{"grype_matches":[{"artifact":{"id":"d0cde0db5ca89a50","cpes":["cpe:2.3:a:microsoft:go-ntlmssp:v0.0.0-20200615164410-66371956d46c:*:*:*:*:go:*:*"],"name":"github.com/Azure/go-ntlmssp","purl":"pkg:golang/github.com/Azure/go-ntlmssp@v0.0.0-20200615164410-66371956d46c","type":"go-module","version":"v0.0.0-20200615164410-66371956d46c","language":"go","licenses":[],"metadata":{"h1Digest":"h1:/IBSNwUN8+eKzUzbJPqhK839ygXJ82sde8x3ogr6R28=","mainModule":"github.com/opentofu/opentofu","architecture":"amd64","goCompiledVersion":"go1.26.6"},"locations":[{"path":"/usr/local/bin/tofu","layerID":"sha256:02f497acae86193b675d599c46408e811e414a5a4487f7551c45fa616bf5d716","accessPath":"/usr/local/bin/tofu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0.1.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-pjcq-xvwq-hhpj","versionConstraint":"<0.1.1 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"github.com/Azure/go-ntlmssp","version":"v0.0.0-20200615164410-66371956d46c"},"language":"go","namespace":"github:language:go"}}],"vulnerability":{"id":"GHSA-pjcq-xvwq-hhpj","fix":{"state":"fixed","versions":["0.1.1"],"available":[{"date":"2026-04-24","kind":"first-observed","version":"0.1.1"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-32952","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-32952","date":"2026-10-08","epss":0.01467,"percentile":0.72915}],"risk":0.7555050000000001,"urls":["https://github.com/Azure/go-ntlmssp/security/advisories/GHSA-pjcq-xvwq-hhpj","https://github.com/Azure/go-ntlmssp/releases/tag/v0.1.1","https://nvd.nist.gov/vuln/detail/CVE-2026-32952"],"severity":"Medium","namespace":"github:language:go","advisories":[],"dataSource":"https://github.com/advisories/GHSA-pjcq-xvwq-hhpj","description":"go-ntlmssp NTLM challenges can panic on malformed payloads"},"relatedVulnerabilities":[{"id":"CVE-2026-32952","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-32952","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-32952","date":"2026-10-08","epss":0.01467,"percentile":0.72915}],"urls":["https://github.com/Azure/go-ntlmssp/releases/tag/v0.1.1","https://github.com/Azure/go-ntlmssp/security/advisories/GHSA-pjcq-xvwq-hhpj"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-32952","description":"go-ntlmssp is a Go package that provides NTLM/Negotiate authentication over HTTP. Prior to version 0.1.1, a malicious NTLM challenge message can causes an slice out of bounds panic, which can crash any Go process using `ntlmssp.Negotiator` as an HTTP transport. Version 0.1.1 patches the issue."}]},{"artifact":{"id":"ee0af0d7b3316b73","cpes":["cpe:2.3:a:nghttp2-libs:nghttp2-libs:1.62.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:nghttp2-libs:nghttp2_libs:1.62.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:nghttp2_libs:nghttp2-libs:1.62.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:nghttp2_libs:nghttp2_libs:1.62.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:nghttp-libs:nghttp2-libs:1.62.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:nghttp-libs:nghttp2_libs:1.62.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:nghttp2-libs:nghttp-libs:1.62.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:nghttp2-libs:nghttp_libs:1.62.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:nghttp2_libs:nghttp-libs:1.62.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:nghttp2_libs:nghttp_libs:1.62.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:nghttp_libs:nghttp2-libs:1.62.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:nghttp_libs:nghttp2_libs:1.62.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:nghttp-libs:nghttp-libs:1.62.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:nghttp-libs:nghttp_libs:1.62.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:nghttp_libs:nghttp-libs:1.62.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:nghttp_libs:nghttp_libs:1.62.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:nghttp2:nghttp2-libs:1.62.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:nghttp2:nghttp2_libs:1.62.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:nghttp2:nghttp-libs:1.62.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:nghttp2:nghttp_libs:1.62.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:nghttp:nghttp2-libs:1.62.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:nghttp:nghttp2_libs:1.62.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:nghttp:nghttp-libs:1.62.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:nghttp:nghttp_libs:1.62.1-r0:*:*:*:*:*:*:*"],"name":"nghttp2-libs","purl":"pkg:apk/alpine/nghttp2-libs@1.62.1-r0?arch=x86_64&distro=alpine-3.20.10&upstream=nghttp2","type":"apk","version":"1.62.1-r0","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libnghttp2.so.14"},{"path":"/usr/lib/libnghttp2.so.14.28.1"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:4ca39b9c4f6154203448400fd6deaa60170b5fed62c4ba1fc19251fe483f44a2","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"nghttp2"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:nghttp2:nghttp2:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-27135","versionConstraint":"< 1.68.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:nghttp2:nghttp2:1.62.1:*:*:*:*:*:*:*"],"package":{"name":"nghttp2","version":"1.62.1-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-27135","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-27135","cwe":"CWE-617","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-27135","cwe":"CWE-617","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-27135","date":"2026-10-08","epss":0.00892,"percentile":0.58186}],"risk":0.669,"urls":["https://github.com/nghttp2/nghttp2/commit/5c7df8fa815ac1004d9ecb9d1f7595c4d37f46e1","https://github.com/nghttp2/nghttp2/security/advisories/GHSA-6933-cjhr-5qg6","http://www.openwall.com/lists/oss-security/2026/03/20/3","https://lists.debian.org/debian-lts-announce/2026/05/msg00025.html","https://access.redhat.com/errata/RHSA-2026:10065","https://access.redhat.com/errata/RHSA-2026:11768","https://access.redhat.com/errata/RHSA-2026:13812","https://access.redhat.com/errata/RHSA-2026:14773","https://access.redhat.com/errata/RHSA-2026:14937","https://access.redhat.com/errata/RHSA-2026:15087","https://access.redhat.com/errata/RHSA-2026:16008","https://access.redhat.com/errata/RHSA-2026:16009","https://access.redhat.com/errata/RHSA-2026:16030","https://access.redhat.com/errata/RHSA-2026:16174","https://access.redhat.com/errata/RHSA-2026:17596","https://access.redhat.com/errata/RHSA-2026:19724","https://access.redhat.com/errata/RHSA-2026:19725","https://access.redhat.com/errata/RHSA-2026:20040","https://access.redhat.com/errata/RHSA-2026:20087","https://access.redhat.com/errata/RHSA-2026:21656","https://access.redhat.com/errata/RHSA-2026:21690","https://access.redhat.com/errata/RHSA-2026:21695","https://access.redhat.com/errata/RHSA-2026:25096","https://access.redhat.com/errata/RHSA-2026:27200","https://access.redhat.com/errata/RHSA-2026:27201","https://access.redhat.com/errata/RHSA-2026:6190","https://access.redhat.com/errata/RHSA-2026:7080","https://access.redhat.com/errata/RHSA-2026:7123","https://access.redhat.com/errata/RHSA-2026:7302","https://access.redhat.com/errata/RHSA-2026:7310","https://access.redhat.com/errata/RHSA-2026:7350","https://access.redhat.com/errata/RHSA-2026:7666","https://access.redhat.com/errata/RHSA-2026:7667","https://access.redhat.com/errata/RHSA-2026:7668","https://access.redhat.com/errata/RHSA-2026:7670","https://access.redhat.com/errata/RHSA-2026:7675","https://access.redhat.com/errata/RHSA-2026:7896","https://access.redhat.com/errata/RHSA-2026:7983","https://access.redhat.com/errata/RHSA-2026:8339","https://access.redhat.com/errata/RHSA-2026:8538","https://access.redhat.com/errata/RHSA-2026:8539","https://access.redhat.com/errata/RHSA-2026:8540","https://access.redhat.com/errata/RHSA-2026:8541","https://access.redhat.com/errata/RHSA-2026:8545","https://access.redhat.com/errata/RHSA-2026:8546","https://access.redhat.com/errata/RHSA-2026:8547","https://access.redhat.com/errata/RHSA-2026:8548","https://access.redhat.com/errata/RHSA-2026:8868","https://access.redhat.com/errata/RHSA-2026:9711","https://access.redhat.com/errata/RHSA-2026:9832","https://access.redhat.com/errata/RHSA-2026:9874","https://access.redhat.com/security/cve/CVE-2026-27135","https://bugzilla.redhat.com/show_bug.cgi?id=2448754","https://cert-portal.siemens.com/productcert/html/ssa-019113.html","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27135.json"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-27135","description":"nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. Prior to version 1.68.1, the nghttp2 library stops reading the incoming data when user facing public API `nghttp2_session_terminate_session` or `nghttp2_session_terminate_session2` is called by the application. They might be called internally by the library when it detects the situation that is subject to connection error. Due to the missing internal state validation, the library keeps reading the rest of the data after one of those APIs is called. Then receiving a malformed frame that causes FRAME_SIZE_ERROR causes assertion failure. nghttp2 v1.68.1 adds missing state validation to avoid assertion failure. No known workarounds are available."},"relatedVulnerabilities":[]},{"artifact":{"id":"a2f9753712cb5d88","cpes":["cpe:2.3:a:c-ares:c-ares:1.33.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:c-ares:c_ares:1.33.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:c_ares:c-ares:1.33.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:c_ares:c_ares:1.33.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:c:c-ares:1.33.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:c:c_ares:1.33.1-r0:*:*:*:*:*:*:*"],"name":"c-ares","purl":"pkg:apk/alpine/c-ares@1.33.1-r0?arch=x86_64&distro=alpine-3.20.10","type":"apk","version":"1.33.1-r0","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcares.so.2"},{"path":"/usr/lib/libcares.so.2.18.1"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:4ca39b9c4f6154203448400fd6deaa60170b5fed62c4ba1fc19251fe483f44a2","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"c-ares"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:c-ares:c-ares:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-33630","versionConstraint":">= 1.32.3, < 1.34.7 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:c-ares:c-ares:1.33.1:*:*:*:*:*:*:*"],"package":{"name":"c-ares","version":"1.33.1-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-33630","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-33630","cwe":"CWE-415","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-33630","cwe":"CWE-416","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-33630","date":"2026-10-08","epss":0.00845,"percentile":0.56706}],"risk":0.6337499999999999,"urls":["https://github.com/c-ares/c-ares/commit/1fa3b86a0b8d18fe7b60f3228a01d770feb026bc","https://github.com/c-ares/c-ares/commit/d823199b688052dcdc1646f2ab4cb8c16b1c644a","https://github.com/c-ares/c-ares/pull/1237","https://github.com/c-ares/c-ares/releases/tag/v1.34.7","https://github.com/c-ares/c-ares/security/advisories/GHSA-6wfj-rwm7-3542"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33630","description":"c-ares is an asynchronous resolver library. From ver 1.32.3 until 1.34.7, a use-after-free / double-free in c-ares' query-completion handling. The same flaw — a query's callback being invoked while the query is still linked in the channel's internal lookup structures — is present at multiple points in the resend/finish path (timeout handling, response handling, and query dispatch). If the query, or for ares_getaddrinfo() the owning host_query, is freed as a side effect of that callback, it is then accessed and/or freed a second time. This vulnerability is fixed in ver 1.34.7."},"relatedVulnerabilities":[]},{"artifact":{"id":"1c808f382e18132b","cpes":["cpe:2.3:a:linuxfoundation:oras:v2.6.1:*:*:*:*:go:*:*"],"name":"oras.land/oras-go/v2","purl":"pkg:golang/oras.land/oras-go/v2@v2.6.1","type":"go-module","version":"v2.6.1","language":"go","licenses":[],"metadata":{"h1Digest":"h1:bonOEkjLfp8tt6qXWRRWP6p1F+9octchOf2EqnWB4Zs=","mainModule":"github.com/opentofu/opentofu","architecture":"amd64","goCompiledVersion":"go1.26.6"},"locations":[{"path":"/usr/local/bin/tofu","layerID":"sha256:02f497acae86193b675d599c46408e811e414a5a4487f7551c45fa616bf5d716","accessPath":"/usr/local/bin/tofu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.6.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-m37j-52j7-pjw7","versionConstraint":"<=2.6.1 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"oras.land/oras-go/v2","version":"v2.6.1"},"language":"go","namespace":"github:language:go"}}],"vulnerability":{"id":"GHSA-m37j-52j7-pjw7","fix":{"state":"fixed","versions":["2.6.2"],"available":[{"date":"2026-09-18","kind":"first-observed","version":"2.6.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-85731","cwe":"CWE-22","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-85731","cwe":"CWE-59","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-85731","date":"2026-10-08","epss":0.00676,"percentile":0.50742}],"risk":0.5509400000000001,"urls":["https://github.com/oras-project/oras-go/security/advisories/GHSA-m37j-52j7-pjw7","https://nvd.nist.gov/vuln/detail/CVE-2026-85731","https://github.com/oras-project/oras-go/commit/adab2f25ea95ef4e6e41f50db9266a6701399422","https://github.com/oras-project/oras-go/releases/tag/v2.6.2"],"severity":"High","namespace":"github:language:go","advisories":[],"dataSource":"https://github.com/advisories/GHSA-m37j-52j7-pjw7","description":"oras-go: Arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction (pushDir)"},"relatedVulnerabilities":[{"id":"CVE-2026-85731","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-85731","cwe":"CWE-22","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-85731","cwe":"CWE-59","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-85731","date":"2026-10-08","epss":0.00676,"percentile":0.50742}],"urls":["https://github.com/oras-project/oras-go/commit/adab2f25ea95ef4e6e41f50db9266a6701399422","https://github.com/oras-project/oras-go/releases/tag/v2.6.2","https://github.com/oras-project/oras-go/security/advisories/GHSA-m37j-52j7-pjw7"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-85731","description":"oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, content/file.Store extraction of OCI layers marked with io.deis.oras.content.unpack=true can write outside the store working directory. The pushDir path through extractTarDirectory and ensureLinkPath validates symlink targets lexically, resolveRelToBase skips its parent-symlink walk for root-level entries, and writeFile follows a terminal symlink when opening a regular file. A malicious archive can therefore create a symlink chain whose lexical target remains inside the extraction root but whose resolved target is an attacker-selected absolute path, then overwrite that target with a same-named regular-file entry even when AllowPathTraversalOnWrite is false. Pulling an attacker-controlled artifact can create or overwrite any file writable by the process and may lead to code execution. This issue is fixed in version 2.6.2."}]},{"artifact":{"id":"02a7da2d8264292d","cpes":["cpe:2.3:a:google:grpc:v1.79.3:*:*:*:*:*:*:*"],"name":"google.golang.org/grpc","purl":"pkg:golang/google.golang.org/grpc@v1.79.3","type":"go-module","version":"v1.79.3","language":"go","licenses":[],"metadata":{"h1Digest":"h1:sybAEdRIEtvcD68Gx7dmnwjZKlyfuc61Dyo9pGXXkKE=","mainModule":"github.com/opentofu/opentofu","architecture":"amd64","goCompiledVersion":"go1.26.6"},"locations":[{"path":"/usr/local/bin/tofu","layerID":"sha256:02f497acae86193b675d599c46408e811e414a5a4487f7551c45fa616bf5d716","accessPath":"/usr/local/bin/tofu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.82.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-2v4p-qf9q-27wj","versionConstraint":"<1.82.2 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"google.golang.org/grpc","version":"v1.79.3"},"language":"go","namespace":"github:language:go"}}],"vulnerability":{"id":"GHSA-2v4p-qf9q-27wj","fix":{"state":"fixed","versions":["1.82.2"],"available":[{"date":"2026-09-09","kind":"first-observed","version":"1.82.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84445","cwe":"CWE-129","type":"Primary","source":"security-advisories@github.com"},{"cve":"CVE-2026-84445","cwe":"CWE-248","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-84445","date":"2026-10-08","epss":0.00641,"percentile":0.49117}],"risk":0.51921,"urls":["https://github.com/grpc/grpc-go/security/advisories/GHSA-2v4p-qf9q-27wj","https://github.com/grpc/grpc-go/issues/9354","https://github.com/grpc/grpc-go/pull/9365","https://github.com/grpc/grpc-go/pull/9366","https://github.com/grpc/grpc-go/pull/9367","https://github.com/grpc/grpc-go/commit/3822494d8ea03b992c089fd2a195f041762fffb7","https://github.com/grpc/grpc-go/commit/8668b69c167df908b6b3666dcbf40992b9e932a4","https://github.com/grpc/grpc-go/commit/93e31b48545e2a8aaeb6e06b47fb249f94e6297f","https://github.com/grpc/grpc-go/releases/tag/v1.82.2","https://github.com/grpc/grpc-go/releases/tag/v1.83.2","https://nvd.nist.gov/vuln/detail/CVE-2026-84445"],"severity":"High","namespace":"github:language:go","advisories":[],"dataSource":"https://github.com/advisories/GHSA-2v4p-qf9q-27wj","description":"gRPC-Go xDS servers: Denial of Service (DoS) via crash due to missing `:authority` and `Host` headers"},"relatedVulnerabilities":[{"id":"CVE-2026-84445","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84445","cwe":"CWE-129","type":"Primary","source":"security-advisories@github.com"},{"cve":"CVE-2026-84445","cwe":"CWE-248","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-84445","date":"2026-10-08","epss":0.00641,"percentile":0.49117}],"urls":["https://github.com/grpc/grpc-go/commit/3822494d8ea03b992c089fd2a195f041762fffb7","https://github.com/grpc/grpc-go/commit/8668b69c167df908b6b3666dcbf40992b9e932a4","https://github.com/grpc/grpc-go/commit/93e31b48545e2a8aaeb6e06b47fb249f94e6297f","https://github.com/grpc/grpc-go/issues/9354","https://github.com/grpc/grpc-go/pull/9365","https://github.com/grpc/grpc-go/pull/9366","https://github.com/grpc/grpc-go/pull/9367","https://github.com/grpc/grpc-go/releases/tag/v1.82.2","https://github.com/grpc/grpc-go/releases/tag/v1.83.2","https://github.com/grpc/grpc-go/security/advisories/GHSA-2v4p-qf9q-27wj"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84445","description":"gRPC-Go is the Go language implementation of gRPC. Prior to 1.82.2 and 1.83.2, servers created with xds.NewGRPCServer() allow internal/transport/http2_server.go to accept an RPC containing neither the :authority header nor the Host header, while RouteAndProcess in internal/xds/server/routing.go assumes that an authority value exists and indexes the empty slice. A remote client that can complete transport connection establishment can trigger an index-out-of-bounds panic that is not recovered by the per-RPC goroutine and terminates the entire server process. In insecure or ordinary TLS deployments the request can be unauthenticated, while strict mTLS or ALTS deployments require valid transport credentials before the malformed RPC can reach the interceptor. This issue is fixed in versions 1.82.2 and 1.83.2."