{ "history": [ { "added": 0, "commit": "54368575d2a0c34a82fb05c904b8207284a64891", "date": "2026-11-01", "dependencies": 101, "errors": [], "fixable": 35, "go_version": "go1.22.10", "in_binary": { "dependencies": 10, "stdlib": 66, "total": 76 }, "new_vulnerabilities": 0, "osv_confirmed": 42, "osv_only": 2, "ref": "v0.4.15", "release_changed": false, "release_integrity": "checksums-only", "removed": 0, "resolved_vulnerabilities": 0, "scorecard": 4.1, "upgraded": 0, "vulnerabilities": { "Critical": 9, "High": 18, "Low": 2, "Medium": 12, "Negligible": 0, "Unknown": 1 }, "workflow": { "High": 8, "Low": 0, "Medium": 3, "files": 2 } }, { "added": 0, "commit": "54368575d2a0c34a82fb05c904b8207284a64891", "date": "2026-11-02", "dependencies": 101, "errors": [], "fixable": 35, "go_version": "go1.22.10", "in_binary": { "dependencies": 10, "stdlib": 66, "total": 76 }, "kev": 0, "kev_new": 0, "new_vulnerabilities": 0, "osv_confirmed": 42, "osv_only": 2, "ref": "v0.4.15", "release_changed": false, "release_integrity": "checksums-only", "removed": 0, "resolved_vulnerabilities": 0, "scorecard": 4.1, "scorecard_date": "2026-10-19", "scorecard_note": null, "scorecard_source": "openssf-api", "upgraded": 0, "vulnerabilities": { "Critical": 9, "High": 18, "Low": 2, "Medium": 12, "Negligible": 0, "Unknown": 1 }, "vulnerable_packages": 11, "workflow": { "High": 8, "Low": 0, "Medium": 3, "files": 2 } } ], "latest": { "archived": false, "category": "Container Security \u203a Image Scanning", "changes": { "added": [], "any": false, "baseline": false, "in_binary_new": [], "in_binary_resolved": [], "integrity_drift": 0, "license_changes": [], "new_vulnerabilities": [], "previous_ref": "v0.4.15", "release_changed": false, "removed": [], "resolved_vulnerabilities": [], "upgraded": [], "workflow_new": 0, "workflow_resolved": 0 }, "commit": "54368575d2a0c34a82fb05c904b8207284a64891", "compliance": { "overall_score": 55, "standards": { "bsi_tr03183": { "failed_checks": [ "Component Creator", "Distribution Licences", "SHA-512 Hash", "Dependency Relationship", "SBOM Creator Contact" ], "passed": 4, "score": 44, "total": 9 }, "cisa": { "failed_checks": [ "Software Producer", "Dependency Relationship", "License Information", "Component Hash", "SBOM Author" ], "passed": 5, "score": 50, "total": 10 }, "ntia": { "failed_checks": [ "Supplier Name", "Dependency Relationship" ], "passed": 5, "score": 71, "total": 7 } } }, "components": [ { "ecosystem": "github", "licenses": [], "location": ".github/workflows/releasebuild.yml", "name": "actions/cache", "purl": "pkg:github/actions/cache@v3.2.2", "version": "v3.2.2" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/build-scan-on-push.yml", "name": "actions/checkout", "purl": "pkg:github/actions/checkout@master", "version": "master" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/releasebuild.yml", "name": "actions/setup-go", "purl": "pkg:github/actions/setup-go@v5", "version": "v5" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/build-scan-on-push.yml", "name": "Azure/container-scan", "purl": "pkg:github/Azure/container-scan@v0", "version": "v0" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/releasebuild.yml", "name": "docker/login-action", "purl": "pkg:github/docker/login-action@v1", "version": "v1" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/releasebuild.yml", "name": "goreleaser/goreleaser-action", "purl": "pkg:github/goreleaser/goreleaser-action@v2", "version": "v2" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "cloud.google.com/go/auth", "purl": "pkg:golang/cloud.google.com/go/auth@v0.10.0", "version": "v0.10.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "cloud.google.com/go/compute/metadata", "purl": "pkg:golang/cloud.google.com/go/compute/metadata@v0.5.2", "version": "v0.5.2" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "dario.cat/mergo", "purl": "pkg:golang/dario.cat/mergo@v1.0.1", "version": "v1.0.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/aws/aws-sdk-go", "purl": "pkg:golang/github.com/aws/aws-sdk-go@v1.55.5", "version": "v1.55.5" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/BurntSushi/toml", "purl": "pkg:golang/github.com/BurntSushi/toml@v1.4.0", "version": "v1.4.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/containerd/cgroups/v3", "purl": "pkg:golang/github.com/containerd/cgroups/v3@v3.0.3", "version": "v3.0.3" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/containerd/errdefs", "purl": "pkg:golang/github.com/containerd/errdefs@v0.3.0", "version": "v0.3.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/containerd/errdefs/pkg", "purl": "pkg:golang/github.com/containerd/errdefs/pkg@v0.3.0", "version": "v0.3.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/containerd/stargz-snapshotter/estargz", "purl": "pkg:golang/github.com/containerd/stargz-snapshotter/estargz@v0.15.1", "version": "v0.15.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/containerd/typeurl/v2", "purl": "pkg:golang/github.com/containerd/typeurl/v2@v2.2.0", "version": "v2.2.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/containers/image/v5", "purl": "pkg:golang/github.com/containers/image/v5@v5.33.0", "version": "v5.33.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/containers/libtrust", "purl": "pkg:golang/github.com/containers/libtrust@v0.0.0-20230121012942-c1716e8a8d01", "version": "v0.0.0-20230121012942-c1716e8a8d01" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/containers/ocicrypt", "purl": "pkg:golang/github.com/containers/ocicrypt@v1.2.0", "version": "v1.2.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/containers/storage", "purl": "pkg:golang/github.com/containers/storage@v1.56.0", "version": "v1.56.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/cpuguy83/go-md2man/v2", "purl": "pkg:golang/github.com/cpuguy83/go-md2man/v2@v2.0.5", "version": "v2.0.5" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/cyphar/filepath-securejoin", "purl": "pkg:golang/github.com/cyphar/filepath-securejoin@v0.3.4", "version": "v0.3.4" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/d4l3k/messagediff", "purl": "pkg:golang/github.com/d4l3k/messagediff@v1.2.2-0.20180726183240-b9e99b2f9263", "version": "v1.2.2-0.20180726183240-b9e99b2f9263" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/davecgh/go-spew", "purl": "pkg:golang/github.com/davecgh/go-spew@v1.1.2-0.20180830191138-d8f796af33cc", "version": "v1.1.2-0.20180830191138-d8f796af33cc" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/distribution/reference", "purl": "pkg:golang/github.com/distribution/reference@v0.6.0", "version": "v0.6.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/docker/distribution", "purl": "pkg:golang/github.com/docker/distribution@v2.8.3%2Bincompatible", "version": "v2.8.3+incompatible" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/docker/docker", "purl": "pkg:golang/github.com/docker/docker@v27.3.1%2Bincompatible", "version": "v27.3.1+incompatible" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/docker/docker-credential-helpers", "purl": "pkg:golang/github.com/docker/docker-credential-helpers@v0.8.2", "version": "v0.8.2" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/docker/go-connections", "purl": "pkg:golang/github.com/docker/go-connections@v0.5.0", "version": "v0.5.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/docker/go-units", "purl": "pkg:golang/github.com/docker/go-units@v0.5.0", "version": "v0.5.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/felixge/httpsnoop", "purl": "pkg:golang/github.com/felixge/httpsnoop@v1.0.4", "version": "v1.0.4" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/go-logr/logr", "purl": "pkg:golang/github.com/go-logr/logr@v1.4.2", "version": "v1.4.2" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/go-logr/stdr", "purl": "pkg:golang/github.com/go-logr/stdr@v1.2.2", "version": "v1.2.2" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/gogo/protobuf", "purl": "pkg:golang/github.com/gogo/protobuf@v1.3.2", "version": "v1.3.2" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/golang/groupcache", "purl": "pkg:golang/github.com/golang/groupcache@v0.0.0-20210331224755-41bb18bfe9da", "version": "v0.0.0-20210331224755-41bb18bfe9da" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/goodwithtech/deckoder", "purl": "pkg:golang/github.com/goodwithtech/deckoder@v0.0.6", "version": "v0.0.6" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/google/go-cmp", "purl": "pkg:golang/github.com/google/go-cmp@v0.6.0", "version": "v0.6.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/google/go-containerregistry", "purl": "pkg:golang/github.com/google/go-containerregistry@v0.20.2", "version": "v0.20.2" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/google/go-intervals", "purl": "pkg:golang/github.com/google/go-intervals@v0.0.2", "version": "v0.0.2" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/google/shlex", "purl": "pkg:golang/github.com/google/shlex@v0.0.0-20191202100458-e7afc7fbc510", "version": "v0.0.0-20191202100458-e7afc7fbc510" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/google/uuid", "purl": "pkg:golang/github.com/google/uuid@v1.6.0", "version": "v1.6.