{"grype_matches":[{"artifact":{"id":"0f9c6349371de084","cpes":["cpe:2.3:a:glibc-2.44:glibc-2.44:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-2.44:glibc_2.44:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_2.44:glibc-2.44:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_2.44:glibc_2.44:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-2.44:glibc:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc-2.44:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc_2.44:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_2.44:glibc:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:gnu:glibc-2.44:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:gnu:glibc_2.44:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:gnu:glibc:2.44-r7:*:*:*:*:*:*:*"],"name":"glibc-2.44","purl":"pkg:apk/wolfi/glibc-2.44@2.44-r7?arch=x86_64&distro=wolfi-20230201","type":"apk","version":"2.44-r7","language":"","licenses":["LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/etc"},{"path":"/etc/rpc"},{"path":"/etc/apk"},{"path":"/etc/apk/commit_hooks.d"},{"path":"/etc/apk/commit_hooks.d/ldconfig-commit.sh"},{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/ld.so"},{"path":"/usr/bin/ldconfig"},{"path":"/usr/lib"},{"path":"/usr/lib/libBrokenLocale.so.1"},{"path":"/usr/lib/libanl.so.1"},{"path":"/usr/lib/libc.so.6"},{"path":"/usr/lib/libc_malloc_debug.so.0"},{"path":"/usr/lib/libdl.so.2"},{"path":"/usr/lib/libm.so.6"},{"path":"/usr/lib/libmemusage.so"},{"path":"/usr/lib/libmvec.so.1"},{"path":"/usr/lib/libnsl.so.1"},{"path":"/usr/lib/libnss_compat.so.2"},{"path":"/usr/lib/libnss_dns.so.2"},{"path":"/usr/lib/libnss_files.so.2"},{"path":"/usr/lib/libpthread.so.0"},{"path":"/usr/lib/libresolv.so.2"},{"path":"/usr/lib/librt.so.1"},{"path":"/usr/lib/libthread_db.so.1"},{"path":"/usr/lib/libutil.so.1"},{"path":"/usr/lib/audit"},{"path":"/usr/lib/locale"},{"path":"/usr/share"},{"path":"/var"},{"path":"/var/lib"},{"path":"/var/lib/db"},{"path":"/var/lib/db/sbom"},{"path":"/var/lib/db/sbom/glibc-2.44-2.44-r7.spdx.json"}]},"locations":[{"path":"/usr/lib/apk/db/installed","layerID":"sha256:bf84f94c00fddd623f1dd0efa62768f7cc8da64535000bd88cc59d3040dbc798","accessPath":"/usr/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"glibc-2.44"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.44-r8"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-8674","versionConstraint":"< 2.44-r8 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"wolfi","version":"20230201"},"package":{"name":"glibc-2.44","version":"2.44-r7"},"namespace":"wolfi:distro:wolfi:rolling"}},{"fix":{"suggestedVersion":"2.44-r8"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-8674","versionConstraint":"< 2.44-r8 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"wolfi","version":"20230201"},"package":{"name":"glibc-2.44","version":"2.44-r7"},"namespace":"wolfi:distro:wolfi:rolling"}}],"vulnerability":{"id":"CVE-2026-8674","fix":{"state":"fixed","versions":["2.44-r8"],"available":[{"date":"2026-10-08","kind":"first-observed","version":"2.44-r8"}]},"cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8674","cwe":"CWE-617","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-8674","date":"2026-10-19","epss":0.00315,"percentile":0.2295}],"risk":0.162225,"urls":[],"severity":"Medium","namespace":"wolfi:distro:wolfi:rolling","advisories":[],"dataSource":"https://images.chainguard.dev/security/CVE-2026-8674"},"relatedVulnerabilities":[{"id":"CVE-2026-8674","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8674","cwe":"CWE-617","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-8674","date":"2026-10-19","epss":0.00315,"percentile":0.2295}],"urls":["https://joshua.hu/fuzzing-glibc-libresolv","https://sourceware.org/bugzilla/show_bug.cgi?id=31026","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0021","https://sourceware.org/git/?p=glibc.git;a=commit;h=506ea57086bfb9ce3daff1c14246a1cb532aba0a","http://www.openwall.com/lists/oss-security/2026/09/17/4"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8674","description":"Initializing the DNS stub resolver from an /etc/resolv.conf file, or a LOCALDOMAIN environment variable, whose search list contains a domain of roughly 200 characters or more in the GNU C Library version 2.26 to 2.44 results in an assertion failure which aborts the process.\n\nThe resolver truncates the search list when copying it into the fixed-size _res.defdname buffer, then asserts that the copy is consistent with the full configuration.  The consistency check compared against the wrong size and did not handle a first entry that does not fit, so a correctly truncated list failed the assertion.  Any process that resolves names through the library is affected, including long-running processes that reload /etc/resolv.conf on the next query after it changes.  Search domains are commonly written to /etc/resolv.conf from data received over DHCP or from a VPN server, so an attacker on the local network may be able to trigger this without privileges on the target system, subject to validation by the network configuration software."}]},{"artifact":{"id":"51d266c9454a8e0b","cpes":["cpe:2.3:a:glibc-2.44-locale-posix:glibc-2.44-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-2.44-locale-posix:glibc_2.44_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_2.44_locale_posix:glibc-2.44-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_2.44_locale_posix:glibc_2.44_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-2.44-locale-posix:glibc-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-2.44-locale-posix:glibc_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-locale-posix:glibc-2.44-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-locale-posix:glibc_2.44_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_2.44_locale_posix:glibc-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_2.44_locale_posix:glibc_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_locale_posix:glibc-2.44-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_locale_posix:glibc_2.44_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-2.44-locale:glibc-2.44-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-2.44-locale:glibc_2.44_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_2.44_locale:glibc-2.44-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_2.44_locale:glibc_2.44_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-locale-posix:glibc-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-locale-posix:glibc_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_locale_posix:glibc-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_locale_posix:glibc_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-2.44-locale:glibc-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-2.44-locale:glibc_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-locale:glibc-2.44-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-locale:glibc_2.44_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_2.44_locale:glibc-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_2.44_locale:glibc_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_locale:glibc-2.44-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_locale:glibc_2.44_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-2.44:glibc-2.44-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-2.44:glibc_2.44_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_2.44:glibc-2.44-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_2.44:glibc_2.44_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-locale:glibc-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-locale:glibc_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_locale:glibc-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_locale:glibc_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-2.44:glibc-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-2.44:glibc_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc-2.44-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc_2.44_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_2.44:glibc-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_2.44:glibc_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc_locale_posix:2.44-r7:*:*:*:*:*:*:*"],"name":"glibc-2.44-locale-posix","purl":"pkg:apk/wolfi/glibc-2.44-locale-posix@2.44-r7?arch=x86_64&distro=wolfi-20230201&upstream=glibc-2.44","type":"apk","version":"2.44-r7","language":"","licenses":["LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/locale"},{"path":"/usr/lib/locale/C.utf8"},{"path":"/usr/lib/locale/C.utf8/LC_ADDRESS"},{"path":"/usr/lib/locale/C.utf8/LC_COLLATE"},{"path":"/usr/lib/locale/C.utf8/LC_CTYPE"},{"path":"/usr/lib/locale/C.utf8/LC_IDENTIFICATION"},{"path":"/usr/lib/locale/C.utf8/LC_MEASUREMENT"},{"path":"/usr/lib/locale/C.utf8/LC_MONETARY"},{"path":"/usr/lib/locale/C.utf8/LC_NAME"},{"path":"/usr/lib/locale/C.utf8/LC_NUMERIC"},{"path":"/usr/lib/locale/C.utf8/LC_PAPER"},{"path":"/usr/lib/locale/C.utf8/LC_TELEPHONE"},{"path":"/usr/lib/locale/C.utf8/LC_TIME"},{"path":"/usr/lib/locale/C.utf8/LC_MESSAGES"},{"path":"/usr/lib/locale/C.utf8/LC_MESSAGES/SYS_LC_MESSAGES"},{"path":"/var"},{"path":"/var/lib"},{"path":"/var/lib/db"},{"path":"/var/lib/db/sbom"},{"path":"/var/lib/db/sbom/glibc-2.44-locale-posix-2.44-r7.spdx.json"}]},"locations":[{"path":"/usr/lib/apk/db/installed","layerID":"sha256:bf84f94c00fddd623f1dd0efa62768f7cc8da64535000bd88cc59d3040dbc798","accessPath":"/usr/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"glibc-2.44"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.44-r8"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-8674","versionConstraint":"< 2.44-r8 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"wolfi","version":"20230201"},"package":{"name":"glibc-2.44","version":"2.44-r7"},"namespace":"wolfi:distro:wolfi:rolling"}}],"vulnerability":{"id":"CVE-2026-8674","fix":{"state":"fixed","versions":["2.44-r8"],"available":[{"date":"2026-10-08","kind":"first-observed","version":"2.44-r8"}]},"cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8674","cwe":"CWE-617","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-8674","date":"2026-10-19","epss":0.00315,"percentile":0.2295}],"risk":0.162225,"urls":[],"severity":"Medium","namespace":"wolfi:distro:wolfi:rolling","advisories":[],"dataSource":"https://images.chainguard.dev/security/CVE-2026-8674"},"relatedVulnerabilities":[{"id":"CVE-2026-8674","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8674","cwe":"CWE-617","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-8674","date":"2026-10-19","epss":0.00315,"percentile":0.2295}],"urls":["https://joshua.hu/fuzzing-glibc-libresolv","https://sourceware.org/bugzilla/show_bug.cgi?id=31026","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0021","https://sourceware.org/git/?p=glibc.git;a=commit;h=506ea57086bfb9ce3daff1c14246a1cb532aba0a","http://www.openwall.com/lists/oss-security/2026/09/17/4"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8674","description":"Initializing the DNS stub resolver from an /etc/resolv.conf file, or a LOCALDOMAIN environment variable, whose search list contains a domain of roughly 200 characters or more in the GNU C Library version 2.26 to 2.44 results in an assertion failure which aborts the process.\n\nThe resolver truncates the search list when copying it into the fixed-size _res.defdname buffer, then asserts that the copy is consistent with the full configuration.  The consistency check compared against the wrong size and did not handle a first entry that does not fit, so a correctly truncated list failed the assertion.  Any process that resolves names through the library is affected, including long-running processes that reload /etc/resolv.conf on the next query after it changes.  Search domains are commonly written to /etc/resolv.conf from data received over DHCP or from a VPN server, so an attacker on the local network may be able to trigger this without privileges on the target system, subject to validation by the network configuration software."}]},{"artifact":{"id":"6f710cb77dbce45d","cpes":["cpe:2.3:a:ld-linux-2.44:ld-linux-2.44:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:ld-linux-2.44:ld_linux_2.44:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:ld_linux_2.44:ld-linux-2.44:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:ld_linux_2.44:ld_linux_2.44:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:ld-linux-2.44:ld-linux:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:ld-linux-2.44:ld_linux:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:ld-linux:ld-linux-2.44:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:ld-linux:ld_linux_2.44:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:ld_linux:ld-linux-2.44:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:ld_linux:ld_linux_2.44:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:ld_linux_2.44:ld-linux:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:ld_linux_2.44:ld_linux:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:ld-linux:ld-linux:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:ld-linux:ld_linux:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:ld_linux:ld-linux:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:ld_linux:ld_linux:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:ld:ld-linux-2.44:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:ld:ld_linux_2.44:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:ld:ld-linux:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:ld:ld_linux:2.44-r7:*:*:*:*:*:*:*"],"name":"ld-linux-2.44","purl":"pkg:apk/wolfi/ld-linux-2.44@2.44-r7?arch=x86_64&distro=wolfi-20230201&upstream=glibc-2.44","type":"apk","version":"2.44-r7","language":"","licenses":["LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/etc"},{"path":"/etc/ld.so.conf"},{"path":"/etc/ld.so.conf.d"},{"path":"/etc/ld.so.conf.d/libc.conf"},{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/ld-linux-x86-64.so.2"},{"path":"/var"},{"path":"/var/lib"},{"path":"/var/lib/db"},{"path":"/var/lib/db/sbom"},{"path":"/var/lib/db/sbom/ld-linux-2.44-2.44-r7.spdx.json"}]},"locations":[{"path":"/usr/lib/apk/db/installed","layerID":"sha256:bf84f94c00fddd623f1dd0efa62768f7cc8da64535000bd88cc59d3040dbc798","accessPath":"/usr/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"glibc-2.44"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.44-r8"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-8674","versionConstraint":"< 2.44-r8 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"wolfi","version":"20230201"},"package":{"name":"glibc-2.44","version":"2.44-r7"},"namespace":"wolfi:distro:wolfi:rolling"}}],"vulnerability":{"id":"CVE-2026-8674","fix":{"state":"fixed","versions":["2.44-r8"],"available":[{"date":"2026-10-08","kind":"first-observed","version":"2.44-r8"}]},"cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8674","cwe":"CWE-617","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-8674","date":"2026-10-19","epss":0.00315,"percentile":0.2295}],"risk":0.162225,"urls":[],"severity":"Medium","namespace":"wolfi:distro:wolfi:rolling","advisories":[],"dataSource":"https://images.chainguard.dev/security/CVE-2026-8674"},"relatedVulnerabilities":[{"id":"CVE-2026-8674","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8674","cwe":"CWE-617","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-8674","date":"2026-10-19","epss":0.00315,"percentile":0.2295}],"urls":["https://joshua.hu/fuzzing-glibc-libresolv","https://sourceware.org/bugzilla/show_bug.cgi?id=31026","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0021","https://sourceware.org/git/?p=glibc.git;a=commit;h=506ea57086bfb9ce3daff1c14246a1cb532aba0a","http://www.openwall.com/lists/oss-security/2026/09/17/4"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8674","description":"Initializing the DNS stub resolver from an /etc/resolv.conf file, or a LOCALDOMAIN environment variable, whose search list contains a domain of roughly 200 characters or more in the GNU C Library version 2.26 to 2.44 results in an assertion failure which aborts the process.