{"matches":[{"vulnerability":{"id":"GO-2026-4887","dataSource":"https://github.com/moby/moby/security/advisories/GHSA-x744-4wpc-v9h2","namespace":"govulndb:language:go","severity":"High","urls":["https://github.com/moby/moby/commit/e89edb19ad7de0407a5d31e3111cb01aa10b5a38","https://docs.docker.com/engine/extend/plugins_authorization","https://github.com/moby/moby/security/advisories/GHSA-v23v-6jw2-98fq"],"description":"Moby has AuthZ plugin bypass when provided oversized request bodies in github.com/docker/docker","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"exploitabilityScore":1.9,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-34040","epss":0.0927,"percentile":0.9536,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-34040","cwe":"CWE-288","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":[],"state":""},"advisories":[],"risk":7.091550000000001},"relatedVulnerabilities":[{"id":"CVE-2026-34040","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-34040","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/moby/moby/releases/tag/docker-v29.3.1","https://github.com/moby/moby/security/advisories/GHSA-x744-4wpc-v9h2"],"description":"Moby is an open source container framework. Prior to version 29.3.1, a security vulnerability has been detected that allows attackers to bypass authorization plugins (AuthZ). This issue has been patched in version 29.3.1.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"exploitabilityScore":1.9,"impactScore":5.9},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.8,"exploitabilityScore":2.1,"impactScore":6.1},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-34040","epss":0.0927,"percentile":0.9536,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-34040","cwe":"CWE-288","source":"security-advisories@github.com","type":"Secondary"}]},{"id":"GHSA-x744-4wpc-v9h2","dataSource":"https://github.com/advisories/GHSA-x744-4wpc-v9h2","namespace":"github:language:go","severity":"High","urls":["https://github.com/moby/moby/security/advisories/GHSA-v23v-6jw2-98fq","https://github.com/moby/moby/security/advisories/GHSA-x744-4wpc-v9h2","https://github.com/moby/moby/commit/e89edb19ad7de0407a5d31e3111cb01aa10b5a38","https://docs.docker.com/engine/extend/plugins_authorization","https://nvd.nist.gov/vuln/detail/CVE-2026-34040","https://github.com/moby/moby/releases/tag/docker-v29.3.1"],"description":"Moby has AuthZ plugin bypass when provided oversized request bodies","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.8,"exploitabilityScore":2.1,"impactScore":6.1},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-34040","epss":0.0927,"percentile":0.9536,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-34040","cwe":"CWE-288","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"github.com/docker/docker","version":"v28.5.2+incompatible"}},"found":{"vulnerabilityID":"GO-2026-4887","versionConstraint":"none (unknown)"}}],"artifact":{"id":"pkg:golang/github.com/docker/docker@v28.5.2%2Bincompatible?package-id=3faa2f9d49f614ca","name":"github.com/docker/docker","version":"v28.5.2+incompatible","type":"go-module","locations":[{"path":"/tool-imports/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:docker:docker:v28.5.2\\+incompatible:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/docker/docker@v28.5.2%2Bincompatible","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:DBX0Y0zAjZbSrm1uzOkdr1onVghKaftjlSWt4AFexzM="}}},{"vulnerability":{"id":"GHSA-5cgq-3rg8-m6cv","dataSource":"https://github.com/advisories/GHSA-5cgq-3rg8-m6cv","namespace":"github:language:go","severity":"Critical","urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-42508","https://go.dev/cl/781220","https://go.dev/issue/79568","https://groups.google.com/g/golang-announce/c/a082jnz-LvI","https://pkg.go.dev/vuln/GO-2026-5021","https://access.redhat.com/errata/RHSA-2026:23262","https://access.redhat.com/errata/RHSA-2026:23264","https://access.redhat.com/security/cve/CVE-2026-42508","https://bugzilla.redhat.com/show_bug.cgi?id=2480688","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42508.json","https://access.redhat.com/errata/RHSA-2026:26546","https://access.redhat.com/errata/RHSA-2026:26547","https://access.redhat.com/errata/RHSA-2026:35833","https://access.redhat.com/errata/RHSA-2026:36648","https://access.redhat.com/errata/RHSA-2026:37123","https://access.redhat.com/errata/RHSA-2026:37072","https://access.redhat.com/errata/RHSA-2026:36808","https://access.redhat.com/errata/RHSA-2026:36797","https://access.redhat.com/errata/RHSA-2026:36796","https://access.redhat.com/errata/RHSA-2026:36651","https://access.redhat.com/errata/RHSA-2026:37387","https://access.redhat.com/errata/RHSA-2026:40262","https://access.redhat.com/errata/RHSA-2026:40138","https://access.redhat.com/errata/RHSA-2026:40118","https://access.redhat.com/errata/RHSA-2026:41066","https://access.redhat.com/errata/RHSA-2026:41064","https://access.redhat.com/errata/RHSA-2026:41036","https://access.redhat.com/errata/RHSA-2026:41031","https://access.redhat.com/errata/RHSA-2026:41019","https://access.redhat.com/errata/RHSA-2026:40945"],"description":"golang.org/x/crypto vulnerable to auth bypass via unenforced @revoked status","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"exploitabilityScore":3.9,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-42508","epss":0.0691,"percentile":0.94091,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-42508","cwe":"CWE-295","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2026-42508","cwe":"CWE-295","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["0.52.0"],"state":"fixed","available":[{"version":"0.52.0","date":"2026-07-07","kind":"first-observed"}]},"advisories":[],"risk":6.25355},"relatedVulnerabilities":[{"id":"CVE-2026-42508","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42508","namespace":"nvd:cpe","severity":"High","urls":["https://go.dev/cl/781220","https://go.dev/issue/79568","https://groups.google.com/g/golang-announce/c/a082jnz-LvI","https://pkg.go.dev/vuln/GO-2026-5021","https://access.redhat.com/errata/RHSA-2026:23262","https://access.redhat.com/errata/RHSA-2026:23264","https://access.redhat.com/errata/RHSA-2026:26546","https://access.redhat.com/errata/RHSA-2026:26547","https://access.redhat.com/errata/RHSA-2026:35833","https://access.redhat.com/errata/RHSA-2026:36648","https://access.redhat.com/errata/RHSA-2026:36651","https://access.redhat.com/errata/RHSA-2026:36796","https://access.redhat.com/errata/RHSA-2026:36797","https://access.redhat.com/errata/RHSA-2026:36808","https://access.redhat.com/errata/RHSA-2026:37072","https://access.redhat.com/errata/RHSA-2026:37123","https://access.redhat.com/errata/RHSA-2026:37387","https://access.redhat.com/errata/RHSA-2026:40118","https://access.redhat.com/errata/RHSA-2026:40262","https://access.redhat.com/errata/RHSA-2026:40945","https://access.redhat.com/errata/RHSA-2026:41019","https://access.redhat.com/errata/RHSA-2026:41031","https://access.redhat.com/errata/RHSA-2026:41036","https://access.redhat.com/errata/RHSA-2026:41064","https://access.redhat.com/errata/RHSA-2026:41066","https://access.redhat.com/errata/RHSA-2026:42146","https://access.redhat.com/errata/RHSA-2026:42796","https://access.redhat.com/errata/RHSA-2026:43052","https://access.redhat.com/errata/RHSA-2026:43692","https://access.redhat.com/errata/RHSA-2026:46885","https://access.redhat.com/errata/RHSA-2026:47735","https://access.redhat.com/errata/RHSA-2026:47737","https://access.redhat.com/errata/RHSA-2026:49944","https://access.redhat.com/errata/RHSA-2026:51033","https://access.redhat.com/errata/RHSA-2026:51288","https://access.redhat.com/errata/RHSA-2026:52857","https://access.redhat.com/errata/RHSA-2026:52910","https://access.redhat.com/errata/RHSA-2026:54400","https://access.redhat.com/errata/RHSA-2026:57194","https://access.redhat.com/errata/RHSA-2026:59467","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/errata/RHSA-2026:61314","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:66022","https://access.redhat.com/errata/RHSA-2026:66521","https://access.redhat.com/errata/RHSA-2026:67450","https://access.redhat.com/security/cve/CVE-2026-42508","https://bugzilla.redhat.com/show_bug.cgi?id=2480688","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42508.json"],"description":"Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation. Now, both the 'key' and 'key.SignatureKey' are checked for @revoked.","cvss":[{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"exploitabilityScore":2.3,"impactScore":5.2},"vendorMetadata":{}},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"exploitabilityScore":3.9,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-42508","epss":0.0691,"percentile":0.94091,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-42508","cwe":"CWE-295","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2026-42508","cwe":"CWE-295","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"golang.org/x/crypto","version":"v0.46.0"}},"found":{"vulnerabilityID":"GHSA-5cgq-3rg8-m6cv","versionConstraint":"<0.52.0 (go)"},"fix":{"suggestedVersion":"0.52.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/crypto@v0.46.0?package-id=b3387fbedc5d73be","name":"golang.org/x/crypto","version":"v0.46.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:crypto:v0.46.0:*:*:*:*:go:*:*","cpe:2.3:a:go:ssh:v0.46.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/crypto@v0.46.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:cKRW/pmt1pKAfetfu+RCEvjvZkA9RimPbh7bhFjGVBU="}}},{"vulnerability":{"id":"GHSA-5cgq-3rg8-m6cv","dataSource":"https://github.com/advisories/GHSA-5cgq-3rg8-m6cv","namespace":"github:language:go","severity":"Critical","urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-42508","https://go.dev/cl/781220","https://go.dev/issue/79568","https://groups.google.com/g/golang-announce/c/a082jnz-LvI","https://pkg.go.dev/vuln/GO-2026-5021","https://access.redhat.com/errata/RHSA-2026:23262","https://access.redhat.com/errata/RHSA-2026:23264","https://access.redhat.com/security/cve/CVE-2026-42508","https://bugzilla.redhat.com/show_bug.cgi?id=2480688","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42508.json","https://access.redhat.com/errata/RHSA-2026:26546","https://access.redhat.com/errata/RHSA-2026:26547","https://access.redhat.com/errata/RHSA-2026:35833","https://access.redhat.com/errata/RHSA-2026:36648","https://access.redhat.com/errata/RHSA-2026:37123","https://access.redhat.com/errata/RHSA-2026:37072","https://access.redhat.com/errata/RHSA-2026:36808","https://access.redhat.com/errata/RHSA-2026:36797","https://access.redhat.com/errata/RHSA-2026:36796","https://access.redhat.com/errata/RHSA-2026:36651","https://access.redhat.com/errata/RHSA-2026:37387","https://access.redhat.com/errata/RHSA-2026:40262","https://access.redhat.com/errata/RHSA-2026:40138","https://access.redhat.com/errata/RHSA-2026:40118","https://access.redhat.com/errata/RHSA-2026:41066","https://access.redhat.com/errata/RHSA-2026:41064","https://access.redhat.com/errata/RHSA-2026:41036","https://access.redhat.com/errata/RHSA-2026:41031","https://access.redhat.com/errata/RHSA-2026:41019","https://access.redhat.com/errata/RHSA-2026:40945"],"description":"golang.org/x/crypto vulnerable to auth bypass via unenforced @revoked status","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"exploitabilityScore":3.9,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-42508","epss":0.0691,"percentile":0.94091,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-42508","cwe":"CWE-295","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2026-42508","cwe":"CWE-295","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["0.52.0"],"state":"fixed","available":[{"version":"0.52.0","date":"2026-07-07","kind":"first-observed"}]},"advisories":[],"risk":6.25355},"relatedVulnerabilities":[{"id":"CVE-2026-42508","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42508","namespace":"nvd:cpe","severity":"High","urls":["https://go.dev/cl/781220","https://go.dev/issue/79568","https://groups.google.com/g/golang-announce/c/a082jnz-LvI","https://pkg.go.dev/vuln/GO-2026-5021","https://access.redhat.com/errata/RHSA-2026:23262","https://access.redhat.com/errata/RHSA-2026:23264","https://access.redhat.com/errata/RHSA-2026:26546","https://access.redhat.com/errata/RHSA-2026:26547","https://access.redhat.com/errata/RHSA-2026:35833","https://access.redhat.com/errata/RHSA-2026:36648","https://access.redhat.com/errata/RHSA-2026:36651","https://access.redhat.com/errata/RHSA-2026:36796","https://access.redhat.com/errata/RHSA-2026:36797","https://access.redhat.com/errata/RHSA-2026:36808","https://access.redhat.com/errata/RHSA-2026:37072","https://access.redhat.com/errata/RHSA-2026:37123","https://access.redhat.com/errata/RHSA-2026:37387","https://access.redhat.com/errata/RHSA-2026:40118","https://access.redhat.com/errata/RHSA-2026:40262","https://access.redhat.com/errata/RHSA-2026:40945","https://access.redhat.com/errata/RHSA-2026:41019","https://access.redhat.com/errata/RHSA-2026:41031","https://access.redhat.com/errata/RHSA-2026:41036","https://access.redhat.com/errata/RHSA-2026:41064","https://access.redhat.com/errata/RHSA-2026:41066","https://access.redhat.com/errata/RHSA-2026:42146","https://access.redhat.com/errata/RHSA-2026:42796","https://access.redhat.com/errata/RHSA-2026:43052","https://access.redhat.com/errata/RHSA-2026:43692","https://access.redhat.com/errata/RHSA-2026:46885","https://access.redhat.com/errata/RHSA-2026:47735","https://access.redhat.com/errata/RHSA-2026:47737","https://access.redhat.com/errata/RHSA-2026:49944","https://access.redhat.com/errata/RHSA-2026:51033","https://access.redhat.com/errata/RHSA-2026:51288","https://access.redhat.com/errata/RHSA-2026:52857","https://access.redhat.com/errata/RHSA-2026:52910","https://access.redhat.com/errata/RHSA-2026:54400","https://access.redhat.com/errata/RHSA-2026:57194","https://access.redhat.com/errata/RHSA-2026:59467","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/errata/RHSA-2026:61314","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:66022","https://access.redhat.com/errata/RHSA-2026:66521","https://access.redhat.com/errata/RHSA-2026:67450","https://access.redhat.com/security/cve/CVE-2026-42508","https://bugzilla.redhat.com/show_bug.cgi?id=2480688","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42508.json"],"description":"Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation. Now, both the 'key' and 'key.SignatureKey' are checked for @revoked.","cvss":[{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"exploitabilityScore":2.3,"impactScore":5.2},"vendorMetadata":{}},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"exploitabilityScore":3.9,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-42508","epss":0.0691,"percentile":0.94091,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-42508","cwe":"CWE-295","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2026-42508","cwe":"CWE-295","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"golang.org/x/crypto","version":"v0.48.0"}},"found":{"vulnerabilityID":"GHSA-5cgq-3rg8-m6cv","versionConstraint":"<0.52.0 (go)"},"fix":{"suggestedVersion":"0.52.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/crypto@v0.48.0?package-id=764d3323ecdb54e3","name":"golang.org/x/crypto","version":"v0.48.0","type":"go-module","locations":[{"path":"/tool-imports/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:crypto:v0.48.0:*:*:*:*:go:*:*","cpe:2.3:a:go:ssh:v0.48.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/crypto@v0.48.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:/VRzVqiRSggnhY7gNRxPauEQ5Drw9haKdM0jqfcCFts="}}},{"vulnerability":{"id":"GO-2026-5026","dataSource":"https://go.dev/cl/767220","namespace":"govulndb:language:go","severity":"High","urls":["https://go.dev/issue/78760","https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8","https://groups.google.com/g/golang-announce/c/94pEornpRlI"],"description":"The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode(\"xn--example-.com\") incorrectly returns the name \"example.com\" rather than an error.\n\nThis behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject \"example.com\" but permit \"xn--example-.com\". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name \"example.com\".","cvss":[{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N","metrics":{"baseScore":8.2,"exploitabilityScore":1.8,"impactScore":5.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-39821","epss":0.01834,"percentile":0.78914,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-39821","cwe":"CWE-1289","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"},{"cve":"CVE-2026-39821","cwe":"CWE-1289","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["0.55.0"],"state":"fixed","available":[{"version":"0.55.0","date":"2026-05-22","kind":"release"}]},"advisories":[],"risk":1.4396899999999997},"relatedVulnerabilities":[{"id":"CVE-2026-39821","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-39821","namespace":"nvd:cpe","severity":"High","urls":["https://go.dev/cl/767220","https://go.dev/issue/78760","https://groups.google.com/g/golang-announce/c/94pEornpRlI","https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8","https://pkg.go.dev/vuln/GO-2026-5026","https://access.redhat.com/errata/RHSA-2026:23262","https://access.redhat.com/errata/RHSA-2026:23264","https://access.redhat.com/errata/RHSA-2026:26546","https://access.redhat.com/errata/RHSA-2026:26547","https://access.redhat.com/errata/RHSA-2026:30650","https://access.redhat.com/errata/RHSA-2026:30651","https://access.redhat.com/errata/RHSA-2026:30853","https://access.redhat.com/errata/RHSA-2026:30854","https://access.redhat.com/errata/RHSA-2026:30855","https://access.redhat.com/errata/RHSA-2026:33155","https://access.redhat.com/errata/RHSA-2026:33160","https://access.redhat.com/errata/RHSA-2026:33163","https://access.redhat.com/errata/RHSA-2026:33173","https://access.redhat.com/errata/RHSA-2026:33183","https://access.redhat.com/errata/RHSA-2026:33524","https://access.redhat.com/errata/RHSA-2026:33531","https://access.redhat.com/errata/RHSA-2026:34342","https://access.redhat.com/errata/RHSA-2026:34357","https://access.redhat.com/errata/RHSA-2026:34359","https://access.redhat.com/errata/RHSA-2026:34364","https://access.redhat.com/errata/RHSA-2026:34789","https://access.redhat.com/errata/RHSA-2026:35826","https://access.redhat.com/errata/RHSA-2026:35827","https://access.redhat.com/errata/RHSA-2026:35828","https://access.redhat.com/errata/RHSA-2026:35829","https://access.redhat.com/errata/RHSA-2026:35830","https://access.redhat.com/errata/RHSA-2026:35831","https://access.redhat.com/errata/RHSA-2026:35993","https://access.redhat.com/errata/RHSA-2026:35994","https://access.redhat.com/errata/RHSA-2026:36105","https://access.redhat.com/errata/RHSA-2026:36167","https://access.redhat.com/errata/RHSA-2026:36207","https://access.redhat.com/errata/RHSA-2026:36648","https://access.redhat.com/errata/RHSA-2026:36651","https://access.redhat.com/errata/RHSA-2026:36796","https://access.redhat.com/errata/RHSA-2026:36797","https://access.redhat.com/errata/RHSA-2026:36808","https://access.redhat.com/errata/RHSA-2026:36820","https://access.redhat.com/errata/RHSA-2026:36883","https://access.redhat.com/errata/RHSA-2026:37387","https://access.redhat.com/errata/RHSA-2026:37435","https://access.redhat.com/errata/RHSA-2026:37436","https://access.redhat.com/errata/RHSA-2026:38995","https://access.redhat.com/errata/RHSA-2026:39005","https://access.redhat.com/errata/RHSA-2026:39573","https://access.redhat.com/errata/RHSA-2026:39879","https://access.redhat.com/errata/RHSA-2026:40118","https://access.redhat.com/errata/RHSA-2026:40262","https://access.redhat.com/errata/RHSA-2026:40945","https://access.redhat.com/errata/RHSA-2026:41019","https://access.redhat.com/errata/RHSA-2026:41030","https://access.redhat.com/errata/RHSA-2026:41031","https://access.redhat.com/errata/RHSA-2026:41036","https://access.redhat.com/errata/RHSA-2026:41055","https://access.redhat.com/errata/RHSA-2026:41066","https://access.redhat.com/errata/RHSA-2026:41928","https://access.redhat.com/errata/RHSA-2026:41930","https://access.redhat.com/errata/RHSA-2026:42043","https://access.redhat.com/errata/RHSA-2026:42047","https://access.redhat.com/errata/RHSA-2026:42048","https://access.redhat.com/errata/RHSA-2026:42049","https://access.redhat.com/errata/RHSA-2026:42050","https://access.redhat.com/errata/RHSA-2026:42051","https://access.redhat.com/errata/RHSA-2026:42078","https://access.redhat.com/errata/RHSA-2026:42079","https://access.redhat.com/errata/RHSA-2026:42080","https://access.redhat.com/errata/RHSA-2026:42082","https://access.redhat.com/errata/RHSA-2026:42132","https://access.redhat.com/errata/RHSA-2026:42142","https://access.redhat.com/errata/RHSA-2026:42146","https://access.redhat.com/errata/RHSA-2026:42150","https://access.redhat.com/errata/RHSA-2026:42151","https://access.redhat.com/errata/RHSA-2026:42240","https://access.redhat.com/errata/RHSA-2026:42644","https://access.redhat.com/errata/RHSA-2026:42796","https://access.redhat.com/errata/RHSA-2026:42852","https://access.redhat.com/errata/RHSA-2026:43038","https://access.redhat.com/errata/RHSA-2026:43052","https://access.redhat.com/errata/RHSA-2026:43692","https://access.redhat.com/errata/RHSA-2026:44622","https://access.redhat.com/errata/RHSA-2026:44624","https://access.redhat.com/errata/RHSA-2026:46395","https://access.redhat.com/errata/RHSA-2026:47149","https://access.redhat.com/errata/RHSA-2026:47735","https://access.redhat.com/errata/RHSA-2026:47737","https://access.redhat.com/errata/RHSA-2026:47952","https://access.redhat.com/errata/RHSA-2026:49702","https://access.redhat.com/errata/RHSA-2026:49712","https://access.redhat.com/errata/RHSA-2026:50300","https://access.redhat.com/errata/RHSA-2026:50843","https://access.redhat.com/errata/RHSA-2026:51033","https://access.redhat.com/errata/RHSA-2026:51112","https://access.redhat.com/errata/RHSA-2026:51187","https://access.redhat.com/errata/RHSA-2026:51194","https://access.redhat.com/errata/RHSA-2026:51341","https://access.redhat.com/errata/RHSA-2026:52826","https://access.redhat.com/errata/RHSA-2026:53374","https://access.redhat.com/errata/RHSA-2026:53412","https://access.redhat.com/errata/RHSA-2026:53413","https://access.redhat.com/errata/RHSA-2026:53415","https://access.redhat.com/errata/RHSA-2026:53530","https://access.redhat.com/errata/RHSA-2026:54191","https://access.redhat.com/errata/RHSA-2026:54274","https://access.redhat.com/errata/RHSA-2026:54283","https://access.redhat.com/errata/RHSA-2026:54284","https://access.redhat.com/errata/RHSA-2026:54285","https://access.redhat.com/errata/RHSA-2026:54286","https://access.redhat.com/errata/RHSA-2026:54287","https://access.redhat.com/errata/RHSA-2026:54395","https://access.redhat.com/errata/RHSA-2026:54401","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:54441","https://access.redhat.com/errata/RHSA-2026:54531","https://access.redhat.com/errata/RHSA-2026:54580","https://access.redhat.com/errata/RHSA-2026:54757","https://access.redhat.com/errata/RHSA-2026:56143","https://access.redhat.com/errata/RHSA-2026:56223","https://access.redhat.com/errata/RHSA-2026:56340","https://access.redhat.com/errata/RHSA-2026:56431","https://access.redhat.com/errata/RHSA-2026:57194","https://access.redhat.com/errata/RHSA-2026:57541","https://access.redhat.com/errata/RHSA-2026:57649","https://access.redhat.com/errata/RHSA-2026:57845","https://access.redhat.com/errata/RHSA-2026:59546","https://access.redhat.com/errata/RHSA-2026:59549","https://access.redhat.com/errata/RHSA-2026:59562","https://access.redhat.com/errata/RHSA-2026:60315","https://access.redhat.com/errata/RHSA-2026:60354","https://access.redhat.com/errata/RHSA-2026:60387","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/errata/RHSA-2026:61245","https://access.redhat.com/errata/RHSA-2026:61253","https://access.redhat.com/errata/RHSA-2026:62549","https://access.redhat.com/errata/RHSA-2026:63134","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:65153","https://access.redhat.com/errata/RHSA-2026:65359","https://access.redhat.com/errata/RHSA-2026:65534","https://access.redhat.com/errata/RHSA-2026:65851","https://access.redhat.com/errata/RHSA-2026:65886","https://access.redhat.com/errata/RHSA-2026:66016","https://access.redhat.com/errata/RHSA-2026:66022","https://access.redhat.com/errata/RHSA-2026:66350","https://access.redhat.com/errata/RHSA-2026:66432","https://access.redhat.com/errata/RHSA-2026:67149","https://access.redhat.com/errata/RHSA-2026:67159","https://access.redhat.com/errata/RHSA-2026:67160","https://access.redhat.com/errata/RHSA-2026:67287","https://access.redhat.com/errata/RHSA-2026:67319","https://access.redhat.com/errata/RHSA-2026:67517","https://access.redhat.com/errata/RHSA-2026:68504","https://access.redhat.com/security/cve/CVE-2026-39821","https://bugzilla.redhat.com/show_bug.cgi?id=2480756","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39821.json"],"description":"The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode(\"xn--example-.com\") incorrectly returns the name \"example.com\" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject \"example.com\" but permit \"xn--example-.com\". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name \"example.com\".","cvss":[{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N","metrics":{"baseScore":8.2,"exploitabilityScore":1.8,"impactScore":5.8},"vendorMetadata":{}},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","metrics":{"baseScore":9.6,"exploitabilityScore":3.2,"impactScore":5.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-39821","epss":0.01834,"percentile":0.78914,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-39821","cwe":"CWE-1289","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"},{"cve":"CVE-2026-39821","cwe":"CWE-1289","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"golang.org/x/net","version":"v0.48.0"}},"found":{"vulnerabilityID":"GO-2026-5026","versionConstraint":"<0.55.0 (go)"},"fix":{"suggestedVersion":"0.55.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/net@v0.48.0?package-id=7e3c0e57ff3d79d8","name":"golang.org/x/net","version":"v0.48.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:networking:v0.48.0:*:*:*:*:go:*:*","cpe:2.3:a:golang:net:v0.48.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/net@v0.48.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:zyQRTTrjc33Lhh0fBgT/H3oZq9WuvRR5gPC70xpDiQU="}}},{"vulnerability":{"id":"GO-2026-5026","dataSource":"https://go.dev/cl/767220","namespace":"govulndb:language:go","severity":"High","urls":["https://go.dev/issue/78760","https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8","https://groups.google.com/g/golang-announce/c/94pEornpRlI"],"description":"The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode(\"xn--example-.com\") incorrectly returns the name \"example.com\" rather than an error.\n\nThis behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject \"example.com\" but permit \"xn--example-.com\". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name \"example.com\".","cvss":[{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N","metrics":{"baseScore":8.2,"exploitabilityScore":1.8,"impactScore":5.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-39821","epss":0.01834,"percentile":0.78914,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-39821","cwe":"CWE-1289","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"},{"cve":"CVE-2026-39821","cwe":"CWE-1289","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["0.55.0"],"state":"fixed","available":[{"version":"0.55.0","date":"2026-05-22","kind":"release"}]},"advisories":[],"risk":1.4396899999999997},"relatedVulnerabilities":[{"id":"CVE-2026-39821","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-39821","namespace":"nvd:cpe","severity":"High","urls":["https://go.dev/cl/767220","https://go.dev/issue/78760","https://groups.google.com/g/golang-announce/c/94pEornpRlI","https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8","https://pkg.go.dev/vuln/GO-2026-5026","https://access.redhat.com/errata/RHSA-2026:23262","https://access.redhat.com/errata/RHSA-2026:23264","https://access.redhat.com/errata/RHSA-2026:26546","https://access.redhat.com/errata/RHSA-2026:26547","https://access.redhat.com/errata/RHSA-2026:30650","https://access.redhat.com/errata/RHSA-2026:30651","https://access.redhat.com/errata/RHSA-2026:30853","https://access.redhat.com/errata/RHSA-2026:30854","https://access.redhat.com/errata/RHSA-2026:30855","https://access.redhat.com/errata/RHSA-2026:33155","https://access.redhat.com/errata/RHSA-2026:33160","https://access.redhat.com/errata/RHSA-2026:33163","https://access.redhat.com/errata/RHSA-2026:33173","https://access.redhat.com/errata/RHSA-2026:33183","https://access.redhat.com/errata/RHSA-2026:33524","https://access.redhat.com/errata/RHSA-2026:33531","https://access.redhat.com/errata/RHSA-2026:34342","https://access.redhat.com/errata/RHSA-2026:34357","https://access.redhat.com/errata/RHSA-2026:34359","https://access.redhat.com/errata/RHSA-2026:34364","https://access.redhat.com/errata/RHSA-2026:34789","https://access.redhat.com/errata/RHSA-2026:35826","https://access.redhat.com/errata/RHSA-2026:35827","https://access.redhat.com/errata/RHSA-2026:35828","https://access.redhat.com/errata/RHSA-2026:35829","https://access.redhat.com/errata/RHSA-2026:35830","https://access.redhat.com/errata/RHSA-2026:35831","https://access.redhat.com/errata/RHSA-2026:35993","https://access.redhat.com/errata/RHSA-2026:35994","https://access.redhat.com/errata/RHSA-2026:36105","https://access.redhat.com/errata/RHSA-2026:36167","https://access.redhat.com/errata/RHSA-2026:36207","https://access.redhat.com/errata/RHSA-2026:36648","https://access.redhat.com/errata/RHSA-2026:36651","https://access.redhat.com/errata/RHSA-2026:36796","https://access.redhat.com/errata/RHSA-2026:36797","https://access.redhat.com/errata/RHSA-2026:36808","https://access.redhat.com/errata/RHSA-2026:36820","https://access.redhat.com/errata/RHSA-2026:36883","https://access.redhat.com/errata/RHSA-2026:37387","https://access.redhat.com/errata/RHSA-2026:37435","https://access.redhat.com/errata/RHSA-2026:37436","https://access.redhat.com/errata/RHSA-2026:38995","https://access.redhat.com/errata/RHSA-2026:39005","https://access.redhat.com/errata/RHSA-2026:39573","https://access.redhat.com/errata/RHSA-2026:39879","https://access.redhat.com/errata/RHSA-2026:40118","https://access.redhat.com/errata/RHSA-2026:40262","https://access.redhat.com/errata/RHSA-2026:40945","https://access.redhat.com/errata/RHSA-2026:41019","https://access.redhat.com/errata/RHSA-2026:41030","https://access.redhat.com/errata/RHSA-2026:41031","https://access.redhat.com/errata/RHSA-2026:41036","https://access.redhat.com/errata/RHSA-2026:41055","https://access.redhat.com/errata/RHSA-2026:41066","https://access.redhat.com/errata/RHSA-2026:41928","https://access.redhat.com/errata/RHSA-2026:41930","https://access.redhat.com/errata/RHSA-2026:42043","https://access.redhat.com/errata/RHSA-2026:42047","https://access.redhat.com/errata/RHSA-2026:42048","https://access.redhat.com/errata/RHSA-2026:42049","https://access.redhat.com/errata/RHSA-2026:42050","https://access.redhat.com/errata/RHSA-2026:42051","https://access.redhat.com/errata/RHSA-2026:42078","https://access.redhat.com/errata/RHSA-2026:42079","https://access.redhat.com/errata/RHSA-2026:42080","https://access.redhat.com/errata/RHSA-2026:42082","https://access.redhat.com/errata/RHSA-2026:42132","https://access.redhat.com/errata/RHSA-2026:42142","https://access.redhat.com/errata/RHSA-2026:42146","https://access.redhat.com/errata/RHSA-2026:42150","https://access.redhat.com/errata/RHSA-2026:42151","https://access.redhat.com/errata/RHSA-2026:42240","https://access.redhat.com/errata/RHSA-2026:42644","https://access.redhat.com/errata/RHSA-2026:42796","https://access.redhat.com/errata/RHSA-2026:42852","https://access.redhat.com/errata/RHSA-2026:43038","https://access.redhat.com/errata/RHSA-2026:43052","https://access.redhat.com/errata/RHSA-2026:43692","https://access.redhat.com/errata/RHSA-2026:44622","https://access.redhat.com/errata/RHSA-2026:44624","https://access.redhat.com/errata/RHSA-2026:46395","https://access.redhat.com/errata/RHSA-2026:47149","https://access.redhat.com/errata/RHSA-2026:47735","https://access.redhat.com/errata/RHSA-2026:47737","https://access.redhat.com/errata/RHSA-2026:47952","https://access.redhat.com/errata/RHSA-2026:49702","https://access.redhat.com/errata/RHSA-2026:49712","https://access.redhat.com/errata/RHSA-2026:50300","https://access.redhat.com/errata/RHSA-2026:50843","https://access.redhat.com/errata/RHSA-2026:51033","https://access.redhat.com/errata/RHSA-2026:51112","https://access.redhat.com/errata/RHSA-2026:51187","https://access.redhat.com/errata/RHSA-2026:51194","https://access.redhat.com/errata/RHSA-2026:51341","https://access.redhat.com/errata/RHSA-2026:52826","https://access.redhat.com/errata/RHSA-2026:53374","https://access.redhat.com/errata/RHSA-2026:53412","https://access.redhat.com/errata/RHSA-2026:53413","https://access.redhat.com/errata/RHSA-2026:53415","https://access.redhat.com/errata/RHSA-2026:53530","https://access.redhat.com/errata/RHSA-2026:54191","https://access.redhat.com/errata/RHSA-2026:54274","https://access.redhat.com/errata/RHSA-2026:54283","https://access.redhat.com/errata/RHSA-2026:54284","https://access.redhat.com/errata/RHSA-2026:54285","https://access.redhat.com/errata/RHSA-2026:54286","https://access.redhat.com/errata/RHSA-2026:54287","https://access.redhat.com/errata/RHSA-2026:54395","https://access.redhat.com/errata/RHSA-2026:54401","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:54441","https://access.redhat.com/errata/RHSA-2026:54531","https://access.redhat.com/errata/RHSA-2026:54580","https://access.redhat.com/errata/RHSA-2026:54757","https://access.redhat.com/errata/RHSA-2026:56143","https://access.redhat.com/errata/RHSA-2026:56223","https://access.redhat.com/errata/RHSA-2026:56340","https://access.redhat.com/errata/RHSA-2026:56431","https://access.redhat.com/errata/RHSA-2026:57194","https://access.redhat.com/errata/RHSA-2026:57541","https://access.redhat.com/errata/RHSA-2026:57649","https://access.redhat.com/errata/RHSA-2026:57845","https://access.redhat.com/errata/RHSA-2026:59546","https://access.redhat.com/errata/RHSA-2026:59549","https://access.redhat.com/errata/RHSA-2026:59562","https://access.redhat.com/errata/RHSA-2026:60315","https://access.redhat.com/errata/RHSA-2026:60354","https://access.redhat.com/errata/RHSA-2026:60387","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/errata/RHSA-2026:61245","https://access.redhat.com/errata/RHSA-2026:61253","https://access.redhat.com/errata/RHSA-2026:62549","https://access.redhat.com/errata/RHSA-2026:63134","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:65153","https://access.redhat.com/errata/RHSA-2026:65359","https://access.redhat.com/errata/RHSA-2026:65534","https://access.redhat.com/errata/RHSA-2026:65851","https://access.redhat.com/errata/RHSA-2026:65886","https://access.redhat.com/errata/RHSA-2026:66016","https://access.redhat.com/errata/RHSA-2026:66022","https://access.redhat.com/errata/RHSA-2026:66350","https://access.redhat.com/errata/RHSA-2026:66432","https://access.redhat.com/errata/RHSA-2026:67149","https://access.redhat.com/errata/RHSA-2026:67159","https://access.redhat.com/errata/RHSA-2026:67160","https://access.redhat.com/errata/RHSA-2026:67287","https://access.redhat.com/errata/RHSA-2026:67319","https://access.redhat.com/errata/RHSA-2026:67517","https://access.redhat.com/errata/RHSA-2026:68504","https://access.redhat.com/security/cve/CVE-2026-39821","https://bugzilla.redhat.com/show_bug.cgi?id=2480756","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39821.json"],"description":"The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode(\"xn--example-.com\") incorrectly returns the name \"example.com\" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject \"example.com\" but permit \"xn--example-.com\". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name \"example.com\".","cvss":[{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N","metrics":{"baseScore":8.2,"exploitabilityScore":1.8,"impactScore":5.8},"vendorMetadata":{}},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","metrics":{"baseScore":9.6,"exploitabilityScore":3.2,"impactScore":5.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-39821","epss":0.01834,"percentile":0.78914,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-39821","cwe":"CWE-1289","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"},{"cve":"CVE-2026-39821","cwe":"CWE-1289","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"golang.org/x/net","version":"v0.50.0"}},"found":{"vulnerabilityID":"GO-2026-5026","versionConstraint":"<0.55.0 (go)"},"fix":{"suggestedVersion":"0.55.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/net@v0.50.0?package-id=a205ae7dff8c80d8","name":"golang.org/x/net","version":"v0.50.0","type":"go-module","locations":[{"path":"/tool-imports/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:networking:v0.50.0:*:*:*:*:go:*:*","cpe:2.3:a:golang:net:v0.50.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/net@v0.50.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:ucWh9eiCGyDR3vtzso0WMQinm2Dnt8cFMuQa9K33J60="}}},{"vulnerability":{"id":"GHSA-p77j-4mvh-x3m3","dataSource":"https://github.com/advisories/GHSA-p77j-4mvh-x3m3","namespace":"github:language:go","severity":"Critical","urls":["https://github.com/grpc/grpc-go/security/advisories/GHSA-p77j-4mvh-x3m3","https://nvd.nist.gov/vuln/detail/CVE-2026-33186"],"description":"gRPC-Go has an authorization bypass via missing leading slash in :path","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"exploitabilityScore":3.9,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-33186","epss":0.01584,"percentile":0.75571,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-33186","cwe":"CWE-285","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-33186","cwe":"CWE-551","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["1.79.3"],"state":"fixed","available":[{"version":"1.79.3","date":"2026-03-19","kind":"first-observed"}]},"advisories":[],"risk":1.4335200000000001},"relatedVulnerabilities":[{"id":"CVE-2026-33186","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33186","namespace":"nvd:cpe","severity":"Critical","urls":["https://github.com/grpc/grpc-go/security/advisories/GHSA-p77j-4mvh-x3m3","https://access.redhat.com/errata/RHSA-2026:10093","https://access.redhat.com/errata/RHSA-2026:10094","https://access.redhat.com/errata/RHSA-2026:10105","https://access.redhat.com/errata/RHSA-2026:10107","https://access.redhat.com/errata/RHSA-2026:10125","https://access.redhat.com/errata/RHSA-2026:10126","https://access.redhat.com/errata/RHSA-2026:10130","https://access.redhat.com/errata/RHSA-2026:10131","https://access.redhat.com/errata/RHSA-2026:10153","https://access.redhat.com/errata/RHSA-2026:10155","https://access.redhat.com/errata/RHSA-2026:10158","https://access.redhat.com/errata/RHSA-2026:10172","https://access.redhat.com/errata/RHSA-2026:10175","https://access.redhat.com/errata/RHSA-2026:10698","https://access.redhat.com/errata/RHSA-2026:10705","https://access.redhat.com/errata/RHSA-2026:10706","https://access.redhat.com/errata/RHSA-2026:11070","https://access.redhat.com/errata/RHSA-2026:11408","https://access.redhat.com/errata/RHSA-2026:11803","https://access.redhat.com/errata/RHSA-2026:11856","https://access.redhat.com/errata/RHSA-2026:11916","https://access.redhat.com/errata/RHSA-2026:11996","https://access.redhat.com/errata/RHSA-2026:12116","https://access.redhat.com/errata/RHSA-2026:12118","https://access.redhat.com/errata/RHSA-2026:12119","https://access.redhat.com/errata/RHSA-2026:12277","https://access.redhat.com/errata/RHSA-2026:12279","https://access.redhat.com/errata/RHSA-2026:12283","https://access.redhat.com/errata/RHSA-2026:12337","https://access.redhat.com/errata/RHSA-2026:13548","https://access.redhat.com/errata/RHSA-2026:13791","https://access.redhat.com/errata/RHSA-2026:13829","https://access.redhat.com/errata/RHSA-2026:14775","https://access.redhat.com/errata/RHSA-2026:15092","https://access.redhat.com/errata/RHSA-2026:17123","https://access.redhat.com/errata/RHSA-2026:17448","https://access.redhat.com/errata/RHSA-2026:17459","https://access.redhat.com/errata/RHSA-2026:17468","https://access.redhat.com/errata/RHSA-2026:17474","https://access.redhat.com/errata/RHSA-2026:17475","https://access.redhat.com/errata/RHSA-2026:17598","https://access.redhat.com/errata/RHSA-2026:17599","https://access.redhat.com/errata/RHSA-2026:17789","https://access.redhat.com/errata/RHSA-2026:18068","https://access.redhat.com/errata/RHSA-2026:18585","https://access.redhat.com/errata/RHSA-2026:19099","https://access.redhat.com/errata/RHSA-2026:19108","https://access.redhat.com/errata/RHSA-2026:19109","https://access.redhat.com/errata/RHSA-2026:19135","https://access.redhat.com/errata/RHSA-2026:19207","https://access.redhat.com/errata/RHSA-2026:19353","https://access.redhat.com/errata/RHSA-2026:19375","https://access.redhat.com/errata/RHSA-2026:19712","https://access.redhat.com/errata/RHSA-2026:19719","https://access.redhat.com/errata/RHSA-2026:19720","https://access.redhat.com/errata/RHSA-2026:19721","https://access.redhat.com/errata/RHSA-2026:20034","https://access.redhat.com/errata/RHSA-2026:20035","https://access.redhat.com/errata/RHSA-2026:20041","https://access.redhat.com/errata/RHSA-2026:20042","https://access.redhat.com/errata/RHSA-2026:20088","https://access.redhat.com/errata/RHSA-2026:20089","https://access.redhat.com/errata/RHSA-2026:20322","https://access.redhat.com/errata/RHSA-2026:20436","https://access.redhat.com/errata/RHSA-2026:20943","https://access.redhat.com/errata/RHSA-2026:20946","https://access.redhat.com/errata/RHSA-2026:21017","https://access.redhat.com/errata/RHSA-2026:21657","https://access.redhat.com/errata/RHSA-2026:21658","https://access.redhat.com/errata/RHSA-2026:21691","https://access.redhat.com/errata/RHSA-2026:21692","https://access.redhat.com/errata/RHSA-2026:21696","https://access.redhat.com/errata/RHSA-2026:21697","https://access.redhat.com/errata/RHSA-2026:21703","https://access.redhat.com/errata/RHSA-2026:21704","https://access.redhat.com/errata/RHSA-2026:21709","https://access.redhat.com/errata/RHSA-2026:21710","https://access.redhat.com/errata/RHSA-2026:21769","https://access.redhat.com/errata/RHSA-2026:21931","https://access.redhat.com/errata/RHSA-2026:21932","https://access.redhat.com/errata/RHSA-2026:22347","https://access.redhat.com/errata/RHSA-2026:22423","https://access.redhat.com/errata/RHSA-2026:22450","https://access.redhat.com/errata/RHSA-2026:22465","https://access.redhat.com/errata/RHSA-2026:22485","https://access.redhat.com/errata/RHSA-2026:22645","https://access.redhat.com/errata/RHSA-2026:22689","https://access.redhat.com/errata/RHSA-2026:22714","https://access.redhat.com/errata/RHSA-2026:22800","https://access.redhat.com/errata/RHSA-2026:22937","https://access.redhat.com/errata/RHSA-2026:22959","https://access.redhat.com/errata/RHSA-2026:22961","https://access.redhat.com/errata/RHSA-2026:23228","https://access.redhat.com/errata/RHSA-2026:23234","https://access.redhat.com/errata/RHSA-2026:23235","https://access.redhat.com/errata/RHSA-2026:23241","https://access.redhat.com/errata/RHSA-2026:23246","https://access.redhat.com/errata/RHSA-2026:23247","https://access.redhat.com/errata/RHSA-2026:23345","https://access.redhat.com/errata/RHSA-2026:24484","https://access.redhat.com/errata/RHSA-2026:24506","https://access.redhat.com/errata/RHSA-2026:24535","https://access.redhat.com/errata/RHSA-2026:24536","https://access.redhat.com/errata/RHSA-2026:24759","https://access.redhat.com/errata/RHSA-2026:24853","https://access.redhat.com/errata/RHSA-2026:24977","https://access.redhat.com/errata/RHSA-2026:25009","https://access.redhat.com/errata/RHSA-2026:25045","https://access.redhat.com/errata/RHSA-2026:25127","https://access.redhat.com/errata/RHSA-2026:25182","https://access.redhat.com/errata/RHSA-2026:25183","https://access.redhat.com/errata/RHSA-2026:25187","https://access.redhat.com/errata/RHSA-2026:25194","https://access.redhat.com/errata/RHSA-2026:25195","https://access.redhat.com/errata/RHSA-2026:25201","https://access.redhat.com/errata/RHSA-2026:26412","https://access.redhat.com/errata/RHSA-2026:26413","https://access.redhat.com/errata/RHSA-2026:26416","https://access.redhat.com/errata/RHSA-2026:26420","https://access.redhat.com/errata/RHSA-2026:26519","https://access.redhat.com/errata/RHSA-2026:26568","https://access.redhat.com/errata/RHSA-2026:26997","https://access.redhat.com/errata/RHSA-2026:26999","https://access.redhat.com/errata/RHSA-2026:27001","https://access.redhat.com/errata/RHSA-2026:27004","https://access.redhat.com/errata/RHSA-2026:27063","https://access.redhat.com/errata/RHSA-2026:27076","https://access.redhat.com/errata/RHSA-2026:27712","https://access.redhat.com/errata/RHSA-2026:27856","https://access.redhat.com/errata/RHSA-2026:27892","https://access.redhat.com/errata/RHSA-2026:27893","https://access.redhat.com/errata/RHSA-2026:27901","https://access.redhat.com/errata/RHSA-2026:27957","https://access.redhat.com/errata/RHSA-2026:28047","https://access.redhat.com/errata/RHSA-2026:28893","https://access.redhat.com/errata/RHSA-2026:28964","https://access.redhat.com/errata/RHSA-2026:29079","https://access.redhat.com/errata/RHSA-2026:29082","https://access.redhat.com/errata/RHSA-2026:29854","https://access.redhat.com/errata/RHSA-2026:34049","https://access.redhat.com/errata/RHSA-2026:34097","https://access.redhat.com/errata/RHSA-2026:34099","https://access.redhat.com/errata/RHSA-2026:34100","https://access.redhat.com/errata/RHSA-2026:34364","https://access.redhat.com/errata/RHSA-2026:34769","https://access.redhat.com/errata/RHSA-2026:34794","https://access.redhat.com/errata/RHSA-2026:34795","https://access.redhat.com/errata/RHSA-2026:36611","https://access.redhat.com/errata/RHSA-2026:36621","https://access.redhat.com/errata/RHSA-2026:36651","https://access.redhat.com/errata/RHSA-2026:36796","https://access.redhat.com/errata/RHSA-2026:36882","https://access.redhat.com/errata/RHSA-2026:37192","https://access.redhat.com/errata/RHSA-2026:37275","https://access.redhat.com/errata/RHSA-2026:37580","https://access.redhat.com/errata/RHSA-2026:37585","https://access.redhat.com/errata/RHSA-2026:40022","https://access.redhat.com/errata/RHSA-2026:40030","https://access.redhat.com/errata/RHSA-2026:40118","https://access.redhat.com/errata/RHSA-2026:40792","https://access.redhat.com/errata/RHSA-2026:40795","https://access.redhat.com/errata/RHSA-2026:40945","https://access.redhat.com/errata/RHSA-2026:40984","https://access.redhat.com/errata/RHSA-2026:41019","https://access.redhat.com/errata/RHSA-2026:41928","https://access.redhat.com/errata/RHSA-2026:41941","https://access.redhat.com/errata/RHSA-2026:41944","https://access.redhat.com/errata/RHSA-2026:42049","https://access.redhat.com/errata/RHSA-2026:42051","https://access.redhat.com/errata/RHSA-2026:42150","https://access.redhat.com/errata/RHSA-2026:42151","https://access.redhat.com/errata/RHSA-2026:42240","https://access.redhat.com/errata/RHSA-2026:42644","https://access.redhat.com/errata/RHSA-2026:43225","https://access.redhat.com/errata/RHSA-2026:43227","https://access.redhat.com/errata/RHSA-2026:43253","https://access.redhat.com/errata/RHSA-2026:43331","https://access.redhat.com/errata/RHSA-2026:43692","https://access.redhat.com/errata/RHSA-2026:44233","https://access.redhat.com/errata/RHSA-2026:44235","https://access.redhat.com/errata/RHSA-2026:47728","https://access.redhat.com/errata/RHSA-2026:47952","https://access.redhat.com/errata/RHSA-2026:48699","https://access.redhat.com/errata/RHSA-2026:48790","https://access.redhat.com/errata/RHSA-2026:50758","https://access.redhat.com/errata/RHSA-2026:50843","https://access.redhat.com/errata/RHSA-2026:51033","https://access.redhat.com/errata/RHSA-2026:53728","https://access.redhat.com/errata/RHSA-2026:53763","https://access.redhat.com/errata/RHSA-2026:53773","https://access.redhat.com/errata/RHSA-2026:53804","https://access.redhat.com/errata/RHSA-2026:54191","https://access.redhat.com/errata/RHSA-2026:54274","https://access.redhat.com/errata/RHSA-2026:54286","https://access.redhat.com/errata/RHSA-2026:54531","https://access.redhat.com/errata/RHSA-2026:54757","https://access.redhat.com/errata/RHSA-2026:56366","https://access.redhat.com/errata/RHSA-2026:56431","https://access.redhat.com/errata/RHSA-2026:56789","https://access.redhat.com/errata/RHSA-2026:56854","https://access.redhat.com/errata/RHSA-2026:56912","https://access.redhat.com/errata/RHSA-2026:56959","https://access.redhat.com/errata/RHSA-2026:57013","https://access.redhat.com/errata/RHSA-2026:57365","https://access.redhat.com/errata/RHSA-2026:59833","https://access.redhat.com/errata/RHSA-2026:60146","https://access.redhat.com/errata/RHSA-2026:61245","https://access.redhat.com/errata/RHSA-2026:6174","https://access.redhat.com/errata/RHSA-2026:6428","https://access.redhat.com/errata/RHSA-2026:6564","https://access.redhat.com/errata/RHSA-2026:6802","https://access.redhat.com/errata/RHSA-2026:7110","https://access.redhat.com/errata/RHSA-2026:7128","https://access.redhat.com/errata/RHSA-2026:7245","https://access.redhat.com/errata/RHSA-2026:8151","https://access.redhat.com/errata/RHSA-2026:8338","https://access.redhat.com/errata/RHSA-2026:8433","https://access.redhat.com/errata/RHSA-2026:8449","https://access.redhat.com/errata/RHSA-2026:8483","https://access.redhat.com/errata/RHSA-2026:8484","https://access.redhat.com/errata/RHSA-2026:8490","https://access.redhat.com/errata/RHSA-2026:8491","https://access.redhat.com/errata/RHSA-2026:8493","https://access.redhat.com/errata/RHSA-2026:9385","https://access.redhat.com/errata/RHSA-2026:9388","https://access.redhat.com/errata/RHSA-2026:9440","https://access.redhat.com/errata/RHSA-2026:9448","https://access.redhat.com/errata/RHSA-2026:9453","https://access.redhat.com/errata/RHSA-2026:9872","https://access.redhat.com/security/cve/CVE-2026-33186","https://bugzilla.redhat.com/show_bug.cgi?id=2449833","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33186.json"],"description":"gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of the HTTP/2 `:path` pseudo-header. The gRPC-Go server was too lenient in its routing logic, accepting requests where the `:path` omitted the mandatory leading slash (e.g., `Service/Method` instead of `/Service/Method`). While the server successfully routed these requests to the correct handler, authorization interceptors (including the official `grpc/authz` package) evaluated the raw, non-canonical path string. Consequently, \"deny\" rules defined using canonical paths (starting with `/`) failed to match the incoming request, allowing it to bypass the policy if a fallback \"allow\" rule was present. This affects gRPC-Go servers that use path-based authorization interceptors, such as the official RBAC implementation in `google.golang.org/grpc/authz` or custom interceptors relying on `info.FullMethod` or `grpc.Method(ctx)`; AND that have a security policy contains specific \"deny\" rules for canonical paths but allows other requests by default (a fallback \"allow\" rule). The vulnerability is exploitable by an attacker who can send raw HTTP/2 frames with malformed `:path` headers directly to the gRPC server. The fix in version 1.79.3 ensures that any request with a `:path` that does not start with a leading slash is immediately rejected with a `codes.Unimplemented` error, preventing it from reaching authorization interceptors or handlers with a non-canonical path string. While upgrading is the most secure and recommended path, users can mitigate the vulnerability using one of the following methods: Use a validating interceptor (recommended mitigation); infrastructure-level normalization; and/or policy hardening.","cvss":[{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"exploitabilityScore":3.9,"impactScore":5.2},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"exploitabilityScore":3.9,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-33186","epss":0.01584,"percentile":0.75571,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-33186","cwe":"CWE-285","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-33186","cwe":"CWE-551","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"google.golang.org/grpc","version":"v1.75.1"}},"found":{"vulnerabilityID":"GHSA-p77j-4mvh-x3m3","versionConstraint":"<1.79.3 (go)"},"fix":{"suggestedVersion":"1.79.3"}}],"artifact":{"id":"pkg:golang/google.golang.org/grpc@v1.75.1?package-id=fe766a98fd2603ca","name":"google.golang.org/grpc","version":"v1.75.1","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:google:grpc:v1.75.1:*:*:*:*:*:*:*"],"purl":"pkg:golang/google.golang.org/grpc@v1.75.1","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:/ODCNEuf9VghjgO3rqLcfg8fiOP0nSluljWFlDxELLI="}}},{"vulnerability":{"id":"GHSA-p77j-4mvh-x3m3","dataSource":"https://github.com/advisories/GHSA-p77j-4mvh-x3m3","namespace":"github:language:go","severity":"Critical","urls":["https://github.com/grpc/grpc-go/security/advisories/GHSA-p77j-4mvh-x3m3","https://nvd.nist.gov/vuln/detail/CVE-2026-33186"],"description":"gRPC-Go has an authorization bypass via missing leading slash in :path","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"exploitabilityScore":3.9,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-33186","epss":0.01584,"percentile":0.75571,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-33186","cwe":"CWE-285","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-33186","cwe":"CWE-551","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["1.79.3"],"state":"fixed","available":[{"version":"1.79.3","date":"2026-03-19","kind":"first-observed"}]},"advisories":[],"risk":1.4335200000000001},"relatedVulnerabilities":[{"id":"CVE-2026-33186","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33186","namespace":"nvd:cpe","severity":"Critical","urls":["https://github.com/grpc/grpc-go/security/advisories/GHSA-p77j-4mvh-x3m3","https://access.redhat.com/errata/RHSA-2026:10093","https://access.redhat.com/errata/RHSA-2026:10094","https://access.redhat.com/errata/RHSA-2026:10105","https://access.redhat.com/errata/RHSA-2026:10107","https://access.redhat.com/errata/RHSA-2026:10125","https://access.redhat.com/errata/RHSA-2026:10126","https://access.redhat.com/errata/RHSA-2026:10130","https://access.redhat.com/errata/RHSA-2026:10131","https://access.redhat.com/errata/RHSA-2026:10153","https://access.redhat.com/errata/RHSA-2026:10155","https://access.redhat.com/errata/RHSA-2026:10158","https://access.redhat.com/errata/RHSA-2026:10172","https://access.redhat.com/errata/RHSA-2026:10175","https://access.redhat.com/errata/RHSA-2026:10698","https://access.redhat.com/errata/RHSA-2026:10705","https://access.redhat.com/errata/RHSA-2026:10706","https://access.redhat.com/errata/RHSA-2026:11070","https://access.redhat.com/errata/RHSA-2026:11408","https://access.redhat.com/errata/RHSA-2026:11803","https://access.redhat.com/errata/RHSA-2026:11856","https://access.redhat.com/errata/RHSA-2026:11916","https://access.redhat.com/errata/RHSA-2026:11996","https://access.redhat.com/errata/RHSA-2026:12116","https://access.redhat.com/errata/RHSA-2026:12118","https://access.redhat.com/errata/RHSA-2026:12119","https://access.redhat.com/errata/RHSA-2026:12277","https://access.redhat.com/errata/RHSA-2026:12279","https://access.redhat.com/errata/RHSA-2026:12283","https://access.redhat.com/errata/RHSA-2026:12337","https://access.redhat.com/errata/RHSA-2026:13548","https://access.redhat.com/errata/RHSA-2026:13791","https://access.redhat.com/errata/RHSA-2026:13829","https://access.redhat.com/errata/RHSA-2026:14775","https://access.redhat.com/errata/RHSA-2026:15092","https://access.redhat.com/errata/RHSA-2026:17123","https://access.redhat.com/errata/RHSA-2026:17448","https://access.redhat.com/errata/RHSA-2026:17459","https://access.redhat.com/errata/RHSA-2026:17468","https://access.redhat.com/errata/RHSA-2026:17474","https://access.redhat.com/errata/RHSA-2026:17475","https://access.redhat.com/errata/RHSA-2026:17598","https://access.redhat.com/errata/RHSA-2026:17599","https://access.redhat.com/errata/RHSA-2026:17789","https://access.redhat.com/errata/RHSA-2026:18068","https://access.redhat.com/errata/RHSA-2026:18585","https://access.redhat.com/errata/RHSA-2026:19099","https://access.redhat.com/errata/RHSA-2026:19108","https://access.redhat.com/errata/RHSA-2026:19109","https://access.redhat.com/errata/RHSA-2026:19135","https://access.redhat.com/errata/RHSA-2026:19207","https://access.redhat.com/errata/RHSA-2026:19353","https://access.redhat.com/errata/RHSA-2026:19375","https://access.redhat.com/errata/RHSA-2026:19712","https://access.redhat.com/errata/RHSA-2026:19719","https://access.redhat.com/errata/RHSA-2026:19720","https://access.redhat.com/errata/RHSA-2026:19721","https://access.redhat.com/errata/RHSA-2026:20034","https://access.redhat.com/errata/RHSA-2026:20035","https://access.redhat.com/errata/RHSA-2026:20041","https://access.redhat.com/errata/RHSA-2026:20042","https://access.redhat.com/errata/RHSA-2026:20088","https://access.redhat.com/errata/RHSA-2026:20089","https://access.redhat.com/errata/RHSA-2026:20322","https://access.redhat.com/errata/RHSA-2026:20436","https://access.redhat.com/errata/RHSA-2026:20943","https://access.redhat.com/errata/RHSA-2026:20946","https://access.redhat.com/errata/RHSA-2026:21017","https://access.redhat.com/errata/RHSA-2026:21657","https://access.redhat.com/errata/RHSA-2026:21658","https://access.redhat.com/errata/RHSA-2026:21691","https://access.redhat.com/errata/RHSA-2026:21692","https://access.redhat.com/errata/RHSA-2026:21696","https://access.redhat.com/errata/RHSA-2026:21697","https://access.redhat.com/errata/RHSA-2026:21703","https://access.redhat.com/errata/RHSA-2026:21704","https://access.redhat.com/errata/RHSA-2026:21709","https://access.redhat.com/errata/RHSA-2026:21710","https://access.redhat.com/errata/RHSA-2026:21769","https://access.redhat.com/errata/RHSA-2026:21931","https://access.redhat.com/errata/RHSA-2026:21932","https://access.redhat.com/errata/RHSA-2026:22347","https://access.redhat.com/errata/RHSA-2026:22423","https://access.redhat.com/errata/RHSA-2026:22450","https://access.redhat.com/errata/RHSA-2026:22465","https://access.redhat.com/errata/RHSA-2026:22485","https://access.redhat.com/errata/RHSA-2026:22645","https://access.redhat.com/errata/RHSA-2026:22689","https://access.redhat.com/errata/RHSA-2026:22714","https://access.redhat.com/errata/RHSA-2026:22800","https://access.redhat.com/errata/RHSA-2026:22937","https://access.redhat.com/errata/RHSA-2026:22959","https://access.redhat.com/errata/RHSA-2026:22961","https://access.redhat.com/errata/RHSA-2026:23228","https://access.redhat.com/errata/RHSA-2026:23234","https://access.redhat.com/errata/RHSA-2026:23235","https://access.redhat.com/errata/RHSA-2026:23241","https://access.redhat.com/errata/RHSA-2026:23246","https://access.redhat.com/errata/RHSA-2026:23247","https://access.redhat.com/errata/RHSA-2026:23345","https://access.redhat.com/errata/RHSA-2026:24484","https://access.redhat.com/errata/RHSA-2026:24506","https://access.redhat.com/errata/RHSA-2026:24535","https://access.redhat.com/errata/RHSA-2026:24536","https://access.redhat.com/errata/RHSA-2026:24759","https://access.redhat.com/errata/RHSA-2026:24853","https://access.redhat.com/errata/RHSA-2026:24977","https://access.redhat.com/errata/RHSA-2026:25009","https://access.redhat.com/errata/RHSA-2026:25045","https://access.redhat.com/errata/RHSA-2026:25127","https://access.redhat.com/errata/RHSA-2026:25182","https://access.redhat.com/errata/RHSA-2026:25183","https://access.redhat.com/errata/RHSA-2026:25187","https://access.redhat.com/errata/RHSA-2026:25194","https://access.redhat.com/errata/RHSA-2026:25195","https://access.redhat.com/errata/RHSA-2026:25201","https://access.redhat.com/errata/RHSA-2026:26412","https://access.redhat.com/errata/RHSA-2026:26413","https://access.redhat.com/errata/RHSA-2026:26416","https://access.redhat.com/errata/RHSA-2026:26420","https://access.redhat.com/errata/RHSA-2026:26519","https://access.redhat.com/errata/RHSA-2026:26568","https://access.redhat.com/errata/RHSA-2026:26997","https://access.redhat.com/errata/RHSA-2026:26999","https://access.redhat.com/errata/RHSA-2026:27001","https://access.redhat.com/errata/RHSA-2026:27004","https://access.redhat.com/errata/RHSA-2026:27063","https://access.redhat.com/errata/RHSA-2026:27076","https://access.redhat.com/errata/RHSA-2026:27712","https://access.redhat.com/errata/RHSA-2026:27856","https://access.redhat.com/errata/RHSA-2026:27892","https://access.redhat.com/errata/RHSA-2026:27893","https://access.redhat.com/errata/RHSA-2026:27901","https://access.redhat.com/errata/RHSA-2026:27957","https://access.redhat.com/errata/RHSA-2026:28047","https://access.redhat.com/errata/RHSA-2026:28893","https://access.redhat.com/errata/RHSA-2026:28964","https://access.redhat.com/errata/RHSA-2026:29079","https://access.redhat.com/errata/RHSA-2026:29082","https://access.redhat.com/errata/RHSA-2026:29854","https://access.redhat.com/errata/RHSA-2026:34049","https://access.redhat.com/errata/RHSA-2026:34097","https://access.redhat.com/errata/RHSA-2026:34099","https://access.redhat.com/errata/RHSA-2026:34100","https://access.redhat.com/errata/RHSA-2026:34364","https://access.redhat.com/errata/RHSA-2026:34769","https://access.redhat.com/errata/RHSA-2026:34794","https://access.redhat.com/errata/RHSA-2026:34795","https://access.redhat.com/errata/RHSA-2026:36611","https://access.redhat.com/errata/RHSA-2026:36621","https://access.redhat.com/errata/RHSA-2026:36651","https://access.redhat.com/errata/RHSA-2026:36796","https://access.redhat.com/errata/RHSA-2026:36882","https://access.redhat.com/errata/RHSA-2026:37192","https://access.redhat.com/errata/RHSA-2026:37275","https://access.redhat.com/errata/RHSA-2026:37580","https://access.redhat.com/errata/RHSA-2026:37585","https://access.redhat.com/errata/RHSA-2026:40022","https://access.redhat.com/errata/RHSA-2026:40030","https://access.redhat.com/errata/RHSA-2026:40118","https://access.redhat.com/errata/RHSA-2026:40792","https://access.redhat.com/errata/RHSA-2026:40795","https://access.redhat.com/errata/RHSA-2026:40945","https://access.redhat.com/errata/RHSA-2026:40984","https://access.redhat.com/errata/RHSA-2026:41019","https://access.redhat.com/errata/RHSA-2026:41928","https://access.redhat.com/errata/RHSA-2026:41941","https://access.redhat.com/errata/RHSA-2026:41944","https://access.redhat.com/errata/RHSA-2026:42049","https://access.redhat.com/errata/RHSA-2026:42051","https://access.redhat.com/errata/RHSA-2026:42150","https://access.redhat.com/errata/RHSA-2026:42151","https://access.redhat.com/errata/RHSA-2026:42240","https://access.redhat.com/errata/RHSA-2026:42644","https://access.redhat.com/errata/RHSA-2026:43225","https://access.redhat.com/errata/RHSA-2026:43227","https://access.redhat.com/errata/RHSA-2026:43253","https://access.redhat.com/errata/RHSA-2026:43331","https://access.redhat.com/errata/RHSA-2026:43692","https://access.redhat.com/errata/RHSA-2026:44233","https://access.redhat.com/errata/RHSA-2026:44235","https://access.redhat.com/errata/RHSA-2026:47728","https://access.redhat.com/errata/RHSA-2026:47952","https://access.redhat.com/errata/RHSA-2026:48699","https://access.redhat.com/errata/RHSA-2026:48790","https://access.redhat.com/errata/RHSA-2026:50758","https://access.redhat.com/errata/RHSA-2026:50843","https://access.redhat.com/errata/RHSA-2026:51033","https://access.redhat.com/errata/RHSA-2026:53728","https://access.redhat.com/errata/RHSA-2026:53763","https://access.redhat.com/errata/RHSA-2026:53773","https://access.redhat.com/errata/RHSA-2026:53804","https://access.redhat.com/errata/RHSA-2026:54191","https://access.redhat.com/errata/RHSA-2026:54274","https://access.redhat.com/errata/RHSA-2026:54286","https://access.redhat.com/errata/RHSA-2026:54531","https://access.redhat.com/errata/RHSA-2026:54757","https://access.redhat.com/errata/RHSA-2026:56366","https://access.redhat.com/errata/RHSA-2026:56431","https://access.redhat.com/errata/RHSA-2026:56789","https://access.redhat.com/errata/RHSA-2026:56854","https://access.redhat.com/errata/RHSA-2026:56912","https://access.redhat.com/errata/RHSA-2026:56959","https://access.redhat.com/errata/RHSA-2026:57013","https://access.redhat.com/errata/RHSA-2026:57365","https://access.redhat.com/errata/RHSA-2026:59833","https://access.redhat.com/errata/RHSA-2026:60146","https://access.redhat.com/errata/RHSA-2026:61245","https://access.redhat.com/errata/RHSA-2026:6174","https://access.redhat.com/errata/RHSA-2026:6428","https://access.redhat.com/errata/RHSA-2026:6564","https://access.redhat.com/errata/RHSA-2026:6802","https://access.redhat.com/errata/RHSA-2026:7110","https://access.redhat.com/errata/RHSA-2026:7128","https://access.redhat.com/errata/RHSA-2026:7245","https://access.redhat.com/errata/RHSA-2026:8151","https://access.redhat.com/errata/RHSA-2026:8338","https://access.redhat.com/errata/RHSA-2026:8433","https://access.redhat.com/errata/RHSA-2026:8449","https://access.redhat.com/errata/RHSA-2026:8483","https://access.redhat.com/errata/RHSA-2026:8484","https://access.redhat.com/errata/RHSA-2026:8490","https://access.redhat.com/errata/RHSA-2026:8491","https://access.redhat.com/errata/RHSA-2026:8493","https://access.redhat.com/errata/RHSA-2026:9385","https://access.redhat.com/errata/RHSA-2026:9388","https://access.redhat.com/errata/RHSA-2026:9440","https://access.redhat.com/errata/RHSA-2026:9448","https://access.redhat.com/errata/RHSA-2026:9453","https://access.redhat.com/errata/RHSA-2026:9872","https://access.redhat.com/security/cve/CVE-2026-33186","https://bugzilla.redhat.com/show_bug.cgi?id=2449833","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33186.json"],"description":"gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of the HTTP/2 `:path` pseudo-header. The gRPC-Go server was too lenient in its routing logic, accepting requests where the `:path` omitted the mandatory leading slash (e.g., `Service/Method` instead of `/Service/Method`). While the server successfully routed these requests to the correct handler, authorization interceptors (including the official `grpc/authz` package) evaluated the raw, non-canonical path string. Consequently, \"deny\" rules defined using canonical paths (starting with `/`) failed to match the incoming request, allowing it to bypass the policy if a fallback \"allow\" rule was present. This affects gRPC-Go servers that use path-based authorization interceptors, such as the official RBAC implementation in `google.golang.org/grpc/authz` or custom interceptors relying on `info.FullMethod` or `grpc.Method(ctx)`; AND that have a security policy contains specific \"deny\" rules for canonical paths but allows other requests by default (a fallback \"allow\" rule). The vulnerability is exploitable by an attacker who can send raw HTTP/2 frames with malformed `:path` headers directly to the gRPC server. The fix in version 1.79.3 ensures that any request with a `:path` that does not start with a leading slash is immediately rejected with a `codes.Unimplemented` error, preventing it from reaching authorization interceptors or handlers with a non-canonical path string. While upgrading is the most secure and recommended path, users can mitigate the vulnerability using one of the following methods: Use a validating interceptor (recommended mitigation); infrastructure-level normalization; and/or policy hardening.","cvss":[{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"exploitabilityScore":3.9,"impactScore":5.2},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"exploitabilityScore":3.9,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-33186","epss":0.01584,"percentile":0.75571,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-33186","cwe":"CWE-285","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-33186","cwe":"CWE-551","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"google.golang.org/grpc","version":"v1.78.0"}},"found":{"vulnerabilityID":"GHSA-p77j-4mvh-x3m3","versionConstraint":"<1.79.3 (go)"},"fix":{"suggestedVersion":"1.79.3"}}],"artifact":{"id":"pkg:golang/google.golang.org/grpc@v1.78.0?package-id=c776a416fb4b5ef1","name":"google.golang.org/grpc","version":"v1.78.0","type":"go-module","locations":[{"path":"/tool-imports/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:google:grpc:v1.78.0:*:*:*:*:*:*:*"],"purl":"pkg:golang/google.golang.org/grpc@v1.78.