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/googleapis/enterprise-certificate-proxy", "purl": "pkg:golang/github.com/googleapis/enterprise-certificate-proxy@v0.3.4", "version": "v0.3.4" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/GoogleCloudPlatform/docker-credential-gcr/v2", "purl": "pkg:golang/github.com/GoogleCloudPlatform/docker-credential-gcr/v2@v2.1.26", "version": "v2.1.26" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/gorilla/mux", "purl": "pkg:golang/github.com/gorilla/mux@v1.8.1", "version": "v1.8.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/grpc-ecosystem/grpc-gateway/v2", "purl": "pkg:golang/github.com/grpc-ecosystem/grpc-gateway/v2@v2.16.0", "version": "v2.16.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/hashicorp/errwrap", "purl": "pkg:golang/github.com/hashicorp/errwrap@v1.1.0", "version": "v1.1.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/hashicorp/go-multierror", "purl": "pkg:golang/github.com/hashicorp/go-multierror@v1.1.1", "version": "v1.1.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/jmespath/go-jmespath", "purl": "pkg:golang/github.com/jmespath/go-jmespath@v0.4.0", "version": "v0.4.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/json-iterator/go", "purl": "pkg:golang/github.com/json-iterator/go@v1.1.12", "version": "v1.1.12" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/klauspost/compress", "purl": "pkg:golang/github.com/klauspost/compress@v1.17.11", "version": "v1.17.11" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/klauspost/pgzip", "purl": "pkg:golang/github.com/klauspost/pgzip@v1.2.6", "version": "v1.2.6" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/knqyf263/nested", "purl": "pkg:golang/github.com/knqyf263/nested@v0.0.1", "version": "v0.0.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/mattn/go-sqlite3", "purl": "pkg:golang/github.com/mattn/go-sqlite3@v1.14.24", "version": "v1.14.24" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/Microsoft/go-winio", "purl": "pkg:golang/github.com/Microsoft/go-winio@v0.6.2", "version": "v0.6.2" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/Microsoft/hcsshim", "purl": "pkg:golang/github.com/Microsoft/hcsshim@v0.12.9", "version": "v0.12.9" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/mistifyio/go-zfs/v3", "purl": "pkg:golang/github.com/mistifyio/go-zfs/v3@v3.0.1", "version": "v3.0.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/moby/docker-image-spec", "purl": "pkg:golang/github.com/moby/docker-image-spec@v1.3.1", "version": "v1.3.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/moby/sys/capability", "purl": "pkg:golang/github.com/moby/sys/capability@v0.3.0", "version": "v0.3.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/moby/sys/mountinfo", "purl": "pkg:golang/github.com/moby/sys/mountinfo@v0.7.2", "version": "v0.7.2" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/moby/sys/user", "purl": "pkg:golang/github.com/moby/sys/user@v0.3.0", "version": "v0.3.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/modern-go/concurrent", "purl": "pkg:golang/github.com/modern-go/concurrent@v0.0.0-20180306012644-bacd9c7ef1dd", "version": "v0.0.0-20180306012644-bacd9c7ef1dd" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/modern-go/reflect2", "purl": "pkg:golang/github.com/modern-go/reflect2@v1.0.2", "version": "v1.0.2" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/opencontainers/go-digest", "purl": "pkg:golang/github.com/opencontainers/go-digest@v1.0.0", "version": "v1.0.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/opencontainers/image-spec", "purl": "pkg:golang/github.com/opencontainers/image-spec@v1.1.0", "version": "v1.1.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/opencontainers/runtime-spec", "purl": "pkg:golang/github.com/opencontainers/runtime-spec@v1.2.0", "version": "v1.2.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/opencontainers/selinux", "purl": "pkg:golang/github.com/opencontainers/selinux@v1.11.1", "version": "v1.11.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/ostreedev/ostree-go", "purl": "pkg:golang/github.com/ostreedev/ostree-go@v0.0.0-20210805093236-719684c64e4f", "version": "v0.0.0-20210805093236-719684c64e4f" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/owenrumney/go-sarif/v2", "purl": "pkg:golang/github.com/owenrumney/go-sarif/v2@v2.0.17", "version": "v2.0.17" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/pkg/errors", "purl": "pkg:golang/github.com/pkg/errors@v0.9.1", "version": "v0.9.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/pmezard/go-difflib", "purl": "pkg:golang/github.com/pmezard/go-difflib@v1.0.1-0.20181226105442-5d4384ee4fb2", "version": "v1.0.1-0.20181226105442-5d4384ee4fb2" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/russross/blackfriday/v2", "purl": "pkg:golang/github.com/russross/blackfriday/v2@v2.1.0", "version": "v2.1.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/sirupsen/logrus", "purl": "pkg:golang/github.com/sirupsen/logrus@v1.9.3", "version": "v1.9.3" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/stretchr/objx", "purl": "pkg:golang/github.com/stretchr/objx@v0.5.2", "version": "v0.5.2" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/stretchr/testify", "purl": "pkg:golang/github.com/stretchr/testify@v1.10.0", "version": "v1.10.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/sylabs/sif/v2", "purl": "pkg:golang/github.com/sylabs/sif/v2@v2.19.1", "version": "v2.19.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/tchap/go-patricia/v2", "purl": "pkg:golang/github.com/tchap/go-patricia/v2@v2.3.1", "version": "v2.3.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/toqueteos/webbrowser", "purl": "pkg:golang/github.com/toqueteos/webbrowser@v1.2.0", "version": "v1.2.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/ulikunitz/xz", "purl": "pkg:golang/github.com/ulikunitz/xz@v0.5.12", "version": "v0.5.12" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/urfave/cli", "purl": "pkg:golang/github.com/urfave/cli@v1.22.15", "version": "v1.22.15" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/vbatts/tar-split", "purl": "pkg:golang/github.com/vbatts/tar-split@v0.11.6", "version": "v0.11.6" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "go.opencensus.io", "purl": "pkg:golang/go.opencensus.io@v0.24.0", "version": "v0.24.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "go.opentelemetry.io/auto/sdk", "purl": "pkg:golang/go.opentelemetry.io/auto/sdk@v1.1.0", "version": "v1.1.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp", "purl": "pkg:golang/go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp@v0.54.0", "version": "v0.54.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "go.opentelemetry.io/otel", "purl": "pkg:golang/go.opentelemetry.io/otel@v1.33.0", "version": "v1.33.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "go.opentelemetry.io/otel/metric", "purl": "pkg:golang/go.opentelemetry.io/otel/metric@v1.33.0", "version": "v1.33.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "go.opentelemetry.io/otel/trace", "purl": "pkg:golang/go.opentelemetry.io/otel/trace@v1.33.0", "version": "v1.33.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "go.uber.org/atomic", "purl": "pkg:golang/go.uber.org/atomic@v1.7.0", "version": "v1.7.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "go.uber.org/multierr", "purl": "pkg:golang/go.uber.org/multierr@v1.6.0", "version": "v1.6.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "go.uber.org/zap", "purl": "pkg:golang/go.uber.org/zap@v1.17.0", "version": "v1.17.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "golang.org/x/crypto", "purl": "pkg:golang/golang.org/x/crypto@v0.29.0", "version": "v0.29.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "golang.org/x/exp", "purl": "pkg:golang/golang.org/x/exp@v0.0.0-20241009180824-f66d83c29e7c", "version": "v0.0.0-20241009180824-f66d83c29e7c" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "golang.org/x/oauth2", "purl": "pkg:golang/golang.org/x/oauth2@v0.23.0", "version": "v0.23.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "golang.org/x/sync", "purl": "pkg:golang/golang.org/x/sync@v0.9.0", "version": "v0.9.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "golang.org/x/sys", "purl": "pkg:golang/golang.org/x/sys@v0.28.0", "version": "v0.28.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "golang.org/x/text", "purl": "pkg:golang/golang.org/x/text@v0.20.0", "version": "v0.20.