\n\nThe resolver truncates the search list when copying it into the fixed-size _res.defdname buffer, then asserts that the copy is consistent with the full configuration.  The consistency check compared against the wrong size and did not handle a first entry that does not fit, so a correctly truncated list failed the assertion.  Any process that resolves names through the library is affected, including long-running processes that reload /etc/resolv.conf on the next query after it changes.  Search domains are commonly written to /etc/resolv.conf from data received over DHCP or from a VPN server, so an attacker on the local network may be able to trigger this without privileges on the target system, subject to validation by the network configuration software."}]},{"artifact":{"id":"0f9c6349371de084","cpes":["cpe:2.3:a:glibc-2.44:glibc-2.44:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-2.44:glibc_2.44:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_2.44:glibc-2.44:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_2.44:glibc_2.44:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-2.44:glibc:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc-2.44:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc_2.44:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_2.44:glibc:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:gnu:glibc-2.44:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:gnu:glibc_2.44:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:gnu:glibc:2.44-r7:*:*:*:*:*:*:*"],"name":"glibc-2.44","purl":"pkg:apk/wolfi/glibc-2.44@2.44-r7?arch=x86_64&distro=wolfi-20230201","type":"apk","version":"2.44-r7","language":"","licenses":["LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/etc"},{"path":"/etc/rpc"},{"path":"/etc/apk"},{"path":"/etc/apk/commit_hooks.d"},{"path":"/etc/apk/commit_hooks.d/ldconfig-commit.sh"},{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/ld.so"},{"path":"/usr/bin/ldconfig"},{"path":"/usr/lib"},{"path":"/usr/lib/libBrokenLocale.so.1"},{"path":"/usr/lib/libanl.so.1"},{"path":"/usr/lib/libc.so.6"},{"path":"/usr/lib/libc_malloc_debug.so.0"},{"path":"/usr/lib/libdl.so.2"},{"path":"/usr/lib/libm.so.6"},{"path":"/usr/lib/libmemusage.so"},{"path":"/usr/lib/libmvec.so.1"},{"path":"/usr/lib/libnsl.so.1"},{"path":"/usr/lib/libnss_compat.so.2"},{"path":"/usr/lib/libnss_dns.so.2"},{"path":"/usr/lib/libnss_files.so.2"},{"path":"/usr/lib/libpthread.so.0"},{"path":"/usr/lib/libresolv.so.2"},{"path":"/usr/lib/librt.so.1"},{"path":"/usr/lib/libthread_db.so.1"},{"path":"/usr/lib/libutil.so.1"},{"path":"/usr/lib/audit"},{"path":"/usr/lib/locale"},{"path":"/usr/share"},{"path":"/var"},{"path":"/var/lib"},{"path":"/var/lib/db"},{"path":"/var/lib/db/sbom"},{"path":"/var/lib/db/sbom/glibc-2.44-2.44-r7.spdx.json"}]},"locations":[{"path":"/usr/lib/apk/db/installed","layerID":"sha256:bf84f94c00fddd623f1dd0efa62768f7cc8da64535000bd88cc59d3040dbc798","accessPath":"/usr/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"glibc-2.44"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.44-r8"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-89092","versionConstraint":"< 2.44-r8 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"wolfi","version":"20230201"},"package":{"name":"glibc-2.44","version":"2.44-r7"},"namespace":"wolfi:distro:wolfi:rolling"}},{"fix":{"suggestedVersion":"2.44-r8"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-89092","versionConstraint":"< 2.44-r8 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"wolfi","version":"20230201"},"package":{"name":"glibc-2.44","version":"2.44-r7"},"namespace":"wolfi:distro:wolfi:rolling"}}],"vulnerability":{"id":"CVE-2026-89092","fix":{"state":"fixed","versions":["2.44-r8"],"available":[{"date":"2026-10-08","kind":"first-observed","version":"2.44-r8"}]},"cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":4.2,"impactScore":2.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89092","cwe":"CWE-789","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-89092","date":"2026-10-19","epss":0.0024,"percentile":0.14142}],"risk":0.1104,"urls":[],"severity":"Medium","namespace":"wolfi:distro:wolfi:rolling","advisories":[],"dataSource":"https://images.chainguard.dev/security/CVE-2026-89092"},"relatedVulnerabilities":[{"id":"CVE-2026-89092","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":4.2,"impactScore":2.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89092","cwe":"CWE-789","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-89092","date":"2026-10-19","epss":0.0024,"percentile":0.14142}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34624","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0016","http://www.openwall.com/lists/oss-security/2026/09/11/2"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-89092","description":"The nscd service in the GNU C Library 2.3.4 onwards may crash due to a \nstack overflow when a malicious DNS server returns too large a response \nfor a DNS query, resulting in degraded DNS resolution for the system.\n\n\n\nExploitation of this bug needs a system that has nscd enabled and using \nan untrusted DNS server for name resolution, with the compromised DNS \nserver being capable of processing records large enough to result in a \nstack overflow in an nscd thread stack.  During experimentation, bind 9 \nwas unable to handle large records, but that could change in future or \nwith a different name server.  In typical installations, nscd is \nexecuted in an isolated context as its own user without a shell, due to \nwhich any compromise of that service is isolated.\n\n\n\nThere is a remote possibility of nscd cache corruption if an attacker \nmanages to get the stack pointer into a desired point in the heap, \npotentially resulting in other caches in nscd being overwritten with \ncorrupt data through the stack overflow, until the buggy code path \neventually results in a crash.\n\n\n\nFinally, a crash in nscd may result in performance degradation when \nresolving names, but it does not result in a denial of service."}]},{"artifact":{"id":"51d266c9454a8e0b","cpes":["cpe:2.3:a:glibc-2.44-locale-posix:glibc-2.44-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-2.44-locale-posix:glibc_2.44_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_2.44_locale_posix:glibc-2.44-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_2.44_locale_posix:glibc_2.44_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-2.44-locale-posix:glibc-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-2.44-locale-posix:glibc_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-locale-posix:glibc-2.44-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-locale-posix:glibc_2.44_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_2.44_locale_posix:glibc-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_2.44_locale_posix:glibc_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_locale_posix:glibc-2.44-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_locale_posix:glibc_2.44_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-2.44-locale:glibc-2.44-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-2.44-locale:glibc_2.44_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_2.44_locale:glibc-2.44-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_2.44_locale:glibc_2.44_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-locale-posix:glibc-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-locale-posix:glibc_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_locale_posix:glibc-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_locale_posix:glibc_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-2.44-locale:glibc-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-2.44-locale:glibc_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-locale:glibc-2.44-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-locale:glibc_2.44_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_2.44_locale:glibc-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_2.44_locale:glibc_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_locale:glibc-2.44-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_locale:glibc_2.44_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-2.44:glibc-2.44-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-2.44:glibc_2.44_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_2.44:glibc-2.44-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_2.44:glibc_2.44_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-locale:glibc-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-locale:glibc_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_locale:glibc-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_locale:glibc_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-2.44:glibc-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-2.44:glibc_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc-2.44-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc_2.44_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_2.44:glibc-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_2.44:glibc_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc_locale_posix:2.44-r7:*:*:*:*:*:*:*"],"name":"glibc-2.44-locale-posix","purl":"pkg:apk/wolfi/glibc-2.44-locale-posix@2.44-r7?arch=x86_64&distro=wolfi-20230201&upstream=glibc-2.44","type":"apk","version":"2.44-r7","language":"","licenses":["LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/locale"},{"path":"/usr/lib/locale/C.utf8"},{"path":"/usr/lib/locale/C.utf8/LC_ADDRESS"},{"path":"/usr/lib/locale/C.utf8/LC_COLLATE"},{"path":"/usr/lib/locale/C.utf8/LC_CTYPE"},{"path":"/usr/lib/locale/C.utf8/LC_IDENTIFICATION"},{"path":"/usr/lib/locale/C.utf8/LC_MEASUREMENT"},{"path":"/usr/lib/locale/C.utf8/LC_MONETARY"},{"path":"/usr/lib/locale/C.utf8/LC_NAME"},{"path":"/usr/lib/locale/C.utf8/LC_NUMERIC"},{"path":"/usr/lib/locale/C.utf8/LC_PAPER"},{"path":"/usr/lib/locale/C.utf8/LC_TELEPHONE"},{"path":"/usr/lib/locale/C.utf8/LC_TIME"},{"path":"/usr/lib/locale/C.utf8/LC_MESSAGES"},{"path":"/usr/lib/locale/C.utf8/LC_MESSAGES/SYS_LC_MESSAGES"},{"path":"/var"},{"path":"/var/lib"},{"path":"/var/lib/db"},{"path":"/var/lib/db/sbom"},{"path":"/var/lib/db/sbom/glibc-2.44-locale-posix-2.44-r7.spdx.json"}]},"locations":[{"path":"/usr/lib/apk/db/installed","layerID":"sha256:bf84f94c00fddd623f1dd0efa62768f7cc8da64535000bd88cc59d3040dbc798","accessPath":"/usr/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"glibc-2.44"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.44-r8"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-89092","versionConstraint":"< 2.44-r8 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"wolfi","version":"20230201"},"package":{"name":"glibc-2.44","version":"2.44-r7"},"namespace":"wolfi:distro:wolfi:rolling"}}],"vulnerability":{"id":"CVE-2026-89092","fix":{"state":"fixed","versions":["2.44-r8"],"available":[{"date":"2026-10-08","kind":"first-observed","version":"2.44-r8"}]},"cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":4.2,"impactScore":2.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89092","cwe":"CWE-789","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-89092","date":"2026-10-19","epss":0.0024,"percentile":0.14142}],"risk":0.1104,"urls":[],"severity":"Medium","namespace":"wolfi:distro:wolfi:rolling","advisories":[],"dataSource":"https://images.chainguard.dev/security/CVE-2026-89092"},"relatedVulnerabilities":[{"id":"CVE-2026-89092","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":4.2,"impactScore":2.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89092","cwe":"CWE-789","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-89092","date":"2026-10-19","epss":0.0024,"percentile":0.14142}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34624","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0016","http://www.openwall.com/lists/oss-security/2026/09/11/2"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-89092","description":"The nscd service in the GNU C Library 2.3.4 onwards may crash due to a \nstack overflow when a malicious DNS server returns too large a response \nfor a DNS query, resulting in degraded DNS resolution for the system.\n\n\n\nExploitation of this bug needs a system that has nscd enabled and using \nan untrusted DNS server for name resolution, with the compromised DNS \nserver being capable of processing records large enough to result in a \nstack overflow in an nscd thread stack.  