}]},{"artifact":{"id":"a2f9753712cb5d88","cpes":["cpe:2.3:a:c-ares:c-ares:1.33.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:c-ares:c_ares:1.33.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:c_ares:c-ares:1.33.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:c_ares:c_ares:1.33.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:c:c-ares:1.33.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:c:c_ares:1.33.1-r0:*:*:*:*:*:*:*"],"name":"c-ares","purl":"pkg:apk/alpine/c-ares@1.33.1-r0?arch=x86_64&distro=alpine-3.20.10","type":"apk","version":"1.33.1-r0","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcares.so.2"},{"path":"/usr/lib/libcares.so.2.18.1"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:4ca39b9c4f6154203448400fd6deaa60170b5fed62c4ba1fc19251fe483f44a2","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"c-ares"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:c-ares:c-ares:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-69184","versionConstraint":"< 1.34.7 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:c-ares:c-ares:1.33.1:*:*:*:*:*:*:*"],"package":{"name":"c-ares","version":"1.33.1-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-69184","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-69184","cwe":"CWE-407","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-69184","date":"2026-10-08","epss":0.00684,"percentile":0.51082}],"risk":0.513,"urls":["https://github.com/c-ares/c-ares/commit/5c8341ba6ff3a8e4e4dfd616f8ed0418838b8b7b","https://github.com/c-ares/c-ares/commit/f1288bbc70e9a1e0a77134c2382157e52d326aea","https://github.com/c-ares/c-ares/pull/1164","https://github.com/c-ares/c-ares/pull/1210","https://github.com/c-ares/c-ares/releases/tag/v1.34.7","https://github.com/c-ares/c-ares/security/advisories/GHSA-pjmc-gx33-gc76"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-69184","description":"c-ares is an asynchronous resolver library. Prior to 1.34.7, ares_dns_name_parse() enforces backward DNS compression pointers but does not bound the total pointer hops or assembled name length. A malicious DNS server can send a response containing a long descending pointer chain and many resource records whose NAME or RDATA fields refer to the chain, causing repeated decompression work that grows quadratically with message size. A single crafted response can stall the single-threaded c-ares event loop and deny DNS resolution, without causing memory corruption or information disclosure. This issue is fixed in version 1.34.7."},"relatedVulnerabilities":[]},{"artifact":{"id":"02a7da2d8264292d","cpes":["cpe:2.3:a:google:grpc:v1.79.3:*:*:*:*:*:*:*"],"name":"google.golang.org/grpc","purl":"pkg:golang/google.golang.org/grpc@v1.79.3","type":"go-module","version":"v1.79.3","language":"go","licenses":[],"metadata":{"h1Digest":"h1:sybAEdRIEtvcD68Gx7dmnwjZKlyfuc61Dyo9pGXXkKE=","mainModule":"github.com/opentofu/opentofu","architecture":"amd64","goCompiledVersion":"go1.26.6"},"locations":[{"path":"/usr/local/bin/tofu","layerID":"sha256:02f497acae86193b675d599c46408e811e414a5a4487f7551c45fa616bf5d716","accessPath":"/usr/local/bin/tofu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.83.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-vp52-pcj8-j9qc","versionConstraint":"<=1.83.0 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"google.golang.org/grpc","version":"v1.79.3"},"language":"go","namespace":"github:language:go"}}],"vulnerability":{"id":"GHSA-vp52-pcj8-j9qc","fix":{"state":"fixed","versions":["1.83.1"],"available":[{"date":"2026-09-02","kind":"first-observed","version":"1.83.1"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84304","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-84304","date":"2026-10-08","epss":0.00609,"percentile":0.47509}],"risk":0.49328999999999995,"urls":["https://github.com/grpc/grpc-go/security/advisories/GHSA-vp52-pcj8-j9qc","https://nvd.nist.gov/vuln/detail/CVE-2026-84304","https://github.com/grpc/grpc-go/pull/9331","https://github.com/grpc/grpc-go/pull/9333","https://github.com/grpc/grpc-go/commit/7354d9c8debb4bcf2225bf429857078de310c176","https://github.com/grpc/grpc-go/commit/8cfeca0e1ee5ea0980dcc320e20240fa1079ec77","https://github.com/grpc/grpc-go/releases/tag/v1.83.1"],"severity":"High","namespace":"github:language:go","advisories":[],"dataSource":"https://github.com/advisories/GHSA-vp52-pcj8-j9qc","description":"gRPC-Go: Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation"},"relatedVulnerabilities":[{"id":"CVE-2026-84304","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84304","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-84304","date":"2026-10-08","epss":0.00609,"percentile":0.47509}],"urls":["https://github.com/grpc/grpc-go/commit/7354d9c8debb4bcf2225bf429857078de310c176","https://github.com/grpc/grpc-go/commit/8cfeca0e1ee5ea0980dcc320e20240fa1079ec77","https://github.com/grpc/grpc-go/pull/9331","https://github.com/grpc/grpc-go/pull/9333","https://github.com/grpc/grpc-go/releases/tag/v1.83.1","https://github.com/grpc/grpc-go/security/advisories/GHSA-vp52-pcj8-j9qc"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84304","description":"gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, internal/transport/transport.go stores each fragmented HTTP/2 DATA frame as a separate recvMsg in recvBuffer, so millions of one-byte frames can consume disproportionate heap memory even when payload bytes remain within connection and stream flow-control windows. An unauthenticated remote attacker can use concurrent multiplexed streams to exhaust process memory and cause a runtime panic or out-of-memory termination. Receive-buffer compaction is enabled by default and can be controlled temporarily with GRPC_GO_EXPERIMENTAL_ENABLE_RECEIVE_BUFFER_COMPACTION. This issue is fixed in version 1.83.1."}]},{"artifact":{"id":"a2f9753712cb5d88","cpes":["cpe:2.3:a:c-ares:c-ares:1.33.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:c-ares:c_ares:1.33.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:c_ares:c-ares:1.33.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:c_ares:c_ares:1.33.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:c:c-ares:1.33.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:c:c_ares:1.33.1-r0:*:*:*:*:*:*:*"],"name":"c-ares","purl":"pkg:apk/alpine/c-ares@1.33.1-r0?arch=x86_64&distro=alpine-3.20.10","type":"apk","version":"1.33.1-r0","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcares.so.2"},{"path":"/usr/lib/libcares.so.2.18.1"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:4ca39b9c4f6154203448400fd6deaa60170b5fed62c4ba1fc19251fe483f44a2","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"c-ares"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:c-ares:c-ares:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-31498","versionConstraint":">= 1.32.3, < 1.34.5 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:c-ares:c-ares:1.33.1:*:*:*:*:*:*:*"],"package":{"name":"c-ares","version":"1.33.1-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2025-31498","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-31498","cwe":"CWE-416","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-31498","date":"2026-10-08","epss":0.0058,"percentile":0.4597}],"risk":0.4582,"urls":["https://github.com/c-ares/c-ares/commit/29d38719112639d8c0ba910254a3dd4f482ea2d1","https://github.com/c-ares/c-ares/pull/821","https://github.com/c-ares/c-ares/security/advisories/GHSA-6hxc-62jh-p29v","http://www.openwall.com/lists/oss-security/2025/04/08/3"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-31498","description":"c-ares is an asynchronous resolver library. From 1.32.3 through 1.34.4, there is a use-after-free in read_answers() when process_answer() may re-enqueue a query either due to a DNS Cookie Failure or when the upstream server does not properly support EDNS, or possibly on TCP queries if the remote closed the connection immediately after a response. If there was an issue trying to put that new transaction on the wire, it would close the connection handle, but read_answers() was still expecting the connection handle to be available to possibly dequeue other responses. In theory a remote attacker might be able to trigger this by flooding the target with ICMP UNREACHABLE packets if they also control the upstream nameserver and can return a result with one of those conditions, this has been untested. Otherwise only a local attacker might be able to change system behavior to make send()/write() return a failure condition. This vulnerability is fixed in 1.34.5."},"relatedVulnerabilities":[]},{"artifact":{"id":"41a1e1da43325d36","cpes":["cpe:2.3:a:zlib:zlib:1.3.2-r0:*:*:*:*:*:*:*"],"name":"zlib","purl":"pkg:apk/alpine/zlib@1.3.2-r0?arch=x86_64&distro=alpine-3.20.10","type":"apk","version":"1.3.2-r0","language":"","licenses":["Zlib"],"metadata":{"Arch":"x86_64","files":[{"path":"/lib"},{"path":"/lib/libz.so.1"},{"path":"/lib/libz.so.1.3.2"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:4ca39b9c4f6154203448400fd6deaa60170b5fed62c4ba1fc19251fe483f44a2","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"zlib"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:zlib:zlib:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-85091","versionConstraint":">= 1.3.1.2, <= 1.3.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:zlib:zlib:1.3.2:*:*:*:*:*:*:*"],"package":{"name":"zlib","version":"1.3.2-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-85091","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-85091","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-85091","date":"2026-10-08","epss":0.00356,"percentile":0.27225}],"risk":0.27323,"urls":["https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490","https://github.com/madler/zlib","https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393","https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-85091","description":"zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary."},"relatedVulnerabilities":[]},{"artifact":{"id":"a2f9753712cb5d88","cpes":["cpe:2.3:a:c-ares:c-ares:1.33.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:c-ares:c_ares:1.33.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:c_ares:c-ares:1.33.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:c_ares:c_ares:1.33.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:c:c-ares:1.33.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:c:c_ares:1.33.1-r0:*:*:*:*:*:*:*"],"name":"c-ares","purl":"pkg:apk/alpine/c-ares@1.33.1-r0?arch=x86_64&distro=alpine-3.20.10","type":"apk","version":"1.33.1-r0","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcares.so.2"},{"path":"/usr/lib/libcares.so.2.18.1"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:4ca39b9c4f6154203448400fd6deaa60170b5fed62c4ba1fc19251fe483f44a2","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"c-ares"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:c-ares:c-ares:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-69186","versionConstraint":"< 1.34.7 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:c-ares:c-ares:1.33.1:*:*:*:*:*:*:*"],"package":{"name":"c-ares","version":"1.33.1-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-69186","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-69186","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-69186","date":"2026-10-08","epss":0.00524,"percentile":0.42607}],"risk":0.26986000000000004,"urls":["https://github.com/c-ares/c-ares/commit/e47c203f91cd8b749c8736bc18d75a31ffdec8f4","https://github.com/c-ares/c-ares/commit/eaded4cb200b2a5f8d73f11021ff7c8d6968aaab","https://github.com/c-ares/c-ares/pull/1134","https://github.com/c-ares/c-ares/releases/tag/v1.34.7","https://github.com/c-ares/c-ares/security/advisories/GHSA-jv8r-gqr9-68wj"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-69186","description":"c-ares is an asynchronous resolver library. Prior to 1.34.7, ares_dns_parse() trusts the attacker-controlled ANCOUNT, NSCOUNT, and ARCOUNT fields before confirming that the DNS response contains enough bytes for the claimed records. Because process_answer() invokes parsing before transaction ID and question validation, a malicious DNS response can cause ares_dns_record_rr_prealloc() and ares_array_set_size() to reserve disproportionate heap memory for a tiny message. Repeated responses create large allocation and release cycles that can degrade or deny name resolution, without causing memory corruption or information disclosure. This issue is fixed in version 1.34.7."},"relatedVulnerabilities":[]},{"artifact":{"id":"1c808f382e18132b","cpes":["cpe:2.3:a:linuxfoundation:oras:v2.6.1:*:*:*:*:go:*:*"],"name":"oras.land/oras-go/v2","purl":"pkg:golang/oras.land/oras-go/v2@v2.6.1","type":"go-module","version":"v2.6.1","language":"go","licenses":[],"metadata":{"h1Digest":"h1:bonOEkjLfp8tt6qXWRRWP6p1F+9octchOf2EqnWB4Zs=","mainModule":"github.com/opentofu/opentofu","architecture":"amd64","goCompiledVersion":"go1.26.6"},"locations":[{"path":"/usr/local/bin/tofu","layerID":"sha256:02f497acae86193b675d599c46408e811e414a5a4487f7551c45fa616bf5d716","accessPath":"/usr/local/bin/tofu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.6.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-fxhp-mv3v-67qp","versionConstraint":"<=2.6.1 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"oras.land/oras-go/v2","version":"v2.6.1"},"language":"go","namespace":"github:language:go"}}],"vulnerability":{"id":"GHSA-fxhp-mv3v-67qp","fix":{"state":"fixed","versions":["2.6.2"],"available":[{"date":"2026-08-05","kind":"first-observed","version":"2.6.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N","metrics":{"baseScore":7.1,"impactScore":4.3,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-50163","cwe":"CWE-22","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-50163","cwe":"CWE-59","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-50163","date":"2026-10-08","epss":0.00346,"percentile":0.26061}],"risk":0.25257999999999997,"urls":["https://github.com/oras-project/oras-go/security/advisories/GHSA-fxhp-mv3v-67qp","https://github.com/oras-project/oras-go/commit/b11f777f8d405c5023c4b307cfdc5068dfc3d406","https://nvd.nist.gov/vuln/detail/CVE-2026-50163","https://github.com/oras-project/oras-go/pull/1232","https://github.com/oras-project/oras-go/commit/c463c654ab3ef34422c1764cd619806cebf20451","https://github.com/oras-project/oras-go/releases/tag/v2.6.2"],"severity":"High","namespace":"github:language:go","advisories":[],"dataSource":"https://github.com/advisories/GHSA-fxhp-mv3v-67qp","description":"`oras-go` tar extraction: Hardlink entry with relative Linkname escapes extract dir via process CWD resolution"},"relatedVulnerabilities":[{"id":"CVE-2026-50163","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N","metrics":{"baseScore":7.1,"impactScore":4.3,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-50163","cwe":"CWE-22","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-50163","cwe":"CWE-59","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-50163","date":"2026-10-08","epss":0.00346,"percentile":0.26061}],"urls":["https://github.com/oras-project/oras-go/commit/c463c654ab3ef34422c1764cd619806cebf20451","https://github.com/oras-project/oras-go/pull/1232","https://github.com/oras-project/oras-go/releases/tag/v2.6.2","https://github.com/oras-project/oras-go/security/advisories/GHSA-fxhp-mv3v-67qp"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-50163","description":"oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, ensureLinkPath in content/file/utils.go:262-275 validates a hardlink target relative to the extract base but returns the unresolved target, causing os.Link(\"victim.secret\", \"<extract_base>/payload.tar.gz/evil_cwd_link\") to resolve header.Linkname against the process current working directory for a Typeflag=TypeLink entry such as Name=payload.tar.gz/evil_cwd_link and Linkname=\"victim.secret\" with io.deis.oras.content.unpack: \"true\", which can expose or tamper with files such as .env, .git/config, .aws/credentials, and ~/.ssh/config. This issue is fixed in version 2.6.2."}]},{"artifact":{"id":"a2f9753712cb5d88","cpes":["cpe:2.3:a:c-ares:c-ares:1.33.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:c-ares:c_ares:1.33.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:c_ares:c-ares:1.33.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:c_ares:c_ares:1.33.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:c:c-ares:1.33.