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "golang.org/x/time", "purl": "pkg:golang/golang.org/x/time@v0.0.0-20220210224613-90d013bbcef8", "version": "v0.0.0-20220210224613-90d013bbcef8" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "golang.org/x/xerrors", "purl": "pkg:golang/golang.org/x/xerrors@v0.0.0-20231012003039-104605ab7028", "version": "v0.0.0-20231012003039-104605ab7028" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "google.golang.org/genproto/googleapis/rpc", "purl": "pkg:golang/google.golang.org/genproto/googleapis/rpc@v0.0.0-20241118233622-e639e219e697", "version": "v0.0.0-20241118233622-e639e219e697" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "google.golang.org/grpc", "purl": "pkg:golang/google.golang.org/grpc@v1.68.0", "version": "v1.68.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "google.golang.org/protobuf", "purl": "pkg:golang/google.golang.org/protobuf@v1.35.2", "version": "v1.35.2" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "gopkg.in/yaml.v3", "purl": "pkg:golang/gopkg.in/yaml.v3@v3.0.1", "version": "v3.0.1" } ], "description": "Lint container images for security best practices", "errors": [], "go_binary": { "asset": "dockle_0.4.15_Linux-64bit.tar.gz", "binary": "dockle", "db": "https://vuln.go.dev", "db_last_modified": "2026-10-27T21:16:18Z", "findings": [ { "aliases": [ "CVE-2024-45341" ], "epss": { "cve": "CVE-2024-45341", "percentile": 0.4706, "score": 0.00568 }, "fixed_version": "v1.22.11", "id": "GO-2025-3373", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Usage of IPv6 zone IDs can bypass URI name constraints in crypto/x509", "version": "v1.22.10" }, { "aliases": [ "CVE-2024-45336" ], "epss": { "cve": "CVE-2024-45336", "percentile": 0.54121, "score": 0.00726 }, "fixed_version": "v1.22.11", "id": "GO-2025-3420", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Sensitive headers incorrectly sent after cross-domain redirect in net/http", "version": "v1.22.10" }, { "aliases": [ "CVE-2025-22870", "GHSA-qxp5-gwg8-xv66" ], "epss": { "cve": "CVE-2025-22870", "percentile": 0.36779, "score": 0.00425 }, "fixed_version": "v1.23.7", "id": "GO-2025-3503", "kev": null, "level": "symbol", "module": "stdlib", "summary": "HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net", "version": "v1.22.10" }, { "aliases": [ "CVE-2025-22871" ], "epss": { "cve": "CVE-2025-22871", "percentile": 0.57935, "score": 0.00842 }, "fixed_version": "v1.23.8", "id": "GO-2025-3563", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Request smuggling due to acceptance of invalid chunked data in net/http", "version": "v1.22.10" }, { "aliases": [ "CVE-2025-4673" ], "epss": { "cve": "CVE-2025-4673", "percentile": 0.51827, "score": 0.00666 }, "fixed_version": "v1.23.10", "id": "GO-2025-3751", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Sensitive headers not cleared on cross-origin redirect in net/http", "version": "v1.22.10" }, { "aliases": [ "CVE-2025-47907" ], "epss": { "cve": "CVE-2025-47907", "percentile": 0.34914, "score": 0.00406 }, "fixed_version": "v1.23.12", "id": "GO-2025-3849", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Incorrect results returned from Rows.Scan in database/sql", "version": "v1.22.10" }, { "aliases": [ "CVE-2025-47906", "CVE-2025-47906" ], "epss": { "cve": "CVE-2025-47906", "percentile": 0.46025, "score": 0.0055 }, "fixed_version": "v1.23.12", "id": "GO-2025-3956", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Unexpected paths returned from LookPath in os/exec", "version": "v1.22.10" }, { "aliases": [ "CVE-2025-61725", "CVE-2025-61725" ], "epss": { "cve": "CVE-2025-61725", "percentile": 0.51041, "score": 0.00647 }, "fixed_version": "v1.24.8", "id": "GO-2025-4006", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Excessive CPU consumption in ParseAddress in net/mail", "version": "v1.22.10" }, { "aliases": [ "CVE-2025-58187", "CVE-2025-58187" ], "epss": { "cve": "CVE-2025-58187", "percentile": 0.34877, "score": 0.00406 }, "fixed_version": "v1.24.9", "id": "GO-2025-4007", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Quadratic complexity when checking name constraints in crypto/x509", "version": "v1.22.10" }, { "aliases": [ "CVE-2025-58189", "CVE-2025-58189" ], "epss": { "cve": "CVE-2025-58189", "percentile": 0.40494, "score": 0.00468 }, "fixed_version": "v1.24.8", "id": "GO-2025-4008", "kev": null, "level": "symbol", "module": "stdlib", "summary": "ALPN negotiation error contains attacker controlled information in crypto/tls", "version": "v1.22.10" }, { "aliases": [ "CVE-2025-61723", "CVE-2025-61723" ], "epss": { "cve": "CVE-2025-61723", "percentile": 0.51648, "score": 0.00661 }, "fixed_version": "v1.24.8", "id": "GO-2025-4009", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Quadratic complexity when parsing some invalid inputs in encoding/pem", "version": "v1.22.10" }, { "aliases": [ "CVE-2025-47912", "CVE-2025-47912" ], "epss": { "cve": "CVE-2025-47912", "percentile": 0.40493, "score": 0.00468 }, "fixed_version": "v1.24.8", "id": "GO-2025-4010", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Insufficient validation of bracketed IPv6 hostnames in net/url", "version": "v1.22.10" }, { "aliases": [ "CVE-2025-58185", "CVE-2025-58185" ], "epss": { "cve": "CVE-2025-58185", "percentile": 0.46363, "score": 0.00556 }, "fixed_version": "v1.24.8", "id": "GO-2025-4011", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Parsing DER payload can cause memory exhaustion in encoding/asn1", "version": "v1.22.10" }, { "aliases": [ "CVE-2025-58186", "CVE-2025-58186" ], "epss": { "cve": "CVE-2025-58186", "percentile": 0.46913, "score": 0.00565 }, "fixed_version": "v1.24.8", "id": "GO-2025-4012", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Lack of limit when parsing cookies can cause memory exhaustion in net/http", "version": "v1.22.10" }, { "aliases": [ "CVE-2025-58188", "CVE-2025-58188" ], "epss": { "cve": "CVE-2025-58188", "percentile": 0.32165, "score": 0.00381 }, "fixed_version": "v1.24.8", "id": "GO-2025-4013", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Panic when validating certificates with DSA public keys in crypto/x509", "version": "v1.22.10" }, { "aliases": [ "CVE-2025-58183", "CVE-2025-58183" ], "epss": { "cve": "CVE-2025-58183", "percentile": 0.38512, "score": 0.00443 }, "fixed_version": "v1.24.8", "id": "GO-2025-4014", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Unbounded allocation when parsing GNU sparse map in archive/tar", "version": "v1.22.10" }, { "aliases": [ "CVE-2025-61724", "CVE-2025-61724" ], "epss": { "cve": "CVE-2025-61724", "percentile": 0.46363, "score": 0.00556 }, "fixed_version": "v1.24.8", "id": "GO-2025-4015", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Excessive CPU consumption in Reader.ReadResponse in net/textproto", "version": "v1.22.10" }, { "aliases": [ "CVE-2025-61729", "CVE-2025-61729" ], "epss": { "cve": "CVE-2025-61729", "percentile": 0.39638, "score": 0.00457 }, "fixed_version": "v1.24.11", "id": "GO-2025-4155", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Excessive resource consumption when printing error string for host certificate validation in crypto/x509", "version": "v1.22.10" }, { "aliases": [ "CVE-2025-61727" ], "epss": { "cve": "CVE-2025-61727", "percentile": 0.20933, "score": 0.00284 }, "fixed_version": "v1.24.11", "id": "GO-2025-4175", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Improper application of excluded DNS name constraints when verifying wildcard names in crypto/x509", "version": "v1.22.10" }, { "aliases": [ "CVE-2025-68121" ], "epss": { "cve": "CVE-2025-68121", "percentile": 0.59731, "score": 0.00902 }, "fixed_version": "v1.24.13", "id": "GO-2026-4337", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Unexpected session resumption in crypto/tls", "version": "v1.22.10" }, { "aliases": [ "CVE-2025-61730", "CVE-2025-61730" ], "epss": { "cve": "CVE-2025-61730", "percentile": 0.25445, "score": 0.00324 }, "fixed_version": "v1.24.12", "id": "GO-2026-4340", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Handshake messages may be processed at the incorrect encryption level in crypto/tls", "version": "v1.22.10" }, { "aliases": [ "CVE-2025-61726", "CVE-2025-61726" ], "epss": { "cve": "CVE-2025-61726", "percentile": 0.83237, "score": 0.02292 }, "fixed_version": "v1.24.12", "id": "GO-2026-4341", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Memory exhaustion in query parameter parsing in net/url", "version": "v1.22.10" }, { "aliases": [ "CVE-2025-61728", "CVE-2025-61728" ], "epss": { "cve": "CVE-2025-61728", "percentile": 0.54549, "score": 0.00738 }, "fixed_version": "v1.24.12", "id": "GO-2026-4342", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Excessive CPU consumption when building archive index in archive/zip", "version": "v1.22.10" }, { "aliases": [ "CVE-2025-22873" ], "epss": { "cve": "CVE-2025-22873", "percentile": 0.1423, "score": 0.00233 }, "fixed_version": "v1.23.9", "id": "GO-2026-4403", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Improper access to parent directory of root in os", "version": "v1.22.10" }, { "aliases": [ "CVE-2026-25679" ], "epss": { "cve": "CVE-2026-25679", "percentile": 0.57493, "score": 0.00827 }, "fixed_version": "v1.25.8", "id": "GO-2026-4601", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Incorrect