During experimentation, bind 9 \nwas unable to handle large records, but that could change in future or \nwith a different name server.  In typical installations, nscd is \nexecuted in an isolated context as its own user without a shell, due to \nwhich any compromise of that service is isolated.\n\n\n\nThere is a remote possibility of nscd cache corruption if an attacker \nmanages to get the stack pointer into a desired point in the heap, \npotentially resulting in other caches in nscd being overwritten with \ncorrupt data through the stack overflow, until the buggy code path \neventually results in a crash.\n\n\n\nFinally, a crash in nscd may result in performance degradation when \nresolving names, but it does not result in a denial of service."}]},{"artifact":{"id":"6f710cb77dbce45d","cpes":["cpe:2.3:a:ld-linux-2.44:ld-linux-2.44:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:ld-linux-2.44:ld_linux_2.44:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:ld_linux_2.44:ld-linux-2.44:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:ld_linux_2.44:ld_linux_2.44:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:ld-linux-2.44:ld-linux:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:ld-linux-2.44:ld_linux:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:ld-linux:ld-linux-2.44:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:ld-linux:ld_linux_2.44:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:ld_linux:ld-linux-2.44:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:ld_linux:ld_linux_2.44:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:ld_linux_2.44:ld-linux:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:ld_linux_2.44:ld_linux:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:ld-linux:ld-linux:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:ld-linux:ld_linux:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:ld_linux:ld-linux:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:ld_linux:ld_linux:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:ld:ld-linux-2.44:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:ld:ld_linux_2.44:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:ld:ld-linux:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:ld:ld_linux:2.44-r7:*:*:*:*:*:*:*"],"name":"ld-linux-2.44","purl":"pkg:apk/wolfi/ld-linux-2.44@2.44-r7?arch=x86_64&distro=wolfi-20230201&upstream=glibc-2.44","type":"apk","version":"2.44-r7","language":"","licenses":["LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/etc"},{"path":"/etc/ld.so.conf"},{"path":"/etc/ld.so.conf.d"},{"path":"/etc/ld.so.conf.d/libc.conf"},{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/ld-linux-x86-64.so.2"},{"path":"/var"},{"path":"/var/lib"},{"path":"/var/lib/db"},{"path":"/var/lib/db/sbom"},{"path":"/var/lib/db/sbom/ld-linux-2.44-2.44-r7.spdx.json"}]},"locations":[{"path":"/usr/lib/apk/db/installed","layerID":"sha256:bf84f94c00fddd623f1dd0efa62768f7cc8da64535000bd88cc59d3040dbc798","accessPath":"/usr/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"glibc-2.44"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.44-r8"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-89092","versionConstraint":"< 2.44-r8 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"wolfi","version":"20230201"},"package":{"name":"glibc-2.44","version":"2.44-r7"},"namespace":"wolfi:distro:wolfi:rolling"}}],"vulnerability":{"id":"CVE-2026-89092","fix":{"state":"fixed","versions":["2.44-r8"],"available":[{"date":"2026-10-08","kind":"first-observed","version":"2.44-r8"}]},"cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":4.2,"impactScore":2.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89092","cwe":"CWE-789","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-89092","date":"2026-10-19","epss":0.0024,"percentile":0.14142}],"risk":0.1104,"urls":[],"severity":"Medium","namespace":"wolfi:distro:wolfi:rolling","advisories":[],"dataSource":"https://images.chainguard.dev/security/CVE-2026-89092"},"relatedVulnerabilities":[{"id":"CVE-2026-89092","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":4.2,"impactScore":2.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89092","cwe":"CWE-789","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-89092","date":"2026-10-19","epss":0.0024,"percentile":0.14142}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34624","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0016","http://www.openwall.com/lists/oss-security/2026/09/11/2"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-89092","description":"The nscd service in the GNU C Library 2.3.4 onwards may crash due to a \nstack overflow when a malicious DNS server returns too large a response \nfor a DNS query, resulting in degraded DNS resolution for the system.\n\n\n\nExploitation of this bug needs a system that has nscd enabled and using \nan untrusted DNS server for name resolution, with the compromised DNS \nserver being capable of processing records large enough to result in a \nstack overflow in an nscd thread stack.  During experimentation, bind 9 \nwas unable to handle large records, but that could change in future or \nwith a different name server.  In typical installations, nscd is \nexecuted in an isolated context as its own user without a shell, due to \nwhich any compromise of that service is isolated.\n\n\n\nThere is a remote possibility of nscd cache corruption if an attacker \nmanages to get the stack pointer into a desired point in the heap, \npotentially resulting in other caches in nscd being overwritten with \ncorrupt data through the stack overflow, until the buggy code path \neventually results in a crash.\n\n\n\nFinally, a crash in nscd may result in performance degradation when \nresolving names, but it does not result in a denial of service."}]},{"artifact":{"id":"0f9c6349371de084","cpes":["cpe:2.3:a:glibc-2.44:glibc-2.44:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-2.44:glibc_2.44:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_2.44:glibc-2.44:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_2.44:glibc_2.44:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-2.44:glibc:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc-2.44:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc_2.44:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_2.44:glibc:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:gnu:glibc-2.44:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:gnu:glibc_2.44:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:gnu:glibc:2.44-r7:*:*:*:*:*:*:*"],"name":"glibc-2.44","purl":"pkg:apk/wolfi/glibc-2.44@2.44-r7?arch=x86_64&distro=wolfi-20230201","type":"apk","version":"2.44-r7","language":"","licenses":["LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/etc"},{"path":"/etc/rpc"},{"path":"/etc/apk"},{"path":"/etc/apk/commit_hooks.d"},{"path":"/etc/apk/commit_hooks.d/ldconfig-commit.sh"},{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/ld.so"},{"path":"/usr/bin/ldconfig"},{"path":"/usr/lib"},{"path":"/usr/lib/libBrokenLocale.so.1"},{"path":"/usr/lib/libanl.so.1"},{"path":"/usr/lib/libc.so.6"},{"path":"/usr/lib/libc_malloc_debug.so.0"},{"path":"/usr/lib/libdl.so.2"},{"path":"/usr/lib/libm.so.6"},{"path":"/usr/lib/libmemusage.so"},{"path":"/usr/lib/libmvec.so.1"},{"path":"/usr/lib/libnsl.so.1"},{"path":"/usr/lib/libnss_compat.so.2"},{"path":"/usr/lib/libnss_dns.so.2"},{"path":"/usr/lib/libnss_files.so.2"},{"path":"/usr/lib/libpthread.so.0"},{"path":"/usr/lib/libresolv.so.2"},{"path":"/usr/lib/librt.so.1"},{"path":"/usr/lib/libthread_db.so.1"},{"path":"/usr/lib/libutil.so.1"},{"path":"/usr/lib/audit"},{"path":"/usr/lib/locale"},{"path":"/usr/share"},{"path":"/var"},{"path":"/var/lib"},{"path":"/var/lib/db"},{"path":"/var/lib/db/sbom"},{"path":"/var/lib/db/sbom/glibc-2.44-2.44-r7.spdx.json"}]},"locations":[{"path":"/usr/lib/apk/db/installed","layerID":"sha256:bf84f94c00fddd623f1dd0efa62768f7cc8da64535000bd88cc59d3040dbc798","accessPath":"/usr/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"glibc-2.44"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.44-r8"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-86805","versionConstraint":"< 2.44-r8 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"wolfi","version":"20230201"},"package":{"name":"glibc-2.44","version":"2.44-r7"},"namespace":"wolfi:distro:wolfi:rolling"}},{"fix":{"suggestedVersion":"2.44-r8"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86805","versionConstraint":"< 2.44-r8 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"wolfi","version":"20230201"},"package":{"name":"glibc-2.44","version":"2.44-r7"},"namespace":"wolfi:distro:wolfi:rolling"}}],"vulnerability":{"id":"CVE-2026-86805","fix":{"state":"fixed","versions":["2.44-r8"],"available":[{"date":"2026-10-08","kind":"first-observed","version":"2.44-r8"}]},"cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:L","metrics":{"baseScore":6.3,"impactScore":5.5,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86805","cwe":"CWE-367","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-86805","date":"2026-10-19","epss":0.00097,"percentile":0.00679}],"risk":0.054805,"urls":[],"severity":"Medium","namespace":"wolfi:distro:wolfi:rolling","advisories":[],"dataSource":"https://images.chainguard.dev/security/CVE-2026-86805"},"relatedVulnerabilities":[{"id":"CVE-2026-86805","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:L","metrics":{"baseScore":6.3,"impactScore":5.5,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86805","cwe":"CWE-367","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-86805","date":"2026-10-19","epss":0.00097,"percentile":0.00679}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34360","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0022"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86805","description":"A time-of-check to time-of-use (TOCTOU) race condition in the dynamic loader (ld.so) of the GNU C Library (glibc) versions 2.14 through 2.44 allows a local attacker to escalate privileges. When expanding $ORIGIN in DT_RPATH for setuid/setgid (AT_SECURE) programs, glibc validates the lexically normalized search path against the trusted directories but then opens the raw, un-normalized path. On systems where the Linux fs.protected_hardlinks sysctl is disabled, a local attacker who hard-links such a program into an attacker-controlled directory and wins a race to replace an intermediate path component with a symbolic link can direct the loader outside the trusted directory, causing it to load an attacker-controlled shared object and execute arbitrary code with the elevated privileges of the program.\n\nExploitation requires an installed setuid or setgid binary whose DT_RPATH uses $ORIGIN followed by \"..\" traversal that normalizes into a trusted directory, and the ability to hard-link that binary and win the race by swapping a path component for a symbolic link. Major Linux-based OS distributions ship with fs.protected_hardlinks enabled by default and mitigate the vulnerability."}]},{"artifact":{"id":"51d266c9454a8e0b","cpes":["cpe:2.3:a:glibc-2.44-locale-posix:glibc-2.44-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-2.44-locale-posix:glibc_2.44_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_2.44_locale_posix:glibc-2.44-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_2.44_locale_posix:glibc_2.44_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-2.44-locale-posix:glibc-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-2.44-locale-posix:glibc_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-locale-posix:glibc-2.44-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-locale-posix:glibc_2.44_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_2.44_locale_posix:glibc-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_2.44_locale_posix:glibc_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_locale_posix:glibc-2.44-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_locale_posix:glibc_2.44_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-2.44-locale:glibc-2.44-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-2.44-locale:glibc_2.44_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_2.44_locale:glibc-2.44-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_2.44_locale:glibc_2.44_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-locale-posix:glibc-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-locale-posix:glibc_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_locale_posix:glibc-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_locale_posix:glibc_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-2.44-locale:glibc-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-2.44-locale:glibc_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-locale:glibc-2.44-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-locale:glibc_2.44_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_2.44_locale:glibc-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_2.44_locale:glibc_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_locale:glibc-2.44-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_locale:glibc_2.44_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-2.44:glibc-2.44-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-2.44:glibc_2.44_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_2.44:glibc-2.44-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_2.44:glibc_2.44_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-locale:glibc-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-locale:glibc_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_locale:glibc-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_locale:glibc_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-2.44:glibc-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-2.44:glibc_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc-2.44-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc_2.44_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_2.44:glibc-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_2.44:glibc_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc_locale_posix:2.44-r7:*:*:*:*:*:*:*"],"name":"glibc-2.44-locale-posix","purl":"pkg:apk/wolfi/glibc-2.44-locale-posix@2.44-r7?arch=x86_64&distro=wolfi-20230201&upstream=glibc-2.44","type":"apk","version":"2.44-r7","language":"","licenses":["LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/locale"},{"path":"/usr/lib/locale/C.utf8"},{"path":"/usr/lib/locale/C.utf8/LC_ADDRESS"},{"path":"/usr/lib/locale/C.utf8/LC_COLLATE"},{"path":"/usr/lib/locale/C.utf8/LC_CTYPE"},{"path":"/usr/lib/locale/C.utf8/LC_IDENTIFICATION"},{"path":"/usr/lib/locale/C.utf8/LC_MEASUREMENT"},{"path":"/usr/lib/locale/C.utf8/LC_MONETARY"},{"path":"/usr/lib/locale/C.utf8/LC_NAME"},{"path":"/usr/lib/locale/C.utf8/LC_NUMERIC"},{"path":"/usr/lib/locale/C.utf8/LC_PAPER"},{"path":"/usr/lib/locale/C.utf8/LC_TELEPHONE"},{"path":"/usr/lib/locale/C.utf8/LC_TIME"},{"path":"/usr/lib/locale/C.utf8/LC_MESSAGES"},{"path":"/usr/lib/locale/C.utf8/LC_MESSAGES/SYS_LC_MESSAGES"},{"path":"/var"},{"path":"/var/lib"},{"path":"/var/lib/db"},{"path":"/var/lib/db/sbom"},{"path":"/var/lib/db/sbom/glibc-2.44-locale-posix-2.44-r7.spdx.json"}]},"locations":[{"path":"/usr/lib/apk/db/installed","layerID":"sha256:bf84f94c00fddd623f1dd0efa62768f7cc8da64535000bd88cc59d3040dbc798","accessPath":"/usr/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"glibc-2.44"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.44-r8"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86805","versionConstraint":"< 