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:c:c_ares:1.33.1-r0:*:*:*:*:*:*:*"],"name":"c-ares","purl":"pkg:apk/alpine/c-ares@1.33.1-r0?arch=x86_64&distro=alpine-3.20.10","type":"apk","version":"1.33.1-r0","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcares.so.2"},{"path":"/usr/lib/libcares.so.2.18.1"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:4ca39b9c4f6154203448400fd6deaa60170b5fed62c4ba1fc19251fe483f44a2","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"c-ares"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:c-ares:c-ares:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-62408","versionConstraint":">= 1.32.3, < 1.34.6 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:c-ares:c-ares:1.33.1:*:*:*:*:*:*:*"],"package":{"name":"c-ares","version":"1.33.1-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2025-62408","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-62408","cwe":"CWE-416","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-62408","date":"2026-10-08","epss":0.00427,"percentile":0.34933}],"risk":0.23271500000000006,"urls":["https://github.com/c-ares/c-ares/commit/714bf5675c541bd1e668a8db8e67ce012651e618","https://github.com/c-ares/c-ares/security/advisories/GHSA-jq53-42q6-pqr5"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-62408","description":"c-ares is an asynchronous resolver library. Versions 1.32.3 through 1.34.5  terminate a query after maximum attempts when using read_answer() and process_answer(), which can cause a Denial of Service. This issue is fixed in version 1.34.6."},"relatedVulnerabilities":[]},{"artifact":{"id":"2b2edaaae435b461","cpes":["cpe:2.3:a:golang:x\\/mod:v0.38.0:*:*:*:*:*:*:*"],"name":"golang.org/x/mod","purl":"pkg:golang/golang.org/x/mod@v0.38.0","type":"go-module","version":"v0.38.0","language":"go","licenses":[],"metadata":{"h1Digest":"h1:MECBjubtXD7yj4HrhIUcywNaGeNVUdfVnxmPajOk4yk=","mainModule":"github.com/opentofu/opentofu","architecture":"amd64","goCompiledVersion":"go1.26.6"},"locations":[{"path":"/usr/local/bin/tofu","layerID":"sha256:02f497acae86193b675d599c46408e811e414a5a4487f7551c45fa616bf5d716","accessPath":"/usr/local/bin/tofu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0.40.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-6180","versionConstraint":"<0.40.0 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"golang.org/x/mod","version":"v0.38.0"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-6180","fix":{"state":"fixed","versions":["0.40.0"],"available":[{"date":"2026-08-13","kind":"release","version":"0.40.0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56864","cwe":"CWE-347","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-56864","date":"2026-10-08","epss":0.00298,"percentile":0.20602}],"risk":0.2235,"urls":["https://groups.google.com/g/golang-announce/c/94pEornpRlI","https://go.dev/cl/815000","https://go.dev/cl/815020"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/issue/80745","description":"A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log.\n\nThis attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log.\n\nIn order to determine if you have been affected:\n\nrm -r go.sum go.work.sum vendor/ && go mod tidy"},"relatedVulnerabilities":[{"id":"CVE-2026-56864","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56864","cwe":"CWE-347","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-56864","date":"2026-10-08","epss":0.00298,"percentile":0.20602}],"urls":["https://go.dev/cl/815000","https://go.dev/cl/815020","https://go.dev/issue/80745","https://groups.google.com/g/golang-announce/c/94pEornpRlI","https://pkg.go.dev/vuln/GO-2026-6180"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56864","description":"A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log. In order to determine if you have been affected:   rm -r go.sum go.work.sum vendor/ && go mod tidy"}]},{"artifact":{"id":"8062d645d54764b6","cpes":["cpe:2.3:a:otel:sdk\\/log:v0.18.0:*:*:*:*:*:*:*"],"name":"go.opentelemetry.io/otel/sdk/log","purl":"pkg:golang/go.opentelemetry.io/otel/sdk/log@v0.18.0","type":"go-module","version":"v0.18.0","language":"go","licenses":[],"metadata":{"h1Digest":"h1:n8OyZr7t7otkeTnPTbDNom6rW16TBYGtvyy2Gk6buQw=","mainModule":"github.com/opentofu/opentofu","architecture":"amd64","goCompiledVersion":"go1.26.6"},"locations":[{"path":"/usr/local/bin/tofu","layerID":"sha256:02f497acae86193b675d599c46408e811e414a5a4487f7551c45fa616bf5d716","accessPath":"/usr/local/bin/tofu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0.21.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-hjf4-fphr-2h65","versionConstraint":"<0.21.0 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"go.opentelemetry.io/otel/sdk/log","version":"v0.18.0"},"language":"go","namespace":"github:language:go"}}],"vulnerability":{"id":"GHSA-hjf4-fphr-2h65","fix":{"state":"fixed","versions":["0.21.0"],"available":[{"date":"2026-09-30","kind":"first-observed","version":"0.21.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-81872","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-81872","cwe":"CWE-834","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-81872","date":"2026-10-08","epss":0.00383,"percentile":0.30222}],"risk":0.216395,"urls":["https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-hjf4-fphr-2h65","https://nvd.nist.gov/vuln/detail/CVE-2026-81872","https://github.com/open-telemetry/opentelemetry-go/issues/6797","https://github.com/open-telemetry/opentelemetry-go/pull/8620","https://github.com/open-telemetry/opentelemetry-go/commit/ba71b09e6ed272e93a669aeaec1e98b1df4cc582","https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/log/v0.21.0"],"severity":"Medium","namespace":"github:language:go","advisories":[],"dataSource":"https://github.com/advisories/GHSA-hjf4-fphr-2h65","description":"OpenTelemetry-Go: BatchProcessor can busy-spin when export buffer is full"},"relatedVulnerabilities":[{"id":"CVE-2026-81872","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-81872","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-81872","cwe":"CWE-834","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-81872","date":"2026-10-08","epss":0.00383,"percentile":0.30222}],"urls":["https://github.com/open-telemetry/opentelemetry-go/commit/ba71b09e6ed272e93a669aeaec1e98b1df4cc582","https://github.com/open-telemetry/opentelemetry-go/issues/6797","https://github.com/open-telemetry/opentelemetry-go/pull/8620","https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/log/v0.21.0","https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-hjf4-fphr-2h65"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-81872","description":"OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to version 0.21.0, the go.opentelemetry.io/otel/sdk/log BatchingProcessor can enter a tight CPU loop when attacker-driven log emission fills its asynchronous export buffer while the exporter is backpressured. NewBatchingProcessor wraps the exporter with newBufferExporter(exporter, 1), and the poll loop calls queue.TryDequeue and bufferExporter.EnqueueExport before immediately signaling pollTrigger whenever the queue remains at or above batchSize. Because a failed nonblocking EnqueueExport leaves the queue length unchanged, the processor repeatedly retries without waiting for its ticker, exhausting CPU and degrading or denying service in the embedding process. This issue is fixed in version 0.21.0."}]},{"artifact":{"id":"9ab589ecf84c72cb","cpes":["cpe:2.3:a:pcre2:pcre2:10.43-r0:*:*:*:*:*:*:*","cpe:2.3:a:pcre2:pcre:10.43-r0:*:*:*:*:*:*:*","cpe:2.3:a:pcre:pcre2:10.43-r0:*:*:*:*:*:*:*","cpe:2.3:a:pcre:pcre:10.43-r0:*:*:*:*:*:*:*"],"name":"pcre2","purl":"pkg:apk/alpine/pcre2@10.43-r0?arch=x86_64&distro=alpine-3.20.10","type":"apk","version":"10.43-r0","language":"","licenses":["BSD-3-Clause"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpcre2-8.so.0"},{"path":"/usr/lib/libpcre2-8.so.0.12.0"},{"path":"/usr/lib/libpcre2-posix.so.3"},{"path":"/usr/lib/libpcre2-posix.so.3.0.5"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:4ca39b9c4f6154203448400fd6deaa60170b5fed62c4ba1fc19251fe483f44a2","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"pcre2"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:pcre:pcre2:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-89157","versionConstraint":">= 10.30, < 10.48||= 10.48-rc1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:pcre:pcre2:10.43:*:*:*:*:*:*:*"],"package":{"name":"pcre2","version":"10.43-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-89157","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L","metrics":{"baseScore":5.7,"impactScore":4.3,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89157","cwe":"CWE-190","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-89157","date":"2026-10-08","epss":0.00278,"percentile":0.18565}],"risk":0.195295,"urls":["https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48","https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-q8g2-wprr-34m9"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-89157","description":"PCRE2 before 10.48, on 32-bit platforms, has a pcre2_pattern_convert out-of-bounds write when an attacker can provide a large pattern."},"relatedVulnerabilities":[]},{"artifact":{"id":"1c808f382e18132b","cpes":["cpe:2.3:a:linuxfoundation:oras:v2.6.1:*:*:*:*:go:*:*"],"name":"oras.land/oras-go/v2","purl":"pkg:golang/oras.land/oras-go/v2@v2.6.1","type":"go-module","version":"v2.6.1","language":"go","licenses":[],"metadata":{"h1Digest":"h1:bonOEkjLfp8tt6qXWRRWP6p1F+9octchOf2EqnWB4Zs=","mainModule":"github.com/opentofu/opentofu","architecture":"amd64","goCompiledVersion":"go1.26.6"},"locations":[{"path":"/usr/local/bin/tofu","layerID":"sha256:02f497acae86193b675d599c46408e811e414a5a4487f7551c45fa616bf5d716","accessPath":"/usr/local/bin/tofu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.6.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-h7vf-4x9w-h99v","versionConstraint":"<=2.6.1 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"oras.land/oras-go/v2","version":"v2.6.1"},"language":"go","namespace":"github:language:go"}}],"vulnerability":{"id":"GHSA-h7vf-4x9w-h99v","fix":{"state":"fixed","versions":["2.6.2"],"available":[{"date":"2026-09-18","kind":"first-observed","version":"2.6.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N","metrics":{"baseScore":4.7,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-85732","cwe":"CWE-918","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-85732","date":"2026-10-08","epss":0.00384,"percentile":0.30336}],"risk":0.18624,"urls":["https://github.com/oras-project/oras-go/security/advisories/GHSA-h7vf-4x9w-h99v","https://nvd.nist.gov/vuln/detail/CVE-2026-85732","https://github.com/oras-project/oras-go/commit/31da1963f8c327dd089cd29faeae95cf0fc50842","https://github.com/oras-project/oras-go/releases/tag/v2.6.2"],"severity":"Medium","namespace":"github:language:go","advisories":[],"dataSource":"https://github.com/advisories/GHSA-h7vf-4x9w-h99v","description":"oras-go: Blind SSRF via unvalidated Link header URL in pagination allows internal network probing"},"relatedVulnerabilities":[{"id":"CVE-2026-85732","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N","metrics":{"baseScore":4.7,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-85732","cwe":"CWE-918","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-85732","date":"2026-10-08","epss":0.00384,"percentile":0.30336}],"urls":["https://github.com/oras-project/oras-go/commit/31da1963f8c327dd089cd29faeae95cf0fc50842","https://github.com/oras-project/oras-go/releases/tag/v2.6.2","https://github.com/oras-project/oras-go/security/advisories/GHSA-h7vf-4x9w-h99v"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-85732","description":"oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, the parseLink function in registry/remote/utils.go accepts an absolute URL from a registry-controlled Link response header without validating its scheme, host, or port. Tags, Referrers, and Repositories pagination operations then issue a GET request to the attacker-selected URL from the victim's network, allowing blind server-side request forgery against internal services. The response body is not returned to the attacker, but timing and error differences can reveal service reachability, and credentials may be attached when the credential store has an entry for the target host. Exploitation requires a victim to perform a pagination-based listing operation against a malicious registry. The maintainer identifies this report as a duplicate of GHSA-3hr5-mjrr-hfjh and states that remediation is consolidated in that earlier advisory. The consolidated issue is fixed in version 2.6.2."}]},{"artifact":{"id":"02a7da2d8264292d","cpes":["cpe:2.3:a:google:grpc:v1.79.3:*:*:*:*:*:*:*"],"name":"google.golang.org/grpc","purl":"pkg:golang/google.golang.org/grpc@v1.79.3","type":"go-module","version":"v1.79.3","language":"go","licenses":[],"metadata":{"h1Digest":"h1:sybAEdRIEtvcD68Gx7dmnwjZKlyfuc61Dyo9pGXXkKE=","mainModule":"github.com/opentofu/opentofu","architecture":"amd64","goCompiledVersion":"go1.26.6"},"locations":[{"path":"/usr/local/bin/tofu","layerID":"sha256:02f497acae86193b675d599c46408e811e414a5a4487f7551c45fa616bf5d716","accessPath":"/usr/local/bin/tofu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.83.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-qc2q-p7wx-3px3","versionConstraint":"<=1.83.0 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"google.golang.org/grpc","version":"v1.79.3"},"language":"go","namespace":"github:language:go"}}],"vulnerability":{"id":"GHSA-qc2q-p7wx-3px3","fix":{"state":"fixed","versions":["1.83.1"],"available":[{"date":"2026-09-09","kind":"first-observed","version":"1.83.1"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84303","cwe":"CWE-178","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-84303","cwe":"CWE-863","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-84303","date":"2026-10-08","epss":0.00311,"percentile":0.21971}],"risk":0.17571499999999998,"urls":["https://github.com/grpc/grpc-go/security/advisories/GHSA-qc2q-p7wx-3px3","https://nvd.nist.gov/vuln/detail/CVE-2026-84303","https://github.com/grpc/grpc-go/pull/9332","https://github.com/grpc/grpc-go/pull/9335","https://github.com/grpc/grpc-go/commit/db9482836c298f234c896cf82ab68cafc78237f8","https://github.com/grpc/grpc-go/commit/ebba6f3f1b206e2b4dc4d1d5a96d18430302c2fe","https://github.com/grpc/grpc-go/releases/tag/v1.83.1"],"severity":"Medium","namespace":"github:language:go","advisories":[],"dataSource":"https://github.com/advisories/GHSA-qc2q-p7wx-3px3","description":"gRPC-Go: xDS RBAC HTTP Filter bypass via mixed-case Header Matching and gRFC A41 validation evasion"},"relatedVulnerabilities":[{"id":"CVE-2026-84303","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84303","cwe":"CWE-178","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-84303","cwe":"CWE-863","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-84303","date":"2026-10-08","epss":0.00311,"percentile":0.21971}],"urls":["https://github.com/grpc/grpc-go/commit/db9482836c298f234c896cf82ab68cafc78237f8","https://github.com/grpc/grpc-go/commit/ebba6f3f1b206e2b4dc4d1d5a96d18430302c2fe","https://github.com/grpc/grpc-go/pull/9332","https://github.com/grpc/grpc-go/pull/9335","https://github.com/grpc/grpc-go/releases/tag/v1.83.1","https://github.com/grpc/grpc-go/security/advisories/GHSA-qc2q-p7wx-3px3"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84303","description":"gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, the xDS RBAC HTTP filter in internal/xds/httpfilter/rbac/rbac.go does not lowercase header matcher names in normalizeHeaderMatcher even though incoming metadata keys are lowercase. A DENY policy using a mixed-case name such as X-Role or User-Agent therefore does not match and fails open, allowing requests that should be rejected. The same case mismatch permits :Scheme or Grpc-Status to evade gRFC A41 validation and prevents Host from being rewritten to :authority. This issue is fixed in version 1.83.1."}]},{"artifact":{"id":"ee0af0d7b3316b73","cpes":["cpe:2.3:a:nghttp2-libs:nghttp2-libs:1.62.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:nghttp2-libs:nghttp2_libs:1.62.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:nghttp2_libs:nghttp2-libs:1.62.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:nghttp2_libs:nghttp2_libs:1.62.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:nghttp-libs:nghttp2-libs:1.62.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:nghttp-libs:nghttp2_libs:1.62.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:nghttp2-libs:nghttp-libs:1.62.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:nghttp2-libs:nghttp_libs:1.62.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:nghttp2_libs:nghttp-libs:1.62.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:nghttp2_libs:nghttp_libs:1.62.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:nghttp_libs:nghttp2-libs:1.62.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:nghttp_libs:nghttp2_libs:1.62.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:nghttp-libs:nghttp-libs:1.62.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:nghttp-libs:nghttp_libs:1.62.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:nghttp_libs:nghttp-libs:1.62.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:nghttp_libs:nghttp_libs:1.62.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:nghttp2:nghttp2-libs:1.62.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:nghttp2:nghttp2_libs:1.62.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:nghttp2:nghttp-libs:1.62.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:nghttp2:nghttp_libs:1.62.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:nghttp:nghttp2-libs:1.62.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:nghttp:nghttp2_libs:1.62.