{"grype_matches":[{"artifact":{"id":"de2e09a252869bf3","cpes":["cpe:2.3:a:git-scm:git:2.30.6-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_scm:git:2.30.6-r0:*:*:*:*:*:*:*","cpe:2.3:a:git:git:2.30.6-r0:*:*:*:*:*:*:*"],"name":"git","purl":"pkg:apk/busybox/git@2.30.6-r0?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"2.30.6-r0","language":"","licenses":["GPL-2.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/git"},{"path":"/usr/bin/git-receive-pack"},{"path":"/usr/bin/git-shell"},{"path":"/usr/bin/git-upload-archive"},{"path":"/usr/bin/git-upload-pack"},{"path":"/usr/libexec"},{"path":"/usr/libexec/git-core"},{"path":"/usr/libexec/git-core/git"},{"path":"/usr/libexec/git-core/git-add"},{"path":"/usr/libexec/git-core/git-am"},{"path":"/usr/libexec/git-core/git-annotate"},{"path":"/usr/libexec/git-core/git-apply"},{"path":"/usr/libexec/git-core/git-archive"},{"path":"/usr/libexec/git-core/git-bisect"},{"path":"/usr/libexec/git-core/git-bisect--helper"},{"path":"/usr/libexec/git-core/git-blame"},{"path":"/usr/libexec/git-core/git-branch"},{"path":"/usr/libexec/git-core/git-bugreport"},{"path":"/usr/libexec/git-core/git-bundle"},{"path":"/usr/libexec/git-core/git-cat-file"},{"path":"/usr/libexec/git-core/git-check-attr"},{"path":"/usr/libexec/git-core/git-check-ignore"},{"path":"/usr/libexec/git-core/git-check-mailmap"},{"path":"/usr/libexec/git-core/git-check-ref-format"},{"path":"/usr/libexec/git-core/git-checkout"},{"path":"/usr/libexec/git-core/git-checkout-index"},{"path":"/usr/libexec/git-core/git-cherry"},{"path":"/usr/libexec/git-core/git-cherry-pick"},{"path":"/usr/libexec/git-core/git-clean"},{"path":"/usr/libexec/git-core/git-clone"},{"path":"/usr/libexec/git-core/git-column"},{"path":"/usr/libexec/git-core/git-commit"},{"path":"/usr/libexec/git-core/git-commit-graph"},{"path":"/usr/libexec/git-core/git-commit-tree"},{"path":"/usr/libexec/git-core/git-config"},{"path":"/usr/libexec/git-core/git-count-objects"},{"path":"/usr/libexec/git-core/git-credential"},{"path":"/usr/libexec/git-core/git-credential-cache"},{"path":"/usr/libexec/git-core/git-credential-cache--daemon"},{"path":"/usr/libexec/git-core/git-credential-store"},{"path":"/usr/libexec/git-core/git-describe"},{"path":"/usr/libexec/git-core/git-diff"},{"path":"/usr/libexec/git-core/git-diff-files"},{"path":"/usr/libexec/git-core/git-diff-index"},{"path":"/usr/libexec/git-core/git-diff-tree"},{"path":"/usr/libexec/git-core/git-difftool"},{"path":"/usr/libexec/git-core/git-difftool--helper"},{"path":"/usr/libexec/git-core/git-env--helper"},{"path":"/usr/libexec/git-core/git-fast-export"},{"path":"/usr/libexec/git-core/git-fetch"},{"path":"/usr/libexec/git-core/git-fetch-pack"},{"path":"/usr/libexec/git-core/git-filter-branch"},{"path":"/usr/libexec/git-core/git-fmt-merge-msg"},{"path":"/usr/libexec/git-core/git-for-each-ref"},{"path":"/usr/libexec/git-core/git-for-each-repo"},{"path":"/usr/libexec/git-core/git-format-patch"},{"path":"/usr/libexec/git-core/git-fsck"},{"path":"/usr/libexec/git-core/git-fsck-objects"},{"path":"/usr/libexec/git-core/git-gc"},{"path":"/usr/libexec/git-core/git-get-tar-commit-id"},{"path":"/usr/libexec/git-core/git-grep"},{"path":"/usr/libexec/git-core/git-hash-object"},{"path":"/usr/libexec/git-core/git-help"},{"path":"/usr/libexec/git-core/git-http-fetch"},{"path":"/usr/libexec/git-core/git-http-push"},{"path":"/usr/libexec/git-core/git-index-pack"},{"path":"/usr/libexec/git-core/git-init"},{"path":"/usr/libexec/git-core/git-init-db"},{"path":"/usr/libexec/git-core/git-interpret-trailers"},{"path":"/usr/libexec/git-core/git-log"},{"path":"/usr/libexec/git-core/git-ls-files"},{"path":"/usr/libexec/git-core/git-ls-remote"},{"path":"/usr/libexec/git-core/git-ls-tree"},{"path":"/usr/libexec/git-core/git-mailinfo"},{"path":"/usr/libexec/git-core/git-mailsplit"},{"path":"/usr/libexec/git-core/git-maintenance"},{"path":"/usr/libexec/git-core/git-merge"},{"path":"/usr/libexec/git-core/git-merge-base"},{"path":"/usr/libexec/git-core/git-merge-file"},{"path":"/usr/libexec/git-core/git-merge-index"},{"path":"/usr/libexec/git-core/git-merge-octopus"},{"path":"/usr/libexec/git-core/git-merge-one-file"},{"path":"/usr/libexec/git-core/git-merge-ours"},{"path":"/usr/libexec/git-core/git-merge-recursive"},{"path":"/usr/libexec/git-core/git-merge-resolve"},{"path":"/usr/libexec/git-core/git-merge-subtree"},{"path":"/usr/libexec/git-core/git-merge-tree"},{"path":"/usr/libexec/git-core/git-mergetool"},{"path":"/usr/libexec/git-core/git-mergetool--lib"},{"path":"/usr/libexec/git-core/git-mktag"},{"path":"/usr/libexec/git-core/git-mktree"},{"path":"/usr/libexec/git-core/git-multi-pack-index"},{"path":"/usr/libexec/git-core/git-mv"},{"path":"/usr/libexec/git-core/git-name-rev"},{"path":"/usr/libexec/git-core/git-notes"},{"path":"/usr/libexec/git-core/git-pack-objects"},{"path":"/usr/libexec/git-core/git-pack-redundant"},{"path":"/usr/libexec/git-core/git-pack-refs"},{"path":"/usr/libexec/git-core/git-patch-id"},{"path":"/usr/libexec/git-core/git-prune"},{"path":"/usr/libexec/git-core/git-prune-packed"},{"path":"/usr/libexec/git-core/git-pull"},{"path":"/usr/libexec/git-core/git-push"},{"path":"/usr/libexec/git-core/git-quiltimport"},{"path":"/usr/libexec/git-core/git-range-diff"},{"path":"/usr/libexec/git-core/git-read-tree"},{"path":"/usr/libexec/git-core/git-rebase"},{"path":"/usr/libexec/git-core/git-rebase--preserve-merges"},{"path":"/usr/libexec/git-core/git-receive-pack"},{"path":"/usr/libexec/git-core/git-reflog"},{"path":"/usr/libexec/git-core/git-remote"},{"path":"/usr/libexec/git-core/git-remote-ext"},{"path":"/usr/libexec/git-core/git-remote-fd"},{"path":"/usr/libexec/git-core/git-remote-ftp"},{"path":"/usr/libexec/git-core/git-remote-ftps"},{"path":"/usr/libexec/git-core/git-remote-http"},{"path":"/usr/libexec/git-core/git-remote-https"},{"path":"/usr/libexec/git-core/git-repack"},{"path":"/usr/libexec/git-core/git-replace"},{"path":"/usr/libexec/git-core/git-request-pull"},{"path":"/usr/libexec/git-core/git-rerere"},{"path":"/usr/libexec/git-core/git-reset"},{"path":"/usr/libexec/git-core/git-restore"},{"path":"/usr/libexec/git-core/git-rev-list"},{"path":"/usr/libexec/git-core/git-rev-parse"},{"path":"/usr/libexec/git-core/git-revert"},{"path":"/usr/libexec/git-core/git-rm"},{"path":"/usr/libexec/git-core/git-send-pack"},{"path":"/usr/libexec/git-core/git-sh-i18n"},{"path":"/usr/libexec/git-core/git-sh-i18n--envsubst"},{"path":"/usr/libexec/git-core/git-sh-setup"},{"path":"/usr/libexec/git-core/git-shortlog"},{"path":"/usr/libexec/git-core/git-show"},{"path":"/usr/libexec/git-core/git-show-branch"},{"path":"/usr/libexec/git-core/git-show-index"},{"path":"/usr/libexec/git-core/git-show-ref"},{"path":"/usr/libexec/git-core/git-sparse-checkout"},{"path":"/usr/libexec/git-core/git-stage"},{"path":"/usr/libexec/git-core/git-stash"},{"path":"/usr/libexec/git-core/git-status"},{"path":"/usr/libexec/git-core/git-stripspace"},{"path":"/usr/libexec/git-core/git-submodule"},{"path":"/usr/libexec/git-core/git-submodule--helper"},{"path":"/usr/libexec/git-core/git-switch"},{"path":"/usr/libexec/git-core/git-symbolic-ref"},{"path":"/usr/libexec/git-core/git-tag"},{"path":"/usr/libexec/git-core/git-unpack-file"},{"path":"/usr/libexec/git-core/git-unpack-objects"},{"path":"/usr/libexec/git-core/git-update-index"},{"path":"/usr/libexec/git-core/git-update-ref"},{"path":"/usr/libexec/git-core/git-update-server-info"},{"path":"/usr/libexec/git-core/git-upload-archive"},{"path":"/usr/libexec/git-core/git-upload-pack"},{"path":"/usr/libexec/git-core/git-var"},{"path":"/usr/libexec/git-core/git-verify-commit"},{"path":"/usr/libexec/git-core/git-verify-pack"},{"path":"/usr/libexec/git-core/git-verify-tag"},{"path":"/usr/libexec/git-core/git-web--browse"},{"path":"/usr/libexec/git-core/git-whatchanged"},{"path":"/usr/libexec/git-core/git-worktree"},{"path":"/usr/libexec/git-core/git-write-tree"},{"path":"/usr/libexec/git-core/mergetools"},{"path":"/usr/libexec/git-core/mergetools/araxis"},{"path":"/usr/libexec/git-core/mergetools/bc"},{"path":"/usr/libexec/git-core/mergetools/codecompare"},{"path":"/usr/libexec/git-core/mergetools/deltawalker"},{"path":"/usr/libexec/git-core/mergetools/diffmerge"},{"path":"/usr/libexec/git-core/mergetools/diffuse"},{"path":"/usr/libexec/git-core/mergetools/ecmerge"},{"path":"/usr/libexec/git-core/mergetools/emerge"},{"path":"/usr/libexec/git-core/mergetools/examdiff"},{"path":"/usr/libexec/git-core/mergetools/guiffy"},{"path":"/usr/libexec/git-core/mergetools/gvimdiff"},{"path":"/usr/libexec/git-core/mergetools/kdiff3"},{"path":"/usr/libexec/git-core/mergetools/kompare"},{"path":"/usr/libexec/git-core/mergetools/meld"},{"path":"/usr/libexec/git-core/mergetools/nvimdiff"},{"path":"/usr/libexec/git-core/mergetools/opendiff"},{"path":"/usr/libexec/git-core/mergetools/smerge"},{"path":"/usr/libexec/git-core/mergetools/tkdiff"},{"path":"/usr/libexec/git-core/mergetools/tortoisemerge"},{"path":"/usr/libexec/git-core/mergetools/vimdiff"},{"path":"/usr/libexec/git-core/mergetools/winmerge"},{"path":"/usr/libexec/git-core/mergetools/xxdiff"},{"path":"/usr/share"},{"path":"/usr/share/git-core"},{"path":"/usr/share/git-core/templates"},{"path":"/usr/share/git-core/templates/description"},{"path":"/usr/share/git-core/templates/branches"},{"path":"/usr/share/git-core/templates/hooks"},{"path":"/usr/share/git-core/templates/hooks/applypatch-msg.sample"},{"path":"/usr/share/git-core/templates/hooks/commit-msg.sample"},{"path":"/usr/share/git-core/templates/hooks/post-update.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-applypatch.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-commit.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-merge-commit.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-push.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-rebase.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-receive.sample"},{"path":"/usr/share/git-core/templates/hooks/prepare-commit-msg.sample"},{"path":"/usr/share/git-core/templates/hooks/push-to-checkout.sample"},{"path":"/usr/share/git-core/templates/hooks/update.sample"},{"path":"/usr/share/git-core/templates/info"},{"path":"/usr/share/git-core/templates/info/exclude"},{"path":"/usr/share/perl5"},{"path":"/var"},{"path":"/var/git"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"git"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-48384","versionConstraint":"< 2.43.7||>= 2.44.0-rc0, < 2.44.4||>= 2.45.0-rc0, < 2.45.4||>= 2.46.0-rc0, < 2.46.4||>= 2.47.0-rc0, < 2.47.3||>= 2.48.0-rc0, < 2.48.2||>= 2.49.0-rc0, < 2.49.1||>= 2.50.0-rc0, < 2.50.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:git-scm:git:2.30.6:*:*:*:*:*:*:*"],"package":{"name":"git","version":"2.30.6-r0"},"namespace":"nvd:cpe"}},{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:git:git:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-48384","versionConstraint":"< 2.43.7||>= 2.44.0-rc0, < 2.44.4||>= 2.45.0-rc0, < 2.45.4||>= 2.46.0-rc0, < 2.46.4||>= 2.47.0-rc0, < 2.47.3||>= 2.48.0-rc0, < 2.48.2||>= 2.49.0-rc0, < 2.49.1||>= 2.50.0-rc0, < 2.50.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:git:git:2.30.6:*:*:*:*:*:*:*"],"package":{"name":"git","version":"2.30.6-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2025-48384","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8,"impactScore":6.1,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-48384","cwe":"CWE-59","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2025-48384","cwe":"CWE-436","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-48384","date":"2026-10-08","epss":0.042,"percentile":0.90696}],"risk":81.37500000000001,"urls":["https://github.com/git/git/security/advisories/GHSA-vwqx-4fm8-6qc9","http://seclists.org/fulldisclosure/2025/Sep/60","http://www.openwall.com/lists/oss-security/2025/07/08/4","https://lists.debian.org/debian-lts-announce/2025/10/msg00003.html","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-48384"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-48384","description":"Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When reading a config value, Git strips any trailing carriage return and line feed (CRLF). When writing a config entry, values with a trailing CR are not quoted, causing the CR to be lost when the config is later read. When initializing a submodule, if the submodule path contains a trailing CR, the altered path is read resulting in the submodule being checked out to an incorrect location. If a symlink exists that points the altered path to the submodule hooks directory, and the submodule contains an executable post-checkout hook, the script may be unintentionally executed after checkout. This vulnerability is fixed in v2.43.7, v2.44.4, v2.45.4, v2.46.4, v2.47.3, v2.48.2, v2.49.1, and v2.50.1.","knownExploited":[{"cve":"CVE-2025-48384","cwes":["CWE-59","CWE-436"],"urls":["https://access.redhat.com/errata/RHSA-2025:13933","https://alas.aws.amazon.com/AL2/ALAS2-2025-2941.html","https://linux.oracle.com/errata/ELSA-2025-11534.html","https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-48384","https://nvd.nist.gov/vuln/detail/CVE-2025-48384"],"notes":"This vulnerability affects a common open-source component, third-party library, or a protocol used by different products. For more information, please see: https://github.com/git/git/security/advisories/GHSA-vwqx-4fm8-6qc9","dueDate":"2025-09-15","product":"Git","dateAdded":"2025-08-25","vendorProject":"Git","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"unknown"}]},"relatedVulnerabilities":[]},{"artifact":{"id":"19103520a7fb35af","cpes":["cpe:2.3:a:nghttp2-libs:nghttp2-libs:1.42.0-r1:*:*:*:*:*:*:*","cpe:2.3:a:nghttp2-libs:nghttp2_libs:1.42.0-r1:*:*:*:*:*:*:*","cpe:2.3:a:nghttp2_libs:nghttp2-libs:1.42.0-r1:*:*:*:*:*:*:*","cpe:2.3:a:nghttp2_libs:nghttp2_libs:1.42.0-r1:*:*:*:*:*:*:*","cpe:2.3:a:nghttp-libs:nghttp2-libs:1.42.0-r1:*:*:*:*:*:*:*","cpe:2.3:a:nghttp-libs:nghttp2_libs:1.42.0-r1:*:*:*:*:*:*:*","cpe:2.3:a:nghttp2-libs:nghttp-libs:1.42.0-r1:*:*:*:*:*:*:*","cpe:2.3:a:nghttp2-libs:nghttp_libs:1.42.0-r1:*:*:*:*:*:*:*","cpe:2.3:a:nghttp2_libs:nghttp-libs:1.42.0-r1:*:*:*:*:*:*:*","cpe:2.3:a:nghttp2_libs:nghttp_libs:1.42.0-r1:*:*:*:*:*:*:*","cpe:2.3:a:nghttp_libs:nghttp2-libs:1.42.0-r1:*:*:*:*:*:*:*","cpe:2.3:a:nghttp_libs:nghttp2_libs:1.42.0-r1:*:*:*:*:*:*:*","cpe:2.3:a:nghttp-libs:nghttp-libs:1.42.0-r1:*:*:*:*:*:*:*","cpe:2.3:a:nghttp-libs:nghttp_libs:1.42.0-r1:*:*:*:*:*:*:*","cpe:2.3:a:nghttp_libs:nghttp-libs:1.42.0-r1:*:*:*:*:*:*:*","cpe:2.3:a:nghttp_libs:nghttp_libs:1.42.0-r1:*:*:*:*:*:*:*","cpe:2.3:a:nghttp2:nghttp2-libs:1.42.0-r1:*:*:*:*:*:*:*","cpe:2.3:a:nghttp2:nghttp2_libs:1.42.0-r1:*:*:*:*:*:*:*","cpe:2.3:a:nghttp2:nghttp-libs:1.42.0-r1:*:*:*:*:*:*:*","cpe:2.3:a:nghttp2:nghttp_libs:1.42.0-r1:*:*:*:*:*:*:*","cpe:2.3:a:nghttp:nghttp2-libs:1.42.0-r1:*:*:*:*:*:*:*","cpe:2.3:a:nghttp:nghttp2_libs:1.42.0-r1:*:*:*:*:*:*:*","cpe:2.3:a:nghttp:nghttp-libs:1.42.0-r1:*:*:*:*:*:*:*","cpe:2.3:a:nghttp:nghttp_libs:1.42.0-r1:*:*:*:*:*:*:*"],"name":"nghttp2-libs","purl":"pkg:apk/busybox/nghttp2-libs@1.42.0-r1?arch=x86_64&distro=busybox-1.32.1&upstream=nghttp2","type":"apk","version":"1.42.0-r1","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libnghttp2.so.14"},{"path":"/usr/lib/libnghttp2.so.14.20.1"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"nghttp2"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:nghttp2:nghttp2:*:*:*:*:*:go:*:*"],"vulnerabilityID":"CVE-2023-44487","versionConstraint":"< 1.57.0 (go)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:nghttp2:nghttp2:1.42.0:*:*:*:*:*:*:*"],"package":{"name":"nghttp2","version":"1.42.0-r1"},"namespace":"nvd:cpe"}},{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:nghttp2:nghttp2:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2023-44487","versionConstraint":"< 1.57.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:nghttp2:nghttp2:1.42.0:*:*:*:*:*:*:*"],"package":{"name":"nghttp2","version":"1.42.0-r1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2023-44487","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-44487","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-44487","date":"2026-10-08","epss":0.99999,"percentile":0.99998}],"risk":78.75000000000001,"urls":["http://www.openwall.com/lists/oss-security/2023/10/10/6","http://www.openwall.com/lists/oss-security/2023/10/10/7","http://www.openwall.com/lists/oss-security/2023/10/13/4","http://www.openwall.com/lists/oss-security/2023/10/13/9","http://www.openwall.com/lists/oss-security/2023/10/18/4","http://www.openwall.com/lists/oss-security/2023/10/18/8","http://www.openwall.com/lists/oss-security/2023/10/19/6","http://www.openwall.com/lists/oss-security/2023/10/20/8","https://access.redhat.com/security/cve/cve-2023-44487","https://arstechnica.com/security/2023/10/how-ddosers-used-the-http-2-protocol-to-deliver-attacks-of-unprecedented-size/","https://aws.amazon.com/security/security-bulletins/AWS-2023-011/","https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/","https://blog.cloudflare.com/zero-day-rapid-reset-http2-record-breaking-ddos-attack/","https://blog.litespeedtech.com/2023/10/11/rapid-reset-http-2-vulnerablilty/","https://blog.qualys.com/vulnerabilities-threat-research/2023/10/10/cve-2023-44487-http-2-rapid-reset-attack","https://blog.vespa.ai/cve-2023-44487/","https://bugzilla.proxmox.com/show_bug.cgi?id=4988","https://bugzilla.redhat.com/show_bug.cgi?id=2242803","https://bugzilla.suse.com/show_bug.cgi?id=1216123","https://cgit.freebsd.org/ports/commit/?id=c64c329c2c1752f46b73e3e6ce9f4329be6629f9","https://cloud.google.com/blog/products/identity-security/google-cloud-mitigated-largest-ddos-attack-peaking-above-398-million-rps/","https://cloud.google.com/blog/products/identity-security/how-it-works-the-novel-http2-rapid-reset-ddos-attack","https://community.traefik.io/t/is-traefik-vulnerable-to-cve-2023-44487/20125","https://discuss.hashicorp.com/t/hcsec-2023-32-vault-consul-and-boundary-affected-by-http-2-rapid-reset-denial-of-service-vulnerability-cve-2023-44487/59715","https://edg.io/lp/blog/resets-leaks-ddos-and-the-tale-of-a-hidden-cve","https://forums.swift.org/t/swift-nio-http2-security-update-cve-2023-44487-http-2-dos/67764","https://gist.github.com/adulau/7c2bfb8e9cdbe4b35a5e131c66a0c088","https://github.com/Azure/AKS/issues/3947","https://github.com/Kong/kong/discussions/11741","https://github.com/advisories/GHSA-qppj-fm5r-hxr3","https://github.com/advisories/GHSA-vx74-f528-fxqg","https://github.com/advisories/GHSA-xpw8-rcwv-8f8p","https://github.com/akka/akka-http/issues/4323","https://github.com/alibaba/tengine/issues/1872","https://github.com/apache/apisix/issues/10320","https://github.com/apache/httpd-site/pull/10","https://github.com/apache/httpd/blob/afcdbeebbff4b0c50ea26cdd16e178c0d1f24152/modules/http2/h2_mplx.c#L1101-L1113","https://github.com/apache/tomcat/tree/main/java/org/apache/coyote/http2","https://github.com/apache/trafficserver/pull/10564","https://github.com/arkrwn/PoC/tree/main/CVE-2023-44487","https://github.com/bcdannyboy/CVE-2023-44487","https://github.com/caddyserver/caddy/issues/5877","https://github.com/caddyserver/caddy/releases/tag/v2.7.5","https://github.com/dotnet/announcements/issues/277","https://github.com/dotnet/core/blob/e4613450ea0da7fd2fc6b61dfb2c1c1dec1ce9ec/release-notes/6.0/6.0.23/6.0.23.md?plain=1#L73","https://github.com/eclipse/jetty.project/issues/10679","https://github.com/envoyproxy/envoy/pull/30055","https://github.com/etcd-io/etcd/issues/16740","https://github.com/facebook/proxygen/pull/466","https://github.com/golang/go/issues/63417","https://github.com/grpc/grpc-go/pull/6703","https://github.com/grpc/grpc/releases/tag/v1.59.2","https://github.com/h2o/h2o/pull/3291","https://github.com/h2o/h2o/security/advisories/GHSA-2m7v-gc89-fjqf","https://github.com/haproxy/haproxy/issues/2312","https://github.com/icing/mod_h2/blob/0a864782af0a942aa2ad4ed960a6b32cd35bcf0a/mod_http2/README.md?plain=1#L239-L244","https://github.com/junkurihara/rust-rpxy/issues/97","https://github.com/kazu-yamamoto/http2/commit/f61d41a502bd0f60eb24e1ce14edc7b6df6722a1","https://github.com/kazu-yamamoto/http2/issues/93","https://github.com/kubernetes/kubernetes/pull/121120","https://github.com/line/armeria/pull/5232","https://github.com/linkerd/website/pull/1695/commits/4b9c6836471bc8270ab48aae6fd2181bc73fd632","https://github.com/micrictor/http2-rst-stream","https://github.com/microsoft/CBL-Mariner/pull/6381","https://github.com/netty/netty/commit/58f75f665aa81a8cbcf6ffa74820042a285c5e61","https://github.com/nghttp2/nghttp2/pull/1961","https://github.com/nghttp2/nghttp2/releases/tag/v1.57.0","https://github.com/ninenines/cowboy/issues/1615","https://github.com/nodejs/node/pull/50121","https://github.com/openresty/openresty/issues/930","https://github.com/opensearch-project/data-prepper/issues/3474","https://github.com/oqtane/oqtane.framework/discussions/3367","https://github.com/projectcontour/contour/pull/5826","https://github.com/tempesta-tech/tempesta/issues/1986","https://github.com/varnishcache/varnish-cache/issues/3996","https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo","https://istio.io/latest/news/security/istio-security-2023-004/","https://linkerd.io/2023/10/12/linkerd-cve-2023-44487/","https://lists.apache.org/thread/5py8h42mxfsn8l1wy6o41xwhsjlsd87q","https://lists.debian.org/debian-lts-announce/2023/10/msg00020.html","https://lists.debian.org/debian-lts-announce/2023/10/msg00023.html","https://lists.debian.org/debian-lts-announce/2023/10/msg00024.html","https://lists.debian.org/debian-lts-announce/2023/10/msg00045.html","https://lists.debian.org/debian-lts-announce/2023/10/msg00047.html","https://lists.debian.org/debian-lts-announce/2023/11/msg00001.html","https://lists.debian.org/debian-lts-announce/2023/11/msg00012.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2MBEPPC36UBVOZZNAXFHKLFGSLCMN5LI/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3N4NJ7FR4X4FPZUGNTQAPSTVB2HB2Y4A/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BFQD3KUEMFBHPAPBGLWQC34L4OWL5HAZ/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CLB4TW7KALB3EEQWNWCN7OUIWWVWWCG2/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/E72T67UPDRXHIDLO3OROR25YAMN4GGW5/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FNA62Q767CFAFHBCDKYNPBMZWB7TWYVU/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HT7T2R4MQKLIF4ODV4BDLPARWFPCJ5CZ/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JIZSEFC3YKCGABA2BZW6ZJRMDZJMB7PJ/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JMEXY22BFG5Q64HQCM5CK2Q7KDKVV4TY/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KSEGD2IWKNUO3DWY4KQGUQM5BISRWHQE/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LKYHSZQFDNR7RSA7LHVLLIAQMVYCUGBG/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LNMZJCDHGLJJLXO4OXWJMTVQRNWOC7UL/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VHUHTSXLXGXS7JYKBXTA3VINUPHTNGVU/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VSRDIV77HNKUSM7SJC5BKE5JSHLHU2NK/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WE2I52RHNNU42PX6NZ2RBUHSFFJ2LVZX/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WLPRQ5TWUQQXYWBJM7ECYDAIL2YVKIUH/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X6QXN4ORIVF6XBW4WWFE7VNPVC74S45Y/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XFOIBB4YFICHDM7IBOP7PWXW3FX4HLL2/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZB43REMKRQR62NJEI7I5NQ4FSXNLBKRT/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZKQSIKIAT5TJ3WSLU3RDBQ35YX4GY4V3/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZLU6U2R2IC2K64NDPNMV55AUAO65MAF4/","https://lists.w3.org/Archives/Public/ietf-http-wg/2023OctDec/0025.html","https://mailman.nginx.org/pipermail/nginx-devel/2023-October/S36Q5HBXR7CAIMPLLPRSSSYR4PCMWILK.html","https://martinthomson.github.io/h2-stream-limits/draft-thomson-httpbis-h2-stream-limits.html","https://msrc.microsoft.com/blog/2023/10/microsoft-response-to-distributed-denial-of-service-ddos-attacks-against-http/2/","https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-44487","https://my.f5.com/manage/s/article/K000137106","https://netty.io/news/2023/10/10/4-1-100-Final.html","https://news.ycombinator.com/item?id=37830987","https://news.ycombinator.com/item?id=37830998","https://news.ycombinator.com/item?id=37831062","https://news.ycombinator.com/item?id=37837043","https://openssf.org/blog/2023/10/10/http-2-rapid-reset-vulnerability-highlights-need-for-rapid-response/","https://seanmonstar.com/post/730794151136935936/hyper-http2-rapid-reset-unaffected","https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-http2-reset-d8Kf32vZ","https://security.gentoo.org/glsa/202311-09","https://security.netapp.com/advisory/ntap-20231016-0001/","https://security.netapp.com/advisory/ntap-20240426-0007/","https://security.netapp.com/advisory/ntap-20240621-0006/","https://security.netapp.com/advisory/ntap-20240621-0007/","https://security.paloaltonetworks.com/CVE-2023-44487","https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.14","https://ubuntu.com/security/CVE-2023-44487","https://www.bleepingcomputer.com/news/security/new-http-2-rapid-reset-zero-day-attack-breaks-ddos-records/","https://www.cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487","https://www.darkreading.com/cloud/internet-wide-zero-day-bug-fuels-largest-ever-ddos-event","https://www.debian.org/security/2023/dsa-5521","https://www.debian.org/security/2023/dsa-5522","https://www.debian.org/security/2023/dsa-5540","https://www.debian.org/security/2023/dsa-5549","https://www.debian.org/security/2023/dsa-5558","https://www.debian.org/security/2023/dsa-5570","https://www.haproxy.com/blog/haproxy-is-not-affected-by-the-http-2-rapid-reset-attack-cve-2023-44487","https://www.netlify.com/blog/netlify-successfully-mitigates-cve-2023-44487/","https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/","https://www.openwall.com/lists/oss-security/2023/10/10/6","https://www.phoronix.com/news/HTTP2-Rapid-Reset-Attack","https://www.theregister.com/2023/10/10/http2_rapid_reset_zeroday/","http://www.openwall.com/lists/oss-security/2025/08/13/6","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2MBEPPC36UBVOZZNAXFHKLFGSLCMN5LI/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3N4NJ7FR4X4FPZUGNTQAPSTVB2HB2Y4A/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BFQD3KUEMFBHPAPBGLWQC34L4OWL5HAZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CLB4TW7KALB3EEQWNWCN7OUIWWVWWCG2/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E72T67UPDRXHIDLO3OROR25YAMN4GGW5/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FNA62Q767CFAFHBCDKYNPBMZWB7TWYVU/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HT7T2R4MQKLIF4ODV4BDLPARWFPCJ5CZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JIZSEFC3YKCGABA2BZW6ZJRMDZJMB7PJ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JMEXY22BFG5Q64HQCM5CK2Q7KDKVV4TY/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KSEGD2IWKNUO3DWY4KQGUQM5BISRWHQE/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LKYHSZQFDNR7RSA7LHVLLIAQMVYCUGBG/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LNMZJCDHGLJJLXO4OXWJMTVQRNWOC7UL/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VHUHTSXLXGXS7JYKBXTA3VINUPHTNGVU/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VSRDIV77HNKUSM7SJC5BKE5JSHLHU2NK/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WE2I52RHNNU42PX6NZ2RBUHSFFJ2LVZX/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WLPRQ5TWUQQXYWBJM7ECYDAIL2YVKIUH/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X6QXN4ORIVF6XBW4WWFE7VNPVC74S45Y/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XFOIBB4YFICHDM7IBOP7PWXW3FX4HLL2/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZB43REMKRQR62NJEI7I5NQ4FSXNLBKRT/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZKQSIKIAT5TJ3WSLU3RDBQ35YX4GY4V3/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZLU6U2R2IC2K64NDPNMV55AUAO65MAF4/","https://www.vicarius.io/vsociety/posts/rapid-reset-cve-2023-44487-dos-in-http2-understanding-the-root-cause","https://cert-portal.siemens.com/productcert/html/ssa-082556.html","https://cert-portal.siemens.com/productcert/html/ssa-341067.html","https://cert-portal.siemens.com/productcert/html/ssa-784301.html","https://cert-portal.siemens.com/productcert/html/ssa-832273.html","https://cert-portal.siemens.com/productcert/html/ssa-915275.html","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-44487","https://github.com/envoyproxy/envoy/security/advisories/GHSA-jhv4-f7mr-xx76","https://github.com/kubernetes/ingress-nginx/blob/4b5c5efe2508dc915a48c54de7f23912ff2ec695/changelog/controller-1.9.3.md?plain=1#L15","https://varnish-cache.org/releases/rel6.0.12.html#rel6-0-12","https://varnish-cache.org/releases/rel7.3.1.html#rel7-3-1","https://varnish-cache.org/releases/rel7.4.2.html#rel7-4-2"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-44487","description":"The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.","knownExploited":[{"cve":"CVE-2023-44487","cwes":["CWE-400"],"urls":["https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/","https://nvd.nist.gov/vuln/detail/CVE-2023-44487"],"notes":"This vulnerability affects a common open-source component, third-party library, or protocol used by different products. For more information, please see: HTTP/2 Rapid Reset Vulnerability, CVE-2023-44487 | CISA: https://www.cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487","dueDate":"2023-10-31","product":"HTTP/2","dateAdded":"2023-10-10","vendorProject":"IETF","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"unknown"}]},"relatedVulnerabilities":[]},{"artifact":{"id":"422a442f930ca27c","cpes":["cpe:2.3:a:nginx:nginx:1.18.0-r15:*:*:*:*:*:*:*"],"name":"nginx","purl":"pkg:apk/busybox/nginx@1.18.0-r15?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"1.18.0-r15","language":"","licenses":["BSD-2-Clause"],"metadata":{"Arch":"x86_64","files":[{"path":"/etc"},{"path":"/etc/logrotate.d"},{"path":"/etc/logrotate.d/nginx"},{"path":"/etc/nginx"},{"path":"/etc/nginx/fastcgi.conf"},{"path":"/etc/nginx/fastcgi_params"},{"path":"/etc/nginx/mime.types"},{"path":"/etc/nginx/nginx.conf"},{"path":"/etc/nginx/scgi_params"},{"path":"/etc/nginx/uwsgi_params"},{"path":"/etc/nginx/http.d"},{"path":"/etc/nginx/modules"},{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/nginx"},{"path":"/usr/lib/nginx/modules"},{"path":"/usr/sbin"},{"path":"/usr/sbin/nginx"},{"path":"/usr/share"},{"path":"/usr/share/nginx"},{"path":"/usr/share/nginx/http-default_server.conf"},{"path":"/var"},{"path":"/var/lib"},{"path":"/var/lib/nginx"},{"path":"/var/lib/nginx/logs"},{"path":"/var/lib/nginx/modules"},{"path":"/var/lib/nginx/run"},{"path":"/var/lib/nginx/html"},{"path":"/var/lib/nginx/html/50x.html"},{"path":"/var/lib/nginx/html/index.html"},{"path":"/var/lib/nginx/tmp"},{"path":"/var/log"},{"path":"/var/log/nginx"},{"path":"/var/www"},{"path":"/var/www/localhost"},{"path":"/var/www/localhost/htdocs"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"nginx"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:nginx:nginx:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2023-44487","versionConstraint":">= 1.9.5, < 1.25.3 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:nginx:nginx:1.18.0:*:*:*:*:*:*:*"],"package":{"name":"nginx","version":"1.18.0-r15"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2023-44487","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-44487","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-44487","date":"2026-10-08","epss":0.99999,"percentile":0.99998}],"risk":78.75000000000001,"urls":["http://www.openwall.com/lists/oss-security/2023/10/10/6","http://www.openwall.com/lists/oss-security/2023/10/10/7","http://www.openwall.com/lists/oss-security/2023/10/13/4","http://www.openwall.com/lists/oss-security/2023/10/13/9","http://www.openwall.com/lists/oss-security/2023/10/18/4","http://www.openwall.com/lists/oss-security/2023/10/18/8","http://www.openwall.com/lists/oss-security/2023/10/19/6","http://www.openwall.com/lists/oss-security/2023/10/20/8","https://access.redhat.com/security/cve/cve-2023-44487","https://arstechnica.com/security/2023/10/how-ddosers-used-the-http-2-protocol-to-deliver-attacks-of-unprecedented-size/","https://aws.amazon.com/security/security-bulletins/AWS-2023-011/","https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/","https://blog.cloudflare.com/zero-day-rapid-reset-http2-record-breaking-ddos-attack/","https://blog.litespeedtech.com/2023/10/11/rapid-reset-http-2-vulnerablilty/","https://blog.qualys.com/vulnerabilities-threat-research/2023/10/10/cve-2023-44487-http-2-rapid-reset-attack","https://blog.vespa.ai/cve-2023-44487/","https://bugzilla.proxmox.com/show_bug.cgi?id=4988","https://bugzilla.redhat.com/show_bug.cgi?id=2242803","https://bugzilla.suse.com/show_bug.cgi?id=1216123","https://cgit.freebsd.org/ports/commit/?id=c64c329c2c1752f46b73e3e6ce9f4329be6629f9","https://cloud.google.com/blog/products/identity-security/google-cloud-mitigated-largest-ddos-attack-peaking-above-398-million-rps/","https://cloud.google.com/blog/products/identity-security/how-it-works-the-novel-http2-rapid-reset-ddos-attack","https://community.traefik.io/t/is-traefik-vulnerable-to-cve-2023-44487/20125","https://discuss.hashicorp.com/t/hcsec-2023-32-vault-consul-and-boundary-affected-by-http-2-rapid-reset-denial-of-service-vulnerability-cve-2023-44487/59715","https://edg.io/lp/blog/resets-leaks-ddos-and-the-tale-of-a-hidden-cve","https://forums.swift.org/t/swift-nio-http2-security-update-cve-2023-44487-http-2-dos/67764","https://gist.github.com/adulau/7c2bfb8e9cdbe4b35a5e131c66a0c088","https://github.com/Azure/AKS/issues/3947","https://github.com/Kong/kong/discussions/11741","https://github.com/advisories/GHSA-qppj-fm5r-hxr3","https://github.com/advisories/GHSA-vx74-f528-fxqg","https://github.com/advisories/GHSA-xpw8-rcwv-8f8p","https://github.com/akka/akka-http/issues/4323","https://github.com/alibaba/tengine/issues/1872","https://github.com/apache/apisix/issues/10320","https://github.com/apache/httpd-site/pull/10","https://github.com/apache/httpd/blob/afcdbeebbff4b0c50ea26cdd16e178c0d1f24152/modules/http2/h2_mplx.c#L1101-L1113","https://github.com/apache/tomcat/tree/main/java/org/apache/coyote/http2","https://github.com/apache/trafficserver/pull/10564","https://github.com/arkrwn/PoC/tree/main/CVE-2023-44487","https://github.com/bcdannyboy/CVE-2023-44487","https://github.com/caddyserver/caddy/issues/5877","https://github.com/caddyserver/caddy/releases/tag/v2.7.5","https://github.com/dotnet/announcements/issues/277","https://github.com/dotnet/core/blob/e4613450ea0da7fd2fc6b61dfb2c1c1dec1ce9ec/release-notes/6.0/6.0.23/6.0.23.md?plain=1#L73","https://github.com/eclipse/jetty.project/issues/10679","https://github.com/envoyproxy/envoy/pull/30055","https://github.com/etcd-io/etcd/issues/16740","https://github.com/facebook/proxygen/pull/466","https://github.com/golang/go/issues/63417","https://github.com/grpc/grpc-go/pull/6703","https://github.com/grpc/grpc/releases/tag/v1.59.2","https://github.com/h2o/h2o/pull/3291","https://github.com/h2o/h2o/security/advisories/GHSA-2m7v-gc89-fjqf","https://github.com/haproxy/haproxy/issues/2312","https://github.com/icing/mod_h2/blob/0a864782af0a942aa2ad4ed960a6b32cd35bcf0a/mod_http2/README.md?plain=1#L239-L244","https://github.com/junkurihara/rust-rpxy/issues/97","https://github.com/kazu-yamamoto/http2/commit/f61d41a502bd0f60eb24e1ce14edc7b6df6722a1","https://github.com/kazu-yamamoto/http2/issues/93","https://github.com/kubernetes/kubernetes/pull/121120","https://github.com/line/armeria/pull/5232","https://github.com/linkerd/website/pull/1695/commits/4b9c6836471bc8270ab48aae6fd2181bc73fd632","https://github.com/micrictor/http2-rst-stream","https://github.com/microsoft/CBL-Mariner/pull/6381","https://github.com/netty/netty/commit/58f75f665aa81a8cbcf6ffa74820042a285c5e61","https://github.com/nghttp2/nghttp2/pull/1961","https://github.com/nghttp2/nghttp2/releases/tag/v1.57.0","https://github.com/ninenines/cowboy/issues/1615","https://github.com/nodejs/node/pull/50121","https://github.com/openresty/openresty/issues/930","https://github.com/opensearch-project/data-prepper/issues/3474","https://github.com/oqtane/oqtane.framework/discussions/3367","https://github.com/projectcontour/contour/pull/5826","https://github.com/tempesta-tech/tempesta/issues/1986","https://github.com/varnishcache/varnish-cache/issues/3996","https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo","https://istio.io/latest/news/security/istio-security-2023-004/","https://linkerd.io/2023/10/12/linkerd-cve-2023-44487/","https://lists.apache.org/thread/5py8h42mxfsn8l1wy6o41xwhsjlsd87q","https://lists.debian.org/debian-lts-announce/2023/10/msg00020.html","https://lists.debian.org/debian-lts-announce/2023/10/msg00023.html","https://lists.debian.org/debian-lts-announce/2023/10/msg00024.html","https://lists.debian.org/debian-lts-announce/2023/10/msg00045.html","https://lists.debian.org/debian-lts-announce/2023/10/msg00047.html","https://lists.debian.org/debian-lts-announce/2023/11/msg00001.html","https://lists.debian.org/debian-lts-announce/2023/11/msg00012.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2MBEPPC36UBVOZZNAXFHKLFGSLCMN5LI/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3N4NJ7FR4X4FPZUGNTQAPSTVB2HB2Y4A/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BFQD3KUEMFBHPAPBGLWQC34L4OWL5HAZ/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CLB4TW7KALB3EEQWNWCN7OUIWWVWWCG2/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/E72T67UPDRXHIDLO3OROR25YAMN4GGW5/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FNA62Q767CFAFHBCDKYNPBMZWB7TWYVU/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HT7T2R4MQKLIF4ODV4BDLPARWFPCJ5CZ/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JIZSEFC3YKCGABA2BZW6ZJRMDZJMB7PJ/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JMEXY22BFG5Q64HQCM5CK2Q7KDKVV4TY/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KSEGD2IWKNUO3DWY4KQGUQM5BISRWHQE/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LKYHSZQFDNR7RSA7LHVLLIAQMVYCUGBG/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LNMZJCDHGLJJLXO4OXWJMTVQRNWOC7UL/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VHUHTSXLXGXS7JYKBXTA3VINUPHTNGVU/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VSRDIV77HNKUSM7SJC5BKE5JSHLHU2NK/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WE2I52RHNNU42PX6NZ2RBUHSFFJ2LVZX/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WLPRQ5TWUQQXYWBJM7ECYDAIL2YVKIUH/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X6QXN4ORIVF6XBW4WWFE7VNPVC74S45Y/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XFOIBB4YFICHDM7IBOP7PWXW3FX4HLL2/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZB43REMKRQR62NJEI7I5NQ4FSXNLBKRT/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZKQSIKIAT5TJ3WSLU3RDBQ35YX4GY4V3/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZLU6U2R2IC2K64NDPNMV55AUAO65MAF4/","https://lists.w3.org/Archives/Public/ietf-http-wg/2023OctDec/0025.html","https://mailman.nginx.org/pipermail/nginx-devel/2023-October/S36Q5HBXR7CAIMPLLPRSSSYR4PCMWILK.html","https://martinthomson.github.io/h2-stream-limits/draft-thomson-httpbis-h2-stream-limits.html","https://msrc.microsoft.com/blog/2023/10/microsoft-response-to-distributed-denial-of-service-ddos-attacks-against-http/2/","https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-44487","https://my.f5.com/manage/s/article/K000137106","https://netty.io/news/2023/10/10/4-1-100-Final.html","https://news.ycombinator.com/item?id=37830987","https://news.ycombinator.com/item?id=37830998","https://news.ycombinator.com/item?id=37831062","https://news.ycombinator.com/item?id=37837043","https://openssf.org/blog/2023/10/10/http-2-rapid-reset-vulnerability-highlights-need-for-rapid-response/","https://seanmonstar.com/post/730794151136935936/hyper-http2-rapid-reset-unaffected","https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-http2-reset-d8Kf32vZ","https://security.gentoo.org/glsa/202311-09","https://security.netapp.com/advisory/ntap-20231016-0001/","https://security.netapp.com/advisory/ntap-20240426-0007/","https://security.netapp.com/advisory/ntap-20240621-0006/","https://security.netapp.com/advisory/ntap-20240621-0007/","https://security.paloaltonetworks.com/CVE-2023-44487","https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.14","https://ubuntu.com/security/CVE-2023-44487","https://www.bleepingcomputer.com/news/security/new-http-2-rapid-reset-zero-day-attack-breaks-ddos-records/","https://www.cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487","https://www.darkreading.com/cloud/internet-wide-zero-day-bug-fuels-largest-ever-ddos-event","https://www.debian.org/security/2023/dsa-5521","https://www.debian.org/security/2023/dsa-5522","https://www.debian.org/security/2023/dsa-5540","https://www.debian.org/security/2023/dsa-5549","https://www.debian.org/security/2023/dsa-5558","https://www.debian.org/security/2023/dsa-5570","https://www.haproxy.com/blog/haproxy-is-not-affected-by-the-http-2-rapid-reset-attack-cve-2023-44487","https://www.netlify.com/blog/netlify-successfully-mitigates-cve-2023-44487/","https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/","https://www.openwall.com/lists/oss-security/2023/10/10/6","https://www.phoronix.com/news/HTTP2-Rapid-Reset-Attack","https://www.theregister.com/2023/10/10/http2_rapid_reset_zeroday/","http://www.openwall.com/lists/oss-security/2025/08/13/6","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2MBEPPC36UBVOZZNAXFHKLFGSLCMN5LI/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3N4NJ7FR4X4FPZUGNTQAPSTVB2HB2Y4A/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BFQD3KUEMFBHPAPBGLWQC34L4OWL5HAZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CLB4TW7KALB3EEQWNWCN7OUIWWVWWCG2/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E72T67UPDRXHIDLO3OROR25YAMN4GGW5/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FNA62Q767CFAFHBCDKYNPBMZWB7TWYVU/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HT7T2R4MQKLIF4ODV4BDLPARWFPCJ5CZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JIZSEFC3YKCGABA2BZW6ZJRMDZJMB7PJ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JMEXY22BFG5Q64HQCM5CK2Q7KDKVV4TY/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KSEGD2IWKNUO3DWY4KQGUQM5BISRWHQE/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LKYHSZQFDNR7RSA7LHVLLIAQMVYCUGBG/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LNMZJCDHGLJJLXO4OXWJMTVQRNWOC7UL/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VHUHTSXLXGXS7JYKBXTA3VINUPHTNGVU/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VSRDIV77HNKUSM7SJC5BKE5JSHLHU2NK/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WE2I52RHNNU42PX6NZ2RBUHSFFJ2LVZX/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WLPRQ5TWUQQXYWBJM7ECYDAIL2YVKIUH/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X6QXN4ORIVF6XBW4WWFE7VNPVC74S45Y/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XFOIBB4YFICHDM7IBOP7PWXW3FX4HLL2/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZB43REMKRQR62NJEI7I5NQ4FSXNLBKRT/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZKQSIKIAT5TJ3WSLU3RDBQ35YX4GY4V3/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZLU6U2R2IC2K64NDPNMV55AUAO65MAF4/","https://www.vicarius.io/vsociety/posts/rapid-reset-cve-2023-44487-dos-in-http2-understanding-the-root-cause","https://cert-portal.siemens.com/productcert/html/ssa-082556.html","https://cert-portal.siemens.com/productcert/html/ssa-341067.html","https://cert-portal.siemens.com/productcert/html/ssa-784301.html","https://cert-portal.siemens.com/productcert/html/ssa-832273.html","https://cert-portal.siemens.com/productcert/html/ssa-915275.html","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-44487","https://github.com/envoyproxy/envoy/security/advisories/GHSA-jhv4-f7mr-xx76","https://github.com/kubernetes/ingress-nginx/blob/4b5c5efe2508dc915a48c54de7f23912ff2ec695/changelog/controller-1.9.3.md?plain=1#L15","https://varnish-cache.org/releases/rel6.0.12.html#rel6-0-12","https://varnish-cache.org/releases/rel7.3.1.html#rel7-3-1","https://varnish-cache.org/releases/rel7.4.2.html#rel7-4-2"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-44487","description":"The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.","knownExploited":[{"cve":"CVE-2023-44487","cwes":["CWE-400"],"urls":["https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/","https://nvd.nist.gov/vuln/detail/CVE-2023-44487"],"notes":"This vulnerability affects a common open-source component, third-party library, or protocol used by different products. For more information, please see: HTTP/2 Rapid Reset Vulnerability, CVE-2023-44487 | CISA: https://www.cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487","dueDate":"2023-10-31","product":"HTTP/2","dateAdded":"2023-10-10","vendorProject":"IETF","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"unknown"}]},"relatedVulnerabilities":[]},{"artifact":{"id":"de2e09a252869bf3","cpes":["cpe:2.3:a:git-scm:git:2.30.6-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_scm:git:2.30.6-r0:*:*:*:*:*:*:*","cpe:2.3:a:git:git:2.30.6-r0:*:*:*:*:*:*:*"],"name":"git","purl":"pkg:apk/busybox/git@2.30.6-r0?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"2.30.6-r0","language":"","licenses":["GPL-2.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/git"},{"path":"/usr/bin/git-receive-pack"},{"path":"/usr/bin/git-shell"},{"path":"/usr/bin/git-upload-archive"},{"path":"/usr/bin/git-upload-pack"},{"path":"/usr/libexec"},{"path":"/usr/libexec/git-core"},{"path":"/usr/libexec/git-core/git"},{"path":"/usr/libexec/git-core/git-add"},{"path":"/usr/libexec/git-core/git-am"},{"path":"/usr/libexec/git-core/git-annotate"},{"path":"/usr/libexec/git-core/git-apply"},{"path":"/usr/libexec/git-core/git-archive"},{"path":"/usr/libexec/git-core/git-bisect"},{"path":"/usr/libexec/git-core/git-bisect--helper"},{"path":"/usr/libexec/git-core/git-blame"},{"path":"/usr/libexec/git-core/git-branch"},{"path":"/usr/libexec/git-core/git-bugreport"},{"path":"/usr/libexec/git-core/git-bundle"},{"path":"/usr/libexec/git-core/git-cat-file"},{"path":"/usr/libexec/git-core/git-check-attr"},{"path":"/usr/libexec/git-core/git-check-ignore"},{"path":"/usr/libexec/git-core/git-check-mailmap"},{"path":"/usr/libexec/git-core/git-check-ref-format"},{"path":"/usr/libexec/git-core/git-checkout"},{"path":"/usr/libexec/git-core/git-checkout-index"},{"path":"/usr/libexec/git-core/git-cherry"},{"path":"/usr/libexec/git-core/git-cherry-pick"},{"path":"/usr/libexec/git-core/git-clean"},{"path":"/usr/libexec/git-core/git-clone"},{"path":"/usr/libexec/git-core/git-column"},{"path":"/usr/libexec/git-core/git-commit"},{"path":"/usr/libexec/git-core/git-commit-graph"},{"path":"/usr/libexec/git-core/git-commit-tree"},{"path":"/usr/libexec/git-core/git-config"},{"path":"/usr/libexec/git-core/git-count-objects"},{"path":"/usr/libexec/git-core/git-credential"},{"path":"/usr/libexec/git-core/git-credential-cache"},{"path":"/usr/libexec/git-core/git-credential-cache--daemon"},{"path":"/usr/libexec/git-core/git-credential-store"},{"path":"/usr/libexec/git-core/git-describe"},{"path":"/usr/libexec/git-core/git-diff"},{"path":"/usr/libexec/git-core/git-diff-files"},{"path":"/usr/libexec/git-core/git-diff-index"},{"path":"/usr/libexec/git-core/git-diff-tree"},{"path":"/usr/libexec/git-core/git-difftool"},{"path":"/usr/libexec/git-core/git-difftool--helper"},{"path":"/usr/libexec/git-core/git-env--helper"},{"path":"/usr/libexec/git-core/git-fast-export"},{"path":"/usr/libexec/git-core/git-fetch"},{"path":"/usr/libexec/git-core/git-fetch-pack"},{"path":"/usr/libexec/git-core/git-filter-branch"},{"path":"/usr/libexec/git-core/git-fmt-merge-msg"},{"path":"/usr/libexec/git-core/git-for-each-ref"},{"path":"/usr/libexec/git-core/git-for-each-repo"},{"path":"/usr/libexec/git-core/git-format-patch"},{"path":"/usr/libexec/git-core/git-fsck"},{"path":"/usr/libexec/git-core/git-fsck-objects"},{"path":"/usr/libexec/git-core/git-gc"},{"path":"/usr/libexec/git-core/git-get-tar-commit-id"},{"path":"/usr/libexec/git-core/git-grep"},{"path":"/usr/libexec/git-core/git-hash-object"},{"path":"/usr/libexec/git-core/git-help"},{"path":"/usr/libexec/git-core/git-http-fetch"},{"path":"/usr/libexec/git-core/git-http-push"},{"path":"/usr/libexec/git-core/git-index-pack"},{"path":"/usr/libexec/git-core/git-init"},{"path":"/usr/libexec/git-core/git-init-db"},{"path":"/usr/libexec/git-core/git-interpret-trailers"},{"path":"/usr/libexec/git-core/git-log"},{"path":"/usr/libexec/git-core/git-ls-files"},{"path":"/usr/libexec/git-core/git-ls-remote"},{"path":"/usr/libexec/git-core/git-ls-tree"},{"path":"/usr/libexec/git-core/git-mailinfo"},{"path":"/usr/libexec/git-core/git-mailsplit"},{"path":"/usr/libexec/git-core/git-maintenance"},{"path":"/usr/libexec/git-core/git-merge"},{"path":"/usr/libexec/git-core/git-merge-base"},{"path":"/usr/libexec/git-core/git-merge-file"},{"path":"/usr/libexec/git-core/git-merge-index"},{"path":"/usr/libexec/git-core/git-merge-octopus"},{"path":"/usr/libexec/git-core/git-merge-one-file"},{"path":"/usr/libexec/git-core/git-merge-ours"},{"path":"/usr/libexec/git-core/git-merge-recursive"},{"path":"/usr/libexec/git-core/git-merge-resolve"},{"path":"/usr/libexec/git-core/git-merge-subtree"},{"path":"/usr/libexec/git-core/git-merge-tree"},{"path":"/usr/libexec/git-core/git-mergetool"},{"path":"/usr/libexec/git-core/git-mergetool--lib"},{"path":"/usr/libexec/git-core/git-mktag"},{"path":"/usr/libexec/git-core/git-mktree"},{"path":"/usr/libexec/git-core/git-multi-pack-index"},{"path":"/usr/libexec/git-core/git-mv"},{"path":"/usr/libexec/git-core/git-name-rev"},{"path":"/usr/libexec/git-core/git-notes"},{"path":"/usr/libexec/git-core/git-pack-objects"},{"path":"/usr/libexec/git-core/git-pack-redundant"},{"path":"/usr/libexec/git-core/git-pack-refs"},{"path":"/usr/libexec/git-core/git-patch-id"},{"path":"/usr/libexec/git-core/git-prune"},{"path":"/usr/libexec/git-core/git-prune-packed"},{"path":"/usr/libexec/git-core/git-pull"},{"path":"/usr/libexec/git-core/git-push"},{"path":"/usr/libexec/git-core/git-quiltimport"},{"path":"/usr/libexec/git-core/git-range-diff"},{"path":"/usr/libexec/git-core/git-read-tree"},{"path":"/usr/libexec/git-core/git-rebase"},{"path":"/usr/libexec/git-core/git-rebase--preserve-merges"},{"path":"/usr/libexec/git-core/git-receive-pack"},{"path":"/usr/libexec/git-core/git-reflog"},{"path":"/usr/libexec/git-core/git-remote"},{"path":"/usr/libexec/git-core/git-remote-ext"},{"path":"/usr/libexec/git-core/git-remote-fd"},{"path":"/usr/libexec/git-core/git-remote-ftp"},{"path":"/usr/libexec/git-core/git-remote-ftps"},{"path":"/usr/libexec/git-core/git-remote-http"},{"path":"/usr/libexec/git-core/git-remote-https"},{"path":"/usr/libexec/git-core/git-repack"},{"path":"/usr/libexec/git-core/git-replace"},{"path":"/usr/libexec/git-core/git-request-pull"},{"path":"/usr/libexec/git-core/git-rerere"},{"path":"/usr/libexec/git-core/git-reset"},{"path":"/usr/libexec/git-core/git-restore"},{"path":"/usr/libexec/git-core/git-rev-list"},{"path":"/usr/libexec/git-core/git-rev-parse"},{"path":"/usr/libexec/git-core/git-revert"},{"path":"/usr/libexec/git-core/git-rm"},{"path":"/usr/libexec/git-core/git-send-pack"},{"path":"/usr/libexec/git-core/git-sh-i18n"},{"path":"/usr/libexec/git-core/git-sh-i18n--envsubst"},{"path":"/usr/libexec/git-core/git-sh-setup"},{"path":"/usr/libexec/git-core/git-shortlog"},{"path":"/usr/libexec/git-core/git-show"},{"path":"/usr/libexec/git-core/git-show-branch"},{"path":"/usr/libexec/git-core/git-show-index"},{"path":"/usr/libexec/git-core/git-show-ref"},{"path":"/usr/libexec/git-core/git-sparse-checkout"},{"path":"/usr/libexec/git-core/git-stage"},{"path":"/usr/libexec/git-core/git-stash"},{"path":"/usr/libexec/git-core/git-status"},{"path":"/usr/libexec/git-core/git-stripspace"},{"path":"/usr/libexec/git-core/git-submodule"},{"path":"/usr/libexec/git-core/git-submodule--helper"},{"path":"/usr/libexec/git-core/git-switch"},{"path":"/usr/libexec/git-core/git-symbolic-ref"},{"path":"/usr/libexec/git-core/git-tag"},{"path":"/usr/libexec/git-core/git-unpack-file"},{"path":"/usr/libexec/git-core/git-unpack-objects"},{"path":"/usr/libexec/git-core/git-update-index"},{"path":"/usr/libexec/git-core/git-update-ref"},{"path":"/usr/libexec/git-core/git-update-server-info"},{"path":"/usr/libexec/git-core/git-upload-archive"},{"path":"/usr/libexec/git-core/git-upload-pack"},{"path":"/usr/libexec/git-core/git-var"},{"path":"/usr/libexec/git-core/git-verify-commit"},{"path":"/usr/libexec/git-core/git-verify-pack"},{"path":"/usr/libexec/git-core/git-verify-tag"},{"path":"/usr/libexec/git-core/git-web--browse"},{"path":"/usr/libexec/git-core/git-whatchanged"},{"path":"/usr/libexec/git-core/git-worktree"},{"path":"/usr/libexec/git-core/git-write-tree"},{"path":"/usr/libexec/git-core/mergetools"},{"path":"/usr/libexec/git-core/mergetools/araxis"},{"path":"/usr/libexec/git-core/mergetools/bc"},{"path":"/usr/libexec/git-core/mergetools/codecompare"},{"path":"/usr/libexec/git-core/mergetools/deltawalker"},{"path":"/usr/libexec/git-core/mergetools/diffmerge"},{"path":"/usr/libexec/git-core/mergetools/diffuse"},{"path":"/usr/libexec/git-core/mergetools/ecmerge"},{"path":"/usr/libexec/git-core/mergetools/emerge"},{"path":"/usr/libexec/git-core/mergetools/examdiff"},{"path":"/usr/libexec/git-core/mergetools/guiffy"},{"path":"/usr/libexec/git-core/mergetools/gvimdiff"},{"path":"/usr/libexec/git-core/mergetools/kdiff3"},{"path":"/usr/libexec/git-core/mergetools/kompare"},{"path":"/usr/libexec/git-core/mergetools/meld"},{"path":"/usr/libexec/git-core/mergetools/nvimdiff"},{"path":"/usr/libexec/git-core/mergetools/opendiff"},{"path":"/usr/libexec/git-core/mergetools/smerge"},{"path":"/usr/libexec/git-core/mergetools/tkdiff"},{"path":"/usr/libexec/git-core/mergetools/tortoisemerge"},{"path":"/usr/libexec/git-core/mergetools/vimdiff"},{"path":"/usr/libexec/git-core/mergetools/winmerge"},{"path":"/usr/libexec/git-core/mergetools/xxdiff"},{"path":"/usr/share"},{"path":"/usr/share/git-core"},{"path":"/usr/share/git-core/templates"},{"path":"/usr/share/git-core/templates/description"},{"path":"/usr/share/git-core/templates/branches"},{"path":"/usr/share/git-core/templates/hooks"},{"path":"/usr/share/git-core/templates/hooks/applypatch-msg.sample"},{"path":"/usr/share/git-core/templates/hooks/commit-msg.sample"},{"path":"/usr/share/git-core/templates/hooks/post-update.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-applypatch.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-commit.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-merge-commit.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-push.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-rebase.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-receive.sample"},{"path":"/usr/share/git-core/templates/hooks/prepare-commit-msg.sample"},{"path":"/usr/share/git-core/templates/hooks/push-to-checkout.sample"},{"path":"/usr/share/git-core/templates/hooks/update.sample"},{"path":"/usr/share/git-core/templates/info"},{"path":"/usr/share/git-core/templates/info/exclude"},{"path":"/usr/share/perl5"},{"path":"/var"},{"path":"/var/git"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"git"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2022-23521","versionConstraint":"<= 2.30.6||>= 2.31.0, <= 2.31.5||>= 2.32.0, <= 2.32.4||>= 2.33.0, <= 2.33.5||>= 2.34.0, <= 2.34.5||>= 2.35.0, <= 2.35.5||>= 2.36.0, <= 2.36.3||>= 2.37.0, <= 2.37.4||>= 2.38.0, <= 2.38.2||= 2.39.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:git-scm:git:2.30.6:*:*:*:*:*:*:*"],"package":{"name":"git","version":"2.30.6-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2022-23521","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-23521","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2022-23521","date":"2026-10-08","epss":0.56334,"percentile":0.99034}],"risk":52.95396,"urls":["https://github.com/git/git/commit/508386c6c5857b4faa2c3e491f422c98cc69ae76","https://github.com/git/git/security/advisories/GHSA-c738-c5qq-xg89","https://security.gentoo.org/glsa/202312-15"],"severity":"Critical","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-23521","description":"Git is distributed revision control system. gitattributes are a mechanism to allow defining attributes for paths. These attributes can be defined by adding a `.gitattributes` file to the repository, which contains a set of file patterns and the attributes that should be set for paths matching this pattern. When parsing gitattributes, multiple integer overflows can occur when there is a huge number of path patterns, a huge number of attributes for a single pattern, or when the declared attribute names are huge. These overflows can be triggered via a crafted `.gitattributes` file that may be part of the commit history. Git silently splits lines longer than 2KB when parsing gitattributes from a file, but not when parsing them from the index. Consequentially, the failure mode depends on whether the file exists in the working tree, the index or both. This integer overflow can result in arbitrary heap reads and writes, which may result in remote code execution. The problem has been patched in the versions published on 2023-01-17, going back to v2.30.7. Users are advised to upgrade. There are no known workarounds for this issue."},"relatedVulnerabilities":[]},{"artifact":{"id":"d081de97c6f633df","cpes":["cpe:2.3:a:libcrypto1.1:libcrypto1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto1.1:libcrypto:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto:libcrypto1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto:libcrypto:1.1.1q-r0:*:*:*:*:*:*:*"],"name":"libcrypto1.1","purl":"pkg:apk/busybox/libcrypto1.1@1.1.1q-r0?arch=x86_64&distro=busybox-1.32.1&upstream=openssl","type":"apk","version":"1.1.1q-r0","language":"","licenses":["OpenSSL"],"metadata":{"Arch":"x86_64","files":[{"path":"/etc"},{"path":"/etc/ssl"},{"path":"/etc/ssl/ct_log_list.cnf"},{"path":"/etc/ssl/ct_log_list.cnf.dist"},{"path":"/etc/ssl/openssl.cnf"},{"path":"/etc/ssl/openssl.cnf.dist"},{"path":"/etc/ssl/certs"},{"path":"/etc/ssl/misc"},{"path":"/etc/ssl/misc/CA.pl"},{"path":"/etc/ssl/misc/tsget"},{"path":"/etc/ssl/misc/tsget.pl"},{"path":"/etc/ssl/private"},{"path":"/lib"},{"path":"/lib/libcrypto.so.1.1"},{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcrypto.so.1.1"},{"path":"/usr/lib/engines-1.1"},{"path":"/usr/lib/engines-1.1/afalg.so"},{"path":"/usr/lib/engines-1.1/capi.so"},{"path":"/usr/lib/engines-1.1/padlock.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2023-0286","versionConstraint":">= 1.0.2, < 1.0.2zg||>= 1.1.1, < 1.1.1t||>= 3.0.0, < 3.0.8 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:1.1.1q:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"1.1.1q-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2023-0286","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-0286","cwe":"CWE-843","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-0286","cwe":"CWE-843","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-0286","date":"2026-10-08","epss":0.59501,"percentile":0.99104}],"risk":44.328245,"urls":["https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-3.6.2-relnotes.txt","https://ftp.openbsd.org/pub/OpenBSD/patches/7.2/common/018_x509.patch.sig","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=2c6c9d439b484e1ba9830d8454a34fa4f80fdfe9","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=2f7530077e0ef79d98718138716bc51ca0cad658","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=fd2af07dc083a350c959147097003a14a5e8ac4d","https://security.gentoo.org/glsa/202402-08","https://www.openssl.org/news/secadv/20230207.txt","https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0003"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-0286","description":"There is a type confusion vulnerability relating to X.400 address processing\ninside an X.509 GeneralName. X.400 addresses were parsed as an ASN1_STRING but\nthe public structure definition for GENERAL_NAME incorrectly specified the type\nof the x400Address field as ASN1_TYPE. This field is subsequently interpreted by\nthe OpenSSL function GENERAL_NAME_cmp as an ASN1_TYPE rather than an\nASN1_STRING.\n\nWhen CRL checking is enabled (i.e. the application sets the\nX509_V_FLAG_CRL_CHECK flag), this vulnerability may allow an attacker to pass\narbitrary pointers to a memcmp call, enabling them to read memory contents or\nenact a denial of service. In most cases, the attack requires the attacker to\nprovide both the certificate chain and CRL, neither of which need to have a\nvalid signature. If the attacker only controls one of these inputs, the other\ninput must already contain an X.400 address as a CRL distribution point, which\nis uncommon. As such, this vulnerability is most likely to only affect\napplications which have implemented their own functionality for retrieving CRLs\nover a network."},"relatedVulnerabilities":[]},{"artifact":{"id":"74f4e71ff41d2d68","cpes":["cpe:2.3:a:libssl1.1:libssl1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl1.1:libssl:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl:1.1.1q-r0:*:*:*:*:*:*:*"],"name":"libssl1.1","purl":"pkg:apk/busybox/libssl1.1@1.1.1q-r0?arch=x86_64&distro=busybox-1.32.1&upstream=openssl","type":"apk","version":"1.1.1q-r0","language":"","licenses":["OpenSSL"],"metadata":{"Arch":"x86_64","files":[{"path":"/lib"},{"path":"/lib/libssl.so.1.1"},{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libssl.so.1.1"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2023-0286","versionConstraint":">= 1.0.2, < 1.0.2zg||>= 1.1.1, < 1.1.1t||>= 3.0.0, < 3.0.8 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:1.1.1q:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"1.1.1q-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2023-0286","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-0286","cwe":"CWE-843","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-0286","cwe":"CWE-843","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-0286","date":"2026-10-08","epss":0.59501,"percentile":0.99104}],"risk":44.328245,"urls":["https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-3.6.2-relnotes.txt","https://ftp.openbsd.org/pub/OpenBSD/patches/7.2/common/018_x509.patch.sig","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=2c6c9d439b484e1ba9830d8454a34fa4f80fdfe9","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=2f7530077e0ef79d98718138716bc51ca0cad658","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=fd2af07dc083a350c959147097003a14a5e8ac4d","https://security.gentoo.org/glsa/202402-08","https://www.openssl.org/news/secadv/20230207.txt","https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0003"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-0286","description":"There is a type confusion vulnerability relating to X.400 address processing\ninside an X.509 GeneralName. X.400 addresses were parsed as an ASN1_STRING but\nthe public structure definition for GENERAL_NAME incorrectly specified the type\nof the x400Address field as ASN1_TYPE. This field is subsequently interpreted by\nthe OpenSSL function GENERAL_NAME_cmp as an ASN1_TYPE rather than an\nASN1_STRING.\n\nWhen CRL checking is enabled (i.e. the application sets the\nX509_V_FLAG_CRL_CHECK flag), this vulnerability may allow an attacker to pass\narbitrary pointers to a memcmp call, enabling them to read memory contents or\nenact a denial of service. In most cases, the attack requires the attacker to\nprovide both the certificate chain and CRL, neither of which need to have a\nvalid signature. If the attacker only controls one of these inputs, the other\ninput must already contain an X.400 address as a CRL distribution point, which\nis uncommon. As such, this vulnerability is most likely to only affect\napplications which have implemented their own functionality for retrieving CRLs\nover a network."},"relatedVulnerabilities":[]},{"artifact":{"id":"14807b4f7067817d","cpes":["cpe:2.3:a:openssl:openssl:1.1.1q-r0:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:apk/busybox/openssl@1.1.1q-r0?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"1.1.1q-r0","language":"","licenses":["OpenSSL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/openssl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2023-0286","versionConstraint":">= 1.0.2, < 1.0.2zg||>= 1.1.1, < 1.1.1t||>= 3.0.0, < 3.0.8 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:1.1.1q:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"1.1.1q-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2023-0286","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-0286","cwe":"CWE-843","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-0286","cwe":"CWE-843","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-0286","date":"2026-10-08","epss":0.59501,"percentile":0.99104}],"risk":44.328245,"urls":["https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-3.6.2-relnotes.txt","https://ftp.openbsd.org/pub/OpenBSD/patches/7.2/common/018_x509.patch.sig","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=2c6c9d439b484e1ba9830d8454a34fa4f80fdfe9","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=2f7530077e0ef79d98718138716bc51ca0cad658","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=fd2af07dc083a350c959147097003a14a5e8ac4d","https://security.gentoo.org/glsa/202402-08","https://www.openssl.org/news/secadv/20230207.txt","https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0003"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-0286","description":"There is a type confusion vulnerability relating to X.400 address processing\ninside an X.509 GeneralName. X.400 addresses were parsed as an ASN1_STRING but\nthe public structure definition for GENERAL_NAME incorrectly specified the type\nof the x400Address field as ASN1_TYPE. This field is subsequently interpreted by\nthe OpenSSL function GENERAL_NAME_cmp as an ASN1_TYPE rather than an\nASN1_STRING.\n\nWhen CRL checking is enabled (i.e. the application sets the\nX509_V_FLAG_CRL_CHECK flag), this vulnerability may allow an attacker to pass\narbitrary pointers to a memcmp call, enabling them to read memory contents or\nenact a denial of service. In most cases, the attack requires the attacker to\nprovide both the certificate chain and CRL, neither of which need to have a\nvalid signature. If the attacker only controls one of these inputs, the other\ninput must already contain an X.400 address as a CRL distribution point, which\nis uncommon. As such, this vulnerability is most likely to only affect\napplications which have implemented their own functionality for retrieving CRLs\nover a network."},"relatedVulnerabilities":[]},{"artifact":{"id":"19103520a7fb35af","cpes":["cpe:2.3:a:nghttp2-libs:nghttp2-libs:1.42.0-r1:*:*:*:*:*:*:*","cpe:2.3:a:nghttp2-libs:nghttp2_libs:1.42.0-r1:*:*:*:*:*:*:*","cpe:2.3:a:nghttp2_libs:nghttp2-libs:1.42.0-r1:*:*:*:*:*:*:*","cpe:2.3:a:nghttp2_libs:nghttp2_libs:1.42.0-r1:*:*:*:*:*:*:*","cpe:2.3:a:nghttp-libs:nghttp2-libs:1.42.0-r1:*:*:*:*:*:*:*","cpe:2.3:a:nghttp-libs:nghttp2_libs:1.42.0-r1:*:*:*:*:*:*:*","cpe:2.3:a:nghttp2-libs:nghttp-libs:1.42.0-r1:*:*:*:*:*:*:*","cpe:2.3:a:nghttp2-libs:nghttp_libs:1.42.0-r1:*:*:*:*:*:*:*","cpe:2.3:a:nghttp2_libs:nghttp-libs:1.42.0-r1:*:*:*:*:*:*:*","cpe:2.3:a:nghttp2_libs:nghttp_libs:1.42.0-r1:*:*:*:*:*:*:*","cpe:2.3:a:nghttp_libs:nghttp2-libs:1.42.0-r1:*:*:*:*:*:*:*","cpe:2.3:a:nghttp_libs:nghttp2_libs:1.42.0-r1:*:*:*:*:*:*:*","cpe:2.3:a:nghttp-libs:nghttp-libs:1.42.0-r1:*:*:*:*:*:*:*","cpe:2.3:a:nghttp-libs:nghttp_libs:1.42.0-r1:*:*:*:*:*:*:*","cpe:2.3:a:nghttp_libs:nghttp-libs:1.42.0-r1:*:*:*:*:*:*:*","cpe:2.3:a:nghttp_libs:nghttp_libs:1.42.0-r1:*:*:*:*:*:*:*","cpe:2.3:a:nghttp2:nghttp2-libs:1.42.0-r1:*:*:*:*:*:*:*","cpe:2.3:a:nghttp2:nghttp2_libs:1.42.0-r1:*:*:*:*:*:*:*","cpe:2.3:a:nghttp2:nghttp-libs:1.42.0-r1:*:*:*:*:*:*:*","cpe:2.3:a:nghttp2:nghttp_libs:1.42.0-r1:*:*:*:*:*:*:*","cpe:2.3:a:nghttp:nghttp2-libs:1.42.0-r1:*:*:*:*:*:*:*","cpe:2.3:a:nghttp:nghttp2_libs:1.42.0-r1:*:*:*:*:*:*:*","cpe:2.3:a:nghttp:nghttp-libs:1.42.0-r1:*:*:*:*:*:*:*","cpe:2.3:a:nghttp:nghttp_libs:1.42.0-r1:*:*:*:*:*:*:*"],"name":"nghttp2-libs","purl":"pkg:apk/busybox/nghttp2-libs@1.42.0-r1?arch=x86_64&distro=busybox-1.32.1&upstream=nghttp2","type":"apk","version":"1.42.0-r1","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libnghttp2.so.14"},{"path":"/usr/lib/libnghttp2.so.14.20.1"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"nghttp2"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:nghttp2:nghttp2:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2024-28182","versionConstraint":"< 1.61.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:nghttp2:nghttp2:1.42.0:*:*:*:*:*:*:*"],"package":{"name":"nghttp2","version":"1.42.0-r1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2024-28182","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-28182","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2024-28182","date":"2026-10-08","epss":0.8496,"percentile":0.99708}],"risk":43.754400000000004,"urls":["http://www.openwall.com/lists/oss-security/2024/04/03/16","https://github.com/nghttp2/nghttp2/commit/00201ecd8f982da3b67d4f6868af72a1b03b14e0","https://github.com/nghttp2/nghttp2/commit/d71a4668c6bead55805d18810d633fbb98315af9","https://github.com/nghttp2/nghttp2/security/advisories/GHSA-x6x3-gv8h-m57q","https://lists.debian.org/debian-lts-announce/2024/04/msg00026.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AGOME6ZXJG7664IPQNVE3DL67E3YP3HY/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/J6ZMXUGB66VAXDW5J6QSTHM5ET25FGSA/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PXJO2EASHM2OQQLGVDY5ZSO7UVDVHTDK/","https://lists.debian.org/debian-lts-announce/2024/09/msg00041.html","https://www.kb.cert.org/vuls/id/421644"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-28182","description":"nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. The nghttp2 library prior to version 1.61.0 keeps reading the unbounded number of HTTP/2 CONTINUATION frames even after a stream is reset to keep HPACK context in sync.  This causes excessive CPU usage to decode HPACK stream. nghttp2 v1.61.0 mitigates this vulnerability by limiting the number of CONTINUATION frames it accepts per stream. There is no workaround for this vulnerability."},"relatedVulnerabilities":[]},{"artifact":{"id":"a45c752c9b8878aa","cpes":["cpe:2.3:a:php7:php7:7.4.26-r0:*:*:*:*:*:*:*","cpe:2.3:a:php7:php:7.4.26-r0:*:*:*:*:*:*:*","cpe:2.3:a:php:php7:7.4.26-r0:*:*:*:*:*:*:*","cpe:2.3:a:php:php:7.4.26-r0:*:*:*:*:*:*:*"],"name":"php7","purl":"pkg:apk/busybox/php7@7.4.26-r0?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"7.4.26-r0","language":"","licenses":["BSD-3-Clause","LGPL-2.0-or-later","MIT","PHP-3.01","Zend-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/php"},{"path":"/usr/bin/php7"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"php7"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:php:php:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2022-31626","versionConstraint":">= 7.4.0, < 7.4.30||>= 8.0.0, < 8.0.20||>= 8.1.0, < 8.1.7 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:php:php:7.4.26:*:*:*:*:*:*:*"],"package":{"name":"php7","version":"7.4.26-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2022-31626","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:S/C:P/I:P/A:P","metrics":{"baseScore":6,"impactScore":6.5,"exploitabilityScore":6.9},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-31626","cwe":"CWE-120","type":"Secondary","source":"security@php.net"},{"cve":"CVE-2022-31626","cwe":"CWE-120","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-31626","date":"2026-10-08","epss":0.58123,"percentile":0.99073}],"risk":43.39850666666667,"urls":["https://bugs.php.net/bug.php?id=81719","https://lists.debian.org/debian-lts-announce/2022/12/msg00030.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3T4MMEEZYYAEHPQMZDFN44PHORJWJFZQ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZZTZQKRGEYJT5UB4FGG3MOE72SQUHSL4/","https://security.gentoo.org/glsa/202209-20","https://security.netapp.com/advisory/ntap-20220722-0005/","https://www.debian.org/security/2022/dsa-5179"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-31626","description":"In PHP versions 7.4.x below 7.4.30, 8.0.x below 8.0.20, and 8.1.x below 8.1.7, when pdo_mysql extension with mysqlnd driver, if the third party is allowed to supply host to connect to and the password for the connection, password of excessive length can trigger a buffer overflow in PHP, which can lead to a remote code execution vulnerability."},"relatedVulnerabilities":[]},{"artifact":{"id":"d081de97c6f633df","cpes":["cpe:2.3:a:libcrypto1.1:libcrypto1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto1.1:libcrypto:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto:libcrypto1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto:libcrypto:1.1.1q-r0:*:*:*:*:*:*:*"],"name":"libcrypto1.1","purl":"pkg:apk/busybox/libcrypto1.1@1.1.1q-r0?arch=x86_64&distro=busybox-1.32.1&upstream=openssl","type":"apk","version":"1.1.1q-r0","language":"","licenses":["OpenSSL"],"metadata":{"Arch":"x86_64","files":[{"path":"/etc"},{"path":"/etc/ssl"},{"path":"/etc/ssl/ct_log_list.cnf"},{"path":"/etc/ssl/ct_log_list.cnf.dist"},{"path":"/etc/ssl/openssl.cnf"},{"path":"/etc/ssl/openssl.cnf.dist"},{"path":"/etc/ssl/certs"},{"path":"/etc/ssl/misc"},{"path":"/etc/ssl/misc/CA.pl"},{"path":"/etc/ssl/misc/tsget"},{"path":"/etc/ssl/misc/tsget.pl"},{"path":"/etc/ssl/private"},{"path":"/lib"},{"path":"/lib/libcrypto.so.1.1"},{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcrypto.so.1.1"},{"path":"/usr/lib/engines-1.1"},{"path":"/usr/lib/engines-1.1/afalg.so"},{"path":"/usr/lib/engines-1.1/capi.so"},{"path":"/usr/lib/engines-1.1/padlock.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2023-2650","versionConstraint":">= 1.0.2, < 1.0.2zh||>= 1.1.1, < 1.1.1u||>= 3.0.0, < 3.0.9||>= 3.1.0, < 3.1.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:1.1.1q:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"1.1.1q-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2023-2650","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-2650","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-2650","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-2650","date":"2026-10-08","epss":0.75116,"percentile":0.995}],"risk":43.1917,"urls":["http://www.openwall.com/lists/oss-security/2023/05/30/1","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=423a2bc737a908ad0c77bda470b2b59dc879936b","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=853c5e56ee0b8650c73140816bb8b91d6163422c","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=9e209944b35cf82368071f160a744b6178f9b098","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=db779b0e10b047f2585615e0b8f2acdf21f8544a","https://lists.debian.org/debian-lts-announce/2023/06/msg00011.html","https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0009","https://security.gentoo.org/glsa/202402-08","https://security.netapp.com/advisory/ntap-20230703-0001/","https://security.netapp.com/advisory/ntap-20231027-0009/","https://www.debian.org/security/2023/dsa-5417","https://www.openssl.org/news/secadv/20230530.txt"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-2650","description":"Issue summary: Processing some specially crafted ASN.1 object identifiers or\ndata containing them may be very slow.\n\nImpact summary: Applications that use OBJ_obj2txt() directly, or use any of\nthe OpenSSL subsystems OCSP, PKCS7/SMIME, CMS, CMP/CRMF or TS with no message\nsize limit may experience notable to very long delays when processing those\nmessages, which may lead to a Denial of Service.\n\nAn OBJECT IDENTIFIER is composed of a series of numbers - sub-identifiers -\nmost of which have no size limit.  OBJ_obj2txt() may be used to translate\nan ASN.1 OBJECT IDENTIFIER given in DER encoding form (using the OpenSSL\ntype ASN1_OBJECT) to its canonical numeric text form, which are the\nsub-identifiers of the OBJECT IDENTIFIER in decimal form, separated by\nperiods.\n\nWhen one of the sub-identifiers in the OBJECT IDENTIFIER is very large\n(these are sizes that are seen as absurdly large, taking up tens or hundreds\nof KiBs), the translation to a decimal number in text may take a very long\ntime.  The time complexity is O(n^2) with 'n' being the size of the\nsub-identifiers in bytes (*).\n\nWith OpenSSL 3.0, support to fetch cryptographic algorithms using names /\nidentifiers in string form was introduced.  This includes using OBJECT\nIDENTIFIERs in canonical numeric text form as identifiers for fetching\nalgorithms.\n\nSuch OBJECT IDENTIFIERs may be received through the ASN.1 structure\nAlgorithmIdentifier, which is commonly used in multiple protocols to specify\nwhat cryptographic algorithm should be used to sign or verify, encrypt or\ndecrypt, or digest passed data.\n\nApplications that call OBJ_obj2txt() directly with untrusted data are\naffected, with any version of OpenSSL.  If the use is for the mere purpose\nof display, the severity is considered low.\n\nIn OpenSSL 3.0 and newer, this affects the subsystems OCSP, PKCS7/SMIME,\nCMS, CMP/CRMF or TS.  It also impacts anything that processes X.509\ncertificates, including simple things like verifying its signature.\n\nThe impact on TLS is relatively low, because all versions of OpenSSL have a\n100KiB limit on the peer's certificate chain.  Additionally, this only\nimpacts clients, or servers that have explicitly enabled client\nauthentication.\n\nIn OpenSSL 1.1.1 and 1.0.2, this only affects displaying diverse objects,\nsuch as X.509 certificates.  This is assumed to not happen in such a way\nthat it would cause a Denial of Service, so these versions are considered\nnot affected by this issue in such a way that it would be cause for concern,\nand the severity is therefore considered low."},"relatedVulnerabilities":[]},{"artifact":{"id":"74f4e71ff41d2d68","cpes":["cpe:2.3:a:libssl1.1:libssl1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl1.1:libssl:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl:1.1.1q-r0:*:*:*:*:*:*:*"],"name":"libssl1.1","purl":"pkg:apk/busybox/libssl1.1@1.1.1q-r0?arch=x86_64&distro=busybox-1.32.1&upstream=openssl","type":"apk","version":"1.1.1q-r0","language":"","licenses":["OpenSSL"],"metadata":{"Arch":"x86_64","files":[{"path":"/lib"},{"path":"/lib/libssl.so.1.1"},{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libssl.so.1.1"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2023-2650","versionConstraint":">= 1.0.2, < 1.0.2zh||>= 1.1.1, < 1.1.1u||>= 3.0.0, < 3.0.9||>= 3.1.0, < 3.1.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:1.1.1q:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"1.1.1q-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2023-2650","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-2650","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-2650","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-2650","date":"2026-10-08","epss":0.75116,"percentile":0.995}],"risk":43.1917,"urls":["http://www.openwall.com/lists/oss-security/2023/05/30/1","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=423a2bc737a908ad0c77bda470b2b59dc879936b","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=853c5e56ee0b8650c73140816bb8b91d6163422c","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=9e209944b35cf82368071f160a744b6178f9b098","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=db779b0e10b047f2585615e0b8f2acdf21f8544a","https://lists.debian.org/debian-lts-announce/2023/06/msg00011.html","https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0009","https://security.gentoo.org/glsa/202402-08","https://security.netapp.com/advisory/ntap-20230703-0001/","https://security.netapp.com/advisory/ntap-20231027-0009/","https://www.debian.org/security/2023/dsa-5417","https://www.openssl.org/news/secadv/20230530.txt"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-2650","description":"Issue summary: Processing some specially crafted ASN.1 object identifiers or\ndata containing them may be very slow.\n\nImpact summary: Applications that use OBJ_obj2txt() directly, or use any of\nthe OpenSSL subsystems OCSP, PKCS7/SMIME, CMS, CMP/CRMF or TS with no message\nsize limit may experience notable to very long delays when processing those\nmessages, which may lead to a Denial of Service.\n\nAn OBJECT IDENTIFIER is composed of a series of numbers - sub-identifiers -\nmost of which have no size limit.  OBJ_obj2txt() may be used to translate\nan ASN.1 OBJECT IDENTIFIER given in DER encoding form (using the OpenSSL\ntype ASN1_OBJECT) to its canonical numeric text form, which are the\nsub-identifiers of the OBJECT IDENTIFIER in decimal form, separated by\nperiods.\n\nWhen one of the sub-identifiers in the OBJECT IDENTIFIER is very large\n(these are sizes that are seen as absurdly large, taking up tens or hundreds\nof KiBs), the translation to a decimal number in text may take a very long\ntime.  The time complexity is O(n^2) with 'n' being the size of the\nsub-identifiers in bytes (*).\n\nWith OpenSSL 3.0, support to fetch cryptographic algorithms using names /\nidentifiers in string form was introduced.  This includes using OBJECT\nIDENTIFIERs in canonical numeric text form as identifiers for fetching\nalgorithms.\n\nSuch OBJECT IDENTIFIERs may be received through the ASN.1 structure\nAlgorithmIdentifier, which is commonly used in multiple protocols to specify\nwhat cryptographic algorithm should be used to sign or verify, encrypt or\ndecrypt, or digest passed data.\n\nApplications that call OBJ_obj2txt() directly with untrusted data are\naffected, with any version of OpenSSL.  If the use is for the mere purpose\nof display, the severity is considered low.\n\nIn OpenSSL 3.0 and newer, this affects the subsystems OCSP, PKCS7/SMIME,\nCMS, CMP/CRMF or TS.  It also impacts anything that processes X.509\ncertificates, including simple things like verifying its signature.\n\nThe impact on TLS is relatively low, because all versions of OpenSSL have a\n100KiB limit on the peer's certificate chain.  Additionally, this only\nimpacts clients, or servers that have explicitly enabled client\nauthentication.\n\nIn OpenSSL 1.1.1 and 1.0.2, this only affects displaying diverse objects,\nsuch as X.509 certificates.  This is assumed to not happen in such a way\nthat it would cause a Denial of Service, so these versions are considered\nnot affected by this issue in such a way that it would be cause for concern,\nand the severity is therefore considered low."},"relatedVulnerabilities":[]},{"artifact":{"id":"14807b4f7067817d","cpes":["cpe:2.3:a:openssl:openssl:1.1.1q-r0:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:apk/busybox/openssl@1.1.1q-r0?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"1.1.1q-r0","language":"","licenses":["OpenSSL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/openssl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2023-2650","versionConstraint":">= 1.0.2, < 1.0.2zh||>= 1.1.1, < 1.1.1u||>= 3.0.0, < 3.0.9||>= 3.1.0, < 3.1.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:1.1.1q:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"1.1.1q-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2023-2650","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-2650","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-2650","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-2650","date":"2026-10-08","epss":0.75116,"percentile":0.995}],"risk":43.1917,"urls":["http://www.openwall.com/lists/oss-security/2023/05/30/1","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=423a2bc737a908ad0c77bda470b2b59dc879936b","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=853c5e56ee0b8650c73140816bb8b91d6163422c","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=9e209944b35cf82368071f160a744b6178f9b098","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=db779b0e10b047f2585615e0b8f2acdf21f8544a","https://lists.debian.org/debian-lts-announce/2023/06/msg00011.html","https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0009","https://security.gentoo.org/glsa/202402-08","https://security.netapp.com/advisory/ntap-20230703-0001/","https://security.netapp.com/advisory/ntap-20231027-0009/","https://www.debian.org/security/2023/dsa-5417","https://www.openssl.org/news/secadv/20230530.txt"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-2650","description":"Issue summary: Processing some specially crafted ASN.1 object identifiers or\ndata containing them may be very slow.\n\nImpact summary: Applications that use OBJ_obj2txt() directly, or use any of\nthe OpenSSL subsystems OCSP, PKCS7/SMIME, CMS, CMP/CRMF or TS with no message\nsize limit may experience notable to very long delays when processing those\nmessages, which may lead to a Denial of Service.\n\nAn OBJECT IDENTIFIER is composed of a series of numbers - sub-identifiers -\nmost of which have no size limit.  OBJ_obj2txt() may be used to translate\nan ASN.1 OBJECT IDENTIFIER given in DER encoding form (using the OpenSSL\ntype ASN1_OBJECT) to its canonical numeric text form, which are the\nsub-identifiers of the OBJECT IDENTIFIER in decimal form, separated by\nperiods.\n\nWhen one of the sub-identifiers in the OBJECT IDENTIFIER is very large\n(these are sizes that are seen as absurdly large, taking up tens or hundreds\nof KiBs), the translation to a decimal number in text may take a very long\ntime.  The time complexity is O(n^2) with 'n' being the size of the\nsub-identifiers in bytes (*).\n\nWith OpenSSL 3.0, support to fetch cryptographic algorithms using names /\nidentifiers in string form was introduced.  This includes using OBJECT\nIDENTIFIERs in canonical numeric text form as identifiers for fetching\nalgorithms.\n\nSuch OBJECT IDENTIFIERs may be received through the ASN.1 structure\nAlgorithmIdentifier, which is commonly used in multiple protocols to specify\nwhat cryptographic algorithm should be used to sign or verify, encrypt or\ndecrypt, or digest passed data.\n\nApplications that call OBJ_obj2txt() directly with untrusted data are\naffected, with any version of OpenSSL.  If the use is for the mere purpose\nof display, the severity is considered low.\n\nIn OpenSSL 3.0 and newer, this affects the subsystems OCSP, PKCS7/SMIME,\nCMS, CMP/CRMF or TS.  It also impacts anything that processes X.509\ncertificates, including simple things like verifying its signature.\n\nThe impact on TLS is relatively low, because all versions of OpenSSL have a\n100KiB limit on the peer's certificate chain.  Additionally, this only\nimpacts clients, or servers that have explicitly enabled client\nauthentication.\n\nIn OpenSSL 1.1.1 and 1.0.2, this only affects displaying diverse objects,\nsuch as X.509 certificates.  This is assumed to not happen in such a way\nthat it would cause a Denial of Service, so these versions are considered\nnot affected by this issue in such a way that it would be cause for concern,\nand the severity is therefore considered low."},"relatedVulnerabilities":[]},{"artifact":{"id":"de2e09a252869bf3","cpes":["cpe:2.3:a:git-scm:git:2.30.6-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_scm:git:2.30.6-r0:*:*:*:*:*:*:*","cpe:2.3:a:git:git:2.30.6-r0:*:*:*:*:*:*:*"],"name":"git","purl":"pkg:apk/busybox/git@2.30.6-r0?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"2.30.6-r0","language":"","licenses":["GPL-2.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/git"},{"path":"/usr/bin/git-receive-pack"},{"path":"/usr/bin/git-shell"},{"path":"/usr/bin/git-upload-archive"},{"path":"/usr/bin/git-upload-pack"},{"path":"/usr/libexec"},{"path":"/usr/libexec/git-core"},{"path":"/usr/libexec/git-core/git"},{"path":"/usr/libexec/git-core/git-add"},{"path":"/usr/libexec/git-core/git-am"},{"path":"/usr/libexec/git-core/git-annotate"},{"path":"/usr/libexec/git-core/git-apply"},{"path":"/usr/libexec/git-core/git-archive"},{"path":"/usr/libexec/git-core/git-bisect"},{"path":"/usr/libexec/git-core/git-bisect--helper"},{"path":"/usr/libexec/git-core/git-blame"},{"path":"/usr/libexec/git-core/git-branch"},{"path":"/usr/libexec/git-core/git-bugreport"},{"path":"/usr/libexec/git-core/git-bundle"},{"path":"/usr/libexec/git-core/git-cat-file"},{"path":"/usr/libexec/git-core/git-check-attr"},{"path":"/usr/libexec/git-core/git-check-ignore"},{"path":"/usr/libexec/git-core/git-check-mailmap"},{"path":"/usr/libexec/git-core/git-check-ref-format"},{"path":"/usr/libexec/git-core/git-checkout"},{"path":"/usr/libexec/git-core/git-checkout-index"},{"path":"/usr/libexec/git-core/git-cherry"},{"path":"/usr/libexec/git-core/git-cherry-pick"},{"path":"/usr/libexec/git-core/git-clean"},{"path":"/usr/libexec/git-core/git-clone"},{"path":"/usr/libexec/git-core/git-column"},{"path":"/usr/libexec/git-core/git-commit"},{"path":"/usr/libexec/git-core/git-commit-graph"},{"path":"/usr/libexec/git-core/git-commit-tree"},{"path":"/usr/libexec/git-core/git-config"},{"path":"/usr/libexec/git-core/git-count-objects"},{"path":"/usr/libexec/git-core/git-credential"},{"path":"/usr/libexec/git-core/git-credential-cache"},{"path":"/usr/libexec/git-core/git-credential-cache--daemon"},{"path":"/usr/libexec/git-core/git-credential-store"},{"path":"/usr/libexec/git-core/git-describe"},{"path":"/usr/libexec/git-core/git-diff"},{"path":"/usr/libexec/git-core/git-diff-files"},{"path":"/usr/libexec/git-core/git-diff-index"},{"path":"/usr/libexec/git-core/git-diff-tree"},{"path":"/usr/libexec/git-core/git-difftool"},{"path":"/usr/libexec/git-core/git-difftool--helper"},{"path":"/usr/libexec/git-core/git-env--helper"},{"path":"/usr/libexec/git-core/git-fast-export"},{"path":"/usr/libexec/git-core/git-fetch"},{"path":"/usr/libexec/git-core/git-fetch-pack"},{"path":"/usr/libexec/git-core/git-filter-branch"},{"path":"/usr/libexec/git-core/git-fmt-merge-msg"},{"path":"/usr/libexec/git-core/git-for-each-ref"},{"path":"/usr/libexec/git-core/git-for-each-repo"},{"path":"/usr/libexec/git-core/git-format-patch"},{"path":"/usr/libexec/git-core/git-fsck"},{"path":"/usr/libexec/git-core/git-fsck-objects"},{"path":"/usr/libexec/git-core/git-gc"},{"path":"/usr/libexec/git-core/git-get-tar-commit-id"},{"path":"/usr/libexec/git-core/git-grep"},{"path":"/usr/libexec/git-core/git-hash-object"},{"path":"/usr/libexec/git-core/git-help"},{"path":"/usr/libexec/git-core/git-http-fetch"},{"path":"/usr/libexec/git-core/git-http-push"},{"path":"/usr/libexec/git-core/git-index-pack"},{"path":"/usr/libexec/git-core/git-init"},{"path":"/usr/libexec/git-core/git-init-db"},{"path":"/usr/libexec/git-core/git-interpret-trailers"},{"path":"/usr/libexec/git-core/git-log"},{"path":"/usr/libexec/git-core/git-ls-files"},{"path":"/usr/libexec/git-core/git-ls-remote"},{"path":"/usr/libexec/git-core/git-ls-tree"},{"path":"/usr/libexec/git-core/git-mailinfo"},{"path":"/usr/libexec/git-core/git-mailsplit"},{"path":"/usr/libexec/git-core/git-maintenance"},{"path":"/usr/libexec/git-core/git-merge"},{"path":"/usr/libexec/git-core/git-merge-base"},{"path":"/usr/libexec/git-core/git-merge-file"},{"path":"/usr/libexec/git-core/git-merge-index"},{"path":"/usr/libexec/git-core/git-merge-octopus"},{"path":"/usr/libexec/git-core/git-merge-one-file"},{"path":"/usr/libexec/git-core/git-merge-ours"},{"path":"/usr/libexec/git-core/git-merge-recursive"},{"path":"/usr/libexec/git-core/git-merge-resolve"},{"path":"/usr/libexec/git-core/git-merge-subtree"},{"path":"/usr/libexec/git-core/git-merge-tree"},{"path":"/usr/libexec/git-core/git-mergetool"},{"path":"/usr/libexec/git-core/git-mergetool--lib"},{"path":"/usr/libexec/git-core/git-mktag"},{"path":"/usr/libexec/git-core/git-mktree"},{"path":"/usr/libexec/git-core/git-multi-pack-index"},{"path":"/usr/libexec/git-core/git-mv"},{"path":"/usr/libexec/git-core/git-name-rev"},{"path":"/usr/libexec/git-core/git-notes"},{"path":"/usr/libexec/git-core/git-pack-objects"},{"path":"/usr/libexec/git-core/git-pack-redundant"},{"path":"/usr/libexec/git-core/git-pack-refs"},{"path":"/usr/libexec/git-core/git-patch-id"},{"path":"/usr/libexec/git-core/git-prune"},{"path":"/usr/libexec/git-core/git-prune-packed"},{"path":"/usr/libexec/git-core/git-pull"},{"path":"/usr/libexec/git-core/git-push"},{"path":"/usr/libexec/git-core/git-quiltimport"},{"path":"/usr/libexec/git-core/git-range-diff"},{"path":"/usr/libexec/git-core/git-read-tree"},{"path":"/usr/libexec/git-core/git-rebase"},{"path":"/usr/libexec/git-core/git-rebase--preserve-merges"},{"path":"/usr/libexec/git-core/git-receive-pack"},{"path":"/usr/libexec/git-core/git-reflog"},{"path":"/usr/libexec/git-core/git-remote"},{"path":"/usr/libexec/git-core/git-remote-ext"},{"path":"/usr/libexec/git-core/git-remote-fd"},{"path":"/usr/libexec/git-core/git-remote-ftp"},{"path":"/usr/libexec/git-core/git-remote-ftps"},{"path":"/usr/libexec/git-core/git-remote-http"},{"path":"/usr/libexec/git-core/git-remote-https"},{"path":"/usr/libexec/git-core/git-repack"},{"path":"/usr/libexec/git-core/git-replace"},{"path":"/usr/libexec/git-core/git-request-pull"},{"path":"/usr/libexec/git-core/git-rerere"},{"path":"/usr/libexec/git-core/git-reset"},{"path":"/usr/libexec/git-core/git-restore"},{"path":"/usr/libexec/git-core/git-rev-list"},{"path":"/usr/libexec/git-core/git-rev-parse"},{"path":"/usr/libexec/git-core/git-revert"},{"path":"/usr/libexec/git-core/git-rm"},{"path":"/usr/libexec/git-core/git-send-pack"},{"path":"/usr/libexec/git-core/git-sh-i18n"},{"path":"/usr/libexec/git-core/git-sh-i18n--envsubst"},{"path":"/usr/libexec/git-core/git-sh-setup"},{"path":"/usr/libexec/git-core/git-shortlog"},{"path":"/usr/libexec/git-core/git-show"},{"path":"/usr/libexec/git-core/git-show-branch"},{"path":"/usr/libexec/git-core/git-show-index"},{"path":"/usr/libexec/git-core/git-show-ref"},{"path":"/usr/libexec/git-core/git-sparse-checkout"},{"path":"/usr/libexec/git-core/git-stage"},{"path":"/usr/libexec/git-core/git-stash"},{"path":"/usr/libexec/git-core/git-status"},{"path":"/usr/libexec/git-core/git-stripspace"},{"path":"/usr/libexec/git-core/git-submodule"},{"path":"/usr/libexec/git-core/git-submodule--helper"},{"path":"/usr/libexec/git-core/git-switch"},{"path":"/usr/libexec/git-core/git-symbolic-ref"},{"path":"/usr/libexec/git-core/git-tag"},{"path":"/usr/libexec/git-core/git-unpack-file"},{"path":"/usr/libexec/git-core/git-unpack-objects"},{"path":"/usr/libexec/git-core/git-update-index"},{"path":"/usr/libexec/git-core/git-update-ref"},{"path":"/usr/libexec/git-core/git-update-server-info"},{"path":"/usr/libexec/git-core/git-upload-archive"},{"path":"/usr/libexec/git-core/git-upload-pack"},{"path":"/usr/libexec/git-core/git-var"},{"path":"/usr/libexec/git-core/git-verify-commit"},{"path":"/usr/libexec/git-core/git-verify-pack"},{"path":"/usr/libexec/git-core/git-verify-tag"},{"path":"/usr/libexec/git-core/git-web--browse"},{"path":"/usr/libexec/git-core/git-whatchanged"},{"path":"/usr/libexec/git-core/git-worktree"},{"path":"/usr/libexec/git-core/git-write-tree"},{"path":"/usr/libexec/git-core/mergetools"},{"path":"/usr/libexec/git-core/mergetools/araxis"},{"path":"/usr/libexec/git-core/mergetools/bc"},{"path":"/usr/libexec/git-core/mergetools/codecompare"},{"path":"/usr/libexec/git-core/mergetools/deltawalker"},{"path":"/usr/libexec/git-core/mergetools/diffmerge"},{"path":"/usr/libexec/git-core/mergetools/diffuse"},{"path":"/usr/libexec/git-core/mergetools/ecmerge"},{"path":"/usr/libexec/git-core/mergetools/emerge"},{"path":"/usr/libexec/git-core/mergetools/examdiff"},{"path":"/usr/libexec/git-core/mergetools/guiffy"},{"path":"/usr/libexec/git-core/mergetools/gvimdiff"},{"path":"/usr/libexec/git-core/mergetools/kdiff3"},{"path":"/usr/libexec/git-core/mergetools/kompare"},{"path":"/usr/libexec/git-core/mergetools/meld"},{"path":"/usr/libexec/git-core/mergetools/nvimdiff"},{"path":"/usr/libexec/git-core/mergetools/opendiff"},{"path":"/usr/libexec/git-core/mergetools/smerge"},{"path":"/usr/libexec/git-core/mergetools/tkdiff"},{"path":"/usr/libexec/git-core/mergetools/tortoisemerge"},{"path":"/usr/libexec/git-core/mergetools/vimdiff"},{"path":"/usr/libexec/git-core/mergetools/winmerge"},{"path":"/usr/libexec/git-core/mergetools/xxdiff"},{"path":"/usr/share"},{"path":"/usr/share/git-core"},{"path":"/usr/share/git-core/templates"},{"path":"/usr/share/git-core/templates/description"},{"path":"/usr/share/git-core/templates/branches"},{"path":"/usr/share/git-core/templates/hooks"},{"path":"/usr/share/git-core/templates/hooks/applypatch-msg.sample"},{"path":"/usr/share/git-core/templates/hooks/commit-msg.sample"},{"path":"/usr/share/git-core/templates/hooks/post-update.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-applypatch.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-commit.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-merge-commit.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-push.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-rebase.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-receive.sample"},{"path":"/usr/share/git-core/templates/hooks/prepare-commit-msg.sample"},{"path":"/usr/share/git-core/templates/hooks/push-to-checkout.sample"},{"path":"/usr/share/git-core/templates/hooks/update.sample"},{"path":"/usr/share/git-core/templates/info"},{"path":"/usr/share/git-core/templates/info/exclude"},{"path":"/usr/share/perl5"},{"path":"/var"},{"path":"/var/git"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"git"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2022-41903","versionConstraint":"<= 2.30.6||>= 2.31.0, <= 2.31.5||>= 2.32.0, <= 2.32.4||>= 2.33.0, <= 2.33.5||>= 2.34.0, <= 2.34.5||>= 2.35.0, <= 2.35.5||>= 2.36.0, <= 2.36.3||>= 2.37.0, <= 2.37.4||>= 2.38.0, <= 2.38.2||= 2.39.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:git-scm:git:2.30.6:*:*:*:*:*:*:*"],"package":{"name":"git","version":"2.30.6-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2022-41903","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-41903","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2022-41903","date":"2026-10-08","epss":0.44268,"percentile":0.98728}],"risk":41.611920000000005,"urls":["https://git-scm.com/book/en/v2/Customizing-Git-Git-Attributes#_export_subst","https://git-scm.com/docs/pretty-formats#Documentation/pretty-formats.txt-emltltNgttruncltruncmtruncem","https://github.com/git/git/commit/508386c6c5857b4faa2c3e491f422c98cc69ae76","https://github.com/git/git/security/advisories/GHSA-475x-2q3q-hvwq","https://security.gentoo.org/glsa/202312-15"],"severity":"Critical","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-41903","description":"Git is distributed revision control system. `git log` can display commits in an arbitrary format using its `--format` specifiers. This functionality is also exposed to `git archive` via the `export-subst` gitattribute. When processing the padding operators, there is a integer overflow in `pretty.c::format_and_pad_commit()` where a `size_t` is stored improperly as an `int`, and then added as an offset to a `memcpy()`. This overflow can be triggered directly by a user running a command which invokes the commit formatting machinery (e.g., `git log --format=...`). It may also be triggered indirectly through git archive via the export-subst mechanism, which expands format specifiers inside of files within the repository during a git archive. This integer overflow can result in arbitrary heap writes, which may result in arbitrary code execution. The problem has been patched in the versions published on 2023-01-17, going back to v2.30.7. Users are advised to upgrade. Users who are unable to upgrade should disable `git archive` in untrusted repositories. If you expose git archive via `git daemon`, disable it by running `git config --global daemon.uploadArch false`."},"relatedVulnerabilities":[]},{"artifact":{"id":"de2e09a252869bf3","cpes":["cpe:2.3:a:git-scm:git:2.30.6-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_scm:git:2.30.6-r0:*:*:*:*:*:*:*","cpe:2.3:a:git:git:2.30.6-r0:*:*:*:*:*:*:*"],"name":"git","purl":"pkg:apk/busybox/git@2.30.6-r0?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"2.30.6-r0","language":"","licenses":["GPL-2.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/git"},{"path":"/usr/bin/git-receive-pack"},{"path":"/usr/bin/git-shell"},{"path":"/usr/bin/git-upload-archive"},{"path":"/usr/bin/git-upload-pack"},{"path":"/usr/libexec"},{"path":"/usr/libexec/git-core"},{"path":"/usr/libexec/git-core/git"},{"path":"/usr/libexec/git-core/git-add"},{"path":"/usr/libexec/git-core/git-am"},{"path":"/usr/libexec/git-core/git-annotate"},{"path":"/usr/libexec/git-core/git-apply"},{"path":"/usr/libexec/git-core/git-archive"},{"path":"/usr/libexec/git-core/git-bisect"},{"path":"/usr/libexec/git-core/git-bisect--helper"},{"path":"/usr/libexec/git-core/git-blame"},{"path":"/usr/libexec/git-core/git-branch"},{"path":"/usr/libexec/git-core/git-bugreport"},{"path":"/usr/libexec/git-core/git-bundle"},{"path":"/usr/libexec/git-core/git-cat-file"},{"path":"/usr/libexec/git-core/git-check-attr"},{"path":"/usr/libexec/git-core/git-check-ignore"},{"path":"/usr/libexec/git-core/git-check-mailmap"},{"path":"/usr/libexec/git-core/git-check-ref-format"},{"path":"/usr/libexec/git-core/git-checkout"},{"path":"/usr/libexec/git-core/git-checkout-index"},{"path":"/usr/libexec/git-core/git-cherry"},{"path":"/usr/libexec/git-core/git-cherry-pick"},{"path":"/usr/libexec/git-core/git-clean"},{"path":"/usr/libexec/git-core/git-clone"},{"path":"/usr/libexec/git-core/git-column"},{"path":"/usr/libexec/git-core/git-commit"},{"path":"/usr/libexec/git-core/git-commit-graph"},{"path":"/usr/libexec/git-core/git-commit-tree"},{"path":"/usr/libexec/git-core/git-config"},{"path":"/usr/libexec/git-core/git-count-objects"},{"path":"/usr/libexec/git-core/git-credential"},{"path":"/usr/libexec/git-core/git-credential-cache"},{"path":"/usr/libexec/git-core/git-credential-cache--daemon"},{"path":"/usr/libexec/git-core/git-credential-store"},{"path":"/usr/libexec/git-core/git-describe"},{"path":"/usr/libexec/git-core/git-diff"},{"path":"/usr/libexec/git-core/git-diff-files"},{"path":"/usr/libexec/git-core/git-diff-index"},{"path":"/usr/libexec/git-core/git-diff-tree"},{"path":"/usr/libexec/git-core/git-difftool"},{"path":"/usr/libexec/git-core/git-difftool--helper"},{"path":"/usr/libexec/git-core/git-env--helper"},{"path":"/usr/libexec/git-core/git-fast-export"},{"path":"/usr/libexec/git-core/git-fetch"},{"path":"/usr/libexec/git-core/git-fetch-pack"},{"path":"/usr/libexec/git-core/git-filter-branch"},{"path":"/usr/libexec/git-core/git-fmt-merge-msg"},{"path":"/usr/libexec/git-core/git-for-each-ref"},{"path":"/usr/libexec/git-core/git-for-each-repo"},{"path":"/usr/libexec/git-core/git-format-patch"},{"path":"/usr/libexec/git-core/git-fsck"},{"path":"/usr/libexec/git-core/git-fsck-objects"},{"path":"/usr/libexec/git-core/git-gc"},{"path":"/usr/libexec/git-core/git-get-tar-commit-id"},{"path":"/usr/libexec/git-core/git-grep"},{"path":"/usr/libexec/git-core/git-hash-object"},{"path":"/usr/libexec/git-core/git-help"},{"path":"/usr/libexec/git-core/git-http-fetch"},{"path":"/usr/libexec/git-core/git-http-push"},{"path":"/usr/libexec/git-core/git-index-pack"},{"path":"/usr/libexec/git-core/git-init"},{"path":"/usr/libexec/git-core/git-init-db"},{"path":"/usr/libexec/git-core/git-interpret-trailers"},{"path":"/usr/libexec/git-core/git-log"},{"path":"/usr/libexec/git-core/git-ls-files"},{"path":"/usr/libexec/git-core/git-ls-remote"},{"path":"/usr/libexec/git-core/git-ls-tree"},{"path":"/usr/libexec/git-core/git-mailinfo"},{"path":"/usr/libexec/git-core/git-mailsplit"},{"path":"/usr/libexec/git-core/git-maintenance"},{"path":"/usr/libexec/git-core/git-merge"},{"path":"/usr/libexec/git-core/git-merge-base"},{"path":"/usr/libexec/git-core/git-merge-file"},{"path":"/usr/libexec/git-core/git-merge-index"},{"path":"/usr/libexec/git-core/git-merge-octopus"},{"path":"/usr/libexec/git-core/git-merge-one-file"},{"path":"/usr/libexec/git-core/git-merge-ours"},{"path":"/usr/libexec/git-core/git-merge-recursive"},{"path":"/usr/libexec/git-core/git-merge-resolve"},{"path":"/usr/libexec/git-core/git-merge-subtree"},{"path":"/usr/libexec/git-core/git-merge-tree"},{"path":"/usr/libexec/git-core/git-mergetool"},{"path":"/usr/libexec/git-core/git-mergetool--lib"},{"path":"/usr/libexec/git-core/git-mktag"},{"path":"/usr/libexec/git-core/git-mktree"},{"path":"/usr/libexec/git-core/git-multi-pack-index"},{"path":"/usr/libexec/git-core/git-mv"},{"path":"/usr/libexec/git-core/git-name-rev"},{"path":"/usr/libexec/git-core/git-notes"},{"path":"/usr/libexec/git-core/git-pack-objects"},{"path":"/usr/libexec/git-core/git-pack-redundant"},{"path":"/usr/libexec/git-core/git-pack-refs"},{"path":"/usr/libexec/git-core/git-patch-id"},{"path":"/usr/libexec/git-core/git-prune"},{"path":"/usr/libexec/git-core/git-prune-packed"},{"path":"/usr/libexec/git-core/git-pull"},{"path":"/usr/libexec/git-core/git-push"},{"path":"/usr/libexec/git-core/git-quiltimport"},{"path":"/usr/libexec/git-core/git-range-diff"},{"path":"/usr/libexec/git-core/git-read-tree"},{"path":"/usr/libexec/git-core/git-rebase"},{"path":"/usr/libexec/git-core/git-rebase--preserve-merges"},{"path":"/usr/libexec/git-core/git-receive-pack"},{"path":"/usr/libexec/git-core/git-reflog"},{"path":"/usr/libexec/git-core/git-remote"},{"path":"/usr/libexec/git-core/git-remote-ext"},{"path":"/usr/libexec/git-core/git-remote-fd"},{"path":"/usr/libexec/git-core/git-remote-ftp"},{"path":"/usr/libexec/git-core/git-remote-ftps"},{"path":"/usr/libexec/git-core/git-remote-http"},{"path":"/usr/libexec/git-core/git-remote-https"},{"path":"/usr/libexec/git-core/git-repack"},{"path":"/usr/libexec/git-core/git-replace"},{"path":"/usr/libexec/git-core/git-request-pull"},{"path":"/usr/libexec/git-core/git-rerere"},{"path":"/usr/libexec/git-core/git-reset"},{"path":"/usr/libexec/git-core/git-restore"},{"path":"/usr/libexec/git-core/git-rev-list"},{"path":"/usr/libexec/git-core/git-rev-parse"},{"path":"/usr/libexec/git-core/git-revert"},{"path":"/usr/libexec/git-core/git-rm"},{"path":"/usr/libexec/git-core/git-send-pack"},{"path":"/usr/libexec/git-core/git-sh-i18n"},{"path":"/usr/libexec/git-core/git-sh-i18n--envsubst"},{"path":"/usr/libexec/git-core/git-sh-setup"},{"path":"/usr/libexec/git-core/git-shortlog"},{"path":"/usr/libexec/git-core/git-show"},{"path":"/usr/libexec/git-core/git-show-branch"},{"path":"/usr/libexec/git-core/git-show-index"},{"path":"/usr/libexec/git-core/git-show-ref"},{"path":"/usr/libexec/git-core/git-sparse-checkout"},{"path":"/usr/libexec/git-core/git-stage"},{"path":"/usr/libexec/git-core/git-stash"},{"path":"/usr/libexec/git-core/git-status"},{"path":"/usr/libexec/git-core/git-stripspace"},{"path":"/usr/libexec/git-core/git-submodule"},{"path":"/usr/libexec/git-core/git-submodule--helper"},{"path":"/usr/libexec/git-core/git-switch"},{"path":"/usr/libexec/git-core/git-symbolic-ref"},{"path":"/usr/libexec/git-core/git-tag"},{"path":"/usr/libexec/git-core/git-unpack-file"},{"path":"/usr/libexec/git-core/git-unpack-objects"},{"path":"/usr/libexec/git-core/git-update-index"},{"path":"/usr/libexec/git-core/git-update-ref"},{"path":"/usr/libexec/git-core/git-update-server-info"},{"path":"/usr/libexec/git-core/git-upload-archive"},{"path":"/usr/libexec/git-core/git-upload-pack"},{"path":"/usr/libexec/git-core/git-var"},{"path":"/usr/libexec/git-core/git-verify-commit"},{"path":"/usr/libexec/git-core/git-verify-pack"},{"path":"/usr/libexec/git-core/git-verify-tag"},{"path":"/usr/libexec/git-core/git-web--browse"},{"path":"/usr/libexec/git-core/git-whatchanged"},{"path":"/usr/libexec/git-core/git-worktree"},{"path":"/usr/libexec/git-core/git-write-tree"},{"path":"/usr/libexec/git-core/mergetools"},{"path":"/usr/libexec/git-core/mergetools/araxis"},{"path":"/usr/libexec/git-core/mergetools/bc"},{"path":"/usr/libexec/git-core/mergetools/codecompare"},{"path":"/usr/libexec/git-core/mergetools/deltawalker"},{"path":"/usr/libexec/git-core/mergetools/diffmerge"},{"path":"/usr/libexec/git-core/mergetools/diffuse"},{"path":"/usr/libexec/git-core/mergetools/ecmerge"},{"path":"/usr/libexec/git-core/mergetools/emerge"},{"path":"/usr/libexec/git-core/mergetools/examdiff"},{"path":"/usr/libexec/git-core/mergetools/guiffy"},{"path":"/usr/libexec/git-core/mergetools/gvimdiff"},{"path":"/usr/libexec/git-core/mergetools/kdiff3"},{"path":"/usr/libexec/git-core/mergetools/kompare"},{"path":"/usr/libexec/git-core/mergetools/meld"},{"path":"/usr/libexec/git-core/mergetools/nvimdiff"},{"path":"/usr/libexec/git-core/mergetools/opendiff"},{"path":"/usr/libexec/git-core/mergetools/smerge"},{"path":"/usr/libexec/git-core/mergetools/tkdiff"},{"path":"/usr/libexec/git-core/mergetools/tortoisemerge"},{"path":"/usr/libexec/git-core/mergetools/vimdiff"},{"path":"/usr/libexec/git-core/mergetools/winmerge"},{"path":"/usr/libexec/git-core/mergetools/xxdiff"},{"path":"/usr/share"},{"path":"/usr/share/git-core"},{"path":"/usr/share/git-core/templates"},{"path":"/usr/share/git-core/templates/description"},{"path":"/usr/share/git-core/templates/branches"},{"path":"/usr/share/git-core/templates/hooks"},{"path":"/usr/share/git-core/templates/hooks/applypatch-msg.sample"},{"path":"/usr/share/git-core/templates/hooks/commit-msg.sample"},{"path":"/usr/share/git-core/templates/hooks/post-update.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-applypatch.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-commit.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-merge-commit.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-push.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-rebase.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-receive.sample"},{"path":"/usr/share/git-core/templates/hooks/prepare-commit-msg.sample"},{"path":"/usr/share/git-core/templates/hooks/push-to-checkout.sample"},{"path":"/usr/share/git-core/templates/hooks/update.sample"},{"path":"/usr/share/git-core/templates/info"},{"path":"/usr/share/git-core/templates/info/exclude"},{"path":"/usr/share/perl5"},{"path":"/var"},{"path":"/var/git"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"git"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2023-25652","versionConstraint":"< 2.30.9||>= 2.31.0, < 2.31.8||>= 2.32.0, < 2.32.7||>= 2.33.0, < 2.33.8||>= 2.34.0, < 2.34.8||>= 2.35.0, < 2.35.8||>= 2.36.0, < 2.36.6||>= 2.37.0, < 2.37.7||>= 2.38.0, < 2.38.5||>= 2.39.0, < 2.39.3||= 2.40.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:git-scm:git:2.30.6:*:*:*:*:*:*:*"],"package":{"name":"git","version":"2.30.6-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2023-25652","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-25652","cwe":"CWE-22","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2023-25652","date":"2026-10-08","epss":0.51883,"percentile":0.98925}],"risk":38.91225,"urls":["http://www.openwall.com/lists/oss-security/2023/04/25/2","https://github.com/git/git/commit/18e2b1cfc80990719275d7b08e6e50f3e8cbc902","https://github.com/git/git/commit/668f2d53613ac8fd373926ebe219f2c29112d93e","https://github.com/git/git/security/advisories/GHSA-2hvf-7c8p-28fx","https://lists.debian.org/debian-lts-announce/2024/06/msg00018.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BSXOGVVBJLYX26IAYX6PJSYQB36BREWH/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PI7FZ4NNR5S5J5K6AMVQBH2JFP6NE4L7/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RKOXOAZ42HLXHXTW6JZI4L5DAIYDTYCU/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YFZWGQKB6MM5MNF2DLFTD7KS2KWPICKL/","https://security.gentoo.org/glsa/202312-15","https://lists.debian.org/debian-lts-announce/2024/09/msg00009.html"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-25652","description":"Git is a revision control system. Prior to versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1, by feeding specially crafted input to `git apply --reject`, a path outside the working tree can be overwritten with partially controlled contents (corresponding to the rejected hunk(s) from the given patch). A fix is available in versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1. As a workaround, avoid using `git apply` with `--reject` when applying patches from an untrusted source. Use `git apply --stat` to inspect a patch before applying; avoid applying one that create a conflict where a link corresponding to the `*.rej` file exists."},"relatedVulnerabilities":[]},{"artifact":{"id":"a45c752c9b8878aa","cpes":["cpe:2.3:a:php7:php7:7.4.26-r0:*:*:*:*:*:*:*","cpe:2.3:a:php7:php:7.4.26-r0:*:*:*:*:*:*:*","cpe:2.3:a:php:php7:7.4.26-r0:*:*:*:*:*:*:*","cpe:2.3:a:php:php:7.4.26-r0:*:*:*:*:*:*:*"],"name":"php7","purl":"pkg:apk/busybox/php7@7.4.26-r0?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"7.4.26-r0","language":"","licenses":["BSD-3-Clause","LGPL-2.0-or-later","MIT","PHP-3.01","Zend-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/php"},{"path":"/usr/bin/php7"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"php7"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:php:php:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2024-1874","versionConstraint":"< 8.1.28||>= 8.2, < 8.2.18||>= 8.3, < 8.3.5 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:php:php:7.4.26:*:*:*:*:*:*:*"],"package":{"name":"php7","version":"7.4.26-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2024-1874","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L","metrics":{"baseScore":9.4,"impactScore":5.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-1874","cwe":"CWE-116","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2024-1874","date":"2026-10-08","epss":0.32568,"percentile":0.98304}],"risk":29.962560000000003,"urls":["http://www.openwall.com/lists/oss-security/2024/04/12/11","http://www.openwall.com/lists/oss-security/2024/06/07/1","https://github.com/php/php-src/security/advisories/GHSA-pc52-254m-w9w7","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PKGTQUOA2NTZ3RXN22CSAUJPIRUYRB4B/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W45DBOH56NQDRTOM2DN2LNA2FZIMC3PK/","https://security.netapp.com/advisory/ntap-20240510-0009/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KJZK3X6B7FBE32FETDSMRLJXTFTHKWSY/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZGWIK3HMBACERGB4TSBB2JUOMPYY2VKY/","https://www.kb.cert.org/vuls/id/123335","https://www.vicarius.io/vsociety/posts/command-injection-vulnerability-in-php-on-windows-systems-cve-2024-1874-and-cve-2024-5585"],"severity":"Critical","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-1874","description":"In PHP versions 8.1.* before 8.1.28, 8.2.* before 8.2.18, 8.3.* before 8.3.5, when using proc_open() command with array syntax, due to insufficient escaping, if the arguments of the executed command are controlled by a malicious user, the user can supply arguments that would execute arbitrary commands in Windows shell."},"relatedVulnerabilities":[]},{"artifact":{"id":"6040784032e8795c","cpes":["cpe:2.3:a:curl:curl:7.79.1-r3:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:7.79.1-r3:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/busybox/curl@7.79.1-r3?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"7.79.1-r3","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2024-2398","versionConstraint":">= 7.4.4, < 8.7.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:haxx:curl:7.79.1:*:*:*:*:*:*:*"],"package":{"name":"curl","version":"7.79.1-r3"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2024-2398","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L","metrics":{"baseScore":8.6,"impactScore":4.8,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-2398","cwe":"CWE-772","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-2398","date":"2026-10-08","epss":0.36081,"percentile":0.98442}],"risk":29.045205000000003,"urls":["http://seclists.org/fulldisclosure/2024/Jul/18","http://seclists.org/fulldisclosure/2024/Jul/19","http://seclists.org/fulldisclosure/2024/Jul/20","http://www.openwall.com/lists/oss-security/2024/03/27/3","https://curl.se/docs/CVE-2024-2398.html","https://curl.se/docs/CVE-2024-2398.json","https://hackerone.com/reports/2402845","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2D44YLAUFJU6BZ4XFG2FYV7SBKXB5IZ6/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GMD6UYKCCRCYETWQZUJ65ZRFULT6SHLI/","https://security.netapp.com/advisory/ntap-20240503-0009/","https://support.apple.com/kb/HT214118","https://support.apple.com/kb/HT214119","https://support.apple.com/kb/HT214120"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-2398","description":"When an application tells libcurl it wants to allow HTTP/2 server push, and the amount of received headers for the push surpasses the maximum allowed limit (1000), libcurl aborts the server push. When aborting, libcurl inadvertently does not free all the previously allocated headers and instead leaks the memory.  Further, this error condition fails silently and is therefore not easily detected by an application."},"relatedVulnerabilities":[]},{"artifact":{"id":"d081de97c6f633df","cpes":["cpe:2.3:a:libcrypto1.1:libcrypto1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto1.1:libcrypto:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto:libcrypto1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto:libcrypto:1.1.1q-r0:*:*:*:*:*:*:*"],"name":"libcrypto1.1","purl":"pkg:apk/busybox/libcrypto1.1@1.1.1q-r0?arch=x86_64&distro=busybox-1.32.1&upstream=openssl","type":"apk","version":"1.1.1q-r0","language":"","licenses":["OpenSSL"],"metadata":{"Arch":"x86_64","files":[{"path":"/etc"},{"path":"/etc/ssl"},{"path":"/etc/ssl/ct_log_list.cnf"},{"path":"/etc/ssl/ct_log_list.cnf.dist"},{"path":"/etc/ssl/openssl.cnf"},{"path":"/etc/ssl/openssl.cnf.dist"},{"path":"/etc/ssl/certs"},{"path":"/etc/ssl/misc"},{"path":"/etc/ssl/misc/CA.pl"},{"path":"/etc/ssl/misc/tsget"},{"path":"/etc/ssl/misc/tsget.pl"},{"path":"/etc/ssl/private"},{"path":"/lib"},{"path":"/lib/libcrypto.so.1.1"},{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcrypto.so.1.1"},{"path":"/usr/lib/engines-1.1"},{"path":"/usr/lib/engines-1.1/afalg.so"},{"path":"/usr/lib/engines-1.1/capi.so"},{"path":"/usr/lib/engines-1.1/padlock.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2024-2511","versionConstraint":">= 1.1.1, < 1.1.1y||>= 3.0.0, < 3.0.14||>= 3.1.0, < 3.1.6||>= 3.2.0, < 3.2.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:1.1.1q:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"1.1.1q-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2024-2511","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-2511","cwe":"CWE-1325","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2024-2511","date":"2026-10-08","epss":0.52421,"percentile":0.98938}],"risk":28.569444999999998,"urls":["https://github.com/openssl/openssl/commit/7e4d731b1c07201ad9374c1cd9ac5263bdf35bce","https://github.com/openssl/openssl/commit/b52867a9f618bb955bed2a3ce3db4d4f97ed8e5d","https://github.com/openssl/openssl/commit/e9d7083e241670332e0443da0f0d4ffb52829f08","https://github.openssl.org/openssl/extended-releases/commit/5f8d25770ae6437db119dfc951e207271a326640","https://www.openssl.org/news/secadv/20240408.txt","http://www.openwall.com/lists/oss-security/2024/04/08/5","https://lists.debian.org/debian-lts-announce/2024/10/msg00033.html","https://lists.debian.org/debian-lts-announce/2024/11/msg00000.html","https://security.netapp.com/advisory/ntap-20240503-0013/","https://cert-portal.siemens.com/productcert/html/ssa-265688.html","https://cert-portal.siemens.com/productcert/html/ssa-354112.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html","https://cert-portal.siemens.com/productcert/html/ssa-613116.html","https://cert-portal.siemens.com/productcert/html/ssa-769027.html","https://cert-portal.siemens.com/productcert/html/ssa-915275.html"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-2511","description":"Issue summary: Some non-default TLS server configurations can cause unbounded\nmemory growth when processing TLSv1.3 sessions\n\nImpact summary: An attacker may exploit certain server configurations to trigger\nunbounded memory growth that would lead to a Denial of Service\n\nThis problem can occur in TLSv1.3 if the non-default SSL_OP_NO_TICKET option is\nbeing used (but not if early_data support is also configured and the default\nanti-replay protection is in use). In this case, under certain conditions, the\nsession cache can get into an incorrect state and it will fail to flush properly\nas it fills. The session cache will continue to grow in an unbounded manner. A\nmalicious client could deliberately create the scenario for this failure to\nforce a Denial of Service. It may also happen by accident in normal operation.\n\nThis issue only affects TLS servers supporting TLSv1.3. It does not affect TLS\nclients.\n\nThe FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue. OpenSSL\n1.0.2 is also not affected by this issue."},"relatedVulnerabilities":[]},{"artifact":{"id":"74f4e71ff41d2d68","cpes":["cpe:2.3:a:libssl1.1:libssl1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl1.1:libssl:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl:1.1.1q-r0:*:*:*:*:*:*:*"],"name":"libssl1.1","purl":"pkg:apk/busybox/libssl1.1@1.1.1q-r0?arch=x86_64&distro=busybox-1.32.1&upstream=openssl","type":"apk","version":"1.1.1q-r0","language":"","licenses":["OpenSSL"],"metadata":{"Arch":"x86_64","files":[{"path":"/lib"},{"path":"/lib/libssl.so.1.1"},{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libssl.so.1.1"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2024-2511","versionConstraint":">= 1.1.1, < 1.1.1y||>= 3.0.0, < 3.0.14||>= 3.1.0, < 3.1.6||>= 3.2.0, < 3.2.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:1.1.1q:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"1.1.1q-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2024-2511","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-2511","cwe":"CWE-1325","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2024-2511","date":"2026-10-08","epss":0.52421,"percentile":0.98938}],"risk":28.569444999999998,"urls":["https://github.com/openssl/openssl/commit/7e4d731b1c07201ad9374c1cd9ac5263bdf35bce","https://github.com/openssl/openssl/commit/b52867a9f618bb955bed2a3ce3db4d4f97ed8e5d","https://github.com/openssl/openssl/commit/e9d7083e241670332e0443da0f0d4ffb52829f08","https://github.openssl.org/openssl/extended-releases/commit/5f8d25770ae6437db119dfc951e207271a326640","https://www.openssl.org/news/secadv/20240408.txt","http://www.openwall.com/lists/oss-security/2024/04/08/5","https://lists.debian.org/debian-lts-announce/2024/10/msg00033.html","https://lists.debian.org/debian-lts-announce/2024/11/msg00000.html","https://security.netapp.com/advisory/ntap-20240503-0013/","https://cert-portal.siemens.com/productcert/html/ssa-265688.html","https://cert-portal.siemens.com/productcert/html/ssa-354112.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html","https://cert-portal.siemens.com/productcert/html/ssa-613116.html","https://cert-portal.siemens.com/productcert/html/ssa-769027.html","https://cert-portal.siemens.com/productcert/html/ssa-915275.html"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-2511","description":"Issue summary: Some non-default TLS server configurations can cause unbounded\nmemory growth when processing TLSv1.3 sessions\n\nImpact summary: An attacker may exploit certain server configurations to trigger\nunbounded memory growth that would lead to a Denial of Service\n\nThis problem can occur in TLSv1.3 if the non-default SSL_OP_NO_TICKET option is\nbeing used (but not if early_data support is also configured and the default\nanti-replay protection is in use). In this case, under certain conditions, the\nsession cache can get into an incorrect state and it will fail to flush properly\nas it fills. The session cache will continue to grow in an unbounded manner. A\nmalicious client could deliberately create the scenario for this failure to\nforce a Denial of Service. It may also happen by accident in normal operation.\n\nThis issue only affects TLS servers supporting TLSv1.3. It does not affect TLS\nclients.\n\nThe FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue. OpenSSL\n1.0.2 is also not affected by this issue."},"relatedVulnerabilities":[]},{"artifact":{"id":"14807b4f7067817d","cpes":["cpe:2.3:a:openssl:openssl:1.1.1q-r0:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:apk/busybox/openssl@1.1.1q-r0?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"1.1.1q-r0","language":"","licenses":["OpenSSL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/openssl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2024-2511","versionConstraint":">= 1.1.1, < 1.1.1y||>= 3.0.0, < 3.0.14||>= 3.1.0, < 3.1.6||>= 3.2.0, < 3.2.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:1.1.1q:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"1.1.1q-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2024-2511","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-2511","cwe":"CWE-1325","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2024-2511","date":"2026-10-08","epss":0.52421,"percentile":0.98938}],"risk":28.569444999999998,"urls":["https://github.com/openssl/openssl/commit/7e4d731b1c07201ad9374c1cd9ac5263bdf35bce","https://github.com/openssl/openssl/commit/b52867a9f618bb955bed2a3ce3db4d4f97ed8e5d","https://github.com/openssl/openssl/commit/e9d7083e241670332e0443da0f0d4ffb52829f08","https://github.openssl.org/openssl/extended-releases/commit/5f8d25770ae6437db119dfc951e207271a326640","https://www.openssl.org/news/secadv/20240408.txt","http://www.openwall.com/lists/oss-security/2024/04/08/5","https://lists.debian.org/debian-lts-announce/2024/10/msg00033.html","https://lists.debian.org/debian-lts-announce/2024/11/msg00000.html","https://security.netapp.com/advisory/ntap-20240503-0013/","https://cert-portal.siemens.com/productcert/html/ssa-265688.html","https://cert-portal.siemens.com/productcert/html/ssa-354112.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html","https://cert-portal.siemens.com/productcert/html/ssa-613116.html","https://cert-portal.siemens.com/productcert/html/ssa-769027.html","https://cert-portal.siemens.com/productcert/html/ssa-915275.html"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-2511","description":"Issue summary: Some non-default TLS server configurations can cause unbounded\nmemory growth when processing TLSv1.3 sessions\n\nImpact summary: An attacker may exploit certain server configurations to trigger\nunbounded memory growth that would lead to a Denial of Service\n\nThis problem can occur in TLSv1.3 if the non-default SSL_OP_NO_TICKET option is\nbeing used (but not if early_data support is also configured and the default\nanti-replay protection is in use). In this case, under certain conditions, the\nsession cache can get into an incorrect state and it will fail to flush properly\nas it fills. The session cache will continue to grow in an unbounded manner. A\nmalicious client could deliberately create the scenario for this failure to\nforce a Denial of Service. It may also happen by accident in normal operation.\n\nThis issue only affects TLS servers supporting TLSv1.3. It does not affect TLS\nclients.\n\nThe FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue. OpenSSL\n1.0.2 is also not affected by this issue."},"relatedVulnerabilities":[]},{"artifact":{"id":"a45c752c9b8878aa","cpes":["cpe:2.3:a:php7:php7:7.4.26-r0:*:*:*:*:*:*:*","cpe:2.3:a:php7:php:7.4.26-r0:*:*:*:*:*:*:*","cpe:2.3:a:php:php7:7.4.26-r0:*:*:*:*:*:*:*","cpe:2.3:a:php:php:7.4.26-r0:*:*:*:*:*:*:*"],"name":"php7","purl":"pkg:apk/busybox/php7@7.4.26-r0?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"7.4.26-r0","language":"","licenses":["BSD-3-Clause","LGPL-2.0-or-later","MIT","PHP-3.01","Zend-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/php"},{"path":"/usr/bin/php7"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"php7"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:php:php:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2022-31629","versionConstraint":"< 7.4.31||>= 8.0.0, < 8.0.24||>= 8.1.0, < 8.1.11 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:php:php:7.4.26:*:*:*:*:*:*:*"],"package":{"name":"php7","version":"7.4.26-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2022-31629","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-31629","cwe":"CWE-20","type":"Secondary","source":"security@php.net"},{"cve":"CVE-2022-31629","cwe":"CWE-1284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-31629","date":"2026-10-08","epss":0.49336,"percentile":0.98864}],"risk":28.368199999999998,"urls":["http://www.openwall.com/lists/oss-security/2024/04/12/11","https://bugs.php.net/bug.php?id=81727","https://lists.debian.org/debian-lts-announce/2022/12/msg00030.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2L5SUVYGAKSWODUQPZFBUB3AL6E6CSEV/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KJZK3X6B7FBE32FETDSMRLJXTFTHKWSY/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LSJVPJTX7T3J5V7XHR4MFNHZGP44R5XE/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VI3E6A3ZTH2RP7OMLJHSVFIEQBIFM6RF/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XNIEABBH5XCXLFWWZYIDE457SPEDZTXV/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZGWIK3HMBACERGB4TSBB2JUOMPYY2VKY/","https://security.gentoo.org/glsa/202211-03","https://security.netapp.com/advisory/ntap-20221209-0001/","https://www.debian.org/security/2022/dsa-5277","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KJZK3X6B7FBE32FETDSMRLJXTFTHKWSY/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZGWIK3HMBACERGB4TSBB2JUOMPYY2VKY/"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-31629","description":"In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the vulnerability enables network and same-site attackers to set a standard insecure cookie in the victim's browser which is treated as a `__Host-` or `__Secure-` cookie by PHP applications."},"relatedVulnerabilities":[]},{"artifact":{"id":"de2e09a252869bf3","cpes":["cpe:2.3:a:git-scm:git:2.30.6-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_scm:git:2.30.6-r0:*:*:*:*:*:*:*","cpe:2.3:a:git:git:2.30.6-r0:*:*:*:*:*:*:*"],"name":"git","purl":"pkg:apk/busybox/git@2.30.6-r0?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"2.30.6-r0","language":"","licenses":["GPL-2.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/git"},{"path":"/usr/bin/git-receive-pack"},{"path":"/usr/bin/git-shell"},{"path":"/usr/bin/git-upload-archive"},{"path":"/usr/bin/git-upload-pack"},{"path":"/usr/libexec"},{"path":"/usr/libexec/git-core"},{"path":"/usr/libexec/git-core/git"},{"path":"/usr/libexec/git-core/git-add"},{"path":"/usr/libexec/git-core/git-am"},{"path":"/usr/libexec/git-core/git-annotate"},{"path":"/usr/libexec/git-core/git-apply"},{"path":"/usr/libexec/git-core/git-archive"},{"path":"/usr/libexec/git-core/git-bisect"},{"path":"/usr/libexec/git-core/git-bisect--helper"},{"path":"/usr/libexec/git-core/git-blame"},{"path":"/usr/libexec/git-core/git-branch"},{"path":"/usr/libexec/git-core/git-bugreport"},{"path":"/usr/libexec/git-core/git-bundle"},{"path":"/usr/libexec/git-core/git-cat-file"},{"path":"/usr/libexec/git-core/git-check-attr"},{"path":"/usr/libexec/git-core/git-check-ignore"},{"path":"/usr/libexec/git-core/git-check-mailmap"},{"path":"/usr/libexec/git-core/git-check-ref-format"},{"path":"/usr/libexec/git-core/git-checkout"},{"path":"/usr/libexec/git-core/git-checkout-index"},{"path":"/usr/libexec/git-core/git-cherry"},{"path":"/usr/libexec/git-core/git-cherry-pick"},{"path":"/usr/libexec/git-core/git-clean"},{"path":"/usr/libexec/git-core/git-clone"},{"path":"/usr/libexec/git-core/git-column"},{"path":"/usr/libexec/git-core/git-commit"},{"path":"/usr/libexec/git-core/git-commit-graph"},{"path":"/usr/libexec/git-core/git-commit-tree"},{"path":"/usr/libexec/git-core/git-config"},{"path":"/usr/libexec/git-core/git-count-objects"},{"path":"/usr/libexec/git-core/git-credential"},{"path":"/usr/libexec/git-core/git-credential-cache"},{"path":"/usr/libexec/git-core/git-credential-cache--daemon"},{"path":"/usr/libexec/git-core/git-credential-store"},{"path":"/usr/libexec/git-core/git-describe"},{"path":"/usr/libexec/git-core/git-diff"},{"path":"/usr/libexec/git-core/git-diff-files"},{"path":"/usr/libexec/git-core/git-diff-index"},{"path":"/usr/libexec/git-core/git-diff-tree"},{"path":"/usr/libexec/git-core/git-difftool"},{"path":"/usr/libexec/git-core/git-difftool--helper"},{"path":"/usr/libexec/git-core/git-env--helper"},{"path":"/usr/libexec/git-core/git-fast-export"},{"path":"/usr/libexec/git-core/git-fetch"},{"path":"/usr/libexec/git-core/git-fetch-pack"},{"path":"/usr/libexec/git-core/git-filter-branch"},{"path":"/usr/libexec/git-core/git-fmt-merge-msg"},{"path":"/usr/libexec/git-core/git-for-each-ref"},{"path":"/usr/libexec/git-core/git-for-each-repo"},{"path":"/usr/libexec/git-core/git-format-patch"},{"path":"/usr/libexec/git-core/git-fsck"},{"path":"/usr/libexec/git-core/git-fsck-objects"},{"path":"/usr/libexec/git-core/git-gc"},{"path":"/usr/libexec/git-core/git-get-tar-commit-id"},{"path":"/usr/libexec/git-core/git-grep"},{"path":"/usr/libexec/git-core/git-hash-object"},{"path":"/usr/libexec/git-core/git-help"},{"path":"/usr/libexec/git-core/git-http-fetch"},{"path":"/usr/libexec/git-core/git-http-push"},{"path":"/usr/libexec/git-core/git-index-pack"},{"path":"/usr/libexec/git-core/git-init"},{"path":"/usr/libexec/git-core/git-init-db"},{"path":"/usr/libexec/git-core/git-interpret-trailers"},{"path":"/usr/libexec/git-core/git-log"},{"path":"/usr/libexec/git-core/git-ls-files"},{"path":"/usr/libexec/git-core/git-ls-remote"},{"path":"/usr/libexec/git-core/git-ls-tree"},{"path":"/usr/libexec/git-core/git-mailinfo"},{"path":"/usr/libexec/git-core/git-mailsplit"},{"path":"/usr/libexec/git-core/git-maintenance"},{"path":"/usr/libexec/git-core/git-merge"},{"path":"/usr/libexec/git-core/git-merge-base"},{"path":"/usr/libexec/git-core/git-merge-file"},{"path":"/usr/libexec/git-core/git-merge-index"},{"path":"/usr/libexec/git-core/git-merge-octopus"},{"path":"/usr/libexec/git-core/git-merge-one-file"},{"path":"/usr/libexec/git-core/git-merge-ours"},{"path":"/usr/libexec/git-core/git-merge-recursive"},{"path":"/usr/libexec/git-core/git-merge-resolve"},{"path":"/usr/libexec/git-core/git-merge-subtree"},{"path":"/usr/libexec/git-core/git-merge-tree"},{"path":"/usr/libexec/git-core/git-mergetool"},{"path":"/usr/libexec/git-core/git-mergetool--lib"},{"path":"/usr/libexec/git-core/git-mktag"},{"path":"/usr/libexec/git-core/git-mktree"},{"path":"/usr/libexec/git-core/git-multi-pack-index"},{"path":"/usr/libexec/git-core/git-mv"},{"path":"/usr/libexec/git-core/git-name-rev"},{"path":"/usr/libexec/git-core/git-notes"},{"path":"/usr/libexec/git-core/git-pack-objects"},{"path":"/usr/libexec/git-core/git-pack-redundant"},{"path":"/usr/libexec/git-core/git-pack-refs"},{"path":"/usr/libexec/git-core/git-patch-id"},{"path":"/usr/libexec/git-core/git-prune"},{"path":"/usr/libexec/git-core/git-prune-packed"},{"path":"/usr/libexec/git-core/git-pull"},{"path":"/usr/libexec/git-core/git-push"},{"path":"/usr/libexec/git-core/git-quiltimport"},{"path":"/usr/libexec/git-core/git-range-diff"},{"path":"/usr/libexec/git-core/git-read-tree"},{"path":"/usr/libexec/git-core/git-rebase"},{"path":"/usr/libexec/git-core/git-rebase--preserve-merges"},{"path":"/usr/libexec/git-core/git-receive-pack"},{"path":"/usr/libexec/git-core/git-reflog"},{"path":"/usr/libexec/git-core/git-remote"},{"path":"/usr/libexec/git-core/git-remote-ext"},{"path":"/usr/libexec/git-core/git-remote-fd"},{"path":"/usr/libexec/git-core/git-remote-ftp"},{"path":"/usr/libexec/git-core/git-remote-ftps"},{"path":"/usr/libexec/git-core/git-remote-http"},{"path":"/usr/libexec/git-core/git-remote-https"},{"path":"/usr/libexec/git-core/git-repack"},{"path":"/usr/libexec/git-core/git-replace"},{"path":"/usr/libexec/git-core/git-request-pull"},{"path":"/usr/libexec/git-core/git-rerere"},{"path":"/usr/libexec/git-core/git-reset"},{"path":"/usr/libexec/git-core/git-restore"},{"path":"/usr/libexec/git-core/git-rev-list"},{"path":"/usr/libexec/git-core/git-rev-parse"},{"path":"/usr/libexec/git-core/git-revert"},{"path":"/usr/libexec/git-core/git-rm"},{"path":"/usr/libexec/git-core/git-send-pack"},{"path":"/usr/libexec/git-core/git-sh-i18n"},{"path":"/usr/libexec/git-core/git-sh-i18n--envsubst"},{"path":"/usr/libexec/git-core/git-sh-setup"},{"path":"/usr/libexec/git-core/git-shortlog"},{"path":"/usr/libexec/git-core/git-show"},{"path":"/usr/libexec/git-core/git-show-branch"},{"path":"/usr/libexec/git-core/git-show-index"},{"path":"/usr/libexec/git-core/git-show-ref"},{"path":"/usr/libexec/git-core/git-sparse-checkout"},{"path":"/usr/libexec/git-core/git-stage"},{"path":"/usr/libexec/git-core/git-stash"},{"path":"/usr/libexec/git-core/git-status"},{"path":"/usr/libexec/git-core/git-stripspace"},{"path":"/usr/libexec/git-core/git-submodule"},{"path":"/usr/libexec/git-core/git-submodule--helper"},{"path":"/usr/libexec/git-core/git-switch"},{"path":"/usr/libexec/git-core/git-symbolic-ref"},{"path":"/usr/libexec/git-core/git-tag"},{"path":"/usr/libexec/git-core/git-unpack-file"},{"path":"/usr/libexec/git-core/git-unpack-objects"},{"path":"/usr/libexec/git-core/git-update-index"},{"path":"/usr/libexec/git-core/git-update-ref"},{"path":"/usr/libexec/git-core/git-update-server-info"},{"path":"/usr/libexec/git-core/git-upload-archive"},{"path":"/usr/libexec/git-core/git-upload-pack"},{"path":"/usr/libexec/git-core/git-var"},{"path":"/usr/libexec/git-core/git-verify-commit"},{"path":"/usr/libexec/git-core/git-verify-pack"},{"path":"/usr/libexec/git-core/git-verify-tag"},{"path":"/usr/libexec/git-core/git-web--browse"},{"path":"/usr/libexec/git-core/git-whatchanged"},{"path":"/usr/libexec/git-core/git-worktree"},{"path":"/usr/libexec/git-core/git-write-tree"},{"path":"/usr/libexec/git-core/mergetools"},{"path":"/usr/libexec/git-core/mergetools/araxis"},{"path":"/usr/libexec/git-core/mergetools/bc"},{"path":"/usr/libexec/git-core/mergetools/codecompare"},{"path":"/usr/libexec/git-core/mergetools/deltawalker"},{"path":"/usr/libexec/git-core/mergetools/diffmerge"},{"path":"/usr/libexec/git-core/mergetools/diffuse"},{"path":"/usr/libexec/git-core/mergetools/ecmerge"},{"path":"/usr/libexec/git-core/mergetools/emerge"},{"path":"/usr/libexec/git-core/mergetools/examdiff"},{"path":"/usr/libexec/git-core/mergetools/guiffy"},{"path":"/usr/libexec/git-core/mergetools/gvimdiff"},{"path":"/usr/libexec/git-core/mergetools/kdiff3"},{"path":"/usr/libexec/git-core/mergetools/kompare"},{"path":"/usr/libexec/git-core/mergetools/meld"},{"path":"/usr/libexec/git-core/mergetools/nvimdiff"},{"path":"/usr/libexec/git-core/mergetools/opendiff"},{"path":"/usr/libexec/git-core/mergetools/smerge"},{"path":"/usr/libexec/git-core/mergetools/tkdiff"},{"path":"/usr/libexec/git-core/mergetools/tortoisemerge"},{"path":"/usr/libexec/git-core/mergetools/vimdiff"},{"path":"/usr/libexec/git-core/mergetools/winmerge"},{"path":"/usr/libexec/git-core/mergetools/xxdiff"},{"path":"/usr/share"},{"path":"/usr/share/git-core"},{"path":"/usr/share/git-core/templates"},{"path":"/usr/share/git-core/templates/description"},{"path":"/usr/share/git-core/templates/branches"},{"path":"/usr/share/git-core/templates/hooks"},{"path":"/usr/share/git-core/templates/hooks/applypatch-msg.sample"},{"path":"/usr/share/git-core/templates/hooks/commit-msg.sample"},{"path":"/usr/share/git-core/templates/hooks/post-update.