2.44-r8 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"wolfi","version":"20230201"},"package":{"name":"glibc-2.44","version":"2.44-r7"},"namespace":"wolfi:distro:wolfi:rolling"}}],"vulnerability":{"id":"CVE-2026-86805","fix":{"state":"fixed","versions":["2.44-r8"],"available":[{"date":"2026-10-08","kind":"first-observed","version":"2.44-r8"}]},"cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:L","metrics":{"baseScore":6.3,"impactScore":5.5,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86805","cwe":"CWE-367","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-86805","date":"2026-10-19","epss":0.00097,"percentile":0.00679}],"risk":0.054805,"urls":[],"severity":"Medium","namespace":"wolfi:distro:wolfi:rolling","advisories":[],"dataSource":"https://images.chainguard.dev/security/CVE-2026-86805"},"relatedVulnerabilities":[{"id":"CVE-2026-86805","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:L","metrics":{"baseScore":6.3,"impactScore":5.5,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86805","cwe":"CWE-367","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-86805","date":"2026-10-19","epss":0.00097,"percentile":0.00679}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34360","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0022"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86805","description":"A time-of-check to time-of-use (TOCTOU) race condition in the dynamic loader (ld.so) of the GNU C Library (glibc) versions 2.14 through 2.44 allows a local attacker to escalate privileges. When expanding $ORIGIN in DT_RPATH for setuid/setgid (AT_SECURE) programs, glibc validates the lexically normalized search path against the trusted directories but then opens the raw, un-normalized path. On systems where the Linux fs.protected_hardlinks sysctl is disabled, a local attacker who hard-links such a program into an attacker-controlled directory and wins a race to replace an intermediate path component with a symbolic link can direct the loader outside the trusted directory, causing it to load an attacker-controlled shared object and execute arbitrary code with the elevated privileges of the program.\n\nExploitation requires an installed setuid or setgid binary whose DT_RPATH uses $ORIGIN followed by \"..\" traversal that normalizes into a trusted directory, and the ability to hard-link that binary and win the race by swapping a path component for a symbolic link. Major Linux-based OS distributions ship with fs.protected_hardlinks enabled by default and mitigate the vulnerability."}]},{"artifact":{"id":"6f710cb77dbce45d","cpes":["cpe:2.3:a:ld-linux-2.44:ld-linux-2.44:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:ld-linux-2.44:ld_linux_2.44:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:ld_linux_2.44:ld-linux-2.44:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:ld_linux_2.44:ld_linux_2.44:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:ld-linux-2.44:ld-linux:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:ld-linux-2.44:ld_linux:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:ld-linux:ld-linux-2.44:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:ld-linux:ld_linux_2.44:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:ld_linux:ld-linux-2.44:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:ld_linux:ld_linux_2.44:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:ld_linux_2.44:ld-linux:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:ld_linux_2.44:ld_linux:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:ld-linux:ld-linux:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:ld-linux:ld_linux:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:ld_linux:ld-linux:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:ld_linux:ld_linux:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:ld:ld-linux-2.44:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:ld:ld_linux_2.44:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:ld:ld-linux:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:ld:ld_linux:2.44-r7:*:*:*:*:*:*:*"],"name":"ld-linux-2.44","purl":"pkg:apk/wolfi/ld-linux-2.44@2.44-r7?arch=x86_64&distro=wolfi-20230201&upstream=glibc-2.44","type":"apk","version":"2.44-r7","language":"","licenses":["LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/etc"},{"path":"/etc/ld.so.conf"},{"path":"/etc/ld.so.conf.d"},{"path":"/etc/ld.so.conf.d/libc.conf"},{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/ld-linux-x86-64.so.2"},{"path":"/var"},{"path":"/var/lib"},{"path":"/var/lib/db"},{"path":"/var/lib/db/sbom"},{"path":"/var/lib/db/sbom/ld-linux-2.44-2.44-r7.spdx.json"}]},"locations":[{"path":"/usr/lib/apk/db/installed","layerID":"sha256:bf84f94c00fddd623f1dd0efa62768f7cc8da64535000bd88cc59d3040dbc798","accessPath":"/usr/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"glibc-2.44"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.44-r8"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86805","versionConstraint":"< 2.44-r8 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"wolfi","version":"20230201"},"package":{"name":"glibc-2.44","version":"2.44-r7"},"namespace":"wolfi:distro:wolfi:rolling"}}],"vulnerability":{"id":"CVE-2026-86805","fix":{"state":"fixed","versions":["2.44-r8"],"available":[{"date":"2026-10-08","kind":"first-observed","version":"2.44-r8"}]},"cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:L","metrics":{"baseScore":6.3,"impactScore":5.5,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86805","cwe":"CWE-367","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-86805","date":"2026-10-19","epss":0.00097,"percentile":0.00679}],"risk":0.054805,"urls":[],"severity":"Medium","namespace":"wolfi:distro:wolfi:rolling","advisories":[],"dataSource":"https://images.chainguard.dev/security/CVE-2026-86805"},"relatedVulnerabilities":[{"id":"CVE-2026-86805","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:L","metrics":{"baseScore":6.3,"impactScore":5.5,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86805","cwe":"CWE-367","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-86805","date":"2026-10-19","epss":0.00097,"percentile":0.00679}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34360","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0022"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86805","description":"A time-of-check to time-of-use (TOCTOU) race condition in the dynamic loader (ld.so) of the GNU C Library (glibc) versions 2.14 through 2.44 allows a local attacker to escalate privileges. When expanding $ORIGIN in DT_RPATH for setuid/setgid (AT_SECURE) programs, glibc validates the lexically normalized search path against the trusted directories but then opens the raw, un-normalized path. On systems where the Linux fs.protected_hardlinks sysctl is disabled, a local attacker who hard-links such a program into an attacker-controlled directory and wins a race to replace an intermediate path component with a symbolic link can direct the loader outside the trusted directory, causing it to load an attacker-controlled shared object and execute arbitrary code with the elevated privileges of the program.\n\nExploitation requires an installed setuid or setgid binary whose DT_RPATH uses $ORIGIN followed by \"..\" traversal that normalizes into a trusted directory, and the ability to hard-link that binary and win the race by swapping a path component for a symbolic link. Major Linux-based OS distributions ship with fs.protected_hardlinks enabled by default and mitigate the vulnerability."}]},{"artifact":{"id":"0f9c6349371de084","cpes":["cpe:2.3:a:glibc-2.44:glibc-2.44:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-2.44:glibc_2.44:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_2.44:glibc-2.44:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_2.44:glibc_2.44:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-2.44:glibc:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc-2.44:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc_2.44:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_2.44:glibc:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:gnu:glibc-2.44:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:gnu:glibc_2.44:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:gnu:glibc:2.44-r7:*:*:*:*:*:*:*"],"name":"glibc-2.44","purl":"pkg:apk/wolfi/glibc-2.44@2.44-r7?arch=x86_64&distro=wolfi-20230201","type":"apk","version":"2.44-r7","language":"","licenses":["LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/etc"},{"path":"/etc/rpc"},{"path":"/etc/apk"},{"path":"/etc/apk/commit_hooks.d"},{"path":"/etc/apk/commit_hooks.d/ldconfig-commit.sh"},{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/ld.so"},{"path":"/usr/bin/ldconfig"},{"path":"/usr/lib"},{"path":"/usr/lib/libBrokenLocale.so.1"},{"path":"/usr/lib/libanl.so.1"},{"path":"/usr/lib/libc.so.6"},{"path":"/usr/lib/libc_malloc_debug.so.0"},{"path":"/usr/lib/libdl.so.2"},{"path":"/usr/lib/libm.so.6"},{"path":"/usr/lib/libmemusage.so"},{"path":"/usr/lib/libmvec.so.1"},{"path":"/usr/lib/libnsl.so.1"},{"path":"/usr/lib/libnss_compat.so.2"},{"path":"/usr/lib/libnss_dns.so.2"},{"path":"/usr/lib/libnss_files.so.2"},{"path":"/usr/lib/libpthread.so.0"},{"path":"/usr/lib/libresolv.so.2"},{"path":"/usr/lib/librt.so.1"},{"path":"/usr/lib/libthread_db.so.1"},{"path":"/usr/lib/libutil.so.1"},{"path":"/usr/lib/audit"},{"path":"/usr/lib/locale"},{"path":"/usr/share"},{"path":"/var"},{"path":"/var/lib"},{"path":"/var/lib/db"},{"path":"/var/lib/db/sbom"},{"path":"/var/lib/db/sbom/glibc-2.44-2.44-r7.spdx.json"}]},"locations":[{"path":"/usr/lib/apk/db/installed","layerID":"sha256:bf84f94c00fddd623f1dd0efa62768f7cc8da64535000bd88cc59d3040dbc798","accessPath":"/usr/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"glibc-2.44"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.44-r8"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-95818","versionConstraint":"< 2.44-r8 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"wolfi","version":"20230201"},"package":{"name":"glibc-2.44","version":"2.44-r7"},"namespace":"wolfi:distro:wolfi:rolling"}},{"fix":{"suggestedVersion":"2.44-r8"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-95818","versionConstraint":"< 2.44-r8 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"wolfi","version":"20230201"},"package":{"name":"glibc-2.44","version":"2.44-r7"},"namespace":"wolfi:distro:wolfi:rolling"}}],"vulnerability":{"id":"CVE-2026-95818","fix":{"state":"fixed","versions":["2.44-r8"],"available":[{"date":"2026-10-08","kind":"first-observed","version":"2.44-r8"}]},"cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":3.6,"impactScore":2.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95818","cwe":"CWE-121","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-95818","date":"2026-10-19","epss":0.00129,"percentile":0.02267}],"risk":0.04257,"urls":[],"severity":"Low","namespace":"wolfi:distro:wolfi:rolling","advisories":[],"dataSource":"https://images.chainguard.dev/security/CVE-2026-95818"},"relatedVulnerabilities":[{"id":"CVE-2026-95818","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":3.6,"impactScore":2.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95818","cwe":"CWE-121","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-95818","date":"2026-10-19","epss":0.00129,"percentile":0.02267}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34360","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0023"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-95818","description":"A stack-based buffer overflow in the dynamic loader (ld.so) of the GNU C Library (glibc) versions 2.14 through 2.44 allows a local attacker to crash or corrupt the memory of setuid/setgid (AT_SECURE) programs.\n\nWhen such a program's DT_RPATH or DT_RUNPATH begins with $ORIGIN and is followed by NUL or '/' the loader both reads past the end of the path buffer and writes past the end of a stack-allocated internal buffer. The corrupted loader stack can lead to a loader crash (denial of service) and limited disclosure of process memory."