg:golang/github.com/moby/moby/api@v1.54.1", "UID": "b03fa3128f1368ab" }, "Version": "v1.54.1", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/moby/moby/client@v0.4.0", "Name": "github.com/moby/moby/client", "Identifier": { "PURL": "pkg:golang/github.com/moby/moby/client@v0.4.0", "UID": "fa4d5d3160880ce9" }, "Version": "v0.4.0", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/moby/sys/atomicwriter@v0.1.0", "Name": "github.com/moby/sys/atomicwriter", "Identifier": { "PURL": "pkg:golang/github.com/moby/sys/atomicwriter@v0.1.0", "UID": "3cedde4e0e228c02" }, "Version": "v0.1.0", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/moby/sys/mountinfo@v0.7.2", "Name": "github.com/moby/sys/mountinfo", "Identifier": { "PURL": "pkg:golang/github.com/moby/sys/mountinfo@v0.7.2", "UID": "dbcdeefba4897daa" }, "Version": "v0.7.2", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/moby/sys/sequential@v0.6.0", "Name": "github.com/moby/sys/sequential", "Identifier": { "PURL": "pkg:golang/github.com/moby/sys/sequential@v0.6.0", "UID": "4406f1662e8257e8" }, "Version": "v0.6.0", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/moby/sys/signal@v0.7.1", "Name": "github.com/moby/sys/signal", "Identifier": { "PURL": "pkg:golang/github.com/moby/sys/signal@v0.7.1", "UID": "89a80bacb9ff4c65" }, "Version": "v0.7.1", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/moby/sys/user@v0.4.0", "Name": "github.com/moby/sys/user", "Identifier": { "PURL": "pkg:golang/github.com/moby/sys/user@v0.4.0", "UID": "ad18d7ea40e71960" }, "Version": "v0.4.0", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/moby/sys/userns@v0.1.0", "Name": "github.com/moby/sys/userns", "Identifier": { "PURL": "pkg:golang/github.com/moby/sys/userns@v0.1.0", "UID": "7c9cc0e22521e813" }, "Version": "v0.1.0", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/moby/term@v0.5.2", "Name": "github.com/moby/term", "Identifier": { "PURL": "pkg:golang/github.com/moby/term@v0.5.2", "UID": "5aa86afd32dc7e17" }, "Version": "v0.5.2", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/modern-go/concurrent@v0.0.0-20180306012644-bacd9c7ef1dd", "Name": "github.com/modern-go/concurrent", "Identifier": { "PURL": "pkg:golang/github.com/modern-go/concurrent@v0.0.0-20180306012644-bacd9c7ef1dd", "UID": "fd92eda2da191208" }, "Version": "v0.0.0-20180306012644-bacd9c7ef1dd", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/modern-go/reflect2@v1.0.3-0.20250322232337-35a7c28c31ee", "Name": "github.com/modern-go/reflect2", "Identifier": { "PURL": "pkg:golang/github.com/modern-go/reflect2@v1.0.3-0.20250322232337-35a7c28c31ee", "UID": "4281e5fee818b0c0" }, "Version": "v1.0.3-0.20250322232337-35a7c28c31ee", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/monochromegane/go-gitignore@v0.0.0-20200626010858-205db1a8cc00", "Name": "github.com/monochromegane/go-gitignore", "Identifier": { "PURL": "pkg:golang/github.com/monochromegane/go-gitignore@v0.0.0-20200626010858-205db1a8cc00", "UID": "ad17ce6a104ac8a6" }, "Version": "v0.0.0-20200626010858-205db1a8cc00", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/morikuni/aec@v1.1.0", "Name": "github.com/morikuni/aec", "Identifier": { "PURL": "pkg:golang/github.com/morikuni/aec@v1.1.0", "UID": "205366929dd7a8a1" }, "Version": "v1.1.0", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/munnerz/goautoneg@v0.0.0-20191010083416-a7dc8b61c822", "Name": "github.com/munnerz/goautoneg", "Identifier": { "PURL": "pkg:golang/github.com/munnerz/goautoneg@v0.0.0-20191010083416-a7dc8b61c822", "UID": "abe45a24072fe29e" }, "Version": "v0.0.0-20191010083416-a7dc8b61c822", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/nikolalohinski/gonja/v2@v2.7.0", "Name": "github.com/nikolalohinski/gonja/v2", "Identifier": { "PURL": "pkg:golang/github.com/nikolalohinski/gonja/v2@v2.7.0", "UID": "919cbe7c6edf6b4b" }, "Version": "v2.7.0", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/nozzle/throttler@v0.0.0-20180817012639-2ea982251481", "Name": "github.com/nozzle/throttler", "Identifier": { "PURL": "pkg:golang/github.com/nozzle/throttler@v0.0.0-20180817012639-2ea982251481", "UID": "d13be155ec41c2f3" }, "Version": "v0.0.0-20180817012639-2ea982251481", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/oklog/ulid/v2@v2.1.1", "Name": "github.com/oklog/ulid/v2", "Identifier": { "PURL": "pkg:golang/github.com/oklog/ulid/v2@v2.1.1", "UID": "701be4c8e01768c0" }, "Version": "v2.1.1", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/open-policy-agent/opa@v1.15.2", "Name": "github.com/open-policy-agent/opa", "Identifier": { "PURL": "pkg:golang/github.com/open-policy-agent/opa@v1.15.2", "UID": "c641ebd8a2967d03" }, "Version": "v1.15.2", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/opencontainers/go-digest@v1.0.0", "Name": "github.com/opencontainers/go-digest", "Identifier": { "PURL": "pkg:golang/github.com/opencontainers/go-digest@v1.0.0", "UID": "d509e6b9eec734c6" }, "Version": "v1.0.0", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/opencontainers/image-spec@v1.1.1", "Name": "github.com/opencontainers/image-spec", "Identifier": { "PURL": "pkg:golang/github.com/opencontainers/image-spec@v1.1.1", "UID": "f2d1b95b6086ab3c" }, "Version": "v1.1.1", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/opencontainers/runtime-spec@v1.3.0", "Name": "github.com/opencontainers/runtime-spec", "Identifier": { "PURL": "pkg:golang/github.com/opencontainers/runtime-spec@v1.3.0", "UID": "865523aa6ebaea64" }, "Version": "v1.3.0", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/opencontainers/selinux@v1.13.1", "Name": "github.com/opencontainers/selinux", "Identifier": { "PURL": "pkg:golang/github.com/opencontainers/selinux@v1.13.1", "UID": "7efa7b4ec13bfa51" }, "Version": "v1.13.1", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/openvex/discovery@v0.1.1-0.20240802171711-7c54efc57553", "Name": "github.com/openvex/discovery", "Identifier": { "PURL": "pkg:golang/github.com/openvex/discovery@v0.1.1-0.20240802171711-7c54efc57553", "UID": "caa63d2783605865" }, "Version": "v0.1.1-0.20240802171711-7c54efc57553", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/openvex/go-vex@v0.2.7", "Name": "github.com/openvex/go-vex", "Identifier": { "PURL": "pkg:golang/github.com/openvex/go-vex@v0.2.7", "UID": "1af917eb213b6f76" }, "Version": "v0.2.7", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/owenrumney/go-sarif/v2@v2.3.3", "Name": "github.com/owenrumney/go-sarif/v2", "Identifier": { "PURL": "pkg:golang/github.com/owenrumney/go-sarif/v2@v2.3.3", "UID": "22b7c5a0a79c718d" }, "Version": "v2.3.3", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/owenrumney/squealer@v1.2.12", "Name": "github.com/owenrumney/squealer", "Identifier": { "PURL": "pkg:golang/github.com/owenrumney/squealer@v1.2.12", "UID": "107576fbf5aab4f2" }, "Version": "v1.2.12", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/package-url/packageurl-go@v0.1.5", "Name": "github.com/package-url/packageurl-go", "Identifier": { "PURL": "pkg:golang/github.com/package-url/packageurl-go@v0.1.5", "UID": "b39f919f48358a8" }, "Version": "v0.1.5", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/pandatix/go-cvss@v0.6.2", "Name": "github.com/pandatix/go-cvss", "Identifier": { "PURL": "pkg:golang/github.com/pandatix/go-cvss@v0.6.2", "UID": "2887439a7735853" }, "Version": "v0.6.2", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/pelletier/go-toml/v2@v2.2.4", "Name": "github.com/pelletier/go-toml/v2", "Identifier": { "PURL": "pkg:golang/github.com/pelletier/go-toml/v2@v2.2.4", "UID": "f09256c52422d9de" }, "Version": "v2.2.4", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/peterbourgon/diskv@v2.0.1+incompatible", "Name": "github.com/peterbourgon/diskv", "Identifier": { "PURL": "pkg:golang/github.com/peterbourgon/diskv@v2.0.1%2Bincompatible", "UID": "c467f44ba766a609" }, "Version": "v2.0.1+incompatible", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/pjbgf/sha1cd@v0.3.2", "Name": "github.com/pjbgf/sha1cd", "Identifier": { "PURL": "pkg:golang/github.com/pjbgf/sha1cd@v0.3.2", "UID": "ce7daffeb334bed8" }, "Version": "v0.3.2", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/pkg/browser@v0.0.0-20240102092130-5ac0b6a4141c", "Name": "github.com/pkg/browser", "Identifier": { "PURL": "pkg:golang/github.com/pkg/browser@v0.0.0-20240102092130-5ac0b6a4141c", "UID": "bf4fddf3420621bc" }, "Version": "v0.0.0-20240102092130-5ac0b6a4141c", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/pkg/errors@v0.9.1", "Name": "github.com/pkg/errors", "Identifier": { "PURL": "pkg:golang/github.com/pkg/errors@v0.9.1", "UID": "af2c635457b37790" }, "Version": "v0.9.1", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/planetscale/vtprotobuf@v0.6.1-0.20240319094008-0393e58bdf10", "Name": "github.com/planetscale/vtprotobuf", "Identifier": { "PURL": "pkg:golang/github.com/planetscale/vtprotobuf@v0.6.1-0.20240319094008-0393e58bdf10", "UID": "1cf140e58a1f3afe" }, "Version": "v0.6.1-0.20240319094008-0393e58bdf10", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/pmezard/go-difflib@v1.0.1-0.20181226105442-5d4384ee4fb2", "Name": "github.com/pmezard/go-difflib", "Identifier": { "PURL": "pkg:golang/github.com/pmezard/go-difflib@v1.0.1-0.20181226105442-5d4384ee4fb2", "UID": "8d5735bc78902712" }, "Version": "v1.0.1-0.20181226105442-5d4384ee4fb2", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/rcrowley/go-metrics@v0.0.0-20250401214520-65e299d6c5c9", "Name": "github.com/rcrowley/go-metrics", "Identifier": { "PURL": "pkg:golang/github.com/rcrowley/go-metrics@v0.0.0-20250401214520-65e299d6c5c9", "UID": "4bbc26a320477f67" }, "Version": "v0.0.0-20250401214520-65e299d6c5c9", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/remyoudompheng/bigfft@v0.0.0-20230129092748-24d4a6f8daec", "Name": "github.com/remyoudompheng/bigfft", "Identifier": { "PURL": "pkg:golang/github.com/remyoudompheng/bigfft@v0.0.0-20230129092748-24d4a6f8daec", "UID": "9f4ca67645d87fd5" }, "Version": "v0.0.0-20230129092748-24d4a6f8daec", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/rivo/uniseg@v0.4.7", "Name": "github.com/rivo/uniseg", "Identifier": { "PURL": "pkg:golang/github.com/rivo/uniseg@v0.4.7", "UID": "6e101f5213f5b3cc" }, "Version": "v0.4.7", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/rubenv/sql-migrate@v1.8.1", "Name": "github.com/rubenv/sql-migrate", "Identifier": { "PURL": "pkg:golang/github.com/rubenv/sql-migrate@v1.8.1", "UID": "e0ff8f4c1226e806" }, "Version": "v1.8.1", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/russross/blackfriday/v2@v2.1.0", "Name": "github.com/russross/blackfriday/v2", "Identifier": { "PURL": "pkg:golang/github.com/russross/blackfriday/v2@v2.1.0", "UID": "1a251e8605ee5576" }, "Version": "v2.1.0", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/rust-secure-code/go-rustaudit@v0.0.0-20250226111315-e20ec32e963c", "Name": "github.com/rust-secure-code/go-rustaudit", "Identifier": { "PURL": "pkg:golang/github.com/rust-secure-code/go-rustaudit@v0.0.0-20250226111315-e20ec32e963c", "UID": "7783937f4d7bc0bc" }, "Version": "v0.0.0-20250226111315-e20ec32e963c", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/sagikazarmark/locafero@v0.11.0", "Name": "github.com/sagikazarmark/locafero", "Identifier": { "PURL": "pkg:golang/github.com/sagikazarmark/locafero@v0.11.0", "UID": "c38c5e2cc1d8392e" }, "Version": "v0.11.0", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/samber/lo@v1.53.0", "Name": "github.com/samber/lo", "Identifier": { "PURL": "pkg:golang/github.com/samber/lo@v1.53.0", "UID": "9c4f4fb4c35a9b89" }, "Version": "v1.53.0", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/samber/oops@v1.18.1", "Name": "github.com/samber/oops", "Identifier": { "PURL": "pkg:golang/github.com/samber/oops@v1.18.1", "UID": "c38900b323ca8518" }, "Version": "v1.18.1", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/santhosh-tekuri/jsonschema/v6@v6.0.2", "Name": "github.com/santhosh-tekuri/jsonschema/v6", "Identifier": { "PURL": "pkg:golang/github.com/santhosh-tekuri/jsonschema/v6@v6.0.2", "UID": "ebe07f57a3fe66d9" }, "Version": "v6.0.2", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/sassoftware/go-rpmutils@v0.4.0", "Name": "github.com/sassoftware/go-rpmutils", "Identifier": { "PURL": "pkg:golang/github.com/sassoftware/go-rpmutils@v0.4.0", "UID": "ec4d5355ead87635" }, "Version": "v0.4.0", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/sassoftware/relic@v7.2.1+incompatible", "Name": "github.com/sassoftware/relic", "Identifier": { "PURL": "pkg:golang/github.com/sassoftware/relic@v7.2.1%2Bincompatible", "UID": "b0b63eb8cb43d2c0" }, "Version": "v7.2.1+incompatible", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/secure-systems-lab/go-securesystemslib@v0.10.0", "Name": "github.com/secure-systems-lab/go-securesystemslib", "Identifier": { "PURL": "pkg:golang/github.com/secure-systems-lab/go-securesystemslib@v0.10.0", "UID": "25e12c8331ef3135" }, "Version": "v0.10.0", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/sergi/go-diff@v1.4.0", "Name": "github.com/sergi/go-diff", "Identifier": { "PURL": "pkg:golang/github.com/sergi/go-diff@v1.4.0", "UID": "10646aa622a6ef3a" }, "Version": "v1.4.0", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/shibumi/go-pathspec@v1.3.0", "Name": "github.com/shibumi/go-pathspec", "Identifier": { "PURL": "pkg:golang/github.com/shibumi/go-pathspec@v1.3.0", "UID": "2b89a4645080d727" }, "Version": "v1.3.0", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/shopspring/decimal@v1.4.0", "Name": "github.com/shopspring/decimal", "Identifier": { "PURL": "pkg:golang/github.com/shopspring/decimal@v1.4.0", "UID": "5b96e4c5a98ecd4d" }, "Version": "v1.4.0", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/sigstore/cosign/v2@v2.6.2", "Name": "github.com/sigstore/cosign/v2", "Identifier": { "PURL": "pkg:golang/github.com/sigstore/cosign/v2@v2.6.2", "UID": "9446708cfde2a8d8" }, "Version": "v2.6.2", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/sigstore/protobuf-specs@v0.5.0", "Name": "github.com/sigstore/protobuf-specs", "Identifier": { "PURL": "pkg:golang/github.com/sigstore/protobuf-specs@v0.5.0", "UID": "779ba31bea7440e3" }, "Version": "v0.5.0", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/sigstore/rekor@v1.5.1", "Name": "github.com/sigstore/rekor", "Identifier": { "PURL": "pkg:golang/github.com/sigstore/rekor@v1.5.1", "UID": "c8bb1a796b199c71" }, "Version": "v1.5.1", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/sigstore/rekor-tiles/v2@v2.0.1", "Name": "github.com/sigstore/rekor-tiles/v2", "Identifier": { "PURL": "pkg:golang/github.com/sigstore/rekor-tiles/v2@v2.0.1", "UID": "318e94ab6159e848" }, "Version": "v2.0.1", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/sigstore/sigstore@v1.10.5", "Name": "github.com/sigstore/sigstore", "Identifier": { "PURL": "pkg:golang/github.com/sigstore/sigstore@v1.10.5", "UID": "ed3218a83663b288" }, "Version": "v1.10.5", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/sigstore/sigstore-go@v1.1.4", "Name": "github.com/sigstore/sigstore-go", "Identifier": { "PURL": "pkg:golang/github.com/sigstore/sigstore-go@v1.1.4", "UID": "9d7bb6c3e0e0c79e" }, "Version": "v1.1.4", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/sigstore/timestamp-authority/v2@v2.0.6", "Name": "github.com/sigstore/timestamp-authority/v2", "Identifier": { "PURL": "pkg:golang/github.com/sigstore/timestamp-authority/v2@v2.0.6", "UID": "ff386c449d83eeff" }, "Version": "v2.0.6", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/sirupsen/logrus@v1.9.4", "Name": "github.com/sirupsen/logrus", "Identifier": { "PURL": "pkg:golang/github.com/sirupsen/logrus@v1.9.4", "UID": "9190fb84187cf0b0" }, "Version": "v1.9.4", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/skeema/knownhosts@v1.3.1", "Name": "github.com/skeema/knownhosts", "Identifier": { "PURL": "pkg:golang/github.com/skeema/knownhosts@v1.3.1", "UID": "c2eac9faf6f8437" }, "Version": "v1.3.1", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/sourcegraph/conc@v0.3.1-0.20240121214520-5f936abd7ae8", "Name": "github.com/sourcegraph/conc", "Identifier": { "PURL": "pkg:golang/github.com/sourcegraph/conc@v0.3.1-0.20240121214520-5f936abd7ae8", "UID": "43058d7611ee50f8" }, "Version": "v0.3.1-0.20240121214520-5f936abd7ae8", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/spdx/tools-golang@v0.5.7", "Name": "github.com/spdx/tools-golang", "Identifier": { "PURL": "pkg:golang/github.com/spdx/tools-golang@v0.5.7", "UID": "d697b7adfed34095" }, "Version": "v0.5.7", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/spf13/afero@v1.15.0", "Name": "github.com/spf13/afero", "Identifier": { "PURL": "pkg:golang/github.com/spf13/afero@v1.15.0", "UID": "752bc372f98b210e" }, "Version": "v1.15.0", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/spf13/cast@v1.10.0", "Name": "github.com/spf13/cast", "Identifier": { "PURL": "pkg:golang/github.com/spf13/cast@v1.10.0", "UID": "92b00a99adb32b82" }, "Version": "v1.10.0", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/spf13/cobra@v1.10.2", "Name": "github.com/spf13/cobra", "Identifier": { "PURL": "pkg:golang/github.com/spf13/cobra@v1.10.2", "UID": "c733cc590073febc" }, "Version": "v1.10.2", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/spf13/pflag@v1.0.10", "Name": "github.com/spf13/pflag", "Identifier": { "PURL": "pkg:golang/github.com/spf13/pflag@v1.0.10", "UID": "f1451eafa1f92c90" }, "Version": "v1.0.10", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/spf13/viper@v1.21.0", "Name": "github.com/spf13/viper", "Identifier": { "PURL": "pkg:golang/github.com/spf13/viper@v1.21.0", "UID": "56d107254faa550a" }, "Version": "v1.21.0", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/spiffe/go-spiffe/v2@v2.6.0", "Name": "github.com/spiffe/go-spiffe/v2", "Identifier": { "PURL": "pkg:golang/github.com/spiffe/go-spiffe/v2@v2.6.0", "UID": "f7f01d013898a5d9" }, "Version": "v2.6.0", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/stretchr/objx@v0.5.3", "Name": "github.com/stretchr/objx", "Identifier": { "PURL": "pkg:golang/github.com/stretchr/objx@v0.5.3", "UID": "8a29c26a63a441f1" }, "Version": "v0.5.3", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/stretchr/testify@v1.11.1", "Name": "github.com/stretchr/testify", "Identifier": { "PURL": "pkg:golang/github.com/stretchr/testify@v1.11.1", "UID": "e8a6d9abf20c7eb8" }, "Version": "v1.11.1", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/subosito/gotenv@v1.6.0", "Name": "github.com/subosito/gotenv", "Identifier": { "PURL": "pkg:golang/github.com/subosito/gotenv@v1.6.0", "UID": "a5b03d3a9c2090c" }, "Version": "v1.6.0", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/syndtr/goleveldb@v1.0.1-0.20220721030215-126854af5e6d", "Name": "github.com/syndtr/goleveldb", "Identifier": { "PURL": "pkg:golang/github.com/syndtr/goleveldb@v1.0.1-0.20220721030215-126854af5e6d", "UID": "f56d59e7e12a0c95" }, "Version": "v1.0.1-0.20220721030215-126854af5e6d", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/tchap/go-patricia/v2@v2.3.3", "Name": "github.com/tchap/go-patricia/v2", "Identifier": { "PURL": "pkg:golang/github.com/tchap/go-patricia/v2@v2.3.3", "UID": "44d9f889c096e5d3" }, "Version": "v2.3.3", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/tetratelabs/wazero@v1.11.0", "Name": "github.com/tetratelabs/wazero", "Identifier": { "PURL": "pkg:golang/github.com/tetratelabs/wazero@v1.11.0", "UID": "68b5f7de1fc27d8b" }, "Version": "v1.11.0", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/theupdateframework/go-tuf@v0.7.0", "Name": "github.com/theupdateframework/go-tuf", "Identifier": { "PURL": "pkg:golang/github.com/theupdateframework/go-tuf@v0.7.0", "UID": "e0e9ac03cae71a01" }, "Version": "v0.7.0", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/theupdateframework/go-tuf/v2@v2.4.1", "Name": "github.com/theupdateframework/go-tuf/v2", "Identifier": { "PURL": "pkg:golang/github.com/theupdateframework/go-tuf/v2@v2.4.1", "UID": "64398ae254426b4a" }, "Version": "v2.4.1", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/titanous/rocacheck@v0.0.0-20171023193734-afe73141d399", "Name": "github.com/titanous/rocacheck", "Identifier": { "PURL": "pkg:golang/github.com/titanous/rocacheck@v0.0.0-20171023193734-afe73141d399", "UID": "51673eb00726726" }, "Version": "v0.0.0-20171023193734-afe73141d399", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/tonistiigi/go-csvvalue@v0.0.0-20240814133006-030d3b2625d0", "Name": "github.com/tonistiigi/go-csvvalue", "Identifier": { "PURL": "pkg:golang/github.com/tonistiigi/go-csvvalue@v0.0.0-20240814133006-030d3b2625d0", "UID": "ba96d9fdca130e4c" }, "Version": "v0.0.0-20240814133006-030d3b2625d0", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/toqueteos/webbrowser@v1.2.0", "Name": "github.com/toqueteos/webbrowser", "Identifier": { "PURL": "pkg:golang/github.com/toqueteos/webbrowser@v1.2.0", "UID": "edce0f4ca4a76d84" }, "Version": "v1.2.0", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/transparency-dev/formats@v0.0.0-20251017110053-404c0d5b696c", "Name": "github.com/transparency-dev/formats", "Identifier": { "PURL": "pkg:golang/github.com/transparency-dev/formats@v0.0.0-20251017110053-404c0d5b696c", "UID": "3841a3b958f5539f" }, "Version": "v0.0.0-20251017110053-404c0d5b696c", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/transparency-dev/merkle@v0.0.2", "Name": "github.com/transparency-dev/merkle", "Identifier": { "PURL": "pkg:golang/github.com/transparency-dev/merkle@v0.0.2", "UID": "91d4619d2f5e0a2b" }, "Version": "v0.0.2", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/twitchtv/twirp@v8.1.3+incompatible", "Name": "github.com/twitchtv/twirp", "Identifier": { "PURL": "pkg:golang/github.com/twitchtv/twirp@v8.1.3%2Bincompatible", "UID": "7ceaa58dec508301" }, "Version": "v8.1.3+incompatible", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/ulikunitz/xz@v0.5.15", "Name": "github.com/ulikunitz/xz", "Identifier": { "PURL": "pkg:golang/github.com/ulikunitz/xz@v0.5.15", "UID": "57867d58e7ed3139" }, "Version": "v0.5.15", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/valyala/fastjson@v1.6.7", "Name": "github.com/valyala/fastjson", "Identifier": { "PURL": "pkg:golang/github.com/valyala/fastjson@v1.6.7", "UID": "46c290945432c4ba" }, "Version": "v1.6.7", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/vbatts/tar-split@v0.12.2", "Name": "github.com/vbatts/tar-split", "Identifier": { "PURL": "pkg:golang/github.com/vbatts/tar-split@v0.12.2", "UID": "1fdefc95e0bde68f" }, "Version": "v0.12.2", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/vektah/gqlparser/v2@v2.5.32", "Name": "github.com/vektah/gqlparser/v2", "Identifier": { "PURL": "pkg:golang/github.com/vektah/gqlparser/v2@v2.5.32", "UID": "aeb7124d7829827" }, "Version": "v2.5.32", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/vmihailenco/msgpack/v5@v5.4.1", "Name": "github.com/vmihailenco/msgpack/v5", "Identifier": { "PURL": "pkg:golang/github.com/vmihailenco/msgpack/v5@v5.4.1", "UID": "98be7c75c8890879" }, "Version": "v5.4.1", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/vmihailenco/tagparser/v2@v2.0.0", "Name": "github.com/vmihailenco/tagparser/v2", "Identifier": { "PURL": "pkg:golang/github.com/vmihailenco/tagparser/v2@v2.0.0", "UID": "4084a10b585e7ec" }, "Version": "v2.0.0", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/x448/float16@v0.8.4", "Name": "github.com/x448/float16", "Identifier": { "PURL": "pkg:golang/github.com/x448/float16@v0.8.4", "UID": "92e4d1656274958c" }, "Version": "v0.8.4", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/xanzy/ssh-agent@v0.3.3", "Name": "github.com/xanzy/ssh-agent", "Identifier": { "PURL": "pkg:golang/github.com/xanzy/ssh-agent@v0.3.3", "UID": "206689b5d59442fd" }, "Version": "v0.3.3", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/xeipuuv/gojsonpointer@v0.0.0-20190905194746-02993c407bfb", "Name": "github.com/xeipuuv/gojsonpointer", "Identifier": { "PURL": "pkg:golang/github.com/xeipuuv/gojsonpointer@v0.0.0-20190905194746-02993c407bfb", "UID": "9288aec111001403" }, "Version": "v0.0.0-20190905194746-02993c407bfb", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/xeipuuv/gojsonreference@v0.0.0-20180127040603-bd5ef7bd5415", "Name": "github.com/xeipuuv/gojsonreference", "Identifier": { "PURL": "pkg:golang/github.com/xeipuuv/gojsonreference@v0.0.0-20180127040603-bd5ef7bd5415", "UID": "d0b0b1bfb36b2e19" }, "Version": "v0.0.0-20180127040603-bd5ef7bd5415", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/xeipuuv/gojsonschema@v1.2.0", "Name": "github.com/xeipuuv/gojsonschema", "Identifier": { "PURL": "pkg:golang/github.com/xeipuuv/gojsonschema@v1.2.0", "UID": "44d170518914b732" }, "Version": "v1.2.0", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/xi2/xz@v0.0.0-20171230120015-48954b6210f8", "Name": "github.com/xi2/xz", "Identifier": { "PURL": "pkg:golang/github.com/xi2/xz@v0.0.0-20171230120015-48954b6210f8", "UID": "7b7c196f8c1e6fff" }, "Version": "v0.0.0-20171230120015-48954b6210f8", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/xlab/treeprint@v1.2.0", "Name": "github.com/xlab/treeprint", "Identifier": { "PURL": "pkg:golang/github.com/xlab/treeprint@v1.2.0", "UID": "e2a2781874aba2cd" }, "Version": "v1.2.0", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/yashtewari/glob-intersection@v0.2.0", "Name": "github.com/yashtewari/glob-intersection", "Identifier": { "PURL": "pkg:golang/github.com/yashtewari/glob-intersection@v0.2.0", "UID": "c9bac6d9131501d1" }, "Version": "v0.2.0", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/zclconf/go-cty@v1.18.0", "Name": "github.com/zclconf/go-cty", "Identifier": { "PURL": "pkg:golang/github.com/zclconf/go-cty@v1.18.0", "UID": "5b7fa8ee0cadfb74" }, "Version": "v1.18.0", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "github.com/zclconf/go-cty-yaml@v1.2.0", "Name": "github.com/zclconf/go-cty-yaml", "Identifier": { "PURL": "pkg:golang/github.com/zclconf/go-cty-yaml@v1.2.0", "UID": "ad085d1cb6f3825f" }, "Version": "v1.2.0", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "go.etcd.io/bbolt@v1.4.3", "Name": "go.etcd.io/bbolt", "Identifier": { "PURL": "pkg:golang/go.etcd.io/bbolt@v1.4.3", "UID": "ce28fe3e008ea977" }, "Version": "v1.4.3", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "go.opentelemetry.io/auto/sdk@v1.2.1", "Name": "go.opentelemetry.io/auto/sdk", "Identifier": { "PURL": "pkg:golang/go.opentelemetry.io/auto/sdk@v1.2.1", "UID": "d6b64dd7665d89ca" }, "Version": "v1.2.1", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "go.opentelemetry.io/contrib/detectors/gcp@v1.39.0", "Name": "go.opentelemetry.io/contrib/detectors/gcp", "Identifier": { "PURL": "pkg:golang/go.opentelemetry.io/contrib/detectors/gcp@v1.39.0", "UID": "dbc3ac183d924f55" }, "Version": "v1.39.0", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc@v0.63.0", "Name": "go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc", "Identifier": { "PURL": "pkg:golang/go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc@v0.63.0", "UID": "119a3a02abd64f86" }, "Version": "v0.63.0", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp@v0.65.0", "Name": "go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp", "Identifier": { "PURL": "pkg:golang/go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp@v0.65.0", "UID": "cd264fff9e77fe50" }, "Version": "v0.65.0", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "go.opentelemetry.io/otel@v1.43.0", "Name": "go.opentelemetry.io/otel", "Identifier": { "PURL": "pkg:golang/go.opentelemetry.io/otel@v1.43.0", "UID": "5840357d5c7e6a0e" }, "Version": "v1.43.0", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc@v1.40.0", "Name": "go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc", "Identifier": { "PURL": "pkg:golang/go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc@v1.40.0", "UID": "ea147c69c10fd292" }, "Version": "v1.40.0", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "go.opentelemetry.io/otel/exporters/otlp/otlptrace@v1.40.0", "Name": "go.opentelemetry.io/otel/exporters/otlp/otlptrace", "Identifier": { "PURL": "pkg:golang/go.opentelemetry.io/otel/exporters/otlp/otlptrace@v1.40.0", "UID": "1a10031b56e9de01" }, "Version": "v1.40.0", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc@v1.40.0", "Name": "go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc", "Identifier": { "PURL": "pkg:golang/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc@v1.40.0", "UID": "dbc6c48d47458ba1" }, "Version": "v1.40.0", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "go.opentelemetry.io/otel/metric@v1.43.0", "Name": "go.opentelemetry.io/otel/metric", "Identifier": { "PURL": "pkg:golang/go.opentelemetry.io/otel/metric@v1.43.0", "UID": "621ee72e35bf16b4" }, "Version": "v1.43.0", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "go.opentelemetry.io/otel/sdk@v1.43.0", "Name": "go.opentelemetry.io/otel/sdk", "Identifier": { "PURL": "pkg:golang/go.opentelemetry.io/otel/sdk@v1.43.0", "UID": "83e3015693054a4b" }, "Version": "v1.43.0", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "go.opentelemetry.io/otel/sdk/metric@v1.43.0", "Name": "go.opentelemetry.io/otel/sdk/metric", "Identifier": { "PURL": "pkg:golang/go.opentelemetry.io/otel/sdk/metric@v1.43.0", "UID": "420a18a964055ae3" }, "Version": "v1.43.0", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "go.opentelemetry.io/otel/trace@v1.43.0", "Name": "go.opentelemetry.io/otel/trace", "Identifier": { "PURL": "pkg:golang/go.opentelemetry.io/otel/trace@v1.43.0", "UID": "75355cb2493ca108" }, "Version": "v1.43.0", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "go.opentelemetry.io/proto/otlp@v1.9.0", "Name": "go.opentelemetry.io/proto/otlp", "Identifier": { "PURL": "pkg:golang/go.opentelemetry.io/proto/otlp@v1.9.0", "UID": "2aba49ffae12a4c6" }, "Version": "v1.9.0", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "go.uber.org/multierr@v1.11.0", "Name": "go.uber.org/multierr", "Identifier": { "PURL": "pkg:golang/go.uber.org/multierr@v1.11.0", "UID": "8eaf98cbf1107a3a" }, "Version": "v1.11.0", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "go.uber.org/zap@v1.27.1", "Name": "go.uber.org/zap", "Identifier": { "PURL": "pkg:golang/go.uber.org/zap@v1.27.1", "UID": "b214d3640bfaa20f" }, "Version": "v1.27.1", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "go.yaml.in/yaml/v2@v2.4.3", "Name": "go.yaml.in/yaml/v2", "Identifier": { "PURL": "pkg:golang/go.yaml.in/yaml/v2@v2.4.3", "UID": "e79d0af40d5c4ac8" }, "Version": "v2.4.3", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "go.yaml.in/yaml/v3@v3.0.4", "Name": "go.yaml.in/yaml/v3", "Identifier": { "PURL": "pkg:golang/go.yaml.in/yaml/v3@v3.0.4", "UID": "92c2e4faa7706d93" }, "Version": "v3.0.4", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "go.yaml.in/yaml/v4@v4.0.0-rc.3", "Name": "go.yaml.in/yaml/v4", "Identifier": { "PURL": "pkg:golang/go.yaml.in/yaml/v4@v4.0.0-rc.3", "UID": "f64e5ca26f59181b" }, "Version": "v4.0.0-rc.3", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "golang.org/x/crypto@v0.50.0", "Name": "golang.org/x/crypto", "Identifier": { "PURL": "pkg:golang/golang.org/x/crypto@v0.50.0", "UID": "86b9f77577ddb8d2" }, "Version": "v0.50.0", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "golang.org/x/exp@v0.0.0-20251023183803-a4bb9ffd2546", "Name": "golang.org/x/exp", "Identifier": { "PURL": "pkg:golang/golang.org/x/exp@v0.0.0-20251023183803-a4bb9ffd2546", "UID": "e672dbdb4c81c90" }, "Version": "v0.0.0-20251023183803-a4bb9ffd2546", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "golang.org/x/mod@v0.34.0", "Name": "golang.org/x/mod", "Identifier": { "PURL": "pkg:golang/golang.org/x/mod@v0.34.0", "UID": "f7b41f716f7b0fe4" }, "Version": "v0.34.0", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "golang.org/x/net@v0.53.0", "Name": "golang.org/x/net", "Identifier": { "PURL": "pkg:golang/golang.org/x/net@v0.53.0", "UID": "a5e3f765714179cd" }, "Version": "v0.53.0", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "golang.org/x/oauth2@v0.36.0", "Name": "golang.org/x/oauth2", "Identifier": { "PURL": "pkg:golang/golang.org/x/oauth2@v0.36.0", "UID": "d129272d4fc9917e" }, "Version": "v0.36.0", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "golang.org/x/sync@v0.20.0", "Name": "golang.org/x/sync", "Identifier": { "PURL": "pkg:golang/golang.org/x/sync@v0.20.0", "UID": "1ebf53664e9778b2" }, "Version": "v0.20.0", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "golang.org/x/sys@v0.43.0", "Name": "golang.org/x/sys", "Identifier": { "PURL": "pkg:golang/golang.org/x/sys@v0.43.0", "UID": "5bfd09e654941e78" }, "Version": "v0.43.0", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "golang.org/x/term@v0.42.0", "Name": "golang.org/x/term", "Identifier": { "PURL": "pkg:golang/golang.org/x/term@v0.42.0", "UID": "6689b29d8b98d344" }, "Version": "v0.42.0", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "golang.org/x/text@v0.36.0", "Name": "golang.org/x/text", "Identifier": { "PURL": "pkg:golang/golang.org/x/text@v0.36.0", "UID": "bef56439b881a874" }, "Version": "v0.36.0", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "golang.org/x/time@v0.15.0", "Name": "golang.org/x/time", "Identifier": { "PURL": "pkg:golang/golang.org/x/time@v0.15.0", "UID": "edfc8c1e95c89dfd" }, "Version": "v0.15.0", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "golang.org/x/xerrors@v0.0.0-20240903120638-7835f813f4da", "Name": "golang.org/x/xerrors", "Identifier": { "PURL": "pkg:golang/golang.org/x/xerrors@v0.0.0-20240903120638-7835f813f4da", "UID": "4139b93d2beead57" }, "Version": "v0.0.0-20240903120638-7835f813f4da", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "google.golang.org/api@v0.272.0", "Name": "google.golang.org/api", "Identifier": { "PURL": "pkg:golang/google.golang.org/api@v0.272.0", "UID": "df88e5c29e892c05" }, "Version": "v0.272.0", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "google.golang.org/genproto@v0.0.0-20260316180232-0b37fe3546d5", "Name": "google.golang.org/genproto", "Identifier": { "PURL": "pkg:golang/google.golang.org/genproto@v0.0.0-20260316180232-0b37fe3546d5", "UID": "fa1ed387c196a4b4" }, "Version": "v0.0.0-20260316180232-0b37fe3546d5", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "google.golang.org/genproto/googleapis/api@v0.0.0-20260316180232-0b37fe3546d5", "Name": "google.golang.org/genproto/googleapis/api", "Identifier": { "PURL": "pkg:golang/google.golang.org/genproto/googleapis/api@v0.0.0-20260316180232-0b37fe3546d5", "UID": "2a6945d432f07fcf" }, "Version": "v0.0.0-20260316180232-0b37fe3546d5", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "google.golang.org/genproto/googleapis/rpc@v0.0.0-20260316180232-0b37fe3546d5", "Name": "google.golang.org/genproto/googleapis/rpc", "Identifier": { "PURL": "pkg:golang/google.golang.org/genproto/googleapis/rpc@v0.0.0-20260316180232-0b37fe3546d5", "UID": "29befa9e37336165" }, "Version": "v0.0.0-20260316180232-0b37fe3546d5", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "google.golang.org/grpc@v1.79.3", "Name": "google.golang.org/grpc", "Identifier": { "PURL": "pkg:golang/google.golang.org/grpc@v1.79.3", "UID": "3220fe69c7d38e52" }, "Version": "v1.79.3", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "google.golang.org/protobuf@v1.36.11", "Name": "google.golang.org/protobuf", "Identifier": { "PURL": "pkg:golang/google.golang.org/protobuf@v1.36.11", "UID": "144bffa6b3faea2e" }, "Version": "v1.36.11", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "gopkg.in/evanphx/json-patch.v4@v4.13.0", "Name": "gopkg.in/evanphx/json-patch.v4", "Identifier": { "PURL": "pkg:golang/gopkg.in/evanphx/json-patch.v4@v4.13.0", "UID": "1120979d6aee3bbd" }, "Version": "v4.13.0", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "gopkg.in/inf.v0@v0.9.1", "Name": "gopkg.in/inf.v0", "Identifier": { "PURL": "pkg:golang/gopkg.in/inf.v0@v0.9.1", "UID": "c9e4c68e9826a838" }, "Version": "v0.9.1", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "gopkg.in/warnings.v0@v0.1.2", "Name": "gopkg.in/warnings.v0", "Identifier": { "PURL": "pkg:golang/gopkg.in/warnings.v0@v0.1.2", "UID": "486bb224ab4934ad" }, "Version": "v0.1.2", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "gopkg.in/yaml.v3@v3.0.1", "Name": "gopkg.in/yaml.v3", "Identifier": { "PURL": "pkg:golang/gopkg.in/yaml.v3@v3.0.1", "UID": "176d36fc44a1e402" }, "Version": "v3.0.1", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "helm.sh/helm/v3@v3.20.2", "Name": "helm.sh/helm/v3", "Identifier": { "PURL": "pkg:golang/helm.sh/helm/v3@v3.20.2", "UID": "76d80ac4706fda3a" }, "Version": "v3.20.2", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "k8s.io/api@v0.35.3", "Name": "k8s.io/api", "Identifier": { "PURL": "pkg:golang/k8s.io/api@v0.35.3", "UID": "d8ad17bda34daba8" }, "Version": "v0.35.3", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "k8s.io/apiextensions-apiserver@v0.35.1", "Name": "k8s.io/apiextensions-apiserver", "Identifier": { "PURL": "pkg:golang/k8s.io/apiextensions-apiserver@v0.35.1", "UID": "2d39273b1635eee4" }, "Version": "v0.35.1", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "k8s.io/apimachinery@v0.35.3", "Name": "k8s.io/apimachinery", "Identifier": { "PURL": "pkg:golang/k8s.io/apimachinery@v0.35.3", "UID": "e4888e0d00944efa" }, "Version": "v0.35.3", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "k8s.io/apiserver@v0.35.1", "Name": "k8s.io/apiserver", "Identifier": { "PURL": "pkg:golang/k8s.io/apiserver@v0.35.1", "UID": "9d1d8296131305eb" }, "Version": "v0.35.1", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "k8s.io/cli-runtime@v0.35.1", "Name": "k8s.io/cli-runtime", "Identifier": { "PURL": "pkg:golang/k8s.io/cli-runtime@v0.35.1", "UID": "6650816b26cb93a2" }, "Version": "v0.35.1", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "k8s.io/client-go@v0.35.1", "Name": "k8s.io/client-go", "Identifier": { "PURL": "pkg:golang/k8s.io/client-go@v0.35.1", "UID": "7924b0ead58c24a3" }, "Version": "v0.35.1", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "k8s.io/component-base@v0.35.1", "Name": "k8s.io/component-base", "Identifier": { "PURL": "pkg:golang/k8s.io/component-base@v0.35.1", "UID": "79d051d2fea4bea0" }, "Version": "v0.35.1", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "k8s.io/klog/v2@v2.130.1", "Name": "k8s.io/klog/v2", "Identifier": { "PURL": "pkg:golang/k8s.io/klog/v2@v2.130.1", "UID": "7c2d5dab024da7b6" }, "Version": "v2.130.1", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "k8s.io/kube-openapi@v0.0.0-20250910181357-589584f1c912", "Name": "k8s.io/kube-openapi", "Identifier": { "PURL": "pkg:golang/k8s.io/kube-openapi@v0.0.0-20250910181357-589584f1c912", "UID": "5f691970e5bc8bd2" }, "Version": "v0.0.0-20250910181357-589584f1c912", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "k8s.io/kubectl@v0.35.1", "Name": "k8s.io/kubectl", "Identifier": { "PURL": "pkg:golang/k8s.io/kubectl@v0.35.1", "UID": "d606c5afd5d2e829" }, "Version": "v0.35.1", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "k8s.io/utils@v0.0.0-20251002143259-bc988d571ff4", "Name": "k8s.io/utils", "Identifier": { "PURL": "pkg:golang/k8s.io/utils@v0.0.0-20251002143259-bc988d571ff4", "UID": "407f39c02212e306" }, "Version": "v0.0.0-20251002143259-bc988d571ff4", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "modernc.org/libc@v1.70.0", "Name": "modernc.org/libc", "Identifier": { "PURL": "pkg:golang/modernc.org/libc@v1.70.0", "UID": "2a9c262bfe453b23" }, "Version": "v1.70.0", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "modernc.org/mathutil@v1.7.1", "Name": "modernc.org/mathutil", "Identifier": { "PURL": "pkg:golang/modernc.org/mathutil@v1.7.1", "UID": "119a717fa5a87496" }, "Version": "v1.7.1", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "modernc.org/memory@v1.11.0", "Name": "modernc.org/memory", "Identifier": { "PURL": "pkg:golang/modernc.org/memory@v1.11.0", "UID": "a55e6c1ef6a462e" }, "Version": "v1.11.0", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "modernc.org/sqlite@v1.48.2", "Name": "modernc.org/sqlite", "Identifier": { "PURL": "pkg:golang/modernc.org/sqlite@v1.48.2", "UID": "a990af1daedfce00" }, "Version": "v1.48.2", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "mvdan.cc/sh/v3@v3.12.0", "Name": "mvdan.cc/sh/v3", "Identifier": { "PURL": "pkg:golang/mvdan.cc/sh/v3@v3.12.0", "UID": "d108624b106a9349" }, "Version": "v3.12.0", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "oras.land/oras-go/v2@v2.6.0", "Name": "oras.land/oras-go/v2", "Identifier": { "PURL": "pkg:golang/oras.land/oras-go/v2@v2.6.0", "UID": "7e5aa3baf9c41f95" }, "Version": "v2.6.0", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "sigs.k8s.io/json@v0.0.0-20250730193827-2d320260d730", "Name": "sigs.k8s.io/json", "Identifier": { "PURL": "pkg:golang/sigs.k8s.io/json@v0.0.0-20250730193827-2d320260d730", "UID": "2f32cc9fa9f2d728" }, "Version": "v0.0.0-20250730193827-2d320260d730", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "sigs.k8s.io/kustomize/api@v0.20.1", "Name": "sigs.k8s.io/kustomize/api", "Identifier": { "PURL": "pkg:golang/sigs.k8s.io/kustomize/api@v0.20.1", "UID": "7460457c9d4cf9d8" }, "Version": "v0.20.1", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "sigs.k8s.io/kustomize/kyaml@v0.20.1", "Name": "sigs.k8s.io/kustomize/kyaml", "Identifier": { "PURL": "pkg:golang/sigs.k8s.io/kustomize/kyaml@v0.20.1", "UID": "7815e09b4bda8a59" }, "Version": "v0.20.1", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "sigs.k8s.io/randfill@v1.0.0", "Name": "sigs.k8s.io/randfill", "Identifier": { "PURL": "pkg:golang/sigs.k8s.io/randfill@v1.0.0", "UID": "9fae49ed5b8729bf" }, "Version": "v1.0.0", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "sigs.k8s.io/structured-merge-diff/v6@v6.3.0", "Name": "sigs.k8s.io/structured-merge-diff/v6", "Identifier": { "PURL": "pkg:golang/sigs.k8s.io/structured-merge-diff/v6@v6.3.0", "UID": "73f8b875003da698" }, "Version": "v6.3.0", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" }, { "ID": "sigs.k8s.io/yaml@v1.6.0", "Name": "sigs.k8s.io/yaml", "Identifier": { "PURL": "pkg:golang/sigs.k8s.io/yaml@v1.6.0", "UID": "96380c28bea11814" }, "Version": "v1.6.0", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "AnalyzedBy": "gobinary" } ], "Vulnerabilities": [ { "VulnerabilityID": "CVE-2026-54448", "VendorIDs": [ "GHSA-q3fv-x8vg-qqm4" ], "PkgID": "github.com/aquasecurity/trivy@v0.70.0", "PkgName": "github.com/aquasecurity/trivy", "PkgIdentifier": { "PURL": "pkg:golang/github.com/aquasecurity/trivy@v0.70.0", "UID": "3b38ce3f34d371cf" }, "InstalledVersion": "v0.70.0", "FixedVersion": "0.71.0", "Status": "fixed", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-54448", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory Go", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Ago" }, "Fingerprint": "sha256:1ab46ef7c5fdd48ec18f779dfe5b55185b249d281a19c16f08aef58fd5c678c8", "Title": "Trivy: Helm chart tar bomb causes OOM via unbounded io.ReadAll in parser", "Description": "Trivy is a security scanner. Prior to 0.71.0, when Trivy scans a Helm chart archive (.tgz), its custom tar unpacker reads each entry with io.ReadAll(tr) and no size limit. An attacker who can place a malicious .tgz file in the scanned path can craft a small compressed archive that decompresses to gigabytes, causing the Trivy process to be killed by the OS OOM killer. This vulnerability is fixed in 0.71.0.", "Severity": "HIGH", "CweIDs": [ "CWE-770", "CWE-789" ], "VendorSeverity": { "ghsa": 3, "nvd": 2 }, "CVSS": { "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 8.7 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "V3Score": 6.5 } }, "References": [ "https://github.com/aquasecurity/trivy", "https://github.com/aquasecurity/trivy/commit/441251e51ae46cbcf7f436547e0a5766b25328b4", "https://github.com/aquasecurity/trivy/pull/10718", "https://github.com/aquasecurity/trivy/releases/tag/v0.71.0", "https://github.com/aquasecurity/trivy/security/advisories/GHSA-q3fv-x8vg-qqm4", "https://nvd.nist.gov/vuln/detail/CVE-2026-54448" ], "PublishedDate": "2026-06-25T17:16:41.257Z", "LastModifiedDate": "2026-10-25T22:10:00.15Z" }, { "VulnerabilityID": "CVE-2026-55092", "VendorIDs": [ "GHSA-mcj4-mphf-j9ff" ], "PkgID": "github.com/aquasecurity/trivy@v0.70.0", "PkgName": "github.com/aquasecurity/trivy", "PkgIdentifier": { "PURL": "pkg:golang/github.com/aquasecurity/trivy@v0.70.0", "UID": "3b38ce3f34d371cf" }, "InstalledVersion": "v0.70.0", "FixedVersion": "0.71.1", "Status": "fixed", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-55092", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory Go", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Ago" }, "Fingerprint": "sha256:b3459f2d5a8e6e070de8d525e55779b54a478e635ed9f4b890b9b502ba4d2072", "Title": "Trivy has a path traversal via a crafted vulnerability database or other downloaded artifacts", "Description": "Trivy is a security scanner. Prior to 0.71.1, when Trivy downloads an OCI artifact, it uses the org.opencontainers.image.title annotation from the artifact manifest as the destination filename without validation. An attacker who can make Trivy fetch an attacker-controlled artifact can supply a crafted annotation that resolves to a path outside the intended destination, causing Trivy to write the layer content to an arbitrary location on the host filesystem. This vulnerability is fixed in 0.71.1.", "Severity": "HIGH", "CweIDs": [ "CWE-22" ], "VendorSeverity": { "ghsa": 3, "nvd": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N", "V3Score": 7.5, "V40Score": 7 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "V3Score": 7.5 } }, "References": [ "https://github.com/aquasecurity/trivy", "https://github.com/aquasecurity/trivy/commit/39e0b132260c60d59fa746c3f6dd10374b0ff6e4", "https://github.com/aquasecurity/trivy/commit/a72d9a4d997c25fbb6534e231b4e206c9b202b31", "https://github.com/aquasecurity/trivy/releases/tag/v0.71.1", "https://github.com/aquasecurity/trivy/security/advisories/GHSA-mcj4-mphf-j9ff", "https://nvd.nist.gov/vuln/detail/CVE-2026-55092" ], "PublishedDate": "2026-06-25T17:16:41.647Z", "LastModifiedDate": "2026-10-25T22:10:00.15Z" }, { "VulnerabilityID": "CVE-2026-46680", "VendorIDs": [ "GHSA-fqw6-gf59-qr4w" ], "PkgID": "github.com/containerd/containerd@v1.7.30", "PkgName": "github.com/containerd/containerd", "PkgIdentifier": { "PURL": "pkg:golang/github.com/containerd/containerd@v1.7.30", "UID": "8a3aa4155939eb09" }, "InstalledVersion": "v1.7.30", "FixedVersion": "1.7.32", "Status": "fixed", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-46680", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory Go", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Ago" }, "Fingerprint": "sha256:72383354b3283d032a70475c2dde3da6f0ac7d450ef2135a326b59dbf2047374", "Title": "github.com/containerd/containerd: containerd: Privilege escalation via incorrect user ID handling", "Description": "containerd is an open-source container runtime. In versions prior to 1.7.32, 2.0.9, 2.2.4 and 2.3.1, containers launched with a numeric User directive that cannot be parsed as a 32-bit integer are incorrectly treated as a username, leading to runAsNonRoot evasion. If a crafted image provides an /etc/passwd file mapping this large numeric string to root, the container ultimately runs as root (UID 0). This allows the Kubernetes runAsNonRoot restriction to be bypassed, causing unexpected behavior for environments that require containers to run as a non-root user. This issue has been fixed in versions 1.7.32, 2.0.9, 2.2.4 and 2.3.1.", "Severity": "HIGH", "CweIDs": [ "CWE-269" ], "VendorSeverity": { "amazon": 3, "azure": 3, "ghsa": 3, "nvd": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V40Vector": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V3Score": 7.8, "V40Score": 7.3 }, "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-46680", "https://github.com/containerd/containerd", "https://github.com/containerd/containerd/security/advisories/GHSA-fqw6-gf59-qr4w", "https://nvd.nist.gov/vuln/detail/CVE-2026-46680", "https://www.cve.org/CVERecord?id=CVE-2026-46680" ], "PublishedDate": "2026-07-01T18:16:32.853Z", "LastModifiedDate": "2026-07-03T04:17:53.813Z" }, { "VulnerabilityID": "CVE-2026-53488", "VendorIDs": [ "GHSA-xhf5-7wjv-pqxp" ], "PkgID": "github.com/containerd/containerd@v1.7.30", "PkgName": "github.com/containerd/containerd", "PkgIdentifier": { "PURL": "pkg:golang/github.com/containerd/containerd@v1.7.30", "UID": "8a3aa4155939eb09" }, "InstalledVersion": "v1.7.30", "FixedVersion": "1.7.33", "Status": "fixed", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53488", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory Go", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Ago" }, "Fingerprint": "sha256:85b871126e26ed6d858f96ef6e9eeacf9c8d19ba98006f8b46089d5b8704fe8d", "Title": "github.com/containerd/containerd: containerd: Host-root command execution via unvalidated image config labels in CRI plugin", "Description": "containerd is an open-source container runtime. In versions prior to 1.7.33, 2.3.2, 2.2.5, 2.1.9, and 2.0.10 the CRI plugin propagates labels from an image config (LABEL instruction in Dockerfile) to a container without validation. This may result in executing an arbitrary command on the host, via a plugin that consumes container labels for some operations. This issue has been fixed in versions 1.7.33, 2.3.2, 2.2.5, 2.1.9, and 2.0.10.", "Severity": "HIGH", "CweIDs": [ "CWE-20" ], "VendorSeverity": { "amazon": 3, "azure": 3, "bottlerocket": 3, "ghsa": 3, "nvd": 3, "redhat": 3, "ubuntu": 3 }, "CVSS": { "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V40Score": 8.7 }, "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "V3Score": 8.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53488", "https://access.redhat.com/security/cve/CVE-2026-53488", "https://github.com/bottlerocket-os/bottlerocket-core-kit/blob/develop/advisories/14.5.1/BRSA-rrw1j1iyz4iz.toml", "https://github.com/containerd/containerd", "https://github.com/containerd/containerd/security/advisories/GHSA-xhf5-7wjv-pqxp", "https://nvd.nist.gov/vuln/detail/CVE-2026-53488", "https://ubuntu.com/security/notices/USN-8471-1", "https://ubuntu.com/security/notices/USN-8472-1", "https://ubuntu.com/security/notices/USN-8473-1", "https://www.cve.org/CVERecord?id=CVE-2026-53488" ], "PublishedDate": "2026-07-01T02:17:00.467Z", "LastModifiedDate": "2026-07-03T04:17:55.77Z" }, { "VulnerabilityID": "CVE-2026-46680", "VendorIDs": [ "GHSA-fqw6-gf59-qr4w" ], "PkgID": "github.com/containerd/containerd/v2@v2.2.2", "PkgName": "github.com/containerd/containerd/v2", "PkgIdentifier": { "PURL": "pkg:golang/github.com/containerd/containerd/v2@v2.2.2", "UID": "e463cbb6b7f5a5c1" }, "InstalledVersion": "v2.2.2", "FixedVersion": "2.0.9, 2.2.4, 2.3.1", "Status": "fixed", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-46680", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory Go", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Ago" }, "Fingerprint": "sha256:c6bf20c89b818fa04ab4a43673bbf2def9eee85e635f61b7577bc6324db4e219", "Title": "github.com/containerd/containerd: containerd: Privilege escalation via incorrect user ID handling", "Description": "containerd is an open-source container runtime. In versions prior to 1.7.32, 2.0.9, 2.2.4 and 2.3.1, containers launched with a numeric User directive that cannot be parsed as a 32-bit integer are incorrectly treated as a username, leading to runAsNonRoot evasion. If a crafted image provides an /etc/passwd file mapping this large numeric string to root, the container ultimately runs as root (UID 0). This allows the Kubernetes runAsNonRoot restriction to be bypassed, causing unexpected behavior for environments that require containers to run as a non-root user. This issue has been fixed in versions 1.7.32, 2.0.9, 2.2.4 and 2.3.1.", "Severity": "HIGH", "CweIDs": [ "CWE-269" ], "VendorSeverity": { "amazon": 3, "azure": 3, "ghsa": 3, "nvd": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V40Vector": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V3Score": 7.8, "V40Score": 7.3 }, "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-46680", "https://github.com/containerd/containerd", "https://github.com/containerd/containerd/security/advisories/GHSA-fqw6-gf59-qr4w", "https://nvd.nist.gov/vuln/detail/CVE-2026-46680", "https://www.cve.org/CVERecord?id=CVE-2026-46680" ], "PublishedDate": "2026-07-01T18:16:32.853Z", "LastModifiedDate": "2026-07-03T04:17:53.813Z" }, { "VulnerabilityID": "CVE-2026-53488", "VendorIDs": [ "GHSA-xhf5-7wjv-pqxp" ], "PkgID": "github.com/containerd/containerd/v2@v2.2.2", "PkgName": "github.com/containerd/containerd/v2", "PkgIdentifier": { "PURL": "pkg:golang/github.com/containerd/containerd/v2@v2.2.2", "UID": "e463cbb6b7f5a5c1" }, "InstalledVersion": "v2.2.2", "FixedVersion": "2.0.10, 2.1.9, 2.2.5, 2.3.2", "Status": "fixed", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53488", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory Go", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Ago" }, "Fingerprint": "sha256:94b644d5839a33f5e887f694d1001b70291bf25f976be4865c92d11b9a2a1d94", "Title": "github.com/containerd/containerd: containerd: Host-root command execution via unvalidated image config labels in CRI plugin", "Description": "containerd is an open-source container runtime. In versions prior to 1.7.33, 2.3.2, 2.2.5, 2.1.9, and 2.0.10 the CRI plugin propagates labels from an image config (LABEL instruction in Dockerfile) to a container without validation. This may result in executing an arbitrary command on the host, via a plugin that consumes container labels for some operations. This issue has been fixed in versions 1.7.33, 2.3.2, 2.2.5, 2.1.9, and 2.0.10.", "Severity": "HIGH", "CweIDs": [ "CWE-20" ], "VendorSeverity": { "amazon": 3, "azure": 3, "bottlerocket": 3, "ghsa": 3, "nvd": 3, "redhat": 3, "ubuntu": 3 }, "CVSS": { "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "V40Score": 8.7 }, "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "V3Score": 8.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53488", "https://access.redhat.com/security/cve/CVE-2026-53488", "https://github.com/bottlerocket-os/bottlerocket-core-kit/blob/develop/advisories/14.5.1/BRSA-rrw1j1iyz4iz.toml", "https://github.com/containerd/containerd", "https://github.com/containerd/containerd/security/advisories/GHSA-xhf5-7wjv-pqxp", "https://nvd.nist.gov/vuln/detail/CVE-2026-53488", "https://ubuntu.com/security/notices/USN-8471-1", "https://ubuntu.com/security/notices/USN-8472-1", "https://ubuntu.com/security/notices/USN-8473-1", "https://www.cve.org/CVERecord?id=CVE-2026-53488" ], "PublishedDate": "2026-07-01T02:17:00.467Z", "LastModifiedDate": "2026-07-03T04:17:55.77Z" }, { "VulnerabilityID": "CVE-2026-53489", "VendorIDs": [ "GHSA-rgh6-rfwx-v388" ], "PkgID": "github.com/containerd/containerd/v2@v2.2.2", "PkgName": "github.com/containerd/containerd/v2", "PkgIdentifier": { "PURL": "pkg:golang/github.com/containerd/containerd/v2@v2.2.2", "UID": "e463cbb6b7f5a5c1" }, "InstalledVersion": "v2.2.2", "FixedVersion": "2.1.9, 2.2.5, 2.3.2", "Status": "fixed", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53489", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory Go", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Ago" }, "Fingerprint": "sha256:882b686a61ece6045fe25131b3ef175c036aa0191fb42576fa75e1c98e8b8a65", "Title": "github.com/containerd/containerd: containerd: Arbitrary host file read via symlink following in CRI checkpoint restore", "Description": "containerd is an open-source container runtime. Versions prior to 2.3.2, 2.2.5 and 2.1.9 contain a bug where the CRI plugin restores container.log from a checkpoint image without validating a symlinked path. This could result in reading an arbitrary file on the host via kubectl logs. This issue has been fixed in versions 2.3.2, 2.2.5 and 2.1.9.", "Severity": "HIGH", "CweIDs": [ "CWE-61" ], "VendorSeverity": { "amazon": 3, "azure": 2, "bottlerocket": 2, "ghsa": 3, "nvd": 2, "redhat": 3, "ubuntu": 3 }, "CVSS": { "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "V40Score": 7.1 }, "nvd": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "V3Score": 6.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "V3Score": 6.5 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53489", "https://access.redhat.com/security/cve/CVE-2026-53489", "https://github.com/bottlerocket-os/bottlerocket-core-kit/blob/develop/advisories/14.5.1/BRSA-hg86gkmhd6vu.toml", "https://github.com/containerd/containerd", "https://github.com/containerd/containerd/security/advisories/GHSA-rgh6-rfwx-v388", "https://nvd.nist.gov/vuln/detail/CVE-2026-53489", "https://ubuntu.com/security/notices/USN-8472-1", "https://ubuntu.com/security/notices/USN-8473-1", "https://www.cve.org/CVERecord?id=CVE-2026-53489" ], "PublishedDate": "2026-07-01T19:16:54.383Z", "LastModifiedDate": "2026-07-02T19:33:12.85Z" }, { "VulnerabilityID": "CVE-2026-53492", "VendorIDs": [ "GHSA-33vj-92qq-66hc" ], "PkgID": "github.com/containerd/containerd/v2@v2.2.2", "PkgName": "github.com/containerd/containerd/v2", "PkgIdentifier": { "PURL": "pkg:golang/github.com/containerd/containerd/v2@v2.2.2", "UID": "e463cbb6b7f5a5c1" }, "InstalledVersion": "v2.2.2", "FixedVersion": "2.1.9, 2.2.5, 2.3.2", "Status": "fixed", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-53492", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory Go", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Ago" }, "Fingerprint": "sha256:8790bb0e7617f2a0d6419232e7750e616ecdb5ba4c7be99a36e116127d1dd1c0", "Title": "github.com/containerd/containerd: containerd: Security bypass via Container Device Interface (CDI) annotation smuggling during checkpoint restoration.", "Description": "containerd is an open-source container runtime. In Versions prior to 2.3.2, 2.2.5 and 2.1.9, the CRI implementation improperly trusts Container Device Interface (CDI) annotations found within untrusted checkpoint image metadata during container restoration. When restoring a container from a checkpoint, containerd preserves CDI-related annotations from the checkpoint archive rather than relying solely on the pod's create-time specification. This allows a user with pod creation permissions to bypass standard Kubernetes resource allocation and device plugin enforcement, injecting arbitrary CDI edits (such as device nodes and host mounts) into the restored container. Successful exploitation requires that the node has CDI enabled and contains a matching host CDI specification for the requested device; environments where CDI is disabled or lacking sensitive device specifications are not affected. This issue has been fixed in versions 2.3.2, 2.2.5 and 2.1.9.", "Severity": "HIGH", "CweIDs": [ "CWE-20", "CWE-863" ], "VendorSeverity": { "amazon": 3, "azure": 2, "bottlerocket": 2, "ghsa": 3, "nvd": 4, "redhat": 3, "ubuntu": 3 }, "CVSS": { "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:N", "V40Score": 8.4 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N", "V3Score": 9.6 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N", "V3Score": 8.2 } }, "References": [ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53492", "https://access.redhat.com/security/cve/CVE-2026-53492", "https://github.com/bottlerocket-os/bottlerocket-core-kit/blob/develop/advisories/14.5.1/BRSA-rsj9m8ifmjes.toml", "https://github.com/containerd/containerd", "https://github.com/containerd/containerd/security/advisories/GHSA-33vj-92qq-66hc", "https://nvd.nist.gov/vuln/detail/CVE-2026-53492", "https://ubuntu.com/security/notices/USN-8472-1", "https://ubuntu.com/security/notices/USN-8473-1", "https://www.cve.org/CVERecord?id=CVE-2026-53492" ], "PublishedDate": "2026-07-01T19:16:54.51Z", "LastModifiedDate": "2026-07-02T19:33:00.93Z" }, { "VulnerabilityID": "CVE-2026-95837", "VendorIDs": [ "GHSA-p7v4-vr35-mj6f" ], "PkgID": "github.com/containerd/containerd/v2@v2.2.2", "PkgName": "github.com/containerd/containerd/v2", "PkgIdentifier": { "PURL": "pkg:golang/github.com/containerd/containerd/v2@v2.2.2", "UID": "e463cbb6b7f5a5c1" }, "InstalledVersion": "v2.2.2", "FixedVersion": "2.2.7, 2.3.4", "Status": "fixed", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-95837", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory Go", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Ago" }, "Fingerprint": "sha256:f15fe0f198c5d30451948f229440c1e69cc1883c966016c99d515caba12aeea6", "Title": "github.com/containerd/containerd: containerd: Privilege escalation via crafted container checkpoint restore", "Description": "containerd is an open-source container runtime. From 2.1.0 until 2.2.7 and 2.3.4, containerd's CRI CreateContainer checkpoint restore is vulnerable because CRIU restores process security state from checkpoint data instead of enforcing the destination ContainerConfig. An attacker who can create a container from a crafted checkpoint can supply restored credentials, capabilities, no_new_privs, and seccomp state. The restored process can run as root with full capabilities and no enforced seccomp filters while CRI status reports the requested configuration. Systems that do not use CRI checkpoint restore are not affected. This issue is fixed in versions 2.2.7 and 2.3.4.", "Severity": "HIGH", "CweIDs": [ "CWE-269" ], "VendorSeverity": { "amazon": 3, "ghsa": 3, "redhat": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-95837", "https://github.com/containerd/containerd", "https://github.com/containerd/containerd/commit/928c03c6898cad95f795300281fdff0dbc55a32f", "https://github.com/containerd/containerd/pull/13913", "https://github.com/containerd/containerd/security/advisories/GHSA-p7v4-vr35-mj6f", "https://nvd.nist.gov/vuln/detail/CVE-2026-95837", "https://www.cve.org/CVERecord?id=CVE-2026-95837" ], "PublishedDate": "2026-10-12T20:17:10.42Z", "LastModifiedDate": "2026-10-16T16:00:33.533Z" }, { "VulnerabilityID": "CVE-2026-44973", "VendorIDs": [ "GHSA-qw64-3x98-g7q2" ], "PkgID": "github.com/go-git/go-billy/v5@v5.8.0", "PkgName": "github.com/go-git/go-billy/v5", "PkgIdentifier": { "PURL": "pkg:golang/github.com/go-git/go-billy/v5@v5.8.0", "UID": "a9d04c20d96dbd1f" }, "InstalledVersion": "v5.8.0", "FixedVersion": "5.9.0", "Status": "fixed", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-44973", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory Go", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Ago" }, "Fingerprint": "sha256:3cec27c4b1f9bb05dae410dd42a176bf32ca3df4663877e162598bd7b096be26", "Title": "github.com/go-git/go-billy: Go-billy: Arbitrary file access due to path traversal vulnerability", "Description": "Billy is an interface filesystem abstraction for Go. Prior to 5.9.0, multiple path traversal issues exist across different components of go-billy. Insufficient path sanitization and boundary enforcement may allow crafted paths (e.g., using ..) to escape intended base directories. While go-billy was not originally designed to provide a strong security boundary, some of these issues were inconsistent across some of the built-in implementations. This results in scenarios where applications relying on go-billy for some level of isolation may inadvertently expose access to unintended filesystem locations. This vulnerability is fixed in 5.9.0.", "Severity": "HIGH", "CweIDs": [ "CWE-22" ], "VendorSeverity": { "ghsa": 3, "redhat": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "V3Score": 8.