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-applypatch.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-commit.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-merge-commit.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-push.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-rebase.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-receive.sample"},{"path":"/usr/share/git-core/templates/hooks/prepare-commit-msg.sample"},{"path":"/usr/share/git-core/templates/hooks/push-to-checkout.sample"},{"path":"/usr/share/git-core/templates/hooks/update.sample"},{"path":"/usr/share/git-core/templates/info"},{"path":"/usr/share/git-core/templates/info/exclude"},{"path":"/usr/share/perl5"},{"path":"/var"},{"path":"/var/git"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"git"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2024-32002","versionConstraint":"< 2.39.4||>= 2.40.0, < 2.40.2||>= 2.41.0, < 2.41.1||>= 2.42.0, < 2.42.2||>= 2.43.0, < 2.43.4||>= 2.44.0, < 2.44.1||>= 2.45.0, < 2.45.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:git-scm:git:2.30.6:*:*:*:*:*:*:*"],"package":{"name":"git","version":"2.30.6-r0"},"namespace":"nvd:cpe"}},{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:git:git:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2024-32002","versionConstraint":"< 2.39.4||>= 2.40.0, < 2.40.2||>= 2.41.0, < 2.41.1||>= 2.42.0, < 2.42.2||>= 2.43.0, < 2.43.4||>= 2.44.0, < 2.44.1||>= 2.45.0, < 2.45.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:git:git:2.30.6:*:*:*:*:*:*:*"],"package":{"name":"git","version":"2.30.6-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2024-32002","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9,"impactScore":6.1,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9,"impactScore":6.1,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-32002","cwe":"CWE-22","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2024-32002","cwe":"CWE-434","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2024-32002","cwe":"CWE-59","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-32002","date":"2026-10-08","epss":0.29234,"percentile":0.98133}],"risk":26.3106,"urls":["http://www.openwall.com/lists/oss-security/2024/05/14/2","https://git-scm.com/docs/git-clone#Documentation/git-clone.txt---recurse-submodulesltpathspecgt","https://git-scm.com/docs/git-config#Documentation/git-config.txt-coresymlinks","https://github.com/git/git/commit/97065761333fd62db1912d81b489db938d8c991d","https://github.com/git/git/security/advisories/GHSA-8h77-4q3w-gfgv","https://lists.debian.org/debian-lts-announce/2024/06/msg00018.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/S4CK4IYTXEOBZTEM5K3T6LWOIZ3S44AR/","https://lists.debian.org/debian-lts-announce/2024/09/msg00009.html"],"severity":"Critical","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-32002","description":"Git is a revision control system. Prior to versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4, repositories with submodules can be crafted in a way that exploits a bug in Git whereby it can be fooled into writing files not into the submodule's worktree but into a `.git/` directory. This allows writing a hook that will be executed while the clone operation is still running, giving the user no opportunity to inspect the code that is being executed. The problem has been patched in versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4. If symbolic link support is disabled in Git (e.g. via `git config --global core.symlinks false`), the described attack won't work. As always, it is best to avoid cloning repositories from untrusted sources."},"relatedVulnerabilities":[]},{"artifact":{"id":"a45c752c9b8878aa","cpes":["cpe:2.3:a:php7:php7:7.4.26-r0:*:*:*:*:*:*:*","cpe:2.3:a:php7:php:7.4.26-r0:*:*:*:*:*:*:*","cpe:2.3:a:php:php7:7.4.26-r0:*:*:*:*:*:*:*","cpe:2.3:a:php:php:7.4.26-r0:*:*:*:*:*:*:*"],"name":"php7","purl":"pkg:apk/busybox/php7@7.4.26-r0?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"7.4.26-r0","language":"","licenses":["BSD-3-Clause","LGPL-2.0-or-later","MIT","PHP-3.01","Zend-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/php"},{"path":"/usr/bin/php7"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"php7"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:php:php:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2024-2756","versionConstraint":"< 8.1.28||>= 8.2, < 8.2.18||>= 8.3, < 8.3.5 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:php:php:7.4.26:*:*:*:*:*:*:*"],"package":{"name":"php7","version":"7.4.26-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2024-2756","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-2756","cwe":"CWE-20","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2024-2756","date":"2026-10-08","epss":0.38115,"percentile":0.98526}],"risk":21.916124999999997,"urls":["http://www.openwall.com/lists/oss-security/2024/04/12/11","https://github.com/php/php-src/security/advisories/GHSA-wpj3-hf5j-x4v4","https://lists.debian.org/debian-lts-announce/2024/05/msg00005.html","https://security.netapp.com/advisory/ntap-20240510-0008/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KJZK3X6B7FBE32FETDSMRLJXTFTHKWSY/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZGWIK3HMBACERGB4TSBB2JUOMPYY2VKY/"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-2756","description":"Due to an incomplete fix to  CVE-2022-31629 https://github.com/advisories/GHSA-c43m-486j-j32p , network and same-site attackers can set a standard insecure cookie in the victim's browser which is treated as a __Host- or __Secure- cookie by PHP applications."},"relatedVulnerabilities":[]},{"artifact":{"id":"422a442f930ca27c","cpes":["cpe:2.3:a:nginx:nginx:1.18.0-r15:*:*:*:*:*:*:*"],"name":"nginx","purl":"pkg:apk/busybox/nginx@1.18.0-r15?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"1.18.0-r15","language":"","licenses":["BSD-2-Clause"],"metadata":{"Arch":"x86_64","files":[{"path":"/etc"},{"path":"/etc/logrotate.d"},{"path":"/etc/logrotate.d/nginx"},{"path":"/etc/nginx"},{"path":"/etc/nginx/fastcgi.conf"},{"path":"/etc/nginx/fastcgi_params"},{"path":"/etc/nginx/mime.types"},{"path":"/etc/nginx/nginx.conf"},{"path":"/etc/nginx/scgi_params"},{"path":"/etc/nginx/uwsgi_params"},{"path":"/etc/nginx/http.d"},{"path":"/etc/nginx/modules"},{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/nginx"},{"path":"/usr/lib/nginx/modules"},{"path":"/usr/sbin"},{"path":"/usr/sbin/nginx"},{"path":"/usr/share"},{"path":"/usr/share/nginx"},{"path":"/usr/share/nginx/http-default_server.conf"},{"path":"/var"},{"path":"/var/lib"},{"path":"/var/lib/nginx"},{"path":"/var/lib/nginx/logs"},{"path":"/var/lib/nginx/modules"},{"path":"/var/lib/nginx/run"},{"path":"/var/lib/nginx/html"},{"path":"/var/lib/nginx/html/50x.html"},{"path":"/var/lib/nginx/html/index.html"},{"path":"/var/lib/nginx/tmp"},{"path":"/var/log"},{"path":"/var/log/nginx"},{"path":"/var/www"},{"path":"/var/www/localhost"},{"path":"/var/www/localhost/htdocs"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"nginx"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:nginx:nginx:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-27654","versionConstraint":">= 0.5.13, < 1.28.3||>= 1.29.0, < 1.29.7 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:nginx:nginx:1.18.0:*:*:*:*:*:*:*"],"package":{"name":"nginx","version":"1.18.0-r15"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-27654","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"f5sirt@f5.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"f5sirt@f5.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-27654","cwe":"CWE-122","type":"Secondary","source":"f5sirt@f5.com"},{"cve":"CVE-2026-27654","cwe":"CWE-120","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-27654","date":"2026-10-08","epss":0.25066,"percentile":0.97877}],"risk":19.92747,"urls":["https://my.f5.com/manage/s/article/K000160382","https://access.redhat.com/errata/RHSA-2026:10065","https://access.redhat.com/errata/RHSA-2026:13634","https://access.redhat.com/errata/RHSA-2026:13680","https://access.redhat.com/errata/RHSA-2026:13839","https://access.redhat.com/errata/RHSA-2026:14836","https://access.redhat.com/errata/RHSA-2026:15942","https://access.redhat.com/errata/RHSA-2026:15943","https://access.redhat.com/errata/RHSA-2026:15945","https://access.redhat.com/errata/RHSA-2026:15966","https://access.redhat.com/errata/RHSA-2026:6906","https://access.redhat.com/errata/RHSA-2026:6907","https://access.redhat.com/errata/RHSA-2026:6923","https://access.redhat.com/errata/RHSA-2026:7002","https://access.redhat.com/errata/RHSA-2026:7343","https://access.redhat.com/errata/RHSA-2026:8346","https://access.redhat.com/security/cve/CVE-2026-27654","https://bugzilla.redhat.com/show_bug.cgi?id=2450776","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27654.json"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-27654","description":"NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_dav_module module that might allow an attacker to trigger a buffer overflow to the NGINX worker process; this vulnerability may result in termination of the NGINX worker process or modification of source or destination file names outside the document root. This issue affects NGINX Open Source and NGINX Plus when the configuration file uses DAV module MOVE or COPY methods, prefix location (nonregular expression location configuration), and alias directives. The integrity impact is constrained because the NGINX worker process user has low privileges and does not have access to the entire system. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated."},"relatedVulnerabilities":[]},{"artifact":{"id":"b7ae79f16d85611b","cpes":["cpe:2.3:a:zlib:zlib:1.2.12-r3:*:*:*:*:*:*:*"],"name":"zlib","purl":"pkg:apk/busybox/zlib@1.2.12-r3?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"1.2.12-r3","language":"","licenses":["Zlib"],"metadata":{"Arch":"x86_64","files":[{"path":"/lib"},{"path":"/lib/libz.so.1"},{"path":"/lib/libz.so.1.2.12"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"zlib"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:zlib:zlib:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2022-37434","versionConstraint":"<= 1.2.12 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:zlib:zlib:1.2.12:*:*:*:*:*:*:*"],"package":{"name":"zlib","version":"1.2.12-r3"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2022-37434","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-37434","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-37434","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-37434","date":"2026-10-08","epss":0.18972,"percentile":0.97237}],"risk":17.83368,"urls":["http://seclists.org/fulldisclosure/2022/Oct/37","http://seclists.org/fulldisclosure/2022/Oct/38","http://seclists.org/fulldisclosure/2022/Oct/41","http://seclists.org/fulldisclosure/2022/Oct/42","http://www.openwall.com/lists/oss-security/2022/08/05/2","http://www.openwall.com/lists/oss-security/2022/08/09/1","https://github.com/curl/curl/issues/9271","https://github.com/ivd38/zlib_overflow","https://github.com/madler/zlib/blob/21767c654d31d2dccdde4330529775c6c5fd5389/zlib.h#L1062-L1063","https://github.com/madler/zlib/commit/1eb7682f845ac9e9bf9ae35bbfb3bad5dacbd91d","https://github.com/madler/zlib/commit/eff308af425b67093bab25f80f1ae950166bece1","https://github.com/nodejs/node/blob/75b68c6e4db515f76df73af476eccf382bbcb00a/deps/zlib/inflate.c#L762-L764","https://lists.debian.org/debian-lts-announce/2022/09/msg00012.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JWN4VE3JQR4O2SOUS5TXNLANRPMHWV4I/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NMBOJ77A7T7PQCARMDUK75TE6LLESZ3O/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PAVPQNCG3XRLCLNSQRM3KAN5ZFMVXVTY/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X5U7OTKZSHY2I3ZFJSR2SHFHW72RKGDK/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YRQAI7H4M4RQZ2IWZUEEXECBE5D56BH2/","https://security.netapp.com/advisory/ntap-20220901-0005/","https://security.netapp.com/advisory/ntap-20230427-0007/","https://support.apple.com/kb/HT213488","https://support.apple.com/kb/HT213489","https://support.apple.com/kb/HT213490","https://support.apple.com/kb/HT213491","https://support.apple.com/kb/HT213493","https://support.apple.com/kb/HT213494","https://www.debian.org/security/2022/dsa-5218","https://cert-portal.siemens.com/productcert/html/ssa-150063.html","https://cert-portal.siemens.com/productcert/html/ssa-202008.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html","https://cert-portal.siemens.com/productcert/html/ssa-470355.html","https://cert-portal.siemens.com/productcert/html/ssa-561322.html"],"severity":"Critical","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-37434","description":"zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field. NOTE: only applications that call inflateGetHeader are affected. Some common applications bundle the affected zlib source code but may be unable to call inflateGetHeader (e.g., see the nodejs/node reference)."},"relatedVulnerabilities":[]},{"artifact":{"id":"6040784032e8795c","cpes":["cpe:2.3:a:curl:curl:7.79.1-r3:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:7.79.1-r3:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/busybox/curl@7.79.1-r3?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"7.79.1-r3","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2022-32206","versionConstraint":"< 7.84.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:haxx:curl:7.79.1:*:*:*:*:*:*:*"],"package":{"name":"curl","version":"7.79.1-r3"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2022-32206","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-32206","cwe":"CWE-770","type":"Secondary","source":"support@hackerone.com"},{"cve":"CVE-2022-32206","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-32206","date":"2026-10-08","epss":0.33097,"percentile":0.98328}],"risk":17.817218333333333,"urls":["http://seclists.org/fulldisclosure/2022/Oct/28","http://seclists.org/fulldisclosure/2022/Oct/41","http://www.openwall.com/lists/oss-security/2023/02/15/3","https://cert-portal.siemens.com/productcert/pdf/ssa-333517.pdf","https://hackerone.com/reports/1570651","https://lists.debian.org/debian-lts-announce/2022/08/msg00017.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BEV6BR4MTI3CEWK2YU2HQZUW5FAS3FEY/","https://security.gentoo.org/glsa/202212-01","https://security.netapp.com/advisory/ntap-20220915-0003/","https://support.apple.com/kb/HT213488","https://www.debian.org/security/2022/dsa-5197"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-32206","description":"curl < 7.84.0 supports \"chained\" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple times and potentially with different algorithms. The number of acceptable \"links\" in this \"decompression chain\" was unbounded, allowing a malicious server to insert a virtually unlimited number of compression steps.The use of such a decompression chain could result in a \"malloc bomb\", makingcurl end up spending enormous amounts of allocated heap memory, or trying toand returning out of memory errors."},"relatedVulnerabilities":[]},{"artifact":{"id":"d081de97c6f633df","cpes":["cpe:2.3:a:libcrypto1.1:libcrypto1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto1.1:libcrypto:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto:libcrypto1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto:libcrypto:1.1.1q-r0:*:*:*:*:*:*:*"],"name":"libcrypto1.1","purl":"pkg:apk/busybox/libcrypto1.1@1.1.1q-r0?arch=x86_64&distro=busybox-1.32.1&upstream=openssl","type":"apk","version":"1.1.1q-r0","language":"","licenses":["OpenSSL"],"metadata":{"Arch":"x86_64","files":[{"path":"/etc"},{"path":"/etc/ssl"},{"path":"/etc/ssl/ct_log_list.cnf"},{"path":"/etc/ssl/ct_log_list.cnf.dist"},{"path":"/etc/ssl/openssl.cnf"},{"path":"/etc/ssl/openssl.cnf.dist"},{"path":"/etc/ssl/certs"},{"path":"/etc/ssl/misc"},{"path":"/etc/ssl/misc/CA.pl"},{"path":"/etc/ssl/misc/tsget"},{"path":"/etc/ssl/misc/tsget.pl"},{"path":"/etc/ssl/private"},{"path":"/lib"},{"path":"/lib/libcrypto.so.1.1"},{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcrypto.so.1.1"},{"path":"/usr/lib/engines-1.1"},{"path":"/usr/lib/engines-1.1/afalg.so"},{"path":"/usr/lib/engines-1.1/capi.so"},{"path":"/usr/lib/engines-1.1/padlock.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2022-4450","versionConstraint":">= 1.1.1, < 1.1.1t||>= 3.0.0, < 3.0.8 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:1.1.1q:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"1.1.1q-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2022-4450","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-4450","cwe":"CWE-415","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-4450","cwe":"CWE-415","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-4450","date":"2026-10-08","epss":0.20287,"percentile":0.97419}],"risk":15.21525,"urls":["https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=63bcf189be73a9cc1264059bed6f57974be74a83","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=bbcf509bd046b34cca19c766bbddc31683d0858b","https://security.gentoo.org/glsa/202402-08","https://www.openssl.org/news/secadv/20230207.txt","https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0003"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-4450","description":"The function PEM_read_bio_ex() reads a PEM file from a BIO and parses and\ndecodes the \"name\" (e.g. \"CERTIFICATE\"), any header data and the payload data.\nIf the function succeeds then the \"name_out\", \"header\" and \"data\" arguments are\npopulated with pointers to buffers containing the relevant decoded data. The\ncaller is responsible for freeing those buffers. It is possible to construct a\nPEM file that results in 0 bytes of payload data. In this case PEM_read_bio_ex()\nwill return a failure code but will populate the header argument with a pointer\nto a buffer that has already been freed. If the caller also frees this buffer\nthen a double free will occur. This will most likely lead to a crash. This\ncould be exploited by an attacker who has the ability to supply malicious PEM\nfiles for parsing to achieve a denial of service attack.\n\nThe functions PEM_read_bio() and PEM_read() are simple wrappers around\nPEM_read_bio_ex() and therefore these functions are also directly affected.\n\nThese functions are also called indirectly by a number of other OpenSSL\nfunctions including PEM_X509_INFO_read_bio_ex() and\nSSL_CTX_use_serverinfo_file() which are also vulnerable. Some OpenSSL internal\nuses of these functions are not vulnerable because the caller does not free the\nheader argument if PEM_read_bio_ex() returns a failure code. These locations\ninclude the PEM_read_bio_TYPE() functions as well as the decoders introduced in\nOpenSSL 3.0.\n\nThe OpenSSL asn1parse command line application is also impacted by this issue."},"relatedVulnerabilities":[]},{"artifact":{"id":"74f4e71ff41d2d68","cpes":["cpe:2.3:a:libssl1.1:libssl1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl1.1:libssl:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl:1.1.1q-r0:*:*:*:*:*:*:*"],"name":"libssl1.1","purl":"pkg:apk/busybox/libssl1.1@1.1.1q-r0?arch=x86_64&distro=busybox-1.32.1&upstream=openssl","type":"apk","version":"1.1.1q-r0","language":"","licenses":["OpenSSL"],"metadata":{"Arch":"x86_64","files":[{"path":"/lib"},{"path":"/lib/libssl.so.1.1"},{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libssl.so.1.1"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2022-4450","versionConstraint":">= 1.1.1, < 1.1.1t||>= 3.0.0, < 3.0.8 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:1.1.1q:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"1.1.1q-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2022-4450","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-4450","cwe":"CWE-415","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-4450","cwe":"CWE-415","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-4450","date":"2026-10-08","epss":0.20287,"percentile":0.97419}],"risk":15.21525,"urls":["https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=63bcf189be73a9cc1264059bed6f57974be74a83","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=bbcf509bd046b34cca19c766bbddc31683d0858b","https://security.gentoo.org/glsa/202402-08","https://www.openssl.org/news/secadv/20230207.txt","https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0003"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-4450","description":"The function PEM_read_bio_ex() reads a PEM file from a BIO and parses and\ndecodes the \"name\" (e.g. \"CERTIFICATE\"), any header data and the payload data.\nIf the function succeeds then the \"name_out\", \"header\" and \"data\" arguments are\npopulated with pointers to buffers containing the relevant decoded data. The\ncaller is responsible for freeing those buffers. It is possible to construct a\nPEM file that results in 0 bytes of payload data. In this case PEM_read_bio_ex()\nwill return a failure code but will populate the header argument with a pointer\nto a buffer that has already been freed. If the caller also frees this buffer\nthen a double free will occur. This will most likely lead to a crash. This\ncould be exploited by an attacker who has the ability to supply malicious PEM\nfiles for parsing to achieve a denial of service attack.\n\nThe functions PEM_read_bio() and PEM_read() are simple wrappers around\nPEM_read_bio_ex() and therefore these functions are also directly affected.\n\nThese functions are also called indirectly by a number of other OpenSSL\nfunctions including PEM_X509_INFO_read_bio_ex() and\nSSL_CTX_use_serverinfo_file() which are also vulnerable. Some OpenSSL internal\nuses of these functions are not vulnerable because the caller does not free the\nheader argument if PEM_read_bio_ex() returns a failure code. These locations\ninclude the PEM_read_bio_TYPE() functions as well as the decoders introduced in\nOpenSSL 3.0.\n\nThe OpenSSL asn1parse command line application is also impacted by this issue."},"relatedVulnerabilities":[]},{"artifact":{"id":"14807b4f7067817d","cpes":["cpe:2.3:a:openssl:openssl:1.1.1q-r0:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:apk/busybox/openssl@1.1.1q-r0?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"1.1.1q-r0","language":"","licenses":["OpenSSL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/openssl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2022-4450","versionConstraint":">= 1.1.1, < 1.1.1t||>= 3.0.0, < 3.0.8 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:1.1.1q:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"1.1.1q-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2022-4450","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-4450","cwe":"CWE-415","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-4450","cwe":"CWE-415","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-4450","date":"2026-10-08","epss":0.20287,"percentile":0.97419}],"risk":15.21525,"urls":["https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=63bcf189be73a9cc1264059bed6f57974be74a83","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=bbcf509bd046b34cca19c766bbddc31683d0858b","https://security.gentoo.org/glsa/202402-08","https://www.openssl.org/news/secadv/20230207.txt","https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0003"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-4450","description":"The function PEM_read_bio_ex() reads a PEM file from a BIO and parses and\ndecodes the \"name\" (e.g. \"CERTIFICATE\"), any header data and the payload data.\nIf the function succeeds then the \"name_out\", \"header\" and \"data\" arguments are\npopulated with pointers to buffers containing the relevant decoded data. The\ncaller is responsible for freeing those buffers. It is possible to construct a\nPEM file that results in 0 bytes of payload data. In this case PEM_read_bio_ex()\nwill return a failure code but will populate the header argument with a pointer\nto a buffer that has already been freed. If the caller also frees this buffer\nthen a double free will occur. This will most likely lead to a crash. This\ncould be exploited by an attacker who has the ability to supply malicious PEM\nfiles for parsing to achieve a denial of service attack.\n\nThe functions PEM_read_bio() and PEM_read() are simple wrappers around\nPEM_read_bio_ex() and therefore these functions are also directly affected.\n\nThese functions are also called indirectly by a number of other OpenSSL\nfunctions including PEM_X509_INFO_read_bio_ex() and\nSSL_CTX_use_serverinfo_file() which are also vulnerable. Some OpenSSL internal\nuses of these functions are not vulnerable because the caller does not free the\nheader argument if PEM_read_bio_ex() returns a failure code. These locations\ninclude the PEM_read_bio_TYPE() functions as well as the decoders introduced in\nOpenSSL 3.0.\n\nThe OpenSSL asn1parse command line application is also impacted by this issue."},"relatedVulnerabilities":[]},{"artifact":{"id":"6040784032e8795c","cpes":["cpe:2.3:a:curl:curl:7.79.1-r3:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:7.79.1-r3:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/busybox/curl@7.79.1-r3?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"7.79.1-r3","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2022-32205","versionConstraint":">= 7.71.0, < 7.84.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:haxx:curl:7.79.1:*:*:*:*:*:*:*"],"package":{"name":"curl","version":"7.79.1-r3"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2022-32205","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-32205","cwe":"CWE-770","type":"Secondary","source":"support@hackerone.com"},{"cve":"CVE-2022-32205","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-32205","date":"2026-10-08","epss":0.27904,"percentile":0.98057}],"risk":12.97536,"urls":["http://seclists.org/fulldisclosure/2022/Oct/28","http://seclists.org/fulldisclosure/2022/Oct/41","https://cert-portal.siemens.com/productcert/pdf/ssa-333517.pdf","https://hackerone.com/reports/1569946","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BEV6BR4MTI3CEWK2YU2HQZUW5FAS3FEY/","https://security.gentoo.org/glsa/202212-01","https://security.netapp.com/advisory/ntap-20220915-0003/","https://support.apple.com/kb/HT213488","https://www.debian.org/security/2022/dsa-5197"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-32205","description":"A malicious server can serve excessive amounts of `Set-Cookie:` headers in a HTTP response to curl and curl < 7.84.0 stores all of them. A sufficiently large amount of (big) cookies make subsequent HTTP requests to this, or other servers to which the cookies match, create requests that become larger than the threshold that curl uses internally to avoid sending crazy large requests (1048576 bytes) and instead returns an error.This denial state might remain for as long as the same cookies are kept, match and haven't expired. Due to cookie matching rules, a server on `foo.example.com` can set cookies that also would match for `bar.example.com`, making it it possible for a \"sister server\" to effectively cause a denial of service for a sibling site on the same second level domain using this method."},"relatedVulnerabilities":[]},{"artifact":{"id":"6040784032e8795c","cpes":["cpe:2.3:a:curl:curl:7.79.1-r3:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:7.79.1-r3:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/busybox/curl@7.79.1-r3?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"7.79.1-r3","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2022-43551","versionConstraint":">= 7.77.0, < 7.87.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:haxx:curl:7.79.1:*:*:*:*:*:*:*"],"package":{"name":"curl","version":"7.79.1-r3"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2022-43551","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-43551","cwe":"CWE-319","type":"Secondary","source":"support@hackerone.com"},{"cve":"CVE-2022-43551","cwe":"CWE-319","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-43551","date":"2026-10-08","epss":0.1654,"percentile":0.96934}],"risk":12.405,"urls":["https://hackerone.com/reports/1755083","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TVWZW5CNSJ7UYAF2BGSYAWAEXDJYUBHA/","https://security.gentoo.org/glsa/202310-12","https://security.netapp.com/advisory/ntap-20230427-0007/"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-43551","description":"A vulnerability exists in curl <7.87.0 HSTS check that could be bypassed to trick it to keep using HTTP. Using its HSTS support, curl can be instructed to use HTTPS instead of using an insecure clear-text HTTP step even when HTTP is provided in the URL. However, the HSTS mechanism could be bypassed if the host name in the given URL first uses IDN characters that get replaced to ASCII counterparts as part of the IDN conversion. Like using the character UTF-8 U+3002 (IDEOGRAPHIC FULL STOP) instead of the common ASCII full stop (U+002E) `.`. Then in a subsequent request, it does not detect the HSTS state and makes a clear text transfer. Because it would store the info IDN encoded but look for it IDN decoded."},"relatedVulnerabilities":[]},{"artifact":{"id":"6040784032e8795c","cpes":["cpe:2.3:a:curl:curl:7.79.1-r3:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:7.79.1-r3:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/busybox/curl@7.79.1-r3?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"7.79.1-r3","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2024-7264","versionConstraint":">= 7.32.0, < 8.9.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:haxx:curl:7.79.1:*:*:*:*:*:*:*"],"package":{"name":"curl","version":"7.79.1-r3"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2024-7264","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":6.3,"impactScore":3.4,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-7264","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-7264","date":"2026-10-08","epss":0.17301,"percentile":0.9704}],"risk":9.861570000000002,"urls":["http://www.openwall.com/lists/oss-security/2024/07/31/1","https://curl.se/docs/CVE-2024-7264.html","https://curl.se/docs/CVE-2024-7264.json","https://hackerone.com/reports/2629968","https://github.com/curl/curl/commit/27959ecce75cdb2809c0bdb3286e60e08fadb519","https://security.netapp.com/advisory/ntap-20240828-0008/","https://security.netapp.com/advisory/ntap-20241025-0006/","https://security.netapp.com/advisory/ntap-20241025-0010/"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-7264","description":"libcurl's ASN1 parser code has the `GTime2str()` function, used for parsing an\nASN.1 Generalized Time field. If given an syntactically incorrect field, the\nparser might end up using -1 for the length of the *time fraction*, leading to\na `strlen()` getting performed on a pointer to a heap buffer area that is not\n(purposely) null terminated.\n\nThis flaw most likely leads to a crash, but can also lead to heap contents\ngetting returned to the application when\n[CURLINFO_CERTINFO](https://curl.se/libcurl/c/CURLINFO_CERTINFO.html) is used."},"relatedVulnerabilities":[]},{"artifact":{"id":"d081de97c6f633df","cpes":["cpe:2.3:a:libcrypto1.1:libcrypto1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto1.1:libcrypto:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto:libcrypto1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto:libcrypto:1.1.1q-r0:*:*:*:*:*:*:*"],"name":"libcrypto1.1","purl":"pkg:apk/busybox/libcrypto1.1@1.1.1q-r0?arch=x86_64&distro=busybox-1.32.1&upstream=openssl","type":"apk","version":"1.1.1q-r0","language":"","licenses":["OpenSSL"],"metadata":{"Arch":"x86_64","files":[{"path":"/etc"},{"path":"/etc/ssl"},{"path":"/etc/ssl/ct_log_list.cnf"},{"path":"/etc/ssl/ct_log_list.cnf.dist"},{"path":"/etc/ssl/openssl.cnf"},{"path":"/etc/ssl/openssl.cnf.dist"},{"path":"/etc/ssl/certs"},{"path":"/etc/ssl/misc"},{"path":"/etc/ssl/misc/CA.pl"},{"path":"/etc/ssl/misc/tsget"},{"path":"/etc/ssl/misc/tsget.pl"},{"path":"/etc/ssl/private"},{"path":"/lib"},{"path":"/lib/libcrypto.so.1.1"},{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcrypto.so.1.1"},{"path":"/usr/lib/engines-1.1"},{"path":"/usr/lib/engines-1.1/afalg.so"},{"path":"/usr/lib/engines-1.1/capi.so"},{"path":"/usr/lib/engines-1.1/padlock.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2022-4304","versionConstraint":">= 1.0.2, < 1.0.2zg||>= 1.1.1, < 1.1.1t||>= 3.0.0, < 3.0.8 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:1.1.1q:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"1.1.1q-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2022-4304","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-4304","cwe":"CWE-203","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-4304","cwe":"CWE-203","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-4304","date":"2026-10-08","epss":0.16195,"percentile":0.96865}],"risk":8.826275,"urls":["https://security.gentoo.org/glsa/202402-08","https://www.openssl.org/news/secadv/20230207.txt","https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0003"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-4304","description":"A timing based side channel exists in the OpenSSL RSA Decryption implementation\nwhich could be sufficient to recover a plaintext across a network in a\nBleichenbacher style attack. To achieve a successful decryption an attacker\nwould have to be able to send a very large number of trial messages for\ndecryption. The vulnerability affects all RSA padding modes: PKCS#1 v1.5,\nRSA-OEAP and RSASVE.\n\nFor example, in a TLS connection, RSA is commonly used by a client to send an\nencrypted pre-master secret to the server. An attacker that had observed a\ngenuine connection between a client and a server could use this flaw to send\ntrial messages to the server and record the time taken to process them. After a\nsufficiently large number of messages the attacker could recover the pre-master\nsecret used for the original connection and thus be able to decrypt the\napplication data sent over that connection."},"relatedVulnerabilities":[]},{"artifact":{"id":"74f4e71ff41d2d68","cpes":["cpe:2.3:a:libssl1.1:libssl1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl1.1:libssl:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl:1.1.1q-r0:*:*:*:*:*:*:*"],"name":"libssl1.1","purl":"pkg:apk/busybox/libssl1.1@1.1.1q-r0?arch=x86_64&distro=busybox-1.32.1&upstream=openssl","type":"apk","version":"1.1.1q-r0","language":"","licenses":["OpenSSL"],"metadata":{"Arch":"x86_64","files":[{"path":"/lib"},{"path":"/lib/libssl.so.1.1"},{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libssl.so.1.1"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2022-4304","versionConstraint":">= 1.0.2, < 1.0.2zg||>= 1.1.1, < 1.1.1t||>= 3.0.0, < 3.0.8 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:1.1.1q:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"1.1.1q-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2022-4304","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-4304","cwe":"CWE-203","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-4304","cwe":"CWE-203","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-4304","date":"2026-10-08","epss":0.16195,"percentile":0.96865}],"risk":8.826275,"urls":["https://security.gentoo.org/glsa/202402-08","https://www.openssl.org/news/secadv/20230207.txt","https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0003"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-4304","description":"A timing based side channel exists in the OpenSSL RSA Decryption implementation\nwhich could be sufficient to recover a plaintext across a network in a\nBleichenbacher style attack. To achieve a successful decryption an attacker\nwould have to be able to send a very large number of trial messages for\ndecryption. The vulnerability affects all RSA padding modes: PKCS#1 v1.5,\nRSA-OEAP and RSASVE.\n\nFor example, in a TLS connection, RSA is commonly used by a client to send an\nencrypted pre-master secret to the server. An attacker that had observed a\ngenuine connection between a client and a server could use this flaw to send\ntrial messages to the server and record the time taken to process them. After a\nsufficiently large number of messages the attacker could recover the pre-master\nsecret used for the original connection and thus be able to decrypt the\napplication data sent over that connection."},"relatedVulnerabilities":[]},{"artifact":{"id":"14807b4f7067817d","cpes":["cpe:2.3:a:openssl:openssl:1.1.1q-r0:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:apk/busybox/openssl@1.1.1q-r0?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"1.1.1q-r0","language":"","licenses":["OpenSSL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/openssl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2022-4304","versionConstraint":">= 1.0.2, < 1.0.2zg||>= 1.1.1, < 1.1.1t||>= 3.0.0, < 3.0.8 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:1.1.1q:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"1.1.1q-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2022-4304","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-4304","cwe":"CWE-203","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-4304","cwe":"CWE-203","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-4304","date":"2026-10-08","epss":0.16195,"percentile":0.96865}],"risk":8.826275,"urls":["https://security.gentoo.org/glsa/202402-08","https://www.openssl.org/news/secadv/20230207.txt","https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0003"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-4304","description":"A timing based side channel exists in the OpenSSL RSA Decryption implementation\nwhich could be sufficient to recover a plaintext across a network in a\nBleichenbacher style attack. To achieve a successful decryption an attacker\nwould have to be able to send a very large number of trial messages for\ndecryption. The vulnerability affects all RSA padding modes: PKCS#1 v1.5,\nRSA-OEAP and RSASVE.\n\nFor example, in a TLS connection, RSA is commonly used by a client to send an\nencrypted pre-master secret to the server. An attacker that had observed a\ngenuine connection between a client and a server could use this flaw to send\ntrial messages to the server and record the time taken to process them. After a\nsufficiently large number of messages the attacker could recover the pre-master\nsecret used for the original connection and thus be able to decrypt the\napplication data sent over that connection."},"relatedVulnerabilities":[]},{"artifact":{"id":"6040784032e8795c","cpes":["cpe:2.3:a:curl:curl:7.79.1-r3:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:7.79.1-r3:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/busybox/curl@7.79.1-r3?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"7.79.1-r3","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2022-32207","versionConstraint":">= 7.69.0, < 7.84.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:haxx:curl:7.79.1:*:*:*:*:*:*:*"],"package":{"name":"curl","version":"7.79.1-r3"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2022-32207","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-32207","cwe":"CWE-840","type":"Secondary","source":"support@hackerone.com"},{"cve":"CVE-2022-32207","cwe":"CWE-276","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-32207","date":"2026-10-08","epss":0.07738,"percentile":0.94484}],"risk":6.977096666666667,"urls":["http://seclists.org/fulldisclosure/2022/Oct/28","http://seclists.org/fulldisclosure/2022/Oct/41","https://hackerone.com/reports/1573634","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BEV6BR4MTI3CEWK2YU2HQZUW5FAS3FEY/","https://security.gentoo.org/glsa/202212-01","https://security.netapp.com/advisory/ntap-20220915-0003/","https://support.apple.com/kb/HT213488","https://www.debian.org/security/2022/dsa-5197"],"severity":"Critical","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-32207","description":"When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the operation with a rename from a temporary name to the final target file name.In that rename operation, it might accidentally *widen* the permissions for the target file, leaving the updated file accessible to more users than intended."},"relatedVulnerabilities":[]},{"artifact":{"id":"a45c752c9b8878aa","cpes":["cpe:2.3:a:php7:php7:7.4.26-r0:*:*:*:*:*:*:*","cpe:2.3:a:php7:php:7.4.26-r0:*:*:*:*:*:*:*","cpe:2.3:a:php:php7:7.4.26-r0:*:*:*:*:*:*:*","cpe:2.3:a:php:php:7.4.26-r0:*:*:*:*:*:*:*"],"name":"php7","purl":"pkg:apk/busybox/php7@7.4.26-r0?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"7.4.26-r0","language":"","licenses":["BSD-3-Clause","LGPL-2.0-or-later","MIT","PHP-3.01","Zend-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/php"},{"path":"/usr/bin/php7"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"php7"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:php:php:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2024-5458","versionConstraint":"< 8.1.29||>= 8.2, < 8.2.20||>= 8.3, < 8.3.8 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:php:php:7.4.26:*:*:*:*:*:*:*"],"package":{"name":"php7","version":"7.4.26-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2024-5458","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-5458","cwe":"CWE-345","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-5458","cwe":"CWE-345","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-5458","date":"2026-10-08","epss":0.12117,"percentile":0.96056}],"risk":6.240255,"urls":["http://www.openwall.com/lists/oss-security/2024/06/07/1","https://github.com/php/php-src/security/advisories/GHSA-w8qr-v226-r27w","https://lists.debian.org/debian-lts-announce/2024/06/msg00009.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PKGTQUOA2NTZ3RXN22CSAUJPIRUYRB4B/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W45DBOH56NQDRTOM2DN2LNA2FZIMC3PK/","https://security.netapp.com/advisory/ntap-20240726-0001/","https://lists.debian.org/debian-lts-announce/2024/10/msg00011.html"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-5458","description":"In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, due to a code logic error, filtering functions such as filter_var when validating URLs (FILTER_VALIDATE_URL) for certain types of URLs the function will result in invalid user information (username + password part of URLs) being treated as valid user information. This may lead to the downstream code accepting invalid URLs as valid and parsing them incorrectly."},"relatedVulnerabilities":[]},{"artifact":{"id":"a45c752c9b8878aa","cpes":["cpe:2.3:a:php7:php7:7.4.26-r0:*:*:*:*:*:*:*","cpe:2.3:a:php7:php:7.4.26-r0:*:*:*:*:*:*:*","cpe:2.3:a:php:php7:7.4.26-r0:*:*:*:*:*:*:*","cpe:2.3:a:php:php:7.4.26-r0:*:*:*:*:*:*:*"],"name":"php7","purl":"pkg:apk/busybox/php7@7.4.26-r0?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"7.4.26-r0","language":"","licenses":["BSD-3-Clause","LGPL-2.0-or-later","MIT","PHP-3.01","Zend-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/php"},{"path":"/usr/bin/php7"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"php7"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:php:php:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2022-37454","versionConstraint":">= 7.2.0, < 7.4.33||>= 8.0.0, < 8.0.25||>= 8.1.0, < 8.1.12 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:php:php:7.4.26:*:*:*:*:*:*:*"],"package":{"name":"php7","version":"7.4.26-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2022-37454","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-37454","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-37454","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-37454","date":"2026-10-08","epss":0.05765,"percentile":0.92888}],"risk":5.4191,"urls":["https://csrc.nist.gov/projects/hash-functions/sha-3-project","https://eprint.iacr.org/2023/331","https://github.com/XKCP/XKCP/security/advisories/GHSA-6w4m-2xhg-2658","https://lists.debian.org/debian-lts-announce/2022/10/msg00041.html","https://lists.debian.org/debian-lts-announce/2022/11/msg00000.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3ALQ6BDDPX5HU5YBQOBMDVAA2TSGDKIJ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CMIEXLMTW5GO36HTFFWIPB3OHZXCT3G4/","https://mouha.be/sha-3-buffer-overflow/","https://news.ycombinator.com/item?id=33281106","https://news.ycombinator.com/item?id=35050307","https://security.gentoo.org/glsa/202305-02","https://www.debian.org/security/2022/dsa-5267","https://www.debian.org/security/2022/dsa-5269","https://security.netapp.com/advisory/ntap-20230203-0001/"],"severity":"Critical","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-37454","description":"The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that allows attackers to execute arbitrary code or eliminate expected cryptographic properties. This occurs in the sponge function interface."},"relatedVulnerabilities":[]},{"artifact":{"id":"d081de97c6f633df","cpes":["cpe:2.3:a:libcrypto1.1:libcrypto1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto1.1:libcrypto:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto:libcrypto1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto:libcrypto:1.1.1q-r0:*:*:*:*:*:*:*"],"name":"libcrypto1.1","purl":"pkg:apk/busybox/libcrypto1.1@1.1.1q-r0?arch=x86_64&distro=busybox-1.32.1&upstream=openssl","type":"apk","version":"1.1.1q-r0","language":"","licenses":["OpenSSL"],"metadata":{"Arch":"x86_64","files":[{"path":"/etc"},{"path":"/etc/ssl"},{"path":"/etc/ssl/ct_log_list.cnf"},{"path":"/etc/ssl/ct_log_list.cnf.dist"},{"path":"/etc/ssl/openssl.cnf"},{"path":"/etc/ssl/openssl.cnf.dist"},{"path":"/etc/ssl/certs"},{"path":"/etc/ssl/misc"},{"path":"/etc/ssl/misc/CA.pl"},{"path":"/etc/ssl/misc/tsget"},{"path":"/etc/ssl/misc/tsget.pl"},{"path":"/etc/ssl/private"},{"path":"/lib"},{"path":"/lib/libcrypto.so.1.1"},{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcrypto.so.1.1"},{"path":"/usr/lib/engines-1.1"},{"path":"/usr/lib/engines-1.1/afalg.so"},{"path":"/usr/lib/engines-1.1/capi.so"},{"path":"/usr/lib/engines-1.1/padlock.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2024-5535","versionConstraint":">= 1.0.2, < 1.0.2zk||>= 1.1.1, < 1.1.1za||>= 3.0.0, < 3.0.15||>= 3.1.0, < 3.1.7||>= 3.2.0, < 3.2.3||>= 3.3.0, < 3.3.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:1.1.1q:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"1.1.1q-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2024-5535","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-5535","cwe":"CWE-125","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2024-5535","date":"2026-10-08","epss":0.05582,"percentile":0.92684}],"risk":5.05171,"urls":["https://github.com/openssl/openssl/commit/4ada436a1946cbb24db5ab4ca082b69c1bc10f37","https://github.com/openssl/openssl/commit/99fb785a5f85315b95288921a321a935ea29a51e","https://github.com/openssl/openssl/commit/cf6f91f6121f4db167405db2f0de410a456f260c","https://github.com/openssl/openssl/commit/e86ac436f0bd54d4517745483e2315650fae7b2c","https://github.openssl.org/openssl/extended-releases/commit/9947251413065a05189a63c9b7a6c1d4e224c21c","https://github.openssl.org/openssl/extended-releases/commit/b78ec0824da857223486660177d3b1f255c65d87","https://www.openssl.org/news/secadv/20240627.txt","http://www.openwall.com/lists/oss-security/2024/06/27/1","http://www.openwall.com/lists/oss-security/2024/06/28/4","http://www.openwall.com/lists/oss-security/2024/08/15/1","https://lists.debian.org/debian-lts-announce/2024/10/msg00033.html","https://lists.debian.org/debian-lts-announce/2024/11/msg00000.html","https://security.netapp.com/advisory/ntap-20240712-0005/","https://security.netapp.com/advisory/ntap-20241025-0006/","https://security.netapp.com/advisory/ntap-20241025-0010/","https://cert-portal.siemens.com/productcert/html/ssa-265688.html","https://cert-portal.siemens.com/productcert/html/ssa-277137.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html","https://cert-portal.siemens.com/productcert/html/ssa-613116.html","https://cert-portal.siemens.com/productcert/html/ssa-769027.html","https://cert-portal.siemens.com/productcert/html/ssa-915275.html"],"severity":"Critical","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-5535","description":"Issue summary: Calling the OpenSSL API function SSL_select_next_proto with an\nempty supported client protocols buffer may cause a crash or memory contents to\nbe sent to the peer.\n\nImpact summary: A buffer overread can have a range of potential consequences\nsuch as unexpected application beahviour or a crash. In particular this issue\ncould result in up to 255 bytes of arbitrary private data from memory being sent\nto the peer leading to a loss of confidentiality. However, only applications\nthat directly call the SSL_select_next_proto function with a 0 length list of\nsupported client protocols are affected by this issue. This would normally never\nbe a valid scenario and is typically not under attacker control but may occur by\naccident in the case of a configuration or programming error in the calling\napplication.\n\nThe OpenSSL API function SSL_select_next_proto is typically used by TLS\napplications that support ALPN (Application Layer Protocol Negotiation) or NPN\n(Next Protocol Negotiation). NPN is older, was never standardised and\nis deprecated in favour of ALPN. We believe that ALPN is significantly more\nwidely deployed than NPN. The SSL_select_next_proto function accepts a list of\nprotocols from the server and a list of protocols from the client and returns\nthe first protocol that appears in the server list that also appears in the\nclient list. In the case of no overlap between the two lists it returns the\nfirst item in the client list. In either case it will signal whether an overlap\nbetween the two lists was found. In the case where SSL_select_next_proto is\ncalled with a zero length client list it fails to notice this condition and\nreturns the memory immediately following the client list pointer (and reports\nthat there was no overlap in the lists).\n\nThis function is typically called from a server side application callback for\nALPN or a client side application callback for NPN. In the case of ALPN the list\nof protocols supplied by the client is guaranteed by libssl to never be zero in\nlength. The list of server protocols comes from the application and should never\nnormally be expected to be of zero length. In this case if the\nSSL_select_next_proto function has been called as expected (with the list\nsupplied by the client passed in the client/client_len parameters), then the\napplication will not be vulnerable to this issue. If the application has\naccidentally been configured with a zero length server list, and has\naccidentally passed that zero length server list in the client/client_len\nparameters, and has additionally failed to correctly handle a \"no overlap\"\nresponse (which would normally result in a handshake failure in ALPN) then it\nwill be vulnerable to this problem.\n\nIn the case of NPN, the protocol permits the client to opportunistically select\na protocol when there is no overlap. OpenSSL returns the first client protocol\nin the no overlap case in support of this. The list of client protocols comes\nfrom the application and should never normally be expected to be of zero length.\nHowever if the SSL_select_next_proto function is accidentally called with a\nclient_len of 0 then an invalid memory pointer will be returned instead. If the\napplication uses this output as the opportunistic protocol then the loss of\nconfidentiality will occur.\n\nThis issue has been assessed as Low severity because applications are most\nlikely to be vulnerable if they are using NPN instead of ALPN - but NPN is not\nwidely used. It also requires an application configuration or programming error.\nFinally, this issue would not typically be under attacker control making active\nexploitation unlikely.\n\nThe FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue.\n\nDue to the low severity of this issue we are not issuing new releases of\nOpenSSL at this time. The fix will be included in the next releases when they\nbecome available."},"relatedVulnerabilities":[]},{"artifact":{"id":"74f4e71ff41d2d68","cpes":["cpe:2.3:a:libssl1.1:libssl1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl1.1:libssl:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl:1.1.1q-r0:*:*:*:*:*:*:*"],"name":"libssl1.1","purl":"pkg:apk/busybox/libssl1.1@1.1.1q-r0?arch=x86_64&distro=busybox-1.32.1&upstream=openssl","type":"apk","version":"1.1.1q-r0","language":"","licenses":["OpenSSL"],"metadata":{"Arch":"x86_64","files":[{"path":"/lib"},{"path":"/lib/libssl.so.1.1"},{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libssl.so.1.1"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2024-5535","versionConstraint":">= 1.0.2, < 1.0.2zk||>= 1.1.1, < 1.1.1za||>= 3.0.0, < 3.0.15||>= 3.1.0, < 3.1.7||>= 3.2.0, < 3.2.3||>= 3.3.0, < 3.3.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:1.1.1q:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"1.1.1q-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2024-5535","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-5535","cwe":"CWE-125","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2024-5535","date":"2026-10-08","epss":0.05582,"percentile":0.92684}],"risk":5.05171,"urls":["https://github.com/openssl/openssl/commit/4ada436a1946cbb24db5ab4ca082b69c1bc10f37","https://github.com/openssl/openssl/commit/99fb785a5f85315b95288921a321a935ea29a51e","https://github.com/openssl/openssl/commit/cf6f91f6121f4db167405db2f0de410a456f260c","https://github.com/openssl/openssl/commit/e86ac436f0bd54d4517745483e2315650fae7b2c","https://github.openssl.org/openssl/extended-releases/commit/9947251413065a05189a63c9b7a6c1d4e224c21c","https://github.openssl.org/openssl/extended-releases/commit/b78ec0824da857223486660177d3b1f255c65d87","https://www.openssl.org/news/secadv/20240627.txt","http://www.openwall.com/lists/oss-security/2024/06/27/1","http://www.openwall.com/lists/oss-security/2024/06/28/4","http://www.openwall.com/lists/oss-security/2024/08/15/1","https://lists.debian.org/debian-lts-announce/2024/10/msg00033.html","https://lists.debian.org/debian-lts-announce/2024/11/msg00000.html","https://security.netapp.com/advisory/ntap-20240712-0005/","https://security.netapp.com/advisory/ntap-20241025-0006/","https://security.netapp.com/advisory/ntap-20241025-0010/","https://cert-portal.siemens.com/productcert/html/ssa-265688.html","https://cert-portal.siemens.com/productcert/html/ssa-277137.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html","https://cert-portal.siemens.com/productcert/html/ssa-613116.html","https://cert-portal.siemens.com/productcert/html/ssa-769027.html","https://cert-portal.siemens.com/productcert/html/ssa-915275.html"],"severity":"Critical","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-5535","description":"Issue summary: Calling the OpenSSL API function SSL_select_next_proto with an\nempty supported client protocols buffer may cause a crash or memory contents to\nbe sent to the peer.\n\nImpact summary: A buffer overread can have a range of potential consequences\nsuch as unexpected application beahviour or a crash. In particular this issue\ncould result in up to 255 bytes of arbitrary private data from memory being sent\nto the peer leading to a loss of confidentiality. However, only applications\nthat directly call the SSL_select_next_proto function with a 0 length list of\nsupported client protocols are affected by this issue. This would normally never\nbe a valid scenario and is typically not under attacker control but may occur by\naccident in the case of a configuration or programming error in the calling\napplication.\n\nThe OpenSSL API function SSL_select_next_proto is typically used by TLS\napplications that support ALPN (Application Layer Protocol Negotiation) or NPN\n(Next Protocol Negotiation). NPN is older, was never standardised and\nis deprecated in favour of ALPN. We believe that ALPN is significantly more\nwidely deployed than NPN. The SSL_select_next_proto function accepts a list of\nprotocols from the server and a list of protocols from the client and returns\nthe first protocol that appears in the server list that also appears in the\nclient list. In the case of no overlap between the two lists it returns the\nfirst item in the client list. In either case it will signal whether an overlap\nbetween the two lists was found. In the case where SSL_select_next_proto is\ncalled with a zero length client list it fails to notice this condition and\nreturns the memory immediately following the client list pointer (and reports\nthat there was no overlap in the lists).\n\nThis function is typically called from a server side application callback for\nALPN or a client side application callback for NPN. In the case of ALPN the list\nof protocols supplied by the client is guaranteed by libssl to never be zero in\nlength. The list of server protocols comes from the application and should never\nnormally be expected to be of zero length. In this case if the\nSSL_select_next_proto function has been called as expected (with the list\nsupplied by the client passed in the client/client_len parameters), then the\napplication will not be vulnerable to this issue. If the application has\naccidentally been configured with a zero length server list, and has\naccidentally passed that zero length server list in the client/client_len\nparameters, and has additionally failed to correctly handle a \"no overlap\"\nresponse (which would normally result in a handshake failure in ALPN) then it\nwill be vulnerable to this problem.\n\nIn the case of NPN, the protocol permits the client to opportunistically select\na protocol when there is no overlap. OpenSSL returns the first client protocol\nin the no overlap case in support of this. The list of client protocols comes\nfrom the application and should never normally be expected to be of zero length.\nHowever if the SSL_select_next_proto function is accidentally called with a\nclient_len of 0 then an invalid memory pointer will be returned instead. If the\napplication uses this output as the opportunistic protocol then the loss of\nconfidentiality will occur.\n\nThis issue has been assessed as Low severity because applications are most\nlikely to be vulnerable if they are using NPN instead of ALPN - but NPN is not\nwidely used. It also requires an application configuration or programming error.\nFinally, this issue would not typically be under attacker control making active\nexploitation unlikely.\n\nThe FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue.\n\nDue to the low severity of this issue we are not issuing new releases of\nOpenSSL at this time. The fix will be included in the next releases when they\nbecome available."},"relatedVulnerabilities":[]},{"artifact":{"id":"14807b4f7067817d","cpes":["cpe:2.3:a:openssl:openssl:1.1.1q-r0:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:apk/busybox/openssl@1.1.1q-r0?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"1.1.1q-r0","language":"","licenses":["OpenSSL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/openssl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2024-5535","versionConstraint":">= 1.0.2, < 1.0.2zk||>= 1.1.1, < 1.1.1za||>= 3.0.0, < 3.0.15||>= 3.1.0, < 3.1.7||>= 3.2.0, < 3.2.3||>= 3.3.0, < 3.3.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:1.1.1q:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"1.1.1q-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2024-5535","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-5535","cwe":"CWE-125","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2024-5535","date":"2026-10-08","epss":0.05582,"percentile":0.92684}],"risk":5.05171,"urls":["https://github.com/openssl/openssl/commit/4ada436a1946cbb24db5ab4ca082b69c1bc10f37","https://github.com/openssl/openssl/commit/99fb785a5f85315b95288921a321a935ea29a51e","https://github.com/openssl/openssl/commit/cf6f91f6121f4db167405db2f0de410a456f260c","https://github.com/openssl/openssl/commit/e86ac436f0bd54d4517745483e2315650fae7b2c","https://github.openssl.org/openssl/extended-releases/commit/9947251413065a05189a63c9b7a6c1d4e224c21c","https://github.openssl.org/openssl/extended-releases/commit/b78ec0824da857223486660177d3b1f255c65d87","https://www.openssl.org/news/secadv/20240627.txt","http://www.openwall.com/lists/oss-security/2024/06/27/1","http://www.openwall.com/lists/oss-security/2024/06/28/4","http://www.openwall.com/lists/oss-security/2024/08/15/1","https://lists.debian.org/debian-lts-announce/2024/10/msg00033.html","https://lists.debian.org/debian-lts-announce/2024/11/msg00000.html","https://security.netapp.com/advisory/ntap-20240712-0005/","https://security.netapp.com/advisory/ntap-20241025-0006/","https://security.netapp.com/advisory/ntap-20241025-0010/","https://cert-portal.siemens.com/productcert/html/ssa-265688.html","https://cert-portal.siemens.com/productcert/html/ssa-277137.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html","https://cert-portal.siemens.com/productcert/html/ssa-613116.html","https://cert-portal.siemens.com/productcert/html/ssa-769027.html","https://cert-portal.siemens.com/productcert/html/ssa-915275.html"],"severity":"Critical","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-5535","description":"Issue summary: Calling the OpenSSL API function SSL_select_next_proto with an\nempty supported client protocols buffer may cause a crash or memory contents to\nbe sent to the peer.\n\nImpact summary: A buffer overread can have a range of potential consequences\nsuch as unexpected application beahviour or a crash. In particular this issue\ncould result in up to 255 bytes of arbitrary private data from memory being sent\nto the peer leading to a loss of confidentiality. However, only applications\nthat directly call the SSL_select_next_proto function with a 0 length list of\nsupported client protocols are affected by this issue. This would normally never\nbe a valid scenario and is typically not under attacker control but may occur by\naccident in the case of a configuration or programming error in the calling\napplication.\n\nThe OpenSSL API function SSL_select_next_proto is typically used by TLS\napplications that support ALPN (Application Layer Protocol Negotiation) or NPN\n(Next Protocol Negotiation). NPN is older, was never standardised and\nis deprecated in favour of ALPN. We believe that ALPN is significantly more\nwidely deployed than NPN. The SSL_select_next_proto function accepts a list of\nprotocols from the server and a list of protocols from the client and returns\nthe first protocol that appears in the server list that also appears in the\nclient list. In the case of no overlap between the two lists it returns the\nfirst item in the client list. In either case it will signal whether an overlap\nbetween the two lists was found. In the case where SSL_select_next_proto is\ncalled with a zero length client list it fails to notice this condition and\nreturns the memory immediately following the client list pointer (and reports\nthat there was no overlap in the lists).\n\nThis function is typically called from a server side application callback for\nALPN or a client side application callback for NPN. In the case of ALPN the list\nof protocols supplied by the client is guaranteed by libssl to never be zero in\nlength. The list of server protocols comes from the application and should never\nnormally be expected to be of zero length. In this case if the\nSSL_select_next_proto function has been called as expected (with the list\nsupplied by the client passed in the client/client_len parameters), then the\napplication will not be vulnerable to this issue. If the application has\naccidentally been configured with a zero length server list, and has\naccidentally passed that zero length server list in the client/client_len\nparameters, and has additionally failed to correctly handle a \"no overlap\"\nresponse (which would normally result in a handshake failure in ALPN) then it\nwill be vulnerable to this problem.\n\nIn the case of NPN, the protocol permits the client to opportunistically select\na protocol when there is no overlap. OpenSSL returns the first client protocol\nin the no overlap case in support of this. The list of client protocols comes\nfrom the application and should never normally be expected to be of zero length.\nHowever if the SSL_select_next_proto function is accidentally called with a\nclient_len of 0 then an invalid memory pointer will be returned instead. If the\napplication uses this output as the opportunistic protocol then the loss of\nconfidentiality will occur.\n\nThis issue has been assessed as Low severity because applications are most\nlikely to be vulnerable if they are using NPN instead of ALPN - but NPN is not\nwidely used. It also requires an application configuration or programming error.\nFinally, this issue would not typically be under attacker control making active\nexploitation unlikely.\n\nThe FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue.\n\nDue to the low severity of this issue we are not issuing new releases of\nOpenSSL at this time. The fix will be included in the next releases when they\nbecome available."},"relatedVulnerabilities":[]},{"artifact":{"id":"de2e09a252869bf3","cpes":["cpe:2.3:a:git-scm:git:2.30.6-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_scm:git:2.30.6-r0:*:*:*:*:*:*:*","cpe:2.3:a:git:git:2.30.6-r0:*:*:*:*:*:*:*"],"name":"git","purl":"pkg:apk/busybox/git@2.30.6-r0?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"2.30.6-r0","language":"","licenses":["GPL-2.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/git"},{"path":"/usr/bin/git-receive-pack"},{"path":"/usr/bin/git-shell"},{"path":"/usr/bin/git-upload-archive"},{"path":"/usr/bin/git-upload-pack"},{"path":"/usr/libexec"},{"path":"/usr/libexec/git-core"},{"path":"/usr/libexec/git-core/git"},{"path":"/usr/libexec/git-core/git-add"},{"path":"/usr/libexec/git-core/git-am"},{"path":"/usr/libexec/git-core/git-annotate"},{"path":"/usr/libexec/git-core/git-apply"},{"path":"/usr/libexec/git-core/git-archive"},{"path":"/usr/libexec/git-core/git-bisect"},{"path":"/usr/libexec/git-core/git-bisect--helper"},{"path":"/usr/libexec/git-core/git-blame"},{"path":"/usr/libexec/git-core/git-branch"},{"path":"/usr/libexec/git-core/git-bugreport"},{"path":"/usr/libexec/git-core/git-bundle"},{"path":"/usr/libexec/git-core/git-cat-file"},{"path":"/usr/libexec/git-core/git-check-attr"},{"path":"/usr/libexec/git-core/git-check-ignore"},{"path":"/usr/libexec/git-core/git-check-mailmap"},{"path":"/usr/libexec/git-core/git-check-ref-format"},{"path":"/usr/libexec/git-core/git-checkout"},{"path":"/usr/libexec/git-core/git-checkout-index"},{"path":"/usr/libexec/git-core/git-cherry"},{"path":"/usr/libexec/git-core/git-cherry-pick"},{"path":"/usr/libexec/git-core/git-clean"},{"path":"/usr/libexec/git-core/git-clone"},{"path":"/usr/libexec/git-core/git-column"},{"path":"/usr/libexec/git-core/git-commit"},{"path":"/usr/libexec/git-core/git-commit-graph"},{"path":"/usr/libexec/git-core/git-commit-tree"},{"path":"/usr/libexec/git-core/git-config"},{"path":"/usr/libexec/git-core/git-count-objects"},{"path":"/usr/libexec/git-core/git-credential"},{"path":"/usr/libexec/git-core/git-credential-cache"},{"path":"/usr/libexec/git-core/git-credential-cache--daemon"},{"path":"/usr/libexec/git-core/git-credential-store"},{"path":"/usr/libexec/git-core/git-describe"},{"path":"/usr/libexec/git-core/git-diff"},{"path":"/usr/libexec/git-core/git-diff-files"},{"path":"/usr/libexec/git-core/git-diff-index"},{"path":"/usr/libexec/git-core/git-diff-tree"},{"path":"/usr/libexec/git-core/git-difftool"},{"path":"/usr/libexec/git-core/git-difftool--helper"},{"path":"/usr/libexec/git-core/git-env--helper"},{"path":"/usr/libexec/git-core/git-fast-export"},{"path":"/usr/libexec/git-core/git-fetch"},{"path":"/usr/libexec/git-core/git-fetch-pack"},{"path":"/usr/libexec/git-core/git-filter-branch"},{"path":"/usr/libexec/git-core/git-fmt-merge-msg"},{"path":"/usr/libexec/git-core/git-for-each-ref"},{"path":"/usr/libexec/git-core/git-for-each-repo"},{"path":"/usr/libexec/git-core/git-format-patch"},{"path":"/usr/libexec/git-core/git-fsck"},{"path":"/usr/libexec/git-core/git-fsck-objects"},{"path":"/usr/libexec/git-core/git-gc"},{"path":"/usr/libexec/git-core/git-get-tar-commit-id"},{"path":"/usr/libexec/git-core/git-grep"},{"path":"/usr/libexec/git-core/git-hash-object"},{"path":"/usr/libexec/git-core/git-help"},{"path":"/usr/libexec/git-core/git-http-fetch"},{"path":"/usr/libexec/git-core/git-http-push"},{"path":"/usr/libexec/git-core/git-index-pack"},{"path":"/usr/libexec/git-core/git-init"},{"path":"/usr/libexec/git-core/git-init-db"},{"path":"/usr/libexec/git-core/git-interpret-trailers"},{"path":"/usr/libexec/git-core/git-log"},{"path":"/usr/libexec/git-core/git-ls-files"},{"path":"/usr/libexec/git-core/git-ls-remote"},{"path":"/usr/libexec/git-core/git-ls-tree"},{"path":"/usr/libexec/git-core/git-mailinfo"},{"path":"/usr/libexec/git-core/git-mailsplit"},{"path":"/usr/libexec/git-core/git-maintenance"},{"path":"/usr/libexec/git-core/git-merge"},{"path":"/usr/libexec/git-core/git-merge-base"},{"path":"/usr/libexec/git-core/git-merge-file"},{"path":"/usr/libexec/git-core/git-merge-index"},{"path":"/usr/libexec/git-core/git-merge-octopus"},{"path":"/usr/libexec/git-core/git-merge-one-file"},{"path":"/usr/libexec/git-core/git-merge-ours"},{"path":"/usr/libexec/git-core/git-merge-recursive"},{"path":"/usr/libexec/git-core/git-merge-resolve"},{"path":"/usr/libexec/git-core/git-merge-subtree"},{"path":"/usr/libexec/git-core/git-merge-tree"},{"path":"/usr/libexec/git-core/git-mergetool"},{"path":"/usr/libexec/git-core/git-mergetool--lib"},{"path":"/usr/libexec/git-core/git-mktag"},{"path":"/usr/libexec/git-core/git-mktree"},{"path":"/usr/libexec/git-core/git-multi-pack-index"},{"path":"/usr/libexec/git-core/git-mv"},{"path":"/usr/libexec/git-core/git-name-rev"},{"path":"/usr/libexec/git-core/git-notes"},{"path":"/usr/libexec/git-core/git-pack-objects"},{"path":"/usr/libexec/git-core/git-pack-redundant"},{"path":"/usr/libexec/git-core/git-pack-refs"},{"path":"/usr/libexec/git-core/git-patch-id"},{"path":"/usr/libexec/git-core/git-prune"},{"path":"/usr/libexec/git-core/git-prune-packed"},{"path":"/usr/libexec/git-core/git-pull"},{"path":"/usr/libexec/git-core/git-push"},{"path":"/usr/libexec/git-core/git-quiltimport"},{"path":"/usr/libexec/git-core/git-range-diff"},{"path":"/usr/libexec/git-core/git-read-tree"},{"path":"/usr/libexec/git-core/git-rebase"},{"path":"/usr/libexec/git-core/git-rebase--preserve-merges"},{"path":"/usr/libexec/git-core/git-receive-pack"},{"path":"/usr/libexec/git-core/git-reflog"},{"path":"/usr/libexec/git-core/git-remote"},{"path":"/usr/libexec/git-core/git-remote-ext"},{"path":"/usr/libexec/git-core/git-remote-fd"},{"path":"/usr/libexec/git-core/git-remote-ftp"},{"path":"/usr/libexec/git-core/git-remote-ftps"},{"path":"/usr/libexec/git-core/git-remote-http"},{"path":"/usr/libexec/git-core/git-remote-https"},{"path":"/usr/libexec/git-core/git-repack"},{"path":"/usr/libexec/git-core/git-replace"},{"path":"/usr/libexec/git-core/git-request-pull"},{"path":"/usr/libexec/git-core/git-rerere"},{"path":"/usr/libexec/git-core/git-reset"},{"path":"/usr/libexec/git-core/git-restore"},{"path":"/usr/libexec/git-core/git-rev-list"},{"path":"/usr/libexec/git-core/git-rev-parse"},{"path":"/usr/libexec/git-core/git-revert"},{"path":"/usr/libexec/git-core/git-rm"},{"path":"/usr/libexec/git-core/git-send-pack"},{"path":"/usr/libexec/git-core/git-sh-i18n"},{"path":"/usr/libexec/git-core/git-sh-i18n--envsubst"},{"path":"/usr/libexec/git-core/git-sh-setup"},{"path":"/usr/libexec/git-core/git-shortlog"},{"path":"/usr/libexec/git-core/git-show"},{"path":"/usr/libexec/git-core/git-show-branch"},{"path":"/usr/libexec/git-core/git-show-index"},{"path":"/usr/libexec/git-core/git-show-ref"},{"path":"/usr/libexec/git-core/git-sparse-checkout"},{"path":"/usr/libexec/git-core/git-stage"},{"path":"/usr/libexec/git-core/git-stash"},{"path":"/usr/libexec/git-core/git-status"},{"path":"/usr/libexec/git-core/git-stripspace"},{"path":"/usr/libexec/git-core/git-submodule"},{"path":"/usr/libexec/git-core/git-submodule--helper"},{"path":"/usr/libexec/git-core/git-switch"},{"path":"/usr/libexec/git-core/git-symbolic-ref"},{"path":"/usr/libexec/git-core/git-tag"},{"path":"/usr/libexec/git-core/git-unpack-file"},{"path":"/usr/libexec/git-core/git-unpack-objects"},{"path":"/usr/libexec/git-core/git-update-index"},{"path":"/usr/libexec/git-core/git-update-ref"},{"path":"/usr/libexec/git-core/git-update-server-info"},{"path":"/usr/libexec/git-core/git-upload-archive"},{"path":"/usr/libexec/git-core/git-upload-pack"},{"path":"/usr/libexec/git-core/git-var"},{"path":"/usr/libexec/git-core/git-verify-commit"},{"path":"/usr/libexec/git-core/git-verify-pack"},{"path":"/usr/libexec/git-core/git-verify-tag"},{"path":"/usr/libexec/git-core/git-web--browse"},{"path":"/usr/libexec/git-core/git-whatchanged"},{"path":"/usr/libexec/git-core/git-worktree"},{"path":"/usr/libexec/git-core/git-write-tree"},{"path":"/usr/libexec/git-core/mergetools"},{"path":"/usr/libexec/git-core/mergetools/araxis"},{"path":"/usr/libexec/git-core/mergetools/bc"},{"path":"/usr/libexec/git-core/mergetools/codecompare"},{"path":"/usr/libexec/git-core/mergetools/deltawalker"},{"path":"/usr/libexec/git-core/mergetools/diffmerge"},{"path":"/usr/libexec/git-core/mergetools/diffuse"},{"path":"/usr/libexec/git-core/mergetools/ecmerge"},{"path":"/usr/libexec/git-core/mergetools/emerge"},{"path":"/usr/libexec/git-core/mergetools/examdiff"},{"path":"/usr/libexec/git-core/mergetools/guiffy"},{"path":"/usr/libexec/git-core/mergetools/gvimdiff"},{"path":"/usr/libexec/git-core/mergetools/kdiff3"},{"path":"/usr/libexec/git-core/mergetools/kompare"},{"path":"/usr/libexec/git-core/mergetools/meld"},{"path":"/usr/libexec/git-core/mergetools/nvimdiff"},{"path":"/usr/libexec/git-core/mergetools/opendiff"},{"path":"/usr/libexec/git-core/mergetools/smerge"},{"path":"/usr/libexec/git-core/mergetools/tkdiff"},{"path":"/usr/libexec/git-core/mergetools/tortoisemerge"},{"path":"/usr/libexec/git-core/mergetools/vimdiff"},{"path":"/usr/libexec/git-core/mergetools/winmerge"},{"path":"/usr/libexec/git-core/mergetools/xxdiff"},{"path":"/usr/share"},{"path":"/usr/share/git-core"},{"path":"/usr/share/git-core/templates"},{"path":"/usr/share/git-core/templates/description"},{"path":"/usr/share/git-core/templates/branches"},{"path":"/usr/share/git-core/templates/hooks"},{"path":"/usr/share/git-core/templates/hooks/applypatch-msg.sample"},{"path":"/usr/share/git-core/templates/hooks/commit-msg.sample"},{"path":"/usr/share/git-core/templates/hooks/post-update.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-applypatch.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-commit.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-merge-commit.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-push.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-rebase.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-receive.sample"},{"path":"/usr/share/git-core/templates/hooks/prepare-commit-msg.sample"},{"path":"/usr/share/git-core/templates/hooks/push-to-checkout.sample"},{"path":"/usr/share/git-core/templates/hooks/update.sample"},{"path":"/usr/share/git-core/templates/info"},{"path":"/usr/share/git-core/templates/info/exclude"},{"path":"/usr/share/perl5"},{"path":"/var"},{"path":"/var/git"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"git"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2023-29007","versionConstraint":"< 2.30.9||>= 2.31.0, < 2.31.8||>= 2.32.0, < 2.32.7||>= 2.33.0, < 2.33.8||>= 2.34.0, < 2.34.8||>= 2.35.0, < 2.35.8||>= 2.36.0, < 2.36.5||>= 2.37.0, < 2.37.7||>= 2.38.0, < 2.38.5||>= 2.39.0, < 2.39.3||= 2.40.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:git-scm:git:2.30.6:*:*:*:*:*:*:*"],"package":{"name":"git","version":"2.30.6-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2023-29007","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-29007","cwe":"CWE-74","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2023-29007","date":"2026-10-08","epss":0.06079,"percentile":0.93223}],"risk":4.528855,"urls":["https://github.com/git/git/blob/9ce9dea4e1c2419cca126d29fa7730baa078a11b/Documentation/RelNotes/2.30.9.txt","https://github.com/git/git/commit/528290f8c61222433a8cf02fb7cfffa8438432b4","https://github.com/git/git/security/advisories/GHSA-v48j-4xgg-4844","https://lists.debian.org/debian-lts-announce/2024/06/msg00018.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PI7FZ4NNR5S5J5K6AMVQBH2JFP6NE4L7/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RKOXOAZ42HLXHXTW6JZI4L5DAIYDTYCU/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YFZWGQKB6MM5MNF2DLFTD7KS2KWPICKL/","https://security.gentoo.org/glsa/202312-15","https://lists.debian.org/debian-lts-announce/2024/09/msg00009.html"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-29007","description":"Git is a revision control system. Prior to versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1, a specially crafted `.gitmodules` file with submodule URLs that are longer than 1024 characters can used to exploit a bug in `config.c::git_config_copy_or_rename_section_in_file()`. This bug can be used to inject arbitrary configuration into a user's `$GIT_DIR/config` when attempting to remove the configuration section associated with that submodule. When the attacker injects configuration values which specify executables to run (such as `core.pager`, `core.editor`, `core.sshCommand`, etc.) this can lead to a remote code execution. A fix A fix is available in versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1. As a workaround, avoid running `git submodule deinit` on untrusted repositories or without prior inspection of any submodule sections in `$GIT_DIR/config`."},"relatedVulnerabilities":[]},{"artifact":{"id":"6040784032e8795c","cpes":["cpe:2.3:a:curl:curl:7.79.1-r3:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:7.79.1-r3:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/busybox/curl@7.79.1-r3?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"7.79.1-r3","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2022-32221","versionConstraint":"< 7.86.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:haxx:curl:7.79.1:*:*:*:*:*:*:*"],"package":{"name":"curl","version":"7.79.1-r3"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2022-32221","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-32221","cwe":"CWE-200","type":"Secondary","source":"support@hackerone.com"},{"cve":"CVE-2022-32221","cwe":"CWE-668","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-32221","date":"2026-10-08","epss":0.04676,"percentile":0.91537}],"risk":4.395440000000001,"urls":["http://seclists.org/fulldisclosure/2023/Jan/19","http://seclists.org/fulldisclosure/2023/Jan/20","http://www.openwall.com/lists/oss-security/2023/05/17/4","https://hackerone.com/reports/1704017","https://lists.debian.org/debian-lts-announce/2023/01/msg00028.html","https://security.gentoo.org/glsa/202212-01","https://security.netapp.com/advisory/ntap-20230110-0006/","https://security.netapp.com/advisory/ntap-20230208-0002/","https://support.apple.com/kb/HT213604","https://support.apple.com/kb/HT213605","https://www.debian.org/security/2023/dsa-5330"],"severity":"Critical","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-32221","description":"When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the `CURLOPT_POSTFIELDS` option has been set, if the same handle previously was used to issue a `PUT` request which used that callback. This flaw may surprise the application and cause it to misbehave and either send off the wrong data or use memory after free or similar in the subsequent `POST` request. The problem exists in the logic for a reused handle when it is changed from a PUT to a POST."},"relatedVulnerabilities":[]},{"artifact":{"id":"6040784032e8795c","cpes":["cpe:2.3:a:curl:curl:7.79.1-r3:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:7.79.1-r3:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/busybox/curl@7.79.1-r3?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"7.79.1-r3","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2022-32208","versionConstraint":">= 7.16.4, < 7.84.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:haxx:curl:7.79.1:*:*:*:*:*:*:*"],"package":{"name":"curl","version":"7.79.1-r3"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2022-32208","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-32208","cwe":"CWE-840","type":"Secondary","source":"support@hackerone.com"},{"cve":"CVE-2022-32208","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-32208","date":"2026-10-08","epss":0.07499,"percentile":0.94338}],"risk":3.886981666666667,"urls":["http://seclists.org/fulldisclosure/2022/Oct/28","http://seclists.org/fulldisclosure/2022/Oct/41","https://hackerone.com/reports/1590071","https://lists.debian.org/debian-lts-announce/2022/08/msg00017.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BEV6BR4MTI3CEWK2YU2HQZUW5FAS3FEY/","https://security.gentoo.org/glsa/202212-01","https://security.netapp.com/advisory/ntap-20220915-0003/","https://support.apple.com/kb/HT213488","https://www.debian.org/security/2022/dsa-5197"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-32208","description":"When curl < 7.84.0 does FTP transfers secured by krb5, it handles message verification failures wrongly. This flaw makes it possible for a Man-In-The-Middle attack to go unnoticed and even allows it to inject data to the client."},"relatedVulnerabilities":[]},{"artifact":{"id":"d081de97c6f633df","cpes":["cpe:2.3:a:libcrypto1.1:libcrypto1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto1.1:libcrypto:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto:libcrypto1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto:libcrypto:1.1.1q-r0:*:*:*:*:*:*:*"],"name":"libcrypto1.1","purl":"pkg:apk/busybox/libcrypto1.1@1.1.1q-r0?arch=x86_64&distro=busybox-1.32.1&upstream=openssl","type":"apk","version":"1.1.1q-r0","language":"","licenses":["OpenSSL"],"metadata":{"Arch":"x86_64","files":[{"path":"/etc"},{"path":"/etc/ssl"},{"path":"/etc/ssl/ct_log_list.cnf"},{"path":"/etc/ssl/ct_log_list.cnf.dist"},{"path":"/etc/ssl/openssl.cnf"},{"path":"/etc/ssl/openssl.cnf.dist"},{"path":"/etc/ssl/certs"},{"path":"/etc/ssl/misc"},{"path":"/etc/ssl/misc/CA.pl"},{"path":"/etc/ssl/misc/tsget"},{"path":"/etc/ssl/misc/tsget.pl"},{"path":"/etc/ssl/private"},{"path":"/lib"},{"path":"/lib/libcrypto.so.1.1"},{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcrypto.so.1.1"},{"path":"/usr/lib/engines-1.1"},{"path":"/usr/lib/engines-1.1/afalg.so"},{"path":"/usr/lib/engines-1.1/capi.so"},{"path":"/usr/lib/engines-1.1/padlock.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2023-0215","versionConstraint":">= 1.0.2, < 1.0.2zg||>= 1.1.1, < 1.1.1t||>= 3.0.0, < 3.0.8 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:1.1.1q:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"1.1.1q-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2023-0215","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-0215","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-0215","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-0215","date":"2026-10-08","epss":0.04494,"percentile":0.91248}],"risk":3.3705,"urls":["https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=8818064ce3c3c0f1b740a5aaba2a987e75bfbafd","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=9816136fe31d92ace4037d5da5257f763aeeb4eb","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=c3829dd8825c654652201e16f8a0a0c46ee3f344","https://security.gentoo.org/glsa/202402-08","https://security.netapp.com/advisory/ntap-20230427-0007/","https://security.netapp.com/advisory/ntap-20230427-0009/","https://security.netapp.com/advisory/ntap-20240621-0006/","https://www.openssl.org/news/secadv/20230207.txt","https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0003"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-0215","description":"The public API function BIO_new_NDEF is a helper function used for streaming\nASN.1 data via a BIO. It is primarily used internally to OpenSSL to support the\nSMIME, CMS and PKCS7 streaming capabilities, but may also be called directly by\nend user applications.\n\nThe function receives a BIO from the caller, prepends a new BIO_f_asn1 filter\nBIO onto the front of it to form a BIO chain, and then returns the new head of\nthe BIO chain to the caller. Under certain conditions, for example if a CMS\nrecipient public key is invalid, the new filter BIO is freed and the function\nreturns a NULL result indicating a failure. However, in this case, the BIO chain\nis not properly cleaned up and the BIO passed by the caller still retains\ninternal pointers to the previously freed filter BIO. If the caller then goes on\nto call BIO_pop() on the BIO then a use-after-free will occur. This will most\nlikely result in a crash.\n\n\n\nThis scenario occurs directly in the internal function B64_write_ASN1() which\nmay cause BIO_new_NDEF() to be called and will subsequently call BIO_pop() on\nthe BIO. This internal function is in turn called by the public API functions\nPEM_write_bio_ASN1_stream, PEM_write_bio_CMS_stream, PEM_write_bio_PKCS7_stream,\nSMIME_write_ASN1, SMIME_write_CMS and SMIME_write_PKCS7.\n\nOther public API functions that may be impacted by this include\ni2d_ASN1_bio_stream, BIO_new_CMS, BIO_new_PKCS7, i2d_CMS_bio_stream and\ni2d_PKCS7_bio_stream.\n\nThe OpenSSL cms and smime command line applications are similarly affected."},"relatedVulnerabilities":[]},{"artifact":{"id":"74f4e71ff41d2d68","cpes":["cpe:2.3:a:libssl1.1:libssl1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl1.1:libssl:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl:1.1.1q-r0:*:*:*:*:*:*:*"],"name":"libssl1.1","purl":"pkg:apk/busybox/libssl1.1@1.1.1q-r0?arch=x86_64&distro=busybox-1.32.1&upstream=openssl","type":"apk","version":"1.1.1q-r0","language":"","licenses":["OpenSSL"],"metadata":{"Arch":"x86_64","files":[{"path":"/lib"},{"path":"/lib/libssl.so.1.1"},{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libssl.so.1.1"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2023-0215","versionConstraint":">= 1.0.2, < 1.0.2zg||>= 1.1.1, < 1.1.1t||>= 3.0.0, < 3.0.8 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:1.1.1q:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"1.1.1q-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2023-0215","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-0215","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-0215","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-0215","date":"2026-10-08","epss":0.04494,"percentile":0.91248}],"risk":3.3705,"urls":["https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=8818064ce3c3c0f1b740a5aaba2a987e75bfbafd","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=9816136fe31d92ace4037d5da5257f763aeeb4eb","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=c3829dd8825c654652201e16f8a0a0c46ee3f344","https://security.gentoo.org/glsa/202402-08","https://security.netapp.com/advisory/ntap-20230427-0007/","https://security.netapp.com/advisory/ntap-20230427-0009/","https://security.netapp.com/advisory/ntap-20240621-0006/","https://www.openssl.org/news/secadv/20230207.txt","https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0003"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-0215","description":"The public API function BIO_new_NDEF is a helper function used for streaming\nASN.1 data via a BIO. It is primarily used internally to OpenSSL to support the\nSMIME, CMS and PKCS7 streaming capabilities, but may also be called directly by\nend user applications.\n\nThe function receives a BIO from the caller, prepends a new BIO_f_asn1 filter\nBIO onto the front of it to form a BIO chain, and then returns the new head of\nthe BIO chain to the caller. Under certain conditions, for example if a CMS\nrecipient public key is invalid, the new filter BIO is freed and the function\nreturns a NULL result indicating a failure. However, in this case, the BIO chain\nis not properly cleaned up and the BIO passed by the caller still retains\ninternal pointers to the previously freed filter BIO. If the caller then goes on\nto call BIO_pop() on the BIO then a use-after-free will occur. This will most\nlikely result in a crash.\n\n\n\nThis scenario occurs directly in the internal function B64_write_ASN1() which\nmay cause BIO_new_NDEF() to be called and will subsequently call BIO_pop() on\nthe BIO. This internal function is in turn called by the public API functions\nPEM_write_bio_ASN1_stream, PEM_write_bio_CMS_stream, PEM_write_bio_PKCS7_stream,\nSMIME_write_ASN1, SMIME_write_CMS and SMIME_write_PKCS7.\n\nOther public API functions that may be impacted by this include\ni2d_ASN1_bio_stream, BIO_new_CMS, BIO_new_PKCS7, i2d_CMS_bio_stream and\ni2d_PKCS7_bio_stream.\n\nThe OpenSSL cms and smime command line applications are similarly affected."},"relatedVulnerabilities":[]},{"artifact":{"id":"14807b4f7067817d","cpes":["cpe:2.3:a:openssl:openssl:1.1.1q-r0:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:apk/busybox/openssl@1.1.1q-r0?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"1.1.1q-r0","language":"","licenses":["OpenSSL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/openssl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2023-0215","versionConstraint":">= 1.0.2, < 1.0.2zg||>= 1.1.1, < 1.1.1t||>= 3.0.0, < 3.0.8 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:1.1.1q:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"1.1.1q-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2023-0215","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-0215","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-0215","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-0215","date":"2026-10-08","epss":0.04494,"percentile":0.91248}],"risk":3.3705,"urls":["https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=8818064ce3c3c0f1b740a5aaba2a987e75bfbafd","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=9816136fe31d92ace4037d5da5257f763aeeb4eb","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=c3829dd8825c654652201e16f8a0a0c46ee3f344","https://security.gentoo.org/glsa/202402-08","https://security.netapp.com/advisory/ntap-20230427-0007/","https://security.netapp.com/advisory/ntap-20230427-0009/","https://security.netapp.com/advisory/ntap-20240621-0006/","https://www.openssl.org/news/secadv/20230207.txt","https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0003"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-0215","description":"The public API function BIO_new_NDEF is a helper function used for streaming\nASN.1 data via a BIO. It is primarily used internally to OpenSSL to support the\nSMIME, CMS and PKCS7 streaming capabilities, but may also be called directly by\nend user applications.\n\nThe function receives a BIO from the caller, prepends a new BIO_f_asn1 filter\nBIO onto the front of it to form a BIO chain, and then returns the new head of\nthe BIO chain to the caller. Under certain conditions, for example if a CMS\nrecipient public key is invalid, the new filter BIO is freed and the function\nreturns a NULL result indicating a failure. However, in this case, the BIO chain\nis not properly cleaned up and the BIO passed by the caller still retains\ninternal pointers to the previously freed filter BIO. If the caller then goes on\nto call BIO_pop() on the BIO then a use-after-free will occur. This will most\nlikely result in a crash.\n\n\n\nThis scenario occurs directly in the internal function B64_write_ASN1() which\nmay cause BIO_new_NDEF() to be called and will subsequently call BIO_pop() on\nthe BIO. This internal function is in turn called by the public API functions\nPEM_write_bio_ASN1_stream, PEM_write_bio_CMS_stream, PEM_write_bio_PKCS7_stream,\nSMIME_write_ASN1, SMIME_write_CMS and SMIME_write_PKCS7.\n\nOther public API functions that may be impacted by this include\ni2d_ASN1_bio_stream, BIO_new_CMS, BIO_new_PKCS7, i2d_CMS_bio_stream and\ni2d_PKCS7_bio_stream.\n\nThe OpenSSL cms and smime command line applications are similarly affected."},"relatedVulnerabilities":[]},{"artifact":{"id":"d081de97c6f633df","cpes":["cpe:2.3:a:libcrypto1.1:libcrypto1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto1.1:libcrypto:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto:libcrypto1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto:libcrypto:1.1.1q-r0:*:*:*:*:*:*:*"],"name":"libcrypto1.1","purl":"pkg:apk/busybox/libcrypto1.1@1.1.1q-r0?arch=x86_64&distro=busybox-1.32.1&upstream=openssl","type":"apk","version":"1.1.1q-r0","language":"","licenses":["OpenSSL"],"metadata":{"Arch":"x86_64","files":[{"path":"/etc"},{"path":"/etc/ssl"},{"path":"/etc/ssl/ct_log_list.cnf"},{"path":"/etc/ssl/ct_log_list.cnf.dist"},{"path":"/etc/ssl/openssl.cnf"},{"path":"/etc/ssl/openssl.cnf.dist"},{"path":"/etc/ssl/certs"},{"path":"/etc/ssl/misc"},{"path":"/etc/ssl/misc/CA.pl"},{"path":"/etc/ssl/misc/tsget"},{"path":"/etc/ssl/misc/tsget.pl"},{"path":"/etc/ssl/private"},{"path":"/lib"},{"path":"/lib/libcrypto.so.1.1"},{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcrypto.so.1.1"},{"path":"/usr/lib/engines-1.1"},{"path":"/usr/lib/engines-1.1/afalg.so"},{"path":"/usr/lib/engines-1.1/capi.so"},{"path":"/usr/lib/engines-1.1/padlock.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2023-3446","versionConstraint":">= 1.0.2, < 1.0.2zi||>= 1.1.1, < 1.1.1v||>= 3.0.0, < 3.0.10||>= 3.1.0, < 3.1.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:1.1.1q:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"1.1.1q-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2023-3446","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-3446","cwe":"CWE-606","type":"Secondary","source":"openssl-security@openssl.org"},{"cve":"CVE-2023-3446","cwe":"CWE-1333","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-3446","date":"2026-10-08","epss":0.06531,"percentile":0.93621}],"risk":3.363465,"urls":["https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=1fa20cf2f506113c761777127a38bce5068740eb","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=8780a896543a654e757db1b9396383f9d8095528","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=9a0a4d3c1e7138915563c0df4fe6a3f9377b839c","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=fc9867c1e03c22ebf56943be205202e576aabf23","https://www.openssl.org/news/secadv/20230719.txt","http://www.openwall.com/lists/oss-security/2023/07/19/4","http://www.openwall.com/lists/oss-security/2023/07/19/5","http://www.openwall.com/lists/oss-security/2023/07/19/6","http://www.openwall.com/lists/oss-security/2023/07/31/1","http://www.openwall.com/lists/oss-security/2024/05/16/1","https://lists.debian.org/debian-lts-announce/2023/08/msg00019.html","https://security.gentoo.org/glsa/202402-08","https://security.netapp.com/advisory/ntap-20230803-0011/"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-3446","description":"Issue summary: Checking excessively long DH keys or parameters may be very slow.\n\nImpact summary: Applications that use the functions DH_check(), DH_check_ex()\nor EVP_PKEY_param_check() to check a DH key or DH parameters may experience long\ndelays. Where the key or parameters that are being checked have been obtained\nfrom an untrusted source this may lead to a Denial of Service.\n\nThe function DH_check() performs various checks on DH parameters. One of those\nchecks confirms that the modulus ('p' parameter) is not too large. Trying to use\na very large modulus is slow and OpenSSL will not normally use a modulus which\nis over 10,000 bits in length.\n\nHowever the DH_check() function checks numerous aspects of the key or parameters\nthat have been supplied. Some of those checks use the supplied modulus value\neven if it has already been found to be too large.\n\nAn application that calls DH_check() and supplies a key or parameters obtained\nfrom an untrusted source could be vulernable to a Denial of Service attack.\n\nThe function DH_check() is itself called by a number of other OpenSSL functions.\nAn application calling any of those other functions may similarly be affected.\nThe other functions affected by this are DH_check_ex() and\nEVP_PKEY_param_check().\n\nAlso vulnerable are the OpenSSL dhparam and pkeyparam command line applications\nwhen using the '-check' option.\n\nThe OpenSSL SSL/TLS implementation is not affected by this issue.\nThe OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue."},"relatedVulnerabilities":[]},{"artifact":{"id":"74f4e71ff41d2d68","cpes":["cpe:2.3:a:libssl1.1:libssl1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl1.1:libssl:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl:1.1.1q-r0:*:*:*:*:*:*:*"],"name":"libssl1.1","purl":"pkg:apk/busybox/libssl1.1@1.1.1q-r0?arch=x86_64&distro=busybox-1.32.1&upstream=openssl","type":"apk","version":"1.1.1q-r0","language":"","licenses":["OpenSSL"],"metadata":{"Arch":"x86_64","files":[{"path":"/lib"},{"path":"/lib/libssl.so.1.1"},{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libssl.so.1.1"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2023-3446","versionConstraint":">= 1.0.2, < 1.0.2zi||>= 1.1.1, < 1.1.1v||>= 3.0.0, < 3.0.10||>= 3.1.0, < 3.1.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:1.1.1q:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"1.1.1q-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2023-3446","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-3446","cwe":"CWE-606","type":"Secondary","source":"openssl-security@openssl.org"},{"cve":"CVE-2023-3446","cwe":"CWE-1333","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-3446","date":"2026-10-08","epss":0.06531,"percentile":0.93621}],"risk":3.363465,"urls":["https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=1fa20cf2f506113c761777127a38bce5068740eb","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=8780a896543a654e757db1b9396383f9d8095528","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=9a0a4d3c1e7138915563c0df4fe6a3f9377b839c","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=fc9867c1e03c22ebf56943be205202e576aabf23","https://www.openssl.org/news/secadv/20230719.txt","http://www.openwall.com/lists/oss-security/2023/07/19/4","http://www.openwall.com/lists/oss-security/2023/07/19/5","http://www.openwall.com/lists/oss-security/2023/07/19/6","http://www.openwall.com/lists/oss-security/2023/07/31/1","http://www.openwall.com/lists/oss-security/2024/05/16/1","https://lists.debian.org/debian-lts-announce/2023/08/msg00019.html","https://security.gentoo.org/glsa/202402-08","https://security.netapp.com/advisory/ntap-20230803-0011/"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-3446","description":"Issue summary: Checking excessively long DH keys or parameters may be very slow.\n\nImpact summary: Applications that use the functions DH_check(), DH_check_ex()\nor EVP_PKEY_param_check() to check a DH key or DH parameters may experience long\ndelays. Where the key or parameters that are being checked have been obtained\nfrom an untrusted source this may lead to a Denial of Service.\n\nThe function DH_check() performs various checks on DH parameters. One of those\nchecks confirms that the modulus ('p' parameter) is not too large. Trying to use\na very large modulus is slow and OpenSSL will not normally use a modulus which\nis over 10,000 bits in length.\n\nHowever the DH_check() function checks numerous aspects of the key or parameters\nthat have been supplied. Some of those checks use the supplied modulus value\neven if it has already been found to be too large.\n\nAn application that calls DH_check() and supplies a key or parameters obtained\nfrom an untrusted source could be vulernable to a Denial of Service attack.\n\nThe function DH_check() is itself called by a number of other OpenSSL functions.\nAn application calling any of those other functions may similarly be affected.\nThe other functions affected by this are DH_check_ex() and\nEVP_PKEY_param_check().\n\nAlso vulnerable are the OpenSSL dhparam and pkeyparam command line applications\nwhen using the '-check' option.\n\nThe OpenSSL SSL/TLS implementation is not affected by this issue.\nThe OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue."},"relatedVulnerabilities":[]},{"artifact":{"id":"14807b4f7067817d","cpes":["cpe:2.3:a:openssl:openssl:1.1.1q-r0:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:apk/busybox/openssl@1.1.1q-r0?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"1.1.1q-r0","language":"","licenses":["OpenSSL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/openssl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2023-3446","versionConstraint":">= 1.0.2, < 1.0.2zi||>= 1.1.1, < 1.1.1v||>= 3.0.0, < 3.0.10||>= 3.1.0, < 3.1.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:1.1.1q:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"1.1.1q-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2023-3446","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-3446","cwe":"CWE-606","type":"Secondary","source":"openssl-security@openssl.org"},{"cve":"CVE-2023-3446","cwe":"CWE-1333","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-3446","date":"2026-10-08","epss":0.06531,"percentile":0.93621}],"risk":3.363465,"urls":["https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=1fa20cf2f506113c761777127a38bce5068740eb","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=8780a896543a654e757db1b9396383f9d8095528","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=9a0a4d3c1e7138915563c0df4fe6a3f9377b839c","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=fc9867c1e03c22ebf56943be205202e576aabf23","https://www.openssl.org/news/secadv/20230719.txt","http://www.openwall.com/lists/oss-security/2023/07/19/4","http://www.openwall.com/lists/oss-security/2023/07/19/5","http://www.openwall.com/lists/oss-security/2023/07/19/6","http://www.openwall.com/lists/oss-security/2023/07/31/1","http://www.openwall.com/lists/oss-security/2024/05/16/1","https://lists.debian.org/debian-lts-announce/2023/08/msg00019.html","https://security.gentoo.org/glsa/202402-08","https://security.netapp.com/advisory/ntap-20230803-0011/"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-3446","description":"Issue summary: Checking excessively long DH keys or parameters may be very slow.\n\nImpact summary: Applications that use the functions DH_check(), DH_check_ex()\nor EVP_PKEY_param_check() to check a DH key or DH parameters may experience long\ndelays. Where the key or parameters that are being checked have been obtained\nfrom an untrusted source this may lead to a Denial of Service.\n\nThe function DH_check() performs various checks on DH parameters. One of those\nchecks confirms that the modulus ('p' parameter) is not too large. Trying to use\na very large modulus is slow and OpenSSL will not normally use a modulus which\nis over 10,000 bits in length.\n\nHowever the DH_check() function checks numerous aspects of the key or parameters\nthat have been supplied. Some of those checks use the supplied modulus value\neven if it has already been found to be too large.\n\nAn application that calls DH_check() and supplies a key or parameters obtained\nfrom an untrusted source could be vulernable to a Denial of Service attack.\n\nThe function DH_check() is itself called by a number of other OpenSSL functions.\nAn application calling any of those other functions may similarly be affected.\nThe other functions affected by this are DH_check_ex() and\nEVP_PKEY_param_check().\n\nAlso vulnerable are the OpenSSL dhparam and pkeyparam command line applications\nwhen using the '-check' option.\n\nThe OpenSSL SSL/TLS implementation is not affected by this issue.\nThe OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue."},"relatedVulnerabilities":[]},{"artifact":{"id":"d081de97c6f633df","cpes":["cpe:2.3:a:libcrypto1.1:libcrypto1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto1.1:libcrypto:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto:libcrypto1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto:libcrypto:1.1.1q-r0:*:*:*:*:*:*:*"],"name":"libcrypto1.1","purl":"pkg:apk/busybox/libcrypto1.1@1.1.1q-r0?arch=x86_64&distro=busybox-1.32.1&upstream=openssl","type":"apk","version":"1.1.1q-r0","language":"","licenses":["OpenSSL"],"metadata":{"Arch":"x86_64","files":[{"path":"/etc"},{"path":"/etc/ssl"},{"path":"/etc/ssl/ct_log_list.cnf"},{"path":"/etc/ssl/ct_log_list.cnf.dist"},{"path":"/etc/ssl/openssl.cnf"},{"path":"/etc/ssl/openssl.cnf.dist"},{"path":"/etc/ssl/certs"},{"path":"/etc/ssl/misc"},{"path":"/etc/ssl/misc/CA.pl"},{"path":"/etc/ssl/misc/tsget"},{"path":"/etc/ssl/misc/tsget.pl"},{"path":"/etc/ssl/private"},{"path":"/lib"},{"path":"/lib/libcrypto.so.1.1"},{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcrypto.so.1.1"},{"path":"/usr/lib/engines-1.1"},{"path":"/usr/lib/engines-1.1/afalg.so"},{"path":"/usr/lib/engines-1.1/capi.so"},{"path":"/usr/lib/engines-1.1/padlock.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-45447","versionConstraint":">= 1.0.2, < 1.0.2zq||>= 1.1.1, < 1.1.1zh||>= 3.0.0, < 3.0.21||>= 3.4.0, < 3.4.6||>= 3.5.0, < 3.5.7||>= 3.6.0, < 3.6.3||>= 4.0.0, < 4.0.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:1.1.1q:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"1.1.1q-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-45447","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-45447","cwe":"CWE-416","type":"Secondary","source":"openssl-security@openssl.org"},{"cve":"CVE-2026-45447","cwe":"CWE-825","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-45447","date":"2026-10-08","epss":0.04002,"percentile":0.90276}],"risk":3.191595,"urls":["https://github.com/openssl/openssl/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c","https://github.com/openssl/openssl/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8","https://github.com/openssl/openssl/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54","https://github.com/openssl/openssl/commit/a541ae8bfe849a30cc885e8780715c0f488e496c","https://github.com/openssl/openssl/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e","https://openssl-library.org/news/secadv/20260609.txt","https://access.redhat.com/errata/RHSA-2026:25237","https://access.redhat.com/errata/RHSA-2026:25239","https://access.redhat.com/errata/RHSA-2026:26275","https://access.redhat.com/errata/RHSA-2026:26319","https://access.redhat.com/errata/RHSA-2026:29197","https://access.redhat.com/errata/RHSA-2026:34102","https://access.redhat.com/errata/RHSA-2026:35869","https://access.redhat.com/errata/RHSA-2026:36215","https://access.redhat.com/errata/RHSA-2026:36217","https://access.redhat.com/errata/RHSA-2026:39009","https://access.redhat.com/errata/RHSA-2026:39012","https://access.redhat.com/errata/RHSA-2026:39981","https://access.redhat.com/errata/RHSA-2026:44438","https://access.redhat.com/errata/RHSA-2026:47735","https://access.redhat.com/errata/RHSA-2026:47737","https://access.redhat.com/errata/RHSA-2026:58563","https://access.redhat.com/errata/RHSA-2026:58981","https://access.redhat.com/errata/RHSA-2026:59831","https://access.redhat.com/errata/RHSA-2026:66524","https://access.redhat.com/security/cve/CVE-2026-45447","https://bugzilla.redhat.com/show_bug.cgi?id=2481898","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45447.json"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-45447","description":"Issue summary: A specially crafted PKCS#7 or S/MIME signed message could\ntrigger a use-after-free during PKCS#7 signature verification.\n\nImpact summary: A use-after-free may result in process crashes, heap\ncorruption, or potentially remote code execution.\n\nWhen processing a PKCS#7 or S/MIME signed message, if the SignedData\ndigestAlgorithms field is present as an empty ASN.1 SET, OpenSSL may\nincorrectly free a caller-owned BIO during PKCS7_verify(). A subsequent\nuse of the BIO by the calling application results in a use-after-free\ncondition.\n\nIn the common case this occurs when the application later calls\nBIO_free() on the BIO originally passed to PKCS7_verify(). Depending\non allocator behavior and application-specific BIO usage patterns, this\nmay result in a crash or other memory corruption. In some application\ncontexts this may potentially be exploitable for remote code execution.\n\nApplications that process PKCS#7 or S/MIME signed messages using OpenSSL\nPKCS#7 APIs may be affected. Applications using the CMS APIs for this\nprocessing are not affected.\n\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary."},"relatedVulnerabilities":[]},{"artifact":{"id":"74f4e71ff41d2d68","cpes":["cpe:2.3:a:libssl1.1:libssl1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl1.1:libssl:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl:1.1.1q-r0:*:*:*:*:*:*:*"],"name":"libssl1.1","purl":"pkg:apk/busybox/libssl1.1@1.1.1q-r0?arch=x86_64&distro=busybox-1.32.1&upstream=openssl","type":"apk","version":"1.1.1q-r0","language":"","licenses":["OpenSSL"],"metadata":{"Arch":"x86_64","files":[{"path":"/lib"},{"path":"/lib/libssl.so.1.1"},{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libssl.so.1.1"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-45447","versionConstraint":">= 1.0.2, < 1.0.2zq||>= 1.1.1, < 1.1.1zh||>= 3.0.0, < 3.0.21||>= 3.4.0, < 3.4.6||>= 3.5.0, < 3.5.7||>= 3.6.0, < 3.6.3||>= 4.0.0, < 4.0.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:1.1.1q:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"1.1.1q-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-45447","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-45447","cwe":"CWE-416","type":"Secondary","source":"openssl-security@openssl.org"},{"cve":"CVE-2026-45447","cwe":"CWE-825","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-45447","date":"2026-10-08","epss":0.04002,"percentile":0.90276}],"risk":3.191595,"urls":["https://github.com/openssl/openssl/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c","https://github.com/openssl/openssl/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8","https://github.com/openssl/openssl/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54","https://github.com/openssl/openssl/commit/a541ae8bfe849a30cc885e8780715c0f488e496c","https://github.com/openssl/openssl/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e","https://openssl-library.org/news/secadv/20260609.txt","https://access.redhat.com/errata/RHSA-2026:25237","https://access.redhat.com/errata/RHSA-2026:25239","https://access.redhat.com/errata/RHSA-2026:26275","https://access.redhat.com/errata/RHSA-2026:26319","https://access.redhat.com/errata/RHSA-2026:29197","https://access.redhat.com/errata/RHSA-2026:34102","https://access.redhat.com/errata/RHSA-2026:35869","https://access.redhat.com/errata/RHSA-2026:36215","https://access.redhat.com/errata/RHSA-2026:36217","https://access.redhat.com/errata/RHSA-2026:39009","https://access.redhat.com/errata/RHSA-2026:39012","https://access.redhat.com/errata/RHSA-2026:39981","https://access.redhat.com/errata/RHSA-2026:44438","https://access.redhat.com/errata/RHSA-2026:47735","https://access.redhat.com/errata/RHSA-2026:47737","https://access.redhat.com/errata/RHSA-2026:58563","https://access.redhat.com/errata/RHSA-2026:58981","https://access.redhat.com/errata/RHSA-2026:59831","https://access.redhat.com/errata/RHSA-2026:66524","https://access.redhat.com/security/cve/CVE-2026-45447","https://bugzilla.redhat.com/show_bug.cgi?id=2481898","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45447.json"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-45447","description":"Issue summary: A specially crafted PKCS#7 or S/MIME signed message could\ntrigger a use-after-free during PKCS#7 signature verification.\n\nImpact summary: A use-after-free may result in process crashes, heap\ncorruption, or potentially remote code execution.\n\nWhen processing a PKCS#7 or S/MIME signed message, if the SignedData\ndigestAlgorithms field is present as an empty ASN.1 SET, OpenSSL may\nincorrectly free a caller-owned BIO during PKCS7_verify(). A subsequent\nuse of the BIO by the calling application results in a use-after-free\ncondition.\n\nIn the common case this occurs when the application later calls\nBIO_free() on the BIO originally passed to PKCS7_verify(). Depending\non allocator behavior and application-specific BIO usage patterns, this\nmay result in a crash or other memory corruption. In some application\ncontexts this may potentially be exploitable for remote code execution.\n\nApplications that process PKCS#7 or S/MIME signed messages using OpenSSL\nPKCS#7 APIs may be affected. Applications using the CMS APIs for this\nprocessing are not affected.\n\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary."},"relatedVulnerabilities":[]},{"artifact":{"id":"14807b4f7067817d","cpes":["cpe:2.3:a:openssl:openssl:1.1.1q-r0:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:apk/busybox/openssl@1.1.1q-r0?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"1.1.1q-r0","language":"","licenses":["OpenSSL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/openssl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-45447","versionConstraint":">= 1.0.2, < 1.0.2zq||>= 1.1.1, < 1.1.1zh||>= 3.0.0, < 3.0.21||>= 3.4.0, < 3.4.6||>= 3.5.0, < 3.5.7||>= 3.6.0, < 3.6.3||>= 4.0.0, < 4.0.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:1.1.1q:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"1.1.1q-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-45447","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-45447","cwe":"CWE-416","type":"Secondary","source":"openssl-security@openssl.org"},{"cve":"CVE-2026-45447","cwe":"CWE-825","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-45447","date":"2026-10-08","epss":0.04002,"percentile":0.90276}],"risk":3.191595,"urls":["https://github.com/openssl/openssl/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c","https://github.com/openssl/openssl/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8","https://github.com/openssl/openssl/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54","https://github.com/openssl/openssl/commit/a541ae8bfe849a30cc885e8780715c0f488e496c","https://github.com/openssl/openssl/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e","https://openssl-library.org/news/secadv/20260609.txt","https://access.redhat.com/errata/RHSA-2026:25237","https://access.redhat.com/errata/RHSA-2026:25239","https://access.redhat.com/errata/RHSA-2026:26275","https://access.redhat.com/errata/RHSA-2026:26319","https://access.redhat.com/errata/RHSA-2026:29197","https://access.redhat.com/errata/RHSA-2026:34102","https://access.redhat.com/errata/RHSA-2026:35869","https://access.redhat.com/errata/RHSA-2026:36215","https://access.redhat.com/errata/RHSA-2026:36217","https://access.redhat.com/errata/RHSA-2026:39009","https://access.redhat.com/errata/RHSA-2026:39012","https://access.redhat.com/errata/RHSA-2026:39981","https://access.redhat.com/errata/RHSA-2026:44438","https://access.redhat.com/errata/RHSA-2026:47735","https://access.redhat.com/errata/RHSA-2026:47737","https://access.redhat.com/errata/RHSA-2026:58563","https://access.redhat.com/errata/RHSA-2026:58981","https://access.redhat.com/errata/RHSA-2026:59831","https://access.redhat.com/errata/RHSA-2026:66524","https://access.redhat.com/security/cve/CVE-2026-45447","https://bugzilla.redhat.com/show_bug.cgi?id=2481898","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45447.json"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-45447","description":"Issue summary: A specially crafted PKCS#7 or S/MIME signed message could\ntrigger a use-after-free during PKCS#7 signature verification.\n\nImpact summary: A use-after-free may result in process crashes, heap\ncorruption, or potentially remote code execution.\n\nWhen processing a PKCS#7 or S/MIME signed message, if the SignedData\ndigestAlgorithms field is present as an empty ASN.1 SET, OpenSSL may\nincorrectly free a caller-owned BIO during PKCS7_verify(). A subsequent\nuse of the BIO by the calling application results in a use-after-free\ncondition.\n\nIn the common case this occurs when the application later calls\nBIO_free() on the BIO originally passed to PKCS7_verify(). Depending\non allocator behavior and application-specific BIO usage patterns, this\nmay result in a crash or other memory corruption. In some application\ncontexts this may potentially be exploitable for remote code execution.\n\nApplications that process PKCS#7 or S/MIME signed messages using OpenSSL\nPKCS#7 APIs may be affected. Applications using the CMS APIs for this\nprocessing are not affected.\n\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary."},"relatedVulnerabilities":[]},{"artifact":{"id":"90f72c5b07fcdbc9","cpes":["cpe:2.3:a:busybox:busybox:1.32.1-r9:*:*:*:*:*:*:*"],"name":"busybox","purl":"pkg:apk/busybox/busybox@1.32.1-r9?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"1.32.1-r9","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/bin"},{"path":"/bin/busybox"},{"path":"/bin/sh"},{"path":"/etc"},{"path":"/etc/securetty"},{"path":"/etc/udhcpd.conf"},{"path":"/etc/logrotate.d"},{"path":"/etc/logrotate.d/acpid"},{"path":"/etc/network"},{"path":"/etc/network/if-down.d"},{"path":"/etc/network/if-post-down.d"},{"path":"/etc/network/if-post-up.d"},{"path":"/etc/network/if-pre-down.d"},{"path":"/etc/network/if-pre-up.d"},{"path":"/etc/network/if-up.d"},{"path":"/etc/network/if-up.d/dad"},{"path":"/sbin"},{"path":"/tmp"},{"path":"/usr"},{"path":"/usr/sbin"},{"path":"/usr/share"},{"path":"/usr/share/udhcpc"},{"path":"/usr/share/udhcpc/default.script"},{"path":"/var"},{"path":"/var/cache"},{"path":"/var/cache/misc"},{"path":"/var/lib"},{"path":"/var/lib/udhcpd"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"busybox"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:busybox:busybox:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2022-48174","versionConstraint":"<= 1.36.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:busybox:busybox:1.32.1:*:*:*:*:*:*:*"],"package":{"name":"busybox","version":"1.32.1-r9"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2022-48174","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-48174","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-48174","date":"2026-10-08","epss":0.03158,"percentile":0.87589}],"risk":2.96852,"urls":["https://bugs.busybox.net/show_bug.cgi?id=15216","https://lists.debian.org/debian-lts-announce/2025/01/msg00012.html","https://security.netapp.com/advisory/ntap-20241129-0001/","https://cert-portal.siemens.com/productcert/html/ssa-089022.html","https://cert-portal.siemens.com/productcert/html/ssa-585531.html"],"severity":"Critical","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-48174","description":"There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution."},"relatedVulnerabilities":[]},{"artifact":{"id":"35fec91b9e067f61","cpes":["cpe:2.3:a:ssl-client:ssl-client:1.32.1-r9:*:*:*:*:*:*:*","cpe:2.3:a:ssl-client:ssl_client:1.32.1-r9:*:*:*:*:*:*:*","cpe:2.3:a:ssl_client:ssl-client:1.32.1-r9:*:*:*:*:*:*:*","cpe:2.3:a:ssl_client:ssl_client:1.32.1-r9:*:*:*:*:*:*:*","cpe:2.3:a:ssl:ssl-client:1.32.1-r9:*:*:*:*:*:*:*","cpe:2.3:a:ssl:ssl_client:1.32.1-r9:*:*:*:*:*:*:*"],"name":"ssl_client","purl":"pkg:apk/busybox/ssl_client@1.32.1-r9?arch=x86_64&distro=busybox-1.32.1&upstream=busybox","type":"apk","version":"1.32.1-r9","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/ssl_client"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"busybox"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:busybox:busybox:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2022-48174","versionConstraint":"<= 1.36.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:busybox:busybox:1.32.1:*:*:*:*:*:*:*"],"package":{"name":"busybox","version":"1.32.1-r9"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2022-48174","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-48174","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-48174","date":"2026-10-08","epss":0.03158,"percentile":0.87589}],"risk":2.96852,"urls":["https://bugs.busybox.net/show_bug.cgi?id=15216","https://lists.debian.org/debian-lts-announce/2025/01/msg00012.html","https://security.netapp.com/advisory/ntap-20241129-0001/","https://cert-portal.siemens.com/productcert/html/ssa-089022.html","https://cert-portal.siemens.com/productcert/html/ssa-585531.html"],"severity":"Critical","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-48174","description":"There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution."},"relatedVulnerabilities":[]},{"artifact":{"id":"a45c752c9b8878aa","cpes":["cpe:2.3:a:php7:php7:7.4.26-r0:*:*:*:*:*:*:*","cpe:2.3:a:php7:php:7.4.26-r0:*:*:*:*:*:*:*","cpe:2.3:a:php:php7:7.4.26-r0:*:*:*:*:*:*:*","cpe:2.3:a:php:php:7.4.26-r0:*:*:*:*:*:*:*"],"name":"php7","purl":"pkg:apk/busybox/php7@7.4.26-r0?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"7.4.26-r0","language":"","licenses":["BSD-3-Clause","LGPL-2.0-or-later","MIT","PHP-3.01","Zend-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/php"},{"path":"/usr/bin/php7"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"php7"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:php:php:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2022-31625","versionConstraint":">= 7.4.0, < 7.4.30||>= 8.0.0, < 8.0.20||>= 8.1.0, < 8.1.7 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:php:php:7.4.26:*:*:*:*:*:*:*"],"package":{"name":"php7","version":"7.4.26-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2022-31625","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-31625","cwe":"CWE-590","type":"Secondary","source":"security@php.net"},{"cve":"CVE-2022-31625","cwe":"CWE-824","type":"Secondary","source":"security@php.net"},{"cve":"CVE-2022-31625","cwe":"CWE-763","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-31625","date":"2026-10-08","epss":0.0379,"percentile":0.89701}],"risk":2.8740833333333335,"urls":["https://bugs.php.net/bug.php?id=81720","https://lists.debian.org/debian-lts-announce/2022/12/msg00030.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3T4MMEEZYYAEHPQMZDFN44PHORJWJFZQ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZZTZQKRGEYJT5UB4FGG3MOE72SQUHSL4/","https://security.gentoo.org/glsa/202209-20","https://security.netapp.com/advisory/ntap-20220722-0005/","https://www.debian.org/security/2022/dsa-5179"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-31625","description":"In PHP versions 7.4.x below 7.4.30, 8.0.x below 8.0.20, and 8.1.x below 8.1.7, when using Postgres database extension, supplying invalid parameters to the parametrized query may lead to PHP attempting to free memory using uninitialized data as pointers. This could lead to RCE vulnerability or denial of service."},"relatedVulnerabilities":[]},{"artifact":{"id":"43a7af5360b6604e","cpes":["cpe:2.3:a:pcre2:pcre2:10.36-r1:*:*:*:*:*:*:*","cpe:2.3:a:pcre2:pcre:10.36-r1:*:*:*:*:*:*:*","cpe:2.3:a:pcre:pcre2:10.36-r1:*:*:*:*:*:*:*","cpe:2.3:a:pcre:pcre:10.36-r1:*:*:*:*:*:*:*"],"name":"pcre2","purl":"pkg:apk/busybox/pcre2@10.36-r1?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"10.36-r1","language":"","licenses":["BSD-3-Clause"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpcre2-8.so.0"},{"path":"/usr/lib/libpcre2-8.so.0.10.1"},{"path":"/usr/lib/libpcre2-posix.so.2"},{"path":"/usr/lib/libpcre2-posix.so.2.0.3"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"pcre2"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:pcre:pcre2:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2022-1586","versionConstraint":"< 10.40 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:pcre:pcre2:10.36:*:*:*:*:*:*:*"],"package":{"name":"pcre2","version":"10.36-r1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2022-1586","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:P","metrics":{"baseScore":6.4,"impactScore":5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-1586","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2022-1586","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-1586","date":"2026-10-08","epss":0.03366,"percentile":0.88405}],"risk":2.8190250000000003,"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=2077976%2C","https://github.com/PCRE2Project/pcre2/commit/50a51cb7e67268e6ad417eb07c9de9bfea5cc55a%2C","https://github.com/PCRE2Project/pcre2/commit/d4fa336fbcc388f89095b184ba6d99422cfc676c","https://lists.debian.org/debian-lts-announce/2023/03/msg00014.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DWNG2NS3GINO6LQYUVC4BZLUQPJ3DYHA/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JXINO3KKI5DICQ45E2FKD6MKVMGJLEKJ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KAX7767BCUFC7JMDGP7GOQ5GIZCAUGBB/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M2GLQQUEY5VFM57CFYXVIFOXN2HUZPDM/","https://security.netapp.com/advisory/ntap-20221028-0009/","https://bugzilla.redhat.com/show_bug.cgi?id=2077976","https://github.com/PCRE2Project/pcre2/commit/50a51cb7e67268e6ad417eb07c9de9bfea5cc55a"],"severity":"Critical","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-1586","description":"An out-of-bounds read vulnerability was discovered in the PCRE2 library in the compile_xclass_matchingpath() function of the pcre2_jit_compile.c file. This involves a unicode property matching issue in JIT-compiled regular expressions. The issue occurs because the character was not fully read in case-less matching within JIT."},"relatedVulnerabilities":[]},{"artifact":{"id":"90f72c5b07fcdbc9","cpes":["cpe:2.3:a:busybox:busybox:1.32.1-r9:*:*:*:*:*:*:*"],"name":"busybox","purl":"pkg:apk/busybox/busybox@1.32.1-r9?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"1.32.1-r9","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/bin"},{"path":"/bin/busybox"},{"path":"/bin/sh"},{"path":"/etc"},{"path":"/etc/securetty"},{"path":"/etc/udhcpd.conf"},{"path":"/etc/logrotate.d"},{"path":"/etc/logrotate.d/acpid"},{"path":"/etc/network"},{"path":"/etc/network/if-down.d"},{"path":"/etc/network/if-post-down.d"},{"path":"/etc/network/if-post-up.d"},{"path":"/etc/network/if-pre-down.d"},{"path":"/etc/network/if-pre-up.d"},{"path":"/etc/network/if-up.d"},{"path":"/etc/network/if-up.d/dad"},{"path":"/sbin"},{"path":"/tmp"},{"path":"/usr"},{"path":"/usr/sbin"},{"path":"/usr/share"},{"path":"/usr/share/udhcpc"},{"path":"/usr/share/udhcpc/default.script"},{"path":"/var"},{"path":"/var/cache"},{"path":"/var/cache/misc"},{"path":"/var/lib"},{"path":"/var/lib/udhcpd"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"busybox"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:busybox:busybox:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2022-28391","versionConstraint":"<= 1.35.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:busybox:busybox:1.32.1:*:*:*:*:*:*:*"],"package":{"name":"busybox","version":"1.32.1-r9"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2022-28391","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-28391","cwe":"CWE-88","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-28391","date":"2026-10-08","epss":0.03521,"percentile":0.88907}],"risk":2.752248333333333,"urls":["https://git.alpinelinux.org/aports/plain/main/busybox/0001-libbb-sockaddr2str-ensure-only-printable-characters-.patch","https://git.alpinelinux.org/aports/plain/main/busybox/0002-nslookup-sanitize-all-printed-strings-with-printable.patch","https://gitlab.alpinelinux.org/alpine/aports/-/issues/13661"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-28391","description":"BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors."},"relatedVulnerabilities":[]},{"artifact":{"id":"35fec91b9e067f61","cpes":["cpe:2.3:a:ssl-client:ssl-client:1.32.1-r9:*:*:*:*:*:*:*","cpe:2.3:a:ssl-client:ssl_client:1.32.1-r9:*:*:*:*:*:*:*","cpe:2.3:a:ssl_client:ssl-client:1.32.1-r9:*:*:*:*:*:*:*","cpe:2.3:a:ssl_client:ssl_client:1.32.1-r9:*:*:*:*:*:*:*","cpe:2.3:a:ssl:ssl-client:1.32.1-r9:*:*:*:*:*:*:*","cpe:2.3:a:ssl:ssl_client:1.32.1-r9:*:*:*:*:*:*:*"],"name":"ssl_client","purl":"pkg:apk/busybox/ssl_client@1.32.1-r9?arch=x86_64&distro=busybox-1.32.1&upstream=busybox","type":"apk","version":"1.32.1-r9","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/ssl_client"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"busybox"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:busybox:busybox:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2022-28391","versionConstraint":"<= 1.35.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:busybox:busybox:1.32.1:*:*:*:*:*:*:*"],"package":{"name":"busybox","version":"1.32.1-r9"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2022-28391","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-28391","cwe":"CWE-88","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-28391","date":"2026-10-08","epss":0.03521,"percentile":0.88907}],"risk":2.752248333333333,"urls":["https://git.alpinelinux.org/aports/plain/main/busybox/0001-libbb-sockaddr2str-ensure-only-printable-characters-.patch","https://git.alpinelinux.org/aports/plain/main/busybox/0002-nslookup-sanitize-all-printed-strings-with-printable.patch","https://gitlab.alpinelinux.org/alpine/aports/-/issues/13661"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-28391","description":"BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors."},"relatedVulnerabilities":[]},{"artifact":{"id":"d081de97c6f633df","cpes":["cpe:2.3:a:libcrypto1.1:libcrypto1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto1.1:libcrypto:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto:libcrypto1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto:libcrypto:1.1.1q-r0:*:*:*:*:*:*:*"],"name":"libcrypto1.1","purl":"pkg:apk/busybox/libcrypto1.1@1.1.1q-r0?arch=x86_64&distro=busybox-1.32.1&upstream=openssl","type":"apk","version":"1.1.1q-r0","language":"","licenses":["OpenSSL"],"metadata":{"Arch":"x86_64","files":[{"path":"/etc"},{"path":"/etc/ssl"},{"path":"/etc/ssl/ct_log_list.cnf"},{"path":"/etc/ssl/ct_log_list.cnf.dist"},{"path":"/etc/ssl/openssl.cnf"},{"path":"/etc/ssl/openssl.cnf.dist"},{"path":"/etc/ssl/certs"},{"path":"/etc/ssl/misc"},{"path":"/etc/ssl/misc/CA.pl"},{"path":"/etc/ssl/misc/tsget"},{"path":"/etc/ssl/misc/tsget.pl"},{"path":"/etc/ssl/private"},{"path":"/lib"},{"path":"/lib/libcrypto.so.1.1"},{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcrypto.so.1.1"},{"path":"/usr/lib/engines-1.1"},{"path":"/usr/lib/engines-1.1/afalg.so"},{"path":"/usr/lib/engines-1.1/capi.so"},{"path":"/usr/lib/engines-1.1/padlock.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2023-0464","versionConstraint":">= 1.0.2, < 1.0.2zh||>= 1.1.1, < 1.1.1u||>= 3.0.0, < 3.0.9||>= 3.1.0, < 3.1.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:1.1.1q:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"1.1.1q-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2023-0464","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-0464","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-0464","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-0464","date":"2026-10-08","epss":0.03658,"percentile":0.89322}],"risk":2.7435,"urls":["https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=2017771e2db3e2b96f89bbe8766c3209f6a99545","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=2dcd4f1e3115f38cefa43e3efbe9b801c27e642e","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=879f7080d7e141f415c79eaa3a8ac4a3dad0348b","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=959c59c7a0164117e7f8366466a32bb1f8d77ff1","https://lists.debian.org/debian-lts-announce/2023/06/msg00011.html","https://security.gentoo.org/glsa/202402-08","https://security.netapp.com/advisory/ntap-20240621-0006/","https://www.couchbase.com/alerts/","https://www.debian.org/security/2023/dsa-5417","https://www.openssl.org/news/secadv/20230322.txt","https://security.netapp.com/advisory/ntap-20230406-0006/"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-0464","description":"A security vulnerability has been identified in all supported versions\n\nof OpenSSL related to the verification of X.509 certificate chains\nthat include policy constraints.  Attackers may be able to exploit this\nvulnerability by creating a malicious certificate chain that triggers\nexponential use of computational resources, leading to a denial-of-service\n(DoS) attack on affected systems.