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:nghttp:nghttp-libs:1.62.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:nghttp:nghttp_libs:1.62.1-r0:*:*:*:*:*:*:*"],"name":"nghttp2-libs","purl":"pkg:apk/alpine/nghttp2-libs@1.62.1-r0?arch=x86_64&distro=alpine-3.20.10&upstream=nghttp2","type":"apk","version":"1.62.1-r0","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libnghttp2.so.14"},{"path":"/usr/lib/libnghttp2.so.14.28.1"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:4ca39b9c4f6154203448400fd6deaa60170b5fed62c4ba1fc19251fe483f44a2","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"nghttp2"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:nghttp2:nghttp2:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-58055","versionConstraint":"<= 1.69.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:nghttp2:nghttp2:1.62.1:*:*:*:*:*:*:*"],"package":{"name":"nghttp2","version":"1.62.1-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-58055","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","metrics":{"baseScore":5.4,"impactScore":2.8,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-58055","cwe":"CWE-444","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-58055","date":"2026-10-08","epss":0.00319,"percentile":0.22818}],"risk":0.1730575,"urls":["https://github.com/bikini/exploitarium/tree/main/nghttp2-nghttpx-upgrade-queue-poison-poc","https://github.com/nghttp2/nghttp2/commit/ab28105c4a0197da24f8bfc414bc116055249e1e","https://www.vulncheck.com/advisories/nghttp2-nghttpx-http-request-response-smuggling-via-upgrade-request-with-content-length"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-58055","description":"nghttp2's nghttpx proxy through 1.69.0 forwards an HTTP/1.1 Upgrade request that also carries a Content-Length header and body onto reusable keep-alive backend connections, re-adding the Upgrade and Connection headers while passing Content-Length verbatim. A backend that resolves the resulting ambiguous message in the attacker's favor enables HTTP request/response smuggling and cross-client response-queue poisoning."},"relatedVulnerabilities":[]},{"artifact":{"id":"eb7a53da2e2526a9","cpes":["cpe:2.3:a:busybox:busybox:1.36.1-r31:*:*:*:*:*:*:*"],"name":"busybox","purl":"pkg:apk/alpine/busybox@1.36.1-r31?arch=x86_64&distro=alpine-3.20.10","type":"apk","version":"1.36.1-r31","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/bin"},{"path":"/bin/busybox"},{"path":"/etc"},{"path":"/etc/securetty"},{"path":"/etc/busybox-paths.d"},{"path":"/etc/busybox-paths.d/busybox"},{"path":"/etc/logrotate.d"},{"path":"/etc/logrotate.d/acpid"},{"path":"/etc/network"},{"path":"/etc/network/if-down.d"},{"path":"/etc/network/if-post-down.d"},{"path":"/etc/network/if-post-up.d"},{"path":"/etc/network/if-pre-down.d"},{"path":"/etc/network/if-pre-up.d"},{"path":"/etc/network/if-up.d"},{"path":"/etc/network/if-up.d/dad"},{"path":"/etc/udhcpc"},{"path":"/etc/udhcpc/udhcpc.conf"},{"path":"/sbin"},{"path":"/tmp"},{"path":"/usr"},{"path":"/usr/sbin"},{"path":"/usr/share"},{"path":"/usr/share/udhcpc"},{"path":"/usr/share/udhcpc/default.script"},{"path":"/var"},{"path":"/var/cache"},{"path":"/var/cache/misc"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:4ca39b9c4f6154203448400fd6deaa60170b5fed62c4ba1fc19251fe483f44a2","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"busybox"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:busybox:busybox:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-60876","versionConstraint":"<= 1.37.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:busybox:busybox:1.36.1:*:*:*:*:*:*:*"],"package":{"name":"busybox","version":"1.36.1-r31"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2025-60876","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-60876","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-60876","date":"2026-10-08","epss":0.00291,"percentile":0.19874}],"risk":0.16732499999999997,"urls":["https://gist.github.com/subyumatest/41554af6a72aedaacaec026adc311092","https://lists.busybox.net/pipermail/busybox/attachments/20250823/ccdc96ef/attachment-0001.htm","https://lists.busybox.net/pipermail/busybox/attachments/20250828/e7f90492/attachment.htm","https://cert-portal.siemens.com/productcert/html/ssa-253495.html"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-60876","description":"BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20)."},"relatedVulnerabilities":[]},{"artifact":{"id":"e4b41b4685cbca2e","cpes":["cpe:2.3:a:busybox-binsh:busybox-binsh:1.36.1-r31:*:*:*:*:*:*:*","cpe:2.3:a:busybox-binsh:busybox_binsh:1.36.1-r31:*:*:*:*:*:*:*","cpe:2.3:a:busybox_binsh:busybox-binsh:1.36.1-r31:*:*:*:*:*:*:*","cpe:2.3:a:busybox_binsh:busybox_binsh:1.36.1-r31:*:*:*:*:*:*:*","cpe:2.3:a:busybox:busybox-binsh:1.36.1-r31:*:*:*:*:*:*:*","cpe:2.3:a:busybox:busybox_binsh:1.36.1-r31:*:*:*:*:*:*:*"],"name":"busybox-binsh","purl":"pkg:apk/alpine/busybox-binsh@1.36.1-r31?arch=x86_64&distro=alpine-3.20.10&upstream=busybox","type":"apk","version":"1.36.1-r31","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/bin"},{"path":"/bin/sh"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:4ca39b9c4f6154203448400fd6deaa60170b5fed62c4ba1fc19251fe483f44a2","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"busybox"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:busybox:busybox:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-60876","versionConstraint":"<= 1.37.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:busybox:busybox:1.36.1:*:*:*:*:*:*:*"],"package":{"name":"busybox","version":"1.36.1-r31"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2025-60876","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-60876","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-60876","date":"2026-10-08","epss":0.00291,"percentile":0.19874}],"risk":0.16732499999999997,"urls":["https://gist.github.com/subyumatest/41554af6a72aedaacaec026adc311092","https://lists.busybox.net/pipermail/busybox/attachments/20250823/ccdc96ef/attachment-0001.htm","https://lists.busybox.net/pipermail/busybox/attachments/20250828/e7f90492/attachment.htm","https://cert-portal.siemens.com/productcert/html/ssa-253495.html"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-60876","description":"BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20)."},"relatedVulnerabilities":[]},{"artifact":{"id":"1c13012139492fbd","cpes":["cpe:2.3:a:ssl-client:ssl-client:1.36.1-r31:*:*:*:*:*:*:*","cpe:2.3:a:ssl-client:ssl_client:1.36.1-r31:*:*:*:*:*:*:*","cpe:2.3:a:ssl_client:ssl-client:1.36.1-r31:*:*:*:*:*:*:*","cpe:2.3:a:ssl_client:ssl_client:1.36.1-r31:*:*:*:*:*:*:*","cpe:2.3:a:ssl:ssl-client:1.36.1-r31:*:*:*:*:*:*:*","cpe:2.3:a:ssl:ssl_client:1.36.1-r31:*:*:*:*:*:*:*"],"name":"ssl_client","purl":"pkg:apk/alpine/ssl_client@1.36.1-r31?arch=x86_64&distro=alpine-3.20.10&upstream=busybox","type":"apk","version":"1.36.1-r31","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/ssl_client"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:4ca39b9c4f6154203448400fd6deaa60170b5fed62c4ba1fc19251fe483f44a2","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"busybox"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:busybox:busybox:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-60876","versionConstraint":"<= 1.37.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:busybox:busybox:1.36.1:*:*:*:*:*:*:*"],"package":{"name":"busybox","version":"1.36.1-r31"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2025-60876","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-60876","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-60876","date":"2026-10-08","epss":0.00291,"percentile":0.19874}],"risk":0.16732499999999997,"urls":["https://gist.github.com/subyumatest/41554af6a72aedaacaec026adc311092","https://lists.busybox.net/pipermail/busybox/attachments/20250823/ccdc96ef/attachment-0001.htm","https://lists.busybox.net/pipermail/busybox/attachments/20250828/e7f90492/attachment.htm","https://cert-portal.siemens.com/productcert/html/ssa-253495.html"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-60876","description":"BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20)."},"relatedVulnerabilities":[]},{"artifact":{"id":"2aa428cb5b1169f4","cpes":["cpe:2.3:a:otel:sdk:v1.42.0:*:*:*:*:*:*:*"],"name":"go.opentelemetry.io/otel/sdk","purl":"pkg:golang/go.opentelemetry.io/otel/sdk@v1.42.0","type":"go-module","version":"v1.42.0","language":"go","licenses":[],"metadata":{"h1Digest":"h1:LyC8+jqk6UJwdrI/8VydAq/hvkFKNHZVIWuslJXYsDo=","mainModule":"github.com/opentofu/opentofu","architecture":"amd64","goCompiledVersion":"go1.26.6"},"locations":[{"path":"/usr/local/bin/tofu","layerID":"sha256:02f497acae86193b675d599c46408e811e414a5a4487f7551c45fa616bf5d716","accessPath":"/usr/local/bin/tofu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.43.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-hfvc-g4fc-pqhx","versionConstraint":">=1.15.0,<=1.42.0 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"go.opentelemetry.io/otel/sdk","version":"v1.42.0"},"language":"go","namespace":"github:language:go"}}],"vulnerability":{"id":"GHSA-hfvc-g4fc-pqhx","fix":{"state":"fixed","versions":["1.43.0"],"available":[{"date":"2026-04-09","kind":"first-observed","version":"1.43.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":7.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-39883","cwe":"CWE-426","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-39883","cwe":"CWE-426","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-39883","date":"2026-10-08","epss":0.00207,"percentile":0.09862}],"risk":0.15317999999999998,"urls":["https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-hfvc-g4fc-pqhx","http://github.com/open-telemetry/opentelemetry-go/releases/tag/v1.43.0","https://nvd.nist.gov/vuln/detail/CVE-2026-39883"],"severity":"High","namespace":"github:language:go","advisories":[],"dataSource":"https://github.com/advisories/GHSA-hfvc-g4fc-pqhx","description":"opentelemetry-go: BSD kenv command not using absolute path enables PATH hijacking"},"relatedVulnerabilities":[{"id":"CVE-2026-39883","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":6.1,"exploitabilityScore":2.1},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-39883","cwe":"CWE-426","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-39883","cwe":"CWE-426","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-39883","date":"2026-10-08","epss":0.00207,"percentile":0.09862}],"urls":["http://github.com/open-telemetry/opentelemetry-go/releases/tag/v1.43.0","https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-hfvc-g4fc-pqhx","https://access.redhat.com/errata/RHSA-2026:26254","https://access.redhat.com/errata/RHSA-2026:26257","https://access.redhat.com/errata/RHSA-2026:37387","https://access.redhat.com/errata/RHSA-2026:54274","https://access.redhat.com/errata/RHSA-2026:54286","https://access.redhat.com/errata/RHSA-2026:63140","https://access.redhat.com/security/cve/CVE-2026-39883","https://bugzilla.redhat.com/show_bug.cgi?id=2456718","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39883.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-39883","description":"OpenTelemetry-Go is the Go implementation of OpenTelemetry. From 1.15.0 to 1.42.0, the fix for CVE-2026-24051 changed the Darwin ioreg command to use an absolute path but left the BSD kenv command using a bare name, allowing the same PATH hijacking attack on BSD and Solaris platforms. This vulnerability is fixed in 1.43.0."}]},{"artifact":{"id":"9ab589ecf84c72cb","cpes":["cpe:2.3:a:pcre2:pcre2:10.43-r0:*:*:*:*:*:*:*","cpe:2.3:a:pcre2:pcre:10.43-r0:*:*:*:*:*:*:*","cpe:2.3:a:pcre:pcre2:10.43-r0:*:*:*:*:*:*:*","cpe:2.3:a:pcre:pcre:10.43-r0:*:*:*:*:*:*:*"],"name":"pcre2","purl":"pkg:apk/alpine/pcre2@10.43-r0?arch=x86_64&distro=alpine-3.20.10","type":"apk","version":"10.43-r0","language":"","licenses":["BSD-3-Clause"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpcre2-8.so.0"},{"path":"/usr/lib/libpcre2-8.so.0.12.0"},{"path":"/usr/lib/libpcre2-posix.so.3"},{"path":"/usr/lib/libpcre2-posix.so.3.0.5"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:4ca39b9c4f6154203448400fd6deaa60170b5fed62c4ba1fc19251fe483f44a2","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"pcre2"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:pcre:pcre2:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-89158","versionConstraint":"< 10.48||= 10.48-rc1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:pcre:pcre2:10.43:*:*:*:*:*:*:*"],"package":{"name":"pcre2","version":"10.43-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-89158","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89158","cwe":"CWE-190","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-89158","date":"2026-10-08","epss":0.00247,"percentile":0.14628}],"risk":0.14202499999999998,"urls":["https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48","https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-fmgr-6ggq-9859"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-89158","description":"PCRE2 before 10.48, on 32-bit platforms, has a pcre2_compile_32 integer overflow and resultant out-of-bounds write."},"relatedVulnerabilities":[]},{"artifact":{"id":"9ab589ecf84c72cb","cpes":["cpe:2.3:a:pcre2:pcre2:10.43-r0:*:*:*:*:*:*:*","cpe:2.3:a:pcre2:pcre:10.43-r0:*:*:*:*:*:*:*","cpe:2.3:a:pcre:pcre2:10.43-r0:*:*:*:*:*:*:*","cpe:2.3:a:pcre:pcre:10.43-r0:*:*:*:*:*:*:*"],"name":"pcre2","purl":"pkg:apk/alpine/pcre2@10.43-r0?arch=x86_64&distro=alpine-3.20.10","type":"apk","version":"10.43-r0","language":"","licenses":["BSD-3-Clause"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpcre2-8.so.0"},{"path":"/usr/lib/libpcre2-8.so.0.12.0"},{"path":"/usr/lib/libpcre2-posix.so.3"},{"path":"/usr/lib/libpcre2-posix.so.3.0.5"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:4ca39b9c4f6154203448400fd6deaa60170b5fed62c4ba1fc19251fe483f44a2","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"pcre2"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:pcre:pcre2:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-89156","versionConstraint":"< 10.48||= 10.48-rc1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:pcre:pcre2:10.43:*:*:*:*:*:*:*"],"package":{"name":"pcre2","version":"10.43-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-89156","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89156","cwe":"CWE-125","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-89156","date":"2026-10-08","epss":0.00294,"percentile":0.20148}],"risk":0.13818,"urls":["https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48","https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-2p8c-ff85-vh9x"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-89156","description":"PCRE2 before 10.48 has a pcre2_match out-of-bounds read after a JIT fallback when an attacker can provide invalid UTF data."},"relatedVulnerabilities":[]},{"artifact":{"id":"9ab589ecf84c72cb","cpes":["cpe:2.3:a:pcre2:pcre2:10.43-r0:*:*:*:*:*:*:*","cpe:2.3:a:pcre2:pcre:10.43-r0:*:*:*:*:*:*:*","cpe:2.3:a:pcre:pcre2:10.43-r0:*:*:*:*:*:*:*","cpe:2.3:a:pcre:pcre:10.43-r0:*:*:*:*:*:*:*"],"name":"pcre2","purl":"pkg:apk/alpine/pcre2@10.43-r0?arch=x86_64&distro=alpine-3.20.10","type":"apk","version":"10.43-r0","language":"","licenses":["BSD-3-Clause"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpcre2-8.so.0"},{"path":"/usr/lib/libpcre2-8.so.0.12.0"},{"path":"/usr/lib/libpcre2-posix.so.3"},{"path":"/usr/lib/libpcre2-posix.so.3.0.5"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:4ca39b9c4f6154203448400fd6deaa60170b5fed62c4ba1fc19251fe483f44a2","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"pcre2"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:pcre:pcre2:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-89160","versionConstraint":">= 10.34, < 10.48||= 10.48-rc1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:pcre:pcre2:10.43:*:*:*:*:*:*:*"],"package":{"name":"pcre2","version":"10.43-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-89160","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89160","cwe":"CWE-125","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-89160","date":"2026-10-08","epss":0.00268,"percentile":0.17337}],"risk":0.13534000000000002,"urls":["https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48","https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-9qww-pwc4-77qq"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-89160","description":"PCRE2 before 10.48 has a pcre2_match out-of-bounds read during the PCRE2_MATCH_INVALID_UTF matching of an invalid UTF subject."},"relatedVulnerabilities":[]},{"artifact":{"id":"93ef4e3fcb787578","cpes":["cpe:2.3:a:otel:exporters\\/otlp\\/otlplog\\/otlploggrpc:v0.18.0:*:*:*:*:*:*:*"],"name":"go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc","purl":"pkg:golang/go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc@v0.18.0","type":"go-module","version":"v0.18.0","language":"go","licenses":[],"metadata":{"h1Digest":"h1:deI9UQMoGFgrg5iLPgzueqFPHevDl+28YKfSpPTI6rY=","mainModule":"github.com/opentofu/opentofu","architecture":"amd64","goCompiledVersion":"go1.26.6"},"locations":[{"path":"/usr/local/bin/tofu","layerID":"sha256:02f497acae86193b675d599c46408e811e414a5a4487f7551c45fa616bf5d716","accessPath":"/usr/local/bin/tofu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0.21.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-w34q-cm8f-9c5x","versionConstraint":"<0.21.0 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc","version":"v0.18.0"},"language":"go","namespace":"github:language:go"}}],"vulnerability":{"id":"GHSA-w34q-cm8f-9c5x","fix":{"state":"fixed","versions":["0.21.0"],"available":[{"date":"2026-09-18","kind":"first-observed","version":"0.21.