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:K1XZG/yGDJnzMdd/uZHAkVqJE+xIDOcmdSFZkBUicNc="}}},{"vulnerability":{"id":"GO-2026-4918","dataSource":"https://go.dev/cl/761581","namespace":"govulndb:language:go","severity":"High","urls":["https://go.dev/cl/761640","https://go.dev/issue/78476","https://groups.google.com/g/golang-announce/c/qcCIEXso47M"],"description":"When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-33814","epss":0.0084,"percentile":0.57882,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-33814","cwe":"CWE-835","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2026-33814","cwe":"CWE-606","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["0.53.0"],"state":"fixed","available":[{"version":"0.53.0","date":"2026-04-09","kind":"release"}]},"advisories":[],"risk":0.63},"relatedVulnerabilities":[{"id":"CVE-2026-33814","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33814","namespace":"nvd:cpe","severity":"High","urls":["https://go.dev/cl/761581","https://go.dev/cl/761640","https://go.dev/issue/78476","https://groups.google.com/g/golang-announce/c/qcCIEXso47M","https://pkg.go.dev/vuln/GO-2026-4918","https://access.redhat.com/errata/RHSA-2026:22112","https://access.redhat.com/errata/RHSA-2026:22120","https://access.redhat.com/errata/RHSA-2026:22121","https://access.redhat.com/errata/RHSA-2026:23262","https://access.redhat.com/errata/RHSA-2026:23264","https://access.redhat.com/errata/RHSA-2026:33120","https://access.redhat.com/errata/RHSA-2026:33123","https://access.redhat.com/errata/RHSA-2026:33142","https://access.redhat.com/errata/RHSA-2026:33150","https://access.redhat.com/errata/RHSA-2026:34342","https://access.redhat.com/errata/RHSA-2026:37387","https://access.redhat.com/errata/RHSA-2026:42644","https://access.redhat.com/errata/RHSA-2026:43692","https://access.redhat.com/errata/RHSA-2026:49702","https://access.redhat.com/errata/RHSA-2026:49712","https://access.redhat.com/errata/RHSA-2026:50205","https://access.redhat.com/errata/RHSA-2026:54274","https://access.redhat.com/errata/RHSA-2026:54283","https://access.redhat.com/errata/RHSA-2026:54284","https://access.redhat.com/errata/RHSA-2026:54285","https://access.redhat.com/errata/RHSA-2026:54286","https://access.redhat.com/errata/RHSA-2026:54287","https://access.redhat.com/errata/RHSA-2026:56854","https://access.redhat.com/errata/RHSA-2026:56912","https://access.redhat.com/errata/RHSA-2026:57191","https://access.redhat.com/errata/RHSA-2026:57194","https://access.redhat.com/errata/RHSA-2026:57365","https://access.redhat.com/errata/RHSA-2026:57367","https://access.redhat.com/errata/RHSA-2026:57408","https://access.redhat.com/errata/RHSA-2026:57545","https://access.redhat.com/errata/RHSA-2026:57649","https://access.redhat.com/errata/RHSA-2026:57845","https://access.redhat.com/errata/RHSA-2026:59833","https://access.redhat.com/errata/RHSA-2026:60023","https://access.redhat.com/errata/RHSA-2026:60025","https://access.redhat.com/errata/RHSA-2026:60441","https://access.redhat.com/errata/RHSA-2026:60442","https://access.redhat.com/errata/RHSA-2026:60446","https://access.redhat.com/errata/RHSA-2026:60447","https://access.redhat.com/errata/RHSA-2026:60454","https://access.redhat.com/errata/RHSA-2026:60477","https://access.redhat.com/errata/RHSA-2026:60478","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/errata/RHSA-2026:60668","https://access.redhat.com/errata/RHSA-2026:61253","https://access.redhat.com/errata/RHSA-2026:62410","https://access.redhat.com/errata/RHSA-2026:62550","https://access.redhat.com/errata/RHSA-2026:62551","https://access.redhat.com/errata/RHSA-2026:63046","https://access.redhat.com/errata/RHSA-2026:63047","https://access.redhat.com/errata/RHSA-2026:63048","https://access.redhat.com/errata/RHSA-2026:63050","https://access.redhat.com/errata/RHSA-2026:63091","https://access.redhat.com/errata/RHSA-2026:63096","https://access.redhat.com/errata/RHSA-2026:63097","https://access.redhat.com/errata/RHSA-2026:63103","https://access.redhat.com/errata/RHSA-2026:63104","https://access.redhat.com/errata/RHSA-2026:63636","https://access.redhat.com/errata/RHSA-2026:63637","https://access.redhat.com/errata/RHSA-2026:63639","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:66350","https://access.redhat.com/security/cve/CVE-2026-33814","https://bugzilla.redhat.com/show_bug.cgi?id=2467815","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33814.json"],"description":"When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-33814","epss":0.0084,"percentile":0.57882,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-33814","cwe":"CWE-835","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2026-33814","cwe":"CWE-606","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"golang.org/x/net","version":"v0.48.0"}},"found":{"vulnerabilityID":"GO-2026-4918","versionConstraint":"<0.53.0 (go)"},"fix":{"suggestedVersion":"0.53.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/net@v0.48.0?package-id=7e3c0e57ff3d79d8","name":"golang.org/x/net","version":"v0.48.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:networking:v0.48.0:*:*:*:*:go:*:*","cpe:2.3:a:golang:net:v0.48.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/net@v0.48.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:zyQRTTrjc33Lhh0fBgT/H3oZq9WuvRR5gPC70xpDiQU="}}},{"vulnerability":{"id":"GO-2026-4918","dataSource":"https://go.dev/cl/761581","namespace":"govulndb:language:go","severity":"High","urls":["https://go.dev/cl/761640","https://go.dev/issue/78476","https://groups.google.com/g/golang-announce/c/qcCIEXso47M"],"description":"When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-33814","epss":0.0084,"percentile":0.57882,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-33814","cwe":"CWE-835","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2026-33814","cwe":"CWE-606","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["0.53.0"],"state":"fixed","available":[{"version":"0.53.0","date":"2026-04-09","kind":"release"}]},"advisories":[],"risk":0.63},"relatedVulnerabilities":[{"id":"CVE-2026-33814","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33814","namespace":"nvd:cpe","severity":"High","urls":["https://go.dev/cl/761581","https://go.dev/cl/761640","https://go.dev/issue/78476","https://groups.google.com/g/golang-announce/c/qcCIEXso47M","https://pkg.go.dev/vuln/GO-2026-4918","https://access.redhat.com/errata/RHSA-2026:22112","https://access.redhat.com/errata/RHSA-2026:22120","https://access.redhat.com/errata/RHSA-2026:22121","https://access.redhat.com/errata/RHSA-2026:23262","https://access.redhat.com/errata/RHSA-2026:23264","https://access.redhat.com/errata/RHSA-2026:33120","https://access.redhat.com/errata/RHSA-2026:33123","https://access.redhat.com/errata/RHSA-2026:33142","https://access.redhat.com/errata/RHSA-2026:33150","https://access.redhat.com/errata/RHSA-2026:34342","https://access.redhat.com/errata/RHSA-2026:37387","https://access.redhat.com/errata/RHSA-2026:42644","https://access.redhat.com/errata/RHSA-2026:43692","https://access.redhat.com/errata/RHSA-2026:49702","https://access.redhat.com/errata/RHSA-2026:49712","https://access.redhat.com/errata/RHSA-2026:50205","https://access.redhat.com/errata/RHSA-2026:54274","https://access.redhat.com/errata/RHSA-2026:54283","https://access.redhat.com/errata/RHSA-2026:54284","https://access.redhat.com/errata/RHSA-2026:54285","https://access.redhat.com/errata/RHSA-2026:54286","https://access.redhat.com/errata/RHSA-2026:54287","https://access.redhat.com/errata/RHSA-2026:56854","https://access.redhat.com/errata/RHSA-2026:56912","https://access.redhat.com/errata/RHSA-2026:57191","https://access.redhat.com/errata/RHSA-2026:57194","https://access.redhat.com/errata/RHSA-2026:57365","https://access.redhat.com/errata/RHSA-2026:57367","https://access.redhat.com/errata/RHSA-2026:57408","https://access.redhat.com/errata/RHSA-2026:57545","https://access.redhat.com/errata/RHSA-2026:57649","https://access.redhat.com/errata/RHSA-2026:57845","https://access.redhat.com/errata/RHSA-2026:59833","https://access.redhat.com/errata/RHSA-2026:60023","https://access.redhat.com/errata/RHSA-2026:60025","https://access.redhat.com/errata/RHSA-2026:60441","https://access.redhat.com/errata/RHSA-2026:60442","https://access.redhat.com/errata/RHSA-2026:60446","https://access.redhat.com/errata/RHSA-2026:60447","https://access.redhat.com/errata/RHSA-2026:60454","https://access.redhat.com/errata/RHSA-2026:60477","https://access.redhat.com/errata/RHSA-2026:60478","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/errata/RHSA-2026:60668","https://access.redhat.com/errata/RHSA-2026:61253","https://access.redhat.com/errata/RHSA-2026:62410","https://access.redhat.com/errata/RHSA-2026:62550","https://access.redhat.com/errata/RHSA-2026:62551","https://access.redhat.com/errata/RHSA-2026:63046","https://access.redhat.com/errata/RHSA-2026:63047","https://access.redhat.com/errata/RHSA-2026:63048","https://access.redhat.com/errata/RHSA-2026:63050","https://access.redhat.com/errata/RHSA-2026:63091","https://access.redhat.com/errata/RHSA-2026:63096","https://access.redhat.com/errata/RHSA-2026:63097","https://access.redhat.com/errata/RHSA-2026:63103","https://access.redhat.com/errata/RHSA-2026:63104","https://access.redhat.com/errata/RHSA-2026:63636","https://access.redhat.com/errata/RHSA-2026:63637","https://access.redhat.com/errata/RHSA-2026:63639","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:66350","https://access.redhat.com/security/cve/CVE-2026-33814","https://bugzilla.redhat.com/show_bug.cgi?id=2467815","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33814.json"],"description":"When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-33814","epss":0.0084,"percentile":0.57882,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-33814","cwe":"CWE-835","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2026-33814","cwe":"CWE-606","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"golang.org/x/net","version":"v0.50.0"}},"found":{"vulnerabilityID":"GO-2026-4918","versionConstraint":"<0.53.0 (go)"},"fix":{"suggestedVersion":"0.53.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/net@v0.50.0?package-id=a205ae7dff8c80d8","name":"golang.org/x/net","version":"v0.50.0","type":"go-module","locations":[{"path":"/tool-imports/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:networking:v0.50.0:*:*:*:*:go:*:*","cpe:2.3:a:golang:net:v0.50.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/net@v0.50.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:ucWh9eiCGyDR3vtzso0WMQinm2Dnt8cFMuQa9K33J60="}}},{"vulnerability":{"id":"GHSA-f5wc-c3c7-36mc","dataSource":"https://github.com/advisories/GHSA-f5wc-c3c7-36mc","namespace":"github:language:go","severity":"Critical","urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-39832","https://go.dev/cl/778642","https://go.dev/issue/79435","https://groups.google.com/g/golang-announce/c/a082jnz-LvI","https://pkg.go.dev/vuln/GO-2026-5006","https://access.redhat.com/security/cve/CVE-2026-39832","https://bugzilla.redhat.com/show_bug.cgi?id=2480685","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39832.json","https://access.redhat.com/errata/RHSA-2026:35833","https://access.redhat.com/errata/RHSA-2026:36199","https://access.redhat.com/errata/RHSA-2026:36319","https://access.redhat.com/errata/RHSA-2026:36625","https://access.redhat.com/errata/RHSA-2026:36648","https://access.redhat.com/errata/RHSA-2026:37271","https://access.redhat.com/errata/RHSA-2026:37123","https://access.redhat.com/errata/RHSA-2026:37072","https://access.redhat.com/errata/RHSA-2026:36797","https://access.redhat.com/errata/RHSA-2026:36796","https://access.redhat.com/errata/RHSA-2026:36651","https://access.redhat.com/errata/RHSA-2026:37410","https://access.redhat.com/errata/RHSA-2026:37387","https://access.redhat.com/errata/RHSA-2026:40262","https://access.redhat.com/errata/RHSA-2026:40118","https://access.redhat.com/errata/RHSA-2026:41066","https://access.redhat.com/errata/RHSA-2026:41036","https://access.redhat.com/errata/RHSA-2026:41031","https://access.redhat.com/errata/RHSA-2026:41019","https://access.redhat.com/errata/RHSA-2026:40972","https://access.redhat.com/errata/RHSA-2026:40945","https://access.redhat.com/errata/RHSA-2026:42146","https://access.redhat.com/errata/RHSA-2026:42796","https://access.redhat.com/errata/RHSA-2026:43052","https://access.redhat.com/errata/RHSA-2026:43692","https://access.redhat.com/errata/RHSA-2026:49944","https://access.redhat.com/errata/RHSA-2026:52857","https://access.redhat.com/errata/RHSA-2026:52910"],"description":"golang.org/x/crypto doesn't drop invoking agent constraints when forwarding keys","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"exploitabilityScore":3.9,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-39832","epss":0.00683,"percentile":0.52549,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-39832","cwe":"CWE-502","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2026-39832","cwe":"CWE-281","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["0.52.0"],"state":"fixed","available":[{"version":"0.52.0","date":"2026-07-07","kind":"first-observed"}]},"advisories":[],"risk":0.6181150000000001},"relatedVulnerabilities":[{"id":"CVE-2026-39832","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-39832","namespace":"nvd:cpe","severity":"High","urls":["https://go.dev/cl/778640","https://go.dev/cl/778641","https://go.dev/issue/79435","https://groups.google.com/g/golang-announce/c/a082jnz-LvI","https://pkg.go.dev/vuln/GO-2026-5006","https://access.redhat.com/errata/RHSA-2026:35833","https://access.redhat.com/errata/RHSA-2026:36199","https://access.redhat.com/errata/RHSA-2026:36319","https://access.redhat.com/errata/RHSA-2026:36625","https://access.redhat.com/errata/RHSA-2026:36648","https://access.redhat.com/errata/RHSA-2026:36651","https://access.redhat.com/errata/RHSA-2026:36796","https://access.redhat.com/errata/RHSA-2026:36797","https://access.redhat.com/errata/RHSA-2026:37072","https://access.redhat.com/errata/RHSA-2026:37123","https://access.redhat.com/errata/RHSA-2026:37271","https://access.redhat.com/errata/RHSA-2026:37387","https://access.redhat.com/errata/RHSA-2026:37410","https://access.redhat.com/errata/RHSA-2026:40118","https://access.redhat.com/errata/RHSA-2026:40262","https://access.redhat.com/errata/RHSA-2026:40945","https://access.redhat.com/errata/RHSA-2026:40972","https://access.redhat.com/errata/RHSA-2026:41019","https://access.redhat.com/errata/RHSA-2026:41031","https://access.redhat.com/errata/RHSA-2026:41036","https://access.redhat.com/errata/RHSA-2026:41066","https://access.redhat.com/errata/RHSA-2026:42146","https://access.redhat.com/errata/RHSA-2026:42796","https://access.redhat.com/errata/RHSA-2026:43052","https://access.redhat.com/errata/RHSA-2026:43692","https://access.redhat.com/errata/RHSA-2026:49944","https://access.redhat.com/errata/RHSA-2026:52857","https://access.redhat.com/errata/RHSA-2026:52910","https://access.redhat.com/errata/RHSA-2026:57194","https://access.redhat.com/errata/RHSA-2026:59579","https://access.redhat.com/errata/RHSA-2026:61314","https://access.redhat.com/errata/RHSA-2026:66521","https://access.redhat.com/errata/RHSA-2026:67450","https://access.redhat.com/security/cve/CVE-2026-39832","https://bugzilla.redhat.com/show_bug.cgi?id=2480685","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39832.json"],"description":"When adding a key to a remote agent constraint extensions such as restrict-destination-v00@openssh.com were not serialized in the request. Destination restrictions were silently stripped when forwarding keys, allowing unrestricted use of the key on the remote host. The client now serializes all constraint extensions. Additionally, the in-memory keyring returned by NewKeyring() now rejects keys with unsupported constraint extensions instead of silently ignoring them.","cvss":[{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","metrics":{"baseScore":8.7,"exploitabilityScore":2.3,"impactScore":5.8},"vendorMetadata":{}},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"exploitabilityScore":3.9,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-39832","epss":0.00683,"percentile":0.52549,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-39832","cwe":"CWE-502","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2026-39832","cwe":"CWE-281","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"golang.org/x/crypto","version":"v0.46.0"}},"found":{"vulnerabilityID":"GHSA-f5wc-c3c7-36mc","versionConstraint":"<0.52.0 (go)"},"fix":{"suggestedVersion":"0.52.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/crypto@v0.46.0?package-id=b3387fbedc5d73be","name":"golang.org/x/crypto","version":"v0.46.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:crypto:v0.46.0:*:*:*:*:go:*:*","cpe:2.3:a:go:ssh:v0.46.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/crypto@v0.46.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:cKRW/pmt1pKAfetfu+RCEvjvZkA9RimPbh7bhFjGVBU="}}},{"vulnerability":{"id":"GHSA-f5wc-c3c7-36mc","dataSource":"https://github.com/advisories/GHSA-f5wc-c3c7-36mc","namespace":"github:language:go","severity":"Critical","urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-39832","https://go.dev/cl/778642","https://go.dev/issue/79435","https://groups.google.com/g/golang-announce/c/a082jnz-LvI","https://pkg.go.dev/vuln/GO-2026-5006","https://access.redhat.com/security/cve/CVE-2026-39832","https://bugzilla.redhat.com/show_bug.cgi?id=2480685","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39832.json","https://access.redhat.com/errata/RHSA-2026:35833","https://access.redhat.com/errata/RHSA-2026:36199","https://access.redhat.com/errata/RHSA-2026:36319","https://access.redhat.com/errata/RHSA-2026:36625","https://access.redhat.com/errata/RHSA-2026:36648","https://access.redhat.com/errata/RHSA-2026:37271","https://access.redhat.com/errata/RHSA-2026:37123","https://access.redhat.com/errata/RHSA-2026:37072","https://access.redhat.com/errata/RHSA-2026:36797","https://access.redhat.com/errata/RHSA-2026:36796","https://access.redhat.com/errata/RHSA-2026:36651","https://access.redhat.com/errata/RHSA-2026:37410","https://access.redhat.com/errata/RHSA-2026:37387","https://access.redhat.com/errata/RHSA-2026:40262","https://access.redhat.com/errata/RHSA-2026:40118","https://access.redhat.com/errata/RHSA-2026:41066","https://access.redhat.com/errata/RHSA-2026:41036","https://access.redhat.com/errata/RHSA-2026:41031","https://access.redhat.com/errata/RHSA-2026:41019","https://access.redhat.com/errata/RHSA-2026:40972","https://access.redhat.com/errata/RHSA-2026:40945","https://access.redhat.com/errata/RHSA-2026:42146","https://access.redhat.com/errata/RHSA-2026:42796","https://access.redhat.com/errata/RHSA-2026:43052","https://access.redhat.com/errata/RHSA-2026:43692","https://access.redhat.com/errata/RHSA-2026:49944","https://access.redhat.com/errata/RHSA-2026:52857","https://access.redhat.com/errata/RHSA-2026:52910"],"description":"golang.org/x/crypto doesn't drop invoking agent constraints when forwarding keys","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"exploitabilityScore":3.9,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-39832","epss":0.00683,"percentile":0.52549,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-39832","cwe":"CWE-502","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2026-39832","cwe":"CWE-281","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["0.52.0"],"state":"fixed","available":[{"version":"0.52.0","date":"2026-07-07","kind":"first-observed"}]},"advisories":[],"risk":0.6181150000000001},"relatedVulnerabilities":[{"id":"CVE-2026-39832","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-39832","namespace":"nvd:cpe","severity":"High","urls":["https://go.dev/cl/778640","https://go.dev/cl/778641","https://go.dev/issue/79435","https://groups.google.com/g/golang-announce/c/a082jnz-LvI","https://pkg.go.dev/vuln/GO-2026-5006","https://access.redhat.com/errata/RHSA-2026:35833","https://access.redhat.com/errata/RHSA-2026:36199","https://access.redhat.com/errata/RHSA-2026:36319","https://access.redhat.com/errata/RHSA-2026:36625","https://access.redhat.com/errata/RHSA-2026:36648","https://access.redhat.com/errata/RHSA-2026:36651","https://access.redhat.com/errata/RHSA-2026:36796","https://access.redhat.com/errata/RHSA-2026:36797","https://access.redhat.com/errata/RHSA-2026:37072","https://access.redhat.com/errata/RHSA-2026:37123","https://access.redhat.com/errata/RHSA-2026:37271","https://access.redhat.com/errata/RHSA-2026:37387","https://access.redhat.com/errata/RHSA-2026:37410","https://access.redhat.com/errata/RHSA-2026:40118","https://access.redhat.com/errata/RHSA-2026:40262","https://access.redhat.com/errata/RHSA-2026:40945","https://access.redhat.com/errata/RHSA-2026:40972","https://access.redhat.com/errata/RHSA-2026:41019","https://access.redhat.com/errata/RHSA-2026:41031","https://access.redhat.com/errata/RHSA-2026:41036","https://access.redhat.com/errata/RHSA-2026:41066","https://access.redhat.com/errata/RHSA-2026:42146","https://access.redhat.com/errata/RHSA-2026:42796","https://access.redhat.com/errata/RHSA-2026:43052","https://access.redhat.com/errata/RHSA-2026:43692","https://access.redhat.com/errata/RHSA-2026:49944","https://access.redhat.com/errata/RHSA-2026:52857","https://access.redhat.com/errata/RHSA-2026:52910","https://access.redhat.com/errata/RHSA-2026:57194","https://access.redhat.com/errata/RHSA-2026:59579","https://access.redhat.com/errata/RHSA-2026:61314","https://access.redhat.com/errata/RHSA-2026:66521","https://access.redhat.com/errata/RHSA-2026:67450","https://access.redhat.com/security/cve/CVE-2026-39832","https://bugzilla.redhat.com/show_bug.cgi?id=2480685","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39832.json"],"description":"When adding a key to a remote agent constraint extensions such as restrict-destination-v00@openssh.com were not serialized in the request. Destination restrictions were silently stripped when forwarding keys, allowing unrestricted use of the key on the remote host. The client now serializes all constraint extensions. Additionally, the in-memory keyring returned by NewKeyring() now rejects keys with unsupported constraint extensions instead of silently ignoring them.","cvss":[{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","metrics":{"baseScore":8.7,"exploitabilityScore":2.3,"impactScore":5.8},"vendorMetadata":{}},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"exploitabilityScore":3.9,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-39832","epss":0.00683,"percentile":0.52549,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-39832","cwe":"CWE-502","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2026-39832","cwe":"CWE-281","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"golang.org/x/crypto","version":"v0.48.0"}},"found":{"vulnerabilityID":"GHSA-f5wc-c3c7-36mc","versionConstraint":"<0.52.0 (go)"},"fix":{"suggestedVersion":"0.52.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/crypto@v0.48.0?package-id=764d3323ecdb54e3","name":"golang.org/x/crypto","version":"v0.48.0","type":"go-module","locations":[{"path":"/tool-imports/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:crypto:v0.48.0:*:*:*:*:go:*:*","cpe:2.3:a:go:ssh:v0.48.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/crypto@v0.48.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:/VRzVqiRSggnhY7gNRxPauEQ5Drw9haKdM0jqfcCFts="}}},{"vulnerability":{"id":"GHSA-vgwf-h737-ff37","dataSource":"https://github.com/advisories/GHSA-vgwf-h737-ff37","namespace":"github:language:go","severity":"Critical","urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-39830","https://go.dev/cl/781640","https://go.dev/cl/781664","https://go.dev/issue/79564","https://groups.google.com/g/golang-announce/c/a082jnz-LvI","https://pkg.go.dev/vuln/GO-2026-5017","https://access.redhat.com/errata/RHSA-2026:29455","https://access.redhat.com/security/cve/CVE-2026-39830","https://bugzilla.redhat.com/show_bug.cgi?id=2480684","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39830.json","https://access.redhat.com/errata/RHSA-2026:35833","https://access.redhat.com/errata/RHSA-2026:36199","https://access.redhat.com/errata/RHSA-2026:36207","https://access.redhat.com/errata/RHSA-2026:36319","https://access.redhat.com/errata/RHSA-2026:36625","https://access.redhat.com/errata/RHSA-2026:36648","https://access.redhat.com/errata/RHSA-2026:37271","https://access.redhat.com/errata/RHSA-2026:37268","https://access.redhat.com/errata/RHSA-2026:37072","https://access.redhat.com/errata/RHSA-2026:36808","https://access.redhat.com/errata/RHSA-2026:36797","https://access.redhat.com/errata/RHSA-2026:36796","https://access.redhat.com/errata/RHSA-2026:36651","https://access.redhat.com/errata/RHSA-2026:37387","https://access.redhat.com/errata/RHSA-2026:37296","https://access.redhat.com/errata/RHSA-2026:37286","https://access.redhat.com/errata/RHSA-2026:37278","https://access.redhat.com/errata/RHSA-2026:37275","https://access.redhat.com/errata/RHSA-2026:37272","https://access.redhat.com/errata/RHSA-2026:40118","https://access.redhat.com/errata/RHSA-2026:40262","https://access.redhat.com/errata/RHSA-2026:40969","https://access.redhat.com/errata/RHSA-2026:40974","https://access.redhat.com/errata/RHSA-2026:40945","https://access.redhat.com/errata/RHSA-2026:40972","https://access.redhat.com/errata/RHSA-2026:41019","https://access.redhat.com/errata/RHSA-2026:41031","https://access.redhat.com/errata/RHSA-2026:41036","https://access.redhat.com/errata/RHSA-2026:41066","https://access.redhat.com/errata/RHSA-2026:42146","https://access.redhat.com/errata/RHSA-2026:42796","https://access.redhat.com/errata/RHSA-2026:43052","https://access.redhat.com/errata/RHSA-2026:43692","https://access.redhat.com/errata/RHSA-2026:46885","https://access.redhat.com/errata/RHSA-2026:47735","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:49944","https://access.redhat.com/errata/RHSA-2026:51033","https://access.redhat.com/errata/RHSA-2026:52857","https://access.redhat.com/errata/RHSA-2026:52910","https://access.redhat.com/errata/RHSA-2026:54400","https://access.redhat.com/errata/RHSA-2026:54531","https://access.redhat.com/errata/RHSA-2026:57194","https://access.redhat.com/errata/RHSA-2026:57801","https://access.redhat.com/errata/RHSA-2026:59467","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/errata/RHSA-2026:61314","https://access.redhat.com/errata/RHSA-2026:65964","https://access.redhat.com/errata/RHSA-2026:66022","https://access.redhat.com/errata/RHSA-2026:66521","https://access.redhat.com/errata/RHSA-2026:67450"],"description":"golang.org/x/crypto: Invoking client can cause server deadlock on unexpected responses","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"exploitabilityScore":3.9,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-39830","epss":0.00683,"percentile":0.52545,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-39830","cwe":"CWE-119","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2026-39830","cwe":"CWE-772","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["0.52.0"],"state":"fixed","available":[{"version":"0.52.0","date":"2026-07-07","kind":"first-observed"}]},"advisories":[],"risk":0.6181150000000001},"relatedVulnerabilities":[{"id":"CVE-2026-39830","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-39830","namespace":"nvd:cpe","severity":"High","urls":["https://go.dev/cl/781640","https://go.dev/cl/781664","https://go.dev/issue/79564","https://groups.google.com/g/golang-announce/c/a082jnz-LvI","https://pkg.go.dev/vuln/GO-2026-5017","https://access.redhat.com/errata/RHSA-2026:29455","https://access.redhat.com/errata/RHSA-2026:35833","https://access.redhat.com/errata/RHSA-2026:36199","https://access.redhat.com/errata/RHSA-2026:36207","https://access.redhat.com/errata/RHSA-2026:36319","https://access.redhat.com/errata/RHSA-2026:36625","https://access.redhat.com/errata/RHSA-2026:36648","https://access.redhat.com/errata/RHSA-2026:36651","https://access.redhat.com/errata/RHSA-2026:36796","https://access.redhat.com/errata/RHSA-2026:36797","https://access.redhat.com/errata/RHSA-2026:36808","https://access.redhat.com/errata/RHSA-2026:37072","https://access.redhat.com/errata/RHSA-2026:37268","https://access.redhat.com/errata/RHSA-2026:37271","https://access.redhat.com/errata/RHSA-2026:37272","https://access.redhat.com/errata/RHSA-2026:37275","https://access.redhat.com/errata/RHSA-2026:37278","https://access.redhat.com/errata/RHSA-2026:37286","https://access.redhat.com/errata/RHSA-2026:37296","https://access.redhat.com/errata/RHSA-2026:37387","https://access.redhat.com/errata/RHSA-2026:40118","https://access.redhat.com/errata/RHSA-2026:40262","https://access.redhat.com/errata/RHSA-2026:40945","https://access.redhat.com/errata/RHSA-2026:40969","https://access.redhat.com/errata/RHSA-2026:40972","https://access.redhat.com/errata/RHSA-2026:40974","https://access.redhat.com/errata/RHSA-2026:41019","https://access.redhat.com/errata/RHSA-2026:41031","https://access.redhat.com/errata/RHSA-2026:41036","https://access.redhat.com/errata/RHSA-2026:41066","https://access.redhat.com/errata/RHSA-2026:42146","https://access.redhat.com/errata/RHSA-2026:42796","https://access.redhat.com/errata/RHSA-2026:43052","https://access.redhat.com/errata/RHSA-2026:43692","https://access.redhat.com/errata/RHSA-2026:46885","https://access.redhat.com/errata/RHSA-2026:47735","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:49944","https://access.redhat.com/errata/RHSA-2026:51033","https://access.redhat.com/errata/RHSA-2026:52857","https://access.redhat.com/errata/RHSA-2026:52910","https://access.redhat.com/errata/RHSA-2026:54400","https://access.redhat.com/errata/RHSA-2026:54531","https://access.redhat.com/errata/RHSA-2026:57194","https://access.redhat.com/errata/RHSA-2026:57801","https://access.redhat.com/errata/RHSA-2026:59467","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/errata/RHSA-2026:61314","https://access.redhat.com/errata/RHSA-2026:65964","https://access.redhat.com/errata/RHSA-2026:66022","https://access.redhat.com/errata/RHSA-2026:66521","https://access.redhat.com/errata/RHSA-2026:67450","https://access.redhat.com/security/cve/CVE-2026-39830","https://bugzilla.redhat.com/show_bug.cgi?id=2480684","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39830.json"],"description":"A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop. The blocked goroutine could not be released by calling Close(), resulting in a resource leak per connection. Unsolicited global responses are now discarded.","cvss":[{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"exploitabilityScore":3.9,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-39830","epss":0.00683,"percentile":0.52545,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-39830","cwe":"CWE-119","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2026-39830","cwe":"CWE-772","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"golang.org/x/crypto","version":"v0.46.0"}},"found":{"vulnerabilityID":"GHSA-vgwf-h737-ff37","versionConstraint":"<0.52.0 (go)"},"fix":{"suggestedVersion":"0.52.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/crypto@v0.46.0?package-id=b3387fbedc5d73be","name":"golang.org/x/crypto","version":"v0.46.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:crypto:v0.46.0:*:*:*:*:go:*:*","cpe:2.3:a:go:ssh:v0.46.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/crypto@v0.46.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:cKRW/pmt1pKAfetfu+RCEvjvZkA9RimPbh7bhFjGVBU="}}},{"vulnerability":{"id":"GHSA-vgwf-h737-ff37","dataSource":"https://github.com/advisories/GHSA-vgwf-h737-ff37","namespace":"github:language:go","severity":"Critical","urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-39830","https://go.dev/cl/781640","https://go.dev/cl/781664","https://go.dev/issue/79564","https://groups.google.com/g/golang-announce/c/a082jnz-LvI","https://pkg.go.dev/vuln/GO-2026-5017","https://access.redhat.com/errata/RHSA-2026:29455","https://access.redhat.com/security/cve/CVE-2026-39830","https://bugzilla.redhat.com/show_bug.cgi?id=2480684","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39830.json","https://access.redhat.com/errata/RHSA-2026:35833","https://access.redhat.com/errata/RHSA-2026:36199","https://access.redhat.com/errata/RHSA-2026:36207","https://access.redhat.com/errata/RHSA-2026:36319","https://access.redhat.com/errata/RHSA-2026:36625","https://access.redhat.com/errata/RHSA-2026:36648","https://access.redhat.com/errata/RHSA-2026:37271","https://access.redhat.com/errata/RHSA-2026:37268","https://access.redhat.com/errata/RHSA-2026:37072","https://access.redhat.com/errata/RHSA-2026:36808","https://access.redhat.com/errata/RHSA-2026:36797","https://access.redhat.com/errata/RHSA-2026:36796","https://access.redhat.com/errata/RHSA-2026:36651","https://access.redhat.com/errata/RHSA-2026:37387","https://access.redhat.com/errata/RHSA-2026:37296","https://access.redhat.com/errata/RHSA-2026:37286","https://access.redhat.com/errata/RHSA-2026:37278","https://access.redhat.com/errata/RHSA-2026:37275","https://access.redhat.com/errata/RHSA-2026:37272","https://access.redhat.com/errata/RHSA-2026:40118","https://access.redhat.com/errata/RHSA-2026:40262","https://access.redhat.com/errata/RHSA-2026:40969","https://access.redhat.com/errata/RHSA-2026:40974","https://access.redhat.com/errata/RHSA-2026:40945","https://access.redhat.com/errata/RHSA-2026:40972","https://access.redhat.com/errata/RHSA-2026:41019","https://access.redhat.com/errata/RHSA-2026:41031","https://access.redhat.com/errata/RHSA-2026:41036","https://access.redhat.com/errata/RHSA-2026:41066","https://access.redhat.com/errata/RHSA-2026:42146","https://access.redhat.com/errata/RHSA-2026:42796","https://access.redhat.com/errata/RHSA-2026:43052","https://access.redhat.com/errata/RHSA-2026:43692","https://access.redhat.com/errata/RHSA-2026:46885","https://access.redhat.com/errata/RHSA-2026:47735","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:49944","https://access.redhat.com/errata/RHSA-2026:51033","https://access.redhat.com/errata/RHSA-2026:52857","https://access.redhat.com/errata/RHSA-2026:52910","https://access.redhat.com/errata/RHSA-2026:54400","https://access.redhat.com/errata/RHSA-2026:54531","https://access.redhat.com/errata/RHSA-2026:57194","https://access.redhat.com/errata/RHSA-2026:57801","https://access.redhat.com/errata/RHSA-2026:59467","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/errata/RHSA-2026:61314","https://access.redhat.com/errata/RHSA-2026:65964","https://access.redhat.com/errata/RHSA-2026:66022","https://access.redhat.com/errata/RHSA-2026:66521","https://access.redhat.com/errata/RHSA-2026:67450"],"description":"golang.org/x/crypto: Invoking client can cause server deadlock on unexpected responses","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"exploitabilityScore":3.9,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-39830","epss":0.00683,"percentile":0.52545,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-39830","cwe":"CWE-119","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2026-39830","cwe":"CWE-772","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["0.52.0"],"state":"fixed","available":[{"version":"0.52.0","date":"2026-07-07","kind":"first-observed"}]},"advisories":[],"risk":0.6181150000000001},"relatedVulnerabilities":[{"id":"CVE-2026-39830","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-39830","namespace":"nvd:cpe","severity":"High","urls":["https://go.dev/cl/781640","https://go.dev/cl/781664","https://go.dev/issue/79564","https://groups.google.com/g/golang-announce/c/a082jnz-LvI","https://pkg.go.dev/vuln/GO-2026-5017","https://access.redhat.com/errata/RHSA-2026:29455","https://access.redhat.com/errata/RHSA-2026:35833","https://access.redhat.com/errata/RHSA-2026:36199","https://access.redhat.com/errata/RHSA-2026:36207","https://access.redhat.com/errata/RHSA-2026:36319","https://access.redhat.com/errata/RHSA-2026:36625","https://access.redhat.com/errata/RHSA-2026:36648","https://access.redhat.com/errata/RHSA-2026:36651","https://access.redhat.com/errata/RHSA-2026:36796","https://access.redhat.com/errata/RHSA-2026:36797","https://access.redhat.com/errata/RHSA-2026:36808","https://access.redhat.com/errata/RHSA-2026:37072","https://access.redhat.com/errata/RHSA-2026:37268","https://access.redhat.com/errata/RHSA-2026:37271","https://access.redhat.com/errata/RHSA-2026:37272","https://access.redhat.com/errata/RHSA-2026:37275","https://access.redhat.com/errata/RHSA-2026:37278","https://access.redhat.com/errata/RHSA-2026:37286","https://access.redhat.com/errata/RHSA-2026:37296","https://access.redhat.com/errata/RHSA-2026:37387","https://access.redhat.com/errata/RHSA-2026:40118","https://access.redhat.com/errata/RHSA-2026:40262","https://access.redhat.com/errata/RHSA-2026:40945","https://access.redhat.com/errata/RHSA-2026:40969","https://access.redhat.com/errata/RHSA-2026:40972","https://access.redhat.com/errata/RHSA-2026:40974","https://access.redhat.com/errata/RHSA-2026:41019","https://access.redhat.com/errata/RHSA-2026:41031","https://access.redhat.com/errata/RHSA-2026:41036","https://access.redhat.com/errata/RHSA-2026:41066","https://access.redhat.com/errata/RHSA-2026:42146","https://access.redhat.com/errata/RHSA-2026:42796","https://access.redhat.com/errata/RHSA-2026:43052","https://access.redhat.com/errata/RHSA-2026:43692","https://access.redhat.com/errata/RHSA-2026:46885","https://access.redhat.com/errata/RHSA-2026:47735","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:49944","https://access.redhat.com/errata/RHSA-2026:51033","https://access.redhat.com/errata/RHSA-2026:52857","https://access.redhat.com/errata/RHSA-2026:52910","https://access.redhat.com/errata/RHSA-2026:54400","https://access.redhat.com/errata/RHSA-2026:54531","https://access.redhat.com/errata/RHSA-2026:57194","https://access.redhat.com/errata/RHSA-2026:57801","https://access.redhat.com/errata/RHSA-2026:59467","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/errata/RHSA-2026:61314","https://access.redhat.com/errata/RHSA-2026:65964","https://access.redhat.com/errata/RHSA-2026:66022","https://access.redhat.com/errata/RHSA-2026:66521","https://access.redhat.com/errata/RHSA-2026:67450","https://access.redhat.com/security/cve/CVE-2026-39830","https://bugzilla.redhat.com/show_bug.cgi?id=2480684","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39830.json"],"description":"A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop. The blocked goroutine could not be released by calling Close(), resulting in a resource leak per connection. Unsolicited global responses are now discarded.","cvss":[{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"exploitabilityScore":3.9,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-39830","epss":0.00683,"percentile":0.52545,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-39830","cwe":"CWE-119","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2026-39830","cwe":"CWE-772","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"golang.org/x/crypto","version":"v0.48.0"}},"found":{"vulnerabilityID":"GHSA-vgwf-h737-ff37","versionConstraint":"<0.52.0 (go)"},"fix":{"suggestedVersion":"0.52.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/crypto@v0.48.0?package-id=764d3323ecdb54e3","name":"golang.org/x/crypto","version":"v0.48.0","type":"go-module","locations":[{"path":"/tool-imports/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:crypto:v0.48.0:*:*:*:*:go:*:*","cpe:2.3:a:go:ssh:v0.48.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/crypto@v0.48.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:/VRzVqiRSggnhY7gNRxPauEQ5Drw9haKdM0jqfcCFts="}}},{"vulnerability":{"id":"GHSA-mh2q-q3fh-2475","dataSource":"https://github.com/advisories/GHSA-mh2q-q3fh-2475","namespace":"github:language:go","severity":"High","urls":["https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-mh2q-q3fh-2475","https://github.com/open-telemetry/opentelemetry-go/pull/7880","https://github.com/open-telemetry/opentelemetry-go/commit/aa1894e09e3fe66860c7885cb40f98901b35277f","https://github.com/open-telemetry/opentelemetry-go/releases/tag/v1.41.0","https://nvd.nist.gov/vuln/detail/CVE-2026-29181"],"description":"OpenTelemetry-Go: multi-value `baggage` header extraction causes excessive allocations (remote dos amplification)","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-29181","epss":0.0079,"percentile":0.5628,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-29181","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-29181","cwe":"CWE-770","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["1.41.0"],"state":"fixed","available":[{"version":"1.41.0","date":"2026-04-25","kind":"first-observed"}]},"advisories":[],"risk":0.5925},"relatedVulnerabilities":[{"id":"CVE-2026-29181","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-29181","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-mh2q-q3fh-2475","https://access.redhat.com/errata/RHSA-2026:25271","https://access.redhat.com/errata/RHSA-2026:47735","https://access.redhat.com/errata/RHSA-2026:61314","https://access.redhat.com/errata/RHSA-2026:63140","https://access.redhat.com/errata/RHSA-2026:66521","https://access.redhat.com/security/cve/CVE-2026-29181","https://bugzilla.redhat.com/show_bug.cgi?id=2456252","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-29181.json"],"description":"OpenTelemetry-Go is the Go implementation of OpenTelemetry. From 1.36.0 to 1.40.0, multi-value baggage: header extraction parses each header field-value independently and aggregates members across values. This allows an attacker to amplify cpu and allocations by sending many baggage: header lines, even when each individual value is within the 8192-byte per-value parse limit. This vulnerability is fixed in 1.41.0.","cvss":[{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-29181","epss":0.0079,"percentile":0.5628,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-29181","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-29181","cwe":"CWE-770","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"go.opentelemetry.io/otel","version":"v1.40.0"}},"found":{"vulnerabilityID":"GHSA-mh2q-q3fh-2475","versionConstraint":">=1.36.0,<=1.40.0 (go)"},"fix":{"suggestedVersion":"1.41.0"}}],"artifact":{"id":"pkg:golang/go.opentelemetry.io/otel@v1.40.0?package-id=724bde702081e5a1","name":"go.opentelemetry.io/otel","version":"v1.40.0","type":"go-module","locations":[{"path":"/tool-imports/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:opentelemetry:opentelemetry:v1.40.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/go.opentelemetry.io/otel@v1.40.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:oA5YeOcpRTXq6NN7frwmwFR0Cn3RhTVZvXsP4duvCms="}}},{"vulnerability":{"id":"GHSA-6g7g-w4f8-9c9x","dataSource":"https://github.com/advisories/GHSA-6g7g-w4f8-9c9x","namespace":"github:language:go","severity":"High","urls":["https://github.com/buger/jsonparser/issues/275","https://github.com/golang/vulndb/issues/4514","https://github.com/buger/jsonparser/pull/276","https://github.com/buger/jsonparser/commit/a69e7e01cd4ad67bdfd3ac2c080b9212af16f4b0","https://github.com/buger/jsonparser/releases/tag/v1.1.2","https://nvd.nist.gov/vuln/detail/CVE-2026-32285","https://pkg.go.dev/vuln/GO-2026-4514","https://securityinfinity.com/research/buger-jsonparser-negative-slice-panic-dos-2026"],"description":"github.com/buger/jsonparser has a denial of service vulnerability","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-32285","epss":0.00779,"percentile":0.55919,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-32285","cwe":"CWE-129","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2026-32285","cwe":"CWE-1285","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["1.1.2"],"state":"fixed","available":[{"version":"1.1.2","date":"2026-03-20","kind":"first-observed"}]},"advisories":[],"risk":0.58425},"relatedVulnerabilities":[{"id":"CVE-2026-32285","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-32285","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/buger/jsonparser/issues/275","https://github.com/golang/vulndb/issues/4514","https://pkg.go.dev/vuln/GO-2026-4514","https://access.redhat.com/errata/RHSA-2026:13548","https://access.redhat.com/errata/RHSA-2026:17121","https://access.redhat.com/errata/RHSA-2026:17123","https://access.redhat.com/errata/RHSA-2026:19099","https://access.redhat.com/errata/RHSA-2026:21769","https://access.redhat.com/errata/RHSA-2026:22347","https://access.redhat.com/errata/RHSA-2026:22423","https://access.redhat.com/errata/RHSA-2026:23345","https://access.redhat.com/errata/RHSA-2026:34364","https://access.redhat.com/errata/RHSA-2026:35111","https://access.redhat.com/errata/RHSA-2026:36882","https://access.redhat.com/errata/RHSA-2026:61314","https://access.redhat.com/errata/RHSA-2026:7191","https://access.redhat.com/errata/RHSA-2026:9385","https://access.redhat.com/security/cve/CVE-2026-32285","https://bugzilla.redhat.com/show_bug.cgi?id=2451846","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32285.json","https://securityinfinity.com/research/buger-jsonparser-negative-slice-panic-dos-2026"],"description":"The Delete function fails to properly validate offsets when processing malformed JSON input. This can lead to a negative slice index and a runtime panic, allowing a denial of service attack.","cvss":[{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-32285","epss":0.00779,"percentile":0.55919,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-32285","cwe":"CWE-129","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2026-32285","cwe":"CWE-1285","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"github.com/buger/jsonparser","version":"v1.1.1"}},"found":{"vulnerabilityID":"GHSA-6g7g-w4f8-9c9x","versionConstraint":"<=1.1.1 (go)"},"fix":{"suggestedVersion":"1.1.2"}}],"artifact":{"id":"pkg:golang/github.com/buger/jsonparser@v1.1.1?package-id=8162275e17cf5781","name":"github.com/buger/jsonparser","version":"v1.1.1","type":"go-module","locations":[{"path":"/tool-imports/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:buger:jsonparser:v1.1.1:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/buger/jsonparser@v1.1.1","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:2PnMjfWD7wBILjqQbt530v576A/cAbQvEW9gGIpYMUs="}}},{"vulnerability":{"id":"GO-2026-6612","dataSource":"https://go.dev/cl/847187","namespace":"govulndb:language:go","severity":"Critical","urls":["https://go.dev/cl/847310","https://go.dev/issue/81743","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs"],"description":"The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"exploitabilityScore":3.9,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-78663","epss":0.00622,"percentile":0.49817,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-78663","cwe":"CWE-675","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["0.60.0"],"state":"fixed","available":[{"version":"0.60.0","date":"2026-10-08","kind":"release"}]},"advisories":[],"risk":0.56291},"relatedVulnerabilities":[{"id":"CVE-2026-78663","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78663","namespace":"nvd:cpe","severity":"Critical","urls":["https://go.dev/cl/847187","https://go.dev/cl/847310","https://go.dev/issue/81743","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs","https://pkg.go.dev/vuln/GO-2026-6612"],"description":"The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"exploitabilityScore":3.9,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-78663","epss":0.00622,"percentile":0.49817,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-78663","cwe":"CWE-675","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"golang.org/x/net","version":"v0.48.0"}},"found":{"vulnerabilityID":"GO-2026-6612","versionConstraint":"<0.60.0 (go)"},"fix":{"suggestedVersion":"0.60.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/net@v0.48.0?package-id=7e3c0e57ff3d79d8","name":"golang.org/x/net","version":"v0.48.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:networking:v0.48.0:*:*:*:*:go:*:*","cpe:2.3:a:golang:net:v0.48.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/net@v0.48.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:zyQRTTrjc33Lhh0fBgT/H3oZq9WuvRR5gPC70xpDiQU="}}},{"vulnerability":{"id":"GO-2026-6612","dataSource":"https://go.dev/cl/847187","namespace":"govulndb:language:go","severity":"Critical","urls":["https://go.dev/cl/847310","https://go.dev/issue/81743","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs"],"description":"The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"exploitabilityScore":3.9,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-78663","epss":0.00622,"percentile":0.49817,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-78663","cwe":"CWE-675","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["0.60.0"],"state":"fixed","available":[{"version":"0.60.0","date":"2026-10-08","kind":"release"}]},"advisories":[],"risk":0.56291},"relatedVulnerabilities":[{"id":"CVE-2026-78663","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78663","namespace":"nvd:cpe","severity":"Critical","urls":["https://go.dev/cl/847187","https://go.dev/cl/847310","https://go.dev/issue/81743","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs","https://pkg.go.dev/vuln/GO-2026-6612"],"description":"The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"exploitabilityScore":3.9,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-78663","epss":0.00622,"percentile":0.49817,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-78663","cwe":"CWE-675","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"golang.org/x/net","version":"v0.50.0"}},"found":{"vulnerabilityID":"GO-2026-6612","versionConstraint":"<0.60.0 (go)"},"fix":{"suggestedVersion":"0.60.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/net@v0.50.0?package-id=a205ae7dff8c80d8","name":"golang.org/x/net","version":"v0.50.0","type":"go-module","locations":[{"path":"/tool-imports/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:networking:v0.50.0:*:*:*:*:go:*:*","cpe:2.3:a:golang:net:v0.50.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/net@v0.50.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:ucWh9eiCGyDR3vtzso0WMQinm2Dnt8cFMuQa9K33J60="}}},{"vulnerability":{"id":"GHSA-m37j-52j7-pjw7","dataSource":"https://github.com/advisories/GHSA-m37j-52j7-pjw7","namespace":"github:language:go","severity":"High","urls":["https://github.com/oras-project/oras-go/security/advisories/GHSA-m37j-52j7-pjw7","https://nvd.nist.gov/vuln/detail/CVE-2026-85731","https://github.com/oras-project/oras-go/commit/adab2f25ea95ef4e6e41f50db9266a6701399422","https://github.com/oras-project/oras-go/releases/tag/v2.6.2"],"description":"oras-go: Arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction (pushDir)","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"exploitabilityScore":2.9,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-85731","epss":0.00676,"percentile":0.52252,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-85731","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-85731","cwe":"CWE-59","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["2.6.2"],"state":"fixed","available":[{"version":"2.6.2","date":"2026-09-18","kind":"first-observed"}]},"advisories":[],"risk":0.5509400000000001},"relatedVulnerabilities":[{"id":"CVE-2026-85731","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-85731","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/oras-project/oras-go/commit/adab2f25ea95ef4e6e41f50db9266a6701399422","https://github.com/oras-project/oras-go/releases/tag/v2.6.2","https://github.com/oras-project/oras-go/security/advisories/GHSA-m37j-52j7-pjw7"],"description":"oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, content/file.Store extraction of OCI layers marked with io.deis.oras.content.unpack=true can write outside the store working directory. The pushDir path through extractTarDirectory and ensureLinkPath validates symlink targets lexically, resolveRelToBase skips its parent-symlink walk for root-level entries, and writeFile follows a terminal symlink when opening a regular file. A malicious archive can therefore create a symlink chain whose lexical target remains inside the extraction root but whose resolved target is an attacker-selected absolute path, then overwrite that target with a same-named regular-file entry even when AllowPathTraversalOnWrite is false. Pulling an attacker-controlled artifact can create or overwrite any file writable by the process and may lead to code execution. This issue is fixed in version 2.6.2.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"exploitabilityScore":2.9,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-85731","epss":0.00676,"percentile":0.52252,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-85731","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-85731","cwe":"CWE-59","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"oras.land/oras-go/v2","version":"v2.6.0"}},"found":{"vulnerabilityID":"GHSA-m37j-52j7-pjw7","versionConstraint":"<=2.6.1 (go)"},"fix":{"suggestedVersion":"2.6.2"}}],"artifact":{"id":"pkg:golang/oras.land/oras-go/v2@v2.6.0?package-id=016c318c2b8258c2","name":"oras.land/oras-go/v2","version":"v2.6.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:linuxfoundation:oras:v2.6.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/oras.land/oras-go/v2@v2.6.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:X4ELRsiGkrbeox69+9tzTu492FMUu7zJQW6eJU+I2oc="}}},{"vulnerability":{"id":"GHSA-rm3j-f69w-wqmq","dataSource":"https://github.com/advisories/GHSA-rm3j-f69w-wqmq","namespace":"github:language:go","severity":"Critical","urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-39834","https://go.dev/cl/781663","https://go.dev/issue/79567","https://groups.google.com/g/golang-announce/c/a082jnz-LvI","https://pkg.go.dev/vuln/GO-2026-5020"],"description":"golang.org/x/crypto vulnerable to infinite loop on large channel writes","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"exploitabilityScore":3.9,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-39834","epss":0.00597,"percentile":0.48592,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-39834","cwe":"CWE-190","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["0.52.0"],"state":"fixed","available":[{"version":"0.52.0","date":"2026-07-07","kind":"first-observed"}]},"advisories":[],"risk":0.540285},"relatedVulnerabilities":[{"id":"CVE-2026-39834","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-39834","namespace":"nvd:cpe","severity":"Critical","urls":["https://go.dev/cl/781663","https://go.dev/issue/79567","https://groups.google.com/g/golang-announce/c/a082jnz-LvI","https://pkg.go.dev/vuln/GO-2026-5020"],"description":"When writing data larger than 4GB in a single Write call on an SSH channel, an integer overflow in the internal payload size calculation caused the write loop to spin indefinitely, sending empty packets without making progress. The size comparison now uses int64 to prevent truncation.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"exploitabilityScore":3.9,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-39834","epss":0.00597,"percentile":0.48592,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-39834","cwe":"CWE-190","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"golang.org/x/crypto","version":"v0.46.0"}},"found":{"vulnerabilityID":"GHSA-rm3j-f69w-wqmq","versionConstraint":"<0.52.0 (go)"},"fix":{"suggestedVersion":"0.52.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/crypto@v0.46.0?package-id=b3387fbedc5d73be","name":"golang.org/x/crypto","version":"v0.46.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:crypto:v0.46.0:*:*:*:*:go:*:*","cpe:2.3:a:go:ssh:v0.46.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/crypto@v0.46.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:cKRW/pmt1pKAfetfu+RCEvjvZkA9RimPbh7bhFjGVBU="}}},{"vulnerability":{"id":"GHSA-rm3j-f69w-wqmq","dataSource":"https://github.com/advisories/GHSA-rm3j-f69w-wqmq","namespace":"github:language:go","severity":"Critical","urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-39834","https://go.dev/cl/781663","https://go.dev/issue/79567","https://groups.google.com/g/golang-announce/c/a082jnz-LvI","https://pkg.go.dev/vuln/GO-2026-5020"],"description":"golang.org/x/crypto vulnerable to infinite loop on large channel writes","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"exploitabilityScore":3.9,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-39834","epss":0.00597,"percentile":0.48592,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-39834","cwe":"CWE-190","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["0.52.0"],"state":"fixed","available":[{"version":"0.52.0","date":"2026-07-07","kind":"first-observed"}]},"advisories":[],"risk":0.540285},"relatedVulnerabilities":[{"id":"CVE-2026-39834","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-39834","namespace":"nvd:cpe","severity":"Critical","urls":["https://go.dev/cl/781663","https://go.dev/issue/79567","https://groups.google.com/g/golang-announce/c/a082jnz-LvI","https://pkg.go.dev/vuln/GO-2026-5020"],"description":"When writing data larger than 4GB in a single Write call on an SSH channel, an integer overflow in the internal payload size calculation caused the write loop to spin indefinitely, sending empty packets without making progress. The size comparison now uses int64 to prevent truncation.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"exploitabilityScore":3.9,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-39834","epss":0.00597,"percentile":0.48592,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-39834","cwe":"CWE-190","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"golang.org/x/crypto","version":"v0.48.0"}},"found":{"vulnerabilityID":"GHSA-rm3j-f69w-wqmq","versionConstraint":"<0.52.0 (go)"},"fix":{"suggestedVersion":"0.52.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/crypto@v0.48.0?package-id=764d3323ecdb54e3","name":"golang.org/x/crypto","version":"v0.48.0","type":"go-module","locations":[{"path":"/tool-imports/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:crypto:v0.48.0:*:*:*:*:go:*:*","cpe:2.3:a:go:ssh:v0.48.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/crypto@v0.48.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:/VRzVqiRSggnhY7gNRxPauEQ5Drw9haKdM0jqfcCFts="}}},{"vulnerability":{"id":"GHSA-x527-x647-q7gg","dataSource":"https://github.com/advisories/GHSA-x527-x647-q7gg","namespace":"github:language:go","severity":"Critical","urls":["https://nvd.nist.gov/vuln/detail/CVE-2024-45337","https://nvd.nist.gov/vuln/detail/CVE-2026-46595","https://go.dev/cl/781642","https://go.dev/issue/79570","https://groups.google.com/g/golang-announce/c/a082jnz-LvI","https://pkg.go.dev/vuln/GO-2026-5023","https://access.redhat.com/errata/RHSA-2026:23262","https://access.redhat.com/errata/RHSA-2026:23264","https://access.redhat.com/errata/RHSA-2026:26546","https://access.redhat.com/errata/RHSA-2026:26547","https://access.redhat.com/errata/RHSA-2026:30650","https://access.redhat.com/errata/RHSA-2026:30651","https://access.redhat.com/security/cve/CVE-2026-46595","https://bugzilla.redhat.com/show_bug.cgi?id=2480689","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46595.json","https://access.redhat.com/errata/RHSA-2026:33531","https://access.redhat.com/errata/RHSA-2026:33524","https://access.redhat.com/errata/RHSA-2026:36648","https://access.redhat.com/errata/RHSA-2026:36207","https://access.redhat.com/errata/RHSA-2026:36820","https://access.redhat.com/errata/RHSA-2026:36808","https://access.redhat.com/errata/RHSA-2026:36797","https://access.redhat.com/errata/RHSA-2026:36796","https://access.redhat.com/errata/RHSA-2026:36651","https://access.redhat.com/errata/RHSA-2026:37387","https://access.redhat.com/errata/RHSA-2026:37275","https://access.redhat.com/errata/RHSA-2026:40118","https://access.redhat.com/errata/RHSA-2026:41036","https://access.redhat.com/errata/RHSA-2026:41019","https://access.redhat.com/errata/RHSA-2026:40945"],"description":"golang.org/x/crypto: Invoking VerifiedPublicKeyCallback permissions skip enforcement","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L","metrics":{"baseScore":10,"exploitabilityScore":3.9,"impactScore":6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-46595","epss":0.00556,"percentile":0.46417,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-46595","cwe":"CWE-863","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"},{"cve":"CVE-2026-46595","cwe":"CWE-303","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["0.52.0"],"state":"fixed","available":[{"version":"0.52.0","date":"2026-07-07","kind":"first-observed"}]},"advisories":[],"risk":0.5281999999999999},"relatedVulnerabilities":[{"id":"CVE-2026-46595","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-46595","namespace":"nvd:cpe","severity":"High","urls":["https://go.dev/cl/781642","https://go.dev/issue/79570","https://groups.google.com/g/golang-announce/c/a082jnz-LvI","https://pkg.go.dev/vuln/GO-2026-5023","https://access.redhat.com/errata/RHSA-2026:23262","https://access.redhat.com/errata/RHSA-2026:23264","https://access.redhat.com/errata/RHSA-2026:26546","https://access.redhat.com/errata/RHSA-2026:26547","https://access.redhat.com/errata/RHSA-2026:30650","https://access.redhat.com/errata/RHSA-2026:30651","https://access.redhat.com/errata/RHSA-2026:33524","https://access.redhat.com/errata/RHSA-2026:33531","https://access.redhat.com/errata/RHSA-2026:36207","https://access.redhat.com/errata/RHSA-2026:36648","https://access.redhat.com/errata/RHSA-2026:36651","https://access.redhat.com/errata/RHSA-2026:36796","https://access.redhat.com/errata/RHSA-2026:36797","https://access.redhat.com/errata/RHSA-2026:36808","https://access.redhat.com/errata/RHSA-2026:36820","https://access.redhat.com/errata/RHSA-2026:37275","https://access.redhat.com/errata/RHSA-2026:37387","https://access.redhat.com/errata/RHSA-2026:40118","https://access.redhat.com/errata/RHSA-2026:40945","https://access.redhat.com/errata/RHSA-2026:41019","https://access.redhat.com/errata/RHSA-2026:41036","https://access.redhat.com/errata/RHSA-2026:42796","https://access.redhat.com/errata/RHSA-2026:43692","https://access.redhat.com/errata/RHSA-2026:47737","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:51033","https://access.redhat.com/errata/RHSA-2026:54531","https://access.redhat.com/errata/RHSA-2026:59467","https://access.redhat.com/errata/RHSA-2026:59558","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/errata/RHSA-2026:61314","https://access.redhat.com/errata/RHSA-2026:66022","https://access.redhat.com/errata/RHSA-2026:66521","https://access.redhat.com/security/cve/CVE-2026-46595","https://bugzilla.redhat.com/show_bug.cgi?id=2480689","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46595.json"],"description":"Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation would be skipped.","cvss":[{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L","metrics":{"baseScore":7.1,"exploitabilityScore":1.7,"impactScore":5.5},"vendorMetadata":{}},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L","metrics":{"baseScore":10,"exploitabilityScore":3.9,"impactScore":6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-46595","epss":0.00556,"percentile":0.46417,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-46595","cwe":"CWE-863","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"},{"cve":"CVE-2026-46595","cwe":"CWE-303","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"golang.org/x/crypto","version":"v0.46.0"}},"found":{"vulnerabilityID":"GHSA-x527-x647-q7gg","versionConstraint":"<0.52.0 (go)"},"fix":{"suggestedVersion":"0.52.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/crypto@v0.46.0?package-id=b3387fbedc5d73be","name":"golang.org/x/crypto","version":"v0.46.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:crypto:v0.46.0:*:*:*:*:go:*:*","cpe:2.3:a:go:ssh:v0.46.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/crypto@v0.46.