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-44973", "https://github.com/go-git/go-billy", "https://github.com/go-git/go-billy/releases/tag/v5.9.0", "https://github.com/go-git/go-billy/releases/tag/v6.0.0-alpha.1", "https://github.com/go-git/go-billy/security/advisories/GHSA-qw64-3x98-g7q2", "https://nvd.nist.gov/vuln/detail/CVE-2026-44973", "https://www.cve.org/CVERecord?id=CVE-2026-44973" ], "PublishedDate": "2026-05-28T22:16:59.937Z", "LastModifiedDate": "2026-07-21T10:10:00.103Z" }, { "VulnerabilityID": "CVE-2026-45022", "VendorIDs": [ "GHSA-389r-gv7p-r3rp" ], "PkgID": "github.com/go-git/go-git/v5@v5.17.2", "PkgName": "github.com/go-git/go-git/v5", "PkgIdentifier": { "PURL": "pkg:golang/github.com/go-git/go-git/v5@v5.17.2", "UID": "d4aabe835d9af77e" }, "InstalledVersion": "v5.17.2", "FixedVersion": "5.19.0", "Status": "fixed", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-45022", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory Go", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Ago" }, "Fingerprint": "sha256:57c11a562bbed4eb6a53bbdc41c6c825ac72abd98101e56a6ee59fa92e320286", "Title": "go-git is an extensible git implementation library written in pure Go. ...", "Description": "go-git is an extensible git implementation library written in pure Go. Prior to 5.19.0 and 6.0.0-alpha.3, go-git may parse malformed Git objects in a way that differs from upstream Git. When commit or tag objects contain ambiguous or malformed headers, go-git’s decoded representation may expose values differently from how Git itself would interpret or reject the same object. Additionally, go-git’s commit signing and verification logic operates over commit data reconstructed from go-git’s parsed representation rather than the original raw object bytes. As a result, go-git may sign or verify a commit payload that is not byte-for-byte equivalent to the object stored in the repository. This can cause a signature to appear valid for a commit whose displayed or effective metadata differs from the object that was intended to be signed. This vulnerability is fixed in 5.19.0 and 6.0.0-alpha.3.", "Severity": "HIGH", "CweIDs": [ "CWE-180", "CWE-345" ], "VendorSeverity": { "ghsa": 3, "nvd": 3 }, "CVSS": { "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N", "V40Score": 7 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "V3Score": 7.5 } }, "References": [ "https://github.com/go-git/go-git", "https://github.com/go-git/go-git/security/advisories/GHSA-389r-gv7p-r3rp", "https://nvd.nist.gov/vuln/detail/CVE-2026-45022" ], "PublishedDate": "2026-05-27T15:16:29.98Z", "LastModifiedDate": "2026-06-17T10:51:36.953Z" }, { "VulnerabilityID": "CVE-2026-71556", "VendorIDs": [ "GHSA-hc8v-wwc9-vgxm" ], "PkgID": "github.com/go-git/go-git/v5@v5.17.2", "PkgName": "github.com/go-git/go-git/v5", "PkgIdentifier": { "PURL": "pkg:golang/github.com/go-git/go-git/v5@v5.17.2", "UID": "d4aabe835d9af77e" }, "InstalledVersion": "v5.17.2", "FixedVersion": "5.19.2", "Status": "fixed", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-71556", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory Go", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Ago" }, "Fingerprint": "sha256:6b57bd404aeab6bab73a3768528967e96776e4884a13cf9a25ff6969ca9ba66b", "Title": "github.com/go-git/go-git/v5: go-git: Arbitrary file read/write via symbolic link resolution", "Description": "go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, worktree operations (including checkout, status, and add) resolve symbolic links inside the working tree without confining resolution to the worktree boundary, so a maliciously crafted repository containing a symlink can cause go-git to read from or write to files outside the intended working directory when the repository is cloned and its worktree operations are used. Versions 5.19.2 and 6.0.0-alpha.5.", "Severity": "HIGH", "CweIDs": [ "CWE-59" ], "VendorSeverity": { "amazon": 4, "azure": 3, "ghsa": 3, "redhat": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L", "V3Score": 7.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L", "V3Score": 7.1 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-71556", "https://github.com/go-git/go-git", "https://github.com/go-git/go-git/commit/008a78f2dd86f52544ddff8b8e8ddeecdf3f7aab", "https://github.com/go-git/go-git/commit/661d1c7f101d34e002a3cfcf8dbea5b7421d07ac", "https://github.com/go-git/go-git/releases/tag/v5.19.2", "https://github.com/go-git/go-git/releases/tag/v6.0.0-alpha.5", "https://github.com/go-git/go-git/security/advisories/GHSA-hc8v-wwc9-vgxm", "https://nvd.nist.gov/vuln/detail/CVE-2026-71556", "https://www.cve.org/CVERecord?id=CVE-2026-71556" ], "PublishedDate": "2026-08-07T17:17:10.15Z", "LastModifiedDate": "2026-09-10T20:41:33.14Z" }, { "VulnerabilityID": "CVE-2026-116587", "VendorIDs": [ "GHSA-mgcc-cww5-fp2q" ], "PkgID": "github.com/go-jose/go-jose/v4@v4.1.4", "PkgName": "github.com/go-jose/go-jose/v4", "PkgIdentifier": { "PURL": "pkg:golang/github.com/go-jose/go-jose/v4@v4.1.4", "UID": "75bc8b9f782c4e3b" }, "InstalledVersion": "v4.1.4", "FixedVersion": "4.1.6", "Status": "fixed", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-116587", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory Go", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Ago" }, "Fingerprint": "sha256:f5eb3c1400c5a4fde1a6d41562e5ae280cbe6dbb4e4da68d185f796003a95c15", "Title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "Description": "Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.6, go-jose parses attacker-controlled RSA modulus and prime values from JWKs without enforcing size and consistency bounds before passing them to crypto/rsa.PrivateKey.Validate. On Go 1.24 and later, crafted large or degenerate RSA parameters can make that validation consume cubic CPU time, allowing remote denial of service in applications that parse JWKs from untrusted sources. This issue is fixed in version 4.1.6.", "Severity": "HIGH", "CweIDs": [ "CWE-407", "CWE-770" ], "VendorSeverity": { "ghsa": 3, "redhat": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-116587", "https://github.com/go-jose/go-jose", "https://github.com/go-jose/go-jose/commit/a0111f82742fa92bceec9ede40845e73319e6230", "https://github.com/go-jose/go-jose/releases/tag/v4.1.6", "https://github.com/go-jose/go-jose/security/advisories/GHSA-mgcc-cww5-fp2q", "https://nvd.nist.gov/vuln/detail/CVE-2026-116587", "https://www.cve.org/CVERecord?id=CVE-2026-116587" ], "PublishedDate": "2026-10-26T22:16:55.193Z", "LastModifiedDate": "2026-10-27T15:16:40.99Z" }, { "VulnerabilityID": "CVE-2026-63209", "VendorIDs": [ "GHSA-259r-337f-4rfw" ], "PkgID": "github.com/klauspost/compress@v1.18.5", "PkgName": "github.com/klauspost/compress", "PkgIdentifier": { "PURL": "pkg:golang/github.com/klauspost/compress@v1.18.5", "UID": "bdf42e01995337d9" }, "InstalledVersion": "v1.18.5", "FixedVersion": "1.18.7", "Status": "fixed", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-63209", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory Go", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Ago" }, "Fingerprint": "sha256:711104e591e11e64cd095979f4c283507401bcea0a7deb75cd41bdcbf8bf847d", "Title": "github.com/klauspost/compress: klauspost/compress: Denial of Service via integer overflow in dictionary processing", "Description": "compress provides various compression algorithms. Prior to version 1.18.7, a signed integer overflow vulnerability in s2.NewDict() allows an attacker to bypass repeat index validation by supplying a dictionary with a uvarint-encoded repeat value exceeding MaxInt64. When Dict.Encode() is subsequently called, the overflowed negative repeat value causes an out-of-bounds memory access via unsafe.Pointer arithmetic, crashing the process with SIGSEGV. This issue has been patched in version 1.18.7.", "Severity": "HIGH", "CweIDs": [ "CWE-190", "CWE-787" ], "VendorSeverity": { "ghsa": 3, "redhat": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-63209", "https://github.com/klauspost/compress", "https://github.com/klauspost/compress/commit/539243b8823ee8f03e49969823d57c348c917536", "https://github.com/klauspost/compress/commit/8668e357e776d5152ed62f33c17f21b8690664fa", "https://github.com/klauspost/compress/pull/1163", "https://github.com/klauspost/compress/releases/tag/v1.18.7", "https://github.com/klauspost/compress/security/advisories/GHSA-259r-337f-4rfw", "https://nvd.nist.gov/vuln/detail/CVE-2026-63209", "https://www.cve.org/CVERecord?id=CVE-2026-63209" ], "PublishedDate": "2026-09-29T15:17:27.13Z", "LastModifiedDate": "2026-09-30T19:57:08.043Z" }, { "VulnerabilityID": "CVE-2026-48702", "VendorIDs": [ "GHSA-47q9-m4ww-924m" ], "PkgID": "github.com/sigstore/rekor@v1.5.1", "PkgName": "github.com/sigstore/rekor", "PkgIdentifier": { "PURL": "pkg:golang/github.com/sigstore/rekor@v1.5.1", "UID": "c8bb1a796b199c71" }, "InstalledVersion": "v1.5.1", "FixedVersion": "1.5.2", "Status": "fixed", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-48702", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory Go", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Ago" }, "Fingerprint": "sha256:b6973476cfe0c4e6109e3118d329c38b097fadf354969503467f1f8f716904b7", "Title": "github.com/sigstore/rekor: Rekor: Denial of Service due to unbounded gzip decompression in Alpine APK parsing", "Description": "Rekor is a software supply chain transparency log. Starting in version 0.3.0 and prior to version 1.5.2, the `Package.Unmarshal()` function in `pkg/types/alpine/apk.go` decompresses the signature and control gzip members of an APK file into in-memory buffers without bounding the total decompressed size. The existing `max_apk_metadata_size` check (default 1MB) is only applied to individual tar entry header sizes after decompression completes, so it does not prevent a decompression bomb from consuming unbounded heap memory. An attacker can craft a gzip stream that compresses at a ~1000:1 ratio (e.g., 2MB compressed zeros → 2GB decompressed). When submitted as spec.package.content in an Alpine `ProposedEntry`, the server decompresses the full payload into memory during request processing, triggering a fatal Go runtime out-of-memory error or OS OOM-kill that cannot be caught by the server's recover() middleware. This is reachable via two unauthenticated endpoints, `POST /api/v1/log/entries (createLogEntry)` and `POST /api/v1/log/entries/retrieve (searchLogQuery)`. Both invoke `V001Entry.Canonicalize()` → `fetchExternalEntities()` → `apk.Unmarshal(packageData)`, which performs the unbounded decompression. Version 1.5.2 patches the issue. There is no effective workaround. Setting `max_request_body_size` reduces but does not eliminate exposure due to the ~1000:1 compression ratio (a 1MB body limit still allows ~1GB heap allocation). Setting `max_apk_metadata_size` has no effect on this vulnerability since the check is applied after decompression.", "Severity": "HIGH", "CweIDs": [ "CWE-770" ], "VendorSeverity": { "amazon": 3, "ghsa": 3, "redhat": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-48702", "https://github.com/sigstore/rekor", "https://github.com/sigstore/rekor/security/advisories/GHSA-47q9-m4ww-924m", "https://nvd.nist.gov/vuln/detail/CVE-2026-48702", "https://www.cve.org/CVERecord?id=CVE-2026-48702" ], "PublishedDate": "2026-08-13T14:17:01.427Z", "LastModifiedDate": "2026-10-23T18:10:00.167Z" }, { "VulnerabilityID": "CVE-2026-39828", "VendorIDs": [ "GO-2026-5014" ], "PkgID": "golang.org/x/crypto@v0.50.0", "PkgName": "golang.org/x/crypto", "PkgIdentifier": { "PURL": "pkg:golang/golang.org/x/crypto@v0.50.0", "UID": "86b9f77577ddb8d2" }, "InstalledVersion": "v0.50.0", "FixedVersion": "0.52.0", "Status": "fixed", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-39828", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:3c129d781bb14ed5f71d26dede4e890d5112a0b2a3cc3a5bf6fd8ddff023936a", "Title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Unauthorized command execution via discarded SSH permissions", "Description": "When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as force-command after a second factor succeeded. Returning non-nil Permissions with PartialSuccessError now results in a connection error.", "Severity": "HIGH", "CweIDs": [ "CWE-295", "CWE-281" ], "VendorSeverity": { "amazon": 2, "azure": 2, "redhat": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:26546", "https://access.redhat.com/errata/RHSA-2026:26547", "https://access.redhat.com/errata/RHSA-2026:36105", "https://access.redhat.com/errata/RHSA-2026:36167", "https://access.redhat.com/errata/RHSA-2026:36207", "https://access.redhat.com/errata/RHSA-2026:36319", "https://access.redhat.com/errata/RHSA-2026:36625", "https://access.redhat.com/errata/RHSA-2026:36648", "https://access.redhat.com/errata/RHSA-2026:36651", "https://access.redhat.com/errata/RHSA-2026:36796", "https://access.redhat.com/errata/RHSA-2026:36797", "https://access.redhat.com/errata/RHSA-2026:36808", "https://access.redhat.com/errata/RHSA-2026:37268", "https://access.redhat.com/errata/RHSA-2026:37271", "https://access.redhat.com/errata/RHSA-2026:37272", "https://access.redhat.com/errata/RHSA-2026:37278", "https://access.redhat.com/errata/RHSA-2026:37286", "https://access.redhat.com/errata/RHSA-2026:37296", "https://access.redhat.com/errata/RHSA-2026:37387", "https://access.redhat.com/errata/RHSA-2026:40118", "https://access.redhat.com/errata/RHSA-2026:40262", "https://access.redhat.com/errata/RHSA-2026:40945", "https://access.redhat.com/errata/RHSA-2026:40969", "https://access.redhat.com/errata/RHSA-2026:40972", "https://access.redhat.com/errata/RHSA-2026:40974", "https://access.redhat.com/errata/RHSA-2026:41019", "https://access.redhat.com/errata/RHSA-2026:41031", "https://access.redhat.com/errata/RHSA-2026:41036", "https://access.redhat.com/errata/RHSA-2026:41055", "https://access.redhat.com/errata/RHSA-2026:41066", "https://access.redhat.com/errata/RHSA-2026:42146", "https://access.redhat.com/errata/RHSA-2026:42796", "https://access.redhat.com/errata/RHSA-2026:43052", "https://access.redhat.com/errata/RHSA-2026:43692", "https://access.redhat.com/errata/RHSA-2026:46885", "https://access.redhat.com/errata/RHSA-2026:46903", "https://access.redhat.com/errata/RHSA-2026:47735", "https://access.redhat.com/errata/RHSA-2026:48151", "https://access.redhat.com/errata/RHSA-2026:51033", "https://access.redhat.com/errata/RHSA-2026:51038", "https://access.redhat.com/errata/RHSA-2026:52857", "https://access.redhat.com/errata/RHSA-2026:52910", "https://access.redhat.com/errata/RHSA-2026:54531", "https://access.redhat.com/errata/RHSA-2026:57191", "https://access.redhat.com/errata/RHSA-2026:57194", "https://access.redhat.com/errata/RHSA-2026:59467", "https://access.redhat.com/errata/RHSA-2026:60520", "https://access.redhat.com/errata/RHSA-2026:66022", "https://access.redhat.com/errata/RHSA-2026:66521", "https://access.redhat.com/security/cve/CVE-2026-39828", "https://bugzilla.redhat.com/show_bug.cgi?id=2480687", "https://go.dev/cl/781621", "https://go.dev/issue/79562", "https://groups.google.com/g/golang-announce/c/a082jnz-LvI", "https://nvd.nist.gov/vuln/detail/CVE-2026-39828", "https://pkg.go.dev/vuln/GO-2026-5014", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39828.json", "https://www.cve.org/CVERecord?id=CVE-2026-39828" ], "PublishedDate": "2026-05-22T04:16:22.19Z", "LastModifiedDate": "2026-09-11T13:17:51.26Z" }, { "VulnerabilityID": "CVE-2026-39829", "VendorIDs": [ "GO-2026-5018" ], "PkgID": "golang.org/x/crypto@v0.50.0", "PkgName": "golang.org/x/crypto", "PkgIdentifier": { "PURL": "pkg:golang/golang.org/x/crypto@v0.50.0", "UID": "86b9f77577ddb8d2" }, "InstalledVersion": "v0.50.0", "FixedVersion": "0.52.0", "Status": "fixed", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-39829", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:f5c288eacca8aabf6e34e46d8f84a05b2945a4b76449dc6b8706fd602a2fe1cc", "Title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters", "Description": "The RSA and DSA public key parsers did not enforce size limits on key parameters. A crafted public key with an excessively large modulus or DSA parameter could cause several minutes of CPU consumption during signature verification. This could be triggered by unauthenticated clients during public key authentication. RSA moduli are now limited to 8192 bits, and DSA parameters are validated per FIPS 186-2.", "Severity": "HIGH", "CweIDs": [ "CWE-347", "CWE-1284" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:26546", "https://access.redhat.com/errata/RHSA-2026:26547", "https://access.redhat.com/errata/RHSA-2026:29455", "https://access.redhat.com/errata/RHSA-2026:35833", "https://access.redhat.com/errata/RHSA-2026:36199", "https://access.redhat.com/errata/RHSA-2026:36207", "https://access.redhat.com/errata/RHSA-2026:36319", "https://access.redhat.com/errata/RHSA-2026:36625", "https://access.redhat.com/errata/RHSA-2026:36648", "https://access.redhat.com/errata/RHSA-2026:36651", "https://access.redhat.com/errata/RHSA-2026:36796", "https://access.redhat.com/errata/RHSA-2026:36797", "https://access.redhat.com/errata/RHSA-2026:36808", "https://access.redhat.com/errata/RHSA-2026:36820", "https://access.redhat.com/errata/RHSA-2026:36883", "https://access.redhat.com/errata/RHSA-2026:37072", "https://access.redhat.com/errata/RHSA-2026:37123", "https://access.redhat.com/errata/RHSA-2026:37268", "https://access.redhat.com/errata/RHSA-2026:37271", "https://access.redhat.com/errata/RHSA-2026:37272", "https://access.redhat.com/errata/RHSA-2026:37278", "https://access.redhat.com/errata/RHSA-2026:37286", "https://access.redhat.com/errata/RHSA-2026:37296", "https://access.redhat.com/errata/RHSA-2026:37387", "https://access.redhat.com/errata/RHSA-2026:40118", "https://access.redhat.com/errata/RHSA-2026:40262", "https://access.redhat.com/errata/RHSA-2026:40945", "https://access.redhat.com/errata/RHSA-2026:40969", "https://access.redhat.com/errata/RHSA-2026:40972", "https://access.redhat.com/errata/RHSA-2026:40974", "https://access.redhat.com/errata/RHSA-2026:41019", "https://access.redhat.com/errata/RHSA-2026:41031", "https://access.redhat.com/errata/RHSA-2026:41036", "https://access.redhat.com/errata/RHSA-2026:41055", "https://access.redhat.com/errata/RHSA-2026:41066", "https://access.redhat.com/errata/RHSA-2026:42146", "https://access.redhat.com/errata/RHSA-2026:42796", "https://access.redhat.com/errata/RHSA-2026:43052", "https://access.redhat.com/errata/RHSA-2026:43692", "https://access.redhat.com/errata/RHSA-2026:46885", "https://access.redhat.com/errata/RHSA-2026:46903", "https://access.redhat.com/errata/RHSA-2026:47735", "https://access.redhat.com/errata/RHSA-2026:47949", "https://access.redhat.com/errata/RHSA-2026:48151", "https://access.redhat.com/errata/RHSA-2026:48693", "https://access.redhat.com/errata/RHSA-2026:49944", "https://access.redhat.com/errata/RHSA-2026:51033", "https://access.redhat.com/errata/RHSA-2026:52857", "https://access.redhat.com/errata/RHSA-2026:52910", "https://access.redhat.com/errata/RHSA-2026:54400", "https://access.redhat.com/errata/RHSA-2026:54432", "https://access.redhat.com/errata/RHSA-2026:57191", "https://access.redhat.com/errata/RHSA-2026:57194", "https://access.redhat.com/errata/RHSA-2026:57365", "https://access.redhat.com/errata/RHSA-2026:57801", "https://access.redhat.com/errata/RHSA-2026:59467", "https://access.redhat.com/errata/RHSA-2026:59559", "https://access.redhat.com/errata/RHSA-2026:59593", "https://access.redhat.com/errata/RHSA-2026:60446", "https://access.redhat.com/errata/RHSA-2026:60454", "https://access.redhat.com/errata/RHSA-2026:60477", "https://access.redhat.com/errata/RHSA-2026:60520", "https://access.redhat.com/errata/RHSA-2026:61314", "https://access.redhat.com/errata/RHSA-2026:65126", "https://access.redhat.com/errata/RHSA-2026:65964", "https://access.redhat.com/errata/RHSA-2026:66022", "https://access.redhat.com/errata/RHSA-2026:67450", "https://access.redhat.com/security/cve/CVE-2026-39829", "https://bugzilla.redhat.com/2480680", "https://bugzilla.redhat.com/2480681", "https://bugzilla.redhat.com/2480685", "https://bugzilla.redhat.com/2480688", "https://bugzilla.redhat.com/2480757", "https://bugzilla.redhat.com/2480761", "https://bugzilla.redhat.com/2493620", "https://bugzilla.redhat.com/show_bug.cgi?id=2480680", "https://bugzilla.redhat.com/show_bug.cgi?id=2480681", "https://bugzilla.redhat.com/show_bug.cgi?id=2480685", "https://bugzilla.redhat.com/show_bug.cgi?id=2480688", "https://bugzilla.redhat.com/show_bug.cgi?id=2480757", "https://bugzilla.redhat.com/show_bug.cgi?id=2480761", "https://bugzilla.redhat.com/show_bug.cgi?id=2493620", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25681", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27136", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39829", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39832", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39835", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42508", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-57231", "https://errata.almalinux.org/9/ALSA-2026-37123.html", "https://errata.rockylinux.org/RLSA-2026:37123", "https://go.dev/cl/781641", "https://go.dev/cl/781661", "https://go.dev/issue/79565", "https://groups.google.com/g/golang-announce/c/a082jnz-LvI", "https://linux.oracle.com/cve/CVE-2026-39829.html", "https://linux.oracle.com/errata/ELSA-2026-37123.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-39829", "https://pkg.go.dev/vuln/GO-2026-5018", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39829.json", "https://www.cve.org/CVERecord?id=CVE-2026-39829" ], "PublishedDate": "2026-05-22T04:16:22.31Z", "LastModifiedDate": "2026-09-16T13:17:52.28Z" }, { "VulnerabilityID": "CVE-2026-39830", "VendorIDs": [ "GO-2026-5017" ], "PkgID": "golang.org/x/crypto@v0.50.0", "PkgName": "golang.org/x/crypto", "PkgIdentifier": { "PURL": "pkg:golang/golang.org/x/crypto@v0.50.0", "UID": "86b9f77577ddb8d2" }, "InstalledVersion": "v0.50.0", "FixedVersion": "0.52.0", "Status": "fixed", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-39830", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:fd0be053933480ea7934e02644a53334f0919ad85da5e38b5cd59688093798cc", "Title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses", "Description": "A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop. The blocked goroutine could not be released by calling Close(), resulting in a resource leak per connection. Unsolicited global responses are now discarded.", "Severity": "HIGH", "CweIDs": [ "CWE-119", "CWE-772" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:29455", "https://access.redhat.com/errata/RHSA-2026:35833", "https://access.redhat.com/errata/RHSA-2026:36199", "https://access.redhat.com/errata/RHSA-2026:36207", "https://access.redhat.com/errata/RHSA-2026:36319", "https://access.redhat.com/errata/RHSA-2026:36625", "https://access.redhat.com/errata/RHSA-2026:36648", "https://access.redhat.com/errata/RHSA-2026:36651", "https://access.redhat.com/errata/RHSA-2026:36796", "https://access.redhat.com/errata/RHSA-2026:36797", "https://access.redhat.com/errata/RHSA-2026:36808", "https://access.redhat.com/errata/RHSA-2026:37072", "https://access.redhat.com/errata/RHSA-2026:37268", "https://access.redhat.com/errata/RHSA-2026:37271", "https://access.redhat.com/errata/RHSA-2026:37272", "https://access.redhat.com/errata/RHSA-2026:37275", "https://access.redhat.com/errata/RHSA-2026:37278", "https://access.redhat.com/errata/RHSA-2026:37286", "https://access.redhat.com/errata/RHSA-2026:37296", "https://access.redhat.com/errata/RHSA-2026:37387", "https://access.redhat.com/errata/RHSA-2026:40118", "https://access.redhat.com/errata/RHSA-2026:40262", "https://access.redhat.com/errata/RHSA-2026:40945", "https://access.redhat.com/errata/RHSA-2026:40969", "https://access.redhat.com/errata/RHSA-2026:40972", "https://access.redhat.com/errata/RHSA-2026:40974", "https://access.redhat.com/errata/RHSA-2026:41019", "https://access.redhat.com/errata/RHSA-2026:41031", "https://access.redhat.com/errata/RHSA-2026:41036", "https://access.redhat.com/errata/RHSA-2026:41066", "https://access.redhat.com/errata/RHSA-2026:42146", "https://access.redhat.com/errata/RHSA-2026:42796", "https://access.redhat.com/errata/RHSA-2026:43052", "https://access.redhat.com/errata/RHSA-2026:43692", "https://access.redhat.com/errata/RHSA-2026:46885", "https://access.redhat.com/errata/RHSA-2026:47735", "https://access.redhat.com/errata/RHSA-2026:48151", "https://access.redhat.com/errata/RHSA-2026:49944", "https://access.redhat.com/errata/RHSA-2026:51033", "https://access.redhat.com/errata/RHSA-2026:52857", "https://access.redhat.com/errata/RHSA-2026:52910", "https://access.redhat.com/errata/RHSA-2026:54400", "https://access.redhat.com/errata/RHSA-2026:54531", "https://access.redhat.com/errata/RHSA-2026:57194", "https://access.redhat.com/errata/RHSA-2026:57801", "https://access.redhat.com/errata/RHSA-2026:59467", "https://access.redhat.com/errata/RHSA-2026:60520", "https://access.redhat.com/errata/RHSA-2026:61314", "https://access.redhat.com/errata/RHSA-2026:65964", "https://access.redhat.com/errata/RHSA-2026:66022", "https://access.redhat.com/errata/RHSA-2026:66521", "https://access.redhat.com/errata/RHSA-2026:67450", "https://access.redhat.com/errata/RHSA-2026:69961", "https://access.redhat.com/security/cve/CVE-2026-39830", "https://bugzilla.redhat.com/2480684", "https://bugzilla.redhat.com/2508234", "https://bugzilla.redhat.com/2515815", "https://bugzilla.redhat.com/2515820", "https://bugzilla.redhat.com/2515827", "https://bugzilla.redhat.com/2515838", "https://bugzilla.redhat.com/2515839", "https://bugzilla.redhat.com/2515840", "https://bugzilla.redhat.com/show_bug.cgi?id=2480684", "https://bugzilla.redhat.com/show_bug.cgi?id=2508234", "https://bugzilla.redhat.com/show_bug.cgi?id=2515815", "https://bugzilla.redhat.com/show_bug.cgi?id=2515820", "https://bugzilla.redhat.com/show_bug.cgi?id=2515827", "https://bugzilla.redhat.com/show_bug.cgi?id=2515838", "https://bugzilla.redhat.com/show_bug.cgi?id=2515839", "https://bugzilla.redhat.com/show_bug.cgi?id=2515840", "https://bugzilla.redhat.com/show_bug.cgi?id=2518147", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-17106", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-19730", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39830", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56859", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862", "https://errata.almalinux.org/9/ALSA-2026-69961.html", "https://errata.rockylinux.org/RLSA-2026:69961", "https://github.com/golang/crypto/commit/4e7a7384ecbc8d519f6f4c11b36fa9d761fc8946", "https://go.dev/cl/781640", "https://go.dev/cl/781664", "https://go.dev/issue/79564", "https://groups.google.com/g/golang-announce/c/a082jnz-LvI", "https://linux.oracle.com/cve/CVE-2026-39830.html", "https://linux.oracle.com/errata/ELSA-2026-69961.