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-81871","cwe":"CWE-295","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-81871","cwe":"CWE-923","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-81871","date":"2026-10-08","epss":0.00196,"percentile":0.08553}],"risk":0.11073999999999999,"urls":["https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-w34q-cm8f-9c5x","https://nvd.nist.gov/vuln/detail/CVE-2026-81871","https://github.com/open-telemetry/opentelemetry-go/commit/c65d435b43e5e6b82310e6b18dd4cdcb8ac63a0c","https://github.com/open-telemetry/opentelemetry-go/releases/tag/exporters/otlp/otlplog/otlploggrpc/v0.21.0"],"severity":"Medium","namespace":"github:language:go","advisories":[],"dataSource":"https://github.com/advisories/GHSA-w34q-cm8f-9c5x","description":"OpenTelemetry-Go: Log gRPC exporter ignores env TLS certs, bypassing mTLS/pinning"},"relatedVulnerabilities":[{"id":"CVE-2026-81871","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-81871","cwe":"CWE-295","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-81871","cwe":"CWE-923","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-81871","date":"2026-10-08","epss":0.00196,"percentile":0.08553}],"urls":["https://github.com/open-telemetry/opentelemetry-go/commit/c65d435b43e5e6b82310e6b18dd4cdcb8ac63a0c","https://github.com/open-telemetry/opentelemetry-go/releases/tag/exporters/otlp/otlplog/otlploggrpc/v0.21.0","https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-w34q-cm8f-9c5x"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-81871","description":"OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to version 0.21.0, the exporters/otlp/otlplog/otlploggrpc package loads OTEL_EXPORTER_OTLP_LOGS_CERTIFICATE, OTEL_EXPORTER_OTLP_CERTIFICATE, and related client certificate environment variables through loadEnvTLS into cfg.tlsCfg, but newGRPCDialOptions does not apply cfg.tlsCfg when creating gRPC transport credentials. The environment-only TLS path instead uses credentials.NewTLS with system roots and no configured client certificate, bypassing intended private CA pinning and mutual TLS unless the application also supplies WithTLSCredentials. A network attacker able to intercept or spoof the collector connection with a system-trusted certificate can read or alter log telemetry. This issue is fixed in version 0.21.0."}]},{"artifact":{"id":"2b2edaaae435b461","cpes":["cpe:2.3:a:golang:x\\/mod:v0.38.0:*:*:*:*:*:*:*"],"name":"golang.org/x/mod","purl":"pkg:golang/golang.org/x/mod@v0.38.0","type":"go-module","version":"v0.38.0","language":"go","licenses":[],"metadata":{"h1Digest":"h1:MECBjubtXD7yj4HrhIUcywNaGeNVUdfVnxmPajOk4yk=","mainModule":"github.com/opentofu/opentofu","architecture":"amd64","goCompiledVersion":"go1.26.6"},"locations":[{"path":"/usr/local/bin/tofu","layerID":"sha256:02f497acae86193b675d599c46408e811e414a5a4487f7551c45fa616bf5d716","accessPath":"/usr/local/bin/tofu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0.40.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-6179","versionConstraint":"<0.40.0 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"golang.org/x/mod","version":"v0.38.0"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-6179","fix":{"state":"fixed","versions":["0.40.0"],"available":[{"date":"2026-08-13","kind":"release","version":"0.40.0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.4,"impactScore":5.9,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56865","cwe":"CWE-347","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-56865","date":"2026-10-08","epss":0.00129,"percentile":0.02197}],"risk":0.10255500000000001,"urls":["https://groups.google.com/g/golang-announce/c/94pEornpRlI","https://go.dev/cl/814960","https://go.dev/cl/815020"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/issue/80744","description":"A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache.\n\nThis attack allows for a malicious GOPROXY to serve malicious module content that cannot be detected by evaluating the transparency log.\n\nAll tiles are now correctly verified against their parents.\n\nIn order to determine if you have been affected:\n\nrm -r go.sum go.work.sum vendor/ && go mod tidy"},"relatedVulnerabilities":[{"id":"CVE-2026-56865","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.4,"impactScore":5.9,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56865","cwe":"CWE-347","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-56865","date":"2026-10-08","epss":0.00129,"percentile":0.02197}],"urls":["https://go.dev/cl/814960","https://go.dev/cl/815020","https://go.dev/issue/80744","https://groups.google.com/g/golang-announce/c/94pEornpRlI","https://pkg.go.dev/vuln/GO-2026-6179"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56865","description":"A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache. This attack allows for a malicious GOPROXY to serve malicious module content that cannot be detected by evaluating the transparency log. All tiles are now correctly verified against their parents. In order to determine if you have been affected:   rm -r go.sum go.work.sum vendor/ && go mod tidy"}]},{"artifact":{"id":"4021682bc850a60e","cpes":["cpe:2.3:a:otel:exporters\\/otlp\\/otlplog\\/otlploghttp:v0.18.0:*:*:*:*:*:*:*"],"name":"go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp","purl":"pkg:golang/go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp@v0.18.0","type":"go-module","version":"v0.18.0","language":"go","licenses":[],"metadata":{"h1Digest":"h1:icqq3Z34UrEFk2u+HMhTtRsvo7Ues+eiJVjaJt62njs=","mainModule":"github.com/opentofu/opentofu","architecture":"amd64","goCompiledVersion":"go1.26.6"},"locations":[{"path":"/usr/local/bin/tofu","layerID":"sha256:02f497acae86193b675d599c46408e811e414a5a4487f7551c45fa616bf5d716","accessPath":"/usr/local/bin/tofu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0.19.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-w8rr-5gcm-pp58","versionConstraint":"<0.19.0 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp","version":"v0.18.0"},"language":"go","namespace":"github:language:go"}}],"vulnerability":{"id":"GHSA-w8rr-5gcm-pp58","fix":{"state":"fixed","versions":["0.19.0"],"available":[{"date":"2026-04-09","kind":"first-observed","version":"0.19.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-39882","cwe":"CWE-789","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-39882","date":"2026-10-08","epss":0.0019,"percentile":0.07935}],"risk":0.09784999999999999,"urls":["https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-w8rr-5gcm-pp58","http://github.com/open-telemetry/opentelemetry-go/releases/tag/v1.43.0","https://nvd.nist.gov/vuln/detail/CVE-2026-39882","https://github.com/open-telemetry/opentelemetry-go/pull/8108"],"severity":"Medium","namespace":"github:language:go","advisories":[],"dataSource":"https://github.com/advisories/GHSA-w8rr-5gcm-pp58","description":"opentelemetry-go: OTLP HTTP exporters read unbounded HTTP response bodies"},"relatedVulnerabilities":[{"id":"CVE-2026-39882","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-39882","cwe":"CWE-789","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-39882","date":"2026-10-08","epss":0.0019,"percentile":0.07935}],"urls":["https://github.com/open-telemetry/opentelemetry-go/pull/8108","https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-w8rr-5gcm-pp58"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-39882","description":"OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to 1.43.0, the otlp HTTP exporters (traces/metrics/logs) read the full HTTP response body into an in-memory bytes.Buffer without a size cap. This is exploitable for memory exhaustion when the configured collector endpoint is attacker-controlled (or a network attacker can mitm the exporter connection). This vulnerability is fixed in 1.43.0."}]},{"artifact":{"id":"08ad0b567e9e0831","cpes":["cpe:2.3:a:otel:exporters\\/otlp\\/otlpmetric\\/otlpmetrichttp:v1.42.0:*:*:*:*:*:*:*"],"name":"go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp","purl":"pkg:golang/go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp@v1.42.0","type":"go-module","version":"v1.42.0","language":"go","licenses":[],"metadata":{"h1Digest":"h1:H7O6RlGOMTizyl3R08Kn5pdM06bnH8oscSj7o11tmLA=","mainModule":"github.com/opentofu/opentofu","architecture":"amd64","goCompiledVersion":"go1.26.6"},"locations":[{"path":"/usr/local/bin/tofu","layerID":"sha256:02f497acae86193b675d599c46408e811e414a5a4487f7551c45fa616bf5d716","accessPath":"/usr/local/bin/tofu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.43.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-w8rr-5gcm-pp58","versionConstraint":"<1.43.0 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp","version":"v1.42.0"},"language":"go","namespace":"github:language:go"}}],"vulnerability":{"id":"GHSA-w8rr-5gcm-pp58","fix":{"state":"fixed","versions":["1.43.0"],"available":[{"date":"2026-04-09","kind":"first-observed","version":"1.43.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-39882","cwe":"CWE-789","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-39882","date":"2026-10-08","epss":0.0019,"percentile":0.07935}],"risk":0.09784999999999999,"urls":["https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-w8rr-5gcm-pp58","http://github.com/open-telemetry/opentelemetry-go/releases/tag/v1.43.0","https://nvd.nist.gov/vuln/detail/CVE-2026-39882","https://github.com/open-telemetry/opentelemetry-go/pull/8108"],"severity":"Medium","namespace":"github:language:go","advisories":[],"dataSource":"https://github.com/advisories/GHSA-w8rr-5gcm-pp58","description":"opentelemetry-go: OTLP HTTP exporters read unbounded HTTP response bodies"},"relatedVulnerabilities":[{"id":"CVE-2026-39882","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-39882","cwe":"CWE-789","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-39882","date":"2026-10-08","epss":0.0019,"percentile":0.07935}],"urls":["https://github.com/open-telemetry/opentelemetry-go/pull/8108","https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-w8rr-5gcm-pp58"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-39882","description":"OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to 1.43.0, the otlp HTTP exporters (traces/metrics/logs) read the full HTTP response body into an in-memory bytes.Buffer without a size cap. This is exploitable for memory exhaustion when the configured collector endpoint is attacker-controlled (or a network attacker can mitm the exporter connection). This vulnerability is fixed in 1.43.0."}]},{"artifact":{"id":"6134e677f2ebb196","cpes":["cpe:2.3:a:otel:exporters\\/otlp\\/otlptrace\\/otlptracehttp:v1.42.0:*:*:*:*:*:*:*"],"name":"go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp","purl":"pkg:golang/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.42.0","type":"go-module","version":"v1.42.0","language":"go","licenses":[],"metadata":{"h1Digest":"h1:uLXP+3mghfMf7XmV4PkGfFhFKuNWoCvvx5wP/wOXo0o=","mainModule":"github.com/opentofu/opentofu","architecture":"amd64","goCompiledVersion":"go1.26.6"},"locations":[{"path":"/usr/local/bin/tofu","layerID":"sha256:02f497acae86193b675d599c46408e811e414a5a4487f7551c45fa616bf5d716","accessPath":"/usr/local/bin/tofu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.43.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-w8rr-5gcm-pp58","versionConstraint":"<1.43.0 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp","version":"v1.42.0"},"language":"go","namespace":"github:language:go"}}],"vulnerability":{"id":"GHSA-w8rr-5gcm-pp58","fix":{"state":"fixed","versions":["1.43.0"],"available":[{"date":"2026-04-09","kind":"first-observed","version":"1.43.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-39882","cwe":"CWE-789","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-39882","date":"2026-10-08","epss":0.0019,"percentile":0.07935}],"risk":0.09784999999999999,"urls":["https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-w8rr-5gcm-pp58","http://github.com/open-telemetry/opentelemetry-go/releases/tag/v1.43.0","https://nvd.nist.gov/vuln/detail/CVE-2026-39882","https://github.com/open-telemetry/opentelemetry-go/pull/8108"],"severity":"Medium","namespace":"github:language:go","advisories":[],"dataSource":"https://github.com/advisories/GHSA-w8rr-5gcm-pp58","description":"opentelemetry-go: OTLP HTTP exporters read unbounded HTTP response bodies"},"relatedVulnerabilities":[{"id":"CVE-2026-39882","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-39882","cwe":"CWE-789","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-39882","date":"2026-10-08","epss":0.0019,"percentile":0.07935}],"urls":["https://github.com/open-telemetry/opentelemetry-go/pull/8108","https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-w8rr-5gcm-pp58"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-39882","description":"OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to 1.43.0, the otlp HTTP exporters (traces/metrics/logs) read the full HTTP response body into an in-memory bytes.Buffer without a size cap. This is exploitable for memory exhaustion when the configured collector endpoint is attacker-controlled (or a network attacker can mitm the exporter connection). This vulnerability is fixed in 1.43.0."}]},{"artifact":{"id":"9ab589ecf84c72cb","cpes":["cpe:2.3:a:pcre2:pcre2:10.43-r0:*:*:*:*:*:*:*","cpe:2.3:a:pcre2:pcre:10.43-r0:*:*:*:*:*:*:*","cpe:2.3:a:pcre:pcre2:10.43-r0:*:*:*:*:*:*:*","cpe:2.3:a:pcre:pcre:10.43-r0:*:*:*:*:*:*:*"],"name":"pcre2","purl":"pkg:apk/alpine/pcre2@10.43-r0?arch=x86_64&distro=alpine-3.20.10","type":"apk","version":"10.43-r0","language":"","licenses":["BSD-3-Clause"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpcre2-8.so.0"},{"path":"/usr/lib/libpcre2-8.so.0.12.0"},{"path":"/usr/lib/libpcre2-posix.so.3"},{"path":"/usr/lib/libpcre2-posix.so.3.0.5"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:4ca39b9c4f6154203448400fd6deaa60170b5fed62c4ba1fc19251fe483f44a2","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"pcre2"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:pcre:pcre2:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-89161","versionConstraint":"< 10.48||= 10.48-rc1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:pcre:pcre2:10.43:*:*:*:*:*:*:*"],"package":{"name":"pcre2","version":"10.43-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-89161","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.4,"impactScore":5.9,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89161","cwe":"CWE-590","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-89161","date":"2026-10-08","epss":0.00126,"percentile":0.02017}],"risk":0.09513,"urls":["https://github.com/PCRE2Project/pcre2/pull/937","https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-89161","description":"In PCRE2 before 10.48, pcre2_jit_match mishandles a previously copied subject being passed in as a context. An incorrect free operation can occur."},"relatedVulnerabilities":[]},{"artifact":{"id":"c581611c9c49c4e9","cpes":["cpe:2.3:a:otel:exporters\\/otlp\\/otlptrace:v1.42.0:*:*:*:*:*:*:*"],"name":"go.opentelemetry.io/otel/exporters/otlp/otlptrace","purl":"pkg:golang/go.opentelemetry.io/otel/exporters/otlp/otlptrace@v1.42.0","type":"go-module","version":"v1.42.0","language":"go","licenses":[],"metadata":{"h1Digest":"h1:THuZiwpQZuHPul65w4WcwEnkX2QIuMT+UFoOrygtoJw=","mainModule":"github.com/opentofu/opentofu","architecture":"amd64","goCompiledVersion":"go1.26.6"},"locations":[{"path":"/usr/local/bin/tofu","layerID":"sha256:02f497acae86193b675d599c46408e811e414a5a4487f7551c45fa616bf5d716","accessPath":"/usr/local/bin/tofu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.45.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-8wmf-6v46-5gfg","versionConstraint":">=1.5.0,<=1.44.0 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"go.opentelemetry.io/otel/exporters/otlp/otlptrace","version":"v1.42.0"},"language":"go","namespace":"github:language:go"}}],"vulnerability":{"id":"GHSA-8wmf-6v46-5gfg","fix":{"state":"fixed","versions":["1.45.0"],"available":[{"date":"2026-09-18","kind":"first-observed","version":"1.45.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-81870","cwe":"CWE-200","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-81870","cwe":"CWE-532","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-81870","date":"2026-10-08","epss":0.00195,"percentile":0.08426}],"risk":0.048749999999999995,"urls":["https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-8wmf-6v46-5gfg","https://nvd.nist.gov/vuln/detail/CVE-2026-81870","https://github.com/open-telemetry/opentelemetry-go/pull/8438","https://github.com/open-telemetry/opentelemetry-go/commit/3a1412d2b3bc4e4231fbeac2ed42117ae541bb38","https://github.com/open-telemetry/opentelemetry-go/releases/tag/exporters/zipkin/v1.45.0","https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/v1.45.0"],"severity":"Low","namespace":"github:language:go","advisories":[],"dataSource":"https://github.com/advisories/GHSA-8wmf-6v46-5gfg","description":"OpenTelemetry-Go: Exporter config logging may leak endpoint URLs in info logs"},"relatedVulnerabilities":[{"id":"CVE-2026-81870","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-81870","cwe":"CWE-200","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-81870","cwe":"CWE-532","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-81870","date":"2026-10-08","epss":0.00195,"percentile":0.08426}],"urls":["https://github.com/open-telemetry/opentelemetry-go/commit/3a1412d2b3bc4e4231fbeac2ed42117ae541bb38","https://github.com/open-telemetry/opentelemetry-go/pull/8438","https://github.com/open-telemetry/opentelemetry-go/releases/tag/exporters/zipkin/v1.45.0","https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/v1.45.0","https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-8wmf-6v46-5gfg"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-81870","description":"OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 1.5.0 to 1.44.0, sdk/trace.NewTracerProvider emits a TracerProvider created internal Info-level diagnostic event whose MarshalLog implementations recursively include span processor, exporter, and client configuration. Applications that call otel.SetLogger to enable OpenTelemetry internal Info logging can therefore record OTLP gRPC and HTTP collector endpoints, the OTLP HTTP Insecure flag, and complete Zipkin collector URLs. A person or system with access to those logs can learn internal collector topology and can recover credentials or tokens embedded in Zipkin URL user information or query strings. The default OpenTelemetry logger does not emit the event, and this path does not log OTLP authentication headers, TLS key material, or span payloads. This issue is fixed in version 1.45.0."