{ "history": [ { "added": 0, "commit": "001cc919603c1dc16c6aad387c94b4209cb9c901", "date": "2026-11-01", "dependencies": 38, "errors": [], "fixable": 30, "go_version": "go1.23.8", "in_binary": { "dependencies": 30, "stdlib": 62, "total": 92 }, "new_vulnerabilities": 0, "osv_confirmed": 31, "osv_only": 0, "ref": "v1.3.2", "release_changed": false, "release_integrity": "checksums-only", "removed": 0, "resolved_vulnerabilities": 0, "scorecard": 6.5, "upgraded": 0, "vulnerabilities": { "Critical": 7, "High": 11, "Low": 2, "Medium": 10, "Negligible": 0, "Unknown": 1 }, "workflow": { "High": 1, "Low": 0, "Medium": 0, "files": 7 } }, { "added": 0, "commit": "001cc919603c1dc16c6aad387c94b4209cb9c901", "date": "2026-11-02", "dependencies": 38, "errors": [], "fixable": 30, "go_version": "go1.23.8", "in_binary": { "dependencies": 30, "stdlib": 62, "total": 92 }, "kev": 0, "kev_new": 0, "new_vulnerabilities": 0, "osv_confirmed": 31, "osv_only": 0, "ref": "v1.3.2", "release_changed": false, "release_integrity": "checksums-only", "removed": 0, "resolved_vulnerabilities": 0, "scorecard": 6.5, "scorecard_date": "2026-10-31", "scorecard_note": null, "scorecard_source": "openssf-api", "upgraded": 0, "vulnerabilities": { "Critical": 7, "High": 11, "Low": 2, "Medium": 10, "Negligible": 0, "Unknown": 1 }, "vulnerable_packages": 5, "workflow": { "High": 1, "Low": 0, "Medium": 0, "files": 7 } } ], "latest": { "archived": false, "category": "Artifact Signing & Verification", "changes": { "added": [], "any": false, "baseline": false, "in_binary_new": [], "in_binary_resolved": [], "integrity_drift": 0, "license_changes": [], "new_vulnerabilities": [], "previous_ref": "v1.3.2", "release_changed": false, "removed": [], "resolved_vulnerabilities": [], "upgraded": [], "workflow_new": 0, "workflow_resolved": 0 }, "commit": "001cc919603c1dc16c6aad387c94b4209cb9c901", "compliance": { "overall_score": 55, "standards": { "bsi_tr03183": { "failed_checks": [ "Component Creator", "Distribution Licences", "SHA-512 Hash", "Dependency Relationship", "SBOM Creator Contact" ], "passed": 4, "score": 44, "total": 9 }, "cisa": { "failed_checks": [ "Software Producer", "Dependency Relationship", "License Information", "Component Hash", "SBOM Author" ], "passed": 5, "score": 50, "total": 10 }, "ntia": { "failed_checks": [ "Supplier Name", "Dependency Relationship" ], "passed": 5, "score": 71, "total": 7 } } }, "components": [ { "ecosystem": "github", "licenses": [], "location": ".github/workflows/add-to-project.yml", "name": "actions/add-to-project", "purl": "pkg:github/actions/add-to-project@v1.0.2", "version": "v1.0.2" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/build.yml", "name": "actions/cache", "purl": "pkg:github/actions/cache@v4.2.3", "version": "v4.2.3" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/scorecard.yml", "name": "actions/checkout", "purl": "pkg:github/actions/checkout@4.2.2", "version": "4.2.2" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/build.yml", "name": "actions/checkout", "purl": "pkg:github/actions/checkout@v4.2.2", "version": "v4.2.2" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/build.yml", "name": "actions/setup-go", "purl": "pkg:github/actions/setup-go@v5.4.0", "version": "v5.4.0" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/stale.yml", "name": "actions/stale", "purl": "pkg:github/actions/stale@v9.1.0", "version": "v9.1.0" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/scorecard.yml", "name": "actions/upload-artifact", "purl": "pkg:github/actions/upload-artifact@v4.6.2", "version": "v4.6.2" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/build.yml", "name": "codecov/codecov-action", "purl": "pkg:github/codecov/codecov-action@v5.4.2", "version": "v5.4.2" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/codeql.yml", "name": "github/codeql-action/analyze", "purl": "pkg:github/github/codeql-action@v3.28.15#analyze", "version": "v3.28.15" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/codeql.yml", "name": "github/codeql-action/init", "purl": "pkg:github/github/codeql-action@v3.28.15#init", "version": "v3.28.15" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/scorecard.yml", "name": "github/codeql-action/upload-sarif", "purl": "pkg:github/github/codeql-action@v3.28.15#upload-sarif", "version": "v3.28.15" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/release-github.yml", "name": "goreleaser/goreleaser-action", "purl": "pkg:github/goreleaser/goreleaser-action@v6.3.0", "version": "v6.3.0" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/license-checker.yml", "name": "notaryproject/notation-core-go/.github/workflows/reusable-license-checker.yml", "purl": "pkg:github/notaryproject/notation-core-go@main#.github/workflows/reusable-license-checker.yml", "version": "main" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/scorecard.yml", "name": "ossf/scorecard-action", "purl": "pkg:github/ossf/scorecard-action@v2.4.1", "version": "v2.4.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/Azure/go-ntlmssp", "purl": "pkg:golang/github.com/Azure/go-ntlmssp@v0.0.0-20221128193559-754e69321358", "version": "v0.0.0-20221128193559-754e69321358" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/fxamacker/cbor/v2", "purl": "pkg:golang/github.com/fxamacker/cbor/v2@v2.8.0", "version": "v2.8.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/go-asn1-ber/asn1-ber", "purl": "pkg:golang/github.com/go-asn1-ber/asn1-ber@v1.5.7", "version": "v1.5.7" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/go-ldap/ldap/v3", "purl": "pkg:golang/github.com/go-ldap/ldap/v3@v3.4.10", "version": "v3.4.10" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/golang-jwt/jwt/v4", "purl": "pkg:golang/github.com/golang-jwt/jwt/v4@v4.5.2", "version": "v4.5.2" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/google/uuid", "purl": "pkg:golang/github.com/google/uuid@v1.6.0", "version": "v1.6.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/inconshreveable/mousetrap", "purl": "pkg:golang/github.com/inconshreveable/mousetrap@v1.1.0", "version": "v1.1.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/notaryproject/notation-core-go", "purl": "pkg:golang/github.com/notaryproject/notation-core-go@v1.3.0", "version": "v1.3.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/notaryproject/notation-go", "purl": "pkg:golang/github.com/notaryproject/notation-go@v1.3.2", "version": "v1.3.2" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/notaryproject/notation-plugin-framework-go", "purl": "pkg:golang/github.com/notaryproject/notation-plugin-framework-go@v1.0.0", "version": "v1.0.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/notaryproject/tspclient-go", "purl": "pkg:golang/github.com/notaryproject/tspclient-go@v1.0.1-0.20250306063739-4f55b14d9f01", "version": "v1.0.1-0.20250306063739-4f55b14d9f01" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/opencontainers/go-digest", "purl": "pkg:golang/github.com/opencontainers/go-digest@v1.0.0", "version": "v1.0.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/opencontainers/image-spec", "purl": "pkg:golang/github.com/opencontainers/image-spec@v1.1.1", "version": "v1.1.