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:cKRW/pmt1pKAfetfu+RCEvjvZkA9RimPbh7bhFjGVBU="}}},{"vulnerability":{"id":"GHSA-x527-x647-q7gg","dataSource":"https://github.com/advisories/GHSA-x527-x647-q7gg","namespace":"github:language:go","severity":"Critical","urls":["https://nvd.nist.gov/vuln/detail/CVE-2024-45337","https://nvd.nist.gov/vuln/detail/CVE-2026-46595","https://go.dev/cl/781642","https://go.dev/issue/79570","https://groups.google.com/g/golang-announce/c/a082jnz-LvI","https://pkg.go.dev/vuln/GO-2026-5023","https://access.redhat.com/errata/RHSA-2026:23262","https://access.redhat.com/errata/RHSA-2026:23264","https://access.redhat.com/errata/RHSA-2026:26546","https://access.redhat.com/errata/RHSA-2026:26547","https://access.redhat.com/errata/RHSA-2026:30650","https://access.redhat.com/errata/RHSA-2026:30651","https://access.redhat.com/security/cve/CVE-2026-46595","https://bugzilla.redhat.com/show_bug.cgi?id=2480689","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46595.json","https://access.redhat.com/errata/RHSA-2026:33531","https://access.redhat.com/errata/RHSA-2026:33524","https://access.redhat.com/errata/RHSA-2026:36648","https://access.redhat.com/errata/RHSA-2026:36207","https://access.redhat.com/errata/RHSA-2026:36820","https://access.redhat.com/errata/RHSA-2026:36808","https://access.redhat.com/errata/RHSA-2026:36797","https://access.redhat.com/errata/RHSA-2026:36796","https://access.redhat.com/errata/RHSA-2026:36651","https://access.redhat.com/errata/RHSA-2026:37387","https://access.redhat.com/errata/RHSA-2026:37275","https://access.redhat.com/errata/RHSA-2026:40118","https://access.redhat.com/errata/RHSA-2026:41036","https://access.redhat.com/errata/RHSA-2026:41019","https://access.redhat.com/errata/RHSA-2026:40945"],"description":"golang.org/x/crypto: Invoking VerifiedPublicKeyCallback permissions skip enforcement","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L","metrics":{"baseScore":10,"exploitabilityScore":3.9,"impactScore":6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-46595","epss":0.00556,"percentile":0.46417,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-46595","cwe":"CWE-863","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"},{"cve":"CVE-2026-46595","cwe":"CWE-303","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["0.52.0"],"state":"fixed","available":[{"version":"0.52.0","date":"2026-07-07","kind":"first-observed"}]},"advisories":[],"risk":0.5281999999999999},"relatedVulnerabilities":[{"id":"CVE-2026-46595","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-46595","namespace":"nvd:cpe","severity":"High","urls":["https://go.dev/cl/781642","https://go.dev/issue/79570","https://groups.google.com/g/golang-announce/c/a082jnz-LvI","https://pkg.go.dev/vuln/GO-2026-5023","https://access.redhat.com/errata/RHSA-2026:23262","https://access.redhat.com/errata/RHSA-2026:23264","https://access.redhat.com/errata/RHSA-2026:26546","https://access.redhat.com/errata/RHSA-2026:26547","https://access.redhat.com/errata/RHSA-2026:30650","https://access.redhat.com/errata/RHSA-2026:30651","https://access.redhat.com/errata/RHSA-2026:33524","https://access.redhat.com/errata/RHSA-2026:33531","https://access.redhat.com/errata/RHSA-2026:36207","https://access.redhat.com/errata/RHSA-2026:36648","https://access.redhat.com/errata/RHSA-2026:36651","https://access.redhat.com/errata/RHSA-2026:36796","https://access.redhat.com/errata/RHSA-2026:36797","https://access.redhat.com/errata/RHSA-2026:36808","https://access.redhat.com/errata/RHSA-2026:36820","https://access.redhat.com/errata/RHSA-2026:37275","https://access.redhat.com/errata/RHSA-2026:37387","https://access.redhat.com/errata/RHSA-2026:40118","https://access.redhat.com/errata/RHSA-2026:40945","https://access.redhat.com/errata/RHSA-2026:41019","https://access.redhat.com/errata/RHSA-2026:41036","https://access.redhat.com/errata/RHSA-2026:42796","https://access.redhat.com/errata/RHSA-2026:43692","https://access.redhat.com/errata/RHSA-2026:47737","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:51033","https://access.redhat.com/errata/RHSA-2026:54531","https://access.redhat.com/errata/RHSA-2026:59467","https://access.redhat.com/errata/RHSA-2026:59558","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/errata/RHSA-2026:61314","https://access.redhat.com/errata/RHSA-2026:66022","https://access.redhat.com/errata/RHSA-2026:66521","https://access.redhat.com/security/cve/CVE-2026-46595","https://bugzilla.redhat.com/show_bug.cgi?id=2480689","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46595.json"],"description":"Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation would be skipped.","cvss":[{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L","metrics":{"baseScore":7.1,"exploitabilityScore":1.7,"impactScore":5.5},"vendorMetadata":{}},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L","metrics":{"baseScore":10,"exploitabilityScore":3.9,"impactScore":6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-46595","epss":0.00556,"percentile":0.46417,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-46595","cwe":"CWE-863","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"},{"cve":"CVE-2026-46595","cwe":"CWE-303","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"golang.org/x/crypto","version":"v0.48.0"}},"found":{"vulnerabilityID":"GHSA-x527-x647-q7gg","versionConstraint":"<0.52.0 (go)"},"fix":{"suggestedVersion":"0.52.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/crypto@v0.48.0?package-id=764d3323ecdb54e3","name":"golang.org/x/crypto","version":"v0.48.0","type":"go-module","locations":[{"path":"/tool-imports/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:crypto:v0.48.0:*:*:*:*:go:*:*","cpe:2.3:a:go:ssh:v0.48.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/crypto@v0.48.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:/VRzVqiRSggnhY7gNRxPauEQ5Drw9haKdM0jqfcCFts="}}},{"vulnerability":{"id":"GHSA-2v4p-qf9q-27wj","dataSource":"https://github.com/advisories/GHSA-2v4p-qf9q-27wj","namespace":"github:language:go","severity":"High","urls":["https://github.com/grpc/grpc-go/security/advisories/GHSA-2v4p-qf9q-27wj","https://github.com/grpc/grpc-go/issues/9354","https://github.com/grpc/grpc-go/pull/9365","https://github.com/grpc/grpc-go/pull/9366","https://github.com/grpc/grpc-go/pull/9367","https://github.com/grpc/grpc-go/commit/3822494d8ea03b992c089fd2a195f041762fffb7","https://github.com/grpc/grpc-go/commit/8668b69c167df908b6b3666dcbf40992b9e932a4","https://github.com/grpc/grpc-go/commit/93e31b48545e2a8aaeb6e06b47fb249f94e6297f","https://github.com/grpc/grpc-go/releases/tag/v1.82.2","https://github.com/grpc/grpc-go/releases/tag/v1.83.2","https://nvd.nist.gov/vuln/detail/CVE-2026-84445"],"description":"gRPC-Go xDS servers: Denial of Service (DoS) via crash due to missing `:authority` and `Host` headers","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-84445","epss":0.00641,"percentile":0.50726,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-84445","cwe":"CWE-129","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-84445","cwe":"CWE-248","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["1.82.2"],"state":"fixed","available":[{"version":"1.82.2","date":"2026-09-09","kind":"first-observed"}]},"advisories":[],"risk":0.51921},"relatedVulnerabilities":[{"id":"CVE-2026-84445","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84445","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/grpc/grpc-go/commit/3822494d8ea03b992c089fd2a195f041762fffb7","https://github.com/grpc/grpc-go/commit/8668b69c167df908b6b3666dcbf40992b9e932a4","https://github.com/grpc/grpc-go/commit/93e31b48545e2a8aaeb6e06b47fb249f94e6297f","https://github.com/grpc/grpc-go/issues/9354","https://github.com/grpc/grpc-go/pull/9365","https://github.com/grpc/grpc-go/pull/9366","https://github.com/grpc/grpc-go/pull/9367","https://github.com/grpc/grpc-go/releases/tag/v1.82.2","https://github.com/grpc/grpc-go/releases/tag/v1.83.2","https://github.com/grpc/grpc-go/security/advisories/GHSA-2v4p-qf9q-27wj"],"description":"gRPC-Go is the Go language implementation of gRPC. Prior to 1.82.2 and 1.83.2, servers created with xds.NewGRPCServer() allow internal/transport/http2_server.go to accept an RPC containing neither the :authority header nor the Host header, while RouteAndProcess in internal/xds/server/routing.go assumes that an authority value exists and indexes the empty slice. A remote client that can complete transport connection establishment can trigger an index-out-of-bounds panic that is not recovered by the per-RPC goroutine and terminates the entire server process. In insecure or ordinary TLS deployments the request can be unauthenticated, while strict mTLS or ALTS deployments require valid transport credentials before the malformed RPC can reach the interceptor. This issue is fixed in versions 1.82.2 and 1.83.2.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-84445","epss":0.00641,"percentile":0.50726,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-84445","cwe":"CWE-129","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-84445","cwe":"CWE-248","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"google.golang.org/grpc","version":"v1.75.1"}},"found":{"vulnerabilityID":"GHSA-2v4p-qf9q-27wj","versionConstraint":"<1.82.2 (go)"},"fix":{"suggestedVersion":"1.82.2"}}],"artifact":{"id":"pkg:golang/google.golang.org/grpc@v1.75.1?package-id=fe766a98fd2603ca","name":"google.golang.org/grpc","version":"v1.75.1","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:google:grpc:v1.75.1:*:*:*:*:*:*:*"],"purl":"pkg:golang/google.golang.org/grpc@v1.75.1","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:/ODCNEuf9VghjgO3rqLcfg8fiOP0nSluljWFlDxELLI="}}},{"vulnerability":{"id":"GHSA-2v4p-qf9q-27wj","dataSource":"https://github.com/advisories/GHSA-2v4p-qf9q-27wj","namespace":"github:language:go","severity":"High","urls":["https://github.com/grpc/grpc-go/security/advisories/GHSA-2v4p-qf9q-27wj","https://github.com/grpc/grpc-go/issues/9354","https://github.com/grpc/grpc-go/pull/9365","https://github.com/grpc/grpc-go/pull/9366","https://github.com/grpc/grpc-go/pull/9367","https://github.com/grpc/grpc-go/commit/3822494d8ea03b992c089fd2a195f041762fffb7","https://github.com/grpc/grpc-go/commit/8668b69c167df908b6b3666dcbf40992b9e932a4","https://github.com/grpc/grpc-go/commit/93e31b48545e2a8aaeb6e06b47fb249f94e6297f","https://github.com/grpc/grpc-go/releases/tag/v1.82.2","https://github.com/grpc/grpc-go/releases/tag/v1.83.2","https://nvd.nist.gov/vuln/detail/CVE-2026-84445"],"description":"gRPC-Go xDS servers: Denial of Service (DoS) via crash due to missing `:authority` and `Host` headers","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-84445","epss":0.00641,"percentile":0.50726,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-84445","cwe":"CWE-129","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-84445","cwe":"CWE-248","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["1.82.2"],"state":"fixed","available":[{"version":"1.82.2","date":"2026-09-09","kind":"first-observed"}]},"advisories":[],"risk":0.51921},"relatedVulnerabilities":[{"id":"CVE-2026-84445","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84445","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/grpc/grpc-go/commit/3822494d8ea03b992c089fd2a195f041762fffb7","https://github.com/grpc/grpc-go/commit/8668b69c167df908b6b3666dcbf40992b9e932a4","https://github.com/grpc/grpc-go/commit/93e31b48545e2a8aaeb6e06b47fb249f94e6297f","https://github.com/grpc/grpc-go/issues/9354","https://github.com/grpc/grpc-go/pull/9365","https://github.com/grpc/grpc-go/pull/9366","https://github.com/grpc/grpc-go/pull/9367","https://github.com/grpc/grpc-go/releases/tag/v1.82.2","https://github.com/grpc/grpc-go/releases/tag/v1.83.2","https://github.com/grpc/grpc-go/security/advisories/GHSA-2v4p-qf9q-27wj"],"description":"gRPC-Go is the Go language implementation of gRPC. Prior to 1.82.2 and 1.83.2, servers created with xds.NewGRPCServer() allow internal/transport/http2_server.go to accept an RPC containing neither the :authority header nor the Host header, while RouteAndProcess in internal/xds/server/routing.go assumes that an authority value exists and indexes the empty slice. A remote client that can complete transport connection establishment can trigger an index-out-of-bounds panic that is not recovered by the per-RPC goroutine and terminates the entire server process. In insecure or ordinary TLS deployments the request can be unauthenticated, while strict mTLS or ALTS deployments require valid transport credentials before the malformed RPC can reach the interceptor. This issue is fixed in versions 1.82.2 and 1.83.2.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-84445","epss":0.00641,"percentile":0.50726,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-84445","cwe":"CWE-129","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-84445","cwe":"CWE-248","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"google.golang.org/grpc","version":"v1.78.0"}},"found":{"vulnerabilityID":"GHSA-2v4p-qf9q-27wj","versionConstraint":"<1.82.2 (go)"},"fix":{"suggestedVersion":"1.82.2"}}],"artifact":{"id":"pkg:golang/google.golang.org/grpc@v1.78.0?package-id=c776a416fb4b5ef1","name":"google.golang.org/grpc","version":"v1.78.0","type":"go-module","locations":[{"path":"/tool-imports/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:google:grpc:v1.78.0:*:*:*:*:*:*:*"],"purl":"pkg:golang/google.golang.org/grpc@v1.78.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:K1XZG/yGDJnzMdd/uZHAkVqJE+xIDOcmdSFZkBUicNc="}}},{"vulnerability":{"id":"GHSA-vp52-pcj8-j9qc","dataSource":"https://github.com/advisories/GHSA-vp52-pcj8-j9qc","namespace":"github:language:go","severity":"High","urls":["https://github.com/grpc/grpc-go/security/advisories/GHSA-vp52-pcj8-j9qc","https://nvd.nist.gov/vuln/detail/CVE-2026-84304","https://github.com/grpc/grpc-go/pull/9331","https://github.com/grpc/grpc-go/pull/9333","https://github.com/grpc/grpc-go/commit/7354d9c8debb4bcf2225bf429857078de310c176","https://github.com/grpc/grpc-go/commit/8cfeca0e1ee5ea0980dcc320e20240fa1079ec77","https://github.com/grpc/grpc-go/releases/tag/v1.83.1"],"description":"gRPC-Go: Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-84304","epss":0.00609,"percentile":0.49155,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-84304","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.83.1"],"state":"fixed","available":[{"version":"1.83.1","date":"2026-09-02","kind":"first-observed"}]},"advisories":[],"risk":0.49328999999999995},"relatedVulnerabilities":[{"id":"CVE-2026-84304","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84304","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/grpc/grpc-go/commit/7354d9c8debb4bcf2225bf429857078de310c176","https://github.com/grpc/grpc-go/commit/8cfeca0e1ee5ea0980dcc320e20240fa1079ec77","https://github.com/grpc/grpc-go/pull/9331","https://github.com/grpc/grpc-go/pull/9333","https://github.com/grpc/grpc-go/releases/tag/v1.83.1","https://github.com/grpc/grpc-go/security/advisories/GHSA-vp52-pcj8-j9qc"],"description":"gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, internal/transport/transport.go stores each fragmented HTTP/2 DATA frame as a separate recvMsg in recvBuffer, so millions of one-byte frames can consume disproportionate heap memory even when payload bytes remain within connection and stream flow-control windows. An unauthenticated remote attacker can use concurrent multiplexed streams to exhaust process memory and cause a runtime panic or out-of-memory termination. Receive-buffer compaction is enabled by default and can be controlled temporarily with GRPC_GO_EXPERIMENTAL_ENABLE_RECEIVE_BUFFER_COMPACTION. This issue is fixed in version 1.83.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-84304","epss":0.00609,"percentile":0.49155,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-84304","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"google.golang.org/grpc","version":"v1.75.1"}},"found":{"vulnerabilityID":"GHSA-vp52-pcj8-j9qc","versionConstraint":"<=1.83.0 (go)"},"fix":{"suggestedVersion":"1.83.1"}}],"artifact":{"id":"pkg:golang/google.golang.org/grpc@v1.75.1?package-id=fe766a98fd2603ca","name":"google.golang.org/grpc","version":"v1.75.1","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:google:grpc:v1.75.1:*:*:*:*:*:*:*"],"purl":"pkg:golang/google.golang.org/grpc@v1.75.1","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:/ODCNEuf9VghjgO3rqLcfg8fiOP0nSluljWFlDxELLI="}}},{"vulnerability":{"id":"GHSA-vp52-pcj8-j9qc","dataSource":"https://github.com/advisories/GHSA-vp52-pcj8-j9qc","namespace":"github:language:go","severity":"High","urls":["https://github.com/grpc/grpc-go/security/advisories/GHSA-vp52-pcj8-j9qc","https://nvd.nist.gov/vuln/detail/CVE-2026-84304","https://github.com/grpc/grpc-go/pull/9331","https://github.com/grpc/grpc-go/pull/9333","https://github.com/grpc/grpc-go/commit/7354d9c8debb4bcf2225bf429857078de310c176","https://github.com/grpc/grpc-go/commit/8cfeca0e1ee5ea0980dcc320e20240fa1079ec77","https://github.com/grpc/grpc-go/releases/tag/v1.83.1"],"description":"gRPC-Go: Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-84304","epss":0.00609,"percentile":0.49155,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-84304","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.83.1"],"state":"fixed","available":[{"version":"1.83.1","date":"2026-09-02","kind":"first-observed"}]},"advisories":[],"risk":0.49328999999999995},"relatedVulnerabilities":[{"id":"CVE-2026-84304","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84304","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/grpc/grpc-go/commit/7354d9c8debb4bcf2225bf429857078de310c176","https://github.com/grpc/grpc-go/commit/8cfeca0e1ee5ea0980dcc320e20240fa1079ec77","https://github.com/grpc/grpc-go/pull/9331","https://github.com/grpc/grpc-go/pull/9333","https://github.com/grpc/grpc-go/releases/tag/v1.83.1","https://github.com/grpc/grpc-go/security/advisories/GHSA-vp52-pcj8-j9qc"],"description":"gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, internal/transport/transport.go stores each fragmented HTTP/2 DATA frame as a separate recvMsg in recvBuffer, so millions of one-byte frames can consume disproportionate heap memory even when payload bytes remain within connection and stream flow-control windows. An unauthenticated remote attacker can use concurrent multiplexed streams to exhaust process memory and cause a runtime panic or out-of-memory termination. Receive-buffer compaction is enabled by default and can be controlled temporarily with GRPC_GO_EXPERIMENTAL_ENABLE_RECEIVE_BUFFER_COMPACTION. This issue is fixed in version 1.83.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-84304","epss":0.00609,"percentile":0.49155,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-84304","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"google.golang.org/grpc","version":"v1.78.0"}},"found":{"vulnerabilityID":"GHSA-vp52-pcj8-j9qc","versionConstraint":"<=1.83.0 (go)"},"fix":{"suggestedVersion":"1.83.1"}}],"artifact":{"id":"pkg:golang/google.golang.org/grpc@v1.78.0?package-id=c776a416fb4b5ef1","name":"google.golang.org/grpc","version":"v1.78.0","type":"go-module","locations":[{"path":"/tool-imports/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:google:grpc:v1.78.0:*:*:*:*:*:*:*"],"purl":"pkg:golang/google.golang.org/grpc@v1.78.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:K1XZG/yGDJnzMdd/uZHAkVqJE+xIDOcmdSFZkBUicNc="}}},{"vulnerability":{"id":"GHSA-78h2-9frx-2jm8","dataSource":"https://github.com/advisories/GHSA-78h2-9frx-2jm8","namespace":"github:language:go","severity":"High","urls":["https://github.com/go-jose/go-jose/security/advisories/GHSA-78h2-9frx-2jm8","https://pkg.go.dev/github.com/go-jose/go-jose/v4#pkg-constants","https://nvd.nist.gov/vuln/detail/CVE-2026-34986"],"description":"Go JOSE Panics in JWE decryption","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-34986","epss":0.00651,"percentile":0.51215,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-34986","cwe":"CWE-248","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-34986","cwe":"CWE-131","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["4.1.4"],"state":"fixed","available":[{"version":"4.1.4","date":"2026-04-03","kind":"first-observed"}]},"advisories":[],"risk":0.48824999999999996},"relatedVulnerabilities":[{"id":"CVE-2026-34986","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-34986","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/go-jose/go-jose/security/advisories/GHSA-78h2-9frx-2jm8","https://pkg.go.dev/github.com/go-jose/go-jose/v4#pkg-constants","https://access.redhat.com/errata/RHSA-2026:10125","https://access.redhat.com/errata/RHSA-2026:10130","https://access.redhat.com/errata/RHSA-2026:10135","https://access.redhat.com/errata/RHSA-2026:10175","https://access.redhat.com/errata/RHSA-2026:11070","https://access.redhat.com/errata/RHSA-2026:11217","https://access.redhat.com/errata/RHSA-2026:11512","https://access.redhat.com/errata/RHSA-2026:11688","https://access.redhat.com/errata/RHSA-2026:11856","https://access.redhat.com/errata/RHSA-2026:11916","https://access.redhat.com/errata/RHSA-2026:11996","https://access.redhat.com/errata/RHSA-2026:12116","https://access.redhat.com/errata/RHSA-2026:12277","https://access.redhat.com/errata/RHSA-2026:12279","https://access.redhat.com/errata/RHSA-2026:13791","https://access.redhat.com/errata/RHSA-2026:13829","https://access.redhat.com/errata/RHSA-2026:16696","https://access.redhat.com/errata/RHSA-2026:17040","https://access.redhat.com/errata/RHSA-2026:17121","https://access.redhat.com/errata/RHSA-2026:17123","https://access.redhat.com/errata/RHSA-2026:17287","https://access.redhat.com/errata/RHSA-2026:17448","https://access.redhat.com/errata/RHSA-2026:17458","https://access.redhat.com/errata/RHSA-2026:17459","https://access.redhat.com/errata/RHSA-2026:17468","https://access.redhat.com/errata/RHSA-2026:17474","https://access.redhat.com/errata/RHSA-2026:17547","https://access.redhat.com/errata/RHSA-2026:17550","https://access.redhat.com/errata/RHSA-2026:17598","https://access.redhat.com/errata/RHSA-2026:17789","https://access.redhat.com/errata/RHSA-2026:18584","https://access.redhat.com/errata/RHSA-2026:18585","https://access.redhat.com/errata/RHSA-2026:19017","https://access.redhat.com/errata/RHSA-2026:19099","https://access.redhat.com/errata/RHSA-2026:19108","https://access.redhat.com/errata/RHSA-2026:19135","https://access.redhat.com/errata/RHSA-2026:19173","https://access.redhat.com/errata/RHSA-2026:19186","https://access.redhat.com/errata/RHSA-2026:19353","https://access.redhat.com/errata/RHSA-2026:19375","https://access.redhat.com/errata/RHSA-2026:19712","https://access.redhat.com/errata/RHSA-2026:19719","https://access.redhat.com/errata/RHSA-2026:19720","https://access.redhat.com/errata/RHSA-2026:19721","https://access.redhat.com/errata/RHSA-2026:20034","https://access.redhat.com/errata/RHSA-2026:20041","https://access.redhat.com/errata/RHSA-2026:20569","https://access.redhat.com/errata/RHSA-2026:20607","https://access.redhat.com/errata/RHSA-2026:20609","https://access.redhat.com/errata/RHSA-2026:20946","https://access.redhat.com/errata/RHSA-2026:21017","https://access.redhat.com/errata/RHSA-2026:21703","https://access.redhat.com/errata/RHSA-2026:21709","https://access.redhat.com/errata/RHSA-2026:21769","https://access.redhat.com/errata/RHSA-2026:21931","https://access.redhat.com/errata/RHSA-2026:21932","https://access.redhat.com/errata/RHSA-2026:22258","https://access.redhat.com/errata/RHSA-2026:22260","https://access.redhat.com/errata/RHSA-2026:22347","https://access.redhat.com/errata/RHSA-2026:22423","https://access.redhat.com/errata/RHSA-2026:22450","https://access.redhat.com/errata/RHSA-2026:22465","https://access.redhat.com/errata/RHSA-2026:22629","https://access.redhat.com/errata/RHSA-2026:22714","https://access.redhat.com/errata/RHSA-2026:22840","https://access.redhat.com/errata/RHSA-2026:22937","https://access.redhat.com/errata/RHSA-2026:23228","https://access.redhat.com/errata/RHSA-2026:23241","https://access.redhat.com/errata/RHSA-2026:23345","https://access.redhat.com/errata/RHSA-2026:23361","https://access.redhat.com/errata/RHSA-2026:24471","https://access.redhat.com/errata/RHSA-2026:24475","https://access.redhat.com/errata/RHSA-2026:24477","https://access.redhat.com/errata/RHSA-2026:24479","https://access.redhat.com/errata/RHSA-2026:24482","https://access.redhat.com/errata/RHSA-2026:24484","https://access.redhat.com/errata/RHSA-2026:24853","https://access.redhat.com/errata/RHSA-2026:24977","https://access.redhat.com/errata/RHSA-2026:25127","https://access.redhat.com/errata/RHSA-2026:25187","https://access.redhat.com/errata/RHSA-2026:25194","https://access.redhat.com/errata/RHSA-2026:25206","https://access.redhat.com/errata/RHSA-2026:25248","https://access.redhat.com/errata/RHSA-2026:25250","https://access.redhat.com/errata/RHSA-2026:25252","https://access.redhat.com/errata/RHSA-2026:26054","https://access.redhat.com/errata/RHSA-2026:26568","https://access.redhat.com/errata/RHSA-2026:26585","https://access.redhat.com/errata/RHSA-2026:26636","https://access.redhat.com/errata/RHSA-2026:27001","https://access.redhat.com/errata/RHSA-2026:27004","https://access.redhat.com/errata/RHSA-2026:27044","https://access.redhat.com/errata/RHSA-2026:27063","https://access.redhat.com/errata/RHSA-2026:27856","https://access.redhat.com/errata/RHSA-2026:28198","https://access.redhat.com/errata/RHSA-2026:29854","https://access.redhat.com/errata/RHSA-2026:30650","https://access.redhat.com/errata/RHSA-2026:32991","https://access.redhat.com/errata/RHSA-2026:33722","https://access.redhat.com/errata/RHSA-2026:34099","https://access.redhat.com/errata/RHSA-2026:34192","https://access.redhat.com/errata/RHSA-2026:34196","https://access.redhat.com/errata/RHSA-2026:34197","https://access.redhat.com/errata/RHSA-2026:34364","https://access.redhat.com/errata/RHSA-2026:34794","https://access.redhat.com/errata/RHSA-2026:35833","https://access.redhat.com/errata/RHSA-2026:36820","https://access.redhat.com/errata/RHSA-2026:37387","https://access.redhat.com/errata/RHSA-2026:40984","https://access.redhat.com/errata/RHSA-2026:41928","https://access.redhat.com/errata/RHSA-2026:41941","https://access.redhat.com/errata/RHSA-2026:41944","https://access.redhat.com/errata/RHSA-2026:44267","https://access.redhat.com/errata/RHSA-2026:46885","https://access.redhat.com/errata/RHSA-2026:47952","https://access.redhat.com/errata/RHSA-2026:48085","https://access.redhat.com/errata/RHSA-2026:48676","https://access.redhat.com/errata/RHSA-2026:48790","https://access.redhat.com/errata/RHSA-2026:49944","https://access.redhat.com/errata/RHSA-2026:51033","https://access.redhat.com/errata/RHSA-2026:54602","https://access.redhat.com/errata/RHSA-2026:56366","https://access.redhat.com/errata/RHSA-2026:56431","https://access.redhat.com/errata/RHSA-2026:56968","https://access.redhat.com/errata/RHSA-2026:57013","https://access.redhat.com/errata/RHSA-2026:57408","https://access.redhat.com/errata/RHSA-2026:57487","https://access.redhat.com/errata/RHSA-2026:57590","https://access.redhat.com/errata/RHSA-2026:60023","https://access.redhat.com/errata/RHSA-2026:60444","https://access.redhat.com/errata/RHSA-2026:60449","https://access.redhat.com/errata/RHSA-2026:60452","https://access.redhat.com/errata/RHSA-2026:62260","https://access.redhat.com/errata/RHSA-2026:62548","https://access.redhat.com/errata/RHSA-2026:62550","https://access.redhat.com/errata/RHSA-2026:65838","https://access.redhat.com/errata/RHSA-2026:65906","https://access.redhat.com/errata/RHSA-2026:66385","https://access.redhat.com/errata/RHSA-2026:8490","https://access.redhat.com/errata/RHSA-2026:8491","https://access.redhat.com/errata/RHSA-2026:8493","https://access.redhat.com/errata/RHSA-2026:9385","https://access.redhat.com/errata/RHSA-2026:9388","https://access.redhat.com/errata/RHSA-2026:9448","https://access.redhat.com/errata/RHSA-2026:9453","https://access.redhat.com/security/cve/CVE-2026-34986","https://bugzilla.redhat.com/show_bug.cgi?id=2455470","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34986.json"],"description":"Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.4 and 3.0.5, decrypting a JSON Web Encryption (JWE) object will panic if the alg field indicates a key wrapping algorithm (one ending in KW, with the exception of A128GCMKW, A192GCMKW, and A256GCMKW) and the encrypted_key field is empty. The panic happens when cipher.KeyUnwrap() in key_wrap.go attempts to allocate a slice with a zero or negative length based on the length of the encrypted_key. This code path is reachable from ParseEncrypted() / ParseEncryptedJSON() / ParseEncryptedCompact() followed by Decrypt() on the resulting object. Note that the parse functions take a list of accepted key algorithms. If the accepted key algorithms do not include any key wrapping algorithms, parsing will fail and the application will be unaffected. This panic is also reachable by calling cipher.KeyUnwrap() directly with any ciphertext parameter less than 16 bytes long, but calling this function directly is less common. Panics can lead to denial of service. This vulnerability is fixed in 4.1.4 and 3.0.5.","cvss":[{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-34986","epss":0.00651,"percentile":0.51215,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-34986","cwe":"CWE-248","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-34986","cwe":"CWE-131","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"github.com/go-jose/go-jose/v4","version":"v4.1.3"}},"found":{"vulnerabilityID":"GHSA-78h2-9frx-2jm8","versionConstraint":"<4.1.4 (go)"},"fix":{"suggestedVersion":"4.1.4"}}],"artifact":{"id":"pkg:golang/github.com/go-jose/go-jose/v4@v4.1.3?package-id=4c794cc45b14cae8","name":"github.com/go-jose/go-jose/v4","version":"v4.1.3","type":"go-module","locations":[{"path":"/tool-imports/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:go-jose:go-jose\\/v4:v4.1.3:*:*:*:*:*:*:*","cpe:2.3:a:go-jose:go_jose\\/v4:v4.1.3:*:*:*:*:*:*:*","cpe:2.3:a:go_jose:go-jose\\/v4:v4.1.3:*:*:*:*:*:*:*","cpe:2.3:a:go_jose:go_jose\\/v4:v4.1.3:*:*:*:*:*:*:*","cpe:2.3:a:go:go-jose\\/v4:v4.1.3:*:*:*:*:*:*:*","cpe:2.3:a:go:go_jose\\/v4:v4.1.3:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/go-jose/go-jose/v4@v4.1.3","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:CVLmWDhDVRa6Mi/IgCgaopNosCaHz7zrMeF9MlZRkrs="}}},{"vulnerability":{"id":"GO-2026-6603","dataSource":"https://go.dev/cl/847185","namespace":"govulndb:language:go","severity":"High","urls":["https://go.dev/cl/847314","https://go.dev/issue/81857","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs"],"description":"When \"Trailer\" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a \"Trailer\" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-78659","epss":0.00627,"percentile":0.50086,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-78659","cwe":"CWE-405","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["0.60.0"],"state":"fixed","available":[{"version":"0.60.0","date":"2026-10-08","kind":"release"}]},"advisories":[],"risk":0.47025},"relatedVulnerabilities":[{"id":"CVE-2026-78659","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78659","namespace":"nvd:cpe","severity":"High","urls":["https://go.dev/cl/847185","https://go.dev/cl/847314","https://go.dev/issue/81857","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs","https://pkg.go.dev/vuln/GO-2026-6603"],"description":"When \"Trailer\" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a \"Trailer\" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-78659","epss":0.00627,"percentile":0.50086,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-78659","cwe":"CWE-405","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"golang.org/x/net","version":"v0.48.0"}},"found":{"vulnerabilityID":"GO-2026-6603","versionConstraint":"<0.60.0 (go)"},"fix":{"suggestedVersion":"0.60.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/net@v0.48.0?package-id=7e3c0e57ff3d79d8","name":"golang.org/x/net","version":"v0.48.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:networking:v0.48.0:*:*:*:*:go:*:*","cpe:2.3:a:golang:net:v0.48.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/net@v0.48.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:zyQRTTrjc33Lhh0fBgT/H3oZq9WuvRR5gPC70xpDiQU="}}},{"vulnerability":{"id":"GO-2026-6603","dataSource":"https://go.dev/cl/847185","namespace":"govulndb:language:go","severity":"High","urls":["https://go.dev/cl/847314","https://go.dev/issue/81857","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs"],"description":"When \"Trailer\" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a \"Trailer\" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-78659","epss":0.00627,"percentile":0.50086,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-78659","cwe":"CWE-405","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["0.60.0"],"state":"fixed","available":[{"version":"0.60.0","date":"2026-10-08","kind":"release"}]},"advisories":[],"risk":0.47025},"relatedVulnerabilities":[{"id":"CVE-2026-78659","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78659","namespace":"nvd:cpe","severity":"High","urls":["https://go.dev/cl/847185","https://go.dev/cl/847314","https://go.dev/issue/81857","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs","https://pkg.go.dev/vuln/GO-2026-6603"],"description":"When \"Trailer\" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a \"Trailer\" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-78659","epss":0.00627,"percentile":0.50086,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-78659","cwe":"CWE-405","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"golang.org/x/net","version":"v0.50.0"}},"found":{"vulnerabilityID":"GO-2026-6603","versionConstraint":"<0.60.0 (go)"},"fix":{"suggestedVersion":"0.60.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/net@v0.50.0?package-id=a205ae7dff8c80d8","name":"golang.org/x/net","version":"v0.50.0","type":"go-module","locations":[{"path":"/tool-imports/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:networking:v0.50.0:*:*:*:*:go:*:*","cpe:2.3:a:golang:net:v0.50.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/net@v0.50.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:ucWh9eiCGyDR3vtzso0WMQinm2Dnt8cFMuQa9K33J60="}}},{"vulnerability":{"id":"GO-2026-6611","dataSource":"https://go.dev/cl/847186","namespace":"govulndb:language:go","severity":"High","urls":["https://go.dev/cl/847308","https://go.dev/issue/81742","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs"],"description":"A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-78669","epss":0.00614,"percentile":0.49429,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-78669","cwe":"CWE-405","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["0.60.0"],"state":"fixed","available":[{"version":"0.60.0","date":"2026-10-08","kind":"release"}]},"advisories":[],"risk":0.46049999999999996},"relatedVulnerabilities":[{"id":"CVE-2026-78669","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78669","namespace":"nvd:cpe","severity":"High","urls":["https://go.dev/cl/847186","https://go.dev/cl/847308","https://go.dev/issue/81742","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs","https://pkg.go.dev/vuln/GO-2026-6611"],"description":"A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-78669","epss":0.00614,"percentile":0.49429,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-78669","cwe":"CWE-405","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"golang.org/x/net","version":"v0.48.0"}},"found":{"vulnerabilityID":"GO-2026-6611","versionConstraint":"<0.60.0 (go)"},"fix":{"suggestedVersion":"0.60.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/net@v0.48.0?package-id=7e3c0e57ff3d79d8","name":"golang.org/x/net","version":"v0.48.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:networking:v0.48.0:*:*:*:*:go:*:*","cpe:2.3:a:golang:net:v0.48.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/net@v0.48.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:zyQRTTrjc33Lhh0fBgT/H3oZq9WuvRR5gPC70xpDiQU="}}},{"vulnerability":{"id":"GO-2026-6611","dataSource":"https://go.dev/cl/847186","namespace":"govulndb:language:go","severity":"High","urls":["https://go.dev/cl/847308","https://go.dev/issue/81742","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs"],"description":"A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-78669","epss":0.00614,"percentile":0.49429,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-78669","cwe":"CWE-405","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["0.60.0"],"state":"fixed","available":[{"version":"0.60.0","date":"2026-10-08","kind":"release"}]},"advisories":[],"risk":0.46049999999999996},"relatedVulnerabilities":[{"id":"CVE-2026-78669","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78669","namespace":"nvd:cpe","severity":"High","urls":["https://go.dev/cl/847186","https://go.dev/cl/847308","https://go.dev/issue/81742","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs","https://pkg.go.dev/vuln/GO-2026-6611"],"description":"A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-78669","epss":0.00614,"percentile":0.49429,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-78669","cwe":"CWE-405","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"golang.org/x/net","version":"v0.50.0"}},"found":{"vulnerabilityID":"GO-2026-6611","versionConstraint":"<0.60.0 (go)"},"fix":{"suggestedVersion":"0.60.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/net@v0.50.0?package-id=a205ae7dff8c80d8","name":"golang.org/x/net","version":"v0.50.0","type":"go-module","locations":[{"path":"/tool-imports/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:networking:v0.50.0:*:*:*:*:go:*:*","cpe:2.3:a:golang:net:v0.50.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/net@v0.50.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:ucWh9eiCGyDR3vtzso0WMQinm2Dnt8cFMuQa9K33J60="}}},{"vulnerability":{"id":"GHSA-89gr-r52h-f8rx","dataSource":"https://github.com/advisories/GHSA-89gr-r52h-f8rx","namespace":"github:language:go","severity":"Critical","urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-39831","https://go.dev/cl/781662","https://go.dev/issue/79566","https://groups.google.com/g/golang-announce/c/a082jnz-LvI","https://pkg.go.dev/vuln/GO-2026-5019"],"description":"golang.org/x/crypto: FIDO/U2F security key physical presence check can be bypassed","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"exploitabilityScore":3.9,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-39831","epss":0.00478,"percentile":0.41315,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-39831","cwe":"CWE-862","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["0.52.0"],"state":"fixed","available":[{"version":"0.52.0","date":"2026-07-07","kind":"first-observed"}]},"advisories":[],"risk":0.43259000000000003},"relatedVulnerabilities":[{"id":"CVE-2026-39831","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-39831","namespace":"nvd:cpe","severity":"Critical","urls":["https://go.dev/cl/781662","https://go.dev/issue/79566","https://groups.google.com/g/golang-announce/c/a082jnz-LvI","https://pkg.go.dev/vuln/GO-2026-5019"],"description":"The Verify() method for FIDO/U2F security key types (sk-ecdsa-sha2-nistp256@openssh.com, sk-ssh-ed25519@openssh.com) did not check the User Presence flag. Signatures generated without physical touch were accepted, allowing unattended use of a hardware security key. To restore the previous behavior, return a \"no-touch-required\" extension in Permissions.Extensions from PublicKeyCallback.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"exploitabilityScore":3.9,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-39831","epss":0.00478,"percentile":0.41315,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-39831","cwe":"CWE-862","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"golang.org/x/crypto","version":"v0.46.0"}},"found":{"vulnerabilityID":"GHSA-89gr-r52h-f8rx","versionConstraint":"<0.52.0 (go)"},"fix":{"suggestedVersion":"0.52.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/crypto@v0.46.0?package-id=b3387fbedc5d73be","name":"golang.org/x/crypto","version":"v0.46.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:crypto:v0.46.0:*:*:*:*:go:*:*","cpe:2.3:a:go:ssh:v0.46.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/crypto@v0.46.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:cKRW/pmt1pKAfetfu+RCEvjvZkA9RimPbh7bhFjGVBU="}}},{"vulnerability":{"id":"GHSA-89gr-r52h-f8rx","dataSource":"https://github.com/advisories/GHSA-89gr-r52h-f8rx","namespace":"github:language:go","severity":"Critical","urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-39831","https://go.dev/cl/781662","https://go.dev/issue/79566","https://groups.google.com/g/golang-announce/c/a082jnz-LvI","https://pkg.go.dev/vuln/GO-2026-5019"],"description":"golang.org/x/crypto: FIDO/U2F security key physical presence check can be bypassed","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"exploitabilityScore":3.9,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-39831","epss":0.00478,"percentile":0.41315,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-39831","cwe":"CWE-862","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["0.52.0"],"state":"fixed","available":[{"version":"0.52.0","date":"2026-07-07","kind":"first-observed"}]},"advisories":[],"risk":0.43259000000000003},"relatedVulnerabilities":[{"id":"CVE-2026-39831","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-39831","namespace":"nvd:cpe","severity":"Critical","urls":["https://go.dev/cl/781662","https://go.dev/issue/79566","https://groups.google.com/g/golang-announce/c/a082jnz-LvI","https://pkg.go.dev/vuln/GO-2026-5019"],"description":"The Verify() method for FIDO/U2F security key types (sk-ecdsa-sha2-nistp256@openssh.com, sk-ssh-ed25519@openssh.com) did not check the User Presence flag. Signatures generated without physical touch were accepted, allowing unattended use of a hardware security key. To restore the previous behavior, return a \"no-touch-required\" extension in Permissions.Extensions from PublicKeyCallback.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"exploitabilityScore":3.9,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-39831","epss":0.00478,"percentile":0.41315,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-39831","cwe":"CWE-862","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"golang.org/x/crypto","version":"v0.48.0"}},"found":{"vulnerabilityID":"GHSA-89gr-r52h-f8rx","versionConstraint":"<0.52.0 (go)"},"fix":{"suggestedVersion":"0.52.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/crypto@v0.48.0?package-id=764d3323ecdb54e3","name":"golang.org/x/crypto","version":"v0.48.0","type":"go-module","locations":[{"path":"/tool-imports/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:crypto:v0.48.0:*:*:*:*:go:*:*","cpe:2.3:a:go:ssh:v0.48.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/crypto@v0.48.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:/VRzVqiRSggnhY7gNRxPauEQ5Drw9haKdM0jqfcCFts="}}},{"vulnerability":{"id":"GHSA-259r-337f-4rfw","dataSource":"https://github.com/advisories/GHSA-259r-337f-4rfw","namespace":"github:language:go","severity":"High","urls":["https://github.com/klauspost/compress/security/advisories/GHSA-259r-337f-4rfw","https://nvd.nist.gov/vuln/detail/CVE-2026-63209","https://github.com/klauspost/compress/pull/1163","https://github.com/klauspost/compress/commit/539243b8823ee8f03e49969823d57c348c917536","https://github.com/klauspost/compress/commit/8668e357e776d5152ed62f33c17f21b8690664fa","https://github.com/klauspost/compress/releases/tag/v1.18.7"],"description":"Compress/s2: Integer Overflow or Wraparound and Out-of-bounds Write in compress","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-63209","epss":0.00572,"percentile":0.47335,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-63209","cwe":"CWE-190","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-63209","cwe":"CWE-787","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.18.7"],"state":"fixed","available":[{"version":"1.18.7","date":"2026-10-20","kind":"first-observed"}]},"advisories":[],"risk":0.42900000000000005},"relatedVulnerabilities":[{"id":"CVE-2026-63209","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-63209","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/klauspost/compress/commit/539243b8823ee8f03e49969823d57c348c917536","https://github.com/klauspost/compress/releases/tag/v1.18.7","https://github.com/klauspost/compress/security/advisories/GHSA-259r-337f-4rfw"],"description":"compress provides various compression algorithms. Prior to version 1.18.7, a signed integer overflow vulnerability in s2.NewDict() allows an attacker to bypass repeat index validation by supplying a dictionary with a uvarint-encoded repeat value exceeding MaxInt64. When Dict.Encode() is subsequently called, the overflowed negative repeat value causes an out-of-bounds memory access via unsafe.Pointer arithmetic, crashing the process with SIGSEGV. This issue has been patched in version 1.18.7.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-63209","epss":0.00572,"percentile":0.47335,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-63209","cwe":"CWE-190","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-63209","cwe":"CWE-787","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"github.com/klauspost/compress","version":"v1.18.0"}},"found":{"vulnerabilityID":"GHSA-259r-337f-4rfw","versionConstraint":"<=1.18.6 (go)"},"fix":{"suggestedVersion":"1.18.7"}}],"artifact":{"id":"pkg:golang/github.com/klauspost/compress@v1.18.0?package-id=6813a3f2b23f48bb","name":"github.com/klauspost/compress","version":"v1.18.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:klauspost:compress:v1.18.0:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/klauspost/compress@v1.18.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:c/Cqfb0r+Yi+JtIEq73FWXVkRonBlf0CRNYc8Zttxdo="}}},{"vulnerability":{"id":"GHSA-259r-337f-4rfw","dataSource":"https://github.com/advisories/GHSA-259r-337f-4rfw","namespace":"github:language:go","severity":"High","urls":["https://github.com/klauspost/compress/security/advisories/GHSA-259r-337f-4rfw","https://nvd.nist.gov/vuln/detail/CVE-2026-63209","https://github.com/klauspost/compress/pull/1163","https://github.com/klauspost/compress/commit/539243b8823ee8f03e49969823d57c348c917536","https://github.com/klauspost/compress/commit/8668e357e776d5152ed62f33c17f21b8690664fa","https://github.com/klauspost/compress/releases/tag/v1.18.7"],"description":"Compress/s2: Integer Overflow or Wraparound and Out-of-bounds Write in compress","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-63209","epss":0.00572,"percentile":0.47335,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-63209","cwe":"CWE-190","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-63209","cwe":"CWE-787","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.18.7"],"state":"fixed","available":[{"version":"1.18.7","date":"2026-10-20","kind":"first-observed"}]},"advisories":[],"risk":0.42900000000000005},"relatedVulnerabilities":[{"id":"CVE-2026-63209","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-63209","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/klauspost/compress/commit/539243b8823ee8f03e49969823d57c348c917536","https://github.com/klauspost/compress/releases/tag/v1.18.7","https://github.com/klauspost/compress/security/advisories/GHSA-259r-337f-4rfw"],"description":"compress provides various compression algorithms. Prior to version 1.18.7, a signed integer overflow vulnerability in s2.NewDict() allows an attacker to bypass repeat index validation by supplying a dictionary with a uvarint-encoded repeat value exceeding MaxInt64. When Dict.Encode() is subsequently called, the overflowed negative repeat value causes an out-of-bounds memory access via unsafe.Pointer arithmetic, crashing the process with SIGSEGV. This issue has been patched in version 1.18.7.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-63209","epss":0.00572,"percentile":0.47335,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-63209","cwe":"CWE-190","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-63209","cwe":"CWE-787","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"github.com/klauspost/compress","version":"v1.18.2"}},"found":{"vulnerabilityID":"GHSA-259r-337f-4rfw","versionConstraint":"<=1.18.6 (go)"},"fix":{"suggestedVersion":"1.18.7"}}],"artifact":{"id":"pkg:golang/github.com/klauspost/compress@v1.18.2?package-id=3d208da926589fa4","name":"github.com/klauspost/compress","version":"v1.18.2","type":"go-module","locations":[{"path":"/tool-imports/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:klauspost:compress:v1.18.2:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/klauspost/compress@v1.18.2","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:iiPHWW0YrcFgpBYhsA6D1+fqHssJscY/Tm/y2Uqnapk="}}},{"vulnerability":{"id":"GO-2026-4559","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-27141","namespace":"govulndb:language:go","severity":"High","urls":["https://go.dev/cl/746180","https://go.dev/issue/77652"],"description":"Due to missing nil check, sending 0x0a-0x0f HTTP/2 frames will cause a running server to panic","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-27141","epss":0.00569,"percentile":0.47145,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-27141","cwe":"CWE-476","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["0.51.0"],"state":"fixed","available":[{"version":"0.51.0","date":"2026-02-25","kind":"release"}]},"advisories":[],"risk":0.42674999999999996},"relatedVulnerabilities":[{"id":"CVE-2026-27141","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-27141","namespace":"nvd:cpe","severity":"High","urls":["https://go.dev/cl/746180","https://go.dev/issue/77652","https://pkg.go.dev/vuln/GO-2026-4559"],"description":"Due to missing nil check, sending 0x0a-0x0f HTTP/2 frames will cause a running server to panic","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-27141","epss":0.00569,"percentile":0.47145,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-27141","cwe":"CWE-476","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"golang.org/x/net","version":"v0.50.0"}},"found":{"vulnerabilityID":"GO-2026-4559","versionConstraint":">=0.50.0,<0.51.0 (go)"},"fix":{"suggestedVersion":"0.51.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/net@v0.50.0?package-id=a205ae7dff8c80d8","name":"golang.org/x/net","version":"v0.50.0","type":"go-module","locations":[{"path":"/tool-imports/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:networking:v0.50.0:*:*:*:*:go:*:*","cpe:2.3:a:golang:net:v0.50.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/net@v0.50.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:ucWh9eiCGyDR3vtzso0WMQinm2Dnt8cFMuQa9K33J60="}}},{"vulnerability":{"id":"GHSA-jppx-rxg9-jmrx","dataSource":"https://github.com/advisories/GHSA-jppx-rxg9-jmrx","namespace":"github:language:go","severity":"Critical","urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-39833","https://go.dev/cl/778640","https://go.dev/cl/778641","https://go.dev/issue/79436","https://groups.google.com/g/golang-announce/c/a082jnz-LvI","https://pkg.go.dev/vuln/GO-2026-5005"],"description":"golang.org/x/crypto doesn't enforce invoking key constraints","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"exploitabilityScore":3.9,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-39833","epss":0.00469,"percentile":0.40593,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-39833","cwe":"CWE-862","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["0.52.0"],"state":"fixed","available":[{"version":"0.52.0","date":"2026-07-07","kind":"first-observed"}]},"advisories":[],"risk":0.424445},"relatedVulnerabilities":[{"id":"CVE-2026-39833","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-39833","namespace":"nvd:cpe","severity":"Critical","urls":["https://go.dev/cl/778642","https://go.dev/issue/79436","https://groups.google.com/g/golang-announce/c/a082jnz-LvI","https://pkg.go.dev/vuln/GO-2026-5005"],"description":"The in-memory keyring returned by NewKeyring() silently accepted keys with the ConfirmBeforeUse constraint but never enforced it. The key would sign without any confirmation prompt, with no indication to the caller that the constraint was not in effect. NewKeyring() now returns an error when unsupported constraints are requested.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"exploitabilityScore":3.9,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-39833","epss":0.00469,"percentile":0.40593,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-39833","cwe":"CWE-862","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"golang.org/x/crypto","version":"v0.46.0"}},"found":{"vulnerabilityID":"GHSA-jppx-rxg9-jmrx","versionConstraint":"<0.52.0 (go)"},"fix":{"suggestedVersion":"0.52.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/crypto@v0.46.0?package-id=b3387fbedc5d73be","name":"golang.org/x/crypto","version":"v0.46.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:crypto:v0.46.0:*:*:*:*:go:*:*","cpe:2.3:a:go:ssh:v0.46.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/crypto@v0.46.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:cKRW/pmt1pKAfetfu+RCEvjvZkA9RimPbh7bhFjGVBU="}}},{"vulnerability":{"id":"GHSA-jppx-rxg9-jmrx","dataSource":"https://github.com/advisories/GHSA-jppx-rxg9-jmrx","namespace":"github:language:go","severity":"Critical","urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-39833","https://go.dev/cl/778640","https://go.dev/cl/778641","https://go.dev/issue/79436","https://groups.google.com/g/golang-announce/c/a082jnz-LvI","https://pkg.go.dev/vuln/GO-2026-5005"],"description":"golang.org/x/crypto doesn't enforce invoking key constraints","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"exploitabilityScore":3.9,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-39833","epss":0.00469,"percentile":0.40593,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-39833","cwe":"CWE-862","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["0.52.0"],"state":"fixed","available":[{"version":"0.52.0","date":"2026-07-07","kind":"first-observed"}]},"advisories":[],"risk":0.424445},"relatedVulnerabilities":[{"id":"CVE-2026-39833","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-39833","namespace":"nvd:cpe","severity":"Critical","urls":["https://go.dev/cl/778642","https://go.dev/issue/79436","https://groups.google.com/g/golang-announce/c/a082jnz-LvI","https://pkg.go.dev/vuln/GO-2026-5005"],"description":"The in-memory keyring returned by NewKeyring() silently accepted keys with the ConfirmBeforeUse constraint but never enforced it. The key would sign without any confirmation prompt, with no indication to the caller that the constraint was not in effect. NewKeyring() now returns an error when unsupported constraints are requested.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"exploitabilityScore":3.9,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-39833","epss":0.00469,"percentile":0.40593,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-39833","cwe":"CWE-862","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"golang.org/x/crypto","version":"v0.48.0"}},"found":{"vulnerabilityID":"GHSA-jppx-rxg9-jmrx","versionConstraint":"<0.52.0 (go)"},"fix":{"suggestedVersion":"0.52.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/crypto@v0.48.0?package-id=764d3323ecdb54e3","name":"golang.org/x/crypto","version":"v0.48.0","type":"go-module","locations":[{"path":"/tool-imports/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:crypto:v0.48.0:*:*:*:*:go:*:*","cpe:2.3:a:go:ssh:v0.48.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/crypto@v0.48.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:/VRzVqiRSggnhY7gNRxPauEQ5Drw9haKdM0jqfcCFts="}}},{"vulnerability":{"id":"GO-2026-5942","dataSource":"https://go.dev/cl/786345","namespace":"govulndb:language:go","severity":"High","urls":["https://go.dev/issue/79795","https://groups.google.com/g/golang-announce/c/94pEornpRlI"],"description":"Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-46600","epss":0.00549,"percentile":0.45997,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-46600","cwe":"CWE-125","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["0.56.0"],"state":"fixed","available":[{"version":"0.56.0","date":"2026-06-09","kind":"release"}]},"advisories":[],"risk":0.41174999999999995},"relatedVulnerabilities":[{"id":"CVE-2026-46600","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-46600","namespace":"nvd:cpe","severity":"High","urls":["https://go.dev/cl/786345","https://go.dev/issue/79795","https://groups.google.com/g/golang-announce/c/94pEornpRlI","https://pkg.go.dev/vuln/GO-2026-5942"],"description":"Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-46600","epss":0.00549,"percentile":0.45997,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-46600","cwe":"CWE-125","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"golang.org/x/net","version":"v0.48.0"}},"found":{"vulnerabilityID":"GO-2026-5942","versionConstraint":"<0.56.0 (go)"},"fix":{"suggestedVersion":"0.56.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/net@v0.48.0?package-id=7e3c0e57ff3d79d8","name":"golang.org/x/net","version":"v0.48.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:networking:v0.48.0:*:*:*:*:go:*:*","cpe:2.3:a:golang:net:v0.48.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/net@v0.48.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:zyQRTTrjc33Lhh0fBgT/H3oZq9WuvRR5gPC70xpDiQU="}}},{"vulnerability":{"id":"GO-2026-5942","dataSource":"https://go.dev/cl/786345","namespace":"govulndb:language:go","severity":"High","urls":["https://go.dev/issue/79795","https://groups.google.com/g/golang-announce/c/94pEornpRlI"],"description":"Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-46600","epss":0.00549,"percentile":0.45997,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-46600","cwe":"CWE-125","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["0.56.0"],"state":"fixed","available":[{"version":"0.56.0","date":"2026-06-09","kind":"release"}]},"advisories":[],"risk":0.41174999999999995},"relatedVulnerabilities":[{"id":"CVE-2026-46600","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-46600","namespace":"nvd:cpe","severity":"High","urls":["https://go.dev/cl/786345","https://go.dev/issue/79795","https://groups.google.com/g/golang-announce/c/94pEornpRlI","https://pkg.go.dev/vuln/GO-2026-5942"],"description":"Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-46600","epss":0.00549,"percentile":0.45997,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-46600","cwe":"CWE-125","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"golang.org/x/net","version":"v0.50.0"}},"found":{"vulnerabilityID":"GO-2026-5942","versionConstraint":"<0.56.0 (go)"},"fix":{"suggestedVersion":"0.56.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/net@v0.50.0?package-id=a205ae7dff8c80d8","name":"golang.org/x/net","version":"v0.50.0","type":"go-module","locations":[{"path":"/tool-imports/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:networking:v0.50.0:*:*:*:*:go:*:*","cpe:2.3:a:golang:net:v0.50.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/net@v0.50.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:ucWh9eiCGyDR3vtzso0WMQinm2Dnt8cFMuQa9K33J60="}}},{"vulnerability":{"id":"GHSA-9c54-x2g4-v92j","dataSource":"https://github.com/advisories/GHSA-9c54-x2g4-v92j","namespace":"github:language:go","severity":"Medium","urls":["https://github.com/sigstore/timestamp-authority/security/advisories/GHSA-9c54-x2g4-v92j"],"description":"Sigstore Timestamp Authority has OOM due to unbounded metric label cardinality","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-49835","epss":0.00744,"percentile":0.54768,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-49835","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["2.1.0"],"state":"fixed","available":[{"version":"2.1.0","date":"2026-07-01","kind":"first-observed"}]},"advisories":[],"risk":0.40548000000000006},"relatedVulnerabilities":[{"id":"CVE-2026-49835","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-49835","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/sigstore/timestamp-authority/commit/506ec57b6ac2ea1e4739322e47453469425b69b5","https://github.com/sigstore/timestamp-authority/releases/tag/v2.1.0","https://github.com/sigstore/timestamp-authority/security/advisories/GHSA-9c54-x2g4-v92j"],"description":"Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps. Prior to 2.1.0, the global wrapMetrics middleware records raw HTTP request path r.URL.Path and raw HTTP request method r.Method as Prometheus labels for latency and request count metric vectors before routing, allowing an unauthenticated remote attacker to issue requests with random paths such as /api/v1/timestamp/<uuid> or random HTTP methods and create unbounded permanent time-series entries that exhaust memory. This issue is fixed in version 2.1.0.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-49835","epss":0.00744,"percentile":0.54768,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-49835","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"github.com/sigstore/timestamp-authority/v2","version":"v2.0.3"}},"found":{"vulnerabilityID":"GHSA-9c54-x2g4-v92j","versionConstraint":"<=2.0.6 (go)"},"fix":{"suggestedVersion":"2.1.0"}}],"artifact":{"id":"pkg:golang/github.com/sigstore/timestamp-authority/v2@v2.0.3?package-id=73bf00714c6e9856","name":"github.com/sigstore/timestamp-authority/v2","version":"v2.0.3","type":"go-module","locations":[{"path":"/tool-imports/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:sigstore:timestamp-authority\\/v2:v2.0.3:*:*:*:*:*:*:*","cpe:2.3:a:sigstore:timestamp_authority\\/v2:v2.0.3:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/sigstore/timestamp-authority/v2@v2.0.3","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:sRyYNtdED/ttLCMdaYnwpf0zre1A9chvjTnCmWWxN8Y="}}},{"vulnerability":{"id":"GO-2026-6355","dataSource":"https://go.dev/issue/81317","namespace":"govulndb:language:go","severity":"High","urls":["https://go.dev/cl/826524","https://groups.google.com/g/golang-announce/c/1y3fb2np35U"],"description":"Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection.\n\nNow, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connection down instead of buffering and blocking.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-56855","epss":0.005,"percentile":0.4287,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-56855","cwe":"CWE-770","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["0.56.0"],"state":"fixed","available":[{"version":"0.56.0","date":"2026-09-02","kind":"release"}]},"advisories":[],"risk":0.375},"relatedVulnerabilities":[{"id":"CVE-2026-56855","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56855","namespace":"nvd:cpe","severity":"High","urls":["https://go.dev/cl/826524","https://go.dev/issue/81317","https://groups.google.com/g/golang-announce/c/1y3fb2np35U","https://pkg.go.dev/vuln/GO-2026-6355"],"description":"Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connection down instead of buffering and blocking.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-56855","epss":0.005,"percentile":0.4287,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-56855","cwe":"CWE-770","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"golang.org/x/crypto","version":"v0.46.0"}},"found":{"vulnerabilityID":"GO-2026-6355","versionConstraint":"<0.56.0 (go)"},"fix":{"suggestedVersion":"0.56.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/crypto@v0.46.0?package-id=b3387fbedc5d73be","name":"golang.org/x/crypto","version":"v0.46.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:crypto:v0.46.0:*:*:*:*:go:*:*","cpe:2.3:a:go:ssh:v0.46.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/crypto@v0.46.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:cKRW/pmt1pKAfetfu+RCEvjvZkA9RimPbh7bhFjGVBU="}}},{"vulnerability":{"id":"GO-2026-6355","dataSource":"https://go.dev/issue/81317","namespace":"govulndb:language:go","severity":"High","urls":["https://go.dev/cl/826524","https://groups.google.com/g/golang-announce/c/1y3fb2np35U"],"description":"Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection.\n\nNow, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connection down instead of buffering and blocking.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-56855","epss":0.005,"percentile":0.4287,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-56855","cwe":"CWE-770","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["0.56.0"],"state":"fixed","available":[{"version":"0.56.0","date":"2026-09-02","kind":"release"}]},"advisories":[],"risk":0.375},"relatedVulnerabilities":[{"id":"CVE-2026-56855","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56855","namespace":"nvd:cpe","severity":"High","urls":["https://go.dev/cl/826524","https://go.dev/issue/81317","https://groups.google.com/g/golang-announce/c/1y3fb2np35U","https://pkg.go.dev/vuln/GO-2026-6355"],"description":"Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connection down instead of buffering and blocking.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-56855","epss":0.005,"percentile":0.4287,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-56855","cwe":"CWE-770","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"golang.org/x/crypto","version":"v0.48.0"}},"found":{"vulnerabilityID":"GO-2026-6355","versionConstraint":"<0.56.0 (go)"},"fix":{"suggestedVersion":"0.56.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/crypto@v0.48.0?package-id=764d3323ecdb54e3","name":"golang.org/x/crypto","version":"v0.48.0","type":"go-module","locations":[{"path":"/tool-imports/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:crypto:v0.48.0:*:*:*:*:go:*:*","cpe:2.3:a:go:ssh:v0.48.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/crypto@v0.48.