}]},{"artifact":{"id":"d1eaa5555d20f838","cpes":["cpe:2.3:a:otel:exporters\\/otlp\\/otlptrace\\/otlptracegrpc:v1.42.0:*:*:*:*:*:*:*"],"name":"go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc","purl":"pkg:golang/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc@v1.42.0","type":"go-module","version":"v1.42.0","language":"go","licenses":[],"metadata":{"h1Digest":"h1:zWWrB1U6nqhS/k6zYB74CjRpuiitRtLLi68VcgmOEto=","mainModule":"github.com/opentofu/opentofu","architecture":"amd64","goCompiledVersion":"go1.26.6"},"locations":[{"path":"/usr/local/bin/tofu","layerID":"sha256:02f497acae86193b675d599c46408e811e414a5a4487f7551c45fa616bf5d716","accessPath":"/usr/local/bin/tofu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.45.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-8wmf-6v46-5gfg","versionConstraint":">=1.5.0,<=1.44.0 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc","version":"v1.42.0"},"language":"go","namespace":"github:language:go"}}],"vulnerability":{"id":"GHSA-8wmf-6v46-5gfg","fix":{"state":"fixed","versions":["1.45.0"],"available":[{"date":"2026-09-18","kind":"first-observed","version":"1.45.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-81870","cwe":"CWE-200","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-81870","cwe":"CWE-532","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-81870","date":"2026-10-08","epss":0.00195,"percentile":0.08426}],"risk":0.048749999999999995,"urls":["https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-8wmf-6v46-5gfg","https://nvd.nist.gov/vuln/detail/CVE-2026-81870","https://github.com/open-telemetry/opentelemetry-go/pull/8438","https://github.com/open-telemetry/opentelemetry-go/commit/3a1412d2b3bc4e4231fbeac2ed42117ae541bb38","https://github.com/open-telemetry/opentelemetry-go/releases/tag/exporters/zipkin/v1.45.0","https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/v1.45.0"],"severity":"Low","namespace":"github:language:go","advisories":[],"dataSource":"https://github.com/advisories/GHSA-8wmf-6v46-5gfg","description":"OpenTelemetry-Go: Exporter config logging may leak endpoint URLs in info logs"},"relatedVulnerabilities":[{"id":"CVE-2026-81870","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-81870","cwe":"CWE-200","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-81870","cwe":"CWE-532","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-81870","date":"2026-10-08","epss":0.00195,"percentile":0.08426}],"urls":["https://github.com/open-telemetry/opentelemetry-go/commit/3a1412d2b3bc4e4231fbeac2ed42117ae541bb38","https://github.com/open-telemetry/opentelemetry-go/pull/8438","https://github.com/open-telemetry/opentelemetry-go/releases/tag/exporters/zipkin/v1.45.0","https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/v1.45.0","https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-8wmf-6v46-5gfg"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-81870","description":"OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 1.5.0 to 1.44.0, sdk/trace.NewTracerProvider emits a TracerProvider created internal Info-level diagnostic event whose MarshalLog implementations recursively include span processor, exporter, and client configuration. Applications that call otel.SetLogger to enable OpenTelemetry internal Info logging can therefore record OTLP gRPC and HTTP collector endpoints, the OTLP HTTP Insecure flag, and complete Zipkin collector URLs. A person or system with access to those logs can learn internal collector topology and can recover credentials or tokens embedded in Zipkin URL user information or query strings. The default OpenTelemetry logger does not emit the event, and this path does not log OTLP authentication headers, TLS key material, or span payloads. This issue is fixed in version 1.45.0."}]},{"artifact":{"id":"6134e677f2ebb196","cpes":["cpe:2.3:a:otel:exporters\\/otlp\\/otlptrace\\/otlptracehttp:v1.42.0:*:*:*:*:*:*:*"],"name":"go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp","purl":"pkg:golang/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.42.0","type":"go-module","version":"v1.42.0","language":"go","licenses":[],"metadata":{"h1Digest":"h1:uLXP+3mghfMf7XmV4PkGfFhFKuNWoCvvx5wP/wOXo0o=","mainModule":"github.com/opentofu/opentofu","architecture":"amd64","goCompiledVersion":"go1.26.6"},"locations":[{"path":"/usr/local/bin/tofu","layerID":"sha256:02f497acae86193b675d599c46408e811e414a5a4487f7551c45fa616bf5d716","accessPath":"/usr/local/bin/tofu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.45.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-8wmf-6v46-5gfg","versionConstraint":">=1.5.0,<=1.44.0 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp","version":"v1.42.0"},"language":"go","namespace":"github:language:go"}}],"vulnerability":{"id":"GHSA-8wmf-6v46-5gfg","fix":{"state":"fixed","versions":["1.45.0"],"available":[{"date":"2026-09-18","kind":"first-observed","version":"1.45.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-81870","cwe":"CWE-200","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-81870","cwe":"CWE-532","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-81870","date":"2026-10-08","epss":0.00195,"percentile":0.08426}],"risk":0.048749999999999995,"urls":["https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-8wmf-6v46-5gfg","https://nvd.nist.gov/vuln/detail/CVE-2026-81870","https://github.com/open-telemetry/opentelemetry-go/pull/8438","https://github.com/open-telemetry/opentelemetry-go/commit/3a1412d2b3bc4e4231fbeac2ed42117ae541bb38","https://github.com/open-telemetry/opentelemetry-go/releases/tag/exporters/zipkin/v1.45.0","https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/v1.45.0"],"severity":"Low","namespace":"github:language:go","advisories":[],"dataSource":"https://github.com/advisories/GHSA-8wmf-6v46-5gfg","description":"OpenTelemetry-Go: Exporter config logging may leak endpoint URLs in info logs"},"relatedVulnerabilities":[{"id":"CVE-2026-81870","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-81870","cwe":"CWE-200","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-81870","cwe":"CWE-532","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-81870","date":"2026-10-08","epss":0.00195,"percentile":0.08426}],"urls":["https://github.com/open-telemetry/opentelemetry-go/commit/3a1412d2b3bc4e4231fbeac2ed42117ae541bb38","https://github.com/open-telemetry/opentelemetry-go/pull/8438","https://github.com/open-telemetry/opentelemetry-go/releases/tag/exporters/zipkin/v1.45.0","https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/v1.45.0","https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-8wmf-6v46-5gfg"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-81870","description":"OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 1.5.0 to 1.44.0, sdk/trace.NewTracerProvider emits a TracerProvider created internal Info-level diagnostic event whose MarshalLog implementations recursively include span processor, exporter, and client configuration. Applications that call otel.SetLogger to enable OpenTelemetry internal Info logging can therefore record OTLP gRPC and HTTP collector endpoints, the OTLP HTTP Insecure flag, and complete Zipkin collector URLs. A person or system with access to those logs can learn internal collector topology and can recover credentials or tokens embedded in Zipkin URL user information or query strings. The default OpenTelemetry logger does not emit the event, and this path does not log OTLP authentication headers, TLS key material, or span payloads. This issue is fixed in version 1.45.0."}]},{"artifact":{"id":"2aa428cb5b1169f4","cpes":["cpe:2.3:a:otel:sdk:v1.42.0:*:*:*:*:*:*:*"],"name":"go.opentelemetry.io/otel/sdk","purl":"pkg:golang/go.opentelemetry.io/otel/sdk@v1.42.0","type":"go-module","version":"v1.42.0","language":"go","licenses":[],"metadata":{"h1Digest":"h1:LyC8+jqk6UJwdrI/8VydAq/hvkFKNHZVIWuslJXYsDo=","mainModule":"github.com/opentofu/opentofu","architecture":"amd64","goCompiledVersion":"go1.26.6"},"locations":[{"path":"/usr/local/bin/tofu","layerID":"sha256:02f497acae86193b675d599c46408e811e414a5a4487f7551c45fa616bf5d716","accessPath":"/usr/local/bin/tofu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.45.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-8wmf-6v46-5gfg","versionConstraint":">=1.5.0,<=1.44.0 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"go.opentelemetry.io/otel/sdk","version":"v1.42.0"},"language":"go","namespace":"github:language:go"}}],"vulnerability":{"id":"GHSA-8wmf-6v46-5gfg","fix":{"state":"fixed","versions":["1.45.0"],"available":[{"date":"2026-09-18","kind":"first-observed","version":"1.45.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-81870","cwe":"CWE-200","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-81870","cwe":"CWE-532","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-81870","date":"2026-10-08","epss":0.00195,"percentile":0.08426}],"risk":0.048749999999999995,"urls":["https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-8wmf-6v46-5gfg","https://nvd.nist.gov/vuln/detail/CVE-2026-81870","https://github.com/open-telemetry/opentelemetry-go/pull/8438","https://github.com/open-telemetry/opentelemetry-go/commit/3a1412d2b3bc4e4231fbeac2ed42117ae541bb38","https://github.com/open-telemetry/opentelemetry-go/releases/tag/exporters/zipkin/v1.45.0","https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/v1.45.0"],"severity":"Low","namespace":"github:language:go","advisories":[],"dataSource":"https://github.com/advisories/GHSA-8wmf-6v46-5gfg","description":"OpenTelemetry-Go: Exporter config logging may leak endpoint URLs in info logs"},"relatedVulnerabilities":[{"id":"CVE-2026-81870","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-81870","cwe":"CWE-200","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-81870","cwe":"CWE-532","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-81870","date":"2026-10-08","epss":0.00195,"percentile":0.08426}],"urls":["https://github.com/open-telemetry/opentelemetry-go/commit/3a1412d2b3bc4e4231fbeac2ed42117ae541bb38","https://github.com/open-telemetry/opentelemetry-go/pull/8438","https://github.com/open-telemetry/opentelemetry-go/releases/tag/exporters/zipkin/v1.45.0","https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/v1.45.0","https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-8wmf-6v46-5gfg"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-81870","description":"OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 1.5.0 to 1.44.0, sdk/trace.NewTracerProvider emits a TracerProvider created internal Info-level diagnostic event whose MarshalLog implementations recursively include span processor, exporter, and client configuration. Applications that call otel.SetLogger to enable OpenTelemetry internal Info logging can therefore record OTLP gRPC and HTTP collector endpoints, the OTLP HTTP Insecure flag, and complete Zipkin collector URLs. A person or system with access to those logs can learn internal collector topology and can recover credentials or tokens embedded in Zipkin URL user information or query strings. The default OpenTelemetry logger does not emit the event, and this path does not log OTLP authentication headers, TLS key material, or span payloads. This issue is fixed in version 1.45.0."}]},{"artifact":{"id":"02a7da2d8264292d","cpes":["cpe:2.3:a:google:grpc:v1.79.3:*:*:*:*:*:*:*"],"name":"google.golang.org/grpc","purl":"pkg:golang/google.golang.org/grpc@v1.79.3","type":"go-module","version":"v1.79.3","language":"go","licenses":[],"metadata":{"h1Digest":"h1:sybAEdRIEtvcD68Gx7dmnwjZKlyfuc61Dyo9pGXXkKE=","mainModule":"github.com/opentofu/opentofu","architecture":"amd64","goCompiledVersion":"go1.26.6"},"locations":[{"path":"/usr/local/bin/tofu","layerID":"sha256:02f497acae86193b675d599c46408e811e414a5a4487f7551c45fa616bf5d716","accessPath":"/usr/local/bin/tofu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.82.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-hrxh-6v49-42gf","versionConstraint":"<1.82.1 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"google.golang.org/grpc","version":"v1.79.3"},"language":"go","namespace":"github:language:go"}}],"vulnerability":{"id":"GHSA-hrxh-6v49-42gf","fix":{"state":"fixed","versions":["1.82.1"],"available":[{"date":"2026-07-22","kind":"first-observed","version":"1.82.1"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.8},"version":"4.0","vendorMetadata":{}}],"risk":0,"urls":["https://github.com/grpc/grpc-go/security/advisories/GHSA-hrxh-6v49-42gf","https://github.com/grpc/grpc-go/pull/9236","https://github.com/grpc/grpc-go/commit/4ea465d4ab98013f72a142fe0fc89c19770b2935","https://github.com/grpc/grpc-go/releases/tag/v1.82.1"],"severity":"High","namespace":"github:language:go","advisories":[],"dataSource":"https://github.com/advisories/GHSA-hrxh-6v49-42gf","description":"gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities"},"relatedVulnerabilities":[]},{"artifact":{"id":"5a931f7608513895","cpes":["cpe:2.3:a:aws:aws-sdk-go-v2\\/aws\\/protocol\\/eventstream:v1.7.7:*:*:*:*:*:*:*","cpe:2.3:a:aws:aws_sdk_go_v2\\/aws\\/protocol\\/eventstream:v1.7.7:*:*:*:*:*:*:*"],"name":"github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream","purl":"pkg:golang/github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.7.7","type":"go-module","version":"v1.7.7","language":"go","licenses":[],"metadata":{"h1Digest":"h1:3kGOqnh1pPeddVa/E37XNTaWJ8W6vrbYV9lJEkCnhuY=","mainModule":"github.com/opentofu/opentofu","architecture":"amd64","goCompiledVersion":"go1.26.6"},"locations":[{"path":"/usr/local/bin/tofu","layerID":"sha256:02f497acae86193b675d599c46408e811e414a5a4487f7551c45fa616bf5d716","accessPath":"/usr/local/bin/tofu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.7.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-xmrv-pmrh-hhx2","versionConstraint":"<1.7.8 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream","version":"v1.7.7"},"language":"go","namespace":"github:language:go"}}],"vulnerability":{"id":"GHSA-xmrv-pmrh-hhx2","fix":{"state":"fixed","versions":["1.7.8"],"available":[{"date":"2026-04-08","kind":"first-observed","version":"1.7.8"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"risk":0,"urls":["https://github.com/aws/aws-sdk-go-v2/security/advisories/GHSA-xmrv-pmrh-hhx2","https://github.com/aws/aws-sdk-go-v2/releases/tag/release-2026-03-23"],"severity":"Medium","namespace":"github:language:go","advisories":[],"dataSource":"https://github.com/advisories/GHSA-xmrv-pmrh-hhx2","description":"Denial of Service due to Panic in AWS SDK for Go v2 SDK EventStream Decoder"},"relatedVulnerabilities":[]},{"artifact":{"id":"db41afee73da807f","cpes":["cpe:2.3:a:aws:aws-sdk-go-v2\\/service\\/s3:v1.97.1:*:*:*:*:*:*:*","cpe:2.3:a:aws:aws_sdk_go_v2\\/service\\/s3:v1.97.1:*:*:*:*:*:*:*"],"name":"github.com/aws/aws-sdk-go-v2/service/s3","purl":"pkg:golang/github.com/aws/aws-sdk-go-v2/service/s3@v1.97.1","type":"go-module","version":"v1.97.1","language":"go","licenses":[],"metadata":{"h1Digest":"h1:csi9NLpFZXb9fxY7rS1xVzgPRGMt7MSNWeQ6eo247kE=","mainModule":"github.com/opentofu/opentofu","architecture":"amd64","goCompiledVersion":"go1.26.6"},"locations":[{"path":"/usr/local/bin/tofu","layerID":"sha256:02f497acae86193b675d599c46408e811e414a5a4487f7551c45fa616bf5d716","accessPath":"/usr/local/bin/tofu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.97.3"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-xmrv-pmrh-hhx2","versionConstraint":"<1.97.3 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"github.com/aws/aws-sdk-go-v2/service/s3","version":"v1.97.1"},"language":"go","namespace":"github:language:go"}}],"vulnerability":{"id":"GHSA-xmrv-pmrh-hhx2","fix":{"state":"fixed","versions":["1.97.3"],"available":[{"date":"2026-04-08","kind":"first-observed","version":"1.97.3"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"risk":0,"urls":["https://github.com/aws/aws-sdk-go-v2/security/advisories/GHSA-xmrv-pmrh-hhx2","https://github.com/aws/aws-sdk-go-v2/releases/tag/release-2026-03-23"],"severity":"Medium","namespace":"github:language:go","advisories":[],"dataSource":"https://github.com/advisories/GHSA-xmrv-pmrh-hhx2","description":"Denial of Service due to Panic in AWS SDK for Go v2 SDK EventStream Decoder"},"relatedVulnerabilities":[]},{"artifact":{"id":"c49d6e7c41e42eec","cpes":["cpe:2.3:a:klauspost:compress:v1.18.5:*:*:*:*:*:*:*"],"name":"github.com/klauspost/compress","purl":"pkg:golang/github.com/klauspost/compress@v1.18.5","type":"go-module","version":"v1.18.5","language":"go","licenses":[],"metadata":{"h1Digest":"h1:/h1gH5Ce+VWNLSWqPzOVn6XBO+vJbCNGvjoaGBFW2IE=","mainModule":"github.com/opentofu/opentofu","architecture":"amd64","goCompiledVersion":"go1.26.6"},"locations":[{"path":"/usr/local/bin/tofu","layerID":"sha256:02f497acae86193b675d599c46408e811e414a5a4487f7551c45fa616bf5d716","accessPath":"/usr/local/bin/tofu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.18.7"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-5841","versionConstraint":">=1.16.0,<1.18.7 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"github.com/klauspost/compress","version":"v1.18.5"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-5841","fix":{"state":"fixed","versions":["1.18.7"],"available":[{"date":"2026-06-30","kind":"release","version":"1.18.7"}]},"cvss":[],"risk":0,"urls":["https://github.com/klauspost/compress/commit/8668e357e776d5152ed62f33c17f21b8690664fa"],"severity":"Unknown","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://github.com/klauspost/compress/security/advisories/GHSA-259r-337f-4rfw","description":"Providing a specially crafted dictionary to s2.NewDict and using it to encode data can make the encoder read out of bounds."