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/sirupsen/logrus", "purl": "pkg:golang/github.com/sirupsen/logrus@v1.9.3", "version": "v1.9.3" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/spf13/cobra", "purl": "pkg:golang/github.com/spf13/cobra@v1.9.1", "version": "v1.9.1" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/spf13/pflag", "purl": "pkg:golang/github.com/spf13/pflag@v1.0.6", "version": "v1.0.6" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/veraison/go-cose", "purl": "pkg:golang/github.com/veraison/go-cose@v1.3.0", "version": "v1.3.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "github.com/x448/float16", "purl": "pkg:golang/github.com/x448/float16@v0.8.4", "version": "v0.8.4" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "golang.org/x/crypto", "purl": "pkg:golang/golang.org/x/crypto@v0.37.0", "version": "v0.37.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "golang.org/x/mod", "purl": "pkg:golang/golang.org/x/mod@v0.24.0", "version": "v0.24.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "golang.org/x/sync", "purl": "pkg:golang/golang.org/x/sync@v0.10.0", "version": "v0.10.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "golang.org/x/sys", "purl": "pkg:golang/golang.org/x/sys@v0.32.0", "version": "v0.32.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "golang.org/x/term", "purl": "pkg:golang/golang.org/x/term@v0.31.0", "version": "v0.31.0" }, { "ecosystem": "golang", "licenses": [], "location": "go.mod", "name": "oras.land/oras-go/v2", "purl": "pkg:golang/oras.land/oras-go/v2@v2.5.0", "version": "v2.5.0" } ], "description": "Sign and verify OCI artifacts with Notary Project specifications", "errors": [], "go_binary": { "asset": "notation_1.3.2_linux_amd64.tar.gz", "binary": "notation", "db": "https://vuln.go.dev", "db_last_modified": "2026-10-27T21:16:18Z", "findings": [ { "aliases": [ "CVE-2025-4673" ], "epss": { "cve": "CVE-2025-4673", "percentile": 0.51827, "score": 0.00666 }, "fixed_version": "v1.23.10", "id": "GO-2025-3751", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Sensitive headers not cleared on cross-origin redirect in net/http", "version": "v1.23.8" }, { "aliases": [ "CVE-2025-47907" ], "epss": { "cve": "CVE-2025-47907", "percentile": 0.34914, "score": 0.00406 }, "fixed_version": "v1.23.12", "id": "GO-2025-3849", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Incorrect results returned from Rows.Scan in database/sql", "version": "v1.23.8" }, { "aliases": [ "CVE-2025-47906", "CVE-2025-47906" ], "epss": { "cve": "CVE-2025-47906", "percentile": 0.46025, "score": 0.0055 }, "fixed_version": "v1.23.12", "id": "GO-2025-3956", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Unexpected paths returned from LookPath in os/exec", "version": "v1.23.8" }, { "aliases": [ "CVE-2025-61725", "CVE-2025-61725" ], "epss": { "cve": "CVE-2025-61725", "percentile": 0.51041, "score": 0.00647 }, "fixed_version": "v1.24.8", "id": "GO-2025-4006", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Excessive CPU consumption in ParseAddress in net/mail", "version": "v1.23.8" }, { "aliases": [ "CVE-2025-58187", "CVE-2025-58187" ], "epss": { "cve": "CVE-2025-58187", "percentile": 0.34877, "score": 0.00406 }, "fixed_version": "v1.24.9", "id": "GO-2025-4007", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Quadratic complexity when checking name constraints in crypto/x509", "version": "v1.23.8" }, { "aliases": [ "CVE-2025-58189", "CVE-2025-58189" ], "epss": { "cve": "CVE-2025-58189", "percentile": 0.40494, "score": 0.00468 }, "fixed_version": "v1.24.8", "id": "GO-2025-4008", "kev": null, "level": "symbol", "module": "stdlib", "summary": "ALPN negotiation error contains attacker controlled information in crypto/tls", "version": "v1.23.8" }, { "aliases": [ "CVE-2025-61723", "CVE-2025-61723" ], "epss": { "cve": "CVE-2025-61723", "percentile": 0.51648, "score": 0.00661 }, "fixed_version": "v1.24.8", "id": "GO-2025-4009", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Quadratic complexity when parsing some invalid inputs in encoding/pem", "version": "v1.23.8" }, { "aliases": [ "CVE-2025-47912", "CVE-2025-47912" ], "epss": { "cve": "CVE-2025-47912", "percentile": 0.40493, "score": 0.00468 }, "fixed_version": "v1.24.8", "id": "GO-2025-4010", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Insufficient validation of bracketed IPv6 hostnames in net/url", "version": "v1.23.8" }, { "aliases": [ "CVE-2025-58185", "CVE-2025-58185" ], "epss": { "cve": "CVE-2025-58185", "percentile": 0.46363, "score": 0.00556 }, "fixed_version": "v1.24.8", "id": "GO-2025-4011", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Parsing DER payload can cause memory exhaustion in encoding/asn1", "version": "v1.23.8" }, { "aliases": [ "CVE-2025-58186", "CVE-2025-58186" ], "epss": { "cve": "CVE-2025-58186", "percentile": 0.46913, "score": 0.00565 }, "fixed_version": "v1.24.8", "id": "GO-2025-4012", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Lack of limit when parsing cookies can cause memory exhaustion in net/http", "version": "v1.23.8" }, { "aliases": [ "CVE-2025-58188", "CVE-2025-58188" ], "epss": { "cve": "CVE-2025-58188", "percentile": 0.32165, "score": 0.00381 }, "fixed_version": "v1.24.8", "id": "GO-2025-4013", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Panic when validating certificates with DSA public keys in crypto/x509", "version": "v1.23.8" }, { "aliases": [ "CVE-2025-58183", "CVE-2025-58183" ], "epss": { "cve": "CVE-2025-58183", "percentile": 0.38512, "score": 0.00443 }, "fixed_version": "v1.24.8", "id": "GO-2025-4014", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Unbounded allocation when parsing GNU sparse map in archive/tar", "version": "v1.23.8" }, { "aliases": [ "CVE-2025-61724", "CVE-2025-61724" ], "epss": { "cve": "CVE-2025-61724", "percentile": 0.46363, "score": 0.00556 }, "fixed_version": "v1.24.8", "id": "GO-2025-4015", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Excessive CPU consumption in Reader.ReadResponse in net/textproto", "version": "v1.23.8" }, { "aliases": [ "CVE-2025-61729", "CVE-2025-61729" ], "epss": { "cve": "CVE-2025-61729", "percentile": 0.39638, "score": 0.00457 }, "fixed_version": "v1.24.11", "id": "GO-2025-4155", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Excessive resource consumption when printing error string for host certificate validation in crypto/x509", "version": "v1.23.8" }, { "aliases": [ "CVE-2025-61727" ], "epss": { "cve": "CVE-2025-61727", "percentile": 0.20933, "score": 0.00284 }, "fixed_version": "v1.24.11", "id": "GO-2025-4175", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Improper application of excluded DNS name constraints when verifying wildcard names in crypto/x509", "version": "v1.23.8" }, { "aliases": [ "CVE-2025-68121" ], "epss": { "cve": "CVE-2025-68121", "percentile": 0.59731, "score": 0.00902 }, "fixed_version": "v1.24.13", "id": "GO-2026-4337", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Unexpected session resumption in crypto/tls", "version": "v1.23.8" }, { "aliases": [ "CVE-2025-61730", "CVE-2025-61730" ], "epss": { "cve": "CVE-2025-61730", "percentile": 0.25445, "score": 0.00324 }, "fixed_version": "v1.24.12", "id": "GO-2026-4340", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Handshake messages may be processed at the incorrect encryption