\n\nPolicy processing is disabled by default but can be enabled by passing\nthe `-policy' argument to the command line utilities or by calling the\n`X509_VERIFY_PARAM_set1_policies()' function."},"relatedVulnerabilities":[]},{"artifact":{"id":"74f4e71ff41d2d68","cpes":["cpe:2.3:a:libssl1.1:libssl1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl1.1:libssl:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl:1.1.1q-r0:*:*:*:*:*:*:*"],"name":"libssl1.1","purl":"pkg:apk/busybox/libssl1.1@1.1.1q-r0?arch=x86_64&distro=busybox-1.32.1&upstream=openssl","type":"apk","version":"1.1.1q-r0","language":"","licenses":["OpenSSL"],"metadata":{"Arch":"x86_64","files":[{"path":"/lib"},{"path":"/lib/libssl.so.1.1"},{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libssl.so.1.1"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2023-0464","versionConstraint":">= 1.0.2, < 1.0.2zh||>= 1.1.1, < 1.1.1u||>= 3.0.0, < 3.0.9||>= 3.1.0, < 3.1.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:1.1.1q:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"1.1.1q-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2023-0464","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-0464","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-0464","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-0464","date":"2026-10-08","epss":0.03658,"percentile":0.89322}],"risk":2.7435,"urls":["https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=2017771e2db3e2b96f89bbe8766c3209f6a99545","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=2dcd4f1e3115f38cefa43e3efbe9b801c27e642e","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=879f7080d7e141f415c79eaa3a8ac4a3dad0348b","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=959c59c7a0164117e7f8366466a32bb1f8d77ff1","https://lists.debian.org/debian-lts-announce/2023/06/msg00011.html","https://security.gentoo.org/glsa/202402-08","https://security.netapp.com/advisory/ntap-20240621-0006/","https://www.couchbase.com/alerts/","https://www.debian.org/security/2023/dsa-5417","https://www.openssl.org/news/secadv/20230322.txt","https://security.netapp.com/advisory/ntap-20230406-0006/"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-0464","description":"A security vulnerability has been identified in all supported versions\n\nof OpenSSL related to the verification of X.509 certificate chains\nthat include policy constraints.  Attackers may be able to exploit this\nvulnerability by creating a malicious certificate chain that triggers\nexponential use of computational resources, leading to a denial-of-service\n(DoS) attack on affected systems.\n\nPolicy processing is disabled by default but can be enabled by passing\nthe `-policy' argument to the command line utilities or by calling the\n`X509_VERIFY_PARAM_set1_policies()' function."},"relatedVulnerabilities":[]},{"artifact":{"id":"14807b4f7067817d","cpes":["cpe:2.3:a:openssl:openssl:1.1.1q-r0:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:apk/busybox/openssl@1.1.1q-r0?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"1.1.1q-r0","language":"","licenses":["OpenSSL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/openssl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2023-0464","versionConstraint":">= 1.0.2, < 1.0.2zh||>= 1.1.1, < 1.1.1u||>= 3.0.0, < 3.0.9||>= 3.1.0, < 3.1.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:1.1.1q:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"1.1.1q-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2023-0464","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-0464","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-0464","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-0464","date":"2026-10-08","epss":0.03658,"percentile":0.89322}],"risk":2.7435,"urls":["https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=2017771e2db3e2b96f89bbe8766c3209f6a99545","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=2dcd4f1e3115f38cefa43e3efbe9b801c27e642e","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=879f7080d7e141f415c79eaa3a8ac4a3dad0348b","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=959c59c7a0164117e7f8366466a32bb1f8d77ff1","https://lists.debian.org/debian-lts-announce/2023/06/msg00011.html","https://security.gentoo.org/glsa/202402-08","https://security.netapp.com/advisory/ntap-20240621-0006/","https://www.couchbase.com/alerts/","https://www.debian.org/security/2023/dsa-5417","https://www.openssl.org/news/secadv/20230322.txt","https://security.netapp.com/advisory/ntap-20230406-0006/"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-0464","description":"A security vulnerability has been identified in all supported versions\n\nof OpenSSL related to the verification of X.509 certificate chains\nthat include policy constraints.  Attackers may be able to exploit this\nvulnerability by creating a malicious certificate chain that triggers\nexponential use of computational resources, leading to a denial-of-service\n(DoS) attack on affected systems.\n\nPolicy processing is disabled by default but can be enabled by passing\nthe `-policy' argument to the command line utilities or by calling the\n`X509_VERIFY_PARAM_set1_policies()' function."},"relatedVulnerabilities":[]},{"artifact":{"id":"d081de97c6f633df","cpes":["cpe:2.3:a:libcrypto1.1:libcrypto1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto1.1:libcrypto:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto:libcrypto1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto:libcrypto:1.1.1q-r0:*:*:*:*:*:*:*"],"name":"libcrypto1.1","purl":"pkg:apk/busybox/libcrypto1.1@1.1.1q-r0?arch=x86_64&distro=busybox-1.32.1&upstream=openssl","type":"apk","version":"1.1.1q-r0","language":"","licenses":["OpenSSL"],"metadata":{"Arch":"x86_64","files":[{"path":"/etc"},{"path":"/etc/ssl"},{"path":"/etc/ssl/ct_log_list.cnf"},{"path":"/etc/ssl/ct_log_list.cnf.dist"},{"path":"/etc/ssl/openssl.cnf"},{"path":"/etc/ssl/openssl.cnf.dist"},{"path":"/etc/ssl/certs"},{"path":"/etc/ssl/misc"},{"path":"/etc/ssl/misc/CA.pl"},{"path":"/etc/ssl/misc/tsget"},{"path":"/etc/ssl/misc/tsget.pl"},{"path":"/etc/ssl/private"},{"path":"/lib"},{"path":"/lib/libcrypto.so.1.1"},{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcrypto.so.1.1"},{"path":"/usr/lib/engines-1.1"},{"path":"/usr/lib/engines-1.1/afalg.so"},{"path":"/usr/lib/engines-1.1/capi.so"},{"path":"/usr/lib/engines-1.1/padlock.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2024-9143","versionConstraint":">= 1.0.2, < 1.0.2zl||>= 1.1.1, < 1.1.1zb||>= 3.0.0, < 3.0.16||>= 3.1.0, < 3.1.8||>= 3.2.0, < 3.2.4||>= 3.3.0, < 3.3.3 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:1.1.1q:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"1.1.1q-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2024-9143","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-9143","cwe":"CWE-125","type":"Secondary","source":"openssl-security@openssl.org"},{"cve":"CVE-2024-9143","cwe":"CWE-787","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2024-9143","date":"2026-10-08","epss":0.05842,"percentile":0.92986}],"risk":2.7165299999999997,"urls":["https://github.com/openssl/openssl/commit/72ae83ad214d2eef262461365a1975707f862712","https://github.com/openssl/openssl/commit/bc7e04d7c8d509fb78fc0e285aa948fb0da04700","https://github.com/openssl/openssl/commit/c0d3e4d32d2805f49bec30547f225bc4d092e1f4","https://github.com/openssl/openssl/commit/fdf6723362ca51bd883295efe206cb5b1cfa5154","https://github.openssl.org/openssl/extended-releases/commit/8efc0cbaa8ebba8e116f7b81a876a4123594d86a","https://github.openssl.org/openssl/extended-releases/commit/9d576994cec2b7aa37a91740ea7e680810957e41","https://openssl-library.org/news/secadv/20241016.txt","http://www.openwall.com/lists/oss-security/2024/10/16/1","http://www.openwall.com/lists/oss-security/2024/10/23/1","http://www.openwall.com/lists/oss-security/2024/10/24/1","https://lists.debian.org/debian-lts-announce/2024/10/msg00033.html","https://lists.debian.org/debian-lts-announce/2024/11/msg00000.html","https://security.netapp.com/advisory/ntap-20241101-0001/","https://cert-portal.siemens.com/productcert/html/ssa-265688.html","https://cert-portal.siemens.com/productcert/html/ssa-277137.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html","https://cert-portal.siemens.com/productcert/html/ssa-769027.html"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-9143","description":"Issue summary: Use of the low-level GF(2^m) elliptic curve APIs with untrusted\nexplicit values for the field polynomial can lead to out-of-bounds memory reads\nor writes.\n\nImpact summary: Out of bound memory writes can lead to an application crash or\neven a possibility of a remote code execution, however, in all the protocols\ninvolving Elliptic Curve Cryptography that we're aware of, either only \"named\ncurves\" are supported, or, if explicit curve parameters are supported, they\nspecify an X9.62 encoding of binary (GF(2^m)) curves that can't represent\nproblematic input values. Thus the likelihood of existence of a vulnerable\napplication is low.\n\nIn particular, the X9.62 encoding is used for ECC keys in X.509 certificates,\nso problematic inputs cannot occur in the context of processing X.509\ncertificates.  Any problematic use-cases would have to be using an \"exotic\"\ncurve encoding.\n\nThe affected APIs include: EC_GROUP_new_curve_GF2m(), EC_GROUP_new_from_params(),\nand various supporting BN_GF2m_*() functions.\n\nApplications working with \"exotic\" explicit binary (GF(2^m)) curve parameters,\nthat make it possible to represent invalid field polynomials with a zero\nconstant term, via the above or similar APIs, may terminate abruptly as a\nresult of reading or writing outside of array bounds.  Remote code execution\ncannot easily be ruled out.\n\nThe FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue."},"relatedVulnerabilities":[]},{"artifact":{"id":"74f4e71ff41d2d68","cpes":["cpe:2.3:a:libssl1.1:libssl1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl1.1:libssl:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl:1.1.1q-r0:*:*:*:*:*:*:*"],"name":"libssl1.1","purl":"pkg:apk/busybox/libssl1.1@1.1.1q-r0?arch=x86_64&distro=busybox-1.32.1&upstream=openssl","type":"apk","version":"1.1.1q-r0","language":"","licenses":["OpenSSL"],"metadata":{"Arch":"x86_64","files":[{"path":"/lib"},{"path":"/lib/libssl.so.1.1"},{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libssl.so.1.1"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2024-9143","versionConstraint":">= 1.0.2, < 1.0.2zl||>= 1.1.1, < 1.1.1zb||>= 3.0.0, < 3.0.16||>= 3.1.0, < 3.1.8||>= 3.2.0, < 3.2.4||>= 3.3.0, < 3.3.3 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:1.1.1q:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"1.1.1q-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2024-9143","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-9143","cwe":"CWE-125","type":"Secondary","source":"openssl-security@openssl.org"},{"cve":"CVE-2024-9143","cwe":"CWE-787","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2024-9143","date":"2026-10-08","epss":0.05842,"percentile":0.92986}],"risk":2.7165299999999997,"urls":["https://github.com/openssl/openssl/commit/72ae83ad214d2eef262461365a1975707f862712","https://github.com/openssl/openssl/commit/bc7e04d7c8d509fb78fc0e285aa948fb0da04700","https://github.com/openssl/openssl/commit/c0d3e4d32d2805f49bec30547f225bc4d092e1f4","https://github.com/openssl/openssl/commit/fdf6723362ca51bd883295efe206cb5b1cfa5154","https://github.openssl.org/openssl/extended-releases/commit/8efc0cbaa8ebba8e116f7b81a876a4123594d86a","https://github.openssl.org/openssl/extended-releases/commit/9d576994cec2b7aa37a91740ea7e680810957e41","https://openssl-library.org/news/secadv/20241016.txt","http://www.openwall.com/lists/oss-security/2024/10/16/1","http://www.openwall.com/lists/oss-security/2024/10/23/1","http://www.openwall.com/lists/oss-security/2024/10/24/1","https://lists.debian.org/debian-lts-announce/2024/10/msg00033.html","https://lists.debian.org/debian-lts-announce/2024/11/msg00000.html","https://security.netapp.com/advisory/ntap-20241101-0001/","https://cert-portal.siemens.com/productcert/html/ssa-265688.html","https://cert-portal.siemens.com/productcert/html/ssa-277137.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html","https://cert-portal.siemens.com/productcert/html/ssa-769027.html"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-9143","description":"Issue summary: Use of the low-level GF(2^m) elliptic curve APIs with untrusted\nexplicit values for the field polynomial can lead to out-of-bounds memory reads\nor writes.\n\nImpact summary: Out of bound memory writes can lead to an application crash or\neven a possibility of a remote code execution, however, in all the protocols\ninvolving Elliptic Curve Cryptography that we're aware of, either only \"named\ncurves\" are supported, or, if explicit curve parameters are supported, they\nspecify an X9.62 encoding of binary (GF(2^m)) curves that can't represent\nproblematic input values. Thus the likelihood of existence of a vulnerable\napplication is low.\n\nIn particular, the X9.62 encoding is used for ECC keys in X.509 certificates,\nso problematic inputs cannot occur in the context of processing X.509\ncertificates.  Any problematic use-cases would have to be using an \"exotic\"\ncurve encoding.\n\nThe affected APIs include: EC_GROUP_new_curve_GF2m(), EC_GROUP_new_from_params(),\nand various supporting BN_GF2m_*() functions.\n\nApplications working with \"exotic\" explicit binary (GF(2^m)) curve parameters,\nthat make it possible to represent invalid field polynomials with a zero\nconstant term, via the above or similar APIs, may terminate abruptly as a\nresult of reading or writing outside of array bounds.  Remote code execution\ncannot easily be ruled out.\n\nThe FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue."},"relatedVulnerabilities":[]},{"artifact":{"id":"14807b4f7067817d","cpes":["cpe:2.3:a:openssl:openssl:1.1.1q-r0:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:apk/busybox/openssl@1.1.1q-r0?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"1.1.1q-r0","language":"","licenses":["OpenSSL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/openssl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2024-9143","versionConstraint":">= 1.0.2, < 1.0.2zl||>= 1.1.1, < 1.1.1zb||>= 3.0.0, < 3.0.16||>= 3.1.0, < 3.1.8||>= 3.2.0, < 3.2.4||>= 3.3.0, < 3.3.3 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:1.1.1q:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"1.1.1q-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2024-9143","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-9143","cwe":"CWE-125","type":"Secondary","source":"openssl-security@openssl.org"},{"cve":"CVE-2024-9143","cwe":"CWE-787","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2024-9143","date":"2026-10-08","epss":0.05842,"percentile":0.92986}],"risk":2.7165299999999997,"urls":["https://github.com/openssl/openssl/commit/72ae83ad214d2eef262461365a1975707f862712","https://github.com/openssl/openssl/commit/bc7e04d7c8d509fb78fc0e285aa948fb0da04700","https://github.com/openssl/openssl/commit/c0d3e4d32d2805f49bec30547f225bc4d092e1f4","https://github.com/openssl/openssl/commit/fdf6723362ca51bd883295efe206cb5b1cfa5154","https://github.openssl.org/openssl/extended-releases/commit/8efc0cbaa8ebba8e116f7b81a876a4123594d86a","https://github.openssl.org/openssl/extended-releases/commit/9d576994cec2b7aa37a91740ea7e680810957e41","https://openssl-library.org/news/secadv/20241016.txt","http://www.openwall.com/lists/oss-security/2024/10/16/1","http://www.openwall.com/lists/oss-security/2024/10/23/1","http://www.openwall.com/lists/oss-security/2024/10/24/1","https://lists.debian.org/debian-lts-announce/2024/10/msg00033.html","https://lists.debian.org/debian-lts-announce/2024/11/msg00000.html","https://security.netapp.com/advisory/ntap-20241101-0001/","https://cert-portal.siemens.com/productcert/html/ssa-265688.html","https://cert-portal.siemens.com/productcert/html/ssa-277137.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html","https://cert-portal.siemens.com/productcert/html/ssa-769027.html"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-9143","description":"Issue summary: Use of the low-level GF(2^m) elliptic curve APIs with untrusted\nexplicit values for the field polynomial can lead to out-of-bounds memory reads\nor writes.\n\nImpact summary: Out of bound memory writes can lead to an application crash or\neven a possibility of a remote code execution, however, in all the protocols\ninvolving Elliptic Curve Cryptography that we're aware of, either only \"named\ncurves\" are supported, or, if explicit curve parameters are supported, they\nspecify an X9.62 encoding of binary (GF(2^m)) curves that can't represent\nproblematic input values. Thus the likelihood of existence of a vulnerable\napplication is low.\n\nIn particular, the X9.62 encoding is used for ECC keys in X.509 certificates,\nso problematic inputs cannot occur in the context of processing X.509\ncertificates.  Any problematic use-cases would have to be using an \"exotic\"\ncurve encoding.\n\nThe affected APIs include: EC_GROUP_new_curve_GF2m(), EC_GROUP_new_from_params(),\nand various supporting BN_GF2m_*() functions.\n\nApplications working with \"exotic\" explicit binary (GF(2^m)) curve parameters,\nthat make it possible to represent invalid field polynomials with a zero\nconstant term, via the above or similar APIs, may terminate abruptly as a\nresult of reading or writing outside of array bounds.  Remote code execution\ncannot easily be ruled out.\n\nThe FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue."},"relatedVulnerabilities":[]},{"artifact":{"id":"422a442f930ca27c","cpes":["cpe:2.3:a:nginx:nginx:1.18.0-r15:*:*:*:*:*:*:*"],"name":"nginx","purl":"pkg:apk/busybox/nginx@1.18.0-r15?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"1.18.0-r15","language":"","licenses":["BSD-2-Clause"],"metadata":{"Arch":"x86_64","files":[{"path":"/etc"},{"path":"/etc/logrotate.d"},{"path":"/etc/logrotate.d/nginx"},{"path":"/etc/nginx"},{"path":"/etc/nginx/fastcgi.conf"},{"path":"/etc/nginx/fastcgi_params"},{"path":"/etc/nginx/mime.types"},{"path":"/etc/nginx/nginx.conf"},{"path":"/etc/nginx/scgi_params"},{"path":"/etc/nginx/uwsgi_params"},{"path":"/etc/nginx/http.d"},{"path":"/etc/nginx/modules"},{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/nginx"},{"path":"/usr/lib/nginx/modules"},{"path":"/usr/sbin"},{"path":"/usr/sbin/nginx"},{"path":"/usr/share"},{"path":"/usr/share/nginx"},{"path":"/usr/share/nginx/http-default_server.conf"},{"path":"/var"},{"path":"/var/lib"},{"path":"/var/lib/nginx"},{"path":"/var/lib/nginx/logs"},{"path":"/var/lib/nginx/modules"},{"path":"/var/lib/nginx/run"},{"path":"/var/lib/nginx/html"},{"path":"/var/lib/nginx/html/50x.html"},{"path":"/var/lib/nginx/html/index.html"},{"path":"/var/lib/nginx/tmp"},{"path":"/var/log"},{"path":"/var/log/nginx"},{"path":"/var/www"},{"path":"/var/www/localhost"},{"path":"/var/www/localhost/htdocs"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"nginx"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:nginx:nginx:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-42945","versionConstraint":">= 0.6.27, < 1.30.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:nginx:nginx:1.18.0:*:*:*:*:*:*:*"],"package":{"name":"nginx","version":"1.18.0-r15"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-42945","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"f5sirt@f5.com","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.2},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"f5sirt@f5.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42945","cwe":"CWE-122","type":"Secondary","source":"f5sirt@f5.com"},{"cve":"CVE-2026-42945","cwe":"CWE-131","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-42945","date":"2026-10-08","epss":0.03396,"percentile":0.88498}],"risk":2.71114,"urls":["https://my.f5.com/manage/s/article/K000161019","https://depthfirst.com/nginx-rift","https://github.com/DepthFirstDisclosures/Nginx-Rift","https://access.redhat.com/errata/RHSA-2026:17417","https://access.redhat.com/errata/RHSA-2026:17751","https://access.redhat.com/errata/RHSA-2026:17752","https://access.redhat.com/errata/RHSA-2026:17753","https://access.redhat.com/errata/RHSA-2026:17790","https://access.redhat.com/errata/RHSA-2026:17791","https://access.redhat.com/errata/RHSA-2026:17792","https://access.redhat.com/errata/RHSA-2026:17793","https://access.redhat.com/errata/RHSA-2026:17794","https://access.redhat.com/errata/RHSA-2026:18029","https://access.redhat.com/errata/RHSA-2026:18041","https://access.redhat.com/errata/RHSA-2026:18063","https://access.redhat.com/errata/RHSA-2026:19159","https://access.redhat.com/errata/RHSA-2026:19371","https://access.redhat.com/errata/RHSA-2026:19372","https://access.redhat.com/errata/RHSA-2026:19374","https://access.redhat.com/errata/RHSA-2026:20442","https://access.redhat.com/errata/RHSA-2026:20444","https://access.redhat.com/errata/RHSA-2026:21275","https://access.redhat.com/errata/RHSA-2026:22382","https://access.redhat.com/errata/RHSA-2026:22383","https://access.redhat.com/errata/RHSA-2026:22388","https://access.redhat.com/errata/RHSA-2026:22389","https://access.redhat.com/errata/RHSA-2026:22390","https://access.redhat.com/errata/RHSA-2026:22393","https://access.redhat.com/errata/RHSA-2026:22394","https://access.redhat.com/errata/RHSA-2026:22396","https://access.redhat.com/errata/RHSA-2026:58981","https://access.redhat.com/security/cve/CVE-2026-42945","https://bugzilla.redhat.com/show_bug.cgi?id=2477116","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42945.json"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42945","description":"NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when the rewrite directive is followed by a rewrite, if, or set directive and an unnamed Perl-Compatible Regular Expression (PCRE) capture (for example, $1, $2) with a replacement string that includes a question mark (?). An unauthenticated attacker along with conditions beyond its control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated."},"relatedVulnerabilities":[]},{"artifact":{"id":"a45c752c9b8878aa","cpes":["cpe:2.3:a:php7:php7:7.4.26-r0:*:*:*:*:*:*:*","cpe:2.3:a:php7:php:7.4.26-r0:*:*:*:*:*:*:*","cpe:2.3:a:php:php7:7.4.26-r0:*:*:*:*:*:*:*","cpe:2.3:a:php:php:7.4.26-r0:*:*:*:*:*:*:*"],"name":"php7","purl":"pkg:apk/busybox/php7@7.4.26-r0?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"7.4.26-r0","language":"","licenses":["BSD-3-Clause","LGPL-2.0-or-later","MIT","PHP-3.01","Zend-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/php"},{"path":"/usr/bin/php7"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"php7"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:php:php:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2021-21708","versionConstraint":">= 7.4.0, < 7.4.28||>= 8.0.0, < 8.0.16||>= 8.1.0, < 8.1.3 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:php:php:7.4.26:*:*:*:*:*:*:*"],"package":{"name":"php7","version":"7.4.26-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2021-21708","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-21708","cwe":"CWE-416","type":"Secondary","source":"security@php.net"},{"cve":"CVE-2021-21708","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-21708","date":"2026-10-08","epss":0.03002,"percentile":0.86975}],"risk":2.591726666666667,"urls":["https://bugs.php.net/bug.php?id=81708","https://security.gentoo.org/glsa/202209-20","https://security.netapp.com/advisory/ntap-20220325-0004/"],"severity":"Critical","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-21708","description":"In PHP versions 7.4.x below 7.4.28, 8.0.x below 8.0.16, and 8.1.x below 8.1.3, when using filter functions with FILTER_VALIDATE_FLOAT filter and min/max limits, if the filter fails, there is a possibility to trigger use of allocated memory after free, which can result it crashes, and potentially in overwrite of other memory chunks and RCE. This issue affects: code that uses FILTER_VALIDATE_FLOAT with min/max limits."},"relatedVulnerabilities":[]},{"artifact":{"id":"43a7af5360b6604e","cpes":["cpe:2.3:a:pcre2:pcre2:10.36-r1:*:*:*:*:*:*:*","cpe:2.3:a:pcre2:pcre:10.36-r1:*:*:*:*:*:*:*","cpe:2.3:a:pcre:pcre2:10.36-r1:*:*:*:*:*:*:*","cpe:2.3:a:pcre:pcre:10.36-r1:*:*:*:*:*:*:*"],"name":"pcre2","purl":"pkg:apk/busybox/pcre2@10.36-r1?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"10.36-r1","language":"","licenses":["BSD-3-Clause"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpcre2-8.so.0"},{"path":"/usr/lib/libpcre2-8.so.0.10.1"},{"path":"/usr/lib/libpcre2-posix.so.2"},{"path":"/usr/lib/libpcre2-posix.so.2.0.3"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"pcre2"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:pcre:pcre2:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2022-1587","versionConstraint":"< 10.40 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:pcre:pcre2:10.36:*:*:*:*:*:*:*"],"package":{"name":"pcre2","version":"10.36-r1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2022-1587","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:P","metrics":{"baseScore":6.4,"impactScore":5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-1587","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2022-1587","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-1587","date":"2026-10-08","epss":0.02767,"percentile":0.85889}],"risk":2.3173624999999998,"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=2077983%2C","https://github.com/PCRE2Project/pcre2/commit/03654e751e7f0700693526b67dfcadda6b42c9d0","https://lists.debian.org/debian-lts-announce/2023/03/msg00014.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DWNG2NS3GINO6LQYUVC4BZLUQPJ3DYHA/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JXINO3KKI5DICQ45E2FKD6MKVMGJLEKJ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KAX7767BCUFC7JMDGP7GOQ5GIZCAUGBB/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M2GLQQUEY5VFM57CFYXVIFOXN2HUZPDM/","https://security.netapp.com/advisory/ntap-20221028-0009/"],"severity":"Critical","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-1587","description":"An out-of-bounds read vulnerability was discovered in the PCRE2 library in the get_recurse_data_length() function of the pcre2_jit_compile.c file. This issue affects recursions in JIT-compiled regular expressions caused by duplicate data transfers."},"relatedVulnerabilities":[]},{"artifact":{"id":"d081de97c6f633df","cpes":["cpe:2.3:a:libcrypto1.1:libcrypto1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto1.1:libcrypto:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto:libcrypto1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto:libcrypto:1.1.1q-r0:*:*:*:*:*:*:*"],"name":"libcrypto1.1","purl":"pkg:apk/busybox/libcrypto1.1@1.1.1q-r0?arch=x86_64&distro=busybox-1.32.1&upstream=openssl","type":"apk","version":"1.1.1q-r0","language":"","licenses":["OpenSSL"],"metadata":{"Arch":"x86_64","files":[{"path":"/etc"},{"path":"/etc/ssl"},{"path":"/etc/ssl/ct_log_list.cnf"},{"path":"/etc/ssl/ct_log_list.cnf.dist"},{"path":"/etc/ssl/openssl.cnf"},{"path":"/etc/ssl/openssl.cnf.dist"},{"path":"/etc/ssl/certs"},{"path":"/etc/ssl/misc"},{"path":"/etc/ssl/misc/CA.pl"},{"path":"/etc/ssl/misc/tsget"},{"path":"/etc/ssl/misc/tsget.pl"},{"path":"/etc/ssl/private"},{"path":"/lib"},{"path":"/lib/libcrypto.so.1.1"},{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcrypto.so.1.1"},{"path":"/usr/lib/engines-1.1"},{"path":"/usr/lib/engines-1.1/afalg.so"},{"path":"/usr/lib/engines-1.1/capi.so"},{"path":"/usr/lib/engines-1.1/padlock.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2023-5678","versionConstraint":">= 1.0.2, < 1.0.2zj||>= 1.1.1, < 1.1.1x||>= 3.0.0, < 3.0.13||>= 3.1.0, < 3.1.5 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:1.1.1q:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"1.1.1q-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2023-5678","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-5678","cwe":"CWE-606","type":"Secondary","source":"openssl-security@openssl.org"},{"cve":"CVE-2023-5678","cwe":"CWE-754","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-5678","date":"2026-10-08","epss":0.04459,"percentile":0.9119}],"risk":2.296385,"urls":["https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=34efaef6c103d636ab507a0cc34dca4d3aecc055","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=710fee740904b6290fef0dd5536fbcedbc38ff0c","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=db925ae2e65d0d925adef429afc37f75bd1c2017","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=ddeb4b6c6d527e54ce9a99cba785c0f7776e54b6","https://www.openssl.org/news/secadv/20231106.txt","http://www.openwall.com/lists/oss-security/2024/03/11/1","https://lists.debian.org/debian-lts-announce/2024/10/msg00033.html","https://lists.debian.org/debian-lts-announce/2024/11/msg00000.html","https://security.netapp.com/advisory/ntap-20231130-0010/","https://cert-portal.siemens.com/productcert/html/ssa-093430.html","https://cert-portal.siemens.com/productcert/html/ssa-128433.html","https://cert-portal.siemens.com/productcert/html/ssa-265688.html","https://cert-portal.siemens.com/productcert/html/ssa-277137.html","https://cert-portal.siemens.com/productcert/html/ssa-331112.html","https://cert-portal.siemens.com/productcert/html/ssa-341067.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html","https://cert-portal.siemens.com/productcert/html/ssa-556635.html","https://cert-portal.siemens.com/productcert/html/ssa-613116.html","https://cert-portal.siemens.com/productcert/html/ssa-769027.html","https://cert-portal.siemens.com/productcert/html/ssa-794697.html","https://cert-portal.siemens.com/productcert/html/ssa-915275.html"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-5678","description":"Issue summary: Generating excessively long X9.42 DH keys or checking\nexcessively long X9.42 DH keys or parameters may be very slow.\n\nImpact summary: Applications that use the functions DH_generate_key() to\ngenerate an X9.42 DH key may experience long delays.  Likewise, applications\nthat use DH_check_pub_key(), DH_check_pub_key_ex() or EVP_PKEY_public_check()\nto check an X9.42 DH key or X9.42 DH parameters may experience long delays.\nWhere the key or parameters that are being checked have been obtained from\nan untrusted source this may lead to a Denial of Service.\n\nWhile DH_check() performs all the necessary checks (as of CVE-2023-3817),\nDH_check_pub_key() doesn't make any of these checks, and is therefore\nvulnerable for excessively large P and Q parameters.\n\nLikewise, while DH_generate_key() performs a check for an excessively large\nP, it doesn't check for an excessively large Q.\n\nAn application that calls DH_generate_key() or DH_check_pub_key() and\nsupplies a key or parameters obtained from an untrusted source could be\nvulnerable to a Denial of Service attack.\n\nDH_generate_key() and DH_check_pub_key() are also called by a number of\nother OpenSSL functions.  An application calling any of those other\nfunctions may similarly be affected.  The other functions affected by this\nare DH_check_pub_key_ex(), EVP_PKEY_public_check(), and EVP_PKEY_generate().\n\nAlso vulnerable are the OpenSSL pkey command line application when using the\n\"-pubcheck\" option, as well as the OpenSSL genpkey command line application.\n\nThe OpenSSL SSL/TLS implementation is not affected by this issue.\n\nThe OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue."},"relatedVulnerabilities":[]},{"artifact":{"id":"74f4e71ff41d2d68","cpes":["cpe:2.3:a:libssl1.1:libssl1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl1.1:libssl:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl:1.1.1q-r0:*:*:*:*:*:*:*"],"name":"libssl1.1","purl":"pkg:apk/busybox/libssl1.1@1.1.1q-r0?arch=x86_64&distro=busybox-1.32.1&upstream=openssl","type":"apk","version":"1.1.1q-r0","language":"","licenses":["OpenSSL"],"metadata":{"Arch":"x86_64","files":[{"path":"/lib"},{"path":"/lib/libssl.so.1.1"},{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libssl.so.1.1"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2023-5678","versionConstraint":">= 1.0.2, < 1.0.2zj||>= 1.1.1, < 1.1.1x||>= 3.0.0, < 3.0.13||>= 3.1.0, < 3.1.5 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:1.1.1q:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"1.1.1q-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2023-5678","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-5678","cwe":"CWE-606","type":"Secondary","source":"openssl-security@openssl.org"},{"cve":"CVE-2023-5678","cwe":"CWE-754","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-5678","date":"2026-10-08","epss":0.04459,"percentile":0.9119}],"risk":2.296385,"urls":["https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=34efaef6c103d636ab507a0cc34dca4d3aecc055","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=710fee740904b6290fef0dd5536fbcedbc38ff0c","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=db925ae2e65d0d925adef429afc37f75bd1c2017","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=ddeb4b6c6d527e54ce9a99cba785c0f7776e54b6","https://www.openssl.org/news/secadv/20231106.txt","http://www.openwall.com/lists/oss-security/2024/03/11/1","https://lists.debian.org/debian-lts-announce/2024/10/msg00033.html","https://lists.debian.org/debian-lts-announce/2024/11/msg00000.html","https://security.netapp.com/advisory/ntap-20231130-0010/","https://cert-portal.siemens.com/productcert/html/ssa-093430.html","https://cert-portal.siemens.com/productcert/html/ssa-128433.html","https://cert-portal.siemens.com/productcert/html/ssa-265688.html","https://cert-portal.siemens.com/productcert/html/ssa-277137.html","https://cert-portal.siemens.com/productcert/html/ssa-331112.html","https://cert-portal.siemens.com/productcert/html/ssa-341067.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html","https://cert-portal.siemens.com/productcert/html/ssa-556635.html","https://cert-portal.siemens.com/productcert/html/ssa-613116.html","https://cert-portal.siemens.com/productcert/html/ssa-769027.html","https://cert-portal.siemens.com/productcert/html/ssa-794697.html","https://cert-portal.siemens.com/productcert/html/ssa-915275.html"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-5678","description":"Issue summary: Generating excessively long X9.42 DH keys or checking\nexcessively long X9.42 DH keys or parameters may be very slow.\n\nImpact summary: Applications that use the functions DH_generate_key() to\ngenerate an X9.42 DH key may experience long delays.  Likewise, applications\nthat use DH_check_pub_key(), DH_check_pub_key_ex() or EVP_PKEY_public_check()\nto check an X9.42 DH key or X9.42 DH parameters may experience long delays.\nWhere the key or parameters that are being checked have been obtained from\nan untrusted source this may lead to a Denial of Service.\n\nWhile DH_check() performs all the necessary checks (as of CVE-2023-3817),\nDH_check_pub_key() doesn't make any of these checks, and is therefore\nvulnerable for excessively large P and Q parameters.\n\nLikewise, while DH_generate_key() performs a check for an excessively large\nP, it doesn't check for an excessively large Q.\n\nAn application that calls DH_generate_key() or DH_check_pub_key() and\nsupplies a key or parameters obtained from an untrusted source could be\nvulnerable to a Denial of Service attack.\n\nDH_generate_key() and DH_check_pub_key() are also called by a number of\nother OpenSSL functions.  An application calling any of those other\nfunctions may similarly be affected.  The other functions affected by this\nare DH_check_pub_key_ex(), EVP_PKEY_public_check(), and EVP_PKEY_generate().\n\nAlso vulnerable are the OpenSSL pkey command line application when using the\n\"-pubcheck\" option, as well as the OpenSSL genpkey command line application.\n\nThe OpenSSL SSL/TLS implementation is not affected by this issue.\n\nThe OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue."},"relatedVulnerabilities":[]},{"artifact":{"id":"14807b4f7067817d","cpes":["cpe:2.3:a:openssl:openssl:1.1.1q-r0:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:apk/busybox/openssl@1.1.1q-r0?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"1.1.1q-r0","language":"","licenses":["OpenSSL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/openssl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2023-5678","versionConstraint":">= 1.0.2, < 1.0.2zj||>= 1.1.1, < 1.1.1x||>= 3.0.0, < 3.0.13||>= 3.1.0, < 3.1.5 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:1.1.1q:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"1.1.1q-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2023-5678","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-5678","cwe":"CWE-606","type":"Secondary","source":"openssl-security@openssl.org"},{"cve":"CVE-2023-5678","cwe":"CWE-754","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-5678","date":"2026-10-08","epss":0.04459,"percentile":0.9119}],"risk":2.296385,"urls":["https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=34efaef6c103d636ab507a0cc34dca4d3aecc055","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=710fee740904b6290fef0dd5536fbcedbc38ff0c","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=db925ae2e65d0d925adef429afc37f75bd1c2017","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=ddeb4b6c6d527e54ce9a99cba785c0f7776e54b6","https://www.openssl.org/news/secadv/20231106.txt","http://www.openwall.com/lists/oss-security/2024/03/11/1","https://lists.debian.org/debian-lts-announce/2024/10/msg00033.html","https://lists.debian.org/debian-lts-announce/2024/11/msg00000.html","https://security.netapp.com/advisory/ntap-20231130-0010/","https://cert-portal.siemens.com/productcert/html/ssa-093430.html","https://cert-portal.siemens.com/productcert/html/ssa-128433.html","https://cert-portal.siemens.com/productcert/html/ssa-265688.html","https://cert-portal.siemens.com/productcert/html/ssa-277137.html","https://cert-portal.siemens.com/productcert/html/ssa-331112.html","https://cert-portal.siemens.com/productcert/html/ssa-341067.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html","https://cert-portal.siemens.com/productcert/html/ssa-556635.html","https://cert-portal.siemens.com/productcert/html/ssa-613116.html","https://cert-portal.siemens.com/productcert/html/ssa-769027.html","https://cert-portal.siemens.com/productcert/html/ssa-794697.html","https://cert-portal.siemens.com/productcert/html/ssa-915275.html"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-5678","description":"Issue summary: Generating excessively long X9.42 DH keys or checking\nexcessively long X9.42 DH keys or parameters may be very slow.\n\nImpact summary: Applications that use the functions DH_generate_key() to\ngenerate an X9.42 DH key may experience long delays.  Likewise, applications\nthat use DH_check_pub_key(), DH_check_pub_key_ex() or EVP_PKEY_public_check()\nto check an X9.42 DH key or X9.42 DH parameters may experience long delays.\nWhere the key or parameters that are being checked have been obtained from\nan untrusted source this may lead to a Denial of Service.\n\nWhile DH_check() performs all the necessary checks (as of CVE-2023-3817),\nDH_check_pub_key() doesn't make any of these checks, and is therefore\nvulnerable for excessively large P and Q parameters.\n\nLikewise, while DH_generate_key() performs a check for an excessively large\nP, it doesn't check for an excessively large Q.\n\nAn application that calls DH_generate_key() or DH_check_pub_key() and\nsupplies a key or parameters obtained from an untrusted source could be\nvulnerable to a Denial of Service attack.\n\nDH_generate_key() and DH_check_pub_key() are also called by a number of\nother OpenSSL functions.  An application calling any of those other\nfunctions may similarly be affected.  The other functions affected by this\nare DH_check_pub_key_ex(), EVP_PKEY_public_check(), and EVP_PKEY_generate().\n\nAlso vulnerable are the OpenSSL pkey command line application when using the\n\"-pubcheck\" option, as well as the OpenSSL genpkey command line application.\n\nThe OpenSSL SSL/TLS implementation is not affected by this issue.\n\nThe OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue."},"relatedVulnerabilities":[]},{"artifact":{"id":"6040784032e8795c","cpes":["cpe:2.3:a:curl:curl:7.79.1-r3:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:7.79.1-r3:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/busybox/curl@7.79.1-r3?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"7.79.1-r3","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2022-42915","versionConstraint":">= 7.77.0, < 7.86.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:haxx:curl:7.79.1:*:*:*:*:*:*:*"],"package":{"name":"curl","version":"7.79.1-r3"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2022-42915","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-42915","cwe":"CWE-415","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-42915","cwe":"CWE-415","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-42915","date":"2026-10-08","epss":0.02926,"percentile":0.86658}],"risk":2.28228,"urls":["http://seclists.org/fulldisclosure/2023/Jan/19","http://seclists.org/fulldisclosure/2023/Jan/20","https://curl.se/docs/CVE-2022-42915.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/37YEVVC6NAF6H7UHH6YAUY5QEVY6LIH2/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HVU3IMZCKR4VE6KJ4GCWRL2ILLC6OV76/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Q27V5YYMXUVI6PRZQVECON32XPVWTKDK/","https://security.gentoo.org/glsa/202212-01","https://security.netapp.com/advisory/ntap-20221209-0010/","https://support.apple.com/kb/HT213604","https://support.apple.com/kb/HT213605"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-42915","description":"curl before 7.86.0 has a double free. If curl is told to use an HTTP proxy for a transfer with a non-HTTP(S) URL, it sets up the connection to the remote server by issuing a CONNECT request to the proxy, and then tunnels the rest of the protocol through. An HTTP proxy might refuse this request (HTTP proxies often only allow outgoing connections to specific port numbers, like 443 for HTTPS) and instead return a non-200 status code to the client. Due to flaws in the error/cleanup handling, this could trigger a double free in curl if one of the following schemes were used in the URL for the transfer: dict, gopher, gophers, ldap, ldaps, rtmp, rtmps, or telnet. The earliest affected version is 7.77.0."},"relatedVulnerabilities":[]},{"artifact":{"id":"6040784032e8795c","cpes":["cpe:2.3:a:curl:curl:7.79.1-r3:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:7.79.1-r3:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/busybox/curl@7.79.1-r3?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"7.79.1-r3","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2022-27775","versionConstraint":">= 7.65.0, < 7.83.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:haxx:curl:7.79.1:*:*:*:*:*:*:*"],"package":{"name":"curl","version":"7.79.1-r3"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2022-27775","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-27775","cwe":"CWE-200","type":"Secondary","source":"support@hackerone.com"}],"epss":[{"cve":"CVE-2022-27775","date":"2026-10-08","epss":0.03154,"percentile":0.87575}],"risk":2.2340833333333334,"urls":["https://hackerone.com/reports/1546268","https://security.gentoo.org/glsa/202212-01","https://security.netapp.com/advisory/ntap-20220609-0008/","https://www.debian.org/security/2022/dsa-5197","https://advisory.splunk.com/advisories/SVD-2023-0809","https://curl.se/docs/CVE-2022-27775.json"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-27775","description":"An information disclosure vulnerability exists in curl 7.65.0 to 7.82.0 are vulnerable that by using an IPv6 address that was in the connection pool but with a different zone id it could reuse a connection instead."},"relatedVulnerabilities":[]},{"artifact":{"id":"90f72c5b07fcdbc9","cpes":["cpe:2.3:a:busybox:busybox:1.32.1-r9:*:*:*:*:*:*:*"],"name":"busybox","purl":"pkg:apk/busybox/busybox@1.32.1-r9?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"1.32.1-r9","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/bin"},{"path":"/bin/busybox"},{"path":"/bin/sh"},{"path":"/etc"},{"path":"/etc/securetty"},{"path":"/etc/udhcpd.conf"},{"path":"/etc/logrotate.d"},{"path":"/etc/logrotate.d/acpid"},{"path":"/etc/network"},{"path":"/etc/network/if-down.d"},{"path":"/etc/network/if-post-down.d"},{"path":"/etc/network/if-post-up.d"},{"path":"/etc/network/if-pre-down.d"},{"path":"/etc/network/if-pre-up.d"},{"path":"/etc/network/if-up.d"},{"path":"/etc/network/if-up.d/dad"},{"path":"/sbin"},{"path":"/tmp"},{"path":"/usr"},{"path":"/usr/sbin"},{"path":"/usr/share"},{"path":"/usr/share/udhcpc"},{"path":"/usr/share/udhcpc/default.script"},{"path":"/var"},{"path":"/var/cache"},{"path":"/var/cache/misc"},{"path":"/var/lib"},{"path":"/var/lib/udhcpd"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"busybox"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:busybox:busybox:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2021-42380","versionConstraint":">= 1.28.0, <= 1.33.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:busybox:busybox:1.32.1:*:*:*:*:*:*:*"],"package":{"name":"busybox","version":"1.32.1-r9"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2021-42380","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","metrics":{"baseScore":6.5,"impactScore":6.5,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-42380","cwe":"CWE-416","type":"Secondary","source":"reefs@jfrog.com"},{"cve":"CVE-2021-42380","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-42380","date":"2026-10-08","epss":0.03087,"percentile":0.87321}],"risk":2.23293,"urls":["https://claroty.com/team82/research/unboxing-busybox-14-vulnerabilities-uncovered-by-claroty-jfrog","https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/","https://security.netapp.com/advisory/ntap-20211223-0002/","https://lists.debian.org/debian-lts-announce/2025/01/msg00012.html"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-42380","description":"A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the clrvar function"},"relatedVulnerabilities":[]},{"artifact":{"id":"35fec91b9e067f61","cpes":["cpe:2.3:a:ssl-client:ssl-client:1.32.1-r9:*:*:*:*:*:*:*","cpe:2.3:a:ssl-client:ssl_client:1.32.1-r9:*:*:*:*:*:*:*","cpe:2.3:a:ssl_client:ssl-client:1.32.1-r9:*:*:*:*:*:*:*","cpe:2.3:a:ssl_client:ssl_client:1.32.1-r9:*:*:*:*:*:*:*","cpe:2.3:a:ssl:ssl-client:1.32.1-r9:*:*:*:*:*:*:*","cpe:2.3:a:ssl:ssl_client:1.32.1-r9:*:*:*:*:*:*:*"],"name":"ssl_client","purl":"pkg:apk/busybox/ssl_client@1.32.1-r9?arch=x86_64&distro=busybox-1.32.1&upstream=busybox","type":"apk","version":"1.32.1-r9","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/ssl_client"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"busybox"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:busybox:busybox:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2021-42380","versionConstraint":">= 1.28.0, <= 1.33.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:busybox:busybox:1.32.1:*:*:*:*:*:*:*"],"package":{"name":"busybox","version":"1.32.1-r9"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2021-42380","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","metrics":{"baseScore":6.5,"impactScore":6.5,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-42380","cwe":"CWE-416","type":"Secondary","source":"reefs@jfrog.com"},{"cve":"CVE-2021-42380","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-42380","date":"2026-10-08","epss":0.03087,"percentile":0.87321}],"risk":2.23293,"urls":["https://claroty.com/team82/research/unboxing-busybox-14-vulnerabilities-uncovered-by-claroty-jfrog","https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/","https://security.netapp.com/advisory/ntap-20211223-0002/","https://lists.debian.org/debian-lts-announce/2025/01/msg00012.html"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-42380","description":"A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the clrvar function"},"relatedVulnerabilities":[]},{"artifact":{"id":"d081de97c6f633df","cpes":["cpe:2.3:a:libcrypto1.1:libcrypto1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto1.1:libcrypto:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto:libcrypto1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto:libcrypto:1.1.1q-r0:*:*:*:*:*:*:*"],"name":"libcrypto1.1","purl":"pkg:apk/busybox/libcrypto1.1@1.1.1q-r0?arch=x86_64&distro=busybox-1.32.1&upstream=openssl","type":"apk","version":"1.1.1q-r0","language":"","licenses":["OpenSSL"],"metadata":{"Arch":"x86_64","files":[{"path":"/etc"},{"path":"/etc/ssl"},{"path":"/etc/ssl/ct_log_list.cnf"},{"path":"/etc/ssl/ct_log_list.cnf.dist"},{"path":"/etc/ssl/openssl.cnf"},{"path":"/etc/ssl/openssl.cnf.dist"},{"path":"/etc/ssl/certs"},{"path":"/etc/ssl/misc"},{"path":"/etc/ssl/misc/CA.pl"},{"path":"/etc/ssl/misc/tsget"},{"path":"/etc/ssl/misc/tsget.pl"},{"path":"/etc/ssl/private"},{"path":"/lib"},{"path":"/lib/libcrypto.so.1.1"},{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcrypto.so.1.1"},{"path":"/usr/lib/engines-1.1"},{"path":"/usr/lib/engines-1.1/afalg.so"},{"path":"/usr/lib/engines-1.1/capi.so"},{"path":"/usr/lib/engines-1.1/padlock.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2024-4741","versionConstraint":">= 1.1.1, < 1.1.1y||>= 3.0.0, < 3.0.14||>= 3.1.0, < 3.1.6||>= 3.2.0, < 3.2.2||>= 3.3.0, < 3.3.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:1.1.1q:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"1.1.1q-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2024-4741","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-4741","cwe":"CWE-416","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2024-4741","date":"2026-10-08","epss":0.02925,"percentile":0.86654}],"risk":2.19375,"urls":["https://github.com/openssl/openssl/commit/704f725b96aa373ee45ecfb23f6abfe8be8d9177","https://github.com/openssl/openssl/commit/b3f0eb0a295f58f16ba43ba99dad70d4ee5c437d","https://github.com/openssl/openssl/commit/c88c3de51020c37e8706bf7a682a162593053aac","https://github.com/openssl/openssl/commit/e5093133c35ca82874ad83697af76f4b0f7e3bd8","https://github.openssl.org/openssl/extended-releases/commit/f7a045f3143fc6da2ee66bf52d8df04829590dd4","https://www.openssl.org/news/secadv/20240528.txt","https://lists.debian.org/debian-lts-announce/2024/10/msg00033.html","https://lists.debian.org/debian-lts-announce/2024/11/msg00000.html","https://security.netapp.com/advisory/ntap-20240621-0004/"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-4741","description":"Issue summary: Calling the OpenSSL API function SSL_free_buffers may cause\nmemory to be accessed that was previously freed in some situations\n\nImpact summary: A use after free can have a range of potential consequences such\nas the corruption of valid data, crashes or execution of arbitrary code.\nHowever, only applications that directly call the SSL_free_buffers function are\naffected by this issue. Applications that do not call this function are not\nvulnerable. Our investigations indicate that this function is rarely used by\napplications.\n\nThe SSL_free_buffers function is used to free the internal OpenSSL buffer used\nwhen processing an incoming record from the network. The call is only expected\nto succeed if the buffer is not currently in use. However, two scenarios have\nbeen identified where the buffer is freed even when still in use.\n\nThe first scenario occurs where a record header has been received from the\nnetwork and processed by OpenSSL, but the full record body has not yet arrived.\nIn this case calling SSL_free_buffers will succeed even though a record has only\nbeen partially processed and the buffer is still in use.\n\nThe second scenario occurs where a full record containing application data has\nbeen received and processed by OpenSSL but the application has only read part of\nthis data. Again a call to SSL_free_buffers will succeed even though the buffer\nis still in use.\n\nWhile these scenarios could occur accidentally during normal operation a\nmalicious attacker could attempt to engineer a stituation where this occurs.\nWe are not aware of this issue being actively exploited.\n\nThe FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue."},"relatedVulnerabilities":[]},{"artifact":{"id":"74f4e71ff41d2d68","cpes":["cpe:2.3:a:libssl1.1:libssl1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl1.1:libssl:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl:1.1.1q-r0:*:*:*:*:*:*:*"],"name":"libssl1.1","purl":"pkg:apk/busybox/libssl1.1@1.1.1q-r0?arch=x86_64&distro=busybox-1.32.1&upstream=openssl","type":"apk","version":"1.1.1q-r0","language":"","licenses":["OpenSSL"],"metadata":{"Arch":"x86_64","files":[{"path":"/lib"},{"path":"/lib/libssl.so.1.1"},{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libssl.so.1.1"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2024-4741","versionConstraint":">= 1.1.1, < 1.1.1y||>= 3.0.0, < 3.0.14||>= 3.1.0, < 3.1.6||>= 3.2.0, < 3.2.2||>= 3.3.0, < 3.3.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:1.1.1q:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"1.1.1q-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2024-4741","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-4741","cwe":"CWE-416","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2024-4741","date":"2026-10-08","epss":0.02925,"percentile":0.86654}],"risk":2.19375,"urls":["https://github.com/openssl/openssl/commit/704f725b96aa373ee45ecfb23f6abfe8be8d9177","https://github.com/openssl/openssl/commit/b3f0eb0a295f58f16ba43ba99dad70d4ee5c437d","https://github.com/openssl/openssl/commit/c88c3de51020c37e8706bf7a682a162593053aac","https://github.com/openssl/openssl/commit/e5093133c35ca82874ad83697af76f4b0f7e3bd8","https://github.openssl.org/openssl/extended-releases/commit/f7a045f3143fc6da2ee66bf52d8df04829590dd4","https://www.openssl.org/news/secadv/20240528.txt","https://lists.debian.org/debian-lts-announce/2024/10/msg00033.html","https://lists.debian.org/debian-lts-announce/2024/11/msg00000.html","https://security.netapp.com/advisory/ntap-20240621-0004/"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-4741","description":"Issue summary: Calling the OpenSSL API function SSL_free_buffers may cause\nmemory to be accessed that was previously freed in some situations\n\nImpact summary: A use after free can have a range of potential consequences such\nas the corruption of valid data, crashes or execution of arbitrary code.\nHowever, only applications that directly call the SSL_free_buffers function are\naffected by this issue. Applications that do not call this function are not\nvulnerable. Our investigations indicate that this function is rarely used by\napplications.\n\nThe SSL_free_buffers function is used to free the internal OpenSSL buffer used\nwhen processing an incoming record from the network. The call is only expected\nto succeed if the buffer is not currently in use. However, two scenarios have\nbeen identified where the buffer is freed even when still in use.\n\nThe first scenario occurs where a record header has been received from the\nnetwork and processed by OpenSSL, but the full record body has not yet arrived.\nIn this case calling SSL_free_buffers will succeed even though a record has only\nbeen partially processed and the buffer is still in use.\n\nThe second scenario occurs where a full record containing application data has\nbeen received and processed by OpenSSL but the application has only read part of\nthis data. Again a call to SSL_free_buffers will succeed even though the buffer\nis still in use.\n\nWhile these scenarios could occur accidentally during normal operation a\nmalicious attacker could attempt to engineer a stituation where this occurs.\nWe are not aware of this issue being actively exploited.\n\nThe FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue."},"relatedVulnerabilities":[]},{"artifact":{"id":"14807b4f7067817d","cpes":["cpe:2.3:a:openssl:openssl:1.1.1q-r0:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:apk/busybox/openssl@1.1.1q-r0?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"1.1.1q-r0","language":"","licenses":["OpenSSL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/openssl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2024-4741","versionConstraint":">= 1.1.1, < 1.1.1y||>= 3.0.0, < 3.0.14||>= 3.1.0, < 3.1.6||>= 3.2.0, < 3.2.2||>= 3.3.0, < 3.3.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:1.1.1q:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"1.1.1q-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2024-4741","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-4741","cwe":"CWE-416","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2024-4741","date":"2026-10-08","epss":0.02925,"percentile":0.86654}],"risk":2.19375,"urls":["https://github.com/openssl/openssl/commit/704f725b96aa373ee45ecfb23f6abfe8be8d9177","https://github.com/openssl/openssl/commit/b3f0eb0a295f58f16ba43ba99dad70d4ee5c437d","https://github.com/openssl/openssl/commit/c88c3de51020c37e8706bf7a682a162593053aac","https://github.com/openssl/openssl/commit/e5093133c35ca82874ad83697af76f4b0f7e3bd8","https://github.openssl.org/openssl/extended-releases/commit/f7a045f3143fc6da2ee66bf52d8df04829590dd4","https://www.openssl.org/news/secadv/20240528.txt","https://lists.debian.org/debian-lts-announce/2024/10/msg00033.html","https://lists.debian.org/debian-lts-announce/2024/11/msg00000.html","https://security.netapp.com/advisory/ntap-20240621-0004/"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-4741","description":"Issue summary: Calling the OpenSSL API function SSL_free_buffers may cause\nmemory to be accessed that was previously freed in some situations\n\nImpact summary: A use after free can have a range of potential consequences such\nas the corruption of valid data, crashes or execution of arbitrary code.\nHowever, only applications that directly call the SSL_free_buffers function are\naffected by this issue. Applications that do not call this function are not\nvulnerable. Our investigations indicate that this function is rarely used by\napplications.\n\nThe SSL_free_buffers function is used to free the internal OpenSSL buffer used\nwhen processing an incoming record from the network. The call is only expected\nto succeed if the buffer is not currently in use. However, two scenarios have\nbeen identified where the buffer is freed even when still in use.\n\nThe first scenario occurs where a record header has been received from the\nnetwork and processed by OpenSSL, but the full record body has not yet arrived.\nIn this case calling SSL_free_buffers will succeed even though a record has only\nbeen partially processed and the buffer is still in use.\n\nThe second scenario occurs where a full record containing application data has\nbeen received and processed by OpenSSL but the application has only read part of\nthis data. Again a call to SSL_free_buffers will succeed even though the buffer\nis still in use.\n\nWhile these scenarios could occur accidentally during normal operation a\nmalicious attacker could attempt to engineer a stituation where this occurs.\nWe are not aware of this issue being actively exploited.\n\nThe FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue."},"relatedVulnerabilities":[]},{"artifact":{"id":"6040784032e8795c","cpes":["cpe:2.3:a:curl:curl:7.79.1-r3:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:7.79.1-r3:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/busybox/curl@7.79.1-r3?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"7.79.1-r3","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2022-27782","versionConstraint":"< 7.83.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:haxx:curl:7.79.1:*:*:*:*:*:*:*"],"package":{"name":"curl","version":"7.79.1-r3"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2022-27782","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-27782","cwe":"CWE-840","type":"Secondary","source":"support@hackerone.com"},{"cve":"CVE-2022-27782","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-27782","date":"2026-10-08","epss":0.0293,"percentile":0.86676}],"risk":2.075416666666667,"urls":["http://www.openwall.com/lists/oss-security/2023/03/20/6","https://hackerone.com/reports/1555796","https://lists.debian.org/debian-lts-announce/2022/08/msg00017.html","https://security.gentoo.org/glsa/202212-01","https://security.netapp.com/advisory/ntap-20220609-0009/","https://www.debian.org/security/2022/dsa-5197"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-27782","description":"libcurl would reuse a previously created connection even when a TLS or SSHrelated option had been changed that should have prohibited reuse.libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse if one of them matches the setup. However, several TLS andSSH settings were left out from the configuration match checks, making themmatch too easily."},"relatedVulnerabilities":[]},{"artifact":{"id":"a45c752c9b8878aa","cpes":["cpe:2.3:a:php7:php7:7.4.26-r0:*:*:*:*:*:*:*","cpe:2.3:a:php7:php:7.4.26-r0:*:*:*:*:*:*:*","cpe:2.3:a:php:php7:7.4.26-r0:*:*:*:*:*:*:*","cpe:2.3:a:php:php:7.4.26-r0:*:*:*:*:*:*:*"],"name":"php7","purl":"pkg:apk/busybox/php7@7.4.26-r0?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"7.4.26-r0","language":"","licenses":["BSD-3-Clause","LGPL-2.0-or-later","MIT","PHP-3.01","Zend-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/php"},{"path":"/usr/bin/php7"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"php7"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:php:php:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2017-9118","versionConstraint":">= 7.4.0, < 7.4.27||>= 8.0.0, < 8.0.14||>= 8.1.0, < 8.1.1||= 7.1.5 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:php:php:7.4.26:*:*:*:*:*:*:*"],"package":{"name":"php7","version":"7.4.26-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2017-9118","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-9118","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-9118","date":"2026-10-08","epss":0.02954,"percentile":0.86773}],"risk":2.030875,"urls":["https://access.redhat.com/errata/RHSA-2019:2519","https://bugs.php.net/bug.php?id=74604","https://security.netapp.com/advisory/ntap-20181107-0003/"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-9118","description":"PHP 7.1.5 has an Out of bounds access in php_pcre_replace_impl via a crafted preg_replace call."},"relatedVulnerabilities":[]},{"artifact":{"id":"90f72c5b07fcdbc9","cpes":["cpe:2.3:a:busybox:busybox:1.32.1-r9:*:*:*:*:*:*:*"],"name":"busybox","purl":"pkg:apk/busybox/busybox@1.32.1-r9?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"1.32.1-r9","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/bin"},{"path":"/bin/busybox"},{"path":"/bin/sh"},{"path":"/etc"},{"path":"/etc/securetty"},{"path":"/etc/udhcpd.conf"},{"path":"/etc/logrotate.d"},{"path":"/etc/logrotate.d/acpid"},{"path":"/etc/network"},{"path":"/etc/network/if-down.d"},{"path":"/etc/network/if-post-down.d"},{"path":"/etc/network/if-post-up.d"},{"path":"/etc/network/if-pre-down.d"},{"path":"/etc/network/if-pre-up.d"},{"path":"/etc/network/if-up.d"},{"path":"/etc/network/if-up.d/dad"},{"path":"/sbin"},{"path":"/tmp"},{"path":"/usr"},{"path":"/usr/sbin"},{"path":"/usr/share"},{"path":"/usr/share/udhcpc"},{"path":"/usr/share/udhcpc/default.script"},{"path":"/var"},{"path":"/var/cache"},{"path":"/var/cache/misc"},{"path":"/var/lib"},{"path":"/var/lib/udhcpd"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"busybox"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:busybox:busybox:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2021-42379","versionConstraint":">= 1.18.0, <= 1.33.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:busybox:busybox:1.32.1:*:*:*:*:*:*:*"],"package":{"name":"busybox","version":"1.32.1-r9"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2021-42379","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","metrics":{"baseScore":6.5,"impactScore":6.5,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-42379","cwe":"CWE-416","type":"Secondary","source":"reefs@jfrog.com"},{"cve":"CVE-2021-42379","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-42379","date":"2026-10-08","epss":0.02795,"percentile":0.86024}],"risk":2.0217166666666664,"urls":["https://claroty.com/team82/research/unboxing-busybox-14-vulnerabilities-uncovered-by-claroty-jfrog","https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/","https://security.netapp.com/advisory/ntap-20211223-0002/","https://lists.debian.org/debian-lts-announce/2025/01/msg00012.html"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-42379","description":"A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the next_input_file function"},"relatedVulnerabilities":[]},{"artifact":{"id":"90f72c5b07fcdbc9","cpes":["cpe:2.3:a:busybox:busybox:1.32.1-r9:*:*:*:*:*:*:*"],"name":"busybox","purl":"pkg:apk/busybox/busybox@1.32.1-r9?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"1.32.1-r9","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/bin"},{"path":"/bin/busybox"},{"path":"/bin/sh"},{"path":"/etc"},{"path":"/etc/securetty"},{"path":"/etc/udhcpd.conf"},{"path":"/etc/logrotate.d"},{"path":"/etc/logrotate.d/acpid"},{"path":"/etc/network"},{"path":"/etc/network/if-down.d"},{"path":"/etc/network/if-post-down.d"},{"path":"/etc/network/if-post-up.d"},{"path":"/etc/network/if-pre-down.d"},{"path":"/etc/network/if-pre-up.d"},{"path":"/etc/network/if-up.d"},{"path":"/etc/network/if-up.d/dad"},{"path":"/sbin"},{"path":"/tmp"},{"path":"/usr"},{"path":"/usr/sbin"},{"path":"/usr/share"},{"path":"/usr/share/udhcpc"},{"path":"/usr/share/udhcpc/default.script"},{"path":"/var"},{"path":"/var/cache"},{"path":"/var/cache/misc"},{"path":"/var/lib"},{"path":"/var/lib/udhcpd"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"busybox"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:busybox:busybox:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2021-42381","versionConstraint":">= 1.21.0, <= 1.33.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:busybox:busybox:1.32.1:*:*:*:*:*:*:*"],"package":{"name":"busybox","version":"1.32.1-r9"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2021-42381","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","metrics":{"baseScore":6.5,"impactScore":6.5,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-42381","cwe":"CWE-416","type":"Secondary","source":"reefs@jfrog.com"},{"cve":"CVE-2021-42381","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-42381","date":"2026-10-08","epss":0.02795,"percentile":0.86024}],"risk":2.0217166666666664,"urls":["https://claroty.com/team82/research/unboxing-busybox-14-vulnerabilities-uncovered-by-claroty-jfrog","https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/","https://security.netapp.com/advisory/ntap-20211223-0002/","https://lists.debian.org/debian-lts-announce/2025/01/msg00012.html"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-42381","description":"A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the hash_init function"},"relatedVulnerabilities":[]},{"artifact":{"id":"35fec91b9e067f61","cpes":["cpe:2.3:a:ssl-client:ssl-client:1.32.1-r9:*:*:*:*:*:*:*","cpe:2.3:a:ssl-client:ssl_client:1.32.1-r9:*:*:*:*:*:*:*","cpe:2.3:a:ssl_client:ssl-client:1.32.1-r9:*:*:*:*:*:*:*","cpe:2.3:a:ssl_client:ssl_client:1.32.1-r9:*:*:*:*:*:*:*","cpe:2.3:a:ssl:ssl-client:1.32.1-r9:*:*:*:*:*:*:*","cpe:2.3:a:ssl:ssl_client:1.32.1-r9:*:*:*:*:*:*:*"],"name":"ssl_client","purl":"pkg:apk/busybox/ssl_client@1.32.1-r9?arch=x86_64&distro=busybox-1.32.1&upstream=busybox","type":"apk","version":"1.32.1-r9","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/ssl_client"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"busybox"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:busybox:busybox:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2021-42379","versionConstraint":">= 1.18.0, <= 1.33.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:busybox:busybox:1.32.1:*:*:*:*:*:*:*"],"package":{"name":"busybox","version":"1.32.1-r9"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2021-42379","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","metrics":{"baseScore":6.5,"impactScore":6.5,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-42379","cwe":"CWE-416","type":"Secondary","source":"reefs@jfrog.com"},{"cve":"CVE-2021-42379","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-42379","date":"2026-10-08","epss":0.02795,"percentile":0.86024}],"risk":2.0217166666666664,"urls":["https://claroty.com/team82/research/unboxing-busybox-14-vulnerabilities-uncovered-by-claroty-jfrog","https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/","https://security.netapp.com/advisory/ntap-20211223-0002/","https://lists.debian.org/debian-lts-announce/2025/01/msg00012.html"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-42379","description":"A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the next_input_file function"},"relatedVulnerabilities":[]},{"artifact":{"id":"35fec91b9e067f61","cpes":["cpe:2.3:a:ssl-client:ssl-client:1.32.1-r9:*:*:*:*:*:*:*","cpe:2.3:a:ssl-client:ssl_client:1.32.1-r9:*:*:*:*:*:*:*","cpe:2.3:a:ssl_client:ssl-client:1.32.1-r9:*:*:*:*:*:*:*","cpe:2.3:a:ssl_client:ssl_client:1.32.1-r9:*:*:*:*:*:*:*","cpe:2.3:a:ssl:ssl-client:1.32.1-r9:*:*:*:*:*:*:*","cpe:2.3:a:ssl:ssl_client:1.32.1-r9:*:*:*:*:*:*:*"],"name":"ssl_client","purl":"pkg:apk/busybox/ssl_client@1.32.1-r9?arch=x86_64&distro=busybox-1.32.1&upstream=busybox","type":"apk","version":"1.32.1-r9","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/ssl_client"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"busybox"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:busybox:busybox:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2021-42381","versionConstraint":">= 1.21.0, <= 1.33.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:busybox:busybox:1.32.1:*:*:*:*:*:*:*"],"package":{"name":"busybox","version":"1.32.1-r9"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2021-42381","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","metrics":{"baseScore":6.5,"impactScore":6.5,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-42381","cwe":"CWE-416","type":"Secondary","source":"reefs@jfrog.com"},{"cve":"CVE-2021-42381","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-42381","date":"2026-10-08","epss":0.02795,"percentile":0.86024}],"risk":2.0217166666666664,"urls":["https://claroty.com/team82/research/unboxing-busybox-14-vulnerabilities-uncovered-by-claroty-jfrog","https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/","https://security.netapp.com/advisory/ntap-20211223-0002/","https://lists.debian.org/debian-lts-announce/2025/01/msg00012.html"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-42381","description":"A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the hash_init function"},"relatedVulnerabilities":[]},{"artifact":{"id":"90f72c5b07fcdbc9","cpes":["cpe:2.3:a:busybox:busybox:1.32.1-r9:*:*:*:*:*:*:*"],"name":"busybox","purl":"pkg:apk/busybox/busybox@1.32.1-r9?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"1.32.1-r9","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/bin"},{"path":"/bin/busybox"},{"path":"/bin/sh"},{"path":"/etc"},{"path":"/etc/securetty"},{"path":"/etc/udhcpd.conf"},{"path":"/etc/logrotate.d"},{"path":"/etc/logrotate.d/acpid"},{"path":"/etc/network"},{"path":"/etc/network/if-down.d"},{"path":"/etc/network/if-post-down.d"},{"path":"/etc/network/if-post-up.d"},{"path":"/etc/network/if-pre-down.d"},{"path":"/etc/network/if-pre-up.d"},{"path":"/etc/network/if-up.d"},{"path":"/etc/network/if-up.d/dad"},{"path":"/sbin"},{"path":"/tmp"},{"path":"/usr"},{"path":"/usr/sbin"},{"path":"/usr/share"},{"path":"/usr/share/udhcpc"},{"path":"/usr/share/udhcpc/default.script"},{"path":"/var"},{"path":"/var/cache"},{"path":"/var/cache/misc"},{"path":"/var/lib"},{"path":"/var/lib/udhcpd"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"busybox"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:busybox:busybox:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2021-42385","versionConstraint":">= 1.16.0, <= 1.33.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:busybox:busybox:1.32.1:*:*:*:*:*:*:*"],"package":{"name":"busybox","version":"1.32.1-r9"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2021-42385","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","metrics":{"baseScore":6.5,"impactScore":6.5,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-42385","cwe":"CWE-416","type":"Secondary","source":"reefs@jfrog.com"},{"cve":"CVE-2021-42385","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-42385","date":"2026-10-08","epss":0.02795,"percentile":0.86023}],"risk":2.0217166666666664,"urls":["https://claroty.com/team82/research/unboxing-busybox-14-vulnerabilities-uncovered-by-claroty-jfrog","https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/","https://security.netapp.com/advisory/ntap-20211223-0002/","https://lists.debian.org/debian-lts-announce/2025/01/msg00012.html"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-42385","description":"A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the evaluate function"},"relatedVulnerabilities":[]},{"artifact":{"id":"35fec91b9e067f61","cpes":["cpe:2.3:a:ssl-client:ssl-client:1.32.1-r9:*:*:*:*:*:*:*","cpe:2.3:a:ssl-client:ssl_client:1.32.1-r9:*:*:*:*:*:*:*","cpe:2.3:a:ssl_client:ssl-client:1.32.1-r9:*:*:*:*:*:*:*","cpe:2.3:a:ssl_client:ssl_client:1.32.1-r9:*:*:*:*:*:*:*","cpe:2.3:a:ssl:ssl-client:1.32.1-r9:*:*:*:*:*:*:*","cpe:2.3:a:ssl:ssl_client:1.32.1-r9:*:*:*:*:*:*:*"],"name":"ssl_client","purl":"pkg:apk/busybox/ssl_client@1.32.1-r9?arch=x86_64&distro=busybox-1.32.1&upstream=busybox","type":"apk","version":"1.32.1-r9","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/ssl_client"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"busybox"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:busybox:busybox:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2021-42385","versionConstraint":">= 1.16.0, <= 1.33.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:busybox:busybox:1.32.1:*:*:*:*:*:*:*"],"package":{"name":"busybox","version":"1.32.1-r9"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2021-42385","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","metrics":{"baseScore":6.5,"impactScore":6.5,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-42385","cwe":"CWE-416","type":"Secondary","source":"reefs@jfrog.com"},{"cve":"CVE-2021-42385","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-42385","date":"2026-10-08","epss":0.02795,"percentile":0.86023}],"risk":2.0217166666666664,"urls":["https://claroty.com/team82/research/unboxing-busybox-14-vulnerabilities-uncovered-by-claroty-jfrog","https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/","https://security.netapp.com/advisory/ntap-20211223-0002/","https://lists.debian.org/debian-lts-announce/2025/01/msg00012.html"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-42385","description":"A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the evaluate function"},"relatedVulnerabilities":[]},{"artifact":{"id":"90f72c5b07fcdbc9","cpes":["cpe:2.3:a:busybox:busybox:1.32.1-r9:*:*:*:*:*:*:*"],"name":"busybox","purl":"pkg:apk/busybox/busybox@1.32.1-r9?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"1.32.1-r9","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/bin"},{"path":"/bin/busybox"},{"path":"/bin/sh"},{"path":"/etc"},{"path":"/etc/securetty"},{"path":"/etc/udhcpd.conf"},{"path":"/etc/logrotate.d"},{"path":"/etc/logrotate.d/acpid"},{"path":"/etc/network"},{"path":"/etc/network/if-down.d"},{"path":"/etc/network/if-post-down.d"},{"path":"/etc/network/if-post-up.d"},{"path":"/etc/network/if-pre-down.d"},{"path":"/etc/network/if-pre-up.d"},{"path":"/etc/network/if-up.d"},{"path":"/etc/network/if-up.d/dad"},{"path":"/sbin"},{"path":"/tmp"},{"path":"/usr"},{"path":"/usr/sbin"},{"path":"/usr/share"},{"path":"/usr/share/udhcpc"},{"path":"/usr/share/udhcpc/default.script"},{"path":"/var"},{"path":"/var/cache"},{"path":"/var/cache/misc"},{"path":"/var/lib"},{"path":"/var/lib/udhcpd"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"busybox"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:busybox:busybox:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2021-42382","versionConstraint":">= 1.26.0, <= 1.33.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:busybox:busybox:1.32.1:*:*:*:*:*:*:*"],"package":{"name":"busybox","version":"1.32.1-r9"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2021-42382","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","metrics":{"baseScore":6.5,"impactScore":6.5,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-42382","cwe":"CWE-416","type":"Secondary","source":"reefs@jfrog.com"},{"cve":"CVE-2021-42382","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-42382","date":"2026-10-08","epss":0.02756,"percentile":0.85823}],"risk":1.9935066666666663,"urls":["https://claroty.com/team82/research/unboxing-busybox-14-vulnerabilities-uncovered-by-claroty-jfrog","https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/","https://security.netapp.com/advisory/ntap-20211223-0002/","https://lists.debian.org/debian-lts-announce/2025/01/msg00012.html"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-42382","description":"A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the getvar_s function"},"relatedVulnerabilities":[]},{"artifact":{"id":"35fec91b9e067f61","cpes":["cpe:2.3:a:ssl-client:ssl-client:1.32.1-r9:*:*:*:*:*:*:*","cpe:2.3:a:ssl-client:ssl_client:1.32.1-r9:*:*:*:*:*:*:*","cpe:2.3:a:ssl_client:ssl-client:1.32.1-r9:*:*:*:*:*:*:*","cpe:2.3:a:ssl_client:ssl_client:1.32.1-r9:*:*:*:*:*:*:*","cpe:2.3:a:ssl:ssl-client:1.32.1-r9:*:*:*:*:*:*:*","cpe:2.3:a:ssl:ssl_client:1.32.1-r9:*:*:*:*:*:*:*"],"name":"ssl_client","purl":"pkg:apk/busybox/ssl_client@1.32.1-r9?arch=x86_64&distro=busybox-1.32.1&upstream=busybox","type":"apk","version":"1.32.1-r9","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/ssl_client"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"busybox"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:busybox:busybox:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2021-42382","versionConstraint":">= 1.26.0, <= 1.33.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:busybox:busybox:1.32.1:*:*:*:*:*:*:*"],"package":{"name":"busybox","version":"1.32.1-r9"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2021-42382","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","metrics":{"baseScore":6.5,"impactScore":6.5,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-42382","cwe":"CWE-416","type":"Secondary","source":"reefs@jfrog.com"},{"cve":"CVE-2021-42382","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-42382","date":"2026-10-08","epss":0.02756,"percentile":0.85823}],"risk":1.9935066666666663,"urls":["https://claroty.com/team82/research/unboxing-busybox-14-vulnerabilities-uncovered-by-claroty-jfrog","https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/","https://security.netapp.com/advisory/ntap-20211223-0002/","https://lists.debian.org/debian-lts-announce/2025/01/msg00012.html"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-42382","description":"A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the getvar_s function"},"relatedVulnerabilities":[]},{"artifact":{"id":"90f72c5b07fcdbc9","cpes":["cpe:2.3:a:busybox:busybox:1.32.1-r9:*:*:*:*:*:*:*"],"name":"busybox","purl":"pkg:apk/busybox/busybox@1.32.1-r9?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"1.32.1-r9","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/bin"},{"path":"/bin/busybox"},{"path":"/bin/sh"},{"path":"/etc"},{"path":"/etc/securetty"},{"path":"/etc/udhcpd.conf"},{"path":"/etc/logrotate.d"},{"path":"/etc/logrotate.d/acpid"},{"path":"/etc/network"},{"path":"/etc/network/if-down.d"},{"path":"/etc/network/if-post-down.d"},{"path":"/etc/network/if-post-up.d"},{"path":"/etc/network/if-pre-down.d"},{"path":"/etc/network/if-pre-up.d"},{"path":"/etc/network/if-up.d"},{"path":"/etc/network/if-up.d/dad"},{"path":"/sbin"},{"path":"/tmp"},{"path":"/usr"},{"path":"/usr/sbin"},{"path":"/usr/share"},{"path":"/usr/share/udhcpc"},{"path":"/usr/share/udhcpc/default.script"},{"path":"/var"},{"path":"/var/cache"},{"path":"/var/cache/misc"},{"path":"/var/lib"},{"path":"/var/lib/udhcpd"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"busybox"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:busybox:busybox:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2021-42378","versionConstraint":">= 1.16.0, <= 1.33.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:busybox:busybox:1.32.1:*:*:*:*:*:*:*"],"package":{"name":"busybox","version":"1.32.1-r9"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2021-42378","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","metrics":{"baseScore":6.5,"impactScore":6.5,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-42378","cwe":"CWE-416","type":"Secondary","source":"reefs@jfrog.com"},{"cve":"CVE-2021-42378","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-42378","date":"2026-10-08","epss":0.02733,"percentile":0.85671}],"risk":1.97687,"urls":["https://claroty.com/team82/research/unboxing-busybox-14-vulnerabilities-uncovered-by-claroty-jfrog","https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/","https://security.netapp.com/advisory/ntap-20211223-0002/","https://lists.debian.org/debian-lts-announce/2025/01/msg00012.html"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-42378","description":"A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the getvar_i function"},"relatedVulnerabilities":[]},{"artifact":{"id":"35fec91b9e067f61","cpes":["cpe:2.3:a:ssl-client:ssl-client:1.32.1-r9:*:*:*:*:*:*:*","cpe:2.3:a:ssl-client:ssl_client:1.32.1-r9:*:*:*:*:*:*:*","cpe:2.3:a:ssl_client:ssl-client:1.32.1-r9:*:*:*:*:*:*:*","cpe:2.3:a:ssl_client:ssl_client:1.32.1-r9:*:*:*:*:*:*:*","cpe:2.3:a:ssl:ssl-client:1.32.1-r9:*:*:*:*:*:*:*","cpe:2.3:a:ssl:ssl_client:1.32.1-r9:*:*:*:*:*:*:*"],"name":"ssl_client","purl":"pkg:apk/busybox/ssl_client@1.32.1-r9?arch=x86_64&distro=busybox-1.32.1&upstream=busybox","type":"apk","version":"1.32.1-r9","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/ssl_client"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"busybox"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:busybox:busybox:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2021-42378","versionConstraint":">= 1.16.0, <= 1.33.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:busybox:busybox:1.32.1:*:*:*:*:*:*:*"],"package":{"name":"busybox","version":"1.32.1-r9"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2021-42378","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","metrics":{"baseScore":6.5,"impactScore":6.5,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-42378","cwe":"CWE-416","type":"Secondary","source":"reefs@jfrog.com"},{"cve":"CVE-2021-42378","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-42378","date":"2026-10-08","epss":0.02733,"percentile":0.85671}],"risk":1.97687,"urls":["https://claroty.com/team82/research/unboxing-busybox-14-vulnerabilities-uncovered-by-claroty-jfrog","https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/","https://security.netapp.com/advisory/ntap-20211223-0002/","https://lists.debian.org/debian-lts-announce/2025/01/msg00012.html"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-42378","description":"A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the getvar_i function"},"relatedVulnerabilities":[]},{"artifact":{"id":"90f72c5b07fcdbc9","cpes":["cpe:2.3:a:busybox:busybox:1.32.1-r9:*:*:*:*:*:*:*"],"name":"busybox","purl":"pkg:apk/busybox/busybox@1.32.1-r9?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"1.32.1-r9","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/bin"},{"path":"/bin/busybox"},{"path":"/bin/sh"},{"path":"/etc"},{"path":"/etc/securetty"},{"path":"/etc/udhcpd.conf"},{"path":"/etc/logrotate.d"},{"path":"/etc/logrotate.d/acpid"},{"path":"/etc/network"},{"path":"/etc/network/if-down.d"},{"path":"/etc/network/if-post-down.d"},{"path":"/etc/network/if-post-up.d"},{"path":"/etc/network/if-pre-down.d"},{"path":"/etc/network/if-pre-up.d"},{"path":"/etc/network/if-up.d"},{"path":"/etc/network/if-up.d/dad"},{"path":"/sbin"},{"path":"/tmp"},{"path":"/usr"},{"path":"/usr/sbin"},{"path":"/usr/share"},{"path":"/usr/share/udhcpc"},{"path":"/usr/share/udhcpc/default.script"},{"path":"/var"},{"path":"/var/cache"},{"path":"/var/cache/misc"},{"path":"/var/lib"},{"path":"/var/lib/udhcpd"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"busybox"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:busybox:busybox:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2021-42384","versionConstraint":">= 1.18.0, <= 1.33.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:busybox:busybox:1.32.1:*:*:*:*:*:*:*"],"package":{"name":"busybox","version":"1.32.1-r9"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2021-42384","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","metrics":{"baseScore":6.5,"impactScore":6.5,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-42384","cwe":"CWE-416","type":"Secondary","source":"reefs@jfrog.com"},{"cve":"CVE-2021-42384","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-42384","date":"2026-10-08","epss":0.02733,"percentile":0.8567}],"risk":1.97687,"urls":["https://claroty.com/team82/research/unboxing-busybox-14-vulnerabilities-uncovered-by-claroty-jfrog","https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/","https://security.netapp.com/advisory/ntap-20211223-0002/","https://lists.debian.org/debian-lts-announce/2025/01/msg00012.html"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-42384","description":"A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the handle_special function"},"relatedVulnerabilities":[]},{"artifact":{"id":"90f72c5b07fcdbc9","cpes":["cpe:2.3:a:busybox:busybox:1.32.1-r9:*:*:*:*:*:*:*"],"name":"busybox","purl":"pkg:apk/busybox/busybox@1.32.1-r9?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"1.32.1-r9","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/bin"},{"path":"/bin/busybox"},{"path":"/bin/sh"},{"path":"/etc"},{"path":"/etc/securetty"},{"path":"/etc/udhcpd.conf"},{"path":"/etc/logrotate.d"},{"path":"/etc/logrotate.d/acpid"},{"path":"/etc/network"},{"path":"/etc/network/if-down.d"},{"path":"/etc/network/if-post-down.d"},{"path":"/etc/network/if-post-up.d"},{"path":"/etc/network/if-pre-down.d"},{"path":"/etc/network/if-pre-up.d"},{"path":"/etc/network/if-up.d"},{"path":"/etc/network/if-up.d/dad"},{"path":"/sbin"},{"path":"/tmp"},{"path":"/usr"},{"path":"/usr/sbin"},{"path":"/usr/share"},{"path":"/usr/share/udhcpc"},{"path":"/usr/share/udhcpc/default.script"},{"path":"/var"},{"path":"/var/cache"},{"path":"/var/cache/misc"},{"path":"/var/lib"},{"path":"/var/lib/udhcpd"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"busybox"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:busybox:busybox:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2021-42386","versionConstraint":">= 1.16.0, <= 1.33.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:busybox:busybox:1.32.1:*:*:*:*:*:*:*"],"package":{"name":"busybox","version":"1.32.1-r9"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2021-42386","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","metrics":{"baseScore":6.5,"impactScore":6.5,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-42386","cwe":"CWE-416","type":"Secondary","source":"reefs@jfrog.com"},{"cve":"CVE-2021-42386","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-42386","date":"2026-10-08","epss":0.02733,"percentile":0.8567}],"risk":1.97687,"urls":["https://claroty.com/team82/research/unboxing-busybox-14-vulnerabilities-uncovered-by-claroty-jfrog","https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/","https://security.netapp.com/advisory/ntap-20211223-0002/","https://lists.debian.org/debian-lts-announce/2025/01/msg00012.html"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-42386","description":"A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the nvalloc function"},"relatedVulnerabilities":[]},{"artifact":{"id":"35fec91b9e067f61","cpes":["cpe:2.3:a:ssl-client:ssl-client:1.32.1-r9:*:*:*:*:*:*:*","cpe:2.3:a:ssl-client:ssl_client:1.32.1-r9:*:*:*:*:*:*:*","cpe:2.3:a:ssl_client:ssl-client:1.32.1-r9:*:*:*:*:*:*:*","cpe:2.3:a:ssl_client:ssl_client:1.32.1-r9:*:*:*:*:*:*:*","cpe:2.3:a:ssl:ssl-client:1.32.1-r9:*:*:*:*:*:*:*","cpe:2.3:a:ssl:ssl_client:1.32.1-r9:*:*:*:*:*:*:*"],"name":"ssl_client","purl":"pkg:apk/busybox/ssl_client@1.32.1-r9?arch=x86_64&distro=busybox-1.32.1&upstream=busybox","type":"apk","version":"1.32.1-r9","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/ssl_client"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"busybox"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:busybox:busybox:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2021-42384","versionConstraint":">= 1.18.0, <= 1.33.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:busybox:busybox:1.32.1:*:*:*:*:*:*:*"],"package":{"name":"busybox","version":"1.32.1-r9"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2021-42384","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","metrics":{"baseScore":6.5,"impactScore":6.5,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-42384","cwe":"CWE-416","type":"Secondary","source":"reefs@jfrog.com"},{"cve":"CVE-2021-42384","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-42384","date":"2026-10-08","epss":0.02733,"percentile":0.8567}],"risk":1.97687,"urls":["https://claroty.com/team82/research/unboxing-busybox-14-vulnerabilities-uncovered-by-claroty-jfrog","https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/","https://security.netapp.com/advisory/ntap-20211223-0002/","https://lists.debian.org/debian-lts-announce/2025/01/msg00012.html"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-42384","description":"A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the handle_special function"},"relatedVulnerabilities":[]},{"artifact":{"id":"35fec91b9e067f61","cpes":["cpe:2.3:a:ssl-client:ssl-client:1.32.1-r9:*:*:*:*:*:*:*","cpe:2.3:a:ssl-client:ssl_client:1.32.1-r9:*:*:*:*:*:*:*","cpe:2.3:a:ssl_client:ssl-client:1.32.1-r9:*:*:*:*:*:*:*","cpe:2.3:a:ssl_client:ssl_client:1.32.1-r9:*:*:*:*:*:*:*","cpe:2.3:a:ssl:ssl-client:1.32.1-r9:*:*:*:*:*:*:*","cpe:2.3:a:ssl:ssl_client:1.32.1-r9:*:*:*:*:*:*:*"],"name":"ssl_client","purl":"pkg:apk/busybox/ssl_client@1.32.1-r9?arch=x86_64&distro=busybox-1.32.1&upstream=busybox","type":"apk","version":"1.32.1-r9","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/ssl_client"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"busybox"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:busybox:busybox:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2021-42386","versionConstraint":">= 1.16.0, <= 1.33.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:busybox:busybox:1.32.1:*:*:*:*:*:*:*"],"package":{"name":"busybox","version":"1.32.1-r9"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2021-42386","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","metrics":{"baseScore":6.5,"impactScore":6.5,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-42386","cwe":"CWE-416","type":"Secondary","source":"reefs@jfrog.com"},{"cve":"CVE-2021-42386","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-42386","date":"2026-10-08","epss":0.02733,"percentile":0.8567}],"risk":1.97687,"urls":["https://claroty.com/team82/research/unboxing-busybox-14-vulnerabilities-uncovered-by-claroty-jfrog","https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/","https://security.netapp.com/advisory/ntap-20211223-0002/","https://lists.debian.org/debian-lts-announce/2025/01/msg00012.html"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-42386","description":"A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the nvalloc function"},"relatedVulnerabilities":[]},{"artifact":{"id":"6040784032e8795c","cpes":["cpe:2.3:a:curl:curl:7.79.1-r3:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:7.79.1-r3:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/busybox/curl@7.79.1-r3?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"7.79.1-r3","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2022-27776","versionConstraint":"< 7.83.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:haxx:curl:7.79.1:*:*:*:*:*:*:*"],"package":{"name":"curl","version":"7.79.1-r3"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2022-27776","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-27776","cwe":"CWE-522","type":"Secondary","source":"support@hackerone.com"},{"cve":"CVE-2022-27776","cwe":"CWE-522","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-27776","date":"2026-10-08","epss":0.03777,"percentile":0.89666}],"risk":1.9640399999999998,"urls":["https://hackerone.com/reports/1547048","https://lists.debian.org/debian-lts-announce/2022/08/msg00017.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7N5ZBWLNNPZKFK7Q4KEHGCJ2YELQEUJP/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DKKOQXPYLMBSEVDHFS32BPBR3ZQJKY5B/","https://security.gentoo.org/glsa/202212-01","https://security.netapp.com/advisory/ntap-20220609-0008/","https://www.debian.org/security/2022/dsa-5197"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-27776","description":"A insufficiently protected credentials vulnerability in fixed in curl 7.83.0 might leak authentication or cookie header data on HTTP redirects to the same host but another port number."},"relatedVulnerabilities":[]},{"artifact":{"id":"6040784032e8795c","cpes":["cpe:2.3:a:curl:curl:7.79.1-r3:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:7.79.1-r3:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/busybox/curl@7.79.1-r3?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"7.79.1-r3","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2022-27781","versionConstraint":"< 7.83.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:haxx:curl:7.79.1:*:*:*:*:*:*:*"],"package":{"name":"curl","version":"7.79.1-r3"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2022-27781","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-27781","cwe":"CWE-400","type":"Secondary","source":"support@hackerone.com"},{"cve":"CVE-2022-27781","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-27781","date":"2026-10-08","epss":0.02747,"percentile":0.85771}],"risk":1.9457916666666668,"urls":["https://hackerone.com/reports/1555441","https://lists.debian.org/debian-lts-announce/2022/08/msg00017.html","https://security.gentoo.org/glsa/202212-01","https://security.netapp.com/advisory/ntap-20220609-0009/","https://www.debian.org/security/2022/dsa-5197"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-27781","description":"libcurl provides the `CURLOPT_CERTINFO` option to allow applications torequest details to be returned about a server's certificate chain.Due to an erroneous function, a malicious server could make libcurl built withNSS get stuck in a never-ending busy-loop when trying to retrieve thatinformation."},"relatedVulnerabilities":[]},{"artifact":{"id":"a45c752c9b8878aa","cpes":["cpe:2.3:a:php7:php7:7.4.26-r0:*:*:*:*:*:*:*","cpe:2.3:a:php7:php:7.4.26-r0:*:*:*:*:*:*:*","cpe:2.3:a:php:php7:7.4.26-r0:*:*:*:*:*:*:*","cpe:2.3:a:php:php:7.4.26-r0:*:*:*:*:*:*:*"],"name":"php7","purl":"pkg:apk/busybox/php7@7.4.26-r0?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"7.4.26-r0","language":"","licenses":["BSD-3-Clause","LGPL-2.0-or-later","MIT","PHP-3.01","Zend-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/php"},{"path":"/usr/bin/php7"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"php7"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:php:php:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2024-11236","versionConstraint":"< 8.1.31||>= 8.2, < 8.2.26||>= 8.3, < 8.3.14 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:php:php:7.4.26:*:*:*:*:*:*:*"],"package":{"name":"php7","version":"7.4.26-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2024-11236","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-11236","cwe":"CWE-787","type":"Secondary","source":"security@php.net"},{"cve":"CVE-2024-11236","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-11236","date":"2026-10-08","epss":0.02065,"percentile":0.80792}],"risk":1.9411,"urls":["https://github.com/php/php-src/security/advisories/GHSA-5hqh-c84r-qjcv","https://lists.debian.org/debian-lts-announce/2024/12/msg00007.html","https://security.netapp.com/advisory/ntap-20241220-0008/"],"severity":"Critical","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-11236","description":"In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, uncontrolled long string inputs to ldap_escape() function on 32-bit systems can cause an integer overflow, resulting in an out-of-bounds write."},"relatedVulnerabilities":[]},{"artifact":{"id":"90f72c5b07fcdbc9","cpes":["cpe:2.3:a:busybox:busybox:1.32.1-r9:*:*:*:*:*:*:*"],"name":"busybox","purl":"pkg:apk/busybox/busybox@1.32.1-r9?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"1.32.1-r9","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/bin"},{"path":"/bin/busybox"},{"path":"/bin/sh"},{"path":"/etc"},{"path":"/etc/securetty"},{"path":"/etc/udhcpd.conf"},{"path":"/etc/logrotate.d"},{"path":"/etc/logrotate.d/acpid"},{"path":"/etc/network"},{"path":"/etc/network/if-down.d"},{"path":"/etc/network/if-post-down.d"},{"path":"/etc/network/if-post-up.d"},{"path":"/etc/network/if-pre-down.d"},{"path":"/etc/network/if-pre-up.d"},{"path":"/etc/network/if-up.d"},{"path":"/etc/network/if-up.d/dad"},{"path":"/sbin"},{"path":"/tmp"},{"path":"/usr"},{"path":"/usr/sbin"},{"path":"/usr/share"},{"path":"/usr/share/udhcpc"},{"path":"/usr/share/udhcpc/default.script"},{"path":"/var"},{"path":"/var/cache"},{"path":"/var/cache/misc"},{"path":"/var/lib"},{"path":"/var/lib/udhcpd"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"busybox"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:busybox:busybox:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2021-28831","versionConstraint":">= 1.32.0, <= 1.32.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:busybox:busybox:1.32.1:*:*:*:*:*:*:*"],"package":{"name":"busybox","version":"1.32.1-r9"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2021-28831","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-28831","cwe":"CWE-755","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-28831","cwe":"CWE-755","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-28831","date":"2026-10-08","epss":0.02719,"percentile":0.85597}],"risk":1.9259583333333334,"urls":["https://git.busybox.net/busybox/commit/?id=f25d254dfd4243698c31a4f3153d4ac72aa9e9bd","https://lists.debian.org/debian-lts-announce/2021/04/msg00001.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3UDQGJRECXFS5EZVDH2OI45FMO436AC4/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z7ZIFKPRR32ZYA3WAA2NXFA3QHHOU6FJ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZASBW7QRRLY5V2R44MQ4QQM4CZIDHM2U/","https://security.gentoo.org/glsa/202105-09","https://lists.debian.org/debian-lts-announce/2025/01/msg00012.html","https://security.netapp.com/advisory/ntap-20250509-0005/"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-28831","description":"decompress_gunzip.c in BusyBox through 1.32.1 mishandles the error bit on the huft_build result pointer, with a resultant invalid free or segmentation fault, via malformed gzip data."},"relatedVulnerabilities":[]},{"artifact":{"id":"35fec91b9e067f61","cpes":["cpe:2.3:a:ssl-client:ssl-client:1.32.1-r9:*:*:*:*:*:*:*","cpe:2.3:a:ssl-client:ssl_client:1.32.1-r9:*:*:*:*:*:*:*","cpe:2.3:a:ssl_client:ssl-client:1.32.1-r9:*:*:*:*:*:*:*","cpe:2.3:a:ssl_client:ssl_client:1.32.1-r9:*:*:*:*:*:*:*","cpe:2.3:a:ssl:ssl-client:1.32.1-r9:*:*:*:*:*:*:*","cpe:2.3:a:ssl:ssl_client:1.32.1-r9:*:*:*:*:*:*:*"],"name":"ssl_client","purl":"pkg:apk/busybox/ssl_client@1.32.1-r9?arch=x86_64&distro=busybox-1.32.1&upstream=busybox","type":"apk","version":"1.32.1-r9","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/ssl_client"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"busybox"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:busybox:busybox:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2021-28831","versionConstraint":">= 1.32.0, <= 1.32.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:busybox:busybox:1.32.1:*:*:*:*:*:*:*"],"package":{"name":"busybox","version":"1.32.1-r9"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2021-28831","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-28831","cwe":"CWE-755","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-28831","cwe":"CWE-755","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-28831","date":"2026-10-08","epss":0.02719,"percentile":0.85597}],"risk":1.9259583333333334,"urls":["https://git.busybox.net/busybox/commit/?id=f25d254dfd4243698c31a4f3153d4ac72aa9e9bd","https://lists.debian.org/debian-lts-announce/2021/04/msg00001.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3UDQGJRECXFS5EZVDH2OI45FMO436AC4/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z7ZIFKPRR32ZYA3WAA2NXFA3QHHOU6FJ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZASBW7QRRLY5V2R44MQ4QQM4CZIDHM2U/","https://security.gentoo.org/glsa/202105-09","https://lists.debian.org/debian-lts-announce/2025/01/msg00012.html","https://security.netapp.com/advisory/ntap-20250509-0005/"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-28831","description":"decompress_gunzip.c in BusyBox through 1.32.1 mishandles the error bit on the huft_build result pointer, with a resultant invalid free or segmentation fault, via malformed gzip data."},"relatedVulnerabilities":[]},{"artifact":{"id":"d081de97c6f633df","cpes":["cpe:2.3:a:libcrypto1.1:libcrypto1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto1.1:libcrypto:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto:libcrypto1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto:libcrypto:1.1.1q-r0:*:*:*:*:*:*:*"],"name":"libcrypto1.1","purl":"pkg:apk/busybox/libcrypto1.1@1.1.1q-r0?arch=x86_64&distro=busybox-1.32.1&upstream=openssl","type":"apk","version":"1.1.1q-r0","language":"","licenses":["OpenSSL"],"metadata":{"Arch":"x86_64","files":[{"path":"/etc"},{"path":"/etc/ssl"},{"path":"/etc/ssl/ct_log_list.cnf"},{"path":"/etc/ssl/ct_log_list.cnf.dist"},{"path":"/etc/ssl/openssl.cnf"},{"path":"/etc/ssl/openssl.cnf.dist"},{"path":"/etc/ssl/certs"},{"path":"/etc/ssl/misc"},{"path":"/etc/ssl/misc/CA.pl"},{"path":"/etc/ssl/misc/tsget"},{"path":"/etc/ssl/misc/tsget.pl"},{"path":"/etc/ssl/private"},{"path":"/lib"},{"path":"/lib/libcrypto.so.1.1"},{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcrypto.so.1.1"},{"path":"/usr/lib/engines-1.1"},{"path":"/usr/lib/engines-1.1/afalg.so"},{"path":"/usr/lib/engines-1.1/capi.so"},{"path":"/usr/lib/engines-1.1/padlock.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-28388","versionConstraint":">= 1.0.2, < 1.0.2zp||>= 1.1.1, < 1.1.1zg||>= 3.0.0, < 3.0.20||>= 3.3.0, < 3.3.7||>= 3.4.0, < 3.4.5||>= 3.5.0, < 3.5.6||>= 3.6.0, < 3.6.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:1.1.1q:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"1.1.1q-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-28388","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-28388","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-28388","date":"2026-10-08","epss":0.02501,"percentile":0.84231}],"risk":1.87575,"urls":["https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e","https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139","https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3","https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8","https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726","https://openssl-library.org/news/secadv/20260407.txt","https://cert-portal.siemens.com/productcert/html/ssa-032379.html","https://cert-portal.siemens.com/productcert/html/ssa-265688.html"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-28388","description":"Issue summary: When a delta CRL that contains a Delta CRL Indicator extension\nis processed a NULL pointer dereference might happen if the required CRL\nNumber extension is missing.\n\nImpact summary: A NULL pointer dereference can trigger a crash which\nleads to a Denial of Service for an application.\n\nWhen CRL processing and delta CRL processing is enabled during X.509\ncertificate verification, the delta CRL processing does not check\nwhether the CRL Number extension is NULL before dereferencing it.\nWhen a malformed delta CRL file is being processed, this parameter\ncan be NULL, causing a NULL pointer dereference.\n\nExploiting this issue requires the X509_V_FLAG_USE_DELTAS flag to be enabled in\nthe verification context, the certificate being verified to contain a\nfreshestCRL extension or the base CRL to have the EXFLAG_FRESHEST flag set, and\nan attacker to provide a malformed CRL to an application that processes it.\n\nThe vulnerability is limited to Denial of Service and cannot be escalated to\nachieve code execution or memory disclosure. For that reason the issue was\nassessed as Low severity according to our Security Policy.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the affected code is outside the OpenSSL FIPS module boundary."},"relatedVulnerabilities":[]},{"artifact":{"id":"74f4e71ff41d2d68","cpes":["cpe:2.3:a:libssl1.1:libssl1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl1.1:libssl:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl:1.1.1q-r0:*:*:*:*:*:*:*"],"name":"libssl1.1","purl":"pkg:apk/busybox/libssl1.1@1.1.1q-r0?arch=x86_64&distro=busybox-1.32.1&upstream=openssl","type":"apk","version":"1.1.1q-r0","language":"","licenses":["OpenSSL"],"metadata":{"Arch":"x86_64","files":[{"path":"/lib"},{"path":"/lib/libssl.so.1.1"},{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libssl.so.1.1"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-28388","versionConstraint":">= 1.0.2, < 1.0.2zp||>= 1.1.1, < 1.1.1zg||>= 3.0.0, < 3.0.20||>= 3.3.0, < 3.3.7||>= 3.4.0, < 3.4.5||>= 3.5.0, < 3.5.6||>= 3.6.0, < 3.6.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:1.1.1q:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"1.1.1q-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-28388","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-28388","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-28388","date":"2026-10-08","epss":0.02501,"percentile":0.84231}],"risk":1.87575,"urls":["https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e","https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139","https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3","https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8","https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726","https://openssl-library.org/news/secadv/20260407.txt","https://cert-portal.siemens.com/productcert/html/ssa-032379.html","https://cert-portal.siemens.com/productcert/html/ssa-265688.html"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-28388","description":"Issue summary: When a delta CRL that contains a Delta CRL Indicator extension\nis processed a NULL pointer dereference might happen if the required CRL\nNumber extension is missing.\n\nImpact summary: A NULL pointer dereference can trigger a crash which\nleads to a Denial of Service for an application.\n\nWhen CRL processing and delta CRL processing is enabled during X.509\ncertificate verification, the delta CRL processing does not check\nwhether the CRL Number extension is NULL before dereferencing it.\nWhen a malformed delta CRL file is being processed, this parameter\ncan be NULL, causing a NULL pointer dereference.\n\nExploiting this issue requires the X509_V_FLAG_USE_DELTAS flag to be enabled in\nthe verification context, the certificate being verified to contain a\nfreshestCRL extension or the base CRL to have the EXFLAG_FRESHEST flag set, and\nan attacker to provide a malformed CRL to an application that processes it.\n\nThe vulnerability is limited to Denial of Service and cannot be escalated to\nachieve code execution or memory disclosure. For that reason the issue was\nassessed as Low severity according to our Security Policy.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the affected code is outside the OpenSSL FIPS module boundary."},"relatedVulnerabilities":[]},{"artifact":{"id":"14807b4f7067817d","cpes":["cpe:2.3:a:openssl:openssl:1.1.1q-r0:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:apk/busybox/openssl@1.1.1q-r0?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"1.1.1q-r0","language":"","licenses":["OpenSSL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/openssl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-28388","versionConstraint":">= 1.0.2, < 1.0.2zp||>= 1.1.1, < 1.1.1zg||>= 3.0.0, < 3.0.20||>= 3.3.0, < 3.3.7||>= 3.4.0, < 3.4.5||>= 3.5.0, < 3.5.6||>= 3.6.0, < 3.6.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:1.1.1q:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"1.1.1q-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-28388","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-28388","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-28388","date":"2026-10-08","epss":0.02501,"percentile":0.84231}],"risk":1.87575,"urls":["https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e","https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139","https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3","https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8","https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726","https://openssl-library.org/news/secadv/20260407.txt","https://cert-portal.siemens.com/productcert/html/ssa-032379.html","https://cert-portal.siemens.com/productcert/html/ssa-265688.html"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-28388","description":"Issue summary: When a delta CRL that contains a Delta CRL Indicator extension\nis processed a NULL pointer dereference might happen if the required CRL\nNumber extension is missing.\n\nImpact summary: A NULL pointer dereference can trigger a crash which\nleads to a Denial of Service for an application.\n\nWhen CRL processing and delta CRL processing is enabled during X.509\ncertificate verification, the delta CRL processing does not check\nwhether the CRL Number extension is NULL before dereferencing it.\nWhen a malformed delta CRL file is being processed, this parameter\ncan be NULL, causing a NULL pointer dereference.\n\nExploiting this issue requires the X509_V_FLAG_USE_DELTAS flag to be enabled in\nthe verification context, the certificate being verified to contain a\nfreshestCRL extension or the base CRL to have the EXFLAG_FRESHEST flag set, and\nan attacker to provide a malformed CRL to an application that processes it.\n\nThe vulnerability is limited to Denial of Service and cannot be escalated to\nachieve code execution or memory disclosure. For that reason the issue was\nassessed as Low severity according to our Security Policy.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the affected code is outside the OpenSSL FIPS module boundary."},"relatedVulnerabilities":[]},{"artifact":{"id":"6040784032e8795c","cpes":["cpe:2.3:a:curl:curl:7.79.1-r3:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:7.79.1-r3:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/busybox/curl@7.79.1-r3?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"7.79.1-r3","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2023-28319","versionConstraint":"< 8.1.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:haxx:curl:7.79.1:*:*:*:*:*:*:*"],"package":{"name":"curl","version":"7.79.1-r3"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2023-28319","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-28319","cwe":"CWE-416","type":"Secondary","source":"support@hackerone.com"},{"cve":"CVE-2023-28319","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-28319","date":"2026-10-08","epss":0.02489,"percentile":0.84155}],"risk":1.86675,"urls":["http://seclists.org/fulldisclosure/2023/Jul/47","http://seclists.org/fulldisclosure/2023/Jul/48","http://seclists.org/fulldisclosure/2023/Jul/52","https://hackerone.com/reports/1913733","https://security.gentoo.org/glsa/202310-12","https://security.netapp.com/advisory/ntap-20230609-0009/","https://support.apple.com/kb/HT213843","https://support.apple.com/kb/HT213844","https://support.apple.com/kb/HT213845"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-28319","description":"A use after free vulnerability exists in curl <v8.1.0 in the way libcurl offers a feature to verify an SSH server's public key using a SHA 256 hash. When this check fails, libcurl would free the memory for the fingerprint before it returns an error message containing the (now freed) hash. This flaw risks inserting sensitive heap-based data into the error message that might be shown to users or otherwise get leaked and revealed."},"relatedVulnerabilities":[]},{"artifact":{"id":"d081de97c6f633df","cpes":["cpe:2.3:a:libcrypto1.1:libcrypto1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto1.1:libcrypto:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto:libcrypto1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto:libcrypto:1.1.1q-r0:*:*:*:*:*:*:*"],"name":"libcrypto1.1","purl":"pkg:apk/busybox/libcrypto1.1@1.1.1q-r0?arch=x86_64&distro=busybox-1.32.1&upstream=openssl","type":"apk","version":"1.1.1q-r0","language":"","licenses":["OpenSSL"],"metadata":{"Arch":"x86_64","files":[{"path":"/etc"},{"path":"/etc/ssl"},{"path":"/etc/ssl/ct_log_list.cnf"},{"path":"/etc/ssl/ct_log_list.cnf.dist"},{"path":"/etc/ssl/openssl.cnf"},{"path":"/etc/ssl/openssl.cnf.dist"},{"path":"/etc/ssl/certs"},{"path":"/etc/ssl/misc"},{"path":"/etc/ssl/misc/CA.pl"},{"path":"/etc/ssl/misc/tsget"},{"path":"/etc/ssl/misc/tsget.pl"},{"path":"/etc/ssl/private"},{"path":"/lib"},{"path":"/lib/libcrypto.so.1.1"},{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcrypto.so.1.1"},{"path":"/usr/lib/engines-1.1"},{"path":"/usr/lib/engines-1.1/afalg.so"},{"path":"/usr/lib/engines-1.1/capi.so"},{"path":"/usr/lib/engines-1.1/padlock.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-28389","versionConstraint":">= 1.0.2, < 1.0.2zp||>= 1.1.1, < 1.1.1zg||>= 3.0.0, < 3.0.20||>= 3.3.0, < 3.3.7||>= 3.4.0, < 3.4.5||>= 3.5.0, < 3.5.6||>= 3.6.0, < 3.6.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:1.1.1q:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"1.1.1q-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-28389","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-28389","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-28389","date":"2026-10-08","epss":0.02435,"percentile":0.83783}],"risk":1.8262500000000002,"urls":["https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5","https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616","https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f","https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a","https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686","https://openssl-library.org/news/secadv/20260407.txt","https://cert-portal.siemens.com/productcert/html/ssa-032379.html","https://cert-portal.siemens.com/productcert/html/ssa-265688.html"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-28389","description":"Issue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyAgreeRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyAgreeRecipientInfo is\nprocessed, the optional parameters field of KeyEncryptionAlgorithmIdentifier\nis examined without checking for its presence. This results in a NULL\npointer dereference if the field is missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary."},"relatedVulnerabilities":[]},{"artifact":{"id":"74f4e71ff41d2d68","cpes":["cpe:2.3:a:libssl1.1:libssl1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl1.1:libssl:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl:1.1.1q-r0:*:*:*:*:*:*:*"],"name":"libssl1.1","purl":"pkg:apk/busybox/libssl1.1@1.1.1q-r0?arch=x86_64&distro=busybox-1.32.1&upstream=openssl","type":"apk","version":"1.1.1q-r0","language":"","licenses":["OpenSSL"],"metadata":{"Arch":"x86_64","files":[{"path":"/lib"},{"path":"/lib/libssl.so.1.1"},{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libssl.so.1.1"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-28389","versionConstraint":">= 1.0.2, < 1.0.2zp||>= 1.1.1, < 1.1.1zg||>= 3.0.0, < 3.0.20||>= 3.3.0, < 3.3.7||>= 3.4.0, < 3.4.5||>= 3.5.0, < 3.5.6||>= 3.6.0, < 3.6.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:1.1.1q:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"1.1.1q-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-28389","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-28389","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-28389","date":"2026-10-08","epss":0.02435,"percentile":0.83783}],"risk":1.8262500000000002,"urls":["https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5","https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616","https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f","https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a","https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686","https://openssl-library.org/news/secadv/20260407.txt","https://cert-portal.siemens.com/productcert/html/ssa-032379.html","https://cert-portal.siemens.com/productcert/html/ssa-265688.html"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-28389","description":"Issue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyAgreeRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyAgreeRecipientInfo is\nprocessed, the optional parameters field of KeyEncryptionAlgorithmIdentifier\nis examined without checking for its presence. This results in a NULL\npointer dereference if the field is missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary."},"relatedVulnerabilities":[]},{"artifact":{"id":"14807b4f7067817d","cpes":["cpe:2.3:a:openssl:openssl:1.1.1q-r0:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:apk/busybox/openssl@1.1.1q-r0?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"1.1.1q-r0","language":"","licenses":["OpenSSL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/openssl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-28389","versionConstraint":">= 1.0.2, < 1.0.2zp||>= 1.1.1, < 1.1.1zg||>= 3.0.0, < 3.0.20||>= 3.3.0, < 3.3.7||>= 3.4.0, < 3.4.5||>= 3.5.0, < 3.5.6||>= 3.6.0, < 3.6.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:1.1.1q:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"1.1.1q-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-28389","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-28389","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-28389","date":"2026-10-08","epss":0.02435,"percentile":0.83783}],"risk":1.8262500000000002,"urls":["https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5","https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616","https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f","https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a","https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686","https://openssl-library.org/news/secadv/20260407.txt","https://cert-portal.siemens.com/productcert/html/ssa-032379.html","https://cert-portal.siemens.com/productcert/html/ssa-265688.html"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-28389","description":"Issue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyAgreeRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyAgreeRecipientInfo is\nprocessed, the optional parameters field of KeyEncryptionAlgorithmIdentifier\nis examined without checking for its presence. This results in a NULL\npointer dereference if the field is missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary."},"relatedVulnerabilities":[]},{"artifact":{"id":"6040784032e8795c","cpes":["cpe:2.3:a:curl:curl:7.79.1-r3:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:7.79.1-r3:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/busybox/curl@7.79.1-r3?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"7.79.1-r3","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2023-27534","versionConstraint":">= 7.18.0, < 8.0.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:haxx:curl:7.79.1:*:*:*:*:*:*:*"],"package":{"name":"curl","version":"7.79.1-r3"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2023-27534","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-27534","cwe":"CWE-22","type":"Secondary","source":"support@hackerone.com"},{"cve":"CVE-2023-27534","cwe":"CWE-22","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-27534","date":"2026-10-08","epss":0.02195,"percentile":0.81928}],"risk":1.7889250000000003,"urls":["https://hackerone.com/reports/1892351","https://lists.debian.org/debian-lts-announce/2024/03/msg00016.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/36NBD5YLJXXEDZLDGNFCERWRYJQ6LAQW/","https://security.gentoo.org/glsa/202310-12","https://security.netapp.com/advisory/ntap-20230420-0012/","https://advisory.splunk.com/advisories/SVD-2023-0809","https://curl.se/docs/CVE-2023-27534.json"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-27534","description":"A path traversal vulnerability exists in curl <8.0.0 SFTP implementation causes the tilde (~) character to be wrongly replaced when used as a prefix in the first path element, in addition to its intended use as the first element to indicate a path relative to the user's home directory. Attackers can exploit this flaw to bypass filtering or execute arbitrary code by crafting a path like /~2/foo while accessing a server with a specific user."},"relatedVulnerabilities":[]},{"artifact":{"id":"de2e09a252869bf3","cpes":["cpe:2.3:a:git-scm:git:2.30.6-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_scm:git:2.30.6-r0:*:*:*:*:*:*:*","cpe:2.3:a:git:git:2.30.6-r0:*:*:*:*:*:*:*"],"name":"git","purl":"pkg:apk/busybox/git@2.30.6-r0?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"2.30.6-r0","language":"","licenses":["GPL-2.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/git"},{"path":"/usr/bin/git-receive-pack"},{"path":"/usr/bin/git-shell"},{"path":"/usr/bin/git-upload-archive"},{"path":"/usr/bin/git-upload-pack"},{"path":"/usr/libexec"},{"path":"/usr/libexec/git-core"},{"path":"/usr/libexec/git-core/git"},{"path":"/usr/libexec/git-core/git-add"},{"path":"/usr/libexec/git-core/git-am"},{"path":"/usr/libexec/git-core/git-annotate"},{"path":"/usr/libexec/git-core/git-apply"},{"path":"/usr/libexec/git-core/git-archive"},{"path":"/usr/libexec/git-core/git-bisect"},{"path":"/usr/libexec/git-core/git-bisect--helper"},{"path":"/usr/libexec/git-core/git-blame"},{"path":"/usr/libexec/git-core/git-branch"},{"path":"/usr/libexec/git-core/git-bugreport"},{"path":"/usr/libexec/git-core/git-bundle"},{"path":"/usr/libexec/git-core/git-cat-file"},{"path":"/usr/libexec/git-core/git-check-attr"},{"path":"/usr/libexec/git-core/git-check-ignore"},{"path":"/usr/libexec/git-core/git-check-mailmap"},{"path":"/usr/libexec/git-core/git-check-ref-format"},{"path":"/usr/libexec/git-core/git-checkout"},{"path":"/usr/libexec/git-core/git-checkout-index"},{"path":"/usr/libexec/git-core/git-cherry"},{"path":"/usr/libexec/git-core/git-cherry-pick"},{"path":"/usr/libexec/git-core/git-clean"},{"path":"/usr/libexec/git-core/git-clone"},{"path":"/usr/libexec/git-core/git-column"},{"path":"/usr/libexec/git-core/git-commit"},{"path":"/usr/libexec/git-core/git-commit-graph"},{"path":"/usr/libexec/git-core/git-commit-tree"},{"path":"/usr/libexec/git-core/git-config"},{"path":"/usr/libexec/git-core/git-count-objects"},{"path":"/usr/libexec/git-core/git-credential"},{"path":"/usr/libexec/git-core/git-credential-cache"},{"path":"/usr/libexec/git-core/git-credential-cache--daemon"},{"path":"/usr/libexec/git-core/git-credential-store"},{"path":"/usr/libexec/git-core/git-describe"},{"path":"/usr/libexec/git-core/git-diff"},{"path":"/usr/libexec/git-core/git-diff-files"},{"path":"/usr/libexec/git-core/git-diff-index"},{"path":"/usr/libexec/git-core/git-diff-tree"},{"path":"/usr/libexec/git-core/git-difftool"},{"path":"/usr/libexec/git-core/git-difftool--helper"},{"path":"/usr/libexec/git-core/git-env--helper"},{"path":"/usr/libexec/git-core/git-fast-export"},{"path":"/usr/libexec/git-core/git-fetch"},{"path":"/usr/libexec/git-core/git-fetch-pack"},{"path":"/usr/libexec/git-core/git-filter-branch"},{"path":"/usr/libexec/git-core/git-fmt-merge-msg"},{"path":"/usr/libexec/git-core/git-for-each-ref"},{"path":"/usr/libexec/git-core/git-for-each-repo"},{"path":"/usr/libexec/git-core/git-format-patch"},{"path":"/usr/libexec/git-core/git-fsck"},{"path":"/usr/libexec/git-core/git-fsck-objects"},{"path":"/usr/libexec/git-core/git-gc"},{"path":"/usr/libexec/git-core/git-get-tar-commit-id"},{"path":"/usr/libexec/git-core/git-grep"},{"path":"/usr/libexec/git-core/git-hash-object"},{"path":"/usr/libexec/git-core/git-help"},{"path":"/usr/libexec/git-core/git-http-fetch"},{"path":"/usr/libexec/git-core/git-http-push"},{"path":"/usr/libexec/git-core/git-index-pack"},{"path":"/usr/libexec/git-core/git-init"},{"path":"/usr/libexec/git-core/git-init-db"},{"path":"/usr/libexec/git-core/git-interpret-trailers"},{"path":"/usr/libexec/git-core/git-log"},{"path":"/usr/libexec/git-core/git-ls-files"},{"path":"/usr/libexec/git-core/git-ls-remote"},{"path":"/usr/libexec/git-core/git-ls-tree"},{"path":"/usr/libexec/git-core/git-mailinfo"},{"path":"/usr/libexec/git-core/git-mailsplit"},{"path":"/usr/libexec/git-core/git-maintenance"},{"path":"/usr/libexec/git-core/git-merge"},{"path":"/usr/libexec/git-core/git-merge-base"},{"path":"/usr/libexec/git-core/git-merge-file"},{"path":"/usr/libexec/git-core/git-merge-index"},{"path":"/usr/libexec/git-core/git-merge-octopus"},{"path":"/usr/libexec/git-core/git-merge-one-file"},{"path":"/usr/libexec/git-core/git-merge-ours"},{"path":"/usr/libexec/git-core/git-merge-recursive"},{"path":"/usr/libexec/git-core/git-merge-resolve"},{"path":"/usr/libexec/git-core/git-merge-subtree"},{"path":"/usr/libexec/git-core/git-merge-tree"},{"path":"/usr/libexec/git-core/git-mergetool"},{"path":"/usr/libexec/git-core/git-mergetool--lib"},{"path":"/usr/libexec/git-core/git-mktag"},{"path":"/usr/libexec/git-core/git-mktree"},{"path":"/usr/libexec/git-core/git-multi-pack-index"},{"path":"/usr/libexec/git-core/git-mv"},{"path":"/usr/libexec/git-core/git-name-rev"},{"path":"/usr/libexec/git-core/git-notes"},{"path":"/usr/libexec/git-core/git-pack-objects"},{"path":"/usr/libexec/git-core/git-pack-redundant"},{"path":"/usr/libexec/git-core/git-pack-refs"},{"path":"/usr/libexec/git-core/git-patch-id"},{"path":"/usr/libexec/git-core/git-prune"},{"path":"/usr/libexec/git-core/git-prune-packed"},{"path":"/usr/libexec/git-core/git-pull"},{"path":"/usr/libexec/git-core/git-push"},{"path":"/usr/libexec/git-core/git-quiltimport"},{"path":"/usr/libexec/git-core/git-range-diff"},{"path":"/usr/libexec/git-core/git-read-tree"},{"path":"/usr/libexec/git-core/git-rebase"},{"path":"/usr/libexec/git-core/git-rebase--preserve-merges"},{"path":"/usr/libexec/git-core/git-receive-pack"},{"path":"/usr/libexec/git-core/git-reflog"},{"path":"/usr/libexec/git-core/git-remote"},{"path":"/usr/libexec/git-core/git-remote-ext"},{"path":"/usr/libexec/git-core/git-remote-fd"},{"path":"/usr/libexec/git-core/git-remote-ftp"},{"path":"/usr/libexec/git-core/git-remote-ftps"},{"path":"/usr/libexec/git-core/git-remote-http"},{"path":"/usr/libexec/git-core/git-remote-https"},{"path":"/usr/libexec/git-core/git-repack"},{"path":"/usr/libexec/git-core/git-replace"},{"path":"/usr/libexec/git-core/git-request-pull"},{"path":"/usr/libexec/git-core/git-rerere"},{"path":"/usr/libexec/git-core/git-reset"},{"path":"/usr/libexec/git-core/git-restore"},{"path":"/usr/libexec/git-core/git-rev-list"},{"path":"/usr/libexec/git-core/git-rev-parse"},{"path":"/usr/libexec/git-core/git-revert"},{"path":"/usr/libexec/git-core/git-rm"},{"path":"/usr/libexec/git-core/git-send-pack"},{"path":"/usr/libexec/git-core/git-sh-i18n"},{"path":"/usr/libexec/git-core/git-sh-i18n--envsubst"},{"path":"/usr/libexec/git-core/git-sh-setup"},{"path":"/usr/libexec/git-core/git-shortlog"},{"path":"/usr/libexec/git-core/git-show"},{"path":"/usr/libexec/git-core/git-show-branch"},{"path":"/usr/libexec/git-core/git-show-index"},{"path":"/usr/libexec/git-core/git-show-ref"},{"path":"/usr/libexec/git-core/git-sparse-checkout"},{"path":"/usr/libexec/git-core/git-stage"},{"path":"/usr/libexec/git-core/git-stash"},{"path":"/usr/libexec/git-core/git-status"},{"path":"/usr/libexec/git-core/git-stripspace"},{"path":"/usr/libexec/git-core/git-submodule"},{"path":"/usr/libexec/git-core/git-submodule--helper"},{"path":"/usr/libexec/git-core/git-switch"},{"path":"/usr/libexec/git-core/git-symbolic-ref"},{"path":"/usr/libexec/git-core/git-tag"},{"path":"/usr/libexec/git-core/git-unpack-file"},{"path":"/usr/libexec/git-core/git-unpack-objects"},{"path":"/usr/libexec/git-core/git-update-index"},{"path":"/usr/libexec/git-core/git-update-ref"},{"path":"/usr/libexec/git-core/git-update-server-info"},{"path":"/usr/libexec/git-core/git-upload-archive"},{"path":"/usr/libexec/git-core/git-upload-pack"},{"path":"/usr/libexec/git-core/git-var"},{"path":"/usr/libexec/git-core/git-verify-commit"},{"path":"/usr/libexec/git-core/git-verify-pack"},{"path":"/usr/libexec/git-core/git-verify-tag"},{"path":"/usr/libexec/git-core/git-web--browse"},{"path":"/usr/libexec/git-core/git-whatchanged"},{"path":"/usr/libexec/git-core/git-worktree"},{"path":"/usr/libexec/git-core/git-write-tree"},{"path":"/usr/libexec/git-core/mergetools"},{"path":"/usr/libexec/git-core/mergetools/araxis"},{"path":"/usr/libexec/git-core/mergetools/bc"},{"path":"/usr/libexec/git-core/mergetools/codecompare"},{"path":"/usr/libexec/git-core/mergetools/deltawalker"},{"path":"/usr/libexec/git-core/mergetools/diffmerge"},{"path":"/usr/libexec/git-core/mergetools/diffuse"},{"path":"/usr/libexec/git-core/mergetools/ecmerge"},{"path":"/usr/libexec/git-core/mergetools/emerge"},{"path":"/usr/libexec/git-core/mergetools/examdiff"},{"path":"/usr/libexec/git-core/mergetools/guiffy"},{"path":"/usr/libexec/git-core/mergetools/gvimdiff"},{"path":"/usr/libexec/git-core/mergetools/kdiff3"},{"path":"/usr/libexec/git-core/mergetools/kompare"},{"path":"/usr/libexec/git-core/mergetools/meld"},{"path":"/usr/libexec/git-core/mergetools/nvimdiff"},{"path":"/usr/libexec/git-core/mergetools/opendiff"},{"path":"/usr/libexec/git-core/mergetools/smerge"},{"path":"/usr/libexec/git-core/mergetools/tkdiff"},{"path":"/usr/libexec/git-core/mergetools/tortoisemerge"},{"path":"/usr/libexec/git-core/mergetools/vimdiff"},{"path":"/usr/libexec/git-core/mergetools/winmerge"},{"path":"/usr/libexec/git-core/mergetools/xxdiff"},{"path":"/usr/share"},{"path":"/usr/share/git-core"},{"path":"/usr/share/git-core/templates"},{"path":"/usr/share/git-core/templates/description"},{"path":"/usr/share/git-core/templates/branches"},{"path":"/usr/share/git-core/templates/hooks"},{"path":"/usr/share/git-core/templates/hooks/applypatch-msg.sample"},{"path":"/usr/share/git-core/templates/hooks/commit-msg.sample"},{"path":"/usr/share/git-core/templates/hooks/post-update.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-applypatch.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-commit.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-merge-commit.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-push.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-rebase.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-receive.sample"},{"path":"/usr/share/git-core/templates/hooks/prepare-commit-msg.sample"},{"path":"/usr/share/git-core/templates/hooks/push-to-checkout.sample"},{"path":"/usr/share/git-core/templates/hooks/update.sample"},{"path":"/usr/share/git-core/templates/info"},{"path":"/usr/share/git-core/templates/info/exclude"},{"path":"/usr/share/perl5"},{"path":"/var"},{"path":"/var/git"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"git"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2022-24975","versionConstraint":"<= 2.35.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:git-scm:git:2.30.6:*:*:*:*:*:*:*"],"package":{"name":"git","version":"2.30.6-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2022-24975","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-24975","cwe":"CWE-668","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-24975","date":"2026-10-08","epss":0.02624,"percentile":0.85025}],"risk":1.75808,"urls":["https://github.com/git/git/blob/2dc94da3744bfbbf145eca587a0f5ff480cc5867/Documentation/git-clone.txt#L185-L191","https://lore.kernel.org/git/xmqq4k14qe9g.fsf%40gitster.g/","https://www.aquasec.com/blog/undetected-hard-code-secrets-expose-corporations/","https://wwws.nightwatchcybersecurity.com/2022/02/11/gitbleed/"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-24975","description":"The --mirror documentation for Git through 2.35.1 does not mention the availability of deleted content, aka the \"GitBleed\" issue. This could present a security risk if information-disclosure auditing processes rely on a clone operation without the --mirror option. Note: This has been disputed by multiple 3rd parties who believe this is an intended feature of the git binary and does not pose a security risk."},"relatedVulnerabilities":[]},{"artifact":{"id":"6040784032e8795c","cpes":["cpe:2.3:a:curl:curl:7.79.1-r3:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:7.79.1-r3:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/busybox/curl@7.79.1-r3?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"7.79.1-r3","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2023-27533","versionConstraint":">= 7.7, < 8.0.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:haxx:curl:7.79.1:*:*:*:*:*:*:*"],"package":{"name":"curl","version":"7.79.1-r3"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2023-27533","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-27533","cwe":"CWE-75","type":"Secondary","source":"support@hackerone.com"},{"cve":"CVE-2023-27533","cwe":"CWE-74","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-27533","date":"2026-10-08","epss":0.01993,"percentile":0.80048}],"risk":1.67412,"urls":["https://hackerone.com/reports/1891474","https://lists.debian.org/debian-lts-announce/2023/04/msg00025.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/36NBD5YLJXXEDZLDGNFCERWRYJQ6LAQW/","https://security.gentoo.org/glsa/202310-12","https://security.netapp.com/advisory/ntap-20230420-0011/","https://advisory.splunk.com/advisories/SVD-2023-0809","https://curl.se/docs/CVE-2023-27533.json"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-27533","description":"A vulnerability in input validation exists in curl <8.0 during communication using the TELNET protocol may allow an attacker to pass on maliciously crafted user name and \"telnet options\" during server negotiation. The lack of proper input scrubbing allows an attacker to send content or perform option negotiation without the application's intent. This vulnerability could be exploited if an application allows user input, thereby enabling attackers to execute arbitrary code on the system."},"relatedVulnerabilities":[]},{"artifact":{"id":"d081de97c6f633df","cpes":["cpe:2.3:a:libcrypto1.1:libcrypto1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto1.1:libcrypto:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto:libcrypto1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto:libcrypto:1.1.1q-r0:*:*:*:*:*:*:*"],"name":"libcrypto1.1","purl":"pkg:apk/busybox/libcrypto1.1@1.1.1q-r0?arch=x86_64&distro=busybox-1.32.1&upstream=openssl","type":"apk","version":"1.1.1q-r0","language":"","licenses":["OpenSSL"],"metadata":{"Arch":"x86_64","files":[{"path":"/etc"},{"path":"/etc/ssl"},{"path":"/etc/ssl/ct_log_list.cnf"},{"path":"/etc/ssl/ct_log_list.cnf.dist"},{"path":"/etc/ssl/openssl.cnf"},{"path":"/etc/ssl/openssl.cnf.dist"},{"path":"/etc/ssl/certs"},{"path":"/etc/ssl/misc"},{"path":"/etc/ssl/misc/CA.pl"},{"path":"/etc/ssl/misc/tsget"},{"path":"/etc/ssl/misc/tsget.pl"},{"path":"/etc/ssl/private"},{"path":"/lib"},{"path":"/lib/libcrypto.so.1.1"},{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcrypto.so.1.1"},{"path":"/usr/lib/engines-1.1"},{"path":"/usr/lib/engines-1.1/afalg.so"},{"path":"/usr/lib/engines-1.1/capi.so"},{"path":"/usr/lib/engines-1.1/padlock.