{"matches":[{"vulnerability":{"id":"GO-2026-4887","dataSource":"https://github.com/moby/moby/security/advisories/GHSA-x744-4wpc-v9h2","namespace":"govulndb:language:go","severity":"High","urls":["https://github.com/moby/moby/commit/e89edb19ad7de0407a5d31e3111cb01aa10b5a38","https://docs.docker.com/engine/extend/plugins_authorization","https://github.com/moby/moby/security/advisories/GHSA-v23v-6jw2-98fq"],"description":"Moby has AuthZ plugin bypass when provided oversized request bodies in github.com/docker/docker","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"exploitabilityScore":1.9,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-34040","epss":0.0927,"percentile":0.9536,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-34040","cwe":"CWE-288","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":[],"state":""},"advisories":[],"risk":7.091550000000001},"relatedVulnerabilities":[{"id":"CVE-2026-34040","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-34040","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/moby/moby/releases/tag/docker-v29.3.1","https://github.com/moby/moby/security/advisories/GHSA-x744-4wpc-v9h2"],"description":"Moby is an open source container framework. Prior to version 29.3.1, a security vulnerability has been detected that allows attackers to bypass authorization plugins (AuthZ). This issue has been patched in version 29.3.1.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"exploitabilityScore":1.9,"impactScore":5.9},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.8,"exploitabilityScore":2.1,"impactScore":6.1},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-34040","epss":0.0927,"percentile":0.9536,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-34040","cwe":"CWE-288","source":"security-advisories@github.com","type":"Secondary"}]},{"id":"GHSA-x744-4wpc-v9h2","dataSource":"https://github.com/advisories/GHSA-x744-4wpc-v9h2","namespace":"github:language:go","severity":"High","urls":["https://github.com/moby/moby/security/advisories/GHSA-v23v-6jw2-98fq","https://github.com/moby/moby/security/advisories/GHSA-x744-4wpc-v9h2","https://github.com/moby/moby/commit/e89edb19ad7de0407a5d31e3111cb01aa10b5a38","https://docs.docker.com/engine/extend/plugins_authorization","https://nvd.nist.gov/vuln/detail/CVE-2026-34040","https://github.com/moby/moby/releases/tag/docker-v29.3.1"],"description":"Moby has AuthZ plugin bypass when provided oversized request bodies","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.8,"exploitabilityScore":2.1,"impactScore":6.1},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-34040","epss":0.0927,"percentile":0.9536,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-34040","cwe":"CWE-288","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"github.com/docker/docker","version":"v28.0.4+incompatible"}},"found":{"vulnerabilityID":"GO-2026-4887","versionConstraint":"none (unknown)"}}],"artifact":{"id":"pkg:golang/github.com/docker/docker@v28.0.4%2Bincompatible?package-id=39ab24a3ac08acd0","name":"github.com/docker/docker","version":"v28.0.4+incompatible","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:docker:docker:v28.0.4\\+incompatible:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/docker/docker@v28.0.4%2Bincompatible","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:JNNkBctYKurkw6FrHfKqY0nKIDf5nrbxjVBtS+cdcok="}}},{"vulnerability":{"id":"GO-2026-5026","dataSource":"https://go.dev/cl/767220","namespace":"govulndb:language:go","severity":"High","urls":["https://go.dev/issue/78760","https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8","https://groups.google.com/g/golang-announce/c/94pEornpRlI"],"description":"The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode(\"xn--example-.com\") incorrectly returns the name \"example.com\" rather than an error.\n\nThis behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject \"example.com\" but permit \"xn--example-.com\". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name \"example.com\".","cvss":[{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N","metrics":{"baseScore":8.2,"exploitabilityScore":1.8,"impactScore":5.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-39821","epss":0.01834,"percentile":0.78914,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-39821","cwe":"CWE-1289","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"},{"cve":"CVE-2026-39821","cwe":"CWE-1289","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["0.55.0"],"state":"fixed","available":[{"version":"0.55.0","date":"2026-05-22","kind":"release"}]},"advisories":[],"risk":1.4396899999999997},"relatedVulnerabilities":[{"id":"CVE-2026-39821","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-39821","namespace":"nvd:cpe","severity":"High","urls":["https://go.dev/cl/767220","https://go.dev/issue/78760","https://groups.google.com/g/golang-announce/c/94pEornpRlI","https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8","https://pkg.go.dev/vuln/GO-2026-5026","https://access.redhat.com/errata/RHSA-2026:23262","https://access.redhat.com/errata/RHSA-2026:23264","https://access.redhat.com/errata/RHSA-2026:26546","https://access.redhat.com/errata/RHSA-2026:26547","https://access.redhat.com/errata/RHSA-2026:30650","https://access.redhat.com/errata/RHSA-2026:30651","https://access.redhat.com/errata/RHSA-2026:30853","https://access.redhat.com/errata/RHSA-2026:30854","https://access.redhat.com/errata/RHSA-2026:30855","https://access.redhat.com/errata/RHSA-2026:33155","https://access.redhat.com/errata/RHSA-2026:33160","https://access.redhat.com/errata/RHSA-2026:33163","https://access.redhat.com/errata/RHSA-2026:33173","https://access.redhat.com/errata/RHSA-2026:33183","https://access.redhat.com/errata/RHSA-2026:33524","https://access.redhat.com/errata/RHSA-2026:33531","https://access.redhat.com/errata/RHSA-2026:34342","https://access.redhat.com/errata/RHSA-2026:34357","https://access.redhat.com/errata/RHSA-2026:34359","https://access.redhat.com/errata/RHSA-2026:34364","https://access.redhat.com/errata/RHSA-2026:34789","https://access.redhat.com/errata/RHSA-2026:35826","https://access.redhat.com/errata/RHSA-2026:35827","https://access.redhat.com/errata/RHSA-2026:35828","https://access.redhat.com/errata/RHSA-2026:35829","https://access.redhat.com/errata/RHSA-2026:35830","https://access.redhat.com/errata/RHSA-2026:35831","https://access.redhat.com/errata/RHSA-2026:35993","https://access.redhat.com/errata/RHSA-2026:35994","https://access.redhat.com/errata/RHSA-2026:36105","https://access.redhat.com/errata/RHSA-2026:36167","https://access.redhat.com/errata/RHSA-2026:36207","https://access.redhat.com/errata/RHSA-2026:36648","https://access.redhat.com/errata/RHSA-2026:36651","https://access.redhat.com/errata/RHSA-2026:36796","https://access.redhat.com/errata/RHSA-2026:36797","https://access.redhat.com/errata/RHSA-2026:36808","https://access.redhat.com/errata/RHSA-2026:36820","https://access.redhat.com/errata/RHSA-2026:36883","https://access.redhat.com/errata/RHSA-2026:37387","https://access.redhat.com/errata/RHSA-2026:37435","https://access.redhat.com/errata/RHSA-2026:37436","https://access.redhat.com/errata/RHSA-2026:38995","https://access.redhat.com/errata/RHSA-2026:39005","https://access.redhat.com/errata/RHSA-2026:39573","https://access.redhat.com/errata/RHSA-2026:39879","https://access.redhat.com/errata/RHSA-2026:40118","https://access.redhat.com/errata/RHSA-2026:40262","https://access.redhat.com/errata/RHSA-2026:40945","https://access.redhat.com/errata/RHSA-2026:41019","https://access.redhat.com/errata/RHSA-2026:41030","https://access.redhat.com/errata/RHSA-2026:41031","https://access.redhat.com/errata/RHSA-2026:41036","https://access.redhat.com/errata/RHSA-2026:41055","https://access.redhat.com/errata/RHSA-2026:41066","https://access.redhat.com/errata/RHSA-2026:41928","https://access.redhat.com/errata/RHSA-2026:41930","https://access.redhat.com/errata/RHSA-2026:42043","https://access.redhat.com/errata/RHSA-2026:42047","https://access.redhat.com/errata/RHSA-2026:42048","https://access.redhat.com/errata/RHSA-2026:42049","https://access.redhat.com/errata/RHSA-2026:42050","https://access.redhat.com/errata/RHSA-2026:42051","https://access.redhat.com/errata/RHSA-2026:42078","https://access.redhat.com/errata/RHSA-2026:42079","https://access.redhat.com/errata/RHSA-2026:42080","https://access.redhat.com/errata/RHSA-2026:42082","https://access.redhat.com/errata/RHSA-2026:42132","https://access.redhat.com/errata/RHSA-2026:42142","https://access.redhat.com/errata/RHSA-2026:42146","https://access.redhat.com/errata/RHSA-2026:42150","https://access.redhat.com/errata/RHSA-2026:42151","https://access.redhat.com/errata/RHSA-2026:42240","https://access.redhat.com/errata/RHSA-2026:42644","https://access.redhat.com/errata/RHSA-2026:42796","https://access.redhat.com/errata/RHSA-2026:42852","https://access.redhat.com/errata/RHSA-2026:43038","https://access.redhat.com/errata/RHSA-2026:43052","https://access.redhat.com/errata/RHSA-2026:43692","https://access.redhat.com/errata/RHSA-2026:44622","https://access.redhat.com/errata/RHSA-2026:44624","https://access.redhat.com/errata/RHSA-2026:46395","https://access.redhat.com/errata/RHSA-2026:47149","https://access.redhat.com/errata/RHSA-2026:47735","https://access.redhat.com/errata/RHSA-2026:47737","https://access.redhat.com/errata/RHSA-2026:47952","https://access.redhat.com/errata/RHSA-2026:49702","https://access.redhat.com/errata/RHSA-2026:49712","https://access.redhat.com/errata/RHSA-2026:50300","https://access.redhat.com/errata/RHSA-2026:50843","https://access.redhat.com/errata/RHSA-2026:51033","https://access.redhat.com/errata/RHSA-2026:51112","https://access.redhat.com/errata/RHSA-2026:51187","https://access.redhat.com/errata/RHSA-2026:51194","https://access.redhat.com/errata/RHSA-2026:51341","https://access.redhat.com/errata/RHSA-2026:52826","https://access.redhat.com/errata/RHSA-2026:53374","https://access.redhat.com/errata/RHSA-2026:53412","https://access.redhat.com/errata/RHSA-2026:53413","https://access.redhat.com/errata/RHSA-2026:53415","https://access.redhat.com/errata/RHSA-2026:53530","https://access.redhat.com/errata/RHSA-2026:54191","https://access.redhat.com/errata/RHSA-2026:54274","https://access.redhat.com/errata/RHSA-2026:54283","https://access.redhat.com/errata/RHSA-2026:54284","https://access.redhat.com/errata/RHSA-2026:54285","https://access.redhat.com/errata/RHSA-2026:54286","https://access.redhat.com/errata/RHSA-2026:54287","https://access.redhat.com/errata/RHSA-2026:54395","https://access.redhat.com/errata/RHSA-2026:54401","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:54441","https://access.redhat.com/errata/RHSA-2026:54531","https://access.redhat.com/errata/RHSA-2026:54580","https://access.redhat.com/errata/RHSA-2026:54757","https://access.redhat.com/errata/RHSA-2026:56143","https://access.redhat.com/errata/RHSA-2026:56223","https://access.redhat.com/errata/RHSA-2026:56340","https://access.redhat.com/errata/RHSA-2026:56431","https://access.redhat.com/errata/RHSA-2026:57194","https://access.redhat.com/errata/RHSA-2026:57541","https://access.redhat.com/errata/RHSA-2026:57649","https://access.redhat.com/errata/RHSA-2026:57845","https://access.redhat.com/errata/RHSA-2026:59546","https://access.redhat.com/errata/RHSA-2026:59549","https://access.redhat.com/errata/RHSA-2026:59562","https://access.redhat.com/errata/RHSA-2026:60315","https://access.redhat.com/errata/RHSA-2026:60354","https://access.redhat.com/errata/RHSA-2026:60387","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/errata/RHSA-2026:61245","https://access.redhat.com/errata/RHSA-2026:61253","https://access.redhat.com/errata/RHSA-2026:62549","https://access.redhat.com/errata/RHSA-2026:63134","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:65153","https://access.redhat.com/errata/RHSA-2026:65359","https://access.redhat.com/errata/RHSA-2026:65534","https://access.redhat.com/errata/RHSA-2026:65851","https://access.redhat.com/errata/RHSA-2026:65886","https://access.redhat.com/errata/RHSA-2026:66016","https://access.redhat.com/errata/RHSA-2026:66022","https://access.redhat.com/errata/RHSA-2026:66350","https://access.redhat.com/errata/RHSA-2026:66432","https://access.redhat.com/errata/RHSA-2026:67149","https://access.redhat.com/errata/RHSA-2026:67159","https://access.redhat.com/errata/RHSA-2026:67160","https://access.redhat.com/errata/RHSA-2026:67287","https://access.redhat.com/errata/RHSA-2026:67319","https://access.redhat.com/errata/RHSA-2026:67517","https://access.redhat.com/errata/RHSA-2026:68504","https://access.redhat.com/security/cve/CVE-2026-39821","https://bugzilla.redhat.com/show_bug.cgi?id=2480756","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39821.json"],"description":"The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode(\"xn--example-.com\") incorrectly returns the name \"example.com\" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject \"example.com\" but permit \"xn--example-.com\". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name \"example.com\".","cvss":[{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N","metrics":{"baseScore":8.2,"exploitabilityScore":1.8,"impactScore":5.8},"vendorMetadata":{}},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","metrics":{"baseScore":9.6,"exploitabilityScore":3.2,"impactScore":5.