},"relatedVulnerabilities":[{"id":"GHSA-259r-337f-4rfw","cvss":[],"urls":[],"severity":"Unknown","namespace":"github:language:go","dataSource":"github"}]},{"artifact":{"id":"9f89dc7ded553e4a","cpes":["cpe:2.3:a:golang:crypto:v0.56.0:*:*:*:*:go:*:*","cpe:2.3:a:go:ssh:v0.56.0:*:*:*:*:go:*:*"],"name":"golang.org/x/crypto","purl":"pkg:golang/golang.org/x/crypto@v0.56.0","type":"go-module","version":"v0.56.0","language":"go","licenses":[],"metadata":{"h1Digest":"h1:GUh5Ii4J5jtcseSMiRqr1jXCNHoxjeV9Fmekc2oLy6Y=","mainModule":"github.com/opentofu/opentofu","architecture":"amd64","goCompiledVersion":"go1.26.6"},"locations":[{"path":"/usr/local/bin/tofu","layerID":"sha256:02f497acae86193b675d599c46408e811e414a5a4487f7551c45fa616bf5d716","accessPath":"/usr/local/bin/tofu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-5932","versionConstraint":"none (unknown)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"golang.org/x/crypto","version":"v0.56.0"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-5932","fix":{"state":"","versions":[]},"cvss":[],"risk":0,"urls":[],"severity":"Unknown","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/issue/44226","description":"The golang.org/x/crypto/openpgp package is unsafe by design, has numerous known security issues, is not maintained, and should not be used.\n\nIf you are required to interoperate with OpenPGP systems and need a maintained package, consider github.com/ProtonMail/go-crypto/openpgp which is a maintained fork that aims to be a drop-in replacement for this package."},"relatedVulnerabilities":[]},{"artifact":{"id":"814b9e8902fe820e","cpes":["cpe:2.3:a:golang:networking:v0.57.0:*:*:*:*:go:*:*","cpe:2.3:a:golang:net:v0.57.0:*:*:*:*:go:*:*"],"name":"golang.org/x/net","purl":"pkg:golang/golang.org/x/net@v0.57.0","type":"go-module","version":"v0.57.0","language":"go","licenses":[],"metadata":{"h1Digest":"h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE=","mainModule":"github.com/opentofu/opentofu","architecture":"amd64","goCompiledVersion":"go1.26.6"},"locations":[{"path":"/usr/local/bin/tofu","layerID":"sha256:02f497acae86193b675d599c46408e811e414a5a4487f7551c45fa616bf5d716","accessPath":"/usr/local/bin/tofu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0.60.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-6603","versionConstraint":"<0.60.0 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"golang.org/x/net","version":"v0.57.0"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-6603","fix":{"state":"fixed","versions":["0.60.0"],"available":[{"date":"2026-10-08","kind":"release","version":"0.60.0"}]},"cvss":[],"risk":0,"urls":["https://go.dev/cl/847314","https://go.dev/issue/81857","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs"],"severity":"Unknown","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/847185","description":"When \"Trailer\" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a \"Trailer\" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently."},"relatedVulnerabilities":[{"id":"CVE-2026-78659","cvss":[],"urls":["https://go.dev/cl/847185","https://go.dev/cl/847314","https://go.dev/issue/81857","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs","https://pkg.go.dev/vuln/GO-2026-6603"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78659","description":"When \"Trailer\" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a \"Trailer\" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently."}]},{"artifact":{"id":"814b9e8902fe820e","cpes":["cpe:2.3:a:golang:networking:v0.57.0:*:*:*:*:go:*:*","cpe:2.3:a:golang:net:v0.57.0:*:*:*:*:go:*:*"],"name":"golang.org/x/net","purl":"pkg:golang/golang.org/x/net@v0.57.0","type":"go-module","version":"v0.57.0","language":"go","licenses":[],"metadata":{"h1Digest":"h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE=","mainModule":"github.com/opentofu/opentofu","architecture":"amd64","goCompiledVersion":"go1.26.6"},"locations":[{"path":"/usr/local/bin/tofu","layerID":"sha256:02f497acae86193b675d599c46408e811e414a5a4487f7551c45fa616bf5d716","accessPath":"/usr/local/bin/tofu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0.60.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-6610","versionConstraint":"<0.60.0 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"golang.org/x/net","version":"v0.57.0"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-6610","fix":{"state":"fixed","versions":["0.60.0"],"available":[{"date":"2026-10-08","kind":"release","version":"0.60.0"}]},"cvss":[],"risk":0,"urls":["https://go.dev/cl/836385","https://go.dev/issue/81115","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI"],"severity":"Unknown","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/835145","description":"Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a reverse proxy. If the HTTP/1 client also does not behave strictly enough, this can result in response smuggling."},"relatedVulnerabilities":[{"id":"CVE-2026-78660","cvss":[],"urls":["https://go.dev/cl/835145","https://go.dev/cl/836385","https://go.dev/issue/81115","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://pkg.go.dev/vuln/GO-2026-6610"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78660","description":"Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a reverse proxy. If the HTTP/1 client also does not behave strictly enough, this can result in response smuggling."}]},{"artifact":{"id":"814b9e8902fe820e","cpes":["cpe:2.3:a:golang:networking:v0.57.0:*:*:*:*:go:*:*","cpe:2.3:a:golang:net:v0.57.0:*:*:*:*:go:*:*"],"name":"golang.org/x/net","purl":"pkg:golang/golang.org/x/net@v0.57.0","type":"go-module","version":"v0.57.0","language":"go","licenses":[],"metadata":{"h1Digest":"h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE=","mainModule":"github.com/opentofu/opentofu","architecture":"amd64","goCompiledVersion":"go1.26.6"},"locations":[{"path":"/usr/local/bin/tofu","layerID":"sha256:02f497acae86193b675d599c46408e811e414a5a4487f7551c45fa616bf5d716","accessPath":"/usr/local/bin/tofu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0.60.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-6611","versionConstraint":"<0.60.0 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"golang.org/x/net","version":"v0.57.0"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-6611","fix":{"state":"fixed","versions":["0.60.0"],"available":[{"date":"2026-10-08","kind":"release","version":"0.60.0"}]},"cvss":[],"risk":0,"urls":["https://go.dev/cl/847308","https://go.dev/issue/81742","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs"],"severity":"Unknown","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/847186","description":"A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values."},"relatedVulnerabilities":[{"id":"CVE-2026-78669","cvss":[],"urls":["https://go.dev/cl/847186","https://go.dev/cl/847308","https://go.dev/issue/81742","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs","https://pkg.go.dev/vuln/GO-2026-6611"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78669","description":"A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values."}]},{"artifact":{"id":"814b9e8902fe820e","cpes":["cpe:2.3:a:golang:networking:v0.57.0:*:*:*:*:go:*:*","cpe:2.3:a:golang:net:v0.57.0:*:*:*:*:go:*:*"],"name":"golang.org/x/net","purl":"pkg:golang/golang.org/x/net@v0.57.0","type":"go-module","version":"v0.57.0","language":"go","licenses":[],"metadata":{"h1Digest":"h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE=","mainModule":"github.com/opentofu/opentofu","architecture":"amd64","goCompiledVersion":"go1.26.6"},"locations":[{"path":"/usr/local/bin/tofu","layerID":"sha256:02f497acae86193b675d599c46408e811e414a5a4487f7551c45fa616bf5d716","accessPath":"/usr/local/bin/tofu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0.60.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-6612","versionConstraint":"<0.60.0 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"golang.org/x/net","version":"v0.57.0"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-6612","fix":{"state":"fixed","versions":["0.60.0"],"available":[{"date":"2026-10-08","kind":"release","version":"0.60.0"}]},"cvss":[],"risk":0,"urls":["https://go.dev/cl/847310","https://go.dev/issue/81743","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs"],"severity":"Unknown","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/847187","description":"The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control."},"relatedVulnerabilities":[{"id":"CVE-2026-78663","cvss":[],"urls":["https://go.dev/cl/847187","https://go.dev/cl/847310","https://go.dev/issue/81743","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs","https://pkg.go.dev/vuln/GO-2026-6612"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78663","description":"The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control."}]},{"artifact":{"id":"814b9e8902fe820e","cpes":["cpe:2.3:a:golang:networking:v0.57.0:*:*:*:*:go:*:*","cpe:2.3:a:golang:net:v0.57.0:*:*:*:*:go:*:*"],"name":"golang.org/x/net","purl":"pkg:golang/golang.org/x/net@v0.57.0","type":"go-module","version":"v0.57.0","language":"go","licenses":[],"metadata":{"h1Digest":"h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE=","mainModule":"github.com/opentofu/opentofu","architecture":"amd64","goCompiledVersion":"go1.26.6"},"locations":[{"path":"/usr/local/bin/tofu","layerID":"sha256:02f497acae86193b675d599c46408e811e414a5a4487f7551c45fa616bf5d716","accessPath":"/usr/local/bin/tofu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"0.60.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-6617","versionConstraint":"<0.60.0 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"golang.org/x/net","version":"v0.57.0"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-6617","fix":{"state":"fixed","versions":["0.60.0"],"available":[{"date":"2026-10-08","kind":"release","version":"0.60.0"}]},"cvss":[],"risk":0,"urls":["https://go.dev/cl/847313","https://go.dev/issue/81867","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs"],"severity":"Unknown","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/847188","description":"HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the other modifies the encoder's table size when handling a SETTINGS frame containing SETTINGS_HEADER_TABLE_SIZE that a client sends. A malicious client can repeatedly send a request while changing the header table size to crash the server."},"relatedVulnerabilities":[{"id":"CVE-2026-97032","cvss":[],"urls":["https://go.dev/cl/847188","https://go.dev/cl/847313","https://go.dev/issue/81867","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs","https://pkg.go.dev/vuln/GO-2026-6617"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-97032","description":"HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the other modifies the encoder's table size when handling a SETTINGS frame containing SETTINGS_HEADER_TABLE_SIZE that a client sends. A malicious client can repeatedly send a request while changing the header table size to crash the server."}]},{"artifact":{"id":"47226dc7dd72fa64","cpes":["cpe:2.3:a:golang:go:1.26.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.26.6","type":"go-module","version":"go1.26.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.26.6"},"locations":[{"path":"/usr/local/bin/tofu","layerID":"sha256:02f497acae86193b675d599c46408e811e414a5a4487f7551c45fa616bf5d716","accessPath":"/usr/local/bin/tofu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.26.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-6599","versionConstraint":"<1.26.9||>=1.27.0-0,<1.27.2 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.26.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-6599","fix":{"state":"fixed","versions":["1.26.9","1.27.2"],"available":[{"date":"2026-10-08","kind":"release","version":"1.26.9"},{"date":"2026-10-08","kind":"release","version":"1.27.2"}]},"cvss":[],"risk":0,"urls":["https://go.dev/issue/81821","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI"],"severity":"Unknown","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/839866","description":"When a JavaScript template literal contains consecutive expressions, the context tracking state was not properly reset upon entering a new expression.\n\nWe now ensure that template-literal expression entries correctly reset context variables so all subsequent regular expression literals are accurately recognized and escaped."},"relatedVulnerabilities":[{"id":"CVE-2026-94448","cvss":[],"urls":["https://go.dev/cl/839866","https://go.dev/issue/81821","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://pkg.go.dev/vuln/GO-2026-6599"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-94448","description":"When a JavaScript template literal contains consecutive expressions, the context tracking state was not properly reset upon entering a new expression. We now ensure that template-literal expression entries correctly reset context variables so all subsequent regular expression literals are accurately recognized and escaped."}]},{"artifact":{"id":"47226dc7dd72fa64","cpes":["cpe:2.3:a:golang:go:1.26.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.26.6","type":"go-module","version":"go1.26.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.26.6"},"locations":[{"path":"/usr/local/bin/tofu","layerID":"sha256:02f497acae86193b675d599c46408e811e414a5a4487f7551c45fa616bf5d716","accessPath":"/usr/local/bin/tofu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.26.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-6600","versionConstraint":"<1.26.9||>=1.27.0-0,<1.27.2 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.26.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-6600","fix":{"state":"fixed","versions":["1.26.9","1.27.2"],"available":[{"date":"2026-10-08","kind":"release","version":"1.26.9"},{"date":"2026-10-08","kind":"release","version":"1.27.2"}]},"cvss":[],"risk":0,"urls":["https://go.dev/issue/81823","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI"],"severity":"Unknown","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/840925","description":"A trusted template author may have previously written a valid template wherein the use of the 'yield' keyword would not be correctly escaped.\n\nWe now ensure that valid keyword uses are escaped and non-keyword uses are not escaped."},"relatedVulnerabilities":[{"id":"CVE-2026-97030","cvss":[],"urls":["https://go.dev/cl/840925","https://go.dev/issue/81823","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://pkg.go.dev/vuln/GO-2026-6600"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-97030","description":"A trusted template author may have previously written a valid template wherein the use of the 'yield' keyword would not be correctly escaped. We now ensure that valid keyword uses are escaped and non-keyword uses are not escaped."}]},{"artifact":{"id":"47226dc7dd72fa64","cpes":["cpe:2.3:a:golang:go:1.26.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.26.6","type":"go-module","version":"go1.26.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.26.6"},"locations":[{"path":"/usr/local/bin/tofu","layerID":"sha256:02f497acae86193b675d599c46408e811e414a5a4487f7551c45fa616bf5d716","accessPath":"/usr/local/bin/tofu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.26.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-6603","versionConstraint":"<1.26.9 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.26.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-6603","fix":{"state":"fixed","versions":["1.26.9"],"available":[{"date":"2026-10-08","kind":"release","version":"1.26.9"}]},"cvss":[],"risk":0,"urls":["https://go.dev/cl/847314","https://go.dev/issue/81857","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs"],"severity":"Unknown","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/847185","description":"When \"Trailer\" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a \"Trailer\" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently."},"relatedVulnerabilities":[{"id":"CVE-2026-78659","cvss":[],"urls":["https://go.dev/cl/847185","https://go.dev/cl/847314","https://go.dev/issue/81857","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs","https://pkg.go.dev/vuln/GO-2026-6603"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78659","description":"When \"Trailer\" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a \"Trailer\" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently."}]},{"artifact":{"id":"47226dc7dd72fa64","cpes":["cpe:2.3:a:golang:go:1.26.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.26.6","type":"go-module","version":"go1.26.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.26.6"},"locations":[{"path":"/usr/local/bin/tofu","layerID":"sha256:02f497acae86193b675d599c46408e811e414a5a4487f7551c45fa616bf5d716","accessPath":"/usr/local/bin/tofu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.26.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-6604","versionConstraint":"<1.26.9||>=1.27.0-0,<1.27.2 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.26.