}]},{"artifact":{"id":"51d266c9454a8e0b","cpes":["cpe:2.3:a:glibc-2.44-locale-posix:glibc-2.44-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-2.44-locale-posix:glibc_2.44_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_2.44_locale_posix:glibc-2.44-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_2.44_locale_posix:glibc_2.44_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-2.44-locale-posix:glibc-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-2.44-locale-posix:glibc_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-locale-posix:glibc-2.44-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-locale-posix:glibc_2.44_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_2.44_locale_posix:glibc-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_2.44_locale_posix:glibc_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_locale_posix:glibc-2.44-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_locale_posix:glibc_2.44_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-2.44-locale:glibc-2.44-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-2.44-locale:glibc_2.44_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_2.44_locale:glibc-2.44-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_2.44_locale:glibc_2.44_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-locale-posix:glibc-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-locale-posix:glibc_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_locale_posix:glibc-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_locale_posix:glibc_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-2.44-locale:glibc-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-2.44-locale:glibc_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-locale:glibc-2.44-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-locale:glibc_2.44_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_2.44_locale:glibc-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_2.44_locale:glibc_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_locale:glibc-2.44-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_locale:glibc_2.44_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-2.44:glibc-2.44-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-2.44:glibc_2.44_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_2.44:glibc-2.44-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_2.44:glibc_2.44_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-locale:glibc-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-locale:glibc_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_locale:glibc-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_locale:glibc_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-2.44:glibc-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-2.44:glibc_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc-2.44-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc_2.44_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_2.44:glibc-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_2.44:glibc_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc_locale_posix:2.44-r7:*:*:*:*:*:*:*"],"name":"glibc-2.44-locale-posix","purl":"pkg:apk/wolfi/glibc-2.44-locale-posix@2.44-r7?arch=x86_64&distro=wolfi-20230201&upstream=glibc-2.44","type":"apk","version":"2.44-r7","language":"","licenses":["LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/locale"},{"path":"/usr/lib/locale/C.utf8"},{"path":"/usr/lib/locale/C.utf8/LC_ADDRESS"},{"path":"/usr/lib/locale/C.utf8/LC_COLLATE"},{"path":"/usr/lib/locale/C.utf8/LC_CTYPE"},{"path":"/usr/lib/locale/C.utf8/LC_IDENTIFICATION"},{"path":"/usr/lib/locale/C.utf8/LC_MEASUREMENT"},{"path":"/usr/lib/locale/C.utf8/LC_MONETARY"},{"path":"/usr/lib/locale/C.utf8/LC_NAME"},{"path":"/usr/lib/locale/C.utf8/LC_NUMERIC"},{"path":"/usr/lib/locale/C.utf8/LC_PAPER"},{"path":"/usr/lib/locale/C.utf8/LC_TELEPHONE"},{"path":"/usr/lib/locale/C.utf8/LC_TIME"},{"path":"/usr/lib/locale/C.utf8/LC_MESSAGES"},{"path":"/usr/lib/locale/C.utf8/LC_MESSAGES/SYS_LC_MESSAGES"},{"path":"/var"},{"path":"/var/lib"},{"path":"/var/lib/db"},{"path":"/var/lib/db/sbom"},{"path":"/var/lib/db/sbom/glibc-2.44-locale-posix-2.44-r7.spdx.json"}]},"locations":[{"path":"/usr/lib/apk/db/installed","layerID":"sha256:bf84f94c00fddd623f1dd0efa62768f7cc8da64535000bd88cc59d3040dbc798","accessPath":"/usr/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"glibc-2.44"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.44-r8"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-95818","versionConstraint":"< 2.44-r8 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"wolfi","version":"20230201"},"package":{"name":"glibc-2.44","version":"2.44-r7"},"namespace":"wolfi:distro:wolfi:rolling"}}],"vulnerability":{"id":"CVE-2026-95818","fix":{"state":"fixed","versions":["2.44-r8"],"available":[{"date":"2026-10-08","kind":"first-observed","version":"2.44-r8"}]},"cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":3.6,"impactScore":2.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95818","cwe":"CWE-121","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-95818","date":"2026-10-19","epss":0.00129,"percentile":0.02267}],"risk":0.04257,"urls":[],"severity":"Low","namespace":"wolfi:distro:wolfi:rolling","advisories":[],"dataSource":"https://images.chainguard.dev/security/CVE-2026-95818"},"relatedVulnerabilities":[{"id":"CVE-2026-95818","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":3.6,"impactScore":2.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95818","cwe":"CWE-121","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-95818","date":"2026-10-19","epss":0.00129,"percentile":0.02267}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34360","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0023"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-95818","description":"A stack-based buffer overflow in the dynamic loader (ld.so) of the GNU C Library (glibc) versions 2.14 through 2.44 allows a local attacker to crash or corrupt the memory of setuid/setgid (AT_SECURE) programs.\n\nWhen such a program's DT_RPATH or DT_RUNPATH begins with $ORIGIN and is followed by NUL or '/' the loader both reads past the end of the path buffer and writes past the end of a stack-allocated internal buffer. The corrupted loader stack can lead to a loader crash (denial of service) and limited disclosure of process memory."}]},{"artifact":{"id":"6f710cb77dbce45d","cpes":["cpe:2.3:a:ld-linux-2.44:ld-linux-2.44:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:ld-linux-2.44:ld_linux_2.44:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:ld_linux_2.44:ld-linux-2.44:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:ld_linux_2.44:ld_linux_2.44:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:ld-linux-2.44:ld-linux:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:ld-linux-2.44:ld_linux:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:ld-linux:ld-linux-2.44:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:ld-linux:ld_linux_2.44:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:ld_linux:ld-linux-2.44:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:ld_linux:ld_linux_2.44:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:ld_linux_2.44:ld-linux:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:ld_linux_2.44:ld_linux:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:ld-linux:ld-linux:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:ld-linux:ld_linux:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:ld_linux:ld-linux:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:ld_linux:ld_linux:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:ld:ld-linux-2.44:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:ld:ld_linux_2.44:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:ld:ld-linux:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:ld:ld_linux:2.44-r7:*:*:*:*:*:*:*"],"name":"ld-linux-2.44","purl":"pkg:apk/wolfi/ld-linux-2.44@2.44-r7?arch=x86_64&distro=wolfi-20230201&upstream=glibc-2.44","type":"apk","version":"2.44-r7","language":"","licenses":["LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/etc"},{"path":"/etc/ld.so.conf"},{"path":"/etc/ld.so.conf.d"},{"path":"/etc/ld.so.conf.d/libc.conf"},{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/ld-linux-x86-64.so.2"},{"path":"/var"},{"path":"/var/lib"},{"path":"/var/lib/db"},{"path":"/var/lib/db/sbom"},{"path":"/var/lib/db/sbom/ld-linux-2.44-2.44-r7.spdx.json"}]},"locations":[{"path":"/usr/lib/apk/db/installed","layerID":"sha256:bf84f94c00fddd623f1dd0efa62768f7cc8da64535000bd88cc59d3040dbc798","accessPath":"/usr/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"glibc-2.44"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.44-r8"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-95818","versionConstraint":"< 2.44-r8 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"wolfi","version":"20230201"},"package":{"name":"glibc-2.44","version":"2.44-r7"},"namespace":"wolfi:distro:wolfi:rolling"}}],"vulnerability":{"id":"CVE-2026-95818","fix":{"state":"fixed","versions":["2.44-r8"],"available":[{"date":"2026-10-08","kind":"first-observed","version":"2.44-r8"}]},"cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":3.6,"impactScore":2.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95818","cwe":"CWE-121","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-95818","date":"2026-10-19","epss":0.00129,"percentile":0.02267}],"risk":0.04257,"urls":[],"severity":"Low","namespace":"wolfi:distro:wolfi:rolling","advisories":[],"dataSource":"https://images.chainguard.dev/security/CVE-2026-95818"},"relatedVulnerabilities":[{"id":"CVE-2026-95818","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":3.6,"impactScore":2.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95818","cwe":"CWE-121","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-95818","date":"2026-10-19","epss":0.00129,"percentile":0.02267}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34360","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0023"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-95818","description":"A stack-based buffer overflow in the dynamic loader (ld.so) of the GNU C Library (glibc) versions 2.14 through 2.44 allows a local attacker to crash or corrupt the memory of setuid/setgid (AT_SECURE) programs.\n\nWhen such a program's DT_RPATH or DT_RUNPATH begins with $ORIGIN and is followed by NUL or '/' the loader both reads past the end of the path buffer and writes past the end of a stack-allocated internal buffer. The corrupted loader stack can lead to a loader crash (denial of service) and limited disclosure of process memory."}]},{"artifact":{"id":"0f9c6349371de084","cpes":["cpe:2.3:a:glibc-2.44:glibc-2.44:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-2.44:glibc_2.44:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_2.44:glibc-2.44:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_2.44:glibc_2.44:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-2.44:glibc:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc-2.44:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc_2.44:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_2.44:glibc:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:gnu:glibc-2.44:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:gnu:glibc_2.44:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:gnu:glibc:2.44-r7:*:*:*:*:*:*:*"],"name":"glibc-2.44","purl":"pkg:apk/wolfi/glibc-2.44@2.44-r7?arch=x86_64&distro=wolfi-20230201","type":"apk","version":"2.44-r7","language":"","licenses":["LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/etc"},{"path":"/etc/rpc"},{"path":"/etc/apk"},{"path":"/etc/apk/commit_hooks.d"},{"path":"/etc/apk/commit_hooks.d/ldconfig-commit.sh"},{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/ld.so"},{"path":"/usr/bin/ldconfig"},{"path":"/usr/lib"},{"path":"/usr/lib/libBrokenLocale.so.1"},{"path":"/usr/lib/libanl.so.1"},{"path":"/usr/lib/libc.so.6"},{"path":"/usr/lib/libc_malloc_debug.so.0"},{"path":"/usr/lib/libdl.so.2"},{"path":"/usr/lib/libm.so.6"},{"path":"/usr/lib/libmemusage.so"},{"path":"/usr/lib/libmvec.so.1"},{"path":"/usr/lib/libnsl.so.1"},{"path":"/usr/lib/libnss_compat.so.2"},{"path":"/usr/lib/libnss_dns.so.2"},{"path":"/usr/lib/libnss_files.so.2"},{"path":"/usr/lib/libpthread.so.0"},{"path":"/usr/lib/libresolv.so.2"},{"path":"/usr/lib/librt.so.1"},{"path":"/usr/lib/libthread_db.so.1"},{"path":"/usr/lib/libutil.so.1"},{"path":"/usr/lib/audit"},{"path":"/usr/lib/locale"},{"path":"/usr/share"},{"path":"/var"},{"path":"/var/lib"},{"path":"/var/lib/db"},{"path":"/var/lib/db/sbom"},{"path":"/var/lib/db/sbom/glibc-2.44-2.44-r7.spdx.json"}]},"locations":[{"path":"/usr/lib/apk/db/installed","layerID":"sha256:bf84f94c00fddd623f1dd0efa62768f7cc8da64535000bd88cc59d3040dbc798","accessPath":"/usr/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"glibc-2.44"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.44-r8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-fmf4-pr35-46c2","versionConstraint":"< 2.44-r8 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"wolfi","version":"20230201"},"package":{"name":"glibc-2.44","version":"2.44-r7"},"namespace":"wolfi:distro:wolfi:rolling"}},{"fix":{"suggestedVersion":"2.44-r8"},"type":"exact-indirect-match","found":{"vulnerabilityID":"GHSA-fmf4-pr35-46c2","versionConstraint":"< 2.44-r8 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"wolfi","version":"20230201"},"package":{"name":"glibc-2.44","version":"2.44-r7"},"namespace":"wolfi:distro:wolfi:rolling"}}],"vulnerability":{"id":"GHSA-fmf4-pr35-46c2","fix":{"state":"fixed","versions":["2.44-r8"],"available":[{"date":"2026-10-08","kind":"first-observed","version":"2.44-r8"}]},"cvss":[],"risk":0,"urls":[],"severity":"Unknown","namespace":"wolfi:distro:wolfi:rolling","advisories":[],"dataSource":"https://images.chainguard.dev/security/GHSA-fmf4-pr35-46c2"},"relatedVulnerabilities":[{"id":"GHSA-fmf4-pr35-46c2","cvss":[],"urls":[],"severity":"Unknown","namespace":"github:language:apk","dataSource":"github"}]},{"artifact":{"id":"0f9c6349371de084","cpes":["cpe:2.3:a:glibc-2.44:glibc-2.44:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-2.44:glibc_2.44:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_2.44:glibc-2.44:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_2.44:glibc_2.44:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-2.44:glibc:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc-2.44:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc_2.44:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_2.44:glibc:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:gnu:glibc-2.44:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:gnu:glibc_2.44:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:gnu:glibc:2.44-r7:*:*:*:*:*:*:*"],"name":"glibc-2.44","purl":"pkg:apk/wolfi/glibc-2.44@2.44-r7?arch=x86_64&distro=wolfi-20230201","type":"apk","version":"2.44-r7","language":"","licenses":["LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/etc"},{"path":"/etc/rpc"},{"path":"/etc/apk"},{"path":"/etc/apk/commit_hooks.d"},{"path":"/etc/apk/commit_hooks.d/ldconfig-commit.sh"},{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/ld.so"},{"path":"/usr/bin/ldconfig"},{"path":"/usr/lib"},{"path":"/usr/lib/libBrokenLocale.so.1"},{"path":"/usr/lib/libanl.so.1"},{"path":"/usr/lib/libc.so.6"},{"path":"/usr/lib/libc_malloc_debug.so.0"},{"path":"/usr/lib/libdl.so.2"},{"path":"/usr/lib/libm.so.6"},{"path":"/usr/lib/libmemusage.so"},{"path":"/usr/lib/libmvec.so.1"},{"path":"/usr/lib/libnsl.so.1"},{"path":"/usr/lib/libnss_compat.so.2"},{"path":"/usr/lib/libnss_dns.so.2"},{"path":"/usr/lib/libnss_files.so.2"},{"path":"/usr/lib/libpthread.so.0"},{"path":"/usr/lib/libresolv.so.2"},{"path":"/usr/lib/librt.so.1"},{"path":"/usr/lib/libthread_db.so.1"},{"path":"/usr/lib/libutil.so.1"},{"path":"/usr/lib/audit"},{"path":"/usr/lib/locale"},{"path":"/usr/share"},{"path":"/var"},{"path":"/var/lib"},{"path":"/var/lib/db"},{"path":"/var/lib/db/sbom"},{"path":"/var/lib/db/sbom/glibc-2.44-2.44-r7.spdx.json"}]},"locations":[{"path":"/usr/lib/apk/db/installed","layerID":"sha256:bf84f94c00fddd623f1dd0efa62768f7cc8da64535000bd88cc59d3040dbc798","accessPath":"/usr/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"glibc-2.44"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.44-r8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-gwqp-9qgw-c5pv","versionConstraint":"< 