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-39821","epss":0.01834,"percentile":0.78914,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-39821","cwe":"CWE-1289","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"},{"cve":"CVE-2026-39821","cwe":"CWE-1289","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"golang.org/x/net","version":"v0.37.0"}},"found":{"vulnerabilityID":"GO-2026-5026","versionConstraint":"<0.55.0 (go)"},"fix":{"suggestedVersion":"0.55.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/net@v0.37.0?package-id=9bde281540d3ec9d","name":"golang.org/x/net","version":"v0.37.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:networking:v0.37.0:*:*:*:*:go:*:*","cpe:2.3:a:golang:net:v0.37.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/net@v0.37.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:1zLorHbz+LYj7MQlSf1+2tPIIgibq2eL5xkrGk6f+2c="}}},{"vulnerability":{"id":"GO-2026-4918","dataSource":"https://go.dev/cl/761581","namespace":"govulndb:language:go","severity":"High","urls":["https://go.dev/cl/761640","https://go.dev/issue/78476","https://groups.google.com/g/golang-announce/c/qcCIEXso47M"],"description":"When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-33814","epss":0.0084,"percentile":0.57882,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-33814","cwe":"CWE-835","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2026-33814","cwe":"CWE-606","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["0.53.0"],"state":"fixed","available":[{"version":"0.53.0","date":"2026-04-09","kind":"release"}]},"advisories":[],"risk":0.63},"relatedVulnerabilities":[{"id":"CVE-2026-33814","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33814","namespace":"nvd:cpe","severity":"High","urls":["https://go.dev/cl/761581","https://go.dev/cl/761640","https://go.dev/issue/78476","https://groups.google.com/g/golang-announce/c/qcCIEXso47M","https://pkg.go.dev/vuln/GO-2026-4918","https://access.redhat.com/errata/RHSA-2026:22112","https://access.redhat.com/errata/RHSA-2026:22120","https://access.redhat.com/errata/RHSA-2026:22121","https://access.redhat.com/errata/RHSA-2026:23262","https://access.redhat.com/errata/RHSA-2026:23264","https://access.redhat.com/errata/RHSA-2026:33120","https://access.redhat.com/errata/RHSA-2026:33123","https://access.redhat.com/errata/RHSA-2026:33142","https://access.redhat.com/errata/RHSA-2026:33150","https://access.redhat.com/errata/RHSA-2026:34342","https://access.redhat.com/errata/RHSA-2026:37387","https://access.redhat.com/errata/RHSA-2026:42644","https://access.redhat.com/errata/RHSA-2026:43692","https://access.redhat.com/errata/RHSA-2026:49702","https://access.redhat.com/errata/RHSA-2026:49712","https://access.redhat.com/errata/RHSA-2026:50205","https://access.redhat.com/errata/RHSA-2026:54274","https://access.redhat.com/errata/RHSA-2026:54283","https://access.redhat.com/errata/RHSA-2026:54284","https://access.redhat.com/errata/RHSA-2026:54285","https://access.redhat.com/errata/RHSA-2026:54286","https://access.redhat.com/errata/RHSA-2026:54287","https://access.redhat.com/errata/RHSA-2026:56854","https://access.redhat.com/errata/RHSA-2026:56912","https://access.redhat.com/errata/RHSA-2026:57191","https://access.redhat.com/errata/RHSA-2026:57194","https://access.redhat.com/errata/RHSA-2026:57365","https://access.redhat.com/errata/RHSA-2026:57367","https://access.redhat.com/errata/RHSA-2026:57408","https://access.redhat.com/errata/RHSA-2026:57545","https://access.redhat.com/errata/RHSA-2026:57649","https://access.redhat.com/errata/RHSA-2026:57845","https://access.redhat.com/errata/RHSA-2026:59833","https://access.redhat.com/errata/RHSA-2026:60023","https://access.redhat.com/errata/RHSA-2026:60025","https://access.redhat.com/errata/RHSA-2026:60441","https://access.redhat.com/errata/RHSA-2026:60442","https://access.redhat.com/errata/RHSA-2026:60446","https://access.redhat.com/errata/RHSA-2026:60447","https://access.redhat.com/errata/RHSA-2026:60454","https://access.redhat.com/errata/RHSA-2026:60477","https://access.redhat.com/errata/RHSA-2026:60478","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/errata/RHSA-2026:60668","https://access.redhat.com/errata/RHSA-2026:61253","https://access.redhat.com/errata/RHSA-2026:62410","https://access.redhat.com/errata/RHSA-2026:62550","https://access.redhat.com/errata/RHSA-2026:62551","https://access.redhat.com/errata/RHSA-2026:63046","https://access.redhat.com/errata/RHSA-2026:63047","https://access.redhat.com/errata/RHSA-2026:63048","https://access.redhat.com/errata/RHSA-2026:63050","https://access.redhat.com/errata/RHSA-2026:63091","https://access.redhat.com/errata/RHSA-2026:63096","https://access.redhat.com/errata/RHSA-2026:63097","https://access.redhat.com/errata/RHSA-2026:63103","https://access.redhat.com/errata/RHSA-2026:63104","https://access.redhat.com/errata/RHSA-2026:63636","https://access.redhat.com/errata/RHSA-2026:63637","https://access.redhat.com/errata/RHSA-2026:63639","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:66350","https://access.redhat.com/security/cve/CVE-2026-33814","https://bugzilla.redhat.com/show_bug.cgi?id=2467815","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33814.json"],"description":"When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-33814","epss":0.0084,"percentile":0.57882,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-33814","cwe":"CWE-835","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2026-33814","cwe":"CWE-606","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"golang.org/x/net","version":"v0.37.0"}},"found":{"vulnerabilityID":"GO-2026-4918","versionConstraint":"<0.53.0 (go)"},"fix":{"suggestedVersion":"0.53.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/net@v0.37.0?package-id=9bde281540d3ec9d","name":"golang.org/x/net","version":"v0.37.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:networking:v0.37.0:*:*:*:*:go:*:*","cpe:2.3:a:golang:net:v0.37.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/net@v0.37.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:1zLorHbz+LYj7MQlSf1+2tPIIgibq2eL5xkrGk6f+2c="}}},{"vulnerability":{"id":"GO-2026-6612","dataSource":"https://go.dev/cl/847187","namespace":"govulndb:language:go","severity":"Critical","urls":["https://go.dev/cl/847310","https://go.dev/issue/81743","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs"],"description":"The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"exploitabilityScore":3.9,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-78663","epss":0.00622,"percentile":0.49817,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-78663","cwe":"CWE-675","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["0.60.0"],"state":"fixed","available":[{"version":"0.60.0","date":"2026-10-08","kind":"release"}]},"advisories":[],"risk":0.56291},"relatedVulnerabilities":[{"id":"CVE-2026-78663","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78663","namespace":"nvd:cpe","severity":"Critical","urls":["https://go.dev/cl/847187","https://go.dev/cl/847310","https://go.dev/issue/81743","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs","https://pkg.go.dev/vuln/GO-2026-6612"],"description":"The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"exploitabilityScore":3.9,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-78663","epss":0.00622,"percentile":0.49817,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-78663","cwe":"CWE-675","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"golang.org/x/net","version":"v0.37.0"}},"found":{"vulnerabilityID":"GO-2026-6612","versionConstraint":"<0.60.0 (go)"},"fix":{"suggestedVersion":"0.60.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/net@v0.37.0?package-id=9bde281540d3ec9d","name":"golang.org/x/net","version":"v0.37.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:networking:v0.37.0:*:*:*:*:go:*:*","cpe:2.3:a:golang:net:v0.37.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/net@v0.37.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:1zLorHbz+LYj7MQlSf1+2tPIIgibq2eL5xkrGk6f+2c="}}},{"vulnerability":{"id":"GO-2026-6603","dataSource":"https://go.dev/cl/847185","namespace":"govulndb:language:go","severity":"High","urls":["https://go.dev/cl/847314","https://go.dev/issue/81857","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs"],"description":"When \"Trailer\" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a \"Trailer\" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-78659","epss":0.00627,"percentile":0.50086,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-78659","cwe":"CWE-405","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["0.60.0"],"state":"fixed","available":[{"version":"0.60.0","date":"2026-10-08","kind":"release"}]},"advisories":[],"risk":0.47025},"relatedVulnerabilities":[{"id":"CVE-2026-78659","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78659","namespace":"nvd:cpe","severity":"High","urls":["https://go.dev/cl/847185","https://go.dev/cl/847314","https://go.dev/issue/81857","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs","https://pkg.go.dev/vuln/GO-2026-6603"],"description":"When \"Trailer\" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a \"Trailer\" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-78659","epss":0.00627,"percentile":0.50086,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-78659","cwe":"CWE-405","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"golang.org/x/net","version":"v0.37.0"}},"found":{"vulnerabilityID":"GO-2026-6603","versionConstraint":"<0.60.0 (go)"},"fix":{"suggestedVersion":"0.60.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/net@v0.37.0?package-id=9bde281540d3ec9d","name":"golang.org/x/net","version":"v0.37.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:networking:v0.37.0:*:*:*:*:go:*:*","cpe:2.3:a:golang:net:v0.37.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/net@v0.37.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:1zLorHbz+LYj7MQlSf1+2tPIIgibq2eL5xkrGk6f+2c="}}},{"vulnerability":{"id":"GO-2026-6611","dataSource":"https://go.dev/cl/847186","namespace":"govulndb:language:go","severity":"High","urls":["https://go.dev/cl/847308","https://go.dev/issue/81742","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs"],"description":"A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-78669","epss":0.00614,"percentile":0.49429,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-78669","cwe":"CWE-405","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["0.60.0"],"state":"fixed","available":[{"version":"0.60.0","date":"2026-10-08","kind":"release"}]},"advisories":[],"risk":0.46049999999999996},"relatedVulnerabilities":[{"id":"CVE-2026-78669","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78669","namespace":"nvd:cpe","severity":"High","urls":["https://go.dev/cl/847186","https://go.dev/cl/847308","https://go.dev/issue/81742","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs","https://pkg.go.dev/vuln/GO-2026-6611"],"description":"A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-78669","epss":0.00614,"percentile":0.49429,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-78669","cwe":"CWE-405","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"golang.org/x/net","version":"v0.37.0"}},"found":{"vulnerabilityID":"GO-2026-6611","versionConstraint":"<0.60.0 (go)"},"fix":{"suggestedVersion":"0.60.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/net@v0.37.0?package-id=9bde281540d3ec9d","name":"golang.org/x/net","version":"v0.37.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:networking:v0.37.0:*:*:*:*:go:*:*","cpe:2.3:a:golang:net:v0.37.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/net@v0.37.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:1zLorHbz+LYj7MQlSf1+2tPIIgibq2eL5xkrGk6f+2c="}}},{"vulnerability":{"id":"GHSA-259r-337f-4rfw","dataSource":"https://github.com/advisories/GHSA-259r-337f-4rfw","namespace":"github:language:go","severity":"High","urls":["https://github.com/klauspost/compress/security/advisories/GHSA-259r-337f-4rfw","https://nvd.nist.gov/vuln/detail/CVE-2026-63209","https://github.com/klauspost/compress/pull/1163","https://github.com/klauspost/compress/commit/539243b8823ee8f03e49969823d57c348c917536","https://github.com/klauspost/compress/commit/8668e357e776d5152ed62f33c17f21b8690664fa","https://github.com/klauspost/compress/releases/tag/v1.18.7"],"description":"Compress/s2: Integer Overflow or Wraparound and Out-of-bounds Write in compress","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-63209","epss":0.00572,"percentile":0.47335,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-63209","cwe":"CWE-190","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-63209","cwe":"CWE-787","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.18.7"],"state":"fixed","available":[{"version":"1.18.7","date":"2026-10-20","kind":"first-observed"}]},"advisories":[],"risk":0.42900000000000005},"relatedVulnerabilities":[{"id":"CVE-2026-63209","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-63209","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/klauspost/compress/commit/539243b8823ee8f03e49969823d57c348c917536","https://github.com/klauspost/compress/releases/tag/v1.18.7","https://github.com/klauspost/compress/security/advisories/GHSA-259r-337f-4rfw"],"description":"compress provides various compression algorithms. Prior to version 1.18.7, a signed integer overflow vulnerability in s2.NewDict() allows an attacker to bypass repeat index validation by supplying a dictionary with a uvarint-encoded repeat value exceeding MaxInt64. When Dict.Encode() is subsequently called, the overflowed negative repeat value causes an out-of-bounds memory access via unsafe.Pointer arithmetic, crashing the process with SIGSEGV. This issue has been patched in version 1.18.7.