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-39830", "https://pkg.go.dev/vuln/GO-2026-5017", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39830.json", "https://ubuntu.com/security/notices/USN-8447-1", "https://ubuntu.com/security/notices/USN-8447-2", "https://ubuntu.com/security/notices/USN-8447-3", "https://www.cve.org/CVERecord?id=CVE-2026-39830" ], "PublishedDate": "2026-05-22T04:16:22.44Z", "LastModifiedDate": "2026-09-16T13:17:53.697Z" }, { "VulnerabilityID": "CVE-2026-39831", "VendorIDs": [ "GO-2026-5019" ], "PkgID": "golang.org/x/crypto@v0.50.0", "PkgName": "golang.org/x/crypto", "PkgIdentifier": { "PURL": "pkg:golang/golang.org/x/crypto@v0.50.0", "UID": "86b9f77577ddb8d2" }, "InstalledVersion": "v0.50.0", "FixedVersion": "0.52.0", "Status": "fixed", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-39831", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:75cf6a88d3ddda269b3fd9f8829250c86609d5d40934ab14efacd33bad8ca6ac", "Title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Security key bypass due to missing user presence check", "Description": "The Verify() method for FIDO/U2F security key types (sk-ecdsa-sha2-nistp256@openssh.com, sk-ssh-ed25519@openssh.com) did not check the User Presence flag. Signatures generated without physical touch were accepted, allowing unattended use of a hardware security key. To restore the previous behavior, return a \"no-touch-required\" extension in Permissions.Extensions from PublicKeyCallback.", "Severity": "HIGH", "CweIDs": [ "CWE-862" ], "VendorSeverity": { "amazon": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-39831", "https://github.com/golang/crypto/commit/b61cf853a89d82cad68da5e12a6beca2116f8456", "https://go.dev/cl/781662", "https://go.dev/issue/79566", "https://groups.google.com/g/golang-announce/c/a082jnz-LvI", "https://nvd.nist.gov/vuln/detail/CVE-2026-39831", "https://pkg.go.dev/vuln/GO-2026-5019", "https://ubuntu.com/security/notices/USN-8447-1", "https://ubuntu.com/security/notices/USN-8447-3", "https://www.cve.org/CVERecord?id=CVE-2026-39831" ], "PublishedDate": "2026-05-22T04:16:22.553Z", "LastModifiedDate": "2026-07-23T16:10:00.137Z" }, { "VulnerabilityID": "CVE-2026-39832", "VendorIDs": [ "GHSA-f5wc-c3c7-36mc", "GO-2026-5006" ], "PkgID": "golang.org/x/crypto@v0.50.0", "PkgName": "golang.org/x/crypto", "PkgIdentifier": { "PURL": "pkg:golang/golang.org/x/crypto@v0.50.0", "UID": "86b9f77577ddb8d2" }, "InstalledVersion": "v0.50.0", "FixedVersion": "0.52.0", "Status": "fixed", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-39832", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:d34b217a8eba9c1f320a3670e9e487b37508599e65e86f2d1be6604d690ba4ea", "Title": "golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to improper handling of key restrictions", "Description": "When adding a key to a remote agent constraint extensions such as restrict-destination-v00@openssh.com were not serialized in the request. Destination restrictions were silently stripped when forwarding keys, allowing unrestricted use of the key on the remote host. The client now serializes all constraint extensions. Additionally, the in-memory keyring returned by NewKeyring() now rejects keys with unsupported constraint extensions instead of silently ignoring them.", "Severity": "HIGH", "CweIDs": [ "CWE-502", "CWE-281" ], "VendorSeverity": { "alma": 3, "amazon": 2, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N", "V3Score": 8.7 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:35833", "https://access.redhat.com/errata/RHSA-2026:36199", "https://access.redhat.com/errata/RHSA-2026:36319", "https://access.redhat.com/errata/RHSA-2026:36625", "https://access.redhat.com/errata/RHSA-2026:36648", "https://access.redhat.com/errata/RHSA-2026:36651", "https://access.redhat.com/errata/RHSA-2026:36796", "https://access.redhat.com/errata/RHSA-2026:36797", "https://access.redhat.com/errata/RHSA-2026:37072", "https://access.redhat.com/errata/RHSA-2026:37123", "https://access.redhat.com/errata/RHSA-2026:37271", "https://access.redhat.com/errata/RHSA-2026:37387", "https://access.redhat.com/errata/RHSA-2026:37410", "https://access.redhat.com/errata/RHSA-2026:40118", "https://access.redhat.com/errata/RHSA-2026:40262", "https://access.redhat.com/errata/RHSA-2026:40945", "https://access.redhat.com/errata/RHSA-2026:40972", "https://access.redhat.com/errata/RHSA-2026:41019", "https://access.redhat.com/errata/RHSA-2026:41031", "https://access.redhat.com/errata/RHSA-2026:41036", "https://access.redhat.com/errata/RHSA-2026:41066", "https://access.redhat.com/errata/RHSA-2026:42146", "https://access.redhat.com/errata/RHSA-2026:42796", "https://access.redhat.com/errata/RHSA-2026:43052", "https://access.redhat.com/errata/RHSA-2026:43692", "https://access.redhat.com/errata/RHSA-2026:49944", "https://access.redhat.com/errata/RHSA-2026:52857", "https://access.redhat.com/errata/RHSA-2026:52910", "https://access.redhat.com/errata/RHSA-2026:57194", "https://access.redhat.com/errata/RHSA-2026:59579", "https://access.redhat.com/errata/RHSA-2026:61314", "https://access.redhat.com/errata/RHSA-2026:66521", "https://access.redhat.com/errata/RHSA-2026:67450", "https://access.redhat.com/security/cve/CVE-2026-39832", "https://bugzilla.redhat.com/2480680", "https://bugzilla.redhat.com/2480685", "https://bugzilla.redhat.com/show_bug.cgi?id=2480680", "https://bugzilla.redhat.com/show_bug.cgi?id=2480685", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39832", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39835", "https://errata.almalinux.org/9/ALSA-2026-37410.html", "https://errata.rockylinux.org/RLSA-2026:37410", "https://github.com/golang/crypto/commit/e3d1254f1e7e60baa086142c46174bf6d8d0fe50", "https://go.dev/cl/778640", "https://go.dev/cl/778641", "https://go.dev/cl/778642", "https://go.dev/issue/79435", "https://groups.google.com/g/golang-announce/c/a082jnz-LvI", "https://linux.oracle.com/cve/CVE-2026-39832.html", "https://linux.oracle.com/errata/ELSA-2026-37410.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-39832", "https://pkg.go.dev/vuln/GO-2026-5006", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39832.json", "https://ubuntu.com/security/notices/USN-8447-1", "https://www.cve.org/CVERecord?id=CVE-2026-39832" ], "PublishedDate": "2026-05-22T04:16:22.663Z", "LastModifiedDate": "2026-09-15T12:17:40.787Z" }, { "VulnerabilityID": "CVE-2026-39835", "VendorIDs": [ "GO-2026-5015" ], "PkgID": "golang.org/x/crypto@v0.50.0", "PkgName": "golang.org/x/crypto", "PkgIdentifier": { "PURL": "pkg:golang/golang.org/x/crypto@v0.50.0", "UID": "86b9f77577ddb8d2" }, "InstalledVersion": "v0.50.0", "FixedVersion": "0.52.0", "Status": "fixed", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-39835", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:ed8d1d5daeeca7d3b69609b703641d28c4504b4c917a346edd2784c2afd5aa0f", "Title": "golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate", "Description": "SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate. CertChecker now returns an error instead of panicking when these callbacks are nil.", "Severity": "HIGH", "CweIDs": [ "CWE-295", "CWE-476" ], "VendorSeverity": { "alma": 3, "amazon": 2, "azure": 2, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:26546", "https://access.redhat.com/errata/RHSA-2026:26547", "https://access.redhat.com/errata/RHSA-2026:36199", "https://access.redhat.com/errata/RHSA-2026:36207", "https://access.redhat.com/errata/RHSA-2026:36319", "https://access.redhat.com/errata/RHSA-2026:36625", "https://access.redhat.com/errata/RHSA-2026:36648", "https://access.redhat.com/errata/RHSA-2026:36651", "https://access.redhat.com/errata/RHSA-2026:36796", "https://access.redhat.com/errata/RHSA-2026:36797", "https://access.redhat.com/errata/RHSA-2026:37072", "https://access.redhat.com/errata/RHSA-2026:37123", "https://access.redhat.com/errata/RHSA-2026:37268", "https://access.redhat.com/errata/RHSA-2026:37271", "https://access.redhat.com/errata/RHSA-2026:37272", "https://access.redhat.com/errata/RHSA-2026:37286", "https://access.redhat.com/errata/RHSA-2026:37296", "https://access.redhat.com/errata/RHSA-2026:37387", "https://access.redhat.com/errata/RHSA-2026:37410", "https://access.redhat.com/errata/RHSA-2026:38504", "https://access.redhat.com/errata/RHSA-2026:40118", "https://access.redhat.com/errata/RHSA-2026:40262", "https://access.redhat.com/errata/RHSA-2026:40945", "https://access.redhat.com/errata/RHSA-2026:40969", "https://access.redhat.com/errata/RHSA-2026:40972", "https://access.redhat.com/errata/RHSA-2026:40974", "https://access.redhat.com/errata/RHSA-2026:41019", "https://access.redhat.com/errata/RHSA-2026:41031", "https://access.redhat.com/errata/RHSA-2026:41036", "https://access.redhat.com/errata/RHSA-2026:41066", "https://access.redhat.com/errata/RHSA-2026:42146", "https://access.redhat.com/errata/RHSA-2026:42796", "https://access.redhat.com/errata/RHSA-2026:43052", "https://access.redhat.com/errata/RHSA-2026:43692", "https://access.redhat.com/errata/RHSA-2026:46885", "https://access.redhat.com/errata/RHSA-2026:47735", "https://access.redhat.com/errata/RHSA-2026:47949", "https://access.redhat.com/errata/RHSA-2026:48151", "https://access.redhat.com/errata/RHSA-2026:51033", "https://access.redhat.com/errata/RHSA-2026:51036", "https://access.redhat.com/errata/RHSA-2026:51038", "https://access.redhat.com/errata/RHSA-2026:52857", "https://access.redhat.com/errata/RHSA-2026:52910", "https://access.redhat.com/errata/RHSA-2026:54525", "https://access.redhat.com/errata/RHSA-2026:57194", "https://access.redhat.com/errata/RHSA-2026:59467", "https://access.redhat.com/errata/RHSA-2026:59593", "https://access.redhat.com/errata/RHSA-2026:60520", "https://access.redhat.com/errata/RHSA-2026:62260", "https://access.redhat.com/errata/RHSA-2026:65126", "https://access.redhat.com/errata/RHSA-2026:66022", "https://access.redhat.com/errata/RHSA-2026:66521", "https://access.redhat.com/security/cve/CVE-2026-39835", "https://bugzilla.redhat.com/2480680", "https://bugzilla.redhat.com/2480685", "https://bugzilla.redhat.com/show_bug.cgi?id=2480680", "https://bugzilla.redhat.com/show_bug.cgi?id=2480685", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39832", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39835", "https://errata.almalinux.org/9/ALSA-2026-37410.html", "https://errata.rockylinux.org/RLSA-2026:37410", "https://go.dev/cl/781660", "https://go.dev/issue/79563", "https://groups.google.com/g/golang-announce/c/a082jnz-LvI", "https://linux.oracle.com/cve/CVE-2026-39835.html", "https://linux.oracle.com/errata/ELSA-2026-38504.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-39835", "https://pkg.go.dev/vuln/GO-2026-5015", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39835.json", "https://www.cve.org/CVERecord?id=CVE-2026-39835" ], "PublishedDate": "2026-05-22T04:16:24.53Z", "LastModifiedDate": "2026-09-18T13:18:12.74Z" }, { "VulnerabilityID": "CVE-2026-42508", "VendorIDs": [ "GHSA-5cgq-3rg8-m6cv", "GO-2026-5021" ], "PkgID": "golang.org/x/crypto@v0.50.0", "PkgName": "golang.org/x/crypto", "PkgIdentifier": { "PURL": "pkg:golang/golang.org/x/crypto@v0.50.0", "UID": "86b9f77577ddb8d2" }, "InstalledVersion": "v0.50.0", "FixedVersion": "0.52.0", "Status": "fixed", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-42508", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:e299b2edabb82cc53bca3daf205d70973cfc9021f7ef6336077e1a0be8a74702", "Title": "golang.org/x/crypto/ssh/knownhosts: golang: golang.org/x/crypto/ssh/knownhosts: Revocation bypass via unchecked SignatureKey", "Description": "Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation. Now, both the 'key' and 'key.SignatureKey' are checked for @revoked.", "Severity": "HIGH", "CweIDs": [ "CWE-295" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "V3Score": 7.4 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:23262", "https://access.redhat.com/errata/RHSA-2026:23264", "https://access.redhat.com/errata/RHSA-2026:26546", "https://access.redhat.com/errata/RHSA-2026:26547", "https://access.redhat.com/errata/RHSA-2026:35833", "https://access.redhat.com/errata/RHSA-2026:36648", "https://access.redhat.com/errata/RHSA-2026:36651", "https://access.redhat.com/errata/RHSA-2026:36796", "https://access.redhat.com/errata/RHSA-2026:36797", "https://access.redhat.com/errata/RHSA-2026:36808", "https://access.redhat.com/errata/RHSA-2026:37072", "https://access.redhat.com/errata/RHSA-2026:37123", "https://access.redhat.com/errata/RHSA-2026:37387", "https://access.redhat.com/errata/RHSA-2026:40118", "https://access.redhat.com/errata/RHSA-2026:40262", "https://access.redhat.com/errata/RHSA-2026:40945", "https://access.redhat.com/errata/RHSA-2026:41019", "https://access.redhat.com/errata/RHSA-2026:41031", "https://access.redhat.com/errata/RHSA-2026:41036", "https://access.redhat.com/errata/RHSA-2026:41064", "https://access.redhat.com/errata/RHSA-2026:41066", "https://access.redhat.com/errata/RHSA-2026:42146", "https://access.redhat.com/errata/RHSA-2026:42796", "https://access.redhat.com/errata/RHSA-2026:43052", "https://access.redhat.com/errata/RHSA-2026:43692", "https://access.redhat.com/errata/RHSA-2026:46885", "https://access.redhat.com/errata/RHSA-2026:47735", "https://access.redhat.com/errata/RHSA-2026:47737", "https://access.redhat.com/errata/RHSA-2026:49944", "https://access.redhat.com/errata/RHSA-2026:51033", "https://access.redhat.com/errata/RHSA-2026:51288", "https://access.redhat.com/errata/RHSA-2026:52857", "https://access.redhat.com/errata/RHSA-2026:52910", "https://access.redhat.com/errata/RHSA-2026:54400", "https://access.redhat.com/errata/RHSA-2026:57194", "https://access.redhat.com/errata/RHSA-2026:59467", "https://access.redhat.com/errata/RHSA-2026:60520", "https://access.redhat.com/errata/RHSA-2026:61314", "https://access.redhat.com/errata/RHSA-2026:65126", "https://access.redhat.com/errata/RHSA-2026:66022", "https://access.redhat.com/errata/RHSA-2026:66521", "https://access.redhat.com/errata/RHSA-2026:67450", "https://access.redhat.com/security/cve/CVE-2026-42508", "https://bugzilla.redhat.com/2480680", "https://bugzilla.redhat.com/2480681", "https://bugzilla.redhat.com/2480685", "https://bugzilla.redhat.com/2480688", "https://bugzilla.redhat.com/2480757", "https://bugzilla.redhat.com/2480761", "https://bugzilla.redhat.com/2493620", "https://bugzilla.redhat.com/show_bug.cgi?id=2480680", "https://bugzilla.redhat.com/show_bug.cgi?id=2480681", "https://bugzilla.redhat.com/show_bug.cgi?id=2480685", "https://bugzilla.redhat.com/show_bug.cgi?id=2480688", "https://bugzilla.redhat.com/show_bug.cgi?id=2480757", "https://bugzilla.redhat.com/show_bug.cgi?id=2480761", "https://bugzilla.redhat.com/show_bug.cgi?id=2493620", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25681", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27136", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39829", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39832", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39835", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42508", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-57231", "https://errata.almalinux.org/9/ALSA-2026-37123.html", "https://errata.rockylinux.org/RLSA-2026:37123", "https://github.com/golang/crypto/commit/f717e29698a271c548239ed56bf5dd9516d6f7e8", "https://go.dev/cl/781220", "https://go.dev/issue/79568", "https://groups.google.com/g/golang-announce/c/a082jnz-LvI", "https://linux.oracle.com/cve/CVE-2026-42508.html", "https://linux.oracle.com/errata/ELSA-2026-37123.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-42508", "https://pkg.go.dev/vuln/GO-2026-5021", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42508.json", "https://ubuntu.com/security/notices/USN-8447-1", "https://ubuntu.com/security/notices/USN-8447-2", "https://www.cve.org/CVERecord?id=CVE-2026-42508" ], "PublishedDate": "2026-05-22T04:16:25.44Z", "LastModifiedDate": "2026-09-15T12:17:45.777Z" }, { "VulnerabilityID": "CVE-2026-46595", "VendorIDs": [ "GO-2026-5023" ], "PkgID": "golang.org/x/crypto@v0.50.0", "PkgName": "golang.org/x/crypto", "PkgIdentifier": { "PURL": "pkg:golang/golang.org/x/crypto@v0.50.0", "UID": "86b9f77577ddb8d2" }, "InstalledVersion": "v0.50.0", "FixedVersion": "0.52.0", "Status": "fixed", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-46595", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:edeb294a6bfbaf9cced2efeadb7bb6be8a9721ef823690ef643602d5313e7d3c", "Title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Authorization bypass due to skipped source-address validation", "Description": "Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation would be skipped.", "Severity": "HIGH", "CweIDs": [ "CWE-863", "CWE-303" ], "VendorSeverity": { "amazon": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L", "V3Score": 7.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:23262", "https://access.redhat.com/errata/RHSA-2026:23264", "https://access.redhat.com/errata/RHSA-2026:26546", "https://access.redhat.com/errata/RHSA-2026:26547", "https://access.redhat.com/errata/RHSA-2026:30650", "https://access.redhat.com/errata/RHSA-2026:30651", "https://access.redhat.com/errata/RHSA-2026:33524", "https://access.redhat.com/errata/RHSA-2026:33531", "https://access.redhat.com/errata/RHSA-2026:36207", "https://access.redhat.com/errata/RHSA-2026:36648", "https://access.redhat.com/errata/RHSA-2026:36651", "https://access.redhat.com/errata/RHSA-2026:36796", "https://access.redhat.com/errata/RHSA-2026:36797", "https://access.redhat.com/errata/RHSA-2026:36808", "https://access.redhat.com/errata/RHSA-2026:36820", "https://access.redhat.com/errata/RHSA-2026:37275", "https://access.redhat.com/errata/RHSA-2026:37387", "https://access.redhat.com/errata/RHSA-2026:40118", "https://access.redhat.com/errata/RHSA-2026:40945", "https://access.redhat.com/errata/RHSA-2026:41019", "https://access.redhat.com/errata/RHSA-2026:41036", "https://access.redhat.com/errata/RHSA-2026:42796", "https://access.redhat.com/errata/RHSA-2026:43692", "https://access.redhat.com/errata/RHSA-2026:47737", "https://access.redhat.com/errata/RHSA-2026:48151", "https://access.redhat.com/errata/RHSA-2026:51033", "https://access.redhat.com/errata/RHSA-2026:54531", "https://access.redhat.com/errata/RHSA-2026:59467", "https://access.redhat.com/errata/RHSA-2026:59558", "https://access.redhat.com/errata/RHSA-2026:60520", "https://access.redhat.com/errata/RHSA-2026:61314", "https://access.redhat.com/errata/RHSA-2026:66022", "https://access.redhat.com/errata/RHSA-2026:66521", "https://access.redhat.com/security/cve/CVE-2026-46595", "https://bugzilla.redhat.com/show_bug.cgi?id=2480689", "https://github.com/golang/crypto/commit/533fb3f7e4a5ae23f69d1837cd851d35ff5b76ce", "https://go.dev/cl/781642", "https://go.dev/issue/79570", "https://groups.google.com/g/golang-announce/c/a082jnz-LvI", "https://nvd.nist.gov/vuln/detail/CVE-2026-46595", "https://pkg.go.dev/vuln/GO-2026-5023", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46595.json", "https://ubuntu.com/security/notices/USN-8447-1", "https://ubuntu.com/security/notices/USN-8447-3", "https://www.cve.org/CVERecord?id=CVE-2026-46595" ], "PublishedDate": "2026-05-22T04:16:25.55Z", "LastModifiedDate": "2026-09-11T13:18:12.367Z" }, { "VulnerabilityID": "CVE-2026-46597", "VendorIDs": [ "GO-2026-5013" ], "PkgID": "golang.org/x/crypto@v0.50.0", "PkgName": "golang.org/x/crypto", "PkgIdentifier": { "PURL": "pkg:golang/golang.org/x/crypto@v0.50.0", "UID": "86b9f77577ddb8d2" }, "InstalledVersion": "v0.50.0", "FixedVersion": "0.52.0", "Status": "fixed", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-46597", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:50dbd9c38a07a450d07a48d0b16bf0d5b9dbb0ffeb8e92f502e0b38cd4b64c83", "Title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted AES-GCM packet decoder inputs", "Description": "An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs.", "Severity": "HIGH", "CweIDs": [ "CWE-704" ], "VendorSeverity": { "amazon": 2, "azure": 3, "redhat": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-46597", "https://go.dev/cl/781620", "https://go.dev/issue/79561", "https://groups.google.com/g/golang-announce/c/a082jnz-LvI", "https://nvd.nist.gov/vuln/detail/CVE-2026-46597", "https://pkg.go.dev/vuln/GO-2026-5013", "https://www.cve.org/CVERecord?id=CVE-2026-46597" ], "PublishedDate": "2026-05-22T04:16:26.003Z", "LastModifiedDate": "2026-07-23T16:10:00.137Z" }, { "VulnerabilityID": "CVE-2026-56854", "VendorIDs": [ "GO-2026-6303" ], "PkgID": "golang.org/x/crypto@v0.50.0", "PkgName": "golang.org/x/crypto", "PkgIdentifier": { "PURL": "pkg:golang/golang.org/x/crypto@v0.50.0", "UID": "86b9f77577ddb8d2" }, "InstalledVersion": "v0.50.0", "FixedVersion": "0.55.0", "Status": "fixed", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-56854", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:1f53883383ee7c19031bd981c526fa2278ac6049a01286e1e223c29ccbc31ee7", "Title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Authentication bypass due to unenforced source-address restrictions", "Description": "The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the PasswordCallback, KeyboardInteractiveCallback, NoClientAuthCallback, and GSSAPIWithMICConfig.AllowLogin callbacks were not validated against the client's remote address, so a source-address restriction set by those callbacks was silently ignored. The check is now applied to the Permissions returned by any authentication callback.", "Severity": "HIGH", "CweIDs": [ "CWE-863" ], "VendorSeverity": { "amazon": 3, "redhat": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N", "V3Score": 6.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-56854", "https://go.dev/cl/797040", "https://go.dev/issue/80213", "https://nvd.nist.gov/vuln/detail/CVE-2026-56854", "https://pkg.go.dev/vuln/GO-2026-6303", "https://www.cve.org/CVERecord?id=CVE-2026-56854" ], "PublishedDate": "2026-08-28T16:18:17.607Z", "LastModifiedDate": "2026-09-03T16:37:52.17Z" }, { "VulnerabilityID": "CVE-2026-56864", "VendorIDs": [ "GO-2026-6180" ], "PkgID": "golang.org/x/mod@v0.34.0", "PkgName": "golang.org/x/mod", "PkgIdentifier": { "PURL": "pkg:golang/golang.org/x/mod@v0.34.0", "UID": "f7b41f716f7b0fe4" }, "InstalledVersion": "v0.34.0", "FixedVersion": "0.40.0", "Status": "fixed", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-56864", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:9d2c35c0bad5b40c7d48bfd99481a5bf1ca5991fd7e4d04406741b0865382dd2", "Title": "golang.org/x/mod/sumdb: golang.org/x/mod/sumdb: Integrity bypass via malicious GOSUMDB", "Description": "A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log. In order to determine if you have been affected: rm -r go.sum go.work.sum vendor/ \u0026\u0026 go mod tidy", "Severity": "HIGH", "CweIDs": [ "CWE-347" ], "VendorSeverity": { "amazon": 3, "bitnami": 3, "photon": 3, "redhat": 3 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-56864", "https://go.dev/cl/815000", "https://go.dev/cl/815020", "https://go.dev/issue/80745", "https://groups.google.com/g/golang-announce/c/94pEornpRlI", "https://nvd.nist.gov/vuln/detail/CVE-2026-56864", "https://pkg.go.dev/vuln/GO-2026-6180", "https://www.cve.org/CVERecord?id=CVE-2026-56864" ], "PublishedDate": "2026-08-13T22:17:22.677Z", "LastModifiedDate": "2026-09-03T16:37:52.17Z" }, { "VulnerabilityID": "CVE-2026-56865", "VendorIDs": [ "GO-2026-6179" ], "PkgID": "golang.org/x/mod@v0.34.0", "PkgName": "golang.org/x/mod", "PkgIdentifier": { "PURL": "pkg:golang/golang.org/x/mod@v0.34.0", "UID": "f7b41f716f7b0fe4" }, "InstalledVersion": "v0.34.0", "FixedVersion": "0.40.0", "Status": "fixed", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-56865", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:e61c80c2e3210559437cc0fc99f91c0ca9e76b05e5545928f126243d23c88faa", "Title": "golang.org/x/mod/sumdb/tlog: golang.org/x/mod/sumdb/tlog: Supply chain compromise via transparency log tile verification bypass", "Description": "A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache. This attack allows for a malicious GOPROXY to serve malicious module content that cannot be detected by evaluating the transparency log. All tiles are now correctly verified against their parents. In order to determine if you have been affected: rm -r go.sum go.work.sum vendor/ \u0026\u0026 go mod tidy", "Severity": "HIGH", "CweIDs": [ "CWE-347" ], "VendorSeverity": { "amazon": 3, "azure": 3, "bitnami": 3, "photon": 3, "redhat": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "V3Score": 8.4 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-56865", "https://github.com/golang/go/issues/80744", "https://go.dev/cl/814960", "https://go.dev/cl/815020", "https://go.dev/issue/80744", "https://groups.google.com/g/golang-announce/c/94pEornpRlI", "https://nvd.nist.gov/vuln/detail/CVE-2026-56865", "https://pkg.go.dev/vuln/GO-2026-6179", "https://ubuntu.com/security/notices/USN-8935-1", "https://www.cve.org/CVERecord?id=CVE-2026-56865" ], "PublishedDate": "2026-08-13T22:17:22.797Z", "LastModifiedDate": "2026-09-03T16:37:52.17Z" }, { "VulnerabilityID": "CVE-2026-25681", "VendorIDs": [ "GO-2026-5029" ], "PkgID": "golang.org/x/net@v0.53.0", "PkgName": "golang.org/x/net", "PkgIdentifier": { "PURL": "pkg:golang/golang.org/x/net@v0.53.0", "UID": "a5e3f765714179cd" }, "InstalledVersion": "v0.53.0", "FixedVersion": "0.55.0", "Status": "fixed", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-25681", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:4fcfdd30a778e0e76300cb17c28f3fbe986bdfcb1aaa40554adcba91878cb697", "Title": "golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting", "Description": "Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.", "Severity": "HIGH", "CweIDs": [ "CWE-1021" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:69293", "https://access.redhat.com/security/cve/CVE-2026-25681", "https://bugzilla.redhat.com/2480757", "https://bugzilla.redhat.com/2480761", "https://bugzilla.redhat.com/2480762", "https://bugzilla.redhat.com/2484830", "https://bugzilla.redhat.com/2493622", "https://bugzilla.redhat.com/show_bug.cgi?id=2480757", "https://bugzilla.redhat.com/show_bug.cgi?id=2480761", "https://bugzilla.redhat.com/show_bug.cgi?id=2480762", "https://bugzilla.redhat.com/show_bug.cgi?id=2484830", "https://bugzilla.redhat.com/show_bug.cgi?id=2493622", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25681", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27136", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-41178", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42502", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-55677", "https://errata.almalinux.org/9/ALSA-2026-69293.html", "https://errata.rockylinux.org/RLSA-2026:69293", "https://go.dev/cl/781703", "https://go.dev/issue/79574", "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8", "https://linux.oracle.com/cve/CVE-2026-25681.html", "https://linux.oracle.com/errata/ELSA-2026-69293.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-25681", "https://pkg.go.dev/vuln/GO-2026-5029", "https://www.cve.org/CVERecord?id=CVE-2026-25681" ], "PublishedDate": "2026-05-22T16:16:19.863Z", "LastModifiedDate": "2026-07-23T16:10:00.137Z" }, { "VulnerabilityID": "CVE-2026-27136", "VendorIDs": [ "GO-2026-5030" ], "PkgID": "golang.org/x/net@v0.53.0", "PkgName": "golang.org/x/net", "PkgIdentifier": { "PURL": "pkg:golang/golang.org/x/net@v0.53.0", "UID": "a5e3f765714179cd" }, "InstalledVersion": "v0.53.0", "FixedVersion": "0.55.0", "Status": "fixed", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-27136", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:5a8e1bc6e3af9175fdb09eecf6b0ba0ff36207dcff1ffe1ef2fb5d7270bd4137", "Title": "golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass", "Description": "Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.", "Severity": "HIGH", "CweIDs": [ "CWE-1021" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:69293", "https://access.redhat.com/security/cve/CVE-2026-27136", "https://bugzilla.redhat.com/2480757", "https://bugzilla.redhat.com/2480761", "https://bugzilla.redhat.com/2480762", "https://bugzilla.redhat.com/2484830", "https://bugzilla.redhat.com/2493622", "https://bugzilla.redhat.com/show_bug.cgi?id=2480757", "https://bugzilla.redhat.com/show_bug.cgi?id=2480761", "https://bugzilla.redhat.com/show_bug.cgi?id=2480762", "https://bugzilla.redhat.com/show_bug.cgi?id=2484830", "https://bugzilla.redhat.com/show_bug.cgi?id=2493622", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25681", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27136", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-41178", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42502", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-55677", "https://errata.almalinux.org/9/ALSA-2026-69293.html", "https://errata.rockylinux.org/RLSA-2026:69293", "https://go.dev/cl/781685", "https://go.dev/issue/79575", "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8", "https://linux.oracle.com/cve/CVE-2026-27136.html", "https://linux.oracle.com/errata/ELSA-2026-69293.