2.44-r8 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"wolfi","version":"20230201"},"package":{"name":"glibc-2.44","version":"2.44-r7"},"namespace":"wolfi:distro:wolfi:rolling"}},{"fix":{"suggestedVersion":"2.44-r8"},"type":"exact-indirect-match","found":{"vulnerabilityID":"GHSA-gwqp-9qgw-c5pv","versionConstraint":"< 2.44-r8 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"wolfi","version":"20230201"},"package":{"name":"glibc-2.44","version":"2.44-r7"},"namespace":"wolfi:distro:wolfi:rolling"}}],"vulnerability":{"id":"GHSA-gwqp-9qgw-c5pv","fix":{"state":"fixed","versions":["2.44-r8"],"available":[{"date":"2026-10-08","kind":"first-observed","version":"2.44-r8"}]},"cvss":[],"risk":0,"urls":[],"severity":"Unknown","namespace":"wolfi:distro:wolfi:rolling","advisories":[],"dataSource":"https://images.chainguard.dev/security/GHSA-gwqp-9qgw-c5pv"},"relatedVulnerabilities":[{"id":"GHSA-gwqp-9qgw-c5pv","cvss":[],"urls":[],"severity":"Unknown","namespace":"github:language:apk","dataSource":"github"}]},{"artifact":{"id":"0f9c6349371de084","cpes":["cpe:2.3:a:glibc-2.44:glibc-2.44:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-2.44:glibc_2.44:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_2.44:glibc-2.44:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_2.44:glibc_2.44:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-2.44:glibc:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc-2.44:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc_2.44:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_2.44:glibc:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:gnu:glibc-2.44:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:gnu:glibc_2.44:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:gnu:glibc:2.44-r7:*:*:*:*:*:*:*"],"name":"glibc-2.44","purl":"pkg:apk/wolfi/glibc-2.44@2.44-r7?arch=x86_64&distro=wolfi-20230201","type":"apk","version":"2.44-r7","language":"","licenses":["LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/etc"},{"path":"/etc/rpc"},{"path":"/etc/apk"},{"path":"/etc/apk/commit_hooks.d"},{"path":"/etc/apk/commit_hooks.d/ldconfig-commit.sh"},{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/ld.so"},{"path":"/usr/bin/ldconfig"},{"path":"/usr/lib"},{"path":"/usr/lib/libBrokenLocale.so.1"},{"path":"/usr/lib/libanl.so.1"},{"path":"/usr/lib/libc.so.6"},{"path":"/usr/lib/libc_malloc_debug.so.0"},{"path":"/usr/lib/libdl.so.2"},{"path":"/usr/lib/libm.so.6"},{"path":"/usr/lib/libmemusage.so"},{"path":"/usr/lib/libmvec.so.1"},{"path":"/usr/lib/libnsl.so.1"},{"path":"/usr/lib/libnss_compat.so.2"},{"path":"/usr/lib/libnss_dns.so.2"},{"path":"/usr/lib/libnss_files.so.2"},{"path":"/usr/lib/libpthread.so.0"},{"path":"/usr/lib/libresolv.so.2"},{"path":"/usr/lib/librt.so.1"},{"path":"/usr/lib/libthread_db.so.1"},{"path":"/usr/lib/libutil.so.1"},{"path":"/usr/lib/audit"},{"path":"/usr/lib/locale"},{"path":"/usr/share"},{"path":"/var"},{"path":"/var/lib"},{"path":"/var/lib/db"},{"path":"/var/lib/db/sbom"},{"path":"/var/lib/db/sbom/glibc-2.44-2.44-r7.spdx.json"}]},"locations":[{"path":"/usr/lib/apk/db/installed","layerID":"sha256:bf84f94c00fddd623f1dd0efa62768f7cc8da64535000bd88cc59d3040dbc798","accessPath":"/usr/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"glibc-2.44"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.44-r8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-h8x4-734c-9753","versionConstraint":"< 2.44-r8 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"wolfi","version":"20230201"},"package":{"name":"glibc-2.44","version":"2.44-r7"},"namespace":"wolfi:distro:wolfi:rolling"}},{"fix":{"suggestedVersion":"2.44-r8"},"type":"exact-indirect-match","found":{"vulnerabilityID":"GHSA-h8x4-734c-9753","versionConstraint":"< 2.44-r8 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"wolfi","version":"20230201"},"package":{"name":"glibc-2.44","version":"2.44-r7"},"namespace":"wolfi:distro:wolfi:rolling"}}],"vulnerability":{"id":"GHSA-h8x4-734c-9753","fix":{"state":"fixed","versions":["2.44-r8"],"available":[{"date":"2026-10-08","kind":"first-observed","version":"2.44-r8"}]},"cvss":[],"risk":0,"urls":[],"severity":"Unknown","namespace":"wolfi:distro:wolfi:rolling","advisories":[],"dataSource":"https://images.chainguard.dev/security/GHSA-h8x4-734c-9753"},"relatedVulnerabilities":[{"id":"GHSA-h8x4-734c-9753","cvss":[],"urls":[],"severity":"Unknown","namespace":"github:language:apk","dataSource":"github"}]},{"artifact":{"id":"0f9c6349371de084","cpes":["cpe:2.3:a:glibc-2.44:glibc-2.44:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-2.44:glibc_2.44:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_2.44:glibc-2.44:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_2.44:glibc_2.44:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-2.44:glibc:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc-2.44:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc_2.44:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_2.44:glibc:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:gnu:glibc-2.44:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:gnu:glibc_2.44:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:gnu:glibc:2.44-r7:*:*:*:*:*:*:*"],"name":"glibc-2.44","purl":"pkg:apk/wolfi/glibc-2.44@2.44-r7?arch=x86_64&distro=wolfi-20230201","type":"apk","version":"2.44-r7","language":"","licenses":["LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/etc"},{"path":"/etc/rpc"},{"path":"/etc/apk"},{"path":"/etc/apk/commit_hooks.d"},{"path":"/etc/apk/commit_hooks.d/ldconfig-commit.sh"},{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/ld.so"},{"path":"/usr/bin/ldconfig"},{"path":"/usr/lib"},{"path":"/usr/lib/libBrokenLocale.so.1"},{"path":"/usr/lib/libanl.so.1"},{"path":"/usr/lib/libc.so.6"},{"path":"/usr/lib/libc_malloc_debug.so.0"},{"path":"/usr/lib/libdl.so.2"},{"path":"/usr/lib/libm.so.6"},{"path":"/usr/lib/libmemusage.so"},{"path":"/usr/lib/libmvec.so.1"},{"path":"/usr/lib/libnsl.so.1"},{"path":"/usr/lib/libnss_compat.so.2"},{"path":"/usr/lib/libnss_dns.so.2"},{"path":"/usr/lib/libnss_files.so.2"},{"path":"/usr/lib/libpthread.so.0"},{"path":"/usr/lib/libresolv.so.2"},{"path":"/usr/lib/librt.so.1"},{"path":"/usr/lib/libthread_db.so.1"},{"path":"/usr/lib/libutil.so.1"},{"path":"/usr/lib/audit"},{"path":"/usr/lib/locale"},{"path":"/usr/share"},{"path":"/var"},{"path":"/var/lib"},{"path":"/var/lib/db"},{"path":"/var/lib/db/sbom"},{"path":"/var/lib/db/sbom/glibc-2.44-2.44-r7.spdx.json"}]},"locations":[{"path":"/usr/lib/apk/db/installed","layerID":"sha256:bf84f94c00fddd623f1dd0efa62768f7cc8da64535000bd88cc59d3040dbc798","accessPath":"/usr/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"glibc-2.44"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.44-r8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-qghr-qhfc-4hxp","versionConstraint":"< 2.44-r8 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"wolfi","version":"20230201"},"package":{"name":"glibc-2.44","version":"2.44-r7"},"namespace":"wolfi:distro:wolfi:rolling"}},{"fix":{"suggestedVersion":"2.44-r8"},"type":"exact-indirect-match","found":{"vulnerabilityID":"GHSA-qghr-qhfc-4hxp","versionConstraint":"< 2.44-r8 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"wolfi","version":"20230201"},"package":{"name":"glibc-2.44","version":"2.44-r7"},"namespace":"wolfi:distro:wolfi:rolling"}}],"vulnerability":{"id":"GHSA-qghr-qhfc-4hxp","fix":{"state":"fixed","versions":["2.44-r8"],"available":[{"date":"2026-10-08","kind":"first-observed","version":"2.44-r8"}]},"cvss":[],"risk":0,"urls":[],"severity":"Unknown","namespace":"wolfi:distro:wolfi:rolling","advisories":[],"dataSource":"https://images.chainguard.dev/security/GHSA-qghr-qhfc-4hxp"},"relatedVulnerabilities":[{"id":"GHSA-qghr-qhfc-4hxp","cvss":[],"urls":[],"severity":"Unknown","namespace":"github:language:apk","dataSource":"github"}]},{"artifact":{"id":"51d266c9454a8e0b","cpes":["cpe:2.3:a:glibc-2.44-locale-posix:glibc-2.44-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-2.44-locale-posix:glibc_2.44_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_2.44_locale_posix:glibc-2.44-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_2.44_locale_posix:glibc_2.44_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-2.44-locale-posix:glibc-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-2.44-locale-posix:glibc_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-locale-posix:glibc-2.44-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-locale-posix:glibc_2.44_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_2.44_locale_posix:glibc-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_2.44_locale_posix:glibc_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_locale_posix:glibc-2.44-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_locale_posix:glibc_2.44_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-2.44-locale:glibc-2.44-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-2.44-locale:glibc_2.44_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_2.44_locale:glibc-2.44-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_2.44_locale:glibc_2.44_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-locale-posix:glibc-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-locale-posix:glibc_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_locale_posix:glibc-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_locale_posix:glibc_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-2.44-locale:glibc-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-2.44-locale:glibc_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-locale:glibc-2.44-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-locale:glibc_2.44_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_2.44_locale:glibc-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_2.44_locale:glibc_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_locale:glibc-2.44-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_locale:glibc_2.44_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-2.44:glibc-2.44-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-2.44:glibc_2.44_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_2.44:glibc-2.44-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_2.44:glibc_2.44_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-locale:glibc-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-locale:glibc_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_locale:glibc-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_locale:glibc_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-2.44:glibc-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-2.44:glibc_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc-2.44-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc_2.44_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_2.44:glibc-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_2.44:glibc_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc_locale_posix:2.44-r7:*:*:*:*:*:*:*"],"name":"glibc-2.44-locale-posix","purl":"pkg:apk/wolfi/glibc-2.44-locale-posix@2.44-r7?arch=x86_64&distro=wolfi-20230201&upstream=glibc-2.44","type":"apk","version":"2.44-r7","language":"","licenses":["LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/locale"},{"path":"/usr/lib/locale/C.utf8"},{"path":"/usr/lib/locale/C.utf8/LC_ADDRESS"},{"path":"/usr/lib/locale/C.utf8/LC_COLLATE"},{"path":"/usr/lib/locale/C.utf8/LC_CTYPE"},{"path":"/usr/lib/locale/C.utf8/LC_IDENTIFICATION"},{"path":"/usr/lib/locale/C.utf8/LC_MEASUREMENT"},{"path":"/usr/lib/locale/C.utf8/LC_MONETARY"},{"path":"/usr/lib/locale/C.utf8/LC_NAME"},{"path":"/usr/lib/locale/C.utf8/LC_NUMERIC"},{"path":"/usr/lib/locale/C.utf8/LC_PAPER"},{"path":"/usr/lib/locale/C.utf8/LC_TELEPHONE"},{"path":"/usr/lib/locale/C.utf8/LC_TIME"},{"path":"/usr/lib/locale/C.utf8/LC_MESSAGES"},{"path":"/usr/lib/locale/C.utf8/LC_MESSAGES/SYS_LC_MESSAGES"},{"path":"/var"},{"path":"/var/lib"},{"path":"/var/lib/db"},{"path":"/var/lib/db/sbom"},{"path":"/var/lib/db/sbom/glibc-2.44-locale-posix-2.44-r7.spdx.json"}]},"locations":[{"path":"/usr/lib/apk/db/installed","layerID":"sha256:bf84f94c00fddd623f1dd0efa62768f7cc8da64535000bd88cc59d3040dbc798","accessPath":"/usr/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"glibc-2.44"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.44-r8"},"type":"exact-indirect-match","found":{"vulnerabilityID":"GHSA-fmf4-pr35-46c2","versionConstraint":"< 2.44-r8 