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-63209","epss":0.00572,"percentile":0.47335,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-63209","cwe":"CWE-190","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-63209","cwe":"CWE-787","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"github.com/klauspost/compress","version":"v1.18.0"}},"found":{"vulnerabilityID":"GHSA-259r-337f-4rfw","versionConstraint":"<=1.18.6 (go)"},"fix":{"suggestedVersion":"1.18.7"}}],"artifact":{"id":"pkg:golang/github.com/klauspost/compress@v1.18.0?package-id=6813a3f2b23f48bb","name":"github.com/klauspost/compress","version":"v1.18.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:klauspost:compress:v1.18.0:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/klauspost/compress@v1.18.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:c/Cqfb0r+Yi+JtIEq73FWXVkRonBlf0CRNYc8Zttxdo="}}},{"vulnerability":{"id":"GO-2026-5942","dataSource":"https://go.dev/cl/786345","namespace":"govulndb:language:go","severity":"High","urls":["https://go.dev/issue/79795","https://groups.google.com/g/golang-announce/c/94pEornpRlI"],"description":"Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-46600","epss":0.00549,"percentile":0.45997,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-46600","cwe":"CWE-125","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["0.56.0"],"state":"fixed","available":[{"version":"0.56.0","date":"2026-06-09","kind":"release"}]},"advisories":[],"risk":0.41174999999999995},"relatedVulnerabilities":[{"id":"CVE-2026-46600","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-46600","namespace":"nvd:cpe","severity":"High","urls":["https://go.dev/cl/786345","https://go.dev/issue/79795","https://groups.google.com/g/golang-announce/c/94pEornpRlI","https://pkg.go.dev/vuln/GO-2026-5942"],"description":"Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-46600","epss":0.00549,"percentile":0.45997,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-46600","cwe":"CWE-125","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"golang.org/x/net","version":"v0.37.0"}},"found":{"vulnerabilityID":"GO-2026-5942","versionConstraint":"<0.56.0 (go)"},"fix":{"suggestedVersion":"0.56.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/net@v0.37.0?package-id=9bde281540d3ec9d","name":"golang.org/x/net","version":"v0.37.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:networking:v0.37.0:*:*:*:*:go:*:*","cpe:2.3:a:golang:net:v0.37.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/net@v0.37.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:1zLorHbz+LYj7MQlSf1+2tPIIgibq2eL5xkrGk6f+2c="}}},{"vulnerability":{"id":"GHSA-p436-gjf2-799p","dataSource":"https://github.com/advisories/GHSA-p436-gjf2-799p","namespace":"github:language:go","severity":"High","urls":["https://github.com/docker/cli/security/advisories/GHSA-p436-gjf2-799p","https://nvd.nist.gov/vuln/detail/CVE-2025-15558","https://github.com/docker/cli/pull/6713","https://github.com/docker/compose/pull/12300","https://github.com/docker/cli/commit/13759330b1f7e7cb0d67047ea42c5482548ba7fa","https://docs.docker.com/desktop/release-notes","https://www.zerodayinitiative.com/advisories/ZDI-CAN-28304"],"description":"Docker CLI Plugins: Uncontrolled Search Path Element Leads to Local Privilege Escalation on Windows","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-15558","epss":0.00549,"percentile":0.45994,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-15558","cwe":"CWE-427","source":"security@docker.com","type":"Secondary"},{"cve":"CVE-2025-15558","cwe":"CWE-427","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["29.2.0"],"state":"fixed","available":[{"version":"29.2.0","date":"2026-03-05","kind":"first-observed"}]},"advisories":[],"risk":0.398025},"relatedVulnerabilities":[{"id":"CVE-2025-15558","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-15558","namespace":"nvd:cpe","severity":"High","urls":["https://docs.docker.com/desktop/release-notes/","https://github.com/docker/cli/pull/6713","https://www.zerodayinitiative.com/advisories/ZDI-CAN-28304/","https://access.redhat.com/security/cve/CVE-2025-15558","https://bugzilla.redhat.com/show_bug.cgi?id=2444574","https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-15558.json"],"description":"Docker CLI for Windows searches for plugin binaries in C:\\ProgramData\\Docker\\cli-plugins, a directory that does not exist by default. A low-privileged attacker can create this directory and place malicious CLI plugin binaries (docker-compose.exe, docker-buildx.exe, etc.) that are executed when a victim user opens Docker Desktop or invokes Docker CLI plugin features, and allow privilege-escalation if the docker CLI is executed as a privileged user.\n\nThis issue affects Docker CLI: through 29.1.5 and Windows binaries acting as a CLI-plugin manager using the  github.com/docker/cli/cli-plugins/manager https://pkg.go.dev/github.com/docker/cli@v29.1.5+incompatible/cli-plugins/manager  package, such as Docker Compose.\n\nThis issue does not impact non-Windows binaries, and projects not using the plugin-manager code.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8,"exploitabilityScore":2.1,"impactScore":5.9},"vendorMetadata":{}},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.3,"exploitabilityScore":1.4,"impactScore":5.9},"vendorMetadata":{}},{"source":"security@docker.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:X/RE:X/U:X","metrics":{"baseScore":7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-15558","epss":0.00549,"percentile":0.45994,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-15558","cwe":"CWE-427","source":"security@docker.com","type":"Secondary"},{"cve":"CVE-2025-15558","cwe":"CWE-427","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"github.com/docker/cli","version":"v28.0.2+incompatible"}},"found":{"vulnerabilityID":"GHSA-p436-gjf2-799p","versionConstraint":">=19.03.0,<29.2.0 (go)"},"fix":{"suggestedVersion":"29.2.0"}}],"artifact":{"id":"pkg:golang/github.com/docker/cli@v28.0.2%2Bincompatible?package-id=164b93c7ccdc43f1","name":"github.com/docker/cli","version":"v28.0.2+incompatible","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:docker:cli:v28.0.2\\+incompatible:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/docker/cli@v28.0.2%2Bincompatible","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:cRPZ77FK3/IXTAIQQj1vmhlxiLS5m+MIUDwS6f57lrE="}}},{"vulnerability":{"id":"GO-2026-6617","dataSource":"https://go.dev/cl/847188","namespace":"govulndb:language:go","severity":"High","urls":["https://go.dev/cl/847313","https://go.dev/issue/81867","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs"],"description":"HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the other modifies the encoder's table size when handling a SETTINGS frame containing SETTINGS_HEADER_TABLE_SIZE that a client sends. A malicious client can repeatedly send a request while changing the header table size to crash the server.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-97032","epss":0.0049,"percentile":0.42162,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-97032","cwe":"CWE-362","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["0.60.0"],"state":"fixed","available":[{"version":"0.60.0","date":"2026-10-08","kind":"release"}]},"advisories":[],"risk":0.3675},"relatedVulnerabilities":[{"id":"CVE-2026-97032","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-97032","namespace":"nvd:cpe","severity":"High","urls":["https://go.dev/cl/847188","https://go.dev/cl/847313","https://go.dev/issue/81867","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs","https://pkg.go.dev/vuln/GO-2026-6617"],"description":"HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the other modifies the encoder's table size when handling a SETTINGS frame containing SETTINGS_HEADER_TABLE_SIZE that a client sends. A malicious client can repeatedly send a request while changing the header table size to crash the server.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-97032","epss":0.0049,"percentile":0.42162,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-97032","cwe":"CWE-362","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"golang.org/x/net","version":"v0.37.0"}},"found":{"vulnerabilityID":"GO-2026-6617","versionConstraint":"<0.60.0 (go)"},"fix":{"suggestedVersion":"0.60.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/net@v0.37.0?package-id=9bde281540d3ec9d","name":"golang.org/x/net","version":"v0.37.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:networking:v0.37.0:*:*:*:*:go:*:*","cpe:2.3:a:golang:net:v0.37.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/net@v0.37.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:1zLorHbz+LYj7MQlSf1+2tPIIgibq2eL5xkrGk6f+2c="}}},{"vulnerability":{"id":"GO-2026-5970","dataSource":"https://go.dev/issue/80142","namespace":"govulndb:language:go","severity":"High","urls":["https://go.dev/cl/794100"],"description":"A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-56852","epss":0.00475,"percentile":0.41065,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-56852","cwe":"CWE-835","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["0.39.0"],"state":"fixed","available":[{"version":"0.39.0","date":"2026-06-30","kind":"release"}]},"advisories":[],"risk":0.35624999999999996},"relatedVulnerabilities":[{"id":"CVE-2026-56852","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56852","namespace":"nvd:cpe","severity":"High","urls":["https://go.dev/cl/794100","https://go.dev/issue/80142","https://pkg.go.dev/vuln/GO-2026-5970"],"description":"A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-56852","epss":0.00475,"percentile":0.41065,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-56852","cwe":"CWE-835","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"golang.org/x/text","version":"v0.23.0"}},"found":{"vulnerabilityID":"GO-2026-5970","versionConstraint":"<0.39.0 (go)"},"fix":{"suggestedVersion":"0.39.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/text@v0.23.0?package-id=51a8f1ff021f26a0","name":"golang.org/x/text","version":"v0.23.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:text:v0.23.0:*:*:*:*:*:*:*"],"purl":"pkg:golang/golang.org/x/text@v0.23.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:D71I7dUrlY+VX0gQShAThNGHFxZ13dGLBHQLVl1mJlY="}}},{"vulnerability":{"id":"GO-2026-6629","dataSource":"https://go.dev/cl/793360","namespace":"govulndb:language:go","severity":"High","urls":["https://go.dev/issue/80112"],"description":"The Nickname profile can panic with an out-of-bounds slice error when transforming crafted input into a short destination buffer.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-56851","epss":0.00466,"percentile":0.40322,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-56851","cwe":"CWE-787","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["0.41.0"],"state":"fixed","available":[{"version":"0.41.0","date":"2026-08-11","kind":"release"}]},"advisories":[],"risk":0.3495},"relatedVulnerabilities":[{"id":"CVE-2026-56851","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56851","namespace":"nvd:cpe","severity":"High","urls":["https://go.dev/cl/793360","https://go.dev/issue/80112","https://pkg.go.dev/vuln/GO-2026-6629"],"description":"The Nickname profile can panic with an out-of-bounds slice error when transforming crafted input into a short destination buffer.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-56851","epss":0.00466,"percentile":0.40322,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-56851","cwe":"CWE-787","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"golang.org/x/text","version":"v0.23.0"}},"found":{"vulnerabilityID":"GO-2026-6629","versionConstraint":"<0.41.0 (go)"},"fix":{"suggestedVersion":"0.41.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/text@v0.23.0?package-id=51a8f1ff021f26a0","name":"golang.org/x/text","version":"v0.23.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:text:v0.23.0:*:*:*:*:*:*:*"],"purl":"pkg:golang/golang.org/x/text@v0.23.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:D71I7dUrlY+VX0gQShAThNGHFxZ13dGLBHQLVl1mJlY="}}},{"vulnerability":{"id":"GO-2026-6610","dataSource":"https://go.dev/cl/835145","namespace":"govulndb:language:go","severity":"High","urls":["https://go.dev/cl/836385","https://go.dev/issue/81115","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI"],"description":"Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a reverse proxy. If the HTTP/1 client also does not behave strictly enough, this can result in response smuggling.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-78660","epss":0.00425,"percentile":0.36847,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-78660","cwe":"CWE-444","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["0.60.0"],"state":"fixed","available":[{"version":"0.60.0","date":"2026-10-08","kind":"release"}]},"advisories":[],"risk":0.31875000000000003},"relatedVulnerabilities":[{"id":"CVE-2026-78660","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78660","namespace":"nvd:cpe","severity":"High","urls":["https://go.dev/cl/835145","https://go.dev/cl/836385","https://go.dev/issue/81115","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://pkg.go.dev/vuln/GO-2026-6610"],"description":"Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a reverse proxy. If the HTTP/1 client also does not behave strictly enough, this can result in response smuggling.