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-27136", "https://pkg.go.dev/vuln/GO-2026-5030", "https://www.cve.org/CVERecord?id=CVE-2026-27136" ], "PublishedDate": "2026-05-22T16:16:20.087Z", "LastModifiedDate": "2026-07-23T16:10:00.137Z" }, { "VulnerabilityID": "CVE-2026-39821", "VendorIDs": [ "GO-2026-5026" ], "PkgID": "golang.org/x/net@v0.53.0", "PkgName": "golang.org/x/net", "PkgIdentifier": { "PURL": "pkg:golang/golang.org/x/net@v0.53.0", "UID": "a5e3f765714179cd" }, "InstalledVersion": "v0.53.0", "FixedVersion": "0.55.0", "Status": "fixed", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-39821", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:ba42eedcc9ade14a16ec43525540fc4666231a3ae51055404750a024800766d5", "Title": "golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing", "Description": "The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode(\"xn--example-.com\") incorrectly returns the name \"example.com\" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject \"example.com\" but permit \"xn--example-.com\". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name \"example.com\".", "Severity": "HIGH", "CweIDs": [ "CWE-1289" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 4, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N", "V3Score": 8.2 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:23262", "https://access.redhat.com/errata/RHSA-2026:23264", "https://access.redhat.com/errata/RHSA-2026:26546", "https://access.redhat.com/errata/RHSA-2026:26547", "https://access.redhat.com/errata/RHSA-2026:30650", "https://access.redhat.com/errata/RHSA-2026:30651", "https://access.redhat.com/errata/RHSA-2026:30853", "https://access.redhat.com/errata/RHSA-2026:30854", "https://access.redhat.com/errata/RHSA-2026:30855", "https://access.redhat.com/errata/RHSA-2026:33155", "https://access.redhat.com/errata/RHSA-2026:33160", "https://access.redhat.com/errata/RHSA-2026:33163", "https://access.redhat.com/errata/RHSA-2026:33173", "https://access.redhat.com/errata/RHSA-2026:33183", "https://access.redhat.com/errata/RHSA-2026:33524", "https://access.redhat.com/errata/RHSA-2026:33531", "https://access.redhat.com/errata/RHSA-2026:34342", "https://access.redhat.com/errata/RHSA-2026:34357", "https://access.redhat.com/errata/RHSA-2026:34359", "https://access.redhat.com/errata/RHSA-2026:34364", "https://access.redhat.com/errata/RHSA-2026:34789", "https://access.redhat.com/errata/RHSA-2026:35826", "https://access.redhat.com/errata/RHSA-2026:35827", "https://access.redhat.com/errata/RHSA-2026:35828", "https://access.redhat.com/errata/RHSA-2026:35829", "https://access.redhat.com/errata/RHSA-2026:35830", "https://access.redhat.com/errata/RHSA-2026:35831", "https://access.redhat.com/errata/RHSA-2026:35993", "https://access.redhat.com/errata/RHSA-2026:35994", "https://access.redhat.com/errata/RHSA-2026:36105", "https://access.redhat.com/errata/RHSA-2026:36167", "https://access.redhat.com/errata/RHSA-2026:36207", "https://access.redhat.com/errata/RHSA-2026:36648", "https://access.redhat.com/errata/RHSA-2026:36651", "https://access.redhat.com/errata/RHSA-2026:36796", "https://access.redhat.com/errata/RHSA-2026:36797", "https://access.redhat.com/errata/RHSA-2026:36808", "https://access.redhat.com/errata/RHSA-2026:36820", "https://access.redhat.com/errata/RHSA-2026:36883", "https://access.redhat.com/errata/RHSA-2026:37387", "https://access.redhat.com/errata/RHSA-2026:37435", "https://access.redhat.com/errata/RHSA-2026:37436", "https://access.redhat.com/errata/RHSA-2026:38995", "https://access.redhat.com/errata/RHSA-2026:39005", "https://access.redhat.com/errata/RHSA-2026:39573", "https://access.redhat.com/errata/RHSA-2026:39879", "https://access.redhat.com/errata/RHSA-2026:40118", "https://access.redhat.com/errata/RHSA-2026:40262", "https://access.redhat.com/errata/RHSA-2026:40945", "https://access.redhat.com/errata/RHSA-2026:41019", "https://access.redhat.com/errata/RHSA-2026:41030", "https://access.redhat.com/errata/RHSA-2026:41031", "https://access.redhat.com/errata/RHSA-2026:41036", "https://access.redhat.com/errata/RHSA-2026:41055", "https://access.redhat.com/errata/RHSA-2026:41066", "https://access.redhat.com/errata/RHSA-2026:41928", "https://access.redhat.com/errata/RHSA-2026:41930", "https://access.redhat.com/errata/RHSA-2026:42043", "https://access.redhat.com/errata/RHSA-2026:42047", "https://access.redhat.com/errata/RHSA-2026:42048", "https://access.redhat.com/errata/RHSA-2026:42049", "https://access.redhat.com/errata/RHSA-2026:42050", "https://access.redhat.com/errata/RHSA-2026:42051", "https://access.redhat.com/errata/RHSA-2026:42078", "https://access.redhat.com/errata/RHSA-2026:42079", "https://access.redhat.com/errata/RHSA-2026:42080", "https://access.redhat.com/errata/RHSA-2026:42082", "https://access.redhat.com/errata/RHSA-2026:42132", "https://access.redhat.com/errata/RHSA-2026:42142", "https://access.redhat.com/errata/RHSA-2026:42146", "https://access.redhat.com/errata/RHSA-2026:42150", "https://access.redhat.com/errata/RHSA-2026:42151", "https://access.redhat.com/errata/RHSA-2026:42240", "https://access.redhat.com/errata/RHSA-2026:42644", "https://access.redhat.com/errata/RHSA-2026:42796", "https://access.redhat.com/errata/RHSA-2026:42852", "https://access.redhat.com/errata/RHSA-2026:43038", "https://access.redhat.com/errata/RHSA-2026:43052", "https://access.redhat.com/errata/RHSA-2026:43692", "https://access.redhat.com/errata/RHSA-2026:44622", "https://access.redhat.com/errata/RHSA-2026:44624", "https://access.redhat.com/errata/RHSA-2026:46395", "https://access.redhat.com/errata/RHSA-2026:47149", "https://access.redhat.com/errata/RHSA-2026:47735", "https://access.redhat.com/errata/RHSA-2026:47737", "https://access.redhat.com/errata/RHSA-2026:47952", "https://access.redhat.com/errata/RHSA-2026:49702", "https://access.redhat.com/errata/RHSA-2026:49712", "https://access.redhat.com/errata/RHSA-2026:50300", "https://access.redhat.com/errata/RHSA-2026:50843", "https://access.redhat.com/errata/RHSA-2026:51033", "https://access.redhat.com/errata/RHSA-2026:51112", "https://access.redhat.com/errata/RHSA-2026:51187", "https://access.redhat.com/errata/RHSA-2026:51194", "https://access.redhat.com/errata/RHSA-2026:51341", "https://access.redhat.com/errata/RHSA-2026:52826", "https://access.redhat.com/errata/RHSA-2026:53374", "https://access.redhat.com/errata/RHSA-2026:53412", "https://access.redhat.com/errata/RHSA-2026:53413", "https://access.redhat.com/errata/RHSA-2026:53415", "https://access.redhat.com/errata/RHSA-2026:53530", "https://access.redhat.com/errata/RHSA-2026:54191", "https://access.redhat.com/errata/RHSA-2026:54274", "https://access.redhat.com/errata/RHSA-2026:54283", "https://access.redhat.com/errata/RHSA-2026:54284", "https://access.redhat.com/errata/RHSA-2026:54285", "https://access.redhat.com/errata/RHSA-2026:54286", "https://access.redhat.com/errata/RHSA-2026:54287", "https://access.redhat.com/errata/RHSA-2026:54395", "https://access.redhat.com/errata/RHSA-2026:54401", "https://access.redhat.com/errata/RHSA-2026:54435", "https://access.redhat.com/errata/RHSA-2026:54441", "https://access.redhat.com/errata/RHSA-2026:54531", "https://access.redhat.com/errata/RHSA-2026:54580", "https://access.redhat.com/errata/RHSA-2026:54757", "https://access.redhat.com/errata/RHSA-2026:56143", "https://access.redhat.com/errata/RHSA-2026:56223", "https://access.redhat.com/errata/RHSA-2026:56340", "https://access.redhat.com/errata/RHSA-2026:56431", "https://access.redhat.com/errata/RHSA-2026:57194", "https://access.redhat.com/errata/RHSA-2026:57541", "https://access.redhat.com/errata/RHSA-2026:57649", "https://access.redhat.com/errata/RHSA-2026:57845", "https://access.redhat.com/errata/RHSA-2026:59546", "https://access.redhat.com/errata/RHSA-2026:59549", "https://access.redhat.com/errata/RHSA-2026:59562", "https://access.redhat.com/errata/RHSA-2026:60315", "https://access.redhat.com/errata/RHSA-2026:60354", "https://access.redhat.com/errata/RHSA-2026:60387", "https://access.redhat.com/errata/RHSA-2026:60520", "https://access.redhat.com/errata/RHSA-2026:61245", "https://access.redhat.com/errata/RHSA-2026:61253", "https://access.redhat.com/errata/RHSA-2026:62549", "https://access.redhat.com/errata/RHSA-2026:63134", "https://access.redhat.com/errata/RHSA-2026:65126", "https://access.redhat.com/errata/RHSA-2026:65153", "https://access.redhat.com/errata/RHSA-2026:65359", "https://access.redhat.com/errata/RHSA-2026:65534", "https://access.redhat.com/errata/RHSA-2026:65851", "https://access.redhat.com/errata/RHSA-2026:65886", "https://access.redhat.com/errata/RHSA-2026:66016", "https://access.redhat.com/errata/RHSA-2026:66022", "https://access.redhat.com/errata/RHSA-2026:66350", "https://access.redhat.com/errata/RHSA-2026:66432", "https://access.redhat.com/errata/RHSA-2026:67149", "https://access.redhat.com/errata/RHSA-2026:67159", "https://access.redhat.com/errata/RHSA-2026:67160", "https://access.redhat.com/errata/RHSA-2026:67287", "https://access.redhat.com/errata/RHSA-2026:67319", "https://access.redhat.com/errata/RHSA-2026:67517", "https://access.redhat.com/errata/RHSA-2026:68504", "https://access.redhat.com/security/cve/CVE-2026-39821", "https://bugzilla.redhat.com/2467809", "https://bugzilla.redhat.com/2467820", "https://bugzilla.redhat.com/2480756", "https://bugzilla.redhat.com/2484204", "https://bugzilla.redhat.com/2515815", "https://bugzilla.redhat.com/2515820", "https://bugzilla.redhat.com/2515827", "https://bugzilla.redhat.com/2515838", "https://bugzilla.redhat.com/2515839", "https://bugzilla.redhat.com/2515840", "https://bugzilla.redhat.com/show_bug.cgi?id=2456333", "https://bugzilla.redhat.com/show_bug.cgi?id=2456339", "https://bugzilla.redhat.com/show_bug.cgi?id=2467809", "https://bugzilla.redhat.com/show_bug.cgi?id=2467820", "https://bugzilla.redhat.com/show_bug.cgi?id=2467822", "https://bugzilla.redhat.com/show_bug.cgi?id=2480756", "https://bugzilla.redhat.com/show_bug.cgi?id=2484204", "https://bugzilla.redhat.com/show_bug.cgi?id=2515815", "https://bugzilla.redhat.com/show_bug.cgi?id=2515820", "https://bugzilla.redhat.com/show_bug.cgi?id=2515827", "https://bugzilla.redhat.com/show_bug.cgi?id=2515838", "https://bugzilla.redhat.com/show_bug.cgi?id=2515839", "https://bugzilla.redhat.com/show_bug.cgi?id=2515840", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32280", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32281", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33811", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39820", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39821", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42499", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42504", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56859", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862", "https://errata.almalinux.org/9/ALSA-2026-65153.html", "https://errata.rockylinux.org/RLSA-2026:65886", "https://go.dev/cl/767220", "https://go.dev/issue/78760", "https://groups.google.com/g/golang-announce/c/94pEornpRlI", "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8", "https://linux.oracle.com/cve/CVE-2026-39821.html", "https://linux.oracle.com/errata/ELSA-2026-66432-0.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-39821", "https://pkg.go.dev/vuln/GO-2026-5026", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39821.json", "https://ubuntu.com/security/notices/USN-8416-1", "https://ubuntu.com/security/notices/USN-8883-1", "https://ubuntu.com/security/notices/USN-8883-2", "https://ubuntu.com/security/notices/USN-8900-1", "https://ubuntu.com/security/notices/USN-8914-1", "https://www.cve.org/CVERecord?id=CVE-2026-39821" ], "PublishedDate": "2026-05-22T16:16:20.41Z", "LastModifiedDate": "2026-09-17T12:18:05.767Z" }, { "VulnerabilityID": "CVE-2026-46600", "VendorIDs": [ "GO-2026-5942" ], "PkgID": "golang.org/x/net@v0.53.0", "PkgName": "golang.org/x/net", "PkgIdentifier": { "PURL": "pkg:golang/golang.org/x/net@v0.53.0", "UID": "a5e3f765714179cd" }, "InstalledVersion": "v0.53.0", "FixedVersion": "0.56.0", "Status": "fixed", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-46600", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:6a6e8d29e7b9b8ffdd5a1bff957c755bfb351511129011277ec9f44480a12b35", "Title": "golang.org/x/net/dns/dnsmessage: golang.org/x/net/dns/dnsmessage: Denial of Service via invalid DNS record parsing", "Description": "Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer.", "Severity": "HIGH", "CweIDs": [ "CWE-125" ], "VendorSeverity": { "azure": 2, "bitnami": 3, "redhat": 3 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-46600", "https://go.dev/cl/786345", "https://go.dev/issue/79795", "https://groups.google.com/g/golang-announce/c/94pEornpRlI", "https://nvd.nist.gov/vuln/detail/CVE-2026-46600", "https://pkg.go.dev/vuln/GO-2026-5942", "https://www.cve.org/CVERecord?id=CVE-2026-46600" ], "PublishedDate": "2026-07-21T20:17:01.213Z", "LastModifiedDate": "2026-10-24T19:10:00.127Z" }, { "VulnerabilityID": "CVE-2026-78661", "VendorIDs": [ "GO-2026-6860" ], "PkgID": "golang.org/x/net@v0.53.0", "PkgName": "golang.org/x/net", "PkgIdentifier": { "PURL": "pkg:golang/golang.org/x/net@v0.53.0", "UID": "a5e3f765714179cd" }, "InstalledVersion": "v0.53.0", "FixedVersion": "0.62.0", "Status": "fixed", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78661", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:af7002f4522296ad9ee7e8e1c7008b4017688594a6f57796a6abe178956add65", "Title": "golang.org/x/net/html: golang.org/x/net/html: Denial of Service via crafted HTML input", "Description": "When coalescing adjacent text nodes in addText and fosterParent, appending to an existing TextNode's Data via string concatenation (n.Data += text) reallocated and copied the accumulated string on every token. Inputs containing many short text runs separated by ignored end tags (such as \"a\u003c/x\u003e\") caused O(n^2) allocations and byte copies. Accumulate coalesced text in per-node byte slices during parsing and materialize Data strings once at the end of parse.", "Severity": "HIGH", "CweIDs": [ "CWE-407" ], "VendorSeverity": { "redhat": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-78661", "https://go.dev/cl/849365", "https://go.dev/issue/82224", "https://groups.google.com/g/golang-announce/c/sqrs2vTx_Xs", "https://nvd.nist.gov/vuln/detail/CVE-2026-78661", "https://pkg.go.dev/vuln/GO-2026-6860", "https://www.cve.org/CVERecord?id=CVE-2026-78661" ], "PublishedDate": "2026-10-27T22:18:05.93Z", "LastModifiedDate": "2026-11-04T17:17:37.673Z" }, { "VulnerabilityID": "CVE-2026-78669", "VendorIDs": [ "GO-2026-6611" ], "PkgID": "golang.org/x/net@v0.53.0", "PkgName": "golang.org/x/net", "PkgIdentifier": { "PURL": "pkg:golang/golang.org/x/net@v0.53.0", "UID": "a5e3f765714179cd" }, "InstalledVersion": "v0.53.0", "FixedVersion": "0.60.0", "Status": "fixed", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78669", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:fb403ee115ef12aef1b4105ffd7ea42016eb6263f9f077087237511d254648df", "Title": "net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive HTTP/2 SETTINGS frames", "Description": "A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values.", "Severity": "HIGH", "CweIDs": [ "CWE-405" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "bitnami": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93617", "https://access.redhat.com/security/cve/CVE-2026-78669", "https://bugzilla.redhat.com/2548334", "https://bugzilla.redhat.com/2548336", "https://bugzilla.redhat.com/2548341", "https://bugzilla.redhat.com/2548344", "https://bugzilla.redhat.com/2556068", "https://bugzilla.redhat.com/show_bug.cgi?id=2548334", "https://bugzilla.redhat.com/show_bug.cgi?id=2548336", "https://bugzilla.redhat.com/show_bug.cgi?id=2548341", "https://bugzilla.redhat.com/show_bug.cgi?id=2548344", "https://bugzilla.redhat.com/show_bug.cgi?id=2556068", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-111943", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78667", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78669", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-94440", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-97031", "https://errata.almalinux.org/9/ALSA-2026-93617.html", "https://errata.rockylinux.org/RLSA-2026:93617", "https://github.com/golang/go/issues/81742", "https://go.dev/cl/847186", "https://go.dev/cl/847308", "https://go.dev/issue/81742", "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI", "https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs", "https://linux.oracle.com/cve/CVE-2026-78669.html", "https://linux.oracle.com/errata/ELSA-2026-95519.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-78669", "https://pkg.go.dev/vuln/GO-2026-6611", "https://ubuntu.com/security/notices/USN-8935-1", "https://www.cve.org/CVERecord?id=CVE-2026-78669", "https://www.openwall.com/lists/oss-security/2026/10/08/9" ], "PublishedDate": "2026-10-08T23:17:04.01Z", "LastModifiedDate": "2026-10-09T17:16:49.857Z" }, { "VulnerabilityID": "CVE-2026-56851", "VendorIDs": [ "GO-2026-6629" ], "PkgID": "golang.org/x/text@v0.36.0", "PkgName": "golang.org/x/text", "PkgIdentifier": { "PURL": "pkg:golang/golang.org/x/text@v0.36.0", "UID": "bef56439b881a874" }, "InstalledVersion": "v0.36.0", "FixedVersion": "0.41.0", "Status": "fixed", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-56851", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:f44f930bc4c9313b1c662849eb0d2222e2bc68e6aca5c3e3082da258bb5bd44f", "Title": "golang.org/x/text: golang.org/x/text: Denial of Service via out-of-bounds slice error in Nickname profile", "Description": "The Nickname profile can panic with an out-of-bounds slice error when transforming crafted input into a short destination buffer.", "Severity": "HIGH", "CweIDs": [ "CWE-787" ], "VendorSeverity": { "azure": 3, "redhat": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-56851", "https://go.dev/cl/793360", "https://go.dev/issue/80112", "https://nvd.nist.gov/vuln/detail/CVE-2026-56851", "https://pkg.go.dev/vuln/GO-2026-6629", "https://www.cve.org/CVERecord?id=CVE-2026-56851" ], "PublishedDate": "2026-10-07T18:17:20.903Z", "LastModifiedDate": "2026-10-08T21:35:53.89Z" }, { "VulnerabilityID": "CVE-2026-56852", "VendorIDs": [ "GO-2026-5970" ], "PkgID": "golang.org/x/text@v0.36.0", "PkgName": "golang.org/x/text", "PkgIdentifier": { "PURL": "pkg:golang/golang.org/x/text@v0.36.0", "UID": "bef56439b881a874" }, "InstalledVersion": "v0.36.0", "FixedVersion": "0.39.0", "Status": "fixed", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-56852", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:dce97beb5b424cf973a81d70f2023749232b0ba6379c84251fc059248c9bbd92", "Title": "golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input", "Description": "A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes.", "Severity": "HIGH", "CweIDs": [ "CWE-835" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:70201", "https://access.redhat.com/security/cve/CVE-2026-56852", "https://bugzilla.redhat.com/2456335", "https://bugzilla.redhat.com/2467809", "https://bugzilla.redhat.com/2504233", "https://bugzilla.redhat.com/2508234", "https://bugzilla.redhat.com/2515815", "https://bugzilla.redhat.com/2515820", "https://bugzilla.redhat.com/2515827", "https://bugzilla.redhat.com/2515838", "https://bugzilla.redhat.com/2515839", "https://bugzilla.redhat.com/2515840", "https://bugzilla.redhat.com/show_bug.cgi?id=2456335", "https://bugzilla.redhat.com/show_bug.cgi?id=2467809", "https://bugzilla.redhat.com/show_bug.cgi?id=2504233", "https://bugzilla.redhat.com/show_bug.cgi?id=2508234", "https://bugzilla.redhat.com/show_bug.cgi?id=2515815", "https://bugzilla.redhat.com/show_bug.cgi?id=2515820", "https://bugzilla.redhat.com/show_bug.cgi?id=2515827", "https://bugzilla.redhat.com/show_bug.cgi?id=2515838", "https://bugzilla.redhat.com/show_bug.cgi?id=2515839", "https://bugzilla.redhat.com/show_bug.cgi?id=2515840", "https://bugzilla.redhat.com/show_bug.cgi?id=2518147", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-17106", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-19730", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33810", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42499", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56852", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56859", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862", "https://errata.almalinux.org/10/ALSA-2026-70201.html", "https://errata.rockylinux.org/RLSA-2026:70201", "https://go.dev/cl/794100", "https://go.dev/issue/80142", "https://linux.oracle.com/cve/CVE-2026-56852.html", "https://linux.oracle.com/errata/ELSA-2026-70201.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-56852", "https://pkg.go.dev/vuln/GO-2026-5970", "https://www.cve.org/CVERecord?id=CVE-2026-56852" ], "PublishedDate": "2026-07-21T20:17:02.867Z", "LastModifiedDate": "2026-10-24T19:10:00.127Z" }, { "VulnerabilityID": "CVE-2026-84304", "VendorIDs": [ "GHSA-vp52-pcj8-j9qc" ], "PkgID": "google.golang.org/grpc@v1.79.3", "PkgName": "google.golang.org/grpc", "PkgIdentifier": { "PURL": "pkg:golang/google.golang.org/grpc@v1.79.3", "UID": "3220fe69c7d38e52" }, "InstalledVersion": "v1.79.3", "FixedVersion": "1.83.1", "Status": "fixed", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-84304", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory Go", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Ago" }, "Fingerprint": "sha256:0aa460bc519770e67fb470248818de3dbd84083d0ce9b287413ee8a33b4f66e3", "Title": "google.golang.org/grpc: gRPC-Go: Denial of Service via HTTP/2 DATA Frame Fragmentation", "Description": "gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, internal/transport/transport.go stores each fragmented HTTP/2 DATA frame as a separate recvMsg in recvBuffer, so millions of one-byte frames can consume disproportionate heap memory even when payload bytes remain within connection and stream flow-control windows. An unauthenticated remote attacker can use concurrent multiplexed streams to exhaust process memory and cause a runtime panic or out-of-memory termination. Receive-buffer compaction is enabled by default and can be controlled temporarily with GRPC_GO_EXPERIMENTAL_ENABLE_RECEIVE_BUFFER_COMPACTION. This issue is fixed in version 1.83.1.", "Severity": "HIGH", "CweIDs": [ "CWE-400" ], "VendorSeverity": { "azure": 3, "ghsa": 3, "redhat": 3 }, "CVSS": { "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 8.7 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-84304", "https://github.com/grpc/grpc-go", "https://github.com/grpc/grpc-go/commit/7354d9c8debb4bcf2225bf429857078de310c176", "https://github.com/grpc/grpc-go/commit/8cfeca0e1ee5ea0980dcc320e20240fa1079ec77", "https://github.com/grpc/grpc-go/pull/9331", "https://github.com/grpc/grpc-go/pull/9333", "https://github.com/grpc/grpc-go/releases/tag/v1.83.1", "https://github.com/grpc/grpc-go/security/advisories/GHSA-vp52-pcj8-j9qc", "https://nvd.nist.gov/vuln/detail/CVE-2026-84304", "https://www.cve.org/CVERecord?id=CVE-2026-84304" ], "PublishedDate": "2026-09-01T19:17:30.743Z", "LastModifiedDate": "2026-09-09T21:09:13.08Z" }, { "VulnerabilityID": "CVE-2026-84445", "VendorIDs": [ "GHSA-2v4p-qf9q-27wj" ], "PkgID": "google.golang.org/grpc@v1.79.3", "PkgName": "google.golang.org/grpc", "PkgIdentifier": { "PURL": "pkg:golang/google.golang.org/grpc@v1.79.3", "UID": "3220fe69c7d38e52" }, "InstalledVersion": "v1.79.3", "FixedVersion": "1.82.2, 1.83.2, 1.84.0-dev.0.20260825144003-d5a41119e0e3, 1.85.0-dev.0.20260825072537-93e31b48545e", "Status": "fixed", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-84445", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory Go", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Ago" }, "Fingerprint": "sha256:3be64670cc37eb3691cc2c3181caab140d06180b0ac376a6ae9e0c7af9e55103", "Title": "google.golang.org/grpc: gRPC-Go: Denial of Service via malformed RPC requests", "Description": "gRPC-Go is the Go language implementation of gRPC. Prior to 1.82.2 and 1.83.2, servers created with xds.NewGRPCServer() allow internal/transport/http2_server.go to accept an RPC containing neither the :authority header nor the Host header, while RouteAndProcess in internal/xds/server/routing.go assumes that an authority value exists and indexes the empty slice. A remote client that can complete transport connection establishment can trigger an index-out-of-bounds panic that is not recovered by the per-RPC goroutine and terminates the entire server process. In insecure or ordinary TLS deployments the request can be unauthenticated, while strict mTLS or ALTS deployments require valid transport credentials before the malformed RPC can reach the interceptor. This issue is fixed in versions 1.82.2 and 1.83.2.", "Severity": "HIGH", "CweIDs": [ "CWE-129", "CWE-248" ], "VendorSeverity": { "alma": 3, "azure": 3, "ghsa": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "V40Score": 8.7 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:76744", "https://access.redhat.com/errata/RHSA-2026:95272", "https://access.redhat.com/security/cve/CVE-2026-84445", "https://bugzilla.redhat.com/2533175", "https://bugzilla.redhat.com/show_bug.cgi?id=2533175", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-84445", "https://errata.almalinux.org/9/ALSA-2026-76744.html", "https://errata.rockylinux.org/RLSA-2026:95272", "https://github.com/grpc/grpc-go", "https://github.com/grpc/grpc-go/commit/3822494d8ea03b992c089fd2a195f041762fffb7", "https://github.com/grpc/grpc-go/commit/8668b69c167df908b6b3666dcbf40992b9e932a4", "https://github.com/grpc/grpc-go/commit/93e31b48545e2a8aaeb6e06b47fb249f94e6297f", "https://github.com/grpc/grpc-go/issues/9354", "https://github.com/grpc/grpc-go/pull/9365", "https://github.com/grpc/grpc-go/pull/9366", "https://github.com/grpc/grpc-go/pull/9367", "https://github.com/grpc/grpc-go/releases/tag/v1.82.2", "https://github.com/grpc/grpc-go/releases/tag/v1.83.2", "https://github.com/grpc/grpc-go/security/advisories/GHSA-2v4p-qf9q-27wj", "https://nvd.nist.gov/vuln/detail/CVE-2026-84445", "https://www.cve.org/CVERecord?id=CVE-2026-84445" ], "PublishedDate": "2026-09-14T17:17:51.743Z", "LastModifiedDate": "2026-09-25T14:10:13.927Z" }, { "VulnerabilityID": "GHSA-hrxh-6v49-42gf", "PkgID": "google.golang.org/grpc@v1.79.3", "PkgName": "google.golang.org/grpc", "PkgIdentifier": { "PURL": "pkg:golang/google.golang.org/grpc@v1.79.3", "UID": "3220fe69c7d38e52" }, "InstalledVersion": "v1.79.3", "FixedVersion": "1.82.1", "Status": "fixed", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "SeveritySource": "ghsa", "PrimaryURL": "https://github.com/advisories/GHSA-hrxh-6v49-42gf", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory Go", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Ago" }, "Fingerprint": "sha256:2f89e6d64a2873f3aa23b97fc93e52f2a8a8950276b0908299c597e7c7b02969", "Title": "gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities", "Description": "Multiple security vulnerabilities have been identified and addressed in grpc-go affecting the xDS RBAC authorization engine (internal/xds/rbac) and the HTTP/2 transport server implementation (internal/transport). These vulnerabilities could result in:\n\n- Authorization Bypass (Fail-Open) when translating xDS RBAC policies containing `Metadata` or `RequestedServerName` fields.\n- Denial of Service (High CPU Consumption) due to an HTTP/2 Rapid Reset mitigation bypass during client-initiated stream resets.\n- Denial of Service (Server Panic) when parsing crafted xDS RBAC policies containing `NOT` rules around unsupported fields.\n\n\n### Impact\n_What kind of vulnerability is it? Who is impacted?_\n\n#### xDS RBAC Authorization Bypass via `Metadata` \u0026 `RequestedServerName` matchers\n\n- Affected Component: xDS RBAC \n- Impact: When building policy matchers for gRPC RBAC from xDS configurations, unsupported `permission` and `principal` rules (specifically `Metadata` and `RequestedServerName`) were silently ignored and treated as no-ops.\n - If an authorization policy relied purely on these matchers for access control, treating those rules as no-ops effectively removed the restrictions.\n- If these unsupported rules were nested inside logical `NOT` rules (`Permission_NotRule` / `Principal_NotId`) or multi-condition `OR/AND` rules, silently dropping them changed the boolean logic flow of the authorization engine.\n\nAs a result, policy evaluation decisions could fail open, allowing unauthorized clients to access protected gRPC services or resources.\n\n#### HTTP/2 Rapid Reset Mitigation Bypass / Denial of Service via Stream Aborts\n\n- Affected Component: HTTP/2 transport\n- Impact: Earlier mitigations in grpc-go for HTTP/2 Rapid Reset only applied threshold checks to items that directly resulted in control frames being written back to the wire, such as `SETTINGS` ACKs or server-initiated `RST_STREAM`s.\n\nWhen a client initiated a rapid flood of stream creation (`HEADERS`) immediately followed by stream termination `RST_STREAM`, items queued up in the control buffer without counting against the transport response frame threshold. An attacker can repeatedly trigger this flood sequence to bypass reader blocking, resulting in high CPU usage, and Denial of Service (DoS).\n\n#### Denial of Service (Panic) in xDS RBAC Engine via Unsupported Fields inside NOT Rules\n\n- Affected Component: xDS RBAC \n- Impact: The xDS RBAC policy translators recursively generate matchers for nested rules. When a `NOT` rule wrapped an unsupported or unhandled field (such as `SourcedMetadata`), the recursive step returned an empty matcher. This could result in a runtime panic when the RBAC engine attempts to authorize an incoming request.\n\nAn attacker or misconfigured/malicious xDS management server delivering an LDS/RDS update containing a `NOT` rule around an unhandled field causes the gRPC server process to crash immediately (CWE-248 / Denial of Service).