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:/VRzVqiRSggnhY7gNRxPauEQ5Drw9haKdM0jqfcCFts="}}},{"vulnerability":{"id":"GO-2026-6617","dataSource":"https://go.dev/cl/847188","namespace":"govulndb:language:go","severity":"High","urls":["https://go.dev/cl/847313","https://go.dev/issue/81867","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs"],"description":"HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the other modifies the encoder's table size when handling a SETTINGS frame containing SETTINGS_HEADER_TABLE_SIZE that a client sends. A malicious client can repeatedly send a request while changing the header table size to crash the server.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-97032","epss":0.0049,"percentile":0.42162,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-97032","cwe":"CWE-362","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["0.60.0"],"state":"fixed","available":[{"version":"0.60.0","date":"2026-10-08","kind":"release"}]},"advisories":[],"risk":0.3675},"relatedVulnerabilities":[{"id":"CVE-2026-97032","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-97032","namespace":"nvd:cpe","severity":"High","urls":["https://go.dev/cl/847188","https://go.dev/cl/847313","https://go.dev/issue/81867","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs","https://pkg.go.dev/vuln/GO-2026-6617"],"description":"HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the other modifies the encoder's table size when handling a SETTINGS frame containing SETTINGS_HEADER_TABLE_SIZE that a client sends. A malicious client can repeatedly send a request while changing the header table size to crash the server.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-97032","epss":0.0049,"percentile":0.42162,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-97032","cwe":"CWE-362","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"golang.org/x/net","version":"v0.48.0"}},"found":{"vulnerabilityID":"GO-2026-6617","versionConstraint":"<0.60.0 (go)"},"fix":{"suggestedVersion":"0.60.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/net@v0.48.0?package-id=7e3c0e57ff3d79d8","name":"golang.org/x/net","version":"v0.48.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:networking:v0.48.0:*:*:*:*:go:*:*","cpe:2.3:a:golang:net:v0.48.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/net@v0.48.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:zyQRTTrjc33Lhh0fBgT/H3oZq9WuvRR5gPC70xpDiQU="}}},{"vulnerability":{"id":"GO-2026-6617","dataSource":"https://go.dev/cl/847188","namespace":"govulndb:language:go","severity":"High","urls":["https://go.dev/cl/847313","https://go.dev/issue/81867","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs"],"description":"HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the other modifies the encoder's table size when handling a SETTINGS frame containing SETTINGS_HEADER_TABLE_SIZE that a client sends. A malicious client can repeatedly send a request while changing the header table size to crash the server.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-97032","epss":0.0049,"percentile":0.42162,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-97032","cwe":"CWE-362","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["0.60.0"],"state":"fixed","available":[{"version":"0.60.0","date":"2026-10-08","kind":"release"}]},"advisories":[],"risk":0.3675},"relatedVulnerabilities":[{"id":"CVE-2026-97032","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-97032","namespace":"nvd:cpe","severity":"High","urls":["https://go.dev/cl/847188","https://go.dev/cl/847313","https://go.dev/issue/81867","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs","https://pkg.go.dev/vuln/GO-2026-6617"],"description":"HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the other modifies the encoder's table size when handling a SETTINGS frame containing SETTINGS_HEADER_TABLE_SIZE that a client sends. A malicious client can repeatedly send a request while changing the header table size to crash the server.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-97032","epss":0.0049,"percentile":0.42162,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-97032","cwe":"CWE-362","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"golang.org/x/net","version":"v0.50.0"}},"found":{"vulnerabilityID":"GO-2026-6617","versionConstraint":"<0.60.0 (go)"},"fix":{"suggestedVersion":"0.60.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/net@v0.50.0?package-id=a205ae7dff8c80d8","name":"golang.org/x/net","version":"v0.50.0","type":"go-module","locations":[{"path":"/tool-imports/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:networking:v0.50.0:*:*:*:*:go:*:*","cpe:2.3:a:golang:net:v0.50.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/net@v0.50.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:ucWh9eiCGyDR3vtzso0WMQinm2Dnt8cFMuQa9K33J60="}}},{"vulnerability":{"id":"GO-2026-5970","dataSource":"https://go.dev/issue/80142","namespace":"govulndb:language:go","severity":"High","urls":["https://go.dev/cl/794100"],"description":"A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-56852","epss":0.00475,"percentile":0.41065,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-56852","cwe":"CWE-835","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["0.39.0"],"state":"fixed","available":[{"version":"0.39.0","date":"2026-06-30","kind":"release"}]},"advisories":[],"risk":0.35624999999999996},"relatedVulnerabilities":[{"id":"CVE-2026-56852","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56852","namespace":"nvd:cpe","severity":"High","urls":["https://go.dev/cl/794100","https://go.dev/issue/80142","https://pkg.go.dev/vuln/GO-2026-5970"],"description":"A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-56852","epss":0.00475,"percentile":0.41065,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-56852","cwe":"CWE-835","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"golang.org/x/text","version":"v0.33.0"}},"found":{"vulnerabilityID":"GO-2026-5970","versionConstraint":"<0.39.0 (go)"},"fix":{"suggestedVersion":"0.39.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/text@v0.33.0?package-id=ba975f34c2d5efbe","name":"golang.org/x/text","version":"v0.33.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:text:v0.33.0:*:*:*:*:*:*:*"],"purl":"pkg:golang/golang.org/x/text@v0.33.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:B3njUFyqtHDUI5jMn1YIr5B0IE2U0qck04r6d4KPAxE="}}},{"vulnerability":{"id":"GO-2026-5970","dataSource":"https://go.dev/issue/80142","namespace":"govulndb:language:go","severity":"High","urls":["https://go.dev/cl/794100"],"description":"A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-56852","epss":0.00475,"percentile":0.41065,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-56852","cwe":"CWE-835","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["0.39.0"],"state":"fixed","available":[{"version":"0.39.0","date":"2026-06-30","kind":"release"}]},"advisories":[],"risk":0.35624999999999996},"relatedVulnerabilities":[{"id":"CVE-2026-56852","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56852","namespace":"nvd:cpe","severity":"High","urls":["https://go.dev/cl/794100","https://go.dev/issue/80142","https://pkg.go.dev/vuln/GO-2026-5970"],"description":"A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-56852","epss":0.00475,"percentile":0.41065,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-56852","cwe":"CWE-835","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"golang.org/x/text","version":"v0.34.0"}},"found":{"vulnerabilityID":"GO-2026-5970","versionConstraint":"<0.39.0 (go)"},"fix":{"suggestedVersion":"0.39.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/text@v0.34.0?package-id=15ba6cd10c849c2e","name":"golang.org/x/text","version":"v0.34.0","type":"go-module","locations":[{"path":"/tool-imports/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:text:v0.34.0:*:*:*:*:*:*:*"],"purl":"pkg:golang/golang.org/x/text@v0.34.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:oL/Qq0Kdaqxa1KbNeMKwQq0reLCCaFtqu2eNuSeNHbk="}}},{"vulnerability":{"id":"GHSA-q4h4-gmj2-qvw2","dataSource":"https://github.com/advisories/GHSA-q4h4-gmj2-qvw2","namespace":"github:language:go","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-46597","https://go.dev/cl/781620","https://go.dev/issue/79561","https://groups.google.com/g/golang-announce/c/a082jnz-LvI","https://pkg.go.dev/vuln/GO-2026-5013"],"description":"golang.org/x/crypto: Invoking byte arithmetic causes underflow and panic","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-46597","epss":0.00473,"percentile":0.40904,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-46597","cwe":"CWE-704","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["0.52.0"],"state":"fixed","available":[{"version":"0.52.0","date":"2026-07-07","kind":"first-observed"}]},"advisories":[],"risk":0.35475},"relatedVulnerabilities":[{"id":"CVE-2026-46597","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-46597","namespace":"nvd:cpe","severity":"High","urls":["https://go.dev/cl/781620","https://go.dev/issue/79561","https://groups.google.com/g/golang-announce/c/a082jnz-LvI","https://pkg.go.dev/vuln/GO-2026-5013"],"description":"An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-46597","epss":0.00473,"percentile":0.40904,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-46597","cwe":"CWE-704","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"golang.org/x/crypto","version":"v0.46.0"}},"found":{"vulnerabilityID":"GHSA-q4h4-gmj2-qvw2","versionConstraint":"<0.52.0 (go)"},"fix":{"suggestedVersion":"0.52.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/crypto@v0.46.0?package-id=b3387fbedc5d73be","name":"golang.org/x/crypto","version":"v0.46.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:crypto:v0.46.0:*:*:*:*:go:*:*","cpe:2.3:a:go:ssh:v0.46.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/crypto@v0.46.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:cKRW/pmt1pKAfetfu+RCEvjvZkA9RimPbh7bhFjGVBU="}}},{"vulnerability":{"id":"GHSA-q4h4-gmj2-qvw2","dataSource":"https://github.com/advisories/GHSA-q4h4-gmj2-qvw2","namespace":"github:language:go","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-46597","https://go.dev/cl/781620","https://go.dev/issue/79561","https://groups.google.com/g/golang-announce/c/a082jnz-LvI","https://pkg.go.dev/vuln/GO-2026-5013"],"description":"golang.org/x/crypto: Invoking byte arithmetic causes underflow and panic","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-46597","epss":0.00473,"percentile":0.40904,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-46597","cwe":"CWE-704","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["0.52.0"],"state":"fixed","available":[{"version":"0.52.0","date":"2026-07-07","kind":"first-observed"}]},"advisories":[],"risk":0.35475},"relatedVulnerabilities":[{"id":"CVE-2026-46597","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-46597","namespace":"nvd:cpe","severity":"High","urls":["https://go.dev/cl/781620","https://go.dev/issue/79561","https://groups.google.com/g/golang-announce/c/a082jnz-LvI","https://pkg.go.dev/vuln/GO-2026-5013"],"description":"An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-46597","epss":0.00473,"percentile":0.40904,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-46597","cwe":"CWE-704","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"golang.org/x/crypto","version":"v0.48.0"}},"found":{"vulnerabilityID":"GHSA-q4h4-gmj2-qvw2","versionConstraint":"<0.52.0 (go)"},"fix":{"suggestedVersion":"0.52.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/crypto@v0.48.0?package-id=764d3323ecdb54e3","name":"golang.org/x/crypto","version":"v0.48.0","type":"go-module","locations":[{"path":"/tool-imports/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:crypto:v0.48.0:*:*:*:*:go:*:*","cpe:2.3:a:go:ssh:v0.48.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/crypto@v0.48.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:/VRzVqiRSggnhY7gNRxPauEQ5Drw9haKdM0jqfcCFts="}}},{"vulnerability":{"id":"GHSA-w879-237q-wc7r","dataSource":"https://github.com/advisories/GHSA-w879-237q-wc7r","namespace":"github:language:go","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-39829","https://go.dev/cl/781641","https://go.dev/cl/781661","https://go.dev/issue/79565","https://groups.google.com/g/golang-announce/c/a082jnz-LvI","https://pkg.go.dev/vuln/GO-2026-5018","https://access.redhat.com/errata/RHSA-2026:29455","https://access.redhat.com/security/cve/CVE-2026-39829","https://bugzilla.redhat.com/show_bug.cgi?id=2480681","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39829.json","https://access.redhat.com/errata/RHSA-2026:26546","https://access.redhat.com/errata/RHSA-2026:26547","https://access.redhat.com/errata/RHSA-2026:35833","https://access.redhat.com/errata/RHSA-2026:36648","https://access.redhat.com/errata/RHSA-2026:36625","https://access.redhat.com/errata/RHSA-2026:36319","https://access.redhat.com/errata/RHSA-2026:36207","https://access.redhat.com/errata/RHSA-2026:36199","https://access.redhat.com/errata/RHSA-2026:37271","https://access.redhat.com/errata/RHSA-2026:37268","https://access.redhat.com/errata/RHSA-2026:37123","https://access.redhat.com/errata/RHSA-2026:37072","https://access.redhat.com/errata/RHSA-2026:36883","https://access.redhat.com/errata/RHSA-2026:36820","https://access.redhat.com/errata/RHSA-2026:36808","https://access.redhat.com/errata/RHSA-2026:36797","https://access.redhat.com/errata/RHSA-2026:36796","https://access.redhat.com/errata/RHSA-2026:36651","https://access.redhat.com/errata/RHSA-2026:37272","https://access.redhat.com/errata/RHSA-2026:37278","https://access.redhat.com/errata/RHSA-2026:37286","https://access.redhat.com/errata/RHSA-2026:37296","https://access.redhat.com/errata/RHSA-2026:37387","https://access.redhat.com/errata/RHSA-2026:40118","https://access.redhat.com/errata/RHSA-2026:40119","https://access.redhat.com/errata/RHSA-2026:40262","https://access.redhat.com/errata/RHSA-2026:40969","https://access.redhat.com/errata/RHSA-2026:40974","https://access.redhat.com/errata/RHSA-2026:40945","https://access.redhat.com/errata/RHSA-2026:40972","https://access.redhat.com/errata/RHSA-2026:41019","https://access.redhat.com/errata/RHSA-2026:41031","https://access.redhat.com/errata/RHSA-2026:41036","https://access.redhat.com/errata/RHSA-2026:41066","https://access.redhat.com/errata/RHSA-2026:41055"],"description":"golang.org/x/crypto: Invoking pathological RSA/DSA parameters may cause DoS","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-39829","epss":0.00467,"percentile":0.40443,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-39829","cwe":"CWE-347","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2026-39829","cwe":"CWE-1284","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["0.52.0"],"state":"fixed","available":[{"version":"0.52.0","date":"2026-07-07","kind":"first-observed"}]},"advisories":[],"risk":0.35024999999999995},"relatedVulnerabilities":[{"id":"CVE-2026-39829","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-39829","namespace":"nvd:cpe","severity":"High","urls":["https://go.dev/cl/781641","https://go.dev/cl/781661","https://go.dev/issue/79565","https://groups.google.com/g/golang-announce/c/a082jnz-LvI","https://pkg.go.dev/vuln/GO-2026-5018","https://access.redhat.com/errata/RHSA-2026:26546","https://access.redhat.com/errata/RHSA-2026:26547","https://access.redhat.com/errata/RHSA-2026:29455","https://access.redhat.com/errata/RHSA-2026:35833","https://access.redhat.com/errata/RHSA-2026:36199","https://access.redhat.com/errata/RHSA-2026:36207","https://access.redhat.com/errata/RHSA-2026:36319","https://access.redhat.com/errata/RHSA-2026:36625","https://access.redhat.com/errata/RHSA-2026:36648","https://access.redhat.com/errata/RHSA-2026:36651","https://access.redhat.com/errata/RHSA-2026:36796","https://access.redhat.com/errata/RHSA-2026:36797","https://access.redhat.com/errata/RHSA-2026:36808","https://access.redhat.com/errata/RHSA-2026:36820","https://access.redhat.com/errata/RHSA-2026:36883","https://access.redhat.com/errata/RHSA-2026:37072","https://access.redhat.com/errata/RHSA-2026:37123","https://access.redhat.com/errata/RHSA-2026:37268","https://access.redhat.com/errata/RHSA-2026:37271","https://access.redhat.com/errata/RHSA-2026:37272","https://access.redhat.com/errata/RHSA-2026:37278","https://access.redhat.com/errata/RHSA-2026:37286","https://access.redhat.com/errata/RHSA-2026:37296","https://access.redhat.com/errata/RHSA-2026:37387","https://access.redhat.com/errata/RHSA-2026:40118","https://access.redhat.com/errata/RHSA-2026:40262","https://access.redhat.com/errata/RHSA-2026:40945","https://access.redhat.com/errata/RHSA-2026:40969","https://access.redhat.com/errata/RHSA-2026:40972","https://access.redhat.com/errata/RHSA-2026:40974","https://access.redhat.com/errata/RHSA-2026:41019","https://access.redhat.com/errata/RHSA-2026:41031","https://access.redhat.com/errata/RHSA-2026:41036","https://access.redhat.com/errata/RHSA-2026:41055","https://access.redhat.com/errata/RHSA-2026:41066","https://access.redhat.com/errata/RHSA-2026:42146","https://access.redhat.com/errata/RHSA-2026:42796","https://access.redhat.com/errata/RHSA-2026:43052","https://access.redhat.com/errata/RHSA-2026:43692","https://access.redhat.com/errata/RHSA-2026:46885","https://access.redhat.com/errata/RHSA-2026:46903","https://access.redhat.com/errata/RHSA-2026:47735","https://access.redhat.com/errata/RHSA-2026:47949","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:48693","https://access.redhat.com/errata/RHSA-2026:49944","https://access.redhat.com/errata/RHSA-2026:51033","https://access.redhat.com/errata/RHSA-2026:52857","https://access.redhat.com/errata/RHSA-2026:52910","https://access.redhat.com/errata/RHSA-2026:54400","https://access.redhat.com/errata/RHSA-2026:54432","https://access.redhat.com/errata/RHSA-2026:57191","https://access.redhat.com/errata/RHSA-2026:57194","https://access.redhat.com/errata/RHSA-2026:57365","https://access.redhat.com/errata/RHSA-2026:57801","https://access.redhat.com/errata/RHSA-2026:59467","https://access.redhat.com/errata/RHSA-2026:59559","https://access.redhat.com/errata/RHSA-2026:59593","https://access.redhat.com/errata/RHSA-2026:60446","https://access.redhat.com/errata/RHSA-2026:60454","https://access.redhat.com/errata/RHSA-2026:60477","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/errata/RHSA-2026:61314","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:65964","https://access.redhat.com/errata/RHSA-2026:66022","https://access.redhat.com/errata/RHSA-2026:67450","https://access.redhat.com/security/cve/CVE-2026-39829","https://bugzilla.redhat.com/show_bug.cgi?id=2480681","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39829.json"],"description":"The RSA and DSA public key parsers did not enforce size limits on key parameters. A crafted public key with an excessively large modulus or DSA parameter could cause several minutes of CPU consumption during signature verification. This could be triggered by unauthenticated clients during public key authentication. RSA moduli are now limited to 8192 bits, and DSA parameters are validated per FIPS 186-2.","cvss":[{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-39829","epss":0.00467,"percentile":0.40443,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-39829","cwe":"CWE-347","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2026-39829","cwe":"CWE-1284","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"golang.org/x/crypto","version":"v0.46.0"}},"found":{"vulnerabilityID":"GHSA-w879-237q-wc7r","versionConstraint":"<0.52.0 (go)"},"fix":{"suggestedVersion":"0.52.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/crypto@v0.46.0?package-id=b3387fbedc5d73be","name":"golang.org/x/crypto","version":"v0.46.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:crypto:v0.46.0:*:*:*:*:go:*:*","cpe:2.3:a:go:ssh:v0.46.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/crypto@v0.46.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:cKRW/pmt1pKAfetfu+RCEvjvZkA9RimPbh7bhFjGVBU="}}},{"vulnerability":{"id":"GHSA-w879-237q-wc7r","dataSource":"https://github.com/advisories/GHSA-w879-237q-wc7r","namespace":"github:language:go","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-39829","https://go.dev/cl/781641","https://go.dev/cl/781661","https://go.dev/issue/79565","https://groups.google.com/g/golang-announce/c/a082jnz-LvI","https://pkg.go.dev/vuln/GO-2026-5018","https://access.redhat.com/errata/RHSA-2026:29455","https://access.redhat.com/security/cve/CVE-2026-39829","https://bugzilla.redhat.com/show_bug.cgi?id=2480681","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39829.json","https://access.redhat.com/errata/RHSA-2026:26546","https://access.redhat.com/errata/RHSA-2026:26547","https://access.redhat.com/errata/RHSA-2026:35833","https://access.redhat.com/errata/RHSA-2026:36648","https://access.redhat.com/errata/RHSA-2026:36625","https://access.redhat.com/errata/RHSA-2026:36319","https://access.redhat.com/errata/RHSA-2026:36207","https://access.redhat.com/errata/RHSA-2026:36199","https://access.redhat.com/errata/RHSA-2026:37271","https://access.redhat.com/errata/RHSA-2026:37268","https://access.redhat.com/errata/RHSA-2026:37123","https://access.redhat.com/errata/RHSA-2026:37072","https://access.redhat.com/errata/RHSA-2026:36883","https://access.redhat.com/errata/RHSA-2026:36820","https://access.redhat.com/errata/RHSA-2026:36808","https://access.redhat.com/errata/RHSA-2026:36797","https://access.redhat.com/errata/RHSA-2026:36796","https://access.redhat.com/errata/RHSA-2026:36651","https://access.redhat.com/errata/RHSA-2026:37272","https://access.redhat.com/errata/RHSA-2026:37278","https://access.redhat.com/errata/RHSA-2026:37286","https://access.redhat.com/errata/RHSA-2026:37296","https://access.redhat.com/errata/RHSA-2026:37387","https://access.redhat.com/errata/RHSA-2026:40118","https://access.redhat.com/errata/RHSA-2026:40119","https://access.redhat.com/errata/RHSA-2026:40262","https://access.redhat.com/errata/RHSA-2026:40969","https://access.redhat.com/errata/RHSA-2026:40974","https://access.redhat.com/errata/RHSA-2026:40945","https://access.redhat.com/errata/RHSA-2026:40972","https://access.redhat.com/errata/RHSA-2026:41019","https://access.redhat.com/errata/RHSA-2026:41031","https://access.redhat.com/errata/RHSA-2026:41036","https://access.redhat.com/errata/RHSA-2026:41066","https://access.redhat.com/errata/RHSA-2026:41055"],"description":"golang.org/x/crypto: Invoking pathological RSA/DSA parameters may cause DoS","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-39829","epss":0.00467,"percentile":0.40443,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-39829","cwe":"CWE-347","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2026-39829","cwe":"CWE-1284","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["0.52.0"],"state":"fixed","available":[{"version":"0.52.0","date":"2026-07-07","kind":"first-observed"}]},"advisories":[],"risk":0.35024999999999995},"relatedVulnerabilities":[{"id":"CVE-2026-39829","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-39829","namespace":"nvd:cpe","severity":"High","urls":["https://go.dev/cl/781641","https://go.dev/cl/781661","https://go.dev/issue/79565","https://groups.google.com/g/golang-announce/c/a082jnz-LvI","https://pkg.go.dev/vuln/GO-2026-5018","https://access.redhat.com/errata/RHSA-2026:26546","https://access.redhat.com/errata/RHSA-2026:26547","https://access.redhat.com/errata/RHSA-2026:29455","https://access.redhat.com/errata/RHSA-2026:35833","https://access.redhat.com/errata/RHSA-2026:36199","https://access.redhat.com/errata/RHSA-2026:36207","https://access.redhat.com/errata/RHSA-2026:36319","https://access.redhat.com/errata/RHSA-2026:36625","https://access.redhat.com/errata/RHSA-2026:36648","https://access.redhat.com/errata/RHSA-2026:36651","https://access.redhat.com/errata/RHSA-2026:36796","https://access.redhat.com/errata/RHSA-2026:36797","https://access.redhat.com/errata/RHSA-2026:36808","https://access.redhat.com/errata/RHSA-2026:36820","https://access.redhat.com/errata/RHSA-2026:36883","https://access.redhat.com/errata/RHSA-2026:37072","https://access.redhat.com/errata/RHSA-2026:37123","https://access.redhat.com/errata/RHSA-2026:37268","https://access.redhat.com/errata/RHSA-2026:37271","https://access.redhat.com/errata/RHSA-2026:37272","https://access.redhat.com/errata/RHSA-2026:37278","https://access.redhat.com/errata/RHSA-2026:37286","https://access.redhat.com/errata/RHSA-2026:37296","https://access.redhat.com/errata/RHSA-2026:37387","https://access.redhat.com/errata/RHSA-2026:40118","https://access.redhat.com/errata/RHSA-2026:40262","https://access.redhat.com/errata/RHSA-2026:40945","https://access.redhat.com/errata/RHSA-2026:40969","https://access.redhat.com/errata/RHSA-2026:40972","https://access.redhat.com/errata/RHSA-2026:40974","https://access.redhat.com/errata/RHSA-2026:41019","https://access.redhat.com/errata/RHSA-2026:41031","https://access.redhat.com/errata/RHSA-2026:41036","https://access.redhat.com/errata/RHSA-2026:41055","https://access.redhat.com/errata/RHSA-2026:41066","https://access.redhat.com/errata/RHSA-2026:42146","https://access.redhat.com/errata/RHSA-2026:42796","https://access.redhat.com/errata/RHSA-2026:43052","https://access.redhat.com/errata/RHSA-2026:43692","https://access.redhat.com/errata/RHSA-2026:46885","https://access.redhat.com/errata/RHSA-2026:46903","https://access.redhat.com/errata/RHSA-2026:47735","https://access.redhat.com/errata/RHSA-2026:47949","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:48693","https://access.redhat.com/errata/RHSA-2026:49944","https://access.redhat.com/errata/RHSA-2026:51033","https://access.redhat.com/errata/RHSA-2026:52857","https://access.redhat.com/errata/RHSA-2026:52910","https://access.redhat.com/errata/RHSA-2026:54400","https://access.redhat.com/errata/RHSA-2026:54432","https://access.redhat.com/errata/RHSA-2026:57191","https://access.redhat.com/errata/RHSA-2026:57194","https://access.redhat.com/errata/RHSA-2026:57365","https://access.redhat.com/errata/RHSA-2026:57801","https://access.redhat.com/errata/RHSA-2026:59467","https://access.redhat.com/errata/RHSA-2026:59559","https://access.redhat.com/errata/RHSA-2026:59593","https://access.redhat.com/errata/RHSA-2026:60446","https://access.redhat.com/errata/RHSA-2026:60454","https://access.redhat.com/errata/RHSA-2026:60477","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/errata/RHSA-2026:61314","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:65964","https://access.redhat.com/errata/RHSA-2026:66022","https://access.redhat.com/errata/RHSA-2026:67450","https://access.redhat.com/security/cve/CVE-2026-39829","https://bugzilla.redhat.com/show_bug.cgi?id=2480681","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39829.json"],"description":"The RSA and DSA public key parsers did not enforce size limits on key parameters. A crafted public key with an excessively large modulus or DSA parameter could cause several minutes of CPU consumption during signature verification. This could be triggered by unauthenticated clients during public key authentication. RSA moduli are now limited to 8192 bits, and DSA parameters are validated per FIPS 186-2.","cvss":[{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-39829","epss":0.00467,"percentile":0.40443,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-39829","cwe":"CWE-347","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2026-39829","cwe":"CWE-1284","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"golang.org/x/crypto","version":"v0.48.0"}},"found":{"vulnerabilityID":"GHSA-w879-237q-wc7r","versionConstraint":"<0.52.0 (go)"},"fix":{"suggestedVersion":"0.52.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/crypto@v0.48.0?package-id=764d3323ecdb54e3","name":"golang.org/x/crypto","version":"v0.48.0","type":"go-module","locations":[{"path":"/tool-imports/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:crypto:v0.48.0:*:*:*:*:go:*:*","cpe:2.3:a:go:ssh:v0.48.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/crypto@v0.48.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:/VRzVqiRSggnhY7gNRxPauEQ5Drw9haKdM0jqfcCFts="}}},{"vulnerability":{"id":"GO-2026-6629","dataSource":"https://go.dev/cl/793360","namespace":"govulndb:language:go","severity":"High","urls":["https://go.dev/issue/80112"],"description":"The Nickname profile can panic with an out-of-bounds slice error when transforming crafted input into a short destination buffer.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-56851","epss":0.00466,"percentile":0.40322,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-56851","cwe":"CWE-787","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["0.41.0"],"state":"fixed","available":[{"version":"0.41.0","date":"2026-08-11","kind":"release"}]},"advisories":[],"risk":0.3495},"relatedVulnerabilities":[{"id":"CVE-2026-56851","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56851","namespace":"nvd:cpe","severity":"High","urls":["https://go.dev/cl/793360","https://go.dev/issue/80112","https://pkg.go.dev/vuln/GO-2026-6629"],"description":"The Nickname profile can panic with an out-of-bounds slice error when transforming crafted input into a short destination buffer.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-56851","epss":0.00466,"percentile":0.40322,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-56851","cwe":"CWE-787","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"golang.org/x/text","version":"v0.33.0"}},"found":{"vulnerabilityID":"GO-2026-6629","versionConstraint":"<0.41.0 (go)"},"fix":{"suggestedVersion":"0.41.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/text@v0.33.0?package-id=ba975f34c2d5efbe","name":"golang.org/x/text","version":"v0.33.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:text:v0.33.0:*:*:*:*:*:*:*"],"purl":"pkg:golang/golang.org/x/text@v0.33.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:B3njUFyqtHDUI5jMn1YIr5B0IE2U0qck04r6d4KPAxE="}}},{"vulnerability":{"id":"GO-2026-6629","dataSource":"https://go.dev/cl/793360","namespace":"govulndb:language:go","severity":"High","urls":["https://go.dev/issue/80112"],"description":"The Nickname profile can panic with an out-of-bounds slice error when transforming crafted input into a short destination buffer.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-56851","epss":0.00466,"percentile":0.40322,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-56851","cwe":"CWE-787","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["0.41.0"],"state":"fixed","available":[{"version":"0.41.0","date":"2026-08-11","kind":"release"}]},"advisories":[],"risk":0.3495},"relatedVulnerabilities":[{"id":"CVE-2026-56851","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56851","namespace":"nvd:cpe","severity":"High","urls":["https://go.dev/cl/793360","https://go.dev/issue/80112","https://pkg.go.dev/vuln/GO-2026-6629"],"description":"The Nickname profile can panic with an out-of-bounds slice error when transforming crafted input into a short destination buffer.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-56851","epss":0.00466,"percentile":0.40322,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-56851","cwe":"CWE-787","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"golang.org/x/text","version":"v0.34.0"}},"found":{"vulnerabilityID":"GO-2026-6629","versionConstraint":"<0.41.0 (go)"},"fix":{"suggestedVersion":"0.41.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/text@v0.34.0?package-id=15ba6cd10c849c2e","name":"golang.org/x/text","version":"v0.34.0","type":"go-module","locations":[{"path":"/tool-imports/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:text:v0.34.0:*:*:*:*:*:*:*"],"purl":"pkg:golang/golang.org/x/text@v0.34.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:oL/Qq0Kdaqxa1KbNeMKwQq0reLCCaFtqu2eNuSeNHbk="}}},{"vulnerability":{"id":"GHSA-47q9-m4ww-924m","dataSource":"https://github.com/advisories/GHSA-47q9-m4ww-924m","namespace":"github:language:go","severity":"High","urls":["https://github.com/sigstore/rekor/security/advisories/GHSA-47q9-m4ww-924m"],"description":"Rekor has an OOM Condition due to Unbounded gzip Decompression in Alpine APK Parsing Logic","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-48702","epss":0.0046,"percentile":0.3989,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-48702","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.5.2"],"state":"fixed","available":[{"version":"1.5.2","date":"2026-06-26","kind":"first-observed"}]},"advisories":[],"risk":0.345},"relatedVulnerabilities":[{"id":"CVE-2026-48702","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-48702","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/sigstore/rekor/security/advisories/GHSA-47q9-m4ww-924m"],"description":"Rekor is a software supply chain transparency log. Starting in version 0.3.0 and prior to version 1.5.2, the `Package.Unmarshal()` function in `pkg/types/alpine/apk.go` decompresses the signature and control gzip members of an APK file into in-memory buffers without bounding the total decompressed size. The existing `max_apk_metadata_size` check (default 1MB) is only applied to individual tar entry header sizes after decompression completes, so it does not prevent a decompression bomb from consuming unbounded heap memory. An attacker can craft a gzip stream that compresses at a ~1000:1 ratio (e.g., 2MB compressed zeros → 2GB decompressed). When submitted as spec.package.content in an Alpine `ProposedEntry`, the server decompresses the full payload into memory during request processing, triggering a fatal Go runtime out-of-memory error or OS OOM-kill that cannot be caught by the server's recover() middleware. This is reachable via two unauthenticated endpoints, `POST /api/v1/log/entries (createLogEntry)` and `POST /api/v1/log/entries/retrieve (searchLogQuery)`. Both invoke `V001Entry.Canonicalize()` → `fetchExternalEntities()` → `apk.Unmarshal(packageData)`, which performs the unbounded decompression. Version 1.5.2 patches the issue. There is no effective workaround. Setting `max_request_body_size` reduces but does not eliminate exposure due to the ~1000:1 compression ratio (a 1MB body limit still allows ~1GB heap allocation). Setting `max_apk_metadata_size` has no effect on this vulnerability since the check is applied after decompression.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-48702","epss":0.0046,"percentile":0.3989,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-48702","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"github.com/sigstore/rekor","version":"v1.5.0"}},"found":{"vulnerabilityID":"GHSA-47q9-m4ww-924m","versionConstraint":">=0.3.0,<1.5.2 (go)"},"fix":{"suggestedVersion":"1.5.2"}}],"artifact":{"id":"pkg:golang/github.com/sigstore/rekor@v1.5.0?package-id=dfb4e3c488b3aa36","name":"github.com/sigstore/rekor","version":"v1.5.0","type":"go-module","locations":[{"path":"/tool-imports/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:sigstore:rekor:v1.5.0:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/sigstore/rekor@v1.5.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:rL7SghHd5HLCtsCrxw0yQg+NczGvM75EjSPPWuGjaiQ="}}},{"vulnerability":{"id":"GO-2026-5064","dataSource":"https://github.com/containerd/containerd/security/advisories/GHSA-33vj-92qq-66hc","namespace":"govulndb:language:go","severity":"Critical","urls":[],"description":"containerd CRI checkpoint restore CDI annotation smuggling in github.com/containerd/containerd","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","metrics":{"baseScore":9.6,"exploitabilityScore":3.2,"impactScore":5.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-53492","epss":0.00353,"percentile":0.28925,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-53492","cwe":"CWE-20","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-53492","cwe":"CWE-863","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":[],"state":""},"advisories":[],"risk":0.32829},"relatedVulnerabilities":[{"id":"CVE-2026-53492","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-53492","namespace":"nvd:cpe","severity":"Critical","urls":["https://github.com/containerd/containerd/security/advisories/GHSA-33vj-92qq-66hc"],"description":"containerd is an open-source container runtime. In Versions prior to 2.3.2, 2.2.5 and 2.1.9, the CRI implementation improperly trusts Container Device Interface (CDI) annotations found within untrusted checkpoint image metadata during container restoration. When restoring a container from a checkpoint, containerd preserves CDI-related annotations from the checkpoint archive rather than relying solely on the pod's create-time specification. This allows a user with pod creation permissions to bypass standard Kubernetes resource allocation and device plugin enforcement, injecting arbitrary CDI edits (such as device nodes and host mounts) into the restored container. Successful exploitation requires that the node has CDI enabled and contains a matching host CDI specification for the requested device; environments where CDI is disabled or lacking sensitive device specifications are not affected. This issue has been fixed in versions 2.3.2, 2.2.5 and 2.1.9.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","metrics":{"baseScore":9.6,"exploitabilityScore":3.2,"impactScore":5.8},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-53492","epss":0.00353,"percentile":0.28925,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-53492","cwe":"CWE-20","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-53492","cwe":"CWE-863","source":"security-advisories@github.com","type":"Secondary"}]},{"id":"GHSA-33vj-92qq-66hc","dataSource":"https://github.com/advisories/GHSA-33vj-92qq-66hc","namespace":"github:language:go","severity":"High","urls":["https://github.com/containerd/containerd/security/advisories/GHSA-33vj-92qq-66hc"],"description":"containerd CRI checkpoint restore CDI annotation smuggling","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:N","metrics":{"baseScore":8.4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-53492","epss":0.00353,"percentile":0.28925,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-53492","cwe":"CWE-20","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-53492","cwe":"CWE-863","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"github.com/containerd/containerd","version":"v1.7.30"}},"found":{"vulnerabilityID":"GO-2026-5064","versionConstraint":"none (unknown)"}}],"artifact":{"id":"pkg:golang/github.com/containerd/containerd@v1.7.30?package-id=f22ca3ad39ee58c2","name":"github.com/containerd/containerd","version":"v1.7.30","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:containerd:containerd:v1.7.30:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/containerd/containerd@v1.7.30","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:/2vezDpLDVGGmkUXmlNPLCCNKHJ5BbC5tJB5JNzQhqE="}}},{"vulnerability":{"id":"GO-2026-6303","dataSource":"https://go.dev/issue/80213","namespace":"govulndb:language:go","severity":"High","urls":["https://go.dev/cl/797040"],"description":"The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the PasswordCallback, KeyboardInteractiveCallback, NoClientAuthCallback, and GSSAPIWithMICConfig.AllowLogin callbacks were not validated against the client's remote address, so a source-address restriction set by those callbacks was silently ignored. The check is now applied to the Permissions returned by any authentication callback.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-56854","epss":0.00437,"percentile":0.38031,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-56854","cwe":"CWE-863","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["0.55.0"],"state":"fixed","available":[{"version":"0.55.0","date":"2026-08-11","kind":"release"}]},"advisories":[],"risk":0.32775},"relatedVulnerabilities":[{"id":"CVE-2026-56854","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56854","namespace":"nvd:cpe","severity":"High","urls":["https://go.dev/cl/797040","https://go.dev/issue/80213","https://pkg.go.dev/vuln/GO-2026-6303"],"description":"The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the PasswordCallback, KeyboardInteractiveCallback, NoClientAuthCallback, and GSSAPIWithMICConfig.AllowLogin callbacks were not validated against the client's remote address, so a source-address restriction set by those callbacks was silently ignored. The check is now applied to the Permissions returned by any authentication callback.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-56854","epss":0.00437,"percentile":0.38031,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-56854","cwe":"CWE-863","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"golang.org/x/crypto","version":"v0.46.0"}},"found":{"vulnerabilityID":"GO-2026-6303","versionConstraint":"<0.55.0 (go)"},"fix":{"suggestedVersion":"0.55.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/crypto@v0.46.0?package-id=b3387fbedc5d73be","name":"golang.org/x/crypto","version":"v0.46.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:crypto:v0.46.0:*:*:*:*:go:*:*","cpe:2.3:a:go:ssh:v0.46.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/crypto@v0.46.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:cKRW/pmt1pKAfetfu+RCEvjvZkA9RimPbh7bhFjGVBU="}}},{"vulnerability":{"id":"GO-2026-6303","dataSource":"https://go.dev/issue/80213","namespace":"govulndb:language:go","severity":"High","urls":["https://go.dev/cl/797040"],"description":"The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the PasswordCallback, KeyboardInteractiveCallback, NoClientAuthCallback, and GSSAPIWithMICConfig.AllowLogin callbacks were not validated against the client's remote address, so a source-address restriction set by those callbacks was silently ignored. The check is now applied to the Permissions returned by any authentication callback.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-56854","epss":0.00437,"percentile":0.38031,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-56854","cwe":"CWE-863","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["0.55.0"],"state":"fixed","available":[{"version":"0.55.0","date":"2026-08-11","kind":"release"}]},"advisories":[],"risk":0.32775},"relatedVulnerabilities":[{"id":"CVE-2026-56854","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56854","namespace":"nvd:cpe","severity":"High","urls":["https://go.dev/cl/797040","https://go.dev/issue/80213","https://pkg.go.dev/vuln/GO-2026-6303"],"description":"The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the PasswordCallback, KeyboardInteractiveCallback, NoClientAuthCallback, and GSSAPIWithMICConfig.AllowLogin callbacks were not validated against the client's remote address, so a source-address restriction set by those callbacks was silently ignored. The check is now applied to the Permissions returned by any authentication callback.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-56854","epss":0.00437,"percentile":0.38031,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-56854","cwe":"CWE-863","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"golang.org/x/crypto","version":"v0.48.0"}},"found":{"vulnerabilityID":"GO-2026-6303","versionConstraint":"<0.55.0 (go)"},"fix":{"suggestedVersion":"0.55.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/crypto@v0.48.0?package-id=764d3323ecdb54e3","name":"golang.org/x/crypto","version":"v0.48.0","type":"go-module","locations":[{"path":"/tool-imports/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:crypto:v0.48.0:*:*:*:*:go:*:*","cpe:2.3:a:go:ssh:v0.48.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/crypto@v0.48.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:/VRzVqiRSggnhY7gNRxPauEQ5Drw9haKdM0jqfcCFts="}}},{"vulnerability":{"id":"GO-2026-6354","dataSource":"https://go.dev/issue/81316","namespace":"govulndb:language:go","severity":"High","urls":["https://go.dev/cl/826504","https://groups.google.com/g/golang-announce/c/1y3fb2np35U"],"description":"Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection.\n\nNow, we add an atomic established state, set when a channel becomes usable. Until such a time, handlePacket drops every packet other than the open confirmation/failure, without blocking and without tearing down the connection.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-78662","epss":0.00431,"percentile":0.37397,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-78662","cwe":"CWE-770","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["0.56.0"],"state":"fixed","available":[{"version":"0.56.0","date":"2026-09-02","kind":"release"}]},"advisories":[],"risk":0.32325},"relatedVulnerabilities":[{"id":"CVE-2026-78662","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78662","namespace":"nvd:cpe","severity":"High","urls":["https://go.dev/cl/826504","https://go.dev/issue/81316","https://groups.google.com/g/golang-announce/c/1y3fb2np35U","https://pkg.go.dev/vuln/GO-2026-6354"],"description":"Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection. Now, we add an atomic established state, set when a channel becomes usable. Until such a time, handlePacket drops every packet other than the open confirmation/failure, without blocking and without tearing down the connection.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-78662","epss":0.00431,"percentile":0.37397,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-78662","cwe":"CWE-770","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"golang.org/x/crypto","version":"v0.46.0"}},"found":{"vulnerabilityID":"GO-2026-6354","versionConstraint":"<0.56.0 (go)"},"fix":{"suggestedVersion":"0.56.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/crypto@v0.46.0?package-id=b3387fbedc5d73be","name":"golang.org/x/crypto","version":"v0.46.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:crypto:v0.46.0:*:*:*:*:go:*:*","cpe:2.3:a:go:ssh:v0.46.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/crypto@v0.46.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:cKRW/pmt1pKAfetfu+RCEvjvZkA9RimPbh7bhFjGVBU="}}},{"vulnerability":{"id":"GO-2026-6354","dataSource":"https://go.dev/issue/81316","namespace":"govulndb:language:go","severity":"High","urls":["https://go.dev/cl/826504","https://groups.google.com/g/golang-announce/c/1y3fb2np35U"],"description":"Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection.\n\nNow, we add an atomic established state, set when a channel becomes usable. Until such a time, handlePacket drops every packet other than the open confirmation/failure, without blocking and without tearing down the connection.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-78662","epss":0.00431,"percentile":0.37397,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-78662","cwe":"CWE-770","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["0.56.0"],"state":"fixed","available":[{"version":"0.56.0","date":"2026-09-02","kind":"release"}]},"advisories":[],"risk":0.32325},"relatedVulnerabilities":[{"id":"CVE-2026-78662","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78662","namespace":"nvd:cpe","severity":"High","urls":["https://go.dev/cl/826504","https://go.dev/issue/81316","https://groups.google.com/g/golang-announce/c/1y3fb2np35U","https://pkg.go.dev/vuln/GO-2026-6354"],"description":"Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection. Now, we add an atomic established state, set when a channel becomes usable. Until such a time, handlePacket drops every packet other than the open confirmation/failure, without blocking and without tearing down the connection.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-78662","epss":0.00431,"percentile":0.37397,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-78662","cwe":"CWE-770","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"golang.org/x/crypto","version":"v0.48.0"}},"found":{"vulnerabilityID":"GO-2026-6354","versionConstraint":"<0.56.0 (go)"},"fix":{"suggestedVersion":"0.56.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/crypto@v0.48.0?package-id=764d3323ecdb54e3","name":"golang.org/x/crypto","version":"v0.48.0","type":"go-module","locations":[{"path":"/tool-imports/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:crypto:v0.48.0:*:*:*:*:go:*:*","cpe:2.3:a:go:ssh:v0.48.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/crypto@v0.48.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:/VRzVqiRSggnhY7gNRxPauEQ5Drw9haKdM0jqfcCFts="}}},{"vulnerability":{"id":"GO-2026-6610","dataSource":"https://go.dev/cl/835145","namespace":"govulndb:language:go","severity":"High","urls":["https://go.dev/cl/836385","https://go.dev/issue/81115","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI"],"description":"Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a reverse proxy. If the HTTP/1 client also does not behave strictly enough, this can result in response smuggling.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-78660","epss":0.00425,"percentile":0.36847,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-78660","cwe":"CWE-444","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["0.60.0"],"state":"fixed","available":[{"version":"0.60.0","date":"2026-10-08","kind":"release"}]},"advisories":[],"risk":0.31875000000000003},"relatedVulnerabilities":[{"id":"CVE-2026-78660","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78660","namespace":"nvd:cpe","severity":"High","urls":["https://go.dev/cl/835145","https://go.dev/cl/836385","https://go.dev/issue/81115","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://pkg.go.dev/vuln/GO-2026-6610"],"description":"Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a reverse proxy. If the HTTP/1 client also does not behave strictly enough, this can result in response smuggling.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-78660","epss":0.00425,"percentile":0.36847,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-78660","cwe":"CWE-444","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"golang.org/x/net","version":"v0.48.0"}},"found":{"vulnerabilityID":"GO-2026-6610","versionConstraint":"<0.60.0 (go)"},"fix":{"suggestedVersion":"0.60.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/net@v0.48.0?package-id=7e3c0e57ff3d79d8","name":"golang.org/x/net","version":"v0.48.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:networking:v0.48.0:*:*:*:*:go:*:*","cpe:2.3:a:golang:net:v0.48.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/net@v0.48.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:zyQRTTrjc33Lhh0fBgT/H3oZq9WuvRR5gPC70xpDiQU="}}},{"vulnerability":{"id":"GO-2026-6610","dataSource":"https://go.dev/cl/835145","namespace":"govulndb:language:go","severity":"High","urls":["https://go.dev/cl/836385","https://go.dev/issue/81115","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI"],"description":"Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a reverse proxy. If the HTTP/1 client also does not behave strictly enough, this can result in response smuggling.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-78660","epss":0.00425,"percentile":0.36847,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-78660","cwe":"CWE-444","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["0.60.0"],"state":"fixed","available":[{"version":"0.60.0","date":"2026-10-08","kind":"release"}]},"advisories":[],"risk":0.31875000000000003},"relatedVulnerabilities":[{"id":"CVE-2026-78660","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78660","namespace":"nvd:cpe","severity":"High","urls":["https://go.dev/cl/835145","https://go.dev/cl/836385","https://go.dev/issue/81115","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://pkg.go.dev/vuln/GO-2026-6610"],"description":"Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a reverse proxy. If the HTTP/1 client also does not behave strictly enough, this can result in response smuggling.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-78660","epss":0.00425,"percentile":0.36847,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-78660","cwe":"CWE-444","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"golang.org/x/net","version":"v0.50.0"}},"found":{"vulnerabilityID":"GO-2026-6610","versionConstraint":"<0.60.0 (go)"},"fix":{"suggestedVersion":"0.60.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/net@v0.50.0?package-id=a205ae7dff8c80d8","name":"golang.org/x/net","version":"v0.50.0","type":"go-module","locations":[{"path":"/tool-imports/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:networking:v0.50.0:*:*:*:*:go:*:*","cpe:2.3:a:golang:net:v0.50.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/net@v0.50.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:ucWh9eiCGyDR3vtzso0WMQinm2Dnt8cFMuQa9K33J60="}}},{"vulnerability":{"id":"GHSA-fxhp-mv3v-67qp","dataSource":"https://github.com/advisories/GHSA-fxhp-mv3v-67qp","namespace":"github:language:go","severity":"High","urls":["https://github.com/oras-project/oras-go/security/advisories/GHSA-fxhp-mv3v-67qp","https://github.com/oras-project/oras-go/commit/b11f777f8d405c5023c4b307cfdc5068dfc3d406","https://nvd.nist.gov/vuln/detail/CVE-2026-50163","https://github.com/oras-project/oras-go/pull/1232","https://github.com/oras-project/oras-go/commit/c463c654ab3ef34422c1764cd619806cebf20451","https://github.com/oras-project/oras-go/releases/tag/v2.6.2"],"description":"`oras-go` tar extraction: Hardlink entry with relative Linkname escapes extract dir via process CWD resolution","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N","metrics":{"baseScore":7.1,"exploitabilityScore":2.9,"impactScore":4.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-50163","epss":0.00403,"percentile":0.34559,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-50163","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-50163","cwe":"CWE-59","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["2.6.2"],"state":"fixed","available":[{"version":"2.6.2","date":"2026-08-05","kind":"first-observed"}]},"advisories":[],"risk":0.29419},"relatedVulnerabilities":[{"id":"CVE-2026-50163","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-50163","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/oras-project/oras-go/commit/c463c654ab3ef34422c1764cd619806cebf20451","https://github.com/oras-project/oras-go/pull/1232","https://github.com/oras-project/oras-go/releases/tag/v2.6.2","https://github.com/oras-project/oras-go/security/advisories/GHSA-fxhp-mv3v-67qp"],"description":"oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, ensureLinkPath in content/file/utils.go:262-275 validates a hardlink target relative to the extract base but returns the unresolved target, causing os.Link(\"victim.secret\", \"<extract_base>/payload.tar.gz/evil_cwd_link\") to resolve header.Linkname against the process current working directory for a Typeflag=TypeLink entry such as Name=payload.tar.gz/evil_cwd_link and Linkname=\"victim.secret\" with io.deis.oras.content.unpack: \"true\", which can expose or tamper with files such as .env, .git/config, .aws/credentials, and ~/.ssh/config. This issue is fixed in version 2.6.2.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N","metrics":{"baseScore":7.1,"exploitabilityScore":2.9,"impactScore":4.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-50163","epss":0.00403,"percentile":0.34559,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-50163","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-50163","cwe":"CWE-59","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"oras.land/oras-go/v2","version":"v2.6.0"}},"found":{"vulnerabilityID":"GHSA-fxhp-mv3v-67qp","versionConstraint":"<=2.6.1 (go)"},"fix":{"suggestedVersion":"2.6.2"}}],"artifact":{"id":"pkg:golang/oras.land/oras-go/v2@v2.6.0?package-id=016c318c2b8258c2","name":"oras.land/oras-go/v2","version":"v2.6.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:linuxfoundation:oras:v2.6.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/oras.land/oras-go/v2@v2.6.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:X4ELRsiGkrbeox69+9tzTu492FMUu7zJQW6eJU+I2oc="}}},{"vulnerability":{"id":"GHSA-jxpm-75mh-9fp7","dataSource":"https://github.com/advisories/GHSA-jxpm-75mh-9fp7","namespace":"github:language:go","severity":"High","urls":["https://github.com/oras-project/oras-go/security/advisories/GHSA-jxpm-75mh-9fp7","https://github.com/oras-project/oras-go/pull/1152","https://github.com/oras-project/oras-go/commit/4683c46ef078091544f5f55fd25102f002806991","https://github.com/oras-project/oras-go/releases/tag/v2.6.1"],"description":"oras-go blob upload vulnerable to credential forwarding via unvalidated Location header","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-50151","epss":0.00382,"percentile":0.32256,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-50151","cwe":"CWE-918","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["2.6.1"],"state":"fixed","available":[{"version":"2.6.1","date":"2026-07-02","kind":"first-observed"}]},"advisories":[],"risk":0.2865},"relatedVulnerabilities":[{"id":"CVE-2026-50151","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-50151","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/oras-project/oras-go/commit/4683c46ef078091544f5f55fd25102f002806991","https://github.com/oras-project/oras-go/pull/1152","https://github.com/oras-project/oras-go/releases/tag/v2.6.1","https://github.com/oras-project/oras-go/security/advisories/GHSA-jxpm-75mh-9fp7"],"description":"oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, registry/remote/repository.go in blobStore.completePushAfterInitialPost follows a registry-controlled Location header during monolithic blob upload and reuses the Authorization header from the initial POST request for the subsequent PUT request, allowing a malicious registry to return a cross-host Location and receive the caller's credentials at an attacker-controlled endpoint. This issue is fixed in version 2.6.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-50151","epss":0.00382,"percentile":0.32256,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-50151","cwe":"CWE-918","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"oras.land/oras-go/v2","version":"v2.6.0"}},"found":{"vulnerabilityID":"GHSA-jxpm-75mh-9fp7","versionConstraint":"<2.6.1 (go)"},"fix":{"suggestedVersion":"2.6.1"}}],"artifact":{"id":"pkg:golang/oras.land/oras-go/v2@v2.6.0?package-id=016c318c2b8258c2","name":"oras.land/oras-go/v2","version":"v2.6.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:linuxfoundation:oras:v2.6.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/oras.land/oras-go/v2@v2.6.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:X4ELRsiGkrbeox69+9tzTu492FMUu7zJQW6eJU+I2oc="}}},{"vulnerability":{"id":"GO-2026-5338","dataSource":"https://github.com/containerd/containerd/security/advisories/GHSA-cvxm-645q-p574","namespace":"govulndb:language:go","severity":"Critical","urls":[],"description":"containerd: CRI checkpoint import allows local image tag poisoning in github.com/containerd/containerd","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.9,"exploitabilityScore":3.2,"impactScore":6.1},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-50195","epss":0.00303,"percentile":0.23137,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-50195","cwe":"CWE-345","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-50195","cwe":"CWE-829","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":[],"state":""},"advisories":[],"risk":0.286335},"relatedVulnerabilities":[{"id":"CVE-2026-50195","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-50195","namespace":"nvd:cpe","severity":"Critical","urls":["https://github.com/containerd/containerd/security/advisories/GHSA-cvxm-645q-p574"],"description":"containerd is an open-source container runtime. Versions prior to 2.3.2, 2.2.5 and 2.1.9 contain a vulnerability in the CRI checkpoint import process where it fails to validate the image references specified within a checkpoint image's configuration. An attacker with permissions to create pods can use a crafted checkpoint image to force containerd to pull a malicious image and assign it an arbitrary local tag, thereby poisoning the node's local image cache. Subsequently, if other pods on the same node attempt to use the poisoned tag with an IfNotPresent (or Never) pull policy, they will unknowingly execute the attacker's malicious image instead of the legitimate one. This can lead to a compromise of the affected pods, allowing the attacker to execute arbitrary code under the victim pod's identity. This issue has been fixed in versions 2.3.2, 2.2.5 and 2.1.9.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.9,"exploitabilityScore":3.2,"impactScore":6.1},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-50195","epss":0.00303,"percentile":0.23137,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-50195","cwe":"CWE-345","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-50195","cwe":"CWE-829","source":"security-advisories@github.com","type":"Primary"}]},{"id":"GHSA-cvxm-645q-p574","dataSource":"https://github.com/advisories/GHSA-cvxm-645q-p574","namespace":"github:language:go","severity":"Medium","urls":["https://github.com/containerd/containerd/security/advisories/GHSA-cvxm-645q-p574","https://nvd.nist.gov/vuln/detail/CVE-2026-50195"],"description":"containerd: CRI checkpoint import allows local image tag poisoning","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.9,"exploitabilityScore":3.2,"impactScore":6.1},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:H/SI:H/SA:L","metrics":{"baseScore":5.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-50195","epss":0.00303,"percentile":0.23137,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-50195","cwe":"CWE-345","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-50195","cwe":"CWE-829","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"github.com/containerd/containerd","version":"v1.7.30"}},"found":{"vulnerabilityID":"GO-2026-5338","versionConstraint":"none (unknown)"}}],"artifact":{"id":"pkg:golang/github.com/containerd/containerd@v1.7.30?package-id=f22ca3ad39ee58c2","name":"github.com/containerd/containerd","version":"v1.7.30","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:containerd:containerd:v1.7.30:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/containerd/containerd@v1.7.30","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:/2vezDpLDVGGmkUXmlNPLCCNKHJ5BbC5tJB5JNzQhqE="}}},{"vulnerability":{"id":"GHSA-mgcc-cww5-fp2q","dataSource":"https://github.com/advisories/GHSA-mgcc-cww5-fp2q","namespace":"github:language:go","severity":"High","urls":["https://github.com/go-jose/go-jose/security/advisories/GHSA-mgcc-cww5-fp2q","https://nvd.nist.gov/vuln/detail/CVE-2026-116587","https://github.com/go-jose/go-jose/commit/a0111f82742fa92bceec9ede40845e73319e6230","https://github.com/go-jose/go-jose/releases/tag/v4.1.6"],"description":"Go JOSE: DoS when parsing JWKs that contain RSA keys","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-116587","epss":0.00366,"percentile":0.30486,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-116587","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-116587","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.1.6"],"state":"fixed","available":[{"version":"4.1.6","date":"2026-10-28","kind":"first-observed"}]},"advisories":[],"risk":0.2745},"relatedVulnerabilities":[{"id":"CVE-2026-116587","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116587","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/go-jose/go-jose/commit/a0111f82742fa92bceec9ede40845e73319e6230","https://github.com/go-jose/go-jose/releases/tag/v4.1.6","https://github.com/go-jose/go-jose/security/advisories/GHSA-mgcc-cww5-fp2q"],"description":"Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.6, go-jose parses attacker-controlled RSA modulus and prime values from JWKs without enforcing size and consistency bounds before passing them to crypto/rsa.PrivateKey.Validate. On Go 1.24 and later, crafted large or degenerate RSA parameters can make that validation consume cubic CPU time, allowing remote denial of service in applications that parse JWKs from untrusted sources. This issue is fixed in version 4.1.6.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-116587","epss":0.00366,"percentile":0.30486,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-116587","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-116587","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"github.com/go-jose/go-jose/v4","version":"v4.1.3"}},"found":{"vulnerabilityID":"GHSA-mgcc-cww5-fp2q","versionConstraint":"<=4.1.5 (go)"},"fix":{"suggestedVersion":"4.1.6"}}],"artifact":{"id":"pkg:golang/github.com/go-jose/go-jose/v4@v4.1.3?package-id=4c794cc45b14cae8","name":"github.com/go-jose/go-jose/v4","version":"v4.1.3","type":"go-module","locations":[{"path":"/tool-imports/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:go-jose:go-jose\\/v4:v4.1.3:*:*:*:*:*:*:*","cpe:2.3:a:go-jose:go_jose\\/v4:v4.1.3:*:*:*:*:*:*:*","cpe:2.3:a:go_jose:go-jose\\/v4:v4.1.3:*:*:*:*:*:*:*","cpe:2.3:a:go_jose:go_jose\\/v4:v4.1.3:*:*:*:*:*:*:*","cpe:2.3:a:go:go-jose\\/v4:v4.1.3:*:*:*:*:*:*:*","cpe:2.3:a:go:go_jose\\/v4:v4.1.3:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/go-jose/go-jose/v4@v4.1.3","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:CVLmWDhDVRa6Mi/IgCgaopNosCaHz7zrMeF9MlZRkrs="}}},{"vulnerability":{"id":"GHSA-hc8v-wwc9-vgxm","dataSource":"https://github.com/advisories/GHSA-hc8v-wwc9-vgxm","namespace":"github:language:go","severity":"High","urls":["https://github.com/go-git/go-git/security/advisories/GHSA-hc8v-wwc9-vgxm","https://github.com/go-git/go-git/commit/008a78f2dd86f52544ddff8b8e8ddeecdf3f7aab","https://github.com/go-git/go-git/commit/661d1c7f101d34e002a3cfcf8dbea5b7421d07ac","https://github.com/go-git/go-git/releases/tag/v5.19.2","https://github.com/go-git/go-git/releases/tag/v6.0.0-alpha.5"],"description":"go-git: Worktree operations may follow symlinks","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L","metrics":{"baseScore":7.1,"exploitabilityScore":2.9,"impactScore":4.