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-78660","epss":0.00425,"percentile":0.36847,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-78660","cwe":"CWE-444","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"golang.org/x/net","version":"v0.37.0"}},"found":{"vulnerabilityID":"GO-2026-6610","versionConstraint":"<0.60.0 (go)"},"fix":{"suggestedVersion":"0.60.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/net@v0.37.0?package-id=9bde281540d3ec9d","name":"golang.org/x/net","version":"v0.37.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:networking:v0.37.0:*:*:*:*:go:*:*","cpe:2.3:a:golang:net:v0.37.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/net@v0.37.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:1zLorHbz+LYj7MQlSf1+2tPIIgibq2eL5xkrGk6f+2c="}}},{"vulnerability":{"id":"GO-2026-4440","dataSource":"https://go.dev/cl/709876","namespace":"govulndb:language:go","severity":"Medium","urls":["https://github.com/golang/vulndb/issues/4440","https://groups.google.com/g/golang-announce/c/jnQcOYpiR2c"],"description":"The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when processing certain inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-47911","epss":0.0057,"percentile":0.47166,"date":"2026-10-31"}],"fix":{"versions":["0.45.0"],"state":"fixed","available":[{"version":"0.45.0","date":"2025-10-07","kind":"release"}]},"advisories":[],"risk":0.29355000000000003},"relatedVulnerabilities":[{"id":"CVE-2025-47911","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-47911","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/golang/vulndb/issues/4440","https://go.dev/cl/709876","https://groups.google.com/g/golang-announce/c/jnQcOYpiR2c","https://pkg.go.dev/vuln/GO-2026-4440"],"description":"The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when processing certain inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-47911","epss":0.0057,"percentile":0.47166,"date":"2026-10-31"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"golang.org/x/net","version":"v0.37.0"}},"found":{"vulnerabilityID":"GO-2026-4440","versionConstraint":"<0.45.0 (go)"},"fix":{"suggestedVersion":"0.45.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/net@v0.37.0?package-id=9bde281540d3ec9d","name":"golang.org/x/net","version":"v0.37.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:networking:v0.37.0:*:*:*:*:go:*:*","cpe:2.3:a:golang:net:v0.37.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/net@v0.37.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:1zLorHbz+LYj7MQlSf1+2tPIIgibq2eL5xkrGk6f+2c="}}},{"vulnerability":{"id":"GO-2026-4441","dataSource":"https://groups.google.com/g/golang-announce/c/jnQcOYpiR2c","namespace":"govulndb:language:go","severity":"Medium","urls":["https://github.com/golang/vulndb/issues/4441","https://go.dev/cl/709875"],"description":"The html.Parse function in golang.org/x/net/html has an infinite parsing loop when processing certain inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-58190","epss":0.00548,"percentile":0.45901,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-58190","cwe":"CWE-835","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["0.45.0"],"state":"fixed","available":[{"version":"0.45.0","date":"2025-10-07","kind":"release"}]},"advisories":[],"risk":0.28221999999999997},"relatedVulnerabilities":[{"id":"CVE-2025-58190","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-58190","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/golang/vulndb/issues/4441","https://go.dev/cl/709875","https://groups.google.com/g/golang-announce/c/jnQcOYpiR2c","https://pkg.go.dev/vuln/GO-2026-4441"],"description":"The html.Parse function in golang.org/x/net/html has an infinite parsing loop when processing certain inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-58190","epss":0.00548,"percentile":0.45901,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-58190","cwe":"CWE-835","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"golang.org/x/net","version":"v0.37.0"}},"found":{"vulnerabilityID":"GO-2026-4441","versionConstraint":"<0.45.0 (go)"},"fix":{"suggestedVersion":"0.45.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/net@v0.37.0?package-id=9bde281540d3ec9d","name":"golang.org/x/net","version":"v0.37.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:networking:v0.37.0:*:*:*:*:go:*:*","cpe:2.3:a:golang:net:v0.37.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/net@v0.37.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:1zLorHbz+LYj7MQlSf1+2tPIIgibq2eL5xkrGk6f+2c="}}},{"vulnerability":{"id":"GHSA-vvgc-356p-c3xw","dataSource":"https://github.com/advisories/GHSA-vvgc-356p-c3xw","namespace":"github:language:go","severity":"Medium","urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-22872","https://go.dev/cl/662715","https://go.dev/issue/73070","https://groups.google.com/g/golang-announce/c/ezSKR9vqbqA","https://pkg.go.dev/vuln/GO-2025-3595","https://security.netapp.com/advisory/ntap-20250516-0007"],"description":"golang.org/x/net vulnerable to Cross-site Scripting","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","metrics":{"baseScore":5.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-22872","epss":0.00545,"percentile":0.45716,"date":"2026-10-31"}],"fix":{"versions":["0.38.0"],"state":"fixed","available":[{"version":"0.38.0","date":"2025-04-17","kind":"first-observed"}]},"advisories":[],"risk":0.280675},"relatedVulnerabilities":[{"id":"CVE-2025-22872","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-22872","namespace":"nvd:cpe","severity":"Medium","urls":["https://go.dev/cl/662715","https://go.dev/issue/73070","https://groups.google.com/g/golang-announce/c/ezSKR9vqbqA","https://pkg.go.dev/vuln/GO-2025-3595","https://security.netapp.com/advisory/ntap-20250516-0007/"],"description":"The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character (/) as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result in content following such tags as being placed in the wrong scope during DOM construction, but only when tags are in foreign content (e.g. <math>, <svg>, etc contexts).","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L","metrics":{"baseScore":6.5,"exploitabilityScore":2.3,"impactScore":3.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-22872","epss":0.00545,"percentile":0.45716,"date":"2026-10-31"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"golang.org/x/net","version":"v0.37.0"}},"found":{"vulnerabilityID":"GHSA-vvgc-356p-c3xw","versionConstraint":"<0.38.0 (go)"},"fix":{"suggestedVersion":"0.38.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/net@v0.37.0?package-id=9bde281540d3ec9d","name":"golang.org/x/net","version":"v0.37.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:networking:v0.37.0:*:*:*:*:go:*:*","cpe:2.3:a:golang:net:v0.37.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/net@v0.37.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:1zLorHbz+LYj7MQlSf1+2tPIIgibq2eL5xkrGk6f+2c="}}},{"vulnerability":{"id":"GHSA-pxq6-2prw-chj9","dataSource":"https://github.com/advisories/GHSA-pxq6-2prw-chj9","namespace":"github:language:go","severity":"Medium","urls":["https://github.com/moby/moby/security/advisories/GHSA-pxq6-2prw-chj9","https://github.com/moby/moby/commit/f4d6f25bf0c3fa12d4968320a45685947756a22a","https://docs.docker.com/engine/extend/legacy_plugins","https://github.com/moby/moby/releases/tag/docker-v29.3.1","https://nvd.nist.gov/vuln/detail/CVE-2026-33997"],"description":"Moby has an Off-by-one error in its plugin privilege validation","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":6.8,"exploitabilityScore":1.7,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-33997","epss":0.00402,"percentile":0.34439,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-33997","cwe":"CWE-193","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-33997","cwe":"CWE-266","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.23717999999999997},"relatedVulnerabilities":[{"id":"CVE-2026-33997","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33997","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/moby/moby/releases/tag/docker-v29.3.1","https://github.com/moby/moby/security/advisories/GHSA-pxq6-2prw-chj9","https://access.redhat.com/errata/RHSA-2026:21769","https://access.redhat.com/errata/RHSA-2026:22347","https://access.redhat.com/errata/RHSA-2026:23345","https://access.redhat.com/security/cve/CVE-2026-33997","https://bugzilla.redhat.com/show_bug.cgi?id=2453277","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33997.json"],"description":"Moby is an open source container framework. Prior to version 29.3.1, a security vulnerability has been detected that allows plugins privilege validation to be bypassed during docker plugin install. Due to an error in the daemon's privilege comparison logic, the daemon may incorrectly accept a privilege set that differs from the one approved by the user. Plugins that request exactly one privilege are also affected, because no comparison is performed at all. This issue has been patched in version 29.3.1.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":8.1,"exploitabilityScore":2.9,"impactScore":5.2},"vendorMetadata":{}},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.4,"exploitabilityScore":1.7,"impactScore":6.1},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":6.8,"exploitabilityScore":1.7,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-33997","epss":0.00402,"percentile":0.34439,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-33997","cwe":"CWE-193","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-33997","cwe":"CWE-266","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"github.com/docker/docker","version":"v28.0.4+incompatible"}},"found":{"vulnerabilityID":"GHSA-pxq6-2prw-chj9","versionConstraint":"<29.3.1 (go)"}}],"artifact":{"id":"pkg:golang/github.com/docker/docker@v28.0.4%2Bincompatible?package-id=39ab24a3ac08acd0","name":"github.com/docker/docker","version":"v28.0.4+incompatible","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:docker:docker:v28.0.4\\+incompatible:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/docker/docker@v28.0.4%2Bincompatible","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:JNNkBctYKurkw6FrHfKqY0nKIDf5nrbxjVBtS+cdcok="}}},{"vulnerability":{"id":"GHSA-2464-8j7c-4cjm","dataSource":"https://github.com/advisories/GHSA-2464-8j7c-4cjm","namespace":"github:language:go","severity":"Medium","urls":["https://github.com/go-viper/mapstructure/security/advisories/GHSA-2464-8j7c-4cjm","https://github.com/go-viper/mapstructure/commit/742921c9ba2854d27baa64272487fc5075d2c39c","https://pkg.go.dev/vuln/GO-2025-3900","https://nvd.nist.gov/vuln/detail/CVE-2025-11065","https://access.redhat.com/security/cve/CVE-2025-11065","https://bugzilla.redhat.com/show_bug.cgi?id=2391829"],"description":"go-viper's mapstructure May Leak Sensitive Information in Logs When Processing Malformed Data","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":1.7,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-11065","epss":0.00434,"percentile":0.37712,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-11065","cwe":"CWE-209","source":"secalert@redhat.com","type":"Secondary"}],"fix":{"versions":["2.4.0"],"state":"fixed","available":[{"version":"2.4.0","date":"2025-08-22","kind":"first-observed"}]},"advisories":[],"risk":0.22351000000000004},"relatedVulnerabilities":[{"id":"CVE-2025-11065","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-11065","namespace":"nvd:cpe","severity":"Medium","urls":["https://access.redhat.com/security/cve/CVE-2025-11065","https://bugzilla.redhat.com/show_bug.cgi?id=2391829","https://github.com/go-viper/mapstructure/commit/742921c9ba2854d27baa64272487fc5075d2c39c","https://github.com/go-viper/mapstructure/security/advisories/GHSA-2464-8j7c-4cjm"],"description":"A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.WeakDecode. This vulnerability allows information disclosure through detailed error messages that may leak sensitive input values via malformed user-supplied data processed in security-critical contexts.","cvss":[{"source":"secalert@redhat.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":1.7,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-11065","epss":0.00434,"percentile":0.37712,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2025-11065","cwe":"CWE-209","source":"secalert@redhat.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"github.com/go-viper/mapstructure/v2","version":"v2.2.1"}},"found":{"vulnerabilityID":"GHSA-2464-8j7c-4cjm","versionConstraint":"<=2.3.0 (go)"},"fix":{"suggestedVersion":"2.4.0"}}],"artifact":{"id":"pkg:golang/github.com/go-viper/mapstructure/v2@v2.2.1?package-id=69f60ff33bdb7011","name":"github.com/go-viper/mapstructure/v2","version":"v2.2.1","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:go-viper:mapstructure\\/v2:v2.2.1:*:*:*:*:*:*:*","cpe:2.3:a:go_viper:mapstructure\\/v2:v2.2.1:*:*:*:*:*:*:*","cpe:2.3:a:go:mapstructure\\/v2:v2.2.1:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/go-viper/mapstructure/v2@v2.2.1","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:ZAaOCxANMuZx5RCeg0mBdEZk7DZasvvZIxtHqx8aGss="}}},{"vulnerability":{"id":"GHSA-5cv4-jp36-h3mw","dataSource":"https://github.com/advisories/GHSA-5cv4-jp36-h3mw","namespace":"github:language:go","severity":"Medium","urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-25680","https://go.dev/cl/781702","https://go.dev/issue/79573","https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8","https://pkg.go.dev/vuln/GO-2026-5028","https://go.googlesource.com/net/+/08be507abce89191d78cd49da60f4501fc910472","https://go.googlesource.com/net/+/refs/tags/v0.55.0"],"description":"Go Net HTML parser is vulnerable to denial of service","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"exploitabilityScore":2.