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2024-0727","versionConstraint":">= 1.0.2, < 1.0.2zj||>= 1.1.1, < 1.1.1x||>= 3.0.0, < 3.0.13||>= 3.1.0, < 3.1.5||= 3.2.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:1.1.1q:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"1.1.1q-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2024-0727","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-0727","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"},{"cve":"CVE-2024-0727","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-0727","date":"2026-10-08","epss":0.03187,"percentile":0.877}],"risk":1.6731750000000003,"urls":["https://github.com/openssl/openssl/commit/09df4395b5071217b76dc7d3d2e630eb8c5a79c2","https://github.com/openssl/openssl/commit/775acfdbd0c6af9ac855f34969cdab0c0c90844a","https://github.com/openssl/openssl/commit/d135eeab8a5dbf72b3da5240bab9ddb7678dbd2c","https://github.openssl.org/openssl/extended-releases/commit/03b3941d60c4bce58fab69a0c22377ab439bc0e8","https://github.openssl.org/openssl/extended-releases/commit/aebaa5883e31122b404e450732dc833dc9dee539","https://www.openssl.org/news/secadv/20240125.txt","http://www.openwall.com/lists/oss-security/2024/03/11/1","https://lists.debian.org/debian-lts-announce/2024/10/msg00033.html","https://lists.debian.org/debian-lts-announce/2024/11/msg00000.html","https://security.netapp.com/advisory/ntap-20240208-0006/","https://cert-portal.siemens.com/productcert/html/ssa-265688.html","https://cert-portal.siemens.com/productcert/html/ssa-277137.html","https://cert-portal.siemens.com/productcert/html/ssa-331112.html","https://cert-portal.siemens.com/productcert/html/ssa-769027.html","https://cert-portal.siemens.com/productcert/html/ssa-915275.html"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-0727","description":"Issue summary: Processing a maliciously formatted PKCS12 file may lead OpenSSL\nto crash leading to a potential Denial of Service attack\n\nImpact summary: Applications loading files in the PKCS12 format from untrusted\nsources might terminate abruptly.\n\nA file in PKCS12 format can contain certificates and keys and may come from an\nuntrusted source. The PKCS12 specification allows certain fields to be NULL, but\nOpenSSL does not correctly check for this case. This can lead to a NULL pointer\ndereference that results in OpenSSL crashing. If an application processes PKCS12\nfiles from an untrusted source using the OpenSSL APIs then that application will\nbe vulnerable to this issue.\n\nOpenSSL APIs that are vulnerable to this are: PKCS12_parse(),\nPKCS12_unpack_p7data(), PKCS12_unpack_p7encdata(), PKCS12_unpack_authsafes()\nand PKCS12_newpass().\n\nWe have also fixed a similar issue in SMIME_write_PKCS7(). However since this\nfunction is related to writing data we do not consider it security significant.\n\nThe FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue."},"relatedVulnerabilities":[]},{"artifact":{"id":"74f4e71ff41d2d68","cpes":["cpe:2.3:a:libssl1.1:libssl1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl1.1:libssl:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl:1.1.1q-r0:*:*:*:*:*:*:*"],"name":"libssl1.1","purl":"pkg:apk/busybox/libssl1.1@1.1.1q-r0?arch=x86_64&distro=busybox-1.32.1&upstream=openssl","type":"apk","version":"1.1.1q-r0","language":"","licenses":["OpenSSL"],"metadata":{"Arch":"x86_64","files":[{"path":"/lib"},{"path":"/lib/libssl.so.1.1"},{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libssl.so.1.1"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2024-0727","versionConstraint":">= 1.0.2, < 1.0.2zj||>= 1.1.1, < 1.1.1x||>= 3.0.0, < 3.0.13||>= 3.1.0, < 3.1.5||= 3.2.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:1.1.1q:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"1.1.1q-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2024-0727","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-0727","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"},{"cve":"CVE-2024-0727","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-0727","date":"2026-10-08","epss":0.03187,"percentile":0.877}],"risk":1.6731750000000003,"urls":["https://github.com/openssl/openssl/commit/09df4395b5071217b76dc7d3d2e630eb8c5a79c2","https://github.com/openssl/openssl/commit/775acfdbd0c6af9ac855f34969cdab0c0c90844a","https://github.com/openssl/openssl/commit/d135eeab8a5dbf72b3da5240bab9ddb7678dbd2c","https://github.openssl.org/openssl/extended-releases/commit/03b3941d60c4bce58fab69a0c22377ab439bc0e8","https://github.openssl.org/openssl/extended-releases/commit/aebaa5883e31122b404e450732dc833dc9dee539","https://www.openssl.org/news/secadv/20240125.txt","http://www.openwall.com/lists/oss-security/2024/03/11/1","https://lists.debian.org/debian-lts-announce/2024/10/msg00033.html","https://lists.debian.org/debian-lts-announce/2024/11/msg00000.html","https://security.netapp.com/advisory/ntap-20240208-0006/","https://cert-portal.siemens.com/productcert/html/ssa-265688.html","https://cert-portal.siemens.com/productcert/html/ssa-277137.html","https://cert-portal.siemens.com/productcert/html/ssa-331112.html","https://cert-portal.siemens.com/productcert/html/ssa-769027.html","https://cert-portal.siemens.com/productcert/html/ssa-915275.html"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-0727","description":"Issue summary: Processing a maliciously formatted PKCS12 file may lead OpenSSL\nto crash leading to a potential Denial of Service attack\n\nImpact summary: Applications loading files in the PKCS12 format from untrusted\nsources might terminate abruptly.\n\nA file in PKCS12 format can contain certificates and keys and may come from an\nuntrusted source. The PKCS12 specification allows certain fields to be NULL, but\nOpenSSL does not correctly check for this case. This can lead to a NULL pointer\ndereference that results in OpenSSL crashing. If an application processes PKCS12\nfiles from an untrusted source using the OpenSSL APIs then that application will\nbe vulnerable to this issue.\n\nOpenSSL APIs that are vulnerable to this are: PKCS12_parse(),\nPKCS12_unpack_p7data(), PKCS12_unpack_p7encdata(), PKCS12_unpack_authsafes()\nand PKCS12_newpass().\n\nWe have also fixed a similar issue in SMIME_write_PKCS7(). However since this\nfunction is related to writing data we do not consider it security significant.\n\nThe FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue."},"relatedVulnerabilities":[]},{"artifact":{"id":"14807b4f7067817d","cpes":["cpe:2.3:a:openssl:openssl:1.1.1q-r0:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:apk/busybox/openssl@1.1.1q-r0?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"1.1.1q-r0","language":"","licenses":["OpenSSL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/openssl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2024-0727","versionConstraint":">= 1.0.2, < 1.0.2zj||>= 1.1.1, < 1.1.1x||>= 3.0.0, < 3.0.13||>= 3.1.0, < 3.1.5||= 3.2.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:1.1.1q:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"1.1.1q-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2024-0727","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-0727","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"},{"cve":"CVE-2024-0727","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-0727","date":"2026-10-08","epss":0.03187,"percentile":0.877}],"risk":1.6731750000000003,"urls":["https://github.com/openssl/openssl/commit/09df4395b5071217b76dc7d3d2e630eb8c5a79c2","https://github.com/openssl/openssl/commit/775acfdbd0c6af9ac855f34969cdab0c0c90844a","https://github.com/openssl/openssl/commit/d135eeab8a5dbf72b3da5240bab9ddb7678dbd2c","https://github.openssl.org/openssl/extended-releases/commit/03b3941d60c4bce58fab69a0c22377ab439bc0e8","https://github.openssl.org/openssl/extended-releases/commit/aebaa5883e31122b404e450732dc833dc9dee539","https://www.openssl.org/news/secadv/20240125.txt","http://www.openwall.com/lists/oss-security/2024/03/11/1","https://lists.debian.org/debian-lts-announce/2024/10/msg00033.html","https://lists.debian.org/debian-lts-announce/2024/11/msg00000.html","https://security.netapp.com/advisory/ntap-20240208-0006/","https://cert-portal.siemens.com/productcert/html/ssa-265688.html","https://cert-portal.siemens.com/productcert/html/ssa-277137.html","https://cert-portal.siemens.com/productcert/html/ssa-331112.html","https://cert-portal.siemens.com/productcert/html/ssa-769027.html","https://cert-portal.siemens.com/productcert/html/ssa-915275.html"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-0727","description":"Issue summary: Processing a maliciously formatted PKCS12 file may lead OpenSSL\nto crash leading to a potential Denial of Service attack\n\nImpact summary: Applications loading files in the PKCS12 format from untrusted\nsources might terminate abruptly.\n\nA file in PKCS12 format can contain certificates and keys and may come from an\nuntrusted source. The PKCS12 specification allows certain fields to be NULL, but\nOpenSSL does not correctly check for this case. This can lead to a NULL pointer\ndereference that results in OpenSSL crashing. If an application processes PKCS12\nfiles from an untrusted source using the OpenSSL APIs then that application will\nbe vulnerable to this issue.\n\nOpenSSL APIs that are vulnerable to this are: PKCS12_parse(),\nPKCS12_unpack_p7data(), PKCS12_unpack_p7encdata(), PKCS12_unpack_authsafes()\nand PKCS12_newpass().\n\nWe have also fixed a similar issue in SMIME_write_PKCS7(). However since this\nfunction is related to writing data we do not consider it security significant.\n\nThe FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue."},"relatedVulnerabilities":[]},{"artifact":{"id":"a45c752c9b8878aa","cpes":["cpe:2.3:a:php7:php7:7.4.26-r0:*:*:*:*:*:*:*","cpe:2.3:a:php7:php:7.4.26-r0:*:*:*:*:*:*:*","cpe:2.3:a:php:php7:7.4.26-r0:*:*:*:*:*:*:*","cpe:2.3:a:php:php:7.4.26-r0:*:*:*:*:*:*:*"],"name":"php7","purl":"pkg:apk/busybox/php7@7.4.26-r0?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"7.4.26-r0","language":"","licenses":["BSD-3-Clause","LGPL-2.0-or-later","MIT","PHP-3.01","Zend-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/php"},{"path":"/usr/bin/php7"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"php7"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:php:php:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2022-31630","versionConstraint":">= 7.4.0, < 7.4.33||>= 8.0.0, < 8.0.25||>= 8.1.0, < 8.1.12 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:php:php:7.4.26:*:*:*:*:*:*:*"],"package":{"name":"php7","version":"7.4.26-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2022-31630","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","metrics":{"baseScore":7.1,"impactScore":5.2,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-31630","cwe":"CWE-131","type":"Secondary","source":"security@php.net"},{"cve":"CVE-2022-31630","cwe":"CWE-190","type":"Secondary","source":"security@php.net"},{"cve":"CVE-2022-31630","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-31630","date":"2026-10-08","epss":0.02284,"percentile":0.82631}],"risk":1.6330599999999997,"urls":["https://bugs.php.net/bug.php?id=81739"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-31630","description":"In PHP versions prior to 7.4.33, 8.0.25 and 8.1.12, when using imageloadfont() function in gd extension, it is possible to supply a specially crafted font file, such as if the loaded font is used with imagechar() function, the read outside allocated buffer will be used. This can lead to crashes or disclosure of confidential information."},"relatedVulnerabilities":[]},{"artifact":{"id":"6040784032e8795c","cpes":["cpe:2.3:a:curl:curl:7.79.1-r3:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:7.79.1-r3:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/busybox/curl@7.79.1-r3?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"7.79.1-r3","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2022-22576","versionConstraint":">= 7.33.0, < 7.83.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:haxx:curl:7.79.1:*:*:*:*:*:*:*"],"package":{"name":"curl","version":"7.79.1-r3"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2022-22576","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:P/I:P/A:N","metrics":{"baseScore":5.5,"impactScore":5,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-22576","cwe":"CWE-287","type":"Secondary","source":"support@hackerone.com"},{"cve":"CVE-2022-22576","cwe":"CWE-306","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-22576","date":"2026-10-08","epss":0.02161,"percentile":0.8166}],"risk":1.5919366666666668,"urls":["https://hackerone.com/reports/1526328","https://lists.debian.org/debian-lts-announce/2022/08/msg00017.html","https://security.gentoo.org/glsa/202212-01","https://security.netapp.com/advisory/ntap-20220609-0008/","https://www.debian.org/security/2022/dsa-5197"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-22576","description":"An improper authentication vulnerability exists in curl 7.33.0 to and including 7.82.0 which might allow reuse OAUTH2-authenticated connections without properly making sure that the connection was authenticated with the same credentials as set for this transfer. This affects SASL-enabled protocols: SMPTP(S), IMAP(S), POP3(S) and LDAP(S) (openldap only)."},"relatedVulnerabilities":[]},{"artifact":{"id":"d081de97c6f633df","cpes":["cpe:2.3:a:libcrypto1.1:libcrypto1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto1.1:libcrypto:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto:libcrypto1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto:libcrypto:1.1.1q-r0:*:*:*:*:*:*:*"],"name":"libcrypto1.1","purl":"pkg:apk/busybox/libcrypto1.1@1.1.1q-r0?arch=x86_64&distro=busybox-1.32.1&upstream=openssl","type":"apk","version":"1.1.1q-r0","language":"","licenses":["OpenSSL"],"metadata":{"Arch":"x86_64","files":[{"path":"/etc"},{"path":"/etc/ssl"},{"path":"/etc/ssl/ct_log_list.cnf"},{"path":"/etc/ssl/ct_log_list.cnf.dist"},{"path":"/etc/ssl/openssl.cnf"},{"path":"/etc/ssl/openssl.cnf.dist"},{"path":"/etc/ssl/certs"},{"path":"/etc/ssl/misc"},{"path":"/etc/ssl/misc/CA.pl"},{"path":"/etc/ssl/misc/tsget"},{"path":"/etc/ssl/misc/tsget.pl"},{"path":"/etc/ssl/private"},{"path":"/lib"},{"path":"/lib/libcrypto.so.1.1"},{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcrypto.so.1.1"},{"path":"/usr/lib/engines-1.1"},{"path":"/usr/lib/engines-1.1/afalg.so"},{"path":"/usr/lib/engines-1.1/capi.so"},{"path":"/usr/lib/engines-1.1/padlock.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2023-3817","versionConstraint":">= 3.0.0, < 3.0.10||>= 3.1.0, < 3.1.2||= 1.0.2||= 1.0.2-beta1||= 1.0.2-beta2||= 1.0.2-beta3||= 1.0.2a||= 1.0.2b||= 1.0.2c||= 1.0.2d||= 1.0.2e||= 1.0.2f||= 1.0.2g||= 1.0.2h||= 1.0.2i||= 1.0.2j||= 1.0.2k||= 1.0.2l||= 1.0.2m||= 1.0.2n||= 1.0.2o||= 1.0.2p||= 1.0.2q||= 1.0.2r||= 1.0.2s||= 1.0.2t||= 1.0.2u||= 1.0.2v||= 1.0.2w||= 1.0.2x||= 1.0.2y||= 1.0.2za||= 1.0.2zb||= 1.0.2zc||= 1.0.2zd||= 1.0.2ze||= 1.0.2zf||= 1.0.2zg||= 1.0.2zh||= 1.1.1||= 1.1.1-pre1||= 1.1.1-pre2||= 1.1.1-pre3||= 1.1.1-pre4||= 1.1.1-pre5||= 1.1.1-pre6||= 1.1.1-pre7||= 1.1.1-pre8||= 1.1.1-pre9||= 1.1.1a||= 1.1.1b||= 1.1.1c||= 1.1.1d||= 1.1.1e||= 1.1.1f||= 1.1.1g||= 1.1.1h||= 1.1.1i||= 1.1.1j||= 1.1.1k||= 1.1.1l||= 1.1.1m||= 1.1.1n||= 1.1.1o||= 1.1.1p||= 1.1.1q||= 1.1.1r||= 1.1.1s||= 1.1.1t||= 1.1.1u (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:1.1.1q:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"1.1.1q-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2023-3817","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-3817","cwe":"CWE-606","type":"Secondary","source":"openssl-security@openssl.org"},{"cve":"CVE-2023-3817","cwe":"CWE-834","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-3817","date":"2026-10-08","epss":0.03047,"percentile":0.87153}],"risk":1.569205,"urls":["https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=6a1eb62c29db6cb5eec707f9338aee00f44e26f5","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=869ad69aadd985c7b8ca6f4e5dd0eb274c9f3644","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=9002fd07327a91f35ba6c1307e71fa6fd4409b7f","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=91ddeba0f2269b017dc06c46c993a788974b1aa5","https://www.openssl.org/news/secadv/20230731.txt","http://seclists.org/fulldisclosure/2023/Jul/43","http://www.openwall.com/lists/oss-security/2023/07/31/1","http://www.openwall.com/lists/oss-security/2023/09/22/11","http://www.openwall.com/lists/oss-security/2023/09/22/9","http://www.openwall.com/lists/oss-security/2023/11/06/2","https://lists.debian.org/debian-lts-announce/2023/08/msg00019.html","https://security.gentoo.org/glsa/202402-08","https://security.netapp.com/advisory/ntap-20230818-0014/","https://security.netapp.com/advisory/ntap-20231027-0008/","https://security.netapp.com/advisory/ntap-20240621-0006/"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-3817","description":"Issue summary: Checking excessively long DH keys or parameters may be very slow.\n\nImpact summary: Applications that use the functions DH_check(), DH_check_ex()\nor EVP_PKEY_param_check() to check a DH key or DH parameters may experience long\ndelays. Where the key or parameters that are being checked have been obtained\nfrom an untrusted source this may lead to a Denial of Service.\n\nThe function DH_check() performs various checks on DH parameters. After fixing\nCVE-2023-3446 it was discovered that a large q parameter value can also trigger\nan overly long computation during some of these checks. A correct q value,\nif present, cannot be larger than the modulus p parameter, thus it is\nunnecessary to perform these checks if q is larger than p.\n\nAn application that calls DH_check() and supplies a key or parameters obtained\nfrom an untrusted source could be vulnerable to a Denial of Service attack.\n\nThe function DH_check() is itself called by a number of other OpenSSL functions.\nAn application calling any of those other functions may similarly be affected.\nThe other functions affected by this are DH_check_ex() and\nEVP_PKEY_param_check().\n\nAlso vulnerable are the OpenSSL dhparam and pkeyparam command line applications\nwhen using the \"-check\" option.\n\nThe OpenSSL SSL/TLS implementation is not affected by this issue.\n\nThe OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue."},"relatedVulnerabilities":[]},{"artifact":{"id":"74f4e71ff41d2d68","cpes":["cpe:2.3:a:libssl1.1:libssl1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl1.1:libssl:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl:1.1.1q-r0:*:*:*:*:*:*:*"],"name":"libssl1.1","purl":"pkg:apk/busybox/libssl1.1@1.1.1q-r0?arch=x86_64&distro=busybox-1.32.1&upstream=openssl","type":"apk","version":"1.1.1q-r0","language":"","licenses":["OpenSSL"],"metadata":{"Arch":"x86_64","files":[{"path":"/lib"},{"path":"/lib/libssl.so.1.1"},{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libssl.so.1.1"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2023-3817","versionConstraint":">= 3.0.0, < 3.0.10||>= 3.1.0, < 3.1.2||= 1.0.2||= 1.0.2-beta1||= 1.0.2-beta2||= 1.0.2-beta3||= 1.0.2a||= 1.0.2b||= 1.0.2c||= 1.0.2d||= 1.0.2e||= 1.0.2f||= 1.0.2g||= 1.0.2h||= 1.0.2i||= 1.0.2j||= 1.0.2k||= 1.0.2l||= 1.0.2m||= 1.0.2n||= 1.0.2o||= 1.0.2p||= 1.0.2q||= 1.0.2r||= 1.0.2s||= 1.0.2t||= 1.0.2u||= 1.0.2v||= 1.0.2w||= 1.0.2x||= 1.0.2y||= 1.0.2za||= 1.0.2zb||= 1.0.2zc||= 1.0.2zd||= 1.0.2ze||= 1.0.2zf||= 1.0.2zg||= 1.0.2zh||= 1.1.1||= 1.1.1-pre1||= 1.1.1-pre2||= 1.1.1-pre3||= 1.1.1-pre4||= 1.1.1-pre5||= 1.1.1-pre6||= 1.1.1-pre7||= 1.1.1-pre8||= 1.1.1-pre9||= 1.1.1a||= 1.1.1b||= 1.1.1c||= 1.1.1d||= 1.1.1e||= 1.1.1f||= 1.1.1g||= 1.1.1h||= 1.1.1i||= 1.1.1j||= 1.1.1k||= 1.1.1l||= 1.1.1m||= 1.1.1n||= 1.1.1o||= 1.1.1p||= 1.1.1q||= 1.1.1r||= 1.1.1s||= 1.1.1t||= 1.1.1u (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:1.1.1q:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"1.1.1q-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2023-3817","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-3817","cwe":"CWE-606","type":"Secondary","source":"openssl-security@openssl.org"},{"cve":"CVE-2023-3817","cwe":"CWE-834","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-3817","date":"2026-10-08","epss":0.03047,"percentile":0.87153}],"risk":1.569205,"urls":["https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=6a1eb62c29db6cb5eec707f9338aee00f44e26f5","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=869ad69aadd985c7b8ca6f4e5dd0eb274c9f3644","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=9002fd07327a91f35ba6c1307e71fa6fd4409b7f","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=91ddeba0f2269b017dc06c46c993a788974b1aa5","https://www.openssl.org/news/secadv/20230731.txt","http://seclists.org/fulldisclosure/2023/Jul/43","http://www.openwall.com/lists/oss-security/2023/07/31/1","http://www.openwall.com/lists/oss-security/2023/09/22/11","http://www.openwall.com/lists/oss-security/2023/09/22/9","http://www.openwall.com/lists/oss-security/2023/11/06/2","https://lists.debian.org/debian-lts-announce/2023/08/msg00019.html","https://security.gentoo.org/glsa/202402-08","https://security.netapp.com/advisory/ntap-20230818-0014/","https://security.netapp.com/advisory/ntap-20231027-0008/","https://security.netapp.com/advisory/ntap-20240621-0006/"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-3817","description":"Issue summary: Checking excessively long DH keys or parameters may be very slow.\n\nImpact summary: Applications that use the functions DH_check(), DH_check_ex()\nor EVP_PKEY_param_check() to check a DH key or DH parameters may experience long\ndelays. Where the key or parameters that are being checked have been obtained\nfrom an untrusted source this may lead to a Denial of Service.\n\nThe function DH_check() performs various checks on DH parameters. After fixing\nCVE-2023-3446 it was discovered that a large q parameter value can also trigger\nan overly long computation during some of these checks. A correct q value,\nif present, cannot be larger than the modulus p parameter, thus it is\nunnecessary to perform these checks if q is larger than p.\n\nAn application that calls DH_check() and supplies a key or parameters obtained\nfrom an untrusted source could be vulnerable to a Denial of Service attack.\n\nThe function DH_check() is itself called by a number of other OpenSSL functions.\nAn application calling any of those other functions may similarly be affected.\nThe other functions affected by this are DH_check_ex() and\nEVP_PKEY_param_check().\n\nAlso vulnerable are the OpenSSL dhparam and pkeyparam command line applications\nwhen using the \"-check\" option.\n\nThe OpenSSL SSL/TLS implementation is not affected by this issue.\n\nThe OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue."},"relatedVulnerabilities":[]},{"artifact":{"id":"14807b4f7067817d","cpes":["cpe:2.3:a:openssl:openssl:1.1.1q-r0:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:apk/busybox/openssl@1.1.1q-r0?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"1.1.1q-r0","language":"","licenses":["OpenSSL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/openssl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2023-3817","versionConstraint":">= 3.0.0, < 3.0.10||>= 3.1.0, < 3.1.2||= 1.0.2||= 1.0.2-beta1||= 1.0.2-beta2||= 1.0.2-beta3||= 1.0.2a||= 1.0.2b||= 1.0.2c||= 1.0.2d||= 1.0.2e||= 1.0.2f||= 1.0.2g||= 1.0.2h||= 1.0.2i||= 1.0.2j||= 1.0.2k||= 1.0.2l||= 1.0.2m||= 1.0.2n||= 1.0.2o||= 1.0.2p||= 1.0.2q||= 1.0.2r||= 1.0.2s||= 1.0.2t||= 1.0.2u||= 1.0.2v||= 1.0.2w||= 1.0.2x||= 1.0.2y||= 1.0.2za||= 1.0.2zb||= 1.0.2zc||= 1.0.2zd||= 1.0.2ze||= 1.0.2zf||= 1.0.2zg||= 1.0.2zh||= 1.1.1||= 1.1.1-pre1||= 1.1.1-pre2||= 1.1.1-pre3||= 1.1.1-pre4||= 1.1.1-pre5||= 1.1.1-pre6||= 1.1.1-pre7||= 1.1.1-pre8||= 1.1.1-pre9||= 1.1.1a||= 1.1.1b||= 1.1.1c||= 1.1.1d||= 1.1.1e||= 1.1.1f||= 1.1.1g||= 1.1.1h||= 1.1.1i||= 1.1.1j||= 1.1.1k||= 1.1.1l||= 1.1.1m||= 1.1.1n||= 1.1.1o||= 1.1.1p||= 1.1.1q||= 1.1.1r||= 1.1.1s||= 1.1.1t||= 1.1.1u (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:1.1.1q:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"1.1.1q-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2023-3817","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-3817","cwe":"CWE-606","type":"Secondary","source":"openssl-security@openssl.org"},{"cve":"CVE-2023-3817","cwe":"CWE-834","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-3817","date":"2026-10-08","epss":0.03047,"percentile":0.87153}],"risk":1.569205,"urls":["https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=6a1eb62c29db6cb5eec707f9338aee00f44e26f5","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=869ad69aadd985c7b8ca6f4e5dd0eb274c9f3644","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=9002fd07327a91f35ba6c1307e71fa6fd4409b7f","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=91ddeba0f2269b017dc06c46c993a788974b1aa5","https://www.openssl.org/news/secadv/20230731.txt","http://seclists.org/fulldisclosure/2023/Jul/43","http://www.openwall.com/lists/oss-security/2023/07/31/1","http://www.openwall.com/lists/oss-security/2023/09/22/11","http://www.openwall.com/lists/oss-security/2023/09/22/9","http://www.openwall.com/lists/oss-security/2023/11/06/2","https://lists.debian.org/debian-lts-announce/2023/08/msg00019.html","https://security.gentoo.org/glsa/202402-08","https://security.netapp.com/advisory/ntap-20230818-0014/","https://security.netapp.com/advisory/ntap-20231027-0008/","https://security.netapp.com/advisory/ntap-20240621-0006/"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-3817","description":"Issue summary: Checking excessively long DH keys or parameters may be very slow.\n\nImpact summary: Applications that use the functions DH_check(), DH_check_ex()\nor EVP_PKEY_param_check() to check a DH key or DH parameters may experience long\ndelays. Where the key or parameters that are being checked have been obtained\nfrom an untrusted source this may lead to a Denial of Service.\n\nThe function DH_check() performs various checks on DH parameters. After fixing\nCVE-2023-3446 it was discovered that a large q parameter value can also trigger\nan overly long computation during some of these checks. A correct q value,\nif present, cannot be larger than the modulus p parameter, thus it is\nunnecessary to perform these checks if q is larger than p.\n\nAn application that calls DH_check() and supplies a key or parameters obtained\nfrom an untrusted source could be vulnerable to a Denial of Service attack.\n\nThe function DH_check() is itself called by a number of other OpenSSL functions.\nAn application calling any of those other functions may similarly be affected.\nThe other functions affected by this are DH_check_ex() and\nEVP_PKEY_param_check().\n\nAlso vulnerable are the OpenSSL dhparam and pkeyparam command line applications\nwhen using the \"-check\" option.\n\nThe OpenSSL SSL/TLS implementation is not affected by this issue.\n\nThe OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue."},"relatedVulnerabilities":[]},{"artifact":{"id":"6040784032e8795c","cpes":["cpe:2.3:a:curl:curl:7.79.1-r3:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:7.79.1-r3:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/busybox/curl@7.79.1-r3?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"7.79.1-r3","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2023-28320","versionConstraint":"< 8.1.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:haxx:curl:7.79.1:*:*:*:*:*:*:*"],"package":{"name":"curl","version":"7.79.1-r3"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2023-28320","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-28320","cwe":"CWE-400","type":"Secondary","source":"support@hackerone.com"},{"cve":"CVE-2023-28320","cwe":"CWE-362","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-28320","cwe":"CWE-400","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-28320","date":"2026-10-08","epss":0.02658,"percentile":0.85241}],"risk":1.44861,"urls":["http://seclists.org/fulldisclosure/2023/Jul/47","http://seclists.org/fulldisclosure/2023/Jul/48","http://seclists.org/fulldisclosure/2023/Jul/52","https://hackerone.com/reports/1929597","https://security.gentoo.org/glsa/202310-12","https://security.netapp.com/advisory/ntap-20230609-0009/","https://support.apple.com/kb/HT213843","https://support.apple.com/kb/HT213844","https://support.apple.com/kb/HT213845"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-28320","description":"A denial of service vulnerability exists in curl <v8.1.0 in the way libcurl provides several different backends for resolving host names, selected at build time. If it is built to use the synchronous resolver, it allows name resolves to time-out slow operations using `alarm()` and `siglongjmp()`. When doing this, libcurl used a global buffer that was not mutex protected and a multi-threaded application might therefore crash or otherwise misbehave."},"relatedVulnerabilities":[]},{"artifact":{"id":"f83ee23f6ddfb737","cpes":["cpe:2.3:a:linux-pam:linux-pam:1.5.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:linux-pam:linux_pam:1.5.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:linux_pam:linux-pam:1.5.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:linux_pam:linux_pam:1.5.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:linux:linux-pam:1.5.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:linux:linux_pam:1.5.1-r0:*:*:*:*:*:*:*"],"name":"linux-pam","purl":"pkg:apk/busybox/linux-pam@1.5.1-r0?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"1.5.1-r0","language":"","licenses":["BSD-3-Clause"],"metadata":{"Arch":"x86_64","files":[{"path":"/etc"},{"path":"/etc/environment"},{"path":"/etc/pam.d"},{"path":"/etc/pam.d/base-account"},{"path":"/etc/pam.d/base-auth"},{"path":"/etc/pam.d/base-password"},{"path":"/etc/pam.d/base-session"},{"path":"/etc/pam.d/base-session-noninteractive"},{"path":"/etc/pam.d/other"},{"path":"/etc/pam.d/su"},{"path":"/etc/pam.d/system-local-login"},{"path":"/etc/pam.d/system-login"},{"path":"/etc/security"},{"path":"/etc/security/access.conf"},{"path":"/etc/security/faillock.conf"},{"path":"/etc/security/group.conf"},{"path":"/etc/security/limits.conf"},{"path":"/etc/security/namespace.conf"},{"path":"/etc/security/namespace.init"},{"path":"/etc/security/pam_env.conf"},{"path":"/etc/security/time.conf"},{"path":"/etc/security/limits.d"},{"path":"/etc/security/namespace.d"},{"path":"/lib"},{"path":"/lib/libpam.so.0"},{"path":"/lib/libpam.so.0.85.1"},{"path":"/lib/libpam_misc.so.0"},{"path":"/lib/libpam_misc.so.0.82.1"},{"path":"/lib/libpamc.so.0"},{"path":"/lib/libpamc.so.0.82.1"},{"path":"/lib/security"},{"path":"/lib/security/pam_access.so"},{"path":"/lib/security/pam_debug.so"},{"path":"/lib/security/pam_deny.so"},{"path":"/lib/security/pam_echo.so"},{"path":"/lib/security/pam_env.so"},{"path":"/lib/security/pam_exec.so"},{"path":"/lib/security/pam_faildelay.so"},{"path":"/lib/security/pam_faillock.so"},{"path":"/lib/security/pam_filter.so"},{"path":"/lib/security/pam_ftp.so"},{"path":"/lib/security/pam_group.so"},{"path":"/lib/security/pam_issue.so"},{"path":"/lib/security/pam_keyinit.so"},{"path":"/lib/security/pam_limits.so"},{"path":"/lib/security/pam_listfile.so"},{"path":"/lib/security/pam_localuser.so"},{"path":"/lib/security/pam_loginuid.so"},{"path":"/lib/security/pam_mail.so"},{"path":"/lib/security/pam_mkhomedir.so"},{"path":"/lib/security/pam_motd.so"},{"path":"/lib/security/pam_namespace.so"},{"path":"/lib/security/pam_nologin.so"},{"path":"/lib/security/pam_permit.so"},{"path":"/lib/security/pam_pwhistory.so"},{"path":"/lib/security/pam_rootok.so"},{"path":"/lib/security/pam_securetty.so"},{"path":"/lib/security/pam_setquota.so"},{"path":"/lib/security/pam_shells.so"},{"path":"/lib/security/pam_stress.so"},{"path":"/lib/security/pam_succeed_if.so"},{"path":"/lib/security/pam_time.so"},{"path":"/lib/security/pam_timestamp.so"},{"path":"/lib/security/pam_umask.so"},{"path":"/lib/security/pam_unix.so"},{"path":"/lib/security/pam_usertype.so"},{"path":"/lib/security/pam_warn.so"},{"path":"/lib/security/pam_wheel.so"},{"path":"/lib/security/pam_xauth.so"},{"path":"/lib/security/pam_filter"},{"path":"/lib/security/pam_filter/upperLOWER"},{"path":"/sbin"},{"path":"/sbin/faillock"},{"path":"/sbin/mkhomedir_helper"},{"path":"/sbin/pam_namespace_helper"},{"path":"/sbin/pam_timestamp_check"},{"path":"/sbin/pwhistory_helper"},{"path":"/sbin/unix_chkpwd"},{"path":"/sbin/unix_update"},{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/systemd"},{"path":"/usr/lib/systemd/system"},{"path":"/usr/lib/systemd/system/pam_namespace.service"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"linux-pam"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:linux-pam:linux-pam:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2022-28321","versionConstraint":"< 1.5.2-6.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:linux-pam:linux-pam:1.5.1:*:*:*:*:*:*:*"],"package":{"name":"linux-pam","version":"1.5.1-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2022-28321","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-28321","cwe":"CWE-287","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-28321","cwe":"CWE-287","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-28321","date":"2026-10-08","epss":0.01502,"percentile":0.73524}],"risk":1.41188,"urls":["http://download.opensuse.org/source/distribution/openSUSE-current/repo/oss/src/","https://bugzilla.suse.com/show_bug.cgi?id=1197654","https://www.suse.com/security/cve/CVE-2022-28321.html"],"severity":"Critical","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-28321","description":"The Linux-PAM package before 1.5.2-6.1 for openSUSE Tumbleweed allows authentication bypass for SSH logins. The pam_access.so module doesn't correctly restrict login if a user tries to connect from an IP address that is not resolvable via DNS. In such conditions, a user with denied access to a machine can still get access. NOTE: the relevance of this issue is largely limited to openSUSE Tumbleweed and openSUSE Factory; it does not affect Linux-PAM upstream."},"relatedVulnerabilities":[]},{"artifact":{"id":"6040784032e8795c","cpes":["cpe:2.3:a:curl:curl:7.79.1-r3:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:7.79.1-r3:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/busybox/curl@7.79.1-r3?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"7.79.1-r3","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2022-42916","versionConstraint":">= 7.77.0, < 7.86.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:haxx:curl:7.79.1:*:*:*:*:*:*:*"],"package":{"name":"curl","version":"7.79.1-r3"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2022-42916","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-42916","cwe":"CWE-319","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-42916","cwe":"CWE-319","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-42916","date":"2026-10-08","epss":0.01846,"percentile":0.78409}],"risk":1.3845,"urls":["http://seclists.org/fulldisclosure/2023/Jan/19","http://seclists.org/fulldisclosure/2023/Jan/20","http://www.openwall.com/lists/oss-security/2022/12/21/1","https://curl.se/docs/CVE-2022-42916.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/37YEVVC6NAF6H7UHH6YAUY5QEVY6LIH2/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HVU3IMZCKR4VE6KJ4GCWRL2ILLC6OV76/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Q27V5YYMXUVI6PRZQVECON32XPVWTKDK/","https://security.gentoo.org/glsa/202212-01","https://security.netapp.com/advisory/ntap-20221209-0010/","https://support.apple.com/kb/HT213604","https://support.apple.com/kb/HT213605"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-42916","description":"In curl before 7.86.0, the HSTS check could be bypassed to trick it into staying with HTTP. Using its HSTS support, curl can be instructed to use HTTPS directly (instead of using an insecure cleartext HTTP step) even when HTTP is provided in the URL. This mechanism could be bypassed if the host name in the given URL uses IDN characters that get replaced with ASCII counterparts as part of the IDN conversion, e.g., using the character UTF-8 U+3002 (IDEOGRAPHIC FULL STOP) instead of the common ASCII full stop of U+002E (.). The earliest affected version is 7.77.0 2021-05-26."},"relatedVulnerabilities":[]},{"artifact":{"id":"422a442f930ca27c","cpes":["cpe:2.3:a:nginx:nginx:1.18.0-r15:*:*:*:*:*:*:*"],"name":"nginx","purl":"pkg:apk/busybox/nginx@1.18.0-r15?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"1.18.0-r15","language":"","licenses":["BSD-2-Clause"],"metadata":{"Arch":"x86_64","files":[{"path":"/etc"},{"path":"/etc/logrotate.d"},{"path":"/etc/logrotate.d/nginx"},{"path":"/etc/nginx"},{"path":"/etc/nginx/fastcgi.conf"},{"path":"/etc/nginx/fastcgi_params"},{"path":"/etc/nginx/mime.types"},{"path":"/etc/nginx/nginx.conf"},{"path":"/etc/nginx/scgi_params"},{"path":"/etc/nginx/uwsgi_params"},{"path":"/etc/nginx/http.d"},{"path":"/etc/nginx/modules"},{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/nginx"},{"path":"/usr/lib/nginx/modules"},{"path":"/usr/sbin"},{"path":"/usr/sbin/nginx"},{"path":"/usr/share"},{"path":"/usr/share/nginx"},{"path":"/usr/share/nginx/http-default_server.conf"},{"path":"/var"},{"path":"/var/lib"},{"path":"/var/lib/nginx"},{"path":"/var/lib/nginx/logs"},{"path":"/var/lib/nginx/modules"},{"path":"/var/lib/nginx/run"},{"path":"/var/lib/nginx/html"},{"path":"/var/lib/nginx/html/50x.html"},{"path":"/var/lib/nginx/html/index.html"},{"path":"/var/lib/nginx/tmp"},{"path":"/var/log"},{"path":"/var/log/nginx"},{"path":"/var/www"},{"path":"/var/www/localhost"},{"path":"/var/www/localhost/htdocs"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"nginx"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:nginx:nginx:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-23419","versionConstraint":">= 1.11.4, < 1.26.3||>= 1.27, < 1.27.4 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:nginx:nginx:1.18.0:*:*:*:*:*:*:*"],"package":{"name":"nginx","version":"1.18.0-r15"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2025-23419","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"f5sirt@f5.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"f5sirt@f5.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-23419","cwe":"CWE-863","type":"Secondary","source":"f5sirt@f5.com"},{"cve":"CVE-2025-23419","cwe":"CWE-863","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-23419","date":"2026-10-08","epss":0.02795,"percentile":0.86024}],"risk":1.3695499999999998,"urls":["https://my.f5.com/manage/s/article/K000149173","http://www.openwall.com/lists/oss-security/2025/02/05/8","https://lists.debian.org/debian-lts-announce/2025/03/msg00017.html"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-23419","description":"When multiple server blocks are configured to share the same IP address and port, an attacker can use session resumption to bypass client certificate authentication requirements on these servers. This vulnerability arises when  TLS Session Tickets https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_session_ticket_key  are used and/or the  SSL session cache https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_session_cache  are used in the default server and the default server is performing client certificate authentication.  \n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated."},"relatedVulnerabilities":[]},{"artifact":{"id":"6040784032e8795c","cpes":["cpe:2.3:a:curl:curl:7.79.1-r3:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:7.79.1-r3:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/busybox/curl@7.79.1-r3?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"7.79.1-r3","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2022-43552","versionConstraint":"< 7.87.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:haxx:curl:7.79.1:*:*:*:*:*:*:*"],"package":{"name":"curl","version":"7.79.1-r3"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2022-43552","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-43552","cwe":"CWE-416","type":"Secondary","source":"support@hackerone.com"},{"cve":"CVE-2022-43552","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-43552","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-43552","date":"2026-10-08","epss":0.02511,"percentile":0.84298}],"risk":1.3684950000000002,"urls":["http://seclists.org/fulldisclosure/2023/Mar/17","https://hackerone.com/reports/1764858","https://security.gentoo.org/glsa/202310-12","https://security.netapp.com/advisory/ntap-20230214-0002/","https://support.apple.com/kb/HT213670"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-43552","description":"A use after free vulnerability exists in curl <7.87.0. Curl can be asked to *tunnel* virtually all protocols it supports through an HTTP proxy. HTTP proxies can (and often do) deny such tunnel operations. When getting denied to tunnel the specific protocols SMB or TELNET, curl would use a heap-allocated struct after it had been freed, in its transfer shutdown code path."},"relatedVulnerabilities":[]},{"artifact":{"id":"a45c752c9b8878aa","cpes":["cpe:2.3:a:php7:php7:7.4.26-r0:*:*:*:*:*:*:*","cpe:2.3:a:php7:php:7.4.26-r0:*:*:*:*:*:*:*","cpe:2.3:a:php:php7:7.4.26-r0:*:*:*:*:*:*:*","cpe:2.3:a:php:php:7.4.26-r0:*:*:*:*:*:*:*"],"name":"php7","purl":"pkg:apk/busybox/php7@7.4.26-r0?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"7.4.26-r0","language":"","licenses":["BSD-3-Clause","LGPL-2.0-or-later","MIT","PHP-3.01","Zend-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/php"},{"path":"/usr/bin/php7"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"php7"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:php:php:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2024-8929","versionConstraint":"< 8.1.31||>= 8.2, < 8.2.24||>= 8.3, < 8.3.14 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:php:php:7.4.26:*:*:*:*:*:*:*"],"package":{"name":"php7","version":"7.4.26-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2024-8929","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N","metrics":{"baseScore":5.8,"impactScore":4,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-8929","cwe":"CWE-125","type":"Secondary","source":"security@php.net"},{"cve":"CVE-2024-8929","cwe":"CWE-200","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2024-8929","date":"2026-10-08","epss":0.02238,"percentile":0.82282}],"risk":1.20852,"urls":["https://github.com/php/php-src/security/advisories/GHSA-h35g-vwh6-m678","https://lists.debian.org/debian-lts-announce/2024/12/msg00007.html","https://security.netapp.com/advisory/ntap-20250110-0008/"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-8929","description":"In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, a hostile MySQL server can cause the client to disclose the content of its heap containing data from other SQL requests and possible other data belonging to different users of the same server."},"relatedVulnerabilities":[]},{"artifact":{"id":"a45c752c9b8878aa","cpes":["cpe:2.3:a:php7:php7:7.4.26-r0:*:*:*:*:*:*:*","cpe:2.3:a:php7:php:7.4.26-r0:*:*:*:*:*:*:*","cpe:2.3:a:php:php7:7.4.26-r0:*:*:*:*:*:*:*","cpe:2.3:a:php:php:7.4.26-r0:*:*:*:*:*:*:*"],"name":"php7","purl":"pkg:apk/busybox/php7@7.4.26-r0?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"7.4.26-r0","language":"","licenses":["BSD-3-Clause","LGPL-2.0-or-later","MIT","PHP-3.01","Zend-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/php"},{"path":"/usr/bin/php7"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"php7"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:php:php:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2024-8932","versionConstraint":"< 8.1.31||>= 8.2, < 8.2.26||>= 8.3, < 8.3.14 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:php:php:7.4.26:*:*:*:*:*:*:*"],"package":{"name":"php7","version":"7.4.26-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2024-8932","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-8932","cwe":"CWE-787","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2024-8932","date":"2026-10-08","epss":0.01275,"percentile":0.69066}],"risk":1.1985,"urls":["https://github.com/php/php-src/security/advisories/GHSA-g665-fm4p-vhff","https://lists.debian.org/debian-lts-announce/2024/12/msg00007.html","https://security.netapp.com/advisory/ntap-20250110-0009/"],"severity":"Critical","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-8932","description":"In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, uncontrolled long string inputs to ldap_escape() function on 32-bit systems can cause an integer overflow, resulting in an out-of-bounds write."},"relatedVulnerabilities":[]},{"artifact":{"id":"d081de97c6f633df","cpes":["cpe:2.3:a:libcrypto1.1:libcrypto1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto1.1:libcrypto:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto:libcrypto1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto:libcrypto:1.1.1q-r0:*:*:*:*:*:*:*"],"name":"libcrypto1.1","purl":"pkg:apk/busybox/libcrypto1.1@1.1.1q-r0?arch=x86_64&distro=busybox-1.32.1&upstream=openssl","type":"apk","version":"1.1.1q-r0","language":"","licenses":["OpenSSL"],"metadata":{"Arch":"x86_64","files":[{"path":"/etc"},{"path":"/etc/ssl"},{"path":"/etc/ssl/ct_log_list.cnf"},{"path":"/etc/ssl/ct_log_list.cnf.dist"},{"path":"/etc/ssl/openssl.cnf"},{"path":"/etc/ssl/openssl.cnf.dist"},{"path":"/etc/ssl/certs"},{"path":"/etc/ssl/misc"},{"path":"/etc/ssl/misc/CA.pl"},{"path":"/etc/ssl/misc/tsget"},{"path":"/etc/ssl/misc/tsget.pl"},{"path":"/etc/ssl/private"},{"path":"/lib"},{"path":"/lib/libcrypto.so.1.1"},{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcrypto.so.1.1"},{"path":"/usr/lib/engines-1.1"},{"path":"/usr/lib/engines-1.1/afalg.so"},{"path":"/usr/lib/engines-1.1/capi.so"},{"path":"/usr/lib/engines-1.1/padlock.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-9230","versionConstraint":">= 1.0.2, < 1.0.2zm||>= 1.1.1, < 1.1.1zd||>= 3.0.0, < 3.0.18||>= 3.2.0, < 3.2.6||>= 3.3.0, < 3.3.5||>= 3.4.0, < 3.4.3||>= 3.5.0, < 3.5.4 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:1.1.1q:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"1.1.1q-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2025-9230","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-9230","cwe":"CWE-125","type":"Secondary","source":"openssl-security@openssl.org"},{"cve":"CVE-2025-9230","cwe":"CWE-787","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2025-9230","date":"2026-10-08","epss":0.01554,"percentile":0.74399}],"risk":1.1655,"urls":["https://github.com/openssl/openssl/commit/5965ea5dd6960f36d8b7f74f8eac67a8eb8f2b45","https://github.com/openssl/openssl/commit/9e91358f365dee6c446dcdcdb01c04d2743fd280","https://github.com/openssl/openssl/commit/a79c4ce559c6a3a8fd4109e9f33c1185d5bf2def","https://github.com/openssl/openssl/commit/b5282d677551afda7d20e9c00e09561b547b2dfd","https://github.com/openssl/openssl/commit/bae259a211ada6315dc50900686daaaaaa55f482","https://github.openssl.org/openssl/extended-releases/commit/c2b96348bfa662f25f4fabf81958ae822063dae3","https://github.openssl.org/openssl/extended-releases/commit/dfbaf161d8dafc1132dd88cd48ad990ed9b4c8ba","https://openssl-library.org/news/secadv/20250930.txt","http://www.openwall.com/lists/oss-security/2025/09/30/5","https://lists.debian.org/debian-lts-announce/2025/10/msg00001.html","https://cert-portal.siemens.com/productcert/html/ssa-032379.html","https://cert-portal.siemens.com/productcert/html/ssa-082556.html","https://cert-portal.siemens.com/productcert/html/ssa-089022.html","https://cert-portal.siemens.com/productcert/html/ssa-253495.html","https://cert-portal.siemens.com/productcert/html/ssa-265688.html","https://cert-portal.siemens.com/productcert/html/ssa-485750.html","https://cert-portal.siemens.com/productcert/html/ssa-585531.html"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-9230","description":"Issue summary: An application trying to decrypt CMS messages encrypted using\npassword based encryption can trigger an out-of-bounds read and write.\n\nImpact summary: This out-of-bounds read may trigger a crash which leads to\nDenial of Service for an application. The out-of-bounds write can cause\na memory corruption which can have various consequences including\na Denial of Service or Execution of attacker-supplied code.\n\nAlthough the consequences of a successful exploit of this vulnerability\ncould be severe, the probability that the attacker would be able to\nperform it is low. Besides, password based (PWRI) encryption support in CMS\nmessages is very rarely used. For that reason the issue was assessed as\nModerate severity according to our Security Policy.\n\nThe FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this\nissue, as the CMS implementation is outside the OpenSSL FIPS module\nboundary."},"relatedVulnerabilities":[]},{"artifact":{"id":"74f4e71ff41d2d68","cpes":["cpe:2.3:a:libssl1.1:libssl1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl1.1:libssl:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl:1.1.1q-r0:*:*:*:*:*:*:*"],"name":"libssl1.1","purl":"pkg:apk/busybox/libssl1.1@1.1.1q-r0?arch=x86_64&distro=busybox-1.32.1&upstream=openssl","type":"apk","version":"1.1.1q-r0","language":"","licenses":["OpenSSL"],"metadata":{"Arch":"x86_64","files":[{"path":"/lib"},{"path":"/lib/libssl.so.1.1"},{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libssl.so.1.1"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-9230","versionConstraint":">= 1.0.2, < 1.0.2zm||>= 1.1.1, < 1.1.1zd||>= 3.0.0, < 3.0.18||>= 3.2.0, < 3.2.6||>= 3.3.0, < 3.3.5||>= 3.4.0, < 3.4.3||>= 3.5.0, < 3.5.4 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:1.1.1q:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"1.1.1q-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2025-9230","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-9230","cwe":"CWE-125","type":"Secondary","source":"openssl-security@openssl.org"},{"cve":"CVE-2025-9230","cwe":"CWE-787","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2025-9230","date":"2026-10-08","epss":0.01554,"percentile":0.74399}],"risk":1.1655,"urls":["https://github.com/openssl/openssl/commit/5965ea5dd6960f36d8b7f74f8eac67a8eb8f2b45","https://github.com/openssl/openssl/commit/9e91358f365dee6c446dcdcdb01c04d2743fd280","https://github.com/openssl/openssl/commit/a79c4ce559c6a3a8fd4109e9f33c1185d5bf2def","https://github.com/openssl/openssl/commit/b5282d677551afda7d20e9c00e09561b547b2dfd","https://github.com/openssl/openssl/commit/bae259a211ada6315dc50900686daaaaaa55f482","https://github.openssl.org/openssl/extended-releases/commit/c2b96348bfa662f25f4fabf81958ae822063dae3","https://github.openssl.org/openssl/extended-releases/commit/dfbaf161d8dafc1132dd88cd48ad990ed9b4c8ba","https://openssl-library.org/news/secadv/20250930.txt","http://www.openwall.com/lists/oss-security/2025/09/30/5","https://lists.debian.org/debian-lts-announce/2025/10/msg00001.html","https://cert-portal.siemens.com/productcert/html/ssa-032379.html","https://cert-portal.siemens.com/productcert/html/ssa-082556.html","https://cert-portal.siemens.com/productcert/html/ssa-089022.html","https://cert-portal.siemens.com/productcert/html/ssa-253495.html","https://cert-portal.siemens.com/productcert/html/ssa-265688.html","https://cert-portal.siemens.com/productcert/html/ssa-485750.html","https://cert-portal.siemens.com/productcert/html/ssa-585531.html"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-9230","description":"Issue summary: An application trying to decrypt CMS messages encrypted using\npassword based encryption can trigger an out-of-bounds read and write.\n\nImpact summary: This out-of-bounds read may trigger a crash which leads to\nDenial of Service for an application. The out-of-bounds write can cause\na memory corruption which can have various consequences including\na Denial of Service or Execution of attacker-supplied code.\n\nAlthough the consequences of a successful exploit of this vulnerability\ncould be severe, the probability that the attacker would be able to\nperform it is low. Besides, password based (PWRI) encryption support in CMS\nmessages is very rarely used. For that reason the issue was assessed as\nModerate severity according to our Security Policy.\n\nThe FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this\nissue, as the CMS implementation is outside the OpenSSL FIPS module\nboundary."},"relatedVulnerabilities":[]},{"artifact":{"id":"14807b4f7067817d","cpes":["cpe:2.3:a:openssl:openssl:1.1.1q-r0:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:apk/busybox/openssl@1.1.1q-r0?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"1.1.1q-r0","language":"","licenses":["OpenSSL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/openssl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-9230","versionConstraint":">= 1.0.2, < 1.0.2zm||>= 1.1.1, < 1.1.1zd||>= 3.0.0, < 3.0.18||>= 3.2.0, < 3.2.6||>= 3.3.0, < 3.3.5||>= 3.4.0, < 3.4.3||>= 3.5.0, < 3.5.4 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:1.1.1q:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"1.1.1q-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2025-9230","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-9230","cwe":"CWE-125","type":"Secondary","source":"openssl-security@openssl.org"},{"cve":"CVE-2025-9230","cwe":"CWE-787","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2025-9230","date":"2026-10-08","epss":0.01554,"percentile":0.74399}],"risk":1.1655,"urls":["https://github.com/openssl/openssl/commit/5965ea5dd6960f36d8b7f74f8eac67a8eb8f2b45","https://github.com/openssl/openssl/commit/9e91358f365dee6c446dcdcdb01c04d2743fd280","https://github.com/openssl/openssl/commit/a79c4ce559c6a3a8fd4109e9f33c1185d5bf2def","https://github.com/openssl/openssl/commit/b5282d677551afda7d20e9c00e09561b547b2dfd","https://github.com/openssl/openssl/commit/bae259a211ada6315dc50900686daaaaaa55f482","https://github.openssl.org/openssl/extended-releases/commit/c2b96348bfa662f25f4fabf81958ae822063dae3","https://github.openssl.org/openssl/extended-releases/commit/dfbaf161d8dafc1132dd88cd48ad990ed9b4c8ba","https://openssl-library.org/news/secadv/20250930.txt","http://www.openwall.com/lists/oss-security/2025/09/30/5","https://lists.debian.org/debian-lts-announce/2025/10/msg00001.html","https://cert-portal.siemens.com/productcert/html/ssa-032379.html","https://cert-portal.siemens.com/productcert/html/ssa-082556.html","https://cert-portal.siemens.com/productcert/html/ssa-089022.html","https://cert-portal.siemens.com/productcert/html/ssa-253495.html","https://cert-portal.siemens.com/productcert/html/ssa-265688.html","https://cert-portal.siemens.com/productcert/html/ssa-485750.html","https://cert-portal.siemens.com/productcert/html/ssa-585531.html"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-9230","description":"Issue summary: An application trying to decrypt CMS messages encrypted using\npassword based encryption can trigger an out-of-bounds read and write.\n\nImpact summary: This out-of-bounds read may trigger a crash which leads to\nDenial of Service for an application. The out-of-bounds write can cause\na memory corruption which can have various consequences including\na Denial of Service or Execution of attacker-supplied code.\n\nAlthough the consequences of a successful exploit of this vulnerability\ncould be severe, the probability that the attacker would be able to\nperform it is low. Besides, password based (PWRI) encryption support in CMS\nmessages is very rarely used. For that reason the issue was assessed as\nModerate severity according to our Security Policy.\n\nThe FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this\nissue, as the CMS implementation is outside the OpenSSL FIPS module\nboundary."},"relatedVulnerabilities":[]},{"artifact":{"id":"a45c752c9b8878aa","cpes":["cpe:2.3:a:php7:php7:7.4.26-r0:*:*:*:*:*:*:*","cpe:2.3:a:php7:php:7.4.26-r0:*:*:*:*:*:*:*","cpe:2.3:a:php:php7:7.4.26-r0:*:*:*:*:*:*:*","cpe:2.3:a:php:php:7.4.26-r0:*:*:*:*:*:*:*"],"name":"php7","purl":"pkg:apk/busybox/php7@7.4.26-r0?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"7.4.26-r0","language":"","licenses":["BSD-3-Clause","LGPL-2.0-or-later","MIT","PHP-3.01","Zend-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/php"},{"path":"/usr/bin/php7"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"php7"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:php:php:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2024-11233","versionConstraint":"< 8.1.31||>= 8.2, < 8.2.26||>= 8.3, < 8.3.14 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:php:php:7.4.26:*:*:*:*:*:*:*"],"package":{"name":"php7","version":"7.4.26-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2024-11233","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L","metrics":{"baseScore":4.8,"impactScore":2.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-11233","cwe":"CWE-122","type":"Secondary","source":"security@php.net"},{"cve":"CVE-2024-11233","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-11233","date":"2026-10-08","epss":0.01607,"percentile":0.75156}],"risk":1.1249,"urls":["https://github.com/php/php-src/security/advisories/GHSA-r977-prxv-hc43","https://lists.debian.org/debian-lts-announce/2024/12/msg00007.html","https://security.netapp.com/advisory/ntap-20241220-0008/"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-11233","description":"In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, due to an error in convert.quoted-printable-decode filter certain data can lead to buffer overread by one byte, which can in certain circumstances lead to crashes or disclose content of other memory areas."},"relatedVulnerabilities":[]},{"artifact":{"id":"6040784032e8795c","cpes":["cpe:2.3:a:curl:curl:7.79.1-r3:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:7.79.1-r3:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/busybox/curl@7.79.1-r3?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"7.79.1-r3","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2024-9681","versionConstraint":">= 7.74.0, < 8.11.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:haxx:curl:7.79.1:*:*:*:*:*:*:*"],"package":{"name":"curl","version":"7.79.1-r3"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2024-9681","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-9681","cwe":"CWE-697","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-9681","date":"2026-10-08","epss":0.01987,"percentile":0.79983}],"risk":1.11272,"urls":["https://curl.se/docs/CVE-2024-9681.html","https://curl.se/docs/CVE-2024-9681.json","https://hackerone.com/reports/2764830","http://seclists.org/fulldisclosure/2025/Apr/10","http://seclists.org/fulldisclosure/2025/Apr/11","http://seclists.org/fulldisclosure/2025/Apr/12","http://seclists.org/fulldisclosure/2025/Apr/13","http://seclists.org/fulldisclosure/2025/Apr/4","http://seclists.org/fulldisclosure/2025/Apr/5","http://seclists.org/fulldisclosure/2025/Apr/8","http://seclists.org/fulldisclosure/2025/Apr/9","http://www.openwall.com/lists/oss-security/2024/11/06/2","https://security.netapp.com/advisory/ntap-20241213-0006/","https://github.com/curl/curl/commit/7385610d0c74c6a25","https://github.com/curl/curl/commit/a94973805df96269bf"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-9681","description":"When curl is asked to use HSTS, the expiry time for a subdomain might\noverwrite a parent domain's cache entry, making it end sooner or later than\notherwise intended.\n\nThis affects curl using applications that enable HSTS and use URLs with the\ninsecure `HTTP://` scheme and perform transfers with hosts like\n`x.example.com` as well as `example.com` where the first host is a subdomain\nof the second host.\n\n(The HSTS cache either needs to have been populated manually or there needs to\nhave been previous HTTPS accesses done as the cache needs to have entries for\nthe domains involved to trigger this problem.)\n\nWhen `x.example.com` responds with `Strict-Transport-Security:` headers, this\nbug can make the subdomain's expiry timeout *bleed over* and get set for the\nparent domain `example.com` in curl's HSTS cache.\n\nThe result of a triggered bug is that HTTP accesses to `example.com` get\nconverted to HTTPS for a different period of time than what was asked for by\nthe origin server. If `example.com` for example stops supporting HTTPS at its\nexpiry time, curl might then fail to access `http://example.com` until the\n(wrongly set) timeout expires. This bug can also expire the parent's entry\n*earlier*, thus making curl inadvertently switch back to insecure HTTP earlier\nthan otherwise intended."},"relatedVulnerabilities":[]},{"artifact":{"id":"a745c6f99abca0da","cpes":["cpe:2.3:a:libxml2:libxml2:2.9.14-r2:*:*:*:*:*:*:*","cpe:2.3:a:libxml2:libxml:2.9.14-r2:*:*:*:*:*:*:*","cpe:2.3:a:libxml:libxml2:2.9.14-r2:*:*:*:*:*:*:*","cpe:2.3:a:libxml:libxml:2.9.14-r2:*:*:*:*:*:*:*"],"name":"libxml2","purl":"pkg:apk/busybox/libxml2@2.9.14-r2?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"2.9.14-r2","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libxml2.so.2"},{"path":"/usr/lib/libxml2.so.2.9.14"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"libxml2"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:libxml2:libxml2:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2024-56171","versionConstraint":"< 2.12.10||>= 2.13.0, < 2.13.6 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:libxml2:libxml2:2.9.14:*:*:*:*:*:*:*"],"package":{"name":"libxml2","version":"2.9.14-r2"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2024-56171","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N","metrics":{"baseScore":7.8,"impactScore":5.8,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-56171","cwe":"CWE-416","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2024-56171","date":"2026-10-08","epss":0.01178,"percentile":0.66725}],"risk":1.0484200000000004,"urls":["https://gitlab.gnome.org/GNOME/libxml2/-/issues/828","http://seclists.org/fulldisclosure/2025/Apr/10","http://seclists.org/fulldisclosure/2025/Apr/11","http://seclists.org/fulldisclosure/2025/Apr/12","http://seclists.org/fulldisclosure/2025/Apr/13","http://seclists.org/fulldisclosure/2025/Apr/4","http://seclists.org/fulldisclosure/2025/Apr/5","http://seclists.org/fulldisclosure/2025/Apr/8","http://seclists.org/fulldisclosure/2025/Apr/9","https://lists.debian.org/debian-lts-announce/2025/02/msg00028.html","https://security.netapp.com/advisory/ntap-20250328-0010/"],"severity":"Critical","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-56171","description":"libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a use-after-free in xmlSchemaIDCFillNodeTables and xmlSchemaBubbleIDCNodeTables in xmlschemas.c. To exploit this, a crafted XML document must be validated against an XML schema with certain identity constraints, or a crafted XML schema must be used."},"relatedVulnerabilities":[]},{"artifact":{"id":"6040784032e8795c","cpes":["cpe:2.3:a:curl:curl:7.79.1-r3:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:7.79.1-r3:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/busybox/curl@7.79.1-r3?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"7.79.1-r3","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-9086","versionConstraint":">= 7.31.0, < 8.16.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:haxx:curl:7.79.1:*:*:*:*:*:*:*"],"package":{"name":"curl","version":"7.79.1-r3"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2025-9086","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-9086","cwe":"CWE-125","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2025-9086","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-9086","date":"2026-10-08","epss":0.01395,"percentile":0.71562}],"risk":1.04625,"urls":["https://curl.se/docs/CVE-2025-9086.html","https://curl.se/docs/CVE-2025-9086.json","https://hackerone.com/reports/3294999","http://www.openwall.com/lists/oss-security/2025/09/10/1","https://lists.debian.org/debian-lts-announce/2026/01/msg00002.html","https://cert-portal.siemens.com/productcert/html/ssa-089022.html","https://cert-portal.siemens.com/productcert/html/ssa-253495.html"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-9086","description":"1. A cookie is set using the `secure` keyword for `https://target`\n2. curl is redirected to or otherwise made to speak with `http://target` (same\n   hostname, but using clear text HTTP) using the same cookie set\n3. The same cookie name is set - but with only a slash as path (`path=\"/\"`).\n   Since this site is not secure, the cookie *should* be ignored.\n4. A bug in the path comparison logic makes curl read outside a heap buffer\n   boundary\n\nThe bug either causes a crash or it potentially makes the comparison come to\nthe wrong conclusion and lets the clear-text site override the contents of the\nsecure cookie, contrary to expectations and depending on the memory contents\nimmediately following the single-byte allocation that holds the path.\n\nThe presumed and correct behavior would be to plainly ignore the second set of\nthe cookie since it was already set as secure on a secure host so overriding\nit on an insecure host should not be okay."},"relatedVulnerabilities":[]},{"artifact":{"id":"de2e09a252869bf3","cpes":["cpe:2.3:a:git-scm:git:2.30.6-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_scm:git:2.30.6-r0:*:*:*:*:*:*:*","cpe:2.3:a:git:git:2.30.6-r0:*:*:*:*:*:*:*"],"name":"git","purl":"pkg:apk/busybox/git@2.30.6-r0?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"2.30.6-r0","language":"","licenses":["GPL-2.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/git"},{"path":"/usr/bin/git-receive-pack"},{"path":"/usr/bin/git-shell"},{"path":"/usr/bin/git-upload-archive"},{"path":"/usr/bin/git-upload-pack"},{"path":"/usr/libexec"},{"path":"/usr/libexec/git-core"},{"path":"/usr/libexec/git-core/git"},{"path":"/usr/libexec/git-core/git-add"},{"path":"/usr/libexec/git-core/git-am"},{"path":"/usr/libexec/git-core/git-annotate"},{"path":"/usr/libexec/git-core/git-apply"},{"path":"/usr/libexec/git-core/git-archive"},{"path":"/usr/libexec/git-core/git-bisect"},{"path":"/usr/libexec/git-core/git-bisect--helper"},{"path":"/usr/libexec/git-core/git-blame"},{"path":"/usr/libexec/git-core/git-branch"},{"path":"/usr/libexec/git-core/git-bugreport"},{"path":"/usr/libexec/git-core/git-bundle"},{"path":"/usr/libexec/git-core/git-cat-file"},{"path":"/usr/libexec/git-core/git-check-attr"},{"path":"/usr/libexec/git-core/git-check-ignore"},{"path":"/usr/libexec/git-core/git-check-mailmap"},{"path":"/usr/libexec/git-core/git-check-ref-format"},{"path":"/usr/libexec/git-core/git-checkout"},{"path":"/usr/libexec/git-core/git-checkout-index"},{"path":"/usr/libexec/git-core/git-cherry"},{"path":"/usr/libexec/git-core/git-cherry-pick"},{"path":"/usr/libexec/git-core/git-clean"},{"path":"/usr/libexec/git-core/git-clone"},{"path":"/usr/libexec/git-core/git-column"},{"path":"/usr/libexec/git-core/git-commit"},{"path":"/usr/libexec/git-core/git-commit-graph"},{"path":"/usr/libexec/git-core/git-commit-tree"},{"path":"/usr/libexec/git-core/git-config"},{"path":"/usr/libexec/git-core/git-count-objects"},{"path":"/usr/libexec/git-core/git-credential"},{"path":"/usr/libexec/git-core/git-credential-cache"},{"path":"/usr/libexec/git-core/git-credential-cache--daemon"},{"path":"/usr/libexec/git-core/git-credential-store"},{"path":"/usr/libexec/git-core/git-describe"},{"path":"/usr/libexec/git-core/git-diff"},{"path":"/usr/libexec/git-core/git-diff-files"},{"path":"/usr/libexec/git-core/git-diff-index"},{"path":"/usr/libexec/git-core/git-diff-tree"},{"path":"/usr/libexec/git-core/git-difftool"},{"path":"/usr/libexec/git-core/git-difftool--helper"},{"path":"/usr/libexec/git-core/git-env--helper"},{"path":"/usr/libexec/git-core/git-fast-export"},{"path":"/usr/libexec/git-core/git-fetch"},{"path":"/usr/libexec/git-core/git-fetch-pack"},{"path":"/usr/libexec/git-core/git-filter-branch"},{"path":"/usr/libexec/git-core/git-fmt-merge-msg"},{"path":"/usr/libexec/git-core/git-for-each-ref"},{"path":"/usr/libexec/git-core/git-for-each-repo"},{"path":"/usr/libexec/git-core/git-format-patch"},{"path":"/usr/libexec/git-core/git-fsck"},{"path":"/usr/libexec/git-core/git-fsck-objects"},{"path":"/usr/libexec/git-core/git-gc"},{"path":"/usr/libexec/git-core/git-get-tar-commit-id"},{"path":"/usr/libexec/git-core/git-grep"},{"path":"/usr/libexec/git-core/git-hash-object"},{"path":"/usr/libexec/git-core/git-help"},{"path":"/usr/libexec/git-core/git-http-fetch"},{"path":"/usr/libexec/git-core/git-http-push"},{"path":"/usr/libexec/git-core/git-index-pack"},{"path":"/usr/libexec/git-core/git-init"},{"path":"/usr/libexec/git-core/git-init-db"},{"path":"/usr/libexec/git-core/git-interpret-trailers"},{"path":"/usr/libexec/git-core/git-log"},{"path":"/usr/libexec/git-core/git-ls-files"},{"path":"/usr/libexec/git-core/git-ls-remote"},{"path":"/usr/libexec/git-core/git-ls-tree"},{"path":"/usr/libexec/git-core/git-mailinfo"},{"path":"/usr/libexec/git-core/git-mailsplit"},{"path":"/usr/libexec/git-core/git-maintenance"},{"path":"/usr/libexec/git-core/git-merge"},{"path":"/usr/libexec/git-core/git-merge-base"},{"path":"/usr/libexec/git-core/git-merge-file"},{"path":"/usr/libexec/git-core/git-merge-index"},{"path":"/usr/libexec/git-core/git-merge-octopus"},{"path":"/usr/libexec/git-core/git-merge-one-file"},{"path":"/usr/libexec/git-core/git-merge-ours"},{"path":"/usr/libexec/git-core/git-merge-recursive"},{"path":"/usr/libexec/git-core/git-merge-resolve"},{"path":"/usr/libexec/git-core/git-merge-subtree"},{"path":"/usr/libexec/git-core/git-merge-tree"},{"path":"/usr/libexec/git-core/git-mergetool"},{"path":"/usr/libexec/git-core/git-mergetool--lib"},{"path":"/usr/libexec/git-core/git-mktag"},{"path":"/usr/libexec/git-core/git-mktree"},{"path":"/usr/libexec/git-core/git-multi-pack-index"},{"path":"/usr/libexec/git-core/git-mv"},{"path":"/usr/libexec/git-core/git-name-rev"},{"path":"/usr/libexec/git-core/git-notes"},{"path":"/usr/libexec/git-core/git-pack-objects"},{"path":"/usr/libexec/git-core/git-pack-redundant"},{"path":"/usr/libexec/git-core/git-pack-refs"},{"path":"/usr/libexec/git-core/git-patch-id"},{"path":"/usr/libexec/git-core/git-prune"},{"path":"/usr/libexec/git-core/git-prune-packed"},{"path":"/usr/libexec/git-core/git-pull"},{"path":"/usr/libexec/git-core/git-push"},{"path":"/usr/libexec/git-core/git-quiltimport"},{"path":"/usr/libexec/git-core/git-range-diff"},{"path":"/usr/libexec/git-core/git-read-tree"},{"path":"/usr/libexec/git-core/git-rebase"},{"path":"/usr/libexec/git-core/git-rebase--preserve-merges"},{"path":"/usr/libexec/git-core/git-receive-pack"},{"path":"/usr/libexec/git-core/git-reflog"},{"path":"/usr/libexec/git-core/git-remote"},{"path":"/usr/libexec/git-core/git-remote-ext"},{"path":"/usr/libexec/git-core/git-remote-fd"},{"path":"/usr/libexec/git-core/git-remote-ftp"},{"path":"/usr/libexec/git-core/git-remote-ftps"},{"path":"/usr/libexec/git-core/git-remote-http"},{"path":"/usr/libexec/git-core/git-remote-https"},{"path":"/usr/libexec/git-core/git-repack"},{"path":"/usr/libexec/git-core/git-replace"},{"path":"/usr/libexec/git-core/git-request-pull"},{"path":"/usr/libexec/git-core/git-rerere"},{"path":"/usr/libexec/git-core/git-reset"},{"path":"/usr/libexec/git-core/git-restore"},{"path":"/usr/libexec/git-core/git-rev-list"},{"path":"/usr/libexec/git-core/git-rev-parse"},{"path":"/usr/libexec/git-core/git-revert"},{"path":"/usr/libexec/git-core/git-rm"},{"path":"/usr/libexec/git-core/git-send-pack"},{"path":"/usr/libexec/git-core/git-sh-i18n"},{"path":"/usr/libexec/git-core/git-sh-i18n--envsubst"},{"path":"/usr/libexec/git-core/git-sh-setup"},{"path":"/usr/libexec/git-core/git-shortlog"},{"path":"/usr/libexec/git-core/git-show"},{"path":"/usr/libexec/git-core/git-show-branch"},{"path":"/usr/libexec/git-core/git-show-index"},{"path":"/usr/libexec/git-core/git-show-ref"},{"path":"/usr/libexec/git-core/git-sparse-checkout"},{"path":"/usr/libexec/git-core/git-stage"},{"path":"/usr/libexec/git-core/git-stash"},{"path":"/usr/libexec/git-core/git-status"},{"path":"/usr/libexec/git-core/git-stripspace"},{"path":"/usr/libexec/git-core/git-submodule"},{"path":"/usr/libexec/git-core/git-submodule--helper"},{"path":"/usr/libexec/git-core/git-switch"},{"path":"/usr/libexec/git-core/git-symbolic-ref"},{"path":"/usr/libexec/git-core/git-tag"},{"path":"/usr/libexec/git-core/git-unpack-file"},{"path":"/usr/libexec/git-core/git-unpack-objects"},{"path":"/usr/libexec/git-core/git-update-index"},{"path":"/usr/libexec/git-core/git-update-ref"},{"path":"/usr/libexec/git-core/git-update-server-info"},{"path":"/usr/libexec/git-core/git-upload-archive"},{"path":"/usr/libexec/git-core/git-upload-pack"},{"path":"/usr/libexec/git-core/git-var"},{"path":"/usr/libexec/git-core/git-verify-commit"},{"path":"/usr/libexec/git-core/git-verify-pack"},{"path":"/usr/libexec/git-core/git-verify-tag"},{"path":"/usr/libexec/git-core/git-web--browse"},{"path":"/usr/libexec/git-core/git-whatchanged"},{"path":"/usr/libexec/git-core/git-worktree"},{"path":"/usr/libexec/git-core/git-write-tree"},{"path":"/usr/libexec/git-core/mergetools"},{"path":"/usr/libexec/git-core/mergetools/araxis"},{"path":"/usr/libexec/git-core/mergetools/bc"},{"path":"/usr/libexec/git-core/mergetools/codecompare"},{"path":"/usr/libexec/git-core/mergetools/deltawalker"},{"path":"/usr/libexec/git-core/mergetools/diffmerge"},{"path":"/usr/libexec/git-core/mergetools/diffuse"},{"path":"/usr/libexec/git-core/mergetools/ecmerge"},{"path":"/usr/libexec/git-core/mergetools/emerge"},{"path":"/usr/libexec/git-core/mergetools/examdiff"},{"path":"/usr/libexec/git-core/mergetools/guiffy"},{"path":"/usr/libexec/git-core/mergetools/gvimdiff"},{"path":"/usr/libexec/git-core/mergetools/kdiff3"},{"path":"/usr/libexec/git-core/mergetools/kompare"},{"path":"/usr/libexec/git-core/mergetools/meld"},{"path":"/usr/libexec/git-core/mergetools/nvimdiff"},{"path":"/usr/libexec/git-core/mergetools/opendiff"},{"path":"/usr/libexec/git-core/mergetools/smerge"},{"path":"/usr/libexec/git-core/mergetools/tkdiff"},{"path":"/usr/libexec/git-core/mergetools/tortoisemerge"},{"path":"/usr/libexec/git-core/mergetools/vimdiff"},{"path":"/usr/libexec/git-core/mergetools/winmerge"},{"path":"/usr/libexec/git-core/mergetools/xxdiff"},{"path":"/usr/share"},{"path":"/usr/share/git-core"},{"path":"/usr/share/git-core/templates"},{"path":"/usr/share/git-core/templates/description"},{"path":"/usr/share/git-core/templates/branches"},{"path":"/usr/share/git-core/templates/hooks"},{"path":"/usr/share/git-core/templates/hooks/applypatch-msg.sample"},{"path":"/usr/share/git-core/templates/hooks/commit-msg.sample"},{"path":"/usr/share/git-core/templates/hooks/post-update.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-applypatch.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-commit.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-merge-commit.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-push.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-rebase.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-receive.sample"},{"path":"/usr/share/git-core/templates/hooks/prepare-commit-msg.sample"},{"path":"/usr/share/git-core/templates/hooks/push-to-checkout.sample"},{"path":"/usr/share/git-core/templates/hooks/update.sample"},{"path":"/usr/share/git-core/templates/info"},{"path":"/usr/share/git-core/templates/info/exclude"},{"path":"/usr/share/perl5"},{"path":"/var"},{"path":"/var/git"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"git"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2024-32004","versionConstraint":"< 2.39.4||>= 2.40.0, < 2.40.2||>= 2.41.0, < 2.41.1||>= 2.42.0, < 2.42.2||>= 2.43.0, < 2.43.4||>= 2.44.0, < 2.44.1||>= 2.45.0, < 2.45.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:git-scm:git:2.30.6:*:*:*:*:*:*:*"],"package":{"name":"git","version":"2.30.6-r0"},"namespace":"nvd:cpe"}},{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:git:git:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2024-32004","versionConstraint":"< 2.39.4||>= 2.40.0, < 2.40.2||>= 2.41.0, < 2.41.1||>= 2.42.0, < 2.42.2||>= 2.43.0, < 2.43.4||>= 2.44.0, < 2.44.1||>= 2.45.0, < 2.45.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:git:git:2.30.6:*:*:*:*:*:*:*"],"package":{"name":"git","version":"2.30.6-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2024-32004","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":6.1,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-32004","cwe":"CWE-114","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2024-32004","date":"2026-10-08","epss":0.01351,"percentile":0.70675}],"risk":1.0436474999999998,"urls":["http://www.openwall.com/lists/oss-security/2024/05/14/2","https://git-scm.com/docs/git-clone","https://github.com/git/git/commit/f4aa8c8bb11dae6e769cd930565173808cbb69c8","https://github.com/git/git/security/advisories/GHSA-xfc6-vwr8-r389","https://lists.debian.org/debian-lts-announce/2024/06/msg00018.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/S4CK4IYTXEOBZTEM5K3T6LWOIZ3S44AR/","https://lists.debian.org/debian-lts-announce/2024/09/msg00009.html"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-32004","description":"Git is a revision control system. Prior to versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4, an attacker can prepare a local repository in such a way that, when cloned, will execute arbitrary code during the operation. The problem has been patched in versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4. As a workaround, avoid cloning repositories from untrusted sources."},"relatedVulnerabilities":[]},{"artifact":{"id":"6040784032e8795c","cpes":["cpe:2.3:a:curl:curl:7.79.1-r3:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:7.79.1-r3:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/busybox/curl@7.79.1-r3?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"7.79.1-r3","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2023-28321","versionConstraint":"< 8.1.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:haxx:curl:7.79.1:*:*:*:*:*:*:*"],"package":{"name":"curl","version":"7.79.1-r3"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2023-28321","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-28321","cwe":"CWE-295","type":"Secondary","source":"support@hackerone.com"},{"cve":"CVE-2023-28321","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-28321","date":"2026-10-08","epss":0.01806,"percentile":0.77908}],"risk":0.9842700000000001,"urls":["http://seclists.org/fulldisclosure/2023/Jul/47","http://seclists.org/fulldisclosure/2023/Jul/48","http://seclists.org/fulldisclosure/2023/Jul/52","https://hackerone.com/reports/1950627","https://lists.debian.org/debian-lts-announce/2023/10/msg00016.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F4I75RDGX5ULSSCBE5BF3P5I5SFO7ULQ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z2LIWHWKOVH24COGGBCVOWDXXIUPKOMK/","https://security.gentoo.org/glsa/202310-12","https://security.netapp.com/advisory/ntap-20230609-0009/","https://support.apple.com/kb/HT213843","https://support.apple.com/kb/HT213844","https://support.apple.com/kb/HT213845"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-28321","description":"An improper certificate validation vulnerability exists in curl <v8.1.0 in the way it supports matching of wildcard patterns when listed as \"Subject Alternative Name\" in TLS server certificates. curl can be built to use its own name matching function for TLS rather than one provided by a TLS library. This private wildcard matching function would match IDN (International Domain Name) hosts incorrectly and could as a result accept patterns that otherwise should mismatch. IDN hostnames are converted to puny code before used for certificate checks. Puny coded names always start with `xn--` and should not be allowed to pattern match, but the wildcard check in curl could still check for `x*`, which would match even though the IDN name most likely contained nothing even resembling an `x`."},"relatedVulnerabilities":[]},{"artifact":{"id":"d081de97c6f633df","cpes":["cpe:2.3:a:libcrypto1.1:libcrypto1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto1.1:libcrypto:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto:libcrypto1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto:libcrypto:1.1.1q-r0:*:*:*:*:*:*:*"],"name":"libcrypto1.1","purl":"pkg:apk/busybox/libcrypto1.1@1.1.1q-r0?arch=x86_64&distro=busybox-1.32.1&upstream=openssl","type":"apk","version":"1.1.1q-r0","language":"","licenses":["OpenSSL"],"metadata":{"Arch":"x86_64","files":[{"path":"/etc"},{"path":"/etc/ssl"},{"path":"/etc/ssl/ct_log_list.cnf"},{"path":"/etc/ssl/ct_log_list.cnf.dist"},{"path":"/etc/ssl/openssl.cnf"},{"path":"/etc/ssl/openssl.cnf.dist"},{"path":"/etc/ssl/certs"},{"path":"/etc/ssl/misc"},{"path":"/etc/ssl/misc/CA.pl"},{"path":"/etc/ssl/misc/tsget"},{"path":"/etc/ssl/misc/tsget.pl"},{"path":"/etc/ssl/private"},{"path":"/lib"},{"path":"/lib/libcrypto.so.1.1"},{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcrypto.so.1.1"},{"path":"/usr/lib/engines-1.1"},{"path":"/usr/lib/engines-1.1/afalg.so"},{"path":"/usr/lib/engines-1.1/capi.so"},{"path":"/usr/lib/engines-1.1/padlock.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-34180","versionConstraint":">= 1.0.2, < 1.0.2zq||>= 1.1.1, < 1.1.1zh||>= 3.0.0, < 3.0.21||>= 3.4.0, < 3.4.6||>= 3.5.0, < 3.5.7||>= 3.6.0, < 3.6.3||>= 4.0.0, < 4.0.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:1.1.1q:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"1.1.1q-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-34180","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-34180","cwe":"CWE-125","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-34180","date":"2026-10-08","epss":0.01311,"percentile":0.69792}],"risk":0.9832500000000001,"urls":["https://github.com/openssl/openssl/commit/1c6908e4fa5fa568752221d8eaf561a809751e5d","https://github.com/openssl/openssl/commit/cbe418ae978539cf14a398a207dba834c0e93e83","https://github.com/openssl/openssl/commit/d93853c42110d6319e3df07842b488cb9f7ac5ff","https://github.com/openssl/openssl/commit/da5d62af75f69d6fbf7803743d7c56ac75461e43","https://github.com/openssl/openssl/commit/f696c73c3e61b8c502d040af62e690c060908a16","https://openssl-library.org/news/secadv/20260609.txt"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-34180","description":"Issue summary: Parsing a crafted DER-encoded ASN.1 structure with a primitive\nelement whose content exceeds 2 gigabytes in length may cause a heap buffer\nover-read on 64-bit Unix and Unix-like platforms.\n\nImpact summary: The heap buffer over-read may crash the application (Denial of\nService) or to load into the decoded ASN.1 object contents of memory beyond the\nend of the input buffer.  More typically such ASN.1 elements would instead be\ntruncated.\n\nAn integer truncation in OpenSSL's ASN.1 decoder causes the content length of\nan ASN.1 primitive element to be mishandled when it exceeds 2 gigabytes. In the\nworst case the truncated length is treated as a request to scan the binary\ncontent for a terminating zero byte, possibly causing OpenSSL to read either\nless than or beyond the end of the allocated buffer.\n\nApplications that pass attacker-supplied data to d2i_X509(), d2i_PKCS7(), or\nany other d2i_* decoding function are affected. OpenSSL's own command-line\ntools are not vulnerable, as data read through the BIO layer is checked before\nit reaches the affected code. The issue only affects 64-bit Unix and Unix-like\nplatforms; 32-bit platforms and 64-bit Windows are not affected.\n\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4 and 3.0 are not affected by this issue,\nas the affected code is outside the OpenSSL FIPS module boundary."},"relatedVulnerabilities":[]},{"artifact":{"id":"74f4e71ff41d2d68","cpes":["cpe:2.3:a:libssl1.1:libssl1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl1.1:libssl:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl:1.1.1q-r0:*:*:*:*:*:*:*"],"name":"libssl1.1","purl":"pkg:apk/busybox/libssl1.1@1.1.1q-r0?arch=x86_64&distro=busybox-1.32.1&upstream=openssl","type":"apk","version":"1.1.1q-r0","language":"","licenses":["OpenSSL"],"metadata":{"Arch":"x86_64","files":[{"path":"/lib"},{"path":"/lib/libssl.so.1.1"},{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libssl.so.1.1"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-34180","versionConstraint":">= 1.0.2, < 1.0.2zq||>= 1.1.1, < 1.1.1zh||>= 3.0.0, < 3.0.21||>= 3.4.0, < 3.4.6||>= 3.5.0, < 3.5.7||>= 3.6.0, < 3.6.3||>= 4.0.0, < 4.0.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:1.1.1q:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"1.1.1q-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-34180","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-34180","cwe":"CWE-125","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-34180","date":"2026-10-08","epss":0.01311,"percentile":0.69792}],"risk":0.9832500000000001,"urls":["https://github.com/openssl/openssl/commit/1c6908e4fa5fa568752221d8eaf561a809751e5d","https://github.com/openssl/openssl/commit/cbe418ae978539cf14a398a207dba834c0e93e83","https://github.com/openssl/openssl/commit/d93853c42110d6319e3df07842b488cb9f7ac5ff","https://github.com/openssl/openssl/commit/da5d62af75f69d6fbf7803743d7c56ac75461e43","https://github.com/openssl/openssl/commit/f696c73c3e61b8c502d040af62e690c060908a16","https://openssl-library.org/news/secadv/20260609.txt"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-34180","description":"Issue summary: Parsing a crafted DER-encoded ASN.1 structure with a primitive\nelement whose content exceeds 2 gigabytes in length may cause a heap buffer\nover-read on 64-bit Unix and Unix-like platforms.\n\nImpact summary: The heap buffer over-read may crash the application (Denial of\nService) or to load into the decoded ASN.1 object contents of memory beyond the\nend of the input buffer.  More typically such ASN.1 elements would instead be\ntruncated.\n\nAn integer truncation in OpenSSL's ASN.1 decoder causes the content length of\nan ASN.1 primitive element to be mishandled when it exceeds 2 gigabytes. In the\nworst case the truncated length is treated as a request to scan the binary\ncontent for a terminating zero byte, possibly causing OpenSSL to read either\nless than or beyond the end of the allocated buffer.\n\nApplications that pass attacker-supplied data to d2i_X509(), d2i_PKCS7(), or\nany other d2i_* decoding function are affected. OpenSSL's own command-line\ntools are not vulnerable, as data read through the BIO layer is checked before\nit reaches the affected code. The issue only affects 64-bit Unix and Unix-like\nplatforms; 32-bit platforms and 64-bit Windows are not affected.\n\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4 and 3.0 are not affected by this issue,\nas the affected code is outside the OpenSSL FIPS module boundary."},"relatedVulnerabilities":[]},{"artifact":{"id":"14807b4f7067817d","cpes":["cpe:2.3:a:openssl:openssl:1.1.1q-r0:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:apk/busybox/openssl@1.1.1q-r0?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"1.1.1q-r0","language":"","licenses":["OpenSSL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/openssl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-34180","versionConstraint":">= 1.0.2, < 1.0.2zq||>= 1.1.1, < 1.1.1zh||>= 3.0.0, < 3.0.21||>= 3.4.0, < 3.4.6||>= 3.5.0, < 3.5.7||>= 3.6.0, < 3.6.3||>= 4.0.0, < 4.0.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:1.1.1q:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"1.1.1q-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-34180","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-34180","cwe":"CWE-125","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-34180","date":"2026-10-08","epss":0.01311,"percentile":0.69792}],"risk":0.9832500000000001,"urls":["https://github.com/openssl/openssl/commit/1c6908e4fa5fa568752221d8eaf561a809751e5d","https://github.com/openssl/openssl/commit/cbe418ae978539cf14a398a207dba834c0e93e83","https://github.com/openssl/openssl/commit/d93853c42110d6319e3df07842b488cb9f7ac5ff","https://github.com/openssl/openssl/commit/da5d62af75f69d6fbf7803743d7c56ac75461e43","https://github.com/openssl/openssl/commit/f696c73c3e61b8c502d040af62e690c060908a16","https://openssl-library.org/news/secadv/20260609.txt"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-34180","description":"Issue summary: Parsing a crafted DER-encoded ASN.1 structure with a primitive\nelement whose content exceeds 2 gigabytes in length may cause a heap buffer\nover-read on 64-bit Unix and Unix-like platforms.\n\nImpact summary: The heap buffer over-read may crash the application (Denial of\nService) or to load into the decoded ASN.1 object contents of memory beyond the\nend of the input buffer.  More typically such ASN.1 elements would instead be\ntruncated.\n\nAn integer truncation in OpenSSL's ASN.1 decoder causes the content length of\nan ASN.1 primitive element to be mishandled when it exceeds 2 gigabytes. In the\nworst case the truncated length is treated as a request to scan the binary\ncontent for a terminating zero byte, possibly causing OpenSSL to read either\nless than or beyond the end of the allocated buffer.\n\nApplications that pass attacker-supplied data to d2i_X509(), d2i_PKCS7(), or\nany other d2i_* decoding function are affected. OpenSSL's own command-line\ntools are not vulnerable, as data read through the BIO layer is checked before\nit reaches the affected code. The issue only affects 64-bit Unix and Unix-like\nplatforms; 32-bit platforms and 64-bit Windows are not affected.\n\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4 and 3.0 are not affected by this issue,\nas the affected code is outside the OpenSSL FIPS module boundary."},"relatedVulnerabilities":[]},{"artifact":{"id":"6040784032e8795c","cpes":["cpe:2.3:a:curl:curl:7.79.1-r3:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:7.79.1-r3:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/busybox/curl@7.79.1-r3?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"7.79.1-r3","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2023-23916","versionConstraint":">= 7.57.0, < 7.88.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:haxx:curl:7.79.1:*:*:*:*:*:*:*"],"package":{"name":"curl","version":"7.79.1-r3"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2023-23916","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-23916","cwe":"CWE-770","type":"Secondary","source":"support@hackerone.com"},{"cve":"CVE-2023-23916","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-23916","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-23916","date":"2026-10-08","epss":0.01703,"percentile":0.76556}],"risk":0.9792249999999999,"urls":["https://hackerone.com/reports/1826048","https://lists.debian.org/debian-lts-announce/2023/02/msg00035.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BQKE6TXYDHOTFHLTBZ5X73GTKI7II5KO/","https://security.gentoo.org/glsa/202310-12","https://security.netapp.com/advisory/ntap-20230309-0006/","https://www.debian.org/security/2023/dsa-5365"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-23916","description":"An allocation of resources without limits or throttling vulnerability exists in curl <v7.88.0 based on the \"chained\" HTTP compression algorithms, meaning that a server response can be compressed multiple times and potentially with differentalgorithms. The number of acceptable \"links\" in this \"decompression chain\" wascapped, but the cap was implemented on a per-header basis allowing a maliciousserver to insert a virtually unlimited number of compression steps simply byusing many headers. The use of such a decompression chain could result in a \"malloc bomb\", making curl end up spending enormous amounts of allocated heap memory, or trying to and returning out of memory errors."},"relatedVulnerabilities":[]},{"artifact":{"id":"6040784032e8795c","cpes":["cpe:2.3:a:curl:curl:7.79.1-r3:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:7.79.1-r3:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/busybox/curl@7.79.1-r3?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"7.79.1-r3","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2023-46218","versionConstraint":">= 7.46.0, < 8.5.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:haxx:curl:7.79.1:*:*:*:*:*:*:*"],"package":{"name":"curl","version":"7.79.1-r3"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2023-46218","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-46218","cwe":"CWE-178","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-46218","date":"2026-10-08","epss":0.01685,"percentile":0.76307}],"risk":0.9688749999999999,"urls":["https://curl.se/docs/CVE-2023-46218.html","https://hackerone.com/reports/2212193","https://lists.debian.org/debian-lts-announce/2023/12/msg00015.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3ZX3VW67N4ACRAPMV2QS2LVYGD7H2MVE/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UOGXU25FMMT2X6UUITQ7EZZYMJ42YWWD/","https://security.netapp.com/advisory/ntap-20240125-0007/","https://www.debian.org/security/2023/dsa-5587","https://cert-portal.siemens.com/productcert/html/ssa-082556.html","https://cert-portal.siemens.com/productcert/html/ssa-093430.html","https://cert-portal.siemens.com/productcert/html/ssa-202008.html","https://cert-portal.siemens.com/productcert/html/ssa-331112.html","https://curl.se/docs/CVE-2023-46218.json"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-46218","description":"This flaw allows a malicious HTTP server to set \"super cookies\" in curl that\nare then passed back to more origins than what is otherwise allowed or\npossible. This allows a site to set cookies that then would get sent to\ndifferent and unrelated sites and domains.\n\nIt could do this by exploiting a mixed case flaw in curl's function that\nverifies a given cookie domain against the Public Suffix List (PSL). For\nexample a cookie could be set with `domain=co.UK` when the URL used a lower\ncase hostname `curl.co.uk`, even though `co.uk` is listed as a PSL domain."},"relatedVulnerabilities":[]},{"artifact":{"id":"19103520a7fb35af","cpes":["cpe:2.3:a:nghttp2-libs:nghttp2-libs:1.42.0-r1:*:*:*:*:*:*:*","cpe:2.3:a:nghttp2-libs:nghttp2_libs:1.42.0-r1:*:*:*:*:*:*:*","cpe:2.3:a:nghttp2_libs:nghttp2-libs:1.42.0-r1:*:*:*:*:*:*:*","cpe:2.3:a:nghttp2_libs:nghttp2_libs:1.42.0-r1:*:*:*:*:*:*:*","cpe:2.3:a:nghttp-libs:nghttp2-libs:1.42.0-r1:*:*:*:*:*:*:*","cpe:2.3:a:nghttp-libs:nghttp2_libs:1.42.0-r1:*:*:*:*:*:*:*","cpe:2.3:a:nghttp2-libs:nghttp-libs:1.42.0-r1:*:*:*:*:*:*:*","cpe:2.3:a:nghttp2-libs:nghttp_libs:1.42.0-r1:*:*:*:*:*:*:*","cpe:2.3:a:nghttp2_libs:nghttp-libs:1.42.0-r1:*:*:*:*:*:*:*","cpe:2.3:a:nghttp2_libs:nghttp_libs:1.42.0-r1:*:*:*:*:*:*:*","cpe:2.3:a:nghttp_libs:nghttp2-libs:1.42.0-r1:*:*:*:*:*:*:*","cpe:2.3:a:nghttp_libs:nghttp2_libs:1.42.0-r1:*:*:*:*:*:*:*","cpe:2.3:a:nghttp-libs:nghttp-libs:1.42.0-r1:*:*:*:*:*:*:*","cpe:2.3:a:nghttp-libs:nghttp_libs:1.42.0-r1:*:*:*:*:*:*:*","cpe:2.3:a:nghttp_libs:nghttp-libs:1.42.0-r1:*:*:*:*:*:*:*","cpe:2.3:a:nghttp_libs:nghttp_libs:1.42.0-r1:*:*:*:*:*:*:*","cpe:2.3:a:nghttp2:nghttp2-libs:1.42.0-r1:*:*:*:*:*:*:*","cpe:2.3:a:nghttp2:nghttp2_libs:1.42.0-r1:*:*:*:*:*:*:*","cpe:2.3:a:nghttp2:nghttp-libs:1.42.0-r1:*:*:*:*:*:*:*","cpe:2.3:a:nghttp2:nghttp_libs:1.42.0-r1:*:*:*:*:*:*:*","cpe:2.3:a:nghttp:nghttp2-libs:1.42.0-r1:*:*:*:*:*:*:*","cpe:2.3:a:nghttp:nghttp2_libs:1.42.0-r1:*:*:*:*:*:*:*","cpe:2.3:a:nghttp:nghttp-libs:1.42.0-r1:*:*:*:*:*:*:*","cpe:2.3:a:nghttp:nghttp_libs:1.42.0-r1:*:*:*:*:*:*:*"],"name":"nghttp2-libs","purl":"pkg:apk/busybox/nghttp2-libs@1.42.0-r1?arch=x86_64&distro=busybox-1.32.1&upstream=nghttp2","type":"apk","version":"1.42.0-r1","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libnghttp2.so.14"},{"path":"/usr/lib/libnghttp2.so.14.20.1"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"nghttp2"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:nghttp2:nghttp2:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2023-35945","versionConstraint":"< 1.55.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:nghttp2:nghttp2:1.42.0:*:*:*:*:*:*:*"],"package":{"name":"nghttp2","version":"1.42.0-r1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2023-35945","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-35945","cwe":"CWE-400","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2023-35945","cwe":"CWE-459","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-35945","date":"2026-10-08","epss":0.01288,"percentile":0.69333}],"risk":0.966,"urls":["https://github.com/envoyproxy/envoy/security/advisories/GHSA-jfxv-29pc-x22r","https://github.com/nghttp2/nghttp2/blob/e7f59406556c80904b81b593d38508591bb7523a/lib/nghttp2_session.c#L3346"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-35945","description":"Envoy is a cloud-native high-performance edge/middle/service proxy. Envoy’s HTTP/2 codec may leak a header map and bookkeeping structures upon receiving `RST_STREAM` immediately followed by the `GOAWAY` frames from an upstream server. In nghttp2, cleanup of pending requests due to receipt of the `GOAWAY` frame skips de-allocation of the bookkeeping structure and pending compressed header. The error return [code path] is taken if connection is already marked for not sending more requests due to `GOAWAY` frame. The clean-up code is right after the return statement, causing memory leak. Denial of service through memory exhaustion. This vulnerability was patched in versions(s) 1.26.3, 1.25.8, 1.24.9, 1.23.11."},"relatedVulnerabilities":[]},{"artifact":{"id":"6040784032e8795c","cpes":["cpe:2.3:a:curl:curl:7.79.1-r3:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:7.79.1-r3:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/busybox/curl@7.79.1-r3?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"7.79.1-r3","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-0725","versionConstraint":">= 7.10.5, < 8.12.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:haxx:curl:7.79.1:*:*:*:*:*:*:*"],"package":{"name":"curl","version":"7.79.1-r3"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2025-0725","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-0725","cwe":"CWE-120","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-0725","date":"2026-10-08","epss":0.01264,"percentile":0.68825}],"risk":0.93536,"urls":["https://curl.se/docs/CVE-2025-0725.html","https://curl.se/docs/CVE-2025-0725.json","https://hackerone.com/reports/2956023","http://www.openwall.com/lists/oss-security/2025/02/05/3","http://www.openwall.com/lists/oss-security/2025/02/06/2","http://www.openwall.com/lists/oss-security/2025/02/06/4","https://github.com/curl/curl/commit/76f83f0db23846e254d940ec7","https://security.netapp.com/advisory/ntap-20250306-0009/"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-0725","description":"When libcurl is asked to perform automatic gzip decompression of\ncontent-encoded HTTP responses with the `CURLOPT_ACCEPT_ENCODING` option,\n**using zlib 1.2.0.3 or older**, an attacker-controlled integer overflow would\nmake libcurl perform a buffer overflow."},"relatedVulnerabilities":[]},{"artifact":{"id":"6040784032e8795c","cpes":["cpe:2.3:a:curl:curl:7.79.1-r3:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:7.79.1-r3:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/busybox/curl@7.79.1-r3?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"7.79.1-r3","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2022-27774","versionConstraint":">= 4.9, < 7.83.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:haxx:curl:7.79.1:*:*:*:*:*:*:*"],"package":{"name":"curl","version":"7.79.1-r3"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2022-27774","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.7,"impactScore":3.6,"exploitabilityScore":2.1},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:S/C:P/I:N/A:N","metrics":{"baseScore":3.5,"impactScore":2.9,"exploitabilityScore":6.9},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.7,"impactScore":3.6,"exploitabilityScore":2.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-27774","cwe":"CWE-522","type":"Secondary","source":"support@hackerone.com"},{"cve":"CVE-2022-27774","cwe":"CWE-522","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-27774","date":"2026-10-08","epss":0.0176,"percentile":0.7731}],"risk":0.8770666666666667,"urls":["https://hackerone.com/reports/1543773","https://lists.debian.org/debian-lts-announce/2023/01/msg00028.html","https://security.gentoo.org/glsa/202212-01","https://security.netapp.com/advisory/ntap-20220609-0008/","https://www.debian.org/security/2022/dsa-5197","https://advisory.splunk.com/advisories/SVD-2023-0809","https://curl.se/docs/CVE-2022-27774.json"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-27774","description":"An insufficiently protected credentials vulnerability exists in curl 4.9 to and include curl 7.82.0 are affected that could allow an attacker to extract credentials when follows HTTP(S) redirects is used with authentication could leak credentials to other services that exist on different protocols or port numbers."},"relatedVulnerabilities":[]},{"artifact":{"id":"a45c752c9b8878aa","cpes":["cpe:2.3:a:php7:php7:7.4.26-r0:*:*:*:*:*:*:*","cpe:2.3:a:php7:php:7.4.26-r0:*:*:*:*:*:*:*","cpe:2.3:a:php:php7:7.4.26-r0:*:*:*:*:*:*:*","cpe:2.3:a:php:php:7.4.26-r0:*:*:*:*:*:*:*"],"name":"php7","purl":"pkg:apk/busybox/php7@7.4.26-r0?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"7.4.26-r0","language":"","licenses":["BSD-3-Clause","LGPL-2.0-or-later","MIT","PHP-3.01","Zend-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/php"},{"path":"/usr/bin/php7"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"php7"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:php:php:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2024-3096","versionConstraint":"< 8.1.28||>= 8.2, < 8.2.18||>= 8.3, < 8.3.5 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:php:php:7.4.26:*:*:*:*:*:*:*"],"package":{"name":"php7","version":"7.4.26-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2024-3096","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-3096","cwe":"CWE-20","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2024-3096","date":"2026-10-08","epss":0.01492,"percentile":0.73352}],"risk":0.8578999999999998,"urls":["http://www.openwall.com/lists/oss-security/2024/04/12/11","https://github.com/php/php-src/security/advisories/GHSA-h746-cjrr-wfmr","https://lists.debian.org/debian-lts-announce/2024/05/msg00005.html","https://security.netapp.com/advisory/ntap-20240510-0010/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KJZK3X6B7FBE32FETDSMRLJXTFTHKWSY/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZGWIK3HMBACERGB4TSBB2JUOMPYY2VKY/"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-3096","description":"In PHP  version 8.1.* before 8.1.28, 8.2.* before 8.2.18, 8.3.* before 8.3.5, if a password stored with password_hash() starts with a null byte (\\x00), testing a blank string as the password via password_verify() will incorrectly return true."},"relatedVulnerabilities":[]},{"artifact":{"id":"43a7af5360b6604e","cpes":["cpe:2.3:a:pcre2:pcre2:10.36-r1:*:*:*:*:*:*:*","cpe:2.3:a:pcre2:pcre:10.36-r1:*:*:*:*:*:*:*","cpe:2.3:a:pcre:pcre2:10.36-r1:*:*:*:*:*:*:*","cpe:2.3:a:pcre:pcre:10.36-r1:*:*:*:*:*:*:*"],"name":"pcre2","purl":"pkg:apk/busybox/pcre2@10.36-r1?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"10.36-r1","language":"","licenses":["BSD-3-Clause"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpcre2-8.so.0"},{"path":"/usr/lib/libpcre2-8.so.0.10.1"},{"path":"/usr/lib/libpcre2-posix.so.2"},{"path":"/usr/lib/libpcre2-posix.so.2.0.3"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"pcre2"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:pcre:pcre2:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2022-41409","versionConstraint":"< 10.41 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:pcre:pcre2:10.36:*:*:*:*:*:*:*"],"package":{"name":"pcre2","version":"10.36-r1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2022-41409","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-41409","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-41409","date":"2026-10-08","epss":0.01121,"percentile":0.65174}],"risk":0.84075,"urls":["https://github.com/PCRE2Project/pcre2/commit/94e1c001761373b7d9450768aa15d04c25547a35","https://github.com/PCRE2Project/pcre2/issues/141"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-41409","description":"Integer overflow vulnerability in pcre2test before 10.41 allows attackers to cause a denial of service or other unspecified impacts via negative input."},"relatedVulnerabilities":[]},{"artifact":{"id":"d081de97c6f633df","cpes":["cpe:2.3:a:libcrypto1.1:libcrypto1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto1.1:libcrypto:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto:libcrypto1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto:libcrypto:1.1.1q-r0:*:*:*:*:*:*:*"],"name":"libcrypto1.1","purl":"pkg:apk/busybox/libcrypto1.1@1.1.1q-r0?arch=x86_64&distro=busybox-1.32.1&upstream=openssl","type":"apk","version":"1.1.1q-r0","language":"","licenses":["OpenSSL"],"metadata":{"Arch":"x86_64","files":[{"path":"/etc"},{"path":"/etc/ssl"},{"path":"/etc/ssl/ct_log_list.cnf"},{"path":"/etc/ssl/ct_log_list.cnf.dist"},{"path":"/etc/ssl/openssl.cnf"},{"path":"/etc/ssl/openssl.cnf.dist"},{"path":"/etc/ssl/certs"},{"path":"/etc/ssl/misc"},{"path":"/etc/ssl/misc/CA.pl"},{"path":"/etc/ssl/misc/tsget"},{"path":"/etc/ssl/misc/tsget.pl"},{"path":"/etc/ssl/private"},{"path":"/lib"},{"path":"/lib/libcrypto.so.1.1"},{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcrypto.so.1.1"},{"path":"/usr/lib/engines-1.1"},{"path":"/usr/lib/engines-1.1/afalg.so"},{"path":"/usr/lib/engines-1.1/capi.so"},{"path":"/usr/lib/engines-1.1/padlock.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2023-0466","versionConstraint":">= 1.0.2, < 1.0.2zh||>= 1.1.1, < 1.1.1u||>= 3.0.0, < 3.0.9||>= 3.1.0, < 3.1.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:1.1.1q:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"1.1.1q-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2023-0466","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-0466","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-0466","date":"2026-10-08","epss":0.01625,"percentile":0.75423}],"risk":0.8368750000000001,"urls":["http://www.openwall.com/lists/oss-security/2023/09/28/4","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=0d16b7e99aafc0b4a6d729eec65a411a7e025f0a","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=51e8a84ce742db0f6c70510d0159dad8f7825908","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=73398dea26de9899fb4baa94098ad0a61f435c72","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=fc814a30fc4f0bc54fcea7d9a7462f5457aab061","https://lists.debian.org/debian-lts-announce/2023/06/msg00011.html","https://security.gentoo.org/glsa/202402-08","https://security.netapp.com/advisory/ntap-20230414-0001/","https://www.debian.org/security/2023/dsa-5417","https://www.openssl.org/news/secadv/20230328.txt"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-0466","description":"The function X509_VERIFY_PARAM_add0_policy() is documented to\nimplicitly enable the certificate policy check when doing certificate\nverification. However the implementation of the function does not\nenable the check which allows certificates with invalid or incorrect\npolicies to pass the certificate verification.\n\nAs suddenly enabling the policy check could break existing deployments it was\ndecided to keep the existing behavior of the X509_VERIFY_PARAM_add0_policy()\nfunction.\n\nInstead the applications that require OpenSSL to perform certificate\npolicy check need to use X509_VERIFY_PARAM_set1_policies() or explicitly\nenable the policy check by calling X509_VERIFY_PARAM_set_flags() with\nthe X509_V_FLAG_POLICY_CHECK flag argument.\n\nCertificate policy checks are disabled by default in OpenSSL and are not\ncommonly used by applications."},"relatedVulnerabilities":[]},{"artifact":{"id":"74f4e71ff41d2d68","cpes":["cpe:2.3:a:libssl1.1:libssl1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl1.1:libssl:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl:1.1.1q-r0:*:*:*:*:*:*:*"],"name":"libssl1.1","purl":"pkg:apk/busybox/libssl1.1@1.1.1q-r0?arch=x86_64&distro=busybox-1.32.1&upstream=openssl","type":"apk","version":"1.1.1q-r0","language":"","licenses":["OpenSSL"],"metadata":{"Arch":"x86_64","files":[{"path":"/lib"},{"path":"/lib/libssl.so.1.1"},{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libssl.so.1.1"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2023-0466","versionConstraint":">= 1.0.2, < 1.0.2zh||>= 1.1.1, < 1.1.1u||>= 3.0.0, < 3.0.9||>= 3.1.0, < 3.1.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:1.1.1q:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"1.1.1q-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2023-0466","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-0466","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-0466","date":"2026-10-08","epss":0.01625,"percentile":0.75423}],"risk":0.8368750000000001,"urls":["http://www.openwall.com/lists/oss-security/2023/09/28/4","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=0d16b7e99aafc0b4a6d729eec65a411a7e025f0a","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=51e8a84ce742db0f6c70510d0159dad8f7825908","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=73398dea26de9899fb4baa94098ad0a61f435c72","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=fc814a30fc4f0bc54fcea7d9a7462f5457aab061","https://lists.debian.org/debian-lts-announce/2023/06/msg00011.html","https://security.gentoo.org/glsa/202402-08","https://security.netapp.com/advisory/ntap-20230414-0001/","https://www.debian.org/security/2023/dsa-5417","https://www.openssl.org/news/secadv/20230328.txt"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-0466","description":"The function X509_VERIFY_PARAM_add0_policy() is documented to\nimplicitly enable the certificate policy check when doing certificate\nverification. However the implementation of the function does not\nenable the check which allows certificates with invalid or incorrect\npolicies to pass the certificate verification.\n\nAs suddenly enabling the policy check could break existing deployments it was\ndecided to keep the existing behavior of the X509_VERIFY_PARAM_add0_policy()\nfunction.\n\nInstead the applications that require OpenSSL to perform certificate\npolicy check need to use X509_VERIFY_PARAM_set1_policies() or explicitly\nenable the policy check by calling X509_VERIFY_PARAM_set_flags() with\nthe X509_V_FLAG_POLICY_CHECK flag argument.\n\nCertificate policy checks are disabled by default in OpenSSL and are not\ncommonly used by applications."},"relatedVulnerabilities":[]},{"artifact":{"id":"14807b4f7067817d","cpes":["cpe:2.3:a:openssl:openssl:1.1.1q-r0:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:apk/busybox/openssl@1.1.1q-r0?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"1.1.1q-r0","language":"","licenses":["OpenSSL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/openssl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2023-0466","versionConstraint":">= 1.0.2, < 1.0.2zh||>= 1.1.1, < 1.1.1u||>= 3.0.0, < 3.0.9||>= 3.1.0, < 3.1.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:1.1.1q:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"1.1.1q-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2023-0466","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-0466","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-0466","date":"2026-10-08","epss":0.01625,"percentile":0.75423}],"risk":0.8368750000000001,"urls":["http://www.openwall.com/lists/oss-security/2023/09/28/4","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=0d16b7e99aafc0b4a6d729eec65a411a7e025f0a","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=51e8a84ce742db0f6c70510d0159dad8f7825908","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=73398dea26de9899fb4baa94098ad0a61f435c72","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=fc814a30fc4f0bc54fcea7d9a7462f5457aab061","https://lists.debian.org/debian-lts-announce/2023/06/msg00011.html","https://security.gentoo.org/glsa/202402-08","https://security.netapp.com/advisory/ntap-20230414-0001/","https://www.debian.org/security/2023/dsa-5417","https://www.openssl.org/news/secadv/20230328.txt"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-0466","description":"The function X509_VERIFY_PARAM_add0_policy() is documented to\nimplicitly enable the certificate policy check when doing certificate\nverification. However the implementation of the function does not\nenable the check which allows certificates with invalid or incorrect\npolicies to pass the certificate verification.\n\nAs suddenly enabling the policy check could break existing deployments it was\ndecided to keep the existing behavior of the X509_VERIFY_PARAM_add0_policy()\nfunction.\n\nInstead the applications that require OpenSSL to perform certificate\npolicy check need to use X509_VERIFY_PARAM_set1_policies() or explicitly\nenable the policy check by calling X509_VERIFY_PARAM_set_flags() with\nthe X509_V_FLAG_POLICY_CHECK flag argument.\n\nCertificate policy checks are disabled by default in OpenSSL and are not\ncommonly used by applications."},"relatedVulnerabilities":[]},{"artifact":{"id":"6040784032e8795c","cpes":["cpe:2.3:a:curl:curl:7.79.1-r3:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:7.79.1-r3:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/busybox/curl@7.79.1-r3?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"7.79.1-r3","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2023-28322","versionConstraint":"< 8.1.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:haxx:curl:7.79.1:*:*:*:*:*:*:*"],"package":{"name":"curl","version":"7.79.1-r3"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2023-28322","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-28322","cwe":"CWE-200","type":"Secondary","source":"support@hackerone.com"}],"epss":[{"cve":"CVE-2023-28322","date":"2026-10-08","epss":0.02211,"percentile":0.82062}],"risk":0.829125,"urls":["http://seclists.org/fulldisclosure/2023/Jul/47","http://seclists.org/fulldisclosure/2023/Jul/48","http://seclists.org/fulldisclosure/2023/Jul/52","https://hackerone.com/reports/1954658","https://lists.debian.org/debian-lts-announce/2023/12/msg00015.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F4I75RDGX5ULSSCBE5BF3P5I5SFO7ULQ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z2LIWHWKOVH24COGGBCVOWDXXIUPKOMK/","https://security.gentoo.org/glsa/202310-12","https://security.netapp.com/advisory/ntap-20230609-0009/","https://support.apple.com/kb/HT213843","https://support.apple.com/kb/HT213844","https://support.apple.com/kb/HT213845"],"severity":"Low","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-28322","description":"An information disclosure vulnerability exists in curl <v8.1.0 when doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the `CURLOPT_POSTFIELDS` option has been set, if the same handle previously wasused to issue a `PUT` request which used that callback. This flaw may surprise the application and cause it to misbehave and either send off the wrong data or use memory after free or similar in the second transfer. The problem exists in the logic for a reused handle when it is (expected to be) changed from a PUT to a POST."},"relatedVulnerabilities":[]},{"artifact":{"id":"de2e09a252869bf3","cpes":["cpe:2.3:a:git-scm:git:2.30.6-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_scm:git:2.30.6-r0:*:*:*:*:*:*:*","cpe:2.3:a:git:git:2.30.6-r0:*:*:*:*:*:*:*"],"name":"git","purl":"pkg:apk/busybox/git@2.30.6-r0?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"2.30.6-r0","language":"","licenses":["GPL-2.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/git"},{"path":"/usr/bin/git-receive-pack"},{"path":"/usr/bin/git-shell"},{"path":"/usr/bin/git-upload-archive"},{"path":"/usr/bin/git-upload-pack"},{"path":"/usr/libexec"},{"path":"/usr/libexec/git-core"},{"path":"/usr/libexec/git-core/git"},{"path":"/usr/libexec/git-core/git-add"},{"path":"/usr/libexec/git-core/git-am"},{"path":"/usr/libexec/git-core/git-annotate"},{"path":"/usr/libexec/git-core/git-apply"},{"path":"/usr/libexec/git-core/git-archive"},{"path":"/usr/libexec/git-core/git-bisect"},{"path":"/usr/libexec/git-core/git-bisect--helper"},{"path":"/usr/libexec/git-core/git-blame"},{"path":"/usr/libexec/git-core/git-branch"},{"path":"/usr/libexec/git-core/git-bugreport"},{"path":"/usr/libexec/git-core/git-bundle"},{"path":"/usr/libexec/git-core/git-cat-file"},{"path":"/usr/libexec/git-core/git-check-attr"},{"path":"/usr/libexec/git-core/git-check-ignore"},{"path":"/usr/libexec/git-core/git-check-mailmap"},{"path":"/usr/libexec/git-core/git-check-ref-format"},{"path":"/usr/libexec/git-core/git-checkout"},{"path":"/usr/libexec/git-core/git-checkout-index"},{"path":"/usr/libexec/git-core/git-cherry"},{"path":"/usr/libexec/git-core/git-cherry-pick"},{"path":"/usr/libexec/git-core/git-clean"},{"path":"/usr/libexec/git-core/git-clone"},{"path":"/usr/libexec/git-core/git-column"},{"path":"/usr/libexec/git-core/git-commit"},{"path":"/usr/libexec/git-core/git-commit-graph"},{"path":"/usr/libexec/git-core/git-commit-tree"},{"path":"/usr/libexec/git-core/git-config"},{"path":"/usr/libexec/git-core/git-count-objects"},{"path":"/usr/libexec/git-core/git-credential"},{"path":"/usr/libexec/git-core/git-credential-cache"},{"path":"/usr/libexec/git-core/git-credential-cache--daemon"},{"path":"/usr/libexec/git-core/git-credential-store"},{"path":"/usr/libexec/git-core/git-describe"},{"path":"/usr/libexec/git-core/git-diff"},{"path":"/usr/libexec/git-core/git-diff-files"},{"path":"/usr/libexec/git-core/git-diff-index"},{"path":"/usr/libexec/git-core/git-diff-tree"},{"path":"/usr/libexec/git-core/git-difftool"},{"path":"/usr/libexec/git-core/git-difftool--helper"},{"path":"/usr/libexec/git-core/git-env--helper"},{"path":"/usr/libexec/git-core/git-fast-export"},{"path":"/usr/libexec/git-core/git-fetch"},{"path":"/usr/libexec/git-core/git-fetch-pack"},{"path":"/usr/libexec/git-core/git-filter-branch"},{"path":"/usr/libexec/git-core/git-fmt-merge-msg"},{"path":"/usr/libexec/git-core/git-for-each-ref"},{"path":"/usr/libexec/git-core/git-for-each-repo"},{"path":"/usr/libexec/git-core/git-format-patch"},{"path":"/usr/libexec/git-core/git-fsck"},{"path":"/usr/libexec/git-core/git-fsck-objects"},{"path":"/usr/libexec/git-core/git-gc"},{"path":"/usr/libexec/git-core/git-get-tar-commit-id"},{"path":"/usr/libexec/git-core/git-grep"},{"path":"/usr/libexec/git-core/git-hash-object"},{"path":"/usr/libexec/git-core/git-help"},{"path":"/usr/libexec/git-core/git-http-fetch"},{"path":"/usr/libexec/git-core/git-http-push"},{"path":"/usr/libexec/git-core/git-index-pack"},{"path":"/usr/libexec/git-core/git-init"},{"path":"/usr/libexec/git-core/git-init-db"},{"path":"/usr/libexec/git-core/git-interpret-trailers"},{"path":"/usr/libexec/git-core/git-log"},{"path":"/usr/libexec/git-core/git-ls-files"},{"path":"/usr/libexec/git-core/git-ls-remote"},{"path":"/usr/libexec/git-core/git-ls-tree"},{"path":"/usr/libexec/git-core/git-mailinfo"},{"path":"/usr/libexec/git-core/git-mailsplit"},{"path":"/usr/libexec/git-core/git-maintenance"},{"path":"/usr/libexec/git-core/git-merge"},{"path":"/usr/libexec/git-core/git-merge-base"},{"path":"/usr/libexec/git-core/git-merge-file"},{"path":"/usr/libexec/git-core/git-merge-index"},{"path":"/usr/libexec/git-core/git-merge-octopus"},{"path":"/usr/libexec/git-core/git-merge-one-file"},{"path":"/usr/libexec/git-core/git-merge-ours"},{"path":"/usr/libexec/git-core/git-merge-recursive"},{"path":"/usr/libexec/git-core/git-merge-resolve"},{"path":"/usr/libexec/git-core/git-merge-subtree"},{"path":"/usr/libexec/git-core/git-merge-tree"},{"path":"/usr/libexec/git-core/git-mergetool"},{"path":"/usr/libexec/git-core/git-mergetool--lib"},{"path":"/usr/libexec/git-core/git-mktag"},{"path":"/usr/libexec/git-core/git-mktree"},{"path":"/usr/libexec/git-core/git-multi-pack-index"},{"path":"/usr/libexec/git-core/git-mv"},{"path":"/usr/libexec/git-core/git-name-rev"},{"path":"/usr/libexec/git-core/git-notes"},{"path":"/usr/libexec/git-core/git-pack-objects"},{"path":"/usr/libexec/git-core/git-pack-redundant"},{"path":"/usr/libexec/git-core/git-pack-refs"},{"path":"/usr/libexec/git-core/git-patch-id"},{"path":"/usr/libexec/git-core/git-prune"},{"path":"/usr/libexec/git-core/git-prune-packed"},{"path":"/usr/libexec/git-core/git-pull"},{"path":"/usr/libexec/git-core/git-push"},{"path":"/usr/libexec/git-core/git-quiltimport"},{"path":"/usr/libexec/git-core/git-range-diff"},{"path":"/usr/libexec/git-core/git-read-tree"},{"path":"/usr/libexec/git-core/git-rebase"},{"path":"/usr/libexec/git-core/git-rebase--preserve-merges"},{"path":"/usr/libexec/git-core/git-receive-pack"},{"path":"/usr/libexec/git-core/git-reflog"},{"path":"/usr/libexec/git-core/git-remote"},{"path":"/usr/libexec/git-core/git-remote-ext"},{"path":"/usr/libexec/git-core/git-remote-fd"},{"path":"/usr/libexec/git-core/git-remote-ftp"},{"path":"/usr/libexec/git-core/git-remote-ftps"},{"path":"/usr/libexec/git-core/git-remote-http"},{"path":"/usr/libexec/git-core/git-remote-https"},{"path":"/usr/libexec/git-core/git-repack"},{"path":"/usr/libexec/git-core/git-replace"},{"path":"/usr/libexec/git-core/git-request-pull"},{"path":"/usr/libexec/git-core/git-rerere"},{"path":"/usr/libexec/git-core/git-reset"},{"path":"/usr/libexec/git-core/git-restore"},{"path":"/usr/libexec/git-core/git-rev-list"},{"path":"/usr/libexec/git-core/git-rev-parse"},{"path":"/usr/libexec/git-core/git-revert"},{"path":"/usr/libexec/git-core/git-rm"},{"path":"/usr/libexec/git-core/git-send-pack"},{"path":"/usr/libexec/git-core/git-sh-i18n"},{"path":"/usr/libexec/git-core/git-sh-i18n--envsubst"},{"path":"/usr/libexec/git-core/git-sh-setup"},{"path":"/usr/libexec/git-core/git-shortlog"},{"path":"/usr/libexec/git-core/git-show"},{"path":"/usr/libexec/git-core/git-show-branch"},{"path":"/usr/libexec/git-core/git-show-index"},{"path":"/usr/libexec/git-core/git-show-ref"},{"path":"/usr/libexec/git-core/git-sparse-checkout"},{"path":"/usr/libexec/git-core/git-stage"},{"path":"/usr/libexec/git-core/git-stash"},{"path":"/usr/libexec/git-core/git-status"},{"path":"/usr/libexec/git-core/git-stripspace"},{"path":"/usr/libexec/git-core/git-submodule"},{"path":"/usr/libexec/git-core/git-submodule--helper"},{"path":"/usr/libexec/git-core/git-switch"},{"path":"/usr/libexec/git-core/git-symbolic-ref"},{"path":"/usr/libexec/git-core/git-tag"},{"path":"/usr/libexec/git-core/git-unpack-file"},{"path":"/usr/libexec/git-core/git-unpack-objects"},{"path":"/usr/libexec/git-core/git-update-index"},{"path":"/usr/libexec/git-core/git-update-ref"},{"path":"/usr/libexec/git-core/git-update-server-info"},{"path":"/usr/libexec/git-core/git-upload-archive"},{"path":"/usr/libexec/git-core/git-upload-pack"},{"path":"/usr/libexec/git-core/git-var"},{"path":"/usr/libexec/git-core/git-verify-commit"},{"path":"/usr/libexec/git-core/git-verify-pack"},{"path":"/usr/libexec/git-core/git-verify-tag"},{"path":"/usr/libexec/git-core/git-web--browse"},{"path":"/usr/libexec/git-core/git-whatchanged"},{"path":"/usr/libexec/git-core/git-worktree"},{"path":"/usr/libexec/git-core/git-write-tree"},{"path":"/usr/libexec/git-core/mergetools"},{"path":"/usr/libexec/git-core/mergetools/araxis"},{"path":"/usr/libexec/git-core/mergetools/bc"},{"path":"/usr/libexec/git-core/mergetools/codecompare"},{"path":"/usr/libexec/git-core/mergetools/deltawalker"},{"path":"/usr/libexec/git-core/mergetools/diffmerge"},{"path":"/usr/libexec/git-core/mergetools/diffuse"},{"path":"/usr/libexec/git-core/mergetools/ecmerge"},{"path":"/usr/libexec/git-core/mergetools/emerge"},{"path":"/usr/libexec/git-core/mergetools/examdiff"},{"path":"/usr/libexec/git-core/mergetools/guiffy"},{"path":"/usr/libexec/git-core/mergetools/gvimdiff"},{"path":"/usr/libexec/git-core/mergetools/kdiff3"},{"path":"/usr/libexec/git-core/mergetools/kompare"},{"path":"/usr/libexec/git-core/mergetools/meld"},{"path":"/usr/libexec/git-core/mergetools/nvimdiff"},{"path":"/usr/libexec/git-core/mergetools/opendiff"},{"path":"/usr/libexec/git-core/mergetools/smerge"},{"path":"/usr/libexec/git-core/mergetools/tkdiff"},{"path":"/usr/libexec/git-core/mergetools/tortoisemerge"},{"path":"/usr/libexec/git-core/mergetools/vimdiff"},{"path":"/usr/libexec/git-core/mergetools/winmerge"},{"path":"/usr/libexec/git-core/mergetools/xxdiff"},{"path":"/usr/share"},{"path":"/usr/share/git-core"},{"path":"/usr/share/git-core/templates"},{"path":"/usr/share/git-core/templates/description"},{"path":"/usr/share/git-core/templates/branches"},{"path":"/usr/share/git-core/templates/hooks"},{"path":"/usr/share/git-core/templates/hooks/applypatch-msg.sample"},{"path":"/usr/share/git-core/templates/hooks/commit-msg.sample"},{"path":"/usr/share/git-core/templates/hooks/post-update.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-applypatch.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-commit.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-merge-commit.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-push.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-rebase.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-receive.sample"},{"path":"/usr/share/git-core/templates/hooks/prepare-commit-msg.sample"},{"path":"/usr/share/git-core/templates/hooks/push-to-checkout.sample"},{"path":"/usr/share/git-core/templates/hooks/update.sample"},{"path":"/usr/share/git-core/templates/info"},{"path":"/usr/share/git-core/templates/info/exclude"},{"path":"/usr/share/perl5"},{"path":"/var"},{"path":"/var/git"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"git"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-48385","versionConstraint":"< 2.43.7||>= 2.44.0-rc0, < 2.44.4||>= 2.45.0-rc0, < 2.45.4||>= 2.46.0-rc0, < 2.46.4||>= 2.47.0-rc0, < 2.47.3||>= 2.48.0-rc0, < 2.48.2||>= 2.49.0-rc0, < 2.49.1||>= 2.50.0-rc0, < 2.50.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:git-scm:git:2.30.6:*:*:*:*:*:*:*"],"package":{"name":"git","version":"2.30.6-r0"},"namespace":"nvd:cpe"}},{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:git:git:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-48385","versionConstraint":"< 2.43.7||>= 2.44.0-rc0, < 2.44.4||>= 2.45.0-rc0, < 2.45.4||>= 2.46.0-rc0, < 2.46.4||>= 2.47.0-rc0, < 2.47.3||>= 2.48.0-rc0, < 2.48.2||>= 2.49.0-rc0, < 2.49.1||>= 2.50.0-rc0, < 2.50.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:git:git:2.30.6:*:*:*:*:*:*:*"],"package":{"name":"git","version":"2.30.6-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2025-48385","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-48385","cwe":"CWE-73","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2025-48385","cwe":"CWE-88","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-48385","date":"2026-10-08","epss":0.0102,"percentile":0.62302}],"risk":0.8210999999999999,"urls":["https://github.com/git/git/security/advisories/GHSA-m98c-vgpc-9655","http://www.openwall.com/lists/oss-security/2025/07/08/4"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-48385","description":"Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When cloning a repository Git knows to optionally fetch a bundle advertised by the remote server, which allows the server-side to offload parts of the clone to a CDN. The Git client does not perform sufficient validation of the advertised bundles, which allows the remote side to perform protocol injection. This protocol injection can cause the client to write the fetched bundle to a location controlled by the adversary. The fetched content is fully controlled by the server, which can in the worst case lead to arbitrary code execution. The use of bundle URIs is not enabled by default and can be controlled by the bundle.heuristic config option. Some cases of the vulnerability require that the adversary is in control of where a repository will be cloned to. This either requires social engineering or a recursive clone with submodules. These cases can thus be avoided by disabling recursive clones. This vulnerability is fixed in v2.43.7, v2.44.4, v2.45.4, v2.46.4, v2.47.3, v2.48.2, v2.49.1, and v2.50.1."},"relatedVulnerabilities":[]},{"artifact":{"id":"de2e09a252869bf3","cpes":["cpe:2.3:a:git-scm:git:2.30.6-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_scm:git:2.30.6-r0:*:*:*:*:*:*:*","cpe:2.3:a:git:git:2.30.6-r0:*:*:*:*:*:*:*"],"name":"git","purl":"pkg:apk/busybox/git@2.30.6-r0?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"2.30.6-r0","language":"","licenses":["GPL-2.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/git"},{"path":"/usr/bin/git-receive-pack"},{"path":"/usr/bin/git-shell"},{"path":"/usr/bin/git-upload-archive"},{"path":"/usr/bin/git-upload-pack"},{"path":"/usr/libexec"},{"path":"/usr/libexec/git-core"},{"path":"/usr/libexec/git-core/git"},{"path":"/usr/libexec/git-core/git-add"},{"path":"/usr/libexec/git-core/git-am"},{"path":"/usr/libexec/git-core/git-annotate"},{"path":"/usr/libexec/git-core/git-apply"},{"path":"/usr/libexec/git-core/git-archive"},{"path":"/usr/libexec/git-core/git-bisect"},{"path":"/usr/libexec/git-core/git-bisect--helper"},{"path":"/usr/libexec/git-core/git-blame"},{"path":"/usr/libexec/git-core/git-branch"},{"path":"/usr/libexec/git-core/git-bugreport"},{"path":"/usr/libexec/git-core/git-bundle"},{"path":"/usr/libexec/git-core/git-cat-file"},{"path":"/usr/libexec/git-core/git-check-attr"},{"path":"/usr/libexec/git-core/git-check-ignore"},{"path":"/usr/libexec/git-core/git-check-mailmap"},{"path":"/usr/libexec/git-core/git-check-ref-format"},{"path":"/usr/libexec/git-core/git-checkout"},{"path":"/usr/libexec/git-core/git-checkout-index"},{"path":"/usr/libexec/git-core/git-cherry"},{"path":"/usr/libexec/git-core/git-cherry-pick"},{"path":"/usr/libexec/git-core/git-clean"},{"path":"/usr/libexec/git-core/git-clone"},{"path":"/usr/libexec/git-core/git-column"},{"path":"/usr/libexec/git-core/git-commit"},{"path":"/usr/libexec/git-core/git-commit-graph"},{"path":"/usr/libexec/git-core/git-commit-tree"},{"path":"/usr/libexec/git-core/git-config"},{"path":"/usr/libexec/git-core/git-count-objects"},{"path":"/usr/libexec/git-core/git-credential"},{"path":"/usr/libexec/git-core/git-credential-cache"},{"path":"/usr/libexec/git-core/git-credential-cache--daemon"},{"path":"/usr/libexec/git-core/git-credential-store"},{"path":"/usr/libexec/git-core/git-describe"},{"path":"/usr/libexec/git-core/git-diff"},{"path":"/usr/libexec/git-core/git-diff-files"},{"path":"/usr/libexec/git-core/git-diff-index"},{"path":"/usr/libexec/git-core/git-diff-tree"},{"path":"/usr/libexec/git-core/git-difftool"},{"path":"/usr/libexec/git-core/git-difftool--helper"},{"path":"/usr/libexec/git-core/git-env--helper"},{"path":"/usr/libexec/git-core/git-fast-export"},{"path":"/usr/libexec/git-core/git-fetch"},{"path":"/usr/libexec/git-core/git-fetch-pack"},{"path":"/usr/libexec/git-core/git-filter-branch"},{"path":"/usr/libexec/git-core/git-fmt-merge-msg"},{"path":"/usr/libexec/git-core/git-for-each-ref"},{"path":"/usr/libexec/git-core/git-for-each-repo"},{"path":"/usr/libexec/git-core/git-format-patch"},{"path":"/usr/libexec/git-core/git-fsck"},{"path":"/usr/libexec/git-core/git-fsck-objects"},{"path":"/usr/libexec/git-core/git-gc"},{"path":"/usr/libexec/git-core/git-get-tar-commit-id"},{"path":"/usr/libexec/git-core/git-grep"},{"path":"/usr/libexec/git-core/git-hash-object"},{"path":"/usr/libexec/git-core/git-help"},{"path":"/usr/libexec/git-core/git-http-fetch"},{"path":"/usr/libexec/git-core/git-http-push"},{"path":"/usr/libexec/git-core/git-index-pack"},{"path":"/usr/libexec/git-core/git-init"},{"path":"/usr/libexec/git-core/git-init-db"},{"path":"/usr/libexec/git-core/git-interpret-trailers"},{"path":"/usr/libexec/git-core/git-log"},{"path":"/usr/libexec/git-core/git-ls-files"},{"path":"/usr/libexec/git-core/git-ls-remote"},{"path":"/usr/libexec/git-core/git-ls-tree"},{"path":"/usr/libexec/git-core/git-mailinfo"},{"path":"/usr/libexec/git-core/git-mailsplit"},{"path":"/usr/libexec/git-core/git-maintenance"},{"path":"/usr/libexec/git-core/git-merge"},{"path":"/usr/libexec/git-core/git-merge-base"},{"path":"/usr/libexec/git-core/git-merge-file"},{"path":"/usr/libexec/git-core/git-merge-index"},{"path":"/usr/libexec/git-core/git-merge-octopus"},{"path":"/usr/libexec/git-core/git-merge-one-file"},{"path":"/usr/libexec/git-core/git-merge-ours"},{"path":"/usr/libexec/git-core/git-merge-recursive"},{"path":"/usr/libexec/git-core/git-merge-resolve"},{"path":"/usr/libexec/git-core/git-merge-subtree"},{"path":"/usr/libexec/git-core/git-merge-tree"},{"path":"/usr/libexec/git-core/git-mergetool"},{"path":"/usr/libexec/git-core/git-mergetool--lib"},{"path":"/usr/libexec/git-core/git-mktag"},{"path":"/usr/libexec/git-core/git-mktree"},{"path":"/usr/libexec/git-core/git-multi-pack-index"},{"path":"/usr/libexec/git-core/git-mv"},{"path":"/usr/libexec/git-core/git-name-rev"},{"path":"/usr/libexec/git-core/git-notes"},{"path":"/usr/libexec/git-core/git-pack-objects"},{"path":"/usr/libexec/git-core/git-pack-redundant"},{"path":"/usr/libexec/git-core/git-pack-refs"},{"path":"/usr/libexec/git-core/git-patch-id"},{"path":"/usr/libexec/git-core/git-prune"},{"path":"/usr/libexec/git-core/git-prune-packed"},{"path":"/usr/libexec/git-core/git-pull"},{"path":"/usr/libexec/git-core/git-push"},{"path":"/usr/libexec/git-core/git-quiltimport"},{"path":"/usr/libexec/git-core/git-range-diff"},{"path":"/usr/libexec/git-core/git-read-tree"},{"path":"/usr/libexec/git-core/git-rebase"},{"path":"/usr/libexec/git-core/git-rebase--preserve-merges"},{"path":"/usr/libexec/git-core/git-receive-pack"},{"path":"/usr/libexec/git-core/git-reflog"},{"path":"/usr/libexec/git-core/git-remote"},{"path":"/usr/libexec/git-core/git-remote-ext"},{"path":"/usr/libexec/git-core/git-remote-fd"},{"path":"/usr/libexec/git-core/git-remote-ftp"},{"path":"/usr/libexec/git-core/git-remote-ftps"},{"path":"/usr/libexec/git-core/git-remote-http"},{"path":"/usr/libexec/git-core/git-remote-https"},{"path":"/usr/libexec/git-core/git-repack"},{"path":"/usr/libexec/git-core/git-replace"},{"path":"/usr/libexec/git-core/git-request-pull"},{"path":"/usr/libexec/git-core/git-rerere"},{"path":"/usr/libexec/git-core/git-reset"},{"path":"/usr/libexec/git-core/git-restore"},{"path":"/usr/libexec/git-core/git-rev-list"},{"path":"/usr/libexec/git-core/git-rev-parse"},{"path":"/usr/libexec/git-core/git-revert"},{"path":"/usr/libexec/git-core/git-rm"},{"path":"/usr/libexec/git-core/git-send-pack"},{"path":"/usr/libexec/git-core/git-sh-i18n"},{"path":"/usr/libexec/git-core/git-sh-i18n--envsubst"},{"path":"/usr/libexec/git-core/git-sh-setup"},{"path":"/usr/libexec/git-core/git-shortlog"},{"path":"/usr/libexec/git-core/git-show"},{"path":"/usr/libexec/git-core/git-show-branch"},{"path":"/usr/libexec/git-core/git-show-index"},{"path":"/usr/libexec/git-core/git-show-ref"},{"path":"/usr/libexec/git-core/git-sparse-checkout"},{"path":"/usr/libexec/git-core/git-stage"},{"path":"/usr/libexec/git-core/git-stash"},{"path":"/usr/libexec/git-core/git-status"},{"path":"/usr/libexec/git-core/git-stripspace"},{"path":"/usr/libexec/git-core/git-submodule"},{"path":"/usr/libexec/git-core/git-submodule--helper"},{"path":"/usr/libexec/git-core/git-switch"},{"path":"/usr/libexec/git-core/git-symbolic-ref"},{"path":"/usr/libexec/git-core/git-tag"},{"path":"/usr/libexec/git-core/git-unpack-file"},{"path":"/usr/libexec/git-core/git-unpack-objects"},{"path":"/usr/libexec/git-core/git-update-index"},{"path":"/usr/libexec/git-core/git-update-ref"},{"path":"/usr/libexec/git-core/git-update-server-info"},{"path":"/usr/libexec/git-core/git-upload-archive"},{"path":"/usr/libexec/git-core/git-upload-pack"},{"path":"/usr/libexec/git-core/git-var"},{"path":"/usr/libexec/git-core/git-verify-commit"},{"path":"/usr/libexec/git-core/git-verify-pack"},{"path":"/usr/libexec/git-core/git-verify-tag"},{"path":"/usr/libexec/git-core/git-web--browse"},{"path":"/usr/libexec/git-core/git-whatchanged"},{"path":"/usr/libexec/git-core/git-worktree"},{"path":"/usr/libexec/git-core/git-write-tree"},{"path":"/usr/libexec/git-core/mergetools"},{"path":"/usr/libexec/git-core/mergetools/araxis"},{"path":"/usr/libexec/git-core/mergetools/bc"},{"path":"/usr/libexec/git-core/mergetools/codecompare"},{"path":"/usr/libexec/git-core/mergetools/deltawalker"},{"path":"/usr/libexec/git-core/mergetools/diffmerge"},{"path":"/usr/libexec/git-core/mergetools/diffuse"},{"path":"/usr/libexec/git-core/mergetools/ecmerge"},{"path":"/usr/libexec/git-core/mergetools/emerge"},{"path":"/usr/libexec/git-core/mergetools/examdiff"},{"path":"/usr/libexec/git-core/mergetools/guiffy"},{"path":"/usr/libexec/git-core/mergetools/gvimdiff"},{"path":"/usr/libexec/git-core/mergetools/kdiff3"},{"path":"/usr/libexec/git-core/mergetools/kompare"},{"path":"/usr/libexec/git-core/mergetools/meld"},{"path":"/usr/libexec/git-core/mergetools/nvimdiff"},{"path":"/usr/libexec/git-core/mergetools/opendiff"},{"path":"/usr/libexec/git-core/mergetools/smerge"},{"path":"/usr/libexec/git-core/mergetools/tkdiff"},{"path":"/usr/libexec/git-core/mergetools/tortoisemerge"},{"path":"/usr/libexec/git-core/mergetools/vimdiff"},{"path":"/usr/libexec/git-core/mergetools/winmerge"},{"path":"/usr/libexec/git-core/mergetools/xxdiff"},{"path":"/usr/share"},{"path":"/usr/share/git-core"},{"path":"/usr/share/git-core/templates"},{"path":"/usr/share/git-core/templates/description"},{"path":"/usr/share/git-core/templates/branches"},{"path":"/usr/share/git-core/templates/hooks"},{"path":"/usr/share/git-core/templates/hooks/applypatch-msg.sample"},{"path":"/usr/share/git-core/templates/hooks/commit-msg.sample"},{"path":"/usr/share/git-core/templates/hooks/post-update.