level in crypto/tls", "version": "v1.23.8" }, { "aliases": [ "CVE-2025-61726", "CVE-2025-61726" ], "epss": { "cve": "CVE-2025-61726", "percentile": 0.83237, "score": 0.02292 }, "fixed_version": "v1.24.12", "id": "GO-2026-4341", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Memory exhaustion in query parameter parsing in net/url", "version": "v1.23.8" }, { "aliases": [ "CVE-2025-61728", "CVE-2025-61728" ], "epss": { "cve": "CVE-2025-61728", "percentile": 0.54549, "score": 0.00738 }, "fixed_version": "v1.24.12", "id": "GO-2026-4342", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Excessive CPU consumption when building archive index in archive/zip", "version": "v1.23.8" }, { "aliases": [ "CVE-2025-22873" ], "epss": { "cve": "CVE-2025-22873", "percentile": 0.1423, "score": 0.00233 }, "fixed_version": "v1.23.9", "id": "GO-2026-4403", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Improper access to parent directory of root in os", "version": "v1.23.8" }, { "aliases": [ "CVE-2026-25679" ], "epss": { "cve": "CVE-2026-25679", "percentile": 0.57493, "score": 0.00827 }, "fixed_version": "v1.25.8", "id": "GO-2026-4601", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Incorrect parsing of IPv6 host literals in net/url", "version": "v1.23.8" }, { "aliases": [ "CVE-2026-27139" ], "epss": { "cve": "CVE-2026-27139", "percentile": 0.12457, "score": 0.00219 }, "fixed_version": "v1.25.8", "id": "GO-2026-4602", "kev": null, "level": "symbol", "module": "stdlib", "summary": "FileInfo can escape from a Root in os", "version": "v1.23.8" }, { "aliases": [ "CVE-2026-27142" ], "epss": { "cve": "CVE-2026-27142", "percentile": 0.31368, "score": 0.00374 }, "fixed_version": "v1.25.8", "id": "GO-2026-4603", "kev": null, "level": "symbol", "module": "stdlib", "summary": "URLs in meta content attribute actions are not escaped in html/template", "version": "v1.23.8" }, { "aliases": [ "CVE-2026-32282" ], "epss": { "cve": "CVE-2026-32282", "percentile": 0.21771, "score": 0.00292 }, "fixed_version": "v1.25.9", "id": "GO-2026-4864", "kev": null, "level": "symbol", "module": "stdlib", "summary": "TOCTOU permits root escape on Linux via Root.Chmod in os in internal/syscall/unix", "version": "v1.23.8" }, { "aliases": [ "CVE-2026-32289" ], "epss": { "cve": "CVE-2026-32289", "percentile": 0.21611, "score": 0.0029 }, "fixed_version": "v1.25.9", "id": "GO-2026-4865", "kev": null, "level": "symbol", "module": "stdlib", "summary": "JsBraceDepth Context Tracking Bugs (XSS) in html/template", "version": "v1.23.8" }, { "aliases": [ "CVE-2026-32288" ], "epss": { "cve": "CVE-2026-32288", "percentile": 0.21609, "score": 0.0029 }, "fixed_version": "v1.25.9", "id": "GO-2026-4869", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Unbounded allocation for old GNU sparse in archive/tar", "version": "v1.23.8" }, { "aliases": [ "CVE-2026-32283" ], "epss": { "cve": "CVE-2026-32283", "percentile": 0.49799, "score": 0.00621 }, "fixed_version": "v1.25.9", "id": "GO-2026-4870", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Unauthenticated TLS 1.3 KeyUpdate record can cause persistent connection retention and DoS in crypto/tls", "version": "v1.23.8" }, { "aliases": [ "CVE-2026-33814" ], "epss": { "cve": "CVE-2026-33814", "percentile": 0.57885, "score": 0.0084 }, "fixed_version": "v1.25.10", "id": "GO-2026-4918", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net", "version": "v1.23.8" }, { "aliases": [ "CVE-2026-32281" ], "epss": { "cve": "CVE-2026-32281", "percentile": 0.2925, "score": 0.00355 }, "fixed_version": "v1.25.9", "id": "GO-2026-4946", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Inefficient policy validation in crypto/x509", "version": "v1.23.8" }, { "aliases": [ "CVE-2026-32280" ], "epss": { "cve": "CVE-2026-32280", "percentile": 0.49458, "score": 0.00615 }, "fixed_version": "v1.25.9", "id": "GO-2026-4947", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Unexpected work during chain building in crypto/x509", "version": "v1.23.8" }, { "aliases": [ "CVE-2026-39822" ], "epss": { "cve": "CVE-2026-39822", "percentile": 0.14177, "score": 0.00232 }, "fixed_version": "v1.25.12", "id": "GO-2026-4970", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Root escape via symlink plus trailing slash in os", "version": "v1.23.8" }, { "aliases": [ "CVE-2026-39836" ], "epss": { "cve": "CVE-2026-39836", "percentile": 0.50332, "score": 0.00633 }, "fixed_version": "v1.25.10", "id": "GO-2026-4971", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Panic in Dial and LookupPort when handling NUL byte on Windows in net", "version": "v1.23.8" }, { "aliases": [ "CVE-2026-39825" ], "epss": { "cve": "CVE-2026-39825", "percentile": 0.33182, "score": 0.0039 }, "fixed_version": "v1.25.10", "id": "GO-2026-4976", "kev": null, "level": "symbol", "module": "stdlib", "summary": "ReverseProxy forwards queries with more than urlmaxqueryparams parameters in net/http/httputil", "version": "v1.23.8" }, { "aliases": [ "CVE-2026-42499" ], "epss": { "cve": "CVE-2026-42499", "percentile": 0.56521, "score": 0.00798 }, "fixed_version": "v1.25.10", "id": "GO-2026-4977", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Quadratic string concatenation in consumePhrase in net/mail", "version": "v1.23.8" }, { "aliases": [ "CVE-2026-39826" ], "epss": { "cve": "CVE-2026-39826", "percentile": 0.31066, "score": 0.00371 }, "fixed_version": "v1.25.10", "id": "GO-2026-4980", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Escaper bypass leads to XSS in html/template", "version": "v1.23.8" }, { "aliases": [ "CVE-2026-33811" ], "epss": { "cve": "CVE-2026-33811", "percentile": 0.58975, "score": 0.00875 }, "fixed_version": "v1.25.10", "id": "GO-2026-4981", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Crash when handling long CNAME response in net", "version": "v1.23.8" }, { "aliases": [ "CVE-2026-39823" ], "epss": { "cve": "CVE-2026-39823", "percentile": 0.24388, "score": 0.00314 }, "fixed_version": "v1.25.10", "id": "GO-2026-4982", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Bypass of meta content URL escaping causes XSS in html/template", "version": "v1.23.8" }, { "aliases": [ "CVE-2026-39820" ], "epss": { "cve": "CVE-2026-39820", "percentile": 0.56059, "score": 0.00784 }, "fixed_version": "v1.25.10", "id": "GO-2026-4986", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Quadratic string concatentation in consumeComment in net/mail", "version": "v1.23.8" }, { "aliases": [ "CVE-2026-39821" ], "epss": { "cve": "CVE-2026-39821", "percentile": 0.78915, "score": 0.01834 }, "fixed_version": "v1.25.13", "id": "GO-2026-5026", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna", "version": "v1.23.8" }, { "aliases": [ "CVE-2026-27145" ], "epss": { "cve": "CVE-2026-27145", "percentile": 0.48256, "score": 0.00591 }, "fixed_version": "v1.25.11", "id": "GO-2026-5037", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Inefficient candidate hostname parsing in crypto/x509", "version": "v1.23.8" }, { "aliases": [ "CVE-2026-42504" ], "epss": { "cve": "CVE-2026-42504", "percentile": 0.46636, "score": 0.0056 }, "fixed_version": "v1.25.11", "id": "GO-2026-5038", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Quadratic complexity in WordDecoder.DecodeHeader in mime", "version": "v1.23.8" }, { "aliases": [ "CVE-2026-42507" ], "epss": { "cve": "CVE-2026-42507", "percentile": 0.30985, "score": 0.0037 }, "fixed_version": "v1.25.11", "id": "GO-2026-5039", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Arbitrary inputs are included in errors without any escaping in net/textproto", "version": "v1.23.8" }, { "aliases": [ "CVE-2026-42505" ], "epss": { "cve": "CVE-2026-42505", "percentile": 0.32254, "score": 0.00382 }, "fixed_version": "v1.25.12", "id": "GO-2026-5856", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Invoking Encrypted Client Hello privacy leak in crypto/tls", "version": "v1.23.8" }, { "aliases": [ "CVE-2026-33818" ], "epss": { "cve": "CVE-2026-33818", "percentile": 0.47077, "score": 0.00568 }, "fixed_version": "v1.25.13", "id": "GO-2026-5972", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Enforce maximum recursion depth in encoding/asn1", "version": "v1.23.8" }, { "aliases": [ "CVE-2026-56859" ], "epss": { "cve": "CVE-2026-56859", "percentile": 0.47076, "score": 0.00568 }, "fixed_version": "v1.25.13", "id": "GO-2026-6088", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Add recursion depth guard during decode in encoding/xml", "version": "v1.23.8" }, { "aliases": [ "CVE-2026-56853" ], "epss": { "cve": "CVE-2026-56853", "percentile": 0.47076, "score": 0.00568 }, "fixed_version": "v1.25.13", "id": "GO-2026-6089", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Apply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/http", "version": "v1.23.8" }, { "aliases": [ "CVE-2026-56862" ], "epss": { "cve": "CVE-2026-56862", "percentile": 0.47076, "score": 0.00568 }, "fixed_version": "v1.25.13", "id": "GO-2026-6090", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Limit handshake messages we are willing to accept post-handshake in crypto/tls", "version": "v1.23.8" }, { "aliases": [ "CVE-2026-56858" ], "epss": { "cve": "CVE-2026-56858", "percentile": 0.23831, "score": 0.0031 }, "fixed_version": "v1.25.13", "id": "GO-2026-6091", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Fix Javascript regexp context tracking in html/template", "version": "v1.23.8" }, { "aliases": [ "CVE-2026-56860" ], "epss": { "cve": "CVE-2026-56860", "percentile": 0.46041, "score": 0.0055 }, "fixed_version": "v1.25.13", "id": "GO-2026-6218", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Avoid quadratic complexity in resolvePath in net/url", "version": "v1.23.8" }, { "aliases": [ "CVE-2026-94448" ], "epss": { "cve": "CVE-2026-94448", "percentile": 0.21475, "score": 0.00289 }, "fixed_version": "v1.26.9", "id": "GO-2026-6599", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Reset context tracking on consecutive template expressions in html/template", "version": "v1.23.8" }, { "aliases": [ "CVE-2026-97030" ], "epss": { "cve": "CVE-2026-97030", "percentile": 0.21475, "score": 0.00289 }, "fixed_version": "v1.26.9", "id": "GO-2026-6600", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Recognize yield as regexp preceder keyword in html/template", "version": "v1.23.8" }, { "aliases": [ "CVE-2026-78659" ], "epss": { "cve": "CVE-2026-78659", "percentile": 0.50082, "score": 0.00627 }, "fixed_version": "v1.26.9", "id": "GO-2026-6603", "kev": null, "level": "symbol", "module": "stdlib", "summary": "HTTP/2 server memory exhaustion due to Trailer headers in net/http", "version": "v1.23.8" }, { "aliases": [ "CVE-2026-56866" ], "epss": { "cve": "CVE-2026-56866", "percentile": 0.40968, "score": 0.00473 }, "fixed_version": "v1.26.9", "id": "GO-2026-6605", "kev": null, "level": "symbol", "module": "stdlib", "summary": "HTTP/1 client connection desynchronization after CONNECT rejection in net/http", "version": "v1.23.8" }, { "aliases": [ "CVE-2026-97031" ], "epss": { "cve": "CVE-2026-97031", "percentile": 0.44095, "score": 0.00519 }, "fixed_version": "v1.26.9", "id": "GO-2026-6607", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Reject malformed ECH outer extension references in crypto/tls", "version": "v1.23.8" }, { "aliases": [ "CVE-2026-94440" ], "epss": { "cve": "CVE-2026-94440", "percentile": 0.4362, "score": 0.00511 }, "fixed_version": "v1.26.9", "id": "GO-2026-6608", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Memory limit bypass when parsing MIME headers in net/textproto, mime/multipart", "version": "v1.23.8" }, { "aliases": [ "CVE-2026-78667" ], "epss": { "cve": "CVE-2026-78667", "percentile": 0.41455, "score": 0.0048 }, "fixed_version": "v1.26.9", "id": "GO-2026-6609", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Lack of limit on size of parsed Range headers in net/http", "version": "v1.23.8" }, { "aliases": [ "CVE-2026-78660" ], "epss": { "cve": "CVE-2026-78660", "percentile": 0.36838, "score": 0.00425 }, "fixed_version": "v1.26.9", "id": "GO-2026-6610", "kev": null, "level": "symbol", "module": "stdlib", "summary": "HTTP/2 transport accepts malformed framing-related headers in net/http", "version": "v1.23.8" }, { "aliases": [ "CVE-2026-78669" ], "epss": { "cve": "CVE-2026-78669", "percentile": 0.49426, "score": 0.00614 }, "fixed_version": "v1.26.9", "id": "GO-2026-6611", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Excessive CPU consumption from repeated initial window changes in net/http", "version": "v1.23.8" }, { "aliases": [ "CVE-2026-78663" ], "epss": { "cve": "CVE-2026-78663", "percentile": 0.49813, "score": 0.00622 }, "fixed_version": "v1.26.9", "id": "GO-2026-6612", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Double flow control refund on HTTP/2 server streams in net/http", "version": "v1.23.8" }, { "aliases": [ "CVE-2026-94439" ], "epss": { "cve": "CVE-2026-94439", "percentile": 0.35772, "score": 0.00414 }, "fixed_version": "v1.26.9", "id": "GO-2026-6613", "kev": null, "level": "symbol", "module": "stdlib", "summary": "HTTP/1 server connection desynchronization after 2xx CONNECT response in net/http", "version": "v1.23.8" }, { "aliases": [ "CVE-2026-97032" ], "epss": { "cve": "CVE-2026-97032", "percentile": 0.42154, "score": 0.0049 }, "fixed_version": "v1.26.9", "id": "GO-2026-6617", "kev": null, "level": "symbol", "module": "stdlib", "summary": "HTTP/2 server crash due to HPACK encoder race in net/http", "version": "v1.23.8" }, { "aliases": [ "CVE-2026-111943" ], "epss": { "cve": "CVE-2026-111943", "percentile": 0.33793, "score": 0.00396 }, "fixed_version": "v1.26.10", "id": "GO-2026-6809", "kev": null, "level": "symbol", "module": "stdlib", "summary": "Distrust compromised intermediate certificates in crypto/x509", "version": "v1.23.8" }, { "aliases": [ "CVE-2026-32952", "GHSA-pjcq-xvwq-hhpj" ], "epss": { "cve": "CVE-2026-32952", "percentile": 0.6364, "score": 0.01027 }, "fixed_version": "v0.1.1", "id": "GO-2026-5543", "kev": null, "level": "symbol", "module": "github.com/Azure/go-ntlmssp", "summary": "Go-ntlmssp NTLM challenges can panic on malformed payloads in github.com/Azure/go-ntlmssp", "version": "v0.0.0-20221128193559-754e69321358" }, { "aliases": [ "CVE-2025-47913" ], "epss": { "cve": "CVE-2025-47913", "percentile": 0.51909, "score": 0.00668 }, "fixed_version": "v0.43.0", "id": "GO-2025-4116", "kev": null, "level": "symbol", "module": "golang.org/x/crypto", "summary": "Potential denial of service in golang.org/x/crypto/ssh/agent", "version": "v0.37.0" }, { "aliases": [ "CVE-2025-58181", "GHSA-j5w8-q4qc-rx2x" ], "epss": { "cve": "CVE-2025-58181", "percentile": 0.4853, "score": 0.00597 }, "fixed_version": "v0.45.0", "id": "GO-2025-4134", "kev": null, "level": "symbol", "module": "golang.org/x/crypto", "summary": "Unbounded memory consumption in golang.org/x/crypto/ssh", "version": "v0.37.0" }, { "aliases": [ "CVE-2025-47914", "GHSA-f6x5-jh6r-wrfv" ], "epss": { "cve": "CVE-2025-47914", "percentile": 0.45818, "score": 0.00546 }, "fixed_version": "v0.45.0", "id": "GO-2025-4135", "kev": null, "level": "symbol", "module": "golang.org/x/crypto", "summary": "Malformed constraint may cause denial of service in golang.org/x/crypto/ssh/agent", "version": "v0.37.0" }, { "aliases": [ "CVE-2026-39833", "GHSA-jppx-rxg9-jmrx" ], "epss": { "cve": "CVE-2026-39833", "percentile": 0.40584, "score": 0.00469 }, "fixed_version": "v0.52.0", "id": "GO-2026-5005", "kev": null, "level": "symbol", "module": "golang.org/x/crypto", "summary": "Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent", "version": "v0.37.0" }, { "aliases": [ "CVE-2026-39832", "GHSA-f5wc-c3c7-36mc" ], "epss": { "cve": "CVE-2026-39832", "percentile": 0.52541, "score": 0.00683 }, "fixed_version": "v0.52.0", "id": "GO-2026-5006", "kev": null, "level": "symbol", "module": "golang.org/x/crypto", "summary": "Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent", "version": "v0.37.0" }, { "aliases": [ "CVE-2026-46597" ], "epss": { "cve": "CVE-2026-46597", "percentile": 0.40897, "score": 0.00473 }, "fixed_version": "v0.52.0", "id": "GO-2026-5013", "kev": null, "level": "symbol", "module": "golang.org/x/crypto", "summary": "Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh", "version": "v0.37.0" }, { "aliases": [ "CVE-2026-39828" ], "epss": { "cve": "CVE-2026-39828", "percentile": 0.3079, "score": 0.00369 }, "fixed_version": "v0.52.0", "id": "GO-2026-5014", "kev": null, "level": "symbol", "module": "golang.org/x/crypto", "summary": "Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh", "version": "v0.37.0" }, { "aliases": [ "CVE-2026-39835" ], "epss": { "cve": "CVE-2026-39835", "percentile": 0.43087, "score": 0.00504 }, "fixed_version": "v0.52.0", "id": "GO-2026-5015", "kev": null, "level": "symbol", "module": "golang.org/x/crypto", "summary": "Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh", "version": "v0.37.0" }, { "aliases": [ "CVE-2026-39827" ], "epss": { "cve": "CVE-2026-39827", "percentile": 0.20461, "score": 0.00279 }, "fixed_version": "v0.52.0", "id": "GO-2026-5016", "kev": null, "level": "symbol", "module": "golang.org/x/crypto", "summary": "Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh", "version": "v0.37.0" }, { "aliases": [ "CVE-2026-39830" ], "epss": { "cve": "CVE-2026-39830", "percentile": 0.52538, "score": 0.00683 }, "fixed_version": "v0.52.0", "id": "GO-2026-5017", "kev": null, "level": "symbol", "module": "golang.org/x/crypto", "summary": "Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh", "version": "v0.37.0" }, { "aliases": [ "CVE-2026-39829" ], "epss": { "cve": "CVE-2026-39829", "percentile": 0.40433, "score": 0.00467 }, "fixed_version": "v0.52.0", "id": "GO-2026-5018", "kev": null, "level": "symbol", "module": "golang.org/x/crypto", "summary": "Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh", "version": "v0.37.0" }, { "aliases": [ "CVE-2026-39831" ], "epss": { "cve": "CVE-2026-39831", "percentile": 0.41307, "score": 0.00478 }, "fixed_version": "v0.52.0", "id": "GO-2026-5019", "kev": null, "level": "symbol", "module": "golang.org/x/crypto", "summary": "Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh", "version": "v0.37.0" }, { "aliases": [ "CVE-2026-39834" ], "epss": { "cve": "CVE-2026-39834", "percentile": 0.48587, "score": 0.00597 }, "fixed_version": "v0.52.0", "id": "GO-2026-5020", "kev": null, "level": "symbol", "module": "golang.org/x/crypto", "summary": "Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh", "version": "v0.37.0" }, { "aliases": [ "CVE-2026-42508", "GHSA-5cgq-3rg8-m6cv" ], "epss": { "cve": "CVE-2026-42508", "percentile": 0.94092, "score": 0.0691 }, "fixed_version": "v0.52.0", "id": "GO-2026-5021", "kev": null, "level": "symbol", "module": "golang.org/x/crypto", "summary": "Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts", "version": "v0.37.0" }, { "aliases": [ "CVE-2026-46595" ], "epss": { "cve": "CVE-2026-46595", "percentile": 0.4641, "score": 0.00556 }, "fixed_version": "v0.52.0", "id": "GO-2026-5023", "kev": null, "level": "symbol", "module": "golang.org/x/crypto", "summary": "Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh", "version": "v0.37.0" }, { "aliases": [ "CVE-2026-46598" ], "epss": { "cve": "CVE-2026-46598", "percentile": 0.35509, "score": 0.00412 }, "fixed_version": "v0.52.0", "id": "GO-2026-5033", "kev": null, "level": "symbol", "module": "golang.org/x/crypto", "summary": "Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent", "version": "v0.37.0" }, { "aliases": [], "epss": null, "fixed_version": "", "id": "GO-2026-5932", "kev": null, "level": "symbol", "module": "golang.org/x/crypto", "summary": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "version": "v0.37.0" }, { "aliases": [ "CVE-2026-56854" ], "epss": { "cve": "CVE-2026-56854", "percentile": 0.38024, "score": 0.00437 }, "fixed_version": "v0.55.0", "id": "GO-2026-6303", "kev": null, "level": "symbol", "module": "golang.org/x/crypto", "summary": "Source-address critical option not enforced for non-public-key auth callbacks in golang.org/x/crypto/ssh", "version": "v0.37.0" }, { "aliases": [ "CVE-2026-78662" ], "epss": { "cve": "CVE-2026-78662", "percentile": 0.37388, "score": 0.00431 }, "fixed_version": "v0.56.0", "id": "GO-2026-6354", "kev": null, "level": "symbol", "module": "golang.org/x/crypto", "summary": "Prevent DoS on deadlocked undecided channel in golang.org/x/crypto/ssh", "version": "v0.37.0" }, { "aliases": [ "CVE-2026-56855" ], "epss": { "cve": "CVE-2026-56855", "percentile": 0.42867, "score": 0.005 }, "fixed_version": "v0.56.0", "id": "GO-2026-6355", "kev": null, "level": "symbol", "module": "golang.org/x/crypto", "summary": "Prevent DoS on deadlocked established channel in golang.org/x/crypto/ssh", "version": "v0.37.0" }, { "aliases": [ "CVE-2026-56865" ], "epss": { "cve": "CVE-2026-56865", "percentile": 0.02533, "score": 0.00129 }, "fixed_version": "v0.40.0", "id": "GO-2026-6179", "kev": null, "level": "symbol", "module": "golang.org/x/mod", "summary": "Fix transparency log tile verification bypass in golang.org/x/mod/sumdb/tlog", "version": "v0.24.0" }, { "aliases": [ "CVE-2026-56864" ], "epss": { "cve": "CVE-2026-56864", "percentile": 0.22506, "score": 0.00298 }, "fixed_version": "v0.40.0", "id": "GO-2026-6180", "kev": null, "level": "symbol", "module": "golang.org/x/mod", "summary": "Ignore unrelated, unauthenticated hashes in Lookup in golang.org/x/mod/sumdb", "version": "v0.24.0" }, { "aliases": [ "CVE-2026-50162", "GHSA-8xwf-rjm4-xvhv" ], "epss": { "cve": "CVE-2026-50162", "percentile": 0.37983, "score": 0.00437 }, "fixed_version": "v2.6.1", "id": "GO-2026-5879", "kev": null, "level": "symbol", "module": "oras.land/oras-go/v2", "summary": "Oras-go: File store write outside workingDir via symlink traversal in