parsing of IPv6 host literals in net/url", "version": "v1.22.10" }, { "aliases": [ "CVE-2026-27139" ], "epss": { "cve": "CVE-2026-27139", "percentile": 0.12457, "score": 0.00219 }, "fixed_version": "v1.25.8", "id": "GO-2026-4602", "kev": null, "level": "symbol", "module": "stdlib", "summary": "FileInfo can escape from a Root in os", "version": "v1.22.10" }, { "aliases": [ "CVE-2026-27142" ], "epss": { "cve": "CVE-2026-27142", "percentile": 0.31368, "score": 0.00374 }, "fixed_version": "v1.25.8", "id": "GO-2026-4603", "kev": null, "level": "symbol", "module": "stdlib", "summary": "URLs in meta content attribute actions are not escaped in html/template", "version": "v1.22.10" }, { "aliases": [ "CVE-2026-32282" ], "epss": { "cve": "CVE-2026-32282", "percentile": 0.21771, "score": 0.00292 }, "fixed_version": "v1.25.9", "id": "GO-2026-4864", "kev": null, "level": "symbol", "module": "stdlib", "summary": "TOCTOU permits root escape on Linux via Root.Chmod in os in internal/syscall/unix", "version": "v1.22.10" }, { "aliases": [ "CVE-2026-32289" ], "epss": { "cve": "CVE-2026-32289", "percentile": 0.21611, "score": 0.0029 }, "fixed_version": "v1.25.9", "id": "GO-2026-4865", "kev": null, "level": "symbol", "module": "stdlib", "summary": "JsBraceDepth Context Tracking Bugs (XSS) in html/template", "version": "v1.22.10" }, { "aliases": [ "CVE-2026-32288" ], "epss": { "cve": "CVE-2026-32288", "percentile": 0.21609, "score": 0.0029 }, "fixed_version": "v1.25.9", "id": "GO-2026-4869", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Unbounded allocation for old GNU sparse in archive/tar", "version": "v1.22.10" }, { "aliases": [ "CVE-2026-32283" ], "epss": { "cve": "CVE-2026-32283", "percentile": 0.49799, "score": 0.00621 }, "fixed_version": "v1.25.9", "id": "GO-2026-4870", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Unauthenticated TLS 1.3 KeyUpdate record can cause persistent connection retention and DoS in crypto/tls", "version": "v1.22.10" }, { "aliases": [ "CVE-2026-33814" ], "epss": { "cve": "CVE-2026-33814", "percentile": 0.57885, "score": 0.0084 }, "fixed_version": "v1.25.10", "id": "GO-2026-4918", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net", "version": "v1.22.10" }, { "aliases": [ "CVE-2026-32281" ], "epss": { "cve": "CVE-2026-32281", "percentile": 0.2925, "score": 0.00355 }, "fixed_version": "v1.25.9", "id": "GO-2026-4946", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Inefficient policy validation in crypto/x509", "version": "v1.22.10" }, { "aliases": [ "CVE-2026-32280" ], "epss": { "cve": "CVE-2026-32280", "percentile": 0.49458, "score": 0.00615 }, "fixed_version": "v1.25.9", "id": "GO-2026-4947", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Unexpected work during chain building in crypto/x509", "version": "v1.22.10" }, { "aliases": [ "CVE-2026-39822" ], "epss": { "cve": "CVE-2026-39822", "percentile": 0.14177, "score": 0.00232 }, "fixed_version": "v1.25.12", "id": "GO-2026-4970", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Root escape via symlink plus trailing slash in os", "version": "v1.22.10" }, { "aliases": [ "CVE-2026-39836" ], "epss": { "cve": "CVE-2026-39836", "percentile": 0.50332, "score": 0.00633 }, "fixed_version": "v1.25.10", "id": "GO-2026-4971", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Panic in Dial and LookupPort when handling NUL byte on Windows in net", "version": "v1.22.10" }, { "aliases": [ "CVE-2026-39825" ], "epss": { "cve": "CVE-2026-39825", "percentile": 0.33182, "score": 0.0039 }, "fixed_version": "v1.25.10", "id": "GO-2026-4976", "kev": null, "level": "symbol", "module": "stdlib", "summary": "ReverseProxy forwards queries with more than urlmaxqueryparams parameters in net/http/httputil", "version": "v1.22.10" }, { "aliases": [ "CVE-2026-42499" ], "epss": { "cve": "CVE-2026-42499", "percentile": 0.56521, "score": 0.00798 }, "fixed_version": "v1.25.10", "id": "GO-2026-4977", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Quadratic string concatenation in consumePhrase in net/mail", "version": "v1.22.10" }, { "aliases": [ "CVE-2026-39826" ], "epss": { "cve": "CVE-2026-39826", "percentile": 0.31066, "score": 0.00371 }, "fixed_version": "v1.25.10", "id": "GO-2026-4980", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Escaper bypass leads to XSS in html/template", "version": "v1.22.10" }, { "aliases": [ "CVE-2026-33811" ], "epss": { "cve": "CVE-2026-33811", "percentile": 0.58975, "score": 0.00875 }, "fixed_version": "v1.25.10", "id": "GO-2026-4981", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Crash when handling long CNAME response in net", "version": "v1.22.10" }, { "aliases": [ "CVE-2026-39823" ], "epss": { "cve": "CVE-2026-39823", "percentile": 0.24388, "score": 0.00314 }, "fixed_version": "v1.25.10", "id": "GO-2026-4982", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Bypass of meta content URL escaping causes XSS in html/template", "version": "v1.22.10" }, { "aliases": [ "CVE-2026-39820" ], "epss": { "cve": "CVE-2026-39820", "percentile": 0.56059, "score": 0.00784 }, "fixed_version": "v1.25.10", "id": "GO-2026-4986", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Quadratic string concatentation in consumeComment in net/mail", "version": "v1.22.10" }, { "aliases": [ "CVE-2026-39821" ], "epss": { "cve": "CVE-2026-39821", "percentile": 0.78915, "score": 0.01834 }, "fixed_version": "v1.25.13", "id": "GO-2026-5026", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna", "version": "v1.22.10" }, { "aliases": [ "CVE-2026-27145" ], "epss": { "cve": "CVE-2026-27145", "percentile": 0.48256, "score": 0.00591 }, "fixed_version": "v1.25.11", "id": "GO-2026-5037", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Inefficient candidate hostname parsing in crypto/x509", "version": "v1.22.10" }, { "aliases": [ "CVE-2026-42504" ], "epss": { "cve": "CVE-2026-42504", "percentile": 0.46636, "score": 0.0056 }, "fixed_version": "v1.25.11", "id": "GO-2026-5038", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Quadratic complexity in WordDecoder.DecodeHeader in mime", "version": "v1.22.10" }, { "aliases": [ "CVE-2026-42507" ], "epss": { "cve": "CVE-2026-42507", "percentile": 0.30985, "score": 0.0037 }, "fixed_version": "v1.25.11", "id": "GO-2026-5039", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Arbitrary inputs are included in errors without any escaping in net/textproto", "version": "v1.22.10" }, { "aliases": [ "CVE-2026-42505" ], "epss": { "cve": "CVE-2026-42505", "percentile": 0.32254, "score": 0.00382 }, "fixed_version": "v1.25.12", "id": "GO-2026-5856", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Invoking Encrypted Client Hello privacy leak in crypto/tls", "version": "v1.22.10" }, { "aliases": [ "CVE-2026-33818" ], "epss": { "cve": "CVE-2026-33818", "percentile": 0.47077, "score": 0.00568 }, "fixed_version": "v1.25.13", "id": "GO-2026-5972", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Enforce maximum recursion depth in encoding/asn1", "version": "v1.22.10" }, { "aliases": [ "CVE-2026-56859" ], "epss": { "cve": "CVE-2026-56859", "percentile": 0.47076, "score": 0.00568 }, "fixed_version": "v1.25.13", "id": "GO-2026-6088", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Add recursion depth guard during decode in encoding/xml", "version": "v1.22.10" }, { "aliases": [ "CVE-2026-56853" ], "epss": { "cve": "CVE-2026-56853", "percentile": 0.47076, "score": 0.00568 }, "fixed_version": "v1.25.13", "id": "GO-2026-6089", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Apply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/http", "version": "v1.22.10" }, { "aliases": [ "CVE-2026-56862" ], "epss": { "cve": "CVE-2026-56862", "percentile": 0.47076, "score": 0.00568 }, "fixed_version": "v1.25.13", "id": "GO-2026-6090", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Limit handshake messages we are willing to accept post-handshake in crypto/tls", "version": "v1.22.10" }, { "aliases": [ "CVE-2026-56858" ], "epss": { "cve": "CVE-2026-56858", "percentile": 0.23831, "score": 0.0031 }, "fixed_version": "v1.25.13", "id": "GO-2026-6091", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Fix Javascript regexp context tracking in html/template", "version": "v1.22.10" }, { "aliases": [ "CVE-2026-56860" ], "epss": { "cve": "CVE-2026-56860", "percentile": 0.46041, "score": 0.0055 }, "fixed_version": "v1.25.13", "id": "GO-2026-6218", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Avoid quadratic complexity in resolvePath in net/url", "version": "v1.22.10" }, { "aliases": [ "CVE-2026-94448" ], "epss": { "cve": "CVE-2026-94448", "percentile": 0.21475, "score": 0.00289 }, "fixed_version": "v1.26.9", "id": "GO-2026-6599", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Reset context tracking on consecutive template expressions in html/template", "version": "v1.22.10" }, { "aliases": [ "CVE-2026-97030" ], "epss": { "cve": "CVE-2026-97030", "percentile": 0.21475, "score": 0.00289 }, "fixed_version": "v1.26.9", "id": "GO-2026-6600", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Recognize yield as regexp preceder keyword in html/template", "version": "v1.22.10" }, { "aliases": [ "CVE-2026-78659" ], "epss": { "cve": "CVE-2026-78659", "percentile": 0.50082, "score": 0.00627 }, "fixed_version": "v1.26.9", "id": "GO-2026-6603", "kev": null, "level": "symbol", "module": "stdlib", "summary": "HTTP/2 server memory exhaustion due to Trailer headers in net/http", "version": "v1.22.10" }, { "aliases": [ "CVE-2026-56866" ], "epss": { "cve": "CVE-2026-56866", "percentile": 0.40968, "score": 0.00473 }, "fixed_version": "v1.26.9", "id": "GO-2026-6605", "kev": null, "level": "symbol", "module": "stdlib", "summary": "HTTP/1 client connection desynchronization after CONNECT rejection in net/http", "version": "v1.22.10" }, { "aliases": [ "CVE-2026-97031" ], "epss": { "cve": "CVE-2026-97031", "percentile": 0.44095, "score": 0.00519 }, "fixed_version": "v1.26.9", "id": "GO-2026-6607", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Reject malformed ECH outer extension references in crypto/tls", "version": "v1.22.10" }, { "aliases": [ "CVE-2026-94440" ], "epss": { "cve": "CVE-2026-94440", "percentile": 0.4362, "score": 0.00511 }, "fixed_version": "v1.26.9", "id": "GO-2026-6608", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Memory limit bypass when parsing MIME headers in net/textproto, mime/multipart", "version": "v1.22.10" }, { "aliases": [ "CVE-2026-78667" ], "epss": { "cve": "CVE-2026-78667", "percentile": 0.41455, "score": 0.0048 }, "fixed_version": "v1.26.9", "id": "GO-2026-6609", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Lack of limit on size of parsed Range headers in net/http", "version": "v1.22.10" }, { "aliases": [ "CVE-2026-78660" ], "epss": { "cve": "CVE-2026-78660", "percentile": 0.36838, "score": 0.00425 }, "fixed_version": "v1.26.9", "id": "GO-2026-6610", "kev": null, "level": "symbol", "module": "stdlib", "summary": "HTTP/2 transport accepts malformed framing-related headers in net/http", "version": "v1.22.10" }, { "aliases": [ "CVE-2026-78669" ], "epss": { "cve": "CVE-2026-78669", "percentile": 0.49426, "score": 0.00614 }, "fixed_version": "v1.26.9", "id": "GO-2026-6611", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Excessive CPU consumption from repeated initial window changes in net/http", "version": "v1.22.10" }, { "aliases": [ "CVE-2026-78663" ], "epss": { "cve": "CVE-2026-78663", "percentile": 0.49813, "score": 0.00622 }, "fixed_version": "v1.26.9", "id": "GO-2026-6612", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Double flow control refund on HTTP/2 server streams in net/http", "version": "v1.22.10" }, { "aliases": [ "CVE-2026-94439" ], "epss": { "cve": "CVE-2026-94439", "percentile": 0.35772, "score": 0.00414 }, "fixed_version": "v1.26.9", "id": "GO-2026-6613", "kev": null, "level": "symbol", "module": "stdlib", "summary": "HTTP/1 server connection desynchronization after 2xx CONNECT response in net/http", "version": "v1.22.10" }, { "aliases": [ "CVE-2026-97032" ], "epss": { "cve": "CVE-2026-97032", "percentile": 0.42154, "score": 0.0049 }, "fixed_version": "v1.26.9", "id": "GO-2026-6617", "kev": null, "level": "symbol", "module": "stdlib", "summary": "HTTP/2 server crash due to HPACK encoder race in net/http", "version": "v1.22.10" }, { "aliases": [ "CVE-2026-111943" ], "epss": { "cve": "CVE-2026-111943", "percentile": 0.33793, "score": 0.00396 }, "fixed_version": "v1.26.10", "id": "GO-2026-6809", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Distrust compromised intermediate certificates in crypto/x509", "version": "v1.22.10" }, { "aliases": [ "CVE-2020-8912", "GHSA-7f33-f4f5-xwgw" ], "epss": { "cve": "CVE-2020-8912", "percentile": 0.14036, "score": 0.00231 }, "fixed_version": "", "id": "GO-2022-0635", "kev": null, "level": "symbol", "module": "github.com/aws/aws-sdk-go", "summary": "In-band key negotiation issue in AWS S3 Crypto SDK for golang in github.com/aws/aws-sdk-go", "version": "v1.55.5" }, { "aliases": [ "CVE-2020-8911", "GHSA-f5pg-7wfw-84q9" ], "epss": { "cve": "CVE-2020-8911", "percentile": 0.28235, "score": 0.00346 }, "fixed_version": "", "id": "GO-2022-0646", "kev": null, "level": "symbol", "module": "github.com/aws/aws-sdk-go", "summary": "CBC padding oracle issue in AWS S3 Crypto SDK for golang in github.com/aws/aws-sdk-go", "version": "v1.55.5" }, { "aliases": [ "CVE-2026-33997", "GHSA-pxq6-2prw-chj9" ], "epss": { "cve": "CVE-2026-33997", "percentile": 0.34433, "score": 0.00402 }, "fixed_version": "", "id": "GO-2026-4883", "kev": null, "level": "symbol", "module": "github.com/docker/docker", "summary": "Moby has an Off-by-one error in its plugin privilege validation in github.com/docker/docker", "version": "v27.3.1+incompatible" }, { "aliases": [ "CVE-2026-34040", "GHSA-x744-4wpc-v9h2" ], "epss": { "cve": "CVE-2026-34040", "percentile": 0.95361, "score": 0.0927 }, "fixed_version": "", "id": "GO-2026-4887", "kev": null, "level": "symbol", "module": "github.com/docker/docker", "summary": "Moby has AuthZ plugin bypass when provided oversized request bodies in github.com/docker/docker", "version": "v27.3.1+incompatible" }, { "aliases": [ "CVE-2026-42306", "GHSA-rg2x-37c3-w2rh" ], "epss": { "cve": "CVE-2026-42306", "percentile": 0.01018, "score": 0.00104 }, "fixed_version": "", "id": "GO-2026-5617", "kev": null, "level": "symbol", "module": "github.com/docker/docker", "summary": "Race condition in 'docker cp' in github.com/docker/docker allows bind mount redirection", "version": "v27.3.1+incompatible" }, { "aliases": [ "CVE-2026-41568", "GHSA-vp62-88p7-qqf5" ], "epss": { "cve": "CVE-2026-41568", "percentile": 0.01188, "score": 0.00108 }, "fixed_version": "", "id": "GO-2026-5668", "kev": null, "level": "symbol", "module": "github.com/docker/docker", "summary": "Race condition in 'docker cp' in github.com/docker/docker allows creation of arbitrary files", "version": "v27.3.1+incompatible" }, { "aliases": [ "CVE-2026-41567", "GHSA-x86f-5xw2-fm2r" ], "epss": { "cve": "CVE-2026-41567", "percentile": 0.04603, "score": 0.00155 }, "fixed_version": "", "id": "GO-2026-5746", "kev": null, "level": "symbol", "module": "github.com/docker/docker", "summary": "Docker: 'PUT /containers/{id}/archive' executes container binary on the host in github.com/docker/docker", "version": "v27.3.1+incompatible" }, { "aliases": [ "GHSA-259r-337f-4rfw" ], "epss": null, "fixed_version": "v1.18.7", "id": "GO-2026-5841", "kev": null, "level": "symbol", "module": "github.com/klauspost/compress", "summary": "OOB read in github.com/klauspost/compress/s2", "version": "v1.17.11" }, { "aliases": [ "CVE-2026-61801", "GHSA-mjcv-p78q-w5fw" ], "epss": { "cve": "CVE-2026-61801", "percentile": 0.01634, "score": 0.00117 }, "fixed_version": "v0.4.1", "id": "GO-2026-6686", "kev": null, "level": "symbol", "module": "github.com/moby/sys/user", "summary": "Possible DoS via unbounded parsing of user and group database files in github.com/moby/sys/user", "version": "v0.3.0" }, { "aliases": [ "CVE-2025-22868" ], "epss": { "cve": "CVE-2025-22868", "percentile": 0.58812, "score": 0.0087 }, "fixed_version": "v0.27.0", "id": "GO-2025-3488", "kev": null, "level": "symbol", "module": "golang.org/x/oauth2", "summary": "Unexpected memory consumption during token parsing in golang.org/x/oauth2", "version": "v0.23.0" }, { "aliases": [ "CVE-2025-52881", "GHSA-cgrx-mc8f-2prm" ], "epss": { "cve": "CVE-2025-52881", "percentile": 0.56643, "score": 0.00801 }, "fixed_version": "v1.13.0", "id": "GO-2025-4098", "kev": null, "level": "module", "module": "github.com/opencontainers/selinux", "summary": "Container escape and DDoS due to arbitrary write gadgets and procfs write redirects in github.com/opencontainers/runc", "version": "v1.11.1" }, { "aliases": [ "CVE-2025-58058", "GHSA-jc7w-c686-c4v9" ], "epss": { "cve": "CVE-2025-58058", "percentile": 0.37578, "score": 0.00433 }, "fixed_version": "v0.5.15", "id": "GO-2025-3922", "kev": null, "level": "module", "module": "github.com/ulikunitz/xz", "summary": "Memory leaks when decoding a corrupted multiple LZMA archives in github.com/ulikunitz/xz", "version": "v0.5.12" } ], "go_version": "go1.22.10", "main_module": "github.com/goodwithtech/dockle" }, "id": "goodwithtech__dockle", "manifests": [ ".github/workflows/build-scan-on-push.yml", ".github/workflows/releasebuild.yml", "go.mod", "go.sum" ], "name": "dockle", "osv": { "advisories": 44, "available": true, "confirmed": 42, "osv_only": [ { "ecosystem": "Go", "ids": [ "CVE-2020-8912", "GHSA-7f33-f4f5-xwgw", "GO-2022-0635" ], "package": "github.com/aws/aws-sdk-go", "score": "", "severity": "Unknown", "version": "1.55.5" }, { "ecosystem": "Go", "ids": [ "CVE-2020-8911", "GHSA-f5pg-7wfw-84q9", "GO-2022-0646" ], "package": "github.com/aws/aws-sdk-go", "score": "", "severity": "Unknown", "version": "1.55.5" } ], "warning": null }, "ref": "v0.4.15", "ref_kind": "release", "release_integrity": { "asset": "dockle_0.4.15_Linux-64bit.tar.gz", "assets": 