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-applypatch.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-commit.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-merge-commit.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-push.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-rebase.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-receive.sample"},{"path":"/usr/share/git-core/templates/hooks/prepare-commit-msg.sample"},{"path":"/usr/share/git-core/templates/hooks/push-to-checkout.sample"},{"path":"/usr/share/git-core/templates/hooks/update.sample"},{"path":"/usr/share/git-core/templates/info"},{"path":"/usr/share/git-core/templates/info/exclude"},{"path":"/usr/share/perl5"},{"path":"/var"},{"path":"/var/git"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"git"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2023-23946","versionConstraint":"< 2.30.8||>= 2.31.0, < 2.31.7||>= 2.32.0, < 2.32.6||>= 2.33.0, < 2.33.7||>= 2.34.0, < 2.34.7||>= 2.35.0, < 2.35.7||>= 2.36.0, < 2.36.5||>= 2.37.0, < 2.37.6||>= 2.38.0, < 2.38.4||>= 2.39.0, < 2.39.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:git-scm:git:2.30.6:*:*:*:*:*:*:*"],"package":{"name":"git","version":"2.30.6-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2023-23946","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-23946","cwe":"CWE-22","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2023-23946","cwe":"CWE-22","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-23946","date":"2026-10-08","epss":0.01144,"percentile":0.65738}],"risk":0.8208200000000001,"urls":["https://github.com/git/git/commit/c867e4fa180bec4750e9b54eb10f459030dbebfd","https://github.com/git/git/security/advisories/GHSA-r87m-v37r-cwfh","https://security.gentoo.org/glsa/202312-15"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-23946","description":"Git, a revision control system, is vulnerable to path traversal prior to versions 2.39.2, 2.38.4, 2.37.6, 2.36.5, 2.35.7, 2.34.7, 2.33.7, 2.32.6, 2.31.7, and 2.30.8. By feeding a crafted input to `git apply`, a path outside the working tree can be overwritten as the user who is running `git apply`. A fix has been prepared and will appear in v2.39.2, v2.38.4, v2.37.6, v2.36.5, v2.35.7, v2.34.7, v2.33.7, v2.32.6, v2.31.7, and v2.30.8. As a workaround, use `git apply --stat` to inspect a patch before applying; avoid applying one that creates a symbolic link and then creates a file beyond the symbolic link."},"relatedVulnerabilities":[]},{"artifact":{"id":"d081de97c6f633df","cpes":["cpe:2.3:a:libcrypto1.1:libcrypto1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto1.1:libcrypto:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto:libcrypto1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto:libcrypto:1.1.1q-r0:*:*:*:*:*:*:*"],"name":"libcrypto1.1","purl":"pkg:apk/busybox/libcrypto1.1@1.1.1q-r0?arch=x86_64&distro=busybox-1.32.1&upstream=openssl","type":"apk","version":"1.1.1q-r0","language":"","licenses":["OpenSSL"],"metadata":{"Arch":"x86_64","files":[{"path":"/etc"},{"path":"/etc/ssl"},{"path":"/etc/ssl/ct_log_list.cnf"},{"path":"/etc/ssl/ct_log_list.cnf.dist"},{"path":"/etc/ssl/openssl.cnf"},{"path":"/etc/ssl/openssl.cnf.dist"},{"path":"/etc/ssl/certs"},{"path":"/etc/ssl/misc"},{"path":"/etc/ssl/misc/CA.pl"},{"path":"/etc/ssl/misc/tsget"},{"path":"/etc/ssl/misc/tsget.pl"},{"path":"/etc/ssl/private"},{"path":"/lib"},{"path":"/lib/libcrypto.so.1.1"},{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcrypto.so.1.1"},{"path":"/usr/lib/engines-1.1"},{"path":"/usr/lib/engines-1.1/afalg.so"},{"path":"/usr/lib/engines-1.1/capi.so"},{"path":"/usr/lib/engines-1.1/padlock.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2023-0465","versionConstraint":">= 1.0.2, < 1.0.2zh||>= 1.1.1, < 1.1.1u||>= 3.0.0, < 3.0.9||>= 3.1.0, < 3.1.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:1.1.1q:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"1.1.1q-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2023-0465","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-0465","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-0465","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-0465","date":"2026-10-08","epss":0.01583,"percentile":0.74801}],"risk":0.815245,"urls":["https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=10325176f3d3e98c6e2b3bf5ab1e3b334de6947a","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=1dd43e0709fece299b15208f36cc7c76209ba0bb","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=b013765abfa80036dc779dd0e50602c57bb3bf95","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=facfb1ab745646e97a1920977ae4a9965ea61d5c","https://lists.debian.org/debian-lts-announce/2023/06/msg00011.html","https://security.gentoo.org/glsa/202402-08","https://security.netapp.com/advisory/ntap-20230414-0001/","https://www.debian.org/security/2023/dsa-5417","https://www.openssl.org/news/secadv/20230328.txt"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-0465","description":"Applications that use a non-default option when verifying certificates may be\nvulnerable to an attack from a malicious CA to circumvent certain checks.\n\nInvalid certificate policies in leaf certificates are silently ignored by\nOpenSSL and other certificate policy checks are skipped for that certificate.\nA malicious CA could use this to deliberately assert invalid certificate policies\nin order to circumvent policy checking on the certificate altogether.\n\nPolicy processing is disabled by default but can be enabled by passing\nthe `-policy' argument to the command line utilities or by calling the\n`X509_VERIFY_PARAM_set1_policies()' function."},"relatedVulnerabilities":[]},{"artifact":{"id":"74f4e71ff41d2d68","cpes":["cpe:2.3:a:libssl1.1:libssl1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl1.1:libssl:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl:1.1.1q-r0:*:*:*:*:*:*:*"],"name":"libssl1.1","purl":"pkg:apk/busybox/libssl1.1@1.1.1q-r0?arch=x86_64&distro=busybox-1.32.1&upstream=openssl","type":"apk","version":"1.1.1q-r0","language":"","licenses":["OpenSSL"],"metadata":{"Arch":"x86_64","files":[{"path":"/lib"},{"path":"/lib/libssl.so.1.1"},{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libssl.so.1.1"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2023-0465","versionConstraint":">= 1.0.2, < 1.0.2zh||>= 1.1.1, < 1.1.1u||>= 3.0.0, < 3.0.9||>= 3.1.0, < 3.1.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:1.1.1q:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"1.1.1q-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2023-0465","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-0465","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-0465","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-0465","date":"2026-10-08","epss":0.01583,"percentile":0.74801}],"risk":0.815245,"urls":["https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=10325176f3d3e98c6e2b3bf5ab1e3b334de6947a","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=1dd43e0709fece299b15208f36cc7c76209ba0bb","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=b013765abfa80036dc779dd0e50602c57bb3bf95","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=facfb1ab745646e97a1920977ae4a9965ea61d5c","https://lists.debian.org/debian-lts-announce/2023/06/msg00011.html","https://security.gentoo.org/glsa/202402-08","https://security.netapp.com/advisory/ntap-20230414-0001/","https://www.debian.org/security/2023/dsa-5417","https://www.openssl.org/news/secadv/20230328.txt"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-0465","description":"Applications that use a non-default option when verifying certificates may be\nvulnerable to an attack from a malicious CA to circumvent certain checks.\n\nInvalid certificate policies in leaf certificates are silently ignored by\nOpenSSL and other certificate policy checks are skipped for that certificate.\nA malicious CA could use this to deliberately assert invalid certificate policies\nin order to circumvent policy checking on the certificate altogether.\n\nPolicy processing is disabled by default but can be enabled by passing\nthe `-policy' argument to the command line utilities or by calling the\n`X509_VERIFY_PARAM_set1_policies()' function."},"relatedVulnerabilities":[]},{"artifact":{"id":"14807b4f7067817d","cpes":["cpe:2.3:a:openssl:openssl:1.1.1q-r0:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:apk/busybox/openssl@1.1.1q-r0?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"1.1.1q-r0","language":"","licenses":["OpenSSL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/openssl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2023-0465","versionConstraint":">= 1.0.2, < 1.0.2zh||>= 1.1.1, < 1.1.1u||>= 3.0.0, < 3.0.9||>= 3.1.0, < 3.1.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:1.1.1q:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"1.1.1q-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2023-0465","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-0465","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-0465","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-0465","date":"2026-10-08","epss":0.01583,"percentile":0.74801}],"risk":0.815245,"urls":["https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=10325176f3d3e98c6e2b3bf5ab1e3b334de6947a","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=1dd43e0709fece299b15208f36cc7c76209ba0bb","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=b013765abfa80036dc779dd0e50602c57bb3bf95","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=facfb1ab745646e97a1920977ae4a9965ea61d5c","https://lists.debian.org/debian-lts-announce/2023/06/msg00011.html","https://security.gentoo.org/glsa/202402-08","https://security.netapp.com/advisory/ntap-20230414-0001/","https://www.debian.org/security/2023/dsa-5417","https://www.openssl.org/news/secadv/20230328.txt"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-0465","description":"Applications that use a non-default option when verifying certificates may be\nvulnerable to an attack from a malicious CA to circumvent certain checks.\n\nInvalid certificate policies in leaf certificates are silently ignored by\nOpenSSL and other certificate policy checks are skipped for that certificate.\nA malicious CA could use this to deliberately assert invalid certificate policies\nin order to circumvent policy checking on the certificate altogether.\n\nPolicy processing is disabled by default but can be enabled by passing\nthe `-policy' argument to the command line utilities or by calling the\n`X509_VERIFY_PARAM_set1_policies()' function."},"relatedVulnerabilities":[]},{"artifact":{"id":"6040784032e8795c","cpes":["cpe:2.3:a:curl:curl:7.79.1-r3:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:7.79.1-r3:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/busybox/curl@7.79.1-r3?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"7.79.1-r3","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2022-35252","versionConstraint":"< 7.85.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:haxx:curl:7.79.1:*:*:*:*:*:*:*"],"package":{"name":"curl","version":"7.79.1-r3"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2022-35252","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-35252","cwe":"CWE-20","type":"Secondary","source":"support@hackerone.com"}],"epss":[{"cve":"CVE-2022-35252","date":"2026-10-08","epss":0.0243,"percentile":0.83755}],"risk":0.8140499999999998,"urls":["http://seclists.org/fulldisclosure/2023/Jan/20","http://seclists.org/fulldisclosure/2023/Jan/21","https://hackerone.com/reports/1613943","https://lists.debian.org/debian-lts-announce/2023/01/msg00028.html","https://security.gentoo.org/glsa/202212-01","https://security.netapp.com/advisory/ntap-20220930-0005/","https://support.apple.com/kb/HT213603","https://support.apple.com/kb/HT213604"],"severity":"Low","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-35252","description":"When curl is used to retrieve and parse cookies from a HTTP(S) server, itaccepts cookies using control codes that when later are sent back to a HTTPserver might make the server return 400 responses. Effectively allowing a\"sister site\" to deny service to all siblings."},"relatedVulnerabilities":[]},{"artifact":{"id":"a45c752c9b8878aa","cpes":["cpe:2.3:a:php7:php7:7.4.26-r0:*:*:*:*:*:*:*","cpe:2.3:a:php7:php:7.4.26-r0:*:*:*:*:*:*:*","cpe:2.3:a:php:php7:7.4.26-r0:*:*:*:*:*:*:*","cpe:2.3:a:php:php:7.4.26-r0:*:*:*:*:*:*:*"],"name":"php7","purl":"pkg:apk/busybox/php7@7.4.26-r0?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"7.4.26-r0","language":"","licenses":["BSD-3-Clause","LGPL-2.0-or-later","MIT","PHP-3.01","Zend-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/php"},{"path":"/usr/bin/php7"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"php7"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:php:php:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2024-8927","versionConstraint":"< 8.1.30||>= 8.2, < 8.2.24||>= 8.3, < 8.3.12 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:php:php:7.4.26:*:*:*:*:*:*:*"],"package":{"name":"php7","version":"7.4.26-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2024-8927","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-8927","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-8927","cwe":"CWE-1220","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-8927","date":"2026-10-08","epss":0.01054,"percentile":0.6336}],"risk":0.7905000000000001,"urls":["https://github.com/php/php-src/security/advisories/GHSA-94p6-54jq-9mwp","https://lists.debian.org/debian-lts-announce/2024/10/msg00011.html","https://security.netapp.com/advisory/ntap-20241101-0003/"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-8927","description":"In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, HTTP_REDIRECT_STATUS variable is used to check whether or not CGI binary is being run by the HTTP server. However, in certain scenarios, the content of this variable can be controlled by the request submitter via HTTP headers, which can lead to cgi.force_redirect option not being correctly applied. In certain configurations this may lead to arbitrary file inclusion in PHP."},"relatedVulnerabilities":[]},{"artifact":{"id":"422a442f930ca27c","cpes":["cpe:2.3:a:nginx:nginx:1.18.0-r15:*:*:*:*:*:*:*"],"name":"nginx","purl":"pkg:apk/busybox/nginx@1.18.0-r15?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"1.18.0-r15","language":"","licenses":["BSD-2-Clause"],"metadata":{"Arch":"x86_64","files":[{"path":"/etc"},{"path":"/etc/logrotate.d"},{"path":"/etc/logrotate.d/nginx"},{"path":"/etc/nginx"},{"path":"/etc/nginx/fastcgi.conf"},{"path":"/etc/nginx/fastcgi_params"},{"path":"/etc/nginx/mime.types"},{"path":"/etc/nginx/nginx.conf"},{"path":"/etc/nginx/scgi_params"},{"path":"/etc/nginx/uwsgi_params"},{"path":"/etc/nginx/http.d"},{"path":"/etc/nginx/modules"},{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/nginx"},{"path":"/usr/lib/nginx/modules"},{"path":"/usr/sbin"},{"path":"/usr/sbin/nginx"},{"path":"/usr/share"},{"path":"/usr/share/nginx"},{"path":"/usr/share/nginx/http-default_server.conf"},{"path":"/var"},{"path":"/var/lib"},{"path":"/var/lib/nginx"},{"path":"/var/lib/nginx/logs"},{"path":"/var/lib/nginx/modules"},{"path":"/var/lib/nginx/run"},{"path":"/var/lib/nginx/html"},{"path":"/var/lib/nginx/html/50x.html"},{"path":"/var/lib/nginx/html/index.html"},{"path":"/var/lib/nginx/tmp"},{"path":"/var/log"},{"path":"/var/log/nginx"},{"path":"/var/www"},{"path":"/var/www/localhost"},{"path":"/var/www/localhost/htdocs"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"nginx"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:nginx:nginx:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-42533","versionConstraint":">= 0.9.6, < 1.30.4||>= 1.31.0, < 1.31.3 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:nginx:nginx:1.18.0:*:*:*:*:*:*:*"],"package":{"name":"nginx","version":"1.18.0-r15"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-42533","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"f5sirt@f5.com","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.2},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"f5sirt@f5.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42533","cwe":"CWE-122","type":"Secondary","source":"f5sirt@f5.com"}],"epss":[{"cve":"CVE-2026-42533","date":"2026-10-08","epss":0.00894,"percentile":0.58263}],"risk":0.7889550000000001,"urls":["https://my.f5.com/manage/s/article/K000162097"],"severity":"Critical","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42533","description":"A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and a string expression references the map's regex capture variables before referencing the map output variable. Alternatively, the same result could be achieved by using a non-cacheable variable in a string expression under certain conditions. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.\n\nImpact:\nThis vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system or to possibly trigger a code execution. There is no control plane exposure; this is a data plane issue only.\n\n\n\n\n Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated."},"relatedVulnerabilities":[]},{"artifact":{"id":"6040784032e8795c","cpes":["cpe:2.3:a:curl:curl:7.79.1-r3:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:7.79.1-r3:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/busybox/curl@7.79.1-r3?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"7.79.1-r3","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2023-23914","versionConstraint":">= 7.77.0, < 7.88.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:haxx:curl:7.79.1:*:*:*:*:*:*:*"],"package":{"name":"curl","version":"7.79.1-r3"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2023-23914","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-23914","cwe":"CWE-319","type":"Secondary","source":"support@hackerone.com"},{"cve":"CVE-2023-23914","cwe":"CWE-319","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-23914","cwe":"CWE-319","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-23914","date":"2026-10-08","epss":0.00858,"percentile":0.57179}],"risk":0.7764900000000001,"urls":["https://hackerone.com/reports/1813864","https://security.gentoo.org/glsa/202310-12","https://security.netapp.com/advisory/ntap-20230309-0006/"],"severity":"Critical","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-23914","description":"A cleartext transmission of sensitive information vulnerability exists in curl <v7.88.0 that could cause HSTS functionality fail when multiple URLs are requested serially. Using its HSTS support, curl can be instructed to use HTTPS instead of usingan insecure clear-text HTTP step even when HTTP is provided in the URL. ThisHSTS mechanism would however surprisingly be ignored by subsequent transferswhen done on the same command line because the state would not be properlycarried on."},"relatedVulnerabilities":[]},{"artifact":{"id":"de2e09a252869bf3","cpes":["cpe:2.3:a:git-scm:git:2.30.6-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_scm:git:2.30.6-r0:*:*:*:*:*:*:*","cpe:2.3:a:git:git:2.30.6-r0:*:*:*:*:*:*:*"],"name":"git","purl":"pkg:apk/busybox/git@2.30.6-r0?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"2.30.6-r0","language":"","licenses":["GPL-2.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/git"},{"path":"/usr/bin/git-receive-pack"},{"path":"/usr/bin/git-shell"},{"path":"/usr/bin/git-upload-archive"},{"path":"/usr/bin/git-upload-pack"},{"path":"/usr/libexec"},{"path":"/usr/libexec/git-core"},{"path":"/usr/libexec/git-core/git"},{"path":"/usr/libexec/git-core/git-add"},{"path":"/usr/libexec/git-core/git-am"},{"path":"/usr/libexec/git-core/git-annotate"},{"path":"/usr/libexec/git-core/git-apply"},{"path":"/usr/libexec/git-core/git-archive"},{"path":"/usr/libexec/git-core/git-bisect"},{"path":"/usr/libexec/git-core/git-bisect--helper"},{"path":"/usr/libexec/git-core/git-blame"},{"path":"/usr/libexec/git-core/git-branch"},{"path":"/usr/libexec/git-core/git-bugreport"},{"path":"/usr/libexec/git-core/git-bundle"},{"path":"/usr/libexec/git-core/git-cat-file"},{"path":"/usr/libexec/git-core/git-check-attr"},{"path":"/usr/libexec/git-core/git-check-ignore"},{"path":"/usr/libexec/git-core/git-check-mailmap"},{"path":"/usr/libexec/git-core/git-check-ref-format"},{"path":"/usr/libexec/git-core/git-checkout"},{"path":"/usr/libexec/git-core/git-checkout-index"},{"path":"/usr/libexec/git-core/git-cherry"},{"path":"/usr/libexec/git-core/git-cherry-pick"},{"path":"/usr/libexec/git-core/git-clean"},{"path":"/usr/libexec/git-core/git-clone"},{"path":"/usr/libexec/git-core/git-column"},{"path":"/usr/libexec/git-core/git-commit"},{"path":"/usr/libexec/git-core/git-commit-graph"},{"path":"/usr/libexec/git-core/git-commit-tree"},{"path":"/usr/libexec/git-core/git-config"},{"path":"/usr/libexec/git-core/git-count-objects"},{"path":"/usr/libexec/git-core/git-credential"},{"path":"/usr/libexec/git-core/git-credential-cache"},{"path":"/usr/libexec/git-core/git-credential-cache--daemon"},{"path":"/usr/libexec/git-core/git-credential-store"},{"path":"/usr/libexec/git-core/git-describe"},{"path":"/usr/libexec/git-core/git-diff"},{"path":"/usr/libexec/git-core/git-diff-files"},{"path":"/usr/libexec/git-core/git-diff-index"},{"path":"/usr/libexec/git-core/git-diff-tree"},{"path":"/usr/libexec/git-core/git-difftool"},{"path":"/usr/libexec/git-core/git-difftool--helper"},{"path":"/usr/libexec/git-core/git-env--helper"},{"path":"/usr/libexec/git-core/git-fast-export"},{"path":"/usr/libexec/git-core/git-fetch"},{"path":"/usr/libexec/git-core/git-fetch-pack"},{"path":"/usr/libexec/git-core/git-filter-branch"},{"path":"/usr/libexec/git-core/git-fmt-merge-msg"},{"path":"/usr/libexec/git-core/git-for-each-ref"},{"path":"/usr/libexec/git-core/git-for-each-repo"},{"path":"/usr/libexec/git-core/git-format-patch"},{"path":"/usr/libexec/git-core/git-fsck"},{"path":"/usr/libexec/git-core/git-fsck-objects"},{"path":"/usr/libexec/git-core/git-gc"},{"path":"/usr/libexec/git-core/git-get-tar-commit-id"},{"path":"/usr/libexec/git-core/git-grep"},{"path":"/usr/libexec/git-core/git-hash-object"},{"path":"/usr/libexec/git-core/git-help"},{"path":"/usr/libexec/git-core/git-http-fetch"},{"path":"/usr/libexec/git-core/git-http-push"},{"path":"/usr/libexec/git-core/git-index-pack"},{"path":"/usr/libexec/git-core/git-init"},{"path":"/usr/libexec/git-core/git-init-db"},{"path":"/usr/libexec/git-core/git-interpret-trailers"},{"path":"/usr/libexec/git-core/git-log"},{"path":"/usr/libexec/git-core/git-ls-files"},{"path":"/usr/libexec/git-core/git-ls-remote"},{"path":"/usr/libexec/git-core/git-ls-tree"},{"path":"/usr/libexec/git-core/git-mailinfo"},{"path":"/usr/libexec/git-core/git-mailsplit"},{"path":"/usr/libexec/git-core/git-maintenance"},{"path":"/usr/libexec/git-core/git-merge"},{"path":"/usr/libexec/git-core/git-merge-base"},{"path":"/usr/libexec/git-core/git-merge-file"},{"path":"/usr/libexec/git-core/git-merge-index"},{"path":"/usr/libexec/git-core/git-merge-octopus"},{"path":"/usr/libexec/git-core/git-merge-one-file"},{"path":"/usr/libexec/git-core/git-merge-ours"},{"path":"/usr/libexec/git-core/git-merge-recursive"},{"path":"/usr/libexec/git-core/git-merge-resolve"},{"path":"/usr/libexec/git-core/git-merge-subtree"},{"path":"/usr/libexec/git-core/git-merge-tree"},{"path":"/usr/libexec/git-core/git-mergetool"},{"path":"/usr/libexec/git-core/git-mergetool--lib"},{"path":"/usr/libexec/git-core/git-mktag"},{"path":"/usr/libexec/git-core/git-mktree"},{"path":"/usr/libexec/git-core/git-multi-pack-index"},{"path":"/usr/libexec/git-core/git-mv"},{"path":"/usr/libexec/git-core/git-name-rev"},{"path":"/usr/libexec/git-core/git-notes"},{"path":"/usr/libexec/git-core/git-pack-objects"},{"path":"/usr/libexec/git-core/git-pack-redundant"},{"path":"/usr/libexec/git-core/git-pack-refs"},{"path":"/usr/libexec/git-core/git-patch-id"},{"path":"/usr/libexec/git-core/git-prune"},{"path":"/usr/libexec/git-core/git-prune-packed"},{"path":"/usr/libexec/git-core/git-pull"},{"path":"/usr/libexec/git-core/git-push"},{"path":"/usr/libexec/git-core/git-quiltimport"},{"path":"/usr/libexec/git-core/git-range-diff"},{"path":"/usr/libexec/git-core/git-read-tree"},{"path":"/usr/libexec/git-core/git-rebase"},{"path":"/usr/libexec/git-core/git-rebase--preserve-merges"},{"path":"/usr/libexec/git-core/git-receive-pack"},{"path":"/usr/libexec/git-core/git-reflog"},{"path":"/usr/libexec/git-core/git-remote"},{"path":"/usr/libexec/git-core/git-remote-ext"},{"path":"/usr/libexec/git-core/git-remote-fd"},{"path":"/usr/libexec/git-core/git-remote-ftp"},{"path":"/usr/libexec/git-core/git-remote-ftps"},{"path":"/usr/libexec/git-core/git-remote-http"},{"path":"/usr/libexec/git-core/git-remote-https"},{"path":"/usr/libexec/git-core/git-repack"},{"path":"/usr/libexec/git-core/git-replace"},{"path":"/usr/libexec/git-core/git-request-pull"},{"path":"/usr/libexec/git-core/git-rerere"},{"path":"/usr/libexec/git-core/git-reset"},{"path":"/usr/libexec/git-core/git-restore"},{"path":"/usr/libexec/git-core/git-rev-list"},{"path":"/usr/libexec/git-core/git-rev-parse"},{"path":"/usr/libexec/git-core/git-revert"},{"path":"/usr/libexec/git-core/git-rm"},{"path":"/usr/libexec/git-core/git-send-pack"},{"path":"/usr/libexec/git-core/git-sh-i18n"},{"path":"/usr/libexec/git-core/git-sh-i18n--envsubst"},{"path":"/usr/libexec/git-core/git-sh-setup"},{"path":"/usr/libexec/git-core/git-shortlog"},{"path":"/usr/libexec/git-core/git-show"},{"path":"/usr/libexec/git-core/git-show-branch"},{"path":"/usr/libexec/git-core/git-show-index"},{"path":"/usr/libexec/git-core/git-show-ref"},{"path":"/usr/libexec/git-core/git-sparse-checkout"},{"path":"/usr/libexec/git-core/git-stage"},{"path":"/usr/libexec/git-core/git-stash"},{"path":"/usr/libexec/git-core/git-status"},{"path":"/usr/libexec/git-core/git-stripspace"},{"path":"/usr/libexec/git-core/git-submodule"},{"path":"/usr/libexec/git-core/git-submodule--helper"},{"path":"/usr/libexec/git-core/git-switch"},{"path":"/usr/libexec/git-core/git-symbolic-ref"},{"path":"/usr/libexec/git-core/git-tag"},{"path":"/usr/libexec/git-core/git-unpack-file"},{"path":"/usr/libexec/git-core/git-unpack-objects"},{"path":"/usr/libexec/git-core/git-update-index"},{"path":"/usr/libexec/git-core/git-update-ref"},{"path":"/usr/libexec/git-core/git-update-server-info"},{"path":"/usr/libexec/git-core/git-upload-archive"},{"path":"/usr/libexec/git-core/git-upload-pack"},{"path":"/usr/libexec/git-core/git-var"},{"path":"/usr/libexec/git-core/git-verify-commit"},{"path":"/usr/libexec/git-core/git-verify-pack"},{"path":"/usr/libexec/git-core/git-verify-tag"},{"path":"/usr/libexec/git-core/git-web--browse"},{"path":"/usr/libexec/git-core/git-whatchanged"},{"path":"/usr/libexec/git-core/git-worktree"},{"path":"/usr/libexec/git-core/git-write-tree"},{"path":"/usr/libexec/git-core/mergetools"},{"path":"/usr/libexec/git-core/mergetools/araxis"},{"path":"/usr/libexec/git-core/mergetools/bc"},{"path":"/usr/libexec/git-core/mergetools/codecompare"},{"path":"/usr/libexec/git-core/mergetools/deltawalker"},{"path":"/usr/libexec/git-core/mergetools/diffmerge"},{"path":"/usr/libexec/git-core/mergetools/diffuse"},{"path":"/usr/libexec/git-core/mergetools/ecmerge"},{"path":"/usr/libexec/git-core/mergetools/emerge"},{"path":"/usr/libexec/git-core/mergetools/examdiff"},{"path":"/usr/libexec/git-core/mergetools/guiffy"},{"path":"/usr/libexec/git-core/mergetools/gvimdiff"},{"path":"/usr/libexec/git-core/mergetools/kdiff3"},{"path":"/usr/libexec/git-core/mergetools/kompare"},{"path":"/usr/libexec/git-core/mergetools/meld"},{"path":"/usr/libexec/git-core/mergetools/nvimdiff"},{"path":"/usr/libexec/git-core/mergetools/opendiff"},{"path":"/usr/libexec/git-core/mergetools/smerge"},{"path":"/usr/libexec/git-core/mergetools/tkdiff"},{"path":"/usr/libexec/git-core/mergetools/tortoisemerge"},{"path":"/usr/libexec/git-core/mergetools/vimdiff"},{"path":"/usr/libexec/git-core/mergetools/winmerge"},{"path":"/usr/libexec/git-core/mergetools/xxdiff"},{"path":"/usr/share"},{"path":"/usr/share/git-core"},{"path":"/usr/share/git-core/templates"},{"path":"/usr/share/git-core/templates/description"},{"path":"/usr/share/git-core/templates/branches"},{"path":"/usr/share/git-core/templates/hooks"},{"path":"/usr/share/git-core/templates/hooks/applypatch-msg.sample"},{"path":"/usr/share/git-core/templates/hooks/commit-msg.sample"},{"path":"/usr/share/git-core/templates/hooks/post-update.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-applypatch.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-commit.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-merge-commit.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-push.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-rebase.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-receive.sample"},{"path":"/usr/share/git-core/templates/hooks/prepare-commit-msg.sample"},{"path":"/usr/share/git-core/templates/hooks/push-to-checkout.sample"},{"path":"/usr/share/git-core/templates/hooks/update.sample"},{"path":"/usr/share/git-core/templates/info"},{"path":"/usr/share/git-core/templates/info/exclude"},{"path":"/usr/share/perl5"},{"path":"/var"},{"path":"/var/git"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"git"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2024-32465","versionConstraint":"< 2.39.4||>= 2.40.0, < 2.40.2||>= 2.41.0, < 2.41.1||>= 2.42.0, < 2.42.2||>= 2.43.0, < 2.43.4||>= 2.44.0, < 2.44.1||>= 2.45.0, < 2.45.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:git-scm:git:2.30.6:*:*:*:*:*:*:*"],"package":{"name":"git","version":"2.30.6-r0"},"namespace":"nvd:cpe"}},{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:git:git:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2024-32465","versionConstraint":"< 2.39.4||>= 2.40.0, < 2.40.2||>= 2.41.0, < 2.41.1||>= 2.42.0, < 2.42.2||>= 2.43.0, < 2.43.4||>= 2.44.0, < 2.44.1||>= 2.45.0, < 2.45.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:git:git:2.30.6:*:*:*:*:*:*:*"],"package":{"name":"git","version":"2.30.6-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2024-32465","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":7.3,"impactScore":6.1,"exploitabilityScore":0.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-32465","cwe":"CWE-22","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2024-32465","date":"2026-10-08","epss":0.01026,"percentile":0.62502}],"risk":0.7720649999999999,"urls":["http://www.openwall.com/lists/oss-security/2024/05/14/2","https://git-scm.com/docs/git#_security","https://git-scm.com/docs/git-clone","https://github.com/git/git/commit/7b70e9efb18c2cc3f219af399bd384c5801ba1d7","https://github.com/git/git/security/advisories/GHSA-vm9j-46j9-qvq4","https://lists.debian.org/debian-lts-announce/2024/06/msg00018.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/S4CK4IYTXEOBZTEM5K3T6LWOIZ3S44AR/","https://lists.debian.org/debian-lts-announce/2024/09/msg00009.html"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-32465","description":"Git is a revision control system. The Git project recommends to avoid working in untrusted repositories, and instead to clone it first with `git clone --no-local` to obtain a clean copy. Git has specific protections to make that a safe operation even with an untrusted source repository, but vulnerabilities allow those protections to be bypassed. In the context of cloning local repositories owned by other users, this vulnerability has been covered in CVE-2024-32004. But there are circumstances where the fixes for CVE-2024-32004 are not enough: For example, when obtaining a `.zip` file containing a full copy of a Git repository, it should not be trusted by default to be safe, as e.g. hooks could be configured to run within the context of that repository. The problem has been patched in versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4. As a workaround, avoid using Git in repositories that have been obtained via archives from untrusted sources."},"relatedVulnerabilities":[]},{"artifact":{"id":"a45c752c9b8878aa","cpes":["cpe:2.3:a:php7:php7:7.4.26-r0:*:*:*:*:*:*:*","cpe:2.3:a:php7:php:7.4.26-r0:*:*:*:*:*:*:*","cpe:2.3:a:php:php7:7.4.26-r0:*:*:*:*:*:*:*","cpe:2.3:a:php:php:7.4.26-r0:*:*:*:*:*:*:*"],"name":"php7","purl":"pkg:apk/busybox/php7@7.4.26-r0?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"7.4.26-r0","language":"","licenses":["BSD-3-Clause","LGPL-2.0-or-later","MIT","PHP-3.01","Zend-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/php"},{"path":"/usr/bin/php7"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"php7"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:php:php:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2024-11234","versionConstraint":"< 8.1.31||>= 8.2, < 8.2.26||>= 8.3, < 8.3.14 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:php:php:7.4.26:*:*:*:*:*:*:*"],"package":{"name":"php7","version":"7.4.26-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2024-11234","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","metrics":{"baseScore":7.2,"impactScore":2.8,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.8,"impactScore":2.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-11234","cwe":"CWE-20","type":"Secondary","source":"security@php.net"},{"cve":"CVE-2024-11234","cwe":"CWE-74","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-11234","date":"2026-10-08","epss":0.01108,"percentile":0.64858}],"risk":0.7479,"urls":["https://github.com/php/php-src/security/advisories/GHSA-c5f2-jwm7-mmq2","https://lists.debian.org/debian-lts-announce/2024/12/msg00007.html","https://security.netapp.com/advisory/ntap-20241220-0008/"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-11234","description":"In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, when using streams with configured proxy and \"request_fulluri\" option, the URI is not properly sanitized which can lead to HTTP request smuggling and allow the attacker to use the proxy to perform arbitrary HTTP requests originating from the server, thus potentially gaining access to resources not normally available to the external user."},"relatedVulnerabilities":[]},{"artifact":{"id":"d081de97c6f633df","cpes":["cpe:2.3:a:libcrypto1.1:libcrypto1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto1.1:libcrypto:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto:libcrypto1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto:libcrypto:1.1.1q-r0:*:*:*:*:*:*:*"],"name":"libcrypto1.1","purl":"pkg:apk/busybox/libcrypto1.1@1.1.1q-r0?arch=x86_64&distro=busybox-1.32.1&upstream=openssl","type":"apk","version":"1.1.1q-r0","language":"","licenses":["OpenSSL"],"metadata":{"Arch":"x86_64","files":[{"path":"/etc"},{"path":"/etc/ssl"},{"path":"/etc/ssl/ct_log_list.cnf"},{"path":"/etc/ssl/ct_log_list.cnf.dist"},{"path":"/etc/ssl/openssl.cnf"},{"path":"/etc/ssl/openssl.cnf.dist"},{"path":"/etc/ssl/certs"},{"path":"/etc/ssl/misc"},{"path":"/etc/ssl/misc/CA.pl"},{"path":"/etc/ssl/misc/tsget"},{"path":"/etc/ssl/misc/tsget.pl"},{"path":"/etc/ssl/private"},{"path":"/lib"},{"path":"/lib/libcrypto.so.1.1"},{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcrypto.so.1.1"},{"path":"/usr/lib/engines-1.1"},{"path":"/usr/lib/engines-1.1/afalg.so"},{"path":"/usr/lib/engines-1.1/capi.so"},{"path":"/usr/lib/engines-1.1/padlock.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-28387","versionConstraint":">= 1.1.1, < 1.1.1zg||>= 3.0.0, < 3.0.20||>= 3.3.0, < 3.3.7||>= 3.4.0, < 3.4.5||>= 3.5.0, < 3.5.6||>= 3.6.0, < 3.6.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:1.1.1q:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"1.1.1q-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-28387","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-28387","cwe":"CWE-416","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-28387","date":"2026-10-08","epss":0.00943,"percentile":0.59839}],"risk":0.73554,"urls":["https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b","https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe","https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3","https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7","https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177","https://openssl-library.org/news/secadv/20260407.txt","https://cert-portal.siemens.com/productcert/html/ssa-032379.html","https://cert-portal.siemens.com/productcert/html/ssa-265688.html"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-28387","description":"Issue summary: An uncommon configuration of clients performing DANE TLSA-based\nserver authentication, when paired with uncommon server DANE TLSA records, may\nresult in a use-after-free and/or double-free on the client side.\n\nImpact summary: A use after free can have a range of potential consequences\nsuch as the corruption of valid data, crashes or execution of arbitrary code.\n\nHowever, the issue only affects clients that make use of TLSA records with both\nthe PKIX-TA(0/PKIX-EE(1) certificate usages and the DANE-TA(2) certificate\nusage.\n\nBy far the most common deployment of DANE is in SMTP MTAs for which RFC7672\nrecommends that clients treat as 'unusable' any TLSA records that have the PKIX\ncertificate usages.  These SMTP (or other similar) clients are not vulnerable\nto this issue.  Conversely, any clients that support only the PKIX usages, and\nignore the DANE-TA(2) usage are also not vulnerable.\n\nThe client would also need to be communicating with a server that publishes a\nTLSA RRset with both types of TLSA records.\n\nNo FIPS modules are affected by this issue, the problem code is outside the\nFIPS module boundary."},"relatedVulnerabilities":[]},{"artifact":{"id":"74f4e71ff41d2d68","cpes":["cpe:2.3:a:libssl1.1:libssl1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl1.1:libssl:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl:1.1.1q-r0:*:*:*:*:*:*:*"],"name":"libssl1.1","purl":"pkg:apk/busybox/libssl1.1@1.1.1q-r0?arch=x86_64&distro=busybox-1.32.1&upstream=openssl","type":"apk","version":"1.1.1q-r0","language":"","licenses":["OpenSSL"],"metadata":{"Arch":"x86_64","files":[{"path":"/lib"},{"path":"/lib/libssl.so.1.1"},{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libssl.so.1.1"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-28387","versionConstraint":">= 1.1.1, < 1.1.1zg||>= 3.0.0, < 3.0.20||>= 3.3.0, < 3.3.7||>= 3.4.0, < 3.4.5||>= 3.5.0, < 3.5.6||>= 3.6.0, < 3.6.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:1.1.1q:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"1.1.1q-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-28387","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-28387","cwe":"CWE-416","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-28387","date":"2026-10-08","epss":0.00943,"percentile":0.59839}],"risk":0.73554,"urls":["https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b","https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe","https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3","https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7","https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177","https://openssl-library.org/news/secadv/20260407.txt","https://cert-portal.siemens.com/productcert/html/ssa-032379.html","https://cert-portal.siemens.com/productcert/html/ssa-265688.html"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-28387","description":"Issue summary: An uncommon configuration of clients performing DANE TLSA-based\nserver authentication, when paired with uncommon server DANE TLSA records, may\nresult in a use-after-free and/or double-free on the client side.\n\nImpact summary: A use after free can have a range of potential consequences\nsuch as the corruption of valid data, crashes or execution of arbitrary code.\n\nHowever, the issue only affects clients that make use of TLSA records with both\nthe PKIX-TA(0/PKIX-EE(1) certificate usages and the DANE-TA(2) certificate\nusage.\n\nBy far the most common deployment of DANE is in SMTP MTAs for which RFC7672\nrecommends that clients treat as 'unusable' any TLSA records that have the PKIX\ncertificate usages.  These SMTP (or other similar) clients are not vulnerable\nto this issue.  Conversely, any clients that support only the PKIX usages, and\nignore the DANE-TA(2) usage are also not vulnerable.\n\nThe client would also need to be communicating with a server that publishes a\nTLSA RRset with both types of TLSA records.\n\nNo FIPS modules are affected by this issue, the problem code is outside the\nFIPS module boundary."},"relatedVulnerabilities":[]},{"artifact":{"id":"14807b4f7067817d","cpes":["cpe:2.3:a:openssl:openssl:1.1.1q-r0:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:apk/busybox/openssl@1.1.1q-r0?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"1.1.1q-r0","language":"","licenses":["OpenSSL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/openssl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-28387","versionConstraint":">= 1.1.1, < 1.1.1zg||>= 3.0.0, < 3.0.20||>= 3.3.0, < 3.3.7||>= 3.4.0, < 3.4.5||>= 3.5.0, < 3.5.6||>= 3.6.0, < 3.6.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:1.1.1q:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"1.1.1q-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-28387","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-28387","cwe":"CWE-416","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-28387","date":"2026-10-08","epss":0.00943,"percentile":0.59839}],"risk":0.73554,"urls":["https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b","https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe","https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3","https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7","https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177","https://openssl-library.org/news/secadv/20260407.txt","https://cert-portal.siemens.com/productcert/html/ssa-032379.html","https://cert-portal.siemens.com/productcert/html/ssa-265688.html"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-28387","description":"Issue summary: An uncommon configuration of clients performing DANE TLSA-based\nserver authentication, when paired with uncommon server DANE TLSA records, may\nresult in a use-after-free and/or double-free on the client side.\n\nImpact summary: A use after free can have a range of potential consequences\nsuch as the corruption of valid data, crashes or execution of arbitrary code.\n\nHowever, the issue only affects clients that make use of TLSA records with both\nthe PKIX-TA(0/PKIX-EE(1) certificate usages and the DANE-TA(2) certificate\nusage.\n\nBy far the most common deployment of DANE is in SMTP MTAs for which RFC7672\nrecommends that clients treat as 'unusable' any TLSA records that have the PKIX\ncertificate usages.  These SMTP (or other similar) clients are not vulnerable\nto this issue.  Conversely, any clients that support only the PKIX usages, and\nignore the DANE-TA(2) usage are also not vulnerable.\n\nThe client would also need to be communicating with a server that publishes a\nTLSA RRset with both types of TLSA records.\n\nNo FIPS modules are affected by this issue, the problem code is outside the\nFIPS module boundary."},"relatedVulnerabilities":[]},{"artifact":{"id":"d081de97c6f633df","cpes":["cpe:2.3:a:libcrypto1.1:libcrypto1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto1.1:libcrypto:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto:libcrypto1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto:libcrypto:1.1.1q-r0:*:*:*:*:*:*:*"],"name":"libcrypto1.1","purl":"pkg:apk/busybox/libcrypto1.1@1.1.1q-r0?arch=x86_64&distro=busybox-1.32.1&upstream=openssl","type":"apk","version":"1.1.1q-r0","language":"","licenses":["OpenSSL"],"metadata":{"Arch":"x86_64","files":[{"path":"/etc"},{"path":"/etc/ssl"},{"path":"/etc/ssl/ct_log_list.cnf"},{"path":"/etc/ssl/ct_log_list.cnf.dist"},{"path":"/etc/ssl/openssl.cnf"},{"path":"/etc/ssl/openssl.cnf.dist"},{"path":"/etc/ssl/certs"},{"path":"/etc/ssl/misc"},{"path":"/etc/ssl/misc/CA.pl"},{"path":"/etc/ssl/misc/tsget"},{"path":"/etc/ssl/misc/tsget.pl"},{"path":"/etc/ssl/private"},{"path":"/lib"},{"path":"/lib/libcrypto.so.1.1"},{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcrypto.so.1.1"},{"path":"/usr/lib/engines-1.1"},{"path":"/usr/lib/engines-1.1/afalg.so"},{"path":"/usr/lib/engines-1.1/capi.so"},{"path":"/usr/lib/engines-1.1/padlock.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-9076","versionConstraint":">= 1.0.2, < 1.0.2zq||>= 1.1.1, < 1.1.1zh||>= 3.0.0, < 3.0.21||>= 3.4.0, < 3.4.6||>= 3.5.0, < 3.5.7||>= 3.6.0, < 3.6.3||>= 4.0.0, < 4.0.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:1.1.1q:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"1.1.1q-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-9076","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-9076","cwe":"CWE-125","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-9076","date":"2026-10-08","epss":0.00973,"percentile":0.60827}],"risk":0.72975,"urls":["https://github.com/openssl/openssl/commit/05b066366842f930fadd9a6e94df98030af431bb","https://github.com/openssl/openssl/commit/3d8d5bc1056b2f62da9fede23fedbf47e85187b0","https://github.com/openssl/openssl/commit/715349a1d7c6db970e6815dafb90915f07307f98","https://github.com/openssl/openssl/commit/77bf00ab13f6ff5e516535432f0328ed70ec0c26","https://github.com/openssl/openssl/commit/eecbe330977e8d023aae1ca2d9bdbe983ef3fdc6","https://openssl-library.org/news/secadv/20260609.txt"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-9076","description":"Issue summary: When CMS password-based decryption (RFC 3211 / PWRI key unwrap)\nprocesses attacker-supplied CMS data, an attacker-chosen stream-mode KEK\ncipher can trigger a heap out-of-bounds read in kek_unwrap_key().\n\nImpact summary: A heap buffer over-read may trigger a crash which leads to\nDenial of Service for an application if the input buffer ends at a memory\npage boundary and the following page is unmapped. There is no information\ndisclosure as the over-read bytes are not revealed to the attacker.\n\nThe key unwrapping function performs a check-byte test as specified in the\nRFC that reads 7 bytes from a heap allocation that is based on the wrapped\nkey length from the message. There is a minimum length check based on the\nblock length of the wrapping cipher. However the cipher is selected from\nan OID carried in the attacker's PWRI keyEncryptionAlgorithm with no\nrequirement that the cipher be a block cipher. When an attacker selects\na stream-mode cipher the guard will be ineffective and the allocated buffer\ncontaining the unwrapped key can be too small to fit the check-bytes\nspecified in the RFC and a buffer over-read can happen.\n\nApplications calling CMS_decrypt() or CMS_decrypt_set1_password()\n(equivalently openssl cms -decrypt -pwri_password ...) on untrusted CMS\ndata are vulnerable to this issue. No password knowledge is required: the\nover-read happens during the unwrap attempt before any authentication\nsucceeds.\n\nThe over-read is limited to a few bytes and is not written to output, so\nthere is no information disclosure. Triggering a crash requires the\nallocation to border unmapped memory, which is unlikely with the normal\nallocator.\n\nThe FIPS modules are not affected by this issue."},"relatedVulnerabilities":[]},{"artifact":{"id":"74f4e71ff41d2d68","cpes":["cpe:2.3:a:libssl1.1:libssl1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl1.1:libssl:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl:1.1.1q-r0:*:*:*:*:*:*:*"],"name":"libssl1.1","purl":"pkg:apk/busybox/libssl1.1@1.1.1q-r0?arch=x86_64&distro=busybox-1.32.1&upstream=openssl","type":"apk","version":"1.1.1q-r0","language":"","licenses":["OpenSSL"],"metadata":{"Arch":"x86_64","files":[{"path":"/lib"},{"path":"/lib/libssl.so.1.1"},{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libssl.so.1.1"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-9076","versionConstraint":">= 1.0.2, < 1.0.2zq||>= 1.1.1, < 1.1.1zh||>= 3.0.0, < 3.0.21||>= 3.4.0, < 3.4.6||>= 3.5.0, < 3.5.7||>= 3.6.0, < 3.6.3||>= 4.0.0, < 4.0.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:1.1.1q:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"1.1.1q-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-9076","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-9076","cwe":"CWE-125","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-9076","date":"2026-10-08","epss":0.00973,"percentile":0.60827}],"risk":0.72975,"urls":["https://github.com/openssl/openssl/commit/05b066366842f930fadd9a6e94df98030af431bb","https://github.com/openssl/openssl/commit/3d8d5bc1056b2f62da9fede23fedbf47e85187b0","https://github.com/openssl/openssl/commit/715349a1d7c6db970e6815dafb90915f07307f98","https://github.com/openssl/openssl/commit/77bf00ab13f6ff5e516535432f0328ed70ec0c26","https://github.com/openssl/openssl/commit/eecbe330977e8d023aae1ca2d9bdbe983ef3fdc6","https://openssl-library.org/news/secadv/20260609.txt"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-9076","description":"Issue summary: When CMS password-based decryption (RFC 3211 / PWRI key unwrap)\nprocesses attacker-supplied CMS data, an attacker-chosen stream-mode KEK\ncipher can trigger a heap out-of-bounds read in kek_unwrap_key().\n\nImpact summary: A heap buffer over-read may trigger a crash which leads to\nDenial of Service for an application if the input buffer ends at a memory\npage boundary and the following page is unmapped. There is no information\ndisclosure as the over-read bytes are not revealed to the attacker.\n\nThe key unwrapping function performs a check-byte test as specified in the\nRFC that reads 7 bytes from a heap allocation that is based on the wrapped\nkey length from the message. There is a minimum length check based on the\nblock length of the wrapping cipher. However the cipher is selected from\nan OID carried in the attacker's PWRI keyEncryptionAlgorithm with no\nrequirement that the cipher be a block cipher. When an attacker selects\na stream-mode cipher the guard will be ineffective and the allocated buffer\ncontaining the unwrapped key can be too small to fit the check-bytes\nspecified in the RFC and a buffer over-read can happen.\n\nApplications calling CMS_decrypt() or CMS_decrypt_set1_password()\n(equivalently openssl cms -decrypt -pwri_password ...) on untrusted CMS\ndata are vulnerable to this issue. No password knowledge is required: the\nover-read happens during the unwrap attempt before any authentication\nsucceeds.\n\nThe over-read is limited to a few bytes and is not written to output, so\nthere is no information disclosure. Triggering a crash requires the\nallocation to border unmapped memory, which is unlikely with the normal\nallocator.\n\nThe FIPS modules are not affected by this issue."},"relatedVulnerabilities":[]},{"artifact":{"id":"14807b4f7067817d","cpes":["cpe:2.3:a:openssl:openssl:1.1.1q-r0:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:apk/busybox/openssl@1.1.1q-r0?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"1.1.1q-r0","language":"","licenses":["OpenSSL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/openssl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-9076","versionConstraint":">= 1.0.2, < 1.0.2zq||>= 1.1.1, < 1.1.1zh||>= 3.0.0, < 3.0.21||>= 3.4.0, < 3.4.6||>= 3.5.0, < 3.5.7||>= 3.6.0, < 3.6.3||>= 4.0.0, < 4.0.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:1.1.1q:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"1.1.1q-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-9076","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-9076","cwe":"CWE-125","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-9076","date":"2026-10-08","epss":0.00973,"percentile":0.60827}],"risk":0.72975,"urls":["https://github.com/openssl/openssl/commit/05b066366842f930fadd9a6e94df98030af431bb","https://github.com/openssl/openssl/commit/3d8d5bc1056b2f62da9fede23fedbf47e85187b0","https://github.com/openssl/openssl/commit/715349a1d7c6db970e6815dafb90915f07307f98","https://github.com/openssl/openssl/commit/77bf00ab13f6ff5e516535432f0328ed70ec0c26","https://github.com/openssl/openssl/commit/eecbe330977e8d023aae1ca2d9bdbe983ef3fdc6","https://openssl-library.org/news/secadv/20260609.txt"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-9076","description":"Issue summary: When CMS password-based decryption (RFC 3211 / PWRI key unwrap)\nprocesses attacker-supplied CMS data, an attacker-chosen stream-mode KEK\ncipher can trigger a heap out-of-bounds read in kek_unwrap_key().\n\nImpact summary: A heap buffer over-read may trigger a crash which leads to\nDenial of Service for an application if the input buffer ends at a memory\npage boundary and the following page is unmapped. There is no information\ndisclosure as the over-read bytes are not revealed to the attacker.\n\nThe key unwrapping function performs a check-byte test as specified in the\nRFC that reads 7 bytes from a heap allocation that is based on the wrapped\nkey length from the message. There is a minimum length check based on the\nblock length of the wrapping cipher. However the cipher is selected from\nan OID carried in the attacker's PWRI keyEncryptionAlgorithm with no\nrequirement that the cipher be a block cipher. When an attacker selects\na stream-mode cipher the guard will be ineffective and the allocated buffer\ncontaining the unwrapped key can be too small to fit the check-bytes\nspecified in the RFC and a buffer over-read can happen.\n\nApplications calling CMS_decrypt() or CMS_decrypt_set1_password()\n(equivalently openssl cms -decrypt -pwri_password ...) on untrusted CMS\ndata are vulnerable to this issue. No password knowledge is required: the\nover-read happens during the unwrap attempt before any authentication\nsucceeds.\n\nThe over-read is limited to a few bytes and is not written to output, so\nthere is no information disclosure. Triggering a crash requires the\nallocation to border unmapped memory, which is unlikely with the normal\nallocator.\n\nThe FIPS modules are not affected by this issue."},"relatedVulnerabilities":[]},{"artifact":{"id":"de2e09a252869bf3","cpes":["cpe:2.3:a:git-scm:git:2.30.6-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_scm:git:2.30.6-r0:*:*:*:*:*:*:*","cpe:2.3:a:git:git:2.30.6-r0:*:*:*:*:*:*:*"],"name":"git","purl":"pkg:apk/busybox/git@2.30.6-r0?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"2.30.6-r0","language":"","licenses":["GPL-2.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/git"},{"path":"/usr/bin/git-receive-pack"},{"path":"/usr/bin/git-shell"},{"path":"/usr/bin/git-upload-archive"},{"path":"/usr/bin/git-upload-pack"},{"path":"/usr/libexec"},{"path":"/usr/libexec/git-core"},{"path":"/usr/libexec/git-core/git"},{"path":"/usr/libexec/git-core/git-add"},{"path":"/usr/libexec/git-core/git-am"},{"path":"/usr/libexec/git-core/git-annotate"},{"path":"/usr/libexec/git-core/git-apply"},{"path":"/usr/libexec/git-core/git-archive"},{"path":"/usr/libexec/git-core/git-bisect"},{"path":"/usr/libexec/git-core/git-bisect--helper"},{"path":"/usr/libexec/git-core/git-blame"},{"path":"/usr/libexec/git-core/git-branch"},{"path":"/usr/libexec/git-core/git-bugreport"},{"path":"/usr/libexec/git-core/git-bundle"},{"path":"/usr/libexec/git-core/git-cat-file"},{"path":"/usr/libexec/git-core/git-check-attr"},{"path":"/usr/libexec/git-core/git-check-ignore"},{"path":"/usr/libexec/git-core/git-check-mailmap"},{"path":"/usr/libexec/git-core/git-check-ref-format"},{"path":"/usr/libexec/git-core/git-checkout"},{"path":"/usr/libexec/git-core/git-checkout-index"},{"path":"/usr/libexec/git-core/git-cherry"},{"path":"/usr/libexec/git-core/git-cherry-pick"},{"path":"/usr/libexec/git-core/git-clean"},{"path":"/usr/libexec/git-core/git-clone"},{"path":"/usr/libexec/git-core/git-column"},{"path":"/usr/libexec/git-core/git-commit"},{"path":"/usr/libexec/git-core/git-commit-graph"},{"path":"/usr/libexec/git-core/git-commit-tree"},{"path":"/usr/libexec/git-core/git-config"},{"path":"/usr/libexec/git-core/git-count-objects"},{"path":"/usr/libexec/git-core/git-credential"},{"path":"/usr/libexec/git-core/git-credential-cache"},{"path":"/usr/libexec/git-core/git-credential-cache--daemon"},{"path":"/usr/libexec/git-core/git-credential-store"},{"path":"/usr/libexec/git-core/git-describe"},{"path":"/usr/libexec/git-core/git-diff"},{"path":"/usr/libexec/git-core/git-diff-files"},{"path":"/usr/libexec/git-core/git-diff-index"},{"path":"/usr/libexec/git-core/git-diff-tree"},{"path":"/usr/libexec/git-core/git-difftool"},{"path":"/usr/libexec/git-core/git-difftool--helper"},{"path":"/usr/libexec/git-core/git-env--helper"},{"path":"/usr/libexec/git-core/git-fast-export"},{"path":"/usr/libexec/git-core/git-fetch"},{"path":"/usr/libexec/git-core/git-fetch-pack"},{"path":"/usr/libexec/git-core/git-filter-branch"},{"path":"/usr/libexec/git-core/git-fmt-merge-msg"},{"path":"/usr/libexec/git-core/git-for-each-ref"},{"path":"/usr/libexec/git-core/git-for-each-repo"},{"path":"/usr/libexec/git-core/git-format-patch"},{"path":"/usr/libexec/git-core/git-fsck"},{"path":"/usr/libexec/git-core/git-fsck-objects"},{"path":"/usr/libexec/git-core/git-gc"},{"path":"/usr/libexec/git-core/git-get-tar-commit-id"},{"path":"/usr/libexec/git-core/git-grep"},{"path":"/usr/libexec/git-core/git-hash-object"},{"path":"/usr/libexec/git-core/git-help"},{"path":"/usr/libexec/git-core/git-http-fetch"},{"path":"/usr/libexec/git-core/git-http-push"},{"path":"/usr/libexec/git-core/git-index-pack"},{"path":"/usr/libexec/git-core/git-init"},{"path":"/usr/libexec/git-core/git-init-db"},{"path":"/usr/libexec/git-core/git-interpret-trailers"},{"path":"/usr/libexec/git-core/git-log"},{"path":"/usr/libexec/git-core/git-ls-files"},{"path":"/usr/libexec/git-core/git-ls-remote"},{"path":"/usr/libexec/git-core/git-ls-tree"},{"path":"/usr/libexec/git-core/git-mailinfo"},{"path":"/usr/libexec/git-core/git-mailsplit"},{"path":"/usr/libexec/git-core/git-maintenance"},{"path":"/usr/libexec/git-core/git-merge"},{"path":"/usr/libexec/git-core/git-merge-base"},{"path":"/usr/libexec/git-core/git-merge-file"},{"path":"/usr/libexec/git-core/git-merge-index"},{"path":"/usr/libexec/git-core/git-merge-octopus"},{"path":"/usr/libexec/git-core/git-merge-one-file"},{"path":"/usr/libexec/git-core/git-merge-ours"},{"path":"/usr/libexec/git-core/git-merge-recursive"},{"path":"/usr/libexec/git-core/git-merge-resolve"},{"path":"/usr/libexec/git-core/git-merge-subtree"},{"path":"/usr/libexec/git-core/git-merge-tree"},{"path":"/usr/libexec/git-core/git-mergetool"},{"path":"/usr/libexec/git-core/git-mergetool--lib"},{"path":"/usr/libexec/git-core/git-mktag"},{"path":"/usr/libexec/git-core/git-mktree"},{"path":"/usr/libexec/git-core/git-multi-pack-index"},{"path":"/usr/libexec/git-core/git-mv"},{"path":"/usr/libexec/git-core/git-name-rev"},{"path":"/usr/libexec/git-core/git-notes"},{"path":"/usr/libexec/git-core/git-pack-objects"},{"path":"/usr/libexec/git-core/git-pack-redundant"},{"path":"/usr/libexec/git-core/git-pack-refs"},{"path":"/usr/libexec/git-core/git-patch-id"},{"path":"/usr/libexec/git-core/git-prune"},{"path":"/usr/libexec/git-core/git-prune-packed"},{"path":"/usr/libexec/git-core/git-pull"},{"path":"/usr/libexec/git-core/git-push"},{"path":"/usr/libexec/git-core/git-quiltimport"},{"path":"/usr/libexec/git-core/git-range-diff"},{"path":"/usr/libexec/git-core/git-read-tree"},{"path":"/usr/libexec/git-core/git-rebase"},{"path":"/usr/libexec/git-core/git-rebase--preserve-merges"},{"path":"/usr/libexec/git-core/git-receive-pack"},{"path":"/usr/libexec/git-core/git-reflog"},{"path":"/usr/libexec/git-core/git-remote"},{"path":"/usr/libexec/git-core/git-remote-ext"},{"path":"/usr/libexec/git-core/git-remote-fd"},{"path":"/usr/libexec/git-core/git-remote-ftp"},{"path":"/usr/libexec/git-core/git-remote-ftps"},{"path":"/usr/libexec/git-core/git-remote-http"},{"path":"/usr/libexec/git-core/git-remote-https"},{"path":"/usr/libexec/git-core/git-repack"},{"path":"/usr/libexec/git-core/git-replace"},{"path":"/usr/libexec/git-core/git-request-pull"},{"path":"/usr/libexec/git-core/git-rerere"},{"path":"/usr/libexec/git-core/git-reset"},{"path":"/usr/libexec/git-core/git-restore"},{"path":"/usr/libexec/git-core/git-rev-list"},{"path":"/usr/libexec/git-core/git-rev-parse"},{"path":"/usr/libexec/git-core/git-revert"},{"path":"/usr/libexec/git-core/git-rm"},{"path":"/usr/libexec/git-core/git-send-pack"},{"path":"/usr/libexec/git-core/git-sh-i18n"},{"path":"/usr/libexec/git-core/git-sh-i18n--envsubst"},{"path":"/usr/libexec/git-core/git-sh-setup"},{"path":"/usr/libexec/git-core/git-shortlog"},{"path":"/usr/libexec/git-core/git-show"},{"path":"/usr/libexec/git-core/git-show-branch"},{"path":"/usr/libexec/git-core/git-show-index"},{"path":"/usr/libexec/git-core/git-show-ref"},{"path":"/usr/libexec/git-core/git-sparse-checkout"},{"path":"/usr/libexec/git-core/git-stage"},{"path":"/usr/libexec/git-core/git-stash"},{"path":"/usr/libexec/git-core/git-status"},{"path":"/usr/libexec/git-core/git-stripspace"},{"path":"/usr/libexec/git-core/git-submodule"},{"path":"/usr/libexec/git-core/git-submodule--helper"},{"path":"/usr/libexec/git-core/git-switch"},{"path":"/usr/libexec/git-core/git-symbolic-ref"},{"path":"/usr/libexec/git-core/git-tag"},{"path":"/usr/libexec/git-core/git-unpack-file"},{"path":"/usr/libexec/git-core/git-unpack-objects"},{"path":"/usr/libexec/git-core/git-update-index"},{"path":"/usr/libexec/git-core/git-update-ref"},{"path":"/usr/libexec/git-core/git-update-server-info"},{"path":"/usr/libexec/git-core/git-upload-archive"},{"path":"/usr/libexec/git-core/git-upload-pack"},{"path":"/usr/libexec/git-core/git-var"},{"path":"/usr/libexec/git-core/git-verify-commit"},{"path":"/usr/libexec/git-core/git-verify-pack"},{"path":"/usr/libexec/git-core/git-verify-tag"},{"path":"/usr/libexec/git-core/git-web--browse"},{"path":"/usr/libexec/git-core/git-whatchanged"},{"path":"/usr/libexec/git-core/git-worktree"},{"path":"/usr/libexec/git-core/git-write-tree"},{"path":"/usr/libexec/git-core/mergetools"},{"path":"/usr/libexec/git-core/mergetools/araxis"},{"path":"/usr/libexec/git-core/mergetools/bc"},{"path":"/usr/libexec/git-core/mergetools/codecompare"},{"path":"/usr/libexec/git-core/mergetools/deltawalker"},{"path":"/usr/libexec/git-core/mergetools/diffmerge"},{"path":"/usr/libexec/git-core/mergetools/diffuse"},{"path":"/usr/libexec/git-core/mergetools/ecmerge"},{"path":"/usr/libexec/git-core/mergetools/emerge"},{"path":"/usr/libexec/git-core/mergetools/examdiff"},{"path":"/usr/libexec/git-core/mergetools/guiffy"},{"path":"/usr/libexec/git-core/mergetools/gvimdiff"},{"path":"/usr/libexec/git-core/mergetools/kdiff3"},{"path":"/usr/libexec/git-core/mergetools/kompare"},{"path":"/usr/libexec/git-core/mergetools/meld"},{"path":"/usr/libexec/git-core/mergetools/nvimdiff"},{"path":"/usr/libexec/git-core/mergetools/opendiff"},{"path":"/usr/libexec/git-core/mergetools/smerge"},{"path":"/usr/libexec/git-core/mergetools/tkdiff"},{"path":"/usr/libexec/git-core/mergetools/tortoisemerge"},{"path":"/usr/libexec/git-core/mergetools/vimdiff"},{"path":"/usr/libexec/git-core/mergetools/winmerge"},{"path":"/usr/libexec/git-core/mergetools/xxdiff"},{"path":"/usr/share"},{"path":"/usr/share/git-core"},{"path":"/usr/share/git-core/templates"},{"path":"/usr/share/git-core/templates/description"},{"path":"/usr/share/git-core/templates/branches"},{"path":"/usr/share/git-core/templates/hooks"},{"path":"/usr/share/git-core/templates/hooks/applypatch-msg.sample"},{"path":"/usr/share/git-core/templates/hooks/commit-msg.sample"},{"path":"/usr/share/git-core/templates/hooks/post-update.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-applypatch.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-commit.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-merge-commit.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-push.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-rebase.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-receive.sample"},{"path":"/usr/share/git-core/templates/hooks/prepare-commit-msg.sample"},{"path":"/usr/share/git-core/templates/hooks/push-to-checkout.sample"},{"path":"/usr/share/git-core/templates/hooks/update.sample"},{"path":"/usr/share/git-core/templates/info"},{"path":"/usr/share/git-core/templates/info/exclude"},{"path":"/usr/share/perl5"},{"path":"/var"},{"path":"/var/git"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"git"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2022-24765","versionConstraint":"< 2.35.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:git-scm:git:2.30.6:*:*:*:*:*:*:*"],"package":{"name":"git","version":"2.30.6-r0"},"namespace":"nvd:cpe"}},{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:git:git:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2022-24765","versionConstraint":"< 2.35.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:git:git:2.30.6:*:*:*:*:*:*:*"],"package":{"name":"git","version":"2.30.6-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2022-24765","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:L/AC:M/Au:N/C:C/I:C/A:C","metrics":{"baseScore":6.9,"impactScore":10.1,"exploitabilityScore":3.4},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":6,"impactScore":5.2,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-24765","cwe":"CWE-427","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2022-24765","date":"2026-10-08","epss":0.0101,"percentile":0.62045}],"risk":0.7272,"urls":["http://seclists.org/fulldisclosure/2022/May/31","http://www.openwall.com/lists/oss-security/2022/04/12/7","https://git-scm.com/book/en/v2/Appendix-A%3A-Git-in-Other-Environments-Git-in-Bash","https://git-scm.com/docs/git#Documentation/git.txt-codeGITCEILINGDIRECTORIEScode","https://github.com/git-for-windows/git/security/advisories/GHSA-vw2c-22j4-2fh2","https://lists.debian.org/debian-lts-announce/2022/12/msg00025.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5PTN5NYEHYN2OQSHSAMCNICZNK2U4QH6/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BENQYTDGUL6TF3UALY6GSIEXIHUIYNWM/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DDI325LOO2XBDDKLINOAQJEG6MHAURZE/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DIKWISWUDFT2FAITYIA6372BVLH3OOOC/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HVOLER2PIGMHPQMDGG4RDE2KZB74QLA2/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SLP42KIZ6HACTVZMZLJLFJQ4W2XYT27M/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TRZG5CDUQ27OWTPC5MQOR4UASNXHWEZS/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UDZRZAL7QULOB6V7MKT66MOMWJLBJPX4/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YROCMBWYFKRSS64PO6FUNM6L7LKBUKVW/","https://security.gentoo.org/glsa/202312-15","https://support.apple.com/kb/HT213261"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-24765","description":"Git for Windows is a fork of Git containing Windows-specific patches. This vulnerability affects users working on multi-user machines, where untrusted parties have write access to the same hard disk. Those untrusted parties could create the folder `C:\\.git`, which would be picked up by Git operations run supposedly outside a repository while searching for a Git directory. Git would then respect any config in said Git directory. Git Bash users who set `GIT_PS1_SHOWDIRTYSTATE` are vulnerable as well. Users who installed posh-gitare vulnerable simply by starting a PowerShell. Users of IDEs such as Visual Studio are vulnerable: simply creating a new project would already read and respect the config specified in `C:\\.git\\config`. Users of the Microsoft fork of Git are vulnerable simply by starting a Git Bash. The problem has been patched in Git for Windows v2.35.2. Users unable to upgrade may create the folder `.git` on all drives where Git commands are run, and remove read/write access from those folders as a workaround. Alternatively, define or extend `GIT_CEILING_DIRECTORIES` to cover the _parent_ directory of the user profile, e.g. `C:\\Users` if the user profile is located in `C:\\Users\\my-user-name`."},"relatedVulnerabilities":[]},{"artifact":{"id":"422a442f930ca27c","cpes":["cpe:2.3:a:nginx:nginx:1.18.0-r15:*:*:*:*:*:*:*"],"name":"nginx","purl":"pkg:apk/busybox/nginx@1.18.0-r15?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"1.18.0-r15","language":"","licenses":["BSD-2-Clause"],"metadata":{"Arch":"x86_64","files":[{"path":"/etc"},{"path":"/etc/logrotate.d"},{"path":"/etc/logrotate.d/nginx"},{"path":"/etc/nginx"},{"path":"/etc/nginx/fastcgi.conf"},{"path":"/etc/nginx/fastcgi_params"},{"path":"/etc/nginx/mime.types"},{"path":"/etc/nginx/nginx.conf"},{"path":"/etc/nginx/scgi_params"},{"path":"/etc/nginx/uwsgi_params"},{"path":"/etc/nginx/http.d"},{"path":"/etc/nginx/modules"},{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/nginx"},{"path":"/usr/lib/nginx/modules"},{"path":"/usr/sbin"},{"path":"/usr/sbin/nginx"},{"path":"/usr/share"},{"path":"/usr/share/nginx"},{"path":"/usr/share/nginx/http-default_server.conf"},{"path":"/var"},{"path":"/var/lib"},{"path":"/var/lib/nginx"},{"path":"/var/lib/nginx/logs"},{"path":"/var/lib/nginx/modules"},{"path":"/var/lib/nginx/run"},{"path":"/var/lib/nginx/html"},{"path":"/var/lib/nginx/html/50x.html"},{"path":"/var/lib/nginx/html/index.html"},{"path":"/var/lib/nginx/tmp"},{"path":"/var/log"},{"path":"/var/log/nginx"},{"path":"/var/www"},{"path":"/var/www/localhost"},{"path":"/var/www/localhost/htdocs"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"nginx"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:nginx:nginx:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-27651","versionConstraint":">= 0.5.15, < 1.28.3||>= 1.29.0, < 1.29.7 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:nginx:nginx:1.18.0:*:*:*:*:*:*:*"],"package":{"name":"nginx","version":"1.18.0-r15"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-27651","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"f5sirt@f5.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"f5sirt@f5.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-27651","cwe":"CWE-476","type":"Secondary","source":"f5sirt@f5.com"},{"cve":"CVE-2026-27651","cwe":"CWE-476","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-27651","date":"2026-10-08","epss":0.00938,"percentile":0.59687}],"risk":0.72226,"urls":["https://my.f5.com/manage/s/article/K000160383","https://access.redhat.com/errata/RHSA-2026:10065","https://access.redhat.com/errata/RHSA-2026:13634","https://access.redhat.com/errata/RHSA-2026:13680","https://access.redhat.com/errata/RHSA-2026:13839","https://access.redhat.com/errata/RHSA-2026:14836","https://access.redhat.com/errata/RHSA-2026:15942","https://access.redhat.com/errata/RHSA-2026:15943","https://access.redhat.com/errata/RHSA-2026:15945","https://access.redhat.com/errata/RHSA-2026:15966","https://access.redhat.com/errata/RHSA-2026:6906","https://access.redhat.com/errata/RHSA-2026:6907","https://access.redhat.com/errata/RHSA-2026:6923","https://access.redhat.com/errata/RHSA-2026:7002","https://access.redhat.com/errata/RHSA-2026:7343","https://access.redhat.com/errata/RHSA-2026:8346","https://access.redhat.com/security/cve/CVE-2026-27651","https://bugzilla.redhat.com/show_bug.cgi?id=2450791","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27651.json"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-27651","description":"When the ngx_mail_auth_http_module module is enabled on NGINX Plus or NGINX Open Source, undisclosed requests can cause worker processes to terminate. This issue may occur when (1) CRAM-MD5 or APOP authentication is enabled, and (2) the authentication server permits retry by returning the Auth-Wait response header. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated."},"relatedVulnerabilities":[]},{"artifact":{"id":"d081de97c6f633df","cpes":["cpe:2.3:a:libcrypto1.1:libcrypto1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto1.1:libcrypto:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto:libcrypto1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto:libcrypto:1.1.1q-r0:*:*:*:*:*:*:*"],"name":"libcrypto1.1","purl":"pkg:apk/busybox/libcrypto1.1@1.1.1q-r0?arch=x86_64&distro=busybox-1.32.1&upstream=openssl","type":"apk","version":"1.1.1q-r0","language":"","licenses":["OpenSSL"],"metadata":{"Arch":"x86_64","files":[{"path":"/etc"},{"path":"/etc/ssl"},{"path":"/etc/ssl/ct_log_list.cnf"},{"path":"/etc/ssl/ct_log_list.cnf.dist"},{"path":"/etc/ssl/openssl.cnf"},{"path":"/etc/ssl/openssl.cnf.dist"},{"path":"/etc/ssl/certs"},{"path":"/etc/ssl/misc"},{"path":"/etc/ssl/misc/CA.pl"},{"path":"/etc/ssl/misc/tsget"},{"path":"/etc/ssl/misc/tsget.pl"},{"path":"/etc/ssl/private"},{"path":"/lib"},{"path":"/lib/libcrypto.so.1.1"},{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcrypto.so.1.1"},{"path":"/usr/lib/engines-1.1"},{"path":"/usr/lib/engines-1.1/afalg.so"},{"path":"/usr/lib/engines-1.1/capi.so"},{"path":"/usr/lib/engines-1.1/padlock.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-69421","versionConstraint":">= 1.0.2, < 1.0.2zn||>= 1.1.1, < 1.1.1ze||>= 3.0.0, < 3.0.19||>= 3.3.0, < 3.3.6||>= 3.4.0, < 3.4.4||>= 3.5.0, < 3.5.5||>= 3.6.0, < 3.6.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:1.1.1q:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"1.1.1q-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2025-69421","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-69421","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2025-69421","date":"2026-10-08","epss":0.00958,"percentile":0.60302}],"risk":0.7185,"urls":["https://github.com/openssl/openssl/commit/3524a29271f8191b8fd8a5257eb05173982a097b","https://github.com/openssl/openssl/commit/36ecb4960872a4ce04bf6f1e1f4e78d75ec0c0c7","https://github.com/openssl/openssl/commit/4bbc8d41a72c842ce4077a8a3eccd1109aaf74bd","https://github.com/openssl/openssl/commit/643986985cd1c21221f941129d76fe0c2785aeb3","https://github.com/openssl/openssl/commit/a2dbc539f0f9cc63832709fa5aa33ad9495eb19c","https://openssl-library.org/news/secadv/20260127.txt","https://cert-portal.siemens.com/productcert/html/ssa-265688.html"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-69421","description":"Issue summary: Processing a malformed PKCS#12 file can trigger a NULL pointer\ndereference in the PKCS12_item_decrypt_d2i_ex() function.\n\nImpact summary: A NULL pointer dereference can trigger a crash which leads to\nDenial of Service for an application processing PKCS#12 files.\n\nThe PKCS12_item_decrypt_d2i_ex() function does not check whether the oct\nparameter is NULL before dereferencing it. When called from\nPKCS12_unpack_p7encdata() with a malformed PKCS#12 file, this parameter can\nbe NULL, causing a crash. The vulnerability is limited to Denial of Service\nand cannot be escalated to achieve code execution or memory disclosure.\n\nExploiting this issue requires an attacker to provide a malformed PKCS#12 file\nto an application that processes it. For that reason the issue was assessed as\nLow severity according to our Security Policy.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the PKCS#12 implementation is outside the OpenSSL FIPS module boundary.\n\nOpenSSL 3.6, 3.5, 3.4, 3.3, 3.0, 1.1.1 and 1.0.2 are vulnerable to this issue."},"relatedVulnerabilities":[]},{"artifact":{"id":"74f4e71ff41d2d68","cpes":["cpe:2.3:a:libssl1.1:libssl1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl1.1:libssl:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl:1.1.1q-r0:*:*:*:*:*:*:*"],"name":"libssl1.1","purl":"pkg:apk/busybox/libssl1.1@1.1.1q-r0?arch=x86_64&distro=busybox-1.32.1&upstream=openssl","type":"apk","version":"1.1.1q-r0","language":"","licenses":["OpenSSL"],"metadata":{"Arch":"x86_64","files":[{"path":"/lib"},{"path":"/lib/libssl.so.1.1"},{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libssl.so.1.1"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-69421","versionConstraint":">= 1.0.2, < 1.0.2zn||>= 1.1.1, < 1.1.1ze||>= 3.0.0, < 3.0.19||>= 3.3.0, < 3.3.6||>= 3.4.0, < 3.4.4||>= 3.5.0, < 3.5.5||>= 3.6.0, < 3.6.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:1.1.1q:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"1.1.1q-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2025-69421","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-69421","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2025-69421","date":"2026-10-08","epss":0.00958,"percentile":0.60302}],"risk":0.7185,"urls":["https://github.com/openssl/openssl/commit/3524a29271f8191b8fd8a5257eb05173982a097b","https://github.com/openssl/openssl/commit/36ecb4960872a4ce04bf6f1e1f4e78d75ec0c0c7","https://github.com/openssl/openssl/commit/4bbc8d41a72c842ce4077a8a3eccd1109aaf74bd","https://github.com/openssl/openssl/commit/643986985cd1c21221f941129d76fe0c2785aeb3","https://github.com/openssl/openssl/commit/a2dbc539f0f9cc63832709fa5aa33ad9495eb19c","https://openssl-library.org/news/secadv/20260127.txt","https://cert-portal.siemens.com/productcert/html/ssa-265688.html"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-69421","description":"Issue summary: Processing a malformed PKCS#12 file can trigger a NULL pointer\ndereference in the PKCS12_item_decrypt_d2i_ex() function.\n\nImpact summary: A NULL pointer dereference can trigger a crash which leads to\nDenial of Service for an application processing PKCS#12 files.\n\nThe PKCS12_item_decrypt_d2i_ex() function does not check whether the oct\nparameter is NULL before dereferencing it. When called from\nPKCS12_unpack_p7encdata() with a malformed PKCS#12 file, this parameter can\nbe NULL, causing a crash. The vulnerability is limited to Denial of Service\nand cannot be escalated to achieve code execution or memory disclosure.\n\nExploiting this issue requires an attacker to provide a malformed PKCS#12 file\nto an application that processes it. For that reason the issue was assessed as\nLow severity according to our Security Policy.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the PKCS#12 implementation is outside the OpenSSL FIPS module boundary.\n\nOpenSSL 3.6, 3.5, 3.4, 3.3, 3.0, 1.1.1 and 1.0.2 are vulnerable to this issue."},"relatedVulnerabilities":[]},{"artifact":{"id":"14807b4f7067817d","cpes":["cpe:2.3:a:openssl:openssl:1.1.1q-r0:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:apk/busybox/openssl@1.1.1q-r0?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"1.1.1q-r0","language":"","licenses":["OpenSSL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/openssl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-69421","versionConstraint":">= 1.0.2, < 1.0.2zn||>= 1.1.1, < 1.1.1ze||>= 3.0.0, < 3.0.19||>= 3.3.0, < 3.3.6||>= 3.4.0, < 3.4.4||>= 3.5.0, < 3.5.5||>= 3.6.0, < 3.6.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:1.1.1q:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"1.1.1q-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2025-69421","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-69421","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2025-69421","date":"2026-10-08","epss":0.00958,"percentile":0.60302}],"risk":0.7185,"urls":["https://github.com/openssl/openssl/commit/3524a29271f8191b8fd8a5257eb05173982a097b","https://github.com/openssl/openssl/commit/36ecb4960872a4ce04bf6f1e1f4e78d75ec0c0c7","https://github.com/openssl/openssl/commit/4bbc8d41a72c842ce4077a8a3eccd1109aaf74bd","https://github.com/openssl/openssl/commit/643986985cd1c21221f941129d76fe0c2785aeb3","https://github.com/openssl/openssl/commit/a2dbc539f0f9cc63832709fa5aa33ad9495eb19c","https://openssl-library.org/news/secadv/20260127.txt","https://cert-portal.siemens.com/productcert/html/ssa-265688.html"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-69421","description":"Issue summary: Processing a malformed PKCS#12 file can trigger a NULL pointer\ndereference in the PKCS12_item_decrypt_d2i_ex() function.\n\nImpact summary: A NULL pointer dereference can trigger a crash which leads to\nDenial of Service for an application processing PKCS#12 files.\n\nThe PKCS12_item_decrypt_d2i_ex() function does not check whether the oct\nparameter is NULL before dereferencing it. When called from\nPKCS12_unpack_p7encdata() with a malformed PKCS#12 file, this parameter can\nbe NULL, causing a crash. The vulnerability is limited to Denial of Service\nand cannot be escalated to achieve code execution or memory disclosure.\n\nExploiting this issue requires an attacker to provide a malformed PKCS#12 file\nto an application that processes it. For that reason the issue was assessed as\nLow severity according to our Security Policy.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the PKCS#12 implementation is outside the OpenSSL FIPS module boundary.\n\nOpenSSL 3.6, 3.5, 3.4, 3.3, 3.0, 1.1.1 and 1.0.2 are vulnerable to this issue."},"relatedVulnerabilities":[]},{"artifact":{"id":"a45c752c9b8878aa","cpes":["cpe:2.3:a:php7:php7:7.4.26-r0:*:*:*:*:*:*:*","cpe:2.3:a:php7:php:7.4.26-r0:*:*:*:*:*:*:*","cpe:2.3:a:php:php7:7.4.26-r0:*:*:*:*:*:*:*","cpe:2.3:a:php:php:7.4.26-r0:*:*:*:*:*:*:*"],"name":"php7","purl":"pkg:apk/busybox/php7@7.4.26-r0?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"7.4.26-r0","language":"","licenses":["BSD-3-Clause","LGPL-2.0-or-later","MIT","PHP-3.01","Zend-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/php"},{"path":"/usr/bin/php7"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"php7"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:php:php:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-1861","versionConstraint":"< 8.1.32||>= 8.2, < 8.2.28||>= 8.3, < 8.3.19||>= 8.4, < 8.4.5 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:php:php:7.4.26:*:*:*:*:*:*:*"],"package":{"name":"php7","version":"7.4.26-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2025-1861","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security@php.net","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-1861","cwe":"CWE-131","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2025-1861","date":"2026-10-08","epss":0.00839,"percentile":0.56548}],"risk":0.7152475,"urls":["https://github.com/php/php-src/security/advisories/GHSA-52jp-hrpf-2jff","https://lists.debian.org/debian-lts-announce/2025/03/msg00014.html","https://security.netapp.com/advisory/ntap-20250523-0005/"],"severity":"Critical","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-1861","description":"In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when parsing HTTP redirect in the response to an HTTP request, there is currently limit on the location value size caused by limited size of the location buffer to 1024. However as per RFC9110, the limit is recommended to be 8000. This may lead to incorrect URL truncation and redirecting to a wrong location."},"relatedVulnerabilities":[]},{"artifact":{"id":"6040784032e8795c","cpes":["cpe:2.3:a:curl:curl:7.79.1-r3:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:7.79.1-r3:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/busybox/curl@7.79.1-r3?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"7.79.1-r3","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-19931","versionConstraint":">= 7.64.1, < 8.14.2||>= 8.15.0, < 8.16.1||>= 8.17.0, < 8.20.1||>= 8.21.0, < 8.22.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:haxx:curl:7.79.1:*:*:*:*:*:*:*"],"package":{"name":"curl","version":"7.79.1-r3"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-19931","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19931","cwe":"CWE-488","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-19931","cwe":"CWE-488","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-19931","date":"2026-10-08","epss":0.00747,"percentile":0.53447}],"risk":0.70218,"urls":["https://curl.se/docs/CVE-2026-19931.html","https://curl.se/docs/CVE-2026-19931.json","https://hackerone.com/reports/3923520"],"severity":"Critical","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19931","description":"A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given\nhostname using Negotiate authentication, when the initial request is done\nusing empty credentials. This can make user B's request get sent over user A's\npreviously authenticated connection."},"relatedVulnerabilities":[]},{"artifact":{"id":"a45c752c9b8878aa","cpes":["cpe:2.3:a:php7:php7:7.4.26-r0:*:*:*:*:*:*:*","cpe:2.3:a:php7:php:7.4.26-r0:*:*:*:*:*:*:*","cpe:2.3:a:php:php7:7.4.26-r0:*:*:*:*:*:*:*","cpe:2.3:a:php:php:7.4.26-r0:*:*:*:*:*:*:*"],"name":"php7","purl":"pkg:apk/busybox/php7@7.4.26-r0?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"7.4.26-r0","language":"","licenses":["BSD-3-Clause","LGPL-2.0-or-later","MIT","PHP-3.01","Zend-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/php"},{"path":"/usr/bin/php7"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"php7"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:php:php:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-1735","versionConstraint":"< 8.1.33||>= 8.2, < 8.2.29||>= 8.3, < 8.3.23||>= 8.4, < 8.4.10 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:php:php:7.4.26:*:*:*:*:*:*:*"],"package":{"name":"php7","version":"7.4.26-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2025-1735","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-1735","cwe":"CWE-89","type":"Secondary","source":"security@php.net"},{"cve":"CVE-2025-1735","cwe":"CWE-476","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2025-1735","date":"2026-10-08","epss":0.00988,"percentile":0.61327}],"risk":0.70148,"urls":["https://github.com/php/php-src/security/advisories/GHSA-hrwm-9436-5mv3","http://www.openwall.com/lists/oss-security/2025/07/11/4","https://lists.debian.org/debian-lts-announce/2025/07/msg00017.html"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-1735","description":"In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8.4.* pgsql and pdo_pgsql escaping functions do not check if the underlying quoting functions returned errors. This could cause crashes if Postgres server rejects the string as invalid."},"relatedVulnerabilities":[]},{"artifact":{"id":"422a442f930ca27c","cpes":["cpe:2.3:a:nginx:nginx:1.18.0-r15:*:*:*:*:*:*:*"],"name":"nginx","purl":"pkg:apk/busybox/nginx@1.18.0-r15?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"1.18.0-r15","language":"","licenses":["BSD-2-Clause"],"metadata":{"Arch":"x86_64","files":[{"path":"/etc"},{"path":"/etc/logrotate.d"},{"path":"/etc/logrotate.d/nginx"},{"path":"/etc/nginx"},{"path":"/etc/nginx/fastcgi.conf"},{"path":"/etc/nginx/fastcgi_params"},{"path":"/etc/nginx/mime.types"},{"path":"/etc/nginx/nginx.conf"},{"path":"/etc/nginx/scgi_params"},{"path":"/etc/nginx/uwsgi_params"},{"path":"/etc/nginx/http.d"},{"path":"/etc/nginx/modules"},{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/nginx"},{"path":"/usr/lib/nginx/modules"},{"path":"/usr/sbin"},{"path":"/usr/sbin/nginx"},{"path":"/usr/share"},{"path":"/usr/share/nginx"},{"path":"/usr/share/nginx/http-default_server.conf"},{"path":"/var"},{"path":"/var/lib"},{"path":"/var/lib/nginx"},{"path":"/var/lib/nginx/logs"},{"path":"/var/lib/nginx/modules"},{"path":"/var/lib/nginx/run"},{"path":"/var/lib/nginx/html"},{"path":"/var/lib/nginx/html/50x.html"},{"path":"/var/lib/nginx/html/index.html"},{"path":"/var/lib/nginx/tmp"},{"path":"/var/log"},{"path":"/var/log/nginx"},{"path":"/var/www"},{"path":"/var/www/localhost"},{"path":"/var/www/localhost/htdocs"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"nginx"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:nginx:nginx:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-42946","versionConstraint":">= 0.8.42, < 1.30.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:nginx:nginx:1.18.0:*:*:*:*:*:*:*"],"package":{"name":"nginx","version":"1.18.0-r15"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-42946","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"f5sirt@f5.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"f5sirt@f5.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:L","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42946","cwe":"CWE-789","type":"Secondary","source":"f5sirt@f5.com"},{"cve":"CVE-2026-42946","cwe":"CWE-823","type":"Secondary","source":"f5sirt@f5.com"}],"epss":[{"cve":"CVE-2026-42946","date":"2026-10-08","epss":0.00932,"percentile":0.59503}],"risk":0.6943400000000002,"urls":["https://my.f5.com/manage/s/article/K000161027"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42946","description":"A vulnerability exists in the ngx_http_scgi_module and ngx_http_uwsgi_module modules that may result in excessive memory allocation or an over-read of data. When scgi_pass or uwsgi_pass is configured, an unauthenticated attacker with man-in-the-middle (MITM) ability to control responses from an upstream server may be able to read the memory of the NGINX worker process or restart it.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated."},"relatedVulnerabilities":[]},{"artifact":{"id":"d081de97c6f633df","cpes":["cpe:2.3:a:libcrypto1.1:libcrypto1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto1.1:libcrypto:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto:libcrypto1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto:libcrypto:1.1.1q-r0:*:*:*:*:*:*:*"],"name":"libcrypto1.1","purl":"pkg:apk/busybox/libcrypto1.1@1.1.1q-r0?arch=x86_64&distro=busybox-1.32.1&upstream=openssl","type":"apk","version":"1.1.1q-r0","language":"","licenses":["OpenSSL"],"metadata":{"Arch":"x86_64","files":[{"path":"/etc"},{"path":"/etc/ssl"},{"path":"/etc/ssl/ct_log_list.cnf"},{"path":"/etc/ssl/ct_log_list.cnf.dist"},{"path":"/etc/ssl/openssl.cnf"},{"path":"/etc/ssl/openssl.cnf.dist"},{"path":"/etc/ssl/certs"},{"path":"/etc/ssl/misc"},{"path":"/etc/ssl/misc/CA.pl"},{"path":"/etc/ssl/misc/tsget"},{"path":"/etc/ssl/misc/tsget.pl"},{"path":"/etc/ssl/private"},{"path":"/lib"},{"path":"/lib/libcrypto.so.1.1"},{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcrypto.so.1.1"},{"path":"/usr/lib/engines-1.1"},{"path":"/usr/lib/engines-1.1/afalg.so"},{"path":"/usr/lib/engines-1.1/capi.so"},{"path":"/usr/lib/engines-1.1/padlock.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-63072","versionConstraint":">= 1.1.1, < 1.1.1zi||>= 3.0.0, < 3.0.22||>= 3.4.0, < 3.4.7||>= 3.5.0, < 3.5.8||>= 3.6.0, < 3.6.4||>= 4.0.0, < 4.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:1.1.1q:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"1.1.1q-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-63072","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-63072","cwe":"CWE-787","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-63072","date":"2026-10-08","epss":0.00916,"percentile":0.58982}],"risk":0.6869999999999999,"urls":["https://github.com/openssl/openssl/commit/2a3dac874c8057c1f0186849bf1ede1ae7b6b756","https://github.com/openssl/openssl/commit/87784ad619af36b8807c2044b3940006fccc1e42","https://github.com/openssl/openssl/commit/9530a5fd1aacaeccdced4478ea2340a480613335","https://github.com/openssl/openssl/commit/9ec2f6d2ae2bcad907cf7ee38584855bafe4979a","https://github.com/openssl/openssl/commit/a0c8ec557d9cac078f032d76cdf684fe743eb382","https://openssl-library.org/news/secadv/20260825.txt"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-63072","description":"Issue summary: OpenSSL CMS decryption sizes the key-unwrap output buffer based\non querying the unwrapped key size, but the AES-WRAP-PAD unwrap primitive\ncan write and cleanse more bytes than that query reports, causing an 8-byte\nout-of-bounds heap write.\n\nImpact summary: An attacker who supplies a crafted CMS message can trigger a\ndeterministic 8-byte out-of-bounds heap write when the victim decrypts it\nwith CMS_decrypt(), corrupting the heap and typically resulting in a Denial\nof Service.\n\nCWE: CWE-787: Out-of-bounds Write\n\nDescription: The key-wrap OID is potentially attacker-controlled on the wire.\nCMS unwrapping allows both id-aesNNN-wrap-pad and id-aesNNN-wrap ciphers.\nAn attacker can take a legitimate message and change a single OID byte to\nselect the padded variant while leaving the message otherwise valid. Since\nthe unwrap key is derived from the recipient's private operation (ECDH key\nagreement or ML-KEM decapsulation), the RFC 5649 integrity check cannot\npass, and the decryption fails with integrity failure.\n\nThe write is a fixed-size (8-byte), fixed-value (zero) heap overflow\nimmediately past the allocation, requires no special configuration, and is\nreachable from the public CMS_decrypt() function. The consequence is\na heap corruption leading to a Denial of Service. The fix in the CMS code\nsizes the unwrap output buffer for the worst case so a failed unwrap cannot\nwrite past the allocation.\n\nFIPS impact: no\n\nAs the CMS code lives outside the FIPS module boundary, no FIPS\nmodules are affected by this CVE."},"relatedVulnerabilities":[]},{"artifact":{"id":"74f4e71ff41d2d68","cpes":["cpe:2.3:a:libssl1.1:libssl1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl1.1:libssl:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl:1.1.1q-r0:*:*:*:*:*:*:*"],"name":"libssl1.1","purl":"pkg:apk/busybox/libssl1.1@1.1.1q-r0?arch=x86_64&distro=busybox-1.32.1&upstream=openssl","type":"apk","version":"1.1.1q-r0","language":"","licenses":["OpenSSL"],"metadata":{"Arch":"x86_64","files":[{"path":"/lib"},{"path":"/lib/libssl.so.1.1"},{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libssl.so.1.1"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-63072","versionConstraint":">= 1.1.1, < 1.1.1zi||>= 3.0.0, < 3.0.22||>= 3.4.0, < 3.4.7||>= 3.5.0, < 3.5.8||>= 3.6.0, < 3.6.4||>= 4.0.0, < 4.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:1.1.1q:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"1.1.1q-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-63072","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-63072","cwe":"CWE-787","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-63072","date":"2026-10-08","epss":0.00916,"percentile":0.58982}],"risk":0.6869999999999999,"urls":["https://github.com/openssl/openssl/commit/2a3dac874c8057c1f0186849bf1ede1ae7b6b756","https://github.com/openssl/openssl/commit/87784ad619af36b8807c2044b3940006fccc1e42","https://github.com/openssl/openssl/commit/9530a5fd1aacaeccdced4478ea2340a480613335","https://github.com/openssl/openssl/commit/9ec2f6d2ae2bcad907cf7ee38584855bafe4979a","https://github.com/openssl/openssl/commit/a0c8ec557d9cac078f032d76cdf684fe743eb382","https://openssl-library.org/news/secadv/20260825.txt"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-63072","description":"Issue summary: OpenSSL CMS decryption sizes the key-unwrap output buffer based\non querying the unwrapped key size, but the AES-WRAP-PAD unwrap primitive\ncan write and cleanse more bytes than that query reports, causing an 8-byte\nout-of-bounds heap write.\n\nImpact summary: An attacker who supplies a crafted CMS message can trigger a\ndeterministic 8-byte out-of-bounds heap write when the victim decrypts it\nwith CMS_decrypt(), corrupting the heap and typically resulting in a Denial\nof Service.\n\nCWE: CWE-787: Out-of-bounds Write\n\nDescription: The key-wrap OID is potentially attacker-controlled on the wire.\nCMS unwrapping allows both id-aesNNN-wrap-pad and id-aesNNN-wrap ciphers.\nAn attacker can take a legitimate message and change a single OID byte to\nselect the padded variant while leaving the message otherwise valid. Since\nthe unwrap key is derived from the recipient's private operation (ECDH key\nagreement or ML-KEM decapsulation), the RFC 5649 integrity check cannot\npass, and the decryption fails with integrity failure.\n\nThe write is a fixed-size (8-byte), fixed-value (zero) heap overflow\nimmediately past the allocation, requires no special configuration, and is\nreachable from the public CMS_decrypt() function. The consequence is\na heap corruption leading to a Denial of Service. The fix in the CMS code\nsizes the unwrap output buffer for the worst case so a failed unwrap cannot\nwrite past the allocation.\n\nFIPS impact: no\n\nAs the CMS code lives outside the FIPS module boundary, no FIPS\nmodules are affected by this CVE."},"relatedVulnerabilities":[]},{"artifact":{"id":"14807b4f7067817d","cpes":["cpe:2.3:a:openssl:openssl:1.1.1q-r0:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:apk/busybox/openssl@1.1.1q-r0?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"1.1.1q-r0","language":"","licenses":["OpenSSL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/openssl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-63072","versionConstraint":">= 1.1.1, < 1.1.1zi||>= 3.0.0, < 3.0.22||>= 3.4.0, < 3.4.7||>= 3.5.0, < 3.5.8||>= 3.6.0, < 3.6.4||>= 4.0.0, < 4.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:1.1.1q:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"1.1.1q-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-63072","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-63072","cwe":"CWE-787","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-63072","date":"2026-10-08","epss":0.00916,"percentile":0.58982}],"risk":0.6869999999999999,"urls":["https://github.com/openssl/openssl/commit/2a3dac874c8057c1f0186849bf1ede1ae7b6b756","https://github.com/openssl/openssl/commit/87784ad619af36b8807c2044b3940006fccc1e42","https://github.com/openssl/openssl/commit/9530a5fd1aacaeccdced4478ea2340a480613335","https://github.com/openssl/openssl/commit/9ec2f6d2ae2bcad907cf7ee38584855bafe4979a","https://github.com/openssl/openssl/commit/a0c8ec557d9cac078f032d76cdf684fe743eb382","https://openssl-library.org/news/secadv/20260825.txt"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-63072","description":"Issue summary: OpenSSL CMS decryption sizes the key-unwrap output buffer based\non querying the unwrapped key size, but the AES-WRAP-PAD unwrap primitive\ncan write and cleanse more bytes than that query reports, causing an 8-byte\nout-of-bounds heap write.\n\nImpact summary: An attacker who supplies a crafted CMS message can trigger a\ndeterministic 8-byte out-of-bounds heap write when the victim decrypts it\nwith CMS_decrypt(), corrupting the heap and typically resulting in a Denial\nof Service.\n\nCWE: CWE-787: Out-of-bounds Write\n\nDescription: The key-wrap OID is potentially attacker-controlled on the wire.\nCMS unwrapping allows both id-aesNNN-wrap-pad and id-aesNNN-wrap ciphers.\nAn attacker can take a legitimate message and change a single OID byte to\nselect the padded variant while leaving the message otherwise valid. Since\nthe unwrap key is derived from the recipient's private operation (ECDH key\nagreement or ML-KEM decapsulation), the RFC 5649 integrity check cannot\npass, and the decryption fails with integrity failure.\n\nThe write is a fixed-size (8-byte), fixed-value (zero) heap overflow\nimmediately past the allocation, requires no special configuration, and is\nreachable from the public CMS_decrypt() function. The consequence is\na heap corruption leading to a Denial of Service. The fix in the CMS code\nsizes the unwrap output buffer for the worst case so a failed unwrap cannot\nwrite past the allocation.\n\nFIPS impact: no\n\nAs the CMS code lives outside the FIPS module boundary, no FIPS\nmodules are affected by this CVE."},"relatedVulnerabilities":[]},{"artifact":{"id":"d081de97c6f633df","cpes":["cpe:2.3:a:libcrypto1.1:libcrypto1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto1.1:libcrypto:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto:libcrypto1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto:libcrypto:1.1.1q-r0:*:*:*:*:*:*:*"],"name":"libcrypto1.1","purl":"pkg:apk/busybox/libcrypto1.1@1.1.1q-r0?arch=x86_64&distro=busybox-1.32.1&upstream=openssl","type":"apk","version":"1.1.1q-r0","language":"","licenses":["OpenSSL"],"metadata":{"Arch":"x86_64","files":[{"path":"/etc"},{"path":"/etc/ssl"},{"path":"/etc/ssl/ct_log_list.cnf"},{"path":"/etc/ssl/ct_log_list.cnf.dist"},{"path":"/etc/ssl/openssl.cnf"},{"path":"/etc/ssl/openssl.cnf.dist"},{"path":"/etc/ssl/certs"},{"path":"/etc/ssl/misc"},{"path":"/etc/ssl/misc/CA.pl"},{"path":"/etc/ssl/misc/tsget"},{"path":"/etc/ssl/misc/tsget.pl"},{"path":"/etc/ssl/private"},{"path":"/lib"},{"path":"/lib/libcrypto.so.1.1"},{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcrypto.so.1.1"},{"path":"/usr/lib/engines-1.1"},{"path":"/usr/lib/engines-1.1/afalg.so"},{"path":"/usr/lib/engines-1.1/capi.so"},{"path":"/usr/lib/engines-1.1/padlock.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-69420","versionConstraint":">= 1.1.1, < 1.1.1ze||>= 3.0.0, < 3.0.19||>= 3.3.0, < 3.3.6||>= 3.4.0, < 3.4.4||>= 3.5.0, < 3.5.5||>= 3.6.0, < 3.6.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:1.1.1q:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"1.1.1q-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2025-69420","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-69420","cwe":"CWE-754","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2025-69420","date":"2026-10-08","epss":0.00899,"percentile":0.58405}],"risk":0.67425,"urls":["https://github.com/openssl/openssl/commit/27c7012c91cc986a598d7540f3079dfde2416eb9","https://github.com/openssl/openssl/commit/4e254b48ad93cc092be3dd62d97015f33f73133a","https://github.com/openssl/openssl/commit/564fd9c73787f25693bf9e75faf7bf6bb1305d4e","https://github.com/openssl/openssl/commit/5eb0770ffcf11b785cf374ff3c19196245e54f1b","https://github.com/openssl/openssl/commit/a99349ebfc519999edc50620abe24d599b9eb085","https://openssl-library.org/news/secadv/20260127.txt","https://cert-portal.siemens.com/productcert/html/ssa-265688.html"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-69420","description":"Issue summary: A type confusion vulnerability exists in the TimeStamp Response\nverification code where an ASN1_TYPE union member is accessed without first\nvalidating the type, causing an invalid or NULL pointer dereference when\nprocessing a malformed TimeStamp Response file.\n\nImpact summary: An application calling TS_RESP_verify_response() with a\nmalformed TimeStamp Response can be caused to dereference an invalid or\nNULL pointer when reading, resulting in a Denial of Service.\n\nThe functions ossl_ess_get_signing_cert() and ossl_ess_get_signing_cert_v2()\naccess the signing cert attribute value without validating its type.\nWhen the type is not V_ASN1_SEQUENCE, this results in accessing invalid memory\nthrough the ASN1_TYPE union, causing a crash.\n\nExploiting this vulnerability requires an attacker to provide a malformed\nTimeStamp Response to an application that verifies timestamp responses. The\nTimeStamp protocol (RFC 3161) is not widely used and the impact of the\nexploit is just a Denial of Service. For these reasons the issue was\nassessed as Low severity.\n\nThe FIPS modules in 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the TimeStamp Response implementation is outside the OpenSSL FIPS module\nboundary.\n\nOpenSSL 3.6, 3.5, 3.4, 3.3, 3.0 and 1.1.1 are vulnerable to this issue.\n\nOpenSSL 1.0.2 is not affected by this issue."},"relatedVulnerabilities":[]},{"artifact":{"id":"74f4e71ff41d2d68","cpes":["cpe:2.3:a:libssl1.1:libssl1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl1.1:libssl:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl:1.1.1q-r0:*:*:*:*:*:*:*"],"name":"libssl1.1","purl":"pkg:apk/busybox/libssl1.1@1.1.1q-r0?arch=x86_64&distro=busybox-1.32.1&upstream=openssl","type":"apk","version":"1.1.1q-r0","language":"","licenses":["OpenSSL"],"metadata":{"Arch":"x86_64","files":[{"path":"/lib"},{"path":"/lib/libssl.so.1.1"},{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libssl.so.1.1"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-69420","versionConstraint":">= 1.1.1, < 1.1.1ze||>= 3.0.0, < 3.0.19||>= 3.3.0, < 3.3.6||>= 3.4.0, < 3.4.4||>= 3.5.0, < 3.5.5||>= 3.6.0, < 3.6.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:1.1.1q:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"1.1.1q-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2025-69420","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-69420","cwe":"CWE-754","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2025-69420","date":"2026-10-08","epss":0.00899,"percentile":0.58405}],"risk":0.67425,"urls":["https://github.com/openssl/openssl/commit/27c7012c91cc986a598d7540f3079dfde2416eb9","https://github.com/openssl/openssl/commit/4e254b48ad93cc092be3dd62d97015f33f73133a","https://github.com/openssl/openssl/commit/564fd9c73787f25693bf9e75faf7bf6bb1305d4e","https://github.com/openssl/openssl/commit/5eb0770ffcf11b785cf374ff3c19196245e54f1b","https://github.com/openssl/openssl/commit/a99349ebfc519999edc50620abe24d599b9eb085","https://openssl-library.org/news/secadv/20260127.txt","https://cert-portal.siemens.com/productcert/html/ssa-265688.html"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-69420","description":"Issue summary: A type confusion vulnerability exists in the TimeStamp Response\nverification code where an ASN1_TYPE union member is accessed without first\nvalidating the type, causing an invalid or NULL pointer dereference when\nprocessing a malformed TimeStamp Response file.\n\nImpact summary: An application calling TS_RESP_verify_response() with a\nmalformed TimeStamp Response can be caused to dereference an invalid or\nNULL pointer when reading, resulting in a Denial of Service.\n\nThe functions ossl_ess_get_signing_cert() and ossl_ess_get_signing_cert_v2()\naccess the signing cert attribute value without validating its type.\nWhen the type is not V_ASN1_SEQUENCE, this results in accessing invalid memory\nthrough the ASN1_TYPE union, causing a crash.\n\nExploiting this vulnerability requires an attacker to provide a malformed\nTimeStamp Response to an application that verifies timestamp responses. The\nTimeStamp protocol (RFC 3161) is not widely used and the impact of the\nexploit is just a Denial of Service. For these reasons the issue was\nassessed as Low severity.\n\nThe FIPS modules in 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the TimeStamp Response implementation is outside the OpenSSL FIPS module\nboundary.\n\nOpenSSL 3.6, 3.5, 3.4, 3.3, 3.0 and 1.1.1 are vulnerable to this issue.\n\nOpenSSL 1.0.2 is not affected by this issue."},"relatedVulnerabilities":[]},{"artifact":{"id":"14807b4f7067817d","cpes":["cpe:2.3:a:openssl:openssl:1.1.1q-r0:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:apk/busybox/openssl@1.1.1q-r0?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"1.1.1q-r0","language":"","licenses":["OpenSSL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/openssl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-69420","versionConstraint":">= 1.1.1, < 1.1.1ze||>= 3.0.0, < 3.0.19||>= 3.3.0, < 3.3.6||>= 3.4.0, < 3.4.4||>= 3.5.0, < 3.5.5||>= 3.6.0, < 3.6.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:1.1.1q:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"1.1.1q-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2025-69420","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-69420","cwe":"CWE-754","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2025-69420","date":"2026-10-08","epss":0.00899,"percentile":0.58405}],"risk":0.67425,"urls":["https://github.com/openssl/openssl/commit/27c7012c91cc986a598d7540f3079dfde2416eb9","https://github.com/openssl/openssl/commit/4e254b48ad93cc092be3dd62d97015f33f73133a","https://github.com/openssl/openssl/commit/564fd9c73787f25693bf9e75faf7bf6bb1305d4e","https://github.com/openssl/openssl/commit/5eb0770ffcf11b785cf374ff3c19196245e54f1b","https://github.com/openssl/openssl/commit/a99349ebfc519999edc50620abe24d599b9eb085","https://openssl-library.org/news/secadv/20260127.txt","https://cert-portal.siemens.com/productcert/html/ssa-265688.html"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-69420","description":"Issue summary: A type confusion vulnerability exists in the TimeStamp Response\nverification code where an ASN1_TYPE union member is accessed without first\nvalidating the type, causing an invalid or NULL pointer dereference when\nprocessing a malformed TimeStamp Response file.\n\nImpact summary: An application calling TS_RESP_verify_response() with a\nmalformed TimeStamp Response can be caused to dereference an invalid or\nNULL pointer when reading, resulting in a Denial of Service.\n\nThe functions ossl_ess_get_signing_cert() and ossl_ess_get_signing_cert_v2()\naccess the signing cert attribute value without validating its type.\nWhen the type is not V_ASN1_SEQUENCE, this results in accessing invalid memory\nthrough the ASN1_TYPE union, causing a crash.\n\nExploiting this vulnerability requires an attacker to provide a malformed\nTimeStamp Response to an application that verifies timestamp responses. The\nTimeStamp protocol (RFC 3161) is not widely used and the impact of the\nexploit is just a Denial of Service. For these reasons the issue was\nassessed as Low severity.\n\nThe FIPS modules in 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the TimeStamp Response implementation is outside the OpenSSL FIPS module\nboundary.\n\nOpenSSL 3.6, 3.5, 3.4, 3.3, 3.0 and 1.1.1 are vulnerable to this issue.\n\nOpenSSL 1.0.2 is not affected by this issue."},"relatedVulnerabilities":[]},{"artifact":{"id":"6040784032e8795c","cpes":["cpe:2.3:a:curl:curl:7.79.1-r3:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:7.79.1-r3:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/busybox/curl@7.79.1-r3?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"7.79.1-r3","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-80231","versionConstraint":">= 7.71.0, < 8.14.2||>= 8.15.0, < 8.16.1||>= 8.17.0, < 8.20.1||>= 8.21.0, < 8.22.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:haxx:curl:7.79.1:*:*:*:*:*:*:*"],"package":{"name":"curl","version":"7.79.1-r3"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-80231","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-80231","cwe":"CWE-488","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-80231","cwe":"CWE-488","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-80231","date":"2026-10-08","epss":0.00898,"percentile":0.58384}],"risk":0.6735,"urls":["https://curl.se/docs/CVE-2026-80231.html","https://curl.se/docs/CVE-2026-80231.json","https://hackerone.com/reports/3969368"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-80231","description":"A flaw in libcurl makes it wrongly reuse an existing HTTPS connection setup\nfor a given hostname even when using a different Native CA Store setting\n(`CURLSSLOPT_NATIVE_CA`) than when the connection was created."},"relatedVulnerabilities":[]},{"artifact":{"id":"19103520a7fb35af","cpes":["cpe:2.3:a:nghttp2-libs:nghttp2-libs:1.42.0-r1:*:*:*:*:*:*:*","cpe:2.3:a:nghttp2-libs:nghttp2_libs:1.42.0-r1:*:*:*:*:*:*:*","cpe:2.3:a:nghttp2_libs:nghttp2-libs:1.42.0-r1:*:*:*:*:*:*:*","cpe:2.3:a:nghttp2_libs:nghttp2_libs:1.42.0-r1:*:*:*:*:*:*:*","cpe:2.3:a:nghttp-libs:nghttp2-libs:1.42.0-r1:*:*:*:*:*:*:*","cpe:2.3:a:nghttp-libs:nghttp2_libs:1.42.0-r1:*:*:*:*:*:*:*","cpe:2.3:a:nghttp2-libs:nghttp-libs:1.42.0-r1:*:*:*:*:*:*:*","cpe:2.3:a:nghttp2-libs:nghttp_libs:1.42.0-r1:*:*:*:*:*:*:*","cpe:2.3:a:nghttp2_libs:nghttp-libs:1.42.0-r1:*:*:*:*:*:*:*","cpe:2.3:a:nghttp2_libs:nghttp_libs:1.42.0-r1:*:*:*:*:*:*:*","cpe:2.3:a:nghttp_libs:nghttp2-libs:1.42.0-r1:*:*:*:*:*:*:*","cpe:2.3:a:nghttp_libs:nghttp2_libs:1.42.0-r1:*:*:*:*:*:*:*","cpe:2.3:a:nghttp-libs:nghttp-libs:1.42.0-r1:*:*:*:*:*:*:*","cpe:2.3:a:nghttp-libs:nghttp_libs:1.42.0-r1:*:*:*:*:*:*:*","cpe:2.3:a:nghttp_libs:nghttp-libs:1.42.0-r1:*:*:*:*:*:*:*","cpe:2.3:a:nghttp_libs:nghttp_libs:1.42.0-r1:*:*:*:*:*:*:*","cpe:2.3:a:nghttp2:nghttp2-libs:1.42.0-r1:*:*:*:*:*:*:*","cpe:2.3:a:nghttp2:nghttp2_libs:1.42.0-r1:*:*:*:*:*:*:*","cpe:2.3:a:nghttp2:nghttp-libs:1.42.0-r1:*:*:*:*:*:*:*","cpe:2.3:a:nghttp2:nghttp_libs:1.42.0-r1:*:*:*:*:*:*:*","cpe:2.3:a:nghttp:nghttp2-libs:1.42.0-r1:*:*:*:*:*:*:*","cpe:2.3:a:nghttp:nghttp2_libs:1.42.0-r1:*:*:*:*:*:*:*","cpe:2.3:a:nghttp:nghttp-libs:1.42.0-r1:*:*:*:*:*:*:*","cpe:2.3:a:nghttp:nghttp_libs:1.42.0-r1:*:*:*:*:*:*:*"],"name":"nghttp2-libs","purl":"pkg:apk/busybox/nghttp2-libs@1.42.0-r1?arch=x86_64&distro=busybox-1.32.1&upstream=nghttp2","type":"apk","version":"1.42.0-r1","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libnghttp2.so.14"},{"path":"/usr/lib/libnghttp2.so.14.20.1"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"nghttp2"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:nghttp2:nghttp2:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-27135","versionConstraint":"< 1.68.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:nghttp2:nghttp2:1.42.0:*:*:*:*:*:*:*"],"package":{"name":"nghttp2","version":"1.42.0-r1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-27135","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-27135","cwe":"CWE-617","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-27135","cwe":"CWE-617","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-27135","date":"2026-10-08","epss":0.00892,"percentile":0.58186}],"risk":0.669,"urls":["https://github.com/nghttp2/nghttp2/commit/5c7df8fa815ac1004d9ecb9d1f7595c4d37f46e1","https://github.com/nghttp2/nghttp2/security/advisories/GHSA-6933-cjhr-5qg6","http://www.openwall.com/lists/oss-security/2026/03/20/3","https://lists.debian.org/debian-lts-announce/2026/05/msg00025.html","https://access.redhat.com/errata/RHSA-2026:10065","https://access.redhat.com/errata/RHSA-2026:11768","https://access.redhat.com/errata/RHSA-2026:13812","https://access.redhat.com/errata/RHSA-2026:14773","https://access.redhat.com/errata/RHSA-2026:14937","https://access.redhat.com/errata/RHSA-2026:15087","https://access.redhat.com/errata/RHSA-2026:16008","https://access.redhat.com/errata/RHSA-2026:16009","https://access.redhat.com/errata/RHSA-2026:16030","https://access.redhat.com/errata/RHSA-2026:16174","https://access.redhat.com/errata/RHSA-2026:17596","https://access.redhat.com/errata/RHSA-2026:19724","https://access.redhat.com/errata/RHSA-2026:19725","https://access.redhat.com/errata/RHSA-2026:20040","https://access.redhat.com/errata/RHSA-2026:20087","https://access.redhat.com/errata/RHSA-2026:21656","https://access.redhat.com/errata/RHSA-2026:21690","https://access.redhat.com/errata/RHSA-2026:21695","https://access.redhat.com/errata/RHSA-2026:25096","https://access.redhat.com/errata/RHSA-2026:27200","https://access.redhat.com/errata/RHSA-2026:27201","https://access.redhat.com/errata/RHSA-2026:6190","https://access.redhat.com/errata/RHSA-2026:7080","https://access.redhat.com/errata/RHSA-2026:7123","https://access.redhat.com/errata/RHSA-2026:7302","https://access.redhat.com/errata/RHSA-2026:7310","https://access.redhat.com/errata/RHSA-2026:7350","https://access.redhat.com/errata/RHSA-2026:7666","https://access.redhat.com/errata/RHSA-2026:7667","https://access.redhat.com/errata/RHSA-2026:7668","https://access.redhat.com/errata/RHSA-2026:7670","https://access.redhat.com/errata/RHSA-2026:7675","https://access.redhat.com/errata/RHSA-2026:7896","https://access.redhat.com/errata/RHSA-2026:7983","https://access.redhat.com/errata/RHSA-2026:8339","https://access.redhat.com/errata/RHSA-2026:8538","https://access.redhat.com/errata/RHSA-2026:8539","https://access.redhat.com/errata/RHSA-2026:8540","https://access.redhat.com/errata/RHSA-2026:8541","https://access.redhat.com/errata/RHSA-2026:8545","https://access.redhat.com/errata/RHSA-2026:8546","https://access.redhat.com/errata/RHSA-2026:8547","https://access.redhat.com/errata/RHSA-2026:8548","https://access.redhat.com/errata/RHSA-2026:8868","https://access.redhat.com/errata/RHSA-2026:9711","https://access.redhat.com/errata/RHSA-2026:9832","https://access.redhat.com/errata/RHSA-2026:9874","https://access.redhat.com/security/cve/CVE-2026-27135","https://bugzilla.redhat.com/show_bug.cgi?id=2448754","https://cert-portal.siemens.com/productcert/html/ssa-019113.html","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27135.json"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-27135","description":"nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. Prior to version 1.68.1, the nghttp2 library stops reading the incoming data when user facing public API `nghttp2_session_terminate_session` or `nghttp2_session_terminate_session2` is called by the application. They might be called internally by the library when it detects the situation that is subject to connection error. Due to the missing internal state validation, the library keeps reading the rest of the data after one of those APIs is called. Then receiving a malformed frame that causes FRAME_SIZE_ERROR causes assertion failure. nghttp2 v1.68.1 adds missing state validation to avoid assertion failure. No known workarounds are available."},"relatedVulnerabilities":[]},{"artifact":{"id":"a745c6f99abca0da","cpes":["cpe:2.3:a:libxml2:libxml2:2.9.14-r2:*:*:*:*:*:*:*","cpe:2.3:a:libxml2:libxml:2.9.14-r2:*:*:*:*:*:*:*","cpe:2.3:a:libxml:libxml2:2.9.14-r2:*:*:*:*:*:*:*","cpe:2.3:a:libxml:libxml:2.9.14-r2:*:*:*:*:*:*:*"],"name":"libxml2","purl":"pkg:apk/busybox/libxml2@2.9.14-r2?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"2.9.14-r2","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libxml2.so.2"},{"path":"/usr/lib/libxml2.so.2.9.14"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"libxml2"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:libxml2:libxml2:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-27113","versionConstraint":"< 2.12.10||>= 2.13.0, < 2.13.6 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:libxml2:libxml2:2.9.14:*:*:*:*:*:*:*"],"package":{"name":"libxml2","version":"2.9.14-r2"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2025-27113","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-27113","cwe":"CWE-476","type":"Secondary","source":"cve@mitre.org"},{"cve":"CVE-2025-27113","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-27113","date":"2026-10-08","epss":0.01053,"percentile":0.63313}],"risk":0.668655,"urls":["https://gitlab.gnome.org/GNOME/libxml2/-/issues/861","http://seclists.org/fulldisclosure/2025/Apr/10","http://seclists.org/fulldisclosure/2025/Apr/11","http://seclists.org/fulldisclosure/2025/Apr/12","http://seclists.org/fulldisclosure/2025/Apr/13","http://seclists.org/fulldisclosure/2025/Apr/4","http://seclists.org/fulldisclosure/2025/Apr/5","http://seclists.org/fulldisclosure/2025/Apr/8","http://seclists.org/fulldisclosure/2025/Apr/9","https://lists.debian.org/debian-lts-announce/2025/02/msg00028.html","https://security.netapp.com/advisory/ntap-20250306-0004/"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-27113","description":"libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a NULL pointer dereference in xmlPatMatch in pattern.c."},"relatedVulnerabilities":[]},{"artifact":{"id":"de2e09a252869bf3","cpes":["cpe:2.3:a:git-scm:git:2.30.6-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_scm:git:2.30.6-r0:*:*:*:*:*:*:*","cpe:2.3:a:git:git:2.30.6-r0:*:*:*:*:*:*:*"],"name":"git","purl":"pkg:apk/busybox/git@2.30.6-r0?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"2.30.6-r0","language":"","licenses":["GPL-2.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/git"},{"path":"/usr/bin/git-receive-pack"},{"path":"/usr/bin/git-shell"},{"path":"/usr/bin/git-upload-archive"},{"path":"/usr/bin/git-upload-pack"},{"path":"/usr/libexec"},{"path":"/usr/libexec/git-core"},{"path":"/usr/libexec/git-core/git"},{"path":"/usr/libexec/git-core/git-add"},{"path":"/usr/libexec/git-core/git-am"},{"path":"/usr/libexec/git-core/git-annotate"},{"path":"/usr/libexec/git-core/git-apply"},{"path":"/usr/libexec/git-core/git-archive"},{"path":"/usr/libexec/git-core/git-bisect"},{"path":"/usr/libexec/git-core/git-bisect--helper"},{"path":"/usr/libexec/git-core/git-blame"},{"path":"/usr/libexec/git-core/git-branch"},{"path":"/usr/libexec/git-core/git-bugreport"},{"path":"/usr/libexec/git-core/git-bundle"},{"path":"/usr/libexec/git-core/git-cat-file"},{"path":"/usr/libexec/git-core/git-check-attr"},{"path":"/usr/libexec/git-core/git-check-ignore"},{"path":"/usr/libexec/git-core/git-check-mailmap"},{"path":"/usr/libexec/git-core/git-check-ref-format"},{"path":"/usr/libexec/git-core/git-checkout"},{"path":"/usr/libexec/git-core/git-checkout-index"},{"path":"/usr/libexec/git-core/git-cherry"},{"path":"/usr/libexec/git-core/git-cherry-pick"},{"path":"/usr/libexec/git-core/git-clean"},{"path":"/usr/libexec/git-core/git-clone"},{"path":"/usr/libexec/git-core/git-column"},{"path":"/usr/libexec/git-core/git-commit"},{"path":"/usr/libexec/git-core/git-commit-graph"},{"path":"/usr/libexec/git-core/git-commit-tree"},{"path":"/usr/libexec/git-core/git-config"},{"path":"/usr/libexec/git-core/git-count-objects"},{"path":"/usr/libexec/git-core/git-credential"},{"path":"/usr/libexec/git-core/git-credential-cache"},{"path":"/usr/libexec/git-core/git-credential-cache--daemon"},{"path":"/usr/libexec/git-core/git-credential-store"},{"path":"/usr/libexec/git-core/git-describe"},{"path":"/usr/libexec/git-core/git-diff"},{"path":"/usr/libexec/git-core/git-diff-files"},{"path":"/usr/libexec/git-core/git-diff-index"},{"path":"/usr/libexec/git-core/git-diff-tree"},{"path":"/usr/libexec/git-core/git-difftool"},{"path":"/usr/libexec/git-core/git-difftool--helper"},{"path":"/usr/libexec/git-core/git-env--helper"},{"path":"/usr/libexec/git-core/git-fast-export"},{"path":"/usr/libexec/git-core/git-fetch"},{"path":"/usr/libexec/git-core/git-fetch-pack"},{"path":"/usr/libexec/git-core/git-filter-branch"},{"path":"/usr/libexec/git-core/git-fmt-merge-msg"},{"path":"/usr/libexec/git-core/git-for-each-ref"},{"path":"/usr/libexec/git-core/git-for-each-repo"},{"path":"/usr/libexec/git-core/git-format-patch"},{"path":"/usr/libexec/git-core/git-fsck"},{"path":"/usr/libexec/git-core/git-fsck-objects"},{"path":"/usr/libexec/git-core/git-gc"},{"path":"/usr/libexec/git-core/git-get-tar-commit-id"},{"path":"/usr/libexec/git-core/git-grep"},{"path":"/usr/libexec/git-core/git-hash-object"},{"path":"/usr/libexec/git-core/git-help"},{"path":"/usr/libexec/git-core/git-http-fetch"},{"path":"/usr/libexec/git-core/git-http-push"},{"path":"/usr/libexec/git-core/git-index-pack"},{"path":"/usr/libexec/git-core/git-init"},{"path":"/usr/libexec/git-core/git-init-db"},{"path":"/usr/libexec/git-core/git-interpret-trailers"},{"path":"/usr/libexec/git-core/git-log"},{"path":"/usr/libexec/git-core/git-ls-files"},{"path":"/usr/libexec/git-core/git-ls-remote"},{"path":"/usr/libexec/git-core/git-ls-tree"},{"path":"/usr/libexec/git-core/git-mailinfo"},{"path":"/usr/libexec/git-core/git-mailsplit"},{"path":"/usr/libexec/git-core/git-maintenance"},{"path":"/usr/libexec/git-core/git-merge"},{"path":"/usr/libexec/git-core/git-merge-base"},{"path":"/usr/libexec/git-core/git-merge-file"},{"path":"/usr/libexec/git-core/git-merge-index"},{"path":"/usr/libexec/git-core/git-merge-octopus"},{"path":"/usr/libexec/git-core/git-merge-one-file"},{"path":"/usr/libexec/git-core/git-merge-ours"},{"path":"/usr/libexec/git-core/git-merge-recursive"},{"path":"/usr/libexec/git-core/git-merge-resolve"},{"path":"/usr/libexec/git-core/git-merge-subtree"},{"path":"/usr/libexec/git-core/git-merge-tree"},{"path":"/usr/libexec/git-core/git-mergetool"},{"path":"/usr/libexec/git-core/git-mergetool--lib"},{"path":"/usr/libexec/git-core/git-mktag"},{"path":"/usr/libexec/git-core/git-mktree"},{"path":"/usr/libexec/git-core/git-multi-pack-index"},{"path":"/usr/libexec/git-core/git-mv"},{"path":"/usr/libexec/git-core/git-name-rev"},{"path":"/usr/libexec/git-core/git-notes"},{"path":"/usr/libexec/git-core/git-pack-objects"},{"path":"/usr/libexec/git-core/git-pack-redundant"},{"path":"/usr/libexec/git-core/git-pack-refs"},{"path":"/usr/libexec/git-core/git-patch-id"},{"path":"/usr/libexec/git-core/git-prune"},{"path":"/usr/libexec/git-core/git-prune-packed"},{"path":"/usr/libexec/git-core/git-pull"},{"path":"/usr/libexec/git-core/git-push"},{"path":"/usr/libexec/git-core/git-quiltimport"},{"path":"/usr/libexec/git-core/git-range-diff"},{"path":"/usr/libexec/git-core/git-read-tree"},{"path":"/usr/libexec/git-core/git-rebase"},{"path":"/usr/libexec/git-core/git-rebase--preserve-merges"},{"path":"/usr/libexec/git-core/git-receive-pack"},{"path":"/usr/libexec/git-core/git-reflog"},{"path":"/usr/libexec/git-core/git-remote"},{"path":"/usr/libexec/git-core/git-remote-ext"},{"path":"/usr/libexec/git-core/git-remote-fd"},{"path":"/usr/libexec/git-core/git-remote-ftp"},{"path":"/usr/libexec/git-core/git-remote-ftps"},{"path":"/usr/libexec/git-core/git-remote-http"},{"path":"/usr/libexec/git-core/git-remote-https"},{"path":"/usr/libexec/git-core/git-repack"},{"path":"/usr/libexec/git-core/git-replace"},{"path":"/usr/libexec/git-core/git-request-pull"},{"path":"/usr/libexec/git-core/git-rerere"},{"path":"/usr/libexec/git-core/git-reset"},{"path":"/usr/libexec/git-core/git-restore"},{"path":"/usr/libexec/git-core/git-rev-list"},{"path":"/usr/libexec/git-core/git-rev-parse"},{"path":"/usr/libexec/git-core/git-revert"},{"path":"/usr/libexec/git-core/git-rm"},{"path":"/usr/libexec/git-core/git-send-pack"},{"path":"/usr/libexec/git-core/git-sh-i18n"},{"path":"/usr/libexec/git-core/git-sh-i18n--envsubst"},{"path":"/usr/libexec/git-core/git-sh-setup"},{"path":"/usr/libexec/git-core/git-shortlog"},{"path":"/usr/libexec/git-core/git-show"},{"path":"/usr/libexec/git-core/git-show-branch"},{"path":"/usr/libexec/git-core/git-show-index"},{"path":"/usr/libexec/git-core/git-show-ref"},{"path":"/usr/libexec/git-core/git-sparse-checkout"},{"path":"/usr/libexec/git-core/git-stage"},{"path":"/usr/libexec/git-core/git-stash"},{"path":"/usr/libexec/git-core/git-status"},{"path":"/usr/libexec/git-core/git-stripspace"},{"path":"/usr/libexec/git-core/git-submodule"},{"path":"/usr/libexec/git-core/git-submodule--helper"},{"path":"/usr/libexec/git-core/git-switch"},{"path":"/usr/libexec/git-core/git-symbolic-ref"},{"path":"/usr/libexec/git-core/git-tag"},{"path":"/usr/libexec/git-core/git-unpack-file"},{"path":"/usr/libexec/git-core/git-unpack-objects"},{"path":"/usr/libexec/git-core/git-update-index"},{"path":"/usr/libexec/git-core/git-update-ref"},{"path":"/usr/libexec/git-core/git-update-server-info"},{"path":"/usr/libexec/git-core/git-upload-archive"},{"path":"/usr/libexec/git-core/git-upload-pack"},{"path":"/usr/libexec/git-core/git-var"},{"path":"/usr/libexec/git-core/git-verify-commit"},{"path":"/usr/libexec/git-core/git-verify-pack"},{"path":"/usr/libexec/git-core/git-verify-tag"},{"path":"/usr/libexec/git-core/git-web--browse"},{"path":"/usr/libexec/git-core/git-whatchanged"},{"path":"/usr/libexec/git-core/git-worktree"},{"path":"/usr/libexec/git-core/git-write-tree"},{"path":"/usr/libexec/git-core/mergetools"},{"path":"/usr/libexec/git-core/mergetools/araxis"},{"path":"/usr/libexec/git-core/mergetools/bc"},{"path":"/usr/libexec/git-core/mergetools/codecompare"},{"path":"/usr/libexec/git-core/mergetools/deltawalker"},{"path":"/usr/libexec/git-core/mergetools/diffmerge"},{"path":"/usr/libexec/git-core/mergetools/diffuse"},{"path":"/usr/libexec/git-core/mergetools/ecmerge"},{"path":"/usr/libexec/git-core/mergetools/emerge"},{"path":"/usr/libexec/git-core/mergetools/examdiff"},{"path":"/usr/libexec/git-core/mergetools/guiffy"},{"path":"/usr/libexec/git-core/mergetools/gvimdiff"},{"path":"/usr/libexec/git-core/mergetools/kdiff3"},{"path":"/usr/libexec/git-core/mergetools/kompare"},{"path":"/usr/libexec/git-core/mergetools/meld"},{"path":"/usr/libexec/git-core/mergetools/nvimdiff"},{"path":"/usr/libexec/git-core/mergetools/opendiff"},{"path":"/usr/libexec/git-core/mergetools/smerge"},{"path":"/usr/libexec/git-core/mergetools/tkdiff"},{"path":"/usr/libexec/git-core/mergetools/tortoisemerge"},{"path":"/usr/libexec/git-core/mergetools/vimdiff"},{"path":"/usr/libexec/git-core/mergetools/winmerge"},{"path":"/usr/libexec/git-core/mergetools/xxdiff"},{"path":"/usr/share"},{"path":"/usr/share/git-core"},{"path":"/usr/share/git-core/templates"},{"path":"/usr/share/git-core/templates/description"},{"path":"/usr/share/git-core/templates/branches"},{"path":"/usr/share/git-core/templates/hooks"},{"path":"/usr/share/git-core/templates/hooks/applypatch-msg.sample"},{"path":"/usr/share/git-core/templates/hooks/commit-msg.sample"},{"path":"/usr/share/git-core/templates/hooks/post-update.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-applypatch.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-commit.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-merge-commit.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-push.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-rebase.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-receive.sample"},{"path":"/usr/share/git-core/templates/hooks/prepare-commit-msg.sample"},{"path":"/usr/share/git-core/templates/hooks/push-to-checkout.sample"},{"path":"/usr/share/git-core/templates/hooks/update.sample"},{"path":"/usr/share/git-core/templates/info"},{"path":"/usr/share/git-core/templates/info/exclude"},{"path":"/usr/share/perl5"},{"path":"/var"},{"path":"/var/git"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"git"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2024-32021","versionConstraint":"< 2.39.4||>= 2.40.0, < 2.40.2||>= 2.41.0, < 2.41.1||>= 2.42.0, < 2.42.2||>= 2.43.0, < 2.43.4||>= 2.44.0, < 2.44.1||>= 2.45.0, < 2.45.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:git-scm:git:2.30.6:*:*:*:*:*:*:*"],"package":{"name":"git","version":"2.30.6-r0"},"namespace":"nvd:cpe"}},{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:git:git:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2024-32021","versionConstraint":"< 2.39.4||>= 2.40.0, < 2.40.2||>= 2.41.0, < 2.41.1||>= 2.42.0, < 2.42.2||>= 2.43.0, < 2.43.4||>= 2.44.0, < 2.44.1||>= 2.45.0, < 2.45.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:git:git:2.30.6:*:*:*:*:*:*:*"],"package":{"name":"git","version":"2.30.6-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2024-32021","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.1,"impactScore":5.2,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:L","metrics":{"baseScore":3.9,"impactScore":2.8,"exploitabilityScore":0.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-32021","cwe":"CWE-547","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2024-32021","date":"2026-10-08","epss":0.01023,"percentile":0.62406}],"risk":0.66495,"urls":["http://www.openwall.com/lists/oss-security/2024/05/14/2","https://github.com/git/git/security/advisories/GHSA-mvxm-9j2h-qjx7","https://lists.debian.org/debian-lts-announce/2024/06/msg00018.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/S4CK4IYTXEOBZTEM5K3T6LWOIZ3S44AR/","https://lists.debian.org/debian-lts-announce/2024/09/msg00009.html"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-32021","description":"Git is a revision control system. Prior to versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4, when cloning a local source repository that contains symlinks via the filesystem, Git may create hardlinks to arbitrary user-readable files on the same filesystem as the target repository in the `objects/` directory. Cloning a local repository over the filesystem may creating hardlinks to arbitrary user-owned files on the same filesystem in the target Git repository's `objects/` directory. When cloning a repository over the filesystem (without explicitly specifying the `file://` protocol or `--no-local`), the optimizations for local cloning\nwill be used, which include attempting to hard link the object files instead of copying them. While the code includes checks against symbolic links in the source repository, which were added during the fix for CVE-2022-39253, these checks can still be raced because the hard link operation ultimately follows symlinks. If the object on the filesystem appears as a file during the check, and then a symlink during the operation, this will allow the adversary to bypass the check and create hardlinks in the destination objects directory to arbitrary, user-readable files. The problem has been patched in versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4."},"relatedVulnerabilities":[]},{"artifact":{"id":"de2e09a252869bf3","cpes":["cpe:2.3:a:git-scm:git:2.30.6-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_scm:git:2.30.6-r0:*:*:*:*:*:*:*","cpe:2.3:a:git:git:2.30.6-r0:*:*:*:*:*:*:*"],"name":"git","purl":"pkg:apk/busybox/git@2.30.6-r0?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"2.30.6-r0","language":"","licenses":["GPL-2.