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-25680","epss":0.00326,"percentile":0.25769,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-25680","cwe":"CWE-400","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["0.55.0"],"state":"fixed","available":[{"version":"0.55.0","date":"2026-07-02","kind":"first-observed"}]},"advisories":[],"risk":0.18744999999999998},"relatedVulnerabilities":[{"id":"CVE-2026-25680","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25680","namespace":"nvd:cpe","severity":"Medium","urls":["https://go.dev/cl/781702","https://go.dev/issue/79573","https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8","https://pkg.go.dev/vuln/GO-2026-5028"],"description":"Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"exploitabilityScore":2.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-25680","epss":0.00326,"percentile":0.25769,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-25680","cwe":"CWE-400","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"golang.org/x/net","version":"v0.37.0"}},"found":{"vulnerabilityID":"GHSA-5cv4-jp36-h3mw","versionConstraint":"<0.55.0 (go)"},"fix":{"suggestedVersion":"0.55.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/net@v0.37.0?package-id=9bde281540d3ec9d","name":"golang.org/x/net","version":"v0.37.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:networking:v0.37.0:*:*:*:*:go:*:*","cpe:2.3:a:golang:net:v0.37.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/net@v0.37.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:1zLorHbz+LYj7MQlSf1+2tPIIgibq2eL5xkrGk6f+2c="}}},{"vulnerability":{"id":"GHSA-hfvc-g4fc-pqhx","dataSource":"https://github.com/advisories/GHSA-hfvc-g4fc-pqhx","namespace":"github:language:go","severity":"High","urls":["https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-hfvc-g4fc-pqhx","http://github.com/open-telemetry/opentelemetry-go/releases/tag/v1.43.0","https://nvd.nist.gov/vuln/detail/CVE-2026-39883"],"description":"opentelemetry-go: BSD kenv command not using absolute path enables PATH hijacking","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":7.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-39883","epss":0.00252,"percentile":0.16787,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-39883","cwe":"CWE-426","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-39883","cwe":"CWE-426","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["1.43.0"],"state":"fixed","available":[{"version":"1.43.0","date":"2026-04-09","kind":"first-observed"}]},"advisories":[],"risk":0.18648},"relatedVulnerabilities":[{"id":"CVE-2026-39883","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-39883","namespace":"nvd:cpe","severity":"High","urls":["http://github.com/open-telemetry/opentelemetry-go/releases/tag/v1.43.0","https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-hfvc-g4fc-pqhx","https://access.redhat.com/errata/RHSA-2026:26254","https://access.redhat.com/errata/RHSA-2026:26257","https://access.redhat.com/errata/RHSA-2026:37387","https://access.redhat.com/errata/RHSA-2026:54274","https://access.redhat.com/errata/RHSA-2026:54286","https://access.redhat.com/errata/RHSA-2026:63140","https://access.redhat.com/security/cve/CVE-2026-39883","https://bugzilla.redhat.com/show_bug.cgi?id=2456718","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39883.json"],"description":"OpenTelemetry-Go is the Go implementation of OpenTelemetry. From 1.15.0 to 1.42.0, the fix for CVE-2026-24051 changed the Darwin ioreg command to use an absolute path but left the BSD kenv command using a bare name, allowing the same PATH hijacking attack on BSD and Solaris platforms. This vulnerability is fixed in 1.43.0.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"exploitabilityScore":1.1,"impactScore":5.9},"vendorMetadata":{}},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.8,"exploitabilityScore":2.1,"impactScore":6.1},"vendorMetadata":{}},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"exploitabilityScore":1.1,"impactScore":5.9},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-39883","epss":0.00252,"percentile":0.16787,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-39883","cwe":"CWE-426","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-39883","cwe":"CWE-426","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"go.opentelemetry.io/otel/sdk","version":"v1.31.0"}},"found":{"vulnerabilityID":"GHSA-hfvc-g4fc-pqhx","versionConstraint":">=1.15.0,<=1.42.0 (go)"},"fix":{"suggestedVersion":"1.43.0"}}],"artifact":{"id":"pkg:golang/go.opentelemetry.io/otel/sdk@v1.31.0?package-id=dd7492963088c09c","name":"go.opentelemetry.io/otel/sdk","version":"v1.31.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:otel:sdk:v1.31.0:*:*:*:*:*:*:*"],"purl":"pkg:golang/go.opentelemetry.io/otel/sdk@v1.31.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:xLY3abVHYZ5HSfOg3l2E5LUj2Cwva5Y7yGxnSW9H5Gk="}}},{"vulnerability":{"id":"GO-2026-5025","dataSource":"https://go.dev/issue/79571","namespace":"govulndb:language:go","severity":"Medium","urls":["https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8","https://go.dev/cl/781700"],"description":"Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":2.9,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-42506","epss":0.00235,"percentile":0.1457,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-42506","cwe":"CWE-79","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["0.55.0"],"state":"fixed","available":[{"version":"0.55.0","date":"2026-05-22","kind":"release"}]},"advisories":[],"risk":0.13042499999999999},"relatedVulnerabilities":[{"id":"CVE-2026-42506","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42506","namespace":"nvd:cpe","severity":"Medium","urls":["https://go.dev/cl/781700","https://go.dev/issue/79571","https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8","https://pkg.go.dev/vuln/GO-2026-5025"],"description":"Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":2.9,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-42506","epss":0.00235,"percentile":0.1457,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-42506","cwe":"CWE-79","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"golang.org/x/net","version":"v0.37.0"}},"found":{"vulnerabilityID":"GO-2026-5025","versionConstraint":"<0.55.0 (go)"},"fix":{"suggestedVersion":"0.55.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/net@v0.37.0?package-id=9bde281540d3ec9d","name":"golang.org/x/net","version":"v0.37.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:networking:v0.37.0:*:*:*:*:go:*:*","cpe:2.3:a:golang:net:v0.37.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/net@v0.37.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:1zLorHbz+LYj7MQlSf1+2tPIIgibq2eL5xkrGk6f+2c="}}},{"vulnerability":{"id":"GHSA-9h8m-3fm2-qjrq","dataSource":"https://github.com/advisories/GHSA-9h8m-3fm2-qjrq","namespace":"github:language:go","severity":"High","urls":["https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-9h8m-3fm2-qjrq","https://github.com/open-telemetry/opentelemetry-go/commit/d45961bcda453fcbdb6469c22d6e88a1f9970a53","https://nvd.nist.gov/vuln/detail/CVE-2026-24051","https://pkg.go.dev/vuln/GO-2026-4394"],"description":"OpenTelemetry Go SDK Vulnerable to Arbitrary Code Execution via PATH Hijacking","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"exploitabilityScore":1.1,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-24051","epss":0.00176,"percentile":0.07106,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-24051","cwe":"CWE-426","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.40.0"],"state":"fixed","available":[{"version":"1.40.0","date":"2026-02-28","kind":"first-observed"}]},"advisories":[],"risk":0.1276},"relatedVulnerabilities":[{"id":"CVE-2026-24051","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-24051","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/open-telemetry/opentelemetry-go/commit/d45961bcda453fcbdb6469c22d6e88a1f9970a53","https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-9h8m-3fm2-qjrq"],"description":"OpenTelemetry-Go is the Go implementation of OpenTelemetry. The OpenTelemetry Go SDK in version v1.20.0-1.39.0 is vulnerable to Path Hijacking (Untrusted Search Paths) on macOS/Darwin systems. The resource detection code in sdk/resource/host_id.go executes the ioreg system command using a search path. An attacker with the ability to locally modify the PATH environment variable can achieve Arbitrary Code Execution (ACE) within the context of the application. A fix was released with v1.40.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"exploitabilityScore":1.1,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-24051","epss":0.00176,"percentile":0.07106,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-24051","cwe":"CWE-426","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"go.opentelemetry.io/otel/sdk","version":"v1.31.0"}},"found":{"vulnerabilityID":"GHSA-9h8m-3fm2-qjrq","versionConstraint":">=1.21.0,<1.40.0 (go)"},"fix":{"suggestedVersion":"1.40.0"}}],"artifact":{"id":"pkg:golang/go.opentelemetry.io/otel/sdk@v1.31.0?package-id=dd7492963088c09c","name":"go.opentelemetry.io/otel/sdk","version":"v1.31.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:otel:sdk:v1.31.0:*:*:*:*:*:*:*"],"purl":"pkg:golang/go.opentelemetry.io/otel/sdk@v1.31.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:xLY3abVHYZ5HSfOg3l2E5LUj2Cwva5Y7yGxnSW9H5Gk="}}},{"vulnerability":{"id":"GO-2026-5027","dataSource":"https://go.dev/issue/79572","namespace":"govulndb:language:go","severity":"Medium","urls":["https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8","https://go.dev/cl/781701"],"description":"Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":2.9,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-42502","epss":0.00223,"percentile":0.12987,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-42502","cwe":"CWE-1021","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["0.55.0"],"state":"fixed","available":[{"version":"0.55.0","date":"2026-05-22","kind":"release"}]},"advisories":[],"risk":0.12376500000000001},"relatedVulnerabilities":[{"id":"CVE-2026-42502","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42502","namespace":"nvd:cpe","severity":"Medium","urls":["https://go.dev/cl/781701","https://go.dev/issue/79572","https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8","https://pkg.go.dev/vuln/GO-2026-5027"],"description":"Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":2.9,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-42502","epss":0.00223,"percentile":0.12987,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-42502","cwe":"CWE-1021","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"golang.org/x/net","version":"v0.37.0"}},"found":{"vulnerabilityID":"GO-2026-5027","versionConstraint":"<0.55.0 (go)"},"fix":{"suggestedVersion":"0.55.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/net@v0.37.0?package-id=9bde281540d3ec9d","name":"golang.org/x/net","version":"v0.37.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:networking:v0.37.0:*:*:*:*:go:*:*","cpe:2.3:a:golang:net:v0.37.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/net@v0.37.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:1zLorHbz+LYj7MQlSf1+2tPIIgibq2eL5xkrGk6f+2c="}}},{"vulnerability":{"id":"GO-2026-5029","dataSource":"https://go.dev/issue/79574","namespace":"govulndb:language:go","severity":"Medium","urls":["https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8","https://go.dev/cl/781703"],"description":"Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":2.9,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-25681","epss":0.00223,"percentile":0.12986,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-25681","cwe":"CWE-1021","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["0.55.0"],"state":"fixed","available":[{"version":"0.55.0","date":"2026-05-22","kind":"release"}]},"advisories":[],"risk":0.12376500000000001},"relatedVulnerabilities":[{"id":"CVE-2026-25681","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25681","namespace":"nvd:cpe","severity":"Medium","urls":["https://go.dev/cl/781703","https://go.dev/issue/79574","https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8","https://pkg.go.dev/vuln/GO-2026-5029"],"description":"Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":2.9,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-25681","epss":0.00223,"percentile":0.12986,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-25681","cwe":"CWE-1021","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"golang.org/x/net","version":"v0.37.0"}},"found":{"vulnerabilityID":"GO-2026-5029","versionConstraint":"<0.55.0 (go)"},"fix":{"suggestedVersion":"0.55.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/net@v0.37.0?package-id=9bde281540d3ec9d","name":"golang.org/x/net","version":"v0.37.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:networking:v0.37.0:*:*:*:*:go:*:*","cpe:2.3:a:golang:net:v0.37.