23, "build_provenance": null, "checksums_published": true, "digest_matches_github": null, "immutable_release": null, "methods": [], "provenance_published": false, "sbom_published": false, "signature": null, "signatures_published": false, "signer": null, "verdict": "checksums-only" }, "released_at": "2025-01-06T06:08:16Z", "repository": "goodwithtech/dockle", "sbomlyze_diff": { "added": 0, "changed": 0, "drift": {}, "findings": [ "0 version changes among 105 shared packages \u2014 no actual upgrades", "Core system packages stable: golang (95) unchanged" ], "removed": 0 }, "scanned_at": "2026-11-02T03:07:35+00:00", "scorecard": { "checks": [ { "name": "CII-Best-Practices", "reason": "no effort to earn an OpenSSF best practices badge detected", "score": 0 }, { "name": "Fuzzing", "reason": "project is not fuzzed", "score": 0 }, { "name": "Maintained", "reason": "0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0", "score": 0 }, { "name": "Security-Policy", "reason": "security policy file not detected", "score": 0 }, { "name": "Signed-Releases", "reason": "Project has not signed or included provenance with any releases.", "score": 0 }, { "name": "Token-Permissions", "reason": "detected GitHub workflow tokens with excessive permissions", "score": 0 }, { "name": "Code-Review", "reason": "Found 8/29 approved changesets -- score normalized to 2", "score": 2 }, { "name": "SAST", "reason": "SAST tool is not run on all commits -- score normalized to 3", "score": 3 }, { "name": "Pinned-Dependencies", "reason": "dependency not pinned by hash detected -- score normalized to 5", "score": 5 }, { "name": "Branch-Protection", "reason": "branch protection is not maximal on development and all release branches", "score": 6 }, { "name": "Binary-Artifacts", "reason": "no binaries found in the repo", "score": 10 }, { "name": "Dangerous-Workflow", "reason": "no dangerous workflow patterns detected", "score": 10 }, { "name": "License", "reason": "license file detected", "score": 10 }, { "name": "Packaging", "reason": "packaging workflow detected", "score": 10 } ], "date": "2026-10-19", "score": 4.1, "source": "openssf-api", "version": "v5.6.0" }, "vulnerabilities": [ { "aliases": [ "CVE-2026-42508" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-42508", "percentile": 0.94092, "score": 0.0691 }, "fix_state": "fixed", "fixed_in": [ "0.52.0" ], "id": "GHSA-5cgq-3rg8-m6cv", "in_binary": "not in released binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/crypto", "severity": "Critical", "summary": "golang.org/x/crypto vulnerable to auth bypass via unenforced @revoked status", "url": "https://github.com/advisories/GHSA-5cgq-3rg8-m6cv", "version": "v0.29.0" }, { "aliases": [ "CVE-2026-39831" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-39831", "percentile": 0.41307, "score": 0.00478 }, "fix_state": "fixed", "fixed_in": [ "0.52.0" ], "id": "GHSA-89gr-r52h-f8rx", "in_binary": "not in released binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/crypto", "severity": "Critical", "summary": "golang.org/x/crypto: FIDO/U2F security key physical presence check can be bypassed", "url": "https://github.com/advisories/GHSA-89gr-r52h-f8rx", "version": "v0.29.0" }, { "aliases": [ "CVE-2026-39832" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-39832", "percentile": 0.52541, "score": 0.00683 }, "fix_state": "fixed", "fixed_in": [ "0.52.0" ], "id": "GHSA-f5wc-c3c7-36mc", "in_binary": "not in released binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/crypto", "severity": "Critical", "summary": "golang.org/x/crypto doesn't drop invoking agent constraints when forwarding keys", "url": "https://github.com/advisories/GHSA-f5wc-c3c7-36mc", "version": "v0.29.0" }, { "aliases": [ "CVE-2026-39833" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-39833", "percentile": 0.40584, "score": 0.00469 }, "fix_state": "fixed", "fixed_in": [ "0.52.0" ], "id": "GHSA-jppx-rxg9-jmrx", "in_binary": "not in released binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/crypto", "severity": "Critical", "summary": "golang.org/x/crypto doesn't enforce invoking key constraints", "url": "https://github.com/advisories/GHSA-jppx-rxg9-jmrx", "version": "v0.29.0" }, { "aliases": [ "CVE-2026-39834" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-39834", "percentile": 0.48587, "score": 0.00597 }, "fix_state": "fixed", "fixed_in": [ "0.52.0" ], "id": "GHSA-rm3j-f69w-wqmq", "in_binary": "not in released binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/crypto", "severity": "Critical", "summary": "golang.org/x/crypto vulnerable to infinite loop on large channel writes", "url": "https://github.com/advisories/GHSA-rm3j-f69w-wqmq", "version": "v0.29.0" }, { "aliases": [ "CVE-2024-45337" ], "ecosystem": "golang", "epss": { "cve": "CVE-2024-45337", "percentile": 0.88069, "score": 0.03181 }, "fix_state": "fixed", "fixed_in": [ "0.31.0" ], "id": "GHSA-v778-237x-gjrc", "in_binary": "not in released binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/crypto", "severity": "Critical", "summary": "Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto", "url": "https://github.com/advisories/GHSA-v778-237x-gjrc", "version": "v0.29.0" }, { "aliases": [ "CVE-2026-39830" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-39830", "percentile": 0.52538, "score": 0.00683 }, "fix_state": "fixed", "fixed_in": [ "0.52.0" ], "id": "GHSA-vgwf-h737-ff37", "in_binary": "not in released binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/crypto", "severity": "Critical", "summary": "golang.org/x/crypto: Invoking client can cause server deadlock on unexpected responses", "url": "https://github.com/advisories/GHSA-vgwf-h737-ff37", "version": "v0.29.0" }, { "aliases": [ "CVE-2026-46595" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-46595", "percentile": 0.4641, "score": 0.00556 }, "fix_state": "fixed", "fixed_in": [ "0.52.0" ], "id": "GHSA-x527-x647-q7gg", "in_binary": "not in released binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/crypto", "severity": "Critical", "summary": "golang.org/x/crypto: Invoking VerifiedPublicKeyCallback permissions skip enforcement", "url": "https://github.com/advisories/GHSA-x527-x647-q7gg", "version": "v0.29.0" }, { "aliases": [ "CVE-2026-33186" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-33186", "percentile": 0.75569, "score": 0.01584 }, "fix_state": "fixed", "fixed_in": [ "1.79.3" ], "id": "GHSA-p77j-4mvh-x3m3", "in_binary": "not in released binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "google.golang.org/grpc", "severity": "Critical", "summary": "gRPC-Go has an authorization bypass via missing leading slash in :path", "url": "https://github.com/advisories/GHSA-p77j-4mvh-x3m3", "version": "v1.68.0" }, { "aliases": [ "CVE-2026-42306" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-42306", "percentile": 0.01018, "score": 0.00104 }, "fix_state": "not-fixed", "fixed_in": [], "id": "GHSA-rg2x-37c3-w2rh", "in_binary": "vulnerable code in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "github.com/docker/docker", "severity": "High", "summary": "Docker: Race condition in docker cp allows bind mount redirection to host path", "url": "https://github.com/advisories/GHSA-rg2x-37c3-w2rh", "version": "v27.3.1+incompatible" }, { "aliases": [ "CVE-2026-41567" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-41567", "percentile": 0.04603, "score": 0.00155 }, "fix_state": "not-fixed", "fixed_in": [], "id": "GHSA-x86f-5xw2-fm2r", "in_binary": "vulnerable code in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "github.com/docker/docker", "severity": "High", "summary": "Docker: `PUT /containers/{id}/archive` executes container binary on the host", "url": "https://github.com/advisories/GHSA-x86f-5xw2-fm2r", "version": "v27.3.1+incompatible" }, { "aliases": [ "CVE-2026-34040", "GHSA-x744-4wpc-v9h2" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-34040", "percentile": 0.95361, "score": 0.0927 }, "fix_state": "unknown", "fixed_in": [], "id": "GO-2026-4887", "in_binary": "vulnerable code in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "github.com/docker/docker", "severity": "High", "summary": "Moby has AuthZ plugin bypass when provided oversized request bodies in github.com/docker/docker", "url": "https://github.com/moby/moby/security/advisories/GHSA-x744-4wpc-v9h2", "version": "v27.3.1+incompatible" }, { "aliases": [ "CVE-2026-63209" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-63209", "percentile": 0.47329, "score": 0.00572 }, "fix_state": "fixed", "fixed_in": [ "1.18.7" ], "id": "GHSA-259r-337f-4rfw", "in_binary": "vulnerable code in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "github.com/klauspost/compress", "severity": "High", "summary": "Compress/s2: Integer Overflow or Wraparound and Out-of-bounds Write in compress", "url": "https://github.com/advisories/GHSA-259r-337f-4rfw", "version": "v1.17.11" }, { "aliases": [ "CVE-2025-52881" ], "ecosystem": "golang", "epss": { "cve": "CVE-2025-52881", "percentile": 