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/git"},{"path":"/usr/bin/git-receive-pack"},{"path":"/usr/bin/git-shell"},{"path":"/usr/bin/git-upload-archive"},{"path":"/usr/bin/git-upload-pack"},{"path":"/usr/libexec"},{"path":"/usr/libexec/git-core"},{"path":"/usr/libexec/git-core/git"},{"path":"/usr/libexec/git-core/git-add"},{"path":"/usr/libexec/git-core/git-am"},{"path":"/usr/libexec/git-core/git-annotate"},{"path":"/usr/libexec/git-core/git-apply"},{"path":"/usr/libexec/git-core/git-archive"},{"path":"/usr/libexec/git-core/git-bisect"},{"path":"/usr/libexec/git-core/git-bisect--helper"},{"path":"/usr/libexec/git-core/git-blame"},{"path":"/usr/libexec/git-core/git-branch"},{"path":"/usr/libexec/git-core/git-bugreport"},{"path":"/usr/libexec/git-core/git-bundle"},{"path":"/usr/libexec/git-core/git-cat-file"},{"path":"/usr/libexec/git-core/git-check-attr"},{"path":"/usr/libexec/git-core/git-check-ignore"},{"path":"/usr/libexec/git-core/git-check-mailmap"},{"path":"/usr/libexec/git-core/git-check-ref-format"},{"path":"/usr/libexec/git-core/git-checkout"},{"path":"/usr/libexec/git-core/git-checkout-index"},{"path":"/usr/libexec/git-core/git-cherry"},{"path":"/usr/libexec/git-core/git-cherry-pick"},{"path":"/usr/libexec/git-core/git-clean"},{"path":"/usr/libexec/git-core/git-clone"},{"path":"/usr/libexec/git-core/git-column"},{"path":"/usr/libexec/git-core/git-commit"},{"path":"/usr/libexec/git-core/git-commit-graph"},{"path":"/usr/libexec/git-core/git-commit-tree"},{"path":"/usr/libexec/git-core/git-config"},{"path":"/usr/libexec/git-core/git-count-objects"},{"path":"/usr/libexec/git-core/git-credential"},{"path":"/usr/libexec/git-core/git-credential-cache"},{"path":"/usr/libexec/git-core/git-credential-cache--daemon"},{"path":"/usr/libexec/git-core/git-credential-store"},{"path":"/usr/libexec/git-core/git-describe"},{"path":"/usr/libexec/git-core/git-diff"},{"path":"/usr/libexec/git-core/git-diff-files"},{"path":"/usr/libexec/git-core/git-diff-index"},{"path":"/usr/libexec/git-core/git-diff-tree"},{"path":"/usr/libexec/git-core/git-difftool"},{"path":"/usr/libexec/git-core/git-difftool--helper"},{"path":"/usr/libexec/git-core/git-env--helper"},{"path":"/usr/libexec/git-core/git-fast-export"},{"path":"/usr/libexec/git-core/git-fetch"},{"path":"/usr/libexec/git-core/git-fetch-pack"},{"path":"/usr/libexec/git-core/git-filter-branch"},{"path":"/usr/libexec/git-core/git-fmt-merge-msg"},{"path":"/usr/libexec/git-core/git-for-each-ref"},{"path":"/usr/libexec/git-core/git-for-each-repo"},{"path":"/usr/libexec/git-core/git-format-patch"},{"path":"/usr/libexec/git-core/git-fsck"},{"path":"/usr/libexec/git-core/git-fsck-objects"},{"path":"/usr/libexec/git-core/git-gc"},{"path":"/usr/libexec/git-core/git-get-tar-commit-id"},{"path":"/usr/libexec/git-core/git-grep"},{"path":"/usr/libexec/git-core/git-hash-object"},{"path":"/usr/libexec/git-core/git-help"},{"path":"/usr/libexec/git-core/git-http-fetch"},{"path":"/usr/libexec/git-core/git-http-push"},{"path":"/usr/libexec/git-core/git-index-pack"},{"path":"/usr/libexec/git-core/git-init"},{"path":"/usr/libexec/git-core/git-init-db"},{"path":"/usr/libexec/git-core/git-interpret-trailers"},{"path":"/usr/libexec/git-core/git-log"},{"path":"/usr/libexec/git-core/git-ls-files"},{"path":"/usr/libexec/git-core/git-ls-remote"},{"path":"/usr/libexec/git-core/git-ls-tree"},{"path":"/usr/libexec/git-core/git-mailinfo"},{"path":"/usr/libexec/git-core/git-mailsplit"},{"path":"/usr/libexec/git-core/git-maintenance"},{"path":"/usr/libexec/git-core/git-merge"},{"path":"/usr/libexec/git-core/git-merge-base"},{"path":"/usr/libexec/git-core/git-merge-file"},{"path":"/usr/libexec/git-core/git-merge-index"},{"path":"/usr/libexec/git-core/git-merge-octopus"},{"path":"/usr/libexec/git-core/git-merge-one-file"},{"path":"/usr/libexec/git-core/git-merge-ours"},{"path":"/usr/libexec/git-core/git-merge-recursive"},{"path":"/usr/libexec/git-core/git-merge-resolve"},{"path":"/usr/libexec/git-core/git-merge-subtree"},{"path":"/usr/libexec/git-core/git-merge-tree"},{"path":"/usr/libexec/git-core/git-mergetool"},{"path":"/usr/libexec/git-core/git-mergetool--lib"},{"path":"/usr/libexec/git-core/git-mktag"},{"path":"/usr/libexec/git-core/git-mktree"},{"path":"/usr/libexec/git-core/git-multi-pack-index"},{"path":"/usr/libexec/git-core/git-mv"},{"path":"/usr/libexec/git-core/git-name-rev"},{"path":"/usr/libexec/git-core/git-notes"},{"path":"/usr/libexec/git-core/git-pack-objects"},{"path":"/usr/libexec/git-core/git-pack-redundant"},{"path":"/usr/libexec/git-core/git-pack-refs"},{"path":"/usr/libexec/git-core/git-patch-id"},{"path":"/usr/libexec/git-core/git-prune"},{"path":"/usr/libexec/git-core/git-prune-packed"},{"path":"/usr/libexec/git-core/git-pull"},{"path":"/usr/libexec/git-core/git-push"},{"path":"/usr/libexec/git-core/git-quiltimport"},{"path":"/usr/libexec/git-core/git-range-diff"},{"path":"/usr/libexec/git-core/git-read-tree"},{"path":"/usr/libexec/git-core/git-rebase"},{"path":"/usr/libexec/git-core/git-rebase--preserve-merges"},{"path":"/usr/libexec/git-core/git-receive-pack"},{"path":"/usr/libexec/git-core/git-reflog"},{"path":"/usr/libexec/git-core/git-remote"},{"path":"/usr/libexec/git-core/git-remote-ext"},{"path":"/usr/libexec/git-core/git-remote-fd"},{"path":"/usr/libexec/git-core/git-remote-ftp"},{"path":"/usr/libexec/git-core/git-remote-ftps"},{"path":"/usr/libexec/git-core/git-remote-http"},{"path":"/usr/libexec/git-core/git-remote-https"},{"path":"/usr/libexec/git-core/git-repack"},{"path":"/usr/libexec/git-core/git-replace"},{"path":"/usr/libexec/git-core/git-request-pull"},{"path":"/usr/libexec/git-core/git-rerere"},{"path":"/usr/libexec/git-core/git-reset"},{"path":"/usr/libexec/git-core/git-restore"},{"path":"/usr/libexec/git-core/git-rev-list"},{"path":"/usr/libexec/git-core/git-rev-parse"},{"path":"/usr/libexec/git-core/git-revert"},{"path":"/usr/libexec/git-core/git-rm"},{"path":"/usr/libexec/git-core/git-send-pack"},{"path":"/usr/libexec/git-core/git-sh-i18n"},{"path":"/usr/libexec/git-core/git-sh-i18n--envsubst"},{"path":"/usr/libexec/git-core/git-sh-setup"},{"path":"/usr/libexec/git-core/git-shortlog"},{"path":"/usr/libexec/git-core/git-show"},{"path":"/usr/libexec/git-core/git-show-branch"},{"path":"/usr/libexec/git-core/git-show-index"},{"path":"/usr/libexec/git-core/git-show-ref"},{"path":"/usr/libexec/git-core/git-sparse-checkout"},{"path":"/usr/libexec/git-core/git-stage"},{"path":"/usr/libexec/git-core/git-stash"},{"path":"/usr/libexec/git-core/git-status"},{"path":"/usr/libexec/git-core/git-stripspace"},{"path":"/usr/libexec/git-core/git-submodule"},{"path":"/usr/libexec/git-core/git-submodule--helper"},{"path":"/usr/libexec/git-core/git-switch"},{"path":"/usr/libexec/git-core/git-symbolic-ref"},{"path":"/usr/libexec/git-core/git-tag"},{"path":"/usr/libexec/git-core/git-unpack-file"},{"path":"/usr/libexec/git-core/git-unpack-objects"},{"path":"/usr/libexec/git-core/git-update-index"},{"path":"/usr/libexec/git-core/git-update-ref"},{"path":"/usr/libexec/git-core/git-update-server-info"},{"path":"/usr/libexec/git-core/git-upload-archive"},{"path":"/usr/libexec/git-core/git-upload-pack"},{"path":"/usr/libexec/git-core/git-var"},{"path":"/usr/libexec/git-core/git-verify-commit"},{"path":"/usr/libexec/git-core/git-verify-pack"},{"path":"/usr/libexec/git-core/git-verify-tag"},{"path":"/usr/libexec/git-core/git-web--browse"},{"path":"/usr/libexec/git-core/git-whatchanged"},{"path":"/usr/libexec/git-core/git-worktree"},{"path":"/usr/libexec/git-core/git-write-tree"},{"path":"/usr/libexec/git-core/mergetools"},{"path":"/usr/libexec/git-core/mergetools/araxis"},{"path":"/usr/libexec/git-core/mergetools/bc"},{"path":"/usr/libexec/git-core/mergetools/codecompare"},{"path":"/usr/libexec/git-core/mergetools/deltawalker"},{"path":"/usr/libexec/git-core/mergetools/diffmerge"},{"path":"/usr/libexec/git-core/mergetools/diffuse"},{"path":"/usr/libexec/git-core/mergetools/ecmerge"},{"path":"/usr/libexec/git-core/mergetools/emerge"},{"path":"/usr/libexec/git-core/mergetools/examdiff"},{"path":"/usr/libexec/git-core/mergetools/guiffy"},{"path":"/usr/libexec/git-core/mergetools/gvimdiff"},{"path":"/usr/libexec/git-core/mergetools/kdiff3"},{"path":"/usr/libexec/git-core/mergetools/kompare"},{"path":"/usr/libexec/git-core/mergetools/meld"},{"path":"/usr/libexec/git-core/mergetools/nvimdiff"},{"path":"/usr/libexec/git-core/mergetools/opendiff"},{"path":"/usr/libexec/git-core/mergetools/smerge"},{"path":"/usr/libexec/git-core/mergetools/tkdiff"},{"path":"/usr/libexec/git-core/mergetools/tortoisemerge"},{"path":"/usr/libexec/git-core/mergetools/vimdiff"},{"path":"/usr/libexec/git-core/mergetools/winmerge"},{"path":"/usr/libexec/git-core/mergetools/xxdiff"},{"path":"/usr/share"},{"path":"/usr/share/git-core"},{"path":"/usr/share/git-core/templates"},{"path":"/usr/share/git-core/templates/description"},{"path":"/usr/share/git-core/templates/branches"},{"path":"/usr/share/git-core/templates/hooks"},{"path":"/usr/share/git-core/templates/hooks/applypatch-msg.sample"},{"path":"/usr/share/git-core/templates/hooks/commit-msg.sample"},{"path":"/usr/share/git-core/templates/hooks/post-update.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-applypatch.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-commit.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-merge-commit.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-push.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-rebase.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-receive.sample"},{"path":"/usr/share/git-core/templates/hooks/prepare-commit-msg.sample"},{"path":"/usr/share/git-core/templates/hooks/push-to-checkout.sample"},{"path":"/usr/share/git-core/templates/hooks/update.sample"},{"path":"/usr/share/git-core/templates/info"},{"path":"/usr/share/git-core/templates/info/exclude"},{"path":"/usr/share/perl5"},{"path":"/var"},{"path":"/var/git"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"git"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2024-52006","versionConstraint":"< 2.40.4||>= 2.41.0, < 2.41.3||>= 2.42.0, < 2.42.4||>= 2.43.0, < 2.43.6||>= 2.44.0, < 2.44.3||>= 2.45.0, < 2.45.3||>= 2.46.0, < 2.46.3||>= 2.47.0, < 2.47.2||>= 2.48.0, < 2.48.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:git-scm:git:2.30.6:*:*:*:*:*:*:*"],"package":{"name":"git","version":"2.30.6-r0"},"namespace":"nvd:cpe"}},{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:git:git:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2024-52006","versionConstraint":"< 2.40.4||>= 2.41.0, < 2.41.3||>= 2.42.0, < 2.42.4||>= 2.43.0, < 2.43.6||>= 2.44.0, < 2.44.3||>= 2.45.0, < 2.45.3||>= 2.46.0, < 2.46.3||>= 2.47.0, < 2.47.2||>= 2.48.0, < 2.48.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:git:git:2.30.6:*:*:*:*:*:*:*"],"package":{"name":"git","version":"2.30.6-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2024-52006","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2.1},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-52006","cwe":"CWE-116","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2024-52006","cwe":"CWE-147","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2024-52006","cwe":"CWE-150","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2024-52006","date":"2026-10-08","epss":0.01057,"percentile":0.63427}],"risk":0.6500549999999999,"urls":["https://github.com/git-ecosystem/git-credential-manager/security/advisories/GHSA-86c2-4x57-wc8g","https://github.com/git/git/commit/b01b9b81d36759cdcd07305e78765199e1bc2060","https://github.com/git/git/security/advisories/GHSA-qm7j-c969-7j4q","https://github.com/git/git/security/advisories/GHSA-r5ph-xg7q-xfrp","https://lists.debian.org/debian-lts-announce/2025/01/msg00025.html"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-52006","description":"Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. Git defines a line-based protocol that is used to exchange information between Git and Git credential helpers. Some ecosystems (most notably, .NET and node.js) interpret single Carriage Return characters as newlines, which renders the protections against CVE-2020-5260 incomplete for credential helpers that treat Carriage Returns in this way. This issue has been addressed in commit `b01b9b8` which is included in release versions v2.48.1, v2.47.2, v2.46.3, v2.45.3, v2.44.3, v2.43.6, v2.42.4, v2.41.3, and v2.40.4. Users are advised to upgrade. Users unable to upgrade should avoid cloning from untrusted URLs, especially recursive clones."},"relatedVulnerabilities":[]},{"artifact":{"id":"6040784032e8795c","cpes":["cpe:2.3:a:curl:curl:7.79.1-r3:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:7.79.1-r3:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/busybox/curl@7.79.1-r3?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"7.79.1-r3","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-11856","versionConstraint":">= 7.10.6, < 8.21.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:haxx:curl:7.79.1:*:*:*:*:*:*:*"],"package":{"name":"curl","version":"7.79.1-r3"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-11856","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-11856","cwe":"CWE-294","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-11856","cwe":"CWE-294","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-11856","date":"2026-10-08","epss":0.00688,"percentile":0.51225}],"risk":0.6467200000000001,"urls":["https://curl.se/docs/CVE-2026-11856.html","https://curl.se/docs/CVE-2026-11856.json","https://hackerone.com/reports/3793260"],"severity":"Critical","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-11856","description":"Successfully using libcurl to do a transfer to a specific HTTP origin\n(`hostA`) with **Digest** authentication and then changing the origin to a\ndifferent one (`hostB`) for a second transfer, reusing the same handle, makes\nlibcurl wrongly pass on the `Authorization:` header field meant for `hostA`,\nto `hostB`."},"relatedVulnerabilities":[]},{"artifact":{"id":"d081de97c6f633df","cpes":["cpe:2.3:a:libcrypto1.1:libcrypto1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto1.1:libcrypto:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto:libcrypto1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto:libcrypto:1.1.1q-r0:*:*:*:*:*:*:*"],"name":"libcrypto1.1","purl":"pkg:apk/busybox/libcrypto1.1@1.1.1q-r0?arch=x86_64&distro=busybox-1.32.1&upstream=openssl","type":"apk","version":"1.1.1q-r0","language":"","licenses":["OpenSSL"],"metadata":{"Arch":"x86_64","files":[{"path":"/etc"},{"path":"/etc/ssl"},{"path":"/etc/ssl/ct_log_list.cnf"},{"path":"/etc/ssl/ct_log_list.cnf.dist"},{"path":"/etc/ssl/openssl.cnf"},{"path":"/etc/ssl/openssl.cnf.dist"},{"path":"/etc/ssl/certs"},{"path":"/etc/ssl/misc"},{"path":"/etc/ssl/misc/CA.pl"},{"path":"/etc/ssl/misc/tsget"},{"path":"/etc/ssl/misc/tsget.pl"},{"path":"/etc/ssl/private"},{"path":"/lib"},{"path":"/lib/libcrypto.so.1.1"},{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcrypto.so.1.1"},{"path":"/usr/lib/engines-1.1"},{"path":"/usr/lib/engines-1.1/afalg.so"},{"path":"/usr/lib/engines-1.1/capi.so"},{"path":"/usr/lib/engines-1.1/padlock.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2023-4807","versionConstraint":">= 1.1.1, < 1.1.1w||>= 3.0.0, < 3.0.11||>= 3.1.0, < 3.1.3 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:1.1.1q:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"1.1.1q-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2023-4807","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-4807","cwe":"CWE-440","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2023-4807","date":"2026-10-08","epss":0.00843,"percentile":0.56656}],"risk":0.644895,"urls":["https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=4bfac4471f53c4f74c8d81020beb938f92d84ca5","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=6754de4a121ec7f261b16723180df6592cbb4508","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=a632d534c73eeb3e3db8c7540d811194ef7c79ff","https://www.openssl.org/news/secadv/20230908.txt","https://security.netapp.com/advisory/ntap-20230921-0001/"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-4807","description":"Issue summary: The POLY1305 MAC (message authentication code) implementation\ncontains a bug that might corrupt the internal state of applications on the\nWindows 64 platform when running on newer X86_64 processors supporting the\nAVX512-IFMA instructions.\n\nImpact summary: If in an application that uses the OpenSSL library an attacker\ncan influence whether the POLY1305 MAC algorithm is used, the application\nstate might be corrupted with various application dependent consequences.\n\nThe POLY1305 MAC (message authentication code) implementation in OpenSSL does\nnot save the contents of non-volatile XMM registers on Windows 64 platform\nwhen calculating the MAC of data larger than 64 bytes. Before returning to\nthe caller all the XMM registers are set to zero rather than restoring their\nprevious content. The vulnerable code is used only on newer x86_64 processors\nsupporting the AVX512-IFMA instructions.\n\nThe consequences of this kind of internal application state corruption can\nbe various - from no consequences, if the calling application does not\ndepend on the contents of non-volatile XMM registers at all, to the worst\nconsequences, where the attacker could get complete control of the application\nprocess. However given the contents of the registers are just zeroized so\nthe attacker cannot put arbitrary values inside, the most likely consequence,\nif any, would be an incorrect result of some application dependent\ncalculations or a crash leading to a denial of service.\n\nThe POLY1305 MAC algorithm is most frequently used as part of the\nCHACHA20-POLY1305 AEAD (authenticated encryption with associated data)\nalgorithm. The most common usage of this AEAD cipher is with TLS protocol\nversions 1.2 and 1.3 and a malicious client can influence whether this AEAD\ncipher is used by the server. This implies that server applications using\nOpenSSL can be potentially impacted. However we are currently not aware of\nany concrete application that would be affected by this issue therefore we\nconsider this a Low severity security issue.\n\nAs a workaround the AVX512-IFMA instructions support can be disabled at\nruntime by setting the environment variable OPENSSL_ia32cap:\n\n   OPENSSL_ia32cap=:~0x200000\n\nThe FIPS provider is not affected by this issue."},"relatedVulnerabilities":[]},{"artifact":{"id":"74f4e71ff41d2d68","cpes":["cpe:2.3:a:libssl1.1:libssl1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl1.1:libssl:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl:1.1.1q-r0:*:*:*:*:*:*:*"],"name":"libssl1.1","purl":"pkg:apk/busybox/libssl1.1@1.1.1q-r0?arch=x86_64&distro=busybox-1.32.1&upstream=openssl","type":"apk","version":"1.1.1q-r0","language":"","licenses":["OpenSSL"],"metadata":{"Arch":"x86_64","files":[{"path":"/lib"},{"path":"/lib/libssl.so.1.1"},{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libssl.so.1.1"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2023-4807","versionConstraint":">= 1.1.1, < 1.1.1w||>= 3.0.0, < 3.0.11||>= 3.1.0, < 3.1.3 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:1.1.1q:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"1.1.1q-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2023-4807","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-4807","cwe":"CWE-440","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2023-4807","date":"2026-10-08","epss":0.00843,"percentile":0.56656}],"risk":0.644895,"urls":["https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=4bfac4471f53c4f74c8d81020beb938f92d84ca5","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=6754de4a121ec7f261b16723180df6592cbb4508","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=a632d534c73eeb3e3db8c7540d811194ef7c79ff","https://www.openssl.org/news/secadv/20230908.txt","https://security.netapp.com/advisory/ntap-20230921-0001/"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-4807","description":"Issue summary: The POLY1305 MAC (message authentication code) implementation\ncontains a bug that might corrupt the internal state of applications on the\nWindows 64 platform when running on newer X86_64 processors supporting the\nAVX512-IFMA instructions.\n\nImpact summary: If in an application that uses the OpenSSL library an attacker\ncan influence whether the POLY1305 MAC algorithm is used, the application\nstate might be corrupted with various application dependent consequences.\n\nThe POLY1305 MAC (message authentication code) implementation in OpenSSL does\nnot save the contents of non-volatile XMM registers on Windows 64 platform\nwhen calculating the MAC of data larger than 64 bytes. Before returning to\nthe caller all the XMM registers are set to zero rather than restoring their\nprevious content. The vulnerable code is used only on newer x86_64 processors\nsupporting the AVX512-IFMA instructions.\n\nThe consequences of this kind of internal application state corruption can\nbe various - from no consequences, if the calling application does not\ndepend on the contents of non-volatile XMM registers at all, to the worst\nconsequences, where the attacker could get complete control of the application\nprocess. However given the contents of the registers are just zeroized so\nthe attacker cannot put arbitrary values inside, the most likely consequence,\nif any, would be an incorrect result of some application dependent\ncalculations or a crash leading to a denial of service.\n\nThe POLY1305 MAC algorithm is most frequently used as part of the\nCHACHA20-POLY1305 AEAD (authenticated encryption with associated data)\nalgorithm. The most common usage of this AEAD cipher is with TLS protocol\nversions 1.2 and 1.3 and a malicious client can influence whether this AEAD\ncipher is used by the server. This implies that server applications using\nOpenSSL can be potentially impacted. However we are currently not aware of\nany concrete application that would be affected by this issue therefore we\nconsider this a Low severity security issue.\n\nAs a workaround the AVX512-IFMA instructions support can be disabled at\nruntime by setting the environment variable OPENSSL_ia32cap:\n\n   OPENSSL_ia32cap=:~0x200000\n\nThe FIPS provider is not affected by this issue."},"relatedVulnerabilities":[]},{"artifact":{"id":"14807b4f7067817d","cpes":["cpe:2.3:a:openssl:openssl:1.1.1q-r0:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:apk/busybox/openssl@1.1.1q-r0?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"1.1.1q-r0","language":"","licenses":["OpenSSL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/openssl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2023-4807","versionConstraint":">= 1.1.1, < 1.1.1w||>= 3.0.0, < 3.0.11||>= 3.1.0, < 3.1.3 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:1.1.1q:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"1.1.1q-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2023-4807","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-4807","cwe":"CWE-440","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2023-4807","date":"2026-10-08","epss":0.00843,"percentile":0.56656}],"risk":0.644895,"urls":["https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=4bfac4471f53c4f74c8d81020beb938f92d84ca5","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=6754de4a121ec7f261b16723180df6592cbb4508","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=a632d534c73eeb3e3db8c7540d811194ef7c79ff","https://www.openssl.org/news/secadv/20230908.txt","https://security.netapp.com/advisory/ntap-20230921-0001/"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-4807","description":"Issue summary: The POLY1305 MAC (message authentication code) implementation\ncontains a bug that might corrupt the internal state of applications on the\nWindows 64 platform when running on newer X86_64 processors supporting the\nAVX512-IFMA instructions.\n\nImpact summary: If in an application that uses the OpenSSL library an attacker\ncan influence whether the POLY1305 MAC algorithm is used, the application\nstate might be corrupted with various application dependent consequences.\n\nThe POLY1305 MAC (message authentication code) implementation in OpenSSL does\nnot save the contents of non-volatile XMM registers on Windows 64 platform\nwhen calculating the MAC of data larger than 64 bytes. Before returning to\nthe caller all the XMM registers are set to zero rather than restoring their\nprevious content. The vulnerable code is used only on newer x86_64 processors\nsupporting the AVX512-IFMA instructions.\n\nThe consequences of this kind of internal application state corruption can\nbe various - from no consequences, if the calling application does not\ndepend on the contents of non-volatile XMM registers at all, to the worst\nconsequences, where the attacker could get complete control of the application\nprocess. However given the contents of the registers are just zeroized so\nthe attacker cannot put arbitrary values inside, the most likely consequence,\nif any, would be an incorrect result of some application dependent\ncalculations or a crash leading to a denial of service.\n\nThe POLY1305 MAC algorithm is most frequently used as part of the\nCHACHA20-POLY1305 AEAD (authenticated encryption with associated data)\nalgorithm. The most common usage of this AEAD cipher is with TLS protocol\nversions 1.2 and 1.3 and a malicious client can influence whether this AEAD\ncipher is used by the server. This implies that server applications using\nOpenSSL can be potentially impacted. However we are currently not aware of\nany concrete application that would be affected by this issue therefore we\nconsider this a Low severity security issue.\n\nAs a workaround the AVX512-IFMA instructions support can be disabled at\nruntime by setting the environment variable OPENSSL_ia32cap:\n\n   OPENSSL_ia32cap=:~0x200000\n\nThe FIPS provider is not affected by this issue."},"relatedVulnerabilities":[]},{"artifact":{"id":"422a442f930ca27c","cpes":["cpe:2.3:a:nginx:nginx:1.18.0-r15:*:*:*:*:*:*:*"],"name":"nginx","purl":"pkg:apk/busybox/nginx@1.18.0-r15?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"1.18.0-r15","language":"","licenses":["BSD-2-Clause"],"metadata":{"Arch":"x86_64","files":[{"path":"/etc"},{"path":"/etc/logrotate.d"},{"path":"/etc/logrotate.d/nginx"},{"path":"/etc/nginx"},{"path":"/etc/nginx/fastcgi.conf"},{"path":"/etc/nginx/fastcgi_params"},{"path":"/etc/nginx/mime.types"},{"path":"/etc/nginx/nginx.conf"},{"path":"/etc/nginx/scgi_params"},{"path":"/etc/nginx/uwsgi_params"},{"path":"/etc/nginx/http.d"},{"path":"/etc/nginx/modules"},{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/nginx"},{"path":"/usr/lib/nginx/modules"},{"path":"/usr/sbin"},{"path":"/usr/sbin/nginx"},{"path":"/usr/share"},{"path":"/usr/share/nginx"},{"path":"/usr/share/nginx/http-default_server.conf"},{"path":"/var"},{"path":"/var/lib"},{"path":"/var/lib/nginx"},{"path":"/var/lib/nginx/logs"},{"path":"/var/lib/nginx/modules"},{"path":"/var/lib/nginx/run"},{"path":"/var/lib/nginx/html"},{"path":"/var/lib/nginx/html/50x.html"},{"path":"/var/lib/nginx/html/index.html"},{"path":"/var/lib/nginx/tmp"},{"path":"/var/log"},{"path":"/var/log/nginx"},{"path":"/var/www"},{"path":"/var/www/localhost"},{"path":"/var/www/localhost/htdocs"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"nginx"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:nginx:nginx:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-27784","versionConstraint":">= 1.1.19, < 1.28.3||>= 1.29.0, < 1.29.7 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:nginx:nginx:1.18.0:*:*:*:*:*:*:*"],"package":{"name":"nginx","version":"1.18.0-r15"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-27784","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"f5sirt@f5.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"f5sirt@f5.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-27784","cwe":"CWE-190","type":"Secondary","source":"f5sirt@f5.com"},{"cve":"CVE-2026-27784","cwe":"CWE-190","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-27784","date":"2026-10-08","epss":0.01031,"percentile":0.62652}],"risk":0.6353537499999999,"urls":["https://my.f5.com/manage/s/article/K000160364","https://access.redhat.com/errata/RHSA-2026:10065","https://access.redhat.com/errata/RHSA-2026:13634","https://access.redhat.com/errata/RHSA-2026:13680","https://access.redhat.com/errata/RHSA-2026:13839","https://access.redhat.com/errata/RHSA-2026:14836","https://access.redhat.com/errata/RHSA-2026:15942","https://access.redhat.com/errata/RHSA-2026:15943","https://access.redhat.com/errata/RHSA-2026:15945","https://access.redhat.com/errata/RHSA-2026:15966","https://access.redhat.com/errata/RHSA-2026:6906","https://access.redhat.com/errata/RHSA-2026:6907","https://access.redhat.com/errata/RHSA-2026:6923","https://access.redhat.com/errata/RHSA-2026:7002","https://access.redhat.com/errata/RHSA-2026:7343","https://access.redhat.com/errata/RHSA-2026:8346","https://access.redhat.com/security/cve/CVE-2026-27784","https://bugzilla.redhat.com/show_bug.cgi?id=2450785","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27784.json"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-27784","description":"The 32-bit implementation of NGINX Open Source has a vulnerability in the ngx_http_mp4_module module, which might allow an attacker to over-read or over-write NGINX worker memory resulting in its termination, using a specially crafted MP4 file. The issue only affects 32-bit NGINX Open Source if it is built with the ngx_http_mp4_module module and the mp4 directive is used in the configuration file. Additionally, the attack is possible only if an attacker can trigger the processing of a specially crafted MP4 file with the ngx_http_mp4_module module. \n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated."},"relatedVulnerabilities":[]},{"artifact":{"id":"a45c752c9b8878aa","cpes":["cpe:2.3:a:php7:php7:7.4.26-r0:*:*:*:*:*:*:*","cpe:2.3:a:php7:php:7.4.26-r0:*:*:*:*:*:*:*","cpe:2.3:a:php:php7:7.4.26-r0:*:*:*:*:*:*:*","cpe:2.3:a:php:php:7.4.26-r0:*:*:*:*:*:*:*"],"name":"php7","purl":"pkg:apk/busybox/php7@7.4.26-r0?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"7.4.26-r0","language":"","licenses":["BSD-3-Clause","LGPL-2.0-or-later","MIT","PHP-3.01","Zend-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/php"},{"path":"/usr/bin/php7"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"php7"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:php:php:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2024-2408","versionConstraint":"< 8.1.29||>= 8.2, < 8.2.20||>= 8.3, < 8.3.8 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:php:php:7.4.26:*:*:*:*:*:*:*"],"package":{"name":"php7","version":"7.4.26-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2024-2408","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-2408","cwe":"CWE-203","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-2408","cwe":"CWE-203","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-2408","date":"2026-10-08","epss":0.01158,"percentile":0.66114}],"risk":0.6311100000000001,"urls":["https://github.com/php/php-src/security/advisories/GHSA-hh26-4ppw-5864","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PKGTQUOA2NTZ3RXN22CSAUJPIRUYRB4B/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W45DBOH56NQDRTOM2DN2LNA2FZIMC3PK/","https://security.netapp.com/advisory/ntap-20250321-0008/"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-2408","description":"The openssl_private_decrypt function in PHP, when using PKCS1 padding (OPENSSL_PKCS1_PADDING, which is the default), is vulnerable to the Marvin Attack unless it is used with an OpenSSL version that includes the changes from this pull request:  https://github.com/openssl/openssl/pull/13817  (rsa_pkcs1_implicit_rejection). These changes are part of OpenSSL 3.2 and have also been backported to stable versions of various Linux distributions, as well as to the PHP builds provided for Windows since the previous release. All distributors and builders should ensure that this version is used to prevent PHP from being vulnerable.\n\nPHP Windows builds for the versions 8.1.29, 8.2.20 and 8.3.8 and above include OpenSSL patches that fix the vulnerability."},"relatedVulnerabilities":[]},{"artifact":{"id":"d081de97c6f633df","cpes":["cpe:2.3:a:libcrypto1.1:libcrypto1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto1.1:libcrypto:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto:libcrypto1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto:libcrypto:1.1.1q-r0:*:*:*:*:*:*:*"],"name":"libcrypto1.1","purl":"pkg:apk/busybox/libcrypto1.1@1.1.1q-r0?arch=x86_64&distro=busybox-1.32.1&upstream=openssl","type":"apk","version":"1.1.1q-r0","language":"","licenses":["OpenSSL"],"metadata":{"Arch":"x86_64","files":[{"path":"/etc"},{"path":"/etc/ssl"},{"path":"/etc/ssl/ct_log_list.cnf"},{"path":"/etc/ssl/ct_log_list.cnf.dist"},{"path":"/etc/ssl/openssl.cnf"},{"path":"/etc/ssl/openssl.cnf.dist"},{"path":"/etc/ssl/certs"},{"path":"/etc/ssl/misc"},{"path":"/etc/ssl/misc/CA.pl"},{"path":"/etc/ssl/misc/tsget"},{"path":"/etc/ssl/misc/tsget.pl"},{"path":"/etc/ssl/private"},{"path":"/lib"},{"path":"/lib/libcrypto.so.1.1"},{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcrypto.so.1.1"},{"path":"/usr/lib/engines-1.1"},{"path":"/usr/lib/engines-1.1/afalg.so"},{"path":"/usr/lib/engines-1.1/capi.so"},{"path":"/usr/lib/engines-1.1/padlock.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-42766","versionConstraint":">= 1.0.2, < 1.0.2zq||>= 1.1.1, < 1.1.1zh||>= 3.0.0, < 3.0.21||>= 3.4.0, < 3.4.6||>= 3.5.0, < 3.5.7||>= 3.6.0, < 3.6.3||>= 4.0.0, < 4.0.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:1.1.1q:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"1.1.1q-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-42766","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42766","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-42766","date":"2026-10-08","epss":0.0111,"percentile":0.64898}],"risk":0.6049500000000001,"urls":["https://github.com/openssl/openssl/commit/056d06c1918fafbb98c1c85a02e4c47cc4e199ce","https://github.com/openssl/openssl/commit/12bc26ffb3a2be728c9b86e1cae277de5b33dfa4","https://github.com/openssl/openssl/commit/3ff64913615d648cfbb6a6f1cf5529ae7ea829d7","https://github.com/openssl/openssl/commit/ab52d88cb5374876d59aee3c91f9e4ccce2b7ce4","https://github.com/openssl/openssl/commit/da26f368732b83e40e9d356fe61c3d3aaab6d2e8","https://openssl-library.org/news/secadv/20260609.txt"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42766","description":"Issue summary: A specially crafted password-encrypted CMS message\ncan trigger a NULL pointer dereference during CMS decryption.\n\nImpact summary: This NULL pointer dereference leads to an application crash\nand a Denial of Service.\n\nThe CMS PasswordRecipientInfo.keyDerivationAlgorithm field is defined as\nOPTIONAL in the ASN.1 specification and may therefore be absent in specially\ncrafted inputs. During the password-based CMS decryption the OpenSSL\nCMS implementation dereferences this field without first checking whether it\nwas present.\n\nAn attacker who supplies such a CMS message to an application performing\npassword-based CMS decryption can trigger an application crash, leading to\na Denial of Service.\n\nApplications that process password-encrypted CMS messages may be affected.\n\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary."},"relatedVulnerabilities":[]},{"artifact":{"id":"74f4e71ff41d2d68","cpes":["cpe:2.3:a:libssl1.1:libssl1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl1.1:libssl:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl:1.1.1q-r0:*:*:*:*:*:*:*"],"name":"libssl1.1","purl":"pkg:apk/busybox/libssl1.1@1.1.1q-r0?arch=x86_64&distro=busybox-1.32.1&upstream=openssl","type":"apk","version":"1.1.1q-r0","language":"","licenses":["OpenSSL"],"metadata":{"Arch":"x86_64","files":[{"path":"/lib"},{"path":"/lib/libssl.so.1.1"},{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libssl.so.1.1"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-42766","versionConstraint":">= 1.0.2, < 1.0.2zq||>= 1.1.1, < 1.1.1zh||>= 3.0.0, < 3.0.21||>= 3.4.0, < 3.4.6||>= 3.5.0, < 3.5.7||>= 3.6.0, < 3.6.3||>= 4.0.0, < 4.0.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:1.1.1q:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"1.1.1q-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-42766","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42766","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-42766","date":"2026-10-08","epss":0.0111,"percentile":0.64898}],"risk":0.6049500000000001,"urls":["https://github.com/openssl/openssl/commit/056d06c1918fafbb98c1c85a02e4c47cc4e199ce","https://github.com/openssl/openssl/commit/12bc26ffb3a2be728c9b86e1cae277de5b33dfa4","https://github.com/openssl/openssl/commit/3ff64913615d648cfbb6a6f1cf5529ae7ea829d7","https://github.com/openssl/openssl/commit/ab52d88cb5374876d59aee3c91f9e4ccce2b7ce4","https://github.com/openssl/openssl/commit/da26f368732b83e40e9d356fe61c3d3aaab6d2e8","https://openssl-library.org/news/secadv/20260609.txt"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42766","description":"Issue summary: A specially crafted password-encrypted CMS message\ncan trigger a NULL pointer dereference during CMS decryption.\n\nImpact summary: This NULL pointer dereference leads to an application crash\nand a Denial of Service.\n\nThe CMS PasswordRecipientInfo.keyDerivationAlgorithm field is defined as\nOPTIONAL in the ASN.1 specification and may therefore be absent in specially\ncrafted inputs. During the password-based CMS decryption the OpenSSL\nCMS implementation dereferences this field without first checking whether it\nwas present.\n\nAn attacker who supplies such a CMS message to an application performing\npassword-based CMS decryption can trigger an application crash, leading to\na Denial of Service.\n\nApplications that process password-encrypted CMS messages may be affected.\n\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary."},"relatedVulnerabilities":[]},{"artifact":{"id":"14807b4f7067817d","cpes":["cpe:2.3:a:openssl:openssl:1.1.1q-r0:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:apk/busybox/openssl@1.1.1q-r0?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"1.1.1q-r0","language":"","licenses":["OpenSSL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/openssl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-42766","versionConstraint":">= 1.0.2, < 1.0.2zq||>= 1.1.1, < 1.1.1zh||>= 3.0.0, < 3.0.21||>= 3.4.0, < 3.4.6||>= 3.5.0, < 3.5.7||>= 3.6.0, < 3.6.3||>= 4.0.0, < 4.0.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:1.1.1q:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"1.1.1q-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-42766","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42766","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-42766","date":"2026-10-08","epss":0.0111,"percentile":0.64898}],"risk":0.6049500000000001,"urls":["https://github.com/openssl/openssl/commit/056d06c1918fafbb98c1c85a02e4c47cc4e199ce","https://github.com/openssl/openssl/commit/12bc26ffb3a2be728c9b86e1cae277de5b33dfa4","https://github.com/openssl/openssl/commit/3ff64913615d648cfbb6a6f1cf5529ae7ea829d7","https://github.com/openssl/openssl/commit/ab52d88cb5374876d59aee3c91f9e4ccce2b7ce4","https://github.com/openssl/openssl/commit/da26f368732b83e40e9d356fe61c3d3aaab6d2e8","https://openssl-library.org/news/secadv/20260609.txt"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42766","description":"Issue summary: A specially crafted password-encrypted CMS message\ncan trigger a NULL pointer dereference during CMS decryption.\n\nImpact summary: This NULL pointer dereference leads to an application crash\nand a Denial of Service.\n\nThe CMS PasswordRecipientInfo.keyDerivationAlgorithm field is defined as\nOPTIONAL in the ASN.1 specification and may therefore be absent in specially\ncrafted inputs. During the password-based CMS decryption the OpenSSL\nCMS implementation dereferences this field without first checking whether it\nwas present.\n\nAn attacker who supplies such a CMS message to an application performing\npassword-based CMS decryption can trigger an application crash, leading to\na Denial of Service.\n\nApplications that process password-encrypted CMS messages may be affected.\n\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary."},"relatedVulnerabilities":[]},{"artifact":{"id":"d081de97c6f633df","cpes":["cpe:2.3:a:libcrypto1.1:libcrypto1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto1.1:libcrypto:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto:libcrypto1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto:libcrypto:1.1.1q-r0:*:*:*:*:*:*:*"],"name":"libcrypto1.1","purl":"pkg:apk/busybox/libcrypto1.1@1.1.1q-r0?arch=x86_64&distro=busybox-1.32.1&upstream=openssl","type":"apk","version":"1.1.1q-r0","language":"","licenses":["OpenSSL"],"metadata":{"Arch":"x86_64","files":[{"path":"/etc"},{"path":"/etc/ssl"},{"path":"/etc/ssl/ct_log_list.cnf"},{"path":"/etc/ssl/ct_log_list.cnf.dist"},{"path":"/etc/ssl/openssl.cnf"},{"path":"/etc/ssl/openssl.cnf.dist"},{"path":"/etc/ssl/certs"},{"path":"/etc/ssl/misc"},{"path":"/etc/ssl/misc/CA.pl"},{"path":"/etc/ssl/misc/tsget"},{"path":"/etc/ssl/misc/tsget.pl"},{"path":"/etc/ssl/private"},{"path":"/lib"},{"path":"/lib/libcrypto.so.1.1"},{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcrypto.so.1.1"},{"path":"/usr/lib/engines-1.1"},{"path":"/usr/lib/engines-1.1/afalg.so"},{"path":"/usr/lib/engines-1.1/capi.so"},{"path":"/usr/lib/engines-1.1/padlock.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-28390","versionConstraint":">= 1.0.2, < 1.0.2zp||>= 1.1.1, < 1.1.1zg||>= 3.0.0, < 3.0.20||>= 3.3.0, < 3.3.7||>= 3.4.0, < 3.4.5||>= 3.5.0, < 3.5.6||>= 3.6.0, < 3.6.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:1.1.1q:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"1.1.1q-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-28390","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-28390","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-28390","date":"2026-10-08","epss":0.00805,"percentile":0.55424}],"risk":0.6037499999999999,"urls":["https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc","https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6","https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4","https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788","https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75","https://openssl-library.org/news/secadv/20260407.txt","https://cert-portal.siemens.com/productcert/html/ssa-032379.html","https://cert-portal.siemens.com/productcert/html/ssa-265688.html"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-28390","description":"Issue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyTransportRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyTransportRecipientInfo with\nRSA-OAEP encryption is processed, the optional parameters field of\nRSA-OAEP SourceFunc algorithm identifier is examined without checking\nfor its presence. This results in a NULL pointer dereference if the field\nis missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary."},"relatedVulnerabilities":[]},{"artifact":{"id":"74f4e71ff41d2d68","cpes":["cpe:2.3:a:libssl1.1:libssl1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl1.1:libssl:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl:1.1.1q-r0:*:*:*:*:*:*:*"],"name":"libssl1.1","purl":"pkg:apk/busybox/libssl1.1@1.1.1q-r0?arch=x86_64&distro=busybox-1.32.1&upstream=openssl","type":"apk","version":"1.1.1q-r0","language":"","licenses":["OpenSSL"],"metadata":{"Arch":"x86_64","files":[{"path":"/lib"},{"path":"/lib/libssl.so.1.1"},{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libssl.so.1.1"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-28390","versionConstraint":">= 1.0.2, < 1.0.2zp||>= 1.1.1, < 1.1.1zg||>= 3.0.0, < 3.0.20||>= 3.3.0, < 3.3.7||>= 3.4.0, < 3.4.5||>= 3.5.0, < 3.5.6||>= 3.6.0, < 3.6.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:1.1.1q:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"1.1.1q-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-28390","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-28390","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-28390","date":"2026-10-08","epss":0.00805,"percentile":0.55424}],"risk":0.6037499999999999,"urls":["https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc","https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6","https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4","https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788","https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75","https://openssl-library.org/news/secadv/20260407.txt","https://cert-portal.siemens.com/productcert/html/ssa-032379.html","https://cert-portal.siemens.com/productcert/html/ssa-265688.html"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-28390","description":"Issue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyTransportRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyTransportRecipientInfo with\nRSA-OAEP encryption is processed, the optional parameters field of\nRSA-OAEP SourceFunc algorithm identifier is examined without checking\nfor its presence. This results in a NULL pointer dereference if the field\nis missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary."},"relatedVulnerabilities":[]},{"artifact":{"id":"14807b4f7067817d","cpes":["cpe:2.3:a:openssl:openssl:1.1.1q-r0:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:apk/busybox/openssl@1.1.1q-r0?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"1.1.1q-r0","language":"","licenses":["OpenSSL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/openssl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-28390","versionConstraint":">= 1.0.2, < 1.0.2zp||>= 1.1.1, < 1.1.1zg||>= 3.0.0, < 3.0.20||>= 3.3.0, < 3.3.7||>= 3.4.0, < 3.4.5||>= 3.5.0, < 3.5.6||>= 3.6.0, < 3.6.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:1.1.1q:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"1.1.1q-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-28390","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-28390","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-28390","date":"2026-10-08","epss":0.00805,"percentile":0.55424}],"risk":0.6037499999999999,"urls":["https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc","https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6","https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4","https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788","https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75","https://openssl-library.org/news/secadv/20260407.txt","https://cert-portal.siemens.com/productcert/html/ssa-032379.html","https://cert-portal.siemens.com/productcert/html/ssa-265688.html"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-28390","description":"Issue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyTransportRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyTransportRecipientInfo with\nRSA-OAEP encryption is processed, the optional parameters field of\nRSA-OAEP SourceFunc algorithm identifier is examined without checking\nfor its presence. This results in a NULL pointer dereference if the field\nis missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary."},"relatedVulnerabilities":[]},{"artifact":{"id":"6040784032e8795c","cpes":["cpe:2.3:a:curl:curl:7.79.1-r3:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:7.79.1-r3:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/busybox/curl@7.79.1-r3?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"7.79.1-r3","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-8924","versionConstraint":">= 7.46.0, < 8.21.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:haxx:curl:7.79.1:*:*:*:*:*:*:*"],"package":{"name":"curl","version":"7.79.1-r3"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-8924","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8924","cwe":"CWE-201","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"}],"epss":[{"cve":"CVE-2026-8924","date":"2026-10-08","epss":0.00661,"percentile":0.50067}],"risk":0.5982050000000001,"urls":["https://curl.se/docs/CVE-2026-8924.html","https://curl.se/docs/CVE-2026-8924.json","https://hackerone.com/reports/3733905"],"severity":"Critical","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8924","description":"A flaw in curl’s cookie parsing logic allows a malicious HTTP server to set\n\"super cookies\" that bypass the Public Suffix List check. This enables an\nattacker-controlled origin to inject cookies that curl subsequently scopes and\ntransmits to unrelated third-party domains."},"relatedVulnerabilities":[]},{"artifact":{"id":"d081de97c6f633df","cpes":["cpe:2.3:a:libcrypto1.1:libcrypto1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto1.1:libcrypto:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto:libcrypto1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto:libcrypto:1.1.1q-r0:*:*:*:*:*:*:*"],"name":"libcrypto1.1","purl":"pkg:apk/busybox/libcrypto1.1@1.1.1q-r0?arch=x86_64&distro=busybox-1.32.1&upstream=openssl","type":"apk","version":"1.1.1q-r0","language":"","licenses":["OpenSSL"],"metadata":{"Arch":"x86_64","files":[{"path":"/etc"},{"path":"/etc/ssl"},{"path":"/etc/ssl/ct_log_list.cnf"},{"path":"/etc/ssl/ct_log_list.cnf.dist"},{"path":"/etc/ssl/openssl.cnf"},{"path":"/etc/ssl/openssl.cnf.dist"},{"path":"/etc/ssl/certs"},{"path":"/etc/ssl/misc"},{"path":"/etc/ssl/misc/CA.pl"},{"path":"/etc/ssl/misc/tsget"},{"path":"/etc/ssl/misc/tsget.pl"},{"path":"/etc/ssl/private"},{"path":"/lib"},{"path":"/lib/libcrypto.so.1.1"},{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcrypto.so.1.1"},{"path":"/usr/lib/engines-1.1"},{"path":"/usr/lib/engines-1.1/afalg.so"},{"path":"/usr/lib/engines-1.1/capi.so"},{"path":"/usr/lib/engines-1.1/padlock.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-7383","versionConstraint":">= 1.0.2, < 1.0.2zq||>= 1.1.1, < 1.1.1zh||>= 3.0.0, < 3.0.21||>= 3.4.0, < 3.4.6||>= 3.5.0, < 3.5.7||>= 3.6.0, < 3.6.3||>= 4.0.0, < 4.0.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:1.1.1q:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"1.1.1q-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-7383","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-7383","cwe":"CWE-787","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-7383","date":"2026-10-08","epss":0.00701,"percentile":0.51746}],"risk":0.54678,"urls":["https://github.com/openssl/openssl/commit/4f8d2bddaa2c8e06f9c33390ee1717059a6e4be6","https://github.com/openssl/openssl/commit/80c15faaf78042bbb8654a0e234c50c381732f74","https://github.com/openssl/openssl/commit/bd17511070fb39a67bfa19682affb765e706a974","https://github.com/openssl/openssl/commit/c332adaced43bcbb85f97410597e951c11ec3083","https://github.com/openssl/openssl/commit/d32350ae8ef7426718f5aa9e383d4b51398ee255","https://openssl-library.org/news/secadv/20260609.txt"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-7383","description":"Issue summary: A signed integer overflow when sizing the destination\nbuffer for Unicode output in ASN1_mbstring_ncopy() can lead to a heap\nbuffer overflow.\n\nImpact summary: A heap buffer overflow may lead to a crash or possibly\nattacker controlled code execution or other undefined behaviour.\n\nIn ASN1_mbstring_copy() and ASN1_mbstring_ncopy() the destination\nsize for Unicode output is computed in a signed int: by left shift\nof the input character count for BMPSTRING (UTF-16) and\nUNIVERSALSTRING (UTF-32), and by summing per-character byte counts\nfor UTF8STRING. The calculation overflows when the input reaches\naround 2^30 characters. In the worst case (UNIVERSALSTRING at 2^30\ncharacters) the size wraps to zero, OPENSSL_malloc(1) is called, and\nthe subsequent character copy writes several gigabytes past the\none-byte allocation.\n\nX.509 certificate processing routes through ASN1_STRING_set_by_NID(),\nwhose DIRSTRING_TYPE mask excludes UNIVERSALSTRING and whose per-NID\nsize limits cap the input length; no network protocol or\ncertificate-handling path in OpenSSL exercises the overflow.\nTriggering the bug requires an application that calls\nASN1_mbstring_copy() or ASN1_mbstring_ncopy() directly, or registers\na custom string type via ASN1_STRING_TABLE_add(), with\nattacker-controlled input on the order of half a gigabyte or more.\nFor these reasons this issue was assigned Low severity.\n\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4 and 3.0 are not affected by\nthis issue, as the affected code is outside the OpenSSL FIPS module\nboundary."},"relatedVulnerabilities":[]},{"artifact":{"id":"74f4e71ff41d2d68","cpes":["cpe:2.3:a:libssl1.1:libssl1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl1.1:libssl:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl:1.1.1q-r0:*:*:*:*:*:*:*"],"name":"libssl1.1","purl":"pkg:apk/busybox/libssl1.1@1.1.1q-r0?arch=x86_64&distro=busybox-1.32.1&upstream=openssl","type":"apk","version":"1.1.1q-r0","language":"","licenses":["OpenSSL"],"metadata":{"Arch":"x86_64","files":[{"path":"/lib"},{"path":"/lib/libssl.so.1.1"},{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libssl.so.1.1"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-7383","versionConstraint":">= 1.0.2, < 1.0.2zq||>= 1.1.1, < 1.1.1zh||>= 3.0.0, < 3.0.21||>= 3.4.0, < 3.4.6||>= 3.5.0, < 3.5.7||>= 3.6.0, < 3.6.3||>= 4.0.0, < 4.0.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:1.1.1q:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"1.1.1q-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-7383","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-7383","cwe":"CWE-787","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-7383","date":"2026-10-08","epss":0.00701,"percentile":0.51746}],"risk":0.54678,"urls":["https://github.com/openssl/openssl/commit/4f8d2bddaa2c8e06f9c33390ee1717059a6e4be6","https://github.com/openssl/openssl/commit/80c15faaf78042bbb8654a0e234c50c381732f74","https://github.com/openssl/openssl/commit/bd17511070fb39a67bfa19682affb765e706a974","https://github.com/openssl/openssl/commit/c332adaced43bcbb85f97410597e951c11ec3083","https://github.com/openssl/openssl/commit/d32350ae8ef7426718f5aa9e383d4b51398ee255","https://openssl-library.org/news/secadv/20260609.txt"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-7383","description":"Issue summary: A signed integer overflow when sizing the destination\nbuffer for Unicode output in ASN1_mbstring_ncopy() can lead to a heap\nbuffer overflow.\n\nImpact summary: A heap buffer overflow may lead to a crash or possibly\nattacker controlled code execution or other undefined behaviour.\n\nIn ASN1_mbstring_copy() and ASN1_mbstring_ncopy() the destination\nsize for Unicode output is computed in a signed int: by left shift\nof the input character count for BMPSTRING (UTF-16) and\nUNIVERSALSTRING (UTF-32), and by summing per-character byte counts\nfor UTF8STRING. The calculation overflows when the input reaches\naround 2^30 characters. In the worst case (UNIVERSALSTRING at 2^30\ncharacters) the size wraps to zero, OPENSSL_malloc(1) is called, and\nthe subsequent character copy writes several gigabytes past the\none-byte allocation.\n\nX.509 certificate processing routes through ASN1_STRING_set_by_NID(),\nwhose DIRSTRING_TYPE mask excludes UNIVERSALSTRING and whose per-NID\nsize limits cap the input length; no network protocol or\ncertificate-handling path in OpenSSL exercises the overflow.\nTriggering the bug requires an application that calls\nASN1_mbstring_copy() or ASN1_mbstring_ncopy() directly, or registers\na custom string type via ASN1_STRING_TABLE_add(), with\nattacker-controlled input on the order of half a gigabyte or more.\nFor these reasons this issue was assigned Low severity.\n\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4 and 3.0 are not affected by\nthis issue, as the affected code is outside the OpenSSL FIPS module\nboundary."},"relatedVulnerabilities":[]},{"artifact":{"id":"14807b4f7067817d","cpes":["cpe:2.3:a:openssl:openssl:1.1.1q-r0:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:apk/busybox/openssl@1.1.1q-r0?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"1.1.1q-r0","language":"","licenses":["OpenSSL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/openssl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-7383","versionConstraint":">= 1.0.2, < 1.0.2zq||>= 1.1.1, < 1.1.1zh||>= 3.0.0, < 3.0.21||>= 3.4.0, < 3.4.6||>= 3.5.0, < 3.5.7||>= 3.6.0, < 3.6.3||>= 4.0.0, < 4.0.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:1.1.1q:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"1.1.1q-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-7383","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-7383","cwe":"CWE-787","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-7383","date":"2026-10-08","epss":0.00701,"percentile":0.51746}],"risk":0.54678,"urls":["https://github.com/openssl/openssl/commit/4f8d2bddaa2c8e06f9c33390ee1717059a6e4be6","https://github.com/openssl/openssl/commit/80c15faaf78042bbb8654a0e234c50c381732f74","https://github.com/openssl/openssl/commit/bd17511070fb39a67bfa19682affb765e706a974","https://github.com/openssl/openssl/commit/c332adaced43bcbb85f97410597e951c11ec3083","https://github.com/openssl/openssl/commit/d32350ae8ef7426718f5aa9e383d4b51398ee255","https://openssl-library.org/news/secadv/20260609.txt"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-7383","description":"Issue summary: A signed integer overflow when sizing the destination\nbuffer for Unicode output in ASN1_mbstring_ncopy() can lead to a heap\nbuffer overflow.\n\nImpact summary: A heap buffer overflow may lead to a crash or possibly\nattacker controlled code execution or other undefined behaviour.\n\nIn ASN1_mbstring_copy() and ASN1_mbstring_ncopy() the destination\nsize for Unicode output is computed in a signed int: by left shift\nof the input character count for BMPSTRING (UTF-16) and\nUNIVERSALSTRING (UTF-32), and by summing per-character byte counts\nfor UTF8STRING. The calculation overflows when the input reaches\naround 2^30 characters. In the worst case (UNIVERSALSTRING at 2^30\ncharacters) the size wraps to zero, OPENSSL_malloc(1) is called, and\nthe subsequent character copy writes several gigabytes past the\none-byte allocation.\n\nX.509 certificate processing routes through ASN1_STRING_set_by_NID(),\nwhose DIRSTRING_TYPE mask excludes UNIVERSALSTRING and whose per-NID\nsize limits cap the input length; no network protocol or\ncertificate-handling path in OpenSSL exercises the overflow.\nTriggering the bug requires an application that calls\nASN1_mbstring_copy() or ASN1_mbstring_ncopy() directly, or registers\na custom string type via ASN1_STRING_TABLE_add(), with\nattacker-controlled input on the order of half a gigabyte or more.\nFor these reasons this issue was assigned Low severity.\n\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4 and 3.0 are not affected by\nthis issue, as the affected code is outside the OpenSSL FIPS module\nboundary."},"relatedVulnerabilities":[]},{"artifact":{"id":"a45c752c9b8878aa","cpes":["cpe:2.3:a:php7:php7:7.4.26-r0:*:*:*:*:*:*:*","cpe:2.3:a:php7:php:7.4.26-r0:*:*:*:*:*:*:*","cpe:2.3:a:php:php7:7.4.26-r0:*:*:*:*:*:*:*","cpe:2.3:a:php:php:7.4.26-r0:*:*:*:*:*:*:*"],"name":"php7","purl":"pkg:apk/busybox/php7@7.4.26-r0?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"7.4.26-r0","language":"","licenses":["BSD-3-Clause","LGPL-2.0-or-later","MIT","PHP-3.01","Zend-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/php"},{"path":"/usr/bin/php7"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"php7"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:php:php:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-14180","versionConstraint":"< 8.1.34||>= 8.2.0, < 8.2.30||>= 8.3.0, < 8.3.29||>= 8.4.0, < 8.4.16||>= 8.5.0, < 8.5.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:php:php:7.4.26:*:*:*:*:*:*:*"],"package":{"name":"php7","version":"7.4.26-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2025-14180","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security@php.net","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-14180","cwe":"CWE-476","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2025-14180","date":"2026-10-08","epss":0.00697,"percentile":0.51579}],"risk":0.5349474999999999,"urls":["https://github.com/php/php-src/security/advisories/GHSA-8xr5-qppj-gvwj"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-14180","description":"In PHP versions 8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1 when using the PDO PostgreSQL driver with PDO::ATTR_EMULATE_PREPARES enabled, an invalid character sequence (such as \\x99) in a prepared statement parameter may cause the quoting function PQescapeStringConn to return NULL, leading to a null pointer dereference in pdo_parse_params() function. This may lead to crashes (segmentation fault) and affect the availability of the target server."},"relatedVulnerabilities":[]},{"artifact":{"id":"a45c752c9b8878aa","cpes":["cpe:2.3:a:php7:php7:7.4.26-r0:*:*:*:*:*:*:*","cpe:2.3:a:php7:php:7.4.26-r0:*:*:*:*:*:*:*","cpe:2.3:a:php:php7:7.4.26-r0:*:*:*:*:*:*:*","cpe:2.3:a:php:php:7.4.26-r0:*:*:*:*:*:*:*"],"name":"php7","purl":"pkg:apk/busybox/php7@7.4.26-r0?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"7.4.26-r0","language":"","licenses":["BSD-3-Clause","LGPL-2.0-or-later","MIT","PHP-3.01","Zend-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/php"},{"path":"/usr/bin/php7"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"php7"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:php:php:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-6491","versionConstraint":"< 8.1.33||>= 8.2, < 8.2.29||>= 8.3, < 8.3.23||>= 8.4, < 8.4.10 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:php:php:7.4.26:*:*:*:*:*:*:*"],"package":{"name":"php7","version":"7.4.26-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2025-6491","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-6491","cwe":"CWE-476","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2025-6491","date":"2026-10-08","epss":0.00978,"percentile":0.61037}],"risk":0.5330100000000001,"urls":["https://github.com/php/php-src/security/advisories/GHSA-453j-q27h-5p8x","http://www.openwall.com/lists/oss-security/2025/07/11/4","https://lists.debian.org/debian-lts-announce/2025/07/msg00017.html"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-6491","description":"In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8.4.* before 8.4.10 when parsing XML data in SOAP extensions, overly large (>2Gb) XML namespace prefix may lead to null pointer dereference. This may lead to crashes and affect the availability of the target server."},"relatedVulnerabilities":[]},{"artifact":{"id":"6040784032e8795c","cpes":["cpe:2.3:a:curl:curl:7.79.1-r3:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:7.79.1-r3:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/busybox/curl@7.79.1-r3?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"7.79.1-r3","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-18924","versionConstraint":">= 7.44.0, < 8.14.2||>= 8.15.0, < 8.16.1||>= 8.17.0, < 8.20.1||>= 8.21.0, < 8.22.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:haxx:curl:7.79.1:*:*:*:*:*:*:*"],"package":{"name":"curl","version":"7.79.1-r3"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-18924","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-18924","cwe":"CWE-416","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-18924","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-18924","date":"2026-10-08","epss":0.00584,"percentile":0.46233}],"risk":0.52852,"urls":["https://curl.se/docs/CVE-2026-18924.html","https://curl.se/docs/CVE-2026-18924.json","https://hackerone.com/reports/3916059"],"severity":"Critical","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-18924","description":"A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent\nhandle is set to share connections with other handles, can lead to\nuse-after-free in the cleanup process."},"relatedVulnerabilities":[]},{"artifact":{"id":"6040784032e8795c","cpes":["cpe:2.3:a:curl:curl:7.79.1-r3:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:7.79.1-r3:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/busybox/curl@7.79.1-r3?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"7.79.1-r3","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2023-23915","versionConstraint":">= 7.77.0, < 7.88.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:haxx:curl:7.79.1:*:*:*:*:*:*:*"],"package":{"name":"curl","version":"7.79.1-r3"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2023-23915","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-23915","cwe":"CWE-319","type":"Secondary","source":"support@hackerone.com"},{"cve":"CVE-2023-23915","cwe":"CWE-319","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-23915","date":"2026-10-08","epss":0.00861,"percentile":0.57277}],"risk":0.49507499999999993,"urls":["https://hackerone.com/reports/1826048","https://security.gentoo.org/glsa/202310-12","https://security.netapp.com/advisory/ntap-20230309-0006/"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-23915","description":"A cleartext transmission of sensitive information vulnerability exists in curl <v7.88.0 that could cause HSTS functionality to behave incorrectly when multiple URLs are requested in parallel. Using its HSTS support, curl can be instructed to use HTTPS instead of using an insecure clear-text HTTP step even when HTTP is provided in the URL. This HSTS mechanism would however surprisingly fail when multiple transfers are done in parallel as the HSTS cache file gets overwritten by the most recentlycompleted transfer. A later HTTP-only transfer to the earlier host name would then *not* get upgraded properly to HSTS."},"relatedVulnerabilities":[]},{"artifact":{"id":"6040784032e8795c","cpes":["cpe:2.3:a:curl:curl:7.79.1-r3:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:7.79.1-r3:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/busybox/curl@7.79.1-r3?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"7.79.1-r3","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-5773","versionConstraint":">= 7.40.0, < 8.20.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:haxx:curl:7.79.1:*:*:*:*:*:*:*"],"package":{"name":"curl","version":"7.79.1-r3"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-5773","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-5773","cwe":"CWE-488","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-5773","cwe":"CWE-918","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-5773","date":"2026-10-08","epss":0.00657,"percentile":0.49896}],"risk":0.49275,"urls":["https://curl.se/docs/CVE-2026-5773.html","https://curl.se/docs/CVE-2026-5773.json","https://hackerone.com/reports/3650689","http://www.openwall.com/lists/oss-security/2026/04/29/9"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-5773","description":"libcurl might in some circumstances reuse the wrong connection for SMB(S)\ntransfers.\n\nlibcurl features a pool of recent connections so that subsequent requests can\nreuse an existing connection to avoid overhead.\n\nWhen reusing a connection a range of criteria must be met. Due to a logical\nerror in the code, a network transfer operation that was requested by an\napplication could wrongfully reuse an existing SMB connection to the same\nserver that was using a different \"share\" than the new subsequent transfer\nshould.\n\nThis could in unlucky situations lead to the download of the wrong file or the\nupload of a file to the wrong place. When this happens, the same credentials\nare used and the server name is the same."},"relatedVulnerabilities":[]},{"artifact":{"id":"d081de97c6f633df","cpes":["cpe:2.3:a:libcrypto1.1:libcrypto1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto1.1:libcrypto:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto:libcrypto1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto:libcrypto:1.1.1q-r0:*:*:*:*:*:*:*"],"name":"libcrypto1.1","purl":"pkg:apk/busybox/libcrypto1.1@1.1.1q-r0?arch=x86_64&distro=busybox-1.32.1&upstream=openssl","type":"apk","version":"1.1.1q-r0","language":"","licenses":["OpenSSL"],"metadata":{"Arch":"x86_64","files":[{"path":"/etc"},{"path":"/etc/ssl"},{"path":"/etc/ssl/ct_log_list.cnf"},{"path":"/etc/ssl/ct_log_list.cnf.dist"},{"path":"/etc/ssl/openssl.cnf"},{"path":"/etc/ssl/openssl.cnf.dist"},{"path":"/etc/ssl/certs"},{"path":"/etc/ssl/misc"},{"path":"/etc/ssl/misc/CA.pl"},{"path":"/etc/ssl/misc/tsget"},{"path":"/etc/ssl/misc/tsget.pl"},{"path":"/etc/ssl/private"},{"path":"/lib"},{"path":"/lib/libcrypto.so.1.1"},{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcrypto.so.1.1"},{"path":"/usr/lib/engines-1.1"},{"path":"/usr/lib/engines-1.1/afalg.so"},{"path":"/usr/lib/engines-1.1/capi.so"},{"path":"/usr/lib/engines-1.1/padlock.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-54874","versionConstraint":">= 1.0.2, < 1.0.2zr||>= 1.1.1, < 1.1.1zi||>= 3.0.0, < 3.0.22||>= 3.4.0, < 3.4.7||>= 3.5.0, < 3.5.8||>= 3.6.0, < 3.6.4||>= 4.0.0, < 4.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:1.1.1q:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"1.1.1q-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-54874","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54874","cwe":"CWE-405","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-54874","date":"2026-10-08","epss":0.00622,"percentile":0.48184}],"risk":0.46649999999999997,"urls":["https://github.com/openssl/openssl/commit/4808b5d64176451f3d93d87d0ac9c81a9b13fb23","https://github.com/openssl/openssl/commit/7110cb2f75806d0bf809eb2f90790d477900be40","https://github.com/openssl/openssl/commit/a0c8ec557d9cac078f032d76cdf684fe743eb382","https://github.com/openssl/openssl/commit/cc0c6710917cd5eec001b297355d2ba723505107","https://github.com/openssl/openssl/commit/f52ffc11b90737ac89083909618dc2e1f42c561c","https://openssl-library.org/news/secadv/20260825.txt"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54874","description":"Issue summary: Receiving a DTLS record for a future epoch while a handshake\nis in progress causes OpenSSL to buffer far more memory than the record\nitself requires.\n\nImpact summary: A peer can use a small amount of network traffic to make an\nOpenSSL DTLS endpoint retain a disproportionately large amount of memory,\nwhich may lead to a Denial of Service.\n\nCWE: CWE-405: Asymmetric Resource Consumption (Amplification)\n\nDescription: While a DTLS handshake is in progress, a peer may legitimately\nhave already moved on to the next epoch (for example, having sent its\nChangeCipherSpec and Finished messages) before the local endpoint has\nprocessed the same transition, typically because of reordering on the\nunderlying UDP transport. OpenSSL buffers such early records so that they\ncan be processed once the local endpoint catches up.\n\nBuffering a record currently retains the entire read buffer it arrived in,\nwhich is sized to hold the largest possible DTLS record (around 16\nkilobytes), rather than just the bytes that make up the record itself. Up\nto 100 such records may be buffered per connection. As a result, a peer\nthat sends a stream of small forged records claiming to belong to the next\nepoch can cause an OpenSSL DTLS endpoint to retain around 1.7 megabytes of\nmemory, despite sending only a small fraction of that amount of data over\nthe network.\n\nAn attacker therefore gains a memory amplification factor of around 1200,\nand can multiply the effect across as many associations as it is able to\nopen, making this a remote memory exhaustion Denial of Service risk for\nDTLS servers. Since the memory retained per connection remains bounded,\nand any limit an application already places on the number of concurrent\nassociations also bounds the total exposure, this issue has been assessed\nas Low severity.\n\nFIPS impact: no\n\nNo FIPS modules are affected by this issue as the affected code is outside\nthe OpenSSL FIPS module boundary.\n\nOpenSSL 4.0, 3.6, 3.5, 3.4, 3.0, 1.1.1 and 1.0.2 are vulnerable to this\nissue.\n\nOpenSSL 4.0 users should upgrade to OpenSSL 4.0.2.\nOpenSSL 3.6 users should upgrade to OpenSSL 3.6.4.\nOpenSSL 3.5 users should upgrade to OpenSSL 3.5.8.\nOpenSSL 3.4 users should upgrade to OpenSSL 3.4.7.\nOpenSSL 3.0 users should upgrade to OpenSSL 3.0.22.\n\nPremium support customers only:\nOpenSSL 1.1.1 users should upgrade to OpenSSL 1.1.1zi\nOpenSSL 1.0.2 users should upgrade to OpenSSL 1.0.2zr\n\nThis issue was reported on 18 May 2026 by Amazon Web Services.\nThe fix has been developed by Matt Caswell.\n\n-- cut (non-publishing metadata for internal use) --\nReported by: Amazon Web Services\nFixed by: Matt Caswell"},"relatedVulnerabilities":[]},{"artifact":{"id":"74f4e71ff41d2d68","cpes":["cpe:2.3:a:libssl1.1:libssl1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl1.1:libssl:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl:1.1.1q-r0:*:*:*:*:*:*:*"],"name":"libssl1.1","purl":"pkg:apk/busybox/libssl1.1@1.1.1q-r0?arch=x86_64&distro=busybox-1.32.1&upstream=openssl","type":"apk","version":"1.1.1q-r0","language":"","licenses":["OpenSSL"],"metadata":{"Arch":"x86_64","files":[{"path":"/lib"},{"path":"/lib/libssl.so.1.1"},{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libssl.so.1.1"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-54874","versionConstraint":">= 1.0.2, < 1.0.2zr||>= 1.1.1, < 1.1.1zi||>= 3.0.0, < 3.0.22||>= 3.4.0, < 3.4.7||>= 3.5.0, < 3.5.8||>= 3.6.0, < 3.6.4||>= 4.0.0, < 4.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:1.1.1q:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"1.1.1q-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-54874","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54874","cwe":"CWE-405","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-54874","date":"2026-10-08","epss":0.00622,"percentile":0.48184}],"risk":0.46649999999999997,"urls":["https://github.com/openssl/openssl/commit/4808b5d64176451f3d93d87d0ac9c81a9b13fb23","https://github.com/openssl/openssl/commit/7110cb2f75806d0bf809eb2f90790d477900be40","https://github.com/openssl/openssl/commit/a0c8ec557d9cac078f032d76cdf684fe743eb382","https://github.com/openssl/openssl/commit/cc0c6710917cd5eec001b297355d2ba723505107","https://github.com/openssl/openssl/commit/f52ffc11b90737ac89083909618dc2e1f42c561c","https://openssl-library.org/news/secadv/20260825.txt"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54874","description":"Issue summary: Receiving a DTLS record for a future epoch while a handshake\nis in progress causes OpenSSL to buffer far more memory than the record\nitself requires.\n\nImpact summary: A peer can use a small amount of network traffic to make an\nOpenSSL DTLS endpoint retain a disproportionately large amount of memory,\nwhich may lead to a Denial of Service.\n\nCWE: CWE-405: Asymmetric Resource Consumption (Amplification)\n\nDescription: While a DTLS handshake is in progress, a peer may legitimately\nhave already moved on to the next epoch (for example, having sent its\nChangeCipherSpec and Finished messages) before the local endpoint has\nprocessed the same transition, typically because of reordering on the\nunderlying UDP transport. OpenSSL buffers such early records so that they\ncan be processed once the local endpoint catches up.\n\nBuffering a record currently retains the entire read buffer it arrived in,\nwhich is sized to hold the largest possible DTLS record (around 16\nkilobytes), rather than just the bytes that make up the record itself. Up\nto 100 such records may be buffered per connection. As a result, a peer\nthat sends a stream of small forged records claiming to belong to the next\nepoch can cause an OpenSSL DTLS endpoint to retain around 1.7 megabytes of\nmemory, despite sending only a small fraction of that amount of data over\nthe network.\n\nAn attacker therefore gains a memory amplification factor of around 1200,\nand can multiply the effect across as many associations as it is able to\nopen, making this a remote memory exhaustion Denial of Service risk for\nDTLS servers. Since the memory retained per connection remains bounded,\nand any limit an application already places on the number of concurrent\nassociations also bounds the total exposure, this issue has been assessed\nas Low severity.\n\nFIPS impact: no\n\nNo FIPS modules are affected by this issue as the affected code is outside\nthe OpenSSL FIPS module boundary.\n\nOpenSSL 4.0, 3.6, 3.5, 3.4, 3.0, 1.1.1 and 1.0.2 are vulnerable to this\nissue.\n\nOpenSSL 4.0 users should upgrade to OpenSSL 4.0.2.\nOpenSSL 3.6 users should upgrade to OpenSSL 3.6.4.\nOpenSSL 3.5 users should upgrade to OpenSSL 3.5.8.\nOpenSSL 3.4 users should upgrade to OpenSSL 3.4.7.\nOpenSSL 3.0 users should upgrade to OpenSSL 3.0.22.\n\nPremium support customers only:\nOpenSSL 1.1.1 users should upgrade to OpenSSL 1.1.1zi\nOpenSSL 1.0.2 users should upgrade to OpenSSL 1.0.2zr\n\nThis issue was reported on 18 May 2026 by Amazon Web Services.\nThe fix has been developed by Matt Caswell.\n\n-- cut (non-publishing metadata for internal use) --\nReported by: Amazon Web Services\nFixed by: Matt Caswell"},"relatedVulnerabilities":[]},{"artifact":{"id":"14807b4f7067817d","cpes":["cpe:2.3:a:openssl:openssl:1.1.1q-r0:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:apk/busybox/openssl@1.1.1q-r0?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"1.1.1q-r0","language":"","licenses":["OpenSSL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/openssl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-54874","versionConstraint":">= 1.0.2, < 1.0.2zr||>= 1.1.1, < 1.1.1zi||>= 3.0.0, < 3.0.22||>= 3.4.0, < 3.4.7||>= 3.5.0, < 3.5.8||>= 3.6.0, < 3.6.4||>= 4.0.0, < 4.0.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:1.1.1q:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"1.1.1q-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-54874","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54874","cwe":"CWE-405","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-54874","date":"2026-10-08","epss":0.00622,"percentile":0.48184}],"risk":0.46649999999999997,"urls":["https://github.com/openssl/openssl/commit/4808b5d64176451f3d93d87d0ac9c81a9b13fb23","https://github.com/openssl/openssl/commit/7110cb2f75806d0bf809eb2f90790d477900be40","https://github.com/openssl/openssl/commit/a0c8ec557d9cac078f032d76cdf684fe743eb382","https://github.com/openssl/openssl/commit/cc0c6710917cd5eec001b297355d2ba723505107","https://github.com/openssl/openssl/commit/f52ffc11b90737ac89083909618dc2e1f42c561c","https://openssl-library.org/news/secadv/20260825.txt"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54874","description":"Issue summary: Receiving a DTLS record for a future epoch while a handshake\nis in progress causes OpenSSL to buffer far more memory than the record\nitself requires.\n\nImpact summary: A peer can use a small amount of network traffic to make an\nOpenSSL DTLS endpoint retain a disproportionately large amount of memory,\nwhich may lead to a Denial of Service.\n\nCWE: CWE-405: Asymmetric Resource Consumption (Amplification)\n\nDescription: While a DTLS handshake is in progress, a peer may legitimately\nhave already moved on to the next epoch (for example, having sent its\nChangeCipherSpec and Finished messages) before the local endpoint has\nprocessed the same transition, typically because of reordering on the\nunderlying UDP transport. OpenSSL buffers such early records so that they\ncan be processed once the local endpoint catches up.\n\nBuffering a record currently retains the entire read buffer it arrived in,\nwhich is sized to hold the largest possible DTLS record (around 16\nkilobytes), rather than just the bytes that make up the record itself. Up\nto 100 such records may be buffered per connection. As a result, a peer\nthat sends a stream of small forged records claiming to belong to the next\nepoch can cause an OpenSSL DTLS endpoint to retain around 1.7 megabytes of\nmemory, despite sending only a small fraction of that amount of data over\nthe network.\n\nAn attacker therefore gains a memory amplification factor of around 1200,\nand can multiply the effect across as many associations as it is able to\nopen, making this a remote memory exhaustion Denial of Service risk for\nDTLS servers. Since the memory retained per connection remains bounded,\nand any limit an application already places on the number of concurrent\nassociations also bounds the total exposure, this issue has been assessed\nas Low severity.\n\nFIPS impact: no\n\nNo FIPS modules are affected by this issue as the affected code is outside\nthe OpenSSL FIPS module boundary.\n\nOpenSSL 4.0, 3.6, 3.5, 3.4, 3.0, 1.1.1 and 1.0.2 are vulnerable to this\nissue.\n\nOpenSSL 4.0 users should upgrade to OpenSSL 4.0.2.\nOpenSSL 3.6 users should upgrade to OpenSSL 3.6.4.\nOpenSSL 3.5 users should upgrade to OpenSSL 3.5.8.\nOpenSSL 3.4 users should upgrade to OpenSSL 3.4.7.\nOpenSSL 3.0 users should upgrade to OpenSSL 3.0.22.\n\nPremium support customers only:\nOpenSSL 1.1.1 users should upgrade to OpenSSL 1.1.1zi\nOpenSSL 1.0.2 users should upgrade to OpenSSL 1.0.2zr\n\nThis issue was reported on 18 May 2026 by Amazon Web Services.\nThe fix has been developed by Matt Caswell.\n\n-- cut (non-publishing metadata for internal use) --\nReported by: Amazon Web Services\nFixed by: Matt Caswell"},"relatedVulnerabilities":[]},{"artifact":{"id":"d081de97c6f633df","cpes":["cpe:2.3:a:libcrypto1.1:libcrypto1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto1.1:libcrypto:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto:libcrypto1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto:libcrypto:1.1.1q-r0:*:*:*:*:*:*:*"],"name":"libcrypto1.1","purl":"pkg:apk/busybox/libcrypto1.1@1.1.1q-r0?arch=x86_64&distro=busybox-1.32.1&upstream=openssl","type":"apk","version":"1.1.1q-r0","language":"","licenses":["OpenSSL"],"metadata":{"Arch":"x86_64","files":[{"path":"/etc"},{"path":"/etc/ssl"},{"path":"/etc/ssl/ct_log_list.cnf"},{"path":"/etc/ssl/ct_log_list.cnf.dist"},{"path":"/etc/ssl/openssl.cnf"},{"path":"/etc/ssl/openssl.cnf.dist"},{"path":"/etc/ssl/certs"},{"path":"/etc/ssl/misc"},{"path":"/etc/ssl/misc/CA.pl"},{"path":"/etc/ssl/misc/tsget"},{"path":"/etc/ssl/misc/tsget.pl"},{"path":"/etc/ssl/private"},{"path":"/lib"},{"path":"/lib/libcrypto.so.1.1"},{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcrypto.so.1.1"},{"path":"/usr/lib/engines-1.1"},{"path":"/usr/lib/engines-1.1/afalg.so"},{"path":"/usr/lib/engines-1.1/capi.so"},{"path":"/usr/lib/engines-1.1/padlock.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-69419","versionConstraint":">= 1.1.1, < 1.1.1ze||>= 3.0.0, < 3.0.19||>= 3.3.0, < 3.3.6||>= 3.4.0, < 3.4.4||>= 3.5.0, < 3.5.5||>= 3.6.0, < 3.6.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:1.1.1q:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"1.1.1q-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2025-69419","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-69419","cwe":"CWE-787","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2025-69419","date":"2026-10-08","epss":0.00616,"percentile":0.47921}],"risk":0.45892,"urls":["https://github.com/openssl/openssl/commit/41be0f216404f14457bbf3b9cc488dba60b49296","https://github.com/openssl/openssl/commit/7e9cac9832e4705b91987c2474ed06a37a93cecb","https://github.com/openssl/openssl/commit/a26a90d38edec3748566129d824e664b54bee2e2","https://github.com/openssl/openssl/commit/cda12de3bc0e333ea8d2c6fd15001dbdaf280015","https://github.com/openssl/openssl/commit/ff628933755075446bca8307e8417c14d164b535","https://openssl-library.org/news/secadv/20260127.txt","https://cert-portal.siemens.com/productcert/html/ssa-265688.html"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-69419","description":"Issue summary: Calling PKCS12_get_friendlyname() function on a maliciously\ncrafted PKCS#12 file with a BMPString (UTF-16BE) friendly name containing\nnon-ASCII BMP code point can trigger a one byte write before the allocated\nbuffer.\n\nImpact summary: The out-of-bounds write can cause a memory corruption\nwhich can have various consequences including a Denial of Service.\n\nThe OPENSSL_uni2utf8() function performs a two-pass conversion of a PKCS#12\nBMPString (UTF-16BE) to UTF-8. In the second pass, when emitting UTF-8 bytes,\nthe helper function bmp_to_utf8() incorrectly forwards the remaining UTF-16\nsource byte count as the destination buffer capacity to UTF8_putc(). For BMP\ncode points above U+07FF, UTF-8 requires three bytes, but the forwarded\ncapacity can be just two bytes. UTF8_putc() then returns -1, and this negative\nvalue is added to the output length without validation, causing the\nlength to become negative. The subsequent trailing NUL byte is then written\nat a negative offset, causing write outside of heap allocated buffer.\n\nThe vulnerability is reachable via the public PKCS12_get_friendlyname() API\nwhen parsing attacker-controlled PKCS#12 files. While PKCS12_parse() uses a\ndifferent code path that avoids this issue, PKCS12_get_friendlyname() directly\ninvokes the vulnerable function. Exploitation requires an attacker to provide\na malicious PKCS#12 file to be parsed by the application and the attacker\ncan just trigger a one zero byte write before the allocated buffer.\nFor that reason the issue was assessed as Low severity according to our\nSecurity Policy.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the PKCS#12 implementation is outside the OpenSSL FIPS module boundary.\n\nOpenSSL 3.6, 3.5, 3.4, 3.3, 3.0 and 1.1.1 are vulnerable to this issue.\n\nOpenSSL 1.0.2 is not affected by this issue."},"relatedVulnerabilities":[]},{"artifact":{"id":"74f4e71ff41d2d68","cpes":["cpe:2.3:a:libssl1.1:libssl1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl1.1:libssl:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl:1.1.1q-r0:*:*:*:*:*:*:*"],"name":"libssl1.1","purl":"pkg:apk/busybox/libssl1.1@1.1.1q-r0?arch=x86_64&distro=busybox-1.32.1&upstream=openssl","type":"apk","version":"1.1.1q-r0","language":"","licenses":["OpenSSL"],"metadata":{"Arch":"x86_64","files":[{"path":"/lib"},{"path":"/lib/libssl.so.1.1"},{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libssl.so.1.1"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-69419","versionConstraint":">= 1.1.1, < 1.1.1ze||>= 3.0.0, < 3.0.19||>= 3.3.0, < 3.3.6||>= 3.4.0, < 3.4.4||>= 3.5.0, < 3.5.5||>= 3.6.0, < 3.6.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:1.1.1q:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"1.1.1q-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2025-69419","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-69419","cwe":"CWE-787","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2025-69419","date":"2026-10-08","epss":0.00616,"percentile":0.47921}],"risk":0.45892,"urls":["https://github.com/openssl/openssl/commit/41be0f216404f14457bbf3b9cc488dba60b49296","https://github.com/openssl/openssl/commit/7e9cac9832e4705b91987c2474ed06a37a93cecb","https://github.com/openssl/openssl/commit/a26a90d38edec3748566129d824e664b54bee2e2","https://github.com/openssl/openssl/commit/cda12de3bc0e333ea8d2c6fd15001dbdaf280015","https://github.com/openssl/openssl/commit/ff628933755075446bca8307e8417c14d164b535","https://openssl-library.org/news/secadv/20260127.txt","https://cert-portal.siemens.com/productcert/html/ssa-265688.html"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-69419","description":"Issue summary: Calling PKCS12_get_friendlyname() function on a maliciously\ncrafted PKCS#12 file with a BMPString (UTF-16BE) friendly name containing\nnon-ASCII BMP code point can trigger a one byte write before the allocated\nbuffer.\n\nImpact summary: The out-of-bounds write can cause a memory corruption\nwhich can have various consequences including a Denial of Service.\n\nThe OPENSSL_uni2utf8() function performs a two-pass conversion of a PKCS#12\nBMPString (UTF-16BE) to UTF-8. In the second pass, when emitting UTF-8 bytes,\nthe helper function bmp_to_utf8() incorrectly forwards the remaining UTF-16\nsource byte count as the destination buffer capacity to UTF8_putc(). For BMP\ncode points above U+07FF, UTF-8 requires three bytes, but the forwarded\ncapacity can be just two bytes. UTF8_putc() then returns -1, and this negative\nvalue is added to the output length without validation, causing the\nlength to become negative. The subsequent trailing NUL byte is then written\nat a negative offset, causing write outside of heap allocated buffer.\n\nThe vulnerability is reachable via the public PKCS12_get_friendlyname() API\nwhen parsing attacker-controlled PKCS#12 files. While PKCS12_parse() uses a\ndifferent code path that avoids this issue, PKCS12_get_friendlyname() directly\ninvokes the vulnerable function. Exploitation requires an attacker to provide\na malicious PKCS#12 file to be parsed by the application and the attacker\ncan just trigger a one zero byte write before the allocated buffer.\nFor that reason the issue was assessed as Low severity according to our\nSecurity Policy.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the PKCS#12 implementation is outside the OpenSSL FIPS module boundary.\n\nOpenSSL 3.6, 3.5, 3.4, 3.3, 3.0 and 1.1.1 are vulnerable to this issue.\n\nOpenSSL 1.0.2 is not affected by this issue."},"relatedVulnerabilities":[]},{"artifact":{"id":"14807b4f7067817d","cpes":["cpe:2.3:a:openssl:openssl:1.1.1q-r0:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:apk/busybox/openssl@1.1.1q-r0?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"1.1.1q-r0","language":"","licenses":["OpenSSL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/openssl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-69419","versionConstraint":">= 1.1.1, < 1.1.1ze||>= 3.0.0, < 3.0.19||>= 3.3.0, < 3.3.6||>= 3.4.0, < 3.4.4||>= 3.5.0, < 3.5.5||>= 3.6.0, < 3.6.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:1.1.1q:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"1.1.1q-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2025-69419","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-69419","cwe":"CWE-787","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2025-69419","date":"2026-10-08","epss":0.00616,"percentile":0.47921}],"risk":0.45892,"urls":["https://github.com/openssl/openssl/commit/41be0f216404f14457bbf3b9cc488dba60b49296","https://github.com/openssl/openssl/commit/7e9cac9832e4705b91987c2474ed06a37a93cecb","https://github.com/openssl/openssl/commit/a26a90d38edec3748566129d824e664b54bee2e2","https://github.com/openssl/openssl/commit/cda12de3bc0e333ea8d2c6fd15001dbdaf280015","https://github.com/openssl/openssl/commit/ff628933755075446bca8307e8417c14d164b535","https://openssl-library.org/news/secadv/20260127.txt","https://cert-portal.siemens.com/productcert/html/ssa-265688.html"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-69419","description":"Issue summary: Calling PKCS12_get_friendlyname() function on a maliciously\ncrafted PKCS#12 file with a BMPString (UTF-16BE) friendly name containing\nnon-ASCII BMP code point can trigger a one byte write before the allocated\nbuffer.\n\nImpact summary: The out-of-bounds write can cause a memory corruption\nwhich can have various consequences including a Denial of Service.\n\nThe OPENSSL_uni2utf8() function performs a two-pass conversion of a PKCS#12\nBMPString (UTF-16BE) to UTF-8. In the second pass, when emitting UTF-8 bytes,\nthe helper function bmp_to_utf8() incorrectly forwards the remaining UTF-16\nsource byte count as the destination buffer capacity to UTF8_putc(). For BMP\ncode points above U+07FF, UTF-8 requires three bytes, but the forwarded\ncapacity can be just two bytes. UTF8_putc() then returns -1, and this negative\nvalue is added to the output length without validation, causing the\nlength to become negative. The subsequent trailing NUL byte is then written\nat a negative offset, causing write outside of heap allocated buffer.\n\nThe vulnerability is reachable via the public PKCS12_get_friendlyname() API\nwhen parsing attacker-controlled PKCS#12 files. While PKCS12_parse() uses a\ndifferent code path that avoids this issue, PKCS12_get_friendlyname() directly\ninvokes the vulnerable function. Exploitation requires an attacker to provide\na malicious PKCS#12 file to be parsed by the application and the attacker\ncan just trigger a one zero byte write before the allocated buffer.\nFor that reason the issue was assessed as Low severity according to our\nSecurity Policy.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the PKCS#12 implementation is outside the OpenSSL FIPS module boundary.\n\nOpenSSL 3.6, 3.5, 3.4, 3.3, 3.0 and 1.1.1 are vulnerable to this issue.\n\nOpenSSL 1.0.2 is not affected by this issue."},"relatedVulnerabilities":[]},{"artifact":{"id":"6040784032e8795c","cpes":["cpe:2.3:a:curl:curl:7.79.1-r3:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:7.79.1-r3:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/busybox/curl@7.79.1-r3?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"7.79.1-r3","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-8927","versionConstraint":">= 7.12.0, < 8.21.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:haxx:curl:7.79.1:*:*:*:*:*:*:*"],"package":{"name":"curl","version":"7.79.1-r3"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-8927","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8927","cwe":"CWE-294","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-8927","cwe":"CWE-294","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-8927","date":"2026-10-08","epss":0.005,"percentile":0.40945}],"risk":0.4525,"urls":["https://curl.se/docs/CVE-2026-8927.html","https://curl.se/docs/CVE-2026-8927.json","https://hackerone.com/reports/3744543"],"severity":"Critical","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8927","description":"When reusing a libcurl handle for sequential transfers driven by\nenvironment-variable proxy configuration, libcurl fails to clear the proxy\nauthentication state between requests. Specifically, if the initial transfer\nauthenticates against `proxyA` using Digest auth, a subsequent transfer routed\nthrough `proxyB` erroneously leaks the `Proxy-Authorization:` header intended\nsolely for `proxyA`."},"relatedVulnerabilities":[]},{"artifact":{"id":"6040784032e8795c","cpes":["cpe:2.3:a:curl:curl:7.79.1-r3:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:7.79.1-r3:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/busybox/curl@7.79.1-r3?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"7.79.1-r3","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2024-11053","versionConstraint":">= 6.5, < 8.11.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:haxx:curl:7.79.1:*:*:*:*:*:*:*"],"package":{"name":"curl","version":"7.79.1-r3"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2024-11053","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N","metrics":{"baseScore":3.4,"impactScore":1.5,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-11053","date":"2026-10-08","epss":0.01348,"percentile":0.7063}],"risk":0.43135999999999997,"urls":["https://curl.se/docs/CVE-2024-11053.html","https://curl.se/docs/CVE-2024-11053.json","https://hackerone.com/reports/2829063","http://www.openwall.com/lists/oss-security/2024/12/11/1","https://security.netapp.com/advisory/ntap-20250124-0012/","https://security.netapp.com/advisory/ntap-20250131-0003/","https://security.netapp.com/advisory/ntap-20250131-0004/"],"severity":"Low","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-11053","description":"When asked to both use a `.netrc` file for credentials and to follow HTTP\nredirects, curl could leak the password used for the first host to the\nfollowed-to host under certain circumstances.\n\nThis flaw only manifests itself if the netrc file has an entry that matches\nthe redirect target hostname but the entry either omits just the password or\nomits both login and password."},"relatedVulnerabilities":[]},{"artifact":{"id":"a45c752c9b8878aa","cpes":["cpe:2.3:a:php7:php7:7.4.26-r0:*:*:*:*:*:*:*","cpe:2.3:a:php7:php:7.4.26-r0:*:*:*:*:*:*:*","cpe:2.3:a:php:php7:7.4.26-r0:*:*:*:*:*:*:*","cpe:2.3:a:php:php:7.4.26-r0:*:*:*:*:*:*:*"],"name":"php7","purl":"pkg:apk/busybox/php7@7.4.26-r0?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"7.4.26-r0","language":"","licenses":["BSD-3-Clause","LGPL-2.0-or-later","MIT","PHP-3.01","Zend-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/php"},{"path":"/usr/bin/php7"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"php7"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:php:php:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2024-8925","versionConstraint":"< 8.1.30||>= 8.2, < 8.2.24||>= 8.3, < 8.3.12 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:php:php:7.4.26:*:*:*:*:*:*:*"],"package":{"name":"php7","version":"7.4.26-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2024-8925","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.1,"impactScore":1.5,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-8925","cwe":"CWE-444","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-8925","cwe":"CWE-444","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-8925","date":"2026-10-08","epss":0.00935,"percentile":0.59577}],"risk":0.43010000000000004,"urls":["https://github.com/php/php-src/security/advisories/GHSA-9pqp-7h25-4f32","https://lists.debian.org/debian-lts-announce/2024/10/msg00011.html","https://security.netapp.com/advisory/ntap-20241101-0003/"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-8925","description":"In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, erroneous parsing of multipart form data contained in an HTTP POST request could lead to legitimate data not being processed. This could lead to malicious attacker able to control part of the submitted data being able to exclude portion of other data, potentially leading to erroneous application behavior."},"relatedVulnerabilities":[]},{"artifact":{"id":"422a442f930ca27c","cpes":["cpe:2.3:a:nginx:nginx:1.18.0-r15:*:*:*:*:*:*:*"],"name":"nginx","purl":"pkg:apk/busybox/nginx@1.18.0-r15?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"1.18.0-r15","language":"","licenses":["BSD-2-Clause"],"metadata":{"Arch":"x86_64","files":[{"path":"/etc"},{"path":"/etc/logrotate.d"},{"path":"/etc/logrotate.d/nginx"},{"path":"/etc/nginx"},{"path":"/etc/nginx/fastcgi.conf"},{"path":"/etc/nginx/fastcgi_params"},{"path":"/etc/nginx/mime.types"},{"path":"/etc/nginx/nginx.conf"},{"path":"/etc/nginx/scgi_params"},{"path":"/etc/nginx/uwsgi_params"},{"path":"/etc/nginx/http.d"},{"path":"/etc/nginx/modules"},{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/nginx"},{"path":"/usr/lib/nginx/modules"},{"path":"/usr/sbin"},{"path":"/usr/sbin/nginx"},{"path":"/usr/share"},{"path":"/usr/share/nginx"},{"path":"/usr/share/nginx/http-default_server.conf"},{"path":"/var"},{"path":"/var/lib"},{"path":"/var/lib/nginx"},{"path":"/var/lib/nginx/logs"},{"path":"/var/lib/nginx/modules"},{"path":"/var/lib/nginx/run"},{"path":"/var/lib/nginx/html"},{"path":"/var/lib/nginx/html/50x.html"},{"path":"/var/lib/nginx/html/index.html"},{"path":"/var/lib/nginx/tmp"},{"path":"/var/log"},{"path":"/var/log/nginx"},{"path":"/var/www"},{"path":"/var/www/localhost"},{"path":"/var/www/localhost/htdocs"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"nginx"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:nginx:nginx:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-60005","versionConstraint":">= 1.15.8, < 1.30.4||>= 1.31.0, < 1.31.3 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:nginx:nginx:1.18.0:*:*:*:*:*:*:*"],"package":{"name":"nginx","version":"1.18.0-r15"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-60005","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"f5sirt@f5.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"f5sirt@f5.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.8},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60005","cwe":"CWE-908","type":"Primary","source":"f5sirt@f5.com"}],"epss":[{"cve":"CVE-2026-60005","date":"2026-10-08","epss":0.00531,"percentile":0.43123}],"risk":0.4248,"urls":["https://my.f5.com/manage/s/article/K000162100"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60005","description":"NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_slice_module module. When the slice directive and unnamed regex captures are configured or when a background cache update happens, unauthenticated attackers can send requests that may cause uninitialized memory access in the NGINX worker process, leading to limited disclosure of memory or a restart.\n\nImpact:\nThis vulnerability may allow remote, unauthenticated attackers to have limited control to disclose memory contents or restart the NGINX worker process. There is no control plane exposure; this is a data plane issue only.\nNote: The ngx_http_slice_module module is not enabled by default; it's enabled with the --with-http_slice_module configuration parameter.\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated."},"relatedVulnerabilities":[]},{"artifact":{"id":"6040784032e8795c","cpes":["cpe:2.3:a:curl:curl:7.79.1-r3:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:7.79.1-r3:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/busybox/curl@7.79.1-r3?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"7.79.1-r3","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2024-8096","versionConstraint":">= 7.41.0, < 8.10.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:haxx:curl:7.79.1:*:*:*:*:*:*:*"],"package":{"name":"curl","version":"7.79.1-r3"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2024-8096","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-8096","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-8096","date":"2026-10-08","epss":0.00729,"percentile":0.52825}],"risk":0.4191749999999999,"urls":["https://curl.se/docs/CVE-2024-8096.html","https://curl.se/docs/CVE-2024-8096.json","https://hackerone.com/reports/2669852","http://www.openwall.com/lists/oss-security/2024/09/11/1","https://lists.debian.org/debian-lts-announce/2024/11/msg00008.html","https://security.netapp.com/advisory/ntap-20241011-0005/","https://github.com/curl/curl/commit/aeb1a281cab13c7ba"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-8096","description":"When curl is told to use the Certificate Status Request TLS extension, often referred to as OCSP stapling, to verify that the server certificate is valid, it might fail to detect some OCSP problems and instead wrongly consider the response as fine.  If the returned status reports another error than 'revoked' (like for example 'unauthorized') it is not treated as a bad certficate."},"relatedVulnerabilities":[]},{"artifact":{"id":"6040784032e8795c","cpes":["cpe:2.3:a:curl:curl:7.79.1-r3:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:7.79.1-r3:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/busybox/curl@7.79.1-r3?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"7.79.1-r3","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-6253","versionConstraint":">= 7.14.1, < 8.20.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:haxx:curl:7.79.1:*:*:*:*:*:*:*"],"package":{"name":"curl","version":"7.79.1-r3"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-6253","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6253","cwe":"CWE-522","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-6253","cwe":"CWE-522","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-6253","date":"2026-10-08","epss":0.0075,"percentile":0.53553}],"risk":0.40875,"urls":["https://curl.se/docs/CVE-2026-6253.html","https://curl.se/docs/CVE-2026-6253.json","https://hackerone.com/reports/3669637","http://www.openwall.com/lists/oss-security/2026/04/29/11"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6253","description":"curl might erroneously pass on credentials for a first proxy to a second\nproxy.\n\nThis can happen when the following conditions are true:\n\n1. curl is setup to use specific different proxies for different URL schemes\n2. the first proxy needs credentials\n3. the second proxy uses no credentials\n4. while using the first proxy (using say `http://`), curl is asked to follow\n   a redirect to a URL using another scheme (say `https://`), accessed using a\n   second, different, proxy"},"relatedVulnerabilities":[]},{"artifact":{"id":"de2e09a252869bf3","cpes":["cpe:2.3:a:git-scm:git:2.30.6-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_scm:git:2.30.6-r0:*:*:*:*:*:*:*","cpe:2.3:a:git:git:2.30.6-r0:*:*:*:*:*:*:*"],"name":"git","purl":"pkg:apk/busybox/git@2.30.6-r0?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"2.30.6-r0","language":"","licenses":["GPL-2.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/git"},{"path":"/usr/bin/git-receive-pack"},{"path":"/usr/bin/git-shell"},{"path":"/usr/bin/git-upload-archive"},{"path":"/usr/bin/git-upload-pack"},{"path":"/usr/libexec"},{"path":"/usr/libexec/git-core"},{"path":"/usr/libexec/git-core/git"},{"path":"/usr/libexec/git-core/git-add"},{"path":"/usr/libexec/git-core/git-am"},{"path":"/usr/libexec/git-core/git-annotate"},{"path":"/usr/libexec/git-core/git-apply"},{"path":"/usr/libexec/git-core/git-archive"},{"path":"/usr/libexec/git-core/git-bisect"},{"path":"/usr/libexec/git-core/git-bisect--helper"},{"path":"/usr/libexec/git-core/git-blame"},{"path":"/usr/libexec/git-core/git-branch"},{"path":"/usr/libexec/git-core/git-bugreport"},{"path":"/usr/libexec/git-core/git-bundle"},{"path":"/usr/libexec/git-core/git-cat-file"},{"path":"/usr/libexec/git-core/git-check-attr"},{"path":"/usr/libexec/git-core/git-check-ignore"},{"path":"/usr/libexec/git-core/git-check-mailmap"},{"path":"/usr/libexec/git-core/git-check-ref-format"},{"path":"/usr/libexec/git-core/git-checkout"},{"path":"/usr/libexec/git-core/git-checkout-index"},{"path":"/usr/libexec/git-core/git-cherry"},{"path":"/usr/libexec/git-core/git-cherry-pick"},{"path":"/usr/libexec/git-core/git-clean"},{"path":"/usr/libexec/git-core/git-clone"},{"path":"/usr/libexec/git-core/git-column"},{"path":"/usr/libexec/git-core/git-commit"},{"path":"/usr/libexec/git-core/git-commit-graph"},{"path":"/usr/libexec/git-core/git-commit-tree"},{"path":"/usr/libexec/git-core/git-config"},{"path":"/usr/libexec/git-core/git-count-objects"},{"path":"/usr/libexec/git-core/git-credential"},{"path":"/usr/libexec/git-core/git-credential-cache"},{"path":"/usr/libexec/git-core/git-credential-cache--daemon"},{"path":"/usr/libexec/git-core/git-credential-store"},{"path":"/usr/libexec/git-core/git-describe"},{"path":"/usr/libexec/git-core/git-diff"},{"path":"/usr/libexec/git-core/git-diff-files"},{"path":"/usr/libexec/git-core/git-diff-index"},{"path":"/usr/libexec/git-core/git-diff-tree"},{"path":"/usr/libexec/git-core/git-difftool"},{"path":"/usr/libexec/git-core/git-difftool--helper"},{"path":"/usr/libexec/git-core/git-env--helper"},{"path":"/usr/libexec/git-core/git-fast-export"},{"path":"/usr/libexec/git-core/git-fetch"},{"path":"/usr/libexec/git-core/git-fetch-pack"},{"path":"/usr/libexec/git-core/git-filter-branch"},{"path":"/usr/libexec/git-core/git-fmt-merge-msg"},{"path":"/usr/libexec/git-core/git-for-each-ref"},{"path":"/usr/libexec/git-core/git-for-each-repo"},{"path":"/usr/libexec/git-core/git-format-patch"},{"path":"/usr/libexec/git-core/git-fsck"},{"path":"/usr/libexec/git-core/git-fsck-objects"},{"path":"/usr/libexec/git-core/git-gc"},{"path":"/usr/libexec/git-core/git-get-tar-commit-id"},{"path":"/usr/libexec/git-core/git-grep"},{"path":"/usr/libexec/git-core/git-hash-object"},{"path":"/usr/libexec/git-core/git-help"},{"path":"/usr/libexec/git-core/git-http-fetch"},{"path":"/usr/libexec/git-core/git-http-push"},{"path":"/usr/libexec/git-core/git-index-pack"},{"path":"/usr/libexec/git-core/git-init"},{"path":"/usr/libexec/git-core/git-init-db"},{"path":"/usr/libexec/git-core/git-interpret-trailers"},{"path":"/usr/libexec/git-core/git-log"},{"path":"/usr/libexec/git-core/git-ls-files"},{"path":"/usr/libexec/git-core/git-ls-remote"},{"path":"/usr/libexec/git-core/git-ls-tree"},{"path":"/usr/libexec/git-core/git-mailinfo"},{"path":"/usr/libexec/git-core/git-mailsplit"},{"path":"/usr/libexec/git-core/git-maintenance"},{"path":"/usr/libexec/git-core/git-merge"},{"path":"/usr/libexec/git-core/git-merge-base"},{"path":"/usr/libexec/git-core/git-merge-file"},{"path":"/usr/libexec/git-core/git-merge-index"},{"path":"/usr/libexec/git-core/git-merge-octopus"},{"path":"/usr/libexec/git-core/git-merge-one-file"},{"path":"/usr/libexec/git-core/git-merge-ours"},{"path":"/usr/libexec/git-core/git-merge-recursive"},{"path":"/usr/libexec/git-core/git-merge-resolve"},{"path":"/usr/libexec/git-core/git-merge-subtree"},{"path":"/usr/libexec/git-core/git-merge-tree"},{"path":"/usr/libexec/git-core/git-mergetool"},{"path":"/usr/libexec/git-core/git-mergetool--lib"},{"path":"/usr/libexec/git-core/git-mktag"},{"path":"/usr/libexec/git-core/git-mktree"},{"path":"/usr/libexec/git-core/git-multi-pack-index"},{"path":"/usr/libexec/git-core/git-mv"},{"path":"/usr/libexec/git-core/git-name-rev"},{"path":"/usr/libexec/git-core/git-notes"},{"path":"/usr/libexec/git-core/git-pack-objects"},{"path":"/usr/libexec/git-core/git-pack-redundant"},{"path":"/usr/libexec/git-core/git-pack-refs"},{"path":"/usr/libexec/git-core/git-patch-id"},{"path":"/usr/libexec/git-core/git-prune"},{"path":"/usr/libexec/git-core/git-prune-packed"},{"path":"/usr/libexec/git-core/git-pull"},{"path":"/usr/libexec/git-core/git-push"},{"path":"/usr/libexec/git-core/git-quiltimport"},{"path":"/usr/libexec/git-core/git-range-diff"},{"path":"/usr/libexec/git-core/git-read-tree"},{"path":"/usr/libexec/git-core/git-rebase"},{"path":"/usr/libexec/git-core/git-rebase--preserve-merges"},{"path":"/usr/libexec/git-core/git-receive-pack"},{"path":"/usr/libexec/git-core/git-reflog"},{"path":"/usr/libexec/git-core/git-remote"},{"path":"/usr/libexec/git-core/git-remote-ext"},{"path":"/usr/libexec/git-core/git-remote-fd"},{"path":"/usr/libexec/git-core/git-remote-ftp"},{"path":"/usr/libexec/git-core/git-remote-ftps"},{"path":"/usr/libexec/git-core/git-remote-http"},{"path":"/usr/libexec/git-core/git-remote-https"},{"path":"/usr/libexec/git-core/git-repack"},{"path":"/usr/libexec/git-core/git-replace"},{"path":"/usr/libexec/git-core/git-request-pull"},{"path":"/usr/libexec/git-core/git-rerere"},{"path":"/usr/libexec/git-core/git-reset"},{"path":"/usr/libexec/git-core/git-restore"},{"path":"/usr/libexec/git-core/git-rev-list"},{"path":"/usr/libexec/git-core/git-rev-parse"},{"path":"/usr/libexec/git-core/git-revert"},{"path":"/usr/libexec/git-core/git-rm"},{"path":"/usr/libexec/git-core/git-send-pack"},{"path":"/usr/libexec/git-core/git-sh-i18n"},{"path":"/usr/libexec/git-core/git-sh-i18n--envsubst"},{"path":"/usr/libexec/git-core/git-sh-setup"},{"path":"/usr/libexec/git-core/git-shortlog"},{"path":"/usr/libexec/git-core/git-show"},{"path":"/usr/libexec/git-core/git-show-branch"},{"path":"/usr/libexec/git-core/git-show-index"},{"path":"/usr/libexec/git-core/git-show-ref"},{"path":"/usr/libexec/git-core/git-sparse-checkout"},{"path":"/usr/libexec/git-core/git-stage"},{"path":"/usr/libexec/git-core/git-stash"},{"path":"/usr/libexec/git-core/git-status"},{"path":"/usr/libexec/git-core/git-stripspace"},{"path":"/usr/libexec/git-core/git-submodule"},{"path":"/usr/libexec/git-core/git-submodule--helper"},{"path":"/usr/libexec/git-core/git-switch"},{"path":"/usr/libexec/git-core/git-symbolic-ref"},{"path":"/usr/libexec/git-core/git-tag"},{"path":"/usr/libexec/git-core/git-unpack-file"},{"path":"/usr/libexec/git-core/git-unpack-objects"},{"path":"/usr/libexec/git-core/git-update-index"},{"path":"/usr/libexec/git-core/git-update-ref"},{"path":"/usr/libexec/git-core/git-update-server-info"},{"path":"/usr/libexec/git-core/git-upload-archive"},{"path":"/usr/libexec/git-core/git-upload-pack"},{"path":"/usr/libexec/git-core/git-var"},{"path":"/usr/libexec/git-core/git-verify-commit"},{"path":"/usr/libexec/git-core/git-verify-pack"},{"path":"/usr/libexec/git-core/git-verify-tag"},{"path":"/usr/libexec/git-core/git-web--browse"},{"path":"/usr/libexec/git-core/git-whatchanged"},{"path":"/usr/libexec/git-core/git-worktree"},{"path":"/usr/libexec/git-core/git-write-tree"},{"path":"/usr/libexec/git-core/mergetools"},{"path":"/usr/libexec/git-core/mergetools/araxis"},{"path":"/usr/libexec/git-core/mergetools/bc"},{"path":"/usr/libexec/git-core/mergetools/codecompare"},{"path":"/usr/libexec/git-core/mergetools/deltawalker"},{"path":"/usr/libexec/git-core/mergetools/diffmerge"},{"path":"/usr/libexec/git-core/mergetools/diffuse"},{"path":"/usr/libexec/git-core/mergetools/ecmerge"},{"path":"/usr/libexec/git-core/mergetools/emerge"},{"path":"/usr/libexec/git-core/mergetools/examdiff"},{"path":"/usr/libexec/git-core/mergetools/guiffy"},{"path":"/usr/libexec/git-core/mergetools/gvimdiff"},{"path":"/usr/libexec/git-core/mergetools/kdiff3"},{"path":"/usr/libexec/git-core/mergetools/kompare"},{"path":"/usr/libexec/git-core/mergetools/meld"},{"path":"/usr/libexec/git-core/mergetools/nvimdiff"},{"path":"/usr/libexec/git-core/mergetools/opendiff"},{"path":"/usr/libexec/git-core/mergetools/smerge"},{"path":"/usr/libexec/git-core/mergetools/tkdiff"},{"path":"/usr/libexec/git-core/mergetools/tortoisemerge"},{"path":"/usr/libexec/git-core/mergetools/vimdiff"},{"path":"/usr/libexec/git-core/mergetools/winmerge"},{"path":"/usr/libexec/git-core/mergetools/xxdiff"},{"path":"/usr/share"},{"path":"/usr/share/git-core"},{"path":"/usr/share/git-core/templates"},{"path":"/usr/share/git-core/templates/description"},{"path":"/usr/share/git-core/templates/branches"},{"path":"/usr/share/git-core/templates/hooks"},{"path":"/usr/share/git-core/templates/hooks/applypatch-msg.sample"},{"path":"/usr/share/git-core/templates/hooks/commit-msg.sample"},{"path":"/usr/share/git-core/templates/hooks/post-update.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-applypatch.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-commit.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-merge-commit.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-push.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-rebase.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-receive.sample"},{"path":"/usr/share/git-core/templates/hooks/prepare-commit-msg.sample"},{"path":"/usr/share/git-core/templates/hooks/push-to-checkout.sample"},{"path":"/usr/share/git-core/templates/hooks/update.sample"},{"path":"/usr/share/git-core/templates/info"},{"path":"/usr/share/git-core/templates/info/exclude"},{"path":"/usr/share/perl5"},{"path":"/var"},{"path":"/var/git"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"git"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2024-52005","versionConstraint":"< 2.40.5||>= 2.41.0, < 2.41.4||>= 2.42.0, < 2.42.5||>= 2.43.0, < 2.43.7||>= 2.44.0, < 2.44.4||>= 2.45.0, < 2.45.4||>= 2.46.0, < 2.46.4||>= 2.47.0, < 2.47.2||>= 2.48.0, < 2.48.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:git-scm:git:2.30.6:*:*:*:*:*:*:*"],"package":{"name":"git","version":"2.30.6-r0"},"namespace":"nvd:cpe"}},{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:git:git:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2024-52005","versionConstraint":"< 2.40.5||>= 2.41.0, < 2.41.4||>= 2.42.0, < 2.42.5||>= 2.43.0, < 2.43.7||>= 2.44.0, < 2.44.4||>= 2.45.0, < 2.45.4||>= 2.46.0, < 2.46.4||>= 2.47.0, < 2.47.2||>= 2.48.0, < 2.48.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:git:git:2.30.6:*:*:*:*:*:*:*"],"package":{"name":"git","version":"2.30.6-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2024-52005","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.5},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-52005","cwe":"CWE-116","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2024-52005","cwe":"CWE-150","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2024-52005","date":"2026-10-08","epss":0.00513,"percentile":0.41827}],"risk":0.40142249999999996,"urls":["https://github.com/git/git/security/advisories/GHSA-7jjc-gg6m-3329","https://lore.kernel.org/git/1M9FnZ-1taoNo1wwh-00ESSd@mail.gmx.net"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-52005","description":"Git is a source code management tool. When cloning from a server (or fetching, or pushing), informational or error messages are transported from the remote Git process to the client via the so-called \"sideband channel\". These messages will be prefixed with \"remote:\" and printed directly to the standard error output. Typically, this standard error output is connected to a terminal that understands ANSI escape sequences, which Git did not protect against. Most modern terminals support control sequences that can be used by a malicious actor to hide and misrepresent information, or to mislead the user into executing untrusted scripts. As requested on the git-security mailing list, the patches are under discussion on the public mailing list. Users are advised to update as soon as possible. Users unable to upgrade should avoid recursive clones unless they are from trusted sources."},"relatedVulnerabilities":[]},{"artifact":{"id":"a45c752c9b8878aa","cpes":["cpe:2.3:a:php7:php7:7.4.26-r0:*:*:*:*:*:*:*","cpe:2.3:a:php7:php:7.4.26-r0:*:*:*:*:*:*:*","cpe:2.3:a:php:php7:7.4.26-r0:*:*:*:*:*:*:*","cpe:2.3:a:php:php:7.4.26-r0:*:*:*:*:*:*:*"],"name":"php7","purl":"pkg:apk/busybox/php7@7.4.26-r0?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"7.4.26-r0","language":"","licenses":["BSD-3-Clause","LGPL-2.0-or-later","MIT","PHP-3.01","Zend-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/php"},{"path":"/usr/bin/php7"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"php7"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:php:php:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-1219","versionConstraint":"< 8.1.32||>= 8.2, < 8.2.28||>= 8.3, < 8.3.19||>= 8.4, < 8.4.5 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:php:php:7.4.26:*:*:*:*:*:*:*"],"package":{"name":"php7","version":"7.4.26-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2025-1219","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security@php.net","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-1219","cwe":"CWE-1116","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-1219","date":"2026-10-08","epss":0.00734,"percentile":0.53004}],"risk":0.39636000000000005,"urls":["https://github.com/php/php-src/security/advisories/GHSA-p3x9-6h7p-cgfc","https://lists.debian.org/debian-lts-announce/2025/03/msg00014.html","https://security.netapp.com/advisory/ntap-20250523-0007/"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-1219","description":"In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when requesting a HTTP resource using the DOM or SimpleXML extensions, the wrong content-type header is used to determine the charset when the requested resource performs a redirect. This may cause the resulting document to be parsed incorrectly or bypass validations."},"relatedVulnerabilities":[]},{"artifact":{"id":"a45c752c9b8878aa","cpes":["cpe:2.3:a:php7:php7:7.4.26-r0:*:*:*:*:*:*:*","cpe:2.3:a:php7:php:7.4.26-r0:*:*:*:*:*:*:*","cpe:2.3:a:php:php7:7.4.26-r0:*:*:*:*:*:*:*","cpe:2.3:a:php:php:7.4.26-r0:*:*:*:*:*:*:*"],"name":"php7","purl":"pkg:apk/busybox/php7@7.4.26-r0?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"7.4.26-r0","language":"","licenses":["BSD-3-Clause","LGPL-2.0-or-later","MIT","PHP-3.01","Zend-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/php"},{"path":"/usr/bin/php7"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"php7"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:php:php:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-1736","versionConstraint":"< 8.1.32||>= 8.2, < 8.2.28||>= 8.3, < 8.3.19||>= 8.4, < 8.4.5 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:php:php:7.4.26:*:*:*:*:*:*:*"],"package":{"name":"php7","version":"7.4.26-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2025-1736","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security@php.net","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-1736","cwe":"CWE-20","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2025-1736","date":"2026-10-08","epss":0.00543,"percentile":0.43855}],"risk":0.388245,"urls":["https://github.com/php/php-src/security/advisories/GHSA-hgf5-96fm-v528","https://lists.debian.org/debian-lts-announce/2025/03/msg00014.html","https://security.netapp.com/advisory/ntap-20250523-0006/"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-1736","description":"In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when user-supplied headers are sent, the insufficient validation of the end-of-line characters may prevent certain headers from being sent or lead to certain headers be misinterpreted."},"relatedVulnerabilities":[]},{"artifact":{"id":"422a442f930ca27c","cpes":["cpe:2.3:a:nginx:nginx:1.18.0-r15:*:*:*:*:*:*:*"],"name":"nginx","purl":"pkg:apk/busybox/nginx@1.18.0-r15?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"1.18.0-r15","language":"","licenses":["BSD-2-Clause"],"metadata":{"Arch":"x86_64","files":[{"path":"/etc"},{"path":"/etc/logrotate.d"},{"path":"/etc/logrotate.d/nginx"},{"path":"/etc/nginx"},{"path":"/etc/nginx/fastcgi.conf"},{"path":"/etc/nginx/fastcgi_params"},{"path":"/etc/nginx/mime.types"},{"path":"/etc/nginx/nginx.conf"},{"path":"/etc/nginx/scgi_params"},{"path":"/etc/nginx/uwsgi_params"},{"path":"/etc/nginx/http.d"},{"path":"/etc/nginx/modules"},{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/nginx"},{"path":"/usr/lib/nginx/modules"},{"path":"/usr/sbin"},{"path":"/usr/sbin/nginx"},{"path":"/usr/share"},{"path":"/usr/share/nginx"},{"path":"/usr/share/nginx/http-default_server.conf"},{"path":"/var"},{"path":"/var/lib"},{"path":"/var/lib/nginx"},{"path":"/var/lib/nginx/logs"},{"path":"/var/lib/nginx/modules"},{"path":"/var/lib/nginx/run"},{"path":"/var/lib/nginx/html"},{"path":"/var/lib/nginx/html/50x.html"},{"path":"/var/lib/nginx/html/index.html"},{"path":"/var/lib/nginx/tmp"},{"path":"/var/log"},{"path":"/var/log/nginx"},{"path":"/var/www"},{"path":"/var/www/localhost"},{"path":"/var/www/localhost/htdocs"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"nginx"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:nginx:nginx:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-42934","versionConstraint":">= 0.3.50, < 1.30.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:nginx:nginx:1.18.0:*:*:*:*:*:*:*"],"package":{"name":"nginx","version":"1.18.0-r15"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-42934","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"f5sirt@f5.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"f5sirt@f5.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L","metrics":{"baseScore":4.8,"impactScore":2.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42934","cwe":"CWE-125","type":"Secondary","source":"f5sirt@f5.com"}],"epss":[{"cve":"CVE-2026-42934","date":"2026-10-08","epss":0.00731,"percentile":0.52868}],"risk":0.38560249999999996,"urls":["https://my.f5.com/manage/s/article/K000161028"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42934","description":"NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_charset_module module. When charset, source_charset, and charset_map and proxy_pass with disabled buffering (\"off\") directives are configured, unauthenticated attackers can send requests that with conditions beyond the attackers' control to cause a heap buffer over-read in the NGINX worker process, leading to limited disclosure of memory or a restart.\n\n\n\n Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated."},"relatedVulnerabilities":[]},{"artifact":{"id":"6040784032e8795c","cpes":["cpe:2.3:a:curl:curl:7.79.1-r3:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:7.79.1-r3:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/busybox/curl@7.79.1-r3?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"7.79.1-r3","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-9547","versionConstraint":">= 7.69.0, < 8.21.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:haxx:curl:7.79.1:*:*:*:*:*:*:*"],"package":{"name":"curl","version":"7.79.1-r3"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-9547","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-9547","cwe":"CWE-297","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-9547","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-9547","date":"2026-10-08","epss":0.00508,"percentile":0.41397}],"risk":0.37846,"urls":["https://curl.se/docs/CVE-2026-9547.html","https://curl.se/docs/CVE-2026-9547.json","https://hackerone.com/reports/3751712"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-9547","description":"When a libcurl-based application performs transfers via `SCP://` or `SFTP://`\nand utilizes the `CURLOPT_SSH_KEYFUNCTION` callback, it may silently accept an\nuntrusted server. This vulnerability occurs when a server presents a host key\ntype that does not match the specific key type already recorded for that host\nin the `known_hosts` file. Instead of rejecting the mismatch, the callback\nmechanism fails to properly enforce the restriction, allowing the connection\nto succeed without warning and risking a potential man-in-the-middle attack."},"relatedVulnerabilities":[]},{"artifact":{"id":"de2e09a252869bf3","cpes":["cpe:2.3:a:git-scm:git:2.30.6-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_scm:git:2.30.6-r0:*:*:*:*:*:*:*","cpe:2.3:a:git:git:2.30.6-r0:*:*:*:*:*:*:*"],"name":"git","purl":"pkg:apk/busybox/git@2.30.6-r0?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"2.30.6-r0","language":"","licenses":["GPL-2.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/git"},{"path":"/usr/bin/git-receive-pack"},{"path":"/usr/bin/git-shell"},{"path":"/usr/bin/git-upload-archive"},{"path":"/usr/bin/git-upload-pack"},{"path":"/usr/libexec"},{"path":"/usr/libexec/git-core"},{"path":"/usr/libexec/git-core/git"},{"path":"/usr/libexec/git-core/git-add"},{"path":"/usr/libexec/git-core/git-am"},{"path":"/usr/libexec/git-core/git-annotate"},{"path":"/usr/libexec/git-core/git-apply"},{"path":"/usr/libexec/git-core/git-archive"},{"path":"/usr/libexec/git-core/git-bisect"},{"path":"/usr/libexec/git-core/git-bisect--helper"},{"path":"/usr/libexec/git-core/git-blame"},{"path":"/usr/libexec/git-core/git-branch"},{"path":"/usr/libexec/git-core/git-bugreport"},{"path":"/usr/libexec/git-core/git-bundle"},{"path":"/usr/libexec/git-core/git-cat-file"},{"path":"/usr/libexec/git-core/git-check-attr"},{"path":"/usr/libexec/git-core/git-check-ignore"},{"path":"/usr/libexec/git-core/git-check-mailmap"},{"path":"/usr/libexec/git-core/git-check-ref-format"},{"path":"/usr/libexec/git-core/git-checkout"},{"path":"/usr/libexec/git-core/git-checkout-index"},{"path":"/usr/libexec/git-core/git-cherry"},{"path":"/usr/libexec/git-core/git-cherry-pick"},{"path":"/usr/libexec/git-core/git-clean"},{"path":"/usr/libexec/git-core/git-clone"},{"path":"/usr/libexec/git-core/git-column"},{"path":"/usr/libexec/git-core/git-commit"},{"path":"/usr/libexec/git-core/git-commit-graph"},{"path":"/usr/libexec/git-core/git-commit-tree"},{"path":"/usr/libexec/git-core/git-config"},{"path":"/usr/libexec/git-core/git-count-objects"},{"path":"/usr/libexec/git-core/git-credential"},{"path":"/usr/libexec/git-core/git-credential-cache"},{"path":"/usr/libexec/git-core/git-credential-cache--daemon"},{"path":"/usr/libexec/git-core/git-credential-store"},{"path":"/usr/libexec/git-core/git-describe"},{"path":"/usr/libexec/git-core/git-diff"},{"path":"/usr/libexec/git-core/git-diff-files"},{"path":"/usr/libexec/git-core/git-diff-index"},{"path":"/usr/libexec/git-core/git-diff-tree"},{"path":"/usr/libexec/git-core/git-difftool"},{"path":"/usr/libexec/git-core/git-difftool--helper"},{"path":"/usr/libexec/git-core/git-env--helper"},{"path":"/usr/libexec/git-core/git-fast-export"},{"path":"/usr/libexec/git-core/git-fetch"},{"path":"/usr/libexec/git-core/git-fetch-pack"},{"path":"/usr/libexec/git-core/git-filter-branch"},{"path":"/usr/libexec/git-core/git-fmt-merge-msg"},{"path":"/usr/libexec/git-core/git-for-each-ref"},{"path":"/usr/libexec/git-core/git-for-each-repo"},{"path":"/usr/libexec/git-core/git-format-patch"},{"path":"/usr/libexec/git-core/git-fsck"},{"path":"/usr/libexec/git-core/git-fsck-objects"},{"path":"/usr/libexec/git-core/git-gc"},{"path":"/usr/libexec/git-core/git-get-tar-commit-id"},{"path":"/usr/libexec/git-core/git-grep"},{"path":"/usr/libexec/git-core/git-hash-object"},{"path":"/usr/libexec/git-core/git-help"},{"path":"/usr/libexec/git-core/git-http-fetch"},{"path":"/usr/libexec/git-core/git-http-push"},{"path":"/usr/libexec/git-core/git-index-pack"},{"path":"/usr/libexec/git-core/git-init"},{"path":"/usr/libexec/git-core/git-init-db"},{"path":"/usr/libexec/git-core/git-interpret-trailers"},{"path":"/usr/libexec/git-core/git-log"},{"path":"/usr/libexec/git-core/git-ls-files"},{"path":"/usr/libexec/git-core/git-ls-remote"},{"path":"/usr/libexec/git-core/git-ls-tree"},{"path":"/usr/libexec/git-core/git-mailinfo"},{"path":"/usr/libexec/git-core/git-mailsplit"},{"path":"/usr/libexec/git-core/git-maintenance"},{"path":"/usr/libexec/git-core/git-merge"},{"path":"/usr/libexec/git-core/git-merge-base"},{"path":"/usr/libexec/git-core/git-merge-file"},{"path":"/usr/libexec/git-core/git-merge-index"},{"path":"/usr/libexec/git-core/git-merge-octopus"},{"path":"/usr/libexec/git-core/git-merge-one-file"},{"path":"/usr/libexec/git-core/git-merge-ours"},{"path":"/usr/libexec/git-core/git-merge-recursive"},{"path":"/usr/libexec/git-core/git-merge-resolve"},{"path":"/usr/libexec/git-core/git-merge-subtree"},{"path":"/usr/libexec/git-core/git-merge-tree"},{"path":"/usr/libexec/git-core/git-mergetool"},{"path":"/usr/libexec/git-core/git-mergetool--lib"},{"path":"/usr/libexec/git-core/git-mktag"},{"path":"/usr/libexec/git-core/git-mktree"},{"path":"/usr/libexec/git-core/git-multi-pack-index"},{"path":"/usr/libexec/git-core/git-mv"},{"path":"/usr/libexec/git-core/git-name-rev"},{"path":"/usr/libexec/git-core/git-notes"},{"path":"/usr/libexec/git-core/git-pack-objects"},{"path":"/usr/libexec/git-core/git-pack-redundant"},{"path":"/usr/libexec/git-core/git-pack-refs"},{"path":"/usr/libexec/git-core/git-patch-id"},{"path":"/usr/libexec/git-core/git-prune"},{"path":"/usr/libexec/git-core/git-prune-packed"},{"path":"/usr/libexec/git-core/git-pull"},{"path":"/usr/libexec/git-core/git-push"},{"path":"/usr/libexec/git-core/git-quiltimport"},{"path":"/usr/libexec/git-core/git-range-diff"},{"path":"/usr/libexec/git-core/git-read-tree"},{"path":"/usr/libexec/git-core/git-rebase"},{"path":"/usr/libexec/git-core/git-rebase--preserve-merges"},{"path":"/usr/libexec/git-core/git-receive-pack"},{"path":"/usr/libexec/git-core/git-reflog"},{"path":"/usr/libexec/git-core/git-remote"},{"path":"/usr/libexec/git-core/git-remote-ext"},{"path":"/usr/libexec/git-core/git-remote-fd"},{"path":"/usr/libexec/git-core/git-remote-ftp"},{"path":"/usr/libexec/git-core/git-remote-ftps"},{"path":"/usr/libexec/git-core/git-remote-http"},{"path":"/usr/libexec/git-core/git-remote-https"},{"path":"/usr/libexec/git-core/git-repack"},{"path":"/usr/libexec/git-core/git-replace"},{"path":"/usr/libexec/git-core/git-request-pull"},{"path":"/usr/libexec/git-core/git-rerere"},{"path":"/usr/libexec/git-core/git-reset"},{"path":"/usr/libexec/git-core/git-restore"},{"path":"/usr/libexec/git-core/git-rev-list"},{"path":"/usr/libexec/git-core/git-rev-parse"},{"path":"/usr/libexec/git-core/git-revert"},{"path":"/usr/libexec/git-core/git-rm"},{"path":"/usr/libexec/git-core/git-send-pack"},{"path":"/usr/libexec/git-core/git-sh-i18n"},{"path":"/usr/libexec/git-core/git-sh-i18n--envsubst"},{"path":"/usr/libexec/git-core/git-sh-setup"},{"path":"/usr/libexec/git-core/git-shortlog"},{"path":"/usr/libexec/git-core/git-show"},{"path":"/usr/libexec/git-core/git-show-branch"},{"path":"/usr/libexec/git-core/git-show-index"},{"path":"/usr/libexec/git-core/git-show-ref"},{"path":"/usr/libexec/git-core/git-sparse-checkout"},{"path":"/usr/libexec/git-core/git-stage"},{"path":"/usr/libexec/git-core/git-stash"},{"path":"/usr/libexec/git-core/git-status"},{"path":"/usr/libexec/git-core/git-stripspace"},{"path":"/usr/libexec/git-core/git-submodule"},{"path":"/usr/libexec/git-core/git-submodule--helper"},{"path":"/usr/libexec/git-core/git-switch"},{"path":"/usr/libexec/git-core/git-symbolic-ref"},{"path":"/usr/libexec/git-core/git-tag"},{"path":"/usr/libexec/git-core/git-unpack-file"},{"path":"/usr/libexec/git-core/git-unpack-objects"},{"path":"/usr/libexec/git-core/git-update-index"},{"path":"/usr/libexec/git-core/git-update-ref"},{"path":"/usr/libexec/git-core/git-update-server-info"},{"path":"/usr/libexec/git-core/git-upload-archive"},{"path":"/usr/libexec/git-core/git-upload-pack"},{"path":"/usr/libexec/git-core/git-var"},{"path":"/usr/libexec/git-core/git-verify-commit"},{"path":"/usr/libexec/git-core/git-verify-pack"},{"path":"/usr/libexec/git-core/git-verify-tag"},{"path":"/usr/libexec/git-core/git-web--browse"},{"path":"/usr/libexec/git-core/git-whatchanged"},{"path":"/usr/libexec/git-core/git-worktree"},{"path":"/usr/libexec/git-core/git-write-tree"},{"path":"/usr/libexec/git-core/mergetools"},{"path":"/usr/libexec/git-core/mergetools/araxis"},{"path":"/usr/libexec/git-core/mergetools/bc"},{"path":"/usr/libexec/git-core/mergetools/codecompare"},{"path":"/usr/libexec/git-core/mergetools/deltawalker"},{"path":"/usr/libexec/git-core/mergetools/diffmerge"},{"path":"/usr/libexec/git-core/mergetools/diffuse"},{"path":"/usr/libexec/git-core/mergetools/ecmerge"},{"path":"/usr/libexec/git-core/mergetools/emerge"},{"path":"/usr/libexec/git-core/mergetools/examdiff"},{"path":"/usr/libexec/git-core/mergetools/guiffy"},{"path":"/usr/libexec/git-core/mergetools/gvimdiff"},{"path":"/usr/libexec/git-core/mergetools/kdiff3"},{"path":"/usr/libexec/git-core/mergetools/kompare"},{"path":"/usr/libexec/git-core/mergetools/meld"},{"path":"/usr/libexec/git-core/mergetools/nvimdiff"},{"path":"/usr/libexec/git-core/mergetools/opendiff"},{"path":"/usr/libexec/git-core/mergetools/smerge"},{"path":"/usr/libexec/git-core/mergetools/tkdiff"},{"path":"/usr/libexec/git-core/mergetools/tortoisemerge"},{"path":"/usr/libexec/git-core/mergetools/vimdiff"},{"path":"/usr/libexec/git-core/mergetools/winmerge"},{"path":"/usr/libexec/git-core/mergetools/xxdiff"},{"path":"/usr/share"},{"path":"/usr/share/git-core"},{"path":"/usr/share/git-core/templates"},{"path":"/usr/share/git-core/templates/description"},{"path":"/usr/share/git-core/templates/branches"},{"path":"/usr/share/git-core/templates/hooks"},{"path":"/usr/share/git-core/templates/hooks/applypatch-msg.sample"},{"path":"/usr/share/git-core/templates/hooks/commit-msg.sample"},{"path":"/usr/share/git-core/templates/hooks/post-update.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-applypatch.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-commit.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-merge-commit.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-push.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-rebase.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-receive.sample"},{"path":"/usr/share/git-core/templates/hooks/prepare-commit-msg.sample"},{"path":"/usr/share/git-core/templates/hooks/push-to-checkout.sample"},{"path":"/usr/share/git-core/templates/hooks/update.sample"},{"path":"/usr/share/git-core/templates/info"},{"path":"/usr/share/git-core/templates/info/exclude"},{"path":"/usr/share/perl5"},{"path":"/var"},{"path":"/var/git"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"git"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2023-22490","versionConstraint":"< 2.30.8||>= 2.31.0, < 2.31.7||>= 2.32.0, < 2.32.6||>= 2.33.0, < 2.33.7||>= 2.34.0, < 2.34.7||>= 2.35.0, < 2.35.7||>= 2.36.0, < 2.36.5||>= 2.37.0, < 2.37.6||>= 2.38.0, < 2.38.4||>= 2.39.0, < 2.39.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:git-scm:git:2.30.6:*:*:*:*:*:*:*"],"package":{"name":"git","version":"2.30.6-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2023-22490","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-22490","cwe":"CWE-59","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2023-22490","cwe":"CWE-59","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-22490","date":"2026-10-08","epss":0.0071,"percentile":0.52097}],"risk":0.37275,"urls":["https://github.com/git/git/commit/c867e4fa180bec4750e9b54eb10f459030dbebfd","https://github.com/git/git/security/advisories/GHSA-3wp6-j8xr-qw85","https://github.com/git/git/security/advisories/GHSA-gw92-x3fm-3g3q","https://security.gentoo.org/glsa/202312-15"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-22490","description":"Git is a revision control system. Using a specially-crafted repository, Git prior to versions 2.39.2, 2.38.4, 2.37.6, 2.36.5, 2.35.7, 2.34.7, 2.33.7, 2.32.6, 2.31.7, and 2.30.8 can be tricked into using its local clone optimization even when using a non-local transport. Though Git will abort local clones whose source `$GIT_DIR/objects` directory contains symbolic links, the `objects` directory itself may still be a symbolic link. These two may be combined to include arbitrary files based on known paths on the victim's filesystem within the malicious repository's working copy, allowing for data exfiltration in a similar manner as CVE-2022-39253.