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/net@v0.37.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:1zLorHbz+LYj7MQlSf1+2tPIIgibq2eL5xkrGk6f+2c="}}},{"vulnerability":{"id":"GO-2026-5030","dataSource":"https://go.dev/issue/79575","namespace":"govulndb:language:go","severity":"Medium","urls":["https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8","https://go.dev/cl/781685"],"description":"Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":2.9,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-27136","epss":0.00223,"percentile":0.12986,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-27136","cwe":"CWE-1021","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["0.55.0"],"state":"fixed","available":[{"version":"0.55.0","date":"2026-05-22","kind":"release"}]},"advisories":[],"risk":0.12376500000000001},"relatedVulnerabilities":[{"id":"CVE-2026-27136","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-27136","namespace":"nvd:cpe","severity":"Medium","urls":["https://go.dev/cl/781685","https://go.dev/issue/79575","https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8","https://pkg.go.dev/vuln/GO-2026-5030"],"description":"Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":2.9,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-27136","epss":0.00223,"percentile":0.12986,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-27136","cwe":"CWE-1021","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"golang.org/x/net","version":"v0.37.0"}},"found":{"vulnerabilityID":"GO-2026-5030","versionConstraint":"<0.55.0 (go)"},"fix":{"suggestedVersion":"0.55.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/net@v0.37.0?package-id=9bde281540d3ec9d","name":"golang.org/x/net","version":"v0.37.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:networking:v0.37.0:*:*:*:*:go:*:*","cpe:2.3:a:golang:net:v0.37.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/net@v0.37.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:1zLorHbz+LYj7MQlSf1+2tPIIgibq2eL5xkrGk6f+2c="}}},{"vulnerability":{"id":"GHSA-x86f-5xw2-fm2r","dataSource":"https://github.com/advisories/GHSA-x86f-5xw2-fm2r","namespace":"github:language:go","severity":"High","urls":["https://github.com/moby/moby/security/advisories/GHSA-x86f-5xw2-fm2r","https://nvd.nist.gov/vuln/detail/CVE-2026-41567"],"description":"Docker: `PUT /containers/{id}/archive` executes container binary on the host","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N","metrics":{"baseScore":7.2,"exploitabilityScore":0.9,"impactScore":5.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-41567","epss":0.00155,"percentile":0.04597,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-41567","cwe":"CWE-427","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-41567","cwe":"CWE-427","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.11392499999999998},"relatedVulnerabilities":[{"id":"CVE-2026-41567","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-41567","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/moby/moby/security/advisories/GHSA-x86f-5xw2-fm2r","https://access.redhat.com/errata/RHSA-2026:37387","https://access.redhat.com/errata/RHSA-2026:41030","https://access.redhat.com/errata/RHSA-2026:42852","https://access.redhat.com/errata/RHSA-2026:44622","https://access.redhat.com/errata/RHSA-2026:51057","https://access.redhat.com/security/cve/CVE-2026-41567","https://bugzilla.redhat.com/show_bug.cgi?id=2485356","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41567.json"],"description":"Moby is an open source container framework. In versions prior to 29.5.1 and in moby/moby v2 prior to v2.0.0-beta.14, when a compressed archive is uploaded to a container via `PUT /containers/{id}/archive` or piped through `docker cp -`, the daemon resolves decompression binaries (such as `xz` or `unpigz`) from the container's filesystem rather than the host's due to incorrect ordering of operations. A malicious container image containing a trojanized decompression binary can achieve arbitrary code execution with full daemon privileges, including host root UID and unrestricted capabilities, when a user uploads a compressed (xz or gzip) archive into that container. This issue is fixed in Docker Engine 29.5.1 and moby/moby v2.0.0-beta.14. Workarounds include only running containers from trusted images, using authorization plugins to restrict access to the `PUT /containers/{id}/archive` endpoint, and avoiding piping compressed archives into containers created from untrusted images","cvss":[{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":0.9,"impactScore":6.1},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N","metrics":{"baseScore":7.2,"exploitabilityScore":0.9,"impactScore":5.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-41567","epss":0.00155,"percentile":0.04597,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-41567","cwe":"CWE-427","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-41567","cwe":"CWE-427","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"github.com/docker/docker","version":"v28.0.4+incompatible"}},"found":{"vulnerabilityID":"GHSA-x86f-5xw2-fm2r","versionConstraint":"<=28.5.2 (go)"}}],"artifact":{"id":"pkg:golang/github.com/docker/docker@v28.0.4%2Bincompatible?package-id=39ab24a3ac08acd0","name":"github.com/docker/docker","version":"v28.0.4+incompatible","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:docker:docker:v28.0.4\\+incompatible:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/docker/docker@v28.0.4%2Bincompatible","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:JNNkBctYKurkw6FrHfKqY0nKIDf5nrbxjVBtS+cdcok="}}},{"vulnerability":{"id":"GO-2026-6866","dataSource":"https://go.dev/cl/855121","namespace":"govulndb:language:go","severity":"Unknown","urls":["https://go.dev/issue/82622","https://groups.google.com/g/golang-announce/c/sqrs2vTx_Xs"],"description":"In childTextNodesAreLiteral, walking up the tree previously stopped at the nearest foreign ancestor once an HTML integration point was found. However, that integration point may itself be a descendant of an element that was foster-parented into a foreign namespace (such as <mglyph> or <malignmark> fostered under <mtext>), causing a parser to resolve the subtree in a different foreign namespace upon re-parsing the rendered output.\n\nContinue walking the full ancestor chain and verify that every transition from a non-empty namespace occurs at an HTML integration point before emitting literal text.","cvss":[],"epss":[{"cve":"CVE-2026-97045","epss":0.00202,"percentile":0.10121,"date":"2026-10-31"}],"fix":{"versions":["0.62.0"],"state":"fixed","available":[{"version":"0.62.0","date":"2026-10-27","kind":"release"}]},"advisories":[],"risk":0.101},"relatedVulnerabilities":[{"id":"CVE-2026-97045","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-97045","namespace":"nvd:cpe","severity":"Unknown","urls":["https://go.dev/cl/855121","https://go.dev/issue/82622","https://groups.google.com/g/golang-announce/c/sqrs2vTx_Xs","https://pkg.go.dev/vuln/GO-2026-6866"],"description":"In childTextNodesAreLiteral, walking up the tree previously stopped at the nearest foreign ancestor once an HTML integration point was found. However, that integration point may itself be a descendant of an element that was foster-parented into a foreign namespace (such as <mglyph> or <malignmark> fostered under <mtext>), causing a parser to resolve the subtree in a different foreign namespace upon re-parsing the rendered output. Continue walking the full ancestor chain and verify that every transition from a non-empty namespace occurs at an HTML integration point before emitting literal text.","cvss":[],"epss":[{"cve":"CVE-2026-97045","epss":0.00202,"percentile":0.10121,"date":"2026-10-31"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"golang.org/x/net","version":"v0.37.0"}},"found":{"vulnerabilityID":"GO-2026-6866","versionConstraint":"<0.62.0 (go)"},"fix":{"suggestedVersion":"0.62.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/net@v0.37.0?package-id=9bde281540d3ec9d","name":"golang.org/x/net","version":"v0.37.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:networking:v0.37.0:*:*:*:*:go:*:*","cpe:2.3:a:golang:net:v0.37.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/net@v0.37.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:1zLorHbz+LYj7MQlSf1+2tPIIgibq2eL5xkrGk6f+2c="}}},{"vulnerability":{"id":"GHSA-w8rr-5gcm-pp58","dataSource":"https://github.com/advisories/GHSA-w8rr-5gcm-pp58","namespace":"github:language:go","severity":"Medium","urls":["https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-w8rr-5gcm-pp58","http://github.com/open-telemetry/opentelemetry-go/releases/tag/v1.43.0","https://nvd.nist.gov/vuln/detail/CVE-2026-39882","https://github.com/open-telemetry/opentelemetry-go/pull/8108"],"description":"opentelemetry-go: OTLP HTTP exporters read unbounded HTTP response bodies","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.3,"exploitabilityScore":1.7,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-39882","epss":0.0019,"percentile":0.08707,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-39882","cwe":"CWE-789","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.43.0"],"state":"fixed","available":[{"version":"1.43.0","date":"2026-04-09","kind":"first-observed"}]},"advisories":[],"risk":0.09784999999999999},"relatedVulnerabilities":[{"id":"CVE-2026-39882","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-39882","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/open-telemetry/opentelemetry-go/pull/8108","https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-w8rr-5gcm-pp58"],"description":"OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to 1.43.0, the otlp HTTP exporters (traces/metrics/logs) read the full HTTP response body into an in-memory bytes.Buffer without a size cap. This is exploitable for memory exhaustion when the configured collector endpoint is attacker-controlled (or a network attacker can mitm the exporter connection). This vulnerability is fixed in 1.43.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.3,"exploitabilityScore":1.7,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-39882","epss":0.0019,"percentile":0.08707,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-39882","cwe":"CWE-789","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp","version":"v1.31.0"}},"found":{"vulnerabilityID":"GHSA-w8rr-5gcm-pp58","versionConstraint":"<1.43.0 (go)"},"fix":{"suggestedVersion":"1.43.0"}}],"artifact":{"id":"pkg:golang/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.31.0?package-id=49d5543722c1efeb","name":"go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp","version":"v1.31.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:otel:exporters\\/otlp\\/otlptrace\\/otlptracehttp:v1.31.0:*:*:*:*:*:*:*"],"purl":"pkg:golang/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.31.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:lUsI2TYsQw2r1IASwoROaCnjdj2cvC2+Jbxvk6nHnWU="}}},{"vulnerability":{"id":"GO-2026-6860","dataSource":"https://go.dev/cl/849365","namespace":"govulndb:language:go","severity":"Unknown","urls":["https://go.dev/issue/82224","https://groups.google.com/g/golang-announce/c/sqrs2vTx_Xs"],"description":"When coalescing adjacent text nodes in addText and fosterParent, appending to an existing TextNode's Data via string concatenation (n.Data += text) reallocated and copied the accumulated string on every token. Inputs containing many short text runs separated by ignored end tags (such as \"a</x>\") caused O(n^2) allocations and byte copies.\n\nAccumulate coalesced text in per-node byte slices during parsing and materialize Data strings once at the end of parse.","cvss":[],"epss":[{"cve":"CVE-2026-78661","epss":0.00185,"percentile":0.08066,"date":"2026-10-31"}],"fix":{"versions":["0.62.0"],"state":"fixed","available":[{"version":"0.62.0","date":"2026-10-27","kind":"release"}]},"advisories":[],"risk":0.0925},"relatedVulnerabilities":[{"id":"CVE-2026-78661","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78661","namespace":"nvd:cpe","severity":"Unknown","urls":["https://go.dev/cl/849365","https://go.dev/issue/82224","https://groups.google.com/g/golang-announce/c/sqrs2vTx_Xs","https://pkg.go.dev/vuln/GO-2026-6860"],"description":"When coalescing adjacent text nodes in addText and fosterParent, appending to an existing TextNode's Data via string concatenation (n.Data += text) reallocated and copied the accumulated string on every token. Inputs containing many short text runs separated by ignored end tags (such as \"a</x>\") caused O(n^2) allocations and byte copies. Accumulate coalesced text in per-node byte slices during parsing and materialize Data strings once at the end of parse.","cvss":[],"epss":[{"cve":"CVE-2026-78661","epss":0.00185,"percentile":0.08066,"date":"2026-10-31"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"golang.org/x/net","version":"v0.37.0"}},"found":{"vulnerabilityID":"GO-2026-6860","versionConstraint":"<0.62.0 (go)"},"fix":{"suggestedVersion":"0.62.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/net@v0.37.0?package-id=9bde281540d3ec9d","name":"golang.org/x/net","version":"v0.37.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:networking:v0.37.0:*:*:*:*:go:*:*","cpe:2.3:a:golang:net:v0.37.0:*:*:*:*:go:*:*"],"purl":"pkg:golang/golang.org/x/net@v0.37.