0.56643, "score": 0.00801 }, "fix_state": "fixed", "fixed_in": [ "1.13.0" ], "id": "GHSA-cgrx-mc8f-2prm", "in_binary": "module in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "github.com/opencontainers/selinux", "severity": "High", "summary": "runc container escape and denial of service due to arbitrary write gadgets and procfs write redirects", "url": "https://github.com/advisories/GHSA-cgrx-mc8f-2prm", "version": "v1.11.1" }, { "aliases": [ "CVE-2025-22869" ], "ecosystem": "golang", "epss": { "cve": "CVE-2025-22869", "percentile": 0.60933, "score": 0.00939 }, "fix_state": "fixed", "fixed_in": [ "0.35.0" ], "id": "GHSA-hcg3-q754-cr77", "in_binary": "not in released binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/crypto", "severity": "High", "summary": "golang.org/x/crypto Vulnerable to Denial of Service (DoS) via Slow or Incomplete Key Exchange", "url": "https://github.com/advisories/GHSA-hcg3-q754-cr77", "version": "v0.29.0" }, { "aliases": [ "CVE-2026-46597" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-46597", "percentile": 0.40897, "score": 0.00473 }, "fix_state": "fixed", "fixed_in": [ "0.52.0" ], "id": "GHSA-q4h4-gmj2-qvw2", "in_binary": "not in released binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/crypto", "severity": "High", "summary": "golang.org/x/crypto: Invoking byte arithmetic causes underflow and panic", "url": "https://github.com/advisories/GHSA-q4h4-gmj2-qvw2", "version": "v0.29.0" }, { "aliases": [ "CVE-2026-39829" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-39829", "percentile": 0.40433, "score": 0.00467 }, "fix_state": "fixed", "fixed_in": [ "0.52.0" ], "id": "GHSA-w879-237q-wc7r", "in_binary": "not in released binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/crypto", "severity": "High", "summary": "golang.org/x/crypto: Invoking pathological RSA/DSA parameters may cause DoS", "url": "https://github.com/advisories/GHSA-w879-237q-wc7r", "version": "v0.29.0" }, { "aliases": [ "CVE-2025-47913" ], "ecosystem": "golang", "epss": { "cve": "CVE-2025-47913", "percentile": 0.51909, "score": 0.00668 }, "fix_state": "fixed", "fixed_in": [ "0.43.0" ], "id": "GO-2025-4116", "in_binary": "not in released binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/crypto", "severity": "High", "summary": "SSH clients receiving SSH_AGENT_SUCCESS when expecting a typed response will panic and cause early termination of the client process.", "url": "https://go.dev/cl/700295", "version": "v0.29.0" }, { "aliases": [ "CVE-2026-56854" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-56854", "percentile": 0.38024, "score": 0.00437 }, "fix_state": "fixed", "fixed_in": [ "0.55.0" ], "id": "GO-2026-6303", "in_binary": "not in released binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/crypto", "severity": "High", "summary": "The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the PasswordCallback, KeyboardInteractiveCallback, NoClientAuthC", "url": "https://go.dev/issue/80213", "version": "v0.29.0" }, { "aliases": [ "CVE-2026-78662" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-78662", "percentile": 0.37388, "score": 0.00431 }, "fix_state": "fixed", "fixed_in": [ "0.56.0" ], "id": "GO-2026-6354", "in_binary": "not in released binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/crypto", "severity": "High", "summary": "Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection. Now, we add an atomic established state, set when a channel becomes usable. Until such a time, handlePacket", "url": "https://go.dev/issue/81316", "version": "v0.29.0" }, { "aliases": [ "CVE-2026-56855" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-56855", "percentile": 0.42867, "score": 0.005 }, "fix_state": "fixed", "fixed_in": [ "0.56.0" ], "id": "GO-2026-6355", "in_binary": "not in released binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/crypto", "severity": "High", "summary": "Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connection d", "url": "https://go.dev/issue/81317", "version": "v0.29.0" }, { "aliases": [ "CVE-2025-22868" ], "ecosystem": "golang", "epss": { "cve": "CVE-2025-22868", "percentile": 0.58812, "score": 0.0087 }, "fix_state": "fixed", "fixed_in": [ "0.27.0" ], "id": "GHSA-6v2p-p543-phr9", "in_binary": "vulnerable code in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/oauth2", "severity": "High", "summary": "golang.org/x/oauth2 Improper Validation of Syntactic Correctness of Input vulnerability", "url": "https://github.com/advisories/GHSA-6v2p-p543-phr9", "version": "v0.23.0" }, { "aliases": [ "CVE-2026-56852" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-56852", "percentile": 0.41057, "score": 0.00475 }, "fix_state": "fixed", "fixed_in": [ "0.39.0" ], "id": "GO-2026-5970", "in_binary": "not in released binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/text", "severity": "High", "summary": "A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes.", "url": "https://go.dev/issue/80142", "version": "v0.20.0" }, { "aliases": [ "CVE-2026-56851" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-56851", "percentile": 0.40313, "score": 0.00466 }, "fix_state": "fixed", "fixed_in": [ "0.41.0" ], "id": "GO-2026-6629", "in_binary": "not in released binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/text", "severity": "High", "summary": "The Nickname profile can panic with an out-of-bounds slice error when transforming crafted input into a short destination buffer.", "url": "https://go.dev/cl/793360", "version": "v0.20.0" }, { "aliases": [ "CVE-2026-84445" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-84445", "percentile": 0.5072, "score": 0.00641 }, "fix_state": "fixed", "fixed_in": [ "1.82.2" ], "id": "GHSA-2v4p-qf9q-27wj", "in_binary": "not in released binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "google.golang.org/grpc", "severity": "High", "summary": "gRPC-Go xDS servers: Denial of Service (DoS) via crash due to missing `:authority` and `Host` headers", "url": "https://github.com/advisories/GHSA-2v4p-qf9q-27wj", "version": "v1.68.0" }, { "aliases": [], "ecosystem": "golang", "epss": null, "fix_state": "fixed", "fixed_in": [ "1.82.1" ], "id": "GHSA-hrxh-6v49-42gf", "in_binary": "not in released binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "google.golang.org/grpc", "severity": "High", "summary": "gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities", "url": "https://github.com/advisories/GHSA-hrxh-6v49-42gf", "version": "v1.68.0" }, { "aliases": [ "CVE-2026-84304" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-84304", "percentile": 0.49152, "score": 0.00609 }, "fix_state": "fixed", "fixed_in": [ "1.83.1" ], "id": "GHSA-vp52-pcj8-j9qc", "in_binary": "not in released binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "google.golang.org/grpc", "severity": "High", "summary": "gRPC-Go: Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation", "url": "https://github.com/advisories/GHSA-vp52-pcj8-j9qc", "version": "v1.68.0" }, { "aliases": [ "CVE-2026-85747" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-85747", "percentile": 0.12276, "score": 0.00218 }, "fix_state": "not-fixed", "fixed_in": [], "id": "GHSA-685w-q87j-wqw3", "in_binary": "vulnerable code not in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "github.com/docker/distribution", "severity": "Medium", "summary": "Distribution: Client `manifests.Get()` does not verify returned content against requested digest", "url": "https://github.com/advisories/GHSA-685w-q87j-wqw3", "version": "v2.8.3+incompatible" }, { "aliases": [ "CVE-2026-33997" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-33997", "percentile": 0.34433, "score": 0.00402 }, "fix_state": "not-fixed", "fixed_in": [], "id": "GHSA-pxq6-2prw-chj9", "in_binary": "vulnerable code in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "github.com/docker/docker", "severity": "Medium", "summary": "Moby has an Off-by-one error in its plugin privilege validation", "url": "https://github.com/advisories/GHSA-pxq6-2prw-chj9", "version": "v27.3.1+incompatible" }, { "aliases": [ "CVE-2026-41568" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-41568", "percentile": 0.01188, "score": 0.00108 }, "fix_state": "not-fixed", "fixed_in": [], "id": "GHSA-vp62-88p7-qqf5", "in_binary": "vulnerable code in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "github.com/docker/docker", "severity": "Medium", "summary": "Docker: Race condition in docker cp allows creation of arbitrary empty files on the host via symlink swap", "url": "https://github.com/advisories/GHSA-vp62-88p7-qqf5", "version": "v27.3.1+incompatible" }, { "aliases": [ "CVE-2026-61801" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-61801", "percentile": 0.01634, "score": 0.00117 }, "fix_state": "fixed", "fixed_in": [ "0.4.1" ], "id": "GHSA-mjcv-p78q-w5fw", "in_binary": "vulnerable code in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "github.com/moby/sys/user", "severity": "Medium", "summary": "github.com/moby/sys/user