\n\n### Patches\n_Has the problem been patched? What versions should users upgrade to?_\n\nAll three issues have been fixed in `master` and will be released in 1.82.1 shortly.\n\n### Workarounds\n_Is there a way for users to fix or remediate the vulnerability without upgrading?_\n\nIf upgrading grpc-go immediately is not possible, apply the following workarounds based on your deployment architecture:\n\n* For xDS RBAC Vulnerabilities \u0026 Panics: Ensure that upstream xDS management servers do not push RBAC policies containing `Metadata`, `RequestedServerName`, or `NOT` rules wrapping unsupported fields (such as `SourcedMetadata`) to grpc-go servers.\n* For HTTP/2 Rapid Reset DOS: Configure upstream reverse proxies or load balancers (such as Envoy) with strict HTTP/2 `max_concurrent_streams` limits and active rate limiting on `RST_STREAM` frequency per connection.\n\n### Severity\n\n | Vulnerability | Qualitative Severity | Approximate CVSS v3.1 Score | Primary Impact |\n | :--- | :--- | :--- | :--- |\n | **xDS RBAC Authorization Bypass** | **High** | `8.2` | Unauthorized Access / Fail-Open |\n | **HTTP/2 Rapid Reset DOS Bypass** | **High** | `7.5` | High CPU Consumption / Denial of Service |\n | **xDS RBAC Engine Server Panic** | **Medium** | `5.9` | Process Crash / Denial of Service |", "Severity": "HIGH", "VendorSeverity": { "ghsa": 3 }, "CVSS": { "ghsa": { "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N", "V40Score": 8.8 } }, "References": [ "https://github.com/grpc/grpc-go", "https://github.com/grpc/grpc-go/commit/4ea465d4ab98013f72a142fe0fc89c19770b2935", "https://github.com/grpc/grpc-go/pull/9236", "https://github.com/grpc/grpc-go/releases/tag/v1.82.1", "https://github.com/grpc/grpc-go/security/advisories/GHSA-hrxh-6v49-42gf" ], "PublishedDate": "2026-07-21T22:03:55Z", "LastModifiedDate": "2026-07-21T22:03:56Z" }, { "VulnerabilityID": "CVE-2026-50151", "VendorIDs": [ "GHSA-jxpm-75mh-9fp7" ], "PkgID": "oras.land/oras-go/v2@v2.6.0", "PkgName": "oras.land/oras-go/v2", "PkgIdentifier": { "PURL": "pkg:golang/oras.land/oras-go/v2@v2.6.0", "UID": "7e5aa3baf9c41f95" }, "InstalledVersion": "v2.6.0", "FixedVersion": "2.6.1", "Status": "fixed", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-50151", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory Go", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Ago" }, "Fingerprint": "sha256:15a81f7f20565309dd7d5d8b64d9434b3b513d588128ddba6d33a5326a4f6fdd", "Title": "oras-go: oras-go: Credential forwarding via unvalidated Location header during blob upload", "Description": "oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, registry/remote/repository.go in blobStore.completePushAfterInitialPost follows a registry-controlled Location header during monolithic blob upload and reuses the Authorization header from the initial POST request for the subsequent PUT request, allowing a malicious registry to return a cross-host Location and receive the caller's credentials at an attacker-controlled endpoint. This issue is fixed in version 2.6.1.", "Severity": "HIGH", "CweIDs": [ "CWE-918" ], "VendorSeverity": { "ghsa": 3, "redhat": 2 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "V3Score": 5.9 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-50151", "https://github.com/oras-project/oras-go", "https://github.com/oras-project/oras-go/commit/4683c46ef078091544f5f55fd25102f002806991", "https://github.com/oras-project/oras-go/pull/1152", "https://github.com/oras-project/oras-go/releases/tag/v2.6.1", "https://github.com/oras-project/oras-go/security/advisories/GHSA-jxpm-75mh-9fp7", "https://nvd.nist.gov/vuln/detail/CVE-2026-50151", "https://www.cve.org/CVERecord?id=CVE-2026-50151" ], "PublishedDate": "2026-07-17T20:17:23.683Z", "LastModifiedDate": "2026-10-24T20:10:00.137Z" }, { "VulnerabilityID": "CVE-2026-50163", "VendorIDs": [ "GHSA-fxhp-mv3v-67qp" ], "PkgID": "oras.land/oras-go/v2@v2.6.0", "PkgName": "oras.land/oras-go/v2", "PkgIdentifier": { "PURL": "pkg:golang/oras.land/oras-go/v2@v2.6.0", "UID": "7e5aa3baf9c41f95" }, "InstalledVersion": "v2.6.0", "FixedVersion": "2.6.2", "Status": "fixed", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-50163", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory Go", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Ago" }, "Fingerprint": "sha256:365dbb081f1e1bb13b08526b4fea8e8c6edf064f04793af733c9493672ed7686", "Title": "oras-go: Oras-go: Information disclosure and arbitrary file access via crafted tarball hardlinks", "Description": "oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, ensureLinkPath in content/file/utils.go:262-275 validates a hardlink target relative to the extract base but returns the unresolved target, causing os.Link(\"victim.secret\", \"\u003cextract_base\u003e/payload.tar.gz/evil_cwd_link\") to resolve header.Linkname against the process current working directory for a Typeflag=TypeLink entry such as Name=payload.tar.gz/evil_cwd_link and Linkname=\"victim.secret\" with io.deis.oras.content.unpack: \"true\", which can expose or tamper with files such as .env, .git/config, .aws/credentials, and ~/.ssh/config. This issue is fixed in version 2.6.2.", "Severity": "HIGH", "CweIDs": [ "CWE-22", "CWE-59" ], "VendorSeverity": { "ghsa": 3, "redhat": 2 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N", "V3Score": 7.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N", "V3Score": 5.9 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-50163", "https://github.com/oras-project/oras-go", "https://github.com/oras-project/oras-go/commit/b11f777f8d405c5023c4b307cfdc5068dfc3d406", "https://github.com/oras-project/oras-go/commit/c463c654ab3ef34422c1764cd619806cebf20451", "https://github.com/oras-project/oras-go/pull/1232", "https://github.com/oras-project/oras-go/releases/tag/v2.6.2", "https://github.com/oras-project/oras-go/security/advisories/GHSA-fxhp-mv3v-67qp", "https://nvd.nist.gov/vuln/detail/CVE-2026-50163", "https://www.cve.org/CVERecord?id=CVE-2026-50163" ], "PublishedDate": "2026-07-17T20:17:23.943Z", "LastModifiedDate": "2026-10-24T20:10:00.137Z" }, { "VulnerabilityID": "CVE-2026-85731", "VendorIDs": [ "GHSA-m37j-52j7-pjw7" ], "PkgID": "oras.land/oras-go/v2@v2.6.0", "PkgName": "oras.land/oras-go/v2", "PkgIdentifier": { "PURL": "pkg:golang/oras.land/oras-go/v2@v2.6.0", "UID": "7e5aa3baf9c41f95" }, "InstalledVersion": "v2.6.0", "FixedVersion": "2.6.2", "Status": "fixed", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-85731", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory Go", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Ago" }, "Fingerprint": "sha256:bb053555b8d4d57393b834825c08925903818dc630d2d25f5a5c7a07c53aee17", "Title": "github.com/oras-project/oras-go: oras-go: Arbitrary file write and code execution via symlink-chain bypass", "Description": "oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, content/file.Store extraction of OCI layers marked with io.deis.oras.content.unpack=true can write outside the store working directory. The pushDir path through extractTarDirectory and ensureLinkPath validates symlink targets lexically, resolveRelToBase skips its parent-symlink walk for root-level entries, and writeFile follows a terminal symlink when opening a regular file. A malicious archive can therefore create a symlink chain whose lexical target remains inside the extraction root but whose resolved target is an attacker-selected absolute path, then overwrite that target with a same-named regular-file entry even when AllowPathTraversalOnWrite is false. Pulling an attacker-controlled artifact can create or overwrite any file writable by the process and may lead to code execution. This issue is fixed in version 2.6.2.", "Severity": "HIGH", "CweIDs": [ "CWE-22", "CWE-59" ], "VendorSeverity": { "ghsa": 3, "redhat": 3 }, "CVSS": { "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 8.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "V3Score": 8.8 } }, "References": [ "https://access.redhat.com/security/cve/CVE-2026-85731", "https://github.com/oras-project/oras-go", "https://github.com/oras-project/oras-go/commit/adab2f25ea95ef4e6e41f50db9266a6701399422", "https://github.com/oras-project/oras-go/releases/tag/v2.6.2", "https://github.com/oras-project/oras-go/security/advisories/GHSA-m37j-52j7-pjw7", "https://nvd.nist.gov/vuln/detail/CVE-2026-85731", "https://www.cve.org/CVERecord?id=CVE-2026-85731" ], "PublishedDate": "2026-09-16T17:18:15.833Z", "LastModifiedDate": "2026-09-16T18:17:17.963Z" }, { "VulnerabilityID": "CVE-2026-111943", "VendorIDs": [ "GO-2026-6809" ], "PkgID": "stdlib@v1.25.9", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.25.9", "UID": "2185fb41a98d095a" }, "InstalledVersion": "v1.25.9", "FixedVersion": "1.26.10, 1.27.3", "Status": "fixed", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-111943", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:678cdcd9c0b45b0077ae1908e11437b7bee34a331edabbdbbcbd3672827a19e8", "Title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "Description": "On most platforms, Go uses the given system root certificates. However, in some narrower cases, the system trust stores may not be updated without further action. To defend against the narrower set of cases that may remain affected, a denylist was added in crypto/x509 to return an error when calling Verify with any of the known intermediate certificates that are no longer considered to be trustworthy.", "Severity": "HIGH", "CweIDs": [ "CWE-299" ], "VendorSeverity": { "alma": 3, "amazon": 2, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N", "V3Score": 6.8 } }, "References": [ "http://www.openwall.com/lists/oss-security/2026/10/20/29", "https://access.redhat.com/errata/RHSA-2026:95518", "https://access.redhat.com/security/cve/CVE-2026-111943", "https://bugzilla.redhat.com/2548336", "https://bugzilla.redhat.com/2556068", "https://bugzilla.redhat.com/show_bug.cgi?id=2548336", "https://bugzilla.redhat.com/show_bug.cgi?id=2556068", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-111943", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-97031", "https://errata.almalinux.org/9/ALSA-2026-95518.html", "https://errata.rockylinux.org/RLSA-2026:95518", "https://github.com/golang/go/issues/82345", "https://go.dev/cl/851047", "https://go.dev/issue/82345", "https://groups.google.com/g/golang-announce/c/66pojueaQek", "https://groups.google.com/g/golang-nuts/c/K22sG2AYnKU", "https://linux.oracle.com/cve/CVE-2026-111943.html", "https://linux.oracle.com/errata/ELSA-2026-95519.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-111943", "https://pkg.go.dev/vuln/GO-2026-6809", "https://www.cve.org/CVERecord?id=CVE-2026-111943" ], "PublishedDate": "2026-10-21T01:17:20.797Z", "LastModifiedDate": "2026-10-30T13:18:28.74Z" }, { "VulnerabilityID": "CVE-2026-27145", "VendorIDs": [ "GO-2026-5037" ], "PkgID": "stdlib@v1.25.9", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.25.9", "UID": "2185fb41a98d095a" }, "InstalledVersion": "v1.25.9", "FixedVersion": "1.25.11, 1.26.4", "Status": "fixed", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-27145", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:484b77088ed8ff757f1760ce483adfa3afc03fb128ef10b6605fd178faf29c41", "Title": "crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries", "Description": "(*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries. This caused strings.Split(host, \".\") to execute repeatedly on the same input hostname. With a large DNS SAN list, verification costs scaled quadratically based on the number of SAN entries multiplied by the hostname's label count. Because x509.Verify validates hostnames before building the certificate chain, this overhead occurred even for untrusted certificates.", "Severity": "HIGH", "CweIDs": [ "CWE-606" ], "VendorSeverity": { "alma": 3, "amazon": 2, "azure": 2, "bitnami": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:23262", "https://access.redhat.com/errata/RHSA-2026:23264", "https://access.redhat.com/errata/RHSA-2026:29980", "https://access.redhat.com/errata/RHSA-2026:29981", "https://access.redhat.com/errata/RHSA-2026:33574", "https://access.redhat.com/errata/RHSA-2026:34357", "https://access.redhat.com/errata/RHSA-2026:34359", "https://access.redhat.com/errata/RHSA-2026:35832", "https://access.redhat.com/errata/RHSA-2026:36317", "https://access.redhat.com/errata/RHSA-2026:36648", "https://access.redhat.com/errata/RHSA-2026:36797", "https://access.redhat.com/errata/RHSA-2026:38995", "https://access.redhat.com/errata/RHSA-2026:39005", "https://access.redhat.com/errata/RHSA-2026:39573", "https://access.redhat.com/errata/RHSA-2026:39879", "https://access.redhat.com/errata/RHSA-2026:41030", "https://access.redhat.com/errata/RHSA-2026:41036", "https://access.redhat.com/errata/RHSA-2026:41930", "https://access.redhat.com/errata/RHSA-2026:42043", "https://access.redhat.com/errata/RHSA-2026:42047", "https://access.redhat.com/errata/RHSA-2026:42049", "https://access.redhat.com/errata/RHSA-2026:42050", "https://access.redhat.com/errata/RHSA-2026:42051", "https://access.redhat.com/errata/RHSA-2026:42079", "https://access.redhat.com/errata/RHSA-2026:42080", "https://access.redhat.com/errata/RHSA-2026:42082", "https://access.redhat.com/errata/RHSA-2026:42142", "https://access.redhat.com/errata/RHSA-2026:42150", "https://access.redhat.com/errata/RHSA-2026:42151", "https://access.redhat.com/errata/RHSA-2026:42240", "https://access.redhat.com/errata/RHSA-2026:42644", "https://access.redhat.com/errata/RHSA-2026:42946", "https://access.redhat.com/errata/RHSA-2026:44622", "https://access.redhat.com/errata/RHSA-2026:46394", "https://access.redhat.com/errata/RHSA-2026:46395", "https://access.redhat.com/errata/RHSA-2026:47149", "https://access.redhat.com/errata/RHSA-2026:47735", "https://access.redhat.com/errata/RHSA-2026:47737", "https://access.redhat.com/errata/RHSA-2026:49702", "https://access.redhat.com/errata/RHSA-2026:49703", "https://access.redhat.com/errata/RHSA-2026:49705", "https://access.redhat.com/errata/RHSA-2026:49712", "https://access.redhat.com/errata/RHSA-2026:49729", "https://access.redhat.com/errata/RHSA-2026:49744", "https://access.redhat.com/errata/RHSA-2026:49765", "https://access.redhat.com/errata/RHSA-2026:49770", "https://access.redhat.com/errata/RHSA-2026:50205", "https://access.redhat.com/errata/RHSA-2026:50319", "https://access.redhat.com/errata/RHSA-2026:51057", "https://access.redhat.com/errata/RHSA-2026:51187", "https://access.redhat.com/errata/RHSA-2026:52946", "https://access.redhat.com/errata/RHSA-2026:53374", "https://access.redhat.com/errata/RHSA-2026:53412", "https://access.redhat.com/errata/RHSA-2026:53413", "https://access.redhat.com/errata/RHSA-2026:53415", "https://access.redhat.com/errata/RHSA-2026:53416", "https://access.redhat.com/errata/RHSA-2026:53530", "https://access.redhat.com/errata/RHSA-2026:54168", "https://access.redhat.com/errata/RHSA-2026:54401", "https://access.redhat.com/errata/RHSA-2026:54427", "https://access.redhat.com/errata/RHSA-2026:54432", "https://access.redhat.com/errata/RHSA-2026:54435", "https://access.redhat.com/errata/RHSA-2026:54441", "https://access.redhat.com/errata/RHSA-2026:54500", "https://access.redhat.com/errata/RHSA-2026:54525", "https://access.redhat.com/errata/RHSA-2026:54531", "https://access.redhat.com/errata/RHSA-2026:54603", "https://access.redhat.com/errata/RHSA-2026:54757", "https://access.redhat.com/errata/RHSA-2026:55899", "https://access.redhat.com/errata/RHSA-2026:57194", "https://access.redhat.com/errata/RHSA-2026:57482", "https://access.redhat.com/errata/RHSA-2026:57488", "https://access.redhat.com/errata/RHSA-2026:57649", "https://access.redhat.com/errata/RHSA-2026:59556", "https://access.redhat.com/errata/RHSA-2026:59557", "https://access.redhat.com/errata/RHSA-2026:59558", "https://access.redhat.com/errata/RHSA-2026:59559", "https://access.redhat.com/errata/RHSA-2026:59579", "https://access.redhat.com/errata/RHSA-2026:59593", "https://access.redhat.com/errata/RHSA-2026:60025", "https://access.redhat.com/errata/RHSA-2026:60315", "https://access.redhat.com/errata/RHSA-2026:60354", "https://access.redhat.com/errata/RHSA-2026:60386", "https://access.redhat.com/errata/RHSA-2026:60387", "https://access.redhat.com/errata/RHSA-2026:60388", "https://access.redhat.com/errata/RHSA-2026:60390", "https://access.redhat.com/errata/RHSA-2026:60391", "https://access.redhat.com/errata/RHSA-2026:61253", "https://access.redhat.com/errata/RHSA-2026:61314", "https://access.redhat.com/errata/RHSA-2026:63016", "https://access.redhat.com/errata/RHSA-2026:66022", "https://access.redhat.com/errata/RHSA-2026:68334", "https://access.redhat.com/errata/RHSA-2026:68335", "https://access.redhat.com/security/cve/CVE-2026-27145", "https://bugzilla.redhat.com/2445356", "https://bugzilla.redhat.com/2484207", "https://bugzilla.redhat.com/show_bug.cgi?id=2445356", "https://bugzilla.redhat.com/show_bug.cgi?id=2484207", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25679", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27145", "https://errata.almalinux.org/9/ALSA-2026-36317.html", "https://errata.rockylinux.org/RLSA-2026:36317", "https://go.dev/cl/783621", "https://go.dev/issue/79694", "https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw", "https://linux.oracle.com/cve/CVE-2026-27145.html", "https://linux.oracle.com/errata/ELSA-2026-53416.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-27145", "https://pkg.go.dev/vuln/GO-2026-5037", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27145.json", "https://www.cve.org/CVERecord?id=CVE-2026-27145" ], "PublishedDate": "2026-06-02T23:16:35.57Z", "LastModifiedDate": "2026-09-18T13:17:43.283Z" }, { "VulnerabilityID": "CVE-2026-33811", "VendorIDs": [ "GO-2026-4981" ], "PkgID": "stdlib@v1.25.9", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.25.9", "UID": "2185fb41a98d095a" }, "InstalledVersion": "v1.25.9", "FixedVersion": "1.25.10, 1.26.3", "Status": "fixed", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-33811", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:80fe5d6c37ba900e50125319fa65c4f5a98f7d9da6ea376c4582fba36ff641ff", "Title": "net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME", "Description": "When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash.", "Severity": "HIGH", "CweIDs": [ "CWE-415", "CWE-1341" ], "VendorSeverity": { "alma": 3, "amazon": 3, "bitnami": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:22112", "https://access.redhat.com/errata/RHSA-2026:22120", "https://access.redhat.com/errata/RHSA-2026:22121", "https://access.redhat.com/errata/RHSA-2026:23262", "https://access.redhat.com/errata/RHSA-2026:23264", "https://access.redhat.com/errata/RHSA-2026:33120", "https://access.redhat.com/errata/RHSA-2026:33123", "https://access.redhat.com/errata/RHSA-2026:33142", "https://access.redhat.com/errata/RHSA-2026:33150", "https://access.redhat.com/errata/RHSA-2026:33574", "https://access.redhat.com/errata/RHSA-2026:34357", "https://access.redhat.com/errata/RHSA-2026:34359", "https://access.redhat.com/errata/RHSA-2026:34364", "https://access.redhat.com/errata/RHSA-2026:35832", "https://access.redhat.com/errata/RHSA-2026:35993", "https://access.redhat.com/errata/RHSA-2026:35994", "https://access.redhat.com/errata/RHSA-2026:35995", "https://access.redhat.com/errata/RHSA-2026:36207", "https://access.redhat.com/errata/RHSA-2026:36319", "https://access.redhat.com/errata/RHSA-2026:36617", "https://access.redhat.com/errata/RHSA-2026:36625", "https://access.redhat.com/errata/RHSA-2026:36648", "https://access.redhat.com/errata/RHSA-2026:36651", "https://access.redhat.com/errata/RHSA-2026:36776", "https://access.redhat.com/errata/RHSA-2026:36796", "https://access.redhat.com/errata/RHSA-2026:36797", "https://access.redhat.com/errata/RHSA-2026:38504", "https://access.redhat.com/errata/RHSA-2026:39266", "https://access.redhat.com/errata/RHSA-2026:39272", "https://access.redhat.com/errata/RHSA-2026:39319", "https://access.redhat.com/errata/RHSA-2026:39573", "https://access.redhat.com/errata/RHSA-2026:39810", "https://access.redhat.com/errata/RHSA-2026:40118", "https://access.redhat.com/errata/RHSA-2026:40119", "https://access.redhat.com/errata/RHSA-2026:40945", "https://access.redhat.com/errata/RHSA-2026:41019", "https://access.redhat.com/errata/RHSA-2026:41030", "https://access.redhat.com/errata/RHSA-2026:41055", "https://access.redhat.com/errata/RHSA-2026:41928", "https://access.redhat.com/errata/RHSA-2026:42043", "https://access.redhat.com/errata/RHSA-2026:42047", "https://access.redhat.com/errata/RHSA-2026:42048", "https://access.redhat.com/errata/RHSA-2026:42049", "https://access.redhat.com/errata/RHSA-2026:42050", "https://access.redhat.com/errata/RHSA-2026:42051", "https://access.redhat.com/errata/RHSA-2026:42078", "https://access.redhat.com/errata/RHSA-2026:42079", "https://access.redhat.com/errata/RHSA-2026:42082", "https://access.redhat.com/errata/RHSA-2026:42132", "https://access.redhat.com/errata/RHSA-2026:42150", "https://access.redhat.com/errata/RHSA-2026:42151", "https://access.redhat.com/errata/RHSA-2026:42240", "https://access.redhat.com/errata/RHSA-2026:42644", "https://access.redhat.com/errata/RHSA-2026:42852", "https://access.redhat.com/errata/RHSA-2026:42946", "https://access.redhat.com/errata/RHSA-2026:43038", "https://access.redhat.com/errata/RHSA-2026:43692", "https://access.redhat.com/errata/RHSA-2026:44622", "https://access.redhat.com/errata/RHSA-2026:46885", "https://access.redhat.com/errata/RHSA-2026:47149", "https://access.redhat.com/errata/RHSA-2026:47735", "https://access.redhat.com/errata/RHSA-2026:47952", "https://access.redhat.com/errata/RHSA-2026:48151", "https://access.redhat.com/errata/RHSA-2026:49702", "https://access.redhat.com/errata/RHSA-2026:49703", "https://access.redhat.com/errata/RHSA-2026:49712", "https://access.redhat.com/errata/RHSA-2026:50205", "https://access.redhat.com/errata/RHSA-2026:50300", "https://access.redhat.com/errata/RHSA-2026:50319", "https://access.redhat.com/errata/RHSA-2026:50336", "https://access.redhat.com/errata/RHSA-2026:50843", "https://access.redhat.com/errata/RHSA-2026:51033", "https://access.redhat.com/errata/RHSA-2026:51057", "https://access.redhat.com/errata/RHSA-2026:51187", "https://access.redhat.com/errata/RHSA-2026:51194", "https://access.redhat.com/errata/RHSA-2026:51341", "https://access.redhat.com/errata/RHSA-2026:53412", "https://access.redhat.com/errata/RHSA-2026:53413", "https://access.redhat.com/errata/RHSA-2026:53415", "https://access.redhat.com/errata/RHSA-2026:53530", "https://access.redhat.com/errata/RHSA-2026:54168", "https://access.redhat.com/errata/RHSA-2026:54191", "https://access.redhat.com/errata/RHSA-2026:54274", "https://access.redhat.com/errata/RHSA-2026:54283", "https://access.redhat.com/errata/RHSA-2026:54284", "https://access.redhat.com/errata/RHSA-2026:54285", "https://access.redhat.com/errata/RHSA-2026:54286", "https://access.redhat.com/errata/RHSA-2026:54287", "https://access.redhat.com/errata/RHSA-2026:54435", "https://access.redhat.com/errata/RHSA-2026:54441", "https://access.redhat.com/errata/RHSA-2026:54500", "https://access.redhat.com/errata/RHSA-2026:54552", "https://access.redhat.com/errata/RHSA-2026:54556", "https://access.redhat.com/errata/RHSA-2026:54584", "https://access.redhat.com/errata/RHSA-2026:54602", "https://access.redhat.com/errata/RHSA-2026:54603", "https://access.redhat.com/errata/RHSA-2026:54757", "https://access.redhat.com/errata/RHSA-2026:56340", "https://access.redhat.com/errata/RHSA-2026:56785", "https://access.redhat.com/errata/RHSA-2026:56789", "https://access.redhat.com/errata/RHSA-2026:56790", "https://access.redhat.com/errata/RHSA-2026:56852", "https://access.redhat.com/errata/RHSA-2026:56855", "https://access.redhat.com/errata/RHSA-2026:56910", "https://access.redhat.com/errata/RHSA-2026:56912", "https://access.redhat.com/errata/RHSA-2026:56913", "https://access.redhat.com/errata/RHSA-2026:57191", "https://access.redhat.com/errata/RHSA-2026:57194", "https://access.redhat.com/errata/RHSA-2026:57482", "https://access.redhat.com/errata/RHSA-2026:57488", "https://access.redhat.com/errata/RHSA-2026:57649", "https://access.redhat.com/errata/RHSA-2026:59467", "https://access.redhat.com/errata/RHSA-2026:59559", "https://access.redhat.com/errata/RHSA-2026:60018", "https://access.redhat.com/errata/RHSA-2026:60025", "https://access.redhat.com/errata/RHSA-2026:60302", "https://access.redhat.com/errata/RHSA-2026:60520", "https://access.redhat.com/errata/RHSA-2026:61253", "https://access.redhat.com/errata/RHSA-2026:61313", "https://access.redhat.com/errata/RHSA-2026:65126", "https://access.redhat.com/errata/RHSA-2026:65534", "https://access.redhat.com/errata/RHSA-2026:65886", "https://access.redhat.com/errata/RHSA-2026:66022", "https://access.redhat.com/errata/RHSA-2026:67149", "https://access.redhat.com/errata/RHSA-2026:67287", "https://access.redhat.com/errata/RHSA-2026:67319", "https://access.redhat.com/security/cve/CVE-2026-33811", "https://bugzilla.redhat.com/2467822", "https://bugzilla.redhat.com/show_bug.cgi?id=2456333", "https://bugzilla.redhat.com/show_bug.cgi?id=2456339", "https://bugzilla.redhat.com/show_bug.cgi?id=2467809", "https://bugzilla.redhat.com/show_bug.cgi?id=2467820", "https://bugzilla.redhat.com/show_bug.cgi?id=2467822", "https://bugzilla.redhat.com/show_bug.cgi?id=2480756", "https://bugzilla.redhat.com/show_bug.cgi?id=2484204", "https://bugzilla.redhat.com/show_bug.cgi?id=2515815", "https://bugzilla.redhat.com/show_bug.cgi?id=2515820", "https://bugzilla.redhat.com/show_bug.cgi?id=2515827", "https://bugzilla.redhat.com/show_bug.cgi?id=2515838", "https://bugzilla.redhat.com/show_bug.cgi?id=2515839", "https://bugzilla.redhat.com/show_bug.cgi?id=2515840", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32280", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32281", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33811", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39820", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39821", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42499", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42504", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56859", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862", "https://errata.almalinux.org/9/ALSA-2026-39319.html", "https://errata.rockylinux.org/RLSA-2026:65886", "https://go.dev/cl/767860", "https://go.dev/issue/78803", "https://groups.google.com/g/golang-announce/c/qcCIEXso47M", "https://linux.oracle.com/cve/CVE-2026-33811.html", "https://linux.oracle.com/errata/ELSA-2026-65886-0.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-33811", "https://pkg.go.dev/vuln/GO-2026-4981", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33811.json", "https://www.cve.org/CVERecord?id=CVE-2026-33811" ], "PublishedDate": "2026-05-07T20:16:42.77Z", "LastModifiedDate": "2026-10-26T00:10:00.15Z" }, { "VulnerabilityID": "CVE-2026-33814", "VendorIDs": [ "GO-2026-4918" ], "PkgID": "stdlib@v1.25.9", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.25.9", "UID": "2185fb41a98d095a" }, "InstalledVersion": "v1.25.9", "FixedVersion": "1.25.10, 1.26.3", "Status": "fixed", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-33814", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:5a89dca0661bb37cc6d40a7f30e84c850ccaefc02f02f34e14b102c0ca92874a", "Title": "net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame", "Description": "When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.", "Severity": "HIGH", "CweIDs": [ "CWE-835", "CWE-606" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 2, "bitnami": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:22112", "https://access.redhat.com/errata/RHSA-2026:22120", "https://access.redhat.com/errata/RHSA-2026:22121", "https://access.redhat.com/errata/RHSA-2026:23262", "https://access.redhat.com/errata/RHSA-2026:23264", "https://access.redhat.com/errata/RHSA-2026:33120", "https://access.redhat.com/errata/RHSA-2026:33123", "https://access.redhat.com/errata/RHSA-2026:33142", "https://access.redhat.com/errata/RHSA-2026:33150", "https://access.redhat.com/errata/RHSA-2026:34342", "https://access.redhat.com/errata/RHSA-2026:37387", "https://access.redhat.com/errata/RHSA-2026:42644", "https://access.redhat.com/errata/RHSA-2026:43692", "https://access.redhat.com/errata/RHSA-2026:49702", "https://access.redhat.com/errata/RHSA-2026:49712", "https://access.redhat.com/errata/RHSA-2026:50205", "https://access.redhat.com/errata/RHSA-2026:54274", "https://access.redhat.com/errata/RHSA-2026:54283", "https://access.redhat.com/errata/RHSA-2026:54284", "https://access.redhat.com/errata/RHSA-2026:54285", "https://access.redhat.com/errata/RHSA-2026:54286", "https://access.redhat.com/errata/RHSA-2026:54287", "https://access.redhat.com/errata/RHSA-2026:56854", "https://access.redhat.com/errata/RHSA-2026:56912", "https://access.redhat.com/errata/RHSA-2026:57191", "https://access.redhat.com/errata/RHSA-2026:57194", "https://access.redhat.com/errata/RHSA-2026:57365", "https://access.redhat.com/errata/RHSA-2026:57367", "https://access.redhat.com/errata/RHSA-2026:57408", "https://access.redhat.com/errata/RHSA-2026:57545", "https://access.redhat.com/errata/RHSA-2026:57649", "https://access.redhat.com/errata/RHSA-2026:57845", "https://access.redhat.com/errata/RHSA-2026:59833", "https://access.redhat.com/errata/RHSA-2026:60023", "https://access.redhat.com/errata/RHSA-2026:60025", "https://access.redhat.com/errata/RHSA-2026:60441", "https://access.redhat.com/errata/RHSA-2026:60442", "https://access.redhat.com/errata/RHSA-2026:60446", "https://access.redhat.com/errata/RHSA-2026:60447", "https://access.redhat.com/errata/RHSA-2026:60454", "https://access.redhat.com/errata/RHSA-2026:60477", "https://access.redhat.com/errata/RHSA-2026:60478", "https://access.redhat.com/errata/RHSA-2026:60520", "https://access.redhat.com/errata/RHSA-2026:60668", "https://access.redhat.com/errata/RHSA-2026:61253", "https://access.redhat.com/errata/RHSA-2026:62410", "https://access.redhat.com/errata/RHSA-2026:62550", "https://access.redhat.com/errata/RHSA-2026:62551", "https://access.redhat.com/errata/RHSA-2026:63046", "https://access.redhat.com/errata/RHSA-2026:63047", "https://access.redhat.com/errata/RHSA-2026:63048", "https://access.redhat.com/errata/RHSA-2026:63050", "https://access.redhat.com/errata/RHSA-2026:63091", "https://access.redhat.com/errata/RHSA-2026:63096", "https://access.redhat.com/errata/RHSA-2026:63097", "https://access.redhat.com/errata/RHSA-2026:63103", "https://access.redhat.com/errata/RHSA-2026:63104", "https://access.redhat.com/errata/RHSA-2026:63636", "https://access.redhat.com/errata/RHSA-2026:63637", "https://access.redhat.com/errata/RHSA-2026:63639", "https://access.redhat.com/errata/RHSA-2026:65126", "https://access.redhat.com/errata/RHSA-2026:66350", "https://access.redhat.com/security/cve/CVE-2026-33814", "https://bugzilla.redhat.com/2467822", "https://bugzilla.redhat.com/show_bug.cgi?id=2467809", "https://bugzilla.redhat.com/show_bug.cgi?id=2467810", "https://bugzilla.redhat.com/show_bug.cgi?id=2467811", "https://bugzilla.redhat.com/show_bug.cgi?id=2467813", "https://bugzilla.redhat.com/show_bug.cgi?id=2467815", "https://bugzilla.redhat.com/show_bug.cgi?id=2467820", "https://bugzilla.redhat.com/show_bug.cgi?id=2467822", "https://bugzilla.redhat.com/show_bug.cgi?id=2467823", "https://bugzilla.redhat.com/show_bug.cgi?id=2467825", "https://bugzilla.redhat.com/show_bug.cgi?id=2467826", "https://bugzilla.redhat.com/show_bug.cgi?id=2467827", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33811", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33814", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39817", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39819", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39820", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39823", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39825", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39826", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39836", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42499", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42501", "https://errata.almalinux.org/9/ALSA-2026-22121.html", "https://errata.rockylinux.org/RLSA-2026:22121", "https://github.com/golang/go/issues/78476", "https://go-review.googlesource.com/c/go/+/761581", "https://go-review.googlesource.com/c/net/+/761640", "https://go.dev/cl/761581", "https://go.dev/cl/761640", "https://go.dev/issue/78476", "https://groups.google.com/g/golang-announce/c/qcCIEXso47M", "https://linux.oracle.com/cve/CVE-2026-33814.html", "https://linux.oracle.com/errata/ELSA-2026-22121.