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-71556","epss":0.00357,"percentile":0.29471,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-71556","cwe":"CWE-59","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["5.19.2"],"state":"fixed","available":[{"version":"5.19.2","date":"2026-08-08","kind":"first-observed"}]},"advisories":[],"risk":0.26060999999999995},"relatedVulnerabilities":[{"id":"CVE-2026-71556","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-71556","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/go-git/go-git/commit/008a78f2dd86f52544ddff8b8e8ddeecdf3f7aab","https://github.com/go-git/go-git/commit/661d1c7f101d34e002a3cfcf8dbea5b7421d07ac","https://github.com/go-git/go-git/releases/tag/v5.19.2","https://github.com/go-git/go-git/releases/tag/v6.0.0-alpha.5","https://github.com/go-git/go-git/security/advisories/GHSA-hc8v-wwc9-vgxm"],"description":"go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, worktree operations (including checkout, status, and add) resolve symbolic links inside the working tree without confining resolution to the worktree boundary, so a maliciously crafted repository containing a symlink can cause go-git to read from or write to files outside the intended working directory when the repository is cloned and its worktree operations are used. Versions 5.19.2 and 6.0.0-alpha.5.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L","metrics":{"baseScore":7.1,"exploitabilityScore":2.9,"impactScore":4.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-71556","epss":0.00357,"percentile":0.29471,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-71556","cwe":"CWE-59","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"github.com/go-git/go-git/v5","version":"v5.16.5"}},"found":{"vulnerabilityID":"GHSA-hc8v-wwc9-vgxm","versionConstraint":"<=5.19.1 (go)"},"fix":{"suggestedVersion":"5.19.2"}}],"artifact":{"id":"pkg:golang/github.com/go-git/go-git/v5@v5.16.5?package-id=0c14767230083f4a","name":"github.com/go-git/go-git/v5","version":"v5.16.5","type":"go-module","locations":[{"path":"/tool-imports/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:go-git:go-git\\/v5:v5.16.5:*:*:*:*:*:*:*","cpe:2.3:a:go-git:go_git\\/v5:v5.16.5:*:*:*:*:*:*:*","cpe:2.3:a:go_git:go-git\\/v5:v5.16.5:*:*:*:*:*:*:*","cpe:2.3:a:go_git:go_git\\/v5:v5.16.5:*:*:*:*:*:*:*","cpe:2.3:a:go:go-git\\/v5:v5.16.5:*:*:*:*:*:*:*","cpe:2.3:a:go:go_git\\/v5:v5.16.5:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/go-git/go-git/v5@v5.16.5","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:mdkuqblwr57kVfXri5TTH+nMFLNUxIj9Z7F5ykFbw5s="}}},{"vulnerability":{"id":"GHSA-8xwf-rjm4-xvhv","dataSource":"https://github.com/advisories/GHSA-8xwf-rjm4-xvhv","namespace":"github:language:go","severity":"Medium","urls":["https://github.com/oras-project/oras-go/security/advisories/GHSA-8xwf-rjm4-xvhv","https://github.com/oras-project/oras-go/commit/cc323e564d90c6b5b4bdd71d3c8d2ee2713b37e5"],"description":"oras-go has file store write outside workingDir via symlink traversal","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-50162","epss":0.00437,"percentile":0.37989,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-50162","cwe":"CWE-73","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["2.6.1"],"state":"fixed","available":[{"version":"2.6.1","date":"2026-07-02","kind":"first-observed"}]},"advisories":[],"risk":0.260015},"relatedVulnerabilities":[{"id":"CVE-2026-50162","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-50162","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/oras-project/oras-go/commit/cc323e564d90c6b5b4bdd71d3c8d2ee2713b37e5","https://github.com/oras-project/oras-go/releases/tag/v2.6.1","https://github.com/oras-project/oras-go/security/advisories/GHSA-8xwf-rjm4-xvhv"],"description":"oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, resolveWritePath() in content/file/file.go uses a lexical filepath.Rel check for workingDir and does not account for symlink traversal, so when AllowPathTraversalOnWrite=false an attacker-controlled blob title through ocispec.AnnotationTitle such as out/pwn.txt can follow a workingDir symlink out -> /some/outside/dir and cause pushFile() to create /some/outside/dir/pwn.txt outside workingDir. This issue is fixed in version 2.6.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-50162","epss":0.00437,"percentile":0.37989,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-50162","cwe":"CWE-73","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"oras.land/oras-go/v2","version":"v2.6.0"}},"found":{"vulnerabilityID":"GHSA-8xwf-rjm4-xvhv","versionConstraint":"<2.6.1 (go)"},"fix":{"suggestedVersion":"2.6.1"}}],"artifact":{"id":"pkg:golang/oras.land/oras-go/v2@v2.6.0?package-id=016c318c2b8258c2","name":"oras.land/oras-go/v2","version":"v2.6.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:linuxfoundation:oras:v2.6.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/oras.land/oras-go/v2@v2.6.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:X4ELRsiGkrbeox69+9tzTu492FMUu7zJQW6eJU+I2oc="}}},{"vulnerability":{"id":"GHSA-78mq-xcr3-xm33","dataSource":"https://github.com/advisories/GHSA-78mq-xcr3-xm33","namespace":"github:language:go","severity":"Medium","urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-39835","https://go.dev/cl/781660","https://go.dev/issue/79563","https://groups.google.com/g/golang-announce/c/a082jnz-LvI","https://pkg.go.dev/vuln/GO-2026-5015","https://access.redhat.com/security/cve/CVE-2026-39835","https://bugzilla.redhat.com/show_bug.cgi?id=2480680","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39835.json","https://access.redhat.com/errata/RHSA-2026:26546","https://access.redhat.com/errata/RHSA-2026:26547","https://access.redhat.com/errata/RHSA-2026:36199","https://access.redhat.com/errata/RHSA-2026:36207","https://access.redhat.com/errata/RHSA-2026:36319","https://access.redhat.com/errata/RHSA-2026:36625","https://access.redhat.com/errata/RHSA-2026:36648","https://access.redhat.com/errata/RHSA-2026:37271","https://access.redhat.com/errata/RHSA-2026:37268","https://access.redhat.com/errata/RHSA-2026:37123","https://access.redhat.com/errata/RHSA-2026:37072","https://access.redhat.com/errata/RHSA-2026:36797","https://access.redhat.com/errata/RHSA-2026:36796","https://access.redhat.com/errata/RHSA-2026:36651","https://access.redhat.com/errata/RHSA-2026:37410","https://access.redhat.com/errata/RHSA-2026:37387","https://access.redhat.com/errata/RHSA-2026:37296","https://access.redhat.com/errata/RHSA-2026:37286","https://access.redhat.com/errata/RHSA-2026:37272","https://access.redhat.com/errata/RHSA-2026:38504","https://access.redhat.com/errata/RHSA-2026:40974","https://access.redhat.com/errata/RHSA-2026:40969","https://access.redhat.com/errata/RHSA-2026:40262","https://access.redhat.com/errata/RHSA-2026:40118","https://access.redhat.com/errata/RHSA-2026:40945","https://access.redhat.com/errata/RHSA-2026:40972","https://access.redhat.com/errata/RHSA-2026:41019","https://access.redhat.com/errata/RHSA-2026:41031","https://access.redhat.com/errata/RHSA-2026:41036","https://access.redhat.com/errata/RHSA-2026:41066","https://access.redhat.com/errata/RHSA-2026:42146","https://access.redhat.com/errata/RHSA-2026:42796","https://access.redhat.com/errata/RHSA-2026:43052","https://access.redhat.com/errata/RHSA-2026:43692","https://access.redhat.com/errata/RHSA-2026:46885","https://access.redhat.com/errata/RHSA-2026:47735","https://access.redhat.com/errata/RHSA-2026:47949","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:51033","https://access.redhat.com/errata/RHSA-2026:51038","https://access.redhat.com/errata/RHSA-2026:52857","https://access.redhat.com/errata/RHSA-2026:52910","https://access.redhat.com/errata/RHSA-2026:51036","https://access.redhat.com/errata/RHSA-2026:54525","https://access.redhat.com/errata/RHSA-2026:57194","https://access.redhat.com/errata/RHSA-2026:59467","https://access.redhat.com/errata/RHSA-2026:59593","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/errata/RHSA-2026:62260","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:66022","https://access.redhat.com/errata/RHSA-2026:66521"],"description":"golang.org/x/crypto is vulnerable to invoking server panic during CheckHostKey/Authenticate flow","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-39835","epss":0.00504,"percentile":0.43093,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-39835","cwe":"CWE-295","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2026-39835","cwe":"CWE-476","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["0.52.0"],"state":"fixed","available":[{"version":"0.52.0","date":"2026-07-07","kind":"first-observed"}]},"advisories":[],"risk":0.25956},"relatedVulnerabilities":[{"id":"CVE-2026-39835","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-39835","namespace":"nvd:cpe","severity":"High","urls":["https://go.dev/cl/781660","https://go.dev/issue/79563","https://groups.google.com/g/golang-announce/c/a082jnz-LvI","https://pkg.go.dev/vuln/GO-2026-5015","https://access.redhat.com/errata/RHSA-2026:26546","https://access.redhat.com/errata/RHSA-2026:26547","https://access.redhat.com/errata/RHSA-2026:36199","https://access.redhat.com/errata/RHSA-2026:36207","https://access.redhat.com/errata/RHSA-2026:36319","https://access.redhat.com/errata/RHSA-2026:36625","https://access.redhat.com/errata/RHSA-2026:36648","https://access.redhat.com/errata/RHSA-2026:36651","https://access.redhat.com/errata/RHSA-2026:36796","https://access.redhat.com/errata/RHSA-2026:36797","https://access.redhat.com/errata/RHSA-2026:37072","https://access.redhat.com/errata/RHSA-2026:37123","https://access.redhat.com/errata/RHSA-2026:37268","https://access.redhat.com/errata/RHSA-2026:37271","https://access.redhat.com/errata/RHSA-2026:37272","https://access.redhat.com/errata/RHSA-2026:37286","https://access.redhat.com/errata/RHSA-2026:37296","https://access.redhat.com/errata/RHSA-2026:37387","https://access.redhat.com/errata/RHSA-2026:37410","https://access.redhat.com/errata/RHSA-2026:38504","https://access.redhat.com/errata/RHSA-2026:40118","https://access.redhat.com/errata/RHSA-2026:40262","https://access.redhat.com/errata/RHSA-2026:40945","https://access.redhat.com/errata/RHSA-2026:40969","https://access.redhat.com/errata/RHSA-2026:40972","https://access.redhat.com/errata/RHSA-2026:40974","https://access.redhat.com/errata/RHSA-2026:41019","https://access.redhat.com/errata/RHSA-2026:41031","https://access.redhat.com/errata/RHSA-2026:41036","https://access.redhat.com/errata/RHSA-2026:41066","https://access.redhat.com/errata/RHSA-2026:42146","https://access.redhat.com/errata/RHSA-2026:42796","https://access.redhat.com/errata/RHSA-2026:43052","https://access.redhat.com/errata/RHSA-2026:43692","https://access.redhat.com/errata/RHSA-2026:46885","https://access.redhat.com/errata/RHSA-2026:47735","https://access.redhat.com/errata/RHSA-2026:47949","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:51033","https://access.redhat.com/errata/RHSA-2026:51036","https://access.redhat.com/errata/RHSA-2026:51038","https://access.redhat.com/errata/RHSA-2026:52857","https://access.redhat.com/errata/RHSA-2026:52910","https://access.redhat.com/errata/RHSA-2026:54525","https://access.redhat.com/errata/RHSA-2026:57194","https://access.redhat.com/errata/RHSA-2026:59467","https://access.redhat.com/errata/RHSA-2026:59593","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/errata/RHSA-2026:62260","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:66022","https://access.redhat.com/errata/RHSA-2026:66521","https://access.redhat.com/security/cve/CVE-2026-39835","https://bugzilla.redhat.com/show_bug.cgi?id=2480680","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39835.json"],"description":"SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate. CertChecker now returns an error instead of panicking when these callbacks are nil.","cvss":[{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-39835","epss":0.00504,"percentile":0.43093,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-39835","cwe":"CWE-295","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2026-39835","cwe":"CWE-476","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"golang.org/x/crypto","version":"v0.46.0"}},"found":{"vulnerabilityID":"GHSA-78mq-xcr3-xm33","versionConstraint":"<0.52.0 (go)"},"fix":{"suggestedVersion":"0.52.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/crypto@v0.46.0?package-id=b3387fbedc5d73be","name":"golang.org/x/crypto","version":"v0.46.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:crypto:v0.46.0:*:*:*:*:go:*:*","cpe:2.3:a:go:ssh:v0.46.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/crypto@v0.46.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:cKRW/pmt1pKAfetfu+RCEvjvZkA9RimPbh7bhFjGVBU="}}},{"vulnerability":{"id":"GHSA-78mq-xcr3-xm33","dataSource":"https://github.com/advisories/GHSA-78mq-xcr3-xm33","namespace":"github:language:go","severity":"Medium","urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-39835","https://go.dev/cl/781660","https://go.dev/issue/79563","https://groups.google.com/g/golang-announce/c/a082jnz-LvI","https://pkg.go.dev/vuln/GO-2026-5015","https://access.redhat.com/security/cve/CVE-2026-39835","https://bugzilla.redhat.com/show_bug.cgi?id=2480680","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39835.json","https://access.redhat.com/errata/RHSA-2026:26546","https://access.redhat.com/errata/RHSA-2026:26547","https://access.redhat.com/errata/RHSA-2026:36199","https://access.redhat.com/errata/RHSA-2026:36207","https://access.redhat.com/errata/RHSA-2026:36319","https://access.redhat.com/errata/RHSA-2026:36625","https://access.redhat.com/errata/RHSA-2026:36648","https://access.redhat.com/errata/RHSA-2026:37271","https://access.redhat.com/errata/RHSA-2026:37268","https://access.redhat.com/errata/RHSA-2026:37123","https://access.redhat.com/errata/RHSA-2026:37072","https://access.redhat.com/errata/RHSA-2026:36797","https://access.redhat.com/errata/RHSA-2026:36796","https://access.redhat.com/errata/RHSA-2026:36651","https://access.redhat.com/errata/RHSA-2026:37410","https://access.redhat.com/errata/RHSA-2026:37387","https://access.redhat.com/errata/RHSA-2026:37296","https://access.redhat.com/errata/RHSA-2026:37286","https://access.redhat.com/errata/RHSA-2026:37272","https://access.redhat.com/errata/RHSA-2026:38504","https://access.redhat.com/errata/RHSA-2026:40974","https://access.redhat.com/errata/RHSA-2026:40969","https://access.redhat.com/errata/RHSA-2026:40262","https://access.redhat.com/errata/RHSA-2026:40118","https://access.redhat.com/errata/RHSA-2026:40945","https://access.redhat.com/errata/RHSA-2026:40972","https://access.redhat.com/errata/RHSA-2026:41019","https://access.redhat.com/errata/RHSA-2026:41031","https://access.redhat.com/errata/RHSA-2026:41036","https://access.redhat.com/errata/RHSA-2026:41066","https://access.redhat.com/errata/RHSA-2026:42146","https://access.redhat.com/errata/RHSA-2026:42796","https://access.redhat.com/errata/RHSA-2026:43052","https://access.redhat.com/errata/RHSA-2026:43692","https://access.redhat.com/errata/RHSA-2026:46885","https://access.redhat.com/errata/RHSA-2026:47735","https://access.redhat.com/errata/RHSA-2026:47949","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:51033","https://access.redhat.com/errata/RHSA-2026:51038","https://access.redhat.com/errata/RHSA-2026:52857","https://access.redhat.com/errata/RHSA-2026:52910","https://access.redhat.com/errata/RHSA-2026:51036","https://access.redhat.com/errata/RHSA-2026:54525","https://access.redhat.com/errata/RHSA-2026:57194","https://access.redhat.com/errata/RHSA-2026:59467","https://access.redhat.com/errata/RHSA-2026:59593","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/errata/RHSA-2026:62260","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:66022","https://access.redhat.com/errata/RHSA-2026:66521"],"description":"golang.org/x/crypto is vulnerable to invoking server panic during CheckHostKey/Authenticate flow","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-39835","epss":0.00504,"percentile":0.43093,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-39835","cwe":"CWE-295","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2026-39835","cwe":"CWE-476","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["0.52.0"],"state":"fixed","available":[{"version":"0.52.0","date":"2026-07-07","kind":"first-observed"}]},"advisories":[],"risk":0.25956},"relatedVulnerabilities":[{"id":"CVE-2026-39835","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-39835","namespace":"nvd:cpe","severity":"High","urls":["https://go.dev/cl/781660","https://go.dev/issue/79563","https://groups.google.com/g/golang-announce/c/a082jnz-LvI","https://pkg.go.dev/vuln/GO-2026-5015","https://access.redhat.com/errata/RHSA-2026:26546","https://access.redhat.com/errata/RHSA-2026:26547","https://access.redhat.com/errata/RHSA-2026:36199","https://access.redhat.com/errata/RHSA-2026:36207","https://access.redhat.com/errata/RHSA-2026:36319","https://access.redhat.com/errata/RHSA-2026:36625","https://access.redhat.com/errata/RHSA-2026:36648","https://access.redhat.com/errata/RHSA-2026:36651","https://access.redhat.com/errata/RHSA-2026:36796","https://access.redhat.com/errata/RHSA-2026:36797","https://access.redhat.com/errata/RHSA-2026:37072","https://access.redhat.com/errata/RHSA-2026:37123","https://access.redhat.com/errata/RHSA-2026:37268","https://access.redhat.com/errata/RHSA-2026:37271","https://access.redhat.com/errata/RHSA-2026:37272","https://access.redhat.com/errata/RHSA-2026:37286","https://access.redhat.com/errata/RHSA-2026:37296","https://access.redhat.com/errata/RHSA-2026:37387","https://access.redhat.com/errata/RHSA-2026:37410","https://access.redhat.com/errata/RHSA-2026:38504","https://access.redhat.com/errata/RHSA-2026:40118","https://access.redhat.com/errata/RHSA-2026:40262","https://access.redhat.com/errata/RHSA-2026:40945","https://access.redhat.com/errata/RHSA-2026:40969","https://access.redhat.com/errata/RHSA-2026:40972","https://access.redhat.com/errata/RHSA-2026:40974","https://access.redhat.com/errata/RHSA-2026:41019","https://access.redhat.com/errata/RHSA-2026:41031","https://access.redhat.com/errata/RHSA-2026:41036","https://access.redhat.com/errata/RHSA-2026:41066","https://access.redhat.com/errata/RHSA-2026:42146","https://access.redhat.com/errata/RHSA-2026:42796","https://access.redhat.com/errata/RHSA-2026:43052","https://access.redhat.com/errata/RHSA-2026:43692","https://access.redhat.com/errata/RHSA-2026:46885","https://access.redhat.com/errata/RHSA-2026:47735","https://access.redhat.com/errata/RHSA-2026:47949","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:51033","https://access.redhat.com/errata/RHSA-2026:51036","https://access.redhat.com/errata/RHSA-2026:51038","https://access.redhat.com/errata/RHSA-2026:52857","https://access.redhat.com/errata/RHSA-2026:52910","https://access.redhat.com/errata/RHSA-2026:54525","https://access.redhat.com/errata/RHSA-2026:57194","https://access.redhat.com/errata/RHSA-2026:59467","https://access.redhat.com/errata/RHSA-2026:59593","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/errata/RHSA-2026:62260","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:66022","https://access.redhat.com/errata/RHSA-2026:66521","https://access.redhat.com/security/cve/CVE-2026-39835","https://bugzilla.redhat.com/show_bug.cgi?id=2480680","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39835.json"],"description":"SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate. CertChecker now returns an error instead of panicking when these callbacks are nil.","cvss":[{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-39835","epss":0.00504,"percentile":0.43093,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-39835","cwe":"CWE-295","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2026-39835","cwe":"CWE-476","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"golang.org/x/crypto","version":"v0.48.0"}},"found":{"vulnerabilityID":"GHSA-78mq-xcr3-xm33","versionConstraint":"<0.52.0 (go)"},"fix":{"suggestedVersion":"0.52.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/crypto@v0.48.0?package-id=764d3323ecdb54e3","name":"golang.org/x/crypto","version":"v0.48.0","type":"go-module","locations":[{"path":"/tool-imports/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:crypto:v0.48.0:*:*:*:*:go:*:*","cpe:2.3:a:go:ssh:v0.48.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/crypto@v0.48.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:/VRzVqiRSggnhY7gNRxPauEQ5Drw9haKdM0jqfcCFts="}}},{"vulnerability":{"id":"GHSA-v8vw-gw5j-w7m6","dataSource":"https://github.com/advisories/GHSA-v8vw-gw5j-w7m6","namespace":"github:language:go","severity":"Medium","urls":["https://github.com/modelcontextprotocol/registry/security/advisories/GHSA-v8vw-gw5j-w7m6","https://github.com/modelcontextprotocol/registry/pull/1227","https://github.com/modelcontextprotocol/registry/commit/1201cbd82b2cf6d4b56edfc05c763059a12f9fdb","https://github.com/modelcontextprotocol/registry/releases/tag/v1.7.5","https://nvd.nist.gov/vuln/detail/CVE-2026-44427"],"description":"MCP Registry has open redirect via protocol-relative path in trailing-slash middleware","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P","metrics":{"baseScore":5.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-44427","epss":0.0047,"percentile":0.40649,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-44427","cwe":"CWE-601","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.7.5"],"state":"fixed","available":[{"version":"1.7.5","date":"2026-05-09","kind":"first-observed"}]},"advisories":[],"risk":0.25145},"relatedVulnerabilities":[{"id":"CVE-2026-44427","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44427","namespace":"nvd:cpe","severity":"Negligible","urls":["https://github.com/modelcontextprotocol/registry/security/advisories/GHSA-v8vw-gw5j-w7m6"],"description":"The MCP Registry provides MCP clients with a list of MCP servers, like an app store for MCP servers. From 1.1.0 to 1.7.4, the TrailingSlashMiddleware in internal/api/server.go is vulnerable to an open redirect attack. An attacker can craft a URL with a protocol-relative path (e.g., //evil.com/) that, after trailing slash removal, results in a Location header of //evil.com — which browsers interpret as an absolute URL to an external domain. This vulnerability is fixed in 1.7.5.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":0},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-44427","epss":0.0047,"percentile":0.40649,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-44427","cwe":"CWE-601","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"github.com/modelcontextprotocol/registry","version":"v1.3.10"}},"found":{"vulnerabilityID":"GHSA-v8vw-gw5j-w7m6","versionConstraint":">=1.1.0,<1.7.5 (go)"},"fix":{"suggestedVersion":"1.7.5"}}],"artifact":{"id":"pkg:golang/github.com/modelcontextprotocol/registry@v1.3.10?package-id=9fa26fe0e176e8ec","name":"github.com/modelcontextprotocol/registry","version":"v1.3.10","type":"go-module","locations":[{"path":"/tool-imports/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:modelcontextprotocol:registry:v1.3.10:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/modelcontextprotocol/registry@v1.3.10","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:sLVSjsHL2ox1HHBy7dVfp45UKIYBjfS+7VKwwJGD79c="}}},{"vulnerability":{"id":"GHSA-qw64-3x98-g7q2","dataSource":"https://github.com/advisories/GHSA-qw64-3x98-g7q2","namespace":"github:language:go","severity":"High","urls":["https://github.com/go-git/go-billy/security/advisories/GHSA-qw64-3x98-g7q2","https://github.com/go-git/go-billy/releases/tag/v5.9.0","https://github.com/go-git/go-billy/releases/tag/v6.0.0-alpha.1","https://nvd.nist.gov/vuln/detail/CVE-2026-44973"],"description":"go-billy has path traversal vulnerabilities","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":8.1,"exploitabilityScore":2.9,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-44973","epss":0.0031,"percentile":0.23932,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-44973","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["5.9.0"],"state":"fixed","available":[{"version":"5.9.0","date":"2026-05-15","kind":"first-observed"}]},"advisories":[],"risk":0.24180000000000001},"relatedVulnerabilities":[{"id":"CVE-2026-44973","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44973","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/go-git/go-billy/security/advisories/GHSA-qw64-3x98-g7q2"],"description":"Billy is an interface filesystem abstraction for Go. Prior to 5.9.0, multiple path traversal issues exist across different components of go-billy. Insufficient path sanitization and boundary enforcement may allow crafted paths (e.g., using ..) to escape intended base directories. While go-billy was not originally designed to provide a strong security boundary, some of these issues were inconsistent across some of the built-in implementations. This results in scenarios where applications relying on go-billy for some level of isolation may inadvertently expose access to unintended filesystem locations. This vulnerability is fixed in 5.9.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":8.1,"exploitabilityScore":2.9,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-44973","epss":0.0031,"percentile":0.23932,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-44973","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"github.com/go-git/go-billy/v5","version":"v5.6.2"}},"found":{"vulnerabilityID":"GHSA-qw64-3x98-g7q2","versionConstraint":"<5.9.0 (go)"},"fix":{"suggestedVersion":"5.9.0"}}],"artifact":{"id":"pkg:golang/github.com/go-git/go-billy/v5@v5.6.2?package-id=97816f3b05cac408","name":"github.com/go-git/go-billy/v5","version":"v5.6.2","type":"go-module","locations":[{"path":"/tool-imports/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:go-git:go-billy\\/v5:v5.6.2:*:*:*:*:*:*:*","cpe:2.3:a:go-git:go_billy\\/v5:v5.6.2:*:*:*:*:*:*:*","cpe:2.3:a:go_git:go-billy\\/v5:v5.6.2:*:*:*:*:*:*:*","cpe:2.3:a:go_git:go_billy\\/v5:v5.6.2:*:*:*:*:*:*:*","cpe:2.3:a:go:go-billy\\/v5:v5.6.2:*:*:*:*:*:*:*","cpe:2.3:a:go:go_billy\\/v5:v5.6.2:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/go-git/go-billy/v5@v5.6.2","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:6Q86EsPXMa7c3YZ3aLAQsMA0VlWmy43r6FHqa/UNbRM="}}},{"vulnerability":{"id":"GHSA-pxq6-2prw-chj9","dataSource":"https://github.com/advisories/GHSA-pxq6-2prw-chj9","namespace":"github:language:go","severity":"Medium","urls":["https://github.com/moby/moby/security/advisories/GHSA-pxq6-2prw-chj9","https://github.com/moby/moby/commit/f4d6f25bf0c3fa12d4968320a45685947756a22a","https://docs.docker.com/engine/extend/legacy_plugins","https://github.com/moby/moby/releases/tag/docker-v29.3.1","https://nvd.nist.gov/vuln/detail/CVE-2026-33997"],"description":"Moby has an Off-by-one error in its plugin privilege validation","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":6.8,"exploitabilityScore":1.7,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-33997","epss":0.00402,"percentile":0.34439,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-33997","cwe":"CWE-193","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-33997","cwe":"CWE-266","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.23717999999999997},"relatedVulnerabilities":[{"id":"CVE-2026-33997","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33997","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/moby/moby/releases/tag/docker-v29.3.1","https://github.com/moby/moby/security/advisories/GHSA-pxq6-2prw-chj9","https://access.redhat.com/errata/RHSA-2026:21769","https://access.redhat.com/errata/RHSA-2026:22347","https://access.redhat.com/errata/RHSA-2026:23345","https://access.redhat.com/security/cve/CVE-2026-33997","https://bugzilla.redhat.com/show_bug.cgi?id=2453277","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33997.json"],"description":"Moby is an open source container framework. Prior to version 29.3.1, a security vulnerability has been detected that allows plugins privilege validation to be bypassed during docker plugin install. Due to an error in the daemon's privilege comparison logic, the daemon may incorrectly accept a privilege set that differs from the one approved by the user. Plugins that request exactly one privilege are also affected, because no comparison is performed at all. This issue has been patched in version 29.3.1.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":8.1,"exploitabilityScore":2.9,"impactScore":5.2},"vendorMetadata":{}},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.4,"exploitabilityScore":1.7,"impactScore":6.1},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":6.8,"exploitabilityScore":1.7,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-33997","epss":0.00402,"percentile":0.34439,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-33997","cwe":"CWE-193","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-33997","cwe":"CWE-266","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"github.com/docker/docker","version":"v28.5.2+incompatible"}},"found":{"vulnerabilityID":"GHSA-pxq6-2prw-chj9","versionConstraint":"<29.3.1 (go)"}}],"artifact":{"id":"pkg:golang/github.com/docker/docker@v28.5.2%2Bincompatible?package-id=3faa2f9d49f614ca","name":"github.com/docker/docker","version":"v28.5.2+incompatible","type":"go-module","locations":[{"path":"/tool-imports/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:docker:docker:v28.5.2\\+incompatible:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/docker/docker@v28.5.2%2Bincompatible","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:DBX0Y0zAjZbSrm1uzOkdr1onVghKaftjlSWt4AFexzM="}}},{"vulnerability":{"id":"GHSA-qgq7-7hm3-q39j","dataSource":"https://github.com/advisories/GHSA-qgq7-7hm3-q39j","namespace":"github:language:go","severity":"Medium","urls":["https://github.com/go-git/go-git/security/advisories/GHSA-qgq7-7hm3-q39j","https://github.com/go-git/go-git/pull/2247","https://github.com/go-git/go-git/pull/2254","https://github.com/go-git/go-git/commit/4a0e66d555de5f9a30c31e2df64f445f42bd01e7","https://github.com/go-git/go-git/commit/da9f7d8a0e98b475600177348d6ece384a370f36","https://github.com/go-git/go-git/releases/tag/v5.19.2","https://github.com/go-git/go-git/releases/tag/v6.0.0-alpha.5"],"description":"go-git: Malicious reference names may modify files outside the reference storage","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:L","metrics":{"baseScore":6.3,"exploitabilityScore":2.1,"impactScore":4.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-71557","epss":0.00413,"percentile":0.3566,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-71557","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["5.19.2"],"state":"fixed","available":[{"version":"5.19.2","date":"2026-08-08","kind":"first-observed"}]},"advisories":[],"risk":0.233345},"relatedVulnerabilities":[{"id":"CVE-2026-71557","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-71557","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/go-git/go-git/commit/4a0e66d555de5f9a30c31e2df64f445f42bd01e7","https://github.com/go-git/go-git/commit/da9f7d8a0e98b475600177348d6ece384a370f36","https://github.com/go-git/go-git/pull/2247","https://github.com/go-git/go-git/pull/2254","https://github.com/go-git/go-git/releases/tag/v5.19.2","https://github.com/go-git/go-git/releases/tag/v6.0.0-alpha.5","https://github.com/go-git/go-git/security/advisories/GHSA-qgq7-7hm3-q39j"],"description":"go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, reference names are not sanitized before being used to construct on-disk paths under the reference storage directory, so a maliciously crafted reference name (for example containing directory-traversal sequences) can cause go-git to write files outside the intended reference storage directory. Versions 5.19.2 and 6.0.0-alpha.5 fix the issue.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:L","metrics":{"baseScore":6.3,"exploitabilityScore":2.1,"impactScore":4.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-71557","epss":0.00413,"percentile":0.3566,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-71557","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"github.com/go-git/go-git/v5","version":"v5.16.5"}},"found":{"vulnerabilityID":"GHSA-qgq7-7hm3-q39j","versionConstraint":"<=5.19.1 (go)"},"fix":{"suggestedVersion":"5.19.2"}}],"artifact":{"id":"pkg:golang/github.com/go-git/go-git/v5@v5.16.5?package-id=0c14767230083f4a","name":"github.com/go-git/go-git/v5","version":"v5.16.5","type":"go-module","locations":[{"path":"/tool-imports/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:go-git:go-git\\/v5:v5.16.5:*:*:*:*:*:*:*","cpe:2.3:a:go-git:go_git\\/v5:v5.16.5:*:*:*:*:*:*:*","cpe:2.3:a:go_git:go-git\\/v5:v5.16.5:*:*:*:*:*:*:*","cpe:2.3:a:go_git:go_git\\/v5:v5.16.5:*:*:*:*:*:*:*","cpe:2.3:a:go:go-git\\/v5:v5.16.5:*:*:*:*:*:*:*","cpe:2.3:a:go:go_git\\/v5:v5.16.5:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/go-git/go-git/v5@v5.16.5","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:mdkuqblwr57kVfXri5TTH+nMFLNUxIj9Z7F5ykFbw5s="}}},{"vulnerability":{"id":"GHSA-m3xc-h892-ggx6","dataSource":"https://github.com/advisories/GHSA-m3xc-h892-ggx6","namespace":"github:language:go","severity":"Medium","urls":["https://github.com/go-git/go-billy/security/advisories/GHSA-m3xc-h892-ggx6","https://github.com/go-git/go-billy/releases/tag/v5.9.0","https://github.com/go-git/go-billy/releases/tag/v6.0.0-alpha.1","https://nvd.nist.gov/vuln/detail/CVE-2026-44740"],"description":"go-billy: Lack of depth and cycle detection in symlink resolution may lead to infinite loops and resource exhaustion","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"exploitabilityScore":2.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-44740","epss":0.00389,"percentile":0.32993,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-44740","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-44740","cwe":"CWE-835","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["5.9.0"],"state":"fixed","available":[{"version":"5.9.0","date":"2026-05-13","kind":"first-observed"}]},"advisories":[],"risk":0.22367499999999996},"relatedVulnerabilities":[{"id":"CVE-2026-44740","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44740","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/go-git/go-billy/releases/tag/v5.9.0","https://github.com/go-git/go-billy/releases/tag/v6.0.0-alpha.1","https://github.com/go-git/go-billy/security/advisories/GHSA-m3xc-h892-ggx6"],"description":"Billy is an interface filesystem abstraction for Go. Prior to versions 5.9.0 and 6.0.0-alpha.1, multiple components may improperly handle crafted or malformed input, resulting in panics, infinite loops, uncontrolled recursion, or excessive resource consumption. These issues arise from insufficient validation and missing safety mechanisms such as cycle detection, recursion limits, or defensive handling of unexpected states when processing untrusted repository data and filesystem structures. This issue has been patched in versions 5.9.0 and 6.0.0-alpha.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"exploitabilityScore":2.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-44740","epss":0.00389,"percentile":0.32993,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-44740","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-44740","cwe":"CWE-835","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"github.com/go-git/go-billy/v5","version":"v5.6.2"}},"found":{"vulnerabilityID":"GHSA-m3xc-h892-ggx6","versionConstraint":"<5.9.0 (go)"},"fix":{"suggestedVersion":"5.9.0"}}],"artifact":{"id":"pkg:golang/github.com/go-git/go-billy/v5@v5.6.2?package-id=97816f3b05cac408","name":"github.com/go-git/go-billy/v5","version":"v5.6.2","type":"go-module","locations":[{"path":"/tool-imports/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:go-git:go-billy\\/v5:v5.6.2:*:*:*:*:*:*:*","cpe:2.3:a:go-git:go_billy\\/v5:v5.6.2:*:*:*:*:*:*:*","cpe:2.3:a:go_git:go-billy\\/v5:v5.6.2:*:*:*:*:*:*:*","cpe:2.3:a:go_git:go_billy\\/v5:v5.6.2:*:*:*:*:*:*:*","cpe:2.3:a:go:go-billy\\/v5:v5.6.2:*:*:*:*:*:*:*","cpe:2.3:a:go:go_billy\\/v5:v5.6.2:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/go-git/go-billy/v5@v5.6.2","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:6Q86EsPXMa7c3YZ3aLAQsMA0VlWmy43r6FHqa/UNbRM="}}},{"vulnerability":{"id":"GO-2026-6180","dataSource":"https://go.dev/issue/80745","namespace":"govulndb:language:go","severity":"High","urls":["https://groups.google.com/g/golang-announce/c/94pEornpRlI","https://go.dev/cl/815000","https://go.dev/cl/815020"],"description":"A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log.\n\nThis attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log.\n\nIn order to determine if you have been affected:\n\nrm -r go.sum go.work.sum vendor/ && go mod tidy","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-56864","epss":0.00298,"percentile":0.22508,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-56864","cwe":"CWE-347","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["0.40.0"],"state":"fixed","available":[{"version":"0.40.0","date":"2026-08-13","kind":"release"}]},"advisories":[],"risk":0.2235},"relatedVulnerabilities":[{"id":"CVE-2026-56864","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56864","namespace":"nvd:cpe","severity":"High","urls":["https://go.dev/cl/815000","https://go.dev/cl/815020","https://go.dev/issue/80745","https://groups.google.com/g/golang-announce/c/94pEornpRlI","https://pkg.go.dev/vuln/GO-2026-6180"],"description":"A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log. In order to determine if you have been affected:   rm -r go.sum go.work.sum vendor/ && go mod tidy","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-56864","epss":0.00298,"percentile":0.22508,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-56864","cwe":"CWE-347","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"golang.org/x/mod","version":"v0.33.0"}},"found":{"vulnerabilityID":"GO-2026-6180","versionConstraint":"<0.40.0 (go)"},"fix":{"suggestedVersion":"0.40.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/mod@v0.33.0?package-id=e7bface2e125298f","name":"golang.org/x/mod","version":"v0.33.0","type":"go-module","locations":[{"path":"/tool-imports/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:x\\/mod:v0.33.0:*:*:*:*:*:*:*"],"purl":"pkg:golang/golang.org/x/mod@v0.33.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:tHFzIWbBifEmbwtGz65eaWyGiGZatSrT9prnU8DbVL8="}}},{"vulnerability":{"id":"GHSA-9m57-25v3-79x9","dataSource":"https://github.com/advisories/GHSA-9m57-25v3-79x9","namespace":"github:language:go","severity":"Medium","urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-46598","https://go.dev/cl/781360","https://go.dev/issue/79596","https://groups.google.com/g/golang-announce/c/a082jnz-LvI","https://pkg.go.dev/vuln/GO-2026-5033"],"description":"golang.org/x/crypto: Invoking pathological inputs can lead to client panic","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-46598","epss":0.00412,"percentile":0.35519,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-46598","cwe":"CWE-129","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["0.52.0"],"state":"fixed","available":[{"version":"0.52.0","date":"2026-07-07","kind":"first-observed"}]},"advisories":[],"risk":0.21218},"relatedVulnerabilities":[{"id":"CVE-2026-46598","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-46598","namespace":"nvd:cpe","severity":"Medium","urls":["https://go.dev/cl/781360","https://go.dev/issue/79596","https://groups.google.com/g/golang-announce/c/a082jnz-LvI","https://pkg.go.dev/vuln/GO-2026-5033"],"description":"For certain crafted inputs, a 'ed25519.PrivateKey' was created by casting malformed wire bytes, leading to a panic when used.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-46598","epss":0.00412,"percentile":0.35519,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-46598","cwe":"CWE-129","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"golang.org/x/crypto","version":"v0.46.0"}},"found":{"vulnerabilityID":"GHSA-9m57-25v3-79x9","versionConstraint":"<0.52.0 (go)"},"fix":{"suggestedVersion":"0.52.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/crypto@v0.46.0?package-id=b3387fbedc5d73be","name":"golang.org/x/crypto","version":"v0.46.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:crypto:v0.46.0:*:*:*:*:go:*:*","cpe:2.3:a:go:ssh:v0.46.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/crypto@v0.46.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:cKRW/pmt1pKAfetfu+RCEvjvZkA9RimPbh7bhFjGVBU="}}},{"vulnerability":{"id":"GHSA-9m57-25v3-79x9","dataSource":"https://github.com/advisories/GHSA-9m57-25v3-79x9","namespace":"github:language:go","severity":"Medium","urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-46598","https://go.dev/cl/781360","https://go.dev/issue/79596","https://groups.google.com/g/golang-announce/c/a082jnz-LvI","https://pkg.go.dev/vuln/GO-2026-5033"],"description":"golang.org/x/crypto: Invoking pathological inputs can lead to client panic","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-46598","epss":0.00412,"percentile":0.35519,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-46598","cwe":"CWE-129","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["0.52.0"],"state":"fixed","available":[{"version":"0.52.0","date":"2026-07-07","kind":"first-observed"}]},"advisories":[],"risk":0.21218},"relatedVulnerabilities":[{"id":"CVE-2026-46598","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-46598","namespace":"nvd:cpe","severity":"Medium","urls":["https://go.dev/cl/781360","https://go.dev/issue/79596","https://groups.google.com/g/golang-announce/c/a082jnz-LvI","https://pkg.go.dev/vuln/GO-2026-5033"],"description":"For certain crafted inputs, a 'ed25519.PrivateKey' was created by casting malformed wire bytes, leading to a panic when used.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-46598","epss":0.00412,"percentile":0.35519,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-46598","cwe":"CWE-129","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"golang.org/x/crypto","version":"v0.48.0"}},"found":{"vulnerabilityID":"GHSA-9m57-25v3-79x9","versionConstraint":"<0.52.0 (go)"},"fix":{"suggestedVersion":"0.52.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/crypto@v0.48.0?package-id=764d3323ecdb54e3","name":"golang.org/x/crypto","version":"v0.48.0","type":"go-module","locations":[{"path":"/tool-imports/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:crypto:v0.48.0:*:*:*:*:go:*:*","cpe:2.3:a:go:ssh:v0.48.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/crypto@v0.48.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:/VRzVqiRSggnhY7gNRxPauEQ5Drw9haKdM0jqfcCFts="}}},{"vulnerability":{"id":"GHSA-pg57-6jwg-q645","dataSource":"https://github.com/advisories/GHSA-pg57-6jwg-q645","namespace":"github:language:go","severity":"Medium","urls":["https://github.com/containerd/containerd/security/advisories/GHSA-pg57-6jwg-q645","https://nvd.nist.gov/vuln/detail/CVE-2026-53493","https://github.com/containerd/containerd/commit/4f5f32636d47f051751065cf824a10da70c619fe","https://github.com/containerd/containerd/commit/94e83c14c8aac963e24e28105dab9c9af812a2a8","https://github.com/containerd/containerd/releases/tag/v1.7.36","https://github.com/containerd/containerd/releases/tag/v2.0.13","https://github.com/containerd/containerd/releases/tag/v2.2.9","https://github.com/containerd/containerd/releases/tag/v2.3.6","https://github.com/containerd/containerd/releases/tag/v2.4.1"],"description":"Containerd has image-pull DoS via crafted OCI index graph amplification","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-53493","epss":0.00356,"percentile":0.29379,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-53493","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-53493","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-53493","cwe":"CWE-834","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.7.36"],"state":"fixed","available":[{"version":"1.7.36","date":"2026-09-26","kind":"first-observed"}]},"advisories":[],"risk":0.21181999999999998},"relatedVulnerabilities":[{"id":"CVE-2026-53493","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-53493","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/containerd/containerd/security/advisories/GHSA-pg57-6jwg-q645"],"description":"containerd is an open-source container runtime. Prior to versions 1.7.36, 2.0.13, 2.2.9, 2.3.6, and 2.4.1, a crafted OCI index graph can force very high CPU/memory usage during PullImage (before container start), causing long ContainerCreating stalls and, at larger sizes, node/runtime instability. Versions 1.7.36, 2.0.13, 2.2.9, 2.3.6, and 2.4.1 fix the issue.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-53493","epss":0.00356,"percentile":0.29379,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-53493","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-53493","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-53493","cwe":"CWE-834","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"github.com/containerd/containerd","version":"v1.7.30"}},"found":{"vulnerabilityID":"GHSA-pg57-6jwg-q645","versionConstraint":"<=1.7.35 (go)"},"fix":{"suggestedVersion":"1.7.36"}}],"artifact":{"id":"pkg:golang/github.com/containerd/containerd@v1.7.30?package-id=f22ca3ad39ee58c2","name":"github.com/containerd/containerd","version":"v1.7.30","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:containerd:containerd:v1.7.30:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/containerd/containerd@v1.7.30","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:/2vezDpLDVGGmkUXmlNPLCCNKHJ5BbC5tJB5JNzQhqE="}}},{"vulnerability":{"id":"GHSA-45gg-vh54-h5m9","dataSource":"https://github.com/advisories/GHSA-45gg-vh54-h5m9","namespace":"github:language:go","severity":"Medium","urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-39828","https://go.dev/cl/781621","https://go.dev/issue/79562","https://groups.google.com/g/golang-announce/c/a082jnz-LvI","https://pkg.go.dev/vuln/GO-2026-5014","https://access.redhat.com/security/cve/CVE-2026-39828","https://bugzilla.redhat.com/show_bug.cgi?id=2480687","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39828.json","https://access.redhat.com/errata/RHSA-2026:26546","https://access.redhat.com/errata/RHSA-2026:26547","https://access.redhat.com/errata/RHSA-2026:36167","https://access.redhat.com/errata/RHSA-2026:36105","https://access.redhat.com/errata/RHSA-2026:36207","https://access.redhat.com/errata/RHSA-2026:36319","https://access.redhat.com/errata/RHSA-2026:36625","https://access.redhat.com/errata/RHSA-2026:36648","https://access.redhat.com/errata/RHSA-2026:37271","https://access.redhat.com/errata/RHSA-2026:37268","https://access.redhat.com/errata/RHSA-2026:36808","https://access.redhat.com/errata/RHSA-2026:36797","https://access.redhat.com/errata/RHSA-2026:36796","https://access.redhat.com/errata/RHSA-2026:36651","https://access.redhat.com/errata/RHSA-2026:37387","https://access.redhat.com/errata/RHSA-2026:37296","https://access.redhat.com/errata/RHSA-2026:37286","https://access.redhat.com/errata/RHSA-2026:37278","https://access.redhat.com/errata/RHSA-2026:37272","https://access.redhat.com/errata/RHSA-2026:40974","https://access.redhat.com/errata/RHSA-2026:40969","https://access.redhat.com/errata/RHSA-2026:40262","https://access.redhat.com/errata/RHSA-2026:40119","https://access.redhat.com/errata/RHSA-2026:40118","https://access.redhat.com/errata/RHSA-2026:40945","https://access.redhat.com/errata/RHSA-2026:40972","https://access.redhat.com/errata/RHSA-2026:41019","https://access.redhat.com/errata/RHSA-2026:41031","https://access.redhat.com/errata/RHSA-2026:41036","https://access.redhat.com/errata/RHSA-2026:41066","https://access.redhat.com/errata/RHSA-2026:41055"],"description":"golang.org/x/crypto vulnerable to invoking bypass of certificate restrictions","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":6.3,"exploitabilityScore":2.9,"impactScore":3.4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-39828","epss":0.00369,"percentile":0.30796,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-39828","cwe":"CWE-295","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2026-39828","cwe":"CWE-281","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["0.52.0"],"state":"fixed","available":[{"version":"0.52.0","date":"2026-07-07","kind":"first-observed"}]},"advisories":[],"risk":0.208485},"relatedVulnerabilities":[{"id":"CVE-2026-39828","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-39828","namespace":"nvd:cpe","severity":"High","urls":["https://go.dev/cl/781621","https://go.dev/issue/79562","https://groups.google.com/g/golang-announce/c/a082jnz-LvI","https://pkg.go.dev/vuln/GO-2026-5014","https://access.redhat.com/errata/RHSA-2026:26546","https://access.redhat.com/errata/RHSA-2026:26547","https://access.redhat.com/errata/RHSA-2026:36105","https://access.redhat.com/errata/RHSA-2026:36167","https://access.redhat.com/errata/RHSA-2026:36207","https://access.redhat.com/errata/RHSA-2026:36319","https://access.redhat.com/errata/RHSA-2026:36625","https://access.redhat.com/errata/RHSA-2026:36648","https://access.redhat.com/errata/RHSA-2026:36651","https://access.redhat.com/errata/RHSA-2026:36796","https://access.redhat.com/errata/RHSA-2026:36797","https://access.redhat.com/errata/RHSA-2026:36808","https://access.redhat.com/errata/RHSA-2026:37268","https://access.redhat.com/errata/RHSA-2026:37271","https://access.redhat.com/errata/RHSA-2026:37272","https://access.redhat.com/errata/RHSA-2026:37278","https://access.redhat.com/errata/RHSA-2026:37286","https://access.redhat.com/errata/RHSA-2026:37296","https://access.redhat.com/errata/RHSA-2026:37387","https://access.redhat.com/errata/RHSA-2026:40118","https://access.redhat.com/errata/RHSA-2026:40262","https://access.redhat.com/errata/RHSA-2026:40945","https://access.redhat.com/errata/RHSA-2026:40969","https://access.redhat.com/errata/RHSA-2026:40972","https://access.redhat.com/errata/RHSA-2026:40974","https://access.redhat.com/errata/RHSA-2026:41019","https://access.redhat.com/errata/RHSA-2026:41031","https://access.redhat.com/errata/RHSA-2026:41036","https://access.redhat.com/errata/RHSA-2026:41055","https://access.redhat.com/errata/RHSA-2026:41066","https://access.redhat.com/errata/RHSA-2026:42146","https://access.redhat.com/errata/RHSA-2026:42796","https://access.redhat.com/errata/RHSA-2026:43052","https://access.redhat.com/errata/RHSA-2026:43692","https://access.redhat.com/errata/RHSA-2026:46885","https://access.redhat.com/errata/RHSA-2026:46903","https://access.redhat.com/errata/RHSA-2026:47735","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:51033","https://access.redhat.com/errata/RHSA-2026:51038","https://access.redhat.com/errata/RHSA-2026:52857","https://access.redhat.com/errata/RHSA-2026:52910","https://access.redhat.com/errata/RHSA-2026:54531","https://access.redhat.com/errata/RHSA-2026:57191","https://access.redhat.com/errata/RHSA-2026:57194","https://access.redhat.com/errata/RHSA-2026:59467","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/errata/RHSA-2026:66022","https://access.redhat.com/errata/RHSA-2026:66521","https://access.redhat.com/security/cve/CVE-2026-39828","https://bugzilla.redhat.com/show_bug.cgi?id=2480687","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39828.json"],"description":"When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as force-command after a second factor succeeded. Returning non-nil Permissions with PartialSuccessError now results in a connection error.","cvss":[{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"exploitabilityScore":2.9,"impactScore":5.9},"vendorMetadata":{}},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":6.3,"exploitabilityScore":2.9,"impactScore":3.4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-39828","epss":0.00369,"percentile":0.30796,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-39828","cwe":"CWE-295","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2026-39828","cwe":"CWE-281","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"golang.org/x/crypto","version":"v0.46.0"}},"found":{"vulnerabilityID":"GHSA-45gg-vh54-h5m9","versionConstraint":"<0.52.0 (go)"},"fix":{"suggestedVersion":"0.52.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/crypto@v0.46.0?package-id=b3387fbedc5d73be","name":"golang.org/x/crypto","version":"v0.46.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:crypto:v0.46.0:*:*:*:*:go:*:*","cpe:2.3:a:go:ssh:v0.46.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/crypto@v0.46.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:cKRW/pmt1pKAfetfu+RCEvjvZkA9RimPbh7bhFjGVBU="}}},{"vulnerability":{"id":"GHSA-45gg-vh54-h5m9","dataSource":"https://github.com/advisories/GHSA-45gg-vh54-h5m9","namespace":"github:language:go","severity":"Medium","urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-39828","https://go.dev/cl/781621","https://go.dev/issue/79562","https://groups.google.com/g/golang-announce/c/a082jnz-LvI","https://pkg.go.dev/vuln/GO-2026-5014","https://access.redhat.com/security/cve/CVE-2026-39828","https://bugzilla.redhat.com/show_bug.cgi?id=2480687","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39828.json","https://access.redhat.com/errata/RHSA-2026:26546","https://access.redhat.com/errata/RHSA-2026:26547","https://access.redhat.com/errata/RHSA-2026:36167","https://access.redhat.com/errata/RHSA-2026:36105","https://access.redhat.com/errata/RHSA-2026:36207","https://access.redhat.com/errata/RHSA-2026:36319","https://access.redhat.com/errata/RHSA-2026:36625","https://access.redhat.com/errata/RHSA-2026:36648","https://access.redhat.com/errata/RHSA-2026:37271","https://access.redhat.com/errata/RHSA-2026:37268","https://access.redhat.com/errata/RHSA-2026:36808","https://access.redhat.com/errata/RHSA-2026:36797","https://access.redhat.com/errata/RHSA-2026:36796","https://access.redhat.com/errata/RHSA-2026:36651","https://access.redhat.com/errata/RHSA-2026:37387","https://access.redhat.com/errata/RHSA-2026:37296","https://access.redhat.com/errata/RHSA-2026:37286","https://access.redhat.com/errata/RHSA-2026:37278","https://access.redhat.com/errata/RHSA-2026:37272","https://access.redhat.com/errata/RHSA-2026:40974","https://access.redhat.com/errata/RHSA-2026:40969","https://access.redhat.com/errata/RHSA-2026:40262","https://access.redhat.com/errata/RHSA-2026:40119","https://access.redhat.com/errata/RHSA-2026:40118","https://access.redhat.com/errata/RHSA-2026:40945","https://access.redhat.com/errata/RHSA-2026:40972","https://access.redhat.com/errata/RHSA-2026:41019","https://access.redhat.com/errata/RHSA-2026:41031","https://access.redhat.com/errata/RHSA-2026:41036","https://access.redhat.com/errata/RHSA-2026:41066","https://access.redhat.com/errata/RHSA-2026:41055"],"description":"golang.org/x/crypto vulnerable to invoking bypass of certificate restrictions","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":6.3,"exploitabilityScore":2.9,"impactScore":3.4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-39828","epss":0.00369,"percentile":0.30796,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-39828","cwe":"CWE-295","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2026-39828","cwe":"CWE-281","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["0.52.0"],"state":"fixed","available":[{"version":"0.52.0","date":"2026-07-07","kind":"first-observed"}]},"advisories":[],"risk":0.208485},"relatedVulnerabilities":[{"id":"CVE-2026-39828","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-39828","namespace":"nvd:cpe","severity":"High","urls":["https://go.dev/cl/781621","https://go.dev/issue/79562","https://groups.google.com/g/golang-announce/c/a082jnz-LvI","https://pkg.go.dev/vuln/GO-2026-5014","https://access.redhat.com/errata/RHSA-2026:26546","https://access.redhat.com/errata/RHSA-2026:26547","https://access.redhat.com/errata/RHSA-2026:36105","https://access.redhat.com/errata/RHSA-2026:36167","https://access.redhat.com/errata/RHSA-2026:36207","https://access.redhat.com/errata/RHSA-2026:36319","https://access.redhat.com/errata/RHSA-2026:36625","https://access.redhat.com/errata/RHSA-2026:36648","https://access.redhat.com/errata/RHSA-2026:36651","https://access.redhat.com/errata/RHSA-2026:36796","https://access.redhat.com/errata/RHSA-2026:36797","https://access.redhat.com/errata/RHSA-2026:36808","https://access.redhat.com/errata/RHSA-2026:37268","https://access.redhat.com/errata/RHSA-2026:37271","https://access.redhat.com/errata/RHSA-2026:37272","https://access.redhat.com/errata/RHSA-2026:37278","https://access.redhat.com/errata/RHSA-2026:37286","https://access.redhat.com/errata/RHSA-2026:37296","https://access.redhat.com/errata/RHSA-2026:37387","https://access.redhat.com/errata/RHSA-2026:40118","https://access.redhat.com/errata/RHSA-2026:40262","https://access.redhat.com/errata/RHSA-2026:40945","https://access.redhat.com/errata/RHSA-2026:40969","https://access.redhat.com/errata/RHSA-2026:40972","https://access.redhat.com/errata/RHSA-2026:40974","https://access.redhat.com/errata/RHSA-2026:41019","https://access.redhat.com/errata/RHSA-2026:41031","https://access.redhat.com/errata/RHSA-2026:41036","https://access.redhat.com/errata/RHSA-2026:41055","https://access.redhat.com/errata/RHSA-2026:41066","https://access.redhat.com/errata/RHSA-2026:42146","https://access.redhat.com/errata/RHSA-2026:42796","https://access.redhat.com/errata/RHSA-2026:43052","https://access.redhat.com/errata/RHSA-2026:43692","https://access.redhat.com/errata/RHSA-2026:46885","https://access.redhat.com/errata/RHSA-2026:46903","https://access.redhat.com/errata/RHSA-2026:47735","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:51033","https://access.redhat.com/errata/RHSA-2026:51038","https://access.redhat.com/errata/RHSA-2026:52857","https://access.redhat.com/errata/RHSA-2026:52910","https://access.redhat.com/errata/RHSA-2026:54531","https://access.redhat.com/errata/RHSA-2026:57191","https://access.redhat.com/errata/RHSA-2026:57194","https://access.redhat.com/errata/RHSA-2026:59467","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/errata/RHSA-2026:66022","https://access.redhat.com/errata/RHSA-2026:66521","https://access.redhat.com/security/cve/CVE-2026-39828","https://bugzilla.redhat.com/show_bug.cgi?id=2480687","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39828.json"],"description":"When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as force-command after a second factor succeeded. Returning non-nil Permissions with PartialSuccessError now results in a connection error.","cvss":[{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"exploitabilityScore":2.9,"impactScore":5.9},"vendorMetadata":{}},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":6.3,"exploitabilityScore":2.9,"impactScore":3.4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-39828","epss":0.00369,"percentile":0.30796,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-39828","cwe":"CWE-295","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2026-39828","cwe":"CWE-281","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"golang.org/x/crypto","version":"v0.48.0"}},"found":{"vulnerabilityID":"GHSA-45gg-vh54-h5m9","versionConstraint":"<0.52.0 (go)"},"fix":{"suggestedVersion":"0.52.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/crypto@v0.48.0?package-id=764d3323ecdb54e3","name":"golang.org/x/crypto","version":"v0.48.0","type":"go-module","locations":[{"path":"/tool-imports/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:crypto:v0.48.0:*:*:*:*:go:*:*","cpe:2.3:a:go:ssh:v0.48.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/crypto@v0.48.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:/VRzVqiRSggnhY7gNRxPauEQ5Drw9haKdM0jqfcCFts="}}},{"vulnerability":{"id":"GHSA-5cv4-jp36-h3mw","dataSource":"https://github.com/advisories/GHSA-5cv4-jp36-h3mw","namespace":"github:language:go","severity":"Medium","urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-25680","https://go.dev/cl/781702","https://go.dev/issue/79573","https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8","https://pkg.go.dev/vuln/GO-2026-5028","https://go.googlesource.com/net/+/08be507abce89191d78cd49da60f4501fc910472","https://go.googlesource.com/net/+/refs/tags/v0.55.0"],"description":"Go Net HTML parser is vulnerable to denial of service","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"exploitabilityScore":2.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-25680","epss":0.00326,"percentile":0.25769,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-25680","cwe":"CWE-400","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["0.55.0"],"state":"fixed","available":[{"version":"0.55.0","date":"2026-07-02","kind":"first-observed"}]},"advisories":[],"risk":0.18744999999999998},"relatedVulnerabilities":[{"id":"CVE-2026-25680","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25680","namespace":"nvd:cpe","severity":"Medium","urls":["https://go.dev/cl/781702","https://go.dev/issue/79573","https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8","https://pkg.go.dev/vuln/GO-2026-5028"],"description":"Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"exploitabilityScore":2.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-25680","epss":0.00326,"percentile":0.25769,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-25680","cwe":"CWE-400","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"golang.org/x/net","version":"v0.48.0"}},"found":{"vulnerabilityID":"GHSA-5cv4-jp36-h3mw","versionConstraint":"<0.55.0 (go)"},"fix":{"suggestedVersion":"0.55.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/net@v0.48.0?package-id=7e3c0e57ff3d79d8","name":"golang.org/x/net","version":"v0.48.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:networking:v0.48.0:*:*:*:*:go:*:*","cpe:2.3:a:golang:net:v0.48.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/net@v0.48.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:zyQRTTrjc33Lhh0fBgT/H3oZq9WuvRR5gPC70xpDiQU="}}},{"vulnerability":{"id":"GHSA-5cv4-jp36-h3mw","dataSource":"https://github.com/advisories/GHSA-5cv4-jp36-h3mw","namespace":"github:language:go","severity":"Medium","urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-25680","https://go.dev/cl/781702","https://go.dev/issue/79573","https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8","https://pkg.go.dev/vuln/GO-2026-5028","https://go.googlesource.com/net/+/08be507abce89191d78cd49da60f4501fc910472","https://go.googlesource.com/net/+/refs/tags/v0.55.0"],"description":"Go Net HTML parser is vulnerable to denial of service","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"exploitabilityScore":2.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-25680","epss":0.00326,"percentile":0.25769,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-25680","cwe":"CWE-400","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["0.55.0"],"state":"fixed","available":[{"version":"0.55.0","date":"2026-07-02","kind":"first-observed"}]},"advisories":[],"risk":0.18744999999999998},"relatedVulnerabilities":[{"id":"CVE-2026-25680","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25680","namespace":"nvd:cpe","severity":"Medium","urls":["https://go.dev/cl/781702","https://go.dev/issue/79573","https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8","https://pkg.go.dev/vuln/GO-2026-5028"],"description":"Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"exploitabilityScore":2.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-25680","epss":0.00326,"percentile":0.25769,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-25680","cwe":"CWE-400","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"golang.org/x/net","version":"v0.50.0"}},"found":{"vulnerabilityID":"GHSA-5cv4-jp36-h3mw","versionConstraint":"<0.55.0 (go)"},"fix":{"suggestedVersion":"0.55.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/net@v0.50.0?package-id=a205ae7dff8c80d8","name":"golang.org/x/net","version":"v0.50.0","type":"go-module","locations":[{"path":"/tool-imports/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:networking:v0.50.0:*:*:*:*:go:*:*","cpe:2.3:a:golang:net:v0.50.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/net@v0.50.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:ucWh9eiCGyDR3vtzso0WMQinm2Dnt8cFMuQa9K33J60="}}},{"vulnerability":{"id":"GHSA-hfvc-g4fc-pqhx","dataSource":"https://github.com/advisories/GHSA-hfvc-g4fc-pqhx","namespace":"github:language:go","severity":"High","urls":["https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-hfvc-g4fc-pqhx","http://github.com/open-telemetry/opentelemetry-go/releases/tag/v1.43.0","https://nvd.nist.gov/vuln/detail/CVE-2026-39883"],"description":"opentelemetry-go: BSD kenv command not using absolute path enables PATH hijacking","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":7.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-39883","epss":0.00252,"percentile":0.16787,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-39883","cwe":"CWE-426","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-39883","cwe":"CWE-426","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["1.43.0"],"state":"fixed","available":[{"version":"1.43.0","date":"2026-04-09","kind":"first-observed"}]},"advisories":[],"risk":0.18648},"relatedVulnerabilities":[{"id":"CVE-2026-39883","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-39883","namespace":"nvd:cpe","severity":"High","urls":["http://github.com/open-telemetry/opentelemetry-go/releases/tag/v1.43.0","https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-hfvc-g4fc-pqhx","https://access.redhat.com/errata/RHSA-2026:26254","https://access.redhat.com/errata/RHSA-2026:26257","https://access.redhat.com/errata/RHSA-2026:37387","https://access.redhat.com/errata/RHSA-2026:54274","https://access.redhat.com/errata/RHSA-2026:54286","https://access.redhat.com/errata/RHSA-2026:63140","https://access.redhat.com/security/cve/CVE-2026-39883","https://bugzilla.redhat.com/show_bug.cgi?id=2456718","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39883.json"],"description":"OpenTelemetry-Go is the Go implementation of OpenTelemetry. From 1.15.0 to 1.42.0, the fix for CVE-2026-24051 changed the Darwin ioreg command to use an absolute path but left the BSD kenv command using a bare name, allowing the same PATH hijacking attack on BSD and Solaris platforms. This vulnerability is fixed in 1.43.0.