has a possible DoS via unbounded parsing of user and group database files", "url": "https://github.com/advisories/GHSA-mjcv-p78q-w5fw", "version": "v0.3.0" }, { "aliases": [ "CVE-2025-58058" ], "ecosystem": "golang", "epss": { "cve": "CVE-2025-58058", "percentile": 0.37578, "score": 0.00433 }, "fix_state": "fixed", "fixed_in": [ "0.5.15" ], "id": "GHSA-jc7w-c686-c4v9", "in_binary": "module in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "github.com/ulikunitz/xz", "severity": "Medium", "summary": "github.com/ulikunitz/xz leaks memory when decoding a corrupted multiple LZMA archives", "url": "https://github.com/advisories/GHSA-jc7w-c686-c4v9", "version": "v0.5.12" }, { "aliases": [ "CVE-2026-39828" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-39828", "percentile": 0.3079, "score": 0.00369 }, "fix_state": "fixed", "fixed_in": [ "0.52.0" ], "id": "GHSA-45gg-vh54-h5m9", "in_binary": "not in released binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/crypto", "severity": "Medium", "summary": "golang.org/x/crypto vulnerable to invoking bypass of certificate restrictions", "url": "https://github.com/advisories/GHSA-45gg-vh54-h5m9", "version": "v0.29.0" }, { "aliases": [ "CVE-2026-39835" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-39835", "percentile": 0.43087, "score": 0.00504 }, "fix_state": "fixed", "fixed_in": [ "0.52.0" ], "id": "GHSA-78mq-xcr3-xm33", "in_binary": "not in released binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/crypto", "severity": "Medium", "summary": "golang.org/x/crypto is vulnerable to invoking server panic during CheckHostKey/Authenticate flow", "url": "https://github.com/advisories/GHSA-78mq-xcr3-xm33", "version": "v0.29.0" }, { "aliases": [ "CVE-2026-46598" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-46598", "percentile": 0.35509, "score": 0.00412 }, "fix_state": "fixed", "fixed_in": [ "0.52.0" ], "id": "GHSA-9m57-25v3-79x9", "in_binary": "not in released binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/crypto", "severity": "Medium", "summary": "golang.org/x/crypto: Invoking pathological inputs can lead to client panic", "url": "https://github.com/advisories/GHSA-9m57-25v3-79x9", "version": "v0.29.0" }, { "aliases": [ "CVE-2025-47914" ], "ecosystem": "golang", "epss": { "cve": "CVE-2025-47914", "percentile": 0.45818, "score": 0.00546 }, "fix_state": "fixed", "fixed_in": [ "0.45.0" ], "id": "GHSA-f6x5-jh6r-wrfv", "in_binary": "not in released binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/crypto", "severity": "Medium", "summary": "golang.org/x/crypto/ssh/agent vulnerable to panic if message is malformed due to out of bounds read", "url": "https://github.com/advisories/GHSA-f6x5-jh6r-wrfv", "version": "v0.29.0" }, { "aliases": [ "CVE-2025-58181" ], "ecosystem": "golang", "epss": { "cve": "CVE-2025-58181", "percentile": 0.4853, "score": 0.00597 }, "fix_state": "fixed", "fixed_in": [ "0.45.0" ], "id": "GHSA-j5w8-q4qc-rx2x", "in_binary": "not in released binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/crypto", "severity": "Medium", "summary": "golang.org/x/crypto/ssh allows an attacker to cause unbounded memory consumption", "url": "https://github.com/advisories/GHSA-j5w8-q4qc-rx2x", "version": "v0.29.0" }, { "aliases": [ "CVE-2026-39827" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-39827", "percentile": 0.20461, "score": 0.00279 }, "fix_state": "fixed", "fixed_in": [ "0.52.0" ], "id": "GHSA-qpw4-5x99-6vjp", "in_binary": "not in released binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/crypto", "severity": "Medium", "summary": "golang.org/x/crypto: Invoking memory leak when rejecting channels can lead to DoS", "url": "https://github.com/advisories/GHSA-qpw4-5x99-6vjp", "version": "v0.29.0" }, { "aliases": [ "CVE-2026-84303" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-84303", "percentile": 0.23991, "score": 0.00311 }, "fix_state": "fixed", "fixed_in": [ "1.83.1" ], "id": "GHSA-qc2q-p7wx-3px3", "in_binary": "not in released binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "google.golang.org/grpc", "severity": "Medium", "summary": "gRPC-Go: xDS RBAC HTTP Filter bypass via mixed-case Header Matching and gRFC A41 validation evasion", "url": "https://github.com/advisories/GHSA-qc2q-p7wx-3px3", "version": "v1.68.0" }, { "aliases": [ "CVE-2025-54410" ], "ecosystem": "golang", "epss": { "cve": "CVE-2025-54410", "percentile": 0.07238, "score": 0.00177 }, "fix_state": "fixed", "fixed_in": [ "28.0.0" ], "id": "GHSA-4vq8-7jfc-9cvp", "in_binary": "vulnerable code not in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "github.com/docker/docker", "severity": "Low", "summary": "Moby firewalld reload removes bridge network isolation", "url": "https://github.com/advisories/GHSA-4vq8-7jfc-9cvp", "version": "v27.3.1+incompatible" }, { "aliases": [ "CVE-2026-39824" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-39824", "percentile": 0.01457, "score": 0.00114 }, "fix_state": "fixed", "fixed_in": [ "0.44.0" ], "id": "GO-2026-5024", "in_binary": "vulnerable code not in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/sys", "severity": "Low", "summary": "NewNTUnicodeString does not check for string length overflow. When provided with a string that overflows the maximum size of a NTUnicodeString (a 16-bit number of bytes), it returns a truncated string rather than an error.", "url": "https://go.dev/issue/78916", "version": "v0.28.0" }, { "aliases": [], "ecosystem": "golang", "epss": null, "fix_state": "unknown", "fixed_in": [], "id": "GO-2026-5932", "in_binary": "not in released binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/crypto", "severity": "Unknown", "summary": "The golang.org/x/crypto/openpgp package is unsafe by design, has numerous known security issues, is not maintained, and should not be used. If you are required to interoperate with OpenPGP systems and need a maintained package, consider github.com/ProtonMail/go-crypto/openpgp which is a maintained f", "url": "https://go.dev/issue/44226", "version": "v0.29.0" } ], "workflow_audit": { "files": 2, "findings": [ { "confidence": "High", "description": "unpinned action reference", "file": ".github/workflows/build-scan-on-push.yml", "line": 8, "note": "this step", "rule": "unpinned-uses", "severity": "High", "url": "https://docs.zizmor.sh/audits/#unpinned-uses" }, { "confidence": "High", "description": "unpinned action reference", "file": ".github/workflows/build-scan-on-push.yml", "line": 10, "note": "this step", "rule": "unpinned-uses", "severity": "High", "url": "https://docs.zizmor.sh/audits/#unpinned-uses" }, { "confidence": "High", "description": "unpinned action reference", "file": ".github/workflows/releasebuild.yml", "line": 15, "note": "this step", "rule": "unpinned-uses", "severity": "High", "url": "https://docs.zizmor.sh/audits/#unpinned-uses" }, { "confidence": "High", "description": "unpinned action reference", "file": ".github/workflows/releasebuild.yml", "line": 18, "note": "this step", "rule": "unpinned-uses", "severity": "High", "url": "https://docs.zizmor.sh/audits/#unpinned-uses" }, { "confidence": "High", "description": "unpinned action reference", "file": ".github/workflows/releasebuild.yml", "line": 21, "note": "this step", "rule": "unpinned-uses", "severity": "High", "url": "https://docs.zizmor.sh/audits/#unpinned-uses" }, { "confidence": "High", "description": "unpinned action reference", "file": ".github/workflows/releasebuild.yml", "line": 31, "note": "this step", "rule": "unpinned-uses", "severity": "High", "url": "https://docs.zizmor.sh/audits/#unpinned-uses" }, { "confidence": "High", "description": "unpinned action reference", "file": ".github/workflows/releasebuild.yml", "line": 36, "note": "this step", "rule": "unpinned-uses", "severity": "High", "url": "https://docs.zizmor.sh/audits/#unpinned-uses" }, { "confidence": "High", "description": "unpinned action reference", "file": ".github/workflows/releasebuild.yml", "line": 43, "note": "this step", "rule": "unpinned-uses", "severity": "High", "url": "https://docs.zizmor.sh/audits/#unpinned-uses" }, { "confidence": "Medium", "description": "overly broad permissions", "file": ".github/workflows/build-scan-on-push.yml", "line": 5, "note": "this job", "rule": "excessive-permissions", "severity": "Medium", "url": "https://docs.zizmor.sh/audits/#excessive-permissions" }, { "confidence": "High", "description": "action or reusable workflow from archived repository", "file": ".github/workflows/build-scan-on-push.yml", "line": 10, "note": "this step", "rule": "archived-uses", "severity": "Medium", "url": "https://docs.zizmor.sh/audits/#archived-uses" }, { "confidence": "Medium", "description": "overly broad permissions", "file": ".github/workflows/releasebuild.yml", "line": 10, "note": "this job", "rule": "excessive-permissions", "severity": "Medium", "url": "https://docs.zizmor.sh/audits/#excessive-permissions" } ] } }, "updated": "2026-11-02" }