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-33814", "https://pkg.go.dev/vuln/GO-2026-4918", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33814.json", "https://ubuntu.com/security/notices/USN-8430-1", "https://ubuntu.com/security/notices/USN-8471-1", "https://ubuntu.com/security/notices/USN-8472-1", "https://ubuntu.com/security/notices/USN-8473-1", "https://www.cve.org/CVERecord?id=CVE-2026-33814" ], "PublishedDate": "2026-05-07T20:16:42.88Z", "LastModifiedDate": "2026-10-26T20:10:00.16Z" }, { "VulnerabilityID": "CVE-2026-33818", "VendorIDs": [ "GO-2026-5972" ], "PkgID": "stdlib@v1.25.9", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.25.9", "UID": "2185fb41a98d095a" }, "InstalledVersion": "v1.25.9", "FixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3", "Status": "fixed", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-33818", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:75213d6da04b963fb1b88a574c947c670ae5789ea2c7e049f450ac50c5136945", "Title": "encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal", "Description": "Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures.", "Severity": "HIGH", "CweIDs": [ "CWE-400" ], "VendorSeverity": { "alma": 3, "amazon": 3, "bitnami": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:70641", "https://access.redhat.com/security/cve/CVE-2026-33818", "https://bugzilla.redhat.com/2515815", "https://bugzilla.redhat.com/2515820", "https://bugzilla.redhat.com/2515827", "https://bugzilla.redhat.com/2515838", "https://bugzilla.redhat.com/2515839", "https://bugzilla.redhat.com/show_bug.cgi?id=2402034", "https://bugzilla.redhat.com/show_bug.cgi?id=2515815", "https://bugzilla.redhat.com/show_bug.cgi?id=2515820", "https://bugzilla.redhat.com/show_bug.cgi?id=2515827", "https://bugzilla.redhat.com/show_bug.cgi?id=2515838", "https://bugzilla.redhat.com/show_bug.cgi?id=2515839", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11395", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862", "https://errata.almalinux.org/9/ALSA-2026-70641.html", "https://errata.rockylinux.org/RLSA-2026:70641", "https://github.com/golang/go/issues/80405", "https://go.dev/cl/814980", "https://go.dev/issue/80405", "https://groups.google.com/g/golang-announce/c/94pEornpRlI", "https://linux.oracle.com/cve/CVE-2026-33818.html", "https://linux.oracle.com/errata/ELSA-2026-70641.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-33818", "https://pkg.go.dev/vuln/GO-2026-5972", "https://ubuntu.com/security/notices/USN-8935-1", "https://www.cve.org/CVERecord?id=CVE-2026-33818" ], "PublishedDate": "2026-08-13T22:17:19.84Z", "LastModifiedDate": "2026-09-03T16:37:52.17Z" }, { "VulnerabilityID": "CVE-2026-39820", "VendorIDs": [ "GO-2026-4986" ], "PkgID": "stdlib@v1.25.9", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.25.9", "UID": "2185fb41a98d095a" }, "InstalledVersion": "v1.25.9", "FixedVersion": "1.25.10, 1.26.3", "Status": "fixed", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-39820", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:9fcb1569245afbf88353764b09ba317723acce957bf1d36b0c593814db0c74c7", "Title": "net/mail: golang: Go net/mail: Denial of Service via crafted email inputs", "Description": "Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations.", "Severity": "HIGH", "CweIDs": [ "CWE-770", "CWE-606" ], "VendorSeverity": { "alma": 3, "amazon": 3, "bitnami": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:22112", "https://access.redhat.com/errata/RHSA-2026:22120", "https://access.redhat.com/errata/RHSA-2026:22121", "https://access.redhat.com/errata/RHSA-2026:23262", "https://access.redhat.com/errata/RHSA-2026:23264", "https://access.redhat.com/errata/RHSA-2026:33120", "https://access.redhat.com/errata/RHSA-2026:33123", "https://access.redhat.com/errata/RHSA-2026:33142", "https://access.redhat.com/errata/RHSA-2026:33150", "https://access.redhat.com/errata/RHSA-2026:33574", "https://access.redhat.com/errata/RHSA-2026:34364", "https://access.redhat.com/errata/RHSA-2026:36319", "https://access.redhat.com/errata/RHSA-2026:36625", "https://access.redhat.com/errata/RHSA-2026:36754", "https://access.redhat.com/errata/RHSA-2026:36797", "https://access.redhat.com/errata/RHSA-2026:40262", "https://access.redhat.com/errata/RHSA-2026:41031", "https://access.redhat.com/errata/RHSA-2026:41066", "https://access.redhat.com/errata/RHSA-2026:41928", "https://access.redhat.com/errata/RHSA-2026:42146", "https://access.redhat.com/errata/RHSA-2026:42644", "https://access.redhat.com/errata/RHSA-2026:42796", "https://access.redhat.com/errata/RHSA-2026:43038", "https://access.redhat.com/errata/RHSA-2026:43052", "https://access.redhat.com/errata/RHSA-2026:43692", "https://access.redhat.com/errata/RHSA-2026:47952", "https://access.redhat.com/errata/RHSA-2026:49702", "https://access.redhat.com/errata/RHSA-2026:49712", "https://access.redhat.com/errata/RHSA-2026:50205", "https://access.redhat.com/errata/RHSA-2026:50300", "https://access.redhat.com/errata/RHSA-2026:50319", "https://access.redhat.com/errata/RHSA-2026:50336", "https://access.redhat.com/errata/RHSA-2026:50843", "https://access.redhat.com/errata/RHSA-2026:51033", "https://access.redhat.com/errata/RHSA-2026:51112", "https://access.redhat.com/errata/RHSA-2026:54274", "https://access.redhat.com/errata/RHSA-2026:54283", "https://access.redhat.com/errata/RHSA-2026:54284", "https://access.redhat.com/errata/RHSA-2026:54285", "https://access.redhat.com/errata/RHSA-2026:54286", "https://access.redhat.com/errata/RHSA-2026:54287", "https://access.redhat.com/errata/RHSA-2026:54531", "https://access.redhat.com/errata/RHSA-2026:54552", "https://access.redhat.com/errata/RHSA-2026:54555", "https://access.redhat.com/errata/RHSA-2026:54583", "https://access.redhat.com/errata/RHSA-2026:54602", "https://access.redhat.com/errata/RHSA-2026:54883", "https://access.redhat.com/errata/RHSA-2026:56340", "https://access.redhat.com/errata/RHSA-2026:56789", "https://access.redhat.com/errata/RHSA-2026:56852", "https://access.redhat.com/errata/RHSA-2026:56854", "https://access.redhat.com/errata/RHSA-2026:57194", "https://access.redhat.com/errata/RHSA-2026:57401", "https://access.redhat.com/errata/RHSA-2026:57482", "https://access.redhat.com/errata/RHSA-2026:57487", "https://access.redhat.com/errata/RHSA-2026:57649", "https://access.redhat.com/errata/RHSA-2026:57845", "https://access.redhat.com/errata/RHSA-2026:57914", "https://access.redhat.com/errata/RHSA-2026:59467", "https://access.redhat.com/errata/RHSA-2026:59830", "https://access.redhat.com/errata/RHSA-2026:59833", "https://access.redhat.com/errata/RHSA-2026:60018", "https://access.redhat.com/errata/RHSA-2026:60023", "https://access.redhat.com/errata/RHSA-2026:60520", "https://access.redhat.com/errata/RHSA-2026:61253", "https://access.redhat.com/errata/RHSA-2026:62260", "https://access.redhat.com/errata/RHSA-2026:62406", "https://access.redhat.com/errata/RHSA-2026:62407", "https://access.redhat.com/errata/RHSA-2026:62753", "https://access.redhat.com/errata/RHSA-2026:62754", "https://access.redhat.com/errata/RHSA-2026:62803", "https://access.redhat.com/errata/RHSA-2026:63022", "https://access.redhat.com/errata/RHSA-2026:65116", "https://access.redhat.com/errata/RHSA-2026:65117", "https://access.redhat.com/errata/RHSA-2026:65153", "https://access.redhat.com/errata/RHSA-2026:65335", "https://access.redhat.com/errata/RHSA-2026:65336", "https://access.redhat.com/errata/RHSA-2026:65534", "https://access.redhat.com/errata/RHSA-2026:65838", "https://access.redhat.com/errata/RHSA-2026:65886", "https://access.redhat.com/errata/RHSA-2026:65895", "https://access.redhat.com/errata/RHSA-2026:66016", "https://access.redhat.com/errata/RHSA-2026:66022", "https://access.redhat.com/errata/RHSA-2026:66327", "https://access.redhat.com/errata/RHSA-2026:67517", "https://access.redhat.com/errata/RHSA-2026:67974", "https://access.redhat.com/errata/RHSA-2026:67975", "https://access.redhat.com/errata/RHSA-2026:68334", "https://access.redhat.com/errata/RHSA-2026:68504", "https://access.redhat.com/errata/RHSA-2026:68527", "https://access.redhat.com/security/cve/CVE-2026-39820", "https://bugzilla.redhat.com/2467809", "https://bugzilla.redhat.com/2467820", "https://bugzilla.redhat.com/2480756", "https://bugzilla.redhat.com/2484204", "https://bugzilla.redhat.com/2515815", "https://bugzilla.redhat.com/2515820", "https://bugzilla.redhat.com/2515827", "https://bugzilla.redhat.com/2515838", "https://bugzilla.redhat.com/2515839", "https://bugzilla.redhat.com/2515840", "https://bugzilla.redhat.com/show_bug.cgi?id=2456333", "https://bugzilla.redhat.com/show_bug.cgi?id=2456339", "https://bugzilla.redhat.com/show_bug.cgi?id=2467809", "https://bugzilla.redhat.com/show_bug.cgi?id=2467820", "https://bugzilla.redhat.com/show_bug.cgi?id=2467822", "https://bugzilla.redhat.com/show_bug.cgi?id=2480756", "https://bugzilla.redhat.com/show_bug.cgi?id=2484204", "https://bugzilla.redhat.com/show_bug.cgi?id=2515815", "https://bugzilla.redhat.com/show_bug.cgi?id=2515820", "https://bugzilla.redhat.com/show_bug.cgi?id=2515827", "https://bugzilla.redhat.com/show_bug.cgi?id=2515838", "https://bugzilla.redhat.com/show_bug.cgi?id=2515839", "https://bugzilla.redhat.com/show_bug.cgi?id=2515840", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32280", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32281", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33811", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39820", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39821", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42499", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42504", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56859", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862", "https://errata.almalinux.org/9/ALSA-2026-65153.html", "https://errata.rockylinux.org/RLSA-2026:65886", "https://go.dev/cl/759940", "https://go.dev/issue/78566", "https://groups.google.com/g/golang-announce/c/qcCIEXso47M", "https://linux.oracle.com/cve/CVE-2026-39820.html", "https://linux.oracle.com/errata/ELSA-2026-65895-0.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-39820", "https://pkg.go.dev/vuln/GO-2026-4986", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39820.json", "https://www.cve.org/CVERecord?id=CVE-2026-39820" ], "PublishedDate": "2026-05-07T20:16:43.187Z", "LastModifiedDate": "2026-10-26T00:10:00.15Z" }, { "VulnerabilityID": "CVE-2026-39821", "VendorIDs": [ "GO-2026-5026" ], "PkgID": "stdlib@v1.25.9", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.25.9", "UID": "2185fb41a98d095a" }, "InstalledVersion": "v1.25.9", "FixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3", "Status": "fixed", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-39821", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:ddc3ccfb8c8d19cfce83dbe27b0d86c5b617e0012ea3a0cc26e9dfcb9130d32a", "Title": "golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing", "Description": "The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode(\"xn--example-.com\") incorrectly returns the name \"example.com\" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject \"example.com\" but permit \"xn--example-.com\". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name \"example.com\".", "Severity": "HIGH", "CweIDs": [ "CWE-1289" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 4, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 3 }, "CVSS": { "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N", "V3Score": 8.2 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:23262", "https://access.redhat.com/errata/RHSA-2026:23264", "https://access.redhat.com/errata/RHSA-2026:26546", "https://access.redhat.com/errata/RHSA-2026:26547", "https://access.redhat.com/errata/RHSA-2026:30650", "https://access.redhat.com/errata/RHSA-2026:30651", "https://access.redhat.com/errata/RHSA-2026:30853", "https://access.redhat.com/errata/RHSA-2026:30854", "https://access.redhat.com/errata/RHSA-2026:30855", "https://access.redhat.com/errata/RHSA-2026:33155", "https://access.redhat.com/errata/RHSA-2026:33160", "https://access.redhat.com/errata/RHSA-2026:33163", "https://access.redhat.com/errata/RHSA-2026:33173", "https://access.redhat.com/errata/RHSA-2026:33183", "https://access.redhat.com/errata/RHSA-2026:33524", "https://access.redhat.com/errata/RHSA-2026:33531", "https://access.redhat.com/errata/RHSA-2026:34342", "https://access.redhat.com/errata/RHSA-2026:34357", "https://access.redhat.com/errata/RHSA-2026:34359", "https://access.redhat.com/errata/RHSA-2026:34364", "https://access.redhat.com/errata/RHSA-2026:34789", "https://access.redhat.com/errata/RHSA-2026:35826", "https://access.redhat.com/errata/RHSA-2026:35827", "https://access.redhat.com/errata/RHSA-2026:35828", "https://access.redhat.com/errata/RHSA-2026:35829", "https://access.redhat.com/errata/RHSA-2026:35830", "https://access.redhat.com/errata/RHSA-2026:35831", "https://access.redhat.com/errata/RHSA-2026:35993", "https://access.redhat.com/errata/RHSA-2026:35994", "https://access.redhat.com/errata/RHSA-2026:36105", "https://access.redhat.com/errata/RHSA-2026:36167", "https://access.redhat.com/errata/RHSA-2026:36207", "https://access.redhat.com/errata/RHSA-2026:36648", "https://access.redhat.com/errata/RHSA-2026:36651", "https://access.redhat.com/errata/RHSA-2026:36796", "https://access.redhat.com/errata/RHSA-2026:36797", "https://access.redhat.com/errata/RHSA-2026:36808", "https://access.redhat.com/errata/RHSA-2026:36820", "https://access.redhat.com/errata/RHSA-2026:36883", "https://access.redhat.com/errata/RHSA-2026:37387", "https://access.redhat.com/errata/RHSA-2026:37435", "https://access.redhat.com/errata/RHSA-2026:37436", "https://access.redhat.com/errata/RHSA-2026:38995", "https://access.redhat.com/errata/RHSA-2026:39005", "https://access.redhat.com/errata/RHSA-2026:39573", "https://access.redhat.com/errata/RHSA-2026:39879", "https://access.redhat.com/errata/RHSA-2026:40118", "https://access.redhat.com/errata/RHSA-2026:40262", "https://access.redhat.com/errata/RHSA-2026:40945", "https://access.redhat.com/errata/RHSA-2026:41019", "https://access.redhat.com/errata/RHSA-2026:41030", "https://access.redhat.com/errata/RHSA-2026:41031", "https://access.redhat.com/errata/RHSA-2026:41036", "https://access.redhat.com/errata/RHSA-2026:41055", "https://access.redhat.com/errata/RHSA-2026:41066", "https://access.redhat.com/errata/RHSA-2026:41928", "https://access.redhat.com/errata/RHSA-2026:41930", "https://access.redhat.com/errata/RHSA-2026:42043", "https://access.redhat.com/errata/RHSA-2026:42047", "https://access.redhat.com/errata/RHSA-2026:42048", "https://access.redhat.com/errata/RHSA-2026:42049", "https://access.redhat.com/errata/RHSA-2026:42050", "https://access.redhat.com/errata/RHSA-2026:42051", "https://access.redhat.com/errata/RHSA-2026:42078", "https://access.redhat.com/errata/RHSA-2026:42079", "https://access.redhat.com/errata/RHSA-2026:42080", "https://access.redhat.com/errata/RHSA-2026:42082", "https://access.redhat.com/errata/RHSA-2026:42132", "https://access.redhat.com/errata/RHSA-2026:42142", "https://access.redhat.com/errata/RHSA-2026:42146", "https://access.redhat.com/errata/RHSA-2026:42150", "https://access.redhat.com/errata/RHSA-2026:42151", "https://access.redhat.com/errata/RHSA-2026:42240", "https://access.redhat.com/errata/RHSA-2026:42644", "https://access.redhat.com/errata/RHSA-2026:42796", "https://access.redhat.com/errata/RHSA-2026:42852", "https://access.redhat.com/errata/RHSA-2026:43038", "https://access.redhat.com/errata/RHSA-2026:43052", "https://access.redhat.com/errata/RHSA-2026:43692", "https://access.redhat.com/errata/RHSA-2026:44622", "https://access.redhat.com/errata/RHSA-2026:44624", "https://access.redhat.com/errata/RHSA-2026:46395", "https://access.redhat.com/errata/RHSA-2026:47149", "https://access.redhat.com/errata/RHSA-2026:47735", "https://access.redhat.com/errata/RHSA-2026:47737", "https://access.redhat.com/errata/RHSA-2026:47952", "https://access.redhat.com/errata/RHSA-2026:49702", "https://access.redhat.com/errata/RHSA-2026:49712", "https://access.redhat.com/errata/RHSA-2026:50300", "https://access.redhat.com/errata/RHSA-2026:50843", "https://access.redhat.com/errata/RHSA-2026:51033", "https://access.redhat.com/errata/RHSA-2026:51112", "https://access.redhat.com/errata/RHSA-2026:51187", "https://access.redhat.com/errata/RHSA-2026:51194", "https://access.redhat.com/errata/RHSA-2026:51341", "https://access.redhat.com/errata/RHSA-2026:52826", "https://access.redhat.com/errata/RHSA-2026:53374", "https://access.redhat.com/errata/RHSA-2026:53412", "https://access.redhat.com/errata/RHSA-2026:53413", "https://access.redhat.com/errata/RHSA-2026:53415", "https://access.redhat.com/errata/RHSA-2026:53530", "https://access.redhat.com/errata/RHSA-2026:54191", "https://access.redhat.com/errata/RHSA-2026:54274", "https://access.redhat.com/errata/RHSA-2026:54283", "https://access.redhat.com/errata/RHSA-2026:54284", "https://access.redhat.com/errata/RHSA-2026:54285", "https://access.redhat.com/errata/RHSA-2026:54286", "https://access.redhat.com/errata/RHSA-2026:54287", "https://access.redhat.com/errata/RHSA-2026:54395", "https://access.redhat.com/errata/RHSA-2026:54401", "https://access.redhat.com/errata/RHSA-2026:54435", "https://access.redhat.com/errata/RHSA-2026:54441", "https://access.redhat.com/errata/RHSA-2026:54531", "https://access.redhat.com/errata/RHSA-2026:54580", "https://access.redhat.com/errata/RHSA-2026:54757", "https://access.redhat.com/errata/RHSA-2026:56143", "https://access.redhat.com/errata/RHSA-2026:56223", "https://access.redhat.com/errata/RHSA-2026:56340", "https://access.redhat.com/errata/RHSA-2026:56431", "https://access.redhat.com/errata/RHSA-2026:57194", "https://access.redhat.com/errata/RHSA-2026:57541", "https://access.redhat.com/errata/RHSA-2026:57649", "https://access.redhat.com/errata/RHSA-2026:57845", "https://access.redhat.com/errata/RHSA-2026:59546", "https://access.redhat.com/errata/RHSA-2026:59549", "https://access.redhat.com/errata/RHSA-2026:59562", "https://access.redhat.com/errata/RHSA-2026:60315", "https://access.redhat.com/errata/RHSA-2026:60354", "https://access.redhat.com/errata/RHSA-2026:60387", "https://access.redhat.com/errata/RHSA-2026:60520", "https://access.redhat.com/errata/RHSA-2026:61245", "https://access.redhat.com/errata/RHSA-2026:61253", "https://access.redhat.com/errata/RHSA-2026:62549", "https://access.redhat.com/errata/RHSA-2026:63134", "https://access.redhat.com/errata/RHSA-2026:65126", "https://access.redhat.com/errata/RHSA-2026:65153", "https://access.redhat.com/errata/RHSA-2026:65359", "https://access.redhat.com/errata/RHSA-2026:65534", "https://access.redhat.com/errata/RHSA-2026:65851", "https://access.redhat.com/errata/RHSA-2026:65886", "https://access.redhat.com/errata/RHSA-2026:66016", "https://access.redhat.com/errata/RHSA-2026:66022", "https://access.redhat.com/errata/RHSA-2026:66350", "https://access.redhat.com/errata/RHSA-2026:66432", "https://access.redhat.com/errata/RHSA-2026:67149", "https://access.redhat.com/errata/RHSA-2026:67159", "https://access.redhat.com/errata/RHSA-2026:67160", "https://access.redhat.com/errata/RHSA-2026:67287", "https://access.redhat.com/errata/RHSA-2026:67319", "https://access.redhat.com/errata/RHSA-2026:67517", "https://access.redhat.com/errata/RHSA-2026:68504", "https://access.redhat.com/security/cve/CVE-2026-39821", "https://bugzilla.redhat.com/2467809", "https://bugzilla.redhat.com/2467820", "https://bugzilla.redhat.com/2480756", "https://bugzilla.redhat.com/2484204", "https://bugzilla.redhat.com/2515815", "https://bugzilla.redhat.com/2515820", "https://bugzilla.redhat.com/2515827", "https://bugzilla.redhat.com/2515838", "https://bugzilla.redhat.com/2515839", "https://bugzilla.redhat.com/2515840", "https://bugzilla.redhat.com/show_bug.cgi?id=2456333", "https://bugzilla.redhat.com/show_bug.cgi?id=2456339", "https://bugzilla.redhat.com/show_bug.cgi?id=2467809", "https://bugzilla.redhat.com/show_bug.cgi?id=2467820", "https://bugzilla.redhat.com/show_bug.cgi?id=2467822", "https://bugzilla.redhat.com/show_bug.cgi?id=2480756", "https://bugzilla.redhat.com/show_bug.cgi?id=2484204", "https://bugzilla.redhat.com/show_bug.cgi?id=2515815", "https://bugzilla.redhat.com/show_bug.cgi?id=2515820", "https://bugzilla.redhat.com/show_bug.cgi?id=2515827", "https://bugzilla.redhat.com/show_bug.cgi?id=2515838", "https://bugzilla.redhat.com/show_bug.cgi?id=2515839", "https://bugzilla.redhat.com/show_bug.cgi?id=2515840", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32280", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32281", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33811", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39820", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39821", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42499", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42504", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56859", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862", "https://errata.almalinux.org/9/ALSA-2026-65153.html", "https://errata.rockylinux.org/RLSA-2026:65886", "https://go.dev/cl/767220", "https://go.dev/issue/78760", "https://groups.google.com/g/golang-announce/c/94pEornpRlI", "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8", "https://linux.oracle.com/cve/CVE-2026-39821.html", "https://linux.oracle.com/errata/ELSA-2026-66432-0.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-39821", "https://pkg.go.dev/vuln/GO-2026-5026", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39821.json", "https://ubuntu.com/security/notices/USN-8416-1", "https://ubuntu.com/security/notices/USN-8883-1", "https://ubuntu.com/security/notices/USN-8883-2", "https://ubuntu.com/security/notices/USN-8900-1", "https://ubuntu.com/security/notices/USN-8914-1", "https://www.cve.org/CVERecord?id=CVE-2026-39821" ], "PublishedDate": "2026-05-22T16:16:20.41Z", "LastModifiedDate": "2026-09-17T12:18:05.767Z" }, { "VulnerabilityID": "CVE-2026-39822", "VendorIDs": [ "GO-2026-4970" ], "PkgID": "stdlib@v1.25.9", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.25.9", "UID": "2185fb41a98d095a" }, "InstalledVersion": "v1.25.9", "FixedVersion": "1.25.12, 1.26.5, 1.27.0-rc.2", "Status": "fixed", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-39822", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:033ee91dc4d186bfcadf28bb3e6c1bf744aa59bce527149bc2b72a8e7bfa19a4", "Title": "golang: Go os.Root: Symlink following vulnerability allows directory traversal", "Description": "On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /. For example, 'root.Open(\"symlink/\")' will open \"symlink\" even when \"symlink\" is a symbolic link pointing outside of the root.", "Severity": "HIGH", "CweIDs": [ "CWE-61" ], "VendorSeverity": { "alma": 3, "amazon": 2, "azure": 3, "bitnami": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 }, "redhat": { "V3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "V3Score": 7.8 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:38878", "https://access.redhat.com/security/cve/CVE-2026-39822", "https://bugzilla.redhat.com/2498152", "https://bugzilla.redhat.com/show_bug.cgi?id=2498152", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39822", "https://errata.almalinux.org/9/ALSA-2026-38878.html", "https://errata.rockylinux.org/RLSA-2026:38878", "https://github.com/golang/go/issues/79005", "https://go.dev/cl/797880", "https://go.dev/issue/79005", "https://groups.google.com/g/golang-announce/c/OrmQE_Yp5Sc", "https://linux.oracle.com/cve/CVE-2026-39822.html", "https://linux.oracle.com/errata/ELSA-2026-38995.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-39822", "https://pkg.go.dev/vuln/GO-2026-4970", "https://www.cve.org/CVERecord?id=CVE-2026-39822" ], "PublishedDate": "2026-07-08T17:17:21.31Z", "LastModifiedDate": "2026-10-25T17:10:00.197Z" }, { "VulnerabilityID": "CVE-2026-39836", "VendorIDs": [ "GO-2026-4971" ], "PkgID": "stdlib@v1.25.9", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.25.9", "UID": "2185fb41a98d095a" }, "InstalledVersion": "v1.25.9", "FixedVersion": "1.25.10, 1.26.3", "Status": "fixed", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "SeveritySource": "nvd", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-39836", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:2524d8c71a43f213f1e661246b9a77c5f8b285e2e1731aa688d84a06f58150a5", "Title": "net: golang: Go net package: Denial of Service via NUL byte in Dial and LookupPort on Windows", "Description": "The Dial and LookupPort functions panic on Windows when provided with an input containing a NUL (0).", "Severity": "HIGH", "CweIDs": [ "CWE-476" ], "VendorSeverity": { "alma": 3, "bitnami": 3, "nvd": 3, "oracle-oval": 3, "photon": 3, "redhat": 2, "rocky": 3 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:22121", "https://access.redhat.com/security/cve/CVE-2026-39836", "https://bugzilla.redhat.com/2467822", "https://bugzilla.redhat.com/show_bug.cgi?id=2467809", "https://bugzilla.redhat.com/show_bug.cgi?id=2467810", "https://bugzilla.redhat.com/show_bug.cgi?id=2467811", "https://bugzilla.redhat.com/show_bug.cgi?id=2467813", "https://bugzilla.redhat.com/show_bug.cgi?id=2467815", "https://bugzilla.redhat.com/show_bug.cgi?id=2467820", "https://bugzilla.redhat.com/show_bug.cgi?id=2467822", "https://bugzilla.redhat.com/show_bug.cgi?id=2467823", "https://bugzilla.redhat.com/show_bug.cgi?id=2467825", "https://bugzilla.redhat.com/show_bug.cgi?id=2467826", "https://bugzilla.redhat.com/show_bug.cgi?id=2467827", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33811", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33814", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39817", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39819", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39820", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39823", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39825", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39826", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39836", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42499", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42501", "https://errata.almalinux.org/9/ALSA-2026-22121.html", "https://errata.rockylinux.org/RLSA-2026:22121", "https://go.dev/cl/775320", "https://go.dev/issue/79006", "https://groups.google.com/g/golang-announce/c/qcCIEXso47M", "https://linux.oracle.com/cve/CVE-2026-39836.html", "https://linux.oracle.com/errata/ELSA-2026-22121.