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"wolfi","version":"20230201"},"package":{"name":"glibc-2.44","version":"2.44-r7"},"namespace":"wolfi:distro:wolfi:rolling"}}],"vulnerability":{"id":"GHSA-fmf4-pr35-46c2","fix":{"state":"fixed","versions":["2.44-r8"],"available":[{"date":"2026-10-08","kind":"first-observed","version":"2.44-r8"}]},"cvss":[],"risk":0,"urls":[],"severity":"Unknown","namespace":"wolfi:distro:wolfi:rolling","advisories":[],"dataSource":"https://images.chainguard.dev/security/GHSA-fmf4-pr35-46c2"},"relatedVulnerabilities":[{"id":"GHSA-fmf4-pr35-46c2","cvss":[],"urls":[],"severity":"Unknown","namespace":"github:language:apk","dataSource":"github"}]},{"artifact":{"id":"51d266c9454a8e0b","cpes":["cpe:2.3:a:glibc-2.44-locale-posix:glibc-2.44-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-2.44-locale-posix:glibc_2.44_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_2.44_locale_posix:glibc-2.44-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_2.44_locale_posix:glibc_2.44_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-2.44-locale-posix:glibc-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-2.44-locale-posix:glibc_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-locale-posix:glibc-2.44-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-locale-posix:glibc_2.44_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_2.44_locale_posix:glibc-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_2.44_locale_posix:glibc_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_locale_posix:glibc-2.44-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_locale_posix:glibc_2.44_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-2.44-locale:glibc-2.44-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-2.44-locale:glibc_2.44_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_2.44_locale:glibc-2.44-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_2.44_locale:glibc_2.44_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-locale-posix:glibc-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-locale-posix:glibc_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_locale_posix:glibc-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_locale_posix:glibc_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-2.44-locale:glibc-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-2.44-locale:glibc_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-locale:glibc-2.44-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-locale:glibc_2.44_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_2.44_locale:glibc-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_2.44_locale:glibc_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_locale:glibc-2.44-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_locale:glibc_2.44_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-2.44:glibc-2.44-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-2.44:glibc_2.44_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_2.44:glibc-2.44-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_2.44:glibc_2.44_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-locale:glibc-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-locale:glibc_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_locale:glibc-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_locale:glibc_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-2.44:glibc-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-2.44:glibc_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc-2.44-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc_2.44_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_2.44:glibc-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_2.44:glibc_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc_locale_posix:2.44-r7:*:*:*:*:*:*:*"],"name":"glibc-2.44-locale-posix","purl":"pkg:apk/wolfi/glibc-2.44-locale-posix@2.44-r7?arch=x86_64&distro=wolfi-20230201&upstream=glibc-2.44","type":"apk","version":"2.44-r7","language":"","licenses":["LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/locale"},{"path":"/usr/lib/locale/C.utf8"},{"path":"/usr/lib/locale/C.utf8/LC_ADDRESS"},{"path":"/usr/lib/locale/C.utf8/LC_COLLATE"},{"path":"/usr/lib/locale/C.utf8/LC_CTYPE"},{"path":"/usr/lib/locale/C.utf8/LC_IDENTIFICATION"},{"path":"/usr/lib/locale/C.utf8/LC_MEASUREMENT"},{"path":"/usr/lib/locale/C.utf8/LC_MONETARY"},{"path":"/usr/lib/locale/C.utf8/LC_NAME"},{"path":"/usr/lib/locale/C.utf8/LC_NUMERIC"},{"path":"/usr/lib/locale/C.utf8/LC_PAPER"},{"path":"/usr/lib/locale/C.utf8/LC_TELEPHONE"},{"path":"/usr/lib/locale/C.utf8/LC_TIME"},{"path":"/usr/lib/locale/C.utf8/LC_MESSAGES"},{"path":"/usr/lib/locale/C.utf8/LC_MESSAGES/SYS_LC_MESSAGES"},{"path":"/var"},{"path":"/var/lib"},{"path":"/var/lib/db"},{"path":"/var/lib/db/sbom"},{"path":"/var/lib/db/sbom/glibc-2.44-locale-posix-2.44-r7.spdx.json"}]},"locations":[{"path":"/usr/lib/apk/db/installed","layerID":"sha256:bf84f94c00fddd623f1dd0efa62768f7cc8da64535000bd88cc59d3040dbc798","accessPath":"/usr/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"glibc-2.44"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.44-r8"},"type":"exact-indirect-match","found":{"vulnerabilityID":"GHSA-gwqp-9qgw-c5pv","versionConstraint":"< 2.44-r8 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"wolfi","version":"20230201"},"package":{"name":"glibc-2.44","version":"2.44-r7"},"namespace":"wolfi:distro:wolfi:rolling"}}],"vulnerability":{"id":"GHSA-gwqp-9qgw-c5pv","fix":{"state":"fixed","versions":["2.44-r8"],"available":[{"date":"2026-10-08","kind":"first-observed","version":"2.44-r8"}]},"cvss":[],"risk":0,"urls":[],"severity":"Unknown","namespace":"wolfi:distro:wolfi:rolling","advisories":[],"dataSource":"https://images.chainguard.dev/security/GHSA-gwqp-9qgw-c5pv"},"relatedVulnerabilities":[{"id":"GHSA-gwqp-9qgw-c5pv","cvss":[],"urls":[],"severity":"Unknown","namespace":"github:language:apk","dataSource":"github"}]},{"artifact":{"id":"51d266c9454a8e0b","cpes":["cpe:2.3:a:glibc-2.44-locale-posix:glibc-2.44-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-2.44-locale-posix:glibc_2.44_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_2.44_locale_posix:glibc-2.44-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_2.44_locale_posix:glibc_2.44_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-2.44-locale-posix:glibc-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-2.44-locale-posix:glibc_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-locale-posix:glibc-2.44-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-locale-posix:glibc_2.44_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_2.44_locale_posix:glibc-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_2.44_locale_posix:glibc_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_locale_posix:glibc-2.44-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_locale_posix:glibc_2.44_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-2.44-locale:glibc-2.44-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-2.44-locale:glibc_2.44_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_2.44_locale:glibc-2.44-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_2.44_locale:glibc_2.44_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-locale-posix:glibc-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-locale-posix:glibc_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_locale_posix:glibc-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_locale_posix:glibc_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-2.44-locale:glibc-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-2.44-locale:glibc_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-locale:glibc-2.44-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-locale:glibc_2.44_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_2.44_locale:glibc-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_2.44_locale:glibc_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_locale:glibc-2.44-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_locale:glibc_2.44_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-2.44:glibc-2.44-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-2.44:glibc_2.44_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_2.44:glibc-2.44-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_2.44:glibc_2.44_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-locale:glibc-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-locale:glibc_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_locale:glibc-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_locale:glibc_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-2.44:glibc-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-2.44:glibc_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc-2.44-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc_2.44_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_2.44:glibc-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_2.44:glibc_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc_locale_posix:2.44-r7:*:*:*:*:*:*:*"],"name":"glibc-2.44-locale-posix","purl":"pkg:apk/wolfi/glibc-2.44-locale-posix@2.44-r7?arch=x86_64&distro=wolfi-20230201&upstream=glibc-2.44","type":"apk","version":"2.44-r7","language":"","licenses":["LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/locale"},{"path":"/usr/lib/locale/C.utf8"},{"path":"/usr/lib/locale/C.utf8/LC_ADDRESS"},{"path":"/usr/lib/locale/C.utf8/LC_COLLATE"},{"path":"/usr/lib/locale/C.utf8/LC_CTYPE"},{"path":"/usr/lib/locale/C.utf8/LC_IDENTIFICATION"},{"path":"/usr/lib/locale/C.utf8/LC_MEASUREMENT"},{"path":"/usr/lib/locale/C.utf8/LC_MONETARY"},{"path":"/usr/lib/locale/C.utf8/LC_NAME"},{"path":"/usr/lib/locale/C.utf8/LC_NUMERIC"},{"path":"/usr/lib/locale/C.utf8/LC_PAPER"},{"path":"/usr/lib/locale/C.utf8/LC_TELEPHONE"},{"path":"/usr/lib/locale/C.utf8/LC_TIME"},{"path":"/usr/lib/locale/C.utf8/LC_MESSAGES"},{"path":"/usr/lib/locale/C.utf8/LC_MESSAGES/SYS_LC_MESSAGES"},{"path":"/var"},{"path":"/var/lib"},{"path":"/var/lib/db"},{"path":"/var/lib/db/sbom"},{"path":"/var/lib/db/sbom/glibc-2.44-locale-posix-2.44-r7.spdx.json"}]},"locations":[{"path":"/usr/lib/apk/db/installed","layerID":"sha256:bf84f94c00fddd623f1dd0efa62768f7cc8da64535000bd88cc59d3040dbc798","accessPath":"/usr/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"glibc-2.44"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.44-r8"},"type":"exact-indirect-match","found":{"vulnerabilityID":"GHSA-h8x4-734c-9753","versionConstraint":"< 2.44-r8 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"wolfi","version":"20230201"},"package":{"name":"glibc-2.44","version":"2.44-r7"},"namespace":"wolfi:distro:wolfi:rolling"}}],"vulnerability":{"id":"GHSA-h8x4-734c-9753","fix":{"state":"fixed","versions":["2.44-r8"],"available":[{"date":"2026-10-08","kind":"first-observed","version":"2.44-r8"}]},"cvss":[],"risk":0,"urls":[],"severity":"Unknown","namespace":"wolfi:distro:wolfi:rolling","advisories":[],"dataSource":"https://images.chainguard.dev/security/GHSA-h8x4-734c-9753"},"relatedVulnerabilities":[{"id":"GHSA-h8x4-734c-9753","cvss":[],"urls":[],"severity":"Unknown","namespace":"github:language:apk","dataSource":"github"}]},{"artifact":{"id":"51d266c9454a8e0b","cpes":["cpe:2.3:a:glibc-2.44-locale-posix:glibc-2.44-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-2.44-locale-posix:glibc_2.44_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_2.44_locale_posix:glibc-2.44-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_2.44_locale_posix:glibc_2.44_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-2.44-locale-posix:glibc-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-2.44-locale-posix:glibc_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-locale-posix:glibc-2.44-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-locale-posix:glibc_2.44_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_2.44_locale_posix:glibc-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_2.44_locale_posix:glibc_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_locale_posix:glibc-2.44-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_locale_posix:glibc_2.44_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-2.44-locale:glibc-2.44-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-2.44-locale:glibc_2.44_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_2.44_locale:glibc-2.44-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_2.44_locale:glibc_2.44_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-locale-posix:glibc-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-locale-posix:glibc_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_locale_posix:glibc-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_locale_posix:glibc_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-2.44-locale:glibc-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-2.44-locale:glibc_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-locale:glibc-2.44-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-locale:glibc_2.44_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_2.44_locale:glibc-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_2.44_locale:glibc_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_locale:glibc-2.44-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_locale:glibc_2.44_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-2.44:glibc-2.44-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-2.44:glibc_2.44_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_2.44:glibc-2.44-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_2.44:glibc_2.44_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-locale:glibc-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-locale:glibc_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_locale:glibc-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_locale:glibc_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-2.44:glibc-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc-2.44:glibc_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc-2.44-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc_2.44_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_2.44:glibc-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc_2.44:glibc_locale_posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc-locale-posix:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:glibc:glibc_locale_posix:2.44-r7:*:*:*:*:*:*:*"],"name":"glibc-2.44-locale-posix","purl":"pkg:apk/wolfi/glibc-2.44-locale-posix@2.44-r7?arch=x86_64&distro=wolfi-20230201&upstream=glibc-2.44","type":"apk","version":"2.44-r7","language":"","licenses":["LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/locale"},{"path":"/usr/lib/locale/C.utf8"},{"path":"/usr/lib/locale/C.utf8/LC_ADDRESS"},{"path":"/usr/lib/locale/C.utf8/LC_COLLATE"},{"path":"/usr/lib/locale/C.utf8/LC_CTYPE"},{"path":"/usr/lib/locale/C.utf8/LC_IDENTIFICATION"},{"path":"/usr/lib/locale/C.utf8/LC_MEASUREMENT"},{"path":"/usr/lib/locale/C.utf8/LC_MONETARY"},{"path":"/usr/lib/locale/C.utf8/LC_NAME"},{"path":"/usr/lib/locale/C.utf8/LC_NUMERIC"},{"path":"/usr/lib/locale/C.utf8/LC_PAPER"},{"path":"/usr/lib/locale/C.utf8/LC_TELEPHONE"},{"path":"/usr/lib/locale/C.utf8/LC_TIME"},{"path":"/usr/lib/locale/C.utf8/LC_MESSAGES"},{"path":"/usr/lib/locale/C.utf8/LC_MESSAGES/SYS_LC_MESSAGES"},{"path":"/var"},{"path":"/var/lib"},{"path":"/var/lib/db"},{"path":"/var/lib/db/sbom"},{"path":"/var/lib/db/sbom/glibc-2.44-locale-posix-2.44-r7.spdx.json"}]},"locations":[{"path":"/usr/lib/apk/db/installed","layerID":"sha256:bf84f94c00fddd623f1dd0efa62768f7cc8da64535000bd88cc59d3040dbc798","accessPath":"/usr/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"glibc-2.44"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.44-r8"},"type":"exact-indirect-match","found":{"vulnerabilityID":"GHSA-qghr-qhfc-4hxp","versionConstraint":"< 