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"exploitabilityScore":1.1,"impactScore":5.9},"vendorMetadata":{}},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.8,"exploitabilityScore":2.1,"impactScore":6.1},"vendorMetadata":{}},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"exploitabilityScore":1.1,"impactScore":5.9},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-39883","epss":0.00252,"percentile":0.16787,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-39883","cwe":"CWE-426","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-39883","cwe":"CWE-426","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"go.opentelemetry.io/otel/sdk","version":"v1.40.0"}},"found":{"vulnerabilityID":"GHSA-hfvc-g4fc-pqhx","versionConstraint":">=1.15.0,<=1.42.0 (go)"},"fix":{"suggestedVersion":"1.43.0"}}],"artifact":{"id":"pkg:golang/go.opentelemetry.io/otel/sdk@v1.40.0?package-id=27729d683439edda","name":"go.opentelemetry.io/otel/sdk","version":"v1.40.0","type":"go-module","locations":[{"path":"/tool-imports/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:otel:sdk:v1.40.0:*:*:*:*:*:*:*"],"purl":"pkg:golang/go.opentelemetry.io/otel/sdk@v1.40.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:KHW/jUzgo6wsPh9At46+h4upjtccTmuZCFAc9OJ71f8="}}},{"vulnerability":{"id":"GHSA-h7vf-4x9w-h99v","dataSource":"https://github.com/advisories/GHSA-h7vf-4x9w-h99v","namespace":"github:language:go","severity":"Medium","urls":["https://github.com/oras-project/oras-go/security/advisories/GHSA-h7vf-4x9w-h99v","https://nvd.nist.gov/vuln/detail/CVE-2026-85732","https://github.com/oras-project/oras-go/commit/31da1963f8c327dd089cd29faeae95cf0fc50842","https://github.com/oras-project/oras-go/releases/tag/v2.6.2"],"description":"oras-go: Blind SSRF via unvalidated Link header URL in pagination allows internal network probing","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N","metrics":{"baseScore":4.7,"exploitabilityScore":2.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-85732","epss":0.00384,"percentile":0.32498,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-85732","cwe":"CWE-918","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["2.6.2"],"state":"fixed","available":[{"version":"2.6.2","date":"2026-09-18","kind":"first-observed"}]},"advisories":[],"risk":0.18624},"relatedVulnerabilities":[{"id":"CVE-2026-85732","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-85732","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/oras-project/oras-go/commit/31da1963f8c327dd089cd29faeae95cf0fc50842","https://github.com/oras-project/oras-go/releases/tag/v2.6.2","https://github.com/oras-project/oras-go/security/advisories/GHSA-h7vf-4x9w-h99v"],"description":"oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, the parseLink function in registry/remote/utils.go accepts an absolute URL from a registry-controlled Link response header without validating its scheme, host, or port. Tags, Referrers, and Repositories pagination operations then issue a GET request to the attacker-selected URL from the victim's network, allowing blind server-side request forgery against internal services. The response body is not returned to the attacker, but timing and error differences can reveal service reachability, and credentials may be attached when the credential store has an entry for the target host. Exploitation requires a victim to perform a pagination-based listing operation against a malicious registry. The maintainer identifies this report as a duplicate of GHSA-3hr5-mjrr-hfjh and states that remediation is consolidated in that earlier advisory. The consolidated issue is fixed in version 2.6.2.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N","metrics":{"baseScore":4.7,"exploitabilityScore":2.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-85732","epss":0.00384,"percentile":0.32498,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-85732","cwe":"CWE-918","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"oras.land/oras-go/v2","version":"v2.6.0"}},"found":{"vulnerabilityID":"GHSA-h7vf-4x9w-h99v","versionConstraint":"<=2.6.1 (go)"},"fix":{"suggestedVersion":"2.6.2"}}],"artifact":{"id":"pkg:golang/oras.land/oras-go/v2@v2.6.0?package-id=016c318c2b8258c2","name":"oras.land/oras-go/v2","version":"v2.6.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:linuxfoundation:oras:v2.6.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/oras.land/oras-go/v2@v2.6.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:X4ELRsiGkrbeox69+9tzTu492FMUu7zJQW6eJU+I2oc="}}},{"vulnerability":{"id":"GHSA-cp6g-7hqx-qxhp","dataSource":"https://github.com/advisories/GHSA-cp6g-7hqx-qxhp","namespace":"github:language:go","severity":"Medium","urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-2303","https://jira.mongodb.org/browse/GODRIVER-3770"],"description":"mongo-go-driver has Heap Out-of-Bounds Read in GSSAPI Error Handling","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":6.5,"exploitabilityScore":2.9,"impactScore":3.6},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-2303","epss":0.00318,"percentile":0.2482,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-2303","cwe":"CWE-183","source":"cna@mongodb.com","type":"Secondary"}],"fix":{"versions":["1.17.7"],"state":"fixed","available":[{"version":"1.17.7","date":"2026-06-19","kind":"first-observed"}]},"advisories":[],"risk":0.18602999999999997},"relatedVulnerabilities":[{"id":"CVE-2026-2303","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-2303","namespace":"nvd:cpe","severity":"Medium","urls":["https://jira.mongodb.org/browse/GODRIVER-3770"],"description":"The mongo-go-driver repository contains CGo bindings for GSSAPI (Kerberos) authentication on Linux and macOS. The C wrapper implementation contains a heap out-of-bounds read vulnerability due to incorrect assumptions about string termination in the GSSAPI standard. Since GSSAPI buffers are not guaranteed to be null-terminated or have extra padding, this results in reading one byte past the allocated heap buffer.","cvss":[{"source":"cna@mongodb.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"vendorMetadata":{}},{"source":"cna@mongodb.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":6.5,"exploitabilityScore":2.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-2303","epss":0.00318,"percentile":0.2482,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-2303","cwe":"CWE-183","source":"cna@mongodb.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"go.mongodb.org/mongo-driver","version":"v1.17.6"}},"found":{"vulnerabilityID":"GHSA-cp6g-7hqx-qxhp","versionConstraint":"<1.17.7 (go)"},"fix":{"suggestedVersion":"1.17.7"}}],"artifact":{"id":"pkg:golang/go.mongodb.org/mongo-driver@v1.17.6?package-id=56456e2cddbac7d8","name":"go.mongodb.org/mongo-driver","version":"v1.17.6","type":"go-module","locations":[{"path":"/tool-imports/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":[],"purl":"pkg:golang/go.mongodb.org/mongo-driver@v1.17.6","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:87JUG1wZfWsr6rIz3ZmpH90rL5tea7O3IHuSwHUpsss="}}},{"vulnerability":{"id":"GHSA-qc2q-p7wx-3px3","dataSource":"https://github.com/advisories/GHSA-qc2q-p7wx-3px3","namespace":"github:language:go","severity":"Medium","urls":["https://github.com/grpc/grpc-go/security/advisories/GHSA-qc2q-p7wx-3px3","https://nvd.nist.gov/vuln/detail/CVE-2026-84303","https://github.com/grpc/grpc-go/pull/9332","https://github.com/grpc/grpc-go/pull/9335","https://github.com/grpc/grpc-go/commit/db9482836c298f234c896cf82ab68cafc78237f8","https://github.com/grpc/grpc-go/commit/ebba6f3f1b206e2b4dc4d1d5a96d18430302c2fe","https://github.com/grpc/grpc-go/releases/tag/v1.83.1"],"description":"gRPC-Go: xDS RBAC HTTP Filter bypass via mixed-case Header Matching and gRFC A41 validation evasion","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-84303","epss":0.00311,"percentile":0.23996,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-84303","cwe":"CWE-178","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-84303","cwe":"CWE-863","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.83.1"],"state":"fixed","available":[{"version":"1.83.1","date":"2026-09-09","kind":"first-observed"}]},"advisories":[],"risk":0.17571499999999998},"relatedVulnerabilities":[{"id":"CVE-2026-84303","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84303","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/grpc/grpc-go/commit/db9482836c298f234c896cf82ab68cafc78237f8","https://github.com/grpc/grpc-go/commit/ebba6f3f1b206e2b4dc4d1d5a96d18430302c2fe","https://github.com/grpc/grpc-go/pull/9332","https://github.com/grpc/grpc-go/pull/9335","https://github.com/grpc/grpc-go/releases/tag/v1.83.1","https://github.com/grpc/grpc-go/security/advisories/GHSA-qc2q-p7wx-3px3"],"description":"gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, the xDS RBAC HTTP filter in internal/xds/httpfilter/rbac/rbac.go does not lowercase header matcher names in normalizeHeaderMatcher even though incoming metadata keys are lowercase. A DENY policy using a mixed-case name such as X-Role or User-Agent therefore does not match and fails open, allowing requests that should be rejected. The same case mismatch permits :Scheme or Grpc-Status to evade gRFC A41 validation and prevents Host from being rewritten to :authority. This issue is fixed in version 1.83.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-84303","epss":0.00311,"percentile":0.23996,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-84303","cwe":"CWE-178","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-84303","cwe":"CWE-863","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"google.golang.org/grpc","version":"v1.75.1"}},"found":{"vulnerabilityID":"GHSA-qc2q-p7wx-3px3","versionConstraint":"<=1.83.0 (go)"},"fix":{"suggestedVersion":"1.83.1"}}],"artifact":{"id":"pkg:golang/google.golang.org/grpc@v1.75.1?package-id=fe766a98fd2603ca","name":"google.golang.org/grpc","version":"v1.75.1","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:google:grpc:v1.75.1:*:*:*:*:*:*:*"],"purl":"pkg:golang/google.golang.org/grpc@v1.75.1","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:/ODCNEuf9VghjgO3rqLcfg8fiOP0nSluljWFlDxELLI="}}},{"vulnerability":{"id":"GHSA-qc2q-p7wx-3px3","dataSource":"https://github.com/advisories/GHSA-qc2q-p7wx-3px3","namespace":"github:language:go","severity":"Medium","urls":["https://github.com/grpc/grpc-go/security/advisories/GHSA-qc2q-p7wx-3px3","https://nvd.nist.gov/vuln/detail/CVE-2026-84303","https://github.com/grpc/grpc-go/pull/9332","https://github.com/grpc/grpc-go/pull/9335","https://github.com/grpc/grpc-go/commit/db9482836c298f234c896cf82ab68cafc78237f8","https://github.com/grpc/grpc-go/commit/ebba6f3f1b206e2b4dc4d1d5a96d18430302c2fe","https://github.com/grpc/grpc-go/releases/tag/v1.83.1"],"description":"gRPC-Go: xDS RBAC HTTP Filter bypass via mixed-case Header Matching and gRFC A41 validation evasion","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-84303","epss":0.00311,"percentile":0.23996,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-84303","cwe":"CWE-178","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-84303","cwe":"CWE-863","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.83.1"],"state":"fixed","available":[{"version":"1.83.1","date":"2026-09-09","kind":"first-observed"}]},"advisories":[],"risk":0.17571499999999998},"relatedVulnerabilities":[{"id":"CVE-2026-84303","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84303","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/grpc/grpc-go/commit/db9482836c298f234c896cf82ab68cafc78237f8","https://github.com/grpc/grpc-go/commit/ebba6f3f1b206e2b4dc4d1d5a96d18430302c2fe","https://github.com/grpc/grpc-go/pull/9332","https://github.com/grpc/grpc-go/pull/9335","https://github.com/grpc/grpc-go/releases/tag/v1.83.1","https://github.com/grpc/grpc-go/security/advisories/GHSA-qc2q-p7wx-3px3"],"description":"gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, the xDS RBAC HTTP filter in internal/xds/httpfilter/rbac/rbac.go does not lowercase header matcher names in normalizeHeaderMatcher even though incoming metadata keys are lowercase. A DENY policy using a mixed-case name such as X-Role or User-Agent therefore does not match and fails open, allowing requests that should be rejected. The same case mismatch permits :Scheme or Grpc-Status to evade gRFC A41 validation and prevents Host from being rewritten to :authority. This issue is fixed in version 1.83.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-84303","epss":0.00311,"percentile":0.23996,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-84303","cwe":"CWE-178","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-84303","cwe":"CWE-863","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"google.golang.org/grpc","version":"v1.78.0"}},"found":{"vulnerabilityID":"GHSA-qc2q-p7wx-3px3","versionConstraint":"<=1.83.0 (go)"},"fix":{"suggestedVersion":"1.83.1"}}],"artifact":{"id":"pkg:golang/google.golang.org/grpc@v1.78.0?package-id=c776a416fb4b5ef1","name":"google.golang.org/grpc","version":"v1.78.0","type":"go-module","locations":[{"path":"/tool-imports/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:google:grpc:v1.78.0:*:*:*:*:*:*:*"],"purl":"pkg:golang/google.golang.org/grpc@v1.78.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:K1XZG/yGDJnzMdd/uZHAkVqJE+xIDOcmdSFZkBUicNc="}}},{"vulnerability":{"id":"GHSA-vvm8-gf78-28g4","dataSource":"https://github.com/advisories/GHSA-vvm8-gf78-28g4","namespace":"github:language:go","severity":"Medium","urls":["https://github.com/go-jose/go-jose/security/advisories/GHSA-vvm8-gf78-28g4","https://nvd.nist.gov/vuln/detail/CVE-2026-116586","https://github.com/go-jose/go-jose/pull/290","https://github.com/go-jose/go-jose/commit/a31af25836222f4c45d366d6e8f9b1049dd9935a","https://github.com/go-jose/go-jose/releases/tag/v4.1.5"],"description":"Go JOSE: Panics in JSON parsing","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-116586","epss":0.00292,"percentile":0.2177,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-116586","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.1.5"],"state":"fixed","available":[{"version":"4.1.5","date":"2026-10-29","kind":"first-observed"}]},"advisories":[],"risk":0.17373999999999998},"relatedVulnerabilities":[{"id":"CVE-2026-116586","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116586","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/go-jose/go-jose/commit/a31af25836222f4c45d366d6e8f9b1049dd9935a","https://github.com/go-jose/go-jose/pull/290","https://github.com/go-jose/go-jose/releases/tag/v4.1.5","https://github.com/go-jose/go-jose/security/advisories/GHSA-vvm8-gf78-28g4"],"description":"Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.5, parsing attacker-controlled JSON through go-jose allows deeply nested arrays or objects to exceed Go's stack limit. The resulting stack overflow crashes the application and permits denial of service in applications that parse untrusted JSON through go-jose. This issue is fixed in version 4.1.5.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-116586","epss":0.00292,"percentile":0.2177,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-116586","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"github.com/go-jose/go-jose/v4","version":"v4.1.3"}},"found":{"vulnerabilityID":"GHSA-vvm8-gf78-28g4","versionConstraint":"<4.1.5 (go)"},"fix":{"suggestedVersion":"4.1.5"}}],"artifact":{"id":"pkg:golang/github.com/go-jose/go-jose/v4@v4.1.3?package-id=4c794cc45b14cae8","name":"github.com/go-jose/go-jose/v4","version":"v4.1.3","type":"go-module","locations":[{"path":"/tool-imports/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:go-jose:go-jose\\/v4:v4.1.3:*:*:*:*:*:*:*","cpe:2.3:a:go-jose:go_jose\\/v4:v4.1.3:*:*:*:*:*:*:*","cpe:2.3:a:go_jose:go-jose\\/v4:v4.1.3:*:*:*:*:*:*:*","cpe:2.3:a:go_jose:go_jose\\/v4:v4.1.3:*:*:*:*:*:*:*","cpe:2.3:a:go:go-jose\\/v4:v4.1.3:*:*:*:*:*:*:*","cpe:2.3:a:go:go_jose\\/v4:v4.1.3:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/go-jose/go-jose/v4@v4.1.3","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:CVLmWDhDVRa6Mi/IgCgaopNosCaHz7zrMeF9MlZRkrs="}}},{"vulnerability":{"id":"GHSA-qpw4-5x99-6vjp","dataSource":"https://github.com/advisories/GHSA-qpw4-5x99-6vjp","namespace":"github:language:go","severity":"Medium","urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-39827","https://go.dev/cl/781320","https://go.dev/issue/35127","https://groups.google.com/g/golang-announce/c/a082jnz-LvI","https://pkg.go.dev/vuln/GO-2026-5016"],"description":"golang.org/x/crypto: Invoking memory leak when rejecting channels can lead to DoS","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"exploitabilityScore":2.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-39827","epss":0.00279,"percentile":0.20461,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-39827","cwe":"CWE-924","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["0.52.0"],"state":"fixed","available":[{"version":"0.52.0","date":"2026-07-07","kind":"first-observed"}]},"advisories":[],"risk":0.16042499999999998},"relatedVulnerabilities":[{"id":"CVE-2026-39827","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-39827","namespace":"nvd:cpe","severity":"Medium","urls":["https://go.dev/cl/781320","https://go.dev/issue/35127","https://groups.google.com/g/golang-announce/c/a082jnz-LvI","https://pkg.go.dev/vuln/GO-2026-5016"],"description":"An authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users. Rejected channels are now properly removed from the connection's internal state and released for garbage collection.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"exploitabilityScore":2.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-39827","epss":0.00279,"percentile":0.20461,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-39827","cwe":"CWE-924","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"golang.org/x/crypto","version":"v0.46.0"}},"found":{"vulnerabilityID":"GHSA-qpw4-5x99-6vjp","versionConstraint":"<0.52.0 (go)"},"fix":{"suggestedVersion":"0.52.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/crypto@v0.46.0?package-id=b3387fbedc5d73be","name":"golang.org/x/crypto","version":"v0.46.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:crypto:v0.46.0:*:*:*:*:go:*:*","cpe:2.3:a:go:ssh:v0.46.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/crypto@v0.46.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:cKRW/pmt1pKAfetfu+RCEvjvZkA9RimPbh7bhFjGVBU="}}},{"vulnerability":{"id":"GHSA-qpw4-5x99-6vjp","dataSource":"https://github.com/advisories/GHSA-qpw4-5x99-6vjp","namespace":"github:language:go","severity":"Medium","urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-39827","https://go.dev/cl/781320","https://go.dev/issue/35127","https://groups.google.com/g/golang-announce/c/a082jnz-LvI","https://pkg.go.dev/vuln/GO-2026-5016"],"description":"golang.org/x/crypto: Invoking memory leak when rejecting channels can lead to DoS","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"exploitabilityScore":2.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-39827","epss":0.00279,"percentile":0.20461,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-39827","cwe":"CWE-924","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["0.52.0"],"state":"fixed","available":[{"version":"0.52.0","date":"2026-07-07","kind":"first-observed"}]},"advisories":[],"risk":0.16042499999999998},"relatedVulnerabilities":[{"id":"CVE-2026-39827","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-39827","namespace":"nvd:cpe","severity":"Medium","urls":["https://go.dev/cl/781320","https://go.dev/issue/35127","https://groups.google.com/g/golang-announce/c/a082jnz-LvI","https://pkg.go.dev/vuln/GO-2026-5016"],"description":"An authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users. Rejected channels are now properly removed from the connection's internal state and released for garbage collection.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"exploitabilityScore":2.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-39827","epss":0.00279,"percentile":0.20461,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-39827","cwe":"CWE-924","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"golang.org/x/crypto","version":"v0.48.0"}},"found":{"vulnerabilityID":"GHSA-qpw4-5x99-6vjp","versionConstraint":"<0.52.0 (go)"},"fix":{"suggestedVersion":"0.52.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/crypto@v0.48.0?package-id=764d3323ecdb54e3","name":"golang.org/x/crypto","version":"v0.48.0","type":"go-module","locations":[{"path":"/tool-imports/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:crypto:v0.48.0:*:*:*:*:go:*:*","cpe:2.3:a:go:ssh:v0.48.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/crypto@v0.48.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:/VRzVqiRSggnhY7gNRxPauEQ5Drw9haKdM0jqfcCFts="}}},{"vulnerability":{"id":"GHSA-jpcc-p29g-p8mq","dataSource":"https://github.com/advisories/GHSA-jpcc-p29g-p8mq","namespace":"github:language:go","severity":"Medium","urls":["https://github.com/containerd/containerd/security/advisories/GHSA-jpcc-p29g-p8mq"],"description":"containerd image-triggered runtime DoS via unbounded group parsing","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-47262","epss":0.00265,"percentile":0.18462,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-47262","cwe":"CWE-400","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["1.7.33"],"state":"fixed","available":[{"version":"1.7.33","date":"2026-06-20","kind":"first-observed"}]},"advisories":[],"risk":0.157675},"relatedVulnerabilities":[{"id":"CVE-2026-47262","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47262","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/containerd/containerd/security/advisories/GHSA-jpcc-p29g-p8mq"],"description":"containerd is an open-source container runtime. Versions prior to 1.7.33, 2.0.10, 2.1.9, 2.2.5 and 2.3.2, contain a vulnerability that allows a maliciously crafted image to cause a Denial of Service (DoS) condition. When creating a container from this image, memory exhaustion occurs, leading to an Out Of Memory (OOM) kill of the containerd process. This renders the container runtime API unavailable and can disrupt clients such as the Docker Engine or Kubernetes control-plane components. This issue has been fixed in versions 1.7.33, 2.0.10, 2.1.9, 2.2.5 and 2.3.2.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"exploitabilityScore":1.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-47262","epss":0.00265,"percentile":0.18462,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-47262","cwe":"CWE-400","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"github.com/containerd/containerd","version":"v1.7.30"}},"found":{"vulnerabilityID":"GHSA-jpcc-p29g-p8mq","versionConstraint":">=1.7.0,<1.7.33 (go)"},"fix":{"suggestedVersion":"1.7.33"}}],"artifact":{"id":"pkg:golang/github.com/containerd/containerd@v1.7.30?package-id=f22ca3ad39ee58c2","name":"github.com/containerd/containerd","version":"v1.7.30","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:containerd:containerd:v1.7.30:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/containerd/containerd@v1.7.30","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:/2vezDpLDVGGmkUXmlNPLCCNKHJ5BbC5tJB5JNzQhqE="}}},{"vulnerability":{"id":"GHSA-4w3g-jfj2-cw2q","dataSource":"https://github.com/advisories/GHSA-4w3g-jfj2-cw2q","namespace":"github:language:go","severity":"Medium","urls":["https://github.com/go-jose/go-jose/security/advisories/GHSA-4w3g-jfj2-cw2q","https://nvd.nist.gov/vuln/detail/CVE-2026-116585","https://github.com/go-jose/go-jose/pull/292","https://github.com/go-jose/go-jose/commit/35883f7999e87cbd1b1f4cda07fdad8cd71c3dd6","https://github.com/go-jose/go-jose/commit/74114c2fa22669a2b2a296746eaa82e15566fd54","https://github.com/go-jose/go-jose/releases/tag/v4.1.5"],"description":"Go JOSE: Panic during CBC-HMAC processing","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-116585","epss":0.00264,"percentile":0.18374,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-116585","cwe":"CWE-129","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.1.5"],"state":"fixed","available":[{"version":"4.1.5","date":"2026-10-29","kind":"first-observed"}]},"advisories":[],"risk":0.15708},"relatedVulnerabilities":[{"id":"CVE-2026-116585","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116585","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/go-jose/go-jose/commit/35883f7999e87cbd1b1f4cda07fdad8cd71c3dd6","https://github.com/go-jose/go-jose/commit/74114c2fa22669a2b2a296746eaa82e15566fd54","https://github.com/go-jose/go-jose/pull/292","https://github.com/go-jose/go-jose/releases/tag/v4.1.5","https://github.com/go-jose/go-jose/security/advisories/GHSA-4w3g-jfj2-cw2q"],"description":"Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.5, decrypting untrusted JWE ciphertext with A128CBC-HS256, A192CBC-HS384, or A256CBC-HS512 can pass an empty ciphertext buffer to CBC-HMAC unpadding. Insufficient validation allows the empty buffer to be indexed, causing a panic and denial of service. Applications that decrypt attacker-controlled ciphertext with one of these content-encryption algorithms are affected. This issue is fixed in version 4.1.5.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-116585","epss":0.00264,"percentile":0.18374,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-116585","cwe":"CWE-129","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"github.com/go-jose/go-jose/v4","version":"v4.1.3"}},"found":{"vulnerabilityID":"GHSA-4w3g-jfj2-cw2q","versionConstraint":"<4.1.5 (go)"},"fix":{"suggestedVersion":"4.1.5"}}],"artifact":{"id":"pkg:golang/github.com/go-jose/go-jose/v4@v4.1.3?package-id=4c794cc45b14cae8","name":"github.com/go-jose/go-jose/v4","version":"v4.1.3","type":"go-module","locations":[{"path":"/tool-imports/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:go-jose:go-jose\\/v4:v4.1.3:*:*:*:*:*:*:*","cpe:2.3:a:go-jose:go_jose\\/v4:v4.1.3:*:*:*:*:*:*:*","cpe:2.3:a:go_jose:go-jose\\/v4:v4.1.3:*:*:*:*:*:*:*","cpe:2.3:a:go_jose:go_jose\\/v4:v4.1.3:*:*:*:*:*:*:*","cpe:2.3:a:go:go-jose\\/v4:v4.1.3:*:*:*:*:*:*:*","cpe:2.3:a:go:go_jose\\/v4:v4.1.3:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/go-jose/go-jose/v4@v4.1.3","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:CVLmWDhDVRa6Mi/IgCgaopNosCaHz7zrMeF9MlZRkrs="}}},{"vulnerability":{"id":"GHSA-crhj-59gh-8x96","dataSource":"https://github.com/advisories/GHSA-crhj-59gh-8x96","namespace":"github:language:go","severity":"Medium","urls":["https://github.com/go-git/go-git/security/advisories/GHSA-crhj-59gh-8x96","https://nvd.nist.gov/vuln/detail/CVE-2026-45571"],"description":"go-git: Crafted repositories may modify main and submodule .git directories","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L","metrics":{"baseScore":5.4,"exploitabilityScore":2.9,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-45571","epss":0.00297,"percentile":0.22424,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-45571","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["5.19.1"],"state":"fixed","available":[{"version":"5.19.1","date":"2026-05-19","kind":"first-observed"}]},"advisories":[],"risk":0.15444},"relatedVulnerabilities":[{"id":"CVE-2026-45571","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-45571","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/go-git/go-git/security/advisories/GHSA-crhj-59gh-8x96"],"description":"go-git is an extensible git implementation library written in pure Go. Prior to 5.19.1 and 6.0.0-alpha.4, a path validation issue in go-git could allow crafted repository data to affect files outside the intended checkout target, including the repository's .git directory. These validations were introduced in upstream Git years ago, so the vulnerability arose from go-git drifting from those checks. This vulnerability is fixed in 5.19.1 and 6.0.0-alpha.4.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L","metrics":{"baseScore":5.4,"exploitabilityScore":2.9,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-45571","epss":0.00297,"percentile":0.22424,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-45571","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"github.com/go-git/go-git/v5","version":"v5.16.5"}},"found":{"vulnerabilityID":"GHSA-crhj-59gh-8x96","versionConstraint":"<=5.19.0 (go)"},"fix":{"suggestedVersion":"5.19.1"}}],"artifact":{"id":"pkg:golang/github.com/go-git/go-git/v5@v5.16.5?package-id=0c14767230083f4a","name":"github.com/go-git/go-git/v5","version":"v5.16.5","type":"go-module","locations":[{"path":"/tool-imports/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:go-git:go-git\\/v5:v5.16.5:*:*:*:*:*:*:*","cpe:2.3:a:go-git:go_git\\/v5:v5.16.5:*:*:*:*:*:*:*","cpe:2.3:a:go_git:go-git\\/v5:v5.16.5:*:*:*:*:*:*:*","cpe:2.3:a:go_git:go_git\\/v5:v5.16.5:*:*:*:*:*:*:*","cpe:2.3:a:go:go-git\\/v5:v5.16.5:*:*:*:*:*:*:*","cpe:2.3:a:go:go_git\\/v5:v5.16.5:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/go-git/go-git/v5@v5.16.5","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:mdkuqblwr57kVfXri5TTH+nMFLNUxIj9Z7F5ykFbw5s="}}},{"vulnerability":{"id":"GHSA-r48c-v28r-pf6v","dataSource":"https://github.com/advisories/GHSA-r48c-v28r-pf6v","namespace":"github:language:go","severity":"Medium","urls":["https://github.com/modelcontextprotocol/registry/security/advisories/GHSA-r48c-v28r-pf6v","https://github.com/modelcontextprotocol/registry/pull/1250","https://github.com/modelcontextprotocol/registry/commit/f5f40bd98084466eaf18fe48ea62a0d534caa774","https://github.com/modelcontextprotocol/registry/releases/tag/v1.7.7","https://nvd.nist.gov/vuln/detail/CVE-2026-44430"],"description":"MCP Registry has an unauthenticated SSRF: HTTP namespace verification dials 6to4 / NAT64 / site-local IPv6 addresses, bypassing private-address allowlist","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N","metrics":{"baseScore":4,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-44430","epss":0.00285,"percentile":0.21042,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-44430","cwe":"CWE-918","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.7.7"],"state":"fixed","available":[{"version":"1.7.7","date":"2026-05-09","kind":"first-observed"}]},"advisories":[],"risk":0.14463750000000003},"relatedVulnerabilities":[{"id":"CVE-2026-44430","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44430","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/modelcontextprotocol/registry/security/advisories/GHSA-r48c-v28r-pf6v"],"description":"The MCP Registry provides MCP clients with a list of MCP servers, like an app store for MCP servers. Prior to 1.7.7, the Registry's HTTP-based namespace verification (POST /v0/auth/http, POST /v0.1/auth/http) uses safeDialContext (internal/api/handlers/v0/auth/http.go:67-110) to refuse dialling private/internal addresses when fetching the well-known public-key file from a publisher-supplied domain. The blocklist (isBlockedIP, lines 125-133) relies entirely on Go stdlib's IsLoopback / IsPrivate / IsLinkLocalUnicast / IsMulticast / IsUnspecified plus a manual CGNAT range. None of these cover IPv6 6to4 (2002::/16), NAT64 (64:ff9b::/96 and 64:ff9b:1::/48 per RFC 8215), or deprecated site-local (fec0::/10) — all of which encode arbitrary IPv4 in the address bits and tunnel to RFC1918 / cloud-metadata services on dual-stack / NAT64-enabled hosts. This vulnerability is fixed in 1.7.7.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N","metrics":{"baseScore":4,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-44430","epss":0.00285,"percentile":0.21042,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-44430","cwe":"CWE-918","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"github.com/modelcontextprotocol/registry","version":"v1.3.10"}},"found":{"vulnerabilityID":"GHSA-r48c-v28r-pf6v","versionConstraint":"<1.7.7 (go)"},"fix":{"suggestedVersion":"1.7.7"}}],"artifact":{"id":"pkg:golang/github.com/modelcontextprotocol/registry@v1.3.10?package-id=9fa26fe0e176e8ec","name":"github.com/modelcontextprotocol/registry","version":"v1.3.10","type":"go-module","locations":[{"path":"/tool-imports/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:modelcontextprotocol:registry:v1.3.10:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/modelcontextprotocol/registry@v1.3.10","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:sLVSjsHL2ox1HHBy7dVfp45UKIYBjfS+7VKwwJGD79c="}}},{"vulnerability":{"id":"GHSA-xhf5-7wjv-pqxp","dataSource":"https://github.com/advisories/GHSA-xhf5-7wjv-pqxp","namespace":"github:language:go","severity":"High","urls":["https://github.com/containerd/containerd/security/advisories/GHSA-xhf5-7wjv-pqxp"],"description":"containerd CRI — image-config `LABEL` flows to restart-monitor `binary://` logger: host-root command execution from an image pull","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-53488","epss":0.00176,"percentile":0.07132,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-53488","cwe":"CWE-20","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.7.33"],"state":"fixed","available":[{"version":"1.7.33","date":"2026-06-20","kind":"first-observed"}]},"advisories":[],"risk":0.14256},"relatedVulnerabilities":[{"id":"CVE-2026-53488","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-53488","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/containerd/containerd/security/advisories/GHSA-xhf5-7wjv-pqxp"],"description":"containerd is an open-source container runtime. In versions prior to 1.7.33, 2.3.2, 2.2.5, 2.1.9, and 2.0.10 the CRI plugin propagates labels from an image config (LABEL instruction in Dockerfile) to a container without validation. This may result in executing an arbitrary command on the host, via a plugin that consumes container labels for some operations. This issue has been fixed in versions 1.7.33, 2.3.2, 2.2.5, 2.1.9, and 2.0.10.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.8,"exploitabilityScore":2.1,"impactScore":6.1},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-53488","epss":0.00176,"percentile":0.07132,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-53488","cwe":"CWE-20","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"github.com/containerd/containerd","version":"v1.7.30"}},"found":{"vulnerabilityID":"GHSA-xhf5-7wjv-pqxp","versionConstraint":">=1.7.0,<1.7.33 (go)"},"fix":{"suggestedVersion":"1.7.33"}}],"artifact":{"id":"pkg:golang/github.com/containerd/containerd@v1.7.30?package-id=f22ca3ad39ee58c2","name":"github.com/containerd/containerd","version":"v1.7.30","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:containerd:containerd:v1.7.30:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/containerd/containerd@v1.7.30","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:/2vezDpLDVGGmkUXmlNPLCCNKHJ5BbC5tJB5JNzQhqE="}}},{"vulnerability":{"id":"GO-2026-5025","dataSource":"https://go.dev/issue/79571","namespace":"govulndb:language:go","severity":"Medium","urls":["https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8","https://go.dev/cl/781700"],"description":"Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":2.9,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-42506","epss":0.00235,"percentile":0.1457,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-42506","cwe":"CWE-79","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["0.55.0"],"state":"fixed","available":[{"version":"0.55.0","date":"2026-05-22","kind":"release"}]},"advisories":[],"risk":0.13042499999999999},"relatedVulnerabilities":[{"id":"CVE-2026-42506","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42506","namespace":"nvd:cpe","severity":"Medium","urls":["https://go.dev/cl/781700","https://go.dev/issue/79571","https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8","https://pkg.go.dev/vuln/GO-2026-5025"],"description":"Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":2.9,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-42506","epss":0.00235,"percentile":0.1457,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-42506","cwe":"CWE-79","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"golang.org/x/net","version":"v0.48.0"}},"found":{"vulnerabilityID":"GO-2026-5025","versionConstraint":"<0.55.0 (go)"},"fix":{"suggestedVersion":"0.55.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/net@v0.48.0?package-id=7e3c0e57ff3d79d8","name":"golang.org/x/net","version":"v0.48.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:networking:v0.48.0:*:*:*:*:go:*:*","cpe:2.3:a:golang:net:v0.48.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/net@v0.48.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:zyQRTTrjc33Lhh0fBgT/H3oZq9WuvRR5gPC70xpDiQU="}}},{"vulnerability":{"id":"GO-2026-5025","dataSource":"https://go.dev/issue/79571","namespace":"govulndb:language:go","severity":"Medium","urls":["https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8","https://go.dev/cl/781700"],"description":"Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":2.9,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-42506","epss":0.00235,"percentile":0.1457,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-42506","cwe":"CWE-79","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["0.55.0"],"state":"fixed","available":[{"version":"0.55.0","date":"2026-05-22","kind":"release"}]},"advisories":[],"risk":0.13042499999999999},"relatedVulnerabilities":[{"id":"CVE-2026-42506","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42506","namespace":"nvd:cpe","severity":"Medium","urls":["https://go.dev/cl/781700","https://go.dev/issue/79571","https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8","https://pkg.go.dev/vuln/GO-2026-5025"],"description":"Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":2.9,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-42506","epss":0.00235,"percentile":0.1457,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-42506","cwe":"CWE-79","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"golang.org/x/net","version":"v0.50.0"}},"found":{"vulnerabilityID":"GO-2026-5025","versionConstraint":"<0.55.0 (go)"},"fix":{"suggestedVersion":"0.55.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/net@v0.50.0?package-id=a205ae7dff8c80d8","name":"golang.org/x/net","version":"v0.50.0","type":"go-module","locations":[{"path":"/tool-imports/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:networking:v0.50.0:*:*:*:*:go:*:*","cpe:2.3:a:golang:net:v0.50.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/net@v0.50.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:ucWh9eiCGyDR3vtzso0WMQinm2Dnt8cFMuQa9K33J60="}}},{"vulnerability":{"id":"GHSA-685w-q87j-wqw3","dataSource":"https://github.com/advisories/GHSA-685w-q87j-wqw3","namespace":"github:language:go","severity":"Medium","urls":["https://github.com/distribution/distribution/security/advisories/GHSA-685w-q87j-wqw3","https://nvd.nist.gov/vuln/detail/CVE-2026-85747","https://github.com/distribution/distribution/commit/8f91c26c8888a95a36c2357a6e30bc15d4dd76d3","https://github.com/distribution/distribution/commit/960439b09f342cdeb8f1c0e18e8c7349bdcfbf80","https://github.com/distribution/distribution/releases/tag/v3.1.2"],"description":"Distribution: Client `manifests.Get()` does not verify returned content against requested digest","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N","metrics":{"baseScore":6.8,"exploitabilityScore":2.3,"impactScore":4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-85747","epss":0.00218,"percentile":0.12279,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-85747","cwe":"CWE-354","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.12861999999999998},"relatedVulnerabilities":[{"id":"CVE-2026-85747","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-85747","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/distribution/distribution/commit/960439b09f342cdeb8f1c0e18e8c7349bdcfbf80","https://github.com/distribution/distribution/releases/tag/v3.1.2","https://github.com/distribution/distribution/security/advisories/GHSA-685w-q87j-wqw3"],"description":"Distribution is a toolkit to pack, ship, store, and deliver container content. Prior to 3.1.2, registry/client.(*manifests).Get() reads a manifest returned for a digest-pinned request and passes it to distribution.UnmarshalManifest without hashing the body against the requested digest, allowing a malicious or intercepted registry response to substitute attacker-chosen manifest content even when Docker-Content-Digest claims the requested value. The bundled pull-through proxy in registry/proxy/proxymanifeststore.go can cache and re-serve the substituted manifest. This issue is fixed in version 3.1.2.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N","metrics":{"baseScore":6.8,"exploitabilityScore":2.3,"impactScore":4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-85747","epss":0.00218,"percentile":0.12279,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-85747","cwe":"CWE-354","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"github.com/docker/distribution","version":"v2.8.3+incompatible"}},"found":{"vulnerabilityID":"GHSA-685w-q87j-wqw3","versionConstraint":"<=2.8.3 (go)"}}],"artifact":{"id":"pkg:golang/github.com/docker/distribution@v2.8.3%2Bincompatible?package-id=4d2ba37f0e11125b","name":"github.com/docker/distribution","version":"v2.8.3+incompatible","type":"go-module","locations":[{"path":"/tool-imports/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:docker:distribution:v2.8.3\\+incompatible:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/docker/distribution@v2.8.3%2Bincompatible","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:AtKxIZ36LoNK51+Z6RpzLpddBirtxJnzDrHLEKxTAYk="}}},{"vulnerability":{"id":"GHSA-3xc5-wrhm-f963","dataSource":"https://github.com/advisories/GHSA-3xc5-wrhm-f963","namespace":"github:language:go","severity":"Medium","urls":["https://github.com/go-git/go-git/security/advisories/GHSA-3xc5-wrhm-f963","https://nvd.nist.gov/vuln/detail/CVE-2026-41506","https://github.com/go-git/go-git/releases/tag/v5.18.0","https://github.com/go-git/go-git/releases/tag/v6.0.0-alpha.2"],"description":"go-git: Credential leak via cross-host redirect in smart HTTP transport","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N","metrics":{"baseScore":4.7,"exploitabilityScore":2.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-41506","epss":0.00259,"percentile":0.17615,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-41506","cwe":"CWE-522","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["5.18.0"],"state":"fixed","available":[{"version":"5.18.0","date":"2026-04-18","kind":"first-observed"}]},"advisories":[],"risk":0.125615},"relatedVulnerabilities":[{"id":"CVE-2026-41506","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-41506","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/go-git/go-git/releases/tag/v5.18.0","https://github.com/go-git/go-git/releases/tag/v6.0.0-alpha.2","https://github.com/go-git/go-git/security/advisories/GHSA-3xc5-wrhm-f963"],"description":"go-git is an extensible git implementation library written in pure Go. Prior to versions 5.18.0 and 6.0.0-alpha.2, go-git may leak HTTP authentication credentials when following redirects during smart-HTTP clone and fetch operations. This issue has been patched in versions 5.18.0 and 6.0.0-alpha.2.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N","metrics":{"baseScore":7.4,"exploitabilityScore":2.9,"impactScore":4},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N","metrics":{"baseScore":4.7,"exploitabilityScore":2.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-41506","epss":0.00259,"percentile":0.17615,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-41506","cwe":"CWE-522","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"github.com/go-git/go-git/v5","version":"v5.16.5"}},"found":{"vulnerabilityID":"GHSA-3xc5-wrhm-f963","versionConstraint":"<=5.17.2 (go)"},"fix":{"suggestedVersion":"5.18.0"}}],"artifact":{"id":"pkg:golang/github.com/go-git/go-git/v5@v5.16.5?package-id=0c14767230083f4a","name":"github.com/go-git/go-git/v5","version":"v5.16.5","type":"go-module","locations":[{"path":"/tool-imports/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:go-git:go-git\\/v5:v5.16.5:*:*:*:*:*:*:*","cpe:2.3:a:go-git:go_git\\/v5:v5.16.5:*:*:*:*:*:*:*","cpe:2.3:a:go_git:go-git\\/v5:v5.16.5:*:*:*:*:*:*:*","cpe:2.3:a:go_git:go_git\\/v5:v5.16.5:*:*:*:*:*:*:*","cpe:2.3:a:go:go-git\\/v5:v5.16.5:*:*:*:*:*:*:*","cpe:2.3:a:go:go_git\\/v5:v5.16.5:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/go-git/go-git/v5@v5.16.5","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:mdkuqblwr57kVfXri5TTH+nMFLNUxIj9Z7F5ykFbw5s="}}},{"vulnerability":{"id":"GO-2026-5694","dataSource":"https://github.com/sigstore/cosign/security/advisories/GHSA-w6c6-c85g-mmv6","namespace":"govulndb:language:go","severity":"Medium","urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-39395"],"description":"Cosign's verify-blob-attestation reports false positive when payload parsing fails in github.com/sigstore/cosign","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-39395","epss":0.00241,"percentile":0.15239,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-39395","cwe":"CWE-754","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["2.6.3"],"state":"fixed","available":[{"version":"2.6.3","date":"2026-04-06","kind":"release"}]},"advisories":[],"risk":0.12411499999999999},"relatedVulnerabilities":[{"id":"CVE-2026-39395","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-39395","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/sigstore/cosign/security/advisories/GHSA-w6c6-c85g-mmv6"],"description":"Cosign provides code signing and transparency for containers and binaries. Prior to 3.0.6 and 2.6.3, cosign verify-blob-attestation may erroneously report a \"Verified OK\" result for attestations with malformed payloads or mismatched predicate types. For old-format bundles and detached signatures, this was due to a logic flaw in the error handling of the predicate type validation. For new-format bundles, the predicate type validation was bypassed completely. This vulnerability is fixed in 3.0.6 and 2.6.3.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","metrics":{"baseScore":4.3,"exploitabilityScore":2.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-39395","epss":0.00241,"percentile":0.15239,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-39395","cwe":"CWE-754","source":"security-advisories@github.com","type":"Secondary"}]},{"id":"GHSA-w6c6-c85g-mmv6","dataSource":"https://github.com/advisories/GHSA-w6c6-c85g-mmv6","namespace":"github:language:go","severity":"Medium","urls":["https://github.com/sigstore/cosign/security/advisories/GHSA-w6c6-c85g-mmv6","https://nvd.nist.gov/vuln/detail/CVE-2026-39395"],"description":"Cosign's verify-blob-attestation reports false positive when payload parsing fails","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","metrics":{"baseScore":4.3,"exploitabilityScore":2.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-39395","epss":0.00241,"percentile":0.15239,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-39395","cwe":"CWE-754","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"github.com/sigstore/cosign/v2","version":"v2.6.2"}},"found":{"vulnerabilityID":"GO-2026-5694","versionConstraint":"<2.6.3 (go)"},"fix":{"suggestedVersion":"2.6.3"}}],"artifact":{"id":"pkg:golang/github.com/sigstore/cosign/v2@v2.6.2?package-id=16dea397dc987968","name":"github.com/sigstore/cosign/v2","version":"v2.6.2","type":"go-module","locations":[{"path":"/tool-imports/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:sigstore:cosign\\/v2:v2.6.2:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/sigstore/cosign/v2@v2.6.2","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:mi6EAUJoPZ+yuyooU7m06a1DZWJouwYgh9a67L9tm2M="}}},{"vulnerability":{"id":"GO-2026-5027","dataSource":"https://go.dev/issue/79572","namespace":"govulndb:language:go","severity":"Medium","urls":["https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8","https://go.dev/cl/781701"],"description":"Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":2.9,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-42502","epss":0.00223,"percentile":0.12987,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-42502","cwe":"CWE-1021","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["0.55.0"],"state":"fixed","available":[{"version":"0.55.0","date":"2026-05-22","kind":"release"}]},"advisories":[],"risk":0.12376500000000001},"relatedVulnerabilities":[{"id":"CVE-2026-42502","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42502","namespace":"nvd:cpe","severity":"Medium","urls":["https://go.dev/cl/781701","https://go.dev/issue/79572","https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8","https://pkg.go.dev/vuln/GO-2026-5027"],"description":"Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":2.9,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-42502","epss":0.00223,"percentile":0.12987,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-42502","cwe":"CWE-1021","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"golang.org/x/net","version":"v0.48.0"}},"found":{"vulnerabilityID":"GO-2026-5027","versionConstraint":"<0.55.0 (go)"},"fix":{"suggestedVersion":"0.55.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/net@v0.48.0?package-id=7e3c0e57ff3d79d8","name":"golang.org/x/net","version":"v0.48.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:networking:v0.48.0:*:*:*:*:go:*:*","cpe:2.3:a:golang:net:v0.48.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/net@v0.48.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:zyQRTTrjc33Lhh0fBgT/H3oZq9WuvRR5gPC70xpDiQU="}}},{"vulnerability":{"id":"GO-2026-5027","dataSource":"https://go.dev/issue/79572","namespace":"govulndb:language:go","severity":"Medium","urls":["https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8","https://go.dev/cl/781701"],"description":"Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":2.9,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-42502","epss":0.00223,"percentile":0.12987,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-42502","cwe":"CWE-1021","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["0.55.0"],"state":"fixed","available":[{"version":"0.55.0","date":"2026-05-22","kind":"release"}]},"advisories":[],"risk":0.12376500000000001},"relatedVulnerabilities":[{"id":"CVE-2026-42502","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42502","namespace":"nvd:cpe","severity":"Medium","urls":["https://go.dev/cl/781701","https://go.dev/issue/79572","https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8","https://pkg.go.dev/vuln/GO-2026-5027"],"description":"Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":2.9,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-42502","epss":0.00223,"percentile":0.12987,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-42502","cwe":"CWE-1021","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"golang.org/x/net","version":"v0.50.0"}},"found":{"vulnerabilityID":"GO-2026-5027","versionConstraint":"<0.55.0 (go)"},"fix":{"suggestedVersion":"0.55.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/net@v0.50.0?package-id=a205ae7dff8c80d8","name":"golang.org/x/net","version":"v0.50.0","type":"go-module","locations":[{"path":"/tool-imports/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:networking:v0.50.0:*:*:*:*:go:*:*","cpe:2.3:a:golang:net:v0.50.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/net@v0.50.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:ucWh9eiCGyDR3vtzso0WMQinm2Dnt8cFMuQa9K33J60="}}},{"vulnerability":{"id":"GO-2026-5029","dataSource":"https://go.dev/issue/79574","namespace":"govulndb:language:go","severity":"Medium","urls":["https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8","https://go.dev/cl/781703"],"description":"Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":2.9,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-25681","epss":0.00223,"percentile":0.12986,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-25681","cwe":"CWE-1021","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["0.55.0"],"state":"fixed","available":[{"version":"0.55.0","date":"2026-05-22","kind":"release"}]},"advisories":[],"risk":0.12376500000000001},"relatedVulnerabilities":[{"id":"CVE-2026-25681","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25681","namespace":"nvd:cpe","severity":"Medium","urls":["https://go.dev/cl/781703","https://go.dev/issue/79574","https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8","https://pkg.go.dev/vuln/GO-2026-5029"],"description":"Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":2.9,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-25681","epss":0.00223,"percentile":0.12986,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-25681","cwe":"CWE-1021","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"golang.org/x/net","version":"v0.48.0"}},"found":{"vulnerabilityID":"GO-2026-5029","versionConstraint":"<0.55.0 (go)"},"fix":{"suggestedVersion":"0.55.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/net@v0.48.0?package-id=7e3c0e57ff3d79d8","name":"golang.org/x/net","version":"v0.48.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:networking:v0.48.0:*:*:*:*:go:*:*","cpe:2.3:a:golang:net:v0.48.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/net@v0.48.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:zyQRTTrjc33Lhh0fBgT/H3oZq9WuvRR5gPC70xpDiQU="}}},{"vulnerability":{"id":"GO-2026-5030","dataSource":"https://go.dev/issue/79575","namespace":"govulndb:language:go","severity":"Medium","urls":["https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8","https://go.dev/cl/781685"],"description":"Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":2.9,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-27136","epss":0.00223,"percentile":0.12986,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-27136","cwe":"CWE-1021","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["0.55.0"],"state":"fixed","available":[{"version":"0.55.0","date":"2026-05-22","kind":"release"}]},"advisories":[],"risk":0.12376500000000001},"relatedVulnerabilities":[{"id":"CVE-2026-27136","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-27136","namespace":"nvd:cpe","severity":"Medium","urls":["https://go.dev/cl/781685","https://go.dev/issue/79575","https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8","https://pkg.go.dev/vuln/GO-2026-5030"],"description":"Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":2.9,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-27136","epss":0.00223,"percentile":0.12986,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-27136","cwe":"CWE-1021","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"golang.org/x/net","version":"v0.48.0"}},"found":{"vulnerabilityID":"GO-2026-5030","versionConstraint":"<0.55.0 (go)"},"fix":{"suggestedVersion":"0.55.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/net@v0.48.0?package-id=7e3c0e57ff3d79d8","name":"golang.org/x/net","version":"v0.48.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:networking:v0.48.0:*:*:*:*:go:*:*","cpe:2.3:a:golang:net:v0.48.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/net@v0.48.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:zyQRTTrjc33Lhh0fBgT/H3oZq9WuvRR5gPC70xpDiQU="}}},{"vulnerability":{"id":"GO-2026-5029","dataSource":"https://go.dev/issue/79574","namespace":"govulndb:language:go","severity":"Medium","urls":["https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8","https://go.dev/cl/781703"],"description":"Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":2.9,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-25681","epss":0.00223,"percentile":0.12986,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-25681","cwe":"CWE-1021","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["0.55.0"],"state":"fixed","available":[{"version":"0.55.0","date":"2026-05-22","kind":"release"}]},"advisories":[],"risk":0.12376500000000001},"relatedVulnerabilities":[{"id":"CVE-2026-25681","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25681","namespace":"nvd:cpe","severity":"Medium","urls":["https://go.dev/cl/781703","https://go.dev/issue/79574","https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8","https://pkg.go.dev/vuln/GO-2026-5029"],"description":"Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":2.9,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-25681","epss":0.00223,"percentile":0.12986,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-25681","cwe":"CWE-1021","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"golang.org/x/net","version":"v0.50.0"}},"found":{"vulnerabilityID":"GO-2026-5029","versionConstraint":"<0.55.0 (go)"},"fix":{"suggestedVersion":"0.55.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/net@v0.50.0?package-id=a205ae7dff8c80d8","name":"golang.org/x/net","version":"v0.50.0","type":"go-module","locations":[{"path":"/tool-imports/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:networking:v0.50.0:*:*:*:*:go:*:*","cpe:2.3:a:golang:net:v0.50.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/net@v0.50.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:ucWh9eiCGyDR3vtzso0WMQinm2Dnt8cFMuQa9K33J60="}}},{"vulnerability":{"id":"GO-2026-5030","dataSource":"https://go.dev/issue/79575","namespace":"govulndb:language:go","severity":"Medium","urls":["https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8","https://go.dev/cl/781685"],"description":"Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":2.9,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-27136","epss":0.00223,"percentile":0.12986,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-27136","cwe":"CWE-1021","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["0.55.0"],"state":"fixed","available":[{"version":"0.55.0","date":"2026-05-22","kind":"release"}]},"advisories":[],"risk":0.12376500000000001},"relatedVulnerabilities":[{"id":"CVE-2026-27136","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-27136","namespace":"nvd:cpe","severity":"Medium","urls":["https://go.dev/cl/781685","https://go.dev/issue/79575","https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8","https://pkg.go.dev/vuln/GO-2026-5030"],"description":"Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":2.9,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-27136","epss":0.00223,"percentile":0.12986,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-27136","cwe":"CWE-1021","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"golang.org/x/net","version":"v0.50.0"}},"found":{"vulnerabilityID":"GO-2026-5030","versionConstraint":"<0.55.0 (go)"},"fix":{"suggestedVersion":"0.55.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/net@v0.50.0?package-id=a205ae7dff8c80d8","name":"golang.org/x/net","version":"v0.50.0","type":"go-module","locations":[{"path":"/tool-imports/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:networking:v0.50.0:*:*:*:*:go:*:*","cpe:2.3:a:golang:net:v0.50.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/net@v0.50.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:ucWh9eiCGyDR3vtzso0WMQinm2Dnt8cFMuQa9K33J60="}}},{"vulnerability":{"id":"GHSA-fqw6-gf59-qr4w","dataSource":"https://github.com/advisories/GHSA-fqw6-gf59-qr4w","namespace":"github:language:go","severity":"High","urls":["https://github.com/containerd/containerd/security/advisories/GHSA-fqw6-gf59-qr4w","https://nvd.nist.gov/vuln/detail/CVE-2026-46680"],"description":"containerd user ID handling bypass allows runAsNonRoot evasion","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"exploitabilityScore":1.9,"impactScore":5.9},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":7.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-46680","epss":0.00163,"percentile":0.05457,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-46680","cwe":"CWE-269","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.7.32"],"state":"fixed","available":[{"version":"1.7.32","date":"2026-05-22","kind":"first-observed"}]},"advisories":[],"risk":0.12265749999999999},"relatedVulnerabilities":[{"id":"CVE-2026-46680","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-46680","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/containerd/containerd/security/advisories/GHSA-fqw6-gf59-qr4w"],"description":"containerd is an open-source container runtime. In versions prior to 1.7.32, 2.0.9, 2.2.4 and 2.3.1, containers launched with a numeric User directive that cannot be parsed as a 32-bit integer are incorrectly treated as a username, leading to runAsNonRoot evasion. If a crafted image provides an /etc/passwd file mapping this large numeric string to root, the container ultimately runs as root (UID 0). This allows the Kubernetes runAsNonRoot restriction to be bypassed, causing unexpected behavior for environments that require containers to run as a non-root user. This issue has been fixed in versions 1.7.32, 2.0.9, 2.2.4 and 2.3.1.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"exploitabilityScore":1.9,"impactScore":5.9},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-46680","epss":0.00163,"percentile":0.05457,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-46680","cwe":"CWE-269","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"github.com/containerd/containerd","version":"v1.7.30"}},"found":{"vulnerabilityID":"GHSA-fqw6-gf59-qr4w","versionConstraint":">=1.7.27,<1.7.32 (go)"},"fix":{"suggestedVersion":"1.7.32"}}],"artifact":{"id":"pkg:golang/github.com/containerd/containerd@v1.7.30?package-id=f22ca3ad39ee58c2","name":"github.com/containerd/containerd","version":"v1.7.30","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:containerd:containerd:v1.7.30:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/containerd/containerd@v1.7.30","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:/2vezDpLDVGGmkUXmlNPLCCNKHJ5BbC5tJB5JNzQhqE="}}},{"vulnerability":{"id":"GHSA-389r-gv7p-r3rp","dataSource":"https://github.com/advisories/GHSA-389r-gv7p-r3rp","namespace":"github:language:go","severity":"High","urls":["https://github.com/go-git/go-git/security/advisories/GHSA-389r-gv7p-r3rp","https://nvd.nist.gov/vuln/detail/CVE-2026-45022"],"description":"go-git's improper parsing of specially crafted objects may lead to inconsistent interpretation compared to upstream Git","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N","metrics":{"baseScore":7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-45022","epss":0.00159,"percentile":0.05072,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-45022","cwe":"CWE-180","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-45022","cwe":"CWE-345","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["5.19.0"],"state":"fixed","available":[{"version":"5.19.0","date":"2026-05-11","kind":"first-observed"}]},"advisories":[],"risk":0.11527499999999999},"relatedVulnerabilities":[{"id":"CVE-2026-45022","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-45022","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/go-git/go-git/security/advisories/GHSA-389r-gv7p-r3rp"],"description":"go-git is an extensible git implementation library written in pure Go. Prior to 5.19.0 and 6.0.0-alpha.3, go-git may parse malformed Git objects in a way that differs from upstream Git. When commit or tag objects contain ambiguous or malformed headers, go-git’s decoded representation may expose values differently from how Git itself would interpret or reject the same object. Additionally, go-git’s commit signing and verification logic operates over commit data reconstructed from go-git’s parsed representation rather than the original raw object bytes. As a result, go-git may sign or verify a commit payload that is not byte-for-byte equivalent to the object stored in the repository. This can cause a signature to appear valid for a commit whose displayed or effective metadata differs from the object that was intended to be signed. This vulnerability is fixed in 5.19.0 and 6.0.0-alpha.3.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-45022","epss":0.00159,"percentile":0.05072,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-45022","cwe":"CWE-180","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-45022","cwe":"CWE-345","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"github.com/go-git/go-git/v5","version":"v5.16.5"}},"found":{"vulnerabilityID":"GHSA-389r-gv7p-r3rp","versionConstraint":"<5.19.0 (go)"},"fix":{"suggestedVersion":"5.19.0"}}],"artifact":{"id":"pkg:golang/github.com/go-git/go-git/v5@v5.16.5?package-id=0c14767230083f4a","name":"github.com/go-git/go-git/v5","version":"v5.16.5","type":"go-module","locations":[{"path":"/tool-imports/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:go-git:go-git\\/v5:v5.16.5:*:*:*:*:*:*:*","cpe:2.3:a:go-git:go_git\\/v5:v5.16.5:*:*:*:*:*:*:*","cpe:2.3:a:go_git:go-git\\/v5:v5.16.5:*:*:*:*:*:*:*","cpe:2.3:a:go_git:go_git\\/v5:v5.16.5:*:*:*:*:*:*:*","cpe:2.3:a:go:go-git\\/v5:v5.16.5:*:*:*:*:*:*:*","cpe:2.3:a:go:go_git\\/v5:v5.16.5:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/go-git/go-git/v5@v5.16.5","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:mdkuqblwr57kVfXri5TTH+nMFLNUxIj9Z7F5ykFbw5s="}}},{"vulnerability":{"id":"GHSA-x86f-5xw2-fm2r","dataSource":"https://github.com/advisories/GHSA-x86f-5xw2-fm2r","namespace":"github:language:go","severity":"High","urls":["https://github.com/moby/moby/security/advisories/GHSA-x86f-5xw2-fm2r","https://nvd.nist.gov/vuln/detail/CVE-2026-41567"],"description":"Docker: `PUT /containers/{id}/archive` executes container binary on the host","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N","metrics":{"baseScore":7.2,"exploitabilityScore":0.9,"impactScore":5.