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-39836", "https://pkg.go.dev/vuln/GO-2026-4971", "https://www.cve.org/CVERecord?id=CVE-2026-39836" ], "PublishedDate": "2026-05-07T20:16:43.593Z", "LastModifiedDate": "2026-10-26T20:10:00.16Z" }, { "VulnerabilityID": "CVE-2026-42499", "VendorIDs": [ "GO-2026-4977" ], "PkgID": "stdlib@v1.25.9", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.25.9", "UID": "2185fb41a98d095a" }, "InstalledVersion": "v1.25.9", "FixedVersion": "1.25.10, 1.26.3", "Status": "fixed", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-42499", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:c717fd3cb3748f1b40e288ccda3201b58a3d7c8e3abc09c4c971611ab1a10348", "Title": "net/mail: golang: net/mail: Denial of Service via pathological email address parsing", "Description": "Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322.", "Severity": "HIGH", "CweIDs": [ "CWE-1046" ], "VendorSeverity": { "alma": 3, "amazon": 3, "bitnami": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:17713", "https://access.redhat.com/errata/RHSA-2026:17714", "https://access.redhat.com/errata/RHSA-2026:22112", "https://access.redhat.com/errata/RHSA-2026:22120", "https://access.redhat.com/errata/RHSA-2026:22121", "https://access.redhat.com/errata/RHSA-2026:33120", "https://access.redhat.com/errata/RHSA-2026:33123", "https://access.redhat.com/errata/RHSA-2026:33142", "https://access.redhat.com/errata/RHSA-2026:33150", "https://access.redhat.com/errata/RHSA-2026:33574", "https://access.redhat.com/errata/RHSA-2026:34364", "https://access.redhat.com/errata/RHSA-2026:36319", "https://access.redhat.com/errata/RHSA-2026:36625", "https://access.redhat.com/errata/RHSA-2026:36754", "https://access.redhat.com/errata/RHSA-2026:36797", "https://access.redhat.com/errata/RHSA-2026:40262", "https://access.redhat.com/errata/RHSA-2026:41031", "https://access.redhat.com/errata/RHSA-2026:41066", "https://access.redhat.com/errata/RHSA-2026:41928", "https://access.redhat.com/errata/RHSA-2026:42146", "https://access.redhat.com/errata/RHSA-2026:42644", "https://access.redhat.com/errata/RHSA-2026:42796", "https://access.redhat.com/errata/RHSA-2026:43038", "https://access.redhat.com/errata/RHSA-2026:43052", "https://access.redhat.com/errata/RHSA-2026:43692", "https://access.redhat.com/errata/RHSA-2026:47952", "https://access.redhat.com/errata/RHSA-2026:49702", "https://access.redhat.com/errata/RHSA-2026:49712", "https://access.redhat.com/errata/RHSA-2026:50300", "https://access.redhat.com/errata/RHSA-2026:50319", "https://access.redhat.com/errata/RHSA-2026:50336", "https://access.redhat.com/errata/RHSA-2026:50843", "https://access.redhat.com/errata/RHSA-2026:51033", "https://access.redhat.com/errata/RHSA-2026:51112", "https://access.redhat.com/errata/RHSA-2026:54274", "https://access.redhat.com/errata/RHSA-2026:54283", "https://access.redhat.com/errata/RHSA-2026:54284", "https://access.redhat.com/errata/RHSA-2026:54285", "https://access.redhat.com/errata/RHSA-2026:54286", "https://access.redhat.com/errata/RHSA-2026:54287", "https://access.redhat.com/errata/RHSA-2026:54531", "https://access.redhat.com/errata/RHSA-2026:54552", "https://access.redhat.com/errata/RHSA-2026:54555", "https://access.redhat.com/errata/RHSA-2026:54583", "https://access.redhat.com/errata/RHSA-2026:54602", "https://access.redhat.com/errata/RHSA-2026:56340", "https://access.redhat.com/errata/RHSA-2026:56785", "https://access.redhat.com/errata/RHSA-2026:56789", "https://access.redhat.com/errata/RHSA-2026:56852", "https://access.redhat.com/errata/RHSA-2026:56854", "https://access.redhat.com/errata/RHSA-2026:56910", "https://access.redhat.com/errata/RHSA-2026:56912", "https://access.redhat.com/errata/RHSA-2026:57194", "https://access.redhat.com/errata/RHSA-2026:57482", "https://access.redhat.com/errata/RHSA-2026:57487", "https://access.redhat.com/errata/RHSA-2026:57649", "https://access.redhat.com/errata/RHSA-2026:57845", "https://access.redhat.com/errata/RHSA-2026:57914", "https://access.redhat.com/errata/RHSA-2026:59467", "https://access.redhat.com/errata/RHSA-2026:59830", "https://access.redhat.com/errata/RHSA-2026:59833", "https://access.redhat.com/errata/RHSA-2026:60018", "https://access.redhat.com/errata/RHSA-2026:60023", "https://access.redhat.com/errata/RHSA-2026:60520", "https://access.redhat.com/errata/RHSA-2026:61253", "https://access.redhat.com/errata/RHSA-2026:62260", "https://access.redhat.com/errata/RHSA-2026:62406", "https://access.redhat.com/errata/RHSA-2026:62407", "https://access.redhat.com/errata/RHSA-2026:62753", "https://access.redhat.com/errata/RHSA-2026:62754", "https://access.redhat.com/errata/RHSA-2026:62803", "https://access.redhat.com/errata/RHSA-2026:63022", "https://access.redhat.com/errata/RHSA-2026:63163", "https://access.redhat.com/errata/RHSA-2026:63332", "https://access.redhat.com/errata/RHSA-2026:63636", "https://access.redhat.com/errata/RHSA-2026:64818", "https://access.redhat.com/errata/RHSA-2026:65116", "https://access.redhat.com/errata/RHSA-2026:65117", "https://access.redhat.com/errata/RHSA-2026:65153", "https://access.redhat.com/errata/RHSA-2026:65335", "https://access.redhat.com/errata/RHSA-2026:65336", "https://access.redhat.com/errata/RHSA-2026:65534", "https://access.redhat.com/errata/RHSA-2026:65838", "https://access.redhat.com/errata/RHSA-2026:65886", "https://access.redhat.com/errata/RHSA-2026:65895", "https://access.redhat.com/errata/RHSA-2026:66022", "https://access.redhat.com/errata/RHSA-2026:66327", "https://access.redhat.com/errata/RHSA-2026:67148", "https://access.redhat.com/errata/RHSA-2026:67517", "https://access.redhat.com/errata/RHSA-2026:67974", "https://access.redhat.com/errata/RHSA-2026:67975", "https://access.redhat.com/errata/RHSA-2026:68334", "https://access.redhat.com/errata/RHSA-2026:68504", "https://access.redhat.com/errata/RHSA-2026:68527", "https://access.redhat.com/security/cve/CVE-2026-42499", "https://bugzilla.redhat.com/2467809", "https://bugzilla.redhat.com/2467820", "https://bugzilla.redhat.com/2480756", "https://bugzilla.redhat.com/2484204", "https://bugzilla.redhat.com/2515815", "https://bugzilla.redhat.com/2515820", "https://bugzilla.redhat.com/2515827", "https://bugzilla.redhat.com/2515838", "https://bugzilla.redhat.com/2515839", "https://bugzilla.redhat.com/2515840", "https://bugzilla.redhat.com/show_bug.cgi?id=2456333", "https://bugzilla.redhat.com/show_bug.cgi?id=2456339", "https://bugzilla.redhat.com/show_bug.cgi?id=2467809", "https://bugzilla.redhat.com/show_bug.cgi?id=2467820", "https://bugzilla.redhat.com/show_bug.cgi?id=2467822", "https://bugzilla.redhat.com/show_bug.cgi?id=2480756", "https://bugzilla.redhat.com/show_bug.cgi?id=2484204", "https://bugzilla.redhat.com/show_bug.cgi?id=2515815", "https://bugzilla.redhat.com/show_bug.cgi?id=2515820", "https://bugzilla.redhat.com/show_bug.cgi?id=2515827", "https://bugzilla.redhat.com/show_bug.cgi?id=2515838", "https://bugzilla.redhat.com/show_bug.cgi?id=2515839", "https://bugzilla.redhat.com/show_bug.cgi?id=2515840", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32280", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32281", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33811", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39820", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39821", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42499", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42504", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56859", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862", "https://errata.almalinux.org/9/ALSA-2026-65153.html", "https://errata.rockylinux.org/RLSA-2026:65886", "https://go.dev/cl/771520", "https://go.dev/issue/78987", "https://groups.google.com/g/golang-announce/c/qcCIEXso47M", "https://linux.oracle.com/cve/CVE-2026-42499.html", "https://linux.oracle.com/errata/ELSA-2026-70201.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-42499", "https://pkg.go.dev/vuln/GO-2026-4977", "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42499.json", "https://www.cve.org/CVERecord?id=CVE-2026-42499" ], "PublishedDate": "2026-05-07T20:16:44.54Z", "LastModifiedDate": "2026-10-26T00:10:00.15Z" }, { "VulnerabilityID": "CVE-2026-42504", "VendorIDs": [ "GO-2026-5038" ], "PkgID": "stdlib@v1.25.9", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.25.9", "UID": "2185fb41a98d095a" }, "InstalledVersion": "v1.25.9", "FixedVersion": "1.25.11, 1.26.4", "Status": "fixed", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-42504", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:3c6b4beb08b8d0b61d9637b7fbf2d4b523da3502793a61fa1596e51511d70141", "Title": "mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header", "Description": "Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU.", "Severity": "HIGH", "CweIDs": [ "CWE-407" ], "VendorSeverity": { "alma": 3, "amazon": 2, "azure": 3, "bitnami": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:65153", "https://access.redhat.com/errata/RHSA-2026:65886", "https://access.redhat.com/security/cve/CVE-2026-42504", "https://bugzilla.redhat.com/2467809", "https://bugzilla.redhat.com/2467820", "https://bugzilla.redhat.com/2480756", "https://bugzilla.redhat.com/2484204", "https://bugzilla.redhat.com/2515815", "https://bugzilla.redhat.com/2515820", "https://bugzilla.redhat.com/2515827", "https://bugzilla.redhat.com/2515838", "https://bugzilla.redhat.com/2515839", "https://bugzilla.redhat.com/2515840", "https://bugzilla.redhat.com/show_bug.cgi?id=2456333", "https://bugzilla.redhat.com/show_bug.cgi?id=2456339", "https://bugzilla.redhat.com/show_bug.cgi?id=2467809", "https://bugzilla.redhat.com/show_bug.cgi?id=2467820", "https://bugzilla.redhat.com/show_bug.cgi?id=2467822", "https://bugzilla.redhat.com/show_bug.cgi?id=2480756", "https://bugzilla.redhat.com/show_bug.cgi?id=2484204", "https://bugzilla.redhat.com/show_bug.cgi?id=2515815", "https://bugzilla.redhat.com/show_bug.cgi?id=2515820", "https://bugzilla.redhat.com/show_bug.cgi?id=2515827", "https://bugzilla.redhat.com/show_bug.cgi?id=2515838", "https://bugzilla.redhat.com/show_bug.cgi?id=2515839", "https://bugzilla.redhat.com/show_bug.cgi?id=2515840", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32280", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32281", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33811", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39820", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39821", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42499", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42504", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56859", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862", "https://errata.almalinux.org/9/ALSA-2026-65153.html", "https://errata.rockylinux.org/RLSA-2026:65886", "https://go.dev/cl/774481", "https://go.dev/issue/79217", "https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw", "https://linux.oracle.com/cve/CVE-2026-42504.html", "https://linux.oracle.com/errata/ELSA-2026-69308.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-42504", "https://pkg.go.dev/vuln/GO-2026-5038", "https://www.cve.org/CVERecord?id=CVE-2026-42504" ], "PublishedDate": "2026-06-02T23:16:37.927Z", "LastModifiedDate": "2026-07-22T19:10:00.12Z" }, { "VulnerabilityID": "CVE-2026-56853", "VendorIDs": [ "GO-2026-6089" ], "PkgID": "stdlib@v1.25.9", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.25.9", "UID": "2185fb41a98d095a" }, "InstalledVersion": "v1.25.9", "FixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3", "Status": "fixed", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-56853", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:ef449152060c19779e8c145a5daf6a746277fcc5d50064b502d6d263c4360cff", "Title": "net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service", "Description": "When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when doing this.", "Severity": "HIGH", "CweIDs": [ "CWE-770" ], "VendorSeverity": { "alma": 3, "amazon": 3, "bitnami": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:70641", "https://access.redhat.com/security/cve/CVE-2026-56853", "https://bugzilla.redhat.com/2515815", "https://bugzilla.redhat.com/2515820", "https://bugzilla.redhat.com/2515827", "https://bugzilla.redhat.com/2515838", "https://bugzilla.redhat.com/2515839", "https://bugzilla.redhat.com/show_bug.cgi?id=2402034", "https://bugzilla.redhat.com/show_bug.cgi?id=2515815", "https://bugzilla.redhat.com/show_bug.cgi?id=2515820", "https://bugzilla.redhat.com/show_bug.cgi?id=2515827", "https://bugzilla.redhat.com/show_bug.cgi?id=2515838", "https://bugzilla.redhat.com/show_bug.cgi?id=2515839", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11395", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862", "https://errata.almalinux.org/9/ALSA-2026-70641.html", "https://errata.rockylinux.org/RLSA-2026:70641", "https://go.dev/cl/795540", "https://go.dev/issue/80205", "https://groups.google.com/g/golang-announce/c/94pEornpRlI", "https://linux.oracle.com/cve/CVE-2026-56853.html", "https://linux.oracle.com/errata/ELSA-2026-89752.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-56853", "https://pkg.go.dev/vuln/GO-2026-6089", "https://www.cve.org/CVERecord?id=CVE-2026-56853" ], "PublishedDate": "2026-08-13T22:17:22.093Z", "LastModifiedDate": "2026-09-03T16:37:52.17Z" }, { "VulnerabilityID": "CVE-2026-56858", "VendorIDs": [ "GO-2026-6091" ], "PkgID": "stdlib@v1.25.9", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.25.9", "UID": "2185fb41a98d095a" }, "InstalledVersion": "v1.25.9", "FixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3", "Status": "fixed", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-56858", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:dadf2b7981c128326c8e3bf90339715ecc5df95c5698ffef9ff88a61f51cd89f", "Title": "html/template: golang: Go html/template: Cross-Site Scripting via pathological input", "Description": "Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS.", "Severity": "HIGH", "CweIDs": [ "CWE-79" ], "VendorSeverity": { "alma": 3, "amazon": 3, "bitnami": 2, "oracle-oval": 3, "photon": 2, "redhat": 3, "rocky": 3 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "V3Score": 6.1 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "V3Score": 8.1 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:70641", "https://access.redhat.com/security/cve/CVE-2026-56858", "https://bugzilla.redhat.com/2515815", "https://bugzilla.redhat.com/2515820", "https://bugzilla.redhat.com/2515827", "https://bugzilla.redhat.com/2515838", "https://bugzilla.redhat.com/2515839", "https://bugzilla.redhat.com/show_bug.cgi?id=2402034", "https://bugzilla.redhat.com/show_bug.cgi?id=2515815", "https://bugzilla.redhat.com/show_bug.cgi?id=2515820", "https://bugzilla.redhat.com/show_bug.cgi?id=2515827", "https://bugzilla.redhat.com/show_bug.cgi?id=2515838", "https://bugzilla.redhat.com/show_bug.cgi?id=2515839", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11395", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862", "https://errata.almalinux.org/9/ALSA-2026-70641.html", "https://errata.rockylinux.org/RLSA-2026:70641", "https://go.dev/cl/807100", "https://go.dev/issue/80435", "https://groups.google.com/g/golang-announce/c/94pEornpRlI", "https://linux.oracle.com/cve/CVE-2026-56858.html", "https://linux.oracle.com/errata/ELSA-2026-70641.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-56858", "https://pkg.go.dev/vuln/GO-2026-6091", "https://www.cve.org/CVERecord?id=CVE-2026-56858" ], "PublishedDate": "2026-08-13T22:17:22.207Z", "LastModifiedDate": "2026-09-03T16:37:52.17Z" }, { "VulnerabilityID": "CVE-2026-56859", "VendorIDs": [ "GO-2026-6088" ], "PkgID": "stdlib@v1.25.9", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.25.9", "UID": "2185fb41a98d095a" }, "InstalledVersion": "v1.25.9", "FixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3", "Status": "fixed", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-56859", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:3762e9afdea7337e16694e4e06a34d3038c30dd09dd45b7b8bb53e8d1a7b331a", "Title": "encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue", "Description": "Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion.", "Severity": "HIGH", "CweIDs": [ "CWE-770" ], "VendorSeverity": { "alma": 3, "amazon": 3, "bitnami": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:69961", "https://access.redhat.com/security/cve/CVE-2026-56859", "https://bugzilla.redhat.com/2480684", "https://bugzilla.redhat.com/2508234", "https://bugzilla.redhat.com/2515815", "https://bugzilla.redhat.com/2515820", "https://bugzilla.redhat.com/2515827", "https://bugzilla.redhat.com/2515838", "https://bugzilla.redhat.com/2515839", "https://bugzilla.redhat.com/2515840", "https://bugzilla.redhat.com/show_bug.cgi?id=2480684", "https://bugzilla.redhat.com/show_bug.cgi?id=2508234", "https://bugzilla.redhat.com/show_bug.cgi?id=2515815", "https://bugzilla.redhat.com/show_bug.cgi?id=2515820", "https://bugzilla.redhat.com/show_bug.cgi?id=2515827", "https://bugzilla.redhat.com/show_bug.cgi?id=2515838", "https://bugzilla.redhat.com/show_bug.cgi?id=2515839", "https://bugzilla.redhat.com/show_bug.cgi?id=2515840", "https://bugzilla.redhat.com/show_bug.cgi?id=2518147", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-17106", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-19730", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39830", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56859", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862", "https://errata.almalinux.org/9/ALSA-2026-69961.html", "https://errata.rockylinux.org/RLSA-2026:69961", "https://github.com/golang/go/issues/80481", "https://go.dev/cl/803320", "https://go.dev/issue/80481", "https://groups.google.com/g/golang-announce/c/94pEornpRlI", "https://linux.oracle.com/cve/CVE-2026-56859.html", "https://linux.oracle.com/errata/ELSA-2026-70201.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-56859", "https://pkg.go.dev/vuln/GO-2026-6088", "https://ubuntu.com/security/notices/USN-8935-1", "https://www.cve.org/CVERecord?id=CVE-2026-56859" ], "PublishedDate": "2026-08-13T22:17:22.32Z", "LastModifiedDate": "2026-09-03T16:37:52.17Z" }, { "VulnerabilityID": "CVE-2026-56860", "VendorIDs": [ "GO-2026-6218" ], "PkgID": "stdlib@v1.25.9", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.25.9", "UID": "2185fb41a98d095a" }, "InstalledVersion": "v1.25.9", "FixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3", "Status": "fixed", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-56860", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:a85e9c8d9a52d2f0670bf48fb3c0b7a902579f726645ab648b33751fa099e947", "Title": "net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution", "Description": "Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead. Now, path resolution operates on a byte buffer using index-based backtracking for '..' segments, eliminating the quadratic time complexity and significantly reducing memory allocations.", "Severity": "HIGH", "CweIDs": [ "CWE-407" ], "VendorSeverity": { "alma": 3, "amazon": 3, "bitnami": 2, "oracle-oval": 3, "photon": 2, "redhat": 3, "rocky": 3 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.9 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:70641", "https://access.redhat.com/security/cve/CVE-2026-56860", "https://bugzilla.redhat.com/2515815", "https://bugzilla.redhat.com/2515820", "https://bugzilla.redhat.com/2515827", "https://bugzilla.redhat.com/2515838", "https://bugzilla.redhat.com/2515839", "https://bugzilla.redhat.com/show_bug.cgi?id=2402034", "https://bugzilla.redhat.com/show_bug.cgi?id=2515815", "https://bugzilla.redhat.com/show_bug.cgi?id=2515820", "https://bugzilla.redhat.com/show_bug.cgi?id=2515827", "https://bugzilla.redhat.com/show_bug.cgi?id=2515838", "https://bugzilla.redhat.com/show_bug.cgi?id=2515839", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11395", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862", "https://errata.almalinux.org/9/ALSA-2026-70641.html", "https://errata.rockylinux.org/RLSA-2026:70641", "https://go.dev/cl/803681", "https://go.dev/issue/80494", "https://groups.google.com/g/golang-announce/c/94pEornpRlI", "https://linux.oracle.com/cve/CVE-2026-56860.html", "https://linux.oracle.com/errata/ELSA-2026-71619.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-56860", "https://pkg.go.dev/vuln/GO-2026-6218", "https://www.cve.org/CVERecord?id=CVE-2026-56860" ], "PublishedDate": "2026-08-13T22:17:22.44Z", "LastModifiedDate": "2026-09-03T16:37:52.17Z" }, { "VulnerabilityID": "CVE-2026-56862", "VendorIDs": [ "GO-2026-6090" ], "PkgID": "stdlib@v1.25.9", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.25.9", "UID": "2185fb41a98d095a" }, "InstalledVersion": "v1.25.9", "FixedVersion": "1.25.13, 1.26.6, 1.27.0-rc.3", "Status": "fixed", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-56862", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:faac37db1db72db2911338568accaacdffbb1bcd0a3fc619e5285c097efede5d", "Title": "crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages", "Description": "Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not. As a result, a malicious client can keep sending KeyUpdate messages to force the server to keep performing key derivation operations indefinitely.", "Severity": "HIGH", "CweIDs": [ "CWE-770" ], "VendorSeverity": { "alma": 3, "amazon": 3, "bitnami": 3, "oracle-oval": 3, "photon": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:70641", "https://access.redhat.com/security/cve/CVE-2026-56862", "https://bugzilla.redhat.com/2515815", "https://bugzilla.redhat.com/2515820", "https://bugzilla.redhat.com/2515827", "https://bugzilla.redhat.com/2515838", "https://bugzilla.redhat.com/2515839", "https://bugzilla.redhat.com/show_bug.cgi?id=2402034", "https://bugzilla.redhat.com/show_bug.cgi?id=2515815", "https://bugzilla.redhat.com/show_bug.cgi?id=2515820", "https://bugzilla.redhat.com/show_bug.cgi?id=2515827", "https://bugzilla.redhat.com/show_bug.cgi?id=2515838", "https://bugzilla.redhat.com/show_bug.cgi?id=2515839", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11395", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33818", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56853", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56858", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56860", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56862", "https://errata.almalinux.org/9/ALSA-2026-70641.html", "https://errata.rockylinux.org/RLSA-2026:70641", "https://github.com/golang/go/issues/80528", "https://go.dev/cl/804261", "https://go.dev/issue/80528", "https://groups.google.com/g/golang-announce/c/94pEornpRlI", "https://linux.oracle.com/cve/CVE-2026-56862.html", "https://linux.oracle.com/errata/ELSA-2026-70641.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-56862", "https://pkg.go.dev/vuln/GO-2026-6090", "https://ubuntu.com/security/notices/USN-8935-1", "https://www.cve.org/CVERecord?id=CVE-2026-56862" ], "PublishedDate": "2026-08-13T22:17:22.55Z", "LastModifiedDate": "2026-10-24T16:10:00.153Z" }, { "VulnerabilityID": "CVE-2026-78667", "VendorIDs": [ "GO-2026-6609" ], "PkgID": "stdlib@v1.25.9", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.25.9", "UID": "2185fb41a98d095a" }, "InstalledVersion": "v1.25.9", "FixedVersion": "1.26.9, 1.27.2", "Status": "fixed", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78667", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:55162b85bbb88f759a7bf5724b2d74e2b3c4f60c50cd1ab6c6c2b6e3737e9fa0", "Title": "net/http: golang: golang: Denial of Service via crafted HTTP Range headers", "Description": "When parsing a Range header containing a large number of small ranges, FileServer(FS), ServeContent, and ServeFile(FS) can consume an excessive amount of CPU.", "Severity": "HIGH", "CweIDs": [ "CWE-770" ], "VendorSeverity": { "alma": 3, "amazon": 3, "bitnami": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93617", "https://access.redhat.com/security/cve/CVE-2026-78667", "https://bugzilla.redhat.com/2548334", "https://bugzilla.redhat.com/2548336", "https://bugzilla.redhat.com/2548341", "https://bugzilla.redhat.com/2548344", "https://bugzilla.redhat.com/2556068", "https://bugzilla.redhat.com/show_bug.cgi?id=2548334", "https://bugzilla.redhat.com/show_bug.cgi?id=2548336", "https://bugzilla.redhat.com/show_bug.cgi?id=2548341", "https://bugzilla.redhat.com/show_bug.cgi?id=2548344", "https://bugzilla.redhat.com/show_bug.cgi?id=2556068", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-111943", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78667", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78669", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-94440", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-97031", "https://errata.almalinux.org/9/ALSA-2026-93617.html", "https://errata.rockylinux.org/RLSA-2026:93617", "https://github.com/golang/go/issues/81858", "https://go.dev/cl/847309", "https://go.dev/issue/81858", "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI", "https://linux.oracle.com/cve/CVE-2026-78667.html", "https://linux.oracle.com/errata/ELSA-2026-95519.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-78667", "https://pkg.go.dev/vuln/GO-2026-6609", "https://ubuntu.com/security/notices/USN-8935-1", "https://www.cve.org/CVERecord?id=CVE-2026-78667", "https://www.openwall.com/lists/oss-security/2026/10/08/9" ], "PublishedDate": "2026-10-08T23:17:03.88Z", "LastModifiedDate": "2026-10-09T17:16:49.69Z" }, { "VulnerabilityID": "CVE-2026-78669", "VendorIDs": [ "GO-2026-6611" ], "PkgID": "stdlib@v1.25.9", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.25.9", "UID": "2185fb41a98d095a" }, "InstalledVersion": "v1.25.9", "FixedVersion": "1.26.9, 1.27.2", "Status": "fixed", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-78669", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:39583c5cba2e1f4123e4887476501bbc520b6cec8252c2dfb89241e5fb331359", "Title": "net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive HTTP/2 SETTINGS frames", "Description": "A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values.", "Severity": "HIGH", "CweIDs": [ "CWE-405" ], "VendorSeverity": { "alma": 3, "amazon": 3, "azure": 3, "bitnami": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3, "ubuntu": 2 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:93617", "https://access.redhat.com/security/cve/CVE-2026-78669", "https://bugzilla.redhat.com/2548334", "https://bugzilla.redhat.com/2548336", "https://bugzilla.redhat.com/2548341", "https://bugzilla.redhat.com/2548344", "https://bugzilla.redhat.com/2556068", "https://bugzilla.redhat.com/show_bug.cgi?id=2548334", "https://bugzilla.redhat.com/show_bug.cgi?id=2548336", "https://bugzilla.redhat.com/show_bug.cgi?id=2548341", "https://bugzilla.redhat.com/show_bug.cgi?id=2548344", "https://bugzilla.redhat.com/show_bug.cgi?id=2556068", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-111943", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78667", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78669", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-94440", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-97031", "https://errata.almalinux.org/9/ALSA-2026-93617.html", "https://errata.rockylinux.org/RLSA-2026:93617", "https://github.com/golang/go/issues/81742", "https://go.dev/cl/847186", "https://go.dev/cl/847308", "https://go.dev/issue/81742", "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI", "https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs", "https://linux.oracle.com/cve/CVE-2026-78669.html", "https://linux.oracle.com/errata/ELSA-2026-95519.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-78669", "https://pkg.go.dev/vuln/GO-2026-6611", "https://ubuntu.com/security/notices/USN-8935-1", "https://www.cve.org/CVERecord?id=CVE-2026-78669", "https://www.openwall.com/lists/oss-security/2026/10/08/9" ], "PublishedDate": "2026-10-08T23:17:04.01Z", "LastModifiedDate": "2026-10-09T17:16:49.857Z" }, { "VulnerabilityID": "CVE-2026-97031", "VendorIDs": [ "GO-2026-6607" ], "PkgID": "stdlib@v1.25.9", "PkgName": "stdlib", "PkgIdentifier": { "PURL": "pkg:golang/stdlib@v1.25.9", "UID": "2185fb41a98d095a" }, "InstalledVersion": "v1.25.9", "FixedVersion": "1.26.9, 1.27.2", "Status": "fixed", "Layer": { "DiffID": "sha256:3c26c97d06c4df5564a77240106ca161e851be9dc66df663c9ea2a1664a8b463" }, "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-97031", "DataSource": { "ID": "govulndb", "Name": "The Go Vulnerability Database", "URL": "https://pkg.go.dev/vuln/" }, "Fingerprint": "sha256:f230163300c2faef1a49ad3107d1eedd648c6b50350eda8174caf34465476382", "Title": "crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references", "Description": "Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted packet that could trigger memory exhaustion in the server process by specifying multiple references. We now reject these as malformed and curb the memory amplification vector as a result.", "Severity": "HIGH", "CweIDs": [ "CWE-405" ], "VendorSeverity": { "alma": 3, "amazon": 3, "bitnami": 3, "oracle-oval": 3, "redhat": 3, "rocky": 3 }, "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 } }, "References": [ "https://access.redhat.com/errata/RHSA-2026:95518", "https://access.redhat.com/security/cve/CVE-2026-97031", "https://bugzilla.redhat.com/2548336", "https://bugzilla.redhat.com/2556068", "https://bugzilla.redhat.com/show_bug.cgi?id=2548336", "https://bugzilla.redhat.com/show_bug.cgi?id=2556068", "https://creativecommons.org/licenses/by/4.0/", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-111943", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-97031", "https://errata.almalinux.org/9/ALSA-2026-95518.html", "https://errata.rockylinux.org/RLSA-2026:95518", "https://go.dev/cl/847312", "https://go.dev/issue/81855", "https://groups.google.com/g/golang-announce/c/U2fTuyDJznI", "https://linux.oracle.com/cve/CVE-2026-97031.html", "https://linux.oracle.com/errata/ELSA-2026-95519.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-97031", "https://pkg.go.dev/vuln/GO-2026-6607", "https://www.cve.org/CVERecord?id=CVE-2026-97031" ], "PublishedDate": "2026-10-08T23:17:06.037Z", "LastModifiedDate": "2026-10-09T16:35:35.9Z" } ] } ] }