2.44-r8 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"wolfi","version":"20230201"},"package":{"name":"glibc-2.44","version":"2.44-r7"},"namespace":"wolfi:distro:wolfi:rolling"}}],"vulnerability":{"id":"GHSA-qghr-qhfc-4hxp","fix":{"state":"fixed","versions":["2.44-r8"],"available":[{"date":"2026-10-08","kind":"first-observed","version":"2.44-r8"}]},"cvss":[],"risk":0,"urls":[],"severity":"Unknown","namespace":"wolfi:distro:wolfi:rolling","advisories":[],"dataSource":"https://images.chainguard.dev/security/GHSA-qghr-qhfc-4hxp"},"relatedVulnerabilities":[{"id":"GHSA-qghr-qhfc-4hxp","cvss":[],"urls":[],"severity":"Unknown","namespace":"github:language:apk","dataSource":"github"}]},{"artifact":{"id":"6f710cb77dbce45d","cpes":["cpe:2.3:a:ld-linux-2.44:ld-linux-2.44:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:ld-linux-2.44:ld_linux_2.44:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:ld_linux_2.44:ld-linux-2.44:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:ld_linux_2.44:ld_linux_2.44:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:ld-linux-2.44:ld-linux:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:ld-linux-2.44:ld_linux:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:ld-linux:ld-linux-2.44:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:ld-linux:ld_linux_2.44:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:ld_linux:ld-linux-2.44:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:ld_linux:ld_linux_2.44:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:ld_linux_2.44:ld-linux:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:ld_linux_2.44:ld_linux:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:ld-linux:ld-linux:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:ld-linux:ld_linux:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:ld_linux:ld-linux:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:ld_linux:ld_linux:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:ld:ld-linux-2.44:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:ld:ld_linux_2.44:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:ld:ld-linux:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:ld:ld_linux:2.44-r7:*:*:*:*:*:*:*"],"name":"ld-linux-2.44","purl":"pkg:apk/wolfi/ld-linux-2.44@2.44-r7?arch=x86_64&distro=wolfi-20230201&upstream=glibc-2.44","type":"apk","version":"2.44-r7","language":"","licenses":["LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/etc"},{"path":"/etc/ld.so.conf"},{"path":"/etc/ld.so.conf.d"},{"path":"/etc/ld.so.conf.d/libc.conf"},{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/ld-linux-x86-64.so.2"},{"path":"/var"},{"path":"/var/lib"},{"path":"/var/lib/db"},{"path":"/var/lib/db/sbom"},{"path":"/var/lib/db/sbom/ld-linux-2.44-2.44-r7.spdx.json"}]},"locations":[{"path":"/usr/lib/apk/db/installed","layerID":"sha256:bf84f94c00fddd623f1dd0efa62768f7cc8da64535000bd88cc59d3040dbc798","accessPath":"/usr/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"glibc-2.44"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.44-r8"},"type":"exact-indirect-match","found":{"vulnerabilityID":"GHSA-fmf4-pr35-46c2","versionConstraint":"< 2.44-r8 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"wolfi","version":"20230201"},"package":{"name":"glibc-2.44","version":"2.44-r7"},"namespace":"wolfi:distro:wolfi:rolling"}}],"vulnerability":{"id":"GHSA-fmf4-pr35-46c2","fix":{"state":"fixed","versions":["2.44-r8"],"available":[{"date":"2026-10-08","kind":"first-observed","version":"2.44-r8"}]},"cvss":[],"risk":0,"urls":[],"severity":"Unknown","namespace":"wolfi:distro:wolfi:rolling","advisories":[],"dataSource":"https://images.chainguard.dev/security/GHSA-fmf4-pr35-46c2"},"relatedVulnerabilities":[{"id":"GHSA-fmf4-pr35-46c2","cvss":[],"urls":[],"severity":"Unknown","namespace":"github:language:apk","dataSource":"github"}]},{"artifact":{"id":"6f710cb77dbce45d","cpes":["cpe:2.3:a:ld-linux-2.44:ld-linux-2.44:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:ld-linux-2.44:ld_linux_2.44:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:ld_linux_2.44:ld-linux-2.44:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:ld_linux_2.44:ld_linux_2.44:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:ld-linux-2.44:ld-linux:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:ld-linux-2.44:ld_linux:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:ld-linux:ld-linux-2.44:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:ld-linux:ld_linux_2.44:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:ld_linux:ld-linux-2.44:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:ld_linux:ld_linux_2.44:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:ld_linux_2.44:ld-linux:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:ld_linux_2.44:ld_linux:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:ld-linux:ld-linux:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:ld-linux:ld_linux:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:ld_linux:ld-linux:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:ld_linux:ld_linux:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:ld:ld-linux-2.44:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:ld:ld_linux_2.44:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:ld:ld-linux:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:ld:ld_linux:2.44-r7:*:*:*:*:*:*:*"],"name":"ld-linux-2.44","purl":"pkg:apk/wolfi/ld-linux-2.44@2.44-r7?arch=x86_64&distro=wolfi-20230201&upstream=glibc-2.44","type":"apk","version":"2.44-r7","language":"","licenses":["LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/etc"},{"path":"/etc/ld.so.conf"},{"path":"/etc/ld.so.conf.d"},{"path":"/etc/ld.so.conf.d/libc.conf"},{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/ld-linux-x86-64.so.2"},{"path":"/var"},{"path":"/var/lib"},{"path":"/var/lib/db"},{"path":"/var/lib/db/sbom"},{"path":"/var/lib/db/sbom/ld-linux-2.44-2.44-r7.spdx.json"}]},"locations":[{"path":"/usr/lib/apk/db/installed","layerID":"sha256:bf84f94c00fddd623f1dd0efa62768f7cc8da64535000bd88cc59d3040dbc798","accessPath":"/usr/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"glibc-2.44"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.44-r8"},"type":"exact-indirect-match","found":{"vulnerabilityID":"GHSA-gwqp-9qgw-c5pv","versionConstraint":"< 2.44-r8 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"wolfi","version":"20230201"},"package":{"name":"glibc-2.44","version":"2.44-r7"},"namespace":"wolfi:distro:wolfi:rolling"}}],"vulnerability":{"id":"GHSA-gwqp-9qgw-c5pv","fix":{"state":"fixed","versions":["2.44-r8"],"available":[{"date":"2026-10-08","kind":"first-observed","version":"2.44-r8"}]},"cvss":[],"risk":0,"urls":[],"severity":"Unknown","namespace":"wolfi:distro:wolfi:rolling","advisories":[],"dataSource":"https://images.chainguard.dev/security/GHSA-gwqp-9qgw-c5pv"},"relatedVulnerabilities":[{"id":"GHSA-gwqp-9qgw-c5pv","cvss":[],"urls":[],"severity":"Unknown","namespace":"github:language:apk","dataSource":"github"}]},{"artifact":{"id":"6f710cb77dbce45d","cpes":["cpe:2.3:a:ld-linux-2.44:ld-linux-2.44:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:ld-linux-2.44:ld_linux_2.44:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:ld_linux_2.44:ld-linux-2.44:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:ld_linux_2.44:ld_linux_2.44:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:ld-linux-2.44:ld-linux:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:ld-linux-2.44:ld_linux:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:ld-linux:ld-linux-2.44:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:ld-linux:ld_linux_2.44:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:ld_linux:ld-linux-2.44:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:ld_linux:ld_linux_2.44:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:ld_linux_2.44:ld-linux:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:ld_linux_2.44:ld_linux:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:ld-linux:ld-linux:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:ld-linux:ld_linux:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:ld_linux:ld-linux:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:ld_linux:ld_linux:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:ld:ld-linux-2.44:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:ld:ld_linux_2.44:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:ld:ld-linux:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:ld:ld_linux:2.44-r7:*:*:*:*:*:*:*"],"name":"ld-linux-2.44","purl":"pkg:apk/wolfi/ld-linux-2.44@2.44-r7?arch=x86_64&distro=wolfi-20230201&upstream=glibc-2.44","type":"apk","version":"2.44-r7","language":"","licenses":["LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/etc"},{"path":"/etc/ld.so.conf"},{"path":"/etc/ld.so.conf.d"},{"path":"/etc/ld.so.conf.d/libc.conf"},{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/ld-linux-x86-64.so.2"},{"path":"/var"},{"path":"/var/lib"},{"path":"/var/lib/db"},{"path":"/var/lib/db/sbom"},{"path":"/var/lib/db/sbom/ld-linux-2.44-2.44-r7.spdx.json"}]},"locations":[{"path":"/usr/lib/apk/db/installed","layerID":"sha256:bf84f94c00fddd623f1dd0efa62768f7cc8da64535000bd88cc59d3040dbc798","accessPath":"/usr/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"glibc-2.44"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.44-r8"},"type":"exact-indirect-match","found":{"vulnerabilityID":"GHSA-h8x4-734c-9753","versionConstraint":"< 2.44-r8 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"wolfi","version":"20230201"},"package":{"name":"glibc-2.44","version":"2.44-r7"},"namespace":"wolfi:distro:wolfi:rolling"}}],"vulnerability":{"id":"GHSA-h8x4-734c-9753","fix":{"state":"fixed","versions":["2.44-r8"],"available":[{"date":"2026-10-08","kind":"first-observed","version":"2.44-r8"}]},"cvss":[],"risk":0,"urls":[],"severity":"Unknown","namespace":"wolfi:distro:wolfi:rolling","advisories":[],"dataSource":"https://images.chainguard.dev/security/GHSA-h8x4-734c-9753"},"relatedVulnerabilities":[{"id":"GHSA-h8x4-734c-9753","cvss":[],"urls":[],"severity":"Unknown","namespace":"github:language:apk","dataSource":"github"}]},{"artifact":{"id":"6f710cb77dbce45d","cpes":["cpe:2.3:a:ld-linux-2.44:ld-linux-2.44:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:ld-linux-2.44:ld_linux_2.44:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:ld_linux_2.44:ld-linux-2.44:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:ld_linux_2.44:ld_linux_2.44:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:ld-linux-2.44:ld-linux:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:ld-linux-2.44:ld_linux:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:ld-linux:ld-linux-2.44:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:ld-linux:ld_linux_2.44:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:ld_linux:ld-linux-2.44:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:ld_linux:ld_linux_2.44:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:ld_linux_2.44:ld-linux:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:ld_linux_2.44:ld_linux:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:ld-linux:ld-linux:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:ld-linux:ld_linux:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:ld_linux:ld-linux:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:ld_linux:ld_linux:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:ld:ld-linux-2.44:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:ld:ld_linux_2.44:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:ld:ld-linux:2.44-r7:*:*:*:*:*:*:*","cpe:2.3:a:ld:ld_linux:2.44-r7:*:*:*:*:*:*:*"],"name":"ld-linux-2.44","purl":"pkg:apk/wolfi/ld-linux-2.44@2.44-r7?arch=x86_64&distro=wolfi-20230201&upstream=glibc-2.44","type":"apk","version":"2.44-r7","language":"","licenses":["LGPL-2.1-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/etc"},{"path":"/etc/ld.so.conf"},{"path":"/etc/ld.so.conf.d"},{"path":"/etc/ld.so.conf.d/libc.conf"},{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/ld-linux-x86-64.so.2"},{"path":"/var"},{"path":"/var/lib"},{"path":"/var/lib/db"},{"path":"/var/lib/db/sbom"},{"path":"/var/lib/db/sbom/ld-linux-2.44-2.44-r7.spdx.json"}]},"locations":[{"path":"/usr/lib/apk/db/installed","layerID":"sha256:bf84f94c00fddd623f1dd0efa62768f7cc8da64535000bd88cc59d3040dbc798","accessPath":"/usr/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"glibc-2.44"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.44-r8"},"type":"exact-indirect-match","found":{"vulnerabilityID":"GHSA-qghr-qhfc-4hxp","versionConstraint":"< 2.44-r8 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"wolfi","version":"20230201"},"package":{"name":"glibc-2.44","version":"2.44-r7"},"namespace":"wolfi:distro:wolfi:rolling"}}],"vulnerability":{"id":"GHSA-qghr-qhfc-4hxp","fix":{"state":"fixed","versions":["2.44-r8"],"available":[{"date":"2026-10-08","kind":"first-observed","version":"2.44-r8"}]},"cvss":[],"risk":0,"urls":[],"severity":"Unknown","namespace":"wolfi:distro:wolfi:rolling","advisories":[],"dataSource":"https://images.chainguard.dev/security/GHSA-qghr-qhfc-4hxp"},"relatedVulnerabilities":[{"id":"GHSA-qghr-qhfc-4hxp","cvss":[],"urls":[],"severity":"Unknown","namespace":"github:language:apk","dataSource":"github"}]}],"grade":"A","score":"100.00","as_of":"2026-10-20T21:43:11.795Z","grype_db_version":"2026-10-20T06:29:49.000Z"}