\n\nA fix has been prepared and will appear in v2.39.2 v2.38.4 v2.37.6 v2.36.5 v2.35.7 v2.34.7 v2.33.7 v2.32.6, v2.31.7 and v2.30.8. If upgrading is impractical, two short-term workarounds are available. Avoid cloning repositories from untrusted sources with `--recurse-submodules`. Instead, consider cloning repositories without recursively cloning their submodules, and instead run `git submodule update` at each layer. Before doing so, inspect each new `.gitmodules` file to ensure that it does not contain suspicious module URLs."},"relatedVulnerabilities":[]},{"artifact":{"id":"a45c752c9b8878aa","cpes":["cpe:2.3:a:php7:php7:7.4.26-r0:*:*:*:*:*:*:*","cpe:2.3:a:php7:php:7.4.26-r0:*:*:*:*:*:*:*","cpe:2.3:a:php:php7:7.4.26-r0:*:*:*:*:*:*:*","cpe:2.3:a:php:php:7.4.26-r0:*:*:*:*:*:*:*"],"name":"php7","purl":"pkg:apk/busybox/php7@7.4.26-r0?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"7.4.26-r0","language":"","licenses":["BSD-3-Clause","LGPL-2.0-or-later","MIT","PHP-3.01","Zend-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/php"},{"path":"/usr/bin/php7"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"php7"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:php:php:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-14177","versionConstraint":"< 8.1.34||>= 8.2.0, < 8.2.30||>= 8.3.0, < 8.3.29||>= 8.4.0, < 8.4.16||>= 8.5.0, < 8.5.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:php:php:7.4.26:*:*:*:*:*:*:*"],"package":{"name":"php7","version":"7.4.26-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2025-14177","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security@php.net","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-14177","cwe":"CWE-125","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2025-14177","date":"2026-10-08","epss":0.00508,"percentile":0.41517}],"risk":0.36576,"urls":["https://github.com/php/php-src/security/advisories/GHSA-3237-qqm7-mfv7"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-14177","description":"In PHP versions:8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1, the getimagesize() function may leak uninitialized heap memory into the APPn segments (e.g., APP1) when reading images in multi-chunk mode (such as via php://filter). This occurs due to a bug in php_read_stream_all_chunks() that overwrites the buffer without advancing the pointer, leaving tail bytes uninitialized. This may lead to information disclosure of sensitive heap data and affect the confidentiality of the target server."},"relatedVulnerabilities":[]},{"artifact":{"id":"6040784032e8795c","cpes":["cpe:2.3:a:curl:curl:7.79.1-r3:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:7.79.1-r3:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/busybox/curl@7.79.1-r3?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"7.79.1-r3","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-14524","versionConstraint":">= 7.33.0, < 8.18.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:haxx:curl:7.79.1:*:*:*:*:*:*:*"],"package":{"name":"curl","version":"7.79.1-r3"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2025-14524","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-14524","cwe":"CWE-522","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2025-14524","cwe":"CWE-601","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-14524","date":"2026-10-08","epss":0.0068,"percentile":0.50927}],"risk":0.3502,"urls":["https://curl.se/docs/CVE-2025-14524.html","https://curl.se/docs/CVE-2025-14524.json","https://hackerone.com/reports/3459417","http://www.openwall.com/lists/oss-security/2026/01/07/4"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-14524","description":"When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer\nperforms a cross-protocol redirect to a second URL that uses an IMAP, LDAP,\nPOP3 or SMTP scheme, curl might wrongly pass on the bearer token to the new\ntarget host."},"relatedVulnerabilities":[]},{"artifact":{"id":"a45c752c9b8878aa","cpes":["cpe:2.3:a:php7:php7:7.4.26-r0:*:*:*:*:*:*:*","cpe:2.3:a:php7:php:7.4.26-r0:*:*:*:*:*:*:*","cpe:2.3:a:php:php7:7.4.26-r0:*:*:*:*:*:*:*","cpe:2.3:a:php:php:7.4.26-r0:*:*:*:*:*:*:*"],"name":"php7","purl":"pkg:apk/busybox/php7@7.4.26-r0?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"7.4.26-r0","language":"","licenses":["BSD-3-Clause","LGPL-2.0-or-later","MIT","PHP-3.01","Zend-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/php"},{"path":"/usr/bin/php7"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"php7"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:php:php:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-14178","versionConstraint":"< 8.1.34||>= 8.2.0, < 8.2.30||>= 8.3.0, < 8.3.29||>= 8.4.0, < 8.4.16||>= 8.5.0, < 8.5.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:php:php:7.4.26:*:*:*:*:*:*:*"],"package":{"name":"php7","version":"7.4.26-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2025-14178","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-14178","cwe":"CWE-190","type":"Secondary","source":"security@php.net"},{"cve":"CVE-2025-14178","cwe":"CWE-787","type":"Secondary","source":"security@php.net"},{"cve":"CVE-2025-14178","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-14178","date":"2026-10-08","epss":0.00459,"percentile":0.37761}],"risk":0.3408075,"urls":["https://github.com/php/php-src/security/advisories/GHSA-h96m-rvf9-jgm2","https://lists.debian.org/debian-lts-announce/2026/01/msg00019.html"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-14178","description":"In PHP versions:8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1, a heap buffer overflow occurs in array_merge() when the total element count of packed arrays exceeds 32-bit limits or HT_MAX_SIZE, due to an integer overflow in the precomputation of element counts using zend_hash_num_elements(). This may lead to memory corruption or crashes and affect the integrity and availability of the target server."},"relatedVulnerabilities":[]},{"artifact":{"id":"422a442f930ca27c","cpes":["cpe:2.3:a:nginx:nginx:1.18.0-r15:*:*:*:*:*:*:*"],"name":"nginx","purl":"pkg:apk/busybox/nginx@1.18.0-r15?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"1.18.0-r15","language":"","licenses":["BSD-2-Clause"],"metadata":{"Arch":"x86_64","files":[{"path":"/etc"},{"path":"/etc/logrotate.d"},{"path":"/etc/logrotate.d/nginx"},{"path":"/etc/nginx"},{"path":"/etc/nginx/fastcgi.conf"},{"path":"/etc/nginx/fastcgi_params"},{"path":"/etc/nginx/mime.types"},{"path":"/etc/nginx/nginx.conf"},{"path":"/etc/nginx/scgi_params"},{"path":"/etc/nginx/uwsgi_params"},{"path":"/etc/nginx/http.d"},{"path":"/etc/nginx/modules"},{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/nginx"},{"path":"/usr/lib/nginx/modules"},{"path":"/usr/sbin"},{"path":"/usr/sbin/nginx"},{"path":"/usr/share"},{"path":"/usr/share/nginx"},{"path":"/usr/share/nginx/http-default_server.conf"},{"path":"/var"},{"path":"/var/lib"},{"path":"/var/lib/nginx"},{"path":"/var/lib/nginx/logs"},{"path":"/var/lib/nginx/modules"},{"path":"/var/lib/nginx/run"},{"path":"/var/lib/nginx/html"},{"path":"/var/lib/nginx/html/50x.html"},{"path":"/var/lib/nginx/html/index.html"},{"path":"/var/lib/nginx/tmp"},{"path":"/var/log"},{"path":"/var/log/nginx"},{"path":"/var/www"},{"path":"/var/www/localhost"},{"path":"/var/www/localhost/htdocs"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"nginx"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:nginx:nginx:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-56434","versionConstraint":">= 0.8.11, < 1.30.4||>= 1.31.0, < 1.31.3 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:nginx:nginx:1.18.0:*:*:*:*:*:*:*"],"package":{"name":"nginx","version":"1.18.0-r15"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-56434","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"f5sirt@f5.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"f5sirt@f5.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56434","cwe":"CWE-416","type":"Secondary","source":"f5sirt@f5.com"}],"epss":[{"cve":"CVE-2026-56434","date":"2026-10-08","epss":0.00419,"percentile":0.34233}],"risk":0.312155,"urls":["https://my.f5.com/manage/s/article/K000162098"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56434","description":"NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_ssi_module module. This vulnerability may exist when the Server-Side Includes (SSI), proxy_pass, and proxy_buffering off directives are configured. With this configuration, an unauthenticated attacker with man-in-the-middle (MITM) ability to control responses from an upstream server may be able to cause a use-after-free in the NGINX worker process. This issue may lead to limited modification of memory or a restart of the NGINX worker process.\n\nImpact:\nThis vulnerability may allow remote attackers to have limited control to modify memory contents or restart the NGINX worker process. There is no control plane exposure; this is a data plane issue only.\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated."},"relatedVulnerabilities":[]},{"artifact":{"id":"d081de97c6f633df","cpes":["cpe:2.3:a:libcrypto1.1:libcrypto1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto1.1:libcrypto:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto:libcrypto1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto:libcrypto:1.1.1q-r0:*:*:*:*:*:*:*"],"name":"libcrypto1.1","purl":"pkg:apk/busybox/libcrypto1.1@1.1.1q-r0?arch=x86_64&distro=busybox-1.32.1&upstream=openssl","type":"apk","version":"1.1.1q-r0","language":"","licenses":["OpenSSL"],"metadata":{"Arch":"x86_64","files":[{"path":"/etc"},{"path":"/etc/ssl"},{"path":"/etc/ssl/ct_log_list.cnf"},{"path":"/etc/ssl/ct_log_list.cnf.dist"},{"path":"/etc/ssl/openssl.cnf"},{"path":"/etc/ssl/openssl.cnf.dist"},{"path":"/etc/ssl/certs"},{"path":"/etc/ssl/misc"},{"path":"/etc/ssl/misc/CA.pl"},{"path":"/etc/ssl/misc/tsget"},{"path":"/etc/ssl/misc/tsget.pl"},{"path":"/etc/ssl/private"},{"path":"/lib"},{"path":"/lib/libcrypto.so.1.1"},{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcrypto.so.1.1"},{"path":"/usr/lib/engines-1.1"},{"path":"/usr/lib/engines-1.1/afalg.so"},{"path":"/usr/lib/engines-1.1/capi.so"},{"path":"/usr/lib/engines-1.1/padlock.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-84782","versionConstraint":">= 1.0.2, < 1.0.2zs||>= 1.1.1, < 1.1.1zj||>= 3.0.0, < 3.0.23||>= 3.4.0, < 3.4.8||>= 3.5.0, < 3.5.9||>= 3.6.0, < 3.6.5||>= 4.0.0, < 4.0.3 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:1.1.1q:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"1.1.1q-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-84782","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84782","cwe":"CWE-125","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-84782","date":"2026-10-08","epss":0.0039,"percentile":0.31045}],"risk":0.30615,"urls":["https://github.com/openssl/openssl/commit/906cf0ef1c85ca40ce69163e9086d6d3fe292943","https://github.com/openssl/openssl/commit/9f6b34422af7eb5dac61322e33dac1ae989fa628","https://github.com/openssl/openssl/commit/a383dafdd754eb5b22bf45e37e1bff9d07277a58","https://github.com/openssl/openssl/commit/d951e02ede8f6a6ff8150546db44b34f0518192c","https://openssl-library.org/news/secadv/20260929.txt"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84782","description":"Issue summary: The DTLS retransmission logic does not correctly handle\na handshake message write that is suspended part-way through.\nThe retransmitted message can be read past the message buffer and\nthe retransmission overwrites the internal state the suspended write\nneeds to resume correctly.\n\nImpact summary: The retransmitted message can disclose a heap memory\nto the peer as plaintext handshake data or cause a crash and a Denial\nof Service when the read reaches an unmapped memory region.\n\nCWE: CWE-125: Out-of-bounds Read\n\nDescription: DTLS handshake messages can be written out in multiple\nfragments, and a write can suspend mid-message (returning WANT_WRITE)\nif the underlying transport temporarily cannot accept more data. While\nsuch a write is suspended, the DTLS retransmission timer may\nindependently fire and ask the retransmission logic to resend an\nearlier, already-acknowledged-as-sent message from its retransmit\nqueue.\n\nThe retransmission logic reused the same internal buffer and position\ntracking as the message that was still being written, without\nresetting the position back to the start of the message being\nretransmitted. As a result the retransmission was read starting from\nwherever the suspended write had left off, producing a mislabelled\nmessage whose body was leftover bytes from the other, larger message\nstill in flight - content that was never meant to be sent at that\npoint, and which could run past the end of the allocated buffer.\n\nSeparately, even when the retransmission is positioned correctly,\nallowing it to run to completion while another write is suspended\noverwrites the same shared bookkeeping that the suspended write\ndepends on to resume. When the application later resumes the\nsuspended write (via a subsequent SSL_read(), SSL_write(),\nSSL_accept(), or SSL_connect() call), it finds that bookkeeping in a\nstate inconsistent with the message and aborts the process in\na debugging build.\n\nThe fix resets the retransmission's read position to the start of the\nmessage before resending, and skips retransmission entirely whenever a\nhandshake write is still suspended, deferring to the next call that\nresumes it instead.\n\nFIPS impact: no\nThe affected code is outside the FIPS module boundary."},"relatedVulnerabilities":[]},{"artifact":{"id":"74f4e71ff41d2d68","cpes":["cpe:2.3:a:libssl1.1:libssl1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl1.1:libssl:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl:1.1.1q-r0:*:*:*:*:*:*:*"],"name":"libssl1.1","purl":"pkg:apk/busybox/libssl1.1@1.1.1q-r0?arch=x86_64&distro=busybox-1.32.1&upstream=openssl","type":"apk","version":"1.1.1q-r0","language":"","licenses":["OpenSSL"],"metadata":{"Arch":"x86_64","files":[{"path":"/lib"},{"path":"/lib/libssl.so.1.1"},{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libssl.so.1.1"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-84782","versionConstraint":">= 1.0.2, < 1.0.2zs||>= 1.1.1, < 1.1.1zj||>= 3.0.0, < 3.0.23||>= 3.4.0, < 3.4.8||>= 3.5.0, < 3.5.9||>= 3.6.0, < 3.6.5||>= 4.0.0, < 4.0.3 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:1.1.1q:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"1.1.1q-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-84782","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84782","cwe":"CWE-125","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-84782","date":"2026-10-08","epss":0.0039,"percentile":0.31045}],"risk":0.30615,"urls":["https://github.com/openssl/openssl/commit/906cf0ef1c85ca40ce69163e9086d6d3fe292943","https://github.com/openssl/openssl/commit/9f6b34422af7eb5dac61322e33dac1ae989fa628","https://github.com/openssl/openssl/commit/a383dafdd754eb5b22bf45e37e1bff9d07277a58","https://github.com/openssl/openssl/commit/d951e02ede8f6a6ff8150546db44b34f0518192c","https://openssl-library.org/news/secadv/20260929.txt"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84782","description":"Issue summary: The DTLS retransmission logic does not correctly handle\na handshake message write that is suspended part-way through.\nThe retransmitted message can be read past the message buffer and\nthe retransmission overwrites the internal state the suspended write\nneeds to resume correctly.\n\nImpact summary: The retransmitted message can disclose a heap memory\nto the peer as plaintext handshake data or cause a crash and a Denial\nof Service when the read reaches an unmapped memory region.\n\nCWE: CWE-125: Out-of-bounds Read\n\nDescription: DTLS handshake messages can be written out in multiple\nfragments, and a write can suspend mid-message (returning WANT_WRITE)\nif the underlying transport temporarily cannot accept more data. While\nsuch a write is suspended, the DTLS retransmission timer may\nindependently fire and ask the retransmission logic to resend an\nearlier, already-acknowledged-as-sent message from its retransmit\nqueue.\n\nThe retransmission logic reused the same internal buffer and position\ntracking as the message that was still being written, without\nresetting the position back to the start of the message being\nretransmitted. As a result the retransmission was read starting from\nwherever the suspended write had left off, producing a mislabelled\nmessage whose body was leftover bytes from the other, larger message\nstill in flight - content that was never meant to be sent at that\npoint, and which could run past the end of the allocated buffer.\n\nSeparately, even when the retransmission is positioned correctly,\nallowing it to run to completion while another write is suspended\noverwrites the same shared bookkeeping that the suspended write\ndepends on to resume. When the application later resumes the\nsuspended write (via a subsequent SSL_read(), SSL_write(),\nSSL_accept(), or SSL_connect() call), it finds that bookkeeping in a\nstate inconsistent with the message and aborts the process in\na debugging build.\n\nThe fix resets the retransmission's read position to the start of the\nmessage before resending, and skips retransmission entirely whenever a\nhandshake write is still suspended, deferring to the next call that\nresumes it instead.\n\nFIPS impact: no\nThe affected code is outside the FIPS module boundary."},"relatedVulnerabilities":[]},{"artifact":{"id":"14807b4f7067817d","cpes":["cpe:2.3:a:openssl:openssl:1.1.1q-r0:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:apk/busybox/openssl@1.1.1q-r0?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"1.1.1q-r0","language":"","licenses":["OpenSSL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/openssl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-84782","versionConstraint":">= 1.0.2, < 1.0.2zs||>= 1.1.1, < 1.1.1zj||>= 3.0.0, < 3.0.23||>= 3.4.0, < 3.4.8||>= 3.5.0, < 3.5.9||>= 3.6.0, < 3.6.5||>= 4.0.0, < 4.0.3 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:1.1.1q:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"1.1.1q-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-84782","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84782","cwe":"CWE-125","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-84782","date":"2026-10-08","epss":0.0039,"percentile":0.31045}],"risk":0.30615,"urls":["https://github.com/openssl/openssl/commit/906cf0ef1c85ca40ce69163e9086d6d3fe292943","https://github.com/openssl/openssl/commit/9f6b34422af7eb5dac61322e33dac1ae989fa628","https://github.com/openssl/openssl/commit/a383dafdd754eb5b22bf45e37e1bff9d07277a58","https://github.com/openssl/openssl/commit/d951e02ede8f6a6ff8150546db44b34f0518192c","https://openssl-library.org/news/secadv/20260929.txt"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84782","description":"Issue summary: The DTLS retransmission logic does not correctly handle\na handshake message write that is suspended part-way through.\nThe retransmitted message can be read past the message buffer and\nthe retransmission overwrites the internal state the suspended write\nneeds to resume correctly.\n\nImpact summary: The retransmitted message can disclose a heap memory\nto the peer as plaintext handshake data or cause a crash and a Denial\nof Service when the read reaches an unmapped memory region.\n\nCWE: CWE-125: Out-of-bounds Read\n\nDescription: DTLS handshake messages can be written out in multiple\nfragments, and a write can suspend mid-message (returning WANT_WRITE)\nif the underlying transport temporarily cannot accept more data. While\nsuch a write is suspended, the DTLS retransmission timer may\nindependently fire and ask the retransmission logic to resend an\nearlier, already-acknowledged-as-sent message from its retransmit\nqueue.\n\nThe retransmission logic reused the same internal buffer and position\ntracking as the message that was still being written, without\nresetting the position back to the start of the message being\nretransmitted. As a result the retransmission was read starting from\nwherever the suspended write had left off, producing a mislabelled\nmessage whose body was leftover bytes from the other, larger message\nstill in flight - content that was never meant to be sent at that\npoint, and which could run past the end of the allocated buffer.\n\nSeparately, even when the retransmission is positioned correctly,\nallowing it to run to completion while another write is suspended\noverwrites the same shared bookkeeping that the suspended write\ndepends on to resume. When the application later resumes the\nsuspended write (via a subsequent SSL_read(), SSL_write(),\nSSL_accept(), or SSL_connect() call), it finds that bookkeeping in a\nstate inconsistent with the message and aborts the process in\na debugging build.\n\nThe fix resets the retransmission's read position to the start of the\nmessage before resending, and skips retransmission entirely whenever a\nhandshake write is still suspended, deferring to the next call that\nresumes it instead.\n\nFIPS impact: no\nThe affected code is outside the FIPS module boundary."},"relatedVulnerabilities":[]},{"artifact":{"id":"6040784032e8795c","cpes":["cpe:2.3:a:curl:curl:7.79.1-r3:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:7.79.1-r3:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/busybox/curl@7.79.1-r3?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"7.79.1-r3","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-7168","versionConstraint":">= 7.12.0, < 8.20.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:haxx:curl:7.79.1:*:*:*:*:*:*:*"],"package":{"name":"curl","version":"7.79.1-r3"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-7168","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-7168","cwe":"CWE-294","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-7168","cwe":"CWE-294","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-7168","date":"2026-10-08","epss":0.00591,"percentile":0.46599}],"risk":0.304365,"urls":["https://curl.se/docs/CVE-2026-7168.html","https://curl.se/docs/CVE-2026-7168.json","https://hackerone.com/reports/3697719","http://www.openwall.com/lists/oss-security/2026/04/29/14"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-7168","description":"Successfully using libcurl to do a transfer over a specific HTTP proxy\n(`proxyA`) with **Digest** authentication and then changing the proxy host to\na second one (`proxyB`) for a second transfer, reusing the same handle, makes\nlibcurl wrongly pass on the `Proxy-Authorization:` header field meant for\n`proxyA`, to `proxyB`."},"relatedVulnerabilities":[]},{"artifact":{"id":"90f72c5b07fcdbc9","cpes":["cpe:2.3:a:busybox:busybox:1.32.1-r9:*:*:*:*:*:*:*"],"name":"busybox","purl":"pkg:apk/busybox/busybox@1.32.1-r9?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"1.32.1-r9","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/bin"},{"path":"/bin/busybox"},{"path":"/bin/sh"},{"path":"/etc"},{"path":"/etc/securetty"},{"path":"/etc/udhcpd.conf"},{"path":"/etc/logrotate.d"},{"path":"/etc/logrotate.d/acpid"},{"path":"/etc/network"},{"path":"/etc/network/if-down.d"},{"path":"/etc/network/if-post-down.d"},{"path":"/etc/network/if-post-up.d"},{"path":"/etc/network/if-pre-down.d"},{"path":"/etc/network/if-pre-up.d"},{"path":"/etc/network/if-up.d"},{"path":"/etc/network/if-up.d/dad"},{"path":"/sbin"},{"path":"/tmp"},{"path":"/usr"},{"path":"/usr/sbin"},{"path":"/usr/share"},{"path":"/usr/share/udhcpc"},{"path":"/usr/share/udhcpc/default.script"},{"path":"/var"},{"path":"/var/cache"},{"path":"/var/cache/misc"},{"path":"/var/lib"},{"path":"/var/lib/udhcpd"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"busybox"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:busybox:busybox:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2021-42374","versionConstraint":">= 1.27.0, <= 1.33.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:busybox:busybox:1.32.1:*:*:*:*:*:*:*"],"package":{"name":"busybox","version":"1.32.1-r9"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2021-42374","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":5.3,"impactScore":4.3,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:L/AC:M/Au:N/C:P/I:N/A:P","metrics":{"baseScore":3.3,"impactScore":5,"exploitabilityScore":3.4},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":5.3,"impactScore":4.3,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-42374","cwe":"CWE-125","type":"Secondary","source":"reefs@jfrog.com"},{"cve":"CVE-2021-42374","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-42374","date":"2026-10-08","epss":0.00623,"percentile":0.48237}],"risk":0.30007833333333334,"urls":["https://claroty.com/team82/research/unboxing-busybox-14-vulnerabilities-uncovered-by-claroty-jfrog","https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/","https://security.netapp.com/advisory/ntap-20211223-0002/","https://lists.debian.org/debian-lts-announce/2025/01/msg00012.html"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-42374","description":"An out-of-bounds heap read in Busybox's unlzma applet leads to information leak and denial of service when crafted LZMA-compressed input is decompressed. This can be triggered by any applet/format that"},"relatedVulnerabilities":[]},{"artifact":{"id":"35fec91b9e067f61","cpes":["cpe:2.3:a:ssl-client:ssl-client:1.32.1-r9:*:*:*:*:*:*:*","cpe:2.3:a:ssl-client:ssl_client:1.32.1-r9:*:*:*:*:*:*:*","cpe:2.3:a:ssl_client:ssl-client:1.32.1-r9:*:*:*:*:*:*:*","cpe:2.3:a:ssl_client:ssl_client:1.32.1-r9:*:*:*:*:*:*:*","cpe:2.3:a:ssl:ssl-client:1.32.1-r9:*:*:*:*:*:*:*","cpe:2.3:a:ssl:ssl_client:1.32.1-r9:*:*:*:*:*:*:*"],"name":"ssl_client","purl":"pkg:apk/busybox/ssl_client@1.32.1-r9?arch=x86_64&distro=busybox-1.32.1&upstream=busybox","type":"apk","version":"1.32.1-r9","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/ssl_client"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"busybox"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:busybox:busybox:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2021-42374","versionConstraint":">= 1.27.0, <= 1.33.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:busybox:busybox:1.32.1:*:*:*:*:*:*:*"],"package":{"name":"busybox","version":"1.32.1-r9"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2021-42374","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":5.3,"impactScore":4.3,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:L/AC:M/Au:N/C:P/I:N/A:P","metrics":{"baseScore":3.3,"impactScore":5,"exploitabilityScore":3.4},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":5.3,"impactScore":4.3,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-42374","cwe":"CWE-125","type":"Secondary","source":"reefs@jfrog.com"},{"cve":"CVE-2021-42374","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-42374","date":"2026-10-08","epss":0.00623,"percentile":0.48237}],"risk":0.30007833333333334,"urls":["https://claroty.com/team82/research/unboxing-busybox-14-vulnerabilities-uncovered-by-claroty-jfrog","https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/","https://security.netapp.com/advisory/ntap-20211223-0002/","https://lists.debian.org/debian-lts-announce/2025/01/msg00012.html"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-42374","description":"An out-of-bounds heap read in Busybox's unlzma applet leads to information leak and denial of service when crafted LZMA-compressed input is decompressed. This can be triggered by any applet/format that"},"relatedVulnerabilities":[]},{"artifact":{"id":"6040784032e8795c","cpes":["cpe:2.3:a:curl:curl:7.79.1-r3:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:7.79.1-r3:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/busybox/curl@7.79.1-r3?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"7.79.1-r3","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-8932","versionConstraint":">= 7.7, < 8.21.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:haxx:curl:7.79.1:*:*:*:*:*:*:*"],"package":{"name":"curl","version":"7.79.1-r3"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-8932","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8932","cwe":"CWE-305","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-8932","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-8932","date":"2026-10-08","epss":0.00396,"percentile":0.31723}],"risk":0.297,"urls":["https://curl.se/docs/CVE-2026-8932.html","https://curl.se/docs/CVE-2026-8932.json","https://hackerone.com/reports/3733910"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8932","description":"libcurl would reuse a previously created connection even when some mTLS config\nrelated option had been changed that should have prohibited reuse.\n\nlibcurl keeps previously used connections in a connection pool for subsequent\ntransfers to reuse if one of them matches the setup. However, some TLS\nsettings related to client certificates were left out from the configuration\nmatch checks, making them match too easily. In particular options related to\nthe private key."},"relatedVulnerabilities":[]},{"artifact":{"id":"d081de97c6f633df","cpes":["cpe:2.3:a:libcrypto1.1:libcrypto1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto1.1:libcrypto:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto:libcrypto1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto:libcrypto:1.1.1q-r0:*:*:*:*:*:*:*"],"name":"libcrypto1.1","purl":"pkg:apk/busybox/libcrypto1.1@1.1.1q-r0?arch=x86_64&distro=busybox-1.32.1&upstream=openssl","type":"apk","version":"1.1.1q-r0","language":"","licenses":["OpenSSL"],"metadata":{"Arch":"x86_64","files":[{"path":"/etc"},{"path":"/etc/ssl"},{"path":"/etc/ssl/ct_log_list.cnf"},{"path":"/etc/ssl/ct_log_list.cnf.dist"},{"path":"/etc/ssl/openssl.cnf"},{"path":"/etc/ssl/openssl.cnf.dist"},{"path":"/etc/ssl/certs"},{"path":"/etc/ssl/misc"},{"path":"/etc/ssl/misc/CA.pl"},{"path":"/etc/ssl/misc/tsget"},{"path":"/etc/ssl/misc/tsget.pl"},{"path":"/etc/ssl/private"},{"path":"/lib"},{"path":"/lib/libcrypto.so.1.1"},{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcrypto.so.1.1"},{"path":"/usr/lib/engines-1.1"},{"path":"/usr/lib/engines-1.1/afalg.so"},{"path":"/usr/lib/engines-1.1/capi.so"},{"path":"/usr/lib/engines-1.1/padlock.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-22796","versionConstraint":">= 1.0.2, < 1.0.2zn||>= 1.1.1, < 1.1.1ze||>= 3.0.0, < 3.0.19||>= 3.3.0, < 3.3.6||>= 3.4.0, < 3.4.4||>= 3.5.0, < 3.5.5||>= 3.6.0, < 3.6.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:1.1.1q:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"1.1.1q-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-22796","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-22796","cwe":"CWE-754","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-22796","date":"2026-10-08","epss":0.00576,"percentile":0.45751}],"risk":0.29664,"urls":["https://github.com/openssl/openssl/commit/2502e7b7d4c0cf4f972a881641fe09edc67aeec4","https://github.com/openssl/openssl/commit/572844beca95068394c916626a6d3a490f831a49","https://github.com/openssl/openssl/commit/7bbca05be55b129651d9df4bdb92becc45002c12","https://github.com/openssl/openssl/commit/eeee3cbd4d682095ed431052f00403004596373e","https://github.com/openssl/openssl/commit/ef2fb66ec571564d64d1c74a12e388a2a54d05d2","https://openssl-library.org/news/secadv/20260127.txt","https://cert-portal.siemens.com/productcert/html/ssa-265688.html"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-22796","description":"Issue summary: A type confusion vulnerability exists in the signature\nverification of signed PKCS#7 data where an ASN1_TYPE union member is\naccessed without first validating the type, causing an invalid or NULL\npointer dereference when processing malformed PKCS#7 data.\n\nImpact summary: An application performing signature verification of PKCS#7\ndata or calling directly the PKCS7_digest_from_attributes() function can be\ncaused to dereference an invalid or NULL pointer when reading, resulting in\na Denial of Service.\n\nThe function PKCS7_digest_from_attributes() accesses the message digest attribute\nvalue without validating its type. When the type is not V_ASN1_OCTET_STRING,\nthis results in accessing invalid memory through the ASN1_TYPE union, causing\na crash.\n\nExploiting this vulnerability requires an attacker to provide a malformed\nsigned PKCS#7 to an application that verifies it. The impact of the\nexploit is just a Denial of Service, the PKCS7 API is legacy and applications\nshould be using the CMS API instead. For these reasons the issue was\nassessed as Low severity.\n\nThe FIPS modules in 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the PKCS#7 parsing implementation is outside the OpenSSL FIPS module\nboundary.\n\nOpenSSL 3.6, 3.5, 3.4, 3.3, 3.0, 1.1.1 and 1.0.2 are vulnerable to this issue."},"relatedVulnerabilities":[]},{"artifact":{"id":"74f4e71ff41d2d68","cpes":["cpe:2.3:a:libssl1.1:libssl1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl1.1:libssl:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl:1.1.1q-r0:*:*:*:*:*:*:*"],"name":"libssl1.1","purl":"pkg:apk/busybox/libssl1.1@1.1.1q-r0?arch=x86_64&distro=busybox-1.32.1&upstream=openssl","type":"apk","version":"1.1.1q-r0","language":"","licenses":["OpenSSL"],"metadata":{"Arch":"x86_64","files":[{"path":"/lib"},{"path":"/lib/libssl.so.1.1"},{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libssl.so.1.1"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-22796","versionConstraint":">= 1.0.2, < 1.0.2zn||>= 1.1.1, < 1.1.1ze||>= 3.0.0, < 3.0.19||>= 3.3.0, < 3.3.6||>= 3.4.0, < 3.4.4||>= 3.5.0, < 3.5.5||>= 3.6.0, < 3.6.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:1.1.1q:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"1.1.1q-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-22796","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-22796","cwe":"CWE-754","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-22796","date":"2026-10-08","epss":0.00576,"percentile":0.45751}],"risk":0.29664,"urls":["https://github.com/openssl/openssl/commit/2502e7b7d4c0cf4f972a881641fe09edc67aeec4","https://github.com/openssl/openssl/commit/572844beca95068394c916626a6d3a490f831a49","https://github.com/openssl/openssl/commit/7bbca05be55b129651d9df4bdb92becc45002c12","https://github.com/openssl/openssl/commit/eeee3cbd4d682095ed431052f00403004596373e","https://github.com/openssl/openssl/commit/ef2fb66ec571564d64d1c74a12e388a2a54d05d2","https://openssl-library.org/news/secadv/20260127.txt","https://cert-portal.siemens.com/productcert/html/ssa-265688.html"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-22796","description":"Issue summary: A type confusion vulnerability exists in the signature\nverification of signed PKCS#7 data where an ASN1_TYPE union member is\naccessed without first validating the type, causing an invalid or NULL\npointer dereference when processing malformed PKCS#7 data.\n\nImpact summary: An application performing signature verification of PKCS#7\ndata or calling directly the PKCS7_digest_from_attributes() function can be\ncaused to dereference an invalid or NULL pointer when reading, resulting in\na Denial of Service.\n\nThe function PKCS7_digest_from_attributes() accesses the message digest attribute\nvalue without validating its type. When the type is not V_ASN1_OCTET_STRING,\nthis results in accessing invalid memory through the ASN1_TYPE union, causing\na crash.\n\nExploiting this vulnerability requires an attacker to provide a malformed\nsigned PKCS#7 to an application that verifies it. The impact of the\nexploit is just a Denial of Service, the PKCS7 API is legacy and applications\nshould be using the CMS API instead. For these reasons the issue was\nassessed as Low severity.\n\nThe FIPS modules in 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the PKCS#7 parsing implementation is outside the OpenSSL FIPS module\nboundary.\n\nOpenSSL 3.6, 3.5, 3.4, 3.3, 3.0, 1.1.1 and 1.0.2 are vulnerable to this issue."},"relatedVulnerabilities":[]},{"artifact":{"id":"14807b4f7067817d","cpes":["cpe:2.3:a:openssl:openssl:1.1.1q-r0:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:apk/busybox/openssl@1.1.1q-r0?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"1.1.1q-r0","language":"","licenses":["OpenSSL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/openssl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-22796","versionConstraint":">= 1.0.2, < 1.0.2zn||>= 1.1.1, < 1.1.1ze||>= 3.0.0, < 3.0.19||>= 3.3.0, < 3.3.6||>= 3.4.0, < 3.4.4||>= 3.5.0, < 3.5.5||>= 3.6.0, < 3.6.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:1.1.1q:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"1.1.1q-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-22796","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-22796","cwe":"CWE-754","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-22796","date":"2026-10-08","epss":0.00576,"percentile":0.45751}],"risk":0.29664,"urls":["https://github.com/openssl/openssl/commit/2502e7b7d4c0cf4f972a881641fe09edc67aeec4","https://github.com/openssl/openssl/commit/572844beca95068394c916626a6d3a490f831a49","https://github.com/openssl/openssl/commit/7bbca05be55b129651d9df4bdb92becc45002c12","https://github.com/openssl/openssl/commit/eeee3cbd4d682095ed431052f00403004596373e","https://github.com/openssl/openssl/commit/ef2fb66ec571564d64d1c74a12e388a2a54d05d2","https://openssl-library.org/news/secadv/20260127.txt","https://cert-portal.siemens.com/productcert/html/ssa-265688.html"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-22796","description":"Issue summary: A type confusion vulnerability exists in the signature\nverification of signed PKCS#7 data where an ASN1_TYPE union member is\naccessed without first validating the type, causing an invalid or NULL\npointer dereference when processing malformed PKCS#7 data.\n\nImpact summary: An application performing signature verification of PKCS#7\ndata or calling directly the PKCS7_digest_from_attributes() function can be\ncaused to dereference an invalid or NULL pointer when reading, resulting in\na Denial of Service.\n\nThe function PKCS7_digest_from_attributes() accesses the message digest attribute\nvalue without validating its type. When the type is not V_ASN1_OCTET_STRING,\nthis results in accessing invalid memory through the ASN1_TYPE union, causing\na crash.\n\nExploiting this vulnerability requires an attacker to provide a malformed\nsigned PKCS#7 to an application that verifies it. The impact of the\nexploit is just a Denial of Service, the PKCS7 API is legacy and applications\nshould be using the CMS API instead. For these reasons the issue was\nassessed as Low severity.\n\nThe FIPS modules in 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the PKCS#7 parsing implementation is outside the OpenSSL FIPS module\nboundary.\n\nOpenSSL 3.6, 3.5, 3.4, 3.3, 3.0, 1.1.1 and 1.0.2 are vulnerable to this issue."},"relatedVulnerabilities":[]},{"artifact":{"id":"a745c6f99abca0da","cpes":["cpe:2.3:a:libxml2:libxml2:2.9.14-r2:*:*:*:*:*:*:*","cpe:2.3:a:libxml2:libxml:2.9.14-r2:*:*:*:*:*:*:*","cpe:2.3:a:libxml:libxml2:2.9.14-r2:*:*:*:*:*:*:*","cpe:2.3:a:libxml:libxml:2.9.14-r2:*:*:*:*:*:*:*"],"name":"libxml2","purl":"pkg:apk/busybox/libxml2@2.9.14-r2?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"2.9.14-r2","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libxml2.so.2"},{"path":"/usr/lib/libxml2.so.2.9.14"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"libxml2"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:libxml2:libxml2:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-24928","versionConstraint":"< 2.12.10||>= 2.13.0, < 2.13.6 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:libxml2:libxml2:2.9.14:*:*:*:*:*:*:*"],"package":{"name":"libxml2","version":"2.9.14-r2"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2025-24928","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.7,"impactScore":5.2,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N","metrics":{"baseScore":7.8,"impactScore":5.8,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-24928","cwe":"CWE-121","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2025-24928","date":"2026-10-08","epss":0.00385,"percentile":0.304}],"risk":0.2935625,"urls":["https://gitlab.gnome.org/GNOME/libxml2/-/issues/847","https://issues.oss-fuzz.com/issues/392687022","https://lists.debian.org/debian-lts-announce/2025/02/msg00028.html","https://security.netapp.com/advisory/ntap-20250321-0006/"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-24928","description":"libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a stack-based buffer overflow in xmlSnprintfElements in valid.c. To exploit this, DTD validation must occur for an untrusted document or untrusted DTD. NOTE: this is similar to CVE-2017-9047."},"relatedVulnerabilities":[]},{"artifact":{"id":"6040784032e8795c","cpes":["cpe:2.3:a:curl:curl:7.79.1-r3:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:7.79.1-r3:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/busybox/curl@7.79.1-r3?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"7.79.1-r3","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-5545","versionConstraint":">= 7.10.6, < 8.20.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:haxx:curl:7.79.1:*:*:*:*:*:*:*"],"package":{"name":"curl","version":"7.79.1-r3"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-5545","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-5545","cwe":"CWE-305","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-5545","cwe":"CWE-613","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-5545","date":"2026-10-08","epss":0.0051,"percentile":0.41602}],"risk":0.29324999999999996,"urls":["https://curl.se/docs/CVE-2026-5545.html","https://curl.se/docs/CVE-2026-5545.json","https://hackerone.com/reports/3642555"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-5545","description":"libcurl might in some circumstances reuse the wrong connection when asked to\ndo an authenticated HTTP(S) request after a Negotiate-authenticated one, when\nboth use the same host.\n\nlibcurl features a pool of recent connections so that subsequent requests can\nreuse an existing connection to avoid overhead.\n\nWhen reusing a connection a range of criteria must be met. Due to a logical\nerror in the code, a request that was issued by an application could\nwrongfully reuse an existing connection to the same server that was\nauthenticated using different credentials.\n\nAn application that first uses Negotiate authentication to a server with\n`user1:password1` and then does another operation to the same server asking\nfor any authentication method but for `user2:password2` (while the previous\nconnection is still alive) - the second request gets confused and wrongly\nreuses the same connection and sends the new request over that connection\nthinking it uses a mix of user1's and user2's credentials when it is in fact\nstill using the connection authenticated for user1..."},"relatedVulnerabilities":[]},{"artifact":{"id":"6040784032e8795c","cpes":["cpe:2.3:a:curl:curl:7.79.1-r3:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:7.79.1-r3:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/busybox/curl@7.79.1-r3?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"7.79.1-r3","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-82209","versionConstraint":">= 7.46.0, < 8.14.2||>= 8.16.0, < 8.16.1||>= 8.17.0, < 8.20.1||>= 8.20.0, < 8.20.1||>= 8.21.0, < 8.22.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:haxx:curl:7.79.1:*:*:*:*:*:*:*"],"package":{"name":"curl","version":"7.79.1-r3"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-82209","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-82209","cwe":"CWE-201","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-82209","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-82209","date":"2026-10-08","epss":0.00373,"percentile":0.29191}],"risk":0.292805,"urls":["https://curl.se/docs/CVE-2026-82209.html","https://curl.se/docs/CVE-2026-82209.json","https://hackerone.com/reports/3972385"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-82209","description":"When libpsl support is enabled, libcurl fails to enforce the Public Suffix\nList boundary check when processing a `Set-Cookie` header where the `Domain`\nattribute explicitly matches an origin host that is itself a public suffix\n(e.g., `Domain=co.uk` set by `co.uk`).\n\nInstead of coercing it into a strict host-only cookie, libcurl saves the\ncookie with wildcard domain scope (`.co.uk`). Consequently, the cookie is\ninappropriately included in subsequent outbound requests or HTTP redirects to\narbitrary sibling subdomains under the same public suffix (e.g.,\n`attacker.co.uk`)."},"relatedVulnerabilities":[]},{"artifact":{"id":"6040784032e8795c","cpes":["cpe:2.3:a:curl:curl:7.79.1-r3:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:7.79.1-r3:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/busybox/curl@7.79.1-r3?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"7.79.1-r3","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-15079","versionConstraint":">= 7.58.0, < 8.18.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:haxx:curl:7.79.1:*:*:*:*:*:*:*"],"package":{"name":"curl","version":"7.79.1-r3"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2025-15079","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-15079","cwe":"CWE-297","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2025-15079","cwe":"CWE-297","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-15079","date":"2026-10-08","epss":0.0055,"percentile":0.44258}],"risk":0.28325,"urls":["https://curl.se/docs/CVE-2025-15079.html","https://curl.se/docs/CVE-2025-15079.json","https://hackerone.com/reports/3477116","http://www.openwall.com/lists/oss-security/2026/01/07/6"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-15079","description":"When doing SSH-based transfers using either SCP or SFTP, and setting the\nknown_hosts file, libcurl could still mistakenly accept connecting to hosts\n*not present* in the specified file if they were added as recognized in the\nlibssh *global* known_hosts file."},"relatedVulnerabilities":[]},{"artifact":{"id":"a45c752c9b8878aa","cpes":["cpe:2.3:a:php7:php7:7.4.26-r0:*:*:*:*:*:*:*","cpe:2.3:a:php7:php:7.4.26-r0:*:*:*:*:*:*:*","cpe:2.3:a:php:php7:7.4.26-r0:*:*:*:*:*:*:*","cpe:2.3:a:php:php:7.4.26-r0:*:*:*:*:*:*:*"],"name":"php7","purl":"pkg:apk/busybox/php7@7.4.26-r0?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"7.4.26-r0","language":"","licenses":["BSD-3-Clause","LGPL-2.0-or-later","MIT","PHP-3.01","Zend-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/php"},{"path":"/usr/bin/php7"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"php7"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:php:php:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-1220","versionConstraint":"< 8.1.33||>= 8.2, < 8.2.29||>= 8.3, < 8.3.23||>= 8.4, < 8.4.10 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:php:php:7.4.26:*:*:*:*:*:*:*"],"package":{"name":"php7","version":"7.4.26-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2025-1220","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-1220","cwe":"CWE-918","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2025-1220","date":"2026-10-08","epss":0.00596,"percentile":0.46818}],"risk":0.28309999999999996,"urls":["https://github.com/php/php-src/security/advisories/GHSA-3cr5-j632-f35r","http://www.openwall.com/lists/oss-security/2025/07/11/4","https://lists.debian.org/debian-lts-announce/2025/07/msg00017.html"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-1220","description":"In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8.4.* before 8.4.10 some functions like fsockopen() lack validation that the hostname supplied does not contain null characters. This may lead to other functions like parse_url() treat the hostname in different way, thus opening way to security problems if the user code implements access checks before access using such functions."},"relatedVulnerabilities":[]},{"artifact":{"id":"de2e09a252869bf3","cpes":["cpe:2.3:a:git-scm:git:2.30.6-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_scm:git:2.30.6-r0:*:*:*:*:*:*:*","cpe:2.3:a:git:git:2.30.6-r0:*:*:*:*:*:*:*"],"name":"git","purl":"pkg:apk/busybox/git@2.30.6-r0?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"2.30.6-r0","language":"","licenses":["GPL-2.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/git"},{"path":"/usr/bin/git-receive-pack"},{"path":"/usr/bin/git-shell"},{"path":"/usr/bin/git-upload-archive"},{"path":"/usr/bin/git-upload-pack"},{"path":"/usr/libexec"},{"path":"/usr/libexec/git-core"},{"path":"/usr/libexec/git-core/git"},{"path":"/usr/libexec/git-core/git-add"},{"path":"/usr/libexec/git-core/git-am"},{"path":"/usr/libexec/git-core/git-annotate"},{"path":"/usr/libexec/git-core/git-apply"},{"path":"/usr/libexec/git-core/git-archive"},{"path":"/usr/libexec/git-core/git-bisect"},{"path":"/usr/libexec/git-core/git-bisect--helper"},{"path":"/usr/libexec/git-core/git-blame"},{"path":"/usr/libexec/git-core/git-branch"},{"path":"/usr/libexec/git-core/git-bugreport"},{"path":"/usr/libexec/git-core/git-bundle"},{"path":"/usr/libexec/git-core/git-cat-file"},{"path":"/usr/libexec/git-core/git-check-attr"},{"path":"/usr/libexec/git-core/git-check-ignore"},{"path":"/usr/libexec/git-core/git-check-mailmap"},{"path":"/usr/libexec/git-core/git-check-ref-format"},{"path":"/usr/libexec/git-core/git-checkout"},{"path":"/usr/libexec/git-core/git-checkout-index"},{"path":"/usr/libexec/git-core/git-cherry"},{"path":"/usr/libexec/git-core/git-cherry-pick"},{"path":"/usr/libexec/git-core/git-clean"},{"path":"/usr/libexec/git-core/git-clone"},{"path":"/usr/libexec/git-core/git-column"},{"path":"/usr/libexec/git-core/git-commit"},{"path":"/usr/libexec/git-core/git-commit-graph"},{"path":"/usr/libexec/git-core/git-commit-tree"},{"path":"/usr/libexec/git-core/git-config"},{"path":"/usr/libexec/git-core/git-count-objects"},{"path":"/usr/libexec/git-core/git-credential"},{"path":"/usr/libexec/git-core/git-credential-cache"},{"path":"/usr/libexec/git-core/git-credential-cache--daemon"},{"path":"/usr/libexec/git-core/git-credential-store"},{"path":"/usr/libexec/git-core/git-describe"},{"path":"/usr/libexec/git-core/git-diff"},{"path":"/usr/libexec/git-core/git-diff-files"},{"path":"/usr/libexec/git-core/git-diff-index"},{"path":"/usr/libexec/git-core/git-diff-tree"},{"path":"/usr/libexec/git-core/git-difftool"},{"path":"/usr/libexec/git-core/git-difftool--helper"},{"path":"/usr/libexec/git-core/git-env--helper"},{"path":"/usr/libexec/git-core/git-fast-export"},{"path":"/usr/libexec/git-core/git-fetch"},{"path":"/usr/libexec/git-core/git-fetch-pack"},{"path":"/usr/libexec/git-core/git-filter-branch"},{"path":"/usr/libexec/git-core/git-fmt-merge-msg"},{"path":"/usr/libexec/git-core/git-for-each-ref"},{"path":"/usr/libexec/git-core/git-for-each-repo"},{"path":"/usr/libexec/git-core/git-format-patch"},{"path":"/usr/libexec/git-core/git-fsck"},{"path":"/usr/libexec/git-core/git-fsck-objects"},{"path":"/usr/libexec/git-core/git-gc"},{"path":"/usr/libexec/git-core/git-get-tar-commit-id"},{"path":"/usr/libexec/git-core/git-grep"},{"path":"/usr/libexec/git-core/git-hash-object"},{"path":"/usr/libexec/git-core/git-help"},{"path":"/usr/libexec/git-core/git-http-fetch"},{"path":"/usr/libexec/git-core/git-http-push"},{"path":"/usr/libexec/git-core/git-index-pack"},{"path":"/usr/libexec/git-core/git-init"},{"path":"/usr/libexec/git-core/git-init-db"},{"path":"/usr/libexec/git-core/git-interpret-trailers"},{"path":"/usr/libexec/git-core/git-log"},{"path":"/usr/libexec/git-core/git-ls-files"},{"path":"/usr/libexec/git-core/git-ls-remote"},{"path":"/usr/libexec/git-core/git-ls-tree"},{"path":"/usr/libexec/git-core/git-mailinfo"},{"path":"/usr/libexec/git-core/git-mailsplit"},{"path":"/usr/libexec/git-core/git-maintenance"},{"path":"/usr/libexec/git-core/git-merge"},{"path":"/usr/libexec/git-core/git-merge-base"},{"path":"/usr/libexec/git-core/git-merge-file"},{"path":"/usr/libexec/git-core/git-merge-index"},{"path":"/usr/libexec/git-core/git-merge-octopus"},{"path":"/usr/libexec/git-core/git-merge-one-file"},{"path":"/usr/libexec/git-core/git-merge-ours"},{"path":"/usr/libexec/git-core/git-merge-recursive"},{"path":"/usr/libexec/git-core/git-merge-resolve"},{"path":"/usr/libexec/git-core/git-merge-subtree"},{"path":"/usr/libexec/git-core/git-merge-tree"},{"path":"/usr/libexec/git-core/git-mergetool"},{"path":"/usr/libexec/git-core/git-mergetool--lib"},{"path":"/usr/libexec/git-core/git-mktag"},{"path":"/usr/libexec/git-core/git-mktree"},{"path":"/usr/libexec/git-core/git-multi-pack-index"},{"path":"/usr/libexec/git-core/git-mv"},{"path":"/usr/libexec/git-core/git-name-rev"},{"path":"/usr/libexec/git-core/git-notes"},{"path":"/usr/libexec/git-core/git-pack-objects"},{"path":"/usr/libexec/git-core/git-pack-redundant"},{"path":"/usr/libexec/git-core/git-pack-refs"},{"path":"/usr/libexec/git-core/git-patch-id"},{"path":"/usr/libexec/git-core/git-prune"},{"path":"/usr/libexec/git-core/git-prune-packed"},{"path":"/usr/libexec/git-core/git-pull"},{"path":"/usr/libexec/git-core/git-push"},{"path":"/usr/libexec/git-core/git-quiltimport"},{"path":"/usr/libexec/git-core/git-range-diff"},{"path":"/usr/libexec/git-core/git-read-tree"},{"path":"/usr/libexec/git-core/git-rebase"},{"path":"/usr/libexec/git-core/git-rebase--preserve-merges"},{"path":"/usr/libexec/git-core/git-receive-pack"},{"path":"/usr/libexec/git-core/git-reflog"},{"path":"/usr/libexec/git-core/git-remote"},{"path":"/usr/libexec/git-core/git-remote-ext"},{"path":"/usr/libexec/git-core/git-remote-fd"},{"path":"/usr/libexec/git-core/git-remote-ftp"},{"path":"/usr/libexec/git-core/git-remote-ftps"},{"path":"/usr/libexec/git-core/git-remote-http"},{"path":"/usr/libexec/git-core/git-remote-https"},{"path":"/usr/libexec/git-core/git-repack"},{"path":"/usr/libexec/git-core/git-replace"},{"path":"/usr/libexec/git-core/git-request-pull"},{"path":"/usr/libexec/git-core/git-rerere"},{"path":"/usr/libexec/git-core/git-reset"},{"path":"/usr/libexec/git-core/git-restore"},{"path":"/usr/libexec/git-core/git-rev-list"},{"path":"/usr/libexec/git-core/git-rev-parse"},{"path":"/usr/libexec/git-core/git-revert"},{"path":"/usr/libexec/git-core/git-rm"},{"path":"/usr/libexec/git-core/git-send-pack"},{"path":"/usr/libexec/git-core/git-sh-i18n"},{"path":"/usr/libexec/git-core/git-sh-i18n--envsubst"},{"path":"/usr/libexec/git-core/git-sh-setup"},{"path":"/usr/libexec/git-core/git-shortlog"},{"path":"/usr/libexec/git-core/git-show"},{"path":"/usr/libexec/git-core/git-show-branch"},{"path":"/usr/libexec/git-core/git-show-index"},{"path":"/usr/libexec/git-core/git-show-ref"},{"path":"/usr/libexec/git-core/git-sparse-checkout"},{"path":"/usr/libexec/git-core/git-stage"},{"path":"/usr/libexec/git-core/git-stash"},{"path":"/usr/libexec/git-core/git-status"},{"path":"/usr/libexec/git-core/git-stripspace"},{"path":"/usr/libexec/git-core/git-submodule"},{"path":"/usr/libexec/git-core/git-submodule--helper"},{"path":"/usr/libexec/git-core/git-switch"},{"path":"/usr/libexec/git-core/git-symbolic-ref"},{"path":"/usr/libexec/git-core/git-tag"},{"path":"/usr/libexec/git-core/git-unpack-file"},{"path":"/usr/libexec/git-core/git-unpack-objects"},{"path":"/usr/libexec/git-core/git-update-index"},{"path":"/usr/libexec/git-core/git-update-ref"},{"path":"/usr/libexec/git-core/git-update-server-info"},{"path":"/usr/libexec/git-core/git-upload-archive"},{"path":"/usr/libexec/git-core/git-upload-pack"},{"path":"/usr/libexec/git-core/git-var"},{"path":"/usr/libexec/git-core/git-verify-commit"},{"path":"/usr/libexec/git-core/git-verify-pack"},{"path":"/usr/libexec/git-core/git-verify-tag"},{"path":"/usr/libexec/git-core/git-web--browse"},{"path":"/usr/libexec/git-core/git-whatchanged"},{"path":"/usr/libexec/git-core/git-worktree"},{"path":"/usr/libexec/git-core/git-write-tree"},{"path":"/usr/libexec/git-core/mergetools"},{"path":"/usr/libexec/git-core/mergetools/araxis"},{"path":"/usr/libexec/git-core/mergetools/bc"},{"path":"/usr/libexec/git-core/mergetools/codecompare"},{"path":"/usr/libexec/git-core/mergetools/deltawalker"},{"path":"/usr/libexec/git-core/mergetools/diffmerge"},{"path":"/usr/libexec/git-core/mergetools/diffuse"},{"path":"/usr/libexec/git-core/mergetools/ecmerge"},{"path":"/usr/libexec/git-core/mergetools/emerge"},{"path":"/usr/libexec/git-core/mergetools/examdiff"},{"path":"/usr/libexec/git-core/mergetools/guiffy"},{"path":"/usr/libexec/git-core/mergetools/gvimdiff"},{"path":"/usr/libexec/git-core/mergetools/kdiff3"},{"path":"/usr/libexec/git-core/mergetools/kompare"},{"path":"/usr/libexec/git-core/mergetools/meld"},{"path":"/usr/libexec/git-core/mergetools/nvimdiff"},{"path":"/usr/libexec/git-core/mergetools/opendiff"},{"path":"/usr/libexec/git-core/mergetools/smerge"},{"path":"/usr/libexec/git-core/mergetools/tkdiff"},{"path":"/usr/libexec/git-core/mergetools/tortoisemerge"},{"path":"/usr/libexec/git-core/mergetools/vimdiff"},{"path":"/usr/libexec/git-core/mergetools/winmerge"},{"path":"/usr/libexec/git-core/mergetools/xxdiff"},{"path":"/usr/share"},{"path":"/usr/share/git-core"},{"path":"/usr/share/git-core/templates"},{"path":"/usr/share/git-core/templates/description"},{"path":"/usr/share/git-core/templates/branches"},{"path":"/usr/share/git-core/templates/hooks"},{"path":"/usr/share/git-core/templates/hooks/applypatch-msg.sample"},{"path":"/usr/share/git-core/templates/hooks/commit-msg.sample"},{"path":"/usr/share/git-core/templates/hooks/post-update.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-applypatch.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-commit.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-merge-commit.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-push.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-rebase.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-receive.sample"},{"path":"/usr/share/git-core/templates/hooks/prepare-commit-msg.sample"},{"path":"/usr/share/git-core/templates/hooks/push-to-checkout.sample"},{"path":"/usr/share/git-core/templates/hooks/update.sample"},{"path":"/usr/share/git-core/templates/info"},{"path":"/usr/share/git-core/templates/info/exclude"},{"path":"/usr/share/perl5"},{"path":"/var"},{"path":"/var/git"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"git"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2024-50349","versionConstraint":"< 2.40.4||>= 2.41.0, < 2.41.3||>= 2.42.0, < 2.42.4||>= 2.43.0, < 2.43.6||>= 2.44.0, < 2.44.3||>= 2.45.0, < 2.45.3||>= 2.46.0, < 2.46.3||>= 2.47.0, < 2.47.2||>= 2.48.0, < 2.48.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:git-scm:git:2.30.6:*:*:*:*:*:*:*"],"package":{"name":"git","version":"2.30.6-r0"},"namespace":"nvd:cpe"}},{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:git:git:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2024-50349","versionConstraint":"< 2.40.4||>= 2.41.0, < 2.41.3||>= 2.42.0, < 2.42.4||>= 2.43.0, < 2.43.6||>= 2.44.0, < 2.44.3||>= 2.45.0, < 2.45.3||>= 2.46.0, < 2.46.3||>= 2.47.0, < 2.47.2||>= 2.48.0, < 2.48.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:git:git:2.30.6:*:*:*:*:*:*:*"],"package":{"name":"git","version":"2.30.6-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2024-50349","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N","metrics":{"baseScore":4.7,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2.1},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-50349","cwe":"CWE-116","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2024-50349","cwe":"CWE-147","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2024-50349","cwe":"CWE-150","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2024-50349","date":"2026-10-08","epss":0.00667,"percentile":0.50337}],"risk":0.28014000000000006,"urls":["https://github.com/git/git/commit/7725b8100ffbbff2750ee4d61a0fcc1f53a086e8","https://github.com/git/git/commit/c903985bf7e772e2d08275c1a95c8a55ab011577","https://github.com/git/git/security/advisories/GHSA-hmg8-h7qf-7cxr","https://lists.debian.org/debian-lts-announce/2025/01/msg00025.html"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-50349","description":"Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When Git asks for credentials via a terminal prompt (i.e. without using any credential helper), it prints out the host name for which the user is expected to provide a username and/or a password. At this stage, any URL-encoded parts have been decoded already, and are printed verbatim. This allows attackers to craft URLs that contain ANSI escape sequences that the terminal interpret to confuse users e.g. into providing passwords for trusted Git hosting sites when in fact they are then sent to untrusted sites that are under the attacker's control. This issue has been patch via commits `7725b81` and `c903985` which are included in release versions v2.48.1, v2.47.2, v2.46.3, v2.45.3, v2.44.3, v2.43.6, v2.42.4, v2.41.3, and v2.40.4. Users are advised to upgrade. Users unable to upgrade should avoid cloning from untrusted URLs, especially recursive clones."},"relatedVulnerabilities":[]},{"artifact":{"id":"422a442f930ca27c","cpes":["cpe:2.3:a:nginx:nginx:1.18.0-r15:*:*:*:*:*:*:*"],"name":"nginx","purl":"pkg:apk/busybox/nginx@1.18.0-r15?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"1.18.0-r15","language":"","licenses":["BSD-2-Clause"],"metadata":{"Arch":"x86_64","files":[{"path":"/etc"},{"path":"/etc/logrotate.d"},{"path":"/etc/logrotate.d/nginx"},{"path":"/etc/nginx"},{"path":"/etc/nginx/fastcgi.conf"},{"path":"/etc/nginx/fastcgi_params"},{"path":"/etc/nginx/mime.types"},{"path":"/etc/nginx/nginx.conf"},{"path":"/etc/nginx/scgi_params"},{"path":"/etc/nginx/uwsgi_params"},{"path":"/etc/nginx/http.d"},{"path":"/etc/nginx/modules"},{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/nginx"},{"path":"/usr/lib/nginx/modules"},{"path":"/usr/sbin"},{"path":"/usr/sbin/nginx"},{"path":"/usr/share"},{"path":"/usr/share/nginx"},{"path":"/usr/share/nginx/http-default_server.conf"},{"path":"/var"},{"path":"/var/lib"},{"path":"/var/lib/nginx"},{"path":"/var/lib/nginx/logs"},{"path":"/var/lib/nginx/modules"},{"path":"/var/lib/nginx/run"},{"path":"/var/lib/nginx/html"},{"path":"/var/lib/nginx/html/50x.html"},{"path":"/var/lib/nginx/html/index.html"},{"path":"/var/lib/nginx/tmp"},{"path":"/var/log"},{"path":"/var/log/nginx"},{"path":"/var/www"},{"path":"/var/www/localhost"},{"path":"/var/www/localhost/htdocs"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"nginx"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:nginx:nginx:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-1642","versionConstraint":">= 1.3.0, < 1.29.5 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:nginx:nginx:1.18.0:*:*:*:*:*:*:*"],"package":{"name":"nginx","version":"1.18.0-r15"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-1642","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"f5sirt@f5.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"f5sirt@f5.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-1642","cwe":"CWE-349","type":"Secondary","source":"f5sirt@f5.com"},{"cve":"CVE-2026-1642","cwe":"CWE-345","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-1642","date":"2026-10-08","epss":0.00385,"percentile":0.30461}],"risk":0.28008750000000004,"urls":["https://my.f5.com/manage/s/article/K000159824","http://www.openwall.com/lists/oss-security/2026/02/05/1"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-1642","description":"A vulnerability exists in NGINX OSS and NGINX Plus when configured to proxy to upstream Transport Layer Security (TLS) servers. An attacker with a man-in-the-middle (MITM) position on the upstream server side—along with conditions beyond the attacker's control—may be able to inject plain text data into the response from an upstream proxied server.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated."},"relatedVulnerabilities":[]},{"artifact":{"id":"a45c752c9b8878aa","cpes":["cpe:2.3:a:php7:php7:7.4.26-r0:*:*:*:*:*:*:*","cpe:2.3:a:php7:php:7.4.26-r0:*:*:*:*:*:*:*","cpe:2.3:a:php:php7:7.4.26-r0:*:*:*:*:*:*:*","cpe:2.3:a:php:php:7.4.26-r0:*:*:*:*:*:*:*"],"name":"php7","purl":"pkg:apk/busybox/php7@7.4.26-r0?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"7.4.26-r0","language":"","licenses":["BSD-3-Clause","LGPL-2.0-or-later","MIT","PHP-3.01","Zend-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/php"},{"path":"/usr/bin/php7"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"php7"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:php:php:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2022-31628","versionConstraint":"< 7.4.31||>= 8.0.0, < 8.0.24||>= 8.1.0, < 8.1.11 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:php:php:7.4.26:*:*:*:*:*:*:*"],"package":{"name":"php7","version":"7.4.26-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2022-31628","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.3,"impactScore":1.5,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-31628","cwe":"CWE-674","type":"Secondary","source":"security@php.net"},{"cve":"CVE-2022-31628","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-31628","date":"2026-10-08","epss":0.00628,"percentile":0.48481}],"risk":0.27946,"urls":["https://bugs.php.net/bug.php?id=81726","https://lists.debian.org/debian-lts-announce/2022/12/msg00030.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2L5SUVYGAKSWODUQPZFBUB3AL6E6CSEV/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VI3E6A3ZTH2RP7OMLJHSVFIEQBIFM6RF/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XNIEABBH5XCXLFWWZYIDE457SPEDZTXV/","https://security.gentoo.org/glsa/202211-03","https://security.netapp.com/advisory/ntap-20221209-0001/","https://www.debian.org/security/2022/dsa-5277"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-31628","description":"In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the phar uncompressor code would recursively uncompress \"quines\" gzip files, resulting in an infinite loop."},"relatedVulnerabilities":[]},{"artifact":{"id":"d081de97c6f633df","cpes":["cpe:2.3:a:libcrypto1.1:libcrypto1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto1.1:libcrypto:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto:libcrypto1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto:libcrypto:1.1.1q-r0:*:*:*:*:*:*:*"],"name":"libcrypto1.1","purl":"pkg:apk/busybox/libcrypto1.1@1.1.1q-r0?arch=x86_64&distro=busybox-1.32.1&upstream=openssl","type":"apk","version":"1.1.1q-r0","language":"","licenses":["OpenSSL"],"metadata":{"Arch":"x86_64","files":[{"path":"/etc"},{"path":"/etc/ssl"},{"path":"/etc/ssl/ct_log_list.cnf"},{"path":"/etc/ssl/ct_log_list.cnf.dist"},{"path":"/etc/ssl/openssl.cnf"},{"path":"/etc/ssl/openssl.cnf.dist"},{"path":"/etc/ssl/certs"},{"path":"/etc/ssl/misc"},{"path":"/etc/ssl/misc/CA.pl"},{"path":"/etc/ssl/misc/tsget"},{"path":"/etc/ssl/misc/tsget.pl"},{"path":"/etc/ssl/private"},{"path":"/lib"},{"path":"/lib/libcrypto.so.1.1"},{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcrypto.so.1.1"},{"path":"/usr/lib/engines-1.1"},{"path":"/usr/lib/engines-1.1/afalg.so"},{"path":"/usr/lib/engines-1.1/capi.so"},{"path":"/usr/lib/engines-1.1/padlock.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2024-13176","versionConstraint":">= 1.0.2, < 1.0.2zl||>= 1.1.1, < 1.1.1zb||>= 3.0.0, < 3.0.16||>= 3.1.0, < 3.1.8||>= 3.2.0, < 3.2.4||>= 3.3.0, < 3.3.3||>= 3.4.0, < 3.4.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:1.1.1q:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"1.1.1q-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2024-13176","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":4.1,"impactScore":3.4,"exploitabilityScore":0.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-13176","cwe":"CWE-385","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2024-13176","date":"2026-10-08","epss":0.00613,"percentile":0.47736}],"risk":0.27891499999999997,"urls":["https://github.com/openssl/openssl/commit/07272b05b04836a762b4baa874958af51d513844","https://github.com/openssl/openssl/commit/2af62e74fb59bc469506bc37eb2990ea408d9467","https://github.com/openssl/openssl/commit/392dcb336405a0c94486aa6655057f59fd3a0902","https://github.com/openssl/openssl/commit/4b1cb94a734a7d4ec363ac0a215a25c181e11f65","https://github.com/openssl/openssl/commit/77c608f4c8857e63e98e66444e2e761c9627916f","https://github.openssl.org/openssl/extended-releases/commit/0d5fd1ab987f7571e2c955d8d8b638fc0fb54ded","https://github.openssl.org/openssl/extended-releases/commit/a2639000db19878d5d89586ae7b725080592ae86","https://openssl-library.org/news/secadv/20250120.txt","http://www.openwall.com/lists/oss-security/2025/01/20/2","https://lists.debian.org/debian-lts-announce/2025/05/msg00028.html","https://security.netapp.com/advisory/ntap-20250124-0005/","https://security.netapp.com/advisory/ntap-20250418-0010/","https://security.netapp.com/advisory/ntap-20250502-0006/"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-13176","description":"Issue summary: A timing side-channel which could potentially allow recovering\nthe private key exists in the ECDSA signature computation.\n\nImpact summary: A timing side-channel in ECDSA signature computations\ncould allow recovering the private key by an attacker. However, measuring\nthe timing would require either local access to the signing application or\na very fast network connection with low latency.\n\nThere is a timing signal of around 300 nanoseconds when the top word of\nthe inverted ECDSA nonce value is zero. This can happen with significant\nprobability only for some of the supported elliptic curves. In particular\nthe NIST P-521 curve is affected. To be able to measure this leak, the attacker\nprocess must either be located in the same physical computer or must\nhave a very fast network connection with low latency. For that reason\nthe severity of this vulnerability is Low.\n\nThe FIPS modules in 3.4, 3.3, 3.2, 3.1 and 3.0 are affected by this issue."},"relatedVulnerabilities":[]},{"artifact":{"id":"74f4e71ff41d2d68","cpes":["cpe:2.3:a:libssl1.1:libssl1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl1.1:libssl:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl:1.1.1q-r0:*:*:*:*:*:*:*"],"name":"libssl1.1","purl":"pkg:apk/busybox/libssl1.1@1.1.1q-r0?arch=x86_64&distro=busybox-1.32.1&upstream=openssl","type":"apk","version":"1.1.1q-r0","language":"","licenses":["OpenSSL"],"metadata":{"Arch":"x86_64","files":[{"path":"/lib"},{"path":"/lib/libssl.so.1.1"},{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libssl.so.1.1"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2024-13176","versionConstraint":">= 1.0.2, < 1.0.2zl||>= 1.1.1, < 1.1.1zb||>= 3.0.0, < 3.0.16||>= 3.1.0, < 3.1.8||>= 3.2.0, < 3.2.4||>= 3.3.0, < 3.3.3||>= 3.4.0, < 3.4.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:1.1.1q:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"1.1.1q-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2024-13176","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":4.1,"impactScore":3.4,"exploitabilityScore":0.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-13176","cwe":"CWE-385","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2024-13176","date":"2026-10-08","epss":0.00613,"percentile":0.47736}],"risk":0.27891499999999997,"urls":["https://github.com/openssl/openssl/commit/07272b05b04836a762b4baa874958af51d513844","https://github.com/openssl/openssl/commit/2af62e74fb59bc469506bc37eb2990ea408d9467","https://github.com/openssl/openssl/commit/392dcb336405a0c94486aa6655057f59fd3a0902","https://github.com/openssl/openssl/commit/4b1cb94a734a7d4ec363ac0a215a25c181e11f65","https://github.com/openssl/openssl/commit/77c608f4c8857e63e98e66444e2e761c9627916f","https://github.openssl.org/openssl/extended-releases/commit/0d5fd1ab987f7571e2c955d8d8b638fc0fb54ded","https://github.openssl.org/openssl/extended-releases/commit/a2639000db19878d5d89586ae7b725080592ae86","https://openssl-library.org/news/secadv/20250120.txt","http://www.openwall.com/lists/oss-security/2025/01/20/2","https://lists.debian.org/debian-lts-announce/2025/05/msg00028.html","https://security.netapp.com/advisory/ntap-20250124-0005/","https://security.netapp.com/advisory/ntap-20250418-0010/","https://security.netapp.com/advisory/ntap-20250502-0006/"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-13176","description":"Issue summary: A timing side-channel which could potentially allow recovering\nthe private key exists in the ECDSA signature computation.\n\nImpact summary: A timing side-channel in ECDSA signature computations\ncould allow recovering the private key by an attacker. However, measuring\nthe timing would require either local access to the signing application or\na very fast network connection with low latency.\n\nThere is a timing signal of around 300 nanoseconds when the top word of\nthe inverted ECDSA nonce value is zero. This can happen with significant\nprobability only for some of the supported elliptic curves. In particular\nthe NIST P-521 curve is affected. To be able to measure this leak, the attacker\nprocess must either be located in the same physical computer or must\nhave a very fast network connection with low latency. For that reason\nthe severity of this vulnerability is Low.\n\nThe FIPS modules in 3.4, 3.3, 3.2, 3.1 and 3.0 are affected by this issue."},"relatedVulnerabilities":[]},{"artifact":{"id":"14807b4f7067817d","cpes":["cpe:2.3:a:openssl:openssl:1.1.1q-r0:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:apk/busybox/openssl@1.1.1q-r0?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"1.1.1q-r0","language":"","licenses":["OpenSSL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/openssl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2024-13176","versionConstraint":">= 1.0.2, < 1.0.2zl||>= 1.1.1, < 1.1.1zb||>= 3.0.0, < 3.0.16||>= 3.1.0, < 3.1.8||>= 3.2.0, < 3.2.4||>= 3.3.0, < 3.3.3||>= 3.4.0, < 3.4.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:1.1.1q:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"1.1.1q-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2024-13176","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":4.1,"impactScore":3.4,"exploitabilityScore":0.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-13176","cwe":"CWE-385","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2024-13176","date":"2026-10-08","epss":0.00613,"percentile":0.47736}],"risk":0.27891499999999997,"urls":["https://github.com/openssl/openssl/commit/07272b05b04836a762b4baa874958af51d513844","https://github.com/openssl/openssl/commit/2af62e74fb59bc469506bc37eb2990ea408d9467","https://github.com/openssl/openssl/commit/392dcb336405a0c94486aa6655057f59fd3a0902","https://github.com/openssl/openssl/commit/4b1cb94a734a7d4ec363ac0a215a25c181e11f65","https://github.com/openssl/openssl/commit/77c608f4c8857e63e98e66444e2e761c9627916f","https://github.openssl.org/openssl/extended-releases/commit/0d5fd1ab987f7571e2c955d8d8b638fc0fb54ded","https://github.openssl.org/openssl/extended-releases/commit/a2639000db19878d5d89586ae7b725080592ae86","https://openssl-library.org/news/secadv/20250120.txt","http://www.openwall.com/lists/oss-security/2025/01/20/2","https://lists.debian.org/debian-lts-announce/2025/05/msg00028.html","https://security.netapp.com/advisory/ntap-20250124-0005/","https://security.netapp.com/advisory/ntap-20250418-0010/","https://security.netapp.com/advisory/ntap-20250502-0006/"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-13176","description":"Issue summary: A timing side-channel which could potentially allow recovering\nthe private key exists in the ECDSA signature computation.\n\nImpact summary: A timing side-channel in ECDSA signature computations\ncould allow recovering the private key by an attacker. However, measuring\nthe timing would require either local access to the signing application or\na very fast network connection with low latency.\n\nThere is a timing signal of around 300 nanoseconds when the top word of\nthe inverted ECDSA nonce value is zero. This can happen with significant\nprobability only for some of the supported elliptic curves. In particular\nthe NIST P-521 curve is affected. To be able to measure this leak, the attacker\nprocess must either be located in the same physical computer or must\nhave a very fast network connection with low latency. For that reason\nthe severity of this vulnerability is Low.\n\nThe FIPS modules in 3.4, 3.3, 3.2, 3.1 and 3.0 are affected by this issue."},"relatedVulnerabilities":[]},{"artifact":{"id":"6040784032e8795c","cpes":["cpe:2.3:a:curl:curl:7.79.1-r3:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:7.79.1-r3:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/busybox/curl@7.79.1-r3?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"7.79.1-r3","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-80230","versionConstraint":">= 7.45.0, < 8.14.2||>= 8.15.0, < 8.16.1||>= 8.17.0, < 8.20.1||>= 8.21.0, < 8.22.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:haxx:curl:7.79.1:*:*:*:*:*:*:*"],"package":{"name":"curl","version":"7.79.1-r3"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-80230","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-80230","cwe":"CWE-295","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-80230","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-80230","date":"2026-10-08","epss":0.00371,"percentile":0.29002}],"risk":0.27825,"urls":["https://curl.se/docs/CVE-2026-80230.html","https://curl.se/docs/CVE-2026-80230.json","https://hackerone.com/reports/3969300"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-80230","description":"When `CURLOPT_PINNEDPUBLICKEY` is configured alongside options that disable\nstandard peer verification (`CURLOPT_SSL_VERIFYPEER = 0` and\n`CURLOPT_SSL_VERIFYHOST = 0`), libcurl fails to enforce public key pinning on\nconnections established without a presented server certificate. Bypassing the\npinning check under these disabled-verification conditions allows\nunauthenticated connections to succeed when they should be rejected."},"relatedVulnerabilities":[]},{"artifact":{"id":"6040784032e8795c","cpes":["cpe:2.3:a:curl:curl:7.79.1-r3:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:7.79.1-r3:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/busybox/curl@7.79.1-r3?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"7.79.1-r3","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-3783","versionConstraint":">= 7.33.0, < 8.19.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:haxx:curl:7.79.1:*:*:*:*:*:*:*"],"package":{"name":"curl","version":"7.79.1-r3"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-3783","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-3783","cwe":"CWE-522","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-3783","cwe":"CWE-522","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-3783","date":"2026-10-08","epss":0.00525,"percentile":0.42692}],"risk":0.27037500000000003,"urls":["https://curl.se/docs/CVE-2026-3783.html","https://curl.se/docs/CVE-2026-3783.json","https://hackerone.com/reports/3583983","http://www.openwall.com/lists/oss-security/2026/03/11/2"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-3783","description":"When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer\nperforms a redirect to a second URL, curl could leak that token to the second\nhostname under some circumstances.\n\nIf the hostname that the first request is redirected to has information in the\nused .netrc file, with either of the `machine` or `default` keywords, curl\nwould pass on the bearer token set for the first host also to the second one."},"relatedVulnerabilities":[]},{"artifact":{"id":"6040784032e8795c","cpes":["cpe:2.3:a:curl:curl:7.79.1-r3:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:7.79.1-r3:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/busybox/curl@7.79.1-r3?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"7.79.1-r3","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-3784","versionConstraint":">= 7.7, < 8.19.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:haxx:curl:7.79.1:*:*:*:*:*:*:*"],"package":{"name":"curl","version":"7.79.1-r3"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-3784","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-3784","cwe":"CWE-305","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-3784","cwe":"CWE-305","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-3784","date":"2026-10-08","epss":0.00469,"percentile":0.38615}],"risk":0.26967499999999994,"urls":["https://curl.se/docs/CVE-2026-3784.html","https://curl.se/docs/CVE-2026-3784.json","https://hackerone.com/reports/3584903","http://www.openwall.com/lists/oss-security/2026/03/11/3","https://cert-portal.siemens.com/productcert/html/ssa-253495.html"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-3784","description":"curl would wrongly reuse an existing HTTP proxy connection doing CONNECT to a\nserver, even if the new request uses different credentials for the HTTP proxy.\nThe proper behavior is to create or use a separate connection."},"relatedVulnerabilities":[]},{"artifact":{"id":"422a442f930ca27c","cpes":["cpe:2.3:a:nginx:nginx:1.18.0-r15:*:*:*:*:*:*:*"],"name":"nginx","purl":"pkg:apk/busybox/nginx@1.18.0-r15?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"1.18.0-r15","language":"","licenses":["BSD-2-Clause"],"metadata":{"Arch":"x86_64","files":[{"path":"/etc"},{"path":"/etc/logrotate.d"},{"path":"/etc/logrotate.d/nginx"},{"path":"/etc/nginx"},{"path":"/etc/nginx/fastcgi.conf"},{"path":"/etc/nginx/fastcgi_params"},{"path":"/etc/nginx/mime.types"},{"path":"/etc/nginx/nginx.conf"},{"path":"/etc/nginx/scgi_params"},{"path":"/etc/nginx/uwsgi_params"},{"path":"/etc/nginx/http.d"},{"path":"/etc/nginx/modules"},{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/nginx"},{"path":"/usr/lib/nginx/modules"},{"path":"/usr/sbin"},{"path":"/usr/sbin/nginx"},{"path":"/usr/share"},{"path":"/usr/share/nginx"},{"path":"/usr/share/nginx/http-default_server.conf"},{"path":"/var"},{"path":"/var/lib"},{"path":"/var/lib/nginx"},{"path":"/var/lib/nginx/logs"},{"path":"/var/lib/nginx/modules"},{"path":"/var/lib/nginx/run"},{"path":"/var/lib/nginx/html"},{"path":"/var/lib/nginx/html/50x.html"},{"path":"/var/lib/nginx/html/index.html"},{"path":"/var/lib/nginx/tmp"},{"path":"/var/log"},{"path":"/var/log/nginx"},{"path":"/var/www"},{"path":"/var/www/localhost"},{"path":"/var/www/localhost/htdocs"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"nginx"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:nginx:nginx:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-32647","versionConstraint":">= 1.1.19, < 1.28.3||>= 1.29.0, < 1.29.7 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:nginx:nginx:1.18.0:*:*:*:*:*:*:*"],"package":{"name":"nginx","version":"1.18.0-r15"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-32647","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"f5sirt@f5.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"f5sirt@f5.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-32647","cwe":"CWE-125","type":"Secondary","source":"f5sirt@f5.com"},{"cve":"CVE-2026-32647","cwe":"CWE-125","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-32647","date":"2026-10-08","epss":0.00344,"percentile":0.25853}],"risk":0.2671733333333333,"urls":["https://my.f5.com/manage/s/article/K000160366","https://access.redhat.com/errata/RHSA-2026:10065","https://access.redhat.com/errata/RHSA-2026:13634","https://access.redhat.com/errata/RHSA-2026:13680","https://access.redhat.com/errata/RHSA-2026:13839","https://access.redhat.com/errata/RHSA-2026:14836","https://access.redhat.com/errata/RHSA-2026:15942","https://access.redhat.com/errata/RHSA-2026:15943","https://access.redhat.com/errata/RHSA-2026:15945","https://access.redhat.com/errata/RHSA-2026:15966","https://access.redhat.com/errata/RHSA-2026:6906","https://access.redhat.com/errata/RHSA-2026:6907","https://access.redhat.com/errata/RHSA-2026:6923","https://access.redhat.com/errata/RHSA-2026:7002","https://access.redhat.com/errata/RHSA-2026:7343","https://access.redhat.com/errata/RHSA-2026:8346","https://access.redhat.com/security/cve/CVE-2026-32647","https://bugzilla.redhat.com/show_bug.cgi?id=2449598","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32647.json"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-32647","description":"NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_mp4_module module, which might allow an attacker to trigger a buffer over-read or over-write to the NGINX worker memory resulting in its termination or possibly code execution, using a specially crafted MP4 file. This issue affects NGINX Open Source and NGINX Plus if it is built with the ngx_http_mp4_module module and the mp4 directive is used in the configuration file. Additionally, the attack is possible only if an attacker can trigger the processing of a specially crafted MP4 file with the ngx_http_mp4_module module. \n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated."},"relatedVulnerabilities":[]},{"artifact":{"id":"a45c752c9b8878aa","cpes":["cpe:2.3:a:php7:php7:7.4.26-r0:*:*:*:*:*:*:*","cpe:2.3:a:php7:php:7.4.26-r0:*:*:*:*:*:*:*","cpe:2.3:a:php:php7:7.4.26-r0:*:*:*:*:*:*:*","cpe:2.3:a:php:php:7.4.26-r0:*:*:*:*:*:*:*"],"name":"php7","purl":"pkg:apk/busybox/php7@7.4.26-r0?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"7.4.26-r0","language":"","licenses":["BSD-3-Clause","LGPL-2.0-or-later","MIT","PHP-3.01","Zend-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/php"},{"path":"/usr/bin/php7"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"php7"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:php:php:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-1734","versionConstraint":"< 8.1.32||>= 8.2, < 8.2.28||>= 8.3, < 8.3.19||>= 8.4, < 8.4.5 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:php:php:7.4.26:*:*:*:*:*:*:*"],"package":{"name":"php7","version":"7.4.26-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2025-1734","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security@php.net","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-1734","cwe":"CWE-20","type":"Secondary","source":"security@php.net"}],"epss":[{"cve":"CVE-2025-1734","date":"2026-10-08","epss":0.00492,"percentile":0.40319}],"risk":0.26567999999999997,"urls":["https://github.com/php/php-src/security/advisories/GHSA-pcmh-g36c-qc44","https://lists.debian.org/debian-lts-announce/2025/03/msg00014.html","https://security.netapp.com/advisory/ntap-20250523-0009/"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-1734","description":"In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when receiving headers from HTTP server, the headers missing a colon (:) are treated as valid headers even though they are not. This may confuse applications into accepting invalid headers."},"relatedVulnerabilities":[]},{"artifact":{"id":"6040784032e8795c","cpes":["cpe:2.3:a:curl:curl:7.79.1-r3:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:7.79.1-r3:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/busybox/curl@7.79.1-r3?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"7.79.1-r3","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-6429","versionConstraint":">= 7.14.0, < 8.20.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:haxx:curl:7.79.1:*:*:*:*:*:*:*"],"package":{"name":"curl","version":"7.79.1-r3"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-6429","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6429","cwe":"CWE-200","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"}],"epss":[{"cve":"CVE-2026-6429","date":"2026-10-08","epss":0.00512,"percentile":0.41775}],"risk":0.26368,"urls":["https://curl.se/docs/CVE-2026-6429.html","https://curl.se/docs/CVE-2026-6429.json","https://hackerone.com/reports/3677759"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6429","description":"When asked to both use a `.netrc` file for credentials and to follow HTTP\nredirects, libcurl could leak the password used for the first host to the\nfollowed-to host under certain circumstances."},"relatedVulnerabilities":[]},{"artifact":{"id":"eaba89df685b6dbe","cpes":["cpe:2.3:a:musl-libc:musl:1.2.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:musl_libc:musl:1.2.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:musl:musl:1.2.2-r1:*:*:*:*:*:*:*"],"name":"musl","purl":"pkg:apk/busybox/musl@1.2.2-r1?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"1.2.2-r1","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/lib"},{"path":"/lib/ld-musl-x86_64.so.1"},{"path":"/lib/libc.musl-x86_64.so.1"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"musl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:musl-libc:musl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-26519","versionConstraint":">= 0.9.13, < 1.2.6 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:musl-libc:musl:1.2.2:*:*:*:*:*:*:*"],"package":{"name":"musl","version":"1.2.2-r1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2025-26519","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L","metrics":{"baseScore":8.1,"impactScore":6,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-26519","cwe":"CWE-787","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2025-26519","date":"2026-10-08","epss":0.00349,"percentile":0.2644}],"risk":0.2626225,"urls":["https://git.musl-libc.org/cgit/musl/commit/?id=c47ad25ea3b484e10326f933e927c0bc8cded3da","https://git.musl-libc.org/cgit/musl/commit/?id=e5adcd97b5196e29991b524237381a0202a60659","https://www.openwall.com/lists/oss-security/2025/02/13/2","http://www.openwall.com/lists/oss-security/2025/02/13/2","http://www.openwall.com/lists/oss-security/2025/02/13/3","http://www.openwall.com/lists/oss-security/2025/02/13/4","http://www.openwall.com/lists/oss-security/2025/02/13/5","http://www.openwall.com/lists/oss-security/2025/02/14/5","http://www.openwall.com/lists/oss-security/2025/02/14/6"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-26519","description":"musl libc 0.9.13 through 1.2.5 before 1.2.6 has an out-of-bounds write vulnerability when an attacker can trigger iconv conversion of untrusted EUC-KR text to UTF-8."},"relatedVulnerabilities":[]},{"artifact":{"id":"a59088f85518efa7","cpes":["cpe:2.3:a:musl-utils:musl-utils:1.2.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:musl-utils:musl_utils:1.2.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:musl_utils:musl-utils:1.2.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:musl_utils:musl_utils:1.2.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:musl-libc:musl-utils:1.2.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:musl-libc:musl_utils:1.2.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:musl:musl-utils:1.2.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:musl:musl_utils:1.2.2-r1:*:*:*:*:*:*:*"],"name":"musl-utils","purl":"pkg:apk/busybox/musl-utils@1.2.2-r1?arch=x86_64&distro=busybox-1.32.1&upstream=musl","type":"apk","version":"1.2.2-r1","language":"","licenses":["BSD","GPL2+","MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/sbin"},{"path":"/sbin/ldconfig"},{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/getconf"},{"path":"/usr/bin/getent"},{"path":"/usr/bin/iconv"},{"path":"/usr/bin/ldd"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"musl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:musl-libc:musl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-26519","versionConstraint":">= 0.9.13, < 1.2.6 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:musl-libc:musl:1.2.2:*:*:*:*:*:*:*"],"package":{"name":"musl","version":"1.2.2-r1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2025-26519","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L","metrics":{"baseScore":8.1,"impactScore":6,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-26519","cwe":"CWE-787","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2025-26519","date":"2026-10-08","epss":0.00349,"percentile":0.2644}],"risk":0.2626225,"urls":["https://git.musl-libc.org/cgit/musl/commit/?id=c47ad25ea3b484e10326f933e927c0bc8cded3da","https://git.musl-libc.org/cgit/musl/commit/?id=e5adcd97b5196e29991b524237381a0202a60659","https://www.openwall.com/lists/oss-security/2025/02/13/2","http://www.openwall.com/lists/oss-security/2025/02/13/2","http://www.openwall.com/lists/oss-security/2025/02/13/3","http://www.openwall.com/lists/oss-security/2025/02/13/4","http://www.openwall.com/lists/oss-security/2025/02/13/5","http://www.openwall.com/lists/oss-security/2025/02/14/5","http://www.openwall.com/lists/oss-security/2025/02/14/6"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-26519","description":"musl libc 0.9.13 through 1.2.5 before 1.2.6 has an out-of-bounds write vulnerability when an attacker can trigger iconv conversion of untrusted EUC-KR text to UTF-8."},"relatedVulnerabilities":[]},{"artifact":{"id":"6040784032e8795c","cpes":["cpe:2.3:a:curl:curl:7.79.1-r3:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:7.79.1-r3:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/busybox/curl@7.79.1-r3?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"7.79.1-r3","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-6276","versionConstraint":">= 7.71.0, < 8.20.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:haxx:curl:7.79.1:*:*:*:*:*:*:*"],"package":{"name":"curl","version":"7.79.1-r3"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-6276","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6276","cwe":"CWE-346","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-6276","cwe":"CWE-319","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-6276","date":"2026-10-08","epss":0.00349,"percentile":0.26447}],"risk":0.26175,"urls":["https://curl.se/docs/CVE-2026-6276.html","https://curl.se/docs/CVE-2026-6276.json","https://hackerone.com/reports/3671818","http://www.openwall.com/lists/oss-security/2026/04/29/13"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6276","description":"Using libcurl, when a custom `Host:` header is first set for an HTTP request\nand a second request is subsequently done using the same *easy handle* but\nwithout the custom `Host:` header set, the second request would use stale\ninformation and pass on cookies meant for the first host in the second\nrequest. Leak them."},"relatedVulnerabilities":[]},{"artifact":{"id":"6040784032e8795c","cpes":["cpe:2.3:a:curl:curl:7.79.1-r3:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:7.79.1-r3:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/busybox/curl@7.79.1-r3?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"7.79.1-r3","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-8286","versionConstraint":">= 7.30.0, < 8.21.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:haxx:curl:7.79.1:*:*:*:*:*:*:*"],"package":{"name":"curl","version":"7.79.1-r3"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-8286","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8286","cwe":"CWE-295","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-8286","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-8286","date":"2026-10-08","epss":0.00309,"percentile":0.21809}],"risk":0.24101999999999998,"urls":["https://curl.se/docs/CVE-2026-8286.html","https://curl.se/docs/CVE-2026-8286.json","https://hackerone.com/reports/3718195"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8286","description":"A vulnerability exists where a new transfer that uses STARTTLS to upgrade the\nconnection might reuse an existing live connection even though the TLS\nconfiguration mismatches so it should not."},"relatedVulnerabilities":[]},{"artifact":{"id":"f83ee23f6ddfb737","cpes":["cpe:2.3:a:linux-pam:linux-pam:1.5.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:linux-pam:linux_pam:1.5.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:linux_pam:linux-pam:1.5.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:linux_pam:linux_pam:1.5.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:linux:linux-pam:1.5.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:linux:linux_pam:1.5.1-r0:*:*:*:*:*:*:*"],"name":"linux-pam","purl":"pkg:apk/busybox/linux-pam@1.5.1-r0?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"1.5.1-r0","language":"","licenses":["BSD-3-Clause"],"metadata":{"Arch":"x86_64","files":[{"path":"/etc"},{"path":"/etc/environment"},{"path":"/etc/pam.d"},{"path":"/etc/pam.d/base-account"},{"path":"/etc/pam.d/base-auth"},{"path":"/etc/pam.d/base-password"},{"path":"/etc/pam.d/base-session"},{"path":"/etc/pam.d/base-session-noninteractive"},{"path":"/etc/pam.d/other"},{"path":"/etc/pam.d/su"},{"path":"/etc/pam.d/system-local-login"},{"path":"/etc/pam.d/system-login"},{"path":"/etc/security"},{"path":"/etc/security/access.conf"},{"path":"/etc/security/faillock.conf"},{"path":"/etc/security/group.conf"},{"path":"/etc/security/limits.conf"},{"path":"/etc/security/namespace.conf"},{"path":"/etc/security/namespace.init"},{"path":"/etc/security/pam_env.conf"},{"path":"/etc/security/time.conf"},{"path":"/etc/security/limits.d"},{"path":"/etc/security/namespace.d"},{"path":"/lib"},{"path":"/lib/libpam.so.0"},{"path":"/lib/libpam.so.0.85.1"},{"path":"/lib/libpam_misc.so.0"},{"path":"/lib/libpam_misc.so.0.82.1"},{"path":"/lib/libpamc.so.0"},{"path":"/lib/libpamc.so.0.82.1"},{"path":"/lib/security"},{"path":"/lib/security/pam_access.so"},{"path":"/lib/security/pam_debug.so"},{"path":"/lib/security/pam_deny.so"},{"path":"/lib/security/pam_echo.so"},{"path":"/lib/security/pam_env.so"},{"path":"/lib/security/pam_exec.so"},{"path":"/lib/security/pam_faildelay.so"},{"path":"/lib/security/pam_faillock.so"},{"path":"/lib/security/pam_filter.so"},{"path":"/lib/security/pam_ftp.so"},{"path":"/lib/security/pam_group.so"},{"path":"/lib/security/pam_issue.so"},{"path":"/lib/security/pam_keyinit.so"},{"path":"/lib/security/pam_limits.so"},{"path":"/lib/security/pam_listfile.so"},{"path":"/lib/security/pam_localuser.so"},{"path":"/lib/security/pam_loginuid.so"},{"path":"/lib/security/pam_mail.so"},{"path":"/lib/security/pam_mkhomedir.so"},{"path":"/lib/security/pam_motd.so"},{"path":"/lib/security/pam_namespace.so"},{"path":"/lib/security/pam_nologin.so"},{"path":"/lib/security/pam_permit.so"},{"path":"/lib/security/pam_pwhistory.so"},{"path":"/lib/security/pam_rootok.so"},{"path":"/lib/security/pam_securetty.so"},{"path":"/lib/security/pam_setquota.so"},{"path":"/lib/security/pam_shells.so"},{"path":"/lib/security/pam_stress.so"},{"path":"/lib/security/pam_succeed_if.so"},{"path":"/lib/security/pam_time.so"},{"path":"/lib/security/pam_timestamp.so"},{"path":"/lib/security/pam_umask.so"},{"path":"/lib/security/pam_unix.so"},{"path":"/lib/security/pam_usertype.so"},{"path":"/lib/security/pam_warn.so"},{"path":"/lib/security/pam_wheel.so"},{"path":"/lib/security/pam_xauth.so"},{"path":"/lib/security/pam_filter"},{"path":"/lib/security/pam_filter/upperLOWER"},{"path":"/sbin"},{"path":"/sbin/faillock"},{"path":"/sbin/mkhomedir_helper"},{"path":"/sbin/pam_namespace_helper"},{"path":"/sbin/pam_timestamp_check"},{"path":"/sbin/pwhistory_helper"},{"path":"/sbin/unix_chkpwd"},{"path":"/sbin/unix_update"},{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/systemd"},{"path":"/usr/lib/systemd/system"},{"path":"/usr/lib/systemd/system/pam_namespace.service"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"linux-pam"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:linux-pam:linux-pam:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2024-22365","versionConstraint":"< 1.6.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:linux-pam:linux-pam:1.5.1:*:*:*:*:*:*:*"],"package":{"name":"linux-pam","version":"1.5.1-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2024-22365","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-22365","cwe":"CWE-664","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-22365","date":"2026-10-08","epss":0.00459,"percentile":0.37771}],"risk":0.24097500000000005,"urls":["http://www.openwall.com/lists/oss-security/2024/01/18/3","https://github.com/linux-pam/linux-pam","https://github.com/linux-pam/linux-pam/commit/031bb5a5d0d950253b68138b498dc93be69a64cb","https://github.com/linux-pam/linux-pam/releases/tag/v1.6.0","https://lists.debian.org/debian-lts-announce/2025/09/msg00021.html","https://cert-portal.siemens.com/productcert/html/ssa-577017.html","https://cert-portal.siemens.com/productcert/html/ssa-794697.html"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-22365","description":"linux-pam (aka Linux PAM) before 1.6.0 allows attackers to cause a denial of service (blocked login process) via mkfifo because the openat call (for protect_dir) lacks O_DIRECTORY."},"relatedVulnerabilities":[]},{"artifact":{"id":"de2e09a252869bf3","cpes":["cpe:2.3:a:git-scm:git:2.30.6-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_scm:git:2.30.6-r0:*:*:*:*:*:*:*","cpe:2.3:a:git:git:2.30.6-r0:*:*:*:*:*:*:*"],"name":"git","purl":"pkg:apk/busybox/git@2.30.6-r0?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"2.30.6-r0","language":"","licenses":["GPL-2.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/git"},{"path":"/usr/bin/git-receive-pack"},{"path":"/usr/bin/git-shell"},{"path":"/usr/bin/git-upload-archive"},{"path":"/usr/bin/git-upload-pack"},{"path":"/usr/libexec"},{"path":"/usr/libexec/git-core"},{"path":"/usr/libexec/git-core/git"},{"path":"/usr/libexec/git-core/git-add"},{"path":"/usr/libexec/git-core/git-am"},{"path":"/usr/libexec/git-core/git-annotate"},{"path":"/usr/libexec/git-core/git-apply"},{"path":"/usr/libexec/git-core/git-archive"},{"path":"/usr/libexec/git-core/git-bisect"},{"path":"/usr/libexec/git-core/git-bisect--helper"},{"path":"/usr/libexec/git-core/git-blame"},{"path":"/usr/libexec/git-core/git-branch"},{"path":"/usr/libexec/git-core/git-bugreport"},{"path":"/usr/libexec/git-core/git-bundle"},{"path":"/usr/libexec/git-core/git-cat-file"},{"path":"/usr/libexec/git-core/git-check-attr"},{"path":"/usr/libexec/git-core/git-check-ignore"},{"path":"/usr/libexec/git-core/git-check-mailmap"},{"path":"/usr/libexec/git-core/git-check-ref-format"},{"path":"/usr/libexec/git-core/git-checkout"},{"path":"/usr/libexec/git-core/git-checkout-index"},{"path":"/usr/libexec/git-core/git-cherry"},{"path":"/usr/libexec/git-core/git-cherry-pick"},{"path":"/usr/libexec/git-core/git-clean"},{"path":"/usr/libexec/git-core/git-clone"},{"path":"/usr/libexec/git-core/git-column"},{"path":"/usr/libexec/git-core/git-commit"},{"path":"/usr/libexec/git-core/git-commit-graph"},{"path":"/usr/libexec/git-core/git-commit-tree"},{"path":"/usr/libexec/git-core/git-config"},{"path":"/usr/libexec/git-core/git-count-objects"},{"path":"/usr/libexec/git-core/git-credential"},{"path":"/usr/libexec/git-core/git-credential-cache"},{"path":"/usr/libexec/git-core/git-credential-cache--daemon"},{"path":"/usr/libexec/git-core/git-credential-store"},{"path":"/usr/libexec/git-core/git-describe"},{"path":"/usr/libexec/git-core/git-diff"},{"path":"/usr/libexec/git-core/git-diff-files"},{"path":"/usr/libexec/git-core/git-diff-index"},{"path":"/usr/libexec/git-core/git-diff-tree"},{"path":"/usr/libexec/git-core/git-difftool"},{"path":"/usr/libexec/git-core/git-difftool--helper"},{"path":"/usr/libexec/git-core/git-env--helper"},{"path":"/usr/libexec/git-core/git-fast-export"},{"path":"/usr/libexec/git-core/git-fetch"},{"path":"/usr/libexec/git-core/git-fetch-pack"},{"path":"/usr/libexec/git-core/git-filter-branch"},{"path":"/usr/libexec/git-core/git-fmt-merge-msg"},{"path":"/usr/libexec/git-core/git-for-each-ref"},{"path":"/usr/libexec/git-core/git-for-each-repo"},{"path":"/usr/libexec/git-core/git-format-patch"},{"path":"/usr/libexec/git-core/git-fsck"},{"path":"/usr/libexec/git-core/git-fsck-objects"},{"path":"/usr/libexec/git-core/git-gc"},{"path":"/usr/libexec/git-core/git-get-tar-commit-id"},{"path":"/usr/libexec/git-core/git-grep"},{"path":"/usr/libexec/git-core/git-hash-object"},{"path":"/usr/libexec/git-core/git-help"},{"path":"/usr/libexec/git-core/git-http-fetch"},{"path":"/usr/libexec/git-core/git-http-push"},{"path":"/usr/libexec/git-core/git-index-pack"},{"path":"/usr/libexec/git-core/git-init"},{"path":"/usr/libexec/git-core/git-init-db"},{"path":"/usr/libexec/git-core/git-interpret-trailers"},{"path":"/usr/libexec/git-core/git-log"},{"path":"/usr/libexec/git-core/git-ls-files"},{"path":"/usr/libexec/git-core/git-ls-remote"},{"path":"/usr/libexec/git-core/git-ls-tree"},{"path":"/usr/libexec/git-core/git-mailinfo"},{"path":"/usr/libexec/git-core/git-mailsplit"},{"path":"/usr/libexec/git-core/git-maintenance"},{"path":"/usr/libexec/git-core/git-merge"},{"path":"/usr/libexec/git-core/git-merge-base"},{"path":"/usr/libexec/git-core/git-merge-file"},{"path":"/usr/libexec/git-core/git-merge-index"},{"path":"/usr/libexec/git-core/git-merge-octopus"},{"path":"/usr/libexec/git-core/git-merge-one-file"},{"path":"/usr/libexec/git-core/git-merge-ours"},{"path":"/usr/libexec/git-core/git-merge-recursive"},{"path":"/usr/libexec/git-core/git-merge-resolve"},{"path":"/usr/libexec/git-core/git-merge-subtree"},{"path":"/usr/libexec/git-core/git-merge-tree"},{"path":"/usr/libexec/git-core/git-mergetool"},{"path":"/usr/libexec/git-core/git-mergetool--lib"},{"path":"/usr/libexec/git-core/git-mktag"},{"path":"/usr/libexec/git-core/git-mktree"},{"path":"/usr/libexec/git-core/git-multi-pack-index"},{"path":"/usr/libexec/git-core/git-mv"},{"path":"/usr/libexec/git-core/git-name-rev"},{"path":"/usr/libexec/git-core/git-notes"},{"path":"/usr/libexec/git-core/git-pack-objects"},{"path":"/usr/libexec/git-core/git-pack-redundant"},{"path":"/usr/libexec/git-core/git-pack-refs"},{"path":"/usr/libexec/git-core/git-patch-id"},{"path":"/usr/libexec/git-core/git-prune"},{"path":"/usr/libexec/git-core/git-prune-packed"},{"path":"/usr/libexec/git-core/git-pull"},{"path":"/usr/libexec/git-core/git-push"},{"path":"/usr/libexec/git-core/git-quiltimport"},{"path":"/usr/libexec/git-core/git-range-diff"},{"path":"/usr/libexec/git-core/git-read-tree"},{"path":"/usr/libexec/git-core/git-rebase"},{"path":"/usr/libexec/git-core/git-rebase--preserve-merges"},{"path":"/usr/libexec/git-core/git-receive-pack"},{"path":"/usr/libexec/git-core/git-reflog"},{"path":"/usr/libexec/git-core/git-remote"},{"path":"/usr/libexec/git-core/git-remote-ext"},{"path":"/usr/libexec/git-core/git-remote-fd"},{"path":"/usr/libexec/git-core/git-remote-ftp"},{"path":"/usr/libexec/git-core/git-remote-ftps"},{"path":"/usr/libexec/git-core/git-remote-http"},{"path":"/usr/libexec/git-core/git-remote-https"},{"path":"/usr/libexec/git-core/git-repack"},{"path":"/usr/libexec/git-core/git-replace"},{"path":"/usr/libexec/git-core/git-request-pull"},{"path":"/usr/libexec/git-core/git-rerere"},{"path":"/usr/libexec/git-core/git-reset"},{"path":"/usr/libexec/git-core/git-restore"},{"path":"/usr/libexec/git-core/git-rev-list"},{"path":"/usr/libexec/git-core/git-rev-parse"},{"path":"/usr/libexec/git-core/git-revert"},{"path":"/usr/libexec/git-core/git-rm"},{"path":"/usr/libexec/git-core/git-send-pack"},{"path":"/usr/libexec/git-core/git-sh-i18n"},{"path":"/usr/libexec/git-core/git-sh-i18n--envsubst"},{"path":"/usr/libexec/git-core/git-sh-setup"},{"path":"/usr/libexec/git-core/git-shortlog"},{"path":"/usr/libexec/git-core/git-show"},{"path":"/usr/libexec/git-core/git-show-branch"},{"path":"/usr/libexec/git-core/git-show-index"},{"path":"/usr/libexec/git-core/git-show-ref"},{"path":"/usr/libexec/git-core/git-sparse-checkout"},{"path":"/usr/libexec/git-core/git-stage"},{"path":"/usr/libexec/git-core/git-stash"},{"path":"/usr/libexec/git-core/git-status"},{"path":"/usr/libexec/git-core/git-stripspace"},{"path":"/usr/libexec/git-core/git-submodule"},{"path":"/usr/libexec/git-core/git-submodule--helper"},{"path":"/usr/libexec/git-core/git-switch"},{"path":"/usr/libexec/git-core/git-symbolic-ref"},{"path":"/usr/libexec/git-core/git-tag"},{"path":"/usr/libexec/git-core/git-unpack-file"},{"path":"/usr/libexec/git-core/git-unpack-objects"},{"path":"/usr/libexec/git-core/git-update-index"},{"path":"/usr/libexec/git-core/git-update-ref"},{"path":"/usr/libexec/git-core/git-update-server-info"},{"path":"/usr/libexec/git-core/git-upload-archive"},{"path":"/usr/libexec/git-core/git-upload-pack"},{"path":"/usr/libexec/git-core/git-var"},{"path":"/usr/libexec/git-core/git-verify-commit"},{"path":"/usr/libexec/git-core/git-verify-pack"},{"path":"/usr/libexec/git-core/git-verify-tag"},{"path":"/usr/libexec/git-core/git-web--browse"},{"path":"/usr/libexec/git-core/git-whatchanged"},{"path":"/usr/libexec/git-core/git-worktree"},{"path":"/usr/libexec/git-core/git-write-tree"},{"path":"/usr/libexec/git-core/mergetools"},{"path":"/usr/libexec/git-core/mergetools/araxis"},{"path":"/usr/libexec/git-core/mergetools/bc"},{"path":"/usr/libexec/git-core/mergetools/codecompare"},{"path":"/usr/libexec/git-core/mergetools/deltawalker"},{"path":"/usr/libexec/git-core/mergetools/diffmerge"},{"path":"/usr/libexec/git-core/mergetools/diffuse"},{"path":"/usr/libexec/git-core/mergetools/ecmerge"},{"path":"/usr/libexec/git-core/mergetools/emerge"},{"path":"/usr/libexec/git-core/mergetools/examdiff"},{"path":"/usr/libexec/git-core/mergetools/guiffy"},{"path":"/usr/libexec/git-core/mergetools/gvimdiff"},{"path":"/usr/libexec/git-core/mergetools/kdiff3"},{"path":"/usr/libexec/git-core/mergetools/kompare"},{"path":"/usr/libexec/git-core/mergetools/meld"},{"path":"/usr/libexec/git-core/mergetools/nvimdiff"},{"path":"/usr/libexec/git-core/mergetools/opendiff"},{"path":"/usr/libexec/git-core/mergetools/smerge"},{"path":"/usr/libexec/git-core/mergetools/tkdiff"},{"path":"/usr/libexec/git-core/mergetools/tortoisemerge"},{"path":"/usr/libexec/git-core/mergetools/vimdiff"},{"path":"/usr/libexec/git-core/mergetools/winmerge"},{"path":"/usr/libexec/git-core/mergetools/xxdiff"},{"path":"/usr/share"},{"path":"/usr/share/git-core"},{"path":"/usr/share/git-core/templates"},{"path":"/usr/share/git-core/templates/description"},{"path":"/usr/share/git-core/templates/branches"},{"path":"/usr/share/git-core/templates/hooks"},{"path":"/usr/share/git-core/templates/hooks/applypatch-msg.sample"},{"path":"/usr/share/git-core/templates/hooks/commit-msg.sample"},{"path":"/usr/share/git-core/templates/hooks/post-update.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-applypatch.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-commit.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-merge-commit.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-push.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-rebase.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-receive.sample"},{"path":"/usr/share/git-core/templates/hooks/prepare-commit-msg.sample"},{"path":"/usr/share/git-core/templates/hooks/push-to-checkout.sample"},{"path":"/usr/share/git-core/templates/hooks/update.sample"},{"path":"/usr/share/git-core/templates/info"},{"path":"/usr/share/git-core/templates/info/exclude"},{"path":"/usr/share/perl5"},{"path":"/var"},{"path":"/var/git"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"git"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-48386","versionConstraint":"< 2.43.7||>= 2.44.0-rc0, < 2.44.4||>= 2.45.0-rc0, < 2.45.4||>= 2.46.0-rc0, < 2.46.4||>= 2.47.0-rc0, < 2.47.3||>= 2.48.0-rc0, < 2.48.2||>= 2.49.0-rc0, < 2.49.1||>= 2.50.0-rc0, < 2.50.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:git-scm:git:2.30.6:*:*:*:*:*:*:*"],"package":{"name":"git","version":"2.30.6-r0"},"namespace":"nvd:cpe"}},{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:git:git:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-48386","versionConstraint":"< 2.43.7||>= 2.44.0-rc0, < 2.44.4||>= 2.45.0-rc0, < 2.45.4||>= 2.46.0-rc0, < 2.46.4||>= 2.47.0-rc0, < 2.47.3||>= 2.48.0-rc0, < 2.48.2||>= 2.49.0-rc0, < 2.49.1||>= 2.50.0-rc0, < 2.50.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:git:git:2.30.6:*:*:*:*:*:*:*"],"package":{"name":"git","version":"2.30.6-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2025-48386","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N","metrics":{"baseScore":6.3,"impactScore":4,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-48386","cwe":"CWE-120","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2025-48386","date":"2026-10-08","epss":0.00415,"percentile":0.33747}],"risk":0.23447499999999996,"urls":["https://github.com/git/git/security/advisories/GHSA-4v56-3xvj-xvfr","http://www.openwall.com/lists/oss-security/2025/07/08/4"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-48386","description":"Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. The wincred credential helper uses a static buffer (target) as a unique key for storing and comparing against internal storage. This credential helper does not properly bounds check the available space remaining in the buffer before appending to it with wcsncat(), leading to potential buffer overflows. This vulnerability is fixed in v2.43.7, v2.44.4, v2.45.4, v2.46.4, v2.47.3, v2.48.2, v2.49.1, and v2.50.1."},"relatedVulnerabilities":[]},{"artifact":{"id":"a45c752c9b8878aa","cpes":["cpe:2.3:a:php7:php7:7.4.26-r0:*:*:*:*:*:*:*","cpe:2.3:a:php7:php:7.4.26-r0:*:*:*:*:*:*:*","cpe:2.3:a:php:php7:7.4.26-r0:*:*:*:*:*:*:*","cpe:2.3:a:php:php:7.4.26-r0:*:*:*:*:*:*:*"],"name":"php7","purl":"pkg:apk/busybox/php7@7.4.26-r0?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"7.4.26-r0","language":"","licenses":["BSD-3-Clause","LGPL-2.0-or-later","MIT","PHP-3.01","Zend-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/php"},{"path":"/usr/bin/php7"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"php7"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:php:php:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-1217","versionConstraint":"< 8.1.32||>= 8.2, < 8.2.28||>= 8.3, < 8.3.19||>= 8.4, < 8.4.5 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:php:php:7.4.26:*:*:*:*:*:*:*"],"package":{"name":"php7","version":"7.4.26-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2025-1217","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.1,"impactScore":1.5,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security@php.net","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-1217","cwe":"CWE-20","type":"Secondary","source":"security@php.net"},{"cve":"CVE-2025-1217","cwe":"CWE-436","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-1217","date":"2026-10-08","epss":0.00573,"percentile":0.45617}],"risk":0.22060500000000002,"urls":["https://github.com/php/php-src/security/advisories/GHSA-v8xr-gpvj-cx9g","https://lists.debian.org/debian-lts-announce/2025/03/msg00014.html","https://security.netapp.com/advisory/ntap-20250523-0008/"],"severity":"Low","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-1217","description":"In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when http request module parses HTTP response obtained from a server, folded headers are parsed incorrectly, which may lead to misinterpreting the response and using incorrect headers, MIME types, etc."},"relatedVulnerabilities":[]},{"artifact":{"id":"6040784032e8795c","cpes":["cpe:2.3:a:curl:curl:7.79.1-r3:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:7.79.1-r3:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/busybox/curl@7.79.1-r3?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"7.79.1-r3","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-0167","versionConstraint":">= 7.76.0, < 8.12.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:haxx:curl:7.79.1:*:*:*:*:*:*:*"],"package":{"name":"curl","version":"7.79.1-r3"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2025-0167","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N","metrics":{"baseScore":3.4,"impactScore":1.5,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-0167","date":"2026-10-08","epss":0.00688,"percentile":0.51228}],"risk":0.22015999999999997,"urls":["https://curl.se/docs/CVE-2025-0167.html","https://curl.se/docs/CVE-2025-0167.json","https://hackerone.com/reports/2917232","https://security.netapp.com/advisory/ntap-20250306-0008/"],"severity":"Low","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-0167","description":"When asked to use a `.netrc` file for credentials **and** to follow HTTP\nredirects, curl could leak the password used for the first host to the\nfollowed-to host under certain circumstances.\n\nThis flaw only manifests itself if the netrc file has a `default` entry that\nomits both login and password. A rare circumstance."},"relatedVulnerabilities":[]},{"artifact":{"id":"6040784032e8795c","cpes":["cpe:2.3:a:curl:curl:7.79.1-r3:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:7.79.1-r3:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/busybox/curl@7.79.1-r3?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"7.79.1-r3","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-8458","versionConstraint":">= 7.43.0, < 8.21.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:haxx:curl:7.79.1:*:*:*:*:*:*:*"],"package":{"name":"curl","version":"7.79.1-r3"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-8458","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8458","cwe":"CWE-488","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"}],"epss":[{"cve":"CVE-2026-8458","date":"2026-10-08","epss":0.00371,"percentile":0.29004}],"risk":0.213325,"urls":["https://curl.se/docs/CVE-2026-8458.html","https://curl.se/docs/CVE-2026-8458.json","https://hackerone.com/reports/3721183"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8458","description":"libcurl might in some circumstances reuse the wrong connection when asked to\ndo Negotiate-authenticated ones, even when they are set to use different\n\"services\".\n\nlibcurl features a pool of recent connections so that subsequent requests can\nreuse an existing connection to avoid overhead.\n\nWhen reusing a connection a range of criteria must be met. Due to a logical\nerror in the code, a request that was issued by an application could\nwrongfully reuse an existing connection to the same server that was\nauthenticated using different services."},"relatedVulnerabilities":[]},{"artifact":{"id":"422a442f930ca27c","cpes":["cpe:2.3:a:nginx:nginx:1.18.0-r15:*:*:*:*:*:*:*"],"name":"nginx","purl":"pkg:apk/busybox/nginx@1.18.0-r15?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"1.18.0-r15","language":"","licenses":["BSD-2-Clause"],"metadata":{"Arch":"x86_64","files":[{"path":"/etc"},{"path":"/etc/logrotate.d"},{"path":"/etc/logrotate.d/nginx"},{"path":"/etc/nginx"},{"path":"/etc/nginx/fastcgi.conf"},{"path":"/etc/nginx/fastcgi_params"},{"path":"/etc/nginx/mime.types"},{"path":"/etc/nginx/nginx.conf"},{"path":"/etc/nginx/scgi_params"},{"path":"/etc/nginx/uwsgi_params"},{"path":"/etc/nginx/http.d"},{"path":"/etc/nginx/modules"},{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/nginx"},{"path":"/usr/lib/nginx/modules"},{"path":"/usr/sbin"},{"path":"/usr/sbin/nginx"},{"path":"/usr/share"},{"path":"/usr/share/nginx"},{"path":"/usr/share/nginx/http-default_server.conf"},{"path":"/var"},{"path":"/var/lib"},{"path":"/var/lib/nginx"},{"path":"/var/lib/nginx/logs"},{"path":"/var/lib/nginx/modules"},{"path":"/var/lib/nginx/run"},{"path":"/var/lib/nginx/html"},{"path":"/var/lib/nginx/html/50x.html"},{"path":"/var/lib/nginx/html/index.html"},{"path":"/var/lib/nginx/tmp"},{"path":"/var/log"},{"path":"/var/log/nginx"},{"path":"/var/www"},{"path":"/var/www/localhost"},{"path":"/var/www/localhost/htdocs"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"nginx"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:nginx:nginx:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-53859","versionConstraint":">= 0.7, < 1.29.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:nginx:nginx:1.18.0:*:*:*:*:*:*:*"],"package":{"name":"nginx","version":"1.18.0-r15"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2025-53859","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"f5sirt@f5.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"f5sirt@f5.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-53859","cwe":"CWE-125","type":"Secondary","source":"f5sirt@f5.com"}],"epss":[{"cve":"CVE-2025-53859","date":"2026-10-08","epss":0.00413,"percentile":0.3357}],"risk":0.2065,"urls":["https://my.f5.com/manage/s/article/K000152786","http://www.openwall.com/lists/oss-security/2025/08/13/5"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-53859","description":"NGINX Open Source and NGINX Plus have a vulnerability in the ngx_mail_smtp_module that might allow an unauthenticated attacker to over-read NGINX SMTP authentication process memory; as a result, the server side may leak arbitrary bytes sent in a request to the authentication server. This issue happens during the NGINX SMTP authentication process and requires the attacker to make preparations against the target system to extract the leaked data. The issue affects NGINX only if (1) it is built with the ngx_mail_smtp_module, (2) the smtp_auth directive is configured with method \"none,\" and (3) the authentication server returns the \"Auth-Wait\" response header.\n\n\n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated."},"relatedVulnerabilities":[]},{"artifact":{"id":"a90dde7f3f17ba55","cpes":["cpe:2.3:a:coreutils:coreutils:8.32-r2:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils:8.32-r2:*:*:*:*:*:*:*"],"name":"coreutils","purl":"pkg:apk/busybox/coreutils@8.32-r2?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"8.32-r2","language":"","licenses":["GPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/bin"},{"path":"/bin/base64"},{"path":"/bin/cat"},{"path":"/bin/chgrp"},{"path":"/bin/chmod"},{"path":"/bin/chown"},{"path":"/bin/cp"},{"path":"/bin/date"},{"path":"/bin/dd"},{"path":"/bin/df"},{"path":"/bin/echo"},{"path":"/bin/false"},{"path":"/bin/ln"},{"path":"/bin/ls"},{"path":"/bin/mkdir"},{"path":"/bin/mknod"},{"path":"/bin/mktemp"},{"path":"/bin/mv"},{"path":"/bin/nice"},{"path":"/bin/printenv"},{"path":"/bin/pwd"},{"path":"/bin/rm"},{"path":"/bin/rmdir"},{"path":"/bin/sleep"},{"path":"/bin/stat"},{"path":"/bin/stty"},{"path":"/bin/sync"},{"path":"/bin/touch"},{"path":"/bin/true"},{"path":"/bin/uname"},{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/["},{"path":"/usr/bin/b2sum"},{"path":"/usr/bin/base32"},{"path":"/usr/bin/basename"},{"path":"/usr/bin/basenc"},{"path":"/usr/bin/chcon"},{"path":"/usr/bin/cksum"},{"path":"/usr/bin/comm"},{"path":"/usr/bin/coreutils"},{"path":"/usr/bin/csplit"},{"path":"/usr/bin/cut"},{"path":"/usr/bin/dir"},{"path":"/usr/bin/dircolors"},{"path":"/usr/bin/dirname"},{"path":"/usr/bin/du"},{"path":"/usr/bin/env"},{"path":"/usr/bin/expand"},{"path":"/usr/bin/expr"},{"path":"/usr/bin/factor"},{"path":"/usr/bin/fmt"},{"path":"/usr/bin/fold"},{"path":"/usr/bin/groups"},{"path":"/usr/bin/head"},{"path":"/usr/bin/hostid"},{"path":"/usr/bin/id"},{"path":"/usr/bin/install"},{"path":"/usr/bin/join"},{"path":"/usr/bin/link"},{"path":"/usr/bin/logname"},{"path":"/usr/bin/md5sum"},{"path":"/usr/bin/mkfifo"},{"path":"/usr/bin/nl"},{"path":"/usr/bin/nohup"},{"path":"/usr/bin/nproc"},{"path":"/usr/bin/numfmt"},{"path":"/usr/bin/od"},{"path":"/usr/bin/paste"},{"path":"/usr/bin/pathchk"},{"path":"/usr/bin/pinky"},{"path":"/usr/bin/pr"},{"path":"/usr/bin/printf"},{"path":"/usr/bin/ptx"},{"path":"/usr/bin/readlink"},{"path":"/usr/bin/realpath"},{"path":"/usr/bin/runcon"},{"path":"/usr/bin/seq"},{"path":"/usr/bin/sha1sum"},{"path":"/usr/bin/sha224sum"},{"path":"/usr/bin/sha256sum"},{"path":"/usr/bin/sha384sum"},{"path":"/usr/bin/sha512sum"},{"path":"/usr/bin/shred"},{"path":"/usr/bin/shuf"},{"path":"/usr/bin/sort"},{"path":"/usr/bin/split"},{"path":"/usr/bin/stdbuf"},{"path":"/usr/bin/sum"},{"path":"/usr/bin/tac"},{"path":"/usr/bin/tail"},{"path":"/usr/bin/tee"},{"path":"/usr/bin/test"},{"path":"/usr/bin/timeout"},{"path":"/usr/bin/tr"},{"path":"/usr/bin/truncate"},{"path":"/usr/bin/tsort"},{"path":"/usr/bin/tty"},{"path":"/usr/bin/unexpand"},{"path":"/usr/bin/uniq"},{"path":"/usr/bin/unlink"},{"path":"/usr/bin/users"},{"path":"/usr/bin/vdir"},{"path":"/usr/bin/wc"},{"path":"/usr/bin/who"},{"path":"/usr/bin/whoami"},{"path":"/usr/bin/yes"},{"path":"/usr/libexec"},{"path":"/usr/libexec/coreutils"},{"path":"/usr/libexec/coreutils/libstdbuf.so"},{"path":"/usr/sbin"},{"path":"/usr/sbin/chroot"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"coreutils"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:gnu:coreutils:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2016-2781","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:gnu:coreutils:8.32:*:*:*:*:*:*:*"],"package":{"name":"coreutils","version":"8.32-r2"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2016-2781","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":4,"exploitabilityScore":2.1},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:L/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":2.1,"impactScore":2.9,"exploitabilityScore":4},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":4.6,"impactScore":2.8,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-2781","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2016-2781","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2016-2781","date":"2026-10-08","epss":0.00428,"percentile":0.35056}],"risk":0.20115999999999998,"urls":["http://www.openwall.com/lists/oss-security/2016/02/28/2","http://www.openwall.com/lists/oss-security/2016/02/28/3","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-2781","description":"chroot in GNU coreutils, when used with --userspec, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer."},"relatedVulnerabilities":[]},{"artifact":{"id":"d081de97c6f633df","cpes":["cpe:2.3:a:libcrypto1.1:libcrypto1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto1.1:libcrypto:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto:libcrypto1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto:libcrypto:1.1.1q-r0:*:*:*:*:*:*:*"],"name":"libcrypto1.1","purl":"pkg:apk/busybox/libcrypto1.1@1.1.1q-r0?arch=x86_64&distro=busybox-1.32.1&upstream=openssl","type":"apk","version":"1.1.1q-r0","language":"","licenses":["OpenSSL"],"metadata":{"Arch":"x86_64","files":[{"path":"/etc"},{"path":"/etc/ssl"},{"path":"/etc/ssl/ct_log_list.cnf"},{"path":"/etc/ssl/ct_log_list.cnf.dist"},{"path":"/etc/ssl/openssl.cnf"},{"path":"/etc/ssl/openssl.cnf.dist"},{"path":"/etc/ssl/certs"},{"path":"/etc/ssl/misc"},{"path":"/etc/ssl/misc/CA.pl"},{"path":"/etc/ssl/misc/tsget"},{"path":"/etc/ssl/misc/tsget.pl"},{"path":"/etc/ssl/private"},{"path":"/lib"},{"path":"/lib/libcrypto.so.1.1"},{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcrypto.so.1.1"},{"path":"/usr/lib/engines-1.1"},{"path":"/usr/lib/engines-1.1/afalg.so"},{"path":"/usr/lib/engines-1.1/capi.so"},{"path":"/usr/lib/engines-1.1/padlock.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-75806","versionConstraint":">= 1.1.1, < 1.1.1zj||>= 3.0.0, < 3.0.23||>= 3.4.0, < 3.4.8||>= 3.5.0, < 3.5.9||>= 3.6.0, < 3.6.5||>= 4.0.0, < 4.0.3 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:1.1.1q:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"1.1.1q-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-75806","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75806","cwe":"CWE-1284","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-75806","date":"2026-10-08","epss":0.00387,"percentile":0.30642}],"risk":0.199305,"urls":["https://github.com/openssl/openssl/commit/04728a289a823e68137f88da016cb9ede307217d","https://github.com/openssl/openssl/commit/050b275cd671a6eed1d6457642d41a5a77aab972","https://github.com/openssl/openssl/commit/3a4589d015a9049d47b66f186cf50a8711343a1d","https://github.com/openssl/openssl/commit/5af82fefbaf2b5fec2fc0e1d87f112844902f01d","https://openssl-library.org/news/secadv/20260929.txt"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-75806","description":"Issue summary: An established DTLS 1.2 association using an AEAD cipher suite\ncan be terminated by a single unauthenticated datagram whose encrypted\nfragment is shorter than the mandatory explicit IV and authentication tag\noverhead.\n\nImpact summary: An attacker who can send a datagram that is routed to an\nexisting DTLS 1.2 association can tear that association down without knowing\nany key material. This is a Denial of Service limited to the targeted\nassociation. There is no memory safety or confidentiality impact.\n\nCWE: CWE-1284: Improper Validation of Specified Quantity in Input\n\nDescription: In TLS 1.2 and DTLS 1.2 every record protected by an AEAD cipher\nsuite carries an explicit IV followed by the ciphertext and an authentication\ntag. When decrypting such a record the record layer passed the record length to\nthe cipher implementation before checking that the record was long enough to\ncontain the explicit IV and the tag. For a record shorter than that overhead the\ncipher implementation rejected the impossible length, and the record layer\ntreated this as an internal failure and raised a fatal internal_error alert\ninstead of treating the record as one that failed authentication.\n\nIn TLS 1.2 the same record causes a fatal internal_error alert instead of the\nexpected bad_record_mac alert. Since any undecryptable record already\nterminates a TLS connection, this is a protocol conformance issue rather than\na security issue in TLS.\n\nThe fix validates the record length against the explicit IV and tag length\nbefore any AEAD processing, so that TLS reports bad_record_mac and DTLS\nsilently discards the record.\n\nFIPS impact: no\nThe affected code is outside the FIPS module boundary."},"relatedVulnerabilities":[]},{"artifact":{"id":"74f4e71ff41d2d68","cpes":["cpe:2.3:a:libssl1.1:libssl1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl1.1:libssl:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl:1.1.1q-r0:*:*:*:*:*:*:*"],"name":"libssl1.1","purl":"pkg:apk/busybox/libssl1.1@1.1.1q-r0?arch=x86_64&distro=busybox-1.32.1&upstream=openssl","type":"apk","version":"1.1.1q-r0","language":"","licenses":["OpenSSL"],"metadata":{"Arch":"x86_64","files":[{"path":"/lib"},{"path":"/lib/libssl.so.1.1"},{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libssl.so.1.1"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-75806","versionConstraint":">= 1.1.1, < 1.1.1zj||>= 3.0.0, < 3.0.23||>= 3.4.0, < 3.4.8||>= 3.5.0, < 3.5.9||>= 3.6.0, < 3.6.5||>= 4.0.0, < 4.0.3 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:1.1.1q:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"1.1.1q-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-75806","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75806","cwe":"CWE-1284","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-75806","date":"2026-10-08","epss":0.00387,"percentile":0.30642}],"risk":0.199305,"urls":["https://github.com/openssl/openssl/commit/04728a289a823e68137f88da016cb9ede307217d","https://github.com/openssl/openssl/commit/050b275cd671a6eed1d6457642d41a5a77aab972","https://github.com/openssl/openssl/commit/3a4589d015a9049d47b66f186cf50a8711343a1d","https://github.com/openssl/openssl/commit/5af82fefbaf2b5fec2fc0e1d87f112844902f01d","https://openssl-library.org/news/secadv/20260929.txt"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-75806","description":"Issue summary: An established DTLS 1.2 association using an AEAD cipher suite\ncan be terminated by a single unauthenticated datagram whose encrypted\nfragment is shorter than the mandatory explicit IV and authentication tag\noverhead.\n\nImpact summary: An attacker who can send a datagram that is routed to an\nexisting DTLS 1.2 association can tear that association down without knowing\nany key material. This is a Denial of Service limited to the targeted\nassociation. There is no memory safety or confidentiality impact.\n\nCWE: CWE-1284: Improper Validation of Specified Quantity in Input\n\nDescription: In TLS 1.2 and DTLS 1.2 every record protected by an AEAD cipher\nsuite carries an explicit IV followed by the ciphertext and an authentication\ntag. When decrypting such a record the record layer passed the record length to\nthe cipher implementation before checking that the record was long enough to\ncontain the explicit IV and the tag. For a record shorter than that overhead the\ncipher implementation rejected the impossible length, and the record layer\ntreated this as an internal failure and raised a fatal internal_error alert\ninstead of treating the record as one that failed authentication.\n\nIn TLS 1.2 the same record causes a fatal internal_error alert instead of the\nexpected bad_record_mac alert. Since any undecryptable record already\nterminates a TLS connection, this is a protocol conformance issue rather than\na security issue in TLS.\n\nThe fix validates the record length against the explicit IV and tag length\nbefore any AEAD processing, so that TLS reports bad_record_mac and DTLS\nsilently discards the record.\n\nFIPS impact: no\nThe affected code is outside the FIPS module boundary."},"relatedVulnerabilities":[]},{"artifact":{"id":"14807b4f7067817d","cpes":["cpe:2.3:a:openssl:openssl:1.1.1q-r0:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:apk/busybox/openssl@1.1.1q-r0?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"1.1.1q-r0","language":"","licenses":["OpenSSL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/openssl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-75806","versionConstraint":">= 1.1.1, < 1.1.1zj||>= 3.0.0, < 3.0.23||>= 3.4.0, < 3.4.8||>= 3.5.0, < 3.5.9||>= 3.6.0, < 3.6.5||>= 4.0.0, < 4.0.3 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:1.1.1q:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"1.1.1q-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-75806","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75806","cwe":"CWE-1284","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-75806","date":"2026-10-08","epss":0.00387,"percentile":0.30642}],"risk":0.199305,"urls":["https://github.com/openssl/openssl/commit/04728a289a823e68137f88da016cb9ede307217d","https://github.com/openssl/openssl/commit/050b275cd671a6eed1d6457642d41a5a77aab972","https://github.com/openssl/openssl/commit/3a4589d015a9049d47b66f186cf50a8711343a1d","https://github.com/openssl/openssl/commit/5af82fefbaf2b5fec2fc0e1d87f112844902f01d","https://openssl-library.org/news/secadv/20260929.txt"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-75806","description":"Issue summary: An established DTLS 1.2 association using an AEAD cipher suite\ncan be terminated by a single unauthenticated datagram whose encrypted\nfragment is shorter than the mandatory explicit IV and authentication tag\noverhead.\n\nImpact summary: An attacker who can send a datagram that is routed to an\nexisting DTLS 1.2 association can tear that association down without knowing\nany key material. This is a Denial of Service limited to the targeted\nassociation. There is no memory safety or confidentiality impact.\n\nCWE: CWE-1284: Improper Validation of Specified Quantity in Input\n\nDescription: In TLS 1.2 and DTLS 1.2 every record protected by an AEAD cipher\nsuite carries an explicit IV followed by the ciphertext and an authentication\ntag. When decrypting such a record the record layer passed the record length to\nthe cipher implementation before checking that the record was long enough to\ncontain the explicit IV and the tag. For a record shorter than that overhead the\ncipher implementation rejected the impossible length, and the record layer\ntreated this as an internal failure and raised a fatal internal_error alert\ninstead of treating the record as one that failed authentication.\n\nIn TLS 1.2 the same record causes a fatal internal_error alert instead of the\nexpected bad_record_mac alert. Since any undecryptable record already\nterminates a TLS connection, this is a protocol conformance issue rather than\na security issue in TLS.