oras.land/oras-go", "version": "v2.5.0" }, { "aliases": [ "CVE-2026-50163", "GHSA-fxhp-mv3v-67qp" ], "epss": { "cve": "CVE-2026-50163", "percentile": 0.34549, "score": 0.00403 }, "fixed_version": "v2.6.2", "id": "GO-2026-5880", "kev": null, "level": "symbol", "module": "oras.land/oras-go/v2", "summary": "Hardlink path traversal during tar extraction in oras.land/oras-go", "version": "v2.5.0" }, { "aliases": [ "CVE-2026-50151", "GHSA-jxpm-75mh-9fp7" ], "epss": { "cve": "CVE-2026-50151", "percentile": 0.3225, "score": 0.00382 }, "fixed_version": "v2.6.1", "id": "GO-2026-5882", "kev": null, "level": "symbol", "module": "oras.land/oras-go/v2", "summary": "Oras-go: Blob upload vulnerable to credential forwarding via unvalidated Location header in oras.land/oras-go", "version": "v2.5.0" }, { "aliases": [ "GHSA-vh4v-2xq2-g5cg" ], "epss": null, "fixed_version": "v2.6.1", "id": "GO-2026-5884", "kev": null, "level": "symbol", "module": "oras.land/oras-go/v2", "summary": "ORAS Go forwards registry credentials across registry redirects in oras.land/oras-go", "version": "v2.5.0" }, { "aliases": [ "CVE-2026-48978", "GHSA-xf85-363p-868w" ], "epss": { "cve": "CVE-2026-48978", "percentile": 0.11316, "score": 0.00211 }, "fixed_version": "v2.6.1", "id": "GO-2026-5885", "kev": null, "level": "symbol", "module": "oras.land/oras-go/v2", "summary": "Oras-go: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens in oras.land/oras-go", "version": "v2.5.0" }, { "aliases": [ "CVE-2026-85732", "GHSA-h7vf-4x9w-h99v" ], "epss": { "cve": "CVE-2026-85732", "percentile": 0.32493, "score": 0.00384 }, "fixed_version": "v2.6.2", "id": "GO-2026-6497", "kev": null, "level": "symbol", "module": "oras.land/oras-go/v2", "summary": "Blind SSRF via unvalidated Link header URL in pagination allows internal network probing in oras.land/oras-go", "version": "v2.5.0" }, { "aliases": [ "CVE-2026-85731", "GHSA-m37j-52j7-pjw7" ], "epss": { "cve": "CVE-2026-85731", "percentile": 0.52244, "score": 0.00676 }, "fixed_version": "v2.6.2", "id": "GO-2026-6499", "kev": null, "level": "symbol", "module": "oras.land/oras-go/v2", "summary": "Arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction (pushDir) in oras.land/oras-go", "version": "v2.5.0" } ], "go_version": "go1.23.8", "main_module": "github.com/notaryproject/notation" }, "id": "notaryproject__notation", "manifests": [ ".github/workflows/add-to-project.yml", ".github/workflows/build.yml", ".github/workflows/codeql.yml", ".github/workflows/license-checker.yml", ".github/workflows/release-github.yml", ".github/workflows/scorecard.yml", ".github/workflows/stale.yml", "go.mod", "go.sum" ], "name": "notation", "osv": { "advisories": 31, "available": true, "confirmed": 31, "osv_only": [], "warning": null }, "ref": "v1.3.2", "ref_kind": "release", "release_integrity": { "asset": "notation_1.3.2_linux_amd64.tar.gz", "assets": 7, "build_provenance": null, "checksums_published": true, "digest_matches_github": null, "immutable_release": null, "methods": [], "provenance_published": false, "sbom_published": false, "signature": null, "signatures_published": false, "signer": null, "verdict": "checksums-only" }, "released_at": "2025-04-27T03:17:42Z", "repository": "notaryproject/notation", "sbomlyze_diff": { "added": 0, "changed": 0, "drift": {}, "findings": [ "0 version changes among 50 shared packages \u2014 no actual upgrades", "Core system packages stable: golang (24), github (18) unchanged" ], "removed": 0 }, "scanned_at": "2026-11-02T03:07:05+00:00", "scorecard": { "checks": [ { "name": "Fuzzing", "reason": "project is not fuzzed", "score": 0 }, { "name": "Signed-Releases", "reason": "Project has not signed or included provenance with any releases.", "score": 0 }, { "name": "Vulnerabilities", "reason": "47 existing vulnerabilities detected", "score": 0 }, { "name": "Maintained", "reason": "2 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 1", "score": 1 }, { "name": "CI-Tests", "reason": "7 out of 29 merged PRs checked by a CI test -- score normalized to 2", "score": 2 }, { "name": "CII-Best-Practices", "reason": "badge detected: InProgress", "score": 2 }, { "name": "SAST", "reason": "SAST tool detected but not run on all commits", "score": 7 }, { "name": "Branch-Protection", "reason": "branch protection is not maximal on development and all release branches", "score": 8 }, { "name": "Code-Review", "reason": "Found 10/11 approved changesets -- score normalized to 9", "score": 9 }, { "name": "Binary-Artifacts", "reason": "no binaries found in the repo", "score": 10 }, { "name": "Contributors", "reason": "project has 11 contributing companies or organizations", "score": 10 }, { "name": "Dangerous-Workflow", "reason": "no dangerous workflow patterns detected", "score": 10 }, { "name": "Dependency-Update-Tool", "reason": "update tool detected", "score": 10 }, { "name": "License", "reason": "license file detected", "score": 10 }, { "name": "Pinned-Dependencies", "reason": "all dependencies are pinned", "score": 10 }, { "name": "Security-Policy", "reason": "security policy file detected", "score": 10 }, { "name": "Token-Permissions", "reason": "GitHub workflow tokens follow principle of least privilege", "score": 10 }, { "name": "Packaging", "reason": "packaging workflow not detected", "score": -1 } ], "date": "2026-10-31", "score": 6.5, "source": "openssf-api", "version": "v5.2.1" }, "vulnerabilities": [ { "aliases": [ "CVE-2026-42508" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-42508", "percentile": 0.94092, "score": 0.0691 }, "fix_state": "fixed", "fixed_in": [ "0.52.0" ], "id": "GHSA-5cgq-3rg8-m6cv", "in_binary": "vulnerable code in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/crypto", "severity": "Critical", "summary": "golang.org/x/crypto vulnerable to auth bypass via unenforced @revoked status", "url": "https://github.com/advisories/GHSA-5cgq-3rg8-m6cv", "version": "v0.37.0" }, { "aliases": [ "CVE-2026-39831" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-39831", "percentile": 0.41307, "score": 0.00478 }, "fix_state": "fixed", "fixed_in": [ "0.52.0" ], "id": "GHSA-89gr-r52h-f8rx", "in_binary": "vulnerable code in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/crypto", "severity": "Critical", "summary": "golang.org/x/crypto: FIDO/U2F security key physical presence check can be bypassed", "url": "https://github.com/advisories/GHSA-89gr-r52h-f8rx", "version": "v0.37.0" }, { "aliases": [ "CVE-2026-39832" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-39832", "percentile": 0.52541, "score": 0.00683 }, "fix_state": "fixed", "fixed_in": [ "0.52.0" ], "id": "GHSA-f5wc-c3c7-36mc", "in_binary": "vulnerable code in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/crypto", "severity": "Critical", "summary": "golang.org/x/crypto doesn't drop invoking agent constraints when forwarding keys", "url": "https://github.com/advisories/GHSA-f5wc-c3c7-36mc", "version": "v0.37.0" }, { "aliases": [ "CVE-2026-39833" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-39833", "percentile": 0.40584, "score": 0.00469 }, "fix_state": "fixed", "fixed_in": [ "0.52.0" ], "id": "GHSA-jppx-rxg9-jmrx", "in_binary": "vulnerable code in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/crypto", "severity": "Critical", "summary": "golang.org/x/crypto