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:1zLorHbz+LYj7MQlSf1+2tPIIgibq2eL5xkrGk6f+2c="}}},{"vulnerability":{"id":"GHSA-p9f8-wvj8-2fg8","dataSource":"https://github.com/advisories/GHSA-p9f8-wvj8-2fg8","namespace":"github:language:go","severity":"Medium","urls":["https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-p9f8-wvj8-2fg8","https://nvd.nist.gov/vuln/detail/CVE-2026-81869","https://github.com/open-telemetry/opentelemetry-go/issues/5996","https://github.com/open-telemetry/opentelemetry-go/pull/5997","https://github.com/open-telemetry/opentelemetry-go/commit/e016a78c9f5b24a1c2beeaad47686c2f2213f49a","https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/v1.33.0"],"description":"OpenTelemetry-Go: UTF-8 replacement rune bypasses attribute length truncation","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":5.1},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-81869","epss":0.0018,"percentile":0.07564,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-81869","cwe":"CWE-176","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-81869","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.33.0"],"state":"fixed","available":[{"version":"1.33.0","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.0909},"relatedVulnerabilities":[{"id":"CVE-2026-81869","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-81869","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/open-telemetry/opentelemetry-go/commit/e016a78c9f5b24a1c2beeaad47686c2f2213f49a","https://github.com/open-telemetry/opentelemetry-go/issues/5996","https://github.com/open-telemetry/opentelemetry-go/pull/5997","https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/v1.33.0","https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-p9f8-wvj8-2fg8"],"description":"OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 1.10.0 until 1.33.0, the sdk/trace/span.go attribute truncation path can fail to enforce AttributeValueLengthLimit for string and string-slice attributes containing the valid Unicode replacement character U+FFFD. safeTruncateValidUTF8 treats the valid replacement rune as invalid UTF-8 and returns the original input, while strings.ToValidUTF8 leaves that valid rune unchanged, so a second safeTruncate attempt can also return the oversized value. An attacker who controls span attribute content can retain values longer than the configured limit, increasing per-span memory use and weakening denial-of-service protection in the instrumented process. This issue is fixed in version 1.33.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.1},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-81869","epss":0.0018,"percentile":0.07564,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-81869","cwe":"CWE-176","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-81869","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"go.opentelemetry.io/otel/sdk","version":"v1.31.0"}},"found":{"vulnerabilityID":"GHSA-p9f8-wvj8-2fg8","versionConstraint":">=1.10.0,<1.33.0 (go)"},"fix":{"suggestedVersion":"1.33.0"}}],"artifact":{"id":"pkg:golang/go.opentelemetry.io/otel/sdk@v1.31.0?package-id=dd7492963088c09c","name":"go.opentelemetry.io/otel/sdk","version":"v1.31.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:otel:sdk:v1.31.0:*:*:*:*:*:*:*"],"purl":"pkg:golang/go.opentelemetry.io/otel/sdk@v1.31.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:xLY3abVHYZ5HSfOg3l2E5LUj2Cwva5Y7yGxnSW9H5Gk="}}},{"vulnerability":{"id":"GHSA-rg2x-37c3-w2rh","dataSource":"https://github.com/advisories/GHSA-rg2x-37c3-w2rh","namespace":"github:language:go","severity":"High","urls":["https://github.com/moby/moby/security/advisories/GHSA-rg2x-37c3-w2rh","https://nvd.nist.gov/vuln/detail/CVE-2026-42306"],"description":"Docker: Race condition in docker cp allows bind mount redirection to host path","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:N/I:H/A:H","metrics":{"baseScore":7.2,"exploitabilityScore":0.9,"impactScore":5.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-42306","epss":0.00104,"percentile":0.01019,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-42306","cwe":"CWE-61","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-42306","cwe":"CWE-367","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.07644},"relatedVulnerabilities":[{"id":"CVE-2026-42306","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42306","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/moby/moby/security/advisories/GHSA-rg2x-37c3-w2rh"],"description":"Moby is an open source container framework. In Docker Engine prior to version 29.5.1, Docker Daemon versions 28.5.2 and prior, and Moby Daemon prior to version 2.0.0-beta.14, a race condition during docker cp mount setup allows a malicious container to redirect a bind mount target to an arbitrary host path, potentially overwriting host files or causing denial of service. This issue has been patched in Docker Engine version 29.5.1 and Moby Daemon version 2.0.0-beta.14.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:N/I:H/A:H","metrics":{"baseScore":7.2,"exploitabilityScore":0.9,"impactScore":5.8},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:N/I:H/A:H","metrics":{"baseScore":7.2,"exploitabilityScore":0.9,"impactScore":5.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-42306","epss":0.00104,"percentile":0.01019,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-42306","cwe":"CWE-61","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-42306","cwe":"CWE-367","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"github.com/docker/docker","version":"v28.0.4+incompatible"}},"found":{"vulnerabilityID":"GHSA-rg2x-37c3-w2rh","versionConstraint":"<=28.5.2 (go)"}}],"artifact":{"id":"pkg:golang/github.com/docker/docker@v28.0.4%2Bincompatible?package-id=39ab24a3ac08acd0","name":"github.com/docker/docker","version":"v28.0.4+incompatible","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:docker:docker:v28.0.4\\+incompatible:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/docker/docker@v28.0.4%2Bincompatible","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:JNNkBctYKurkw6FrHfKqY0nKIDf5nrbxjVBtS+cdcok="}}},{"vulnerability":{"id":"GHSA-8wmf-6v46-5gfg","dataSource":"https://github.com/advisories/GHSA-8wmf-6v46-5gfg","namespace":"github:language:go","severity":"Low","urls":["https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-8wmf-6v46-5gfg","https://nvd.nist.gov/vuln/detail/CVE-2026-81870","https://github.com/open-telemetry/opentelemetry-go/pull/8438","https://github.com/open-telemetry/opentelemetry-go/commit/3a1412d2b3bc4e4231fbeac2ed42117ae541bb38","https://github.com/open-telemetry/opentelemetry-go/releases/tag/exporters/zipkin/v1.45.0","https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/v1.45.0"],"description":"OpenTelemetry-Go: Exporter config logging may leak endpoint URLs in info logs","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-81870","epss":0.00266,"percentile":0.1856,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-81870","cwe":"CWE-200","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-81870","cwe":"CWE-532","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.45.0"],"state":"fixed","available":[{"version":"1.45.0","date":"2026-09-18","kind":"first-observed"}]},"advisories":[],"risk":0.0665},"relatedVulnerabilities":[{"id":"CVE-2026-81870","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-81870","namespace":"nvd:cpe","severity":"Low","urls":["https://github.com/open-telemetry/opentelemetry-go/commit/3a1412d2b3bc4e4231fbeac2ed42117ae541bb38","https://github.com/open-telemetry/opentelemetry-go/pull/8438","https://github.com/open-telemetry/opentelemetry-go/releases/tag/exporters/zipkin/v1.45.0","https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/v1.45.0","https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-8wmf-6v46-5gfg"],"description":"OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 1.5.0 to 1.44.0, sdk/trace.NewTracerProvider emits a TracerProvider created internal Info-level diagnostic event whose MarshalLog implementations recursively include span processor, exporter, and client configuration. Applications that call otel.SetLogger to enable OpenTelemetry internal Info logging can therefore record OTLP gRPC and HTTP collector endpoints, the OTLP HTTP Insecure flag, and complete Zipkin collector URLs. A person or system with access to those logs can learn internal collector topology and can recover credentials or tokens embedded in Zipkin URL user information or query strings. The default OpenTelemetry logger does not emit the event, and this path does not log OTLP authentication headers, TLS key material, or span payloads. This issue is fixed in version 1.45.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-81870","epss":0.00266,"percentile":0.1856,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-81870","cwe":"CWE-200","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-81870","cwe":"CWE-532","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp","version":"v1.31.0"}},"found":{"vulnerabilityID":"GHSA-8wmf-6v46-5gfg","versionConstraint":">=1.5.0,<=1.44.0 (go)"},"fix":{"suggestedVersion":"1.45.0"}}],"artifact":{"id":"pkg:golang/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.31.0?package-id=49d5543722c1efeb","name":"go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp","version":"v1.31.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:otel:exporters\\/otlp\\/otlptrace\\/otlptracehttp:v1.31.0:*:*:*:*:*:*:*"],"purl":"pkg:golang/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.31.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:lUsI2TYsQw2r1IASwoROaCnjdj2cvC2+Jbxvk6nHnWU="}}},{"vulnerability":{"id":"GHSA-8wmf-6v46-5gfg","dataSource":"https://github.com/advisories/GHSA-8wmf-6v46-5gfg","namespace":"github:language:go","severity":"Low","urls":["https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-8wmf-6v46-5gfg","https://nvd.nist.gov/vuln/detail/CVE-2026-81870","https://github.com/open-telemetry/opentelemetry-go/pull/8438","https://github.com/open-telemetry/opentelemetry-go/commit/3a1412d2b3bc4e4231fbeac2ed42117ae541bb38","https://github.com/open-telemetry/opentelemetry-go/releases/tag/exporters/zipkin/v1.45.0","https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/v1.45.0"],"description":"OpenTelemetry-Go: Exporter config logging may leak endpoint URLs in info logs","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-81870","epss":0.00266,"percentile":0.1856,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-81870","cwe":"CWE-200","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-81870","cwe":"CWE-532","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.45.0"],"state":"fixed","available":[{"version":"1.45.0","date":"2026-09-18","kind":"first-observed"}]},"advisories":[],"risk":0.0665},"relatedVulnerabilities":[{"id":"CVE-2026-81870","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-81870","namespace":"nvd:cpe","severity":"Low","urls":["https://github.com/open-telemetry/opentelemetry-go/commit/3a1412d2b3bc4e4231fbeac2ed42117ae541bb38","https://github.com/open-telemetry/opentelemetry-go/pull/8438","https://github.com/open-telemetry/opentelemetry-go/releases/tag/exporters/zipkin/v1.45.0","https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/v1.45.0","https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-8wmf-6v46-5gfg"],"description":"OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 1.5.0 to 1.44.0, sdk/trace.NewTracerProvider emits a TracerProvider created internal Info-level diagnostic event whose MarshalLog implementations recursively include span processor, exporter, and client configuration. Applications that call otel.SetLogger to enable OpenTelemetry internal Info logging can therefore record OTLP gRPC and HTTP collector endpoints, the OTLP HTTP Insecure flag, and complete Zipkin collector URLs. A person or system with access to those logs can learn internal collector topology and can recover credentials or tokens embedded in Zipkin URL user information or query strings. The default OpenTelemetry logger does not emit the event, and this path does not log OTLP authentication headers, TLS key material, or span payloads. This issue is fixed in version 1.45.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-81870","epss":0.00266,"percentile":0.1856,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-81870","cwe":"CWE-200","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-81870","cwe":"CWE-532","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"go.opentelemetry.io/otel/sdk","version":"v1.31.0"}},"found":{"vulnerabilityID":"GHSA-8wmf-6v46-5gfg","versionConstraint":">=1.5.0,<=1.44.0 (go)"},"fix":{"suggestedVersion":"1.45.0"}}],"artifact":{"id":"pkg:golang/go.opentelemetry.io/otel/sdk@v1.31.0?package-id=dd7492963088c09c","name":"go.opentelemetry.io/otel/sdk","version":"v1.31.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:otel:sdk:v1.31.0:*:*:*:*:*:*:*"],"purl":"pkg:golang/go.opentelemetry.io/otel/sdk@v1.31.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:xLY3abVHYZ5HSfOg3l2E5LUj2Cwva5Y7yGxnSW9H5Gk="}}},{"vulnerability":{"id":"GHSA-vp62-88p7-qqf5","dataSource":"https://github.com/advisories/GHSA-vp62-88p7-qqf5","namespace":"github:language:go","severity":"Medium","urls":["https://github.com/moby/moby/security/advisories/GHSA-vp62-88p7-qqf5","https://nvd.nist.gov/vuln/detail/CVE-2026-41568"],"description":"Docker: Race condition in docker cp allows creation of arbitrary empty files on the host via symlink swap","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:H","metrics":{"baseScore":6.1,"exploitabilityScore":0.9,"impactScore":4.