\n\nThe fix validates the record length against the explicit IV and tag length\nbefore any AEAD processing, so that TLS reports bad_record_mac and DTLS\nsilently discards the record.\n\nFIPS impact: no\nThe affected code is outside the FIPS module boundary."},"relatedVulnerabilities":[]},{"artifact":{"id":"a45c752c9b8878aa","cpes":["cpe:2.3:a:php7:php7:7.4.26-r0:*:*:*:*:*:*:*","cpe:2.3:a:php7:php:7.4.26-r0:*:*:*:*:*:*:*","cpe:2.3:a:php:php7:7.4.26-r0:*:*:*:*:*:*:*","cpe:2.3:a:php:php:7.4.26-r0:*:*:*:*:*:*:*"],"name":"php7","purl":"pkg:apk/busybox/php7@7.4.26-r0?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"7.4.26-r0","language":"","licenses":["BSD-3-Clause","LGPL-2.0-or-later","MIT","PHP-3.01","Zend-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/php"},{"path":"/usr/bin/php7"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"php7"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:php:php:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2022-4900","versionConstraint":">= 7.4.0, < 8.0.22 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:php:php:7.4.26:*:*:*:*:*:*:*"],"package":{"name":"php7","version":"7.4.26-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2022-4900","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-4900","cwe":"CWE-119","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2022-4900","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-4900","date":"2026-10-08","epss":0.00367,"percentile":0.28454}],"risk":0.19909749999999998,"urls":["https://access.redhat.com/security/cve/CVE-2022-4900","https://bugzilla.redhat.com/show_bug.cgi?id=2179880","https://security.netapp.com/advisory/ntap-20231130-0008/","https://lists.debian.org/debian-lts-announce/2024/10/msg00011.html","https://github.com/php/php-src/commit/789a37f14405e2d1a05a76c9fb4ed2d49d4580d5","https://github.com/php/php-src/commit/82effb3fc7bcab0efcc343b3e03355f5f2f663c9"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-4900","description":"A vulnerability was found in PHP where setting the environment variable PHP_CLI_SERVER_WORKERS to a large value leads to a heap buffer overflow."},"relatedVulnerabilities":[]},{"artifact":{"id":"6040784032e8795c","cpes":["cpe:2.3:a:curl:curl:7.79.1-r3:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:7.79.1-r3:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/busybox/curl@7.79.1-r3?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"7.79.1-r3","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-10966","versionConstraint":">= 7.69.0, < 8.16.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:haxx:curl:7.79.1:*:*:*:*:*:*:*"],"package":{"name":"curl","version":"7.79.1-r3"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2025-10966","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-10966","cwe":"CWE-322","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"}],"epss":[{"cve":"CVE-2025-10966","date":"2026-10-08","epss":0.00427,"percentile":0.34978}],"risk":0.198555,"urls":["https://curl.se/docs/CVE-2025-10966.html","https://curl.se/docs/CVE-2025-10966.json","https://hackerone.com/reports/3355218","http://www.openwall.com/lists/oss-security/2025/11/05/2","https://cert-portal.siemens.com/productcert/html/ssa-253495.html","https://github.com/curl/curl/commit/b011e3fcfb06d6c0278595ee2ee297036fbe9793"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-10966","description":"curl's code for managing SSH connections when SFTP was done using the wolfSSH\npowered backend was flawed and missed host verification mechanisms.\n\nThis prevents curl from detecting MITM attackers and more."},"relatedVulnerabilities":[]},{"artifact":{"id":"422a442f930ca27c","cpes":["cpe:2.3:a:nginx:nginx:1.18.0-r15:*:*:*:*:*:*:*"],"name":"nginx","purl":"pkg:apk/busybox/nginx@1.18.0-r15?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"1.18.0-r15","language":"","licenses":["BSD-2-Clause"],"metadata":{"Arch":"x86_64","files":[{"path":"/etc"},{"path":"/etc/logrotate.d"},{"path":"/etc/logrotate.d/nginx"},{"path":"/etc/nginx"},{"path":"/etc/nginx/fastcgi.conf"},{"path":"/etc/nginx/fastcgi_params"},{"path":"/etc/nginx/mime.types"},{"path":"/etc/nginx/nginx.conf"},{"path":"/etc/nginx/scgi_params"},{"path":"/etc/nginx/uwsgi_params"},{"path":"/etc/nginx/http.d"},{"path":"/etc/nginx/modules"},{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/nginx"},{"path":"/usr/lib/nginx/modules"},{"path":"/usr/sbin"},{"path":"/usr/sbin/nginx"},{"path":"/usr/share"},{"path":"/usr/share/nginx"},{"path":"/usr/share/nginx/http-default_server.conf"},{"path":"/var"},{"path":"/var/lib"},{"path":"/var/lib/nginx"},{"path":"/var/lib/nginx/logs"},{"path":"/var/lib/nginx/modules"},{"path":"/var/lib/nginx/run"},{"path":"/var/lib/nginx/html"},{"path":"/var/lib/nginx/html/50x.html"},{"path":"/var/lib/nginx/html/index.html"},{"path":"/var/lib/nginx/tmp"},{"path":"/var/log"},{"path":"/var/log/nginx"},{"path":"/var/www"},{"path":"/var/www/localhost"},{"path":"/var/www/localhost/htdocs"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"nginx"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:nginx:nginx:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-48142","versionConstraint":">= 1.0.0, < 1.30.3||>= 1.31.0, < 1.31.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:nginx:nginx:1.18.0:*:*:*:*:*:*:*"],"package":{"name":"nginx","version":"1.18.0-r15"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-48142","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"f5sirt@f5.com","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"f5sirt@f5.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L","metrics":{"baseScore":4.8,"impactScore":2.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-48142","cwe":"CWE-125","type":"Secondary","source":"f5sirt@f5.com"}],"epss":[{"cve":"CVE-2026-48142","date":"2026-10-08","epss":0.00373,"percentile":0.29122}],"risk":0.19675749999999997,"urls":["https://my.f5.com/manage/s/article/K000161585"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-48142","description":"NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_charset_module module. When content is served or proxied through a location block with both source_charset utf-8; and a charset directive (for example, charset koi8-r;) configured, remote, unauthenticated attackers can send requests (in conjunction with conditions beyond their control) to cause a heap buffer over-read in the NGINX worker process, leading to limited disclosure of memory or a restart. \n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated."},"relatedVulnerabilities":[]},{"artifact":{"id":"6040784032e8795c","cpes":["cpe:2.3:a:curl:curl:7.79.1-r3:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:7.79.1-r3:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/busybox/curl@7.79.1-r3?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"7.79.1-r3","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-4873","versionConstraint":">= 7.20.0, < 8.20.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:haxx:curl:7.79.1:*:*:*:*:*:*:*"],"package":{"name":"curl","version":"7.79.1-r3"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-4873","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-4873","cwe":"CWE-319","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-4873","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-4873","cwe":"CWE-319","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-4873","date":"2026-10-08","epss":0.00359,"percentile":0.27581}],"risk":0.195655,"urls":["https://curl.se/docs/CVE-2026-4873.html","https://curl.se/docs/CVE-2026-4873.json","https://hackerone.com/reports/3621851","http://www.openwall.com/lists/oss-security/2026/04/29/7"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-4873","description":"A vulnerability exists where a connection requiring TLS incorrectly reuses an\nexisting unencrypted connection from the same connection pool. If an initial\ntransfer is made in clear-text (via IMAP, SMTP, or POP3), a subsequent request\nto that same host bypasses the TLS requirement and instead transmit data\nunencrypted."},"relatedVulnerabilities":[]},{"artifact":{"id":"43a7af5360b6604e","cpes":["cpe:2.3:a:pcre2:pcre2:10.36-r1:*:*:*:*:*:*:*","cpe:2.3:a:pcre2:pcre:10.36-r1:*:*:*:*:*:*:*","cpe:2.3:a:pcre:pcre2:10.36-r1:*:*:*:*:*:*:*","cpe:2.3:a:pcre:pcre:10.36-r1:*:*:*:*:*:*:*"],"name":"pcre2","purl":"pkg:apk/busybox/pcre2@10.36-r1?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"10.36-r1","language":"","licenses":["BSD-3-Clause"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpcre2-8.so.0"},{"path":"/usr/lib/libpcre2-8.so.0.10.1"},{"path":"/usr/lib/libpcre2-posix.so.2"},{"path":"/usr/lib/libpcre2-posix.so.2.0.3"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"pcre2"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:pcre:pcre2:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-89157","versionConstraint":">= 10.30, < 10.48||= 10.48-rc1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:pcre:pcre2:10.36:*:*:*:*:*:*:*"],"package":{"name":"pcre2","version":"10.36-r1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-89157","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L","metrics":{"baseScore":5.7,"impactScore":4.3,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89157","cwe":"CWE-190","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-89157","date":"2026-10-08","epss":0.00278,"percentile":0.18565}],"risk":0.195295,"urls":["https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48","https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-q8g2-wprr-34m9"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-89157","description":"PCRE2 before 10.48, on 32-bit platforms, has a pcre2_pattern_convert out-of-bounds write when an attacker can provide a large pattern."},"relatedVulnerabilities":[]},{"artifact":{"id":"90f72c5b07fcdbc9","cpes":["cpe:2.3:a:busybox:busybox:1.32.1-r9:*:*:*:*:*:*:*"],"name":"busybox","purl":"pkg:apk/busybox/busybox@1.32.1-r9?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"1.32.1-r9","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/bin"},{"path":"/bin/busybox"},{"path":"/bin/sh"},{"path":"/etc"},{"path":"/etc/securetty"},{"path":"/etc/udhcpd.conf"},{"path":"/etc/logrotate.d"},{"path":"/etc/logrotate.d/acpid"},{"path":"/etc/network"},{"path":"/etc/network/if-down.d"},{"path":"/etc/network/if-post-down.d"},{"path":"/etc/network/if-post-up.d"},{"path":"/etc/network/if-pre-down.d"},{"path":"/etc/network/if-pre-up.d"},{"path":"/etc/network/if-up.d"},{"path":"/etc/network/if-up.d/dad"},{"path":"/sbin"},{"path":"/tmp"},{"path":"/usr"},{"path":"/usr/sbin"},{"path":"/usr/share"},{"path":"/usr/share/udhcpc"},{"path":"/usr/share/udhcpc/default.script"},{"path":"/var"},{"path":"/var/cache"},{"path":"/var/cache/misc"},{"path":"/var/lib"},{"path":"/var/lib/udhcpd"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"busybox"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:busybox:busybox:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2021-42376","versionConstraint":">= 1.16.0, < 1.34.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:busybox:busybox:1.32.1:*:*:*:*:*:*:*"],"package":{"name":"busybox","version":"1.32.1-r9"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2021-42376","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:L/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":1.9,"impactScore":2.9,"exploitabilityScore":3.4},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-42376","cwe":"CWE-476","type":"Secondary","source":"reefs@jfrog.com"},{"cve":"CVE-2021-42376","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-42376","date":"2026-10-08","epss":0.00432,"percentile":0.35546}],"risk":0.18792,"urls":["https://claroty.com/team82/research/unboxing-busybox-14-vulnerabilities-uncovered-by-claroty-jfrog","https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/","https://security.netapp.com/advisory/ntap-20211223-0002/"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-42376","description":"A NULL pointer dereference in Busybox's hush applet leads to denial of service when processing a crafted shell command, due to missing validation after a \\x03 delimiter character. This may be used for DoS under very rare conditions of filtered command input."},"relatedVulnerabilities":[]},{"artifact":{"id":"35fec91b9e067f61","cpes":["cpe:2.3:a:ssl-client:ssl-client:1.32.1-r9:*:*:*:*:*:*:*","cpe:2.3:a:ssl-client:ssl_client:1.32.1-r9:*:*:*:*:*:*:*","cpe:2.3:a:ssl_client:ssl-client:1.32.1-r9:*:*:*:*:*:*:*","cpe:2.3:a:ssl_client:ssl_client:1.32.1-r9:*:*:*:*:*:*:*","cpe:2.3:a:ssl:ssl-client:1.32.1-r9:*:*:*:*:*:*:*","cpe:2.3:a:ssl:ssl_client:1.32.1-r9:*:*:*:*:*:*:*"],"name":"ssl_client","purl":"pkg:apk/busybox/ssl_client@1.32.1-r9?arch=x86_64&distro=busybox-1.32.1&upstream=busybox","type":"apk","version":"1.32.1-r9","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/ssl_client"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"busybox"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:busybox:busybox:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2021-42376","versionConstraint":">= 1.16.0, < 1.34.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:busybox:busybox:1.32.1:*:*:*:*:*:*:*"],"package":{"name":"busybox","version":"1.32.1-r9"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2021-42376","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:L/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":1.9,"impactScore":2.9,"exploitabilityScore":3.4},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-42376","cwe":"CWE-476","type":"Secondary","source":"reefs@jfrog.com"},{"cve":"CVE-2021-42376","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-42376","date":"2026-10-08","epss":0.00432,"percentile":0.35546}],"risk":0.18792,"urls":["https://claroty.com/team82/research/unboxing-busybox-14-vulnerabilities-uncovered-by-claroty-jfrog","https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/","https://security.netapp.com/advisory/ntap-20211223-0002/"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-42376","description":"A NULL pointer dereference in Busybox's hush applet leads to denial of service when processing a crafted shell command, due to missing validation after a \\x03 delimiter character. This may be used for DoS under very rare conditions of filtered command input."},"relatedVulnerabilities":[]},{"artifact":{"id":"19103520a7fb35af","cpes":["cpe:2.3:a:nghttp2-libs:nghttp2-libs:1.42.0-r1:*:*:*:*:*:*:*","cpe:2.3:a:nghttp2-libs:nghttp2_libs:1.42.0-r1:*:*:*:*:*:*:*","cpe:2.3:a:nghttp2_libs:nghttp2-libs:1.42.0-r1:*:*:*:*:*:*:*","cpe:2.3:a:nghttp2_libs:nghttp2_libs:1.42.0-r1:*:*:*:*:*:*:*","cpe:2.3:a:nghttp-libs:nghttp2-libs:1.42.0-r1:*:*:*:*:*:*:*","cpe:2.3:a:nghttp-libs:nghttp2_libs:1.42.0-r1:*:*:*:*:*:*:*","cpe:2.3:a:nghttp2-libs:nghttp-libs:1.42.0-r1:*:*:*:*:*:*:*","cpe:2.3:a:nghttp2-libs:nghttp_libs:1.42.0-r1:*:*:*:*:*:*:*","cpe:2.3:a:nghttp2_libs:nghttp-libs:1.42.0-r1:*:*:*:*:*:*:*","cpe:2.3:a:nghttp2_libs:nghttp_libs:1.42.0-r1:*:*:*:*:*:*:*","cpe:2.3:a:nghttp_libs:nghttp2-libs:1.42.0-r1:*:*:*:*:*:*:*","cpe:2.3:a:nghttp_libs:nghttp2_libs:1.42.0-r1:*:*:*:*:*:*:*","cpe:2.3:a:nghttp-libs:nghttp-libs:1.42.0-r1:*:*:*:*:*:*:*","cpe:2.3:a:nghttp-libs:nghttp_libs:1.42.0-r1:*:*:*:*:*:*:*","cpe:2.3:a:nghttp_libs:nghttp-libs:1.42.0-r1:*:*:*:*:*:*:*","cpe:2.3:a:nghttp_libs:nghttp_libs:1.42.0-r1:*:*:*:*:*:*:*","cpe:2.3:a:nghttp2:nghttp2-libs:1.42.0-r1:*:*:*:*:*:*:*","cpe:2.3:a:nghttp2:nghttp2_libs:1.42.0-r1:*:*:*:*:*:*:*","cpe:2.3:a:nghttp2:nghttp-libs:1.42.0-r1:*:*:*:*:*:*:*","cpe:2.3:a:nghttp2:nghttp_libs:1.42.0-r1:*:*:*:*:*:*:*","cpe:2.3:a:nghttp:nghttp2-libs:1.42.0-r1:*:*:*:*:*:*:*","cpe:2.3:a:nghttp:nghttp2_libs:1.42.0-r1:*:*:*:*:*:*:*","cpe:2.3:a:nghttp:nghttp-libs:1.42.0-r1:*:*:*:*:*:*:*","cpe:2.3:a:nghttp:nghttp_libs:1.42.0-r1:*:*:*:*:*:*:*"],"name":"nghttp2-libs","purl":"pkg:apk/busybox/nghttp2-libs@1.42.0-r1?arch=x86_64&distro=busybox-1.32.1&upstream=nghttp2","type":"apk","version":"1.42.0-r1","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libnghttp2.so.14"},{"path":"/usr/lib/libnghttp2.so.14.20.1"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"nghttp2"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:nghttp2:nghttp2:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-58055","versionConstraint":"<= 1.69.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:nghttp2:nghttp2:1.42.0:*:*:*:*:*:*:*"],"package":{"name":"nghttp2","version":"1.42.0-r1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-58055","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","metrics":{"baseScore":5.4,"impactScore":2.8,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-58055","cwe":"CWE-444","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-58055","date":"2026-10-08","epss":0.00319,"percentile":0.22818}],"risk":0.1730575,"urls":["https://github.com/bikini/exploitarium/tree/main/nghttp2-nghttpx-upgrade-queue-poison-poc","https://github.com/nghttp2/nghttp2/commit/ab28105c4a0197da24f8bfc414bc116055249e1e","https://www.vulncheck.com/advisories/nghttp2-nghttpx-http-request-response-smuggling-via-upgrade-request-with-content-length"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-58055","description":"nghttp2's nghttpx proxy through 1.69.0 forwards an HTTP/1.1 Upgrade request that also carries a Content-Length header and body onto reusable keep-alive backend connections, re-adding the Upgrade and Connection headers while passing Content-Length verbatim. A backend that resolves the resulting ambiguous message in the attacker's favor enables HTTP request/response smuggling and cross-client response-queue poisoning."},"relatedVulnerabilities":[]},{"artifact":{"id":"de2e09a252869bf3","cpes":["cpe:2.3:a:git-scm:git:2.30.6-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_scm:git:2.30.6-r0:*:*:*:*:*:*:*","cpe:2.3:a:git:git:2.30.6-r0:*:*:*:*:*:*:*"],"name":"git","purl":"pkg:apk/busybox/git@2.30.6-r0?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"2.30.6-r0","language":"","licenses":["GPL-2.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/git"},{"path":"/usr/bin/git-receive-pack"},{"path":"/usr/bin/git-shell"},{"path":"/usr/bin/git-upload-archive"},{"path":"/usr/bin/git-upload-pack"},{"path":"/usr/libexec"},{"path":"/usr/libexec/git-core"},{"path":"/usr/libexec/git-core/git"},{"path":"/usr/libexec/git-core/git-add"},{"path":"/usr/libexec/git-core/git-am"},{"path":"/usr/libexec/git-core/git-annotate"},{"path":"/usr/libexec/git-core/git-apply"},{"path":"/usr/libexec/git-core/git-archive"},{"path":"/usr/libexec/git-core/git-bisect"},{"path":"/usr/libexec/git-core/git-bisect--helper"},{"path":"/usr/libexec/git-core/git-blame"},{"path":"/usr/libexec/git-core/git-branch"},{"path":"/usr/libexec/git-core/git-bugreport"},{"path":"/usr/libexec/git-core/git-bundle"},{"path":"/usr/libexec/git-core/git-cat-file"},{"path":"/usr/libexec/git-core/git-check-attr"},{"path":"/usr/libexec/git-core/git-check-ignore"},{"path":"/usr/libexec/git-core/git-check-mailmap"},{"path":"/usr/libexec/git-core/git-check-ref-format"},{"path":"/usr/libexec/git-core/git-checkout"},{"path":"/usr/libexec/git-core/git-checkout-index"},{"path":"/usr/libexec/git-core/git-cherry"},{"path":"/usr/libexec/git-core/git-cherry-pick"},{"path":"/usr/libexec/git-core/git-clean"},{"path":"/usr/libexec/git-core/git-clone"},{"path":"/usr/libexec/git-core/git-column"},{"path":"/usr/libexec/git-core/git-commit"},{"path":"/usr/libexec/git-core/git-commit-graph"},{"path":"/usr/libexec/git-core/git-commit-tree"},{"path":"/usr/libexec/git-core/git-config"},{"path":"/usr/libexec/git-core/git-count-objects"},{"path":"/usr/libexec/git-core/git-credential"},{"path":"/usr/libexec/git-core/git-credential-cache"},{"path":"/usr/libexec/git-core/git-credential-cache--daemon"},{"path":"/usr/libexec/git-core/git-credential-store"},{"path":"/usr/libexec/git-core/git-describe"},{"path":"/usr/libexec/git-core/git-diff"},{"path":"/usr/libexec/git-core/git-diff-files"},{"path":"/usr/libexec/git-core/git-diff-index"},{"path":"/usr/libexec/git-core/git-diff-tree"},{"path":"/usr/libexec/git-core/git-difftool"},{"path":"/usr/libexec/git-core/git-difftool--helper"},{"path":"/usr/libexec/git-core/git-env--helper"},{"path":"/usr/libexec/git-core/git-fast-export"},{"path":"/usr/libexec/git-core/git-fetch"},{"path":"/usr/libexec/git-core/git-fetch-pack"},{"path":"/usr/libexec/git-core/git-filter-branch"},{"path":"/usr/libexec/git-core/git-fmt-merge-msg"},{"path":"/usr/libexec/git-core/git-for-each-ref"},{"path":"/usr/libexec/git-core/git-for-each-repo"},{"path":"/usr/libexec/git-core/git-format-patch"},{"path":"/usr/libexec/git-core/git-fsck"},{"path":"/usr/libexec/git-core/git-fsck-objects"},{"path":"/usr/libexec/git-core/git-gc"},{"path":"/usr/libexec/git-core/git-get-tar-commit-id"},{"path":"/usr/libexec/git-core/git-grep"},{"path":"/usr/libexec/git-core/git-hash-object"},{"path":"/usr/libexec/git-core/git-help"},{"path":"/usr/libexec/git-core/git-http-fetch"},{"path":"/usr/libexec/git-core/git-http-push"},{"path":"/usr/libexec/git-core/git-index-pack"},{"path":"/usr/libexec/git-core/git-init"},{"path":"/usr/libexec/git-core/git-init-db"},{"path":"/usr/libexec/git-core/git-interpret-trailers"},{"path":"/usr/libexec/git-core/git-log"},{"path":"/usr/libexec/git-core/git-ls-files"},{"path":"/usr/libexec/git-core/git-ls-remote"},{"path":"/usr/libexec/git-core/git-ls-tree"},{"path":"/usr/libexec/git-core/git-mailinfo"},{"path":"/usr/libexec/git-core/git-mailsplit"},{"path":"/usr/libexec/git-core/git-maintenance"},{"path":"/usr/libexec/git-core/git-merge"},{"path":"/usr/libexec/git-core/git-merge-base"},{"path":"/usr/libexec/git-core/git-merge-file"},{"path":"/usr/libexec/git-core/git-merge-index"},{"path":"/usr/libexec/git-core/git-merge-octopus"},{"path":"/usr/libexec/git-core/git-merge-one-file"},{"path":"/usr/libexec/git-core/git-merge-ours"},{"path":"/usr/libexec/git-core/git-merge-recursive"},{"path":"/usr/libexec/git-core/git-merge-resolve"},{"path":"/usr/libexec/git-core/git-merge-subtree"},{"path":"/usr/libexec/git-core/git-merge-tree"},{"path":"/usr/libexec/git-core/git-mergetool"},{"path":"/usr/libexec/git-core/git-mergetool--lib"},{"path":"/usr/libexec/git-core/git-mktag"},{"path":"/usr/libexec/git-core/git-mktree"},{"path":"/usr/libexec/git-core/git-multi-pack-index"},{"path":"/usr/libexec/git-core/git-mv"},{"path":"/usr/libexec/git-core/git-name-rev"},{"path":"/usr/libexec/git-core/git-notes"},{"path":"/usr/libexec/git-core/git-pack-objects"},{"path":"/usr/libexec/git-core/git-pack-redundant"},{"path":"/usr/libexec/git-core/git-pack-refs"},{"path":"/usr/libexec/git-core/git-patch-id"},{"path":"/usr/libexec/git-core/git-prune"},{"path":"/usr/libexec/git-core/git-prune-packed"},{"path":"/usr/libexec/git-core/git-pull"},{"path":"/usr/libexec/git-core/git-push"},{"path":"/usr/libexec/git-core/git-quiltimport"},{"path":"/usr/libexec/git-core/git-range-diff"},{"path":"/usr/libexec/git-core/git-read-tree"},{"path":"/usr/libexec/git-core/git-rebase"},{"path":"/usr/libexec/git-core/git-rebase--preserve-merges"},{"path":"/usr/libexec/git-core/git-receive-pack"},{"path":"/usr/libexec/git-core/git-reflog"},{"path":"/usr/libexec/git-core/git-remote"},{"path":"/usr/libexec/git-core/git-remote-ext"},{"path":"/usr/libexec/git-core/git-remote-fd"},{"path":"/usr/libexec/git-core/git-remote-ftp"},{"path":"/usr/libexec/git-core/git-remote-ftps"},{"path":"/usr/libexec/git-core/git-remote-http"},{"path":"/usr/libexec/git-core/git-remote-https"},{"path":"/usr/libexec/git-core/git-repack"},{"path":"/usr/libexec/git-core/git-replace"},{"path":"/usr/libexec/git-core/git-request-pull"},{"path":"/usr/libexec/git-core/git-rerere"},{"path":"/usr/libexec/git-core/git-reset"},{"path":"/usr/libexec/git-core/git-restore"},{"path":"/usr/libexec/git-core/git-rev-list"},{"path":"/usr/libexec/git-core/git-rev-parse"},{"path":"/usr/libexec/git-core/git-revert"},{"path":"/usr/libexec/git-core/git-rm"},{"path":"/usr/libexec/git-core/git-send-pack"},{"path":"/usr/libexec/git-core/git-sh-i18n"},{"path":"/usr/libexec/git-core/git-sh-i18n--envsubst"},{"path":"/usr/libexec/git-core/git-sh-setup"},{"path":"/usr/libexec/git-core/git-shortlog"},{"path":"/usr/libexec/git-core/git-show"},{"path":"/usr/libexec/git-core/git-show-branch"},{"path":"/usr/libexec/git-core/git-show-index"},{"path":"/usr/libexec/git-core/git-show-ref"},{"path":"/usr/libexec/git-core/git-sparse-checkout"},{"path":"/usr/libexec/git-core/git-stage"},{"path":"/usr/libexec/git-core/git-stash"},{"path":"/usr/libexec/git-core/git-status"},{"path":"/usr/libexec/git-core/git-stripspace"},{"path":"/usr/libexec/git-core/git-submodule"},{"path":"/usr/libexec/git-core/git-submodule--helper"},{"path":"/usr/libexec/git-core/git-switch"},{"path":"/usr/libexec/git-core/git-symbolic-ref"},{"path":"/usr/libexec/git-core/git-tag"},{"path":"/usr/libexec/git-core/git-unpack-file"},{"path":"/usr/libexec/git-core/git-unpack-objects"},{"path":"/usr/libexec/git-core/git-update-index"},{"path":"/usr/libexec/git-core/git-update-ref"},{"path":"/usr/libexec/git-core/git-update-server-info"},{"path":"/usr/libexec/git-core/git-upload-archive"},{"path":"/usr/libexec/git-core/git-upload-pack"},{"path":"/usr/libexec/git-core/git-var"},{"path":"/usr/libexec/git-core/git-verify-commit"},{"path":"/usr/libexec/git-core/git-verify-pack"},{"path":"/usr/libexec/git-core/git-verify-tag"},{"path":"/usr/libexec/git-core/git-web--browse"},{"path":"/usr/libexec/git-core/git-whatchanged"},{"path":"/usr/libexec/git-core/git-worktree"},{"path":"/usr/libexec/git-core/git-write-tree"},{"path":"/usr/libexec/git-core/mergetools"},{"path":"/usr/libexec/git-core/mergetools/araxis"},{"path":"/usr/libexec/git-core/mergetools/bc"},{"path":"/usr/libexec/git-core/mergetools/codecompare"},{"path":"/usr/libexec/git-core/mergetools/deltawalker"},{"path":"/usr/libexec/git-core/mergetools/diffmerge"},{"path":"/usr/libexec/git-core/mergetools/diffuse"},{"path":"/usr/libexec/git-core/mergetools/ecmerge"},{"path":"/usr/libexec/git-core/mergetools/emerge"},{"path":"/usr/libexec/git-core/mergetools/examdiff"},{"path":"/usr/libexec/git-core/mergetools/guiffy"},{"path":"/usr/libexec/git-core/mergetools/gvimdiff"},{"path":"/usr/libexec/git-core/mergetools/kdiff3"},{"path":"/usr/libexec/git-core/mergetools/kompare"},{"path":"/usr/libexec/git-core/mergetools/meld"},{"path":"/usr/libexec/git-core/mergetools/nvimdiff"},{"path":"/usr/libexec/git-core/mergetools/opendiff"},{"path":"/usr/libexec/git-core/mergetools/smerge"},{"path":"/usr/libexec/git-core/mergetools/tkdiff"},{"path":"/usr/libexec/git-core/mergetools/tortoisemerge"},{"path":"/usr/libexec/git-core/mergetools/vimdiff"},{"path":"/usr/libexec/git-core/mergetools/winmerge"},{"path":"/usr/libexec/git-core/mergetools/xxdiff"},{"path":"/usr/share"},{"path":"/usr/share/git-core"},{"path":"/usr/share/git-core/templates"},{"path":"/usr/share/git-core/templates/description"},{"path":"/usr/share/git-core/templates/branches"},{"path":"/usr/share/git-core/templates/hooks"},{"path":"/usr/share/git-core/templates/hooks/applypatch-msg.sample"},{"path":"/usr/share/git-core/templates/hooks/commit-msg.sample"},{"path":"/usr/share/git-core/templates/hooks/post-update.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-applypatch.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-commit.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-merge-commit.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-push.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-rebase.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-receive.sample"},{"path":"/usr/share/git-core/templates/hooks/prepare-commit-msg.sample"},{"path":"/usr/share/git-core/templates/hooks/push-to-checkout.sample"},{"path":"/usr/share/git-core/templates/hooks/update.sample"},{"path":"/usr/share/git-core/templates/info"},{"path":"/usr/share/git-core/templates/info/exclude"},{"path":"/usr/share/perl5"},{"path":"/var"},{"path":"/var/git"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"git"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2024-32020","versionConstraint":"< 2.39.4||>= 2.40.0, < 2.40.2||>= 2.41.0, < 2.41.1||>= 2.42.0, < 2.42.2||>= 2.43.0, < 2.43.4||>= 2.44.0, < 2.44.1||>= 2.45.0, < 2.45.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:git-scm:git:2.30.6:*:*:*:*:*:*:*"],"package":{"name":"git","version":"2.30.6-r0"},"namespace":"nvd:cpe"}},{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:git:git:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2024-32020","versionConstraint":"< 2.39.4||>= 2.40.0, < 2.40.2||>= 2.41.0, < 2.41.1||>= 2.42.0, < 2.42.2||>= 2.43.0, < 2.43.4||>= 2.44.0, < 2.44.1||>= 2.45.0, < 2.45.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:git:git:2.30.6:*:*:*:*:*:*:*"],"package":{"name":"git","version":"2.30.6-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2024-32020","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:L","metrics":{"baseScore":3.9,"impactScore":2.8,"exploitabilityScore":0.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-32020","cwe":"CWE-281","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2024-32020","date":"2026-10-08","epss":0.00519,"percentile":0.42295}],"risk":0.17127,"urls":["http://www.openwall.com/lists/oss-security/2024/05/14/2","https://github.com/git/git/commit/1204e1a824c34071019fe106348eaa6d88f9528d","https://github.com/git/git/commit/9e65df5eab274bf74c7b570107aacd1303a1e703","https://github.com/git/git/security/advisories/GHSA-5rfh-556j-fhgj","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/S4CK4IYTXEOBZTEM5K3T6LWOIZ3S44AR/"],"severity":"Low","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-32020","description":"Git is a revision control system. Prior to versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4, local clones may end up hardlinking files into the target repository's object database when source and target repository reside on the same disk. If the source repository is owned by a different user, then those hardlinked files may be rewritten at any point in time by the untrusted user. Cloning local repositories will cause Git to either copy or hardlink files of the source repository into the target repository. This significantly speeds up such local clones compared to doing a \"proper\" clone and saves both disk space and compute time. When cloning a repository located on the same disk that is owned by a different user than the current user we also end up creating such hardlinks. These files will continue to be owned and controlled by the potentially-untrusted user and can be rewritten by them at will in the future. The problem has been patched in versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4."},"relatedVulnerabilities":[]},{"artifact":{"id":"90f72c5b07fcdbc9","cpes":["cpe:2.3:a:busybox:busybox:1.32.1-r9:*:*:*:*:*:*:*"],"name":"busybox","purl":"pkg:apk/busybox/busybox@1.32.1-r9?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"1.32.1-r9","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/bin"},{"path":"/bin/busybox"},{"path":"/bin/sh"},{"path":"/etc"},{"path":"/etc/securetty"},{"path":"/etc/udhcpd.conf"},{"path":"/etc/logrotate.d"},{"path":"/etc/logrotate.d/acpid"},{"path":"/etc/network"},{"path":"/etc/network/if-down.d"},{"path":"/etc/network/if-post-down.d"},{"path":"/etc/network/if-post-up.d"},{"path":"/etc/network/if-pre-down.d"},{"path":"/etc/network/if-pre-up.d"},{"path":"/etc/network/if-up.d"},{"path":"/etc/network/if-up.d/dad"},{"path":"/sbin"},{"path":"/tmp"},{"path":"/usr"},{"path":"/usr/sbin"},{"path":"/usr/share"},{"path":"/usr/share/udhcpc"},{"path":"/usr/share/udhcpc/default.script"},{"path":"/var"},{"path":"/var/cache"},{"path":"/var/cache/misc"},{"path":"/var/lib"},{"path":"/var/lib/udhcpd"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"busybox"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:busybox:busybox:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-60876","versionConstraint":"<= 1.37.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:busybox:busybox:1.32.1:*:*:*:*:*:*:*"],"package":{"name":"busybox","version":"1.32.1-r9"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2025-60876","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-60876","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-60876","date":"2026-10-08","epss":0.00291,"percentile":0.19874}],"risk":0.16732499999999997,"urls":["https://gist.github.com/subyumatest/41554af6a72aedaacaec026adc311092","https://lists.busybox.net/pipermail/busybox/attachments/20250823/ccdc96ef/attachment-0001.htm","https://lists.busybox.net/pipermail/busybox/attachments/20250828/e7f90492/attachment.htm","https://cert-portal.siemens.com/productcert/html/ssa-253495.html"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-60876","description":"BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20)."},"relatedVulnerabilities":[]},{"artifact":{"id":"35fec91b9e067f61","cpes":["cpe:2.3:a:ssl-client:ssl-client:1.32.1-r9:*:*:*:*:*:*:*","cpe:2.3:a:ssl-client:ssl_client:1.32.1-r9:*:*:*:*:*:*:*","cpe:2.3:a:ssl_client:ssl-client:1.32.1-r9:*:*:*:*:*:*:*","cpe:2.3:a:ssl_client:ssl_client:1.32.1-r9:*:*:*:*:*:*:*","cpe:2.3:a:ssl:ssl-client:1.32.1-r9:*:*:*:*:*:*:*","cpe:2.3:a:ssl:ssl_client:1.32.1-r9:*:*:*:*:*:*:*"],"name":"ssl_client","purl":"pkg:apk/busybox/ssl_client@1.32.1-r9?arch=x86_64&distro=busybox-1.32.1&upstream=busybox","type":"apk","version":"1.32.1-r9","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/ssl_client"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"busybox"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:busybox:busybox:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-60876","versionConstraint":"<= 1.37.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:busybox:busybox:1.32.1:*:*:*:*:*:*:*"],"package":{"name":"busybox","version":"1.32.1-r9"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2025-60876","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-60876","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-60876","date":"2026-10-08","epss":0.00291,"percentile":0.19874}],"risk":0.16732499999999997,"urls":["https://gist.github.com/subyumatest/41554af6a72aedaacaec026adc311092","https://lists.busybox.net/pipermail/busybox/attachments/20250823/ccdc96ef/attachment-0001.htm","https://lists.busybox.net/pipermail/busybox/attachments/20250828/e7f90492/attachment.htm","https://cert-portal.siemens.com/productcert/html/ssa-253495.html"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-60876","description":"BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20)."},"relatedVulnerabilities":[]},{"artifact":{"id":"422a442f930ca27c","cpes":["cpe:2.3:a:nginx:nginx:1.18.0-r15:*:*:*:*:*:*:*"],"name":"nginx","purl":"pkg:apk/busybox/nginx@1.18.0-r15?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"1.18.0-r15","language":"","licenses":["BSD-2-Clause"],"metadata":{"Arch":"x86_64","files":[{"path":"/etc"},{"path":"/etc/logrotate.d"},{"path":"/etc/logrotate.d/nginx"},{"path":"/etc/nginx"},{"path":"/etc/nginx/fastcgi.conf"},{"path":"/etc/nginx/fastcgi_params"},{"path":"/etc/nginx/mime.types"},{"path":"/etc/nginx/nginx.conf"},{"path":"/etc/nginx/scgi_params"},{"path":"/etc/nginx/uwsgi_params"},{"path":"/etc/nginx/http.d"},{"path":"/etc/nginx/modules"},{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/nginx"},{"path":"/usr/lib/nginx/modules"},{"path":"/usr/sbin"},{"path":"/usr/sbin/nginx"},{"path":"/usr/share"},{"path":"/usr/share/nginx"},{"path":"/usr/share/nginx/http-default_server.conf"},{"path":"/var"},{"path":"/var/lib"},{"path":"/var/lib/nginx"},{"path":"/var/lib/nginx/logs"},{"path":"/var/lib/nginx/modules"},{"path":"/var/lib/nginx/run"},{"path":"/var/lib/nginx/html"},{"path":"/var/lib/nginx/html/50x.html"},{"path":"/var/lib/nginx/html/index.html"},{"path":"/var/lib/nginx/tmp"},{"path":"/var/log"},{"path":"/var/log/nginx"},{"path":"/var/www"},{"path":"/var/www/localhost"},{"path":"/var/www/localhost/htdocs"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"nginx"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:nginx:nginx:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2024-7347","versionConstraint":">= 1.27, < 1.27.1||>= 1.5.13, < 1.26.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:nginx:nginx:1.18.0:*:*:*:*:*:*:*"],"package":{"name":"nginx","version":"1.18.0-r15"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2024-7347","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"f5sirt@f5.com","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"f5sirt@f5.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-7347","cwe":"CWE-126","type":"Secondary","source":"f5sirt@f5.com"},{"cve":"CVE-2024-7347","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-7347","date":"2026-10-08","epss":0.0032,"percentile":0.23021}],"risk":0.16053333333333336,"urls":["https://my.f5.com/manage/s/article/K000140529","http://www.openwall.com/lists/oss-security/2024/08/14/4","https://lists.debian.org/debian-lts-announce/2025/03/msg00017.html"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-7347","description":"NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_mp4_module, which might allow an attacker to over-read NGINX worker memory resulting in its termination, using a specially crafted mp4 file. The issue only affects NGINX if it is built with the ngx_http_mp4_module and the mp4 directive is used in the configuration file. Additionally, the attack is possible only if an attacker can trigger the processing of a specially crafted mp4 file with the ngx_http_mp4_module.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated."},"relatedVulnerabilities":[]},{"artifact":{"id":"a45c752c9b8878aa","cpes":["cpe:2.3:a:php7:php7:7.4.26-r0:*:*:*:*:*:*:*","cpe:2.3:a:php7:php:7.4.26-r0:*:*:*:*:*:*:*","cpe:2.3:a:php:php7:7.4.26-r0:*:*:*:*:*:*:*","cpe:2.3:a:php:php:7.4.26-r0:*:*:*:*:*:*:*"],"name":"php7","purl":"pkg:apk/busybox/php7@7.4.26-r0?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"7.4.26-r0","language":"","licenses":["BSD-3-Clause","LGPL-2.0-or-later","MIT","PHP-3.01","Zend-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/php"},{"path":"/usr/bin/php7"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"php7"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:php:php:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2024-9026","versionConstraint":"< 8.1.30||>= 8.2, < 8.2.24||>= 8.3, < 8.3.12 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:php:php:7.4.26:*:*:*:*:*:*:*"],"package":{"name":"php7","version":"7.4.26-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2024-9026","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security@php.net","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-9026","cwe":"CWE-117","type":"Secondary","source":"security@php.net"},{"cve":"CVE-2024-9026","cwe":"CWE-158","type":"Secondary","source":"security@php.net"},{"cve":"CVE-2024-9026","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-9026","date":"2026-10-08","epss":0.00487,"percentile":0.39965}],"risk":0.15340499999999999,"urls":["https://github.com/php/php-src/security/advisories/GHSA-865w-9rf3-2wh5","https://lists.debian.org/debian-lts-announce/2024/10/msg00011.html","https://security.netapp.com/advisory/ntap-20241101-0003/"],"severity":"Low","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-9026","description":"In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, when using PHP-FPM SAPI and it is configured to catch workers output through catch_workers_output = yes, it may be possible to pollute the final log or remove up to 4 characters from the log messages by manipulating log message content. Additionally, if PHP-FPM is configured to use syslog output, it may be possible to further remove log data using the same vulnerability."},"relatedVulnerabilities":[]},{"artifact":{"id":"6040784032e8795c","cpes":["cpe:2.3:a:curl:curl:7.79.1-r3:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:7.79.1-r3:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/busybox/curl@7.79.1-r3?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"7.79.1-r3","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-1965","versionConstraint":">= 7.10.6, < 8.19.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:haxx:curl:7.79.1:*:*:*:*:*:*:*"],"package":{"name":"curl","version":"7.79.1-r3"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-1965","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-1965","cwe":"CWE-305","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2026-1965","cwe":"CWE-305","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-1965","date":"2026-10-08","epss":0.00264,"percentile":0.16794}],"risk":0.1518,"urls":["https://curl.se/docs/CVE-2026-1965.html","https://curl.se/docs/CVE-2026-1965.json"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-1965","description":"libcurl can in some circumstances reuse the wrong connection when asked to do\nan Negotiate-authenticated HTTP or HTTPS request.\n\nlibcurl features a pool of recent connections so that subsequent requests can\nreuse an existing connection to avoid overhead.\n\nWhen reusing a connection a range of criterion must first be met. Due to a\nlogical error in the code, a request that was issued by an application could\nwrongfully reuse an existing connection to the same server that was\nauthenticated using different credentials. One underlying reason being that\nNegotiate sometimes authenticates *connections* and not *requests*, contrary\nto how HTTP is designed to work.\n\nAn application that allows Negotiate authentication to a server (that responds\nwanting Negotiate) with `user1:password1` and then does another operation to\nthe same server also using Negotiate but with `user2:password2` (while the\nprevious connection is still alive) - the second request wrongly reused the\nsame connection and since it then sees that the Negotiate negotiation is\nalready made, it sends the request over that connection thinking it uses\nthe user2 credentials when it is in fact still using the connection\nauthenticated for user1...\n\nThe set of authentication methods to use is set with `CURLOPT_HTTPAUTH`.\n\nApplications can disable libcurl's reuse of connections and thus mitigate this\nproblem, by using one of the following libcurl options to alter how\nconnections are or are not reused: `CURLOPT_FRESH_CONNECT`,\n`CURLOPT_MAXCONNECTS` and `CURLMOPT_MAX_HOST_CONNECTIONS` (if using the\ncurl_multi API)."},"relatedVulnerabilities":[]},{"artifact":{"id":"6040784032e8795c","cpes":["cpe:2.3:a:curl:curl:7.79.1-r3:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:7.79.1-r3:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/busybox/curl@7.79.1-r3?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"7.79.1-r3","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-15224","versionConstraint":">= 7.58.0, < 8.18.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:haxx:curl:7.79.1:*:*:*:*:*:*:*"],"package":{"name":"curl","version":"7.79.1-r3"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2025-15224","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.1,"impactScore":1.5,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-15224","cwe":"CWE-287","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2025-15224","cwe":"CWE-287","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-15224","date":"2026-10-08","epss":0.0048,"percentile":0.39438}],"risk":0.14639999999999997,"urls":["https://curl.se/docs/CVE-2025-15224.html","https://curl.se/docs/CVE-2025-15224.json","https://hackerone.com/reports/3480925","http://www.openwall.com/lists/oss-security/2026/01/07/7"],"severity":"Low","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-15224","description":"When doing SSH-based transfers using either SCP or SFTP, and asked to do\npublic key authentication, curl would wrongly still ask and authenticate using\na locally running SSH agent."},"relatedVulnerabilities":[]},{"artifact":{"id":"43a7af5360b6604e","cpes":["cpe:2.3:a:pcre2:pcre2:10.36-r1:*:*:*:*:*:*:*","cpe:2.3:a:pcre2:pcre:10.36-r1:*:*:*:*:*:*:*","cpe:2.3:a:pcre:pcre2:10.36-r1:*:*:*:*:*:*:*","cpe:2.3:a:pcre:pcre:10.36-r1:*:*:*:*:*:*:*"],"name":"pcre2","purl":"pkg:apk/busybox/pcre2@10.36-r1?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"10.36-r1","language":"","licenses":["BSD-3-Clause"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpcre2-8.so.0"},{"path":"/usr/lib/libpcre2-8.so.0.10.1"},{"path":"/usr/lib/libpcre2-posix.so.2"},{"path":"/usr/lib/libpcre2-posix.so.2.0.3"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"pcre2"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:pcre:pcre2:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-89158","versionConstraint":"< 10.48||= 10.48-rc1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:pcre:pcre2:10.36:*:*:*:*:*:*:*"],"package":{"name":"pcre2","version":"10.36-r1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-89158","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89158","cwe":"CWE-190","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-89158","date":"2026-10-08","epss":0.00247,"percentile":0.14628}],"risk":0.14202499999999998,"urls":["https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48","https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-fmgr-6ggq-9859"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-89158","description":"PCRE2 before 10.48, on 32-bit platforms, has a pcre2_compile_32 integer overflow and resultant out-of-bounds write."},"relatedVulnerabilities":[]},{"artifact":{"id":"43a7af5360b6604e","cpes":["cpe:2.3:a:pcre2:pcre2:10.36-r1:*:*:*:*:*:*:*","cpe:2.3:a:pcre2:pcre:10.36-r1:*:*:*:*:*:*:*","cpe:2.3:a:pcre:pcre2:10.36-r1:*:*:*:*:*:*:*","cpe:2.3:a:pcre:pcre:10.36-r1:*:*:*:*:*:*:*"],"name":"pcre2","purl":"pkg:apk/busybox/pcre2@10.36-r1?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"10.36-r1","language":"","licenses":["BSD-3-Clause"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpcre2-8.so.0"},{"path":"/usr/lib/libpcre2-8.so.0.10.1"},{"path":"/usr/lib/libpcre2-posix.so.2"},{"path":"/usr/lib/libpcre2-posix.so.2.0.3"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"pcre2"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:pcre:pcre2:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-89156","versionConstraint":"< 10.48||= 10.48-rc1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:pcre:pcre2:10.36:*:*:*:*:*:*:*"],"package":{"name":"pcre2","version":"10.36-r1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-89156","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89156","cwe":"CWE-125","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-89156","date":"2026-10-08","epss":0.00294,"percentile":0.20148}],"risk":0.13818,"urls":["https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48","https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-2p8c-ff85-vh9x"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-89156","description":"PCRE2 before 10.48 has a pcre2_match out-of-bounds read after a JIT fallback when an attacker can provide invalid UTF data."},"relatedVulnerabilities":[]},{"artifact":{"id":"d081de97c6f633df","cpes":["cpe:2.3:a:libcrypto1.1:libcrypto1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto1.1:libcrypto:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto:libcrypto1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto:libcrypto:1.1.1q-r0:*:*:*:*:*:*:*"],"name":"libcrypto1.1","purl":"pkg:apk/busybox/libcrypto1.1@1.1.1q-r0?arch=x86_64&distro=busybox-1.32.1&upstream=openssl","type":"apk","version":"1.1.1q-r0","language":"","licenses":["OpenSSL"],"metadata":{"Arch":"x86_64","files":[{"path":"/etc"},{"path":"/etc/ssl"},{"path":"/etc/ssl/ct_log_list.cnf"},{"path":"/etc/ssl/ct_log_list.cnf.dist"},{"path":"/etc/ssl/openssl.cnf"},{"path":"/etc/ssl/openssl.cnf.dist"},{"path":"/etc/ssl/certs"},{"path":"/etc/ssl/misc"},{"path":"/etc/ssl/misc/CA.pl"},{"path":"/etc/ssl/misc/tsget"},{"path":"/etc/ssl/misc/tsget.pl"},{"path":"/etc/ssl/private"},{"path":"/lib"},{"path":"/lib/libcrypto.so.1.1"},{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcrypto.so.1.1"},{"path":"/usr/lib/engines-1.1"},{"path":"/usr/lib/engines-1.1/afalg.so"},{"path":"/usr/lib/engines-1.1/capi.so"},{"path":"/usr/lib/engines-1.1/padlock.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-35189","versionConstraint":">= 1.0.2, < 1.0.2zs||>= 1.1.1, < 1.1.1zj||>= 3.0.0, < 3.0.23||>= 3.4.0, < 3.4.8||>= 3.5.0, < 3.5.9||>= 3.6.0, < 3.6.5||>= 4.0.0, < 4.0.3 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:1.1.1q:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"1.1.1q-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-35189","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-35189","cwe":"CWE-770","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-35189","date":"2026-10-08","epss":0.00267,"percentile":0.17282}],"risk":0.13750500000000002,"urls":["https://github.com/openssl/openssl/commit/2b93c73b2c70ddc4c61c5e4bfaaa6bd71379eb84","https://github.com/openssl/openssl/commit/3842516cc15e8b2cf55747011045e77547e71d89","https://github.com/openssl/openssl/commit/8e0efc7549b7ff8246d40e585e3fd604f728473f","https://github.com/openssl/openssl/commit/c72ae182cac17a82e4246c6ecd4e9c4ec3586ec9","https://openssl-library.org/news/secadv/20260929.txt"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-35189","description":"Issue summary: A certificate with many nameRelativeToCRLIssuer CRL\ndistribution points causes disproportionate heap growth when OpenSSL caches\nX.509 extensions.\n\nImpact summary: Receiving a crafted certificate from a malicious peer can lead\nto significant memory pressure and possible Denial of Service in clients or\nin servers that solicit client certificates.\n\nCWE: CWE-770: Allocation of Resources Without Limits or Throttling\n\nDescription: A certificate or a set of certificates that fits under the limit for\nsize of certificates accepted from the peer (~100 KiB) can result in allocation\nof several hundred MiB of resident memory on the receiving side\nduring a normal TLS handshake.  This may be enough to crash the client or\nserver, if multiple concurrent connections lead to similarly large memory\nallocations.\n\nThe fix postpones processing of the CRL distribution points extensions in\ncertificates to the time when the processed value is required for CRL processing.\nThis avoids keeping large memory allocations for a long time when such\ncertificates are received.\n\nFIPS impact: no\nThe affected code is outside the FIPS module boundary."},"relatedVulnerabilities":[]},{"artifact":{"id":"74f4e71ff41d2d68","cpes":["cpe:2.3:a:libssl1.1:libssl1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl1.1:libssl:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl:1.1.1q-r0:*:*:*:*:*:*:*"],"name":"libssl1.1","purl":"pkg:apk/busybox/libssl1.1@1.1.1q-r0?arch=x86_64&distro=busybox-1.32.1&upstream=openssl","type":"apk","version":"1.1.1q-r0","language":"","licenses":["OpenSSL"],"metadata":{"Arch":"x86_64","files":[{"path":"/lib"},{"path":"/lib/libssl.so.1.1"},{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libssl.so.1.1"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-35189","versionConstraint":">= 1.0.2, < 1.0.2zs||>= 1.1.1, < 1.1.1zj||>= 3.0.0, < 3.0.23||>= 3.4.0, < 3.4.8||>= 3.5.0, < 3.5.9||>= 3.6.0, < 3.6.5||>= 4.0.0, < 4.0.3 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:1.1.1q:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"1.1.1q-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-35189","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-35189","cwe":"CWE-770","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-35189","date":"2026-10-08","epss":0.00267,"percentile":0.17282}],"risk":0.13750500000000002,"urls":["https://github.com/openssl/openssl/commit/2b93c73b2c70ddc4c61c5e4bfaaa6bd71379eb84","https://github.com/openssl/openssl/commit/3842516cc15e8b2cf55747011045e77547e71d89","https://github.com/openssl/openssl/commit/8e0efc7549b7ff8246d40e585e3fd604f728473f","https://github.com/openssl/openssl/commit/c72ae182cac17a82e4246c6ecd4e9c4ec3586ec9","https://openssl-library.org/news/secadv/20260929.txt"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-35189","description":"Issue summary: A certificate with many nameRelativeToCRLIssuer CRL\ndistribution points causes disproportionate heap growth when OpenSSL caches\nX.509 extensions.\n\nImpact summary: Receiving a crafted certificate from a malicious peer can lead\nto significant memory pressure and possible Denial of Service in clients or\nin servers that solicit client certificates.\n\nCWE: CWE-770: Allocation of Resources Without Limits or Throttling\n\nDescription: A certificate or a set of certificates that fits under the limit for\nsize of certificates accepted from the peer (~100 KiB) can result in allocation\nof several hundred MiB of resident memory on the receiving side\nduring a normal TLS handshake.  This may be enough to crash the client or\nserver, if multiple concurrent connections lead to similarly large memory\nallocations.\n\nThe fix postpones processing of the CRL distribution points extensions in\ncertificates to the time when the processed value is required for CRL processing.\nThis avoids keeping large memory allocations for a long time when such\ncertificates are received.\n\nFIPS impact: no\nThe affected code is outside the FIPS module boundary."},"relatedVulnerabilities":[]},{"artifact":{"id":"14807b4f7067817d","cpes":["cpe:2.3:a:openssl:openssl:1.1.1q-r0:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:apk/busybox/openssl@1.1.1q-r0?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"1.1.1q-r0","language":"","licenses":["OpenSSL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/openssl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-35189","versionConstraint":">= 1.0.2, < 1.0.2zs||>= 1.1.1, < 1.1.1zj||>= 3.0.0, < 3.0.23||>= 3.4.0, < 3.4.8||>= 3.5.0, < 3.5.9||>= 3.6.0, < 3.6.5||>= 4.0.0, < 4.0.3 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:1.1.1q:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"1.1.1q-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-35189","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-35189","cwe":"CWE-770","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-35189","date":"2026-10-08","epss":0.00267,"percentile":0.17282}],"risk":0.13750500000000002,"urls":["https://github.com/openssl/openssl/commit/2b93c73b2c70ddc4c61c5e4bfaaa6bd71379eb84","https://github.com/openssl/openssl/commit/3842516cc15e8b2cf55747011045e77547e71d89","https://github.com/openssl/openssl/commit/8e0efc7549b7ff8246d40e585e3fd604f728473f","https://github.com/openssl/openssl/commit/c72ae182cac17a82e4246c6ecd4e9c4ec3586ec9","https://openssl-library.org/news/secadv/20260929.txt"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-35189","description":"Issue summary: A certificate with many nameRelativeToCRLIssuer CRL\ndistribution points causes disproportionate heap growth when OpenSSL caches\nX.509 extensions.\n\nImpact summary: Receiving a crafted certificate from a malicious peer can lead\nto significant memory pressure and possible Denial of Service in clients or\nin servers that solicit client certificates.\n\nCWE: CWE-770: Allocation of Resources Without Limits or Throttling\n\nDescription: A certificate or a set of certificates that fits under the limit for\nsize of certificates accepted from the peer (~100 KiB) can result in allocation\nof several hundred MiB of resident memory on the receiving side\nduring a normal TLS handshake.  This may be enough to crash the client or\nserver, if multiple concurrent connections lead to similarly large memory\nallocations.\n\nThe fix postpones processing of the CRL distribution points extensions in\ncertificates to the time when the processed value is required for CRL processing.\nThis avoids keeping large memory allocations for a long time when such\ncertificates are received.\n\nFIPS impact: no\nThe affected code is outside the FIPS module boundary."},"relatedVulnerabilities":[]},{"artifact":{"id":"43a7af5360b6604e","cpes":["cpe:2.3:a:pcre2:pcre2:10.36-r1:*:*:*:*:*:*:*","cpe:2.3:a:pcre2:pcre:10.36-r1:*:*:*:*:*:*:*","cpe:2.3:a:pcre:pcre2:10.36-r1:*:*:*:*:*:*:*","cpe:2.3:a:pcre:pcre:10.36-r1:*:*:*:*:*:*:*"],"name":"pcre2","purl":"pkg:apk/busybox/pcre2@10.36-r1?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"10.36-r1","language":"","licenses":["BSD-3-Clause"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpcre2-8.so.0"},{"path":"/usr/lib/libpcre2-8.so.0.10.1"},{"path":"/usr/lib/libpcre2-posix.so.2"},{"path":"/usr/lib/libpcre2-posix.so.2.0.3"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"pcre2"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:pcre:pcre2:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-89160","versionConstraint":">= 10.34, < 10.48||= 10.48-rc1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:pcre:pcre2:10.36:*:*:*:*:*:*:*"],"package":{"name":"pcre2","version":"10.36-r1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-89160","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89160","cwe":"CWE-125","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-89160","date":"2026-10-08","epss":0.00268,"percentile":0.17337}],"risk":0.13534000000000002,"urls":["https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48","https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-9qww-pwc4-77qq"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-89160","description":"PCRE2 before 10.48 has a pcre2_match out-of-bounds read during the PCRE2_MATCH_INVALID_UTF matching of an invalid UTF subject."},"relatedVulnerabilities":[]},{"artifact":{"id":"eaba89df685b6dbe","cpes":["cpe:2.3:a:musl-libc:musl:1.2.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:musl_libc:musl:1.2.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:musl:musl:1.2.2-r1:*:*:*:*:*:*:*"],"name":"musl","purl":"pkg:apk/busybox/musl@1.2.2-r1?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"1.2.2-r1","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/lib"},{"path":"/lib/ld-musl-x86_64.so.1"},{"path":"/lib/libc.musl-x86_64.so.1"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"musl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:musl-libc:musl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-40200","versionConstraint":">= 0.7.10, <= 1.2.6 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:musl-libc:musl:1.2.2:*:*:*:*:*:*:*"],"package":{"name":"musl","version":"1.2.2-r1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-40200","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":6.1,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-40200","cwe":"CWE-670","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-40200","date":"2026-10-08","epss":0.00171,"percentile":0.05925}],"risk":0.13338,"urls":["https://musl.libc.org/releases.html","https://www.openwall.com/lists/oss-security/2026/04/10/13","http://www.openwall.com/lists/oss-security/2026/04/10/13"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-40200","description":"An issue was discovered in musl libc 0.7.10 through 1.2.6. Stack-based memory corruption can occur during qsort of very large arrays, due to incorrectly implemented double-word primitives. The number of elements must exceed about seven million, i.e., the 32nd Leonardo number on 32-bit platforms (or the 64th Leonardo number on 64-bit platforms, which is not practical)."},"relatedVulnerabilities":[]},{"artifact":{"id":"a59088f85518efa7","cpes":["cpe:2.3:a:musl-utils:musl-utils:1.2.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:musl-utils:musl_utils:1.2.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:musl_utils:musl-utils:1.2.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:musl_utils:musl_utils:1.2.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:musl-libc:musl-utils:1.2.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:musl-libc:musl_utils:1.2.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:musl:musl-utils:1.2.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:musl:musl_utils:1.2.2-r1:*:*:*:*:*:*:*"],"name":"musl-utils","purl":"pkg:apk/busybox/musl-utils@1.2.2-r1?arch=x86_64&distro=busybox-1.32.1&upstream=musl","type":"apk","version":"1.2.2-r1","language":"","licenses":["BSD","GPL2+","MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/sbin"},{"path":"/sbin/ldconfig"},{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/getconf"},{"path":"/usr/bin/getent"},{"path":"/usr/bin/iconv"},{"path":"/usr/bin/ldd"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"musl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:musl-libc:musl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-40200","versionConstraint":">= 0.7.10, <= 1.2.6 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:musl-libc:musl:1.2.2:*:*:*:*:*:*:*"],"package":{"name":"musl","version":"1.2.2-r1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-40200","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":6.1,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-40200","cwe":"CWE-670","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-40200","date":"2026-10-08","epss":0.00171,"percentile":0.05925}],"risk":0.13338,"urls":["https://musl.libc.org/releases.html","https://www.openwall.com/lists/oss-security/2026/04/10/13","http://www.openwall.com/lists/oss-security/2026/04/10/13"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-40200","description":"An issue was discovered in musl libc 0.7.10 through 1.2.6. Stack-based memory corruption can occur during qsort of very large arrays, due to incorrectly implemented double-word primitives. The number of elements must exceed about seven million, i.e., the 32nd Leonardo number on 32-bit platforms (or the 64th Leonardo number on 64-bit platforms, which is not practical)."},"relatedVulnerabilities":[]},{"artifact":{"id":"422a442f930ca27c","cpes":["cpe:2.3:a:nginx:nginx:1.18.0-r15:*:*:*:*:*:*:*"],"name":"nginx","purl":"pkg:apk/busybox/nginx@1.18.0-r15?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"1.18.0-r15","language":"","licenses":["BSD-2-Clause"],"metadata":{"Arch":"x86_64","files":[{"path":"/etc"},{"path":"/etc/logrotate.d"},{"path":"/etc/logrotate.d/nginx"},{"path":"/etc/nginx"},{"path":"/etc/nginx/fastcgi.conf"},{"path":"/etc/nginx/fastcgi_params"},{"path":"/etc/nginx/mime.types"},{"path":"/etc/nginx/nginx.conf"},{"path":"/etc/nginx/scgi_params"},{"path":"/etc/nginx/uwsgi_params"},{"path":"/etc/nginx/http.d"},{"path":"/etc/nginx/modules"},{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/nginx"},{"path":"/usr/lib/nginx/modules"},{"path":"/usr/sbin"},{"path":"/usr/sbin/nginx"},{"path":"/usr/share"},{"path":"/usr/share/nginx"},{"path":"/usr/share/nginx/http-default_server.conf"},{"path":"/var"},{"path":"/var/lib"},{"path":"/var/lib/nginx"},{"path":"/var/lib/nginx/logs"},{"path":"/var/lib/nginx/modules"},{"path":"/var/lib/nginx/run"},{"path":"/var/lib/nginx/html"},{"path":"/var/lib/nginx/html/50x.html"},{"path":"/var/lib/nginx/html/index.html"},{"path":"/var/lib/nginx/tmp"},{"path":"/var/log"},{"path":"/var/log/nginx"},{"path":"/var/www"},{"path":"/var/www/localhost"},{"path":"/var/www/localhost/htdocs"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"nginx"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:nginx:nginx:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-28753","versionConstraint":">= 0.6.27, < 1.28.3||>= 1.29.0, < 1.29.7 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:nginx:nginx:1.18.0:*:*:*:*:*:*:*"],"package":{"name":"nginx","version":"1.18.0-r15"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-28753","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"f5sirt@f5.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"f5sirt@f5.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-28753","cwe":"CWE-93","type":"Secondary","source":"f5sirt@f5.com"}],"epss":[{"cve":"CVE-2026-28753","date":"2026-10-08","epss":0.00264,"percentile":0.16859}],"risk":0.132,"urls":["https://my.f5.com/manage/s/article/K000160367"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-28753","description":"NGINX Plus and NGINX Open Source have a vulnerability in the ngx_mail_smtp_module module due to the improper handling of CRLF sequences in DNS responses. This allows an attacker-controlled DNS server to inject arbitrary headers into SMTP upstream requests, leading to potential request manipulation. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated."},"relatedVulnerabilities":[]},{"artifact":{"id":"f83ee23f6ddfb737","cpes":["cpe:2.3:a:linux-pam:linux-pam:1.5.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:linux-pam:linux_pam:1.5.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:linux_pam:linux-pam:1.5.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:linux_pam:linux_pam:1.5.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:linux:linux-pam:1.5.1-r0:*:*:*:*:*:*:*","cpe:2.3:a:linux:linux_pam:1.5.1-r0:*:*:*:*:*:*:*"],"name":"linux-pam","purl":"pkg:apk/busybox/linux-pam@1.5.1-r0?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"1.5.1-r0","language":"","licenses":["BSD-3-Clause"],"metadata":{"Arch":"x86_64","files":[{"path":"/etc"},{"path":"/etc/environment"},{"path":"/etc/pam.d"},{"path":"/etc/pam.d/base-account"},{"path":"/etc/pam.d/base-auth"},{"path":"/etc/pam.d/base-password"},{"path":"/etc/pam.d/base-session"},{"path":"/etc/pam.d/base-session-noninteractive"},{"path":"/etc/pam.d/other"},{"path":"/etc/pam.d/su"},{"path":"/etc/pam.d/system-local-login"},{"path":"/etc/pam.d/system-login"},{"path":"/etc/security"},{"path":"/etc/security/access.conf"},{"path":"/etc/security/faillock.conf"},{"path":"/etc/security/group.conf"},{"path":"/etc/security/limits.conf"},{"path":"/etc/security/namespace.conf"},{"path":"/etc/security/namespace.init"},{"path":"/etc/security/pam_env.conf"},{"path":"/etc/security/time.conf"},{"path":"/etc/security/limits.d"},{"path":"/etc/security/namespace.d"},{"path":"/lib"},{"path":"/lib/libpam.so.0"},{"path":"/lib/libpam.so.0.85.1"},{"path":"/lib/libpam_misc.so.0"},{"path":"/lib/libpam_misc.so.0.82.1"},{"path":"/lib/libpamc.so.0"},{"path":"/lib/libpamc.so.0.82.1"},{"path":"/lib/security"},{"path":"/lib/security/pam_access.so"},{"path":"/lib/security/pam_debug.so"},{"path":"/lib/security/pam_deny.so"},{"path":"/lib/security/pam_echo.so"},{"path":"/lib/security/pam_env.so"},{"path":"/lib/security/pam_exec.so"},{"path":"/lib/security/pam_faildelay.so"},{"path":"/lib/security/pam_faillock.so"},{"path":"/lib/security/pam_filter.so"},{"path":"/lib/security/pam_ftp.so"},{"path":"/lib/security/pam_group.so"},{"path":"/lib/security/pam_issue.so"},{"path":"/lib/security/pam_keyinit.so"},{"path":"/lib/security/pam_limits.so"},{"path":"/lib/security/pam_listfile.so"},{"path":"/lib/security/pam_localuser.so"},{"path":"/lib/security/pam_loginuid.so"},{"path":"/lib/security/pam_mail.so"},{"path":"/lib/security/pam_mkhomedir.so"},{"path":"/lib/security/pam_motd.so"},{"path":"/lib/security/pam_namespace.so"},{"path":"/lib/security/pam_nologin.so"},{"path":"/lib/security/pam_permit.so"},{"path":"/lib/security/pam_pwhistory.so"},{"path":"/lib/security/pam_rootok.so"},{"path":"/lib/security/pam_securetty.so"},{"path":"/lib/security/pam_setquota.so"},{"path":"/lib/security/pam_shells.so"},{"path":"/lib/security/pam_stress.so"},{"path":"/lib/security/pam_succeed_if.so"},{"path":"/lib/security/pam_time.so"},{"path":"/lib/security/pam_timestamp.so"},{"path":"/lib/security/pam_umask.so"},{"path":"/lib/security/pam_unix.so"},{"path":"/lib/security/pam_usertype.so"},{"path":"/lib/security/pam_warn.so"},{"path":"/lib/security/pam_wheel.so"},{"path":"/lib/security/pam_xauth.so"},{"path":"/lib/security/pam_filter"},{"path":"/lib/security/pam_filter/upperLOWER"},{"path":"/sbin"},{"path":"/sbin/faillock"},{"path":"/sbin/mkhomedir_helper"},{"path":"/sbin/pam_namespace_helper"},{"path":"/sbin/pam_timestamp_check"},{"path":"/sbin/pwhistory_helper"},{"path":"/sbin/unix_chkpwd"},{"path":"/sbin/unix_update"},{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/systemd"},{"path":"/usr/lib/systemd/system"},{"path":"/usr/lib/systemd/system/pam_namespace.service"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"linux-pam"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:linux-pam:linux-pam:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2024-10041","versionConstraint":"< 1.6.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:linux-pam:linux-pam:1.5.1:*:*:*:*:*:*:*"],"package":{"name":"linux-pam","version":"1.5.1-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2024-10041","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-10041","cwe":"CWE-922","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2024-10041","cwe":"CWE-922","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-10041","date":"2026-10-08","epss":0.00265,"percentile":0.16907}],"risk":0.128525,"urls":["https://access.redhat.com/errata/RHSA-2024:10379","https://access.redhat.com/errata/RHSA-2024:11250","https://access.redhat.com/errata/RHSA-2024:9941","https://access.redhat.com/security/cve/CVE-2024-10041","https://bugzilla.redhat.com/show_bug.cgi?id=2319212","https://github.com/linux-pam/linux-pam/commit/b3020da7da384d769f27a8713257fbe1001878be","https://github.com/linux-pam/linux-pam/commit/b7b96362087414e52524d3d9d9b3faa21e1db620","https://github.com/linux-pam/linux-pam/pull/b3020da7da384d769f27a8713257fbe1001878be","https://github.com/linux-pam/linux-pam/pull/b7b96362087414e52524d3d9d9b3faa21e1db620"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-10041","description":"A vulnerability was found in PAM. The secret information is stored in memory, where the attacker can trigger the victim program to execute by sending characters to its standard input (stdin). As this occurs, the attacker can train the branch predictor to execute an ROP chain speculatively. This flaw could result in leaked passwords, such as those found in /etc/shadow while performing authentications."},"relatedVulnerabilities":[]},{"artifact":{"id":"43a7af5360b6604e","cpes":["cpe:2.3:a:pcre2:pcre2:10.36-r1:*:*:*:*:*:*:*","cpe:2.3:a:pcre2:pcre:10.36-r1:*:*:*:*:*:*:*","cpe:2.3:a:pcre:pcre2:10.36-r1:*:*:*:*:*:*:*","cpe:2.3:a:pcre:pcre:10.36-r1:*:*:*:*:*:*:*"],"name":"pcre2","purl":"pkg:apk/busybox/pcre2@10.36-r1?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"10.36-r1","language":"","licenses":["BSD-3-Clause"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpcre2-8.so.0"},{"path":"/usr/lib/libpcre2-8.so.0.10.1"},{"path":"/usr/lib/libpcre2-posix.so.2"},{"path":"/usr/lib/libpcre2-posix.so.2.0.3"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"pcre2"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:pcre:pcre2:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-89161","versionConstraint":"< 10.48||= 10.48-rc1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:pcre:pcre2:10.36:*:*:*:*:*:*:*"],"package":{"name":"pcre2","version":"10.36-r1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-89161","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.4,"impactScore":5.9,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89161","cwe":"CWE-590","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-89161","date":"2026-10-08","epss":0.00126,"percentile":0.02017}],"risk":0.09513,"urls":["https://github.com/PCRE2Project/pcre2/pull/937","https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-89161","description":"In PCRE2 before 10.48, pcre2_jit_match mishandles a previously copied subject being passed in as a context. An incorrect free operation can occur."},"relatedVulnerabilities":[]},{"artifact":{"id":"d081de97c6f633df","cpes":["cpe:2.3:a:libcrypto1.1:libcrypto1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto1.1:libcrypto:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto:libcrypto1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto:libcrypto:1.1.1q-r0:*:*:*:*:*:*:*"],"name":"libcrypto1.1","purl":"pkg:apk/busybox/libcrypto1.1@1.1.1q-r0?arch=x86_64&distro=busybox-1.32.1&upstream=openssl","type":"apk","version":"1.1.1q-r0","language":"","licenses":["OpenSSL"],"metadata":{"Arch":"x86_64","files":[{"path":"/etc"},{"path":"/etc/ssl"},{"path":"/etc/ssl/ct_log_list.cnf"},{"path":"/etc/ssl/ct_log_list.cnf.dist"},{"path":"/etc/ssl/openssl.cnf"},{"path":"/etc/ssl/openssl.cnf.dist"},{"path":"/etc/ssl/certs"},{"path":"/etc/ssl/misc"},{"path":"/etc/ssl/misc/CA.pl"},{"path":"/etc/ssl/misc/tsget"},{"path":"/etc/ssl/misc/tsget.pl"},{"path":"/etc/ssl/private"},{"path":"/lib"},{"path":"/lib/libcrypto.so.1.1"},{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcrypto.so.1.1"},{"path":"/usr/lib/engines-1.1"},{"path":"/usr/lib/engines-1.1/afalg.so"},{"path":"/usr/lib/engines-1.1/capi.so"},{"path":"/usr/lib/engines-1.1/padlock.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-22795","versionConstraint":">= 1.1.1, < 1.1.1ze||>= 3.0.0, < 3.0.19||>= 3.3.0, < 3.3.6||>= 3.4.0, < 3.4.4||>= 3.5.0, < 3.5.5||>= 3.6.0, < 3.6.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:1.1.1q:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"1.1.1q-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-22795","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-22795","cwe":"CWE-754","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-22795","date":"2026-10-08","epss":0.00169,"percentile":0.0568}],"risk":0.08872500000000001,"urls":["https://github.com/openssl/openssl/commit/2502e7b7d4c0cf4f972a881641fe09edc67aeec4","https://github.com/openssl/openssl/commit/572844beca95068394c916626a6d3a490f831a49","https://github.com/openssl/openssl/commit/7bbca05be55b129651d9df4bdb92becc45002c12","https://github.com/openssl/openssl/commit/eeee3cbd4d682095ed431052f00403004596373e","https://github.com/openssl/openssl/commit/ef2fb66ec571564d64d1c74a12e388a2a54d05d2","https://openssl-library.org/news/secadv/20260127.txt","https://cert-portal.siemens.com/productcert/html/ssa-265688.html"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-22795","description":"Issue summary: An invalid or NULL pointer dereference can happen in\nan application processing a malformed PKCS#12 file.\n\nImpact summary: An application processing a malformed PKCS#12 file can be\ncaused to dereference an invalid or NULL pointer on memory read, resulting\nin a Denial of Service.\n\nA type confusion vulnerability exists in PKCS#12 parsing code where\nan ASN1_TYPE union member is accessed without first validating the type,\ncausing an invalid pointer read.\n\nThe location is constrained to a 1-byte address space, meaning any\nattempted pointer manipulation can only target addresses between 0x00 and 0xFF.\nThis range corresponds to the zero page, which is unmapped on most modern\noperating systems and will reliably result in a crash, leading only to a\nDenial of Service. Exploiting this issue also requires a user or application\nto process a maliciously crafted PKCS#12 file. It is uncommon to accept\nuntrusted PKCS#12 files in applications as they are usually used to store\nprivate keys which are trusted by definition. For these reasons, the issue\nwas assessed as Low severity.\n\nThe FIPS modules in 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the PKCS12 implementation is outside the OpenSSL FIPS module boundary.\n\nOpenSSL 3.6, 3.5, 3.4, 3.3, 3.0 and 1.1.1 are vulnerable to this issue.\n\nOpenSSL 1.0.2 is not affected by this issue."},"relatedVulnerabilities":[]},{"artifact":{"id":"74f4e71ff41d2d68","cpes":["cpe:2.3:a:libssl1.1:libssl1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl1.1:libssl:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl:1.1.1q-r0:*:*:*:*:*:*:*"],"name":"libssl1.1","purl":"pkg:apk/busybox/libssl1.1@1.1.1q-r0?arch=x86_64&distro=busybox-1.32.1&upstream=openssl","type":"apk","version":"1.1.1q-r0","language":"","licenses":["OpenSSL"],"metadata":{"Arch":"x86_64","files":[{"path":"/lib"},{"path":"/lib/libssl.so.1.1"},{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libssl.so.1.1"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-22795","versionConstraint":">= 1.1.1, < 1.1.1ze||>= 3.0.0, < 3.0.19||>= 3.3.0, < 3.3.6||>= 3.4.0, < 3.4.4||>= 3.5.0, < 3.5.5||>= 3.6.0, < 3.6.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:1.1.1q:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"1.1.1q-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-22795","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-22795","cwe":"CWE-754","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-22795","date":"2026-10-08","epss":0.00169,"percentile":0.0568}],"risk":0.08872500000000001,"urls":["https://github.com/openssl/openssl/commit/2502e7b7d4c0cf4f972a881641fe09edc67aeec4","https://github.com/openssl/openssl/commit/572844beca95068394c916626a6d3a490f831a49","https://github.com/openssl/openssl/commit/7bbca05be55b129651d9df4bdb92becc45002c12","https://github.com/openssl/openssl/commit/eeee3cbd4d682095ed431052f00403004596373e","https://github.com/openssl/openssl/commit/ef2fb66ec571564d64d1c74a12e388a2a54d05d2","https://openssl-library.org/news/secadv/20260127.txt","https://cert-portal.siemens.com/productcert/html/ssa-265688.html"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-22795","description":"Issue summary: An invalid or NULL pointer dereference can happen in\nan application processing a malformed PKCS#12 file.\n\nImpact summary: An application processing a malformed PKCS#12 file can be\ncaused to dereference an invalid or NULL pointer on memory read, resulting\nin a Denial of Service.\n\nA type confusion vulnerability exists in PKCS#12 parsing code where\nan ASN1_TYPE union member is accessed without first validating the type,\ncausing an invalid pointer read.\n\nThe location is constrained to a 1-byte address space, meaning any\nattempted pointer manipulation can only target addresses between 0x00 and 0xFF.\nThis range corresponds to the zero page, which is unmapped on most modern\noperating systems and will reliably result in a crash, leading only to a\nDenial of Service. Exploiting this issue also requires a user or application\nto process a maliciously crafted PKCS#12 file. It is uncommon to accept\nuntrusted PKCS#12 files in applications as they are usually used to store\nprivate keys which are trusted by definition. For these reasons, the issue\nwas assessed as Low severity.\n\nThe FIPS modules in 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the PKCS12 implementation is outside the OpenSSL FIPS module boundary.\n\nOpenSSL 3.6, 3.5, 3.4, 3.3, 3.0 and 1.1.1 are vulnerable to this issue.\n\nOpenSSL 1.0.2 is not affected by this issue."},"relatedVulnerabilities":[]},{"artifact":{"id":"14807b4f7067817d","cpes":["cpe:2.3:a:openssl:openssl:1.1.1q-r0:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:apk/busybox/openssl@1.1.1q-r0?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"1.1.1q-r0","language":"","licenses":["OpenSSL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/openssl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-22795","versionConstraint":">= 1.1.1, < 1.1.1ze||>= 3.0.0, < 3.0.19||>= 3.3.0, < 3.3.6||>= 3.4.0, < 3.4.4||>= 3.5.0, < 3.5.5||>= 3.6.0, < 3.6.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:1.1.1q:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"1.1.1q-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-22795","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-22795","cwe":"CWE-754","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-22795","date":"2026-10-08","epss":0.00169,"percentile":0.0568}],"risk":0.08872500000000001,"urls":["https://github.com/openssl/openssl/commit/2502e7b7d4c0cf4f972a881641fe09edc67aeec4","https://github.com/openssl/openssl/commit/572844beca95068394c916626a6d3a490f831a49","https://github.com/openssl/openssl/commit/7bbca05be55b129651d9df4bdb92becc45002c12","https://github.com/openssl/openssl/commit/eeee3cbd4d682095ed431052f00403004596373e","https://github.com/openssl/openssl/commit/ef2fb66ec571564d64d1c74a12e388a2a54d05d2","https://openssl-library.org/news/secadv/20260127.txt","https://cert-portal.siemens.com/productcert/html/ssa-265688.html"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-22795","description":"Issue summary: An invalid or NULL pointer dereference can happen in\nan application processing a malformed PKCS#12 file.\n\nImpact summary: An application processing a malformed PKCS#12 file can be\ncaused to dereference an invalid or NULL pointer on memory read, resulting\nin a Denial of Service.\n\nA type confusion vulnerability exists in PKCS#12 parsing code where\nan ASN1_TYPE union member is accessed without first validating the type,\ncausing an invalid pointer read.\n\nThe location is constrained to a 1-byte address space, meaning any\nattempted pointer manipulation can only target addresses between 0x00 and 0xFF.\nThis range corresponds to the zero page, which is unmapped on most modern\noperating systems and will reliably result in a crash, leading only to a\nDenial of Service. Exploiting this issue also requires a user or application\nto process a maliciously crafted PKCS#12 file. It is uncommon to accept\nuntrusted PKCS#12 files in applications as they are usually used to store\nprivate keys which are trusted by definition. For these reasons, the issue\nwas assessed as Low severity.\n\nThe FIPS modules in 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the PKCS12 implementation is outside the OpenSSL FIPS module boundary.\n\nOpenSSL 3.6, 3.5, 3.4, 3.3, 3.0 and 1.1.1 are vulnerable to this issue.\n\nOpenSSL 1.0.2 is not affected by this issue."},"relatedVulnerabilities":[]},{"artifact":{"id":"d081de97c6f633df","cpes":["cpe:2.3:a:libcrypto1.1:libcrypto1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto1.1:libcrypto:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto:libcrypto1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto:libcrypto:1.1.1q-r0:*:*:*:*:*:*:*"],"name":"libcrypto1.1","purl":"pkg:apk/busybox/libcrypto1.1@1.1.1q-r0?arch=x86_64&distro=busybox-1.32.1&upstream=openssl","type":"apk","version":"1.1.1q-r0","language":"","licenses":["OpenSSL"],"metadata":{"Arch":"x86_64","files":[{"path":"/etc"},{"path":"/etc/ssl"},{"path":"/etc/ssl/ct_log_list.cnf"},{"path":"/etc/ssl/ct_log_list.cnf.dist"},{"path":"/etc/ssl/openssl.cnf"},{"path":"/etc/ssl/openssl.cnf.dist"},{"path":"/etc/ssl/certs"},{"path":"/etc/ssl/misc"},{"path":"/etc/ssl/misc/CA.pl"},{"path":"/etc/ssl/misc/tsget"},{"path":"/etc/ssl/misc/tsget.pl"},{"path":"/etc/ssl/private"},{"path":"/lib"},{"path":"/lib/libcrypto.so.1.1"},{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcrypto.so.1.1"},{"path":"/usr/lib/engines-1.1"},{"path":"/usr/lib/engines-1.1/afalg.so"},{"path":"/usr/lib/engines-1.1/capi.so"},{"path":"/usr/lib/engines-1.1/padlock.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-54872","versionConstraint":">= 1.0.2, < 1.0.2zs||>= 1.1.1, < 1.1.1zj||>= 3.0.0, < 3.0.23||>= 3.4.0, < 3.4.8||>= 3.5.0, < 3.5.9||>= 3.6.0, < 3.6.5||>= 4.0.0, < 4.0.3 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:1.1.1q:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"1.1.1q-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-54872","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54872","cwe":"CWE-208","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-54872","date":"2026-10-08","epss":0.00263,"percentile":0.16589}],"risk":0.08810499999999999,"urls":["https://github.com/openssl/openssl/commit/1a5bee8dc57430a2be69cd1ffe7fec6a62f4f179","https://github.com/openssl/openssl/commit/3f7e1363dccec6f7732bb9e9fa471bb6e4aa68cb","https://github.com/openssl/openssl/commit/7d83bc7764999dfd91b83b4f0815b45390422afd","https://github.com/openssl/openssl/commit/8166827a78aad164a07aa86dea2b425403ced471","https://openssl-library.org/news/secadv/20260929.txt"],"severity":"Low","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54872","description":"Issue summary: The generic elliptic-curve scalar multiplication used for\nECDSA and SM2 signature operations with curves that do not have a dedicated\nimplementation leaks information about the secret nonce through timing.\n\nImpact summary: An attacker able to measure signing times may learn\ninformation about the per-signature secret nonce, which over many signatures\ncan, via a lattice / Hidden Number Problem attack, lead to recovery of the\nprivate key.\n\nCWE: CWE-208: Observable Timing Discrepancy\n\nDescription: The generic elliptic-curve scalar multiplication used for\ncurves that do not have a dedicated constant-time implementation pads the\nsecret scalar with non-constant-time BIGNUM operations, so the time taken\ndepends on the value of the secret scalar derived from the ECDSA and SM2 nonce.\n\nThe leak is very small; observing it requires a large number of\nmeasurements. The effect is largest for curves whose group order lies\non a machine-word boundary, such as brainpoolP384r1.\n\nApplications using ECDSA signing over the Brainpool and other generic prime\ncurves, and SM2 signing on platforms that use the generic implementation,\nare vulnerable to this issue.\n\nThe NIST curves P-256, P-384 and P-521 use dedicated constant-time\nimplementations and are not affected.\n\nFIPS Impact: no\nThe FIPS modules are not affected: the approved NIST curves used in the FIPS\nprovider have dedicated constant-time implementations and do not use the\naffected code path."},"relatedVulnerabilities":[]},{"artifact":{"id":"74f4e71ff41d2d68","cpes":["cpe:2.3:a:libssl1.1:libssl1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl1.1:libssl:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl:1.1.1q-r0:*:*:*:*:*:*:*"],"name":"libssl1.1","purl":"pkg:apk/busybox/libssl1.1@1.1.1q-r0?arch=x86_64&distro=busybox-1.32.1&upstream=openssl","type":"apk","version":"1.1.1q-r0","language":"","licenses":["OpenSSL"],"metadata":{"Arch":"x86_64","files":[{"path":"/lib"},{"path":"/lib/libssl.so.1.1"},{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libssl.so.1.1"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-54872","versionConstraint":">= 1.0.2, < 1.0.2zs||>= 1.1.1, < 1.1.1zj||>= 3.0.0, < 3.0.23||>= 3.4.0, < 3.4.8||>= 3.5.0, < 3.5.9||>= 3.6.0, < 3.6.5||>= 4.0.0, < 4.0.3 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:1.1.1q:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"1.1.1q-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-54872","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54872","cwe":"CWE-208","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-54872","date":"2026-10-08","epss":0.00263,"percentile":0.16589}],"risk":0.08810499999999999,"urls":["https://github.com/openssl/openssl/commit/1a5bee8dc57430a2be69cd1ffe7fec6a62f4f179","https://github.com/openssl/openssl/commit/3f7e1363dccec6f7732bb9e9fa471bb6e4aa68cb","https://github.com/openssl/openssl/commit/7d83bc7764999dfd91b83b4f0815b45390422afd","https://github.com/openssl/openssl/commit/8166827a78aad164a07aa86dea2b425403ced471","https://openssl-library.org/news/secadv/20260929.txt"],"severity":"Low","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54872","description":"Issue summary: The generic elliptic-curve scalar multiplication used for\nECDSA and SM2 signature operations with curves that do not have a dedicated\nimplementation leaks information about the secret nonce through timing.\n\nImpact summary: An attacker able to measure signing times may learn\ninformation about the per-signature secret nonce, which over many signatures\ncan, via a lattice / Hidden Number Problem attack, lead to recovery of the\nprivate key.\n\nCWE: CWE-208: Observable Timing Discrepancy\n\nDescription: The generic elliptic-curve scalar multiplication used for\ncurves that do not have a dedicated constant-time implementation pads the\nsecret scalar with non-constant-time BIGNUM operations, so the time taken\ndepends on the value of the secret scalar derived from the ECDSA and SM2 nonce.\n\nThe leak is very small; observing it requires a large number of\nmeasurements. The effect is largest for curves whose group order lies\non a machine-word boundary, such as brainpoolP384r1.\n\nApplications using ECDSA signing over the Brainpool and other generic prime\ncurves, and SM2 signing on platforms that use the generic implementation,\nare vulnerable to this issue.\n\nThe NIST curves P-256, P-384 and P-521 use dedicated constant-time\nimplementations and are not affected.\n\nFIPS Impact: no\nThe FIPS modules are not affected: the approved NIST curves used in the FIPS\nprovider have dedicated constant-time implementations and do not use the\naffected code path."},"relatedVulnerabilities":[]},{"artifact":{"id":"14807b4f7067817d","cpes":["cpe:2.3:a:openssl:openssl:1.1.1q-r0:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:apk/busybox/openssl@1.1.1q-r0?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"1.1.1q-r0","language":"","licenses":["OpenSSL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/openssl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-54872","versionConstraint":">= 1.0.2, < 1.0.2zs||>= 1.1.1, < 1.1.1zj||>= 3.0.0, < 3.0.23||>= 3.4.0, < 3.4.8||>= 3.5.0, < 3.5.9||>= 3.6.0, < 3.6.5||>= 4.0.0, < 4.0.3 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:1.1.1q:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"1.1.1q-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-54872","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54872","cwe":"CWE-208","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-54872","date":"2026-10-08","epss":0.00263,"percentile":0.16589}],"risk":0.08810499999999999,"urls":["https://github.com/openssl/openssl/commit/1a5bee8dc57430a2be69cd1ffe7fec6a62f4f179","https://github.com/openssl/openssl/commit/3f7e1363dccec6f7732bb9e9fa471bb6e4aa68cb","https://github.com/openssl/openssl/commit/7d83bc7764999dfd91b83b4f0815b45390422afd","https://github.com/openssl/openssl/commit/8166827a78aad164a07aa86dea2b425403ced471","https://openssl-library.org/news/secadv/20260929.txt"],"severity":"Low","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54872","description":"Issue summary: The generic elliptic-curve scalar multiplication used for\nECDSA and SM2 signature operations with curves that do not have a dedicated\nimplementation leaks information about the secret nonce through timing.\n\nImpact summary: An attacker able to measure signing times may learn\ninformation about the per-signature secret nonce, which over many signatures\ncan, via a lattice / Hidden Number Problem attack, lead to recovery of the\nprivate key.\n\nCWE: CWE-208: Observable Timing Discrepancy\n\nDescription: The generic elliptic-curve scalar multiplication used for\ncurves that do not have a dedicated constant-time implementation pads the\nsecret scalar with non-constant-time BIGNUM operations, so the time taken\ndepends on the value of the secret scalar derived from the ECDSA and SM2 nonce.\n\nThe leak is very small; observing it requires a large number of\nmeasurements. The effect is largest for curves whose group order lies\non a machine-word boundary, such as brainpoolP384r1.\n\nApplications using ECDSA signing over the Brainpool and other generic prime\ncurves, and SM2 signing on platforms that use the generic implementation,\nare vulnerable to this issue.\n\nThe NIST curves P-256, P-384 and P-521 use dedicated constant-time\nimplementations and are not affected.\n\nFIPS Impact: no\nThe FIPS modules are not affected: the approved NIST curves used in the FIPS\nprovider have dedicated constant-time implementations and do not use the\naffected code path."},"relatedVulnerabilities":[]},{"artifact":{"id":"b7ae79f16d85611b","cpes":["cpe:2.3:a:zlib:zlib:1.2.12-r3:*:*:*:*:*:*:*"],"name":"zlib","purl":"pkg:apk/busybox/zlib@1.2.12-r3?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"1.2.12-r3","language":"","licenses":["Zlib"],"metadata":{"Arch":"x86_64","files":[{"path":"/lib"},{"path":"/lib/libz.so.1"},{"path":"/lib/libz.so.1.2.12"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"zlib"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:zlib:zlib:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-27171","versionConstraint":">= 1.2.12, < 1.3.2 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:zlib:zlib:1.2.12:*:*:*:*:*:*:*"],"package":{"name":"zlib","version":"1.2.12-r3"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-27171","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-27171","cwe":"CWE-1284","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-27171","date":"2026-10-08","epss":0.00191,"percentile":0.08065}],"risk":0.08786,"urls":["https://7asecurity.com/blog/2026/02/zlib-7asecurity-audit/","https://7asecurity.com/reports/pentest-report-zlib-RC1.1.pdf","https://github.com/madler/zlib/issues/904","https://github.com/madler/zlib/releases/tag/v1.3.2","https://ostif.org/zlib-audit-complete/"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-27171","description":"zlib before 1.3.2 allows CPU consumption via crc32_combine64 and crc32_combine_gen64 because x2nmodp can do right shifts within a loop that has no termination condition."},"relatedVulnerabilities":[]},{"artifact":{"id":"d081de97c6f633df","cpes":["cpe:2.3:a:libcrypto1.1:libcrypto1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto1.1:libcrypto:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto:libcrypto1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto:libcrypto:1.1.1q-r0:*:*:*:*:*:*:*"],"name":"libcrypto1.1","purl":"pkg:apk/busybox/libcrypto1.1@1.1.1q-r0?arch=x86_64&distro=busybox-1.32.1&upstream=openssl","type":"apk","version":"1.1.1q-r0","language":"","licenses":["OpenSSL"],"metadata":{"Arch":"x86_64","files":[{"path":"/etc"},{"path":"/etc/ssl"},{"path":"/etc/ssl/ct_log_list.cnf"},{"path":"/etc/ssl/ct_log_list.cnf.dist"},{"path":"/etc/ssl/openssl.cnf"},{"path":"/etc/ssl/openssl.cnf.dist"},{"path":"/etc/ssl/certs"},{"path":"/etc/ssl/misc"},{"path":"/etc/ssl/misc/CA.pl"},{"path":"/etc/ssl/misc/tsget"},{"path":"/etc/ssl/misc/tsget.pl"},{"path":"/etc/ssl/private"},{"path":"/lib"},{"path":"/lib/libcrypto.so.1.1"},{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcrypto.so.1.1"},{"path":"/usr/lib/engines-1.1"},{"path":"/usr/lib/engines-1.1/afalg.so"},{"path":"/usr/lib/engines-1.1/capi.so"},{"path":"/usr/lib/engines-1.1/padlock.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-68160","versionConstraint":">= 1.0.2, < 1.0.2zn||>= 1.1.1, < 1.1.1ze||>= 3.0.0, < 3.0.19||>= 3.3.0, < 3.3.6||>= 3.4.0, < 3.4.4||>= 3.5.0, < 3.5.5||>= 3.6.0, < 3.6.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:1.1.1q:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"1.1.1q-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2025-68160","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-68160","cwe":"CWE-787","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2025-68160","date":"2026-10-08","epss":0.00178,"percentile":0.0678}],"risk":0.08632999999999999,"urls":["https://github.com/openssl/openssl/commit/384011202af92605d926fafe4a0bcd6b65d162ad","https://github.com/openssl/openssl/commit/475c466ef2fbd8fc1df6fae1c3eed9c813fc8ff6","https://github.com/openssl/openssl/commit/4c96fbba618e1940f038012506ee9e21d32ee12c","https://github.com/openssl/openssl/commit/6845c3b6460a98b1ec4e463baa2ea1a63a32d7c0","https://github.com/openssl/openssl/commit/68a7cd2e2816c3a02f4d45a2ce43fc04fac97096","https://openssl-library.org/news/secadv/20260127.txt","https://cert-portal.siemens.com/productcert/html/ssa-265688.html"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-68160","description":"Issue summary: Writing large, newline-free data into a BIO chain using the\nline-buffering filter where the next BIO performs short writes can trigger\na heap-based out-of-bounds write.\n\nImpact summary: This out-of-bounds write can cause memory corruption which\ntypically results in a crash, leading to Denial of Service for an application.\n\nThe line-buffering BIO filter (BIO_f_linebuffer) is not used by default in\nTLS/SSL data paths. In OpenSSL command-line applications, it is typically\nonly pushed onto stdout/stderr on VMS systems. Third-party applications that\nexplicitly use this filter with a BIO chain that can short-write and that\nwrite large, newline-free data influenced by an attacker would be affected.\nHowever, the circumstances where this could happen are unlikely to be under\nattacker control, and BIO_f_linebuffer is unlikely to be handling non-curated\ndata controlled by an attacker. For that reason the issue was assessed as\nLow severity.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the BIO implementation is outside the OpenSSL FIPS module boundary.\n\nOpenSSL 3.6, 3.5, 3.4, 3.3, 3.0, 1.1.1 and 1.0.2 are vulnerable to this issue."},"relatedVulnerabilities":[]},{"artifact":{"id":"74f4e71ff41d2d68","cpes":["cpe:2.3:a:libssl1.1:libssl1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl1.1:libssl:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl:1.1.1q-r0:*:*:*:*:*:*:*"],"name":"libssl1.1","purl":"pkg:apk/busybox/libssl1.1@1.1.1q-r0?arch=x86_64&distro=busybox-1.32.1&upstream=openssl","type":"apk","version":"1.1.1q-r0","language":"","licenses":["OpenSSL"],"metadata":{"Arch":"x86_64","files":[{"path":"/lib"},{"path":"/lib/libssl.so.1.1"},{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libssl.so.1.1"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-68160","versionConstraint":">= 1.0.2, < 1.0.2zn||>= 1.1.1, < 1.1.1ze||>= 3.0.0, < 3.0.19||>= 3.3.0, < 3.3.6||>= 3.4.0, < 3.4.4||>= 3.5.0, < 3.5.5||>= 3.6.0, < 3.6.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:1.1.1q:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"1.1.1q-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2025-68160","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-68160","cwe":"CWE-787","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2025-68160","date":"2026-10-08","epss":0.00178,"percentile":0.0678}],"risk":0.08632999999999999,"urls":["https://github.com/openssl/openssl/commit/384011202af92605d926fafe4a0bcd6b65d162ad","https://github.com/openssl/openssl/commit/475c466ef2fbd8fc1df6fae1c3eed9c813fc8ff6","https://github.com/openssl/openssl/commit/4c96fbba618e1940f038012506ee9e21d32ee12c","https://github.com/openssl/openssl/commit/6845c3b6460a98b1ec4e463baa2ea1a63a32d7c0","https://github.com/openssl/openssl/commit/68a7cd2e2816c3a02f4d45a2ce43fc04fac97096","https://openssl-library.org/news/secadv/20260127.txt","https://cert-portal.siemens.com/productcert/html/ssa-265688.html"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-68160","description":"Issue summary: Writing large, newline-free data into a BIO chain using the\nline-buffering filter where the next BIO performs short writes can trigger\na heap-based out-of-bounds write.\n\nImpact summary: This out-of-bounds write can cause memory corruption which\ntypically results in a crash, leading to Denial of Service for an application.\n\nThe line-buffering BIO filter (BIO_f_linebuffer) is not used by default in\nTLS/SSL data paths. In OpenSSL command-line applications, it is typically\nonly pushed onto stdout/stderr on VMS systems. Third-party applications that\nexplicitly use this filter with a BIO chain that can short-write and that\nwrite large, newline-free data influenced by an attacker would be affected.\nHowever, the circumstances where this could happen are unlikely to be under\nattacker control, and BIO_f_linebuffer is unlikely to be handling non-curated\ndata controlled by an attacker. For that reason the issue was assessed as\nLow severity.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the BIO implementation is outside the OpenSSL FIPS module boundary.\n\nOpenSSL 3.6, 3.5, 3.4, 3.3, 3.0, 1.1.1 and 1.0.2 are vulnerable to this issue."},"relatedVulnerabilities":[]},{"artifact":{"id":"14807b4f7067817d","cpes":["cpe:2.3:a:openssl:openssl:1.1.1q-r0:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:apk/busybox/openssl@1.1.1q-r0?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"1.1.1q-r0","language":"","licenses":["OpenSSL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/openssl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-68160","versionConstraint":">= 1.0.2, < 1.0.2zn||>= 1.1.1, < 1.1.1ze||>= 3.0.0, < 3.0.19||>= 3.3.0, < 3.3.6||>= 3.4.0, < 3.4.4||>= 3.5.0, < 3.5.5||>= 3.6.0, < 3.6.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:1.1.1q:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"1.1.1q-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2025-68160","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-68160","cwe":"CWE-787","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2025-68160","date":"2026-10-08","epss":0.00178,"percentile":0.0678}],"risk":0.08632999999999999,"urls":["https://github.com/openssl/openssl/commit/384011202af92605d926fafe4a0bcd6b65d162ad","https://github.com/openssl/openssl/commit/475c466ef2fbd8fc1df6fae1c3eed9c813fc8ff6","https://github.com/openssl/openssl/commit/4c96fbba618e1940f038012506ee9e21d32ee12c","https://github.com/openssl/openssl/commit/6845c3b6460a98b1ec4e463baa2ea1a63a32d7c0","https://github.com/openssl/openssl/commit/68a7cd2e2816c3a02f4d45a2ce43fc04fac97096","https://openssl-library.org/news/secadv/20260127.txt","https://cert-portal.siemens.com/productcert/html/ssa-265688.html"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-68160","description":"Issue summary: Writing large, newline-free data into a BIO chain using the\nline-buffering filter where the next BIO performs short writes can trigger\na heap-based out-of-bounds write.\n\nImpact summary: This out-of-bounds write can cause memory corruption which\ntypically results in a crash, leading to Denial of Service for an application.\n\nThe line-buffering BIO filter (BIO_f_linebuffer) is not used by default in\nTLS/SSL data paths. In OpenSSL command-line applications, it is typically\nonly pushed onto stdout/stderr on VMS systems. Third-party applications that\nexplicitly use this filter with a BIO chain that can short-write and that\nwrite large, newline-free data influenced by an attacker would be affected.\nHowever, the circumstances where this could happen are unlikely to be under\nattacker control, and BIO_f_linebuffer is unlikely to be handling non-curated\ndata controlled by an attacker. For that reason the issue was assessed as\nLow severity.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the BIO implementation is outside the OpenSSL FIPS module boundary.\n\nOpenSSL 3.6, 3.5, 3.4, 3.3, 3.0, 1.1.1 and 1.0.2 are vulnerable to this issue."},"relatedVulnerabilities":[]},{"artifact":{"id":"d081de97c6f633df","cpes":["cpe:2.3:a:libcrypto1.1:libcrypto1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto1.1:libcrypto:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto:libcrypto1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto:libcrypto:1.1.1q-r0:*:*:*:*:*:*:*"],"name":"libcrypto1.1","purl":"pkg:apk/busybox/libcrypto1.1@1.1.1q-r0?arch=x86_64&distro=busybox-1.32.1&upstream=openssl","type":"apk","version":"1.1.1q-r0","language":"","licenses":["OpenSSL"],"metadata":{"Arch":"x86_64","files":[{"path":"/etc"},{"path":"/etc/ssl"},{"path":"/etc/ssl/ct_log_list.cnf"},{"path":"/etc/ssl/ct_log_list.cnf.dist"},{"path":"/etc/ssl/openssl.cnf"},{"path":"/etc/ssl/openssl.cnf.dist"},{"path":"/etc/ssl/certs"},{"path":"/etc/ssl/misc"},{"path":"/etc/ssl/misc/CA.pl"},{"path":"/etc/ssl/misc/tsget"},{"path":"/etc/ssl/misc/tsget.pl"},{"path":"/etc/ssl/private"},{"path":"/lib"},{"path":"/lib/libcrypto.so.1.1"},{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcrypto.so.1.1"},{"path":"/usr/lib/engines-1.1"},{"path":"/usr/lib/engines-1.1/afalg.so"},{"path":"/usr/lib/engines-1.1/capi.so"},{"path":"/usr/lib/engines-1.1/padlock.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-77696","versionConstraint":">= 1.1.1, < 1.1.1zj||>= 3.0.0, < 3.0.23||>= 3.4.0, < 3.4.8||>= 3.5.0, < 3.5.9||>= 3.6.0, < 3.6.5||>= 4.0.0, < 4.0.3 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:1.1.1q:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"1.1.1q-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-77696","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-77696","cwe":"CWE-208","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-77696","date":"2026-10-08","epss":0.00243,"percentile":0.14252}],"risk":0.08140499999999999,"urls":["https://github.com/openssl/openssl/commit/1c4aed808a7aea32d2d013049c2e0d9fef164fc9","https://github.com/openssl/openssl/commit/20b20628d39b2dcc4677194bd68c7c060fa598cb","https://github.com/openssl/openssl/commit/419f5cb519721dceed393dbc524d79e487c72e64","https://github.com/openssl/openssl/commit/6b90445a56b99a328ac1feba058abf976504f440","https://openssl-library.org/news/secadv/20260929.txt"],"severity":"Low","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-77696","description":"Issue summary: SM2 signature generation uses non-constant-time arithmetic\non secret values, forming a timing side-channel.\n\nImpact summary: An attacker able to measure SM2 signing times may learn\ninformation about the per-signature secret nonce, which over many signatures\ncan, via a lattice / Hidden Number Problem attack, lead to recovery of the\nprivate key.\n\nCWE: CWE-208: Observable Timing Discrepancy\n\nDescription: SM2 signature generation computes the signature value using\nvariable-time BIGNUM operations on the secret nonce and the private key, so\nthe time taken to produce an SM2 signature depends on these secret values,\nforming a timing side-channel.\n\nApplications performing SM2 signature generation are affected on all\nplatforms.\n\nFIPS Impact: no\nSM2 is not a FIPS algorithm."},"relatedVulnerabilities":[]},{"artifact":{"id":"74f4e71ff41d2d68","cpes":["cpe:2.3:a:libssl1.1:libssl1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl1.1:libssl:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl:1.1.1q-r0:*:*:*:*:*:*:*"],"name":"libssl1.1","purl":"pkg:apk/busybox/libssl1.1@1.1.1q-r0?arch=x86_64&distro=busybox-1.32.1&upstream=openssl","type":"apk","version":"1.1.1q-r0","language":"","licenses":["OpenSSL"],"metadata":{"Arch":"x86_64","files":[{"path":"/lib"},{"path":"/lib/libssl.so.1.1"},{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libssl.so.1.1"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-77696","versionConstraint":">= 1.1.1, < 1.1.1zj||>= 3.0.0, < 3.0.23||>= 3.4.0, < 3.4.8||>= 3.5.0, < 3.5.9||>= 3.6.0, < 3.6.5||>= 4.0.0, < 4.0.3 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:1.1.1q:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"1.1.1q-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-77696","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-77696","cwe":"CWE-208","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-77696","date":"2026-10-08","epss":0.00243,"percentile":0.14252}],"risk":0.08140499999999999,"urls":["https://github.com/openssl/openssl/commit/1c4aed808a7aea32d2d013049c2e0d9fef164fc9","https://github.com/openssl/openssl/commit/20b20628d39b2dcc4677194bd68c7c060fa598cb","https://github.com/openssl/openssl/commit/419f5cb519721dceed393dbc524d79e487c72e64","https://github.com/openssl/openssl/commit/6b90445a56b99a328ac1feba058abf976504f440","https://openssl-library.org/news/secadv/20260929.txt"],"severity":"Low","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-77696","description":"Issue summary: SM2 signature generation uses non-constant-time arithmetic\non secret values, forming a timing side-channel.\n\nImpact summary: An attacker able to measure SM2 signing times may learn\ninformation about the per-signature secret nonce, which over many signatures\ncan, via a lattice / Hidden Number Problem attack, lead to recovery of the\nprivate key.\n\nCWE: CWE-208: Observable Timing Discrepancy\n\nDescription: SM2 signature generation computes the signature value using\nvariable-time BIGNUM operations on the secret nonce and the private key, so\nthe time taken to produce an SM2 signature depends on these secret values,\nforming a timing side-channel.\n\nApplications performing SM2 signature generation are affected on all\nplatforms.\n\nFIPS Impact: no\nSM2 is not a FIPS algorithm."},"relatedVulnerabilities":[]},{"artifact":{"id":"14807b4f7067817d","cpes":["cpe:2.3:a:openssl:openssl:1.1.1q-r0:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:apk/busybox/openssl@1.1.1q-r0?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"1.1.1q-r0","language":"","licenses":["OpenSSL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/openssl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-77696","versionConstraint":">= 1.1.1, < 1.1.1zj||>= 3.0.0, < 3.0.23||>= 3.4.0, < 3.4.8||>= 3.5.0, < 3.5.9||>= 3.6.0, < 3.6.5||>= 4.0.0, < 4.0.3 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:1.1.1q:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"1.1.1q-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-77696","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-77696","cwe":"CWE-208","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-77696","date":"2026-10-08","epss":0.00243,"percentile":0.14252}],"risk":0.08140499999999999,"urls":["https://github.com/openssl/openssl/commit/1c4aed808a7aea32d2d013049c2e0d9fef164fc9","https://github.com/openssl/openssl/commit/20b20628d39b2dcc4677194bd68c7c060fa598cb","https://github.com/openssl/openssl/commit/419f5cb519721dceed393dbc524d79e487c72e64","https://github.com/openssl/openssl/commit/6b90445a56b99a328ac1feba058abf976504f440","https://openssl-library.org/news/secadv/20260929.txt"],"severity":"Low","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-77696","description":"Issue summary: SM2 signature generation uses non-constant-time arithmetic\non secret values, forming a timing side-channel.\n\nImpact summary: An attacker able to measure SM2 signing times may learn\ninformation about the per-signature secret nonce, which over many signatures\ncan, via a lattice / Hidden Number Problem attack, lead to recovery of the\nprivate key.\n\nCWE: CWE-208: Observable Timing Discrepancy\n\nDescription: SM2 signature generation computes the signature value using\nvariable-time BIGNUM operations on the secret nonce and the private key, so\nthe time taken to produce an SM2 signature depends on these secret values,\nforming a timing side-channel.\n\nApplications performing SM2 signature generation are affected on all\nplatforms.\n\nFIPS Impact: no\nSM2 is not a FIPS algorithm."},"relatedVulnerabilities":[]},{"artifact":{"id":"eaba89df685b6dbe","cpes":["cpe:2.3:a:musl-libc:musl:1.2.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:musl_libc:musl:1.2.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:musl:musl:1.2.2-r1:*:*:*:*:*:*:*"],"name":"musl","purl":"pkg:apk/busybox/musl@1.2.2-r1?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"1.2.2-r1","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/lib"},{"path":"/lib/ld-musl-x86_64.so.1"},{"path":"/lib/libc.musl-x86_64.so.1"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"musl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:musl-libc:musl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-6042","versionConstraint":">= 1.2.0, <= 1.2.6 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:musl-libc:musl:1.2.2:*:*:*:*:*:*:*"],"package":{"name":"musl","version":"1.2.2-r1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-6042","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:L/AC:L/Au:S/C:N/I:N/A:P","metrics":{"baseScore":1.7,"impactScore":2.9,"exploitabilityScore":3.2},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6042","cwe":"CWE-404","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2026-6042","cwe":"CWE-407","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2026-6042","date":"2026-10-08","epss":0.0016,"percentile":0.04551}],"risk":0.06613333333333334,"urls":["https://vuldb.com/submit/796352","https://vuldb.com/vuln/356620","https://vuldb.com/vuln/356620/cti","https://www.openwall.com/lists/oss-security/2026/04/02/10","https://www.openwall.com/lists/oss-security/2026/04/03/2","http://www.openwall.com/lists/oss-security/2026/04/09/19"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6042","description":"A security flaw has been discovered in musl libc up to 1.2.6. Affected is the function iconv of the file src/locale/iconv.c of the component GB18030 4-byte Decoder. Performing a manipulation results in inefficient algorithmic complexity. The attack must be initiated from a local position. To fix this issue, it is recommended to deploy a patch."},"relatedVulnerabilities":[]},{"artifact":{"id":"a59088f85518efa7","cpes":["cpe:2.3:a:musl-utils:musl-utils:1.2.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:musl-utils:musl_utils:1.2.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:musl_utils:musl-utils:1.2.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:musl_utils:musl_utils:1.2.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:musl-libc:musl-utils:1.2.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:musl-libc:musl_utils:1.2.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:musl:musl-utils:1.2.2-r1:*:*:*:*:*:*:*","cpe:2.3:a:musl:musl_utils:1.2.2-r1:*:*:*:*:*:*:*"],"name":"musl-utils","purl":"pkg:apk/busybox/musl-utils@1.2.2-r1?arch=x86_64&distro=busybox-1.32.1&upstream=musl","type":"apk","version":"1.2.2-r1","language":"","licenses":["BSD","GPL2+","MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/sbin"},{"path":"/sbin/ldconfig"},{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/getconf"},{"path":"/usr/bin/getent"},{"path":"/usr/bin/iconv"},{"path":"/usr/bin/ldd"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"musl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:musl-libc:musl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-6042","versionConstraint":">= 1.2.0, <= 1.2.6 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:musl-libc:musl:1.2.2:*:*:*:*:*:*:*"],"package":{"name":"musl","version":"1.2.2-r1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-6042","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:L/AC:L/Au:S/C:N/I:N/A:P","metrics":{"baseScore":1.7,"impactScore":2.9,"exploitabilityScore":3.2},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6042","cwe":"CWE-404","type":"Secondary","source":"cna@vuldb.com"},{"cve":"CVE-2026-6042","cwe":"CWE-407","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2026-6042","date":"2026-10-08","epss":0.0016,"percentile":0.04551}],"risk":0.06613333333333334,"urls":["https://vuldb.com/submit/796352","https://vuldb.com/vuln/356620","https://vuldb.com/vuln/356620/cti","https://www.openwall.com/lists/oss-security/2026/04/02/10","https://www.openwall.com/lists/oss-security/2026/04/03/2","http://www.openwall.com/lists/oss-security/2026/04/09/19"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6042","description":"A security flaw has been discovered in musl libc up to 1.2.6. Affected is the function iconv of the file src/locale/iconv.c of the component GB18030 4-byte Decoder. Performing a manipulation results in inefficient algorithmic complexity. The attack must be initiated from a local position. To fix this issue, it is recommended to deploy a patch."},"relatedVulnerabilities":[]},{"artifact":{"id":"6040784032e8795c","cpes":["cpe:2.3:a:curl:curl:7.79.1-r3:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:7.79.1-r3:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/busybox/curl@7.79.1-r3?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"7.79.1-r3","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-14017","versionConstraint":">= 7.17.0, < 8.18.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:haxx:curl:7.79.1:*:*:*:*:*:*:*"],"package":{"name":"curl","version":"7.79.1-r3"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2025-14017","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":6.3,"impactScore":5.2,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-14017","cwe":"CWE-567","type":"Secondary","source":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"cve":"CVE-2025-14017","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-14017","date":"2026-10-08","epss":0.00114,"percentile":0.01374}],"risk":0.06441,"urls":["https://curl.se/docs/CVE-2025-14017.html","https://curl.se/docs/CVE-2025-14017.json","http://www.openwall.com/lists/oss-security/2026/01/07/3"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-14017","description":"When doing multi-threaded LDAPS transfers (LDAP over TLS) with libcurl,\nchanging TLS options in one thread would inadvertently change them globally\nand therefore possibly also affect other concurrently setup transfers.\n\nDisabling certificate verification for a specific transfer could\nunintentionally disable the feature for other threads as well."},"relatedVulnerabilities":[]},{"artifact":{"id":"d081de97c6f633df","cpes":["cpe:2.3:a:libcrypto1.1:libcrypto1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto1.1:libcrypto:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto:libcrypto1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libcrypto:libcrypto:1.1.1q-r0:*:*:*:*:*:*:*"],"name":"libcrypto1.1","purl":"pkg:apk/busybox/libcrypto1.1@1.1.1q-r0?arch=x86_64&distro=busybox-1.32.1&upstream=openssl","type":"apk","version":"1.1.1q-r0","language":"","licenses":["OpenSSL"],"metadata":{"Arch":"x86_64","files":[{"path":"/etc"},{"path":"/etc/ssl"},{"path":"/etc/ssl/ct_log_list.cnf"},{"path":"/etc/ssl/ct_log_list.cnf.dist"},{"path":"/etc/ssl/openssl.cnf"},{"path":"/etc/ssl/openssl.cnf.dist"},{"path":"/etc/ssl/certs"},{"path":"/etc/ssl/misc"},{"path":"/etc/ssl/misc/CA.pl"},{"path":"/etc/ssl/misc/tsget"},{"path":"/etc/ssl/misc/tsget.pl"},{"path":"/etc/ssl/private"},{"path":"/lib"},{"path":"/lib/libcrypto.so.1.1"},{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcrypto.so.1.1"},{"path":"/usr/lib/engines-1.1"},{"path":"/usr/lib/engines-1.1/afalg.so"},{"path":"/usr/lib/engines-1.1/capi.so"},{"path":"/usr/lib/engines-1.1/padlock.so"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-69418","versionConstraint":">= 1.1.1, < 1.1.1ze||>= 3.0.0, < 3.0.19||>= 3.3.0, < 3.3.6||>= 3.4.0, < 3.4.4||>= 3.5.0, < 3.5.5||>= 3.6.0, < 3.6.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:1.1.1q:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"1.1.1q-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2025-69418","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":4,"impactScore":2.6,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-69418","cwe":"CWE-325","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2025-69418","date":"2026-10-08","epss":0.00129,"percentile":0.02225}],"risk":0.05805,"urls":["https://github.com/openssl/openssl/commit/372fc5c77529695b05b4f5b5187691a57ef5dffc","https://github.com/openssl/openssl/commit/4016975d4469cd6b94927c607f7c511385f928d8","https://github.com/openssl/openssl/commit/52d23c86a54adab5ee9f80e48b242b52c4cc2347","https://github.com/openssl/openssl/commit/a7589230356d908c0eca4b969ec4f62106f4f5ae","https://github.com/openssl/openssl/commit/ed40856d7d4ba6cb42779b6770666a65f19cb977","https://openssl-library.org/news/secadv/20260127.txt","https://cert-portal.siemens.com/productcert/html/ssa-265688.html"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-69418","description":"Issue summary: When using the low-level OCB API directly with AES-NI or<br>other hardware-accelerated code paths, inputs whose length is not a multiple<br>of 16 bytes can leave the final partial block unencrypted and unauthenticated.<br><br>Impact summary: The trailing 1-15 bytes of a message may be exposed in<br>cleartext on encryption and are not covered by the authentication tag,<br>allowing an attacker to read or tamper with those bytes without detection.<br><br>The low-level OCB encrypt and decrypt routines in the hardware-accelerated<br>stream path process full 16-byte blocks but do not advance the input/output<br>pointers. The subsequent tail-handling code then operates on the original<br>base pointers, effectively reprocessing the beginning of the buffer while<br>leaving the actual trailing bytes unprocessed. The authentication checksum<br>also excludes the true tail bytes.<br><br>However, typical OpenSSL consumers using EVP are not affected because the<br>higher-level EVP and provider OCB implementations split inputs so that full<br>blocks and trailing partial blocks are processed in separate calls, avoiding<br>the problematic code path. Additionally, TLS does not use OCB ciphersuites.<br>The vulnerability only affects applications that call the low-level<br>CRYPTO_ocb128_encrypt() or CRYPTO_ocb128_decrypt() functions directly with<br>non-block-aligned lengths in a single call on hardware-accelerated builds.<br>For these reasons the issue was assessed as Low severity.<br><br>The FIPS modules in 3.6, 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected<br>by this issue, as OCB mode is not a FIPS-approved algorithm.<br><br>OpenSSL 3.6, 3.5, 3.4, 3.3, 3.0 and 1.1.1 are vulnerable to this issue.<br><br>OpenSSL 1.0.2 is not affected by this issue."},"relatedVulnerabilities":[]},{"artifact":{"id":"74f4e71ff41d2d68","cpes":["cpe:2.3:a:libssl1.1:libssl1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl1.1:libssl:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl1.1:1.1.1q-r0:*:*:*:*:*:*:*","cpe:2.3:a:libssl:libssl:1.1.1q-r0:*:*:*:*:*:*:*"],"name":"libssl1.1","purl":"pkg:apk/busybox/libssl1.1@1.1.1q-r0?arch=x86_64&distro=busybox-1.32.1&upstream=openssl","type":"apk","version":"1.1.1q-r0","language":"","licenses":["OpenSSL"],"metadata":{"Arch":"x86_64","files":[{"path":"/lib"},{"path":"/lib/libssl.so.1.1"},{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libssl.so.1.1"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-69418","versionConstraint":">= 1.1.1, < 1.1.1ze||>= 3.0.0, < 3.0.19||>= 3.3.0, < 3.3.6||>= 3.4.0, < 3.4.4||>= 3.5.0, < 3.5.5||>= 3.6.0, < 3.6.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:1.1.1q:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"1.1.1q-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2025-69418","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":4,"impactScore":2.6,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-69418","cwe":"CWE-325","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2025-69418","date":"2026-10-08","epss":0.00129,"percentile":0.02225}],"risk":0.05805,"urls":["https://github.com/openssl/openssl/commit/372fc5c77529695b05b4f5b5187691a57ef5dffc","https://github.com/openssl/openssl/commit/4016975d4469cd6b94927c607f7c511385f928d8","https://github.com/openssl/openssl/commit/52d23c86a54adab5ee9f80e48b242b52c4cc2347","https://github.com/openssl/openssl/commit/a7589230356d908c0eca4b969ec4f62106f4f5ae","https://github.com/openssl/openssl/commit/ed40856d7d4ba6cb42779b6770666a65f19cb977","https://openssl-library.org/news/secadv/20260127.txt","https://cert-portal.siemens.com/productcert/html/ssa-265688.html"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-69418","description":"Issue summary: When using the low-level OCB API directly with AES-NI or<br>other hardware-accelerated code paths, inputs whose length is not a multiple<br>of 16 bytes can leave the final partial block unencrypted and unauthenticated.<br><br>Impact summary: The trailing 1-15 bytes of a message may be exposed in<br>cleartext on encryption and are not covered by the authentication tag,<br>allowing an attacker to read or tamper with those bytes without detection.<br><br>The low-level OCB encrypt and decrypt routines in the hardware-accelerated<br>stream path process full 16-byte blocks but do not advance the input/output<br>pointers. The subsequent tail-handling code then operates on the original<br>base pointers, effectively reprocessing the beginning of the buffer while<br>leaving the actual trailing bytes unprocessed. The authentication checksum<br>also excludes the true tail bytes.<br><br>However, typical OpenSSL consumers using EVP are not affected because the<br>higher-level EVP and provider OCB implementations split inputs so that full<br>blocks and trailing partial blocks are processed in separate calls, avoiding<br>the problematic code path. Additionally, TLS does not use OCB ciphersuites.<br>The vulnerability only affects applications that call the low-level<br>CRYPTO_ocb128_encrypt() or CRYPTO_ocb128_decrypt() functions directly with<br>non-block-aligned lengths in a single call on hardware-accelerated builds.<br>For these reasons the issue was assessed as Low severity.<br><br>The FIPS modules in 3.6, 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected<br>by this issue, as OCB mode is not a FIPS-approved algorithm.<br><br>OpenSSL 3.6, 3.5, 3.4, 3.3, 3.0 and 1.1.1 are vulnerable to this issue.<br><br>OpenSSL 1.0.2 is not affected by this issue."},"relatedVulnerabilities":[]},{"artifact":{"id":"14807b4f7067817d","cpes":["cpe:2.3:a:openssl:openssl:1.1.1q-r0:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:apk/busybox/openssl@1.1.1q-r0?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"1.1.1q-r0","language":"","licenses":["OpenSSL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/openssl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"openssl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-69418","versionConstraint":">= 1.1.1, < 1.1.1ze||>= 3.0.0, < 3.0.19||>= 3.3.0, < 3.3.6||>= 3.4.0, < 3.4.4||>= 3.5.0, < 3.5.5||>= 3.6.0, < 3.6.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:openssl:openssl:1.1.1q:*:*:*:*:*:*:*"],"package":{"name":"openssl","version":"1.1.1q-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2025-69418","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":4,"impactScore":2.6,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-69418","cwe":"CWE-325","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2025-69418","date":"2026-10-08","epss":0.00129,"percentile":0.02225}],"risk":0.05805,"urls":["https://github.com/openssl/openssl/commit/372fc5c77529695b05b4f5b5187691a57ef5dffc","https://github.com/openssl/openssl/commit/4016975d4469cd6b94927c607f7c511385f928d8","https://github.com/openssl/openssl/commit/52d23c86a54adab5ee9f80e48b242b52c4cc2347","https://github.com/openssl/openssl/commit/a7589230356d908c0eca4b969ec4f62106f4f5ae","https://github.com/openssl/openssl/commit/ed40856d7d4ba6cb42779b6770666a65f19cb977","https://openssl-library.org/news/secadv/20260127.txt","https://cert-portal.siemens.com/productcert/html/ssa-265688.html"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-69418","description":"Issue summary: When using the low-level OCB API directly with AES-NI or<br>other hardware-accelerated code paths, inputs whose length is not a multiple<br>of 16 bytes can leave the final partial block unencrypted and unauthenticated.<br><br>Impact summary: The trailing 1-15 bytes of a message may be exposed in<br>cleartext on encryption and are not covered by the authentication tag,<br>allowing an attacker to read or tamper with those bytes without detection.<br><br>The low-level OCB encrypt and decrypt routines in the hardware-accelerated<br>stream path process full 16-byte blocks but do not advance the input/output<br>pointers. The subsequent tail-handling code then operates on the original<br>base pointers, effectively reprocessing the beginning of the buffer while<br>leaving the actual trailing bytes unprocessed. The authentication checksum<br>also excludes the true tail bytes.<br><br>However, typical OpenSSL consumers using EVP are not affected because the<br>higher-level EVP and provider OCB implementations split inputs so that full<br>blocks and trailing partial blocks are processed in separate calls, avoiding<br>the problematic code path. Additionally, TLS does not use OCB ciphersuites.<br>The vulnerability only affects applications that call the low-level<br>CRYPTO_ocb128_encrypt() or CRYPTO_ocb128_decrypt() functions directly with<br>non-block-aligned lengths in a single call on hardware-accelerated builds.<br>For these reasons the issue was assessed as Low severity.<br><br>The FIPS modules in 3.6, 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected<br>by this issue, as OCB mode is not a FIPS-approved algorithm.<br><br>OpenSSL 3.6, 3.5, 3.4, 3.3, 3.0 and 1.1.1 are vulnerable to this issue.<br><br>OpenSSL 1.0.2 is not affected by this issue."},"relatedVulnerabilities":[]},{"artifact":{"id":"90f72c5b07fcdbc9","cpes":["cpe:2.3:a:busybox:busybox:1.32.1-r9:*:*:*:*:*:*:*"],"name":"busybox","purl":"pkg:apk/busybox/busybox@1.32.1-r9?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"1.32.1-r9","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/bin"},{"path":"/bin/busybox"},{"path":"/bin/sh"},{"path":"/etc"},{"path":"/etc/securetty"},{"path":"/etc/udhcpd.conf"},{"path":"/etc/logrotate.d"},{"path":"/etc/logrotate.d/acpid"},{"path":"/etc/network"},{"path":"/etc/network/if-down.d"},{"path":"/etc/network/if-post-down.d"},{"path":"/etc/network/if-post-up.d"},{"path":"/etc/network/if-pre-down.d"},{"path":"/etc/network/if-pre-up.d"},{"path":"/etc/network/if-up.d"},{"path":"/etc/network/if-up.d/dad"},{"path":"/sbin"},{"path":"/tmp"},{"path":"/usr"},{"path":"/usr/sbin"},{"path":"/usr/share"},{"path":"/usr/share/udhcpc"},{"path":"/usr/share/udhcpc/default.script"},{"path":"/var"},{"path":"/var/cache"},{"path":"/var/cache/misc"},{"path":"/var/lib"},{"path":"/var/lib/udhcpd"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"busybox"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:busybox:busybox:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-46394","versionConstraint":"<= 1.37.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:busybox:busybox:1.32.1:*:*:*:*:*:*:*"],"package":{"name":"busybox","version":"1.32.1-r9"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2025-46394","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N","metrics":{"baseScore":3.2,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-46394","cwe":"CWE-451","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2025-46394","date":"2026-10-08","epss":0.00183,"percentile":0.07182}],"risk":0.0571875,"urls":["https://bugs.busybox.net/show_bug.cgi?id=16018","https://www.busybox.net","https://www.busybox.net/downloads/","http://www.openwall.com/lists/oss-security/2025/04/23/5","http://www.openwall.com/lists/oss-security/2025/04/24/3","https://cert-portal.siemens.com/productcert/html/ssa-253495.html"],"severity":"Low","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-46394","description":"In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences."},"relatedVulnerabilities":[]},{"artifact":{"id":"35fec91b9e067f61","cpes":["cpe:2.3:a:ssl-client:ssl-client:1.32.1-r9:*:*:*:*:*:*:*","cpe:2.3:a:ssl-client:ssl_client:1.32.1-r9:*:*:*:*:*:*:*","cpe:2.3:a:ssl_client:ssl-client:1.32.1-r9:*:*:*:*:*:*:*","cpe:2.3:a:ssl_client:ssl_client:1.32.1-r9:*:*:*:*:*:*:*","cpe:2.3:a:ssl:ssl-client:1.32.1-r9:*:*:*:*:*:*:*","cpe:2.3:a:ssl:ssl_client:1.32.1-r9:*:*:*:*:*:*:*"],"name":"ssl_client","purl":"pkg:apk/busybox/ssl_client@1.32.1-r9?arch=x86_64&distro=busybox-1.32.1&upstream=busybox","type":"apk","version":"1.32.1-r9","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/ssl_client"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"busybox"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:busybox:busybox:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-46394","versionConstraint":"<= 1.37.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:busybox:busybox:1.32.1:*:*:*:*:*:*:*"],"package":{"name":"busybox","version":"1.32.1-r9"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2025-46394","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N","metrics":{"baseScore":3.2,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-46394","cwe":"CWE-451","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2025-46394","date":"2026-10-08","epss":0.00183,"percentile":0.07182}],"risk":0.0571875,"urls":["https://bugs.busybox.net/show_bug.cgi?id=16018","https://www.busybox.net","https://www.busybox.net/downloads/","http://www.openwall.com/lists/oss-security/2025/04/23/5","http://www.openwall.com/lists/oss-security/2025/04/24/3","https://cert-portal.siemens.com/productcert/html/ssa-253495.html"],"severity":"Low","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-46394","description":"In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences."},"relatedVulnerabilities":[]},{"artifact":{"id":"90f72c5b07fcdbc9","cpes":["cpe:2.3:a:busybox:busybox:1.32.1-r9:*:*:*:*:*:*:*"],"name":"busybox","purl":"pkg:apk/busybox/busybox@1.32.1-r9?arch=x86_64&distro=busybox-1.32.1","type":"apk","version":"1.32.1-r9","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/bin"},{"path":"/bin/busybox"},{"path":"/bin/sh"},{"path":"/etc"},{"path":"/etc/securetty"},{"path":"/etc/udhcpd.conf"},{"path":"/etc/logrotate.d"},{"path":"/etc/logrotate.d/acpid"},{"path":"/etc/network"},{"path":"/etc/network/if-down.d"},{"path":"/etc/network/if-post-down.d"},{"path":"/etc/network/if-post-up.d"},{"path":"/etc/network/if-pre-down.d"},{"path":"/etc/network/if-pre-up.d"},{"path":"/etc/network/if-up.d"},{"path":"/etc/network/if-up.d/dad"},{"path":"/sbin"},{"path":"/tmp"},{"path":"/usr"},{"path":"/usr/sbin"},{"path":"/usr/share"},{"path":"/usr/share/udhcpc"},{"path":"/usr/share/udhcpc/default.script"},{"path":"/var"},{"path":"/var/cache"},{"path":"/var/cache/misc"},{"path":"/var/lib"},{"path":"/var/lib/udhcpd"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"busybox"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:busybox:busybox:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2024-58251","versionConstraint":"<= 1.37.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:busybox:busybox:1.32.1:*:*:*:*:*:*:*"],"package":{"name":"busybox","version":"1.32.1-r9"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2024-58251","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.5,"impactScore":1.5,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-58251","cwe":"CWE-150","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2024-58251","date":"2026-10-08","epss":0.00178,"percentile":0.06734}],"risk":0.04895,"urls":["https://bugs.busybox.net/show_bug.cgi?id=15922","https://www.busybox.net","https://www.busybox.net/downloads/","http://www.openwall.com/lists/oss-security/2025/04/23/6"],"severity":"Low","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-58251","description":"In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim."},"relatedVulnerabilities":[]},{"artifact":{"id":"35fec91b9e067f61","cpes":["cpe:2.3:a:ssl-client:ssl-client:1.32.1-r9:*:*:*:*:*:*:*","cpe:2.3:a:ssl-client:ssl_client:1.32.1-r9:*:*:*:*:*:*:*","cpe:2.3:a:ssl_client:ssl-client:1.32.1-r9:*:*:*:*:*:*:*","cpe:2.3:a:ssl_client:ssl_client:1.32.1-r9:*:*:*:*:*:*:*","cpe:2.3:a:ssl:ssl-client:1.32.1-r9:*:*:*:*:*:*:*","cpe:2.3:a:ssl:ssl_client:1.32.1-r9:*:*:*:*:*:*:*"],"name":"ssl_client","purl":"pkg:apk/busybox/ssl_client@1.32.1-r9?arch=x86_64&distro=busybox-1.32.1&upstream=busybox","type":"apk","version":"1.32.1-r9","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/ssl_client"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:053ad5b6ecb679daebeaeaedcaf30f3429ce11e2df1f9265c6883badff8be492","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"busybox"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:busybox:busybox:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2024-58251","versionConstraint":"<= 1.37.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:busybox:busybox:1.32.1:*:*:*:*:*:*:*"],"package":{"name":"busybox","version":"1.32.1-r9"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2024-58251","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.5,"impactScore":1.5,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-58251","cwe":"CWE-150","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2024-58251","date":"2026-10-08","epss":0.00178,"percentile":0.06734}],"risk":0.04895,"urls":["https://bugs.busybox.net/show_bug.cgi?id=15922","https://www.busybox.net","https://www.busybox.net/downloads/","http://www.openwall.com/lists/oss-security/2025/04/23/6"],"severity":"Low","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-58251","description":"In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim."},"relatedVulnerabilities":[]}],"grade":"F","score":"0.00","as_of":"2026-10-10T00:17:01.216Z","grype_db_version":"2026-10-09T06:32:32.000Z"}