doesn't enforce invoking key constraints", "url": "https://github.com/advisories/GHSA-jppx-rxg9-jmrx", "version": "v0.37.0" }, { "aliases": [ "CVE-2026-39834" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-39834", "percentile": 0.48587, "score": 0.00597 }, "fix_state": "fixed", "fixed_in": [ "0.52.0" ], "id": "GHSA-rm3j-f69w-wqmq", "in_binary": "vulnerable code in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/crypto", "severity": "Critical", "summary": "golang.org/x/crypto vulnerable to infinite loop on large channel writes", "url": "https://github.com/advisories/GHSA-rm3j-f69w-wqmq", "version": "v0.37.0" }, { "aliases": [ "CVE-2026-39830" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-39830", "percentile": 0.52538, "score": 0.00683 }, "fix_state": "fixed", "fixed_in": [ "0.52.0" ], "id": "GHSA-vgwf-h737-ff37", "in_binary": "vulnerable code in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/crypto", "severity": "Critical", "summary": "golang.org/x/crypto: Invoking client can cause server deadlock on unexpected responses", "url": "https://github.com/advisories/GHSA-vgwf-h737-ff37", "version": "v0.37.0" }, { "aliases": [ "CVE-2026-46595" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-46595", "percentile": 0.4641, "score": 0.00556 }, "fix_state": "fixed", "fixed_in": [ "0.52.0" ], "id": "GHSA-x527-x647-q7gg", "in_binary": "vulnerable code in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/crypto", "severity": "Critical", "summary": "golang.org/x/crypto: Invoking VerifiedPublicKeyCallback permissions skip enforcement", "url": "https://github.com/advisories/GHSA-x527-x647-q7gg", "version": "v0.37.0" }, { "aliases": [ "CVE-2026-46597" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-46597", "percentile": 0.40897, "score": 0.00473 }, "fix_state": "fixed", "fixed_in": [ "0.52.0" ], "id": "GHSA-q4h4-gmj2-qvw2", "in_binary": "vulnerable code in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/crypto", "severity": "High", "summary": "golang.org/x/crypto: Invoking byte arithmetic causes underflow and panic", "url": "https://github.com/advisories/GHSA-q4h4-gmj2-qvw2", "version": "v0.37.0" }, { "aliases": [ "CVE-2026-39829" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-39829", "percentile": 0.40433, "score": 0.00467 }, "fix_state": "fixed", "fixed_in": [ "0.52.0" ], "id": "GHSA-w879-237q-wc7r", "in_binary": "vulnerable code in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/crypto", "severity": "High", "summary": "golang.org/x/crypto: Invoking pathological RSA/DSA parameters may cause DoS", "url": "https://github.com/advisories/GHSA-w879-237q-wc7r", "version": "v0.37.0" }, { "aliases": [ "CVE-2025-47913" ], "ecosystem": "golang", "epss": { "cve": "CVE-2025-47913", "percentile": 0.51909, "score": 0.00668 }, "fix_state": "fixed", "fixed_in": [ "0.43.0" ], "id": "GO-2025-4116", "in_binary": "vulnerable code in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/crypto", "severity": "High", "summary": "SSH clients receiving SSH_AGENT_SUCCESS when expecting a typed response will panic and cause early termination of the client process.", "url": "https://go.dev/cl/700295", "version": "v0.37.0" }, { "aliases": [ "CVE-2026-56854" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-56854", "percentile": 0.38024, "score": 0.00437 }, "fix_state": "fixed", "fixed_in": [ "0.55.0" ], "id": "GO-2026-6303", "in_binary": "vulnerable code in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/crypto", "severity": "High", "summary": "The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the PasswordCallback, KeyboardInteractiveCallback, NoClientAuthC", "url": "https://go.dev/issue/80213", "version": "v0.37.0" }, { "aliases": [ "CVE-2026-78662" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-78662", "percentile": 0.37388, "score": 0.00431 }, "fix_state": "fixed", "fixed_in": [ "0.56.0" ], "id": "GO-2026-6354", "in_binary": "vulnerable code in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/crypto", "severity": "High", "summary": "Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection. Now, we add an atomic established state, set when a channel becomes usable. Until such a time, handlePacket", "url": "https://go.dev/issue/81316", "version": "v0.37.0" }, { "aliases": [ "CVE-2026-56855" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-56855", "percentile": 0.42867, "score": 0.005 }, "fix_state": "fixed", "fixed_in": [ "0.56.0" ], "id": "GO-2026-6355", "in_binary": "vulnerable code in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/crypto", "severity": "High", "summary": "Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connection d", "url": "https://go.dev/issue/81317", "version": "v0.37.0" }, { "aliases": [ "CVE-2026-56865" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-56865", "percentile": 0.02533, "score": 0.00129 }, "fix_state": "fixed", "fixed_in": [ "0.40.0" ], "id": "GO-2026-6179", "in_binary": "vulnerable code in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/mod", "severity": "High", "summary": "A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache. This attack allows for a malicious GOPROXY to serve malicious module content that canno", "url": "https://go.dev/issue/80744", "version": "v0.24.0" }, { "aliases": [ "CVE-2026-56864" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-56864", "percentile": 0.22506, "score": 0.00298 }, "fix_state": "fixed", "fixed_in": [ "0.40.0" ], "id": "GO-2026-6180", "in_binary": "vulnerable code in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/mod", "severity": "High", "summary": "A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log. In order to determine if you", "url": "https://go.dev/issue/80745", "version": "v0.24.0" }, { "aliases": [ "CVE-2026-50163" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-50163", "percentile": 0.34549, "score": 0.00403 }, "fix_state": "fixed", "fixed_in": [ "2.6.2" ], "id": "GHSA-fxhp-mv3v-67qp", "in_binary": "vulnerable code in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "oras.land/oras-go/v2", "severity": "High", "summary": "`oras-go` tar extraction: Hardlink entry with relative Linkname escapes extract dir via process CWD resolution", "url": "https://github.com/advisories/GHSA-fxhp-mv3v-67qp", "version": "v2.5.0" }, { "aliases": [ "CVE-2026-50151" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-50151", "percentile": 0.3225, "score": 0.00382 }, "fix_state": "fixed", "fixed_in": [ "2.6.1" ], "id": "GHSA-jxpm-75mh-9fp7", "in_binary": "vulnerable code in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "oras.land/oras-go/v2", "severity": "High", "summary": "oras-go blob upload vulnerable to credential forwarding via unvalidated Location header", "url": "https://github.com/advisories/GHSA-jxpm-75mh-9fp7", "version": "v2.5.0" }, { "aliases": [ "CVE-2026-85731" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-85731", "percentile": 0.52244, "score": 0.00676 }, "fix_state": "fixed", "fixed_in": [ "2.6.2" ], "id": "GHSA-m37j-52j7-pjw7", "in_binary": "vulnerable code in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "oras.land/oras-go/v2", "severity": "High", "summary": "oras-go: Arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction (pushDir)", "url": "https://github.com/advisories/GHSA-m37j-52j7-pjw7", "version": "v2.5.0" }, { "aliases": [ "CVE-2026-32952" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-32952", "percentile": 0.6364, "score": 0.01027 }, "fix_state": "fixed", "fixed_in": [ "0.1.1" ], "id": "GHSA-pjcq-xvwq-hhpj", "in_binary": "vulnerable code in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "github.com/Azure/go-ntlmssp", "severity": "Medium", "summary": "go-ntlmssp NTLM challenges can panic on malformed payloads", "url": "https://github.com/advisories/GHSA-pjcq-xvwq-hhpj", "version": "v0.0.0-20221128193559-754e69321358" }, { "aliases": [ "CVE-2026-39828" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-39828", "percentile": 0.3079, "score": 0.00369 }, "fix_state": "fixed", "fixed_in": [ "0.52.0" ], "id": "GHSA-45gg-vh54-h5m9", "in_binary": "vulnerable code in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/crypto", "severity": "Medium", "summary": "golang.org/x/crypto vulnerable to invoking bypass of certificate restrictions", "url": "https://github.com/advisories/GHSA-45gg-vh54-h5m9", "version": "v0.37.0" }, { "aliases": [ "CVE-2026-39835" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-39835", "percentile": 0.43087, "score": 0.00504 }, "fix_state": "fixed", "fixed_in": [ "0.52.0" ], "id": "GHSA-78mq-xcr3-xm33", "in_binary": "vulnerable code in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/crypto", "severity": "Medium", "summary": "golang.org/x/crypto is vulnerable to invoking server panic during CheckHostKey/Authenticate flow", "url": "https://github.com/advisories/GHSA-78mq-xcr3-xm33", "version": "v0.37.0" }, { "aliases": [ "CVE-2026-46598" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-46598", "percentile": 0.35509, "score": 0.00412 }, "fix_state": "fixed", "fixed_in": [ "0.52.0" ], "id": "GHSA-9m57-25v3-79x9", "in_binary": "vulnerable code in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/crypto", "severity": "Medium", "summary": "golang.org/x/crypto: Invoking pathological inputs can lead to client panic", "url": "https://github.com/advisories/GHSA-9m57-25v3-79x9", "version": "v0.37.0" }, { "aliases": [ "CVE-2025-47914" ], "ecosystem": "golang", "epss": { "cve": "CVE-2025-47914", "percentile": 0.45818, "score": 0.00546 }, "fix_state": "fixed", "fixed_in": [ "0.45.0" ], "id": "GHSA-f6x5-jh6r-wrfv", "in_binary": "vulnerable code in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/crypto", "severity": "Medium", "summary": "golang.org/x/crypto/ssh/agent vulnerable to panic if message is malformed due to out of bounds read", "url": "https://github.com/advisories/GHSA-f6x5-jh6r-wrfv", "version": "v0.37.0" }, { "aliases": [ "CVE-2025-58181" ], "ecosystem": "golang", "epss": { "cve": "CVE-2025-58181", "percentile": 0.4853, "score": 0.00597 }, "fix_state": "fixed", "fixed_in": [ "0.45.0" ], "id": "GHSA-j5w8-q4qc-rx2x", "in_binary": "vulnerable code in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/crypto", "severity": "Medium", "summary": "golang.org/x/crypto/ssh allows an attacker to cause unbounded memory consumption", "url": "https://github.com/advisories/GHSA-j5w8-q4qc-rx2x", "version": "v0.37.0" }, { "aliases": [ "CVE-2026-39827" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-39827", "percentile": 0.20461, "score": 0.00279 }, "fix_state": "fixed", "fixed_in": [ "0.52.0" ], "id": "GHSA-qpw4-5x99-6vjp", "in_binary": "vulnerable code in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/crypto", "severity": "Medium", "summary": "golang.org/x/crypto: Invoking memory leak when rejecting channels can lead to DoS", "url": "https://github.com/advisories/GHSA-qpw4-5x99-6vjp", "version": "v0.37.0" }, { "aliases": [ "CVE-2026-50162" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-50162", "percentile": 0.37983, "score": 0.00437 }, "fix_state": "fixed", "fixed_in": [ "2.6.1" ], "id": "GHSA-8xwf-rjm4-xvhv", "in_binary": "vulnerable code in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "oras.land/oras-go/v2", "severity": "Medium", "summary": "oras-go has file store write outside workingDir via symlink traversal", "url": "https://github.com/advisories/GHSA-8xwf-rjm4-xvhv", "version": "v2.5.0" }, { "aliases": [ "CVE-2026-85732" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-85732", "percentile": 0.32493, "score": 0.00384 }, "fix_state": "fixed", "fixed_in": [ "2.6.2" ], "id": "GHSA-h7vf-4x9w-h99v", "in_binary": "vulnerable code in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "oras.land/oras-go/v2", "severity": "Medium", "summary": "oras-go: Blind SSRF via unvalidated Link header URL in pagination allows internal network probing", "url": "https://github.com/advisories/GHSA-h7vf-4x9w-h99v", "version": "v2.5.0" }, { "aliases": [], "ecosystem": "golang", "epss": null, "fix_state": "fixed", "fixed_in": [ "2.6.1" ], "id": "GHSA-vh4v-2xq2-g5cg", "in_binary": "vulnerable code in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "oras.land/oras-go/v2", "severity": "Medium", "summary": "ORAS Go forwards registry credentials across registry redirects", "url": "https://github.com/advisories/GHSA-vh4v-2xq2-g5cg", "version": "v2.5.0" }, { "aliases": [ "CVE-2026-39824" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-39824", "percentile": 0.01457, "score": 0.00114 }, "fix_state": "fixed", "fixed_in": [ "0.44.0" ], "id": "GO-2026-5024", "in_binary": "vulnerable code not in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/sys", "severity": "Low", "summary": "NewNTUnicodeString does not check for string length overflow. When provided with a string that overflows the maximum size of a NTUnicodeString (a 16-bit number of bytes), it returns a truncated string rather than an error.", "url": "https://go.dev/issue/78916", "version": "v0.32.0" }, { "aliases": [ "CVE-2026-48978" ], "ecosystem": "golang", "epss": { "cve": "CVE-2026-48978", "percentile": 0.11316, "score": 0.00211 }, "fix_state": "fixed", "fixed_in": [ "2.6.1" ], "id": "GHSA-xf85-363p-868w", "in_binary": "vulnerable code in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "oras.land/oras-go/v2", "severity": "Low", "summary": "oras-go: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens", "url": "https://github.com/advisories/GHSA-xf85-363p-868w", "version": "v2.5.0" }, { "aliases": [], "ecosystem": "golang", "epss": null, "fix_state": "unknown", "fixed_in": [], "id": "GO-2026-5932", "in_binary": "vulnerable code in binary", "kev": null, "location": "go.mod", "osv_confirmed": true, "package": "golang.org/x/crypto", "severity": "Unknown", "summary": "The golang.org/x/crypto/openpgp package is unsafe by design, has numerous known security issues, is not maintained, and should not be used. If you are required to interoperate with OpenPGP systems and need a maintained package, consider github.com/ProtonMail/go-crypto/openpgp which is a maintained f", "url": "https://go.dev/issue/44226", "version": "v0.37.0" } ], "workflow_audit": { "files": 7, "findings": [ { "confidence": "High", "description": "unpinned action reference", "file": ".github/workflows/license-checker.yml", "line": 30, "note": "this job", "rule": "unpinned-uses", "severity": "High", "url": "https://docs.zizmor.sh/audits/#unpinned-uses" } ] } }, "updated": "2026-11-02" }