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-41568","epss":0.00108,"percentile":0.0119,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-41568","cwe":"CWE-81","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-41568","cwe":"CWE-367","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.05993999999999999},"relatedVulnerabilities":[{"id":"CVE-2026-41568","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-41568","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/moby/moby/security/advisories/GHSA-vp62-88p7-qqf5"],"description":"Moby is an open source container framework. In Docker Engine prior to version 29.5.1, Docker Daemon versions 28.5.2 and prior, and Moby Daemon prior to version 2.0.0-beta.14, a race condition during docker cp mount setup allows a malicious container to create empty files or directories at arbitrary absolute paths on the host filesystem. This issue has been patched in Docker Engine version 29.5.1 and Moby Daemon version 2.0.0-beta.14.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:H","metrics":{"baseScore":6.1,"exploitabilityScore":0.9,"impactScore":4.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-41568","epss":0.00108,"percentile":0.0119,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-41568","cwe":"CWE-81","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-41568","cwe":"CWE-367","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"github.com/docker/docker","version":"v28.0.4+incompatible"}},"found":{"vulnerabilityID":"GHSA-vp62-88p7-qqf5","versionConstraint":"<=28.5.2 (go)"}}],"artifact":{"id":"pkg:golang/github.com/docker/docker@v28.0.4%2Bincompatible?package-id=39ab24a3ac08acd0","name":"github.com/docker/docker","version":"v28.0.4+incompatible","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:docker:docker:v28.0.4\\+incompatible:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/docker/docker@v28.0.4%2Bincompatible","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:JNNkBctYKurkw6FrHfKqY0nKIDf5nrbxjVBtS+cdcok="}}},{"vulnerability":{"id":"GO-2026-5024","dataSource":"https://go.dev/issue/78916","namespace":"govulndb:language:go","severity":"Low","urls":["https://go.dev/cl/770080","https://groups.google.com/g/golang-announce/c/6MMI8Lj-Atg"],"description":"NewNTUnicodeString does not check for string length overflow. When provided with a string that overflows the maximum size of a NTUnicodeString (a 16-bit number of bytes), it returns a truncated string rather than an error.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.3,"exploitabilityScore":1.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-39824","epss":0.00114,"percentile":0.01458,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-39824","cwe":"CWE-190","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["0.44.0"],"state":"fixed","available":[{"version":"0.44.0","date":"2026-04-23","kind":"release"}]},"advisories":[],"risk":0.03591},"relatedVulnerabilities":[{"id":"CVE-2026-39824","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-39824","namespace":"nvd:cpe","severity":"Low","urls":["https://go.dev/cl/770080","https://go.dev/issue/78916","https://groups.google.com/g/golang-announce/c/6MMI8Lj-Atg","https://pkg.go.dev/vuln/GO-2026-5024"],"description":"NewNTUnicodeString does not check for string length overflow. When provided with a string that overflows the maximum size of a NTUnicodeString (a 16-bit number of bytes), it returns a truncated string rather than an error.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.3,"exploitabilityScore":1.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-39824","epss":0.00114,"percentile":0.01458,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-39824","cwe":"CWE-190","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"govulndb:language:go","package":{"name":"golang.org/x/sys","version":"v0.31.0"}},"found":{"vulnerabilityID":"GO-2026-5024","versionConstraint":"<0.44.0 (go)"},"fix":{"suggestedVersion":"0.44.0"}}],"artifact":{"id":"pkg:golang/golang.org/x/sys@v0.31.0?package-id=99f26aff570eb118","name":"golang.org/x/sys","version":"v0.31.0","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:golang:x\\/sys:v0.31.0:*:*:*:*:*:*:*"],"purl":"pkg:golang/golang.org/x/sys@v0.31.0","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:ioabZlmFYtWhL+TRYpcnNlLwhyxaM9kWTDEmfnprqik="}}},{"vulnerability":{"id":"GHSA-cxww-7g56-2vh6","dataSource":"https://github.com/advisories/GHSA-cxww-7g56-2vh6","namespace":"github:language:github-action","severity":"High","urls":["https://github.com/actions/download-artifact/security/advisories/GHSA-cxww-7g56-2vh6","https://github.com/advisories/GHSA-6q32-hq47-5qq3","https://snyk.io/research/zip-slip-vulnerability","https://github.com/actions/download-artifact/releases/tag/v4.1.3"],"description":"@actions/download-artifact has an Arbitrary File Write via artifact extraction","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.3,"exploitabilityScore":2.1,"impactScore":5.2},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":8.6},"vendorMetadata":{}}],"fix":{"versions":["4.1.3"],"state":"fixed","available":[{"version":"4.1.3","date":"2025-09-04","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"stock-matcher","searchedBy":{"language":"","namespace":"github:language:github-action","package":{"name":"actions/download-artifact","version":"v4"}},"found":{"vulnerabilityID":"GHSA-cxww-7g56-2vh6","versionConstraint":">=4.0.0,<4.1.3 (unknown)"},"fix":{"suggestedVersion":"4.1.3"}}],"artifact":{"id":"pkg:github/actions/download-artifact@v4?package-id=d51409984c8ad12d","name":"actions/download-artifact","version":"v4","type":"github-action","locations":[{"path":"/.github/workflows/validations.yaml","accessPath":""}],"language":"","licenses":[],"cpes":["cpe:2.3:a:actions\\/download-artifact:actions\\/download-artifact:v4:*:*:*:*:*:*:*","cpe:2.3:a:actions\\/download-artifact:actions\\/download_artifact:v4:*:*:*:*:*:*:*","cpe:2.3:a:actions\\/download_artifact:actions\\/download-artifact:v4:*:*:*:*:*:*:*","cpe:2.3:a:actions\\/download_artifact:actions\\/download_artifact:v4:*:*:*:*:*:*:*","cpe:2.3:a:actions\\/download:actions\\/download-artifact:v4:*:*:*:*:*:*:*","cpe:2.3:a:actions\\/download:actions\\/download_artifact:v4:*:*:*:*:*:*:*"],"purl":"pkg:github/actions/download-artifact@v4","upstreams":[]}},{"vulnerability":{"id":"GHSA-fv92-fjc5-jj9h","dataSource":"https://github.com/advisories/GHSA-fv92-fjc5-jj9h","namespace":"github:language:go","severity":"Medium","urls":["https://github.com/go-viper/mapstructure/security/advisories/GHSA-fv92-fjc5-jj9h"],"description":"mapstructure May Leak Sensitive Information in Logs When Processing Malformed Data","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":1.7,"impactScore":3.6},"vendorMetadata":{}}],"fix":{"versions":["2.3.0"],"state":"fixed","available":[{"version":"2.3.0","date":"2025-06-28","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"go-module-matcher","searchedBy":{"language":"go","namespace":"github:language:go","package":{"name":"github.com/go-viper/mapstructure/v2","version":"v2.2.1"}},"found":{"vulnerabilityID":"GHSA-fv92-fjc5-jj9h","versionConstraint":"<2.3.0 (go)"},"fix":{"suggestedVersion":"2.3.0"}}],"artifact":{"id":"pkg:golang/github.com/go-viper/mapstructure/v2@v2.2.1?package-id=69f60ff33bdb7011","name":"github.com/go-viper/mapstructure/v2","version":"v2.2.1","type":"go-module","locations":[{"path":"/go.mod","accessPath":""}],"language":"go","licenses":[],"cpes":["cpe:2.3:a:go-viper:mapstructure\\/v2:v2.2.1:*:*:*:*:*:*:*","cpe:2.3:a:go_viper:mapstructure\\/v2:v2.2.1:*:*:*:*:*:*:*","cpe:2.3:a:go:mapstructure\\/v2:v2.2.1:*:*:*:*:*:*:*"],"purl":"pkg:golang/github.com/go-viper/mapstructure/v2@v2.2.1","upstreams":[],"metadataType":"GolangModMetadata","metadata":{"h1Digest":"h1:ZAaOCxANMuZx5RCeg0mBdEZk7DZasvvZIxtHqx8aGss="}}}],"source":{"type":"file","target":"wagoodman/dive"},"distro":{"name":"","version":"","idLike":null},"descriptor":{"name":"grype","version":"0.121.0","configuration":{"output":["json"],"file":"./grype.json","pretty":false,"distro":"","add-cpes-if-none":false,"output-template-file":"","check-for-app-update":true,"only-fixed":false,"only-notfixed":false,"ignore-wontfix":"","platform":"","search":{"scope":"squashed","unindexed-archives":false,"indexed-archives":true},"ignore":[{"vulnerability":"","include-aliases":false,"reason":"","namespace":"","fix-state":"","package":{"name":"kernel-headers","version":"","language":"","type":"rpm","location":"","upstream-name":"kernel"},"vex-status":"","vex-justification":"","match-type":"exact-indirect-match"},{"vulnerability":"","include-aliases":false,"reason":"","namespace":"","fix-state":"","package":{"name":"linux(-.*)?-headers-.*","version":"","language":"","type":"deb","location":"","upstream-name":"linux.*"},"vex-status":"","vex-justification":"","match-type":"exact-indirect-match"},{"vulnerability":"","include-aliases":false,"reason":"","namespace":"","fix-state":"","package":{"name":"linux-libc-dev","version":"","language":"","type":"deb","location":"","upstream-name":"linux"},"vex-status":"","vex-justification":"","match-type":"exact-indirect-match"},{"vulnerability":"","include-aliases":false,"reason":"","namespace":"","fix-state":"","package":{"name":"linux-kbuild-.*","version":"","language":"","type":"deb","location":"","upstream-name":"linux.*"},"vex-status":"","vex-justification":"","match-type":"exact-indirect-match"}],"exclude":[],"externalSources":{"enable":false,"maven":{"searchUpstreamBySha1":true,"baseUrl":"https://search.maven.org/solrsearch/select","rateLimit":300000000}},"match":{"java":{"using-cpes":false},"jvm":{"using-cpes":true},"dotnet":{"using-cpes":false},"golang":{"using-cpes":false,"always-use-cpe-for-stdlib":false,"allow-main-module-pseudo-version-comparison":false},"javascript":{"using-cpes":false},"python":{"using-cpes":false},"ruby":{"using-cpes":false},"rust":{"using-cpes":false},"hex":{"using-cpes":false},"stock":{"using-cpes":true},"dpkg":{"using-cpes":false,"missing-epoch-strategy":"zero","use-cpes-for-eol":false},"rpm":{"using-cpes":false,"missing-epoch-strategy":"auto","use-cpes-for-eol":false}},"fail-on-severity":"","registry":{"insecure-skip-tls-verify":false,"insecure-use-http":false,"ca-cert":""},"show-suppressed":false,"include-matcher-suppressions":false,"by-cve":false,"SortBy":{"sort-by":"risk"},"name":"","default-image-pull-source":"","from":null,"vex-documents":[],"vex-add":[],"match-upstream-kernel-headers":false,"fix-channel":{"redhat-eus":{"apply":"auto","versions":">= 8.0"},"ubuntu-esm":{"apply":"auto","versions":""}},"timestamp":true,"alerts":{"enable-eol-distro-warnings":true},"db":{"cache-dir":"$HOME/.cache/grype/db","update-url":"https://grype.anchore.io/databases","ca-cert":"","auto-update":true,"validate-by-hash-on-start":true,"validate-age":true,"max-allowed-built-age":432000000000000,"require-update-check":false,"update-available-timeout":30000000000,"update-download-timeout":300000000000,"max-update-check-frequency":7200000000000},"exp":{},"dev":{"db":{"debug":false}}},"db":{"status":{"schemaVersion":"v6.1.10","from":"https://grype.anchore.io/databases/v6/vulnerability-db_v6.1.10_2026-11-01T00:24:34Z_1793514012.tar.zst?checksum=sha256%3Ad0e1af9e6491440e1a671d0a0aafc32c5c7cb5cda787dcec3482799ef298f31c","built":"2026-11-01T06:20:12Z","path":"$HOME/.cache/grype/db/6/vulnerability.db","valid":true},"providers":{"alma":{"captured":"2026-11-01T00:24:39Z","input":"xxh64:d398731e6455b022"},"alpine":{"captured":"2026-11-01T00:24:47Z","input":"xxh64:c40c8985935df81b"},"amazon":{"captured":"2026-11-01T00:24:37Z","input":"xxh64:ee129200b14d5c8a"},"arch":{"captured":"2026-11-01T00:24:47Z","input":"xxh64:14f6c24dd6cd12c8"},"bitnami":{"captured":"2026-11-01T00:24:34Z","input":"xxh64:971619846357ae10"},"chainguard":{"captured":"2026-11-01T00:24:48Z","input":"xxh64:dfbf78c7fc58a603"},"chainguard-libraries":{"captured":"2026-11-01T00:24:50Z","input":"xxh64:db9c34dd1b7bc8d0"},"debian":{"captured":"2026-11-01T00:24:52Z","input":"xxh64:078c82a49c8cb529"},"echo":{"captured":"2026-11-01T00:24:41Z","input":"xxh64:1d0df98736854a48"},"eol":{"captured":"2026-11-01T00:24:59Z","input":"xxh64:0f2164b3e62ba44b"},"epss":{"captured":"2026-11-01T00:25:00Z","input":"xxh64:0d4c3b8d2c2e5188"},"fedora":{"captured":"2026-11-01T00:24:40Z","input":"xxh64:28fe3d1d8ae41f9b"},"github":{"captured":"2026-11-01T00:24:57Z","input":"xxh64:076a86d2dc5c9e83"},"govulndb":{"captured":"2026-11-01T00:24:45Z","input":"xxh64:56e169604e12196e"},"hummingbird":{"captured":"2026-11-01T00:27:26Z","input":"xxh64:e86abd0466410fb6"},"kev":{"captured":"2026-11-01T00:25:06Z","input":"xxh64:cb0f4041bd51c379"},"mariner":{"captured":"2026-11-01T00:24:56Z","input":"xxh64:003337efdc7e1888"},"minimos":{"captured":"2026-11-01T00:24:56Z","input":"xxh64:219c30ffded7a12c"},"nvd":{"captured":"2026-11-01T00:25:41Z","input":"xxh64:75e41eec415fdb0a"},"oracle":{"captured":"2026-11-01T00:24:42Z","input":"xxh64:0546c2dd11a85c07"},"photon":{"captured":"2026-11-01T00:24:37Z","input":"xxh64:8dbfd0c521fd470a"},"rhel":{"captured":"2026-11-01T01:08:40Z","input":"xxh64:57c5e6a7f9f134ff"},"secureos":{"captured":"2026-11-01T00:24:34Z","input":"xxh64:ac7fa7f44e8ed7dd"},"sles":{"captured":"2026-11-01T00:26:56Z","input":"xxh64:025a1565b2cc7cdf"},"ubuntu":{"captured":"2026-11-01T00:25:58Z","input":"xxh64:9ab4d29f0ea6275d"},"wolfi":{"captured":"2026-11-01T00:25:02Z","input":"xxh64:d27b08e998baab8e"}}},"timestamp":"2026-11-02T03:07:36.77816647Z"}}