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-6604","fix":{"state":"fixed","versions":["1.26.9","1.27.2"],"available":[{"date":"2026-10-08","kind":"release","version":"1.26.9"},{"date":"2026-10-08","kind":"release","version":"1.27.2"}]},"cvss":[],"risk":0,"urls":["https://go.dev/issue/81739","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI"],"severity":"Unknown","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/847305","description":"On Windows, when the target of Root.Mkdir or Root.MkdirAll is a junction pointing to an empty location, the operation can create a directory at the junction target even when that target is located outside the root. This only applies to operations where the last path component is a junction (path/to/junction, but not path/junction/target)."},"relatedVulnerabilities":[{"id":"CVE-2026-56857","cvss":[],"urls":["https://go.dev/cl/847305","https://go.dev/issue/81739","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://pkg.go.dev/vuln/GO-2026-6604"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56857","description":"On Windows, when the target of Root.Mkdir or Root.MkdirAll is a junction pointing to an empty location, the operation can create a directory at the junction target even when that target is located outside the root. This only applies to operations where the last path component is a junction (path/to/junction, but not path/junction/target)."}]},{"artifact":{"id":"47226dc7dd72fa64","cpes":["cpe:2.3:a:golang:go:1.26.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.26.6","type":"go-module","version":"go1.26.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.26.6"},"locations":[{"path":"/usr/local/bin/tofu","layerID":"sha256:02f497acae86193b675d599c46408e811e414a5a4487f7551c45fa616bf5d716","accessPath":"/usr/local/bin/tofu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.26.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-6605","versionConstraint":"<1.26.9||>=1.27.0-0,<1.27.2 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.26.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-6605","fix":{"state":"fixed","versions":["1.26.9","1.27.2"],"available":[{"date":"2026-10-08","kind":"release","version":"1.26.9"},{"date":"2026-10-08","kind":"release","version":"1.27.2"}]},"cvss":[],"risk":0,"urls":["https://go.dev/issue/81740","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI"],"severity":"Unknown","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/847306","description":"When http.Transport sends an HTTP/1 CONNECT request with a non-empty Request.Body, it writes the body directly to the connection without framing after the request headers. If the server rejects the CONNECT request with a non-2xx keep-alive response, Transport returns the connection to the idle pool. Because CONNECT requests do not have a request body, the server may interpret the trailing body bytes as a subsequent pipelined HTTP/1.1 request on the connection, leaving the pooled connection desynchronized and causing the next caller that reuses it to read the response to the injected request. In reverse proxies (including httputil.ReverseProxy) that forward CONNECT requests through a shared Transport, this can lead to cross-user response poisoning."},"relatedVulnerabilities":[{"id":"CVE-2026-56866","cvss":[],"urls":["https://go.dev/cl/847306","https://go.dev/issue/81740","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://pkg.go.dev/vuln/GO-2026-6605"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56866","description":"When http.Transport sends an HTTP/1 CONNECT request with a non-empty Request.Body, it writes the body directly to the connection without framing after the request headers. If the server rejects the CONNECT request with a non-2xx keep-alive response, Transport returns the connection to the idle pool. Because CONNECT requests do not have a request body, the server may interpret the trailing body bytes as a subsequent pipelined HTTP/1.1 request on the connection, leaving the pooled connection desynchronized and causing the next caller that reuses it to read the response to the injected request. In reverse proxies (including httputil.ReverseProxy) that forward CONNECT requests through a shared Transport, this can lead to cross-user response poisoning."}]},{"artifact":{"id":"47226dc7dd72fa64","cpes":["cpe:2.3:a:golang:go:1.26.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.26.6","type":"go-module","version":"go1.26.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.26.6"},"locations":[{"path":"/usr/local/bin/tofu","layerID":"sha256:02f497acae86193b675d599c46408e811e414a5a4487f7551c45fa616bf5d716","accessPath":"/usr/local/bin/tofu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.26.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-6607","versionConstraint":"<1.26.9||>=1.27.0-0,<1.27.2 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.26.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-6607","fix":{"state":"fixed","versions":["1.26.9","1.27.2"],"available":[{"date":"2026-10-08","kind":"release","version":"1.26.9"},{"date":"2026-10-08","kind":"release","version":"1.27.2"}]},"cvss":[],"risk":0,"urls":["https://go.dev/issue/81855","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI"],"severity":"Unknown","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/847312","description":"Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted packet that could trigger memory exhaustion in the server process by specifying multiple references.\n\nWe now reject these as malformed and curb the memory amplification vector as a result."},"relatedVulnerabilities":[{"id":"CVE-2026-97031","cvss":[],"urls":["https://go.dev/cl/847312","https://go.dev/issue/81855","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://pkg.go.dev/vuln/GO-2026-6607"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-97031","description":"Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted packet that could trigger memory exhaustion in the server process by specifying multiple references. We now reject these as malformed and curb the memory amplification vector as a result."}]},{"artifact":{"id":"47226dc7dd72fa64","cpes":["cpe:2.3:a:golang:go:1.26.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.26.6","type":"go-module","version":"go1.26.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.26.6"},"locations":[{"path":"/usr/local/bin/tofu","layerID":"sha256:02f497acae86193b675d599c46408e811e414a5a4487f7551c45fa616bf5d716","accessPath":"/usr/local/bin/tofu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.26.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-6608","versionConstraint":"<1.26.9||>=1.27.0-0,<1.27.2 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.26.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-6608","fix":{"state":"fixed","versions":["1.26.9","1.27.2"],"available":[{"date":"2026-10-08","kind":"release","version":"1.26.9"},{"date":"2026-10-08","kind":"release","version":"1.27.2"}]},"cvss":[],"risk":0,"urls":["https://go.dev/issue/81741","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI"],"severity":"Unknown","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/847307","description":"Parsing a multipart form can bypass memory limits and read an arbitrarily long line into memory when the remaining limit at the start of a part is less than 400 bytes."},"relatedVulnerabilities":[{"id":"CVE-2026-94440","cvss":[],"urls":["https://go.dev/cl/847307","https://go.dev/issue/81741","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://pkg.go.dev/vuln/GO-2026-6608"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-94440","description":"Parsing a multipart form can bypass memory limits and read an arbitrarily long line into memory when the remaining limit at the start of a part is less than 400 bytes."}]},{"artifact":{"id":"47226dc7dd72fa64","cpes":["cpe:2.3:a:golang:go:1.26.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.26.6","type":"go-module","version":"go1.26.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.26.6"},"locations":[{"path":"/usr/local/bin/tofu","layerID":"sha256:02f497acae86193b675d599c46408e811e414a5a4487f7551c45fa616bf5d716","accessPath":"/usr/local/bin/tofu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.26.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-6609","versionConstraint":"<1.26.9||>=1.27.0-0,<1.27.2 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.26.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-6609","fix":{"state":"fixed","versions":["1.26.9","1.27.2"],"available":[{"date":"2026-10-08","kind":"release","version":"1.26.9"},{"date":"2026-10-08","kind":"release","version":"1.27.2"}]},"cvss":[],"risk":0,"urls":["https://go.dev/issue/81858","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI"],"severity":"Unknown","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/847309","description":"When parsing a Range header containing a large number of small ranges, FileServer(FS), ServeContent, and ServeFile(FS) can consume an excessive amount of CPU."},"relatedVulnerabilities":[{"id":"CVE-2026-78667","cvss":[],"urls":["https://go.dev/cl/847309","https://go.dev/issue/81858","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://pkg.go.dev/vuln/GO-2026-6609"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78667","description":"When parsing a Range header containing a large number of small ranges, FileServer(FS), ServeContent, and ServeFile(FS) can consume an excessive amount of CPU."}]},{"artifact":{"id":"47226dc7dd72fa64","cpes":["cpe:2.3:a:golang:go:1.26.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.26.6","type":"go-module","version":"go1.26.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.26.6"},"locations":[{"path":"/usr/local/bin/tofu","layerID":"sha256:02f497acae86193b675d599c46408e811e414a5a4487f7551c45fa616bf5d716","accessPath":"/usr/local/bin/tofu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.26.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-6610","versionConstraint":"<1.26.9 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.26.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-6610","fix":{"state":"fixed","versions":["1.26.9"],"available":[{"date":"2026-10-08","kind":"release","version":"1.26.9"}]},"cvss":[],"risk":0,"urls":["https://go.dev/cl/836385","https://go.dev/issue/81115","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI"],"severity":"Unknown","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/835145","description":"Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a reverse proxy. If the HTTP/1 client also does not behave strictly enough, this can result in response smuggling."},"relatedVulnerabilities":[{"id":"CVE-2026-78660","cvss":[],"urls":["https://go.dev/cl/835145","https://go.dev/cl/836385","https://go.dev/issue/81115","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://pkg.go.dev/vuln/GO-2026-6610"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78660","description":"Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a reverse proxy. If the HTTP/1 client also does not behave strictly enough, this can result in response smuggling."}]},{"artifact":{"id":"47226dc7dd72fa64","cpes":["cpe:2.3:a:golang:go:1.26.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.26.6","type":"go-module","version":"go1.26.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.26.6"},"locations":[{"path":"/usr/local/bin/tofu","layerID":"sha256:02f497acae86193b675d599c46408e811e414a5a4487f7551c45fa616bf5d716","accessPath":"/usr/local/bin/tofu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.26.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-6611","versionConstraint":"<1.26.9 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.26.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-6611","fix":{"state":"fixed","versions":["1.26.9"],"available":[{"date":"2026-10-08","kind":"release","version":"1.26.9"}]},"cvss":[],"risk":0,"urls":["https://go.dev/cl/847308","https://go.dev/issue/81742","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs"],"severity":"Unknown","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/847186","description":"A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values."},"relatedVulnerabilities":[{"id":"CVE-2026-78669","cvss":[],"urls":["https://go.dev/cl/847186","https://go.dev/cl/847308","https://go.dev/issue/81742","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs","https://pkg.go.dev/vuln/GO-2026-6611"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78669","description":"A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values."}]},{"artifact":{"id":"47226dc7dd72fa64","cpes":["cpe:2.3:a:golang:go:1.26.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.26.6","type":"go-module","version":"go1.26.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.26.6"},"locations":[{"path":"/usr/local/bin/tofu","layerID":"sha256:02f497acae86193b675d599c46408e811e414a5a4487f7551c45fa616bf5d716","accessPath":"/usr/local/bin/tofu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.26.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-6612","versionConstraint":"<1.26.9 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.26.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-6612","fix":{"state":"fixed","versions":["1.26.9"],"available":[{"date":"2026-10-08","kind":"release","version":"1.26.9"}]},"cvss":[],"risk":0,"urls":["https://go.dev/cl/847310","https://go.dev/issue/81743","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs"],"severity":"Unknown","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/847187","description":"The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control."},"relatedVulnerabilities":[{"id":"CVE-2026-78663","cvss":[],"urls":["https://go.dev/cl/847187","https://go.dev/cl/847310","https://go.dev/issue/81743","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs","https://pkg.go.dev/vuln/GO-2026-6612"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78663","description":"The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control."}]},{"artifact":{"id":"47226dc7dd72fa64","cpes":["cpe:2.3:a:golang:go:1.26.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.26.6","type":"go-module","version":"go1.26.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.26.6"},"locations":[{"path":"/usr/local/bin/tofu","layerID":"sha256:02f497acae86193b675d599c46408e811e414a5a4487f7551c45fa616bf5d716","accessPath":"/usr/local/bin/tofu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.26.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-6613","versionConstraint":"<1.26.9||>=1.27.0-0,<1.27.2 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.26.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-6613","fix":{"state":"fixed","versions":["1.26.9","1.27.2"],"available":[{"date":"2026-10-08","kind":"release","version":"1.26.9"},{"date":"2026-10-08","kind":"release","version":"1.27.2"}]},"cvss":[],"risk":0,"urls":["https://go.dev/issue/81744","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI"],"severity":"Unknown","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/847311","description":"When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the connection. Since a 2xx response to an HTTP/1 CONNECT converts the connection into a tunnel, the server should not treat the connection as continuing to contain HTTP.\n\nThe impact of this misbehavior is mostly limited to potential request smuggling, where an intermediate proxy considers the data on the connection to be tunneled and the server considers it to be HTTP."},"relatedVulnerabilities":[{"id":"CVE-2026-94439","cvss":[],"urls":["https://go.dev/cl/847311","https://go.dev/issue/81744","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://pkg.go.dev/vuln/GO-2026-6613"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-94439","description":"When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the connection. Since a 2xx response to an HTTP/1 CONNECT converts the connection into a tunnel, the server should not treat the connection as continuing to contain HTTP. The impact of this misbehavior is mostly limited to potential request smuggling, where an intermediate proxy considers the data on the connection to be tunneled and the server considers it to be HTTP."}]},{"artifact":{"id":"47226dc7dd72fa64","cpes":["cpe:2.3:a:golang:go:1.26.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.26.6","type":"go-module","version":"go1.26.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.26.6"},"locations":[{"path":"/usr/local/bin/tofu","layerID":"sha256:02f497acae86193b675d599c46408e811e414a5a4487f7551c45fa616bf5d716","accessPath":"/usr/local/bin/tofu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.26.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-6617","versionConstraint":"<1.26.9 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.26.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-6617","fix":{"state":"fixed","versions":["1.26.9"],"available":[{"date":"2026-10-08","kind":"release","version":"1.26.9"}]},"cvss":[],"risk":0,"urls":["https://go.dev/cl/847313","https://go.dev/issue/81867","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs"],"severity":"Unknown","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/847188","description":"HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the other modifies the encoder's table size when handling a SETTINGS frame containing SETTINGS_HEADER_TABLE_SIZE that a client sends. A malicious client can repeatedly send a request while changing the header table size to crash the server."},"relatedVulnerabilities":[{"id":"CVE-2026-97032","cvss":[],"urls":["https://go.dev/cl/847188","https://go.dev/cl/847313","https://go.dev/issue/81867","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs","https://pkg.go.dev/vuln/GO-2026-6617"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-97032","description":"HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the other modifies the encoder's table size when handling a SETTINGS frame containing SETTINGS_HEADER_TABLE_SIZE that a client sends. A malicious client can repeatedly send a request while changing the header table size to crash the server."}]}],"grade":"F","score":"0.00","as_of":"2026-10-09T19:19:18.669Z","grype_db_version":"2026-10-09T06:32:32.000Z"}