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-41567","epss":0.00155,"percentile":0.04597,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-41567","cwe":"CWE-427","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-41567","cwe":"CWE-427","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.11392499999999998},"relatedVulnerabilities":[{"id":"CVE-2026-41567","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-41567","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/moby/moby/security/advisories/GHSA-x86f-5xw2-fm2r","https://access.redhat.com/errata/RHSA-2026:37387","https://access.redhat.com/errata/RHSA-2026:41030","https://access.redhat.com/errata/RHSA-2026:42852","https://access.redhat.com/errata/RHSA-2026:44622","https://access.redhat.com/errata/RHSA-2026:51057","https://access.redhat.com/security/cve/CVE-2026-41567","https://bugzilla.redhat.com/show_bug.cgi?id=2485356","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41567.json"],"description":"Moby is an open source container framework. In versions prior to 29.5.1 and in moby/moby v2 prior to v2.0.0-beta.14, when a compressed archive is uploaded to a container via `PUT /containers/{id}/archive` or piped through `docker cp -`, the daemon resolves decompression binaries (such as `xz` or `unpigz`) from the container's filesystem rather than the host's due to incorrect ordering of operations. A malicious container image containing a trojanized decompression binary can achieve arbitrary code execution with full daemon privileges, including host root UID and unrestricted capabilities, when a user uploads a compressed (xz or gzip) archive into that container. This issue is fixed in Docker Engine 29.5.1 and moby/moby v2.0.0-beta.14. Workarounds include only running containers from trusted images, using authorization plugins to restrict access to the `PUT /containers/{id}/archive` endpoint, and avoiding piping compressed archives into containers created from untrusted images","cvss":[{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":0.9,"impactScore":6.1},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N","metrics":{"baseScore":7.2,"exploitabilityScore":0.9,"impactScore":5.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-41567","epss":0.00155,"percentile":0.04597,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-41567","cwe":"CWE-427","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-41567","cwe":"CWE-427","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"github.com/docker/docker","version":"v28.5.2+incompatible"}},"found":{"vulnerabilityID":"GHSA-x86f-5xw2-fm2r","versionConstraint":"<=28.5.2 (go)"}}],"artifact":{"id":"pkg:golang/github.com/docker/docker@v28.5.2%2Bincompatible?package-id=3faa2f9d49f614ca","name":"github.com/docker/docker","version":"v28.5.2+incompatible","type":"go-module","locations":[{"path":"/tool-imports/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:docker:docker:v28.5.2\\+incompatible:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/docker/docker@v28.5.2%2Bincompatible","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:DBX0Y0zAjZbSrm1uzOkdr1onVghKaftjlSWt4AFexzM="}}},{"vulnerability":{"id":"GHSA-rp3h-jf77-q9p4","dataSource":"https://github.com/advisories/GHSA-rp3h-jf77-q9p4","namespace":"github:language:go","severity":"Medium","urls":["https://github.com/containerd/containerd/security/advisories/GHSA-rp3h-jf77-q9p4","https://nvd.nist.gov/vuln/detail/CVE-2026-95838","https://github.com/containerd/containerd/commit/e6ca378dcfa610d06589a3ac96aa992de866e4f0"],"description":"containerd: Unpack DoS via repeated opaque whiteouts","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":4.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-95838","epss":0.00223,"percentile":0.12963,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-95838","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-95838","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.7.35"],"state":"fixed","available":[{"version":"1.7.35","date":"2026-10-16","kind":"first-observed"}]},"advisories":[],"risk":0.10704},"relatedVulnerabilities":[{"id":"CVE-2026-95838","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-95838","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/containerd/containerd/commit/e6ca378dcfa610d06589a3ac96aa992de866e4f0","https://github.com/containerd/containerd/security/advisories/GHSA-rp3h-jf77-q9p4"],"description":"containerd is an open-source container runtime. Prior to 1.7.35, 2.0.12, 2.2.8, and 2.3.5, containerd's layer unpack handler repeatedly traverses directories for certain opaque whiteout configurations. A malicious image layer can trigger repeated directory traversals while opaque whiteouts are processed. Pulling or importing the image can consume CPU, delay container startup, and reduce image-pull concurrency for unrelated deployments. This issue is fixed in versions 1.7.35, 2.0.12, 2.2.8, and 2.3.5.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-95838","epss":0.00223,"percentile":0.12963,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-95838","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-95838","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"github.com/containerd/containerd","version":"v1.7.30"}},"found":{"vulnerabilityID":"GHSA-rp3h-jf77-q9p4","versionConstraint":"<1.7.35 (go)"},"fix":{"suggestedVersion":"1.7.35"}}],"artifact":{"id":"pkg:golang/github.com/containerd/containerd@v1.7.30?package-id=f22ca3ad39ee58c2","name":"github.com/containerd/containerd","version":"v1.7.30","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:containerd:containerd:v1.7.30:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/containerd/containerd@v1.7.30","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:/2vezDpLDVGGmkUXmlNPLCCNKHJ5BbC5tJB5JNzQhqE="}}},{"vulnerability":{"id":"GO-2026-6179","dataSource":"https://go.dev/issue/80744","namespace":"govulndb:language:go","severity":"High","urls":["https://groups.google.com/g/golang-announce/c/94pEornpRlI","https://go.dev/cl/814960","https://go.dev/cl/815020"],"description":"A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache.\n\nThis attack allows for a malicious GOPROXY to serve malicious module content that cannot be detected by evaluating the transparency log.\n\nAll tiles are now correctly verified against their parents.\n\nIn order to determine if you have been affected:\n\nrm -r go.sum go.work.sum vendor/ && go mod tidy","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.4,"exploitabilityScore":2.6,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-56865","epss":0.00129,"percentile":0.02529,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-56865","cwe":"CWE-347","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["0.40.0"],"state":"fixed","available":[{"version":"0.40.0","date":"2026-08-13","kind":"release"}]},"advisories":[],"risk":0.10255500000000001},"relatedVulnerabilities":[{"id":"CVE-2026-56865","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56865","namespace":"nvd:cpe","severity":"High","urls":["https://go.dev/cl/814960","https://go.dev/cl/815020","https://go.dev/issue/80744","https://groups.google.com/g/golang-announce/c/94pEornpRlI","https://pkg.go.dev/vuln/GO-2026-6179"],"description":"A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache. This attack allows for a malicious GOPROXY to serve malicious module content that cannot be detected by evaluating the transparency log. All tiles are now correctly verified against their parents. In order to determine if you have been affected:   rm -r go.sum go.work.sum vendor/ && go mod tidy","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.4,"exploitabilityScore":2.6,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-56865","epss":0.00129,"percentile":0.02529,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-56865","cwe":"CWE-347","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"golang.org/x/mod","version":"v0.33.0"}},"found":{"vulnerabilityID":"GO-2026-6179","versionConstraint":"<0.40.0 (go)"},"fix":{"suggestedVersion":"0.40.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/mod@v0.33.0?package-id=e7bface2e125298f","name":"golang.org/x/mod","version":"v0.33.0","type":"go-module","locations":[{"path":"/tool-imports/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:x\\/mod:v0.33.0:*:*:*:*:*:*:*"],"purl":"pkg:golang/golang.org/x/mod@v0.33.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:tHFzIWbBifEmbwtGz65eaWyGiGZatSrT9prnU8DbVL8="}}},{"vulnerability":{"id":"GO-2026-6866","dataSource":"https://go.dev/cl/855121","namespace":"govulndb:language:go","severity":"Unknown","urls":["https://go.dev/issue/82622","https://groups.google.com/g/golang-announce/c/sqrs2vTx_Xs"],"description":"In childTextNodesAreLiteral, walking up the tree previously stopped at the nearest foreign ancestor once an HTML integration point was found. However, that integration point may itself be a descendant of an element that was foster-parented into a foreign namespace (such as <mglyph> or <malignmark> fostered under <mtext>), causing a parser to resolve the subtree in a different foreign namespace upon re-parsing the rendered output.\n\nContinue walking the full ancestor chain and verify that every transition from a non-empty namespace occurs at an HTML integration point before emitting literal text.","cvss":[],"epss":[{"cve":"CVE-2026-97045","epss":0.00202,"percentile":0.10121,"date":"2026-10-31"}],"fix":{"versions":["0.62.0"],"state":"fixed","available":[{"version":"0.62.0","date":"2026-10-27","kind":"release"}]},"advisories":[],"risk":0.101},"relatedVulnerabilities":[{"id":"CVE-2026-97045","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-97045","namespace":"nvd:cpe","severity":"Unknown","urls":["https://go.dev/cl/855121","https://go.dev/issue/82622","https://groups.google.com/g/golang-announce/c/sqrs2vTx_Xs","https://pkg.go.dev/vuln/GO-2026-6866"],"description":"In childTextNodesAreLiteral, walking up the tree previously stopped at the nearest foreign ancestor once an HTML integration point was found. However, that integration point may itself be a descendant of an element that was foster-parented into a foreign namespace (such as <mglyph> or <malignmark> fostered under <mtext>), causing a parser to resolve the subtree in a different foreign namespace upon re-parsing the rendered output. Continue walking the full ancestor chain and verify that every transition from a non-empty namespace occurs at an HTML integration point before emitting literal text.","cvss":[],"epss":[{"cve":"CVE-2026-97045","epss":0.00202,"percentile":0.10121,"date":"2026-10-31"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"golang.org/x/net","version":"v0.48.0"}},"found":{"vulnerabilityID":"GO-2026-6866","versionConstraint":"<0.62.0 (go)"},"fix":{"suggestedVersion":"0.62.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/net@v0.48.0?package-id=7e3c0e57ff3d79d8","name":"golang.org/x/net","version":"v0.48.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:networking:v0.48.0:*:*:*:*:go:*:*","cpe:2.3:a:golang:net:v0.48.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/net@v0.48.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:zyQRTTrjc33Lhh0fBgT/H3oZq9WuvRR5gPC70xpDiQU="}}},{"vulnerability":{"id":"GO-2026-6866","dataSource":"https://go.dev/cl/855121","namespace":"govulndb:language:go","severity":"Unknown","urls":["https://go.dev/issue/82622","https://groups.google.com/g/golang-announce/c/sqrs2vTx_Xs"],"description":"In childTextNodesAreLiteral, walking up the tree previously stopped at the nearest foreign ancestor once an HTML integration point was found. However, that integration point may itself be a descendant of an element that was foster-parented into a foreign namespace (such as <mglyph> or <malignmark> fostered under <mtext>), causing a parser to resolve the subtree in a different foreign namespace upon re-parsing the rendered output.\n\nContinue walking the full ancestor chain and verify that every transition from a non-empty namespace occurs at an HTML integration point before emitting literal text.","cvss":[],"epss":[{"cve":"CVE-2026-97045","epss":0.00202,"percentile":0.10121,"date":"2026-10-31"}],"fix":{"versions":["0.62.0"],"state":"fixed","available":[{"version":"0.62.0","date":"2026-10-27","kind":"release"}]},"advisories":[],"risk":0.101},"relatedVulnerabilities":[{"id":"CVE-2026-97045","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-97045","namespace":"nvd:cpe","severity":"Unknown","urls":["https://go.dev/cl/855121","https://go.dev/issue/82622","https://groups.google.com/g/golang-announce/c/sqrs2vTx_Xs","https://pkg.go.dev/vuln/GO-2026-6866"],"description":"In childTextNodesAreLiteral, walking up the tree previously stopped at the nearest foreign ancestor once an HTML integration point was found. However, that integration point may itself be a descendant of an element that was foster-parented into a foreign namespace (such as <mglyph> or <malignmark> fostered under <mtext>), causing a parser to resolve the subtree in a different foreign namespace upon re-parsing the rendered output. Continue walking the full ancestor chain and verify that every transition from a non-empty namespace occurs at an HTML integration point before emitting literal text.","cvss":[],"epss":[{"cve":"CVE-2026-97045","epss":0.00202,"percentile":0.10121,"date":"2026-10-31"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"golang.org/x/net","version":"v0.50.0"}},"found":{"vulnerabilityID":"GO-2026-6866","versionConstraint":"<0.62.0 (go)"},"fix":{"suggestedVersion":"0.62.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/net@v0.50.0?package-id=a205ae7dff8c80d8","name":"golang.org/x/net","version":"v0.50.0","type":"go-module","locations":[{"path":"/tool-imports/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:networking:v0.50.0:*:*:*:*:go:*:*","cpe:2.3:a:golang:net:v0.50.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/net@v0.50.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:ucWh9eiCGyDR3vtzso0WMQinm2Dnt8cFMuQa9K33J60="}}},{"vulnerability":{"id":"GO-2026-5622","dataSource":"https://github.com/containerd/containerd/security/advisories/GHSA-rgh6-rfwx-v388","namespace":"govulndb:language:go","severity":"Medium","urls":[],"description":"Arbitrary host CRI log file read via symlink following in CRI checkpoint restore in github.com/containerd/containerd","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","metrics":{"baseScore":6.5,"exploitabilityScore":2.1,"impactScore":4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-53489","epss":0.00174,"percentile":0.06877,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-53489","cwe":"CWE-61","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":[],"state":""},"advisories":[],"risk":0.10004999999999999},"relatedVulnerabilities":[{"id":"CVE-2026-53489","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-53489","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/containerd/containerd/security/advisories/GHSA-rgh6-rfwx-v388"],"description":"containerd is an open-source container runtime. Versions prior to 2.3.2, 2.2.5 and 2.1.9 contain a bug where the CRI plugin restores container.log from a checkpoint image without validating a symlinked path. This could result in reading an arbitrary file on the host via kubectl logs. This issue has been fixed in versions 2.3.2, 2.2.5 and 2.1.9.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","metrics":{"baseScore":6.5,"exploitabilityScore":2.1,"impactScore":4},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-53489","epss":0.00174,"percentile":0.06877,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-53489","cwe":"CWE-61","source":"security-advisories@github.com","type":"Secondary"}]},{"id":"GHSA-rgh6-rfwx-v388","dataSource":"https://github.com/advisories/GHSA-rgh6-rfwx-v388","namespace":"github:language:go","severity":"High","urls":["https://github.com/containerd/containerd/security/advisories/GHSA-rgh6-rfwx-v388"],"description":"Arbitrary host CRI log file read via symlink following in CRI checkpoint restore","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":7.1},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-53489","epss":0.00174,"percentile":0.06877,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-53489","cwe":"CWE-61","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"github.com/containerd/containerd","version":"v1.7.30"}},"found":{"vulnerabilityID":"GO-2026-5622","versionConstraint":"none (unknown)"}}],"artifact":{"id":"pkg:golang/github.com/containerd/containerd@v1.7.30?package-id=f22ca3ad39ee58c2","name":"github.com/containerd/containerd","version":"v1.7.30","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:containerd:containerd:v1.7.30:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/containerd/containerd@v1.7.30","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:/2vezDpLDVGGmkUXmlNPLCCNKHJ5BbC5tJB5JNzQhqE="}}},{"vulnerability":{"id":"GHSA-9vcr-p3rj-q5q6","dataSource":"https://github.com/advisories/GHSA-9vcr-p3rj-q5q6","namespace":"github:language:go","severity":"Medium","urls":["https://github.com/sigstore/sigstore-go/security/advisories/GHSA-9vcr-p3rj-q5q6","https://nvd.nist.gov/vuln/detail/CVE-2026-49834","https://github.com/sigstore/sigstore-go/pull/633","https://github.com/sigstore/sigstore-go/commit/dbb07e62623edd5b175fb9dd5a41dcb85a159207","https://github.com/sigstore/sigstore-go/releases/tag/v1.2.0"],"description":"sigstore-go has a multi-log threshold bypass via single compromised log","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-49834","epss":0.00181,"percentile":0.07667,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-49834","cwe":"CWE-347","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["1.2.0"],"state":"fixed","available":[{"version":"1.2.0","date":"2026-07-10","kind":"first-observed"}]},"advisories":[],"risk":0.09864500000000001},"relatedVulnerabilities":[{"id":"CVE-2026-49834","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-49834","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/sigstore/sigstore-go/commit/dbb07e62623edd5b175fb9dd5a41dcb85a159207","https://github.com/sigstore/sigstore-go/pull/633","https://github.com/sigstore/sigstore-go/releases/tag/v1.2.0","https://github.com/sigstore/sigstore-go/security/advisories/GHSA-9vcr-p3rj-q5q6"],"description":"sigstore-go is a Go library for Sigstore signing and verification. Prior to 1.2.0, a verifier configured with WithTransparencyLog(N>1) or WithSignedCertificateTimestamps(N>1) counts verified witnesses per entry or per validation path rather than per log authority, allowing a single compromised transparency log or CT log to satisfy multi-log threshold requirements and defeat the multi-log policy. This issue is fixed in version 1.2.0.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-49834","epss":0.00181,"percentile":0.07667,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-49834","cwe":"CWE-347","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"github.com/sigstore/sigstore-go","version":"v1.1.4"}},"found":{"vulnerabilityID":"GHSA-9vcr-p3rj-q5q6","versionConstraint":"<=1.1.4 (go)"},"fix":{"suggestedVersion":"1.2.0"}}],"artifact":{"id":"pkg:golang/github.com/sigstore/sigstore-go@v1.1.4?package-id=647eebcabc897611","name":"github.com/sigstore/sigstore-go","version":"v1.1.4","type":"go-module","locations":[{"path":"/tool-imports/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:sigstore:sigstore-go:v1.1.4:*:*:*:*:*:*:*","cpe:2.3:a:sigstore:sigstore_go:v1.1.4:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/sigstore/sigstore-go@v1.1.4","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:wTTsgCHOfqiEzVyBYA6mDczGtBkN7cM8mPpjJj5QvMg="}}},{"vulnerability":{"id":"GHSA-w8rr-5gcm-pp58","dataSource":"https://github.com/advisories/GHSA-w8rr-5gcm-pp58","namespace":"github:language:go","severity":"Medium","urls":["https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-w8rr-5gcm-pp58","http://github.com/open-telemetry/opentelemetry-go/releases/tag/v1.43.0","https://nvd.nist.gov/vuln/detail/CVE-2026-39882","https://github.com/open-telemetry/opentelemetry-go/pull/8108"],"description":"opentelemetry-go: OTLP HTTP exporters read unbounded HTTP response bodies","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.3,"exploitabilityScore":1.7,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-39882","epss":0.0019,"percentile":0.08707,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-39882","cwe":"CWE-789","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.43.0"],"state":"fixed","available":[{"version":"1.43.0","date":"2026-04-09","kind":"first-observed"}]},"advisories":[],"risk":0.09784999999999999},"relatedVulnerabilities":[{"id":"CVE-2026-39882","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-39882","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/open-telemetry/opentelemetry-go/pull/8108","https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-w8rr-5gcm-pp58"],"description":"OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to 1.43.0, the otlp HTTP exporters (traces/metrics/logs) read the full HTTP response body into an in-memory bytes.Buffer without a size cap. This is exploitable for memory exhaustion when the configured collector endpoint is attacker-controlled (or a network attacker can mitm the exporter connection). This vulnerability is fixed in 1.43.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.3,"exploitabilityScore":1.7,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-39882","epss":0.0019,"percentile":0.08707,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-39882","cwe":"CWE-789","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp","version":"v1.35.0"}},"found":{"vulnerabilityID":"GHSA-w8rr-5gcm-pp58","versionConstraint":"<1.43.0 (go)"},"fix":{"suggestedVersion":"1.43.0"}}],"artifact":{"id":"pkg:golang/go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp@v1.35.0?package-id=32a19e28efacd9df","name":"go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp","version":"v1.35.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:otel:exporters\\/otlp\\/otlpmetric\\/otlpmetrichttp:v1.35.0:*:*:*:*:*:*:*"],"purl":"pkg:golang/go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp@v1.35.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:0NIXxOCFx+SKbhCVxwl3ETG8ClLPAa0KuKV6p3yhxP8="}}},{"vulnerability":{"id":"GHSA-hr2v-4r36-88hr","dataSource":"https://github.com/advisories/GHSA-hr2v-4r36-88hr","namespace":"github:language:go","severity":"Medium","urls":["https://github.com/helm/helm/security/advisories/GHSA-hr2v-4r36-88hr","https://nvd.nist.gov/vuln/detail/CVE-2026-35206","https://github.com/helm/helm/commit/4e7994d4467182f535b6797c94b5b0e994a91436","https://github.com/helm/helm/releases/tag/v4.1.4"],"description":"Helm Chart extraction output directory collapse via `Chart.yaml` name dot-segment","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":4.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-35206","epss":0.00199,"percentile":0.09716,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-35206","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["3.20.2"],"state":"fixed","available":[{"version":"3.20.2","date":"2026-04-10","kind":"first-observed"}]},"advisories":[],"risk":0.09751},"relatedVulnerabilities":[{"id":"CVE-2026-35206","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-35206","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/helm/helm/commit/4e7994d4467182f535b6797c94b5b0e994a91436","https://github.com/helm/helm/releases/tag/v4.1.4","https://github.com/helm/helm/security/advisories/GHSA-hr2v-4r36-88hr"],"description":"Helm is a package manager for Charts for Kubernetes. In Helm versions <=3.20.1 and <=4.1.3, a specially crafted Chart will cause helm pull --untar  [chart URL | repo/chartname] to write the Chart's contents to the immediate output directory (as defaulted to the current working directory; or as given by the --destination and --untardir flags), rather than the expected output directory suffixed by the chart's name. This vulnerability is fixed in 3.20.2 and 4.1.4.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L","metrics":{"baseScore":4.4,"exploitabilityScore":1.9,"impactScore":2.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-35206","epss":0.00199,"percentile":0.09716,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-35206","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"helm.sh/helm/v3","version":"v3.20.0"}},"found":{"vulnerabilityID":"GHSA-hr2v-4r36-88hr","versionConstraint":"<=3.20.1 (go)"},"fix":{"suggestedVersion":"3.20.2"}}],"artifact":{"id":"pkg:golang/helm.sh/helm/v3@v3.20.0?package-id=9b660d5127e9b2bf","name":"helm.sh/helm/v3","version":"v3.20.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:helm:v3:v3.20.0:*:*:*:*:*:*:*"],"purl":"pkg:golang/helm.sh/helm/v3@v3.20.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:2M+0qQwnbI1a2CxN7dbmfsWHg/MloeaFMnZCY56as50="}}},{"vulnerability":{"id":"GHSA-m7cr-m3pv-hgrp","dataSource":"https://github.com/advisories/GHSA-m7cr-m3pv-hgrp","namespace":"github:language:go","severity":"Low","urls":["https://github.com/go-git/go-git/security/advisories/GHSA-m7cr-m3pv-hgrp","https://nvd.nist.gov/vuln/detail/CVE-2026-45570"],"description":"go-git: Improper single-quote escaping in go-git SSH transport","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:L","metrics":{"baseScore":2.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-45570","epss":0.00365,"percentile":0.3041,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-45570","cwe":"CWE-116","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["5.19.1"],"state":"fixed","available":[{"version":"5.19.1","date":"2026-05-19","kind":"first-observed"}]},"advisories":[],"risk":0.096725},"relatedVulnerabilities":[{"id":"CVE-2026-45570","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-45570","namespace":"nvd:cpe","severity":"Critical","urls":["https://github.com/go-git/go-git/security/advisories/GHSA-m7cr-m3pv-hgrp"],"description":"go-git is an extensible git implementation library written in pure Go. Prior to 5.19.1 and 6.0.0-alpha.4, go-git's SSH transport constructs the remote exec command by wrapping the repository path in single quotes without escaping single quotes embedded inside the path. A repository path containing a single quote can therefore break out of the quoted region in the exec command and be appended as additional shell tokens. This vulnerability is fixed in 5.19.1 and 6.0.0-alpha.4.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"exploitabilityScore":2.9,"impactScore":6.1},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-45570","epss":0.00365,"percentile":0.3041,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-45570","cwe":"CWE-116","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"github.com/go-git/go-git/v5","version":"v5.16.5"}},"found":{"vulnerabilityID":"GHSA-m7cr-m3pv-hgrp","versionConstraint":"<=5.19.0 (go)"},"fix":{"suggestedVersion":"5.19.1"}}],"artifact":{"id":"pkg:golang/github.com/go-git/go-git/v5@v5.16.5?package-id=0c14767230083f4a","name":"github.com/go-git/go-git/v5","version":"v5.16.5","type":"go-module","locations":[{"path":"/tool-imports/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:go-git:go-git\\/v5:v5.16.5:*:*:*:*:*:*:*","cpe:2.3:a:go-git:go_git\\/v5:v5.16.5:*:*:*:*:*:*:*","cpe:2.3:a:go_git:go-git\\/v5:v5.16.5:*:*:*:*:*:*:*","cpe:2.3:a:go_git:go_git\\/v5:v5.16.5:*:*:*:*:*:*:*","cpe:2.3:a:go:go-git\\/v5:v5.16.5:*:*:*:*:*:*:*","cpe:2.3:a:go:go_git\\/v5:v5.16.5:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/go-git/go-git/v5@v5.16.5","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:mdkuqblwr57kVfXri5TTH+nMFLNUxIj9Z7F5ykFbw5s="}}},{"vulnerability":{"id":"GHSA-7jxh-36q5-gcqv","dataSource":"https://github.com/advisories/GHSA-7jxh-36q5-gcqv","namespace":"github:language:go","severity":"Medium","urls":["https://github.com/containerd/containerd/security/advisories/GHSA-7jxh-36q5-gcqv","https://github.com/containerd/containerd/releases/tag/v1.7.35","https://github.com/containerd/containerd/releases/tag/v2.0.12","https://github.com/containerd/containerd/releases/tag/v2.2.8","https://github.com/containerd/containerd/releases/tag/v2.3.5"],"description":"containerd: CRI ExecSync Goroutine Leak Leads to Node-Level Denial of Service","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":6.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-53495","epss":0.00162,"percentile":0.05327,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-53495","cwe":"CWE-400","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["1.7.35"],"state":"fixed","available":[{"version":"1.7.35","date":"2026-09-10","kind":"first-observed"}]},"advisories":[],"risk":0.09558},"relatedVulnerabilities":[{"id":"CVE-2026-53495","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-53495","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/containerd/containerd/commit/22ccf4314d1fe0834f8e28f10d37d5305ef9880c","https://github.com/containerd/containerd/commit/5a2a3a759b0d2ad8c821b33c3afc20890daf6d81","https://github.com/containerd/containerd/commit/9ec55f024041d0641f6d79841e45c8781141ddaa","https://github.com/containerd/containerd/commit/eebea8c4c912f44b656c8295c9e6607a19b76650","https://github.com/containerd/containerd/commit/ff39a972369e2f12fae561a58d658bbf8f2bc318","https://github.com/containerd/containerd/releases/tag/v2.0.12","https://github.com/containerd/containerd/releases/tag/v2.2.8","https://github.com/containerd/containerd/releases/tag/v2.3.5","https://github.com/containerd/containerd/security/advisories/GHSA-7jxh-36q5-gcqv"],"description":"containerd is an open-source container runtime. Prior to 1.7.35, 2.0.12, 2.2.8, and 2.3.5, containerd on Linux with the CRI plugin enabled can indefinitely block the drainExecSyncIO goroutine in internal/cri/server/container_execsync.go when CRI ExecSync is used by exec probes or lifecycle hooks that launch long-lived background child processes retaining standard input and output pipes. The input and output drain phase has no default timeout and did not stop when the request context was canceled, so repeated ExecSync invocations can accumulate blocked goroutines and host memory. The resulting resource exhaustion can cause the OOM killer to terminate containerd, leaving the container runtime unavailable until restart. Deployments not using containerd's CRI implementation and containers not running on Linux are not affected. This issue is fixed in versions 1.7.35, 2.0.12, 2.2.8, and 2.3.5.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-53495","epss":0.00162,"percentile":0.05327,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-53495","cwe":"CWE-400","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"github.com/containerd/containerd","version":"v1.7.30"}},"found":{"vulnerabilityID":"GHSA-7jxh-36q5-gcqv","versionConstraint":"<1.7.35 (go)"},"fix":{"suggestedVersion":"1.7.35"}}],"artifact":{"id":"pkg:golang/github.com/containerd/containerd@v1.7.30?package-id=f22ca3ad39ee58c2","name":"github.com/containerd/containerd","version":"v1.7.30","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:containerd:containerd:v1.7.30:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/containerd/containerd@v1.7.30","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:/2vezDpLDVGGmkUXmlNPLCCNKHJ5BbC5tJB5JNzQhqE="}}},{"vulnerability":{"id":"GO-2026-6860","dataSource":"https://go.dev/cl/849365","namespace":"govulndb:language:go","severity":"Unknown","urls":["https://go.dev/issue/82224","https://groups.google.com/g/golang-announce/c/sqrs2vTx_Xs"],"description":"When coalescing adjacent text nodes in addText and fosterParent, appending to an existing TextNode's Data via string concatenation (n.Data += text) reallocated and copied the accumulated string on every token. Inputs containing many short text runs separated by ignored end tags (such as \"a</x>\") caused O(n^2) allocations and byte copies.\n\nAccumulate coalesced text in per-node byte slices during parsing and materialize Data strings once at the end of parse.","cvss":[],"epss":[{"cve":"CVE-2026-78661","epss":0.00185,"percentile":0.08066,"date":"2026-10-31"}],"fix":{"versions":["0.62.0"],"state":"fixed","available":[{"version":"0.62.0","date":"2026-10-27","kind":"release"}]},"advisories":[],"risk":0.0925},"relatedVulnerabilities":[{"id":"CVE-2026-78661","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78661","namespace":"nvd:cpe","severity":"Unknown","urls":["https://go.dev/cl/849365","https://go.dev/issue/82224","https://groups.google.com/g/golang-announce/c/sqrs2vTx_Xs","https://pkg.go.dev/vuln/GO-2026-6860"],"description":"When coalescing adjacent text nodes in addText and fosterParent, appending to an existing TextNode's Data via string concatenation (n.Data += text) reallocated and copied the accumulated string on every token. Inputs containing many short text runs separated by ignored end tags (such as \"a</x>\") caused O(n^2) allocations and byte copies. Accumulate coalesced text in per-node byte slices during parsing and materialize Data strings once at the end of parse.","cvss":[],"epss":[{"cve":"CVE-2026-78661","epss":0.00185,"percentile":0.08066,"date":"2026-10-31"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"golang.org/x/net","version":"v0.48.0"}},"found":{"vulnerabilityID":"GO-2026-6860","versionConstraint":"<0.62.0 (go)"},"fix":{"suggestedVersion":"0.62.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/net@v0.48.0?package-id=7e3c0e57ff3d79d8","name":"golang.org/x/net","version":"v0.48.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:networking:v0.48.0:*:*:*:*:go:*:*","cpe:2.3:a:golang:net:v0.48.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/net@v0.48.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:zyQRTTrjc33Lhh0fBgT/H3oZq9WuvRR5gPC70xpDiQU="}}},{"vulnerability":{"id":"GO-2026-6860","dataSource":"https://go.dev/cl/849365","namespace":"govulndb:language:go","severity":"Unknown","urls":["https://go.dev/issue/82224","https://groups.google.com/g/golang-announce/c/sqrs2vTx_Xs"],"description":"When coalescing adjacent text nodes in addText and fosterParent, appending to an existing TextNode's Data via string concatenation (n.Data += text) reallocated and copied the accumulated string on every token. Inputs containing many short text runs separated by ignored end tags (such as \"a</x>\") caused O(n^2) allocations and byte copies.\n\nAccumulate coalesced text in per-node byte slices during parsing and materialize Data strings once at the end of parse.","cvss":[],"epss":[{"cve":"CVE-2026-78661","epss":0.00185,"percentile":0.08066,"date":"2026-10-31"}],"fix":{"versions":["0.62.0"],"state":"fixed","available":[{"version":"0.62.0","date":"2026-10-27","kind":"release"}]},"advisories":[],"risk":0.0925},"relatedVulnerabilities":[{"id":"CVE-2026-78661","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78661","namespace":"nvd:cpe","severity":"Unknown","urls":["https://go.dev/cl/849365","https://go.dev/issue/82224","https://groups.google.com/g/golang-announce/c/sqrs2vTx_Xs","https://pkg.go.dev/vuln/GO-2026-6860"],"description":"When coalescing adjacent text nodes in addText and fosterParent, appending to an existing TextNode's Data via string concatenation (n.Data += text) reallocated and copied the accumulated string on every token. Inputs containing many short text runs separated by ignored end tags (such as \"a</x>\") caused O(n^2) allocations and byte copies. Accumulate coalesced text in per-node byte slices during parsing and materialize Data strings once at the end of parse.","cvss":[],"epss":[{"cve":"CVE-2026-78661","epss":0.00185,"percentile":0.08066,"date":"2026-10-31"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"golang.org/x/net","version":"v0.50.0"}},"found":{"vulnerabilityID":"GO-2026-6860","versionConstraint":"<0.62.0 (go)"},"fix":{"suggestedVersion":"0.62.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/net@v0.50.0?package-id=a205ae7dff8c80d8","name":"golang.org/x/net","version":"v0.50.0","type":"go-module","locations":[{"path":"/tool-imports/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:networking:v0.50.0:*:*:*:*:go:*:*","cpe:2.3:a:golang:net:v0.50.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/net@v0.50.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:ucWh9eiCGyDR3vtzso0WMQinm2Dnt8cFMuQa9K33J60="}}},{"vulnerability":{"id":"GHSA-rqv2-m695-f8j4","dataSource":"https://github.com/advisories/GHSA-rqv2-m695-f8j4","namespace":"github:language:go","severity":"Medium","urls":["https://github.com/modelcontextprotocol/registry/security/advisories/GHSA-rqv2-m695-f8j4","https://github.com/modelcontextprotocol/registry/pull/1249","https://github.com/modelcontextprotocol/registry/commit/78b7bbde07948049b916d76b4769faee461ff930","https://github.com/modelcontextprotocol/registry/releases/tag/v1.7.7","https://nvd.nist.gov/vuln/detail/CVE-2026-44429"],"description":"MCP Registry vulnerable to stored XSS in catalogue UI via attribute-quote breakout in publisher-controlled `websiteUrl`","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":5.4,"exploitabilityScore":2.3,"impactScore":2.8},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:N/SI:L/SA:L","metrics":{"baseScore":5.1},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-44429","epss":0.00167,"percentile":0.05995,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-44429","cwe":"CWE-79","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-44429","cwe":"CWE-116","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.7.7"],"state":"fixed","available":[{"version":"1.7.7","date":"2026-05-09","kind":"first-observed"}]},"advisories":[],"risk":0.0855875},"relatedVulnerabilities":[{"id":"CVE-2026-44429","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44429","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/modelcontextprotocol/registry/security/advisories/GHSA-rqv2-m695-f8j4"],"description":"The MCP Registry provides MCP clients with a list of MCP servers, like an app store for MCP servers. Prior to 1.7.7, the public catalogue UI served at GET / (file internal/api/handlers/v0/ui_index.html) is vulnerable to stored cross-site scripting via the server.websiteUrl field of any published server.json. Server-side validation in internal/validators/validators.go (validateWebsiteURL) only checks that the URL parses, is absolute, and uses the https scheme; it does not reject quote characters. Client-side, the value is interpolated into a double-quoted href attribute via innerHTML, using a homegrown escapeHtml helper that performs the standard textContent → innerHTML round-trip. Per the HTML serialisation algorithm, that round-trip encodes only &, <, > and U+00A0 inside text nodes — it does not encode \" or '. A literal \" in websiteUrl therefore breaks out of the href attribute, allowing arbitrary on* event handlers to be appended to the same <a> element. The Content-Security-Policy on / is script-src 'self' 'unsafe-inline' https://cdn.tailwindcss.com, so the injected event handlers execute. Any user able to obtain a publish token (e.g. via POST /v0/auth/github-at with their own GitHub account, or POST /v0/auth/none on a deployment that has anonymous auth enabled) can plant a poisoned record visible to every visitor of the registry homepage. This vulnerability is fixed in 1.7.7.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":5.4,"exploitabilityScore":2.3,"impactScore":2.8},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:N/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.1},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-44429","epss":0.00167,"percentile":0.05995,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-44429","cwe":"CWE-79","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-44429","cwe":"CWE-116","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"github.com/modelcontextprotocol/registry","version":"v1.3.10"}},"found":{"vulnerabilityID":"GHSA-rqv2-m695-f8j4","versionConstraint":"<1.7.7 (go)"},"fix":{"suggestedVersion":"1.7.7"}}],"artifact":{"id":"pkg:golang/github.com/modelcontextprotocol/registry@v1.3.10?package-id=9fa26fe0e176e8ec","name":"github.com/modelcontextprotocol/registry","version":"v1.3.10","type":"go-module","locations":[{"path":"/tool-imports/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:modelcontextprotocol:registry:v1.3.10:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/modelcontextprotocol/registry@v1.3.10","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:sLVSjsHL2ox1HHBy7dVfp45UKIYBjfS+7VKwwJGD79c="}}},{"vulnerability":{"id":"GHSA-8rvj-mm4h-c258","dataSource":"https://github.com/advisories/GHSA-8rvj-mm4h-c258","namespace":"github:language:go","severity":"High","urls":["https://github.com/cert-manager/cert-manager/security/advisories/GHSA-8rvj-mm4h-c258","https://nvd.nist.gov/vuln/detail/CVE-2026-62290","https://github.com/cert-manager/cert-manager/pull/8940","https://github.com/cert-manager/cert-manager/pull/8941","https://github.com/cert-manager/cert-manager/commit/6bda47297c8fbc6b121b8b76624b668d26f1a155","https://github.com/cert-manager/cert-manager/commit/b37dbf01ecea50a0b3a19df0a7fe4c5ad6803f16","https://github.com/cert-manager/cert-manager/releases/tag/v1.19.6","https://github.com/cert-manager/cert-manager/releases/tag/v1.20.3"],"description":"cert-manager: Direct ACME Challenge resources can bypass Issuer DNS01 solver policy and use ClusterIssuer DNS credentials","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N","metrics":{"baseScore":7.3,"exploitabilityScore":2.1,"impactScore":4.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-62290","epss":0.00112,"percentile":0.0135,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-62290","cwe":"CWE-863","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.19.6"],"state":"fixed","available":[{"version":"1.19.6","date":"2026-10-30","kind":"first-observed"}]},"advisories":[],"risk":0.08287999999999998},"relatedVulnerabilities":[{"id":"CVE-2026-62290","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-62290","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/cert-manager/cert-manager/commit/6bda47297c8fbc6b121b8b76624b668d26f1a155","https://github.com/cert-manager/cert-manager/commit/b37dbf01ecea50a0b3a19df0a7fe4c5ad6803f16","https://github.com/cert-manager/cert-manager/pull/8940","https://github.com/cert-manager/cert-manager/pull/8941","https://github.com/cert-manager/cert-manager/releases/tag/v1.19.6","https://github.com/cert-manager/cert-manager/releases/tag/v1.20.3","https://github.com/cert-manager/cert-manager/security/advisories/GHSA-8rvj-mm4h-c258"],"description":"cert-manager adds certificates and certificate issuers as resource types in Kubernetes clusters, and simplifies the process of obtaining, renewing and using those certificates. From 1.18.0 until 1.19.6 and 1.20.3, Challenge resources under acme.cert-manager.io can be created directly by namespace users without admission validation tying the Challenge to an Order, owner reference, or Issuer-selected solver, allowing attacker-controlled Challenge.spec.solver values referencing a ClusterIssuer to bypass DNS01 solver selectors such as dnsZones, dnsNames, and matchLabels and cause cert-manager to use ClusterIssuer DNS credentials for attacker-selected provider settings and DNS names, including disclosure of X-Api-User and X-Api-Key headers for acme-dns. This issue is fixed in versions 1.19.6 and 1.20.3.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N","metrics":{"baseScore":7.3,"exploitabilityScore":2.1,"impactScore":4.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-62290","epss":0.00112,"percentile":0.0135,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-62290","cwe":"CWE-863","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"github.com/cert-manager/cert-manager","version":"v1.19.4"}},"found":{"vulnerabilityID":"GHSA-8rvj-mm4h-c258","versionConstraint":">=1.18.0,<1.19.6 (go)"},"fix":{"suggestedVersion":"1.19.6"}}],"artifact":{"id":"pkg:golang/github.com/cert-manager/cert-manager@v1.19.4?package-id=3114c3d8d0d6cb35","name":"github.com/cert-manager/cert-manager","version":"v1.19.4","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:cert-manager:cert-manager:v1.19.4:*:*:*:*:*:*:*","cpe:2.3:a:cert-manager:cert_manager:v1.19.4:*:*:*:*:*:*:*","cpe:2.3:a:cert_manager:cert-manager:v1.19.4:*:*:*:*:*:*:*","cpe:2.3:a:cert_manager:cert_manager:v1.19.4:*:*:*:*:*:*:*","cpe:2.3:a:cert:cert-manager:v1.19.4:*:*:*:*:*:*:*","cpe:2.3:a:cert:cert_manager:v1.19.4:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/cert-manager/cert-manager@v1.19.4","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:7lOkSYj+nJNjgGFfAznQzPpOfWX+1Kgz6xUXwTa/K5k="}}},{"vulnerability":{"id":"GO-2026-6791","dataSource":"https://github.com/containerd/containerd/security/advisories/GHSA-p7v4-vr35-mj6f","namespace":"govulndb:language:go","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-95837","https://github.com/containerd/containerd/commit/928c03c6898cad95f795300281fdff0dbc55a32f","https://github.com/containerd/containerd/pull/13913"],"description":"containerd CRI plugin: Checkpoint restore bypasses destination security context in github.com/containerd/containerd","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"exploitabilityScore":1.9,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-95837","epss":0.00106,"percentile":0.01101,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-95837","cwe":"CWE-269","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":[],"state":""},"advisories":[],"risk":0.08109000000000001},"relatedVulnerabilities":[{"id":"CVE-2026-95837","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-95837","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/containerd/containerd/commit/928c03c6898cad95f795300281fdff0dbc55a32f","https://github.com/containerd/containerd/pull/13913","https://github.com/containerd/containerd/security/advisories/GHSA-p7v4-vr35-mj6f"],"description":"containerd is an open-source container runtime. From 2.1.0 until 2.2.7 and 2.3.4, containerd's CRI CreateContainer checkpoint restore is vulnerable because CRIU restores process security state from checkpoint data instead of enforcing the destination ContainerConfig. An attacker who can create a container from a crafted checkpoint can supply restored credentials, capabilities, no_new_privs, and seccomp state. The restored process can run as root with full capabilities and no enforced seccomp filters while CRI status reports the requested configuration. Systems that do not use CRI checkpoint restore are not affected. This issue is fixed in versions 2.2.7 and 2.3.4.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"exploitabilityScore":1.9,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-95837","epss":0.00106,"percentile":0.01101,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-95837","cwe":"CWE-269","source":"security-advisories@github.com","type":"Secondary"}]},{"id":"GHSA-p7v4-vr35-mj6f","dataSource":"https://github.com/advisories/GHSA-p7v4-vr35-mj6f","namespace":"github:language:go","severity":"High","urls":["https://github.com/containerd/containerd/security/advisories/GHSA-p7v4-vr35-mj6f","https://nvd.nist.gov/vuln/detail/CVE-2026-95837","https://github.com/containerd/containerd/pull/13913","https://github.com/containerd/containerd/commit/928c03c6898cad95f795300281fdff0dbc55a32f"],"description":"containerd CRI plugin: Checkpoint restore bypasses destination security context","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"exploitabilityScore":1.9,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-95837","epss":0.00106,"percentile":0.01101,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-95837","cwe":"CWE-269","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"github.com/containerd/containerd","version":"v1.7.30"}},"found":{"vulnerabilityID":"GO-2026-6791","versionConstraint":"none (unknown)"}}],"artifact":{"id":"pkg:golang/github.com/containerd/containerd@v1.7.30?package-id=f22ca3ad39ee58c2","name":"github.com/containerd/containerd","version":"v1.7.30","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:containerd:containerd:v1.7.30:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/containerd/containerd@v1.7.30","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:/2vezDpLDVGGmkUXmlNPLCCNKHJ5BbC5tJB5JNzQhqE="}}},{"vulnerability":{"id":"GHSA-jhf3-xxhw-2wpp","dataSource":"https://github.com/advisories/GHSA-jhf3-xxhw-2wpp","namespace":"github:language:go","severity":"Medium","urls":["https://github.com/go-git/go-git/security/advisories/GHSA-jhf3-xxhw-2wpp","https://github.com/go-git/go-git/releases/tag/v5.17.1","https://nvd.nist.gov/vuln/detail/CVE-2026-34165"],"description":"go-git: Maliciously crafted idx file can cause asymmetric memory consumption","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5,"exploitabilityScore":1.4,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-34165","epss":0.00153,"percentile":0.04421,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-34165","cwe":"CWE-191","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-34165","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["5.17.1"],"state":"fixed","available":[{"version":"5.17.1","date":"2026-03-31","kind":"first-observed"}]},"advisories":[],"risk":0.0765},"relatedVulnerabilities":[{"id":"CVE-2026-34165","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-34165","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/go-git/go-git/releases/tag/v5.17.1","https://github.com/go-git/go-git/security/advisories/GHSA-jhf3-xxhw-2wpp"],"description":"go-git is an extensible git implementation library written in pure Go. From version 5.0.0 to before version 5.17.1, a vulnerability has been identified in which a maliciously crafted .idx file can cause asymmetric memory consumption, potentially exhausting available memory and resulting in a denial-of-service (DoS) condition. Exploitation requires write access to the local repository's .git directory, it order to create or alter existing .idx files. This issue has been patched in version 5.17.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5,"exploitabilityScore":1.4,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-34165","epss":0.00153,"percentile":0.04421,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-34165","cwe":"CWE-191","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-34165","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"github.com/go-git/go-git/v5","version":"v5.16.5"}},"found":{"vulnerabilityID":"GHSA-jhf3-xxhw-2wpp","versionConstraint":">=5.0.0,<=5.17.0 (go)"},"fix":{"suggestedVersion":"5.17.1"}}],"artifact":{"id":"pkg:golang/github.com/go-git/go-git/v5@v5.16.5?package-id=0c14767230083f4a","name":"github.com/go-git/go-git/v5","version":"v5.16.5","type":"go-module","locations":[{"path":"/tool-imports/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:go-git:go-git\\/v5:v5.16.5:*:*:*:*:*:*:*","cpe:2.3:a:go-git:go_git\\/v5:v5.16.5:*:*:*:*:*:*:*","cpe:2.3:a:go_git:go-git\\/v5:v5.16.5:*:*:*:*:*:*:*","cpe:2.3:a:go_git:go_git\\/v5:v5.16.5:*:*:*:*:*:*:*","cpe:2.3:a:go:go-git\\/v5:v5.16.5:*:*:*:*:*:*:*","cpe:2.3:a:go:go_git\\/v5:v5.16.5:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/go-git/go-git/v5@v5.16.5","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:mdkuqblwr57kVfXri5TTH+nMFLNUxIj9Z7F5ykFbw5s="}}},{"vulnerability":{"id":"GHSA-rg2x-37c3-w2rh","dataSource":"https://github.com/advisories/GHSA-rg2x-37c3-w2rh","namespace":"github:language:go","severity":"High","urls":["https://github.com/moby/moby/security/advisories/GHSA-rg2x-37c3-w2rh","https://nvd.nist.gov/vuln/detail/CVE-2026-42306"],"description":"Docker: Race condition in docker cp allows bind mount redirection to host path","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:N/I:H/A:H","metrics":{"baseScore":7.2,"exploitabilityScore":0.9,"impactScore":5.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-42306","epss":0.00104,"percentile":0.01019,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-42306","cwe":"CWE-61","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-42306","cwe":"CWE-367","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.07644},"relatedVulnerabilities":[{"id":"CVE-2026-42306","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42306","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/moby/moby/security/advisories/GHSA-rg2x-37c3-w2rh"],"description":"Moby is an open source container framework. In Docker Engine prior to version 29.5.1, Docker Daemon versions 28.5.2 and prior, and Moby Daemon prior to version 2.0.0-beta.14, a race condition during docker cp mount setup allows a malicious container to redirect a bind mount target to an arbitrary host path, potentially overwriting host files or causing denial of service. This issue has been patched in Docker Engine version 29.5.1 and Moby Daemon version 2.0.0-beta.14.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:N/I:H/A:H","metrics":{"baseScore":7.2,"exploitabilityScore":0.9,"impactScore":5.8},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:N/I:H/A:H","metrics":{"baseScore":7.2,"exploitabilityScore":0.9,"impactScore":5.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-42306","epss":0.00104,"percentile":0.01019,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-42306","cwe":"CWE-61","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-42306","cwe":"CWE-367","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"github.com/docker/docker","version":"v28.5.2+incompatible"}},"found":{"vulnerabilityID":"GHSA-rg2x-37c3-w2rh","versionConstraint":"<=28.5.2 (go)"}}],"artifact":{"id":"pkg:golang/github.com/docker/docker@v28.5.2%2Bincompatible?package-id=3faa2f9d49f614ca","name":"github.com/docker/docker","version":"v28.5.2+incompatible","type":"go-module","locations":[{"path":"/tool-imports/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:docker:docker:v28.5.2\\+incompatible:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/docker/docker@v28.5.2%2Bincompatible","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:DBX0Y0zAjZbSrm1uzOkdr1onVghKaftjlSWt4AFexzM="}}},{"vulnerability":{"id":"GHSA-2v5f-5r6w-p67r","dataSource":"https://github.com/advisories/GHSA-2v5f-5r6w-p67r","namespace":"github:language:go","severity":"Low","urls":["https://github.com/modelcontextprotocol/registry/security/advisories/GHSA-2v5f-5r6w-p67r","https://nvd.nist.gov/vuln/detail/CVE-2026-45781"],"description":"MCP Registry: OCI validator skips ownership check on upstream rate limits","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.5,"exploitabilityScore":2.1,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-45781","epss":0.00233,"percentile":0.14293,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-45781","cwe":"CWE-636","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.7.9"],"state":"fixed","available":[{"version":"1.7.9","date":"2026-05-19","kind":"first-observed"}]},"advisories":[],"risk":0.07572499999999999},"relatedVulnerabilities":[{"id":"CVE-2026-45781","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-45781","namespace":"nvd:cpe","severity":"Low","urls":["https://github.com/modelcontextprotocol/registry/security/advisories/GHSA-2v5f-5r6w-p67r"],"description":"The MCP Registry provides MCP clients with a list of MCP servers, like an app store for MCP servers. Prior to 1.7.9, OCI ownership validation skips label-match check when upstream OCI registry returns HTTP 429, letting any authenticated publisher bind their io.github.<user>/* namespace to OCI images they do not control. internal/validators/registries/oci.go:104-119 fails open on http.StatusTooManyRequests: when the registry's anonymous fetch to the upstream OCI registry is rate-limited, ValidateOCI returns nil and the publish is accepted without ever running the io.modelcontextprotocol.server.name label-match check at lines 122-141. That label check is the only cross-system ownership proof the registry applies to OCI packages — every other registry type (NPM, PyPI, NuGet, MCPB) treats a non-200 upstream response as a hard error. This vulnerability is fixed in 1.7.9.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.5,"exploitabilityScore":2.1,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-45781","epss":0.00233,"percentile":0.14293,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-45781","cwe":"CWE-636","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"github.com/modelcontextprotocol/registry","version":"v1.3.10"}},"found":{"vulnerabilityID":"GHSA-2v5f-5r6w-p67r","versionConstraint":"<1.7.9 (go)"},"fix":{"suggestedVersion":"1.7.9"}}],"artifact":{"id":"pkg:golang/github.com/modelcontextprotocol/registry@v1.3.10?package-id=9fa26fe0e176e8ec","name":"github.com/modelcontextprotocol/registry","version":"v1.3.10","type":"go-module","locations":[{"path":"/tool-imports/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:modelcontextprotocol:registry:v1.3.10:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/modelcontextprotocol/registry@v1.3.10","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:sLVSjsHL2ox1HHBy7dVfp45UKIYBjfS+7VKwwJGD79c="}}},{"vulnerability":{"id":"GO-2026-4529","dataSource":"https://github.com/sigstore/cosign/security/advisories/GHSA-wfqv-66vq-46rm","namespace":"govulndb:language:go","severity":"Low","urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-24122","https://github.com/sigstore/cosign/commit/3c9a7363f563db76d78e2de2cabd945450f3781e","https://github.com/sigstore/cosign/releases/tag/v3.0.5"],"description":"Cosign considered signatures valid with expired intermediate certificates when transparency log verification is skipped in github.com/sigstore/cosign","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-24122","epss":0.00215,"percentile":0.11984,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-24122","cwe":"CWE-295","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":[],"state":""},"advisories":[],"risk":0.07202499999999999},"relatedVulnerabilities":[{"id":"CVE-2026-24122","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-24122","namespace":"nvd:cpe","severity":"Low","urls":["https://github.com/sigstore/cosign/commit/3c9a7363f563db76d78e2de2cabd945450f3781e","https://github.com/sigstore/cosign/releases/tag/v3.0.5","https://github.com/sigstore/cosign/security/advisories/GHSA-wfqv-66vq-46rm"],"description":"Cosign provides code signing and transparency for containers and binaries. In versions 3.0.4 and below, an issuing certificate with a validity that expires before the leaf certificate will be considered valid during verification even if the provided timestamp would mean the issuing certificate should be considered expired. When verifying artifact signatures using a certificate, Cosign first verifies the certificate chain using the leaf certificate's \"not before\" timestamp and later checks expiry of the leaf certificate using either a signed timestamp provided by the Rekor transparency log or from a timestamp authority, or using the current time. The root and all issuing certificates are assumed to be valid during the leaf certificate's validity. There is no impact to users of the public Sigstore infrastructure. This may affect private deployments with customized PKIs. This issue has been fixed in version 3.0.5.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-24122","epss":0.00215,"percentile":0.11984,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-24122","cwe":"CWE-295","source":"security-advisories@github.com","type":"Secondary"}]},{"id":"GHSA-wfqv-66vq-46rm","dataSource":"https://github.com/advisories/GHSA-wfqv-66vq-46rm","namespace":"github:language:go","severity":"Low","urls":["https://github.com/sigstore/cosign/security/advisories/GHSA-wfqv-66vq-46rm","https://nvd.nist.gov/vuln/detail/CVE-2026-24122","https://github.com/sigstore/cosign/commit/3c9a7363f563db76d78e2de2cabd945450f3781e","https://github.com/sigstore/cosign/releases/tag/v3.0.5"],"description":"Cosign considered signatures valid with expired intermediate certificates when transparency log verification is skipped","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-24122","epss":0.00215,"percentile":0.11984,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-24122","cwe":"CWE-295","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"github.com/sigstore/cosign/v2","version":"v2.6.2"}},"found":{"vulnerabilityID":"GO-2026-4529","versionConstraint":"none (unknown)"}}],"artifact":{"id":"pkg:golang/github.com/sigstore/cosign/v2@v2.6.2?package-id=16dea397dc987968","name":"github.com/sigstore/cosign/v2","version":"v2.6.2","type":"go-module","locations":[{"path":"/tool-imports/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:sigstore:cosign\\/v2:v2.6.2:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/sigstore/cosign/v2@v2.6.2","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:mi6EAUJoPZ+yuyooU7m06a1DZWJouwYgh9a67L9tm2M="}}},{"vulnerability":{"id":"GHSA-95c3-6vvw-4mrq","dataSource":"https://github.com/advisories/GHSA-95c3-6vvw-4mrq","namespace":"github:language:go","severity":"Low","urls":["https://github.com/modelcontextprotocol/registry/security/advisories/GHSA-95c3-6vvw-4mrq","https://github.com/modelcontextprotocol/registry/pull/1229","https://github.com/modelcontextprotocol/registry/commit/3f89fc2b1fb34fd49f3c0e1b39e964a5c67b613f","https://github.com/modelcontextprotocol/registry/releases/tag/v1.7.6","https://nvd.nist.gov/vuln/detail/CVE-2026-44428"],"description":"MCP Registry's GitHub OIDC tokens are replayable across registry deployments due to shared audience","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N","metrics":{"baseScore":4.7,"exploitabilityScore":2.9,"impactScore":1.5},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N","metrics":{"baseScore":2.1},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-44428","epss":0.00219,"percentile":0.12419,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-44428","cwe":"CWE-918","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.7.6"],"state":"fixed","available":[{"version":"1.7.6","date":"2026-05-09","kind":"first-observed"}]},"advisories":[],"risk":0.07008},"relatedVulnerabilities":[{"id":"CVE-2026-44428","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44428","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/modelcontextprotocol/registry/security/advisories/GHSA-95c3-6vvw-4mrq"],"description":"The MCP Registry provides MCP clients with a list of MCP servers, like an app store for MCP servers. Prior to 1.7.6, the client-side and server-side GitHub OIDC flow is bound only to a global audience string, not to the specific registry instance being targeted. On the client side, the publisher always appends audience=mcp-registry when requesting the GitHub Actions ID token, regardless of the selected --registry URL. On the server side, the exchange endpoint validates only that same fixed audience and then derives publish permissions directly from repository_owner. As a result, a token legitimately obtained while interacting with one registry deployment remains acceptable to any other deployment that shares the same code and audience string. This vulnerability is fixed in 1.7.6.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N","metrics":{"baseScore":4.7,"exploitabilityScore":2.9,"impactScore":1.5},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2.1},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-44428","epss":0.00219,"percentile":0.12419,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-44428","cwe":"CWE-918","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"github.com/modelcontextprotocol/registry","version":"v1.3.10"}},"found":{"vulnerabilityID":"GHSA-95c3-6vvw-4mrq","versionConstraint":"<1.7.6 (go)"},"fix":{"suggestedVersion":"1.7.6"}}],"artifact":{"id":"pkg:golang/github.com/modelcontextprotocol/registry@v1.3.10?package-id=9fa26fe0e176e8ec","name":"github.com/modelcontextprotocol/registry","version":"v1.3.10","type":"go-module","locations":[{"path":"/tool-imports/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:modelcontextprotocol:registry:v1.3.10:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/modelcontextprotocol/registry@v1.3.10","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:sLVSjsHL2ox1HHBy7dVfp45UKIYBjfS+7VKwwJGD79c="}}},{"vulnerability":{"id":"GHSA-8wmf-6v46-5gfg","dataSource":"https://github.com/advisories/GHSA-8wmf-6v46-5gfg","namespace":"github:language:go","severity":"Low","urls":["https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-8wmf-6v46-5gfg","https://nvd.nist.gov/vuln/detail/CVE-2026-81870","https://github.com/open-telemetry/opentelemetry-go/pull/8438","https://github.com/open-telemetry/opentelemetry-go/commit/3a1412d2b3bc4e4231fbeac2ed42117ae541bb38","https://github.com/open-telemetry/opentelemetry-go/releases/tag/exporters/zipkin/v1.45.0","https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/v1.45.0"],"description":"OpenTelemetry-Go: Exporter config logging may leak endpoint URLs in info logs","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-81870","epss":0.00266,"percentile":0.1856,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-81870","cwe":"CWE-200","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-81870","cwe":"CWE-532","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.45.0"],"state":"fixed","available":[{"version":"1.45.0","date":"2026-09-18","kind":"first-observed"}]},"advisories":[],"risk":0.0665},"relatedVulnerabilities":[{"id":"CVE-2026-81870","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-81870","namespace":"nvd:cpe","severity":"Low","urls":["https://github.com/open-telemetry/opentelemetry-go/commit/3a1412d2b3bc4e4231fbeac2ed42117ae541bb38","https://github.com/open-telemetry/opentelemetry-go/pull/8438","https://github.com/open-telemetry/opentelemetry-go/releases/tag/exporters/zipkin/v1.45.0","https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/v1.45.0","https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-8wmf-6v46-5gfg"],"description":"OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 1.5.0 to 1.44.0, sdk/trace.NewTracerProvider emits a TracerProvider created internal Info-level diagnostic event whose MarshalLog implementations recursively include span processor, exporter, and client configuration. Applications that call otel.SetLogger to enable OpenTelemetry internal Info logging can therefore record OTLP gRPC and HTTP collector endpoints, the OTLP HTTP Insecure flag, and complete Zipkin collector URLs. A person or system with access to those logs can learn internal collector topology and can recover credentials or tokens embedded in Zipkin URL user information or query strings. The default OpenTelemetry logger does not emit the event, and this path does not log OTLP authentication headers, TLS key material, or span payloads. This issue is fixed in version 1.45.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-81870","epss":0.00266,"percentile":0.1856,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-81870","cwe":"CWE-200","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-81870","cwe":"CWE-532","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"go.opentelemetry.io/otel/exporters/otlp/otlptrace","version":"v1.38.0"}},"found":{"vulnerabilityID":"GHSA-8wmf-6v46-5gfg","versionConstraint":">=1.5.0,<=1.44.0 (go)"},"fix":{"suggestedVersion":"1.45.0"}}],"artifact":{"id":"pkg:golang/go.opentelemetry.io/otel/exporters/otlp/otlptrace@v1.38.0?package-id=049d23e85a701045","name":"go.opentelemetry.io/otel/exporters/otlp/otlptrace","version":"v1.38.0","type":"go-module","locations":[{"path":"/tool-imports/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:otel:exporters\\/otlp\\/otlptrace:v1.38.0:*:*:*:*:*:*:*"],"purl":"pkg:golang/go.opentelemetry.io/otel/exporters/otlp/otlptrace@v1.38.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:GqRJVj7UmLjCVyVJ3ZFLdPRmhDUp2zFmQe3RHIOsw24="}}},{"vulnerability":{"id":"GHSA-8wmf-6v46-5gfg","dataSource":"https://github.com/advisories/GHSA-8wmf-6v46-5gfg","namespace":"github:language:go","severity":"Low","urls":["https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-8wmf-6v46-5gfg","https://nvd.nist.gov/vuln/detail/CVE-2026-81870","https://github.com/open-telemetry/opentelemetry-go/pull/8438","https://github.com/open-telemetry/opentelemetry-go/commit/3a1412d2b3bc4e4231fbeac2ed42117ae541bb38","https://github.com/open-telemetry/opentelemetry-go/releases/tag/exporters/zipkin/v1.45.0","https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/v1.45.0"],"description":"OpenTelemetry-Go: Exporter config logging may leak endpoint URLs in info logs","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-81870","epss":0.00266,"percentile":0.1856,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-81870","cwe":"CWE-200","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-81870","cwe":"CWE-532","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.45.0"],"state":"fixed","available":[{"version":"1.45.0","date":"2026-09-18","kind":"first-observed"}]},"advisories":[],"risk":0.0665},"relatedVulnerabilities":[{"id":"CVE-2026-81870","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-81870","namespace":"nvd:cpe","severity":"Low","urls":["https://github.com/open-telemetry/opentelemetry-go/commit/3a1412d2b3bc4e4231fbeac2ed42117ae541bb38","https://github.com/open-telemetry/opentelemetry-go/pull/8438","https://github.com/open-telemetry/opentelemetry-go/releases/tag/exporters/zipkin/v1.45.0","https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/v1.45.0","https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-8wmf-6v46-5gfg"],"description":"OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 1.5.0 to 1.44.0, sdk/trace.NewTracerProvider emits a TracerProvider created internal Info-level diagnostic event whose MarshalLog implementations recursively include span processor, exporter, and client configuration. Applications that call otel.SetLogger to enable OpenTelemetry internal Info logging can therefore record OTLP gRPC and HTTP collector endpoints, the OTLP HTTP Insecure flag, and complete Zipkin collector URLs. A person or system with access to those logs can learn internal collector topology and can recover credentials or tokens embedded in Zipkin URL user information or query strings. The default OpenTelemetry logger does not emit the event, and this path does not log OTLP authentication headers, TLS key material, or span payloads. This issue is fixed in version 1.45.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-81870","epss":0.00266,"percentile":0.1856,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-81870","cwe":"CWE-200","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-81870","cwe":"CWE-532","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc","version":"v1.38.0"}},"found":{"vulnerabilityID":"GHSA-8wmf-6v46-5gfg","versionConstraint":">=1.5.0,<=1.44.0 (go)"},"fix":{"suggestedVersion":"1.45.0"}}],"artifact":{"id":"pkg:golang/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc@v1.38.0?package-id=0024e44cb0be35d4","name":"go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc","version":"v1.38.0","type":"go-module","locations":[{"path":"/tool-imports/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:otel:exporters\\/otlp\\/otlptrace\\/otlptracegrpc:v1.38.0:*:*:*:*:*:*:*"],"purl":"pkg:golang/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc@v1.38.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:lwI4Dc5leUqENgGuQImwLo4WnuXFPetmPpkLi2IrX54="}}},{"vulnerability":{"id":"GHSA-8wmf-6v46-5gfg","dataSource":"https://github.com/advisories/GHSA-8wmf-6v46-5gfg","namespace":"github:language:go","severity":"Low","urls":["https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-8wmf-6v46-5gfg","https://nvd.nist.gov/vuln/detail/CVE-2026-81870","https://github.com/open-telemetry/opentelemetry-go/pull/8438","https://github.com/open-telemetry/opentelemetry-go/commit/3a1412d2b3bc4e4231fbeac2ed42117ae541bb38","https://github.com/open-telemetry/opentelemetry-go/releases/tag/exporters/zipkin/v1.45.0","https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/v1.45.0"],"description":"OpenTelemetry-Go: Exporter config logging may leak endpoint URLs in info logs","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-81870","epss":0.00266,"percentile":0.1856,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-81870","cwe":"CWE-200","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-81870","cwe":"CWE-532","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.45.0"],"state":"fixed","available":[{"version":"1.45.0","date":"2026-09-18","kind":"first-observed"}]},"advisories":[],"risk":0.0665},"relatedVulnerabilities":[{"id":"CVE-2026-81870","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-81870","namespace":"nvd:cpe","severity":"Low","urls":["https://github.com/open-telemetry/opentelemetry-go/commit/3a1412d2b3bc4e4231fbeac2ed42117ae541bb38","https://github.com/open-telemetry/opentelemetry-go/pull/8438","https://github.com/open-telemetry/opentelemetry-go/releases/tag/exporters/zipkin/v1.45.0","https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/v1.45.0","https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-8wmf-6v46-5gfg"],"description":"OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 1.5.0 to 1.44.0, sdk/trace.NewTracerProvider emits a TracerProvider created internal Info-level diagnostic event whose MarshalLog implementations recursively include span processor, exporter, and client configuration. Applications that call otel.SetLogger to enable OpenTelemetry internal Info logging can therefore record OTLP gRPC and HTTP collector endpoints, the OTLP HTTP Insecure flag, and complete Zipkin collector URLs. A person or system with access to those logs can learn internal collector topology and can recover credentials or tokens embedded in Zipkin URL user information or query strings. The default OpenTelemetry logger does not emit the event, and this path does not log OTLP authentication headers, TLS key material, or span payloads. This issue is fixed in version 1.45.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-81870","epss":0.00266,"percentile":0.1856,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-81870","cwe":"CWE-200","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-81870","cwe":"CWE-532","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"go.opentelemetry.io/otel/sdk","version":"v1.40.0"}},"found":{"vulnerabilityID":"GHSA-8wmf-6v46-5gfg","versionConstraint":">=1.5.0,<=1.44.0 (go)"},"fix":{"suggestedVersion":"1.45.0"}}],"artifact":{"id":"pkg:golang/go.opentelemetry.io/otel/sdk@v1.40.0?package-id=27729d683439edda","name":"go.opentelemetry.io/otel/sdk","version":"v1.40.0","type":"go-module","locations":[{"path":"/tool-imports/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:otel:sdk:v1.40.0:*:*:*:*:*:*:*"],"purl":"pkg:golang/go.opentelemetry.io/otel/sdk@v1.40.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:KHW/jUzgo6wsPh9At46+h4upjtccTmuZCFAc9OJ71f8="}}},{"vulnerability":{"id":"GHSA-vp62-88p7-qqf5","dataSource":"https://github.com/advisories/GHSA-vp62-88p7-qqf5","namespace":"github:language:go","severity":"Medium","urls":["https://github.com/moby/moby/security/advisories/GHSA-vp62-88p7-qqf5","https://nvd.nist.gov/vuln/detail/CVE-2026-41568"],"description":"Docker: Race condition in docker cp allows creation of arbitrary empty files on the host via symlink swap","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:H","metrics":{"baseScore":6.1,"exploitabilityScore":0.9,"impactScore":4.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-41568","epss":0.00108,"percentile":0.0119,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-41568","cwe":"CWE-81","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-41568","cwe":"CWE-367","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.05993999999999999},"relatedVulnerabilities":[{"id":"CVE-2026-41568","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-41568","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/moby/moby/security/advisories/GHSA-vp62-88p7-qqf5"],"description":"Moby is an open source container framework. In Docker Engine prior to version 29.5.1, Docker Daemon versions 28.5.2 and prior, and Moby Daemon prior to version 2.0.0-beta.14, a race condition during docker cp mount setup allows a malicious container to create empty files or directories at arbitrary absolute paths on the host filesystem. This issue has been patched in Docker Engine version 29.5.1 and Moby Daemon version 2.0.0-beta.14.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:H","metrics":{"baseScore":6.1,"exploitabilityScore":0.9,"impactScore":4.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-41568","epss":0.00108,"percentile":0.0119,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-41568","cwe":"CWE-81","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-41568","cwe":"CWE-367","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"github.com/docker/docker","version":"v28.5.2+incompatible"}},"found":{"vulnerabilityID":"GHSA-vp62-88p7-qqf5","versionConstraint":"<=28.5.2 (go)"}}],"artifact":{"id":"pkg:golang/github.com/docker/docker@v28.5.2%2Bincompatible?package-id=3faa2f9d49f614ca","name":"github.com/docker/docker","version":"v28.5.2+incompatible","type":"go-module","locations":[{"path":"/tool-imports/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:docker:docker:v28.5.2\\+incompatible:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/docker/docker@v28.5.2%2Bincompatible","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:DBX0Y0zAjZbSrm1uzOkdr1onVghKaftjlSWt4AFexzM="}}},{"vulnerability":{"id":"CVE-2026-31961","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-31961","namespace":"nvd:language:go","severity":"Medium","urls":["https://github.com/anchore/quill/security/advisories/GHSA-xj69-m9qq-8m94"],"description":"Quill provides simple mac binary signing and notarization from any platform. Quill before version v0.7.1 contains an unbounded memory allocation vulnerability when parsing Mach-O binaries. Exploitation requires that Quill processes an attacker-supplied Mach-O binary, which is most likely in environments such as CI/CD pipelines, shared signing services, or any workflow where externally-submitted binaries are accepted for signing. When parsing a Mach-O binary, Quill reads several size and count fields from the LC_CODE_SIGNATURE load command and embedded code signing structures (SuperBlob, BlobIndex) and uses them to allocate memory buffers without validating that the values are reasonable or consistent with the actual file size. Affected fields include DataSize, DataOffset, and Size from the load command, Count from the SuperBlob header, and Length from individual blob headers. An attacker can craft a minimal (~4KB) malicious Mach-O binary with extremely large values in these fields, causing Quill to attempt to allocate excessive memory. This leads to memory exhaustion and denial of service, potentially crashing the host process. Both the Quill CLI and Go library are affected when used to parse untrusted Mach-O files. This vulnerability is fixed in 0.7.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"exploitabilityScore":1.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-31961","epss":0.00104,"percentile":0.01017,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-31961","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["0.7.1"],"state":"fixed","available":[{"version":"0.7.1","date":"2026-03-21","kind":"first-observed"}]},"advisories":[],"risk":0.054599999999999996},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"nvd:language:go","package":{"name":"github.com/anchore/quill","version":"v0.5.1"}},"found":{"vulnerabilityID":"CVE-2026-31961","versionConstraint":"< 0.7.1 (go)"},"fix":{"suggestedVersion":"0.7.1"}}],"artifact":{"id":"pkg:golang/github.com/anchore/quill@v0.5.1?package-id=b87ff4b6417cf573","name":"github.com/anchore/quill","version":"v0.5.1","type":"go-module","locations":[{"path":"/tool-imports/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:anchore:quill:v0.5.1:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/anchore/quill@v0.5.1","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:+TAJroWuMC0AofI4gD9V9v65zR8EfKZg8u+ZD+dKZS4="}}},{"vulnerability":{"id":"GHSA-xj69-m9qq-8m94","dataSource":"https://github.com/advisories/GHSA-xj69-m9qq-8m94","namespace":"github:language:go","severity":"Medium","urls":["https://github.com/anchore/quill/security/advisories/GHSA-xj69-m9qq-8m94","https://github.com/anchore/quill/commit/80cf3fe082678af0ec4f9f8dd93f39189d2dc1fe","https://developer.apple.com/documentation/technotes/tn3126-inside-code-signing-hashes","https://github.com/anchore/quill/releases/tag/v0.7.1","https://nvd.nist.gov/vuln/detail/CVE-2026-31961"],"description":"Quill has unbounded memory allocation via unvalidated size fields in Mach-O binary parsing","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"exploitabilityScore":1.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-31961","epss":0.00104,"percentile":0.01017,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-31961","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["0.7.1"],"state":"fixed","available":[{"version":"0.7.1","date":"2026-03-11","kind":"first-observed"}]},"advisories":[],"risk":0.054599999999999996},"relatedVulnerabilities":[{"id":"CVE-2026-31961","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-31961","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/anchore/quill/security/advisories/GHSA-xj69-m9qq-8m94"],"description":"Quill provides simple mac binary signing and notarization from any platform. Quill before version v0.7.1 contains an unbounded memory allocation vulnerability when parsing Mach-O binaries. Exploitation requires that Quill processes an attacker-supplied Mach-O binary, which is most likely in environments such as CI/CD pipelines, shared signing services, or any workflow where externally-submitted binaries are accepted for signing. When parsing a Mach-O binary, Quill reads several size and count fields from the LC_CODE_SIGNATURE load command and embedded code signing structures (SuperBlob, BlobIndex) and uses them to allocate memory buffers without validating that the values are reasonable or consistent with the actual file size. Affected fields include DataSize, DataOffset, and Size from the load command, Count from the SuperBlob header, and Length from individual blob headers. An attacker can craft a minimal (~4KB) malicious Mach-O binary with extremely large values in these fields, causing Quill to attempt to allocate excessive memory. This leads to memory exhaustion and denial of service, potentially crashing the host process. Both the Quill CLI and Go library are affected when used to parse untrusted Mach-O files. This vulnerability is fixed in 0.7.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"exploitabilityScore":1.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-31961","epss":0.00104,"percentile":0.01017,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-31961","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"github.com/anchore/quill","version":"v0.5.1"}},"found":{"vulnerabilityID":"GHSA-xj69-m9qq-8m94","versionConstraint":"<0.7.1 (go)"},"fix":{"suggestedVersion":"0.7.1"}}],"artifact":{"id":"pkg:golang/github.com/anchore/quill@v0.5.1?package-id=b87ff4b6417cf573","name":"github.com/anchore/quill","version":"v0.5.1","type":"go-module","locations":[{"path":"/tool-imports/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:anchore:quill:v0.5.1:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/anchore/quill@v0.5.1","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:+TAJroWuMC0AofI4gD9V9v65zR8EfKZg8u+ZD+dKZS4="}}},{"vulnerability":{"id":"GHSA-xf85-363p-868w","dataSource":"https://github.com/advisories/GHSA-xf85-363p-868w","namespace":"github:language:go","severity":"Low","urls":["https://github.com/oras-project/oras-go/security/advisories/GHSA-xf85-363p-868w","https://github.com/oras-project/oras-go/commit/7a9f4b0b9558821b0422152ebe21ae56930fe764","https://github.com/oras-project/oras-go/releases/tag/v2.6.1"],"description":"oras-go: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":2.1},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-48978","epss":0.00211,"percentile":0.1132,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-48978","cwe":"CWE-319","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-48978","cwe":"CWE-918","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["2.6.1"],"state":"fixed","available":[{"version":"2.6.1","date":"2026-07-02","kind":"first-observed"}]},"advisories":[],"risk":0.053805},"relatedVulnerabilities":[{"id":"CVE-2026-48978","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-48978","namespace":"nvd:cpe","severity":"Low","urls":["https://github.com/oras-project/oras-go/commit/7a9f4b0b9558821b0422152ebe21ae56930fe764","https://github.com/oras-project/oras-go/releases/tag/v2.6.1","https://github.com/oras-project/oras-go/security/advisories/GHSA-xf85-363p-868w"],"description":"oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, auth.Client follows the realm URL from a registry's WWW-Authenticate: Bearer challenge without validating the scheme or host, allowing a malicious or compromised registry to cause SSRF to internal networks such as http://169.254.169.254/, http://10.0.0.x/, and http://127.0.0.1/, or to downgrade a registry contacted over https:// to an http:// token endpoint in registry/remote/auth/client.go through Client.Do(), Client.fetchBearerToken(), fetchDistributionToken, and fetchOAuth2Token. This issue is fixed in version 2.6.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2.1},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-48978","epss":0.00211,"percentile":0.1132,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-48978","cwe":"CWE-319","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-48978","cwe":"CWE-918","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"oras.land/oras-go/v2","version":"v2.6.0"}},"found":{"vulnerabilityID":"GHSA-xf85-363p-868w","versionConstraint":"<2.6.1 (go)"},"fix":{"suggestedVersion":"2.6.1"}}],"artifact":{"id":"pkg:golang/oras.land/oras-go/v2@v2.6.0?package-id=016c318c2b8258c2","name":"oras.land/oras-go/v2","version":"v2.6.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:linuxfoundation:oras:v2.6.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/oras.land/oras-go/v2@v2.6.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:X4ELRsiGkrbeox69+9tzTu492FMUu7zJQW6eJU+I2oc="}}},{"vulnerability":{"id":"CVE-2026-31959","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-31959","namespace":"nvd:language:go","severity":"Medium","urls":["https://github.com/anchore/quill/security/advisories/GHSA-7q3q-5px6-4c5p"],"description":"Quill provides simple mac binary signing and notarization from any platform. Quill before version v0.7.1 contains a Server-Side Request Forgery (SSRF) vulnerability when attempting to fetch the Apple notarization submission logs. Exploitation requires the ability to modify API responses from Apple's notarization service, which is not possible under standard network conditions due to HTTPS with proper TLS certificate validation; however, environments with TLS-intercepting proxies (common in corporate networks), compromised certificate authorities, or other trust boundary violations are at risk. When retrieving submission logs, Quill fetches a URL provided in the API response without validating that the scheme is https or that the host does not point to a local or multicast IP address. An attacker who can tamper with the response can supply an arbitrary URL, causing the Quill client to issue HTTP or HTTPS requests to attacker-controlled or internal network destinations. This could lead to exfiltration of sensitive data such as cloud provider credentials or internal service responses. Both the Quill CLI and library are affected when used to retrieve notarization submission logs. This vulnerability is fixed in 0.7.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":1.7,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-31959","epss":0.00102,"percentile":0.0092,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-31959","cwe":"CWE-918","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":[],"state":""},"advisories":[],"risk":0.05253},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"nvd:language:go","package":{"name":"github.com/anchore/quill","version":"v0.5.1"}},"found":{"vulnerabilityID":"CVE-2026-31959","versionConstraint":"<= 0.7.1 (go)"}}],"artifact":{"id":"pkg:golang/github.com/anchore/quill@v0.5.1?package-id=b87ff4b6417cf573","name":"github.com/anchore/quill","version":"v0.5.1","type":"go-module","locations":[{"path":"/tool-imports/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:anchore:quill:v0.5.1:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/anchore/quill@v0.5.1","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:+TAJroWuMC0AofI4gD9V9v65zR8EfKZg8u+ZD+dKZS4="}}},{"vulnerability":{"id":"GHSA-7q3q-5px6-4c5p","dataSource":"https://github.com/advisories/GHSA-7q3q-5px6-4c5p","namespace":"github:language:go","severity":"Medium","urls":["https://github.com/anchore/quill/security/advisories/GHSA-7q3q-5px6-4c5p","https://github.com/anchore/quill/commit/e41d66a517c2dc20ad8e9fbccffbdc6ba5ef0020","https://developer.apple.com/documentation/notaryapi/get-submission-log","https://github.com/anchore/quill/releases/tag/v0.7.1","https://nvd.nist.gov/vuln/detail/CVE-2026-31959"],"description":"Quill vulnerable to SSRF via unvalidated URL from Apple notarization log retrieval","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":1.7,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-31959","epss":0.00102,"percentile":0.0092,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-31959","cwe":"CWE-918","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["0.7.1"],"state":"fixed","available":[{"version":"0.7.1","date":"2026-03-11","kind":"first-observed"}]},"advisories":[],"risk":0.05253},"relatedVulnerabilities":[{"id":"CVE-2026-31959","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-31959","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/anchore/quill/security/advisories/GHSA-7q3q-5px6-4c5p"],"description":"Quill provides simple mac binary signing and notarization from any platform. Quill before version v0.7.1 contains a Server-Side Request Forgery (SSRF) vulnerability when attempting to fetch the Apple notarization submission logs. Exploitation requires the ability to modify API responses from Apple's notarization service, which is not possible under standard network conditions due to HTTPS with proper TLS certificate validation; however, environments with TLS-intercepting proxies (common in corporate networks), compromised certificate authorities, or other trust boundary violations are at risk. When retrieving submission logs, Quill fetches a URL provided in the API response without validating that the scheme is https or that the host does not point to a local or multicast IP address. An attacker who can tamper with the response can supply an arbitrary URL, causing the Quill client to issue HTTP or HTTPS requests to attacker-controlled or internal network destinations. This could lead to exfiltration of sensitive data such as cloud provider credentials or internal service responses. Both the Quill CLI and library are affected when used to retrieve notarization submission logs. This vulnerability is fixed in 0.7.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":1.7,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-31959","epss":0.00102,"percentile":0.0092,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-31959","cwe":"CWE-918","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"github.com/anchore/quill","version":"v0.5.1"}},"found":{"vulnerabilityID":"GHSA-7q3q-5px6-4c5p","versionConstraint":"<0.7.1 (go)"},"fix":{"suggestedVersion":"0.7.1"}}],"artifact":{"id":"pkg:golang/github.com/anchore/quill@v0.5.1?package-id=b87ff4b6417cf573","name":"github.com/anchore/quill","version":"v0.5.1","type":"go-module","locations":[{"path":"/tool-imports/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:anchore:quill:v0.5.1:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/anchore/quill@v0.5.1","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:+TAJroWuMC0AofI4gD9V9v65zR8EfKZg8u+ZD+dKZS4="}}},{"vulnerability":{"id":"GHSA-xm5m-wgh2-rrg3","dataSource":"https://github.com/advisories/GHSA-xm5m-wgh2-rrg3","namespace":"github:language:go","severity":"Medium","urls":["https://github.com/sigstore/timestamp-authority/security/advisories/GHSA-xm5m-wgh2-rrg3","https://nvd.nist.gov/vuln/detail/CVE-2026-39984","https://github.com/sigstore/timestamp-authority/releases/tag/v2.0.6"],"description":"Sigstore Timestamp Authority has Improper Certificate Validation in verifier","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.5,"exploitabilityScore":1.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-39984","epss":0.00099,"percentile":0.00795,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-39984","cwe":"CWE-295","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["2.0.6"],"state":"fixed","available":[{"version":"2.0.6","date":"2026-04-14","kind":"first-observed"}]},"advisories":[],"risk":0.051975},"relatedVulnerabilities":[{"id":"CVE-2026-39984","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-39984","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/sigstore/timestamp-authority/releases/tag/v2.0.6","https://github.com/sigstore/timestamp-authority/security/advisories/GHSA-xm5m-wgh2-rrg3"],"description":"Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps. Versions 2.0.5 and below contain an authorization bypass vulnerability in the VerifyTimestampResponse function. VerifyTimestampResponse correctly verifies the certificate chain signature, but the TSA-specific constraint checks in VerifyLeafCert uses the first non-CA certificate from the PKCS#7 certificate bag instead of the leaf certificate from the verified chain. An attacker can exploit this by prepending a forged certificate to the certificate bag while the message is signed with an authorized key, causing the library to validate the signature against one certificate but perform authorization checks against another. This vulnerability only affects users of the timestamp-authority/v2/pkg/verification package and does not affect the timestamp-authority service itself or sigstore-go. The issue has been fixed in version 2.0.6.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.5,"exploitabilityScore":1.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-39984","epss":0.00099,"percentile":0.00795,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-39984","cwe":"CWE-295","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"github.com/sigstore/timestamp-authority/v2","version":"v2.0.3"}},"found":{"vulnerabilityID":"GHSA-xm5m-wgh2-rrg3","versionConstraint":"<=2.0.5 (go)"},"fix":{"suggestedVersion":"2.0.6"}}],"artifact":{"id":"pkg:golang/github.com/sigstore/timestamp-authority/v2@v2.0.3?package-id=73bf00714c6e9856","name":"github.com/sigstore/timestamp-authority/v2","version":"v2.0.3","type":"go-module","locations":[{"path":"/tool-imports/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:sigstore:timestamp-authority\\/v2:v2.0.3:*:*:*:*:*:*:*","cpe:2.3:a:sigstore:timestamp_authority\\/v2:v2.0.3:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/sigstore/timestamp-authority/v2@v2.0.3","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:sRyYNtdED/ttLCMdaYnwpf0zre1A9chvjTnCmWWxN8Y="}}},{"vulnerability":{"id":"CVE-2026-31960","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-31960","namespace":"nvd:language:go","severity":"Medium","urls":["https://github.com/anchore/quill/security/advisories/GHSA-g32c-4pvp-769g"],"description":"Quill provides simple mac binary signing and notarization from any platform. Quill before version v0.7.1 has unbounded reads of HTTP response bodies during the Apple notarization process. Exploitation requires the ability to modify API responses from Apple's notarization service, which is not possible under standard network conditions due to HTTPS with proper TLS certificate validation; however, environments with TLS-intercepting proxies (common in corporate networks), compromised certificate authorities, or other trust boundary violations are at risk. When processing HTTP responses during notarization, Quill reads the entire response body into memory without any size limit. An attacker who can control or modify the response content can return an arbitrarily large payload, causing the Quill client to run out of memory and crash. The impact is limited to availability; there is no effect on confidentiality or integrity. Both the Quill CLI and library are affected when used to perform notarization operations. This vulnerability is fixed in 0.7.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.3,"exploitabilityScore":1.7,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-31960","epss":0.00092,"percentile":0.00479,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-31960","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["0.7.1"],"state":"fixed","available":[{"version":"0.7.1","date":"2026-03-21","kind":"first-observed"}]},"advisories":[],"risk":0.047380000000000005},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"nvd:language:go","package":{"name":"github.com/anchore/quill","version":"v0.5.1"}},"found":{"vulnerabilityID":"CVE-2026-31960","versionConstraint":"< 0.7.1 (go)"},"fix":{"suggestedVersion":"0.7.1"}}],"artifact":{"id":"pkg:golang/github.com/anchore/quill@v0.5.1?package-id=b87ff4b6417cf573","name":"github.com/anchore/quill","version":"v0.5.1","type":"go-module","locations":[{"path":"/tool-imports/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:anchore:quill:v0.5.1:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/anchore/quill@v0.5.1","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:+TAJroWuMC0AofI4gD9V9v65zR8EfKZg8u+ZD+dKZS4="}}},{"vulnerability":{"id":"GHSA-g32c-4pvp-769g","dataSource":"https://github.com/advisories/GHSA-g32c-4pvp-769g","namespace":"github:language:go","severity":"Medium","urls":["https://github.com/anchore/quill/security/advisories/GHSA-g32c-4pvp-769g","https://github.com/anchore/quill/commit/9cdb0823ea1d2c45dcc11557f8c5cd7291c75d29","https://developer.apple.com/documentation/notaryapi/get-submission-log","https://github.com/anchore/quill/releases/tag/v0.7.1","https://nvd.nist.gov/vuln/detail/CVE-2026-31960"],"description":"Quill has DoS via unbounded read of HTTP response body during notarization","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.3,"exploitabilityScore":1.7,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-31960","epss":0.00092,"percentile":0.00479,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-31960","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["0.7.1"],"state":"fixed","available":[{"version":"0.7.1","date":"2026-03-11","kind":"first-observed"}]},"advisories":[],"risk":0.047380000000000005},"relatedVulnerabilities":[{"id":"CVE-2026-31960","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-31960","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/anchore/quill/security/advisories/GHSA-g32c-4pvp-769g"],"description":"Quill provides simple mac binary signing and notarization from any platform. Quill before version v0.7.1 has unbounded reads of HTTP response bodies during the Apple notarization process. Exploitation requires the ability to modify API responses from Apple's notarization service, which is not possible under standard network conditions due to HTTPS with proper TLS certificate validation; however, environments with TLS-intercepting proxies (common in corporate networks), compromised certificate authorities, or other trust boundary violations are at risk. When processing HTTP responses during notarization, Quill reads the entire response body into memory without any size limit. An attacker who can control or modify the response content can return an arbitrarily large payload, causing the Quill client to run out of memory and crash. The impact is limited to availability; there is no effect on confidentiality or integrity. Both the Quill CLI and library are affected when used to perform notarization operations. This vulnerability is fixed in 0.7.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.3,"exploitabilityScore":1.7,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-31960","epss":0.00092,"percentile":0.00479,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-31960","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"github.com/anchore/quill","version":"v0.5.1"}},"found":{"vulnerabilityID":"GHSA-g32c-4pvp-769g","versionConstraint":"<0.7.1 (go)"},"fix":{"suggestedVersion":"0.7.1"}}],"artifact":{"id":"pkg:golang/github.com/anchore/quill@v0.5.1?package-id=b87ff4b6417cf573","name":"github.com/anchore/quill","version":"v0.5.1","type":"go-module","locations":[{"path":"/tool-imports/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:anchore:quill:v0.5.1:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/anchore/quill@v0.5.1","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:+TAJroWuMC0AofI4gD9V9v65zR8EfKZg8u+ZD+dKZS4="}}},{"vulnerability":{"id":"GHSA-gm2x-2g9h-ccm8","dataSource":"https://github.com/advisories/GHSA-gm2x-2g9h-ccm8","namespace":"github:language:go","severity":"Low","urls":["https://github.com/go-git/go-git/security/advisories/GHSA-gm2x-2g9h-ccm8","https://nvd.nist.gov/vuln/detail/CVE-2026-33762","https://github.com/go-git/go-git/releases/tag/v5.17.1"],"description":"go-git missing validation decoding Index v4 files leads to panic","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.8,"exploitabilityScore":1.4,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-33762","epss":0.00159,"percentile":0.05038,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-33762","cwe":"CWE-129","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["5.17.1"],"state":"fixed","available":[{"version":"5.17.1","date":"2026-03-31","kind":"first-observed"}]},"advisories":[],"risk":0.04611},"relatedVulnerabilities":[{"id":"CVE-2026-33762","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33762","namespace":"nvd:cpe","severity":"Low","urls":["https://github.com/go-git/go-git/releases/tag/v5.17.1","https://github.com/go-git/go-git/security/advisories/GHSA-gm2x-2g9h-ccm8"],"description":"go-git is an extensible git implementation library written in pure Go. Prior to version 5.17.1, go-git’s index decoder for format version 4 fails to validate the path name prefix length before applying it to the previously decoded path name. A maliciously crafted index file can trigger an out-of-bounds slice operation, resulting in a runtime panic during normal index parsing. This issue only affects Git index format version 4. Earlier formats (go-git supports only v2 and v3) are not vulnerable to this issue. This issue has been patched in version 5.17.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.8,"exploitabilityScore":1.4,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-33762","epss":0.00159,"percentile":0.05038,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-33762","cwe":"CWE-129","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"github.com/go-git/go-git/v5","version":"v5.16.5"}},"found":{"vulnerabilityID":"GHSA-gm2x-2g9h-ccm8","versionConstraint":"<=5.17.0 (go)"},"fix":{"suggestedVersion":"5.17.1"}}],"artifact":{"id":"pkg:golang/github.com/go-git/go-git/v5@v5.16.5?package-id=0c14767230083f4a","name":"github.com/go-git/go-git/v5","version":"v5.16.5","type":"go-module","locations":[{"path":"/tool-imports/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:go-git:go-git\\/v5:v5.16.5:*:*:*:*:*:*:*","cpe:2.3:a:go-git:go_git\\/v5:v5.16.5:*:*:*:*:*:*:*","cpe:2.3:a:go_git:go-git\\/v5:v5.16.5:*:*:*:*:*:*:*","cpe:2.3:a:go_git:go_git\\/v5:v5.16.5:*:*:*:*:*:*:*","cpe:2.3:a:go:go-git\\/v5:v5.16.5:*:*:*:*:*:*:*","cpe:2.3:a:go:go_git\\/v5:v5.16.5:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/go-git/go-git/v5@v5.16.5","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:mdkuqblwr57kVfXri5TTH+nMFLNUxIj9Z7F5ykFbw5s="}}},{"vulnerability":{"id":"GHSA-wqqc-jjcq-vfxm","dataSource":"https://github.com/advisories/GHSA-wqqc-jjcq-vfxm","namespace":"github:language:go","severity":"Low","urls":["https://github.com/sigstore/sigstore-go/security/advisories/GHSA-wqqc-jjcq-vfxm","https://github.com/sigstore/sigstore-go/pull/642","https://github.com/sigstore/sigstore-go/commit/4594ab4c779d08be1f4419803a8249188f35ed5f","https://github.com/sigstore/sigstore-go/releases/tag/v1.2.1"],"description":"sigstore-go fails to check signature timestamps against a signing key's validity period","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.1,"exploitabilityScore":1.7,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-54787","epss":0.00134,"percentile":0.02858,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-54787","cwe":"CWE-324","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.2.1"],"state":"fixed","available":[{"version":"1.2.1","date":"2026-08-01","kind":"first-observed"}]},"advisories":[],"risk":0.040870000000000004},"relatedVulnerabilities":[{"id":"CVE-2026-54787","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54787","namespace":"nvd:cpe","severity":"Low","urls":["https://github.com/sigstore/sigstore-go/commit/4594ab4c779d08be1f4419803a8249188f35ed5f","https://github.com/sigstore/sigstore-go/pull/642","https://github.com/sigstore/sigstore-go/releases/tag/v1.2.1","https://github.com/sigstore/sigstore-go/security/advisories/GHSA-wqqc-jjcq-vfxm"],"description":"sigstore-go is a Go library for Sigstore signing and verification. Prior to 1.2.1, sigstore-go does not check a bundle signing timestamp against the validity window of an ExpiringKey wrapping a self-managed long-lived signing key without a certificate, which can allow an attacker holding expired key material to sign accepted bundles. This issue is fixed in version 1.2.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.1,"exploitabilityScore":1.7,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-54787","epss":0.00134,"percentile":0.02858,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-54787","cwe":"CWE-324","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"github.com/sigstore/sigstore-go","version":"v1.1.4"}},"found":{"vulnerabilityID":"GHSA-wqqc-jjcq-vfxm","versionConstraint":"<=1.2.0 (go)"},"fix":{"suggestedVersion":"1.2.1"}}],"artifact":{"id":"pkg:golang/github.com/sigstore/sigstore-go@v1.1.4?package-id=647eebcabc897611","name":"github.com/sigstore/sigstore-go","version":"v1.1.4","type":"go-module","locations":[{"path":"/tool-imports/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:sigstore:sigstore-go:v1.1.4:*:*:*:*:*:*:*","cpe:2.3:a:sigstore:sigstore_go:v1.1.4:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/sigstore/sigstore-go@v1.1.4","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:wTTsgCHOfqiEzVyBYA6mDczGtBkN7cM8mPpjJj5QvMg="}}},{"vulnerability":{"id":"GO-2026-5024","dataSource":"https://go.dev/issue/78916","namespace":"govulndb:language:go","severity":"Low","urls":["https://go.dev/cl/770080","https://groups.google.com/g/golang-announce/c/6MMI8Lj-Atg"],"description":"NewNTUnicodeString does not check for string length overflow. When provided with a string that overflows the maximum size of a NTUnicodeString (a 16-bit number of bytes), it returns a truncated string rather than an error.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.3,"exploitabilityScore":1.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-39824","epss":0.00114,"percentile":0.01458,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-39824","cwe":"CWE-190","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["0.44.0"],"state":"fixed","available":[{"version":"0.44.0","date":"2026-04-23","kind":"release"}]},"advisories":[],"risk":0.03591},"relatedVulnerabilities":[{"id":"CVE-2026-39824","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-39824","namespace":"nvd:cpe","severity":"Low","urls":["https://go.dev/cl/770080","https://go.dev/issue/78916","https://groups.google.com/g/golang-announce/c/6MMI8Lj-Atg","https://pkg.go.dev/vuln/GO-2026-5024"],"description":"NewNTUnicodeString does not check for string length overflow. When provided with a string that overflows the maximum size of a NTUnicodeString (a 16-bit number of bytes), it returns a truncated string rather than an error.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.3,"exploitabilityScore":1.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-39824","epss":0.00114,"percentile":0.01458,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-39824","cwe":"CWE-190","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"golang.org/x/sys","version":"v0.40.0"}},"found":{"vulnerabilityID":"GO-2026-5024","versionConstraint":"<0.44.0 (go)"},"fix":{"suggestedVersion":"0.44.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/sys@v0.40.0?package-id=724a509511fab39e","name":"golang.org/x/sys","version":"v0.40.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:x\\/sys:v0.40.0:*:*:*:*:*:*:*"],"purl":"pkg:golang/golang.org/x/sys@v0.40.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:DBZZqJ2Rkml6QMQsZywtnjnnGvHza6BTfYFWY9kjEWQ="}}},{"vulnerability":{"id":"GO-2026-5024","dataSource":"https://go.dev/issue/78916","namespace":"govulndb:language:go","severity":"Low","urls":["https://go.dev/cl/770080","https://groups.google.com/g/golang-announce/c/6MMI8Lj-Atg"],"description":"NewNTUnicodeString does not check for string length overflow. When provided with a string that overflows the maximum size of a NTUnicodeString (a 16-bit number of bytes), it returns a truncated string rather than an error.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.3,"exploitabilityScore":1.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-39824","epss":0.00114,"percentile":0.01458,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-39824","cwe":"CWE-190","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["0.44.0"],"state":"fixed","available":[{"version":"0.44.0","date":"2026-04-23","kind":"release"}]},"advisories":[],"risk":0.03591},"relatedVulnerabilities":[{"id":"CVE-2026-39824","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-39824","namespace":"nvd:cpe","severity":"Low","urls":["https://go.dev/cl/770080","https://go.dev/issue/78916","https://groups.google.com/g/golang-announce/c/6MMI8Lj-Atg","https://pkg.go.dev/vuln/GO-2026-5024"],"description":"NewNTUnicodeString does not check for string length overflow. When provided with a string that overflows the maximum size of a NTUnicodeString (a 16-bit number of bytes), it returns a truncated string rather than an error.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.3,"exploitabilityScore":1.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-39824","epss":0.00114,"percentile":0.01458,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-39824","cwe":"CWE-190","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"golang.org/x/sys","version":"v0.41.0"}},"found":{"vulnerabilityID":"GO-2026-5024","versionConstraint":"<0.44.0 (go)"},"fix":{"suggestedVersion":"0.44.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/sys@v0.41.0?package-id=d4c44f7bb8d3c65e","name":"golang.org/x/sys","version":"v0.41.0","type":"go-module","locations":[{"path":"/tool-imports/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:x\\/sys:v0.41.0:*:*:*:*:*:*:*"],"purl":"pkg:golang/golang.org/x/sys@v0.41.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:Ivj+2Cp/ylzLiEU89QhWblYnOE9zerudt9Ftecq2C6k="}}},{"vulnerability":{"id":"GHSA-hrxh-6v49-42gf","dataSource":"https://github.com/advisories/GHSA-hrxh-6v49-42gf","namespace":"github:language:go","severity":"High","urls":["https://github.com/grpc/grpc-go/security/advisories/GHSA-hrxh-6v49-42gf","https://github.com/grpc/grpc-go/pull/9236","https://github.com/grpc/grpc-go/commit/4ea465d4ab98013f72a142fe0fc89c19770b2935","https://github.com/grpc/grpc-go/releases/tag/v1.82.1"],"description":"gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.8},"vendorMetadata":{}}],"fix":{"versions":["1.82.1"],"state":"fixed","available":[{"version":"1.82.1","date":"2026-07-22","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"google.golang.org/grpc","version":"v1.75.1"}},"found":{"vulnerabilityID":"GHSA-hrxh-6v49-42gf","versionConstraint":"<1.82.1 (go)"},"fix":{"suggestedVersion":"1.82.1"}}],"artifact":{"id":"pkg:golang/google.golang.org/grpc@v1.75.1?package-id=fe766a98fd2603ca","name":"google.golang.org/grpc","version":"v1.75.1","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:google:grpc:v1.75.1:*:*:*:*:*:*:*"],"purl":"pkg:golang/google.golang.org/grpc@v1.75.1","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:/ODCNEuf9VghjgO3rqLcfg8fiOP0nSluljWFlDxELLI="}}},{"vulnerability":{"id":"GHSA-hrxh-6v49-42gf","dataSource":"https://github.com/advisories/GHSA-hrxh-6v49-42gf","namespace":"github:language:go","severity":"High","urls":["https://github.com/grpc/grpc-go/security/advisories/GHSA-hrxh-6v49-42gf","https://github.com/grpc/grpc-go/pull/9236","https://github.com/grpc/grpc-go/commit/4ea465d4ab98013f72a142fe0fc89c19770b2935","https://github.com/grpc/grpc-go/releases/tag/v1.82.1"],"description":"gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.8},"vendorMetadata":{}}],"fix":{"versions":["1.82.1"],"state":"fixed","available":[{"version":"1.82.1","date":"2026-07-22","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"google.golang.org/grpc","version":"v1.78.0"}},"found":{"vulnerabilityID":"GHSA-hrxh-6v49-42gf","versionConstraint":"<1.82.1 (go)"},"fix":{"suggestedVersion":"1.82.1"}}],"artifact":{"id":"pkg:golang/google.golang.org/grpc@v1.78.0?package-id=c776a416fb4b5ef1","name":"google.golang.org/grpc","version":"v1.78.0","type":"go-module","locations":[{"path":"/tool-imports/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:google:grpc:v1.78.0:*:*:*:*:*:*:*"],"purl":"pkg:golang/google.golang.org/grpc@v1.78.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:K1XZG/yGDJnzMdd/uZHAkVqJE+xIDOcmdSFZkBUicNc="}}},{"vulnerability":{"id":"GHSA-xmrv-pmrh-hhx2","dataSource":"https://github.com/advisories/GHSA-xmrv-pmrh-hhx2","namespace":"github:language:go","severity":"Medium","urls":["https://github.com/aws/aws-sdk-go-v2/security/advisories/GHSA-xmrv-pmrh-hhx2","https://github.com/aws/aws-sdk-go-v2/releases/tag/release-2026-03-23"],"description":"Denial of Service due to Panic in AWS SDK for Go v2 SDK EventStream Decoder","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"fix":{"versions":["1.7.8"],"state":"fixed","available":[{"version":"1.7.8","date":"2026-04-08","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream","version":"v1.7.4"}},"found":{"vulnerabilityID":"GHSA-xmrv-pmrh-hhx2","versionConstraint":"<1.7.8 (go)"},"fix":{"suggestedVersion":"1.7.8"}}],"artifact":{"id":"pkg:golang/github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.7.4?package-id=98ef61d6d4162499","name":"github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream","version":"v1.7.4","type":"go-module","locations":[{"path":"/tool-imports/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:aws:aws-sdk-go-v2\\/aws\\/protocol\\/eventstream:v1.7.4:*:*:*:*:*:*:*","cpe:2.3:a:aws:aws_sdk_go_v2\\/aws\\/protocol\\/eventstream:v1.7.4:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.7.4","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:489krEF9xIGkOaaX3CE/Be2uWjiXrkCH6gUX+bZA/BU="}}},{"vulnerability":{"id":"GHSA-xmrv-pmrh-hhx2","dataSource":"https://github.com/advisories/GHSA-xmrv-pmrh-hhx2","namespace":"github:language:go","severity":"Medium","urls":["https://github.com/aws/aws-sdk-go-v2/security/advisories/GHSA-xmrv-pmrh-hhx2","https://github.com/aws/aws-sdk-go-v2/releases/tag/release-2026-03-23"],"description":"Denial of Service due to Panic in AWS SDK for Go v2 SDK EventStream Decoder","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"fix":{"versions":["1.97.3"],"state":"fixed","available":[{"version":"1.97.3","date":"2026-04-08","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"github.com/aws/aws-sdk-go-v2/service/s3","version":"v1.93.0"}},"found":{"vulnerabilityID":"GHSA-xmrv-pmrh-hhx2","versionConstraint":"<1.97.3 (go)"},"fix":{"suggestedVersion":"1.97.3"}}],"artifact":{"id":"pkg:golang/github.com/aws/aws-sdk-go-v2/service/s3@v1.93.0?package-id=01a14947e0ef9794","name":"github.com/aws/aws-sdk-go-v2/service/s3","version":"v1.93.0","type":"go-module","locations":[{"path":"/tool-imports/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:aws:aws-sdk-go-v2\\/service\\/s3:v1.93.0:*:*:*:*:*:*:*","cpe:2.3:a:aws:aws_sdk_go_v2\\/service\\/s3:v1.93.0:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/aws/aws-sdk-go-v2/service/s3@v1.93.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:IrbE3B8O9pm3lsg96AXIN5MXX4pECEuExh/A0Du3AuI="}}},{"vulnerability":{"id":"GHSA-w5pp-99ch-qj29","dataSource":"https://github.com/advisories/GHSA-w5pp-99ch-qj29","namespace":"github:language:go","severity":"Medium","urls":["https://github.com/go-git/go-git/security/advisories/GHSA-w5pp-99ch-qj29"],"description":"go-git: Malformed Git object data may cause panics or resource exhaustion","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"exploitabilityScore":2.9,"impactScore":3.6},"vendorMetadata":{}}],"fix":{"versions":["5.19.1"],"state":"fixed","available":[{"version":"5.19.1","date":"2026-05-30","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"github.com/go-git/go-git/v5","version":"v5.16.5"}},"found":{"vulnerabilityID":"GHSA-w5pp-99ch-qj29","versionConstraint":"<=5.19.0 (go)"},"fix":{"suggestedVersion":"5.19.1"}}],"artifact":{"id":"pkg:golang/github.com/go-git/go-git/v5@v5.16.5?package-id=0c14767230083f4a","name":"github.com/go-git/go-git/v5","version":"v5.16.5","type":"go-module","locations":[{"path":"/tool-imports/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:go-git:go-git\\/v5:v5.16.5:*:*:*:*:*:*:*","cpe:2.3:a:go-git:go_git\\/v5:v5.16.5:*:*:*:*:*:*:*","cpe:2.3:a:go_git:go-git\\/v5:v5.16.5:*:*:*:*:*:*:*","cpe:2.3:a:go_git:go_git\\/v5:v5.16.5:*:*:*:*:*:*:*","cpe:2.3:a:go:go-git\\/v5:v5.16.5:*:*:*:*:*:*:*","cpe:2.3:a:go:go_git\\/v5:v5.16.5:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/go-git/go-git/v5@v5.16.5","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:mdkuqblwr57kVfXri5TTH+nMFLNUxIj9Z7F5ykFbw5s="}}},{"vulnerability":{"id":"GHSA-gcjh-h69q-9w9g","dataSource":"https://github.com/advisories/GHSA-gcjh-h69q-9w9g","namespace":"github:language:go","severity":"Medium","urls":["https://github.com/cel-expr/cel-go/security/advisories/GHSA-gcjh-h69q-9w9g"],"description":"cel-go: JSON Private Fields Exposed via NativeTypes and ParseStructTag","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"fix":{"versions":["0.29.0"],"state":"fixed","available":[{"version":"0.29.0","date":"2026-07-25","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"github.com/google/cel-go","version":"v0.27.0"}},"found":{"vulnerabilityID":"GHSA-gcjh-h69q-9w9g","versionConstraint":">=0.22.0,<=0.28.1 (go)"},"fix":{"suggestedVersion":"0.29.0"}}],"artifact":{"id":"pkg:golang/github.com/google/cel-go@v0.27.0?package-id=ae17916633c94a2b","name":"github.com/google/cel-go","version":"v0.27.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:google:cel-go:v0.27.0:*:*:*:*:*:*:*","cpe:2.3:a:google:cel_go:v0.27.0:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/google/cel-go@v0.27.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:e7ih85+4qVrBuqQWTW4FKSqZYokVuc3HnhH5keboFTo="}}},{"vulnerability":{"id":"GHSA-pmwq-pjrm-6p5r","dataSource":"https://github.com/advisories/GHSA-pmwq-pjrm-6p5r","namespace":"github:language:go","severity":"Medium","urls":["https://github.com/in-toto/in-toto-golang/security/advisories/GHSA-pmwq-pjrm-6p5r","https://github.com/in-toto/in-toto-golang/pull/462","https://github.com/in-toto/in-toto-golang/commit/36d782ffb2ca3adbffcdce1fd971c23319dd4469"],"description":"in-toto-golang and in-toto-python have inconsistent negation behavior","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":4.1,"exploitabilityScore":0.5,"impactScore":3.6},"vendorMetadata":{}}],"fix":{"versions":["0.11.0"],"state":"fixed","available":[{"version":"0.11.0","date":"2026-05-09","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"github.com/in-toto/in-toto-golang","version":"v0.9.0"}},"found":{"vulnerabilityID":"GHSA-pmwq-pjrm-6p5r","versionConstraint":"<0.11.0 (go)"},"fix":{"suggestedVersion":"0.11.0"}}],"artifact":{"id":"pkg:golang/github.com/in-toto/in-toto-golang@v0.9.0?package-id=7843731303940fb6","name":"github.com/in-toto/in-toto-golang","version":"v0.9.0","type":"go-module","locations":[{"path":"/tool-imports/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:in-toto:in-toto-golang:v0.9.0:*:*:*:*:*:*:*","cpe:2.3:a:in-toto:in_toto_golang:v0.9.0:*:*:*:*:*:*:*","cpe:2.3:a:in_toto:in-toto-golang:v0.9.0:*:*:*:*:*:*:*","cpe:2.3:a:in_toto:in_toto_golang:v0.9.0:*:*:*:*:*:*:*","cpe:2.3:a:in:in-toto-golang:v0.9.0:*:*:*:*:*:*:*","cpe:2.3:a:in:in_toto_golang:v0.9.0:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/in-toto/in-toto-golang@v0.9.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:tHny7ac4KgtsfrG6ybU8gVOZux2H8jN05AXJ9EBM1XU="}}},{"vulnerability":{"id":"GHSA-gxhx-2686-5h9g","dataSource":"https://github.com/advisories/GHSA-gxhx-2686-5h9g","namespace":"github:language:go","severity":"Medium","urls":["https://github.com/slack-go/slack/security/advisories/GHSA-gxhx-2686-5h9g","https://github.com/slack-go/slack/releases/tag/v0.23.1","https://github.com/slack-go/slack/commit/34ad5c052e446f58505ae8d81a2a72821de107cc"],"description":"slack-go `SecretsVerifier` accepts empty signing secret without precondition","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:U","metrics":{"baseScore":4.8},"vendorMetadata":{}}],"fix":{"versions":["0.23.1"],"state":"fixed","available":[{"version":"0.23.1","date":"2026-05-15","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"github.com/slack-go/slack","version":"v0.17.3"}},"found":{"vulnerabilityID":"GHSA-gxhx-2686-5h9g","versionConstraint":"<0.23.1 (go)"},"fix":{"suggestedVersion":"0.23.1"}}],"artifact":{"id":"pkg:golang/github.com/slack-go/slack@v0.17.3?package-id=94b2707130d62169","name":"github.com/slack-go/slack","version":"v0.17.3","type":"go-module","locations":[{"path":"/tool-imports/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:slack-go:slack:v0.17.3:*:*:*:*:*:*:*","cpe:2.3:a:slack_go:slack:v0.17.3:*:*:*:*:*:*:*","cpe:2.3:a:slack:slack:v0.17.3:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/slack-go/slack@v0.17.3","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:zV5qO3Q+WJAQ/XwbGfNFrRMaJ5T/naqaonyPV/1TP4g="}}},{"vulnerability":{"id":"GHSA-vh4v-2xq2-g5cg","dataSource":"https://github.com/advisories/GHSA-vh4v-2xq2-g5cg","namespace":"github:language:go","severity":"Medium","urls":["https://github.com/oras-project/oras-go/security/advisories/GHSA-vh4v-2xq2-g5cg","https://github.com/oras-project/oras-go/commit/3c2e884e12ea52b6bff60c97f1edb7df7d0e0909","https://github.com/oras-project/oras-go/releases/tag/v2.6.1"],"description":"ORAS Go forwards registry credentials across registry redirects","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"fix":{"versions":["2.6.1"],"state":"fixed","available":[{"version":"2.6.1","date":"2026-07-02","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"oras.land/oras-go/v2","version":"v2.6.0"}},"found":{"vulnerabilityID":"GHSA-vh4v-2xq2-g5cg","versionConstraint":"<2.6.1 (go)"},"fix":{"suggestedVersion":"2.6.1"}}],"artifact":{"id":"pkg:golang/oras.land/oras-go/v2@v2.6.0?package-id=016c318c2b8258c2","name":"oras.land/oras-go/v2","version":"v2.6.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:linuxfoundation:oras:v2.6.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/oras.land/oras-go/v2@v2.6.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:X4ELRsiGkrbeox69+9tzTu492FMUu7zJQW6eJU+I2oc="}}},{"vulnerability":{"id":"GO-2026-6225","dataSource":"https://github.com/chrismellard/docker-credential-acr-env/issues/21","namespace":"govulndb:language:go","severity":"Unknown","urls":["https://github.com/osscontainertools/docker-credential-acr"],"description":"In github.com/chrismellard/docker-credential-acr-env/pkg/credhelper, the regular expression used by isACRRegistry to validate Azure Container Registry hostnames is unanchored. As a result, arbitrary hostnames containing the substring \".azurecr.io\" (such as evil.azurecr.io.attacker.com) are treated as valid ACR registries, causing ACRCredHelper.Get to send the Azure Active Directory (AAD) access token to attacker-controlled hosts.","cvss":[],"fix":{"versions":[],"state":""},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"github.com/chrismellard/docker-credential-acr-env","version":"v0.0.0-20230304212654-82a0ddb27589"}},"found":{"vulnerabilityID":"GO-2026-6225","versionConstraint":"none (unknown)"}}],"artifact":{"id":"pkg:golang/github.com/chrismellard/docker-credential-acr-env@v0.0.0-20230304212654-82a0ddb27589?package-id=e8f95b6c46ccf000","name":"github.com/chrismellard/docker-credential-acr-env","version":"v0.0.0-20230304212654-82a0ddb27589","type":"go-module","locations":[{"path":"/tool-imports/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:chrismellard:docker-credential-acr-env:v0.0.0-20230304212654-82a0ddb27589:*:*:*:*:*:*:*","cpe:2.3:a:chrismellard:docker_credential_acr_env:v0.0.0-20230304212654-82a0ddb27589:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/chrismellard/docker-credential-acr-env@v0.0.0-20230304212654-82a0ddb27589","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:krfRl01rzPzxSxyLyrChD+U+MzsBXbm0OwYYB67uF+4="}}},{"vulnerability":{"id":"GO-2026-5932","dataSource":"https://go.dev/issue/44226","namespace":"govulndb:language:go","severity":"Unknown","urls":[],"description":"The golang.org/x/crypto/openpgp package is unsafe by design, has numerous known security issues, is not maintained, and should not be used.\n\nIf you are required to interoperate with OpenPGP systems and need a maintained package, consider github.com/ProtonMail/go-crypto/openpgp which is a maintained fork that aims to be a drop-in replacement for this package.","cvss":[],"fix":{"versions":[],"state":""},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"golang.org/x/crypto","version":"v0.46.0"}},"found":{"vulnerabilityID":"GO-2026-5932","versionConstraint":"none (unknown)"}}],"artifact":{"id":"pkg:golang/golang.org/x/crypto@v0.46.0?package-id=b3387fbedc5d73be","name":"golang.org/x/crypto","version":"v0.46.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:crypto:v0.46.0:*:*:*:*:go:*:*","cpe:2.3:a:go:ssh:v0.46.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/crypto@v0.46.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:cKRW/pmt1pKAfetfu+RCEvjvZkA9RimPbh7bhFjGVBU="}}},{"vulnerability":{"id":"GO-2026-5932","dataSource":"https://go.dev/issue/44226","namespace":"govulndb:language:go","severity":"Unknown","urls":[],"description":"The golang.org/x/crypto/openpgp package is unsafe by design, has numerous known security issues, is not maintained, and should not be used.\n\nIf you are required to interoperate with OpenPGP systems and need a maintained package, consider github.com/ProtonMail/go-crypto/openpgp which is a maintained fork that aims to be a drop-in replacement for this package.","cvss":[],"fix":{"versions":[],"state":""},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"golang.org/x/crypto","version":"v0.48.0"}},"found":{"vulnerabilityID":"GO-2026-5932","versionConstraint":"none (unknown)"}}],"artifact":{"id":"pkg:golang/golang.org/x/crypto@v0.48.0?package-id=764d3323ecdb54e3","name":"golang.org/x/crypto","version":"v0.48.0","type":"go-module","locations":[{"path":"/tool-imports/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:crypto:v0.48.0:*:*:*:*:go:*:*","cpe:2.3:a:go:ssh:v0.48.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/crypto@v0.48.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:/VRzVqiRSggnhY7gNRxPauEQ5Drw9haKdM0jqfcCFts="}}}],"source":{"type":"file","target":"stackrox/kube-linter"},"distro":{"name":"","version":"","idLike":null},"descriptor":{"name":"grype","version":"0.121.0","configuration":{"output":["json"],"file":"./grype.json","pretty":false,"distro":"","add-cpes-if-none":false,"output-template-file":"","check-for-app-update":true,"only-fixed":false,"only-notfixed":false,"ignore-wontfix":"","platform":"","search":{"scope":"squashed","unindexed-archives":false,"indexed-archives":true},"ignore":[{"vulnerability":"","include-aliases":false,"reason":"","namespace":"","fix-state":"","package":{"name":"kernel-headers","version":"","language":"","type":"rpm","location":"","upstream-name":"kernel"},"vex-status":"","vex-justification":"","match-type":"exact-indirect-match"},{"vulnerability":"","include-aliases":false,"reason":"","namespace":"","fix-state":"","package":{"name":"linux(-.*)?-headers-.*","version":"","language":"","type":"deb","location":"","upstream-name":"linux.*"},"vex-status":"","vex-justification":"","match-type":"exact-indirect-match"},{"vulnerability":"","include-aliases":false,"reason":"","namespace":"","fix-state":"","package":{"name":"linux-libc-dev","version":"","language":"","type":"deb","location":"","upstream-name":"linux"},"vex-status":"","vex-justification":"","match-type":"exact-indirect-match"},{"vulnerability":"","include-aliases":false,"reason":"","namespace":"","fix-state":"","package":{"name":"linux-kbuild-.*","version":"","language":"","type":"deb","location":"","upstream-name":"linux.*"},"vex-status":"","vex-justification":"","match-type":"exact-indirect-match"}],"exclude":[],"externalSources":{"enable":false,"maven":{"searchUpstreamBySha1":true,"baseUrl":"https://search.maven.org/solrsearch/select","rateLimit":300000000}},"match":{"java":{"using-cpes":false},"jvm":{"using-cpes":true},"dotnet":{"using-cpes":false},"golang":{"using-cpes":false,"always-use-cpe-for-stdlib":false,"allow-main-module-pseudo-version-comparison":false},"javascript":{"using-cpes":false},"python":{"using-cpes":false},"ruby":{"using-cpes":false},"rust":{"using-cpes":false},"hex":{"using-cpes":false},"stock":{"using-cpes":true},"dpkg":{"using-cpes":false,"missing-epoch-strategy":"zero","use-cpes-for-eol":false},"rpm":{"using-cpes":false,"missing-epoch-strategy":"auto","use-cpes-for-eol":false}},"fail-on-severity":"","registry":{"insecure-skip-tls-verify":false,"insecure-use-http":false,"ca-cert":""},"show-suppressed":false,"include-matcher-suppressions":false,"by-cve":false,"SortBy":{"sort-by":"risk"},"name":"","default-image-pull-source":"","from":null,"vex-documents":[],"vex-add":[],"match-upstream-kernel-headers":false,"fix-channel":{"redhat-eus":{"apply":"auto","versions":">= 8.0"},"ubuntu-esm":{"apply":"auto","versions":""}},"timestamp":true,"alerts":{"enable-eol-distro-warnings":true},"db":{"cache-dir":"$HOME/.cache/grype/db","update-url":"https://grype.anchore.io/databases","ca-cert":"","auto-update":true,"validate-by-hash-on-start":true,"validate-age":true,"max-allowed-built-age":432000000000000,"require-update-check":false,"update-available-timeout":30000000000,"update-download-timeout":300000000000,"max-update-check-frequency":7200000000000},"exp":{},"dev":{"db":{"debug":false}}},"db":{"status":{"schemaVersion":"v6.1.10","from":"https://grype.anchore.io/databases/v6/vulnerability-db_v6.1.10_2026-11-01T00:24:34Z_1793514012.tar.zst?checksum=sha256%3Ad0e1af9e6491440e1a671d0a0aafc32c5c7cb5cda787dcec3482799ef298f31c","built":"2026-11-01T06:20:12Z","path":"$HOME/.cache/grype/db/6/vulnerability.db","valid":true},"providers":{"alma":{"captured":"2026-11-01T00:24:39Z","input":"xxh64:d398731e6455b022"},"alpine":{"captured":"2026-11-01T00:24:47Z","input":"xxh64:c40c8985935df81b"},"amazon":{"captured":"2026-11-01T00:24:37Z","input":"xxh64:ee129200b14d5c8a"},"arch":{"captured":"2026-11-01T00:24:47Z","input":"xxh64:14f6c24dd6cd12c8"},"bitnami":{"captured":"2026-11-01T00:24:34Z","input":"xxh64:971619846357ae10"},"chainguard":{"captured":"2026-11-01T00:24:48Z","input":"xxh64:dfbf78c7fc58a603"},"chainguard-libraries":{"captured":"2026-11-01T00:24:50Z","input":"xxh64:db9c34dd1b7bc8d0"},"debian":{"captured":"2026-11-01T00:24:52Z","input":"xxh64:078c82a49c8cb529"},"echo":{"captured":"2026-11-01T00:24:41Z","input":"xxh64:1d0df98736854a48"},"eol":{"captured":"2026-11-01T00:24:59Z","input":"xxh64:0f2164b3e62ba44b"},"epss":{"captured":"2026-11-01T00:25:00Z","input":"xxh64:0d4c3b8d2c2e5188"},"fedora":{"captured":"2026-11-01T00:24:40Z","input":"xxh64:28fe3d1d8ae41f9b"},"github":{"captured":"2026-11-01T00:24:57Z","input":"xxh64:076a86d2dc5c9e83"},"govulndb":{"captured":"2026-11-01T00:24:45Z","input":"xxh64:56e169604e12196e"},"hummingbird":{"captured":"2026-11-01T00:27:26Z","input":"xxh64:e86abd0466410fb6"},"kev":{"captured":"2026-11-01T00:25:06Z","input":"xxh64:cb0f4041bd51c379"},"mariner":{"captured":"2026-11-01T00:24:56Z","input":"xxh64:003337efdc7e1888"},"minimos":{"captured":"2026-11-01T00:24:56Z","input":"xxh64:219c30ffded7a12c"},"nvd":{"captured":"2026-11-01T00:25:41Z","input":"xxh64:75e41eec415fdb0a"},"oracle":{"captured":"2026-11-01T00:24:42Z","input":"xxh64:0546c2dd11a85c07"},"photon":{"captured":"2026-11-01T00:24:37Z","input":"xxh64:8dbfd0c521fd470a"},"rhel":{"captured":"2026-11-01T01:08:40Z","input":"xxh64:57c5e6a7f9f134ff"},"secureos":{"captured":"2026-11-01T00:24:34Z","input":"xxh64:ac7fa7f44e8ed7dd"},"sles":{"captured":"2026-11-01T00:26:56Z","input":"xxh64:025a1565b2cc7cdf"},"ubuntu":{"captured":"2026-11-01T00:25:58Z","input":"xxh64:9ab4d29f0ea6275d"},"wolfi":{"captured":"2026-11-01T00:25:02Z","